@wildo-ai/saas-models 1.1.5 → 1.1.6

package/dist/esm/security/authentications/sso/sso-config.shared.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"sso-config.shared.schemas.js","sourceRoot":"","sources":["../../../../../../src/security/authentications/sso/sso-config.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AACvE,OAAO,EAAE,yBAAyB,EAAE,MAAM,wDAAwD,CAAC;AAEnG,MAAM,CAAC,MAAM,wBAAwB,GAAG;IACtC,OAAO,EAAE,SAAS;IAClB,QAAQ,EAAE,UAAU;IACpB,MAAM,EAAE,QAAQ;IAChB,OAAO,EAAE,SAAS;CACV,CAAC;AAEX,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IAEtD,gGAAgG;IAChG,+FAA+F;IAC/F,iGAAiG;IACjG,+FAA+F;IAC/F,gGAAgG;IAChG,6FAA6F;IAC7F,oFAAoF;IACpF,EAAE;IACF,iGAAiG;IACjG,6FAA6F;IAC7F,+FAA+F;IAC/F,aAAa;IACb,EAAE;IACF,mGAAmG;IACnG,oCAAoC;IACpC,EAAE;IACF,gGAAgG;IAChG,6FAA6F;IAC7F,2FAA2F;IAC3F,EAAE;IACF,gGAAgG;IAChG,gGAAgG;IAChG,4FAA4F;IAC5F,kGAAkG;IAClG,+FAA+F;IAC/F,kGAAkG;IAClG,8DAA8D;IAC9D,EAAE;IACF,2EAA2E;IAC3E,0GAA0G;IAC1G,kGAAkG;IAClG,6FAA6F;IAC7F,iCAAiC;IACjC,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC;QACpB,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,cAAc,EAAE;QACvD,qBAAqB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;QAChD,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;KACzD,CAAC,CAAC,cAAc,EAAE,CAAC,eAAe,EAAE;IAErC,oFAAoF;IACpF,kGAAkG;IAClG,8FAA8F;IAC9F,6FAA6F;IAC7F,iGAAiG;IACjG,yFAAyF;IACzF,EAAE;IACF,+FAA+F;IAC/F,qDAAqD;IACrD,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC;QAChB;;;;;;;;;;;;;;;;WAgBG;QACH,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,eAAe,EAAE;QAClE,iBAAiB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,eAAe,EAAE;QACpE;;;;;;;;;;;;;WAaG;QACH;;;;;;;;;;;;WAYG;QACH,wBAAwB,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,eAAe,EAAE;QAC9G;;;;;;;WAOG;QACH,wBAAwB,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,aAAa,EAAE;KACvF,CAAC;IAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAoCG;IAEH;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,eAAe,EAAE,CAAC,CAAC,MAAM,CAAC;QACxB,mBAAmB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;KAC/C,CAAC,CAAC,eAAe,EAAE;IAEpB;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IAEH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAmCG;IACH,eAAe,EAAE,CAAC,CAAC,MAAM,CAAC;QACxB,kGAAkG;QAClG,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;QAClC;;;;;;;WAOG;QACH,kBAAkB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;KACnD,CAAC,CAAC,eAAe,EAAE;IAEpB,0BAA0B,EAAE,CAAC,CAAC,MAAM,CAAC;QACnC,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;QACjD,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;QACjD,wBAAwB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;KACrD,CAAC,CAAC,eAAe,EAAE;IAEpB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAgCG;IACH,yBAAyB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;QAC1C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC9B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC3B,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,iBAAiB,EAAE;QACnD,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,aAAa,EAAE;QACrD,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,aAAa,EAAE;KACvD,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,MAAM,CACpB,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,KAAK,GAAG,CAAC,MAAM,EACjE,EAAE,OAAO,EAAE,oDAAoD,EAAE,CAClE;IAED,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IACrF,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;CACtF,CAAC,CAAC;AAIH;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,UAAU,sBAAsB,CAAC,OAG1B;IACX,MAAM,MAAM,GAAG,OAAO,EAAE,wBAAwB,IAAI,EAAE,CAAC;IACvD,OAAO,CAAC,OAAO,EAAE,eAAe,IAAI,EAAE,CAAC,CAAC,MAAM,CAC5C,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,wBAAwB,CAAC,QAAQ,CAC/D,CAAC;AACJ,CAAC;AAED,gGAAgG;AAChG,MAAM,UAAU,gBAAgB,CAC9B,OAGa,EACb,MAAc;IAEd,OAAO,CAAC,OAAO,EAAE,eAAe,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;WACnD,OAAO,EAAE,wBAAwB,EAAE,CAAC,MAAM,CAAC,KAAK,wBAAwB,CAAC,QAAQ,CAAC;AACzF,CAAC;AAED,MAAM,CAAC,MAAM,+BAA+B,GAAG,yBAAyB,CAAC;IACvE,gBAAgB,EAAE,WAAW;IAC7B,mBAAmB,EAAE,aAAa;IAClC,WAAW,EAAE,YAAY;IACzB,UAAU,EAAE,mBAAmB;IAC/B,QAAQ,EAAE,mBAAmB;CAC9B,CAAC,CAAC","sourcesContent":["/**\n * SSO Config Schema (Shared) — Polymorphic\n *\n * SSO enforcement, domain verification, provider restrictions, provisioning,\n * session settings, emergency access. Policy/settings layer only —\n * provider connections are a separate resource (SsoConnection).\n * Scope FK (organizationId / applicationId) is injected by the polymorphism engine.\n *\n * @see auth-data-model-audit.md §2A\n */\n\nimport { z } from 'zod';\nimport { AUTH_SCOPE_VARIANTS } from '../authentication.shared.schemas';\nimport { declarePolymorphicSchemas } from '../../../resources/utils/resource-polymorphism.schemas';\n\nexport const DomainVerificationStatus = {\n  PENDING: 'pending',\n  VERIFIED: 'verified',\n  FAILED: 'failed',\n  EXPIRED: 'expired',\n} as const;\n\nexport const SsoConfigBaseSchema = z.object({\n  _id: z.string().min(1).isPrimaryKey().isSummaryField(),\n\n  // ── `.isAuditEvidence()` on the authentication-authority blocks ──────────────────────────────\n  // Every block below decides WHO may authenticate into this tenant and with what standing, so a\n  // change to one is an authorization change even though no role is named: weakening `requireSSO`,\n  // re-enabling `allowPasswordFallback`, granting a `defaultRole` on auto-provision, or adding a\n  // break-glass account each widen access tenant-wide. The generic resource-operation audit event\n  // records the changed field NAMES for free; the marker is what makes the before/after VALUES\n  // survive, and without values \"someone changed the SSO enforcement\" proves nothing.\n  //\n  // These are configuration flags, domains and role names — NOT personal data — so recording their\n  // values does not conflict with the Art. 5(1)(c) / Art. 17 minimisation reasoning that keeps\n  // user-identifying fields unmarked (audit rows replicate to an immutable ledger that cannot be\n  // scrubbed).\n  //\n  // assurance-control: WILDO.IDENTITY.SESSION_ASSURANCE — SSO enforcement decides how principals are\n  // permitted to authenticate at all.\n  //\n  // `enforceForAdmins` was REMOVED here (#481). It said \"this tenant's SSO requirement also binds\n  // its administrators\", defaulted `true`, and was read by nothing — so an operator who set it\n  // `false` believed their administrators had a way in when the IdP broke, and they did not.\n  //\n  // It was not reimplemented, because a ROLE is the wrong unit for an authentication bypass. Role\n  // membership changes, and a standing exemption for \"whoever is an admin\" means compromising one\n  // administrator and promoting an account silently grants an SSO bypass to the promoted one.\n  // Microsoft Entra's emergency-access guidance is explicit about the alternative — exclude a small\n  // NAMED set through a dedicated group, never a role — and that is what `emergencyAccess` below\n  // now does. Google Workspace does take the role-shaped route for its super administrators; it was\n  // considered and rejected here for the escalation path above.\n  //\n  // spec-cite: Microsoft Entra ID — \"Manage emergency access admin accounts\"\n  // (https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/security-emergency-access),\n  // \"Conditional Access considerations\": create a dedicated security group for the emergency access\n  // accounts and exclude THAT from policies. The reading that a role is the wrong unit is this\n  // repository's, not a quotation.\n  enforcement: z.object({\n    requireSSO: z.boolean().default(false).isSummaryField(),\n    allowPasswordFallback: z.boolean().default(true),\n    graceLoginAttempts: z.number().min(0).max(10).default(3),\n  }).isSummaryField().isAuditEvidence(),\n\n  // NOT marked, deliberately: this block carries `domainVerificationTokens`, which is\n  // `.isBackendOnly()` — a SECRET. `.isAuditEvidence()` on a parent object records the WHOLE object\n  // before/after, so marking `domains` would copy live verification tokens into audit rows that\n  // replicate to the immutable ledger and to every configured SIEM sink. The security-relevant\n  // sub-fields (`ssoEnabledDomains`, and `domainVerificationStatus` below) are marked individually\n  // instead, which keeps the secret out by construction rather than by reviewer vigilance.\n  //\n  // Read this before marking any other container: a block is safe to mark WHOLESALE only when no\n  // descendant is `.isBackendOnly()` or personal data.\n  domains: z.object({\n    /**\n     * Every domain this organization has CLAIMED — verified and unverified alike.\n     *\n     * ⚠️ The name asserts more than the field holds. `initiateDomainVerification` pushes a domain\n     * here at CLAIM time with `domainVerificationStatus[domain] = 'pending'`, so membership means\n     * \"somebody asked\", never \"we checked\". The real answer is the join with that map, and\n     * `resolveVerifiedDomains` below is the only place it should be computed (#457).\n     *\n     * **Do not read this array directly.** A reader that does gets pending, failed and expired\n     * domains under a name that says otherwise — which `AuthOrganizationConfigurationService\n     * .getDomains` did, returning them as `verified`, with no consumer to notice.\n     *\n     * The field was NOT renamed to `claimedDomains`, and that is a decision rather than an\n     * omission: it is persisted on every SSO config row of both dogfood applications, so the rename\n     * is a schema change plus a data migration for a field whose every reader now goes through the\n     * helper. The name is no longer what a new reader reaches.\n     */\n    verifiedDomains: z.array(z.string()).default([]).isAuditEvidence(),\n    ssoEnabledDomains: z.array(z.string()).default([]).isAuditEvidence(),\n    /*\n     * `domainHinting` and `allowExternalDomains` were REMOVED here, and both were read by nothing.\n     *\n     * `domainHinting` promised the sign-in form would route a person to their IdP from their email\n     * domain — a real and common feature, and one this engine implements from `ssoEnabledDomains`\n     * plus the verification map, never from this flag. Turning it off changed no routing.\n     *\n     * `allowExternalDomains` carried `.isAuditEvidence()` and read as an admission control on who\n     * may join through SSO. Nothing consulted it, so an operator who left it `false` — the default —\n     * believed they had closed a door that was never fitted. What actually restricts admission is\n     * the connection's `allowedDomains`, and on the SCIM lane the verified-domain projection.\n     *\n     * Absence is pinned in `authentication-knobs-have-readers.test.ts`.\n     */\n    /**\n     * The half of the join that decides routing authority — and therefore the audit evidence.\n     *\n     * Marked individually rather than through the containing `domains` block, for the reason that\n     * block's own comment gives: a whole-object mark would copy `domainVerificationTokens` into the\n     * immutable ledger. This map holds domain names and one of four statuses — no secret, no\n     * personal data — and it is the only field that answers the question an auditor asks about a\n     * domain workflow: WHICH domain became verified, and when did it stop being verified.\n     *\n     * Without it the trail records `domains` as a changed field name and nothing more, which cannot\n     * distinguish \"a tenant claimed a domain\" from \"a tenant gained SSO routing control over every\n     * address at it\".\n     */\n    domainVerificationStatus: z.record(z.string(), z.enum(DomainVerificationStatus)).default({}).isAuditEvidence(),\n    /**\n     * The DNS-TXT challenge nonce per claimed domain. `.isBackendOnly()` — never leaves the backend\n     * through a resource READ, and never enters the audit trail (see the block comment above).\n     *\n     * The one place its value is disclosed is the response to `claimDomain`, which returns it once\n     * as an `.isEphemeral()` field, because the operator cannot publish a record they cannot see.\n     * A lost token is recovered by claiming again, which mints a new one — there is no re-read.\n     */\n    domainVerificationTokens: z.record(z.string(), z.string()).default({}).isBackendOnly(),\n  }),\n\n  /*\n   * `provisioning` was REMOVED here, and the reason is that it decided NOTHING.\n   *\n   * It declared six fields — `autoCreateUsers`, `autoUpdateUsers`, `autoDeactivateUsers`,\n   * `defaultRole`, `requiredAttributes`, `syncFrequencyHours` — carried `.isAuditEvidence()`, was\n   * written by the default seed, was rendered as a section of the SSO settings pane, and had ZERO\n   * production readers. An administrator set \"create users automatically\" there and nothing\n   * anywhere consulted it.\n   *\n   * ## What actually decides, and why there are two of them rather than three\n   *\n   * Just-in-time provisioning on an INTERACTIVE sign-in reads the CONNECTION, not this row:\n   * `SsoConnectionSchema.{autoCreateUsers, autoVerifyEmail, defaultRole, roleMapping, groupMapping}`,\n   * assembled once per connection by `oauth2-connection-resolver` and `saml-authentication` and\n   * carried into `provisionEnterpriseUser`. Per connection is the right grain — two IdPs bound to\n   * one tenant may legitimately differ.\n   *\n   * A DIRECTORY PUSH reads `ScimProvisioningConfigBaseSchema`, resolved by\n   * `scim.backend.controller._getProvisioningConfig`. Per organization is the right grain — there\n   * is one directory relationship.\n   *\n   * Those two are NOT duplicates of each other. They are different planes (a person signing in\n   * versus a directory pushing), on different code paths, and an organization can run either\n   * without the other. This block was the duplicate: a third grain, org-wide and inert, whose own\n   * documentation described it as \"SSO JIT provisioning\" — the one thing it did not do.\n   *\n   * ## What is NOT lost\n   *\n   * `autoCreateUsers` / `defaultRole` exist per connection; `autoDeactivateUsers` exists on the SCIM\n   * config. `autoUpdateUsers`, `requiredAttributes` and `syncFrequencyHours` existed ONLY here and\n   * were never implemented anywhere — removing them removes an advertised capability that was never\n   * present, which is the honest state. Wanting any of them back is a feature with a design, not a\n   * field to re-add. `syncFrequencyHours` in particular was already removed once for exactly this\n   * reason on the org-TYPE side (#1224); this is its twin.\n   *\n   * Absence is pinned in `authentication-knobs-have-readers.test.ts`.\n   */\n\n  /**\n   * Federated logout, and the ONLY thing this block still decides.\n   *\n   * `saml-metadata.backend.service` reads it as `spConfig.singleLogoutEnabled` and advertises — or\n   * withholds — the SP's SLO endpoint in the published metadata; `saml-authentication` honours the\n   * opt-out in both directions, terminating the local session on an SP-initiated logout and\n   * answering an IdP-initiated one with a graceful no-op LogoutResponse.\n   *\n   * ## Its three former neighbours were removed, and none of them was implemented\n   *\n   * - `requireReauthForSensitive` — nothing anywhere asks a session to re-authenticate for a\n   *   \"sensitive\" operation, and nothing classified one. Step-up authentication is a real mechanism\n   *   in this engine and it is not reached from here.\n   * - `ssoSessionDurationMinutes` — the ONLY mention outside the seed was a comment in\n   *   `saml-authentication` asserting the app session \"expires on its own `ssoSessionDurationMinutes`\".\n   *   It does not: session lifetime comes from the token issuer's own configuration. A comment is\n   *   not an implementation, and one that names a field makes the field look wired.\n   * - `maxConcurrentSessions` — a SECOND source of truth for a setting that already has a live one.\n   *   `userTypes.<type>.auth.maxConcurrentSessions` is what the token issuer enforces (pinned in\n   *   `auth-token-issuer.rotation-concurrency.redis.test.ts`); the copy here was read by nothing, so\n   *   an operator could set two different limits and neither the lower nor the later would win.\n   */\n  sessionSettings: z.object({\n    singleLogoutEnabled: z.boolean().default(true),\n  }).isAuditEvidence(),\n\n  /*\n   * `auditConfig` was REMOVED here — all five fields, and the assurance marker that stood over them.\n   *\n   * It declared `logAllSSOEvents`, `logProviderSwitching`, `logRoleMapping`, `complianceReporting`\n   * and `retentionDays`, and carried\n   * `assurance-control: WILDO.AUDIT.EVIDENCE_INTEGRITY — this block governs the audit trail itself`.\n   * Its own comment argued the marker: \"disabling `logAllSSOEvents` or shortening `retentionDays` is\n   * the classic pre-incident tampering move, and it must not be the one change the trail cannot\n   * evidence.\"\n   *\n   * Every word of that is a good argument about a block that governed NOTHING. Zero production\n   * readers: the declaration, the default seed, a specification example and the display template\n   * were the complete set of mentions. No SSO event consults `logAllSSOEvents` before emitting, and\n   * no retention job consults `retentionDays` — which made the marker the worse half of the defect,\n   * because a control marker is a CLAIM, and `compliance-is-derived-from-the-product.md` names a\n   * marker whose truth nothing checks as the thing to remove rather than the thing to keep.\n   *\n   * Audit-trail behaviour is not configurable per SSO policy and was never meant to be: emission is\n   * decided by the operation's own risk level against `AUTOMATIC_AUDIT_RISK_FLOOR`, and RETENTION by\n   * `ApplicationRetentionSchedule` over `DataRetentionClass` — application-level, derived, and total\n   * over that vocabulary. `retentionDays` here was a second, inert answer to a question already\n   * answered there.\n   *\n   * Absence is pinned in `authentication-knobs-have-readers.test.ts`.\n   */\n\n  /**\n   * Break-glass: the named accounts that may still sign in with a password when the identity\n   * provider cannot be reached.\n   *\n   * Every field here is READ at runtime. It carried three more — `requireApproval`,\n   * `maxDurationHours` and `auditLevel` — and all three were removed with `enforceForAdmins` (#481,\n   * #423) rather than implemented, for reasons worth keeping:\n   *\n   * - **`requireApproval` cannot exist on this path.** Break-glass is the door for the case where\n   *   nobody can act; an approval step means the approver may be locked out too, which is the\n   *   deadlock the door exists to break. Entra's guidance asks for monitoring and a post-mortem\n   *   after each use, never for prior approval.\n   * - **`maxDurationHours`** describes a bounded break-glass SESSION, which is a real control and\n   *   is not built. A field that names a control nobody enforces is exactly what this issue was\n   *   about, so it is absent until the session cap exists.\n   * - **`auditLevel`** could not change anything: `EMERGENCY_ACCESS_USED` is CRITICAL in\n   *   `SECURITY_AUDIT_EVENT_ENVELOPE`, and a per-tenant knob that lowers the severity of a\n   *   privileged-access record is not a setting a tenant should have.\n   *\n   * ## What a listed account gets, and what it does not\n   *\n   * A listed account is exempt from the SSO enforcement refusal — including grace exhaustion — and\n   * nothing else. It authenticates with the same password, against the same lockout counters and\n   * the same rate limits, and every use emits `EMERGENCY_ACCESS_USED` at CRITICAL.\n   *\n   * ## Why the whole TENANT keeps a password field when this list is non-empty\n   *\n   * The sign-in surface must not depend on the account, or the offered methods become an oracle for\n   * \"is this address a break-glass account\". So `requiresEnterpriseSsoOnly` answers false for the\n   * whole tenant while this list is non-empty: everyone at the domain sees a password field, and\n   * everyone not on the list is refused AFTER presenting a correct credential. The cost is a\n   * password field that only two accounts can use; the alternative discloses who they are.\n   *\n   * assurance-control: WILDO.IDENTITY.SESSION_ASSURANCE — the authenticated bypass of this tenant's\n   * own authentication requirement.\n   */\n  emergencyAccess: z.object({\n    /** Off switch. `true` with an empty list grants nothing — the list is what confers the bypass. */\n    enabled: z.boolean().default(true),\n    /**\n     * The email addresses that may bypass SSO enforcement. An authority LIST: adding an entry grants\n     * a standing password path into a tenant that has otherwise required SSO.\n     *\n     * Keep it SMALL and keep it reviewed. Entra asks for at least two (redundancy), credentials\n     * stored apart from any individual, and a validation drill every 90 days; none of that is\n     * enforceable from here, and all of it is what makes this list safe to have.\n     */\n    breakGlassAccounts: z.array(z.email()).default([]),\n  }).isAuditEvidence(),\n\n  oauth2ProviderRestrictions: z.object({\n    allowedProviders: z.array(z.string()).default([]),\n    blockedProviders: z.array(z.string()).default([]),\n    requireEnterpriseSSOOnly: z.boolean().default(false),\n  }).isAuditEvidence(),\n\n  /**\n   * Per-scope social provider credential overrides (P3).\n   *\n   * By default, social providers (Google, GitHub, Apple, etc.) use platform-level\n   * OAuth2 credentials from AppConfiguration. This array lets an org/app override\n   * those with their own registered OAuth2 app at the identity provider.\n   *\n   * Only `clientId` + `clientSecret` are needed for most providers — the OAuth2\n   * endpoints, scopes, and profile mapping still come from the provider catalog.\n   *\n   * `signedJwtKeyId` / `signedJwtTeamId` are required only for providers that use\n   * signed-JWT client secrets (e.g. Apple Sign-In, where the \"client secret\" is a\n   * short-lived JWT signed with a private key). These correspond to the Apple\n   * Developer Team ID and Key ID that are bound to the private key.\n   * When omitted, the app-level values from the secrets store are used.\n   *\n   * Secret handling (two distinct contracts, on purpose):\n   * - `clientSecret` is `.isWriteOnlySecret()` — the operator sets/rotates it, so it\n   *   stays writable AND stays in the response DTO where the framework redacts it to\n   *   `••••••••` at the client boundary. Internal reads (`resolveSocialConnection`\n   *   via `readAsSystem`) keep the real value.\n   * - `signedJwtKeyId` / `signedJwtTeamId` are `.isBackendOnly()` — never sent to the\n   *   frontend at all (stripped from every client DTO).\n   *\n   * Because these secrets live inside an ARRAY, neither the central write-only-secret\n   * sentinel-strip NOR a whole-array `$set` preserves them on save: the repository\n   * replaces the entire array with no deep merge. The UPDATE custom-impl therefore\n   * matches each incoming override to the stored record by `providerRef` and\n   * re-injects any secret that arrived absent or as the `••••••••` mask.\n   *\n   * @see oauth2-connection-resolver — resolveSocialConnection() steps 5b/5c\n   * @see sso-config.custom-impl — prefixCoreOperations UPDATE handler\n   */\n  socialCredentialOverrides: z.array(z.object({\n    providerRef: z.string().min(1),\n    clientId: z.string().min(1),\n    clientSecret: z.string().min(1).isWriteOnlySecret(),\n    signedJwtKeyId: z.string().optional().isBackendOnly(),\n    signedJwtTeamId: z.string().optional().isBackendOnly(),\n  })).default([]).refine(\n    (arr) => new Set(arr.map(o => o.providerRef)).size === arr.length,\n    { message: 'Duplicate providerRef in socialCredentialOverrides' },\n  ),\n\n  createdAt: z.date().default(() => new Date()).excludeFromCreate().excludeFromUpdate(),\n  updatedAt: z.date().default(() => new Date()).excludeFromCreate().excludeFromUpdate(),\n});\n\nexport type SsoConfigBase = z.infer<typeof SsoConfigBaseSchema>;\n\n/**\n * The domains this organization has actually VERIFIED — the join `verifiedDomains` does not carry.\n *\n * ## Why this exists rather than five correct joins\n *\n * The stored list holds CLAIMED domains, so safety depends on every reader filtering it by\n * `domainVerificationStatus`. Measured 2026-09-08, **five** reader sites did that by hand — the SCIM\n * controller, the SCIM virtual field, the domain-verification service, and the domain-to-org lookup\n * TWICE — and a sixth, `getDomains`, did not. It returned the raw list under the name `verified`.\n *\n * That is `.claude/rules/invariant-call-site-enumeration.md`'s exact shape: an invariant hand-applied\n * at N sites, where the next site is the one that forgets. It had already happened; it was harmless\n * only because that reader had no consumer — and claiming a domain is now reachable by tenants\n * through `SsoConfig_Operations.CLAIM_DOMAIN` (#424), so the margin that made it harmless is gone.\n *\n * So the join is computed ONCE, here, beside the field it corrects. A new reader that reaches for\n * the verified set finds this; one that reaches for the raw array finds the warning on the field.\n *\n * Takes the shape structurally rather than `SsoConfigBase` so a caller holding a partial config, a\n * DTO or a lean document can use it — the three existing shapes at the call sites — without the\n * helper forcing a cast at every one of them.\n */\nexport function resolveVerifiedDomains(domains: {\n  readonly verifiedDomains?: readonly string[];\n  readonly domainVerificationStatus?: Readonly<Record<string, string>>;\n} | undefined): string[] {\n  const status = domains?.domainVerificationStatus ?? {};\n  return (domains?.verifiedDomains ?? []).filter(\n    domain => status[domain] === DomainVerificationStatus.VERIFIED,\n  );\n}\n\n/** Whether ONE domain is verified for this organization. The single-domain form of the join. */\nexport function isDomainVerified(\n  domains: {\n    readonly verifiedDomains?: readonly string[];\n    readonly domainVerificationStatus?: Readonly<Record<string, string>>;\n  } | undefined,\n  domain: string,\n): boolean {\n  return (domains?.verifiedDomains ?? []).includes(domain)\n    && domains?.domainVerificationStatus?.[domain] === DomainVerificationStatus.VERIFIED;\n}\n\nexport const ssoConfigPolymorphicDeclaration = declarePolymorphicSchemas({\n  baseResourceType: 'ssoConfig',\n  baseFieldIdentifier: 'ssoConfigId',\n  baseEnumKey: 'SSO_CONFIG',\n  baseSchema: SsoConfigBaseSchema,\n  variants: AUTH_SCOPE_VARIANTS,\n});\n"]}
+{"version":3,"file":"sso-config.shared.schemas.js","sourceRoot":"","sources":["../../../../../../src/security/authentications/sso/sso-config.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AACvE,OAAO,EAAE,yBAAyB,EAAE,MAAM,wDAAwD,CAAC;AAEnG,MAAM,CAAC,MAAM,wBAAwB,GAAG;IACtC,OAAO,EAAE,SAAS;IAClB,QAAQ,EAAE,UAAU;IACpB,MAAM,EAAE,QAAQ;IAChB,OAAO,EAAE,SAAS;CACV,CAAC;AAEX,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IAEtD,gGAAgG;IAChG,+FAA+F;IAC/F,iGAAiG;IACjG,+FAA+F;IAC/F,gGAAgG;IAChG,6FAA6F;IAC7F,oFAAoF;IACpF,EAAE;IACF,iGAAiG;IACjG,6FAA6F;IAC7F,+FAA+F;IAC/F,aAAa;IACb,EAAE;IACF,mGAAmG;IACnG,oCAAoC;IACpC,EAAE;IACF,gGAAgG;IAChG,6FAA6F;IAC7F,2FAA2F;IAC3F,EAAE;IACF,gGAAgG;IAChG,gGAAgG;IAChG,4FAA4F;IAC5F,kGAAkG;IAClG,+FAA+F;IAC/F,kGAAkG;IAClG,8DAA8D;IAC9D,EAAE;IACF,2EAA2E;IAC3E,0GAA0G;IAC1G,kGAAkG;IAClG,6FAA6F;IAC7F,iCAAiC;IACjC,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC;QACpB,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,cAAc,EAAE,CAAC,QAAQ,CAAC,wFAAwF,CAAC;QAC1J,qBAAqB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,wKAAwK,CAAC;QACnO,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,gHAAgH,CAAC;KACpL,CAAC,CAAC,cAAc,EAAE,CAAC,eAAe,EAAE,CAAC,QAAQ,CAAC,sDAAsD,CAAC;IAEtG,oFAAoF;IACpF,kGAAkG;IAClG,8FAA8F;IAC9F,6FAA6F;IAC7F,iGAAiG;IACjG,yFAAyF;IACzF,EAAE;IACF,+FAA+F;IAC/F,qDAAqD;IACrD,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC;QAChB;;;;;;;;;;;;;;;;WAgBG;QACH,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,eAAe,EAAE,CAAC,QAAQ,CAAC,gJAAgJ,CAAC;QAC7N,iBAAiB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,eAAe,EAAE,CAAC,QAAQ,CAAC,6FAA6F,CAAC;QAC5K;;;;;;;;;;;;;WAaG;QACH;;;;;;;;;;;;WAYG;QACH,wBAAwB,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,eAAe,EAAE,CAAC,QAAQ,CAAC,kEAAkE,CAAC;QAC3L;;;;;;;WAOG;QACH,wBAAwB,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,aAAa,EAAE;aACnF,QAAQ,CAAC,2OAA2O,CAAC;KACzP,CAAC,CAAC,QAAQ,CAAC,4NAA4N,CAAC;IAEzO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAoCG;IAEH;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,eAAe,EAAE,CAAC,CAAC,MAAM,CAAC;QACxB,mBAAmB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,0KAA0K,CAAC;KACpO,CAAC,CAAC,eAAe,EAAE,CAAC,QAAQ,CAAC,uCAAuC,CAAC;IAEtE;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IAEH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAmCG;IACH,eAAe,EAAE,CAAC,CAAC,MAAM,CAAC;QACxB,kGAAkG;QAClG,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,mGAAmG,CAAC;QAChJ;;;;;;;WAOG;QACH,kBAAkB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,0QAA0Q,CAAC;KACxU,CAAC,CAAC,eAAe,EAAE,CAAC,QAAQ,CAAC,8DAA8D,CAAC;IAE7F,0BAA0B,EAAE,CAAC,CAAC,MAAM,CAAC;QACnC,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,oEAAoE,CAAC;QAChI,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,kFAAkF,CAAC;QAC9I,wBAAwB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,2FAA2F,CAAC;KAC3J,CAAC,CAAC,eAAe,EAAE,CAAC,QAAQ,CAAC,yFAAyF,CAAC;IAExH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAgCG;IACH,yBAAyB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;QAC1C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,+EAA+E,CAAC;QACxH,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,mEAAmE,CAAC;QACzG,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,iBAAiB,EAAE,CAAC,QAAQ,CAAC,mHAAmH,CAAC;QACjL,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,aAAa,EAAE;aAClD,QAAQ,CAAC,gPAAgP,CAAC;QAC7P,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,aAAa,EAAE;aACnD,QAAQ,CAAC,wPAAwP,CAAC;KACtQ,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,MAAM,CACpB,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,KAAK,GAAG,CAAC,MAAM,EACjE,EAAE,OAAO,EAAE,oDAAoD,EAAE,CAClE,CAAC,QAAQ,CAAC,+JAA+J,CAAC;IAE3K,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IACrF,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;CACtF,CAAC,CAAC;AAIH;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,UAAU,sBAAsB,CAAC,OAG1B;IACX,MAAM,MAAM,GAAG,OAAO,EAAE,wBAAwB,IAAI,EAAE,CAAC;IACvD,OAAO,CAAC,OAAO,EAAE,eAAe,IAAI,EAAE,CAAC,CAAC,MAAM,CAC5C,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,wBAAwB,CAAC,QAAQ,CAC/D,CAAC;AACJ,CAAC;AAED,gGAAgG;AAChG,MAAM,UAAU,gBAAgB,CAC9B,OAGa,EACb,MAAc;IAEd,OAAO,CAAC,OAAO,EAAE,eAAe,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;WACnD,OAAO,EAAE,wBAAwB,EAAE,CAAC,MAAM,CAAC,KAAK,wBAAwB,CAAC,QAAQ,CAAC;AACzF,CAAC;AAED,MAAM,CAAC,MAAM,+BAA+B,GAAG,yBAAyB,CAAC;IACvE,gBAAgB,EAAE,WAAW;IAC7B,mBAAmB,EAAE,aAAa;IAClC,WAAW,EAAE,YAAY;IACzB,UAAU,EAAE,mBAAmB;IAC/B,QAAQ,EAAE,mBAAmB;CAC9B,CAAC,CAAC","sourcesContent":["/**\n * SSO Config Schema (Shared) — Polymorphic\n *\n * SSO enforcement, domain verification, provider restrictions, provisioning,\n * session settings, emergency access. Policy/settings layer only —\n * provider connections are a separate resource (SsoConnection).\n * Scope FK (organizationId / applicationId) is injected by the polymorphism engine.\n *\n * @see auth-data-model-audit.md §2A\n */\n\nimport { z } from 'zod';\nimport { AUTH_SCOPE_VARIANTS } from '../authentication.shared.schemas';\nimport { declarePolymorphicSchemas } from '../../../resources/utils/resource-polymorphism.schemas';\n\nexport const DomainVerificationStatus = {\n  PENDING: 'pending',\n  VERIFIED: 'verified',\n  FAILED: 'failed',\n  EXPIRED: 'expired',\n} as const;\n\nexport const SsoConfigBaseSchema = z.object({\n  _id: z.string().min(1).isPrimaryKey().isSummaryField(),\n\n  // ── `.isAuditEvidence()` on the authentication-authority blocks ──────────────────────────────\n  // Every block below decides WHO may authenticate into this tenant and with what standing, so a\n  // change to one is an authorization change even though no role is named: weakening `requireSSO`,\n  // re-enabling `allowPasswordFallback`, granting a `defaultRole` on auto-provision, or adding a\n  // break-glass account each widen access tenant-wide. The generic resource-operation audit event\n  // records the changed field NAMES for free; the marker is what makes the before/after VALUES\n  // survive, and without values \"someone changed the SSO enforcement\" proves nothing.\n  //\n  // These are configuration flags, domains and role names — NOT personal data — so recording their\n  // values does not conflict with the Art. 5(1)(c) / Art. 17 minimisation reasoning that keeps\n  // user-identifying fields unmarked (audit rows replicate to an immutable ledger that cannot be\n  // scrubbed).\n  //\n  // assurance-control: WILDO.IDENTITY.SESSION_ASSURANCE — SSO enforcement decides how principals are\n  // permitted to authenticate at all.\n  //\n  // `enforceForAdmins` was REMOVED here (#481). It said \"this tenant's SSO requirement also binds\n  // its administrators\", defaulted `true`, and was read by nothing — so an operator who set it\n  // `false` believed their administrators had a way in when the IdP broke, and they did not.\n  //\n  // It was not reimplemented, because a ROLE is the wrong unit for an authentication bypass. Role\n  // membership changes, and a standing exemption for \"whoever is an admin\" means compromising one\n  // administrator and promoting an account silently grants an SSO bypass to the promoted one.\n  // Microsoft Entra's emergency-access guidance is explicit about the alternative — exclude a small\n  // NAMED set through a dedicated group, never a role — and that is what `emergencyAccess` below\n  // now does. Google Workspace does take the role-shaped route for its super administrators; it was\n  // considered and rejected here for the escalation path above.\n  //\n  // spec-cite: Microsoft Entra ID — \"Manage emergency access admin accounts\"\n  // (https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/security-emergency-access),\n  // \"Conditional Access considerations\": create a dedicated security group for the emergency access\n  // accounts and exclude THAT from policies. The reading that a role is the wrong unit is this\n  // repository's, not a quotation.\n  enforcement: z.object({\n    requireSSO: z.boolean().default(false).isSummaryField().describe(\"Whether members whose email domain is SSO-enabled must sign in through single sign-on.\"),\n    allowPasswordFallback: z.boolean().default(true).describe(\"While SSO is required, whether a password sign-in is still accepted within the grace allowance. `false` refuses every password sign-in except a break-glass account's.\"),\n    graceLoginAttempts: z.number().min(0).max(10).default(3).describe(\"How many password sign-ins each member may still make after SSO becomes required, from 0 to 10. 0 allows none.\"),\n  }).isSummaryField().isAuditEvidence().describe(\"Whether and how strictly single sign-on is required.\"),\n\n  // NOT marked, deliberately: this block carries `domainVerificationTokens`, which is\n  // `.isBackendOnly()` — a SECRET. `.isAuditEvidence()` on a parent object records the WHOLE object\n  // before/after, so marking `domains` would copy live verification tokens into audit rows that\n  // replicate to the immutable ledger and to every configured SIEM sink. The security-relevant\n  // sub-fields (`ssoEnabledDomains`, and `domainVerificationStatus` below) are marked individually\n  // instead, which keeps the secret out by construction rather than by reviewer vigilance.\n  //\n  // Read this before marking any other container: a block is safe to mark WHOLESALE only when no\n  // descendant is `.isBackendOnly()` or personal data.\n  domains: z.object({\n    /**\n     * Every domain this organization has CLAIMED — verified and unverified alike.\n     *\n     * ⚠️ The name asserts more than the field holds. `initiateDomainVerification` pushes a domain\n     * here at CLAIM time with `domainVerificationStatus[domain] = 'pending'`, so membership means\n     * \"somebody asked\", never \"we checked\". The real answer is the join with that map, and\n     * `resolveVerifiedDomains` below is the only place it should be computed (#457).\n     *\n     * **Do not read this array directly.** A reader that does gets pending, failed and expired\n     * domains under a name that says otherwise — which `AuthOrganizationConfigurationService\n     * .getDomains` did, returning them as `verified`, with no consumer to notice.\n     *\n     * The field was NOT renamed to `claimedDomains`, and that is a decision rather than an\n     * omission: it is persisted on every SSO config row of both dogfood applications, so the rename\n     * is a schema change plus a data migration for a field whose every reader now goes through the\n     * helper. The name is no longer what a new reader reaches.\n     */\n    verifiedDomains: z.array(z.string()).default([]).isAuditEvidence().describe(\"Every domain this scope has claimed, verified or not. Whether a domain is verified is `domainVerificationStatus`, not membership of this list.\"),\n    ssoEnabledDomains: z.array(z.string()).default([]).isAuditEvidence().describe(\"The verified domains whose members are routed to this scope's identity provider at sign-in.\"),\n    /*\n     * `domainHinting` and `allowExternalDomains` were REMOVED here, and both were read by nothing.\n     *\n     * `domainHinting` promised the sign-in form would route a person to their IdP from their email\n     * domain — a real and common feature, and one this engine implements from `ssoEnabledDomains`\n     * plus the verification map, never from this flag. Turning it off changed no routing.\n     *\n     * `allowExternalDomains` carried `.isAuditEvidence()` and read as an admission control on who\n     * may join through SSO. Nothing consulted it, so an operator who left it `false` — the default —\n     * believed they had closed a door that was never fitted. What actually restricts admission is\n     * the connection's `allowedDomains`, and on the SCIM lane the verified-domain projection.\n     *\n     * Absence is pinned in `authentication-knobs-have-readers.test.ts`.\n     */\n    /**\n     * The half of the join that decides routing authority — and therefore the audit evidence.\n     *\n     * Marked individually rather than through the containing `domains` block, for the reason that\n     * block's own comment gives: a whole-object mark would copy `domainVerificationTokens` into the\n     * immutable ledger. This map holds domain names and one of four statuses — no secret, no\n     * personal data — and it is the only field that answers the question an auditor asks about a\n     * domain workflow: WHICH domain became verified, and when did it stop being verified.\n     *\n     * Without it the trail records `domains` as a changed field name and nothing more, which cannot\n     * distinguish \"a tenant claimed a domain\" from \"a tenant gained SSO routing control over every\n     * address at it\".\n     */\n    domainVerificationStatus: z.record(z.string(), z.enum(DomainVerificationStatus)).default({}).isAuditEvidence().describe(\"The verification status of each claimed domain, keyed by domain.\"),\n    /**\n     * The DNS-TXT challenge nonce per claimed domain. `.isBackendOnly()` — never leaves the backend\n     * through a resource READ, and never enters the audit trail (see the block comment above).\n     *\n     * The one place its value is disclosed is the response to `claimDomain`, which returns it once\n     * as an `.isEphemeral()` field, because the operator cannot publish a record they cannot see.\n     * A lost token is recovered by claiming again, which mints a new one — there is no re-read.\n     */\n    domainVerificationTokens: z.record(z.string(), z.string()).default({}).isBackendOnly()\n      .describe('The DNS TXT challenge value for each claimed domain, keyed by domain. Never returned by a read: the value is shown once, in the claim response, and claiming again issues a new one. An update keeps the stored values whatever it sends.'),\n  }).describe(\"The domains this scope has claimed and verified, and which of them use single sign-on. Changed only by the claim, verify and revoke domain operations: an update may repeat it unchanged, and any other change is refused.\"),\n\n  /*\n   * `provisioning` was REMOVED here, and the reason is that it decided NOTHING.\n   *\n   * It declared six fields — `autoCreateUsers`, `autoUpdateUsers`, `autoDeactivateUsers`,\n   * `defaultRole`, `requiredAttributes`, `syncFrequencyHours` — carried `.isAuditEvidence()`, was\n   * written by the default seed, was rendered as a section of the SSO settings pane, and had ZERO\n   * production readers. An administrator set \"create users automatically\" there and nothing\n   * anywhere consulted it.\n   *\n   * ## What actually decides, and why there are two of them rather than three\n   *\n   * Just-in-time provisioning on an INTERACTIVE sign-in reads the CONNECTION, not this row:\n   * `SsoConnectionSchema.{autoCreateUsers, defaultRole, roleMapping, groupMapping}`,\n   * assembled once per connection by `oauth2-connection-resolver` and `saml-authentication` and\n   * carried into `provisionEnterpriseUser`. Per connection is the right grain — two IdPs bound to\n   * one tenant may legitimately differ.\n   *\n   * A DIRECTORY PUSH reads `ScimProvisioningConfigBaseSchema`, resolved by\n   * `scim.backend.controller._getProvisioningConfig`. Per organization is the right grain — there\n   * is one directory relationship.\n   *\n   * Those two are NOT duplicates of each other. They are different planes (a person signing in\n   * versus a directory pushing), on different code paths, and an organization can run either\n   * without the other. This block was the duplicate: a third grain, org-wide and inert, whose own\n   * documentation described it as \"SSO JIT provisioning\" — the one thing it did not do.\n   *\n   * ## What is NOT lost\n   *\n   * `autoCreateUsers` / `defaultRole` exist per connection; `autoDeactivateUsers` exists on the SCIM\n   * config. `autoUpdateUsers`, `requiredAttributes` and `syncFrequencyHours` existed ONLY here and\n   * were never implemented anywhere — removing them removes an advertised capability that was never\n   * present, which is the honest state. Wanting any of them back is a feature with a design, not a\n   * field to re-add. `syncFrequencyHours` in particular was already removed once for exactly this\n   * reason on the org-TYPE side (#1224); this is its twin.\n   *\n   * Absence is pinned in `authentication-knobs-have-readers.test.ts`.\n   */\n\n  /**\n   * Federated logout, and the ONLY thing this block still decides.\n   *\n   * `saml-metadata.backend.service` reads it as `spConfig.singleLogoutEnabled` and advertises — or\n   * withholds — the SP's SLO endpoint in the published metadata; `saml-authentication` honours the\n   * opt-out in both directions, terminating the local session on an SP-initiated logout and\n   * answering an IdP-initiated one with a graceful no-op LogoutResponse.\n   *\n   * ## Its three former neighbours were removed, and none of them was implemented\n   *\n   * - `requireReauthForSensitive` — nothing anywhere asks a session to re-authenticate for a\n   *   \"sensitive\" operation, and nothing classified one. Step-up authentication is a real mechanism\n   *   in this engine and it is not reached from here.\n   * - `ssoSessionDurationMinutes` — the ONLY mention outside the seed was a comment in\n   *   `saml-authentication` asserting the app session \"expires on its own `ssoSessionDurationMinutes`\".\n   *   It does not: session lifetime comes from the token issuer's own configuration. A comment is\n   *   not an implementation, and one that names a field makes the field look wired.\n   * - `maxConcurrentSessions` — a SECOND source of truth for a setting that already has a live one.\n   *   `userTypes.<type>.auth.maxConcurrentSessions` is what the token issuer enforces (pinned in\n   *   `auth-token-issuer.rotation-concurrency.redis.test.ts`); the copy here was read by nothing, so\n   *   an operator could set two different limits and neither the lower nor the later would win.\n   */\n  sessionSettings: z.object({\n    singleLogoutEnabled: z.boolean().default(true).describe(\"Whether signing out through the identity provider also ends the session here, and the reverse. `false` withholds the logout endpoint from the service-provider metadata.\"),\n  }).isAuditEvidence().describe(\"Session behaviour for single sign-on.\"),\n\n  /*\n   * `auditConfig` was REMOVED here — all five fields, and the assurance marker that stood over them.\n   *\n   * It declared `logAllSSOEvents`, `logProviderSwitching`, `logRoleMapping`, `complianceReporting`\n   * and `retentionDays`, and carried\n   * `assurance-control: WILDO.AUDIT.EVIDENCE_INTEGRITY — this block governs the audit trail itself`.\n   * Its own comment argued the marker: \"disabling `logAllSSOEvents` or shortening `retentionDays` is\n   * the classic pre-incident tampering move, and it must not be the one change the trail cannot\n   * evidence.\"\n   *\n   * Every word of that is a good argument about a block that governed NOTHING. Zero production\n   * readers: the declaration, the default seed, a specification example and the display template\n   * were the complete set of mentions. No SSO event consults `logAllSSOEvents` before emitting, and\n   * no retention job consults `retentionDays` — which made the marker the worse half of the defect,\n   * because a control marker is a CLAIM, and `compliance-is-derived-from-the-product.md` names a\n   * marker whose truth nothing checks as the thing to remove rather than the thing to keep.\n   *\n   * Audit-trail behaviour is not configurable per SSO policy and was never meant to be: emission is\n   * decided by the operation's own risk level against `AUTOMATIC_AUDIT_RISK_FLOOR`, and RETENTION by\n   * `ApplicationRetentionSchedule` over `DataRetentionClass` — application-level, derived, and total\n   * over that vocabulary. `retentionDays` here was a second, inert answer to a question already\n   * answered there.\n   *\n   * Absence is pinned in `authentication-knobs-have-readers.test.ts`.\n   */\n\n  /**\n   * Break-glass: the named accounts that may still sign in with a password when the identity\n   * provider cannot be reached.\n   *\n   * Every field here is READ at runtime. It carried three more — `requireApproval`,\n   * `maxDurationHours` and `auditLevel` — and all three were removed with `enforceForAdmins` (#481,\n   * #423) rather than implemented, for reasons worth keeping:\n   *\n   * - **`requireApproval` cannot exist on this path.** Break-glass is the door for the case where\n   *   nobody can act; an approval step means the approver may be locked out too, which is the\n   *   deadlock the door exists to break. Entra's guidance asks for monitoring and a post-mortem\n   *   after each use, never for prior approval.\n   * - **`maxDurationHours`** describes a bounded break-glass SESSION, which is a real control and\n   *   is not built. A field that names a control nobody enforces is exactly what this issue was\n   *   about, so it is absent until the session cap exists.\n   * - **`auditLevel`** could not change anything: `EMERGENCY_ACCESS_USED` is CRITICAL in\n   *   `SECURITY_AUDIT_EVENT_ENVELOPE`, and a per-tenant knob that lowers the severity of a\n   *   privileged-access record is not a setting a tenant should have.\n   *\n   * ## What a listed account gets, and what it does not\n   *\n   * A listed account is exempt from the SSO enforcement refusal — including grace exhaustion — and\n   * nothing else. It authenticates with the same password, against the same lockout counters and\n   * the same rate limits, and every use emits `EMERGENCY_ACCESS_USED` at CRITICAL.\n   *\n   * ## Why the whole TENANT keeps a password field when this list is non-empty\n   *\n   * The sign-in surface must not depend on the account, or the offered methods become an oracle for\n   * \"is this address a break-glass account\". So `requiresEnterpriseSsoOnly` answers false for the\n   * whole tenant while this list is non-empty: everyone at the domain sees a password field, and\n   * everyone not on the list is refused AFTER presenting a correct credential. The cost is a\n   * password field that only two accounts can use; the alternative discloses who they are.\n   *\n   * assurance-control: WILDO.IDENTITY.SESSION_ASSURANCE — the authenticated bypass of this tenant's\n   * own authentication requirement.\n   */\n  emergencyAccess: z.object({\n    /** Off switch. `true` with an empty list grants nothing — the list is what confers the bypass. */\n    enabled: z.boolean().default(true).describe(\"Whether the break-glass accounts may use their bypass. Enabled with an empty list grants nothing.\"),\n    /**\n     * The email addresses that may bypass SSO enforcement. An authority LIST: adding an entry grants\n     * a standing password path into a tenant that has otherwise required SSO.\n     *\n     * Keep it SMALL and keep it reviewed. Entra asks for at least two (redundancy), credentials\n     * stored apart from any individual, and a validation drill every 90 days; none of that is\n     * enforceable from here, and all of it is what makes this list safe to have.\n     */\n    breakGlassAccounts: z.array(z.email()).default([]).describe(\"The email addresses that may still sign in with a password when SSO is required, for when the identity provider cannot be reached. Each one is a standing way in with a password alone, so keep the list short and review it; every use is audited at critical severity.\"),\n  }).isAuditEvidence().describe(\"Break-glass: named accounts exempt from the SSO requirement.\"),\n\n  oauth2ProviderRestrictions: z.object({\n    allowedProviders: z.array(z.string()).default([]).describe(\"When not empty, the only social sign-in providers members may use.\"),\n    blockedProviders: z.array(z.string()).default([]).describe(\"Social sign-in providers members may not use. This wins over `allowedProviders`.\"),\n    requireEnterpriseSSOOnly: z.boolean().default(false).describe(\"Whether every social sign-in provider is refused, leaving only enterprise single sign-on.\"),\n  }).isAuditEvidence().describe(\"Which social sign-in providers (Google, GitHub and so on) this scope's members may use.\"),\n\n  /**\n   * Per-scope social provider credential overrides (P3).\n   *\n   * By default, social providers (Google, GitHub, Apple, etc.) use platform-level\n   * OAuth2 credentials from AppConfiguration. This array lets an org/app override\n   * those with their own registered OAuth2 app at the identity provider.\n   *\n   * Only `clientId` + `clientSecret` are needed for most providers — the OAuth2\n   * endpoints, scopes, and profile mapping still come from the provider catalog.\n   *\n   * `signedJwtKeyId` / `signedJwtTeamId` are required only for providers that use\n   * signed-JWT client secrets (e.g. Apple Sign-In, where the \"client secret\" is a\n   * short-lived JWT signed with a private key). These correspond to the Apple\n   * Developer Team ID and Key ID that are bound to the private key.\n   * When omitted, the app-level values from the secrets store are used.\n   *\n   * Secret handling (two distinct contracts, on purpose):\n   * - `clientSecret` is `.isWriteOnlySecret()` — the operator sets/rotates it, so it\n   *   stays writable AND stays in the response DTO where the framework redacts it to\n   *   `••••••••` at the client boundary. Internal reads (`resolveSocialConnection`\n   *   via `readAsSystem`) keep the real value.\n   * - `signedJwtKeyId` / `signedJwtTeamId` are `.isBackendOnly()` — never sent to the\n   *   frontend at all (stripped from every client DTO).\n   *\n   * Because these secrets live inside an ARRAY, neither the central write-only-secret\n   * sentinel-strip NOR a whole-array `$set` preserves them on save: the repository\n   * replaces the entire array with no deep merge. The UPDATE custom-impl therefore\n   * matches each incoming override to the stored record by `providerRef` and\n   * re-injects any secret that arrived absent or as the `••••••••` mask.\n   *\n   * @see oauth2-connection-resolver — resolveSocialConnection() steps 5b/5c\n   * @see sso-config.custom-impl — prefixCoreOperations UPDATE handler\n   */\n  socialCredentialOverrides: z.array(z.object({\n    providerRef: z.string().min(1).describe(\"The social provider these credentials are for. Each provider may appear once.\"),\n    clientId: z.string().min(1).describe(\"The client id of this scope's own app registered at the provider.\"),\n    clientSecret: z.string().min(1).isWriteOnlySecret().describe(\"The client secret of that app. Write-only: reads return a mask, and sending the mask back keeps the stored value.\"),\n    signedJwtKeyId: z.string().optional().isBackendOnly()\n      .describe('For a provider whose client secret is a signed JWT, such as Sign in with Apple: the id of the private key that signs it. Write-only: never returned by a read, and kept when an update omits it. Absent: the application\\'s own value is used.'),\n    signedJwtTeamId: z.string().optional().isBackendOnly()\n      .describe('For a provider whose client secret is a signed JWT, such as Sign in with Apple: the developer team id that owns the signing key. Write-only: never returned by a read, and kept when an update omits it. Absent: the application\\'s own value is used.'),\n  })).default([]).refine(\n    (arr) => new Set(arr.map(o => o.providerRef)).size === arr.length,\n    { message: 'Duplicate providerRef in socialCredentialOverrides' },\n  ).describe(\"This scope's own OAuth app credentials for social providers, replacing the application's. Endpoints, scopes and profile mapping still come from the provider.\"),\n\n  createdAt: z.date().default(() => new Date()).excludeFromCreate().excludeFromUpdate(),\n  updatedAt: z.date().default(() => new Date()).excludeFromCreate().excludeFromUpdate(),\n});\n\nexport type SsoConfigBase = z.infer<typeof SsoConfigBaseSchema>;\n\n/**\n * The domains this organization has actually VERIFIED — the join `verifiedDomains` does not carry.\n *\n * ## Why this exists rather than five correct joins\n *\n * The stored list holds CLAIMED domains, so safety depends on every reader filtering it by\n * `domainVerificationStatus`. Measured 2026-09-08, **five** reader sites did that by hand — the SCIM\n * controller, the SCIM virtual field, the domain-verification service, and the domain-to-org lookup\n * TWICE — and a sixth, `getDomains`, did not. It returned the raw list under the name `verified`.\n *\n * That is `.claude/rules/invariant-call-site-enumeration.md`'s exact shape: an invariant hand-applied\n * at N sites, where the next site is the one that forgets. It had already happened; it was harmless\n * only because that reader had no consumer — and claiming a domain is now reachable by tenants\n * through `SsoConfig_Operations.CLAIM_DOMAIN` (#424), so the margin that made it harmless is gone.\n *\n * So the join is computed ONCE, here, beside the field it corrects. A new reader that reaches for\n * the verified set finds this; one that reaches for the raw array finds the warning on the field.\n *\n * Takes the shape structurally rather than `SsoConfigBase` so a caller holding a partial config, a\n * DTO or a lean document can use it — the three existing shapes at the call sites — without the\n * helper forcing a cast at every one of them.\n */\nexport function resolveVerifiedDomains(domains: {\n  readonly verifiedDomains?: readonly string[];\n  readonly domainVerificationStatus?: Readonly<Record<string, string>>;\n} | undefined): string[] {\n  const status = domains?.domainVerificationStatus ?? {};\n  return (domains?.verifiedDomains ?? []).filter(\n    domain => status[domain] === DomainVerificationStatus.VERIFIED,\n  );\n}\n\n/** Whether ONE domain is verified for this organization. The single-domain form of the join. */\nexport function isDomainVerified(\n  domains: {\n    readonly verifiedDomains?: readonly string[];\n    readonly domainVerificationStatus?: Readonly<Record<string, string>>;\n  } | undefined,\n  domain: string,\n): boolean {\n  return (domains?.verifiedDomains ?? []).includes(domain)\n    && domains?.domainVerificationStatus?.[domain] === DomainVerificationStatus.VERIFIED;\n}\n\nexport const ssoConfigPolymorphicDeclaration = declarePolymorphicSchemas({\n  baseResourceType: 'ssoConfig',\n  baseFieldIdentifier: 'ssoConfigId',\n  baseEnumKey: 'SSO_CONFIG',\n  baseSchema: SsoConfigBaseSchema,\n  variants: AUTH_SCOPE_VARIANTS,\n});\n"]}

package/dist/esm/security/authentications/sso/sso-connection.shared.resources-config.schemas.d.ts

@@ -20,7 +20,9 @@ export declare enum SsoConnectionTestOverallStatus {
 }
 /** Evidence source that produced a supported endpoint-discovery result. */
 export declare enum SsoConnectionDiscoverySource {
-    SAML_METADATA = "saml-metadata"
+    SAML_METADATA = "saml-metadata",
+    /** The OpenID Provider's `/.well-known/openid-configuration` document at `issuerUrl` (#1800). */
+    OIDC_DISCOVERY = "oidc-discovery"
 }
 /**
  * TEST_CONNECTION addresses the connection through the resource URL. It has no
@@ -31,8 +33,10 @@ export declare const SsoConnection_TestConnectionRequestDto: z.ZodObject<{}, z.c
 /**
  * Metadata discovery needs at least one protocol-specific source. The union
  * makes that invariant visible in generated JSON Schema (`anyOf`) as well as at
- * runtime; an object with both sources remains valid and SAML metadata takes
- * precedence until OIDC discovery is implemented.
+ * runtime. `metadataUrl` discovers a SAML provider and `issuerUrl` an OpenID
+ * Connect one; an object with both remains valid and SAML metadata takes
+ * precedence, since the two describe different connections and the operation
+ * answers one protocol.
  */
 export declare const SsoConnection_DiscoverEndpointsRequestDto: z.ZodUnion<readonly [z.ZodObject<{
     metadataUrl: z.ZodURL;
@@ -92,11 +96,18 @@ export declare const SsoConnection_DiscoverEndpointsResponseDto: z.ZodDiscrimina
     sloUrl: z.ZodOptional<z.ZodURL>;
     x509Certificates: z.ZodArray<z.ZodString>;
     nameIdFormat: z.ZodOptional<z.ZodString>;
-    source: z.ZodLiteral<SsoConnectionDiscoverySource>;
+    source: z.ZodLiteral<SsoConnectionDiscoverySource.SAML_METADATA>;
 }, z.core.$strict>, z.ZodObject<{
     protocol: z.ZodLiteral<SsoProtocol.OIDC>;
-    supported: z.ZodLiteral<false>;
-    message: z.ZodString;
+    supported: z.ZodLiteral<true>;
+    issuer: z.ZodURL;
+    authorizationEndpoint: z.ZodURL;
+    tokenEndpoint: z.ZodURL;
+    userInfoEndpoint: z.ZodOptional<z.ZodURL>;
+    jwksUri: z.ZodURL;
+    endSessionEndpoint: z.ZodOptional<z.ZodURL>;
+    scopesSupported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    source: z.ZodLiteral<SsoConnectionDiscoverySource.OIDC_DISCOVERY>;
 }, z.core.$strict>], "protocol">;
 export declare const ssoConnectionPolymorphicFactories: Record<string, import("../../..").ResourceConfiguration_InitializationFactory<typeof SsoConnection_Operations, CoreResourceOperation.READ | CoreResourceOperation.UPDATE | CoreResourceOperation.DELETE | CoreResourceOperation.CREATE | CoreResourceOperation.LIST, any>>;
 //# sourceMappingURL=sso-connection.shared.resources-config.schemas.d.ts.map

package/dist/esm/security/authentications/sso/sso-connection.shared.resources-config.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sso-connection.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../../../src/security/authentications/sso/sso-connection.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,qBAAqB,EAAoB,MAAM,sDAAsD,CAAC;AAQ/G,OAAO,EAAE,WAAW,EAAuC,MAAM,iCAAiC,CAAC;AAInG,oBAAY,wBAAwB;IAClC,eAAe,mBAAmB;IAClC,kBAAkB,sBAAsB;CACzC;AAED,0EAA0E;AAC1E,oBAAY,8BAA8B;IACxC,IAAI,SAAS;IACb,OAAO,YAAY;IACnB,IAAI,SAAS;CACd;AAED,2EAA2E;AAC3E,oBAAY,4BAA4B;IACtC,aAAa,kBAAkB;CAChC;AAID;;;;GAIG;AACH,eAAO,MAAM,sCAAsC,iCAAqB,CAAC;AAEzE;;;;;GAKG;AACH,eAAO,MAAM,yCAAyC;;;;;;oBASpD,CAAC;AAYH;;;;GAIG;AACH,eAAO,MAAM,uCAAuC;;;;IAKhD;;;;;;OAMG;;;;;;;;;;;;IAIH,uEAAuE;;;;;;;;;;;gCAazE,CAAC;AAEH;;;GAGG;AACH,eAAO,MAAM,0CAA0C;;;;;;;;;;;;;gCAgBrD,CAAC;AAIH,eAAO,MAAM,iCAAiC,4QA0J7C,CAAC"}
+{"version":3,"file":"sso-connection.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../../../src/security/authentications/sso/sso-connection.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,qBAAqB,EAAoB,MAAM,sDAAsD,CAAC;AAQ/G,OAAO,EAAE,WAAW,EAAuC,MAAM,iCAAiC,CAAC;AAInG,oBAAY,wBAAwB;IAClC,eAAe,mBAAmB;IAClC,kBAAkB,sBAAsB;CACzC;AAED,0EAA0E;AAC1E,oBAAY,8BAA8B;IACxC,IAAI,SAAS;IACb,OAAO,YAAY;IACnB,IAAI,SAAS;CACd;AAED,2EAA2E;AAC3E,oBAAY,4BAA4B;IACtC,aAAa,kBAAkB;IAC/B,iGAAiG;IACjG,cAAc,mBAAmB;CAClC;AAID;;;;GAIG;AACH,eAAO,MAAM,sCAAsC,iCAAqB,CAAC;AAEzE;;;;;;;GAOG;AACH,eAAO,MAAM,yCAAyC;;;;;;oBAgBpD,CAAC;AAiBH;;;;GAIG;AACH,eAAO,MAAM,uCAAuC;;;;IAKhD;;;;;;OAMG;;;;;;;;;;;;IAWH,uEAAuE;;;;;;;;;;;gCAwBzE,CAAC;AAEH;;;GAGG;AACH,eAAO,MAAM,0CAA0C;;;;;;;;;;;;;;;;;;;;gCAoCrD,CAAC;AAIH,eAAO,MAAM,iCAAiC,4QA0J7C,CAAC"}

package/dist/esm/security/authentications/sso/sso-connection.shared.resources-config.schemas.js

@@ -29,6 +29,8 @@ export var SsoConnectionTestOverallStatus;
 export var SsoConnectionDiscoverySource;
 (function (SsoConnectionDiscoverySource) {
     SsoConnectionDiscoverySource["SAML_METADATA"] = "saml-metadata";
+    /** The OpenID Provider's `/.well-known/openid-configuration` document at `issuerUrl` (#1800). */
+    SsoConnectionDiscoverySource["OIDC_DISCOVERY"] = "oidc-discovery";
 })(SsoConnectionDiscoverySource || (SsoConnectionDiscoverySource = {}));
 // ── Request DTOs ─────────────────────────────────────────────────────
 /**
@@ -40,27 +42,41 @@ export const SsoConnection_TestConnectionRequestDto = z.strictObject({});
 /**
  * Metadata discovery needs at least one protocol-specific source. The union
  * makes that invariant visible in generated JSON Schema (`anyOf`) as well as at
- * runtime; an object with both sources remains valid and SAML metadata takes
- * precedence until OIDC discovery is implemented.
+ * runtime. `metadataUrl` discovers a SAML provider and `issuerUrl` an OpenID
+ * Connect one; an object with both remains valid and SAML metadata takes
+ * precedence, since the two describe different connections and the operation
+ * answers one protocol.
  */
 export const SsoConnection_DiscoverEndpointsRequestDto = z.union([
     z.strictObject({
-        metadataUrl: z.url(),
-        issuerUrl: z.url().optional(),
+        metadataUrl: z
+            .url()
+            .describe("The URL of the identity provider's SAML metadata document. The server fetches and reads it; nothing is saved to the connection."),
+        issuerUrl: z.url().optional().describe("An OpenID Connect provider's issuer. Ignored when `metadataUrl` is given."),
     }),
     z.strictObject({
-        issuerUrl: z.url(),
-        metadataUrl: z.url().optional(),
+        issuerUrl: z
+            .url()
+            .describe("An OpenID Connect provider's issuer. The server fetches `<issuer>/.well-known/openid-configuration` and reads it; nothing is saved to the connection."),
+        metadataUrl: z
+            .url()
+            .optional()
+            .describe("The URL of the identity provider's SAML metadata document. When given, the server fetches and reads it; nothing is saved to the connection."),
     }),
 ]);
 const SsoConnection_CertificateTestResultDto = z.strictObject({
-    index: z.number().int().nonnegative(),
-    valid: z.boolean(),
-    expiresAt: z.string(),
-    daysRemaining: z.number().int(),
-    algorithm: z.string(),
-    fingerprint: z.string(),
-    warnings: z.array(z.string()),
+    index: z.number().int().nonnegative().describe("The certificate's position in the connection's certificate list, starting at 0."),
+    valid: z.boolean().describe('`true` when the certificate could be read and today falls within its validity period.'),
+    expiresAt: z.string().describe('When the certificate expires, as an ISO 8601 date-time. Empty when the certificate could not be read.'),
+    daysRemaining: z
+        .number()
+        .int()
+        .describe('Whole days until the certificate expires; negative once it has expired. `-1` when the certificate could not be read.'),
+    algorithm: z.string().describe("The certificate's signature algorithm, or `unknown` when it is not recognised."),
+    fingerprint: z.string().describe("The certificate's SHA-256 fingerprint, as colon-separated hex. Empty when the certificate could not be read."),
+    warnings: z
+        .array(z.string())
+        .describe('Problems found with this certificate: expired or not yet valid, expiring within 30 days, a SHA-1 signature, or unreadable.'),
 });
 /**
  * Protocol-discriminated result for TEST_CONNECTION. SAML diagnostics are a
@@ -70,8 +86,8 @@ const SsoConnection_CertificateTestResultDto = z.strictObject({
 export const SsoConnection_TestConnectionResponseDto = z.discriminatedUnion('protocol', [
     z.strictObject({
         protocol: z.literal(SsoProtocol.SAML),
-        supported: z.literal(true),
-        entityIdConfigured: z.boolean(),
+        supported: z.literal(true).describe('`true`: the connection was tested.'),
+        entityIdConfigured: z.boolean().describe("Whether the identity provider's entity ID is set on the connection."),
         /**
          * Did the server's probe reach the SSO URL? ABSENT when the server was not allowed to probe it — the
          * outbound-target guard refused the destination (a private address the operator has not declared in
@@ -79,21 +95,37 @@ export const SsoConnection_TestConnectionResponseDto = z.discriminatedUnion('pro
          * about the endpoint then: SAML sign-in reaches it through the user's browser, so a private IdP the
          * server may not address can still be a working SSO URL. The reason is carried in `warnings` (#516).
          */
-        ssoUrlReachable: z.boolean().optional(),
-        ssoUrlStatus: z.number().int().optional(),
-        certificates: z.array(SsoConnection_CertificateTestResultDto),
+        ssoUrlReachable: z
+            .boolean()
+            .optional()
+            .describe("Whether the server got an HTTP response from the SSO URL, whatever its status. `false` when it did not answer or no SSO URL is set. Absent when the server may not connect to that address, because sign-in reaches it through the user's browser; `warnings` says why."),
+        ssoUrlStatus: z.number().int().optional().describe('The HTTP status the SSO URL answered with. Absent when it did not answer.'),
+        certificates: z
+            .array(SsoConnection_CertificateTestResultDto)
+            .describe("One result per X.509 certificate configured for the identity provider, in the connection's order."),
         /** As `ssoUrlReachable`; also absent when no SLO URL is configured. */
-        sloUrlReachable: z.boolean().optional(),
-        sloUrlStatus: z.number().int().optional(),
-        spMetadataValid: z.boolean(),
-        overallStatus: z.enum(SsoConnectionTestOverallStatus),
-        errors: z.array(z.string()),
-        warnings: z.array(z.string()),
+        sloUrlReachable: z
+            .boolean()
+            .optional()
+            .describe('Whether the server got an HTTP response from the single-logout URL, checked like `ssoUrlReachable`. Absent when no single-logout URL is set.'),
+        sloUrlStatus: z.number().int().optional().describe('The HTTP status the single-logout URL answered with. Absent when it did not answer or none is set.'),
+        spMetadataValid: z
+            .boolean()
+            .describe("Whether this application can generate valid service-provider metadata for the connection. `false` means the application's own SAML settings are incomplete, reported as a warning."),
+        overallStatus: z
+            .enum(SsoConnectionTestOverallStatus)
+            .describe('The verdict: `fail` when there is at least one error, `warning` when there are only warnings, `pass` otherwise.'),
+        errors: z
+            .array(z.string())
+            .describe('Problems that stop sign-in from working, such as a missing entity ID or SSO URL, an unreachable SSO URL, or no valid certificate.'),
+        warnings: z
+            .array(z.string())
+            .describe('Problems worth fixing that do not by themselves stop sign-in, such as a certificate expiring soon or an unreachable single-logout URL.'),
     }),
     z.strictObject({
         protocol: z.literal(SsoProtocol.OIDC),
-        supported: z.literal(false),
-        message: z.string().min(1),
+        supported: z.literal(false).describe('`false`: OpenID Connect connections cannot be tested yet, and nothing was attempted.'),
+        message: z.string().min(1).describe('Explains why no test was run.'),
     }),
 ]);
 /**
@@ -103,18 +135,38 @@ export const SsoConnection_TestConnectionResponseDto = z.discriminatedUnion('pro
 export const SsoConnection_DiscoverEndpointsResponseDto = z.discriminatedUnion('protocol', [
     z.strictObject({
         protocol: z.literal(SsoProtocol.SAML),
-        supported: z.literal(true),
-        entityId: z.string().min(1),
-        ssoUrl: z.url(),
-        sloUrl: z.url().optional(),
-        x509Certificates: z.array(z.string()),
-        nameIdFormat: z.string().optional(),
-        source: z.literal(SsoConnectionDiscoverySource.SAML_METADATA),
+        supported: z.literal(true).describe('`true`: the metadata was fetched and read.'),
+        entityId: z.string().min(1).describe("The identity provider's entity ID, from the metadata."),
+        ssoUrl: z.url().describe("The identity provider's single sign-on URL, from the metadata."),
+        sloUrl: z.url().optional().describe("The identity provider's single-logout URL, when the metadata declares one."),
+        x509Certificates: z.array(z.string()).describe("The identity provider's X.509 certificates, from the metadata."),
+        nameIdFormat: z.string().optional().describe('The name identifier format the identity provider declares, when the metadata carries one.'),
+        source: z
+            .literal(SsoConnectionDiscoverySource.SAML_METADATA)
+            .describe('Where these values came from: the SAML metadata document at `metadataUrl`.'),
     }),
+    /*
+     * OpenID Connect discovery (#1800). `issuerUrl` was accepted and never read: the operation answered
+     * `supported: false` whatever it said. The field names are the connection's own `oidc.*` names, so a
+     * form can merge the result straight into a connection, as the SAML wizard does with `saml.*`.
+     *
+     * A failed discovery is a 400 (`oidc_discovery_failed`) naming why — not an HTTPS issuer, unreachable,
+     * not a JSON object, a required endpoint missing, or an issuer the document does not assert — rather
+     * than a response member, exactly as a SAML metadata failure is.
+     */
     z.strictObject({
         protocol: z.literal(SsoProtocol.OIDC),
-        supported: z.literal(false),
-        message: z.string().min(1),
+        supported: z.literal(true).describe('`true`: the discovery document was fetched and read.'),
+        issuer: z.url().describe("The provider's issuer exactly as its discovery document publishes it. An ID token's `iss` claim must equal this string, so store it as `oidc.issuer` unchanged."),
+        authorizationEndpoint: z.url().describe("The provider's authorization endpoint."),
+        tokenEndpoint: z.url().describe("The provider's token endpoint."),
+        userInfoEndpoint: z.url().optional().describe("The provider's userinfo endpoint, when the document declares one."),
+        jwksUri: z.url().describe('Where the provider publishes the keys its ID tokens are signed with.'),
+        endSessionEndpoint: z.url().optional().describe("The provider's logout endpoint, when the document declares one."),
+        scopesSupported: z.array(z.string()).optional().describe('The scopes the provider says it supports, when the document lists them.'),
+        source: z
+            .literal(SsoConnectionDiscoverySource.OIDC_DISCOVERY)
+            .describe("Where these values came from: the discovery document at `<issuerUrl>/.well-known/openid-configuration`."),
     }),
 ]);
 // ── Polymorphic Factory ──────────────────────────────────────────────
@@ -177,7 +229,7 @@ export const ssoConnectionPolymorphicFactories = createPolymorphicResourceConfig
                     variantType: ResourceOperationVariantType.API_CALL,
                     isDefault: true,
                     polymorphicRole: {
-                        [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],
+                        [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN, CORE_ORG_ROLES.ORG_DELEGATED_MANAGE_SSO_SCIM],
                         [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],
                     },
                     riskLevel: ResourceOperationRiskLevel.LOW,
@@ -242,7 +294,7 @@ export const ssoConnectionPolymorphicFactories = createPolymorphicResourceConfig
                     variantType: ResourceOperationVariantType.API_CALL,
                     isDefault: true,
                     polymorphicRole: {
-                        [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],
+                        [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN, CORE_ORG_ROLES.ORG_DELEGATED_MANAGE_SSO_SCIM],
                         [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],
                     },
                     riskLevel: ResourceOperationRiskLevel.MEDIUM,
@@ -258,7 +310,7 @@ export const ssoConnectionPolymorphicFactories = createPolymorphicResourceConfig
                     variantType: ResourceOperationVariantType.API_CALL,
                     isDefault: true,
                     polymorphicRole: {
-                        [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],
+                        [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN, CORE_ORG_ROLES.ORG_DELEGATED_MANAGE_SSO_SCIM],
                         [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],
                     },
                     riskLevel: ResourceOperationRiskLevel.MEDIUM,

package/dist/esm/security/authentications/sso/sso-connection.shared.resources-config.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"sso-connection.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../../../../src/security/authentications/sso/sso-connection.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,sDAAsD,CAAC;AAC/G,OAAO,EACL,0BAA0B,EAC1B,4BAA4B,GAC7B,MAAM,6CAA6C,CAAC;AACrD,OAAO,EAAE,wBAAwB,EAAE,MAAM,oDAAoD,CAAC;AAC9F,OAAO,EAAE,uCAAuC,EAAE,MAAM,wDAAwD,CAAC;AACjH,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,2CAA2C,CAAC;AAC3F,OAAO,EAAE,WAAW,EAAE,mCAAmC,EAAE,MAAM,iCAAiC,CAAC;AAEnG,wEAAwE;AAExE,MAAM,CAAN,IAAY,wBAGX;AAHD,WAAY,wBAAwB;IAClC,8DAAkC,CAAA;IAClC,oEAAwC,CAAA;AAC1C,CAAC,EAHW,wBAAwB,KAAxB,wBAAwB,QAGnC;AAED,0EAA0E;AAC1E,MAAM,CAAN,IAAY,8BAIX;AAJD,WAAY,8BAA8B;IACxC,+CAAa,CAAA;IACb,qDAAmB,CAAA;IACnB,+CAAa,CAAA;AACf,CAAC,EAJW,8BAA8B,KAA9B,8BAA8B,QAIzC;AAED,2EAA2E;AAC3E,MAAM,CAAN,IAAY,4BAEX;AAFD,WAAY,4BAA4B;IACtC,+DAA+B,CAAA;AACjC,CAAC,EAFW,4BAA4B,KAA5B,4BAA4B,QAEvC;AAED,wEAAwE;AAExE;;;;GAIG;AACH,MAAM,CAAC,MAAM,sCAAsC,GAAG,CAAC,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;AAEzE;;;;;GAKG;AACH,MAAM,CAAC,MAAM,yCAAyC,GAAG,CAAC,CAAC,KAAK,CAAC;IAC/D,CAAC,CAAC,YAAY,CAAC;QACb,WAAW,EAAE,CAAC,CAAC,GAAG,EAAE;QACpB,SAAS,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;KAC9B,CAAC;IACF,CAAC,CAAC,YAAY,CAAC;QACb,SAAS,EAAE,CAAC,CAAC,GAAG,EAAE;QAClB,WAAW,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;KAChC,CAAC;CACH,CAAC,CAAC;AAEH,MAAM,sCAAsC,GAAG,CAAC,CAAC,YAAY,CAAC;IAC5D,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IACrC,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE;IAClB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IAC/B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;CAC9B,CAAC,CAAC;AAEH;;;;GAIG;AACH,MAAM,CAAC,MAAM,uCAAuC,GAAG,CAAC,CAAC,kBAAkB,CAAC,UAAU,EAAE;IACtF,CAAC,CAAC,YAAY,CAAC;QACb,QAAQ,EAAE,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC;QACrC,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;QAC1B,kBAAkB,EAAE,CAAC,CAAC,OAAO,EAAE;QAC/B;;;;;;WAMG;QACH,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;QACvC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;QACzC,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,sCAAsC,CAAC;QAC7D,uEAAuE;QACvE,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;QACvC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;QACzC,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE;QAC5B,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC,8BAA8B,CAAC;QACrD,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;QAC3B,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;KAC9B,CAAC;IACF,CAAC,CAAC,YAAY,CAAC;QACb,QAAQ,EAAE,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC;QACrC,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;QAC3B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;KAC3B,CAAC;CACH,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,CAAC,MAAM,0CAA0C,GAAG,CAAC,CAAC,kBAAkB,CAAC,UAAU,EAAE;IACzF,CAAC,CAAC,YAAY,CAAC;QACb,QAAQ,EAAE,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC;QACrC,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;QAC1B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC3B,MAAM,EAAE,CAAC,CAAC,GAAG,EAAE;QACf,MAAM,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;QAC1B,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;QACrC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QACnC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,4BAA4B,CAAC,aAAa,CAAC;KAC9D,CAAC;IACF,CAAC,CAAC,YAAY,CAAC;QACb,QAAQ,EAAE,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC;QACrC,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;QAC3B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;KAC3B,CAAC;CACH,CAAC,CAAC;AAEH,wEAAwE;AAExE,MAAM,CAAC,MAAM,iCAAiC,GAAG,uCAAuC,CACtF,mCAAmC,EACnC;IACE,gBAAgB,EAAE,IAAI;IACtB,0EAA0E;IAC1E,+EAA+E;IAC/E,8EAA8E;IAC9E,6EAA6E;IAC7E,2EAA2E;IAC3E,8EAA8E;IAC9E,6EAA6E;IAC7E,mFAAmF;IACnF,2EAA2E;IAC3E,mEAAmE;IACnE,EAAE;IACF,sFAAsF;IACtF,2FAA2F;IAC3F,oFAAoF;IACpF,qFAAqF;IACrF,gFAAgF;IAChF,uFAAuF;IACvF,6FAA6F;IAC7F,kBAAkB,EAAE;QAClB,IAAI,EAAE,wBAAwB,CAAC,OAAO;QACtC,IAAI,EAAE,wBAAwB,CAAC,OAAO;KACvC;IACD,eAAe,EAAE,wBAAwB;IACzC,cAAc,EAAE;QACd,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;KAC7B;IACD,uBAAuB,EAAE;QACvB,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,iEAAiE;oBACjE,kEAAkE;oBAClE,wEAAwE;oBACxE,sEAAsE;oBACtE,kEAAkE;oBAClE,uEAAuE;oBACvE,sEAAsE;oBACtE,6CAA6C;oBAC7C,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aAAC;SACL;QACD,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C,CAAC;SACH;QACD,8EAA8E;QAC9E,yEAAyE;QACzE,4EAA4E;QAC5E,4EAA4E;QAC5E,EAAE;QACF,gFAAgF;QAChF,gFAAgF;QAChF,+EAA+E;QAC/E,2DAA2D;QAC3D,kEAAkE;QAClE,qEAAqE;QACrE,2DAA2D;QAC3D,EAAE;QACF,gFAAgF;QAChF,gFAAgF;QAChF,wEAAwE;QACxE,EAAE;QACF,kEAAkE;QAClE,kFAAkF;QAClF,6EAA6E;QAC7E,kFAAkF;QAClF,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,IAAI;iBAC3C,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,IAAI;iBAC3C,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,IAAI;iBAC3C,CAAC;SACH;QACD,CAAC,wBAAwB,CAAC,eAAe,CAAC,EAAE;YAC1C,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,qBAAqB,EAAE,qBAAqB,CAAC,IAAI;oBACjD,UAAU,EAAE,sCAAsC;oBAClD,qEAAqE;oBACrE,2CAA2C;oBAC3C,iBAAiB,EAAE,uCAAuC;iBAC3D,CAAC;SACH;QACD,CAAC,wBAAwB,CAAC,kBAAkB,CAAC,EAAE;YAC7C,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,yCAAyC;oBACrD,qEAAqE;oBACrE,+CAA+C;oBAC/C,iBAAiB,EAAE,0CAA0C;iBAC9D,CAAC;SACH;KACF;CACF,CACF,CAAC","sourcesContent":["/**\n * SSO Connection Resource Configuration — Polymorphic\n *\n * Produces 2 factory functions (ORG + APP) via the polymorphic factory.\n * Spread into the registry factory map:\n *   ...ssoConnectionPolymorphicFactories\n */\n\nimport { z } from 'zod';\nimport { CoreResourceOperation, CoreResourceType } from '../../../resources/resources.shared.core.definitions';\nimport {\n  ResourceOperationRiskLevel,\n  ResourceOperationVariantType,\n} from '../../../resources/resources.shared.schemas';\nimport { ResourceSystemAccessMode } from '../../../resources/resources-config.shared.schemas';\nimport { createPolymorphicResourceConfigurations } from '../../../resources/utils/resource-polymorphism.factory';\nimport { CORE_ORG_ROLES, CORE_APP_ROLES } from '../../authorizations/roles.shared.schemas';\nimport { SsoProtocol, ssoConnectionPolymorphicDeclaration } from './sso-connection.shared.schemas';\n\n// ── Custom Operations ────────────────────────────────────────────────\n\nexport enum SsoConnection_Operations {\n  TEST_CONNECTION = 'testConnection',\n  DISCOVER_ENDPOINTS = 'discoverEndpoints',\n}\n\n/** Final SAML diagnostic posture after all configured checks complete. */\nexport enum SsoConnectionTestOverallStatus {\n  PASS = 'pass',\n  WARNING = 'warning',\n  FAIL = 'fail',\n}\n\n/** Evidence source that produced a supported endpoint-discovery result. */\nexport enum SsoConnectionDiscoverySource {\n  SAML_METADATA = 'saml-metadata',\n}\n\n// ── Request DTOs ─────────────────────────────────────────────────────\n\n/**\n * TEST_CONNECTION addresses the connection through the resource URL. It has no\n * independent query/body input: accepting a second `connectionId` let callers\n * provide two identities while the service always used `utils.currentObject`.\n */\nexport const SsoConnection_TestConnectionRequestDto = z.strictObject({});\n\n/**\n * Metadata discovery needs at least one protocol-specific source. The union\n * makes that invariant visible in generated JSON Schema (`anyOf`) as well as at\n * runtime; an object with both sources remains valid and SAML metadata takes\n * precedence until OIDC discovery is implemented.\n */\nexport const SsoConnection_DiscoverEndpointsRequestDto = z.union([\n  z.strictObject({\n    metadataUrl: z.url(),\n    issuerUrl: z.url().optional(),\n  }),\n  z.strictObject({\n    issuerUrl: z.url(),\n    metadataUrl: z.url().optional(),\n  }),\n]);\n\nconst SsoConnection_CertificateTestResultDto = z.strictObject({\n  index: z.number().int().nonnegative(),\n  valid: z.boolean(),\n  expiresAt: z.string(),\n  daysRemaining: z.number().int(),\n  algorithm: z.string(),\n  fingerprint: z.string(),\n  warnings: z.array(z.string()),\n});\n\n/**\n * Protocol-discriminated result for TEST_CONNECTION. SAML diagnostics are a\n * real implementation; OIDC deliberately reports its unavailable test path as\n * data instead of returning an ambiguous `{ message }` success payload.\n */\nexport const SsoConnection_TestConnectionResponseDto = z.discriminatedUnion('protocol', [\n  z.strictObject({\n    protocol: z.literal(SsoProtocol.SAML),\n    supported: z.literal(true),\n    entityIdConfigured: z.boolean(),\n    /**\n     * Did the server's probe reach the SSO URL? ABSENT when the server was not allowed to probe it — the\n     * outbound-target guard refused the destination (a private address the operator has not declared in\n     * `auth.federatedIdentityProviderPrivateNetworks`). Neither `true` nor `false` would be a statement\n     * about the endpoint then: SAML sign-in reaches it through the user's browser, so a private IdP the\n     * server may not address can still be a working SSO URL. The reason is carried in `warnings` (#516).\n     */\n    ssoUrlReachable: z.boolean().optional(),\n    ssoUrlStatus: z.number().int().optional(),\n    certificates: z.array(SsoConnection_CertificateTestResultDto),\n    /** As `ssoUrlReachable`; also absent when no SLO URL is configured. */\n    sloUrlReachable: z.boolean().optional(),\n    sloUrlStatus: z.number().int().optional(),\n    spMetadataValid: z.boolean(),\n    overallStatus: z.enum(SsoConnectionTestOverallStatus),\n    errors: z.array(z.string()),\n    warnings: z.array(z.string()),\n  }),\n  z.strictObject({\n    protocol: z.literal(SsoProtocol.OIDC),\n    supported: z.literal(false),\n    message: z.string().min(1),\n  }),\n]);\n\n/**\n * Protocol-discriminated result for DISCOVER_ENDPOINTS. The operation returns\n * discovered metadata only; it never persists or enriches a connection row.\n */\nexport const SsoConnection_DiscoverEndpointsResponseDto = z.discriminatedUnion('protocol', [\n  z.strictObject({\n    protocol: z.literal(SsoProtocol.SAML),\n    supported: z.literal(true),\n    entityId: z.string().min(1),\n    ssoUrl: z.url(),\n    sloUrl: z.url().optional(),\n    x509Certificates: z.array(z.string()),\n    nameIdFormat: z.string().optional(),\n    source: z.literal(SsoConnectionDiscoverySource.SAML_METADATA),\n  }),\n  z.strictObject({\n    protocol: z.literal(SsoProtocol.OIDC),\n    supported: z.literal(false),\n    message: z.string().min(1),\n  }),\n]);\n\n// ── Polymorphic Factory ──────────────────────────────────────────────\n\nexport const ssoConnectionPolymorphicFactories = createPolymorphicResourceConfigurations(\n  ssoConnectionPolymorphicDeclaration,\n  {\n    isSystemResource: true,\n    // Enterprise SSO login initiation is a PRE-AUTH flow: the enterprise OIDC\n    // authorize route (`/auth/enterprise/authorize/:orgId/:connectionId`) resolves\n    // the target connection BEFORE any user is authenticated, so the caller holds\n    // no ORG_ADMIN / APP_ADMIN role the READ ACL demands. The resolver therefore\n    // reads the connection through the sanctioned request-triggered ACL-bypass\n    // primitive (`AuthOrganizationConfigurationService.loadSsoConnectionAsSystem`\n    // → `SystemAccessService.readAsSystem`), which is fail-closed on this opt-in\n    // and audited (`SYSTEM_CONTEXT_READ`). READ and LIST are exposed to system access;\n    // connection mutation stays admin-gated over the HTTP surface. Mirrors the\n    // ORGANIZATION_MEMBERS opt-in read by `resolveActiveMemberOrgIds`.\n    //\n    // LIST is exposed for the SAME pre-auth reason as READ, one flow later. IdP-INITIATED\n    // SAML (an unsolicited assertion, or a LogoutRequest, arriving with no prior AuthnRequest)\n    // must resolve the tenant by the assertion's `<Issuer>` entityId BEFORE any user is\n    // authenticated — a cross-scope LIST over `saml.entityId`. The resolver reads it via\n    // `AuthOrganizationConfigurationService.listSsoConnectionsByEntityIdAsSystem` →\n    // `SystemAccessService.listAsSystem`. Without this opt-in, IdP-initiated login AND SLO\n    // fail closed (`SAML_UNKNOWN_IDP`) exactly as SP-initiated login did before the READ opt-in.\n    systemAccessPolicy: {\n      read: ResourceSystemAccessMode.ALLOWED,\n      list: ResourceSystemAccessMode.ALLOWED,\n    },\n    customOperation: SsoConnection_Operations,\n    coreOperations: [\n      CoreResourceOperation.READ,\n      CoreResourceOperation.LIST,\n      CoreResourceOperation.CREATE,\n      CoreResourceOperation.UPDATE,\n      CoreResourceOperation.DELETE,\n    ],\n    operationsConfiguration: {\n      [CoreResourceOperation.READ]: {\n        variants: [\n          {\n            // Service-transport default. The enterprise SSO login-initiation\n            // resolver reads a single connection PRE-AUTH via `readAsSystem`,\n            // which resolves the READ path through `getServiceOperationPathDefault`\n            // — that resolver honours INTERNAL_CALL / API_CALL defaults but NOT a\n            // REPOSITORY_ONLY-only op. Declaring an INTERNAL_CALL default (no\n            // public HTTP surface — admins list connections via the API_CALL LIST)\n            // gives the system read a resolvable service-transport path. Gated by\n            // `systemAccessPolicy.read = ALLOWED` above.\n            variantType: ResourceOperationVariantType.INTERNAL_CALL,\n            isDefault: true,\n            polymorphicRole: {\n              [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n              [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n            },\n            riskLevel: ResourceOperationRiskLevel.LOW,\n          }],\n      },\n      [CoreResourceOperation.LIST]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n            [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          },\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }],\n      },\n      // Writes are INTERNAL_CALL for the SAME reason the READ default above is: the\n      // service transport is the only tier that carries the connection's write\n      // semantics, and `getServiceOperationPathDefault` (behind every `*AsSystem`\n      // call) honours INTERNAL_CALL / API_CALL but NOT a REPOSITORY_ONLY-only op.\n      //\n      // As REPOSITORY_ONLY these three were unreachable in both directions: no system\n      // write could resolve a service op-path, AND `doOperation` throws outright on a\n      // REPOSITORY_ONLY operation, so the custom implementations carrying the actual\n      // write semantics never ran — `connectionId` minting, SAML\n      // `x509CertificatePem` → `x509Certificates` normalization, nested\n      // `oidc.clientSecret` write-only-secret preservation, and the DELETE\n      // last-connection / in-use guards. They are now reachable.\n      //\n      // Still NO public HTTP surface: only API_CALL / API_CALL_WITH_CALLBACK register\n      // routes, so the external exposure is identical to REPOSITORY_ONLY. Admins list\n      // via the API_CALL LIST and drive discovery through DISCOVER_ENDPOINTS.\n      //\n      // The `onParentDelete` cascade is unaffected — it deletes through\n      // `childRepository.delete(...)` after a `supportsOperation` check that matches on\n      // `operationIdentifier` + `isOperationDefault` only, never on `variantType`.\n      // That path still bypasses the service tier and the DELETE custom impl by design.\n      [CoreResourceOperation.CREATE]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n            [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          },\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n        }],\n      },\n      [CoreResourceOperation.UPDATE]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n            [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          },\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n        }],\n      },\n      [CoreResourceOperation.DELETE]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n            [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          },\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n        }],\n      },\n      [SsoConnection_Operations.TEST_CONNECTION]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n            [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          },\n          riskLevel: ResourceOperationRiskLevel.MEDIUM,\n          resourceOperationLike: CoreResourceOperation.READ,\n          requestDto: SsoConnection_TestConnectionRequestDto,\n          // Borrows READ for its route/verb but returns protocol-discriminated\n          // diagnostics, not the SSO-connection row.\n          customResponseDto: SsoConnection_TestConnectionResponseDto,\n        }],\n      },\n      [SsoConnection_Operations.DISCOVER_ENDPOINTS]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n            [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          },\n          riskLevel: ResourceOperationRiskLevel.MEDIUM,\n          resourceOperationLike: CoreResourceOperation.CREATE,\n          requestDto: SsoConnection_DiscoverEndpointsRequestDto,\n          // Borrows CREATE for its route/verb but returns discovered metadata,\n          // not a created or updated SSO-connection row.\n          customResponseDto: SsoConnection_DiscoverEndpointsResponseDto,\n        }],\n      },\n    },\n  },\n);\n"]}
+{"version":3,"file":"sso-connection.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../../../../src/security/authentications/sso/sso-connection.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,sDAAsD,CAAC;AAC/G,OAAO,EACL,0BAA0B,EAC1B,4BAA4B,GAC7B,MAAM,6CAA6C,CAAC;AACrD,OAAO,EAAE,wBAAwB,EAAE,MAAM,oDAAoD,CAAC;AAC9F,OAAO,EAAE,uCAAuC,EAAE,MAAM,wDAAwD,CAAC;AACjH,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,2CAA2C,CAAC;AAC3F,OAAO,EAAE,WAAW,EAAE,mCAAmC,EAAE,MAAM,iCAAiC,CAAC;AAEnG,wEAAwE;AAExE,MAAM,CAAN,IAAY,wBAGX;AAHD,WAAY,wBAAwB;IAClC,8DAAkC,CAAA;IAClC,oEAAwC,CAAA;AAC1C,CAAC,EAHW,wBAAwB,KAAxB,wBAAwB,QAGnC;AAED,0EAA0E;AAC1E,MAAM,CAAN,IAAY,8BAIX;AAJD,WAAY,8BAA8B;IACxC,+CAAa,CAAA;IACb,qDAAmB,CAAA;IACnB,+CAAa,CAAA;AACf,CAAC,EAJW,8BAA8B,KAA9B,8BAA8B,QAIzC;AAED,2EAA2E;AAC3E,MAAM,CAAN,IAAY,4BAIX;AAJD,WAAY,4BAA4B;IACtC,+DAA+B,CAAA;IAC/B,iGAAiG;IACjG,iEAAiC,CAAA;AACnC,CAAC,EAJW,4BAA4B,KAA5B,4BAA4B,QAIvC;AAED,wEAAwE;AAExE;;;;GAIG;AACH,MAAM,CAAC,MAAM,sCAAsC,GAAG,CAAC,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;AAEzE;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,yCAAyC,GAAG,CAAC,CAAC,KAAK,CAAC;IAC/D,CAAC,CAAC,YAAY,CAAC;QACb,WAAW,EAAE,CAAC;aACX,GAAG,EAAE;aACL,QAAQ,CAAC,iIAAiI,CAAC;QAC9I,SAAS,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,2EAA2E,CAAC;KACpH,CAAC;IACF,CAAC,CAAC,YAAY,CAAC;QACb,SAAS,EAAE,CAAC;aACT,GAAG,EAAE;aACL,QAAQ,CAAC,uJAAuJ,CAAC;QACpK,WAAW,EAAE,CAAC;aACX,GAAG,EAAE;aACL,QAAQ,EAAE;aACV,QAAQ,CAAC,6IAA6I,CAAC;KAC3J,CAAC;CACH,CAAC,CAAC;AAEH,MAAM,sCAAsC,GAAG,CAAC,CAAC,YAAY,CAAC;IAC5D,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,iFAAiF,CAAC;IACjI,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,CAAC,uFAAuF,CAAC;IACpH,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,uGAAuG,CAAC;IACvI,aAAa,EAAE,CAAC;SACb,MAAM,EAAE;SACR,GAAG,EAAE;SACL,QAAQ,CAAC,sHAAsH,CAAC;IACnI,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,gFAAgF,CAAC;IAChH,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,8GAA8G,CAAC;IAChJ,QAAQ,EAAE,CAAC;SACR,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;SACjB,QAAQ,CAAC,4HAA4H,CAAC;CAC1I,CAAC,CAAC;AAEH;;;;GAIG;AACH,MAAM,CAAC,MAAM,uCAAuC,GAAG,CAAC,CAAC,kBAAkB,CAAC,UAAU,EAAE;IACtF,CAAC,CAAC,YAAY,CAAC;QACb,QAAQ,EAAE,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC;QACrC,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,oCAAoC,CAAC;QACzE,kBAAkB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,CAAC,qEAAqE,CAAC;QAC/G;;;;;;WAMG;QACH,eAAe,EAAE,CAAC;aACf,OAAO,EAAE;aACT,QAAQ,EAAE;aACV,QAAQ,CACP,yQAAyQ,CAC1Q;QACH,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,2EAA2E,CAAC;QAC/H,YAAY,EAAE,CAAC;aACZ,KAAK,CAAC,sCAAsC,CAAC;aAC7C,QAAQ,CAAC,mGAAmG,CAAC;QAChH,uEAAuE;QACvE,eAAe,EAAE,CAAC;aACf,OAAO,EAAE;aACT,QAAQ,EAAE;aACV,QAAQ,CAAC,8IAA8I,CAAC;QAC3J,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,oGAAoG,CAAC;QACxJ,eAAe,EAAE,CAAC;aACf,OAAO,EAAE;aACT,QAAQ,CAAC,oLAAoL,CAAC;QACjM,aAAa,EAAE,CAAC;aACb,IAAI,CAAC,8BAA8B,CAAC;aACpC,QAAQ,CAAC,iHAAiH,CAAC;QAC9H,MAAM,EAAE,CAAC;aACN,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;aACjB,QAAQ,CAAC,mIAAmI,CAAC;QAChJ,QAAQ,EAAE,CAAC;aACR,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;aACjB,QAAQ,CAAC,wIAAwI,CAAC;KACtJ,CAAC;IACF,CAAC,CAAC,YAAY,CAAC;QACb,QAAQ,EAAE,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC;QACrC,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,sFAAsF,CAAC;QAC5H,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,+BAA+B,CAAC;KACrE,CAAC;CACH,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,CAAC,MAAM,0CAA0C,GAAG,CAAC,CAAC,kBAAkB,CAAC,UAAU,EAAE;IACzF,CAAC,CAAC,YAAY,CAAC;QACb,QAAQ,EAAE,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC;QACrC,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,4CAA4C,CAAC;QACjF,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,uDAAuD,CAAC;QAC7F,MAAM,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,gEAAgE,CAAC;QAC1F,MAAM,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,4EAA4E,CAAC;QACjH,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC,gEAAgE,CAAC;QAChH,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,2FAA2F,CAAC;QACzI,MAAM,EAAE,CAAC;aACN,OAAO,CAAC,4BAA4B,CAAC,aAAa,CAAC;aACnD,QAAQ,CAAC,4EAA4E,CAAC;KAC1F,CAAC;IACF;;;;;;;;OAQG;IACH,CAAC,CAAC,YAAY,CAAC;QACb,QAAQ,EAAE,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC;QACrC,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,sDAAsD,CAAC;QAC3F,MAAM,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,iKAAiK,CAAC;QAC3L,qBAAqB,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,wCAAwC,CAAC;QACjF,aAAa,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,gCAAgC,CAAC;QACjE,gBAAgB,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,mEAAmE,CAAC;QAClH,OAAO,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,sEAAsE,CAAC;QACjG,kBAAkB,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,iEAAiE,CAAC;QAClH,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,yEAAyE,CAAC;QACnI,MAAM,EAAE,CAAC;aACN,OAAO,CAAC,4BAA4B,CAAC,cAAc,CAAC;aACpD,QAAQ,CAAC,yGAAyG,CAAC;KACvH,CAAC;CACH,CAAC,CAAC;AAEH,wEAAwE;AAExE,MAAM,CAAC,MAAM,iCAAiC,GAAG,uCAAuC,CACtF,mCAAmC,EACnC;IACE,gBAAgB,EAAE,IAAI;IACtB,0EAA0E;IAC1E,+EAA+E;IAC/E,8EAA8E;IAC9E,6EAA6E;IAC7E,2EAA2E;IAC3E,8EAA8E;IAC9E,6EAA6E;IAC7E,mFAAmF;IACnF,2EAA2E;IAC3E,mEAAmE;IACnE,EAAE;IACF,sFAAsF;IACtF,2FAA2F;IAC3F,oFAAoF;IACpF,qFAAqF;IACrF,gFAAgF;IAChF,uFAAuF;IACvF,6FAA6F;IAC7F,kBAAkB,EAAE;QAClB,IAAI,EAAE,wBAAwB,CAAC,OAAO;QACtC,IAAI,EAAE,wBAAwB,CAAC,OAAO;KACvC;IACD,eAAe,EAAE,wBAAwB;IACzC,cAAc,EAAE;QACd,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;KAC7B;IACD,uBAAuB,EAAE;QACvB,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,iEAAiE;oBACjE,kEAAkE;oBAClE,wEAAwE;oBACxE,sEAAsE;oBACtE,kEAAkE;oBAClE,uEAAuE;oBACvE,sEAAsE;oBACtE,6CAA6C;oBAC7C,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aAAC;SACL;QACD,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,6BAA6B,CAAC;wBAC1G,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C,CAAC;SACH;QACD,8EAA8E;QAC9E,yEAAyE;QACzE,4EAA4E;QAC5E,4EAA4E;QAC5E,EAAE;QACF,gFAAgF;QAChF,gFAAgF;QAChF,+EAA+E;QAC/E,2DAA2D;QAC3D,kEAAkE;QAClE,qEAAqE;QACrE,2DAA2D;QAC3D,EAAE;QACF,gFAAgF;QAChF,gFAAgF;QAChF,wEAAwE;QACxE,EAAE;QACF,kEAAkE;QAClE,kFAAkF;QAClF,6EAA6E;QAC7E,kFAAkF;QAClF,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,IAAI;iBAC3C,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,IAAI;iBAC3C,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,IAAI;iBAC3C,CAAC;SACH;QACD,CAAC,wBAAwB,CAAC,eAAe,CAAC,EAAE;YAC1C,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,6BAA6B,CAAC;wBAC1G,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,qBAAqB,EAAE,qBAAqB,CAAC,IAAI;oBACjD,UAAU,EAAE,sCAAsC;oBAClD,qEAAqE;oBACrE,2CAA2C;oBAC3C,iBAAiB,EAAE,uCAAuC;iBAC3D,CAAC;SACH;QACD,CAAC,wBAAwB,CAAC,kBAAkB,CAAC,EAAE;YAC7C,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,6BAA6B,CAAC;wBAC1G,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,yCAAyC;oBACrD,qEAAqE;oBACrE,+CAA+C;oBAC/C,iBAAiB,EAAE,0CAA0C;iBAC9D,CAAC;SACH;KACF;CACF,CACF,CAAC","sourcesContent":["/**\n * SSO Connection Resource Configuration — Polymorphic\n *\n * Produces 2 factory functions (ORG + APP) via the polymorphic factory.\n * Spread into the registry factory map:\n *   ...ssoConnectionPolymorphicFactories\n */\n\nimport { z } from 'zod';\nimport { CoreResourceOperation, CoreResourceType } from '../../../resources/resources.shared.core.definitions';\nimport {\n  ResourceOperationRiskLevel,\n  ResourceOperationVariantType,\n} from '../../../resources/resources.shared.schemas';\nimport { ResourceSystemAccessMode } from '../../../resources/resources-config.shared.schemas';\nimport { createPolymorphicResourceConfigurations } from '../../../resources/utils/resource-polymorphism.factory';\nimport { CORE_ORG_ROLES, CORE_APP_ROLES } from '../../authorizations/roles.shared.schemas';\nimport { SsoProtocol, ssoConnectionPolymorphicDeclaration } from './sso-connection.shared.schemas';\n\n// ── Custom Operations ────────────────────────────────────────────────\n\nexport enum SsoConnection_Operations {\n  TEST_CONNECTION = 'testConnection',\n  DISCOVER_ENDPOINTS = 'discoverEndpoints',\n}\n\n/** Final SAML diagnostic posture after all configured checks complete. */\nexport enum SsoConnectionTestOverallStatus {\n  PASS = 'pass',\n  WARNING = 'warning',\n  FAIL = 'fail',\n}\n\n/** Evidence source that produced a supported endpoint-discovery result. */\nexport enum SsoConnectionDiscoverySource {\n  SAML_METADATA = 'saml-metadata',\n  /** The OpenID Provider's `/.well-known/openid-configuration` document at `issuerUrl` (#1800). */\n  OIDC_DISCOVERY = 'oidc-discovery',\n}\n\n// ── Request DTOs ─────────────────────────────────────────────────────\n\n/**\n * TEST_CONNECTION addresses the connection through the resource URL. It has no\n * independent query/body input: accepting a second `connectionId` let callers\n * provide two identities while the service always used `utils.currentObject`.\n */\nexport const SsoConnection_TestConnectionRequestDto = z.strictObject({});\n\n/**\n * Metadata discovery needs at least one protocol-specific source. The union\n * makes that invariant visible in generated JSON Schema (`anyOf`) as well as at\n * runtime. `metadataUrl` discovers a SAML provider and `issuerUrl` an OpenID\n * Connect one; an object with both remains valid and SAML metadata takes\n * precedence, since the two describe different connections and the operation\n * answers one protocol.\n */\nexport const SsoConnection_DiscoverEndpointsRequestDto = z.union([\n  z.strictObject({\n    metadataUrl: z\n      .url()\n      .describe(\"The URL of the identity provider's SAML metadata document. The server fetches and reads it; nothing is saved to the connection.\"),\n    issuerUrl: z.url().optional().describe(\"An OpenID Connect provider's issuer. Ignored when `metadataUrl` is given.\"),\n  }),\n  z.strictObject({\n    issuerUrl: z\n      .url()\n      .describe(\"An OpenID Connect provider's issuer. The server fetches `<issuer>/.well-known/openid-configuration` and reads it; nothing is saved to the connection.\"),\n    metadataUrl: z\n      .url()\n      .optional()\n      .describe(\"The URL of the identity provider's SAML metadata document. When given, the server fetches and reads it; nothing is saved to the connection.\"),\n  }),\n]);\n\nconst SsoConnection_CertificateTestResultDto = z.strictObject({\n  index: z.number().int().nonnegative().describe(\"The certificate's position in the connection's certificate list, starting at 0.\"),\n  valid: z.boolean().describe('`true` when the certificate could be read and today falls within its validity period.'),\n  expiresAt: z.string().describe('When the certificate expires, as an ISO 8601 date-time. Empty when the certificate could not be read.'),\n  daysRemaining: z\n    .number()\n    .int()\n    .describe('Whole days until the certificate expires; negative once it has expired. `-1` when the certificate could not be read.'),\n  algorithm: z.string().describe(\"The certificate's signature algorithm, or `unknown` when it is not recognised.\"),\n  fingerprint: z.string().describe(\"The certificate's SHA-256 fingerprint, as colon-separated hex. Empty when the certificate could not be read.\"),\n  warnings: z\n    .array(z.string())\n    .describe('Problems found with this certificate: expired or not yet valid, expiring within 30 days, a SHA-1 signature, or unreadable.'),\n});\n\n/**\n * Protocol-discriminated result for TEST_CONNECTION. SAML diagnostics are a\n * real implementation; OIDC deliberately reports its unavailable test path as\n * data instead of returning an ambiguous `{ message }` success payload.\n */\nexport const SsoConnection_TestConnectionResponseDto = z.discriminatedUnion('protocol', [\n  z.strictObject({\n    protocol: z.literal(SsoProtocol.SAML),\n    supported: z.literal(true).describe('`true`: the connection was tested.'),\n    entityIdConfigured: z.boolean().describe(\"Whether the identity provider's entity ID is set on the connection.\"),\n    /**\n     * Did the server's probe reach the SSO URL? ABSENT when the server was not allowed to probe it — the\n     * outbound-target guard refused the destination (a private address the operator has not declared in\n     * `auth.federatedIdentityProviderPrivateNetworks`). Neither `true` nor `false` would be a statement\n     * about the endpoint then: SAML sign-in reaches it through the user's browser, so a private IdP the\n     * server may not address can still be a working SSO URL. The reason is carried in `warnings` (#516).\n     */\n    ssoUrlReachable: z\n      .boolean()\n      .optional()\n      .describe(\n        \"Whether the server got an HTTP response from the SSO URL, whatever its status. `false` when it did not answer or no SSO URL is set. Absent when the server may not connect to that address, because sign-in reaches it through the user's browser; `warnings` says why.\",\n      ),\n    ssoUrlStatus: z.number().int().optional().describe('The HTTP status the SSO URL answered with. Absent when it did not answer.'),\n    certificates: z\n      .array(SsoConnection_CertificateTestResultDto)\n      .describe(\"One result per X.509 certificate configured for the identity provider, in the connection's order.\"),\n    /** As `ssoUrlReachable`; also absent when no SLO URL is configured. */\n    sloUrlReachable: z\n      .boolean()\n      .optional()\n      .describe('Whether the server got an HTTP response from the single-logout URL, checked like `ssoUrlReachable`. Absent when no single-logout URL is set.'),\n    sloUrlStatus: z.number().int().optional().describe('The HTTP status the single-logout URL answered with. Absent when it did not answer or none is set.'),\n    spMetadataValid: z\n      .boolean()\n      .describe(\"Whether this application can generate valid service-provider metadata for the connection. `false` means the application's own SAML settings are incomplete, reported as a warning.\"),\n    overallStatus: z\n      .enum(SsoConnectionTestOverallStatus)\n      .describe('The verdict: `fail` when there is at least one error, `warning` when there are only warnings, `pass` otherwise.'),\n    errors: z\n      .array(z.string())\n      .describe('Problems that stop sign-in from working, such as a missing entity ID or SSO URL, an unreachable SSO URL, or no valid certificate.'),\n    warnings: z\n      .array(z.string())\n      .describe('Problems worth fixing that do not by themselves stop sign-in, such as a certificate expiring soon or an unreachable single-logout URL.'),\n  }),\n  z.strictObject({\n    protocol: z.literal(SsoProtocol.OIDC),\n    supported: z.literal(false).describe('`false`: OpenID Connect connections cannot be tested yet, and nothing was attempted.'),\n    message: z.string().min(1).describe('Explains why no test was run.'),\n  }),\n]);\n\n/**\n * Protocol-discriminated result for DISCOVER_ENDPOINTS. The operation returns\n * discovered metadata only; it never persists or enriches a connection row.\n */\nexport const SsoConnection_DiscoverEndpointsResponseDto = z.discriminatedUnion('protocol', [\n  z.strictObject({\n    protocol: z.literal(SsoProtocol.SAML),\n    supported: z.literal(true).describe('`true`: the metadata was fetched and read.'),\n    entityId: z.string().min(1).describe(\"The identity provider's entity ID, from the metadata.\"),\n    ssoUrl: z.url().describe(\"The identity provider's single sign-on URL, from the metadata.\"),\n    sloUrl: z.url().optional().describe(\"The identity provider's single-logout URL, when the metadata declares one.\"),\n    x509Certificates: z.array(z.string()).describe(\"The identity provider's X.509 certificates, from the metadata.\"),\n    nameIdFormat: z.string().optional().describe('The name identifier format the identity provider declares, when the metadata carries one.'),\n    source: z\n      .literal(SsoConnectionDiscoverySource.SAML_METADATA)\n      .describe('Where these values came from: the SAML metadata document at `metadataUrl`.'),\n  }),\n  /*\n   * OpenID Connect discovery (#1800). `issuerUrl` was accepted and never read: the operation answered\n   * `supported: false` whatever it said. The field names are the connection's own `oidc.*` names, so a\n   * form can merge the result straight into a connection, as the SAML wizard does with `saml.*`.\n   *\n   * A failed discovery is a 400 (`oidc_discovery_failed`) naming why — not an HTTPS issuer, unreachable,\n   * not a JSON object, a required endpoint missing, or an issuer the document does not assert — rather\n   * than a response member, exactly as a SAML metadata failure is.\n   */\n  z.strictObject({\n    protocol: z.literal(SsoProtocol.OIDC),\n    supported: z.literal(true).describe('`true`: the discovery document was fetched and read.'),\n    issuer: z.url().describe(\"The provider's issuer exactly as its discovery document publishes it. An ID token's `iss` claim must equal this string, so store it as `oidc.issuer` unchanged.\"),\n    authorizationEndpoint: z.url().describe(\"The provider's authorization endpoint.\"),\n    tokenEndpoint: z.url().describe(\"The provider's token endpoint.\"),\n    userInfoEndpoint: z.url().optional().describe(\"The provider's userinfo endpoint, when the document declares one.\"),\n    jwksUri: z.url().describe('Where the provider publishes the keys its ID tokens are signed with.'),\n    endSessionEndpoint: z.url().optional().describe(\"The provider's logout endpoint, when the document declares one.\"),\n    scopesSupported: z.array(z.string()).optional().describe('The scopes the provider says it supports, when the document lists them.'),\n    source: z\n      .literal(SsoConnectionDiscoverySource.OIDC_DISCOVERY)\n      .describe(\"Where these values came from: the discovery document at `<issuerUrl>/.well-known/openid-configuration`.\"),\n  }),\n]);\n\n// ── Polymorphic Factory ──────────────────────────────────────────────\n\nexport const ssoConnectionPolymorphicFactories = createPolymorphicResourceConfigurations(\n  ssoConnectionPolymorphicDeclaration,\n  {\n    isSystemResource: true,\n    // Enterprise SSO login initiation is a PRE-AUTH flow: the enterprise OIDC\n    // authorize route (`/auth/enterprise/authorize/:orgId/:connectionId`) resolves\n    // the target connection BEFORE any user is authenticated, so the caller holds\n    // no ORG_ADMIN / APP_ADMIN role the READ ACL demands. The resolver therefore\n    // reads the connection through the sanctioned request-triggered ACL-bypass\n    // primitive (`AuthOrganizationConfigurationService.loadSsoConnectionAsSystem`\n    // → `SystemAccessService.readAsSystem`), which is fail-closed on this opt-in\n    // and audited (`SYSTEM_CONTEXT_READ`). READ and LIST are exposed to system access;\n    // connection mutation stays admin-gated over the HTTP surface. Mirrors the\n    // ORGANIZATION_MEMBERS opt-in read by `resolveActiveMemberOrgIds`.\n    //\n    // LIST is exposed for the SAME pre-auth reason as READ, one flow later. IdP-INITIATED\n    // SAML (an unsolicited assertion, or a LogoutRequest, arriving with no prior AuthnRequest)\n    // must resolve the tenant by the assertion's `<Issuer>` entityId BEFORE any user is\n    // authenticated — a cross-scope LIST over `saml.entityId`. The resolver reads it via\n    // `AuthOrganizationConfigurationService.listSsoConnectionsByEntityIdAsSystem` →\n    // `SystemAccessService.listAsSystem`. Without this opt-in, IdP-initiated login AND SLO\n    // fail closed (`SAML_UNKNOWN_IDP`) exactly as SP-initiated login did before the READ opt-in.\n    systemAccessPolicy: {\n      read: ResourceSystemAccessMode.ALLOWED,\n      list: ResourceSystemAccessMode.ALLOWED,\n    },\n    customOperation: SsoConnection_Operations,\n    coreOperations: [\n      CoreResourceOperation.READ,\n      CoreResourceOperation.LIST,\n      CoreResourceOperation.CREATE,\n      CoreResourceOperation.UPDATE,\n      CoreResourceOperation.DELETE,\n    ],\n    operationsConfiguration: {\n      [CoreResourceOperation.READ]: {\n        variants: [\n          {\n            // Service-transport default. The enterprise SSO login-initiation\n            // resolver reads a single connection PRE-AUTH via `readAsSystem`,\n            // which resolves the READ path through `getServiceOperationPathDefault`\n            // — that resolver honours INTERNAL_CALL / API_CALL defaults but NOT a\n            // REPOSITORY_ONLY-only op. Declaring an INTERNAL_CALL default (no\n            // public HTTP surface — admins list connections via the API_CALL LIST)\n            // gives the system read a resolvable service-transport path. Gated by\n            // `systemAccessPolicy.read = ALLOWED` above.\n            variantType: ResourceOperationVariantType.INTERNAL_CALL,\n            isDefault: true,\n            polymorphicRole: {\n              [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n              [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n            },\n            riskLevel: ResourceOperationRiskLevel.LOW,\n          }],\n      },\n      [CoreResourceOperation.LIST]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN, CORE_ORG_ROLES.ORG_DELEGATED_MANAGE_SSO_SCIM],\n            [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          },\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }],\n      },\n      // Writes are INTERNAL_CALL for the SAME reason the READ default above is: the\n      // service transport is the only tier that carries the connection's write\n      // semantics, and `getServiceOperationPathDefault` (behind every `*AsSystem`\n      // call) honours INTERNAL_CALL / API_CALL but NOT a REPOSITORY_ONLY-only op.\n      //\n      // As REPOSITORY_ONLY these three were unreachable in both directions: no system\n      // write could resolve a service op-path, AND `doOperation` throws outright on a\n      // REPOSITORY_ONLY operation, so the custom implementations carrying the actual\n      // write semantics never ran — `connectionId` minting, SAML\n      // `x509CertificatePem` → `x509Certificates` normalization, nested\n      // `oidc.clientSecret` write-only-secret preservation, and the DELETE\n      // last-connection / in-use guards. They are now reachable.\n      //\n      // Still NO public HTTP surface: only API_CALL / API_CALL_WITH_CALLBACK register\n      // routes, so the external exposure is identical to REPOSITORY_ONLY. Admins list\n      // via the API_CALL LIST and drive discovery through DISCOVER_ENDPOINTS.\n      //\n      // The `onParentDelete` cascade is unaffected — it deletes through\n      // `childRepository.delete(...)` after a `supportsOperation` check that matches on\n      // `operationIdentifier` + `isOperationDefault` only, never on `variantType`.\n      // That path still bypasses the service tier and the DELETE custom impl by design.\n      [CoreResourceOperation.CREATE]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n            [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          },\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n        }],\n      },\n      [CoreResourceOperation.UPDATE]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n            [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          },\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n        }],\n      },\n      [CoreResourceOperation.DELETE]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n            [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          },\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n        }],\n      },\n      [SsoConnection_Operations.TEST_CONNECTION]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN, CORE_ORG_ROLES.ORG_DELEGATED_MANAGE_SSO_SCIM],\n            [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          },\n          riskLevel: ResourceOperationRiskLevel.MEDIUM,\n          resourceOperationLike: CoreResourceOperation.READ,\n          requestDto: SsoConnection_TestConnectionRequestDto,\n          // Borrows READ for its route/verb but returns protocol-discriminated\n          // diagnostics, not the SSO-connection row.\n          customResponseDto: SsoConnection_TestConnectionResponseDto,\n        }],\n      },\n      [SsoConnection_Operations.DISCOVER_ENDPOINTS]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN, CORE_ORG_ROLES.ORG_DELEGATED_MANAGE_SSO_SCIM],\n            [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          },\n          riskLevel: ResourceOperationRiskLevel.MEDIUM,\n          resourceOperationLike: CoreResourceOperation.CREATE,\n          requestDto: SsoConnection_DiscoverEndpointsRequestDto,\n          // Borrows CREATE for its route/verb but returns discovered metadata,\n          // not a created or updated SSO-connection row.\n          customResponseDto: SsoConnection_DiscoverEndpointsResponseDto,\n        }],\n      },\n    },\n  },\n);\n"]}

package/dist/esm/security/authentications/sso/sso-connection.shared.schemas.d.ts

@@ -80,11 +80,6 @@ export declare const SsoConnectionBaseSchema: z.ZodObject<{
             readonly TRANSIENT: "urn:oasis:names:tc:SAML:2.0:nameid-format:transient";
         }>>>;
         allowIdpInitiated: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodBoolean>>;
-        auditSettings: z.ZodObject<{
-            logAuthAttempts: z.ZodDefault<z.ZodBoolean>;
-            logAttributeMapping: z.ZodDefault<z.ZodBoolean>;
-            retentionDays: z.ZodDefault<z.ZodNumber>;
-        }, z.core.$strip>;
     }, z.core.$strip>>;
     oidc: z.ZodOptional<z.ZodObject<{
         templateMode: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodEnum<{
@@ -138,15 +133,8 @@ export declare const SsoConnectionBaseSchema: z.ZodObject<{
             readonly S256: "S256";
             readonly PLAIN: "plain";
         }>>>;
-        auditSettings: z.ZodObject<{
-            logAuthAttempts: z.ZodDefault<z.ZodBoolean>;
-            logTokenExchange: z.ZodDefault<z.ZodBoolean>;
-            logClaimsMapping: z.ZodDefault<z.ZodBoolean>;
-            retentionDays: z.ZodDefault<z.ZodNumber>;
-        }, z.core.$strip>;
     }, z.core.$strip>>;
     autoCreateUsers: z.ZodDefault<z.ZodBoolean>;
-    autoVerifyEmail: z.ZodDefault<z.ZodBoolean>;
     defaultRole: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodString>>;
     allowedDomains: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodArray<z.ZodString>>>>;
     allowedDirectoryIds: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodArray<z.ZodString>>>;
@@ -191,11 +179,6 @@ export declare const ssoConnectionPolymorphicDeclaration: import("../../..").Pol
             readonly TRANSIENT: "urn:oasis:names:tc:SAML:2.0:nameid-format:transient";
         }>>>;
         allowIdpInitiated: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodBoolean>>;
-        auditSettings: z.ZodObject<{
-            logAuthAttempts: z.ZodDefault<z.ZodBoolean>;
-            logAttributeMapping: z.ZodDefault<z.ZodBoolean>;
-            retentionDays: z.ZodDefault<z.ZodNumber>;
-        }, z.core.$strip>;
     }, z.core.$strip>>;
     oidc: z.ZodOptional<z.ZodObject<{
         templateMode: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodEnum<{
@@ -249,15 +232,8 @@ export declare const ssoConnectionPolymorphicDeclaration: import("../../..").Pol
             readonly S256: "S256";
             readonly PLAIN: "plain";
         }>>>;
-        auditSettings: z.ZodObject<{
-            logAuthAttempts: z.ZodDefault<z.ZodBoolean>;
-            logTokenExchange: z.ZodDefault<z.ZodBoolean>;
-            logClaimsMapping: z.ZodDefault<z.ZodBoolean>;
-            retentionDays: z.ZodDefault<z.ZodNumber>;
-        }, z.core.$strip>;
     }, z.core.$strip>>;
     autoCreateUsers: z.ZodDefault<z.ZodBoolean>;
-    autoVerifyEmail: z.ZodDefault<z.ZodBoolean>;
     defaultRole: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodString>>;
     allowedDomains: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodArray<z.ZodString>>>>;
     allowedDirectoryIds: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodArray<z.ZodString>>>;

package/dist/esm/security/authentications/sso/sso-connection.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sso-connection.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../../../src/security/authentications/sso/sso-connection.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,2EAA2E;AAC3E,oBAAY,WAAW;IACrB,IAAI,SAAS;IACb,IAAI,SAAS;CACd;AAED,eAAO,MAAM,eAAe;;;;CAIlB,CAAC;AAEX,eAAO,MAAM,eAAe;;;;CAIlB,CAAC;AAEX,eAAO,MAAM,eAAe;;;;CAIlB,CAAC;AAEX,eAAO,MAAM,SAAS;;;;;CAKZ,CAAC;AAEX,eAAO,MAAM,aAAa;;;CAGhB,CAAC;AAEX,eAAO,MAAM,gBAAgB;;;;;CAKnB,CAAC;AAEX,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAqPlC,CAAC;AAMH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE,eAAO,MAAM,mCAAmC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAQ9C,CAAC"}
+{"version":3,"file":"sso-connection.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../../../src/security/authentications/sso/sso-connection.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,2EAA2E;AAC3E,oBAAY,WAAW;IACrB,IAAI,SAAS;IACb,IAAI,SAAS;CACd;AAED,eAAO,MAAM,eAAe;;;;CAIlB,CAAC;AAEX,eAAO,MAAM,eAAe;;;;CAIlB,CAAC;AAEX,eAAO,MAAM,eAAe;;;;CAIlB,CAAC;AAEX,eAAO,MAAM,SAAS;;;;;CAKZ,CAAC;AAEX,eAAO,MAAM,aAAa;;;CAGhB,CAAC;AAEX,eAAO,MAAM,gBAAgB;;;;;CAKnB,CAAC;AAEX,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAgQlC,CAAC;AAMH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE,eAAO,MAAM,mCAAmC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAQ9C,CAAC"}