@wildo-ai/saas-models 1.1.5 → 1.1.6

package/dist/esm/security/authentications/sso/sso-connection.shared.schemas.js

@@ -60,7 +60,14 @@ export const SsoConnectionBaseSchema = z.object({
     // assurance-control: WILDO.IDENTITY.SESSION_ASSURANCE — the live/dead switch and the default IdP
     // decide which identity provider is trusted to authenticate this tenant.
     enabled: z.boolean().default(true).isSummaryField().isAuditEvidence(),
-    isDefault: z.boolean().default(false).isAuditEvidence(),
+    // Read by `selectSsoConnectionForRouting` (#1800): among the eligible connections equally specific to
+    // the signing-in user's domain, the default receives the sign-in. A write that makes one connection
+    // the default demotes the scope's others in the same transaction.
+    isDefault: z
+        .boolean()
+        .default(false)
+        .isAuditEvidence()
+        .describe("Whether sign-ins go to this connection when several of this organization's connections could take them. A connection that names the user's email domain in `allowedDomains` still wins over a default that accepts any domain. Making a connection the default removes the flag from the others."),
     // `.isAuditEvidence()` on the SAML leaves below — they say WHERE this connection federates
     // (`entityId` / `ssoUrl` / `sloUrl`) and HOW strictly it validates the IdP (`signRequests`,
     // `wantAssertionsSigned`, `allowedClockDrift`, `forceAuthn`, `maxAuthAge`, `nameIdFormat`,
@@ -68,33 +75,33 @@ export const SsoConnectionBaseSchema = z.object({
     // assertions — an authentication-assurance change the field NAME alone cannot evidence — so a
     // reviewer must see the before/after value. Marked per LEAF, never on the `saml` container: the
     // certificate material (`x509Certificates` / `x509CertificatePem`) sits beside these and marking the
-    // container would copy key material into an unerasable ledger. The two-level `attributeMapping` /
-    // `auditSettings` leaves are deliberately NOT marked — the evidence resolver reaches one level of
-    // nesting only, so a marker there would be inert.
+    // container would copy key material into an unerasable ledger. The two-level `attributeMapping`
+    // leaves are deliberately NOT marked — the evidence resolver reaches one level of nesting only, so a
+    // marker there would be inert.
     // assurance-control: WILDO.IDENTITY.SESSION_ASSURANCE — the IdP endpoints and signature/replay
     // validation posture decide which provider is trusted to authenticate this tenant and whether its
     // assertions are actually verified.
     saml: z.object({
-        entityId: z.string().min(1).isAuditEvidence(),
-        ssoUrl: z.url().isAuditEvidence(),
-        sloUrl: z.url().optional().isAuditEvidence(),
+        entityId: z.string().min(1).isAuditEvidence().describe("The identity provider's SAML entity ID: the issuer its assertions name, and how a sign-in the provider starts is matched to this connection."),
+        ssoUrl: z.url().isAuditEvidence().describe("The identity provider's single sign-on endpoint, where the application sends a sign-in request."),
+        sloUrl: z.url().optional().isAuditEvidence().describe("The identity provider's single logout endpoint. Absent when the provider offers none."),
         /** Frontend input: PEM-encoded certificate(s). Backend transforms to x509Certificates. */
-        x509CertificatePem: z.string().min(1).optional(),
+        x509CertificatePem: z.string().min(1).optional().describe("The identity provider's signing certificate or certificates, PEM-encoded, used to verify its signatures. Accepted on create and update, and stored parsed as `x509Certificates`, which no response includes."),
         x509Certificates: z.array(z.string()).min(1).isBackendOnly(),
         attributeMapping: z.object({
-            email: z.string().default('http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress'),
-            firstName: z.string().default('http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname'),
-            lastName: z.string().default('http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname'),
-            roles: z.string().optional(),
-            department: z.string().optional(),
-            employeeId: z.string().optional(),
-            groups: z.string().optional(),
-        }),
-        signRequests: z.boolean().default(true).isAuditEvidence(),
-        wantAssertionsSigned: z.boolean().default(true).isAuditEvidence(),
-        allowedClockDrift: z.number().min(0).max(300).default(30).isAuditEvidence(),
-        forceAuthn: z.boolean().default(false).isAuditEvidence(),
-        maxAuthAge: z.number().min(0).optional().isAuditEvidence(),
+            email: z.string().default('http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress').describe("The name of the SAML attribute carrying the user's email address."),
+            firstName: z.string().default('http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname').describe("The name of the SAML attribute carrying the user's first name."),
+            lastName: z.string().default('http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname').describe("The name of the SAML attribute carrying the user's last name."),
+            roles: z.string().optional().describe("The name of the SAML attribute carrying the user's roles, which `roleMapping` translates into application roles."),
+            department: z.string().optional().describe("The name of the SAML attribute carrying the user's department."),
+            employeeId: z.string().optional().describe("The name of the SAML attribute carrying the user's employee ID."),
+            groups: z.string().optional().describe("The name of the SAML attribute carrying the user's group memberships."),
+        }).describe('Which SAML attribute carries each user detail. A detail with no attribute named is not read.'),
+        signRequests: z.boolean().default(true).isAuditEvidence().describe('Whether the application signs the sign-in requests it sends to the identity provider.'),
+        wantAssertionsSigned: z.boolean().default(true).isAuditEvidence().describe('Whether an assertion must be signed to be accepted.'),
+        allowedClockDrift: z.number().min(0).max(300).default(30).isAuditEvidence().describe("How far, in seconds, the identity provider's clock may differ from the application's when an assertion's validity times and authentication instant are checked."),
+        forceAuthn: z.boolean().default(false).isAuditEvidence().describe('Whether every sign-in asks the identity provider to authenticate the person afresh rather than reuse its own session (`ForceAuthn`).'),
+        maxAuthAge: z.number().min(0).optional().isAuditEvidence().describe("The oldest, in seconds, the identity provider's own authentication may be: an assertion whose `AuthnInstant` is older is refused. Absent means no limit."),
         /**
          * Whether a person linked through this connection may confirm it is them by signing in again here
          * (#1441), when adding or removing a way to sign in. Off by default, like the OIDC flag.
@@ -111,14 +118,18 @@ export const SsoConnectionBaseSchema = z.object({
          * `AuthnInstant [Required]`, fetched 2026-09-21 from
          * https://docs.oasis-open.org/security/saml/v2.0/saml-core-2.0-os.pdf
          */
-        reAuthenticationEnabled: z.boolean().default(false).isAuditEvidence(),
-        nameIdFormat: z.enum(SamlNameIdFormat).default(SamlNameIdFormat.EMAIL_ADDRESS).isAuditEvidence(),
-        allowIdpInitiated: z.boolean().default(false).isAuditEvidence(),
-        auditSettings: z.object({
-            logAuthAttempts: z.boolean().default(true),
-            logAttributeMapping: z.boolean().default(true),
-            retentionDays: z.number().min(1).max(2555).default(90),
-        }),
+        reAuthenticationEnabled: z.boolean().default(false).isAuditEvidence().describe('Whether a person linked through this connection may confirm it is them by signing in here again, when adding or removing a way to sign in. Turn it on only for a provider that honours `ForceAuthn`.'),
+        nameIdFormat: z.enum(SamlNameIdFormat).default(SamlNameIdFormat.EMAIL_ADDRESS).isAuditEvidence().describe("The NameID format the application asks the identity provider to use for the person's identifier."),
+        allowIdpInitiated: z.boolean().default(false).isAuditEvidence().describe('Whether a sign-in the identity provider starts, with no request from the application, is accepted. Single logout the provider starts is accepted either way.'),
+        /*
+         * NO `auditSettings` (`logAuthAttempts` / `logAttributeMapping` / `retentionDays`), here or on the
+         * OIDC block. They were stored, shown on the settings screen, and read by nothing, so an
+         * administrator could switch authentication logging off or shorten its retention and nothing
+         * happened (#1768). Removed rather than wired, like #419 and #1236: every sign-in is recorded on the
+         * application's audit trail whatever a connection says, which is intended — a tenant switch that
+         * turns off its own authentication logging would weaken the evidence the audit trail exists for —
+         * and how long rows are kept is the application's retention schedule, not a per-connection number.
+         */
     }).optional(),
     // `.isAuditEvidence()` on the OIDC leaves below — like the SAML block, they say WHERE this connection
     // federates (`discoveryUrl` / `issuer` / the four endpoints / `jwksUri` / `endSessionEndpoint` /
@@ -128,21 +139,20 @@ export const SsoConnectionBaseSchema = z.object({
     // `issuer` / `jwksUri`, silently breaks the token trust chain, so a reviewer must see the
     // before/after — and so does a change to `acrValues`, which is an authentication-strength
     // requirement placed on the identity provider. `clientSecret` is NEVER marked (it is
-    // a write-only secret); `claimsMapping` / `auditSettings` are two-level and out of the resolver's
-    // one-level reach.
+    // a write-only secret); `claimsMapping` is two-level and out of the resolver's one-level reach.
     // assurance-control: WILDO.IDENTITY.SESSION_ASSURANCE — the OIDC endpoints, issuer and token-
     // validation posture decide which provider is trusted and whether its tokens are actually verified.
     oidc: z.object({
-        templateMode: z.enum(SSOTemplateMode).default(SSOTemplateMode.MANUAL).isAuditEvidence(),
-        templateOverrides: z.record(z.string(), z.string()).optional().isAuditEvidence(),
-        customScopes: z.array(z.string()).optional().isAuditEvidence(),
-        discoveryUrl: z.url().optional().isAuditEvidence(),
-        issuer: z.url().optional().isAuditEvidence(),
-        authorizationEndpoint: z.url().optional().isAuditEvidence(),
-        tokenEndpoint: z.url().optional().isAuditEvidence(),
-        userInfoEndpoint: z.url().optional().isAuditEvidence(),
-        jwksUri: z.url().optional().isAuditEvidence(),
-        endSessionEndpoint: z.url().optional().isAuditEvidence(),
+        templateMode: z.enum(SSOTemplateMode).default(SSOTemplateMode.MANUAL).isAuditEvidence().describe("How the provider's endpoints are found: `template` reads them from a known provider's definition, `discovery` reads them from the provider's OpenID discovery document, and `manual` uses the endpoints entered here."),
+        templateOverrides: z.record(z.string(), z.string()).optional().isAuditEvidence().describe("In `template` mode, values substituted into the provider definition's endpoint URLs, such as a tenant id."),
+        customScopes: z.array(z.string()).optional().isAuditEvidence().describe('Scopes requested in addition to `scopes`.'),
+        discoveryUrl: z.url().optional().isAuditEvidence().describe("The provider's OpenID discovery document URL. In `discovery` mode the endpoints are read from it when `issuer` is not given."),
+        issuer: z.url().optional().isAuditEvidence().describe("The provider's issuer identifier. An ID token is accepted only when its `iss` claim matches it."),
+        authorizationEndpoint: z.url().optional().isAuditEvidence().describe("The provider's authorization endpoint, where the browser is sent to sign in."),
+        tokenEndpoint: z.url().optional().isAuditEvidence().describe("The provider's token endpoint, where the application exchanges the authorization code for tokens."),
+        userInfoEndpoint: z.url().optional().isAuditEvidence().describe("The provider's userinfo endpoint, read for profile claims the ID token does not carry."),
+        jwksUri: z.url().optional().isAuditEvidence().describe('Where the provider publishes the keys its ID tokens are verified against.'),
+        endSessionEndpoint: z.url().optional().isAuditEvidence().describe("The provider's logout endpoint, used when `federatedLogoutEnabled` is on."),
         /**
          * Redirect the browser to the identity provider's `endSessionEndpoint` when this connection's
          * user logs out of Wildo — RP-initiated logout (issue #445).
@@ -157,8 +167,8 @@ export const SsoConnectionBaseSchema = z.object({
          * The endpoint is the CAPABILITY and this is the DECISION. Both are needed — a connection with
          * this on and no endpoint federates nothing, and says so in the log rather than failing a logout.
          */
-        federatedLogoutEnabled: z.boolean().default(false).isAuditEvidence(),
-        clientId: z.string().min(1).isAuditEvidence(),
+        federatedLogoutEnabled: z.boolean().default(false).isAuditEvidence().describe("Whether logging out of the application also sends the browser to the provider's `endSessionEndpoint`. Off by default."),
+        clientId: z.string().min(1).isAuditEvidence().describe('The client ID the provider issued for this application.'),
         /**
          * OIDC/OAuth2 client secret issued by the IdP, used by the backend token
          * exchange (`oauth2-connection-resolver` → `exchangeCodeForTokens`) to
@@ -178,19 +188,19 @@ export const SsoConnectionBaseSchema = z.object({
          * connection UPDATE custom-impl (`sso-connection.custom-impl` prefix). The
          * central sentinel-strip only preserves TOP-LEVEL write-only secrets.
          */
-        clientSecret: z.string().min(1).isWriteOnlySecret(),
-        scopes: z.array(z.string()).default(['openid', 'email', 'profile']).isAuditEvidence(),
-        responseType: z.enum(SSOResponseType).default(SSOResponseType.CODE).isAuditEvidence(),
-        responseMode: z.enum(SSOResponseMode).optional().isAuditEvidence(),
+        clientSecret: z.string().min(1).isWriteOnlySecret().describe('The client secret the provider issued, used at its token endpoint. Write-only: responses return it masked.'),
+        scopes: z.array(z.string()).default(['openid', 'email', 'profile']).isAuditEvidence().describe('The scopes requested at sign-in.'),
+        responseType: z.enum(SSOResponseType).default(SSOResponseType.CODE).isAuditEvidence().describe('The OAuth response type requested (`response_type`).'),
+        responseMode: z.enum(SSOResponseMode).optional().isAuditEvidence().describe('How the provider returns the result to the application (`response_mode`). Absent means `query`.'),
         claimsMapping: z.object({
-            email: z.string().default('email'),
-            firstName: z.string().default('given_name'),
-            lastName: z.string().default('family_name'),
-            roles: z.string().optional(),
-            department: z.string().optional(),
-            employeeId: z.string().optional(),
-            groups: z.string().optional(),
-        }),
+            email: z.string().default('email').describe("The name of the claim carrying the user's email address."),
+            firstName: z.string().default('given_name').describe("The name of the claim carrying the user's first name."),
+            lastName: z.string().default('family_name').describe("The name of the claim carrying the user's last name."),
+            roles: z.string().optional().describe("The name of the claim carrying the user's roles, which `roleMapping` translates into application roles."),
+            department: z.string().optional().describe("The name of the claim carrying the user's department."),
+            employeeId: z.string().optional().describe("The name of the claim carrying the user's employee ID."),
+            groups: z.string().optional().describe("The name of the claim carrying the user's group memberships."),
+        }).describe('Which ID-token or userinfo claim carries each user detail. A detail with no claim named is not read.'),
         /*
          * NO `validateIssuer` / `validateAudience` / `clockTolerance`. All three were declared here,
          * persisted and audit-marked, and read by nothing — and they were inert in the SAFE direction,
@@ -202,9 +212,9 @@ export const SsoConnectionBaseSchema = z.object({
          * break the token trust chain from a settings screen. A configuration field whose only
          * achievable effect is to weaken a security control should not exist.
          */
-        acrValues: z.array(z.string()).optional().isAuditEvidence(),
-        maxAge: z.number().min(0).optional().isAuditEvidence(),
-        prompt: z.enum(SSOPrompt).optional().isAuditEvidence(),
+        acrValues: z.array(z.string()).optional().isAuditEvidence().describe('Authentication context classes requested from the provider (`acr_values`), for example a stronger sign-in method.'),
+        maxAge: z.number().min(0).optional().isAuditEvidence().describe("The oldest, in seconds, the provider's authentication may be (`max_age`)."),
+        prompt: z.enum(SSOPrompt).optional().isAuditEvidence().describe('The `prompt` value sent with the authorization request.'),
         /**
          * May an account re-prove who it is through this identity provider (#1441)?
          *
@@ -225,18 +235,19 @@ export const SsoConnectionBaseSchema = z.object({
          * spec-cite: Google Identity, OpenID Connect documentation (`prompt` values, `auth_time`), fetched
          * 2026-09-21 from https://developers.google.com/identity/openid-connect/openid-connect
          */
-        reAuthenticationEnabled: z.boolean().default(false).isAuditEvidence(),
-        pkceEnabled: z.boolean().default(true).isAuditEvidence(),
-        pkceMethod: z.enum(SSOPKCEMethod).default(SSOPKCEMethod.S256).isAuditEvidence(),
-        auditSettings: z.object({
-            logAuthAttempts: z.boolean().default(true),
-            logTokenExchange: z.boolean().default(true),
-            logClaimsMapping: z.boolean().default(true),
-            retentionDays: z.number().min(1).max(2555).default(90),
-        }),
+        reAuthenticationEnabled: z.boolean().default(false).isAuditEvidence().describe('Whether a person linked through this connection may confirm it is them by signing in here again, when adding or removing a way to sign in. Turn it on only for a provider that honours `prompt=login` and returns `auth_time`.'),
+        pkceEnabled: z.boolean().default(true).isAuditEvidence().describe('Whether the sign-in uses PKCE to bind the authorization code to this request.'),
+        pkceMethod: z.enum(SSOPKCEMethod).default(SSOPKCEMethod.S256).isAuditEvidence().describe('The PKCE code challenge method.'),
+        // NO `auditSettings` — removed with the SAML block's, for the same reason (#1768).
     }).optional(),
     autoCreateUsers: z.boolean().default(true),
-    autoVerifyEmail: z.boolean().default(true),
+    /*
+     * NO `autoVerifyEmail` (#1769). The only reader honours it for SCIM provisioning alone — an
+     * interactive sign-in cannot stop to send the person off to verify an address — and SCIM reads the
+     * SCIM provisioning config's own `autoVerifyEmail`, never this one. So the connection's copy was a
+     * setting nothing could ever act on. The directory's assertion of an address is trusted on an
+     * enterprise connection because the tenant configured the connection for its own domain.
+     */
     /*
      * `bypassAppMFA` was REMOVED (#1236), rather than wired.
      *

package/dist/esm/security/authentications/sso/sso-connection.shared.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"sso-connection.shared.schemas.js","sourceRoot":"","sources":["../../../../../../src/security/authentications/sso/sso-connection.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AACvE,OAAO,EAAE,yBAAyB,EAAE,gCAAgC,EAAE,MAAM,wDAAwD,CAAC;AAErI,2EAA2E;AAC3E,MAAM,CAAN,IAAY,WAGX;AAHD,WAAY,WAAW;IACrB,4BAAa,CAAA;IACb,4BAAa,CAAA;AACf,CAAC,EAHW,WAAW,KAAX,WAAW,QAGtB;AAED,MAAM,CAAC,MAAM,eAAe,GAAG;IAC7B,QAAQ,EAAE,UAAU;IACpB,SAAS,EAAE,WAAW;IACtB,MAAM,EAAE,QAAQ;CACR,CAAC;AAEX,MAAM,CAAC,MAAM,eAAe,GAAG;IAC7B,IAAI,EAAE,MAAM;IACZ,QAAQ,EAAE,UAAU;IACpB,KAAK,EAAE,OAAO;CACN,CAAC;AAEX,MAAM,CAAC,MAAM,eAAe,GAAG;IAC7B,KAAK,EAAE,OAAO;IACd,QAAQ,EAAE,UAAU;IACpB,SAAS,EAAE,WAAW;CACd,CAAC;AAEX,MAAM,CAAC,MAAM,SAAS,GAAG;IACvB,IAAI,EAAE,MAAM;IACZ,KAAK,EAAE,OAAO;IACd,OAAO,EAAE,SAAS;IAClB,cAAc,EAAE,gBAAgB;CACxB,CAAC;AAEX,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B,IAAI,EAAE,MAAM;IACZ,KAAK,EAAE,OAAO;CACN,CAAC;AAEX,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC9B,WAAW,EAAE,uDAAuD;IACpE,aAAa,EAAE,wDAAwD;IACvE,UAAU,EAAE,sDAAsD;IAClE,SAAS,EAAE,qDAAqD;CACxD,CAAC;AAEX,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IAEtD,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,cAAc,EAAE;IAC9C,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAChD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,cAAc,EAAE;IAC/C,gGAAgG;IAChG,0FAA0F;IAC1F,8FAA8F;IAC9F,qEAAqE;IACrE,iGAAiG;IACjG,yEAAyE;IACzE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,cAAc,EAAE,CAAC,eAAe,EAAE;IACrE,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,eAAe,EAAE;IAEvD,2FAA2F;IAC3F,4FAA4F;IAC5F,2FAA2F;IAC3F,qGAAqG;IACrG,8FAA8F;IAC9F,gGAAgG;IAChG,qGAAqG;IACrG,kGAAkG;IAClG,kGAAkG;IAClG,kDAAkD;IAClD,+FAA+F;IAC/F,kGAAkG;IAClG,oCAAoC;IACpC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;QACb,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,eAAe,EAAE;QAC7C,MAAM,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,eAAe,EAAE;QACjC,MAAM,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE;QAC5C,0FAA0F;QAC1F,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;QAChD,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,aAAa,EAAE;QAC5D,gBAAgB,EAAE,CAAC,CAAC,MAAM,CAAC;YACzB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,oEAAoE,CAAC;YAC/F,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,iEAAiE,CAAC;YAChG,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,+DAA+D,CAAC;YAC7F,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;YAC5B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;YACjC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;YACjC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;SAC9B,CAAC;QACF,YAAY,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,eAAe,EAAE;QACzD,oBAAoB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,eAAe,EAAE;QACjE,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,eAAe,EAAE;QAC3E,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,eAAe,EAAE;QACxD,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE;QAC1D;;;;;;;;;;;;;;;WAeG;QACH,uBAAuB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,eAAe,EAAE;QACrE,YAAY,EAAE,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC,aAAa,CAAC,CAAC,eAAe,EAAE;QAChG,iBAAiB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,eAAe,EAAE;QAC/D,aAAa,EAAE,CAAC,CAAC,MAAM,CAAC;YACtB,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;YAC1C,mBAAmB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;YAC9C,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;SACvD,CAAC;KACH,CAAC,CAAC,QAAQ,EAAE;IAEb,sGAAsG;IACtG,iGAAiG;IACjG,+FAA+F;IAC/F,kGAAkG;IAClG,+FAA+F;IAC/F,0FAA0F;IAC1F,0FAA0F;IAC1F,qFAAqF;IACrF,kGAAkG;IAClG,mBAAmB;IACnB,8FAA8F;IAC9F,oGAAoG;IACpG,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;QACb,YAAY,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,eAAe,EAAE;QACvF,iBAAiB,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE;QAChF,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE;QAC9D,YAAY,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE;QAClD,MAAM,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE;QAC5C,qBAAqB,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE;QAC3D,aAAa,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE;QACnD,gBAAgB,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE;QACtD,OAAO,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE;QAC7C,kBAAkB,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE;QACxD;;;;;;;;;;;;;WAaG;QACH,sBAAsB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,eAAe,EAAE;QACpE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,eAAe,EAAE;QAC7C;;;;;;;;;;;;;;;;;;WAkBG;QACH,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,iBAAiB,EAAE;QACnD,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC,eAAe,EAAE;QACrF,YAAY,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,eAAe,EAAE;QACrF,YAAY,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE;QAClE,aAAa,EAAE,CAAC,CAAC,MAAM,CAAC;YACtB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC;YAClC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,YAAY,CAAC;YAC3C,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,aAAa,CAAC;YAC3C,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;YAC5B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;YACjC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;YACjC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;SAC9B,CAAC;QACF;;;;;;;;;;WAUG;QACH,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE;QAC3D,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE;QACtD,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE;QACtD;;;;;;;;;;;;;;;;;;;WAmBG;QACH,uBAAuB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,eAAe,EAAE;QACrE,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,eAAe,EAAE;QACxD,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,eAAe,EAAE;QAC/E,aAAa,EAAE,CAAC,CAAC,MAAM,CAAC;YACtB,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;YAC1C,gBAAgB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;YAC3C,gBAAgB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;YAC3C,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;SACvD,CAAC;KACH,CAAC,CAAC,QAAQ,EAAE;IAEb,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAC1C,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAC1C;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,gGAAgG;IAChG,8FAA8F;IAC9F,4FAA4F;IAC5F,4EAA4E;IAC5E,4EAA4E;IAC5E,sFAAsF;IACtF,mFAAmF;IACnF,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE;IACpD,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,eAAe,EAAE;IAC/E;;;;;;;;;;;;;;OAcG;IACH,mBAAmB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,eAAe,EAAE;IACtE,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE;IAC1E,YAAY,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE;IAEpF,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IACrF,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;CACtF,CAAC,CAAC;AAQH,MAAM,CAAC,MAAM,mCAAmC,GAAG,yBAAyB,CAAC;IAC3E,gBAAgB,EAAE,gBAAgB;IAClC,mBAAmB,EAAE,iBAAiB;IACtC,WAAW,EAAE,iBAAiB;IAC9B,UAAU,EAAE,uBAAuB;IACnC,0EAA0E;IAC1E,uEAAuE;IACvE,QAAQ,EAAE,mBAAmB,CAAC,GAAG,CAAC,gCAAgC,CAAC;CACpE,CAAC,CAAC","sourcesContent":["/**\n * SSO Connection Schema (Shared) — Polymorphic\n *\n * Individual SSO provider connections with protocol discriminator (OIDC vs SAML).\n * Unified resource — `protocol` field determines which sub-object is populated.\n * Both OIDC and SAML protocol engines consume this shared discriminator.\n * Scope FK (organizationId / applicationId) is injected by the polymorphism engine.\n *\n * @see auth-data-model-audit.md §2B\n */\n\nimport { z } from 'zod';\nimport { AUTH_SCOPE_VARIANTS } from '../authentication.shared.schemas';\nimport { declarePolymorphicSchemas, optOutPolymorphicAutoBusinessKey } from '../../../resources/utils/resource-polymorphism.schemas';\n\n/** Interactive single-sign-on protocols supported by an SSO connection. */\nexport enum SsoProtocol {\n  OIDC = 'oidc',\n  SAML = 'saml',\n}\n\nexport const SSOTemplateMode = {\n  TEMPLATE: 'template',\n  DISCOVERY: 'discovery',\n  MANUAL: 'manual',\n} as const;\n\nexport const SSOResponseType = {\n  CODE: 'code',\n  ID_TOKEN: 'id_token',\n  TOKEN: 'token',\n} as const;\n\nexport const SSOResponseMode = {\n  QUERY: 'query',\n  FRAGMENT: 'fragment',\n  FORM_POST: 'form_post',\n} as const;\n\nexport const SSOPrompt = {\n  NONE: 'none',\n  LOGIN: 'login',\n  CONSENT: 'consent',\n  SELECT_ACCOUNT: 'select_account',\n} as const;\n\nexport const SSOPKCEMethod = {\n  S256: 'S256',\n  PLAIN: 'plain',\n} as const;\n\nexport const SamlNameIdFormat = {\n  UNSPECIFIED: 'urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified',\n  EMAIL_ADDRESS: 'urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress',\n  PERSISTENT: 'urn:oasis:names:tc:SAML:2.0:nameid-format:persistent',\n  TRANSIENT: 'urn:oasis:names:tc:SAML:2.0:nameid-format:transient',\n} as const;\n\nexport const SsoConnectionBaseSchema = z.object({\n  _id: z.string().min(1).isPrimaryKey().isSummaryField(),\n\n  protocol: z.enum(SsoProtocol).isSummaryField(),\n  externalProviderId: z.string().min(1).optional(),\n  displayName: z.string().min(1).isSummaryField(),\n  // `.isAuditEvidence()` — `enabled` is the connection's live/dead switch and `isDefault` decides\n  // which IdP silently receives logins. Marked individually rather than on any parent: this\n  // schema carries `x509Certificates` under `.isBackendOnly()`, and marking a container records\n  // the WHOLE object into rows that replicate to an unerasable ledger.\n  // assurance-control: WILDO.IDENTITY.SESSION_ASSURANCE — the live/dead switch and the default IdP\n  // decide which identity provider is trusted to authenticate this tenant.\n  enabled: z.boolean().default(true).isSummaryField().isAuditEvidence(),\n  isDefault: z.boolean().default(false).isAuditEvidence(),\n\n  // `.isAuditEvidence()` on the SAML leaves below — they say WHERE this connection federates\n  // (`entityId` / `ssoUrl` / `sloUrl`) and HOW strictly it validates the IdP (`signRequests`,\n  // `wantAssertionsSigned`, `allowedClockDrift`, `forceAuthn`, `maxAuthAge`, `nameIdFormat`,\n  // `allowIdpInitiated`). A silent change here redirects the trust anchor or accepts unsigned/replayed\n  // assertions — an authentication-assurance change the field NAME alone cannot evidence — so a\n  // reviewer must see the before/after value. Marked per LEAF, never on the `saml` container: the\n  // certificate material (`x509Certificates` / `x509CertificatePem`) sits beside these and marking the\n  // container would copy key material into an unerasable ledger. The two-level `attributeMapping` /\n  // `auditSettings` leaves are deliberately NOT marked — the evidence resolver reaches one level of\n  // nesting only, so a marker there would be inert.\n  // assurance-control: WILDO.IDENTITY.SESSION_ASSURANCE — the IdP endpoints and signature/replay\n  // validation posture decide which provider is trusted to authenticate this tenant and whether its\n  // assertions are actually verified.\n  saml: z.object({\n    entityId: z.string().min(1).isAuditEvidence(),\n    ssoUrl: z.url().isAuditEvidence(),\n    sloUrl: z.url().optional().isAuditEvidence(),\n    /** Frontend input: PEM-encoded certificate(s). Backend transforms to x509Certificates. */\n    x509CertificatePem: z.string().min(1).optional(),\n    x509Certificates: z.array(z.string()).min(1).isBackendOnly(),\n    attributeMapping: z.object({\n      email: z.string().default('http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress'),\n      firstName: z.string().default('http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname'),\n      lastName: z.string().default('http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname'),\n      roles: z.string().optional(),\n      department: z.string().optional(),\n      employeeId: z.string().optional(),\n      groups: z.string().optional(),\n    }),\n    signRequests: z.boolean().default(true).isAuditEvidence(),\n    wantAssertionsSigned: z.boolean().default(true).isAuditEvidence(),\n    allowedClockDrift: z.number().min(0).max(300).default(30).isAuditEvidence(),\n    forceAuthn: z.boolean().default(false).isAuditEvidence(),\n    maxAuthAge: z.number().min(0).optional().isAuditEvidence(),\n    /**\n     * Whether a person linked through this connection may confirm it is them by signing in again here\n     * (#1441), when adding or removing a way to sign in. Off by default, like the OIDC flag.\n     *\n     * The request is sent with `ForceAuthn=\"true\"` whatever `forceAuthn` says, and the assertion's\n     * `AuthnStatement/@AuthnInstant` must be no older than the request: SAML 2.0 Core §3.4.1 says an IdP\n     * receiving `ForceAuthn=\"true\"` MUST authenticate the presenter directly rather than rely on a previous\n     * security context, and the schema makes `AuthnInstant` required on every authentication statement.\n     * Turn it on only for an IdP that honours `ForceAuthn`: one that silently reuses its session answers\n     * with an old `AuthnInstant` and every re-authentication through it is refused.\n     *\n     * spec-cite: OASIS SAML 2.0 Core (saml-core-2.0-os) §3.4.1 `ForceAuthn` (\"the identity provider MUST\n     * authenticate the presenter directly rather than rely on a previous security context\") and §2.7.2\n     * `AuthnInstant [Required]`, fetched 2026-09-21 from\n     * https://docs.oasis-open.org/security/saml/v2.0/saml-core-2.0-os.pdf\n     */\n    reAuthenticationEnabled: z.boolean().default(false).isAuditEvidence(),\n    nameIdFormat: z.enum(SamlNameIdFormat).default(SamlNameIdFormat.EMAIL_ADDRESS).isAuditEvidence(),\n    allowIdpInitiated: z.boolean().default(false).isAuditEvidence(),\n    auditSettings: z.object({\n      logAuthAttempts: z.boolean().default(true),\n      logAttributeMapping: z.boolean().default(true),\n      retentionDays: z.number().min(1).max(2555).default(90),\n    }),\n  }).optional(),\n\n  // `.isAuditEvidence()` on the OIDC leaves below — like the SAML block, they say WHERE this connection\n  // federates (`discoveryUrl` / `issuer` / the four endpoints / `jwksUri` / `endSessionEndpoint` /\n  // `clientId`) and HOW strictly it validates tokens (`pkceEnabled`, `pkceMethod`), plus what it\n  // requests (`scopes` / `customScopes` / `responseType` / `responseMode` / template + auth-request\n  // shaping, including the `acrValues` step-up demand). Turning `pkceEnabled` off, or repointing\n  // `issuer` / `jwksUri`, silently breaks the token trust chain, so a reviewer must see the\n  // before/after — and so does a change to `acrValues`, which is an authentication-strength\n  // requirement placed on the identity provider. `clientSecret` is NEVER marked (it is\n  // a write-only secret); `claimsMapping` / `auditSettings` are two-level and out of the resolver's\n  // one-level reach.\n  // assurance-control: WILDO.IDENTITY.SESSION_ASSURANCE — the OIDC endpoints, issuer and token-\n  // validation posture decide which provider is trusted and whether its tokens are actually verified.\n  oidc: z.object({\n    templateMode: z.enum(SSOTemplateMode).default(SSOTemplateMode.MANUAL).isAuditEvidence(),\n    templateOverrides: z.record(z.string(), z.string()).optional().isAuditEvidence(),\n    customScopes: z.array(z.string()).optional().isAuditEvidence(),\n    discoveryUrl: z.url().optional().isAuditEvidence(),\n    issuer: z.url().optional().isAuditEvidence(),\n    authorizationEndpoint: z.url().optional().isAuditEvidence(),\n    tokenEndpoint: z.url().optional().isAuditEvidence(),\n    userInfoEndpoint: z.url().optional().isAuditEvidence(),\n    jwksUri: z.url().optional().isAuditEvidence(),\n    endSessionEndpoint: z.url().optional().isAuditEvidence(),\n    /**\n     * Redirect the browser to the identity provider's `endSessionEndpoint` when this connection's\n     * user logs out of Wildo — RP-initiated logout (issue #445).\n     *\n     * OPT-IN, and `false` by default, mirroring SAML's `singleLogoutEnabled` rather than inventing a\n     * second shape for the same question. Defaulting it on would change the logout behaviour of\n     * every existing connection that merely happens to have discovered an `end_session_endpoint`,\n     * which for the DISCOVERY template mode is most of them: the endpoint is read out of the\n     * provider's own document, so its presence records what the provider CAN do, never what the\n     * operator wants.\n     *\n     * The endpoint is the CAPABILITY and this is the DECISION. Both are needed — a connection with\n     * this on and no endpoint federates nothing, and says so in the log rather than failing a logout.\n     */\n    federatedLogoutEnabled: z.boolean().default(false).isAuditEvidence(),\n    clientId: z.string().min(1).isAuditEvidence(),\n    /**\n     * OIDC/OAuth2 client secret issued by the IdP, used by the backend token\n     * exchange (`oauth2-connection-resolver` → `exchangeCodeForTokens`) to\n     * authenticate this connection at the provider's token endpoint.\n     *\n     * `.isWriteOnlySecret()` gives it the framework's write-then-masked contract:\n     * the operator sets/rotates it (stays in the CREATE/UPDATE request DTO) and it\n     * stays in the response DTO so the UI renders a masked placeholder, but the\n     * framework redacts it to `••••••••` at the client-serialization boundary only\n     * — internal reads (`servicesRegistryHandler.read` during token exchange) keep\n     * the real value. Do NOT use `.isBackendOnly()`: that strips the field from\n     * every client DTO, so the operator could never supply it.\n     *\n     * Preservation on UPDATE is NOT automatic here: this is a nested field, and the\n     * repository UPDATE is a whole-subdocument `$set` (no deep merge), so a\n     * round-tripped mask must be re-injected from the stored record by the SSO\n     * connection UPDATE custom-impl (`sso-connection.custom-impl` prefix). The\n     * central sentinel-strip only preserves TOP-LEVEL write-only secrets.\n     */\n    clientSecret: z.string().min(1).isWriteOnlySecret(),\n    scopes: z.array(z.string()).default(['openid', 'email', 'profile']).isAuditEvidence(),\n    responseType: z.enum(SSOResponseType).default(SSOResponseType.CODE).isAuditEvidence(),\n    responseMode: z.enum(SSOResponseMode).optional().isAuditEvidence(),\n    claimsMapping: z.object({\n      email: z.string().default('email'),\n      firstName: z.string().default('given_name'),\n      lastName: z.string().default('family_name'),\n      roles: z.string().optional(),\n      department: z.string().optional(),\n      employeeId: z.string().optional(),\n      groups: z.string().optional(),\n    }),\n    /*\n     * NO `validateIssuer` / `validateAudience` / `clockTolerance`. All three were declared here,\n     * persisted and audit-marked, and read by nothing — and they were inert in the SAFE direction,\n     * which is why they were removed rather than honoured (#419, decided 2026-09-08).\n     *\n     * `verifyIdToken` ALWAYS verifies the issuer and the audience and hardcodes a five-minute\n     * maximum token age. Honouring the three toggles could therefore only ever LOOSEN a guard that\n     * is currently unconditional — an operator could switch off issuer or audience validation and\n     * break the token trust chain from a settings screen. A configuration field whose only\n     * achievable effect is to weaken a security control should not exist.\n     */\n    acrValues: z.array(z.string()).optional().isAuditEvidence(),\n    maxAge: z.number().min(0).optional().isAuditEvidence(),\n    prompt: z.enum(SSOPrompt).optional().isAuditEvidence(),\n    /**\n     * May an account re-prove who it is through this identity provider (#1441)?\n     *\n     * When on, an account whose link to this provider is an OIDC link can answer a re-authentication\n     * request (adding or removing a sign-in method, or a step-up the policy allows it for) by signing in\n     * again at the provider. The request carries `prompt=login`, `max_age=0` and an essential `auth_time`\n     * claim; the verified ID token must carry an `auth_time` no older than the request itself, or the\n     * proof is refused. So a provider that does not force a fresh sign-in yields an old `auth_time` and is\n     * refused, never trusted.\n     *\n     * OFF by default, and it should be switched on only for a provider that honours those parameters.\n     * OpenID Connect Core 1.0 §3.1.2.1 defines `prompt=login` and `max_age`, and §2 makes `auth_time`\n     * REQUIRED when `max_age` is sent, but providers differ: Google's documentation lists no `login` value\n     * for `prompt` and returns `auth_time` only when that claim is requested and enabled in its security\n     * settings. An account on a provider that cannot re-prove it is not asked for a proof it cannot give.\n     * spec-cite: OpenID Connect Core 1.0 §3.1.2.1 and §2, fetched 2026-09-21 from\n     * https://openid.net/specs/openid-connect-core-1_0.html\n     * spec-cite: Google Identity, OpenID Connect documentation (`prompt` values, `auth_time`), fetched\n     * 2026-09-21 from https://developers.google.com/identity/openid-connect/openid-connect\n     */\n    reAuthenticationEnabled: z.boolean().default(false).isAuditEvidence(),\n    pkceEnabled: z.boolean().default(true).isAuditEvidence(),\n    pkceMethod: z.enum(SSOPKCEMethod).default(SSOPKCEMethod.S256).isAuditEvidence(),\n    auditSettings: z.object({\n      logAuthAttempts: z.boolean().default(true),\n      logTokenExchange: z.boolean().default(true),\n      logClaimsMapping: z.boolean().default(true),\n      retentionDays: z.number().min(1).max(2555).default(90),\n    }),\n  }).optional(),\n\n  autoCreateUsers: z.boolean().default(true),\n  autoVerifyEmail: z.boolean().default(true),\n  /*\n   * `bypassAppMFA` was REMOVED (#1236), rather than wired.\n   *\n   * It was authorable, `.isAuditEvidence()`, and read by no production code — so a change to it was\n   * recorded in the trail as a change to a security setting that had no runtime effect. That is the\n   * sharp edge: the ledger asserted a posture change that did not happen, and a reviewer reading the\n   * trail would conclude a control had been relaxed.\n   *\n   * Removed rather than implemented because implementing it would re-open what #1223 had just closed.\n   * An application's declared `requireMFA` is now enforced on the federated lane too — the external\n   * assurance default derives from that declaration — and the organization policy merge is\n   * most-restrictive, so a tenant may tighten the application's posture and never loosen it. A\n   * connection-level escape hatch is the one shape that contradicts both.\n   *\n   * The framework's own shipped documentation already told operators \"keep it off and do not use it as\n   * evidence that MFA was bypassed or enforced\". A field whose documentation says not to use it is a\n   * field to delete.\n   *\n   * If an application ever needs a tenant to lower the application's requirement, that belongs where\n   * the requirement is DECLARED — in the user-type MFA policy — not on a connection, so that the\n   * relaxation is visible beside the thing it relaxes.\n   */\n  // `.isAuditEvidence()` on all four — this is the connection's ROLE-GRANT surface. `defaultRole`\n  // and the two mappings decide what authority an externally-authenticated identity lands with,\n  // and `allowedDomains` decides whose identities the connection will accept at all. A change\n  // here is an authorization change; the field NAME alone cannot evidence it.\n  // The values are role names and domains — configuration, not personal data.\n  // assurance-control: WILDO.ACCESS.PRIVILEGE_EVIDENCE — these decide what authority an\n  // externally-authenticated identity lands with, and whose identities are accepted.\n  defaultRole: z.string().optional().isAuditEvidence(),\n  allowedDomains: z.array(z.string()).default([]).isDBIndexed().isAuditEvidence(),\n  /**\n   * The provider DIRECTORIES this connection admits — for Microsoft, the Entra tenant ids (#1230).\n   *\n   * A separate list from `allowedDomains` because the values are a different KIND. An email domain says\n   * where an address is; a directory id says which organization's directory asserted it, and only the\n   * second is a membership proof — a directory can assert an address in a domain it does not own,\n   * which is the case the whole mechanism exists to separate.\n   *\n   * Empty means no directory restriction, matching `allowedDomains` rather than inventing a second\n   * convention. The two are INDEPENDENT: a connection may restrict the directory and not the domain,\n   * and the directory check does not stop when the domain list is empty.\n   *\n   * `.isAuditEvidence()` for the same reason as its neighbours below — widening the set of directories\n   * a connection accepts is an authorization change, and the field name alone cannot evidence it.\n   */\n  allowedDirectoryIds: z.array(z.string()).default([]).isAuditEvidence(),\n  roleMapping: z.record(z.string(), z.string()).optional().isAuditEvidence(),\n  groupMapping: z.record(z.string(), z.array(z.string())).optional().isAuditEvidence(),\n\n  createdAt: z.date().default(() => new Date()).excludeFromCreate().excludeFromUpdate(),\n  updatedAt: z.date().default(() => new Date()).excludeFromCreate().excludeFromUpdate(),\n});\n// NOTE: Protocol-config discriminant enforcement (protocol=saml → saml defined, protocol=oidc → oidc defined)\n// is validated at the backend service layer, not via .refine() here.\n// Zod 4 doesn't allow .extend() on refined objects, which breaks the polymorphism engine.\n\n\nexport type SsoConnectionBase = z.infer<typeof SsoConnectionBaseSchema>;\n\nexport const ssoConnectionPolymorphicDeclaration = declarePolymorphicSchemas({\n  baseResourceType: 'ssoConnections',\n  baseFieldIdentifier: 'ssoConnectionId',\n  baseEnumKey: 'SSO_CONNECTIONS',\n  baseSchema: SsoConnectionBaseSchema,\n  // Many connections per scope (LIST/CREATE/UPDATE/DELETE) — opt out of the\n  // polymorphism engine's singleton-per-scope business-key auto-default.\n  variants: AUTH_SCOPE_VARIANTS.map(optOutPolymorphicAutoBusinessKey),\n});\n"]}
+{"version":3,"file":"sso-connection.shared.schemas.js","sourceRoot":"","sources":["../../../../../../src/security/authentications/sso/sso-connection.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AACvE,OAAO,EAAE,yBAAyB,EAAE,gCAAgC,EAAE,MAAM,wDAAwD,CAAC;AAErI,2EAA2E;AAC3E,MAAM,CAAN,IAAY,WAGX;AAHD,WAAY,WAAW;IACrB,4BAAa,CAAA;IACb,4BAAa,CAAA;AACf,CAAC,EAHW,WAAW,KAAX,WAAW,QAGtB;AAED,MAAM,CAAC,MAAM,eAAe,GAAG;IAC7B,QAAQ,EAAE,UAAU;IACpB,SAAS,EAAE,WAAW;IACtB,MAAM,EAAE,QAAQ;CACR,CAAC;AAEX,MAAM,CAAC,MAAM,eAAe,GAAG;IAC7B,IAAI,EAAE,MAAM;IACZ,QAAQ,EAAE,UAAU;IACpB,KAAK,EAAE,OAAO;CACN,CAAC;AAEX,MAAM,CAAC,MAAM,eAAe,GAAG;IAC7B,KAAK,EAAE,OAAO;IACd,QAAQ,EAAE,UAAU;IACpB,SAAS,EAAE,WAAW;CACd,CAAC;AAEX,MAAM,CAAC,MAAM,SAAS,GAAG;IACvB,IAAI,EAAE,MAAM;IACZ,KAAK,EAAE,OAAO;IACd,OAAO,EAAE,SAAS;IAClB,cAAc,EAAE,gBAAgB;CACxB,CAAC;AAEX,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B,IAAI,EAAE,MAAM;IACZ,KAAK,EAAE,OAAO;CACN,CAAC;AAEX,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC9B,WAAW,EAAE,uDAAuD;IACpE,aAAa,EAAE,wDAAwD;IACvE,UAAU,EAAE,sDAAsD;IAClE,SAAS,EAAE,qDAAqD;CACxD,CAAC;AAEX,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IAEtD,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,cAAc,EAAE;IAC9C,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAChD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,cAAc,EAAE;IAC/C,gGAAgG;IAChG,0FAA0F;IAC1F,8FAA8F;IAC9F,qEAAqE;IACrE,iGAAiG;IACjG,yEAAyE;IACzE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,cAAc,EAAE,CAAC,eAAe,EAAE;IACrE,sGAAsG;IACtG,oGAAoG;IACpG,kEAAkE;IAClE,SAAS,EAAE,CAAC;SACT,OAAO,EAAE;SACT,OAAO,CAAC,KAAK,CAAC;SACd,eAAe,EAAE;SACjB,QAAQ,CAAC,kSAAkS,CAAC;IAE/S,2FAA2F;IAC3F,4FAA4F;IAC5F,2FAA2F;IAC3F,qGAAqG;IACrG,8FAA8F;IAC9F,gGAAgG;IAChG,qGAAqG;IACrG,gGAAgG;IAChG,qGAAqG;IACrG,+BAA+B;IAC/B,+FAA+F;IAC/F,kGAAkG;IAClG,oCAAoC;IACpC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;QACb,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,eAAe,EAAE,CAAC,QAAQ,CAAC,8IAA8I,CAAC;QACtM,MAAM,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,eAAe,EAAE,CAAC,QAAQ,CAAC,iGAAiG,CAAC;QAC7I,MAAM,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE,CAAC,QAAQ,CAAC,uFAAuF,CAAC;QAC9I,0FAA0F;QAC1F,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,8MAA8M,CAAC;QACzQ,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,aAAa,EAAE;QAC5D,gBAAgB,EAAE,CAAC,CAAC,MAAM,CAAC;YACzB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,oEAAoE,CAAC,CAAC,QAAQ,CAAC,mEAAmE,CAAC;YAC7K,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,iEAAiE,CAAC,CAAC,QAAQ,CAAC,gEAAgE,CAAC;YAC3K,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,+DAA+D,CAAC,CAAC,QAAQ,CAAC,+DAA+D,CAAC;YACvK,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,kHAAkH,CAAC;YACzJ,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,gEAAgE,CAAC;YAC5G,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,iEAAiE,CAAC;YAC7G,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,uEAAuE,CAAC;SAChH,CAAC,CAAC,QAAQ,CAAC,8FAA8F,CAAC;QAC3G,YAAY,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,eAAe,EAAE,CAAC,QAAQ,CAAC,uFAAuF,CAAC;QAC3J,oBAAoB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,eAAe,EAAE,CAAC,QAAQ,CAAC,qDAAqD,CAAC;QACjI,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,eAAe,EAAE,CAAC,QAAQ,CAAC,iKAAiK,CAAC;QACvP,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,eAAe,EAAE,CAAC,QAAQ,CAAC,sIAAsI,CAAC;QACzM,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE,CAAC,QAAQ,CAAC,0JAA0J,CAAC;QAC/N;;;;;;;;;;;;;;;WAeG;QACH,uBAAuB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,eAAe,EAAE,CAAC,QAAQ,CAAC,sMAAsM,CAAC;QACtR,YAAY,EAAE,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC,aAAa,CAAC,CAAC,eAAe,EAAE,CAAC,QAAQ,CAAC,kGAAkG,CAAC;QAC7M,iBAAiB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,eAAe,EAAE,CAAC,QAAQ,CAAC,8JAA8J,CAAC;QACxO;;;;;;;;WAQG;KACJ,CAAC,CAAC,QAAQ,EAAE;IAEb,sGAAsG;IACtG,iGAAiG;IACjG,+FAA+F;IAC/F,kGAAkG;IAClG,+FAA+F;IAC/F,0FAA0F;IAC1F,0FAA0F;IAC1F,qFAAqF;IACrF,gGAAgG;IAChG,8FAA8F;IAC9F,oGAAoG;IACpG,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;QACb,YAAY,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,eAAe,EAAE,CAAC,QAAQ,CAAC,uNAAuN,CAAC;QACzT,iBAAiB,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE,CAAC,QAAQ,CAAC,2GAA2G,CAAC;QACtM,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE,CAAC,QAAQ,CAAC,2CAA2C,CAAC;QACpH,YAAY,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE,CAAC,QAAQ,CAAC,8HAA8H,CAAC;QAC3L,MAAM,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE,CAAC,QAAQ,CAAC,iGAAiG,CAAC;QACxJ,qBAAqB,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE,CAAC,QAAQ,CAAC,8EAA8E,CAAC;QACpJ,aAAa,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE,CAAC,QAAQ,CAAC,mGAAmG,CAAC;QACjK,gBAAgB,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE,CAAC,QAAQ,CAAC,wFAAwF,CAAC;QACzJ,OAAO,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE,CAAC,QAAQ,CAAC,2EAA2E,CAAC;QACnI,kBAAkB,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE,CAAC,QAAQ,CAAC,2EAA2E,CAAC;QAC9I;;;;;;;;;;;;;WAaG;QACH,sBAAsB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,eAAe,EAAE,CAAC,QAAQ,CAAC,uHAAuH,CAAC;QACtM,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,eAAe,EAAE,CAAC,QAAQ,CAAC,yDAAyD,CAAC;QACjH;;;;;;;;;;;;;;;;;;WAkBG;QACH,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,iBAAiB,EAAE,CAAC,QAAQ,CAAC,4GAA4G,CAAC;QAC1K,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC,eAAe,EAAE,CAAC,QAAQ,CAAC,kCAAkC,CAAC;QAClI,YAAY,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,eAAe,EAAE,CAAC,QAAQ,CAAC,sDAAsD,CAAC;QACtJ,YAAY,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE,CAAC,QAAQ,CAAC,iGAAiG,CAAC;QAC9K,aAAa,EAAE,CAAC,CAAC,MAAM,CAAC;YACtB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,0DAA0D,CAAC;YACvG,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,QAAQ,CAAC,uDAAuD,CAAC;YAC7G,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,QAAQ,CAAC,sDAAsD,CAAC;YAC5G,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,yGAAyG,CAAC;YAChJ,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,uDAAuD,CAAC;YACnG,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,wDAAwD,CAAC;YACpG,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,8DAA8D,CAAC;SACvG,CAAC,CAAC,QAAQ,CAAC,sGAAsG,CAAC;QACnH;;;;;;;;;;WAUG;QACH,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE,CAAC,QAAQ,CAAC,mHAAmH,CAAC;QACzL,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE,CAAC,QAAQ,CAAC,2EAA2E,CAAC;QAC5I,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE,CAAC,QAAQ,CAAC,yDAAyD,CAAC;QAC1H;;;;;;;;;;;;;;;;;;;WAmBG;QACH,uBAAuB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,eAAe,EAAE,CAAC,QAAQ,CAAC,gOAAgO,CAAC;QAChT,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,eAAe,EAAE,CAAC,QAAQ,CAAC,+EAA+E,CAAC;QAClJ,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,eAAe,EAAE,CAAC,QAAQ,CAAC,iCAAiC,CAAC;QAC3H,mFAAmF;KACpF,CAAC,CAAC,QAAQ,EAAE;IAEb,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAC1C;;;;;;OAMG;IACH;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,gGAAgG;IAChG,8FAA8F;IAC9F,4FAA4F;IAC5F,4EAA4E;IAC5E,4EAA4E;IAC5E,sFAAsF;IACtF,mFAAmF;IACnF,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE;IACpD,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,eAAe,EAAE;IAC/E;;;;;;;;;;;;;;OAcG;IACH,mBAAmB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,eAAe,EAAE;IACtE,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE;IAC1E,YAAY,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE;IAEpF,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IACrF,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;CACtF,CAAC,CAAC;AAQH,MAAM,CAAC,MAAM,mCAAmC,GAAG,yBAAyB,CAAC;IAC3E,gBAAgB,EAAE,gBAAgB;IAClC,mBAAmB,EAAE,iBAAiB;IACtC,WAAW,EAAE,iBAAiB;IAC9B,UAAU,EAAE,uBAAuB;IACnC,0EAA0E;IAC1E,uEAAuE;IACvE,QAAQ,EAAE,mBAAmB,CAAC,GAAG,CAAC,gCAAgC,CAAC;CACpE,CAAC,CAAC","sourcesContent":["/**\n * SSO Connection Schema (Shared) — Polymorphic\n *\n * Individual SSO provider connections with protocol discriminator (OIDC vs SAML).\n * Unified resource — `protocol` field determines which sub-object is populated.\n * Both OIDC and SAML protocol engines consume this shared discriminator.\n * Scope FK (organizationId / applicationId) is injected by the polymorphism engine.\n *\n * @see auth-data-model-audit.md §2B\n */\n\nimport { z } from 'zod';\nimport { AUTH_SCOPE_VARIANTS } from '../authentication.shared.schemas';\nimport { declarePolymorphicSchemas, optOutPolymorphicAutoBusinessKey } from '../../../resources/utils/resource-polymorphism.schemas';\n\n/** Interactive single-sign-on protocols supported by an SSO connection. */\nexport enum SsoProtocol {\n  OIDC = 'oidc',\n  SAML = 'saml',\n}\n\nexport const SSOTemplateMode = {\n  TEMPLATE: 'template',\n  DISCOVERY: 'discovery',\n  MANUAL: 'manual',\n} as const;\n\nexport const SSOResponseType = {\n  CODE: 'code',\n  ID_TOKEN: 'id_token',\n  TOKEN: 'token',\n} as const;\n\nexport const SSOResponseMode = {\n  QUERY: 'query',\n  FRAGMENT: 'fragment',\n  FORM_POST: 'form_post',\n} as const;\n\nexport const SSOPrompt = {\n  NONE: 'none',\n  LOGIN: 'login',\n  CONSENT: 'consent',\n  SELECT_ACCOUNT: 'select_account',\n} as const;\n\nexport const SSOPKCEMethod = {\n  S256: 'S256',\n  PLAIN: 'plain',\n} as const;\n\nexport const SamlNameIdFormat = {\n  UNSPECIFIED: 'urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified',\n  EMAIL_ADDRESS: 'urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress',\n  PERSISTENT: 'urn:oasis:names:tc:SAML:2.0:nameid-format:persistent',\n  TRANSIENT: 'urn:oasis:names:tc:SAML:2.0:nameid-format:transient',\n} as const;\n\nexport const SsoConnectionBaseSchema = z.object({\n  _id: z.string().min(1).isPrimaryKey().isSummaryField(),\n\n  protocol: z.enum(SsoProtocol).isSummaryField(),\n  externalProviderId: z.string().min(1).optional(),\n  displayName: z.string().min(1).isSummaryField(),\n  // `.isAuditEvidence()` — `enabled` is the connection's live/dead switch and `isDefault` decides\n  // which IdP silently receives logins. Marked individually rather than on any parent: this\n  // schema carries `x509Certificates` under `.isBackendOnly()`, and marking a container records\n  // the WHOLE object into rows that replicate to an unerasable ledger.\n  // assurance-control: WILDO.IDENTITY.SESSION_ASSURANCE — the live/dead switch and the default IdP\n  // decide which identity provider is trusted to authenticate this tenant.\n  enabled: z.boolean().default(true).isSummaryField().isAuditEvidence(),\n  // Read by `selectSsoConnectionForRouting` (#1800): among the eligible connections equally specific to\n  // the signing-in user's domain, the default receives the sign-in. A write that makes one connection\n  // the default demotes the scope's others in the same transaction.\n  isDefault: z\n    .boolean()\n    .default(false)\n    .isAuditEvidence()\n    .describe(\"Whether sign-ins go to this connection when several of this organization's connections could take them. A connection that names the user's email domain in `allowedDomains` still wins over a default that accepts any domain. Making a connection the default removes the flag from the others.\"),\n\n  // `.isAuditEvidence()` on the SAML leaves below — they say WHERE this connection federates\n  // (`entityId` / `ssoUrl` / `sloUrl`) and HOW strictly it validates the IdP (`signRequests`,\n  // `wantAssertionsSigned`, `allowedClockDrift`, `forceAuthn`, `maxAuthAge`, `nameIdFormat`,\n  // `allowIdpInitiated`). A silent change here redirects the trust anchor or accepts unsigned/replayed\n  // assertions — an authentication-assurance change the field NAME alone cannot evidence — so a\n  // reviewer must see the before/after value. Marked per LEAF, never on the `saml` container: the\n  // certificate material (`x509Certificates` / `x509CertificatePem`) sits beside these and marking the\n  // container would copy key material into an unerasable ledger. The two-level `attributeMapping`\n  // leaves are deliberately NOT marked — the evidence resolver reaches one level of nesting only, so a\n  // marker there would be inert.\n  // assurance-control: WILDO.IDENTITY.SESSION_ASSURANCE — the IdP endpoints and signature/replay\n  // validation posture decide which provider is trusted to authenticate this tenant and whether its\n  // assertions are actually verified.\n  saml: z.object({\n    entityId: z.string().min(1).isAuditEvidence().describe(\"The identity provider's SAML entity ID: the issuer its assertions name, and how a sign-in the provider starts is matched to this connection.\"),\n    ssoUrl: z.url().isAuditEvidence().describe(\"The identity provider's single sign-on endpoint, where the application sends a sign-in request.\"),\n    sloUrl: z.url().optional().isAuditEvidence().describe(\"The identity provider's single logout endpoint. Absent when the provider offers none.\"),\n    /** Frontend input: PEM-encoded certificate(s). Backend transforms to x509Certificates. */\n    x509CertificatePem: z.string().min(1).optional().describe(\"The identity provider's signing certificate or certificates, PEM-encoded, used to verify its signatures. Accepted on create and update, and stored parsed as `x509Certificates`, which no response includes.\"),\n    x509Certificates: z.array(z.string()).min(1).isBackendOnly(),\n    attributeMapping: z.object({\n      email: z.string().default('http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress').describe(\"The name of the SAML attribute carrying the user's email address.\"),\n      firstName: z.string().default('http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname').describe(\"The name of the SAML attribute carrying the user's first name.\"),\n      lastName: z.string().default('http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname').describe(\"The name of the SAML attribute carrying the user's last name.\"),\n      roles: z.string().optional().describe(\"The name of the SAML attribute carrying the user's roles, which `roleMapping` translates into application roles.\"),\n      department: z.string().optional().describe(\"The name of the SAML attribute carrying the user's department.\"),\n      employeeId: z.string().optional().describe(\"The name of the SAML attribute carrying the user's employee ID.\"),\n      groups: z.string().optional().describe(\"The name of the SAML attribute carrying the user's group memberships.\"),\n    }).describe('Which SAML attribute carries each user detail. A detail with no attribute named is not read.'),\n    signRequests: z.boolean().default(true).isAuditEvidence().describe('Whether the application signs the sign-in requests it sends to the identity provider.'),\n    wantAssertionsSigned: z.boolean().default(true).isAuditEvidence().describe('Whether an assertion must be signed to be accepted.'),\n    allowedClockDrift: z.number().min(0).max(300).default(30).isAuditEvidence().describe(\"How far, in seconds, the identity provider's clock may differ from the application's when an assertion's validity times and authentication instant are checked.\"),\n    forceAuthn: z.boolean().default(false).isAuditEvidence().describe('Whether every sign-in asks the identity provider to authenticate the person afresh rather than reuse its own session (`ForceAuthn`).'),\n    maxAuthAge: z.number().min(0).optional().isAuditEvidence().describe(\"The oldest, in seconds, the identity provider's own authentication may be: an assertion whose `AuthnInstant` is older is refused. Absent means no limit.\"),\n    /**\n     * Whether a person linked through this connection may confirm it is them by signing in again here\n     * (#1441), when adding or removing a way to sign in. Off by default, like the OIDC flag.\n     *\n     * The request is sent with `ForceAuthn=\"true\"` whatever `forceAuthn` says, and the assertion's\n     * `AuthnStatement/@AuthnInstant` must be no older than the request: SAML 2.0 Core §3.4.1 says an IdP\n     * receiving `ForceAuthn=\"true\"` MUST authenticate the presenter directly rather than rely on a previous\n     * security context, and the schema makes `AuthnInstant` required on every authentication statement.\n     * Turn it on only for an IdP that honours `ForceAuthn`: one that silently reuses its session answers\n     * with an old `AuthnInstant` and every re-authentication through it is refused.\n     *\n     * spec-cite: OASIS SAML 2.0 Core (saml-core-2.0-os) §3.4.1 `ForceAuthn` (\"the identity provider MUST\n     * authenticate the presenter directly rather than rely on a previous security context\") and §2.7.2\n     * `AuthnInstant [Required]`, fetched 2026-09-21 from\n     * https://docs.oasis-open.org/security/saml/v2.0/saml-core-2.0-os.pdf\n     */\n    reAuthenticationEnabled: z.boolean().default(false).isAuditEvidence().describe('Whether a person linked through this connection may confirm it is them by signing in here again, when adding or removing a way to sign in. Turn it on only for a provider that honours `ForceAuthn`.'),\n    nameIdFormat: z.enum(SamlNameIdFormat).default(SamlNameIdFormat.EMAIL_ADDRESS).isAuditEvidence().describe(\"The NameID format the application asks the identity provider to use for the person's identifier.\"),\n    allowIdpInitiated: z.boolean().default(false).isAuditEvidence().describe('Whether a sign-in the identity provider starts, with no request from the application, is accepted. Single logout the provider starts is accepted either way.'),\n    /*\n     * NO `auditSettings` (`logAuthAttempts` / `logAttributeMapping` / `retentionDays`), here or on the\n     * OIDC block. They were stored, shown on the settings screen, and read by nothing, so an\n     * administrator could switch authentication logging off or shorten its retention and nothing\n     * happened (#1768). Removed rather than wired, like #419 and #1236: every sign-in is recorded on the\n     * application's audit trail whatever a connection says, which is intended — a tenant switch that\n     * turns off its own authentication logging would weaken the evidence the audit trail exists for —\n     * and how long rows are kept is the application's retention schedule, not a per-connection number.\n     */\n  }).optional(),\n\n  // `.isAuditEvidence()` on the OIDC leaves below — like the SAML block, they say WHERE this connection\n  // federates (`discoveryUrl` / `issuer` / the four endpoints / `jwksUri` / `endSessionEndpoint` /\n  // `clientId`) and HOW strictly it validates tokens (`pkceEnabled`, `pkceMethod`), plus what it\n  // requests (`scopes` / `customScopes` / `responseType` / `responseMode` / template + auth-request\n  // shaping, including the `acrValues` step-up demand). Turning `pkceEnabled` off, or repointing\n  // `issuer` / `jwksUri`, silently breaks the token trust chain, so a reviewer must see the\n  // before/after — and so does a change to `acrValues`, which is an authentication-strength\n  // requirement placed on the identity provider. `clientSecret` is NEVER marked (it is\n  // a write-only secret); `claimsMapping` is two-level and out of the resolver's one-level reach.\n  // assurance-control: WILDO.IDENTITY.SESSION_ASSURANCE — the OIDC endpoints, issuer and token-\n  // validation posture decide which provider is trusted and whether its tokens are actually verified.\n  oidc: z.object({\n    templateMode: z.enum(SSOTemplateMode).default(SSOTemplateMode.MANUAL).isAuditEvidence().describe(\"How the provider's endpoints are found: `template` reads them from a known provider's definition, `discovery` reads them from the provider's OpenID discovery document, and `manual` uses the endpoints entered here.\"),\n    templateOverrides: z.record(z.string(), z.string()).optional().isAuditEvidence().describe(\"In `template` mode, values substituted into the provider definition's endpoint URLs, such as a tenant id.\"),\n    customScopes: z.array(z.string()).optional().isAuditEvidence().describe('Scopes requested in addition to `scopes`.'),\n    discoveryUrl: z.url().optional().isAuditEvidence().describe(\"The provider's OpenID discovery document URL. In `discovery` mode the endpoints are read from it when `issuer` is not given.\"),\n    issuer: z.url().optional().isAuditEvidence().describe(\"The provider's issuer identifier. An ID token is accepted only when its `iss` claim matches it.\"),\n    authorizationEndpoint: z.url().optional().isAuditEvidence().describe(\"The provider's authorization endpoint, where the browser is sent to sign in.\"),\n    tokenEndpoint: z.url().optional().isAuditEvidence().describe(\"The provider's token endpoint, where the application exchanges the authorization code for tokens.\"),\n    userInfoEndpoint: z.url().optional().isAuditEvidence().describe(\"The provider's userinfo endpoint, read for profile claims the ID token does not carry.\"),\n    jwksUri: z.url().optional().isAuditEvidence().describe('Where the provider publishes the keys its ID tokens are verified against.'),\n    endSessionEndpoint: z.url().optional().isAuditEvidence().describe(\"The provider's logout endpoint, used when `federatedLogoutEnabled` is on.\"),\n    /**\n     * Redirect the browser to the identity provider's `endSessionEndpoint` when this connection's\n     * user logs out of Wildo — RP-initiated logout (issue #445).\n     *\n     * OPT-IN, and `false` by default, mirroring SAML's `singleLogoutEnabled` rather than inventing a\n     * second shape for the same question. Defaulting it on would change the logout behaviour of\n     * every existing connection that merely happens to have discovered an `end_session_endpoint`,\n     * which for the DISCOVERY template mode is most of them: the endpoint is read out of the\n     * provider's own document, so its presence records what the provider CAN do, never what the\n     * operator wants.\n     *\n     * The endpoint is the CAPABILITY and this is the DECISION. Both are needed — a connection with\n     * this on and no endpoint federates nothing, and says so in the log rather than failing a logout.\n     */\n    federatedLogoutEnabled: z.boolean().default(false).isAuditEvidence().describe(\"Whether logging out of the application also sends the browser to the provider's `endSessionEndpoint`. Off by default.\"),\n    clientId: z.string().min(1).isAuditEvidence().describe('The client ID the provider issued for this application.'),\n    /**\n     * OIDC/OAuth2 client secret issued by the IdP, used by the backend token\n     * exchange (`oauth2-connection-resolver` → `exchangeCodeForTokens`) to\n     * authenticate this connection at the provider's token endpoint.\n     *\n     * `.isWriteOnlySecret()` gives it the framework's write-then-masked contract:\n     * the operator sets/rotates it (stays in the CREATE/UPDATE request DTO) and it\n     * stays in the response DTO so the UI renders a masked placeholder, but the\n     * framework redacts it to `••••••••` at the client-serialization boundary only\n     * — internal reads (`servicesRegistryHandler.read` during token exchange) keep\n     * the real value. Do NOT use `.isBackendOnly()`: that strips the field from\n     * every client DTO, so the operator could never supply it.\n     *\n     * Preservation on UPDATE is NOT automatic here: this is a nested field, and the\n     * repository UPDATE is a whole-subdocument `$set` (no deep merge), so a\n     * round-tripped mask must be re-injected from the stored record by the SSO\n     * connection UPDATE custom-impl (`sso-connection.custom-impl` prefix). The\n     * central sentinel-strip only preserves TOP-LEVEL write-only secrets.\n     */\n    clientSecret: z.string().min(1).isWriteOnlySecret().describe('The client secret the provider issued, used at its token endpoint. Write-only: responses return it masked.'),\n    scopes: z.array(z.string()).default(['openid', 'email', 'profile']).isAuditEvidence().describe('The scopes requested at sign-in.'),\n    responseType: z.enum(SSOResponseType).default(SSOResponseType.CODE).isAuditEvidence().describe('The OAuth response type requested (`response_type`).'),\n    responseMode: z.enum(SSOResponseMode).optional().isAuditEvidence().describe('How the provider returns the result to the application (`response_mode`). Absent means `query`.'),\n    claimsMapping: z.object({\n      email: z.string().default('email').describe(\"The name of the claim carrying the user's email address.\"),\n      firstName: z.string().default('given_name').describe(\"The name of the claim carrying the user's first name.\"),\n      lastName: z.string().default('family_name').describe(\"The name of the claim carrying the user's last name.\"),\n      roles: z.string().optional().describe(\"The name of the claim carrying the user's roles, which `roleMapping` translates into application roles.\"),\n      department: z.string().optional().describe(\"The name of the claim carrying the user's department.\"),\n      employeeId: z.string().optional().describe(\"The name of the claim carrying the user's employee ID.\"),\n      groups: z.string().optional().describe(\"The name of the claim carrying the user's group memberships.\"),\n    }).describe('Which ID-token or userinfo claim carries each user detail. A detail with no claim named is not read.'),\n    /*\n     * NO `validateIssuer` / `validateAudience` / `clockTolerance`. All three were declared here,\n     * persisted and audit-marked, and read by nothing — and they were inert in the SAFE direction,\n     * which is why they were removed rather than honoured (#419, decided 2026-09-08).\n     *\n     * `verifyIdToken` ALWAYS verifies the issuer and the audience and hardcodes a five-minute\n     * maximum token age. Honouring the three toggles could therefore only ever LOOSEN a guard that\n     * is currently unconditional — an operator could switch off issuer or audience validation and\n     * break the token trust chain from a settings screen. A configuration field whose only\n     * achievable effect is to weaken a security control should not exist.\n     */\n    acrValues: z.array(z.string()).optional().isAuditEvidence().describe('Authentication context classes requested from the provider (`acr_values`), for example a stronger sign-in method.'),\n    maxAge: z.number().min(0).optional().isAuditEvidence().describe(\"The oldest, in seconds, the provider's authentication may be (`max_age`).\"),\n    prompt: z.enum(SSOPrompt).optional().isAuditEvidence().describe('The `prompt` value sent with the authorization request.'),\n    /**\n     * May an account re-prove who it is through this identity provider (#1441)?\n     *\n     * When on, an account whose link to this provider is an OIDC link can answer a re-authentication\n     * request (adding or removing a sign-in method, or a step-up the policy allows it for) by signing in\n     * again at the provider. The request carries `prompt=login`, `max_age=0` and an essential `auth_time`\n     * claim; the verified ID token must carry an `auth_time` no older than the request itself, or the\n     * proof is refused. So a provider that does not force a fresh sign-in yields an old `auth_time` and is\n     * refused, never trusted.\n     *\n     * OFF by default, and it should be switched on only for a provider that honours those parameters.\n     * OpenID Connect Core 1.0 §3.1.2.1 defines `prompt=login` and `max_age`, and §2 makes `auth_time`\n     * REQUIRED when `max_age` is sent, but providers differ: Google's documentation lists no `login` value\n     * for `prompt` and returns `auth_time` only when that claim is requested and enabled in its security\n     * settings. An account on a provider that cannot re-prove it is not asked for a proof it cannot give.\n     * spec-cite: OpenID Connect Core 1.0 §3.1.2.1 and §2, fetched 2026-09-21 from\n     * https://openid.net/specs/openid-connect-core-1_0.html\n     * spec-cite: Google Identity, OpenID Connect documentation (`prompt` values, `auth_time`), fetched\n     * 2026-09-21 from https://developers.google.com/identity/openid-connect/openid-connect\n     */\n    reAuthenticationEnabled: z.boolean().default(false).isAuditEvidence().describe('Whether a person linked through this connection may confirm it is them by signing in here again, when adding or removing a way to sign in. Turn it on only for a provider that honours `prompt=login` and returns `auth_time`.'),\n    pkceEnabled: z.boolean().default(true).isAuditEvidence().describe('Whether the sign-in uses PKCE to bind the authorization code to this request.'),\n    pkceMethod: z.enum(SSOPKCEMethod).default(SSOPKCEMethod.S256).isAuditEvidence().describe('The PKCE code challenge method.'),\n    // NO `auditSettings` — removed with the SAML block's, for the same reason (#1768).\n  }).optional(),\n\n  autoCreateUsers: z.boolean().default(true),\n  /*\n   * NO `autoVerifyEmail` (#1769). The only reader honours it for SCIM provisioning alone — an\n   * interactive sign-in cannot stop to send the person off to verify an address — and SCIM reads the\n   * SCIM provisioning config's own `autoVerifyEmail`, never this one. So the connection's copy was a\n   * setting nothing could ever act on. The directory's assertion of an address is trusted on an\n   * enterprise connection because the tenant configured the connection for its own domain.\n   */\n  /*\n   * `bypassAppMFA` was REMOVED (#1236), rather than wired.\n   *\n   * It was authorable, `.isAuditEvidence()`, and read by no production code — so a change to it was\n   * recorded in the trail as a change to a security setting that had no runtime effect. That is the\n   * sharp edge: the ledger asserted a posture change that did not happen, and a reviewer reading the\n   * trail would conclude a control had been relaxed.\n   *\n   * Removed rather than implemented because implementing it would re-open what #1223 had just closed.\n   * An application's declared `requireMFA` is now enforced on the federated lane too — the external\n   * assurance default derives from that declaration — and the organization policy merge is\n   * most-restrictive, so a tenant may tighten the application's posture and never loosen it. A\n   * connection-level escape hatch is the one shape that contradicts both.\n   *\n   * The framework's own shipped documentation already told operators \"keep it off and do not use it as\n   * evidence that MFA was bypassed or enforced\". A field whose documentation says not to use it is a\n   * field to delete.\n   *\n   * If an application ever needs a tenant to lower the application's requirement, that belongs where\n   * the requirement is DECLARED — in the user-type MFA policy — not on a connection, so that the\n   * relaxation is visible beside the thing it relaxes.\n   */\n  // `.isAuditEvidence()` on all four — this is the connection's ROLE-GRANT surface. `defaultRole`\n  // and the two mappings decide what authority an externally-authenticated identity lands with,\n  // and `allowedDomains` decides whose identities the connection will accept at all. A change\n  // here is an authorization change; the field NAME alone cannot evidence it.\n  // The values are role names and domains — configuration, not personal data.\n  // assurance-control: WILDO.ACCESS.PRIVILEGE_EVIDENCE — these decide what authority an\n  // externally-authenticated identity lands with, and whose identities are accepted.\n  defaultRole: z.string().optional().isAuditEvidence(),\n  allowedDomains: z.array(z.string()).default([]).isDBIndexed().isAuditEvidence(),\n  /**\n   * The provider DIRECTORIES this connection admits — for Microsoft, the Entra tenant ids (#1230).\n   *\n   * A separate list from `allowedDomains` because the values are a different KIND. An email domain says\n   * where an address is; a directory id says which organization's directory asserted it, and only the\n   * second is a membership proof — a directory can assert an address in a domain it does not own,\n   * which is the case the whole mechanism exists to separate.\n   *\n   * Empty means no directory restriction, matching `allowedDomains` rather than inventing a second\n   * convention. The two are INDEPENDENT: a connection may restrict the directory and not the domain,\n   * and the directory check does not stop when the domain list is empty.\n   *\n   * `.isAuditEvidence()` for the same reason as its neighbours below — widening the set of directories\n   * a connection accepts is an authorization change, and the field name alone cannot evidence it.\n   */\n  allowedDirectoryIds: z.array(z.string()).default([]).isAuditEvidence(),\n  roleMapping: z.record(z.string(), z.string()).optional().isAuditEvidence(),\n  groupMapping: z.record(z.string(), z.array(z.string())).optional().isAuditEvidence(),\n\n  createdAt: z.date().default(() => new Date()).excludeFromCreate().excludeFromUpdate(),\n  updatedAt: z.date().default(() => new Date()).excludeFromCreate().excludeFromUpdate(),\n});\n// NOTE: Protocol-config discriminant enforcement (protocol=saml → saml defined, protocol=oidc → oidc defined)\n// is validated at the backend service layer, not via .refine() here.\n// Zod 4 doesn't allow .extend() on refined objects, which breaks the polymorphism engine.\n\n\nexport type SsoConnectionBase = z.infer<typeof SsoConnectionBaseSchema>;\n\nexport const ssoConnectionPolymorphicDeclaration = declarePolymorphicSchemas({\n  baseResourceType: 'ssoConnections',\n  baseFieldIdentifier: 'ssoConnectionId',\n  baseEnumKey: 'SSO_CONNECTIONS',\n  baseSchema: SsoConnectionBaseSchema,\n  // Many connections per scope (LIST/CREATE/UPDATE/DELETE) — opt out of the\n  // polymorphism engine's singleton-per-scope business-key auto-default.\n  variants: AUTH_SCOPE_VARIANTS.map(optOutPolymorphicAutoBusinessKey),\n});\n"]}

package/dist/esm/security/authorizations/administrative-continuity.shared.schemas.d.ts

@@ -95,7 +95,14 @@ export declare enum AdministrativeContinuityErrorCode {
      * linked user. A crossing platform administrator still needs its declared variant and a usable
      * tenant-access grant; ownerless request auto-approval does not bypass the repair's checks.
      */
-    LAST_ORGANIZATION_OWNER = "LAST_ORGANIZATION_OWNER"
+    LAST_ORGANIZATION_OWNER = "LAST_ORGANIZATION_OWNER",
+    /**
+     * `grantOwnership` was asked to make a PROVIDER membership (#1597 — a service firm's expert, present
+     * through the client's service-provider relationship) an owner. Refused: an organization whose owner
+     * is a firm's expert still cannot administer itself, and the floor never counts such a row. Remedy:
+     * grant ownership to one of the organization's OWN members.
+     */
+    SERVICE_PROVIDER_MEMBERSHIP_CANNOT_OWN = "SERVICE_PROVIDER_MEMBERSHIP_CANNOT_OWN"
 }
 /** @wildo_source:part:end saas.models.authorization.administrative-continuity-codes */
 //# sourceMappingURL=administrative-continuity.shared.schemas.d.ts.map

package/dist/esm/security/authorizations/administrative-continuity.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"administrative-continuity.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/security/authorizations/administrative-continuity.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,yIAAyI;AACzI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8CG;AACH,oBAAY,iCAAiC;IAC3C;;;;;;;OAOG;IACH,4BAA4B,iCAAiC;IAE7D;;;;;;;;;OASG;IACH,uBAAuB,4BAA4B;CACpD;AACD,uFAAuF"}
+{"version":3,"file":"administrative-continuity.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/security/authorizations/administrative-continuity.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,yIAAyI;AACzI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8CG;AACH,oBAAY,iCAAiC;IAC3C;;;;;;;OAOG;IACH,4BAA4B,iCAAiC;IAE7D;;;;;;;;;OASG;IACH,uBAAuB,4BAA4B;IAEnD;;;;;OAKG;IACH,sCAAsC,2CAA2C;CAClF;AACD,uFAAuF"}

package/dist/esm/security/authorizations/administrative-continuity.shared.schemas.js

@@ -97,6 +97,13 @@ export var AdministrativeContinuityErrorCode;
      * tenant-access grant; ownerless request auto-approval does not bypass the repair's checks.
      */
     AdministrativeContinuityErrorCode["LAST_ORGANIZATION_OWNER"] = "LAST_ORGANIZATION_OWNER";
+    /**
+     * `grantOwnership` was asked to make a PROVIDER membership (#1597 — a service firm's expert, present
+     * through the client's service-provider relationship) an owner. Refused: an organization whose owner
+     * is a firm's expert still cannot administer itself, and the floor never counts such a row. Remedy:
+     * grant ownership to one of the organization's OWN members.
+     */
+    AdministrativeContinuityErrorCode["SERVICE_PROVIDER_MEMBERSHIP_CANNOT_OWN"] = "SERVICE_PROVIDER_MEMBERSHIP_CANNOT_OWN";
 })(AdministrativeContinuityErrorCode || (AdministrativeContinuityErrorCode = {}));
 /** @wildo_source:part:end saas.models.authorization.administrative-continuity-codes */
 //# sourceMappingURL=administrative-continuity.shared.schemas.js.map

package/dist/esm/security/authorizations/administrative-continuity.shared.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"administrative-continuity.shared.schemas.js","sourceRoot":"","sources":["../../../../../src/security/authorizations/administrative-continuity.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,yIAAyI;AACzI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8CG;AACH,MAAM,CAAN,IAAY,iCAsBX;AAtBD,WAAY,iCAAiC;IAC3C;;;;;;;OAOG;IACH,kGAA6D,CAAA;IAE7D;;;;;;;;;OASG;IACH,wFAAmD,CAAA;AACrD,CAAC,EAtBW,iCAAiC,KAAjC,iCAAiC,QAsB5C;AACD,uFAAuF","sourcesContent":["/**\n * Administrative-continuity refusal codes — the stable, client-branchable identity of a\n * \"you would remove the last accountable administrator\" refusal.\n *\n * assurance-control: WILDO.ACCESS.ADMINISTRATIVE_CONTINUITY — an application, and each of its\n * tenants, must retain an accountable administrative principal.\n *\n * ## Why this exists as a shared enum rather than prose\n *\n * Both authority floors refuse with `ErrorType.CONFLICT`, and `sanitizeErrorForClient` keeps only an\n * ALLOWLIST of context keys on a CONFLICT. The human remedy travels under `message`, which is on that\n * list — but prose is not a contract: a client wanting to tell \"you would strip the last\n * administrator\" apart from any other 409 would have to regex-parse it, and that breaks the moment\n * the wording is improved.\n *\n * The allowlist's own documented rule is that a client-branchable value rides under the stable `code`\n * key, sourced from an enum declared HERE in `@wildo-ai/saas-models` so backend and frontend share one\n * definition — and explicitly NOT under an invented `reason` / `errorKind` field (which the sanitizer\n * strips precisely so that this rule is the only way through). The backend-side `reason` codes remain,\n * unchanged and unshipped: they are the LOG/audit identity, richer than the wire and free to stay so.\n *\n * ## Why one enum for two floors\n *\n * The application floor and the organization-owner floor are distinct authorities over distinct\n * populations, but from a CLIENT's perspective they are one situation with one remedy shape: appoint\n * another administrator at the named scope, then retry. A single enum lets a caller branch on \"this is\n * an administrative-continuity refusal\" with one check and still distinguish the scope when it wants\n * to — which two unrelated enums would not.\n */\n\n/** @wildo_source:part:start saas.models.authorization.administrative-continuity-codes facet:layer:shared facet:audience:app-developer */\n/**\n * Which administrative population a refusal was protecting.\n *\n * Imported from `@wildo-ai/saas-models`. A closed vocabulary with one named runtime source: schemas,\n * comparisons and client branches all derive from this enum rather than re-typing the literals.\n *\n * ## Where you meet it\n *\n * A write that would strip the last accountable administrator is refused with HTTP **409 CONFLICT**,\n * and this value rides under the response's stable `code` key. Branch on `code`, never on the\n * message: the message is a human remedy and is free to be reworded, and every other field a backend\n * might have used to carry the reason is stripped from a CONFLICT before it reaches a client.\n *\n * `409` and not `403`/`400` is deliberate and worth handling separately: the caller IS authorised and\n * the payload IS valid. What forbids the write is the current state, so a generic \"conflict, retry\"\n * branch loops forever — the remedy is to appoint another administrator at the named scope first.\n *\n * ## What counts as an administrator, when you are deciding whether the remedy will work\n *\n * Three conditions, all of which must hold, and each resolved toward the SMALLER count so an\n * ambiguity produces an over-refusal (recoverable) rather than a lockout (not):\n *\n * 1. the roles must CONFER the anchor role — `APP_ADMIN_SUPER_ADMIN` at application scope,\n *    `ORG_OWNER` at organization scope — directly OR through an `inheritFrom` chain. The conferring\n *    set is resolved from your application's LIVE role table at the moment of the call, so a role you\n *    registered yourself that inherits from the anchor counts, and its holders are equally protected;\n * 2. the membership must be `ACTIVE`. An `INVITED` row does not count even though accepting it would\n *    flip the same row — a recoverable administrator is not a usable one, and the invitee may never\n *    accept;\n * 3. the linked user account must be `ACTIVE`. A suspended user cannot present the membership at all.\n *\n * ## Two traps\n *\n * **A UNIT-scoped grant does not satisfy the organization floor.** Granting the owner role inside one\n * organization unit reaches that unit and nothing across the tenant, so the floor — which reads\n * organization-wide membership roles and nothing else — refuses the retry exactly as before. Promote\n * an organization-wide member instead.\n *\n * **Deactivating a user REPORTS rather than refuses.** Suspending an account is overwhelmingly\n * incident response, and refusing it would mean an operator cannot lock out a hostile owner without\n * first transferring ownership using the tenant the attacker controls. So the containment proceeds\n * and every tenant it strands is recorded at critical severity — do not read this refusal as a\n * guarantee that no suspension can leave a tenant ownerless.\n *\n * A tenant that is finished is exempt: a `CANCELLED` or `DELETED` organization, or one that has\n * already requested deletion, may lose its last owner, so ordinary offboarding is never blocked.\n */\nexport enum AdministrativeContinuityErrorCode {\n  /**\n   * The write would leave the APPLICATION with no administratively usable super-administrator —\n   * a principal that confers `APP_ADMIN_SUPER_ADMIN` (directly or through an `inheritFrom` chain)\n   * and whose account status can still authenticate.\n   *\n   * Unrecoverable in-product once breached: every recovery door is itself gated on that role.\n   * Remedy: grant a super-administrator role to another active user, then retry.\n   */\n  LAST_APPLICATION_SUPER_ADMIN = 'LAST_APPLICATION_SUPER_ADMIN',\n\n  /**\n   * The write would leave ONE organization with no administratively usable owner — an ACTIVE\n   * membership conferring `ORG_OWNER` (directly or by inheritance) whose linked user is also ACTIVE.\n   *\n   * Remedy before removing the last owner: grant an owner role to another active member, then retry.\n   * If external mutation or restored data already stranded the organization, the dedicated\n   * GRANT_OWNERSHIP operation provides a repair path to an eligible ACTIVE member with an ACTIVE\n   * linked user. A crossing platform administrator still needs its declared variant and a usable\n   * tenant-access grant; ownerless request auto-approval does not bypass the repair's checks.\n   */\n  LAST_ORGANIZATION_OWNER = 'LAST_ORGANIZATION_OWNER',\n}\n/** @wildo_source:part:end saas.models.authorization.administrative-continuity-codes */\n"]}
+{"version":3,"file":"administrative-continuity.shared.schemas.js","sourceRoot":"","sources":["../../../../../src/security/authorizations/administrative-continuity.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,yIAAyI;AACzI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8CG;AACH,MAAM,CAAN,IAAY,iCA8BX;AA9BD,WAAY,iCAAiC;IAC3C;;;;;;;OAOG;IACH,kGAA6D,CAAA;IAE7D;;;;;;;;;OASG;IACH,wFAAmD,CAAA;IAEnD;;;;;OAKG;IACH,sHAAiF,CAAA;AACnF,CAAC,EA9BW,iCAAiC,KAAjC,iCAAiC,QA8B5C;AACD,uFAAuF","sourcesContent":["/**\n * Administrative-continuity refusal codes — the stable, client-branchable identity of a\n * \"you would remove the last accountable administrator\" refusal.\n *\n * assurance-control: WILDO.ACCESS.ADMINISTRATIVE_CONTINUITY — an application, and each of its\n * tenants, must retain an accountable administrative principal.\n *\n * ## Why this exists as a shared enum rather than prose\n *\n * Both authority floors refuse with `ErrorType.CONFLICT`, and `sanitizeErrorForClient` keeps only an\n * ALLOWLIST of context keys on a CONFLICT. The human remedy travels under `message`, which is on that\n * list — but prose is not a contract: a client wanting to tell \"you would strip the last\n * administrator\" apart from any other 409 would have to regex-parse it, and that breaks the moment\n * the wording is improved.\n *\n * The allowlist's own documented rule is that a client-branchable value rides under the stable `code`\n * key, sourced from an enum declared HERE in `@wildo-ai/saas-models` so backend and frontend share one\n * definition — and explicitly NOT under an invented `reason` / `errorKind` field (which the sanitizer\n * strips precisely so that this rule is the only way through). The backend-side `reason` codes remain,\n * unchanged and unshipped: they are the LOG/audit identity, richer than the wire and free to stay so.\n *\n * ## Why one enum for two floors\n *\n * The application floor and the organization-owner floor are distinct authorities over distinct\n * populations, but from a CLIENT's perspective they are one situation with one remedy shape: appoint\n * another administrator at the named scope, then retry. A single enum lets a caller branch on \"this is\n * an administrative-continuity refusal\" with one check and still distinguish the scope when it wants\n * to — which two unrelated enums would not.\n */\n\n/** @wildo_source:part:start saas.models.authorization.administrative-continuity-codes facet:layer:shared facet:audience:app-developer */\n/**\n * Which administrative population a refusal was protecting.\n *\n * Imported from `@wildo-ai/saas-models`. A closed vocabulary with one named runtime source: schemas,\n * comparisons and client branches all derive from this enum rather than re-typing the literals.\n *\n * ## Where you meet it\n *\n * A write that would strip the last accountable administrator is refused with HTTP **409 CONFLICT**,\n * and this value rides under the response's stable `code` key. Branch on `code`, never on the\n * message: the message is a human remedy and is free to be reworded, and every other field a backend\n * might have used to carry the reason is stripped from a CONFLICT before it reaches a client.\n *\n * `409` and not `403`/`400` is deliberate and worth handling separately: the caller IS authorised and\n * the payload IS valid. What forbids the write is the current state, so a generic \"conflict, retry\"\n * branch loops forever — the remedy is to appoint another administrator at the named scope first.\n *\n * ## What counts as an administrator, when you are deciding whether the remedy will work\n *\n * Three conditions, all of which must hold, and each resolved toward the SMALLER count so an\n * ambiguity produces an over-refusal (recoverable) rather than a lockout (not):\n *\n * 1. the roles must CONFER the anchor role — `APP_ADMIN_SUPER_ADMIN` at application scope,\n *    `ORG_OWNER` at organization scope — directly OR through an `inheritFrom` chain. The conferring\n *    set is resolved from your application's LIVE role table at the moment of the call, so a role you\n *    registered yourself that inherits from the anchor counts, and its holders are equally protected;\n * 2. the membership must be `ACTIVE`. An `INVITED` row does not count even though accepting it would\n *    flip the same row — a recoverable administrator is not a usable one, and the invitee may never\n *    accept;\n * 3. the linked user account must be `ACTIVE`. A suspended user cannot present the membership at all.\n *\n * ## Two traps\n *\n * **A UNIT-scoped grant does not satisfy the organization floor.** Granting the owner role inside one\n * organization unit reaches that unit and nothing across the tenant, so the floor — which reads\n * organization-wide membership roles and nothing else — refuses the retry exactly as before. Promote\n * an organization-wide member instead.\n *\n * **Deactivating a user REPORTS rather than refuses.** Suspending an account is overwhelmingly\n * incident response, and refusing it would mean an operator cannot lock out a hostile owner without\n * first transferring ownership using the tenant the attacker controls. So the containment proceeds\n * and every tenant it strands is recorded at critical severity — do not read this refusal as a\n * guarantee that no suspension can leave a tenant ownerless.\n *\n * A tenant that is finished is exempt: a `CANCELLED` or `DELETED` organization, or one that has\n * already requested deletion, may lose its last owner, so ordinary offboarding is never blocked.\n */\nexport enum AdministrativeContinuityErrorCode {\n  /**\n   * The write would leave the APPLICATION with no administratively usable super-administrator —\n   * a principal that confers `APP_ADMIN_SUPER_ADMIN` (directly or through an `inheritFrom` chain)\n   * and whose account status can still authenticate.\n   *\n   * Unrecoverable in-product once breached: every recovery door is itself gated on that role.\n   * Remedy: grant a super-administrator role to another active user, then retry.\n   */\n  LAST_APPLICATION_SUPER_ADMIN = 'LAST_APPLICATION_SUPER_ADMIN',\n\n  /**\n   * The write would leave ONE organization with no administratively usable owner — an ACTIVE\n   * membership conferring `ORG_OWNER` (directly or by inheritance) whose linked user is also ACTIVE.\n   *\n   * Remedy before removing the last owner: grant an owner role to another active member, then retry.\n   * If external mutation or restored data already stranded the organization, the dedicated\n   * GRANT_OWNERSHIP operation provides a repair path to an eligible ACTIVE member with an ACTIVE\n   * linked user. A crossing platform administrator still needs its declared variant and a usable\n   * tenant-access grant; ownerless request auto-approval does not bypass the repair's checks.\n   */\n  LAST_ORGANIZATION_OWNER = 'LAST_ORGANIZATION_OWNER',\n\n  /**\n   * `grantOwnership` was asked to make a PROVIDER membership (#1597 — a service firm's expert, present\n   * through the client's service-provider relationship) an owner. Refused: an organization whose owner\n   * is a firm's expert still cannot administer itself, and the floor never counts such a row. Remedy:\n   * grant ownership to one of the organization's OWN members.\n   */\n  SERVICE_PROVIDER_MEMBERSHIP_CANNOT_OWN = 'SERVICE_PROVIDER_MEMBERSHIP_CANNOT_OWN',\n}\n/** @wildo_source:part:end saas.models.authorization.administrative-continuity-codes */\n"]}

package/dist/esm/security/authorizations/application-access-grants.shared.resources-config.schemas.js

@@ -154,7 +154,7 @@ export const applicationAccessGrantsResourceConfiguration_InitializationFactory
                     requestDto: z.object({
                         justification: z.string().min(1).max(1000),
                         /** Minutes. Clamped server-side to the 1h ceiling; a longer ask is not refused. */
-                        requestedDurationMinutes: z.number().int().positive().optional(),
+                        requestedDurationMinutes: z.number().int().positive().optional().describe("How long the elevation lasts, in whole minutes, counted from this request rather than from approval. Defaults to 30; a longer request is reduced to 60 rather than refused."),
                         /**
                          * Ask for the elevation ON BEHALF OF one machine credential of this application — an API key or an
                          * OAuth client, e.g. an assurance collector's (#297). The credential must exist, belong to this

package/dist/esm/security/authorizations/application-access-grants.shared.resources-config.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"application-access-grants.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../../../src/security/authorizations/application-access-grants.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,wCAAwC,EAAE,MAAM,gDAAgD,CAAC;AAC1G,OAAO,EACL,4BAA4B,EAC5B,kCAAkC,EAClC,wCAAwC,GACzC,MAAM,4CAA4C,CAAC;AACpD,OAAO,EAAE,yBAAyB,EAAE,MAAM,yCAAyC,CAAC;AACpF,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,kCAAkC,EAAE,MAAM,mDAAmD,CAAC;AAChJ,OAAO,EACL,0BAA0B,EAC1B,4BAA4B,GAE7B,MAAM,0CAA0C,CAAC;AAClD,OAAO,EAAE,0CAA0C,EAAE,MAAM,iDAAiD,CAAC;AAC7G,OAAO,EAAE,wBAAwB,EAAE,MAAM,iDAAiD,CAAC;AAC3F,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AACxD,OAAO,EAAE,oBAAoB,EAAE,uBAAuB,EAAE,MAAM,2DAA2D,CAAC;AAS1H,MAAM,CAAC,MAAM,kEAAkE,GAAG,CAAC,sBAA8C,EAAE,EAAE,CACnI,0CAA0C,CAIxC;IACA,UAAU,EAAE,4BAA4B;IACxC,kBAAkB,EAAE,gBAAgB,CAAC,yBAAyB;IAC9D,uBAAuB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,yBAAyB,CAAC;IACvG,qBAAqB,EAAE,sBAAsB;IAC7C,gBAAgB,EAAE,IAAI;IAEtB;;;;;;;;;;;;;;;;OAgBG;IACH,kBAAkB,EAAE;QAClB,IAAI,EAAE,wBAAwB,CAAC,OAAO;QACtC,IAAI,EAAE,wBAAwB,CAAC,OAAO;QACtC,aAAa,EAAE,wBAAwB,CAAC,SAAS;KAClD;IAED;;;;;OAKG;IACH,eAAe,EAAE;QACf,IAAI,EAAE,oBAAoB,CAAC,wBAAwB;KACpD;IAED;;;OAGG;IACH,iBAAiB,EAAE,EAAE,IAAI,EAAE,uBAAuB,CAAC,YAAY,EAAE;IAEjE,cAAc,EAAE;QACd,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,KAAK;QAC3B,oEAAoE;QACpE,qBAAqB,CAAC,WAAW;KAClC;IAED,uBAAuB,EAAE;QAEvB;;;;;WAKG;QACH,CAAC,qBAAqB,CAAC,WAAW,CAAC,EAAE;YACnC,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,QAAQ;iBAC/C,CAAC;SACH;QAED;;;;;;;WAOG;QACH,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,KAAK,CAAC,EAAE;YAC7B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QAED;;;;;;;;;;;;;;;;;;WAkBG;QACH,CAAC,kCAAkC,CAAC,cAAc,CAAC,EAAE;YACnD,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,QAAQ;oBAC9C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;wBACnB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;wBAC1C,mFAAmF;wBACnF,wBAAwB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;wBAChE;;;;;2BAKG;wBACH,wBAAwB,EAAE,wCAAwC,CAAC,QAAQ,EAAE;qBAC9E,CAAC;iBACH;aACF;SACF;QAED;;;;;;;;;;;;;;WAcG;QACH,CAAC,kCAAkC,CAAC,OAAO,CAAC,EAAE;YAC5C,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,QAAQ;oBAC9C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;wBACnB,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;qBAChD,CAAC;oBACF,gBAAgB,EAAE,CAAC,EAAE,aAAa,EAAE,YAAY,EAAE,EAAE,EAAE,CACpD,aAAa,CAAC,MAAM,KAAK,yBAAyB,CAAC,gBAAgB;2BAChE,wCAAwC,CAAC;4BAC1C,cAAc,EAAE,aAAa,CAAC,cAAc;4BAC5C,cAAc,EAAE,YAAY,EAAE,MAAM;yBACrC,CAAC;iBACL;aACF;SACF;QAED;;;;;WAKG;QACH,CAAC,kCAAkC,CAAC,IAAI,CAAC,EAAE;YACzC,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;wBACnB,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;qBAChD,CAAC;oBACF,gBAAgB,EAAE,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE,CAAC,aAAa,CAAC,MAAM,KAAK,yBAAyB,CAAC,gBAAgB;iBAC7G;aACF;SACF;QAED,mIAAmI;QACnI,CAAC,kCAAkC,CAAC,MAAM,CAAC,EAAE;YAC3C,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;wBACnB,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;qBAChD,CAAC;oBACF,gBAAgB,EAAE,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE,CACtC,aAAa,CAAC,MAAM,KAAK,yBAAyB,CAAC,gBAAgB;2BAChE,aAAa,CAAC,MAAM,KAAK,yBAAyB,CAAC,MAAM;iBAC/D;aACF;SACF;QAED;;;;;;;WAOG;QACH,CAAC,kCAAkC,CAAC,MAAM,CAAC,EAAE;YAC3C,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;iBACzB;aACF;SACF;KACF;IACD,4FAA4F;IAC5F,0FAA0F;CAC3F,CAAC,CAAC","sourcesContent":["/**\n * Application Access Grants — resource configuration.\n *\n * The operation set mirrors `platformAccessGrants` verb for verb, and the ONE difference is the whole\n * feature: `approve` is gated on the PLATFORM's own administrators rather than a tenant's, and refuses\n * the requester. On the tenant resource the ABSENCE of `admitsCrossTenantPlatformAdministration` on\n * `approve` is what stops an operator approving their own request; here every verb is platform-tier by\n * construction, so that absence buys nothing and the refusal has to be a MEASUREMENT the\n * implementation makes — `applicationAccessGrantApproverIsDistinct`.\n *\n * See `application-access-grants.shared.schemas.ts` for why the resource exists and why it is a\n * sibling type rather than a field, and `.claude/rules/administrative-continuity-floors.md` for the\n * ladder it sits on.\n */\n\nimport { z } from 'zod';\nimport { ExecutionContext_MachineCredentialSchema } from '../../runtime/execution-context.shared.schemas';\nimport {\n  ApplicationAccessGrantSchema,\n  ApplicationAccessGrants_Operations,\n  applicationAccessGrantApproverIsDistinct,\n} from './application-access-grants.shared.schemas';\nimport { PlatformAccessGrantStatus } from './platform-access-grants.shared.schemas';\nimport { CoreResourceOperation, CoreResourceType, coreResourceShared_FieldIdentifier } from '../../resources/resources.shared.core.definitions';\nimport {\n  ResourceOperationRiskLevel,\n  ResourceOperationVariantType,\n  type ResourceRelationship,\n} from '../../resources/resources.shared.schemas';\nimport { createResourceConfiguration_Initialization } from '../../resources/resources-config.shared.factory';\nimport { ResourceSystemAccessMode } from '../../resources/resources-config.shared.schemas';\nimport { CORE_APP_ROLES } from './roles.shared.schemas';\nimport { ErasureRetentionMode, ResourceDataSubjectKind } from '../../compliance/privacy/impersonalization.shared.schemas';\n\ntype ApplicationAccessGrantsCoreOperations =\n  | CoreResourceOperation.READ\n  | CoreResourceOperation.LIST\n  | CoreResourceOperation.COUNT\n  // Route-less; `retentionPolicy` requires READ + LIST + UPDATE_MANY.\n  | CoreResourceOperation.UPDATE_MANY;\n\nexport const applicationAccessGrantsResourceConfiguration_InitializationFactory = (resourcesRelationships: ResourceRelationship[]) =>\n  createResourceConfiguration_Initialization<\n    typeof ApplicationAccessGrants_Operations,\n    ApplicationAccessGrantsCoreOperations,\n    typeof ApplicationAccessGrantSchema\n  >({\n    mainSchema: ApplicationAccessGrantSchema,\n    resourceIdentifier: CoreResourceType.APPLICATION_ACCESS_GRANTS,\n    resourceFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.APPLICATION_ACCESS_GRANTS],\n    resourceRelationships: resourcesRelationships,\n    isSystemResource: true,\n\n    /**\n     * `read`/`list` ALLOWED for the trusted path, and for exactly the reason the tenant resource\n     * allows them: the authorization layer itself resolves a caller's usable grant on a system\n     * context, before the caller's own authority has been established for the read it is gating.\n     *\n     * No trusted `create`/`update`: every transition belongs to a custom implementation that applies\n     * the two-person measurement. A system door around those would be a second way to mint an\n     * application-wide elevation, which is the one thing this resource exists to prevent.\n     *\n     * `exportSubject: FORBIDDEN`, mirrored from the tenant resource. `operatorUserId` and\n     * `approvedByUserId` are foreign keys back to USERS, so these rows sit on a user's Art. 15 graph\n     * as `INCLUDED_REFERENCES_SUBJECT`; an included resource carrying NO declaration REFUSES the whole\n     * export, so omitting this would trade a boot failure for a broken disclosure right. FORBIDDEN\n     * because this is a security-monitoring record and handing the monitoring trail to the person it\n     * monitors is self-defeating — and because it names ANOTHER data subject's decision (the second\n     * administrator), which Art. 15(4) protects.\n     */\n    systemAccessPolicy: {\n      read: ResourceSystemAccessMode.ALLOWED,\n      list: ResourceSystemAccessMode.ALLOWED,\n      exportSubject: ResourceSystemAccessMode.FORBIDDEN,\n    },\n\n    /**\n     * Subject erasure RETAINS this row and scrubs its free text — mirrored from the tenant resource\n     * because it is the same kind of record. What survives is WHO reached application-wide, WHEN, and\n     * who signed for it; what does not is `justification` and `decisionReason`, the operator- and\n     * approver-written prose most likely to name a third party in passing.\n     */\n    retentionPolicy: {\n      mode: ErasureRetentionMode.RETAIN_AND_IMPERSONALIZE,\n    },\n\n    /**\n     * Erasing one of these revokes NO session: the grant is a record ABOUT an operator's access, not\n     * the operator. Their session ends through the `USERS` row, which is `SELF_PRINCIPAL`.\n     */\n    dataSubjectPolicy: { kind: ResourceDataSubjectKind.NO_PRINCIPAL },\n\n    coreOperations: [\n      CoreResourceOperation.READ,\n      CoreResourceOperation.LIST,\n      CoreResourceOperation.COUNT,\n      // Route-less; `retentionPolicy` requires READ + LIST + UPDATE_MANY.\n      CoreResourceOperation.UPDATE_MANY,\n    ],\n\n    operationsConfiguration: {\n\n      /*\n       * Route-less retention plumbing — INTERNAL_CALL registers no route and must not be\n       * REPOSITORY_ONLY: the retention primitives resolve through `getServiceOperationPathDefault`,\n       * which matches only INTERNAL_CALL / API_CALL. CRITICAL — it is the verb the impersonalize\n       * writer uses to stamp markers.\n       */\n      [CoreResourceOperation.UPDATE_MANY]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.CRITICAL,\n        }],\n      },\n\n      /**\n       * The pending queue a second administrator works from, and the record of what was granted.\n       *\n       * `APP_ADMIN_SUPER_ADMIN` on every read: the rows name operator reach across every tenant, and\n       * there is no tenant-side reader here as there is on the platform resource — an application-wide\n       * grant has no customer to show it to. That absence is precisely why the approval had to become\n       * a second signature.\n       */\n      [CoreResourceOperation.READ]: {\n        variants: [\n          {\n            variantType: ResourceOperationVariantType.API_CALL,\n            isDefault: true,\n            roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n            riskLevel: ResourceOperationRiskLevel.LOW,\n          },\n        ],\n      },\n\n      [CoreResourceOperation.LIST]: {\n        variants: [\n          {\n            variantType: ResourceOperationVariantType.API_CALL,\n            isDefault: true,\n            roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n            riskLevel: ResourceOperationRiskLevel.LOW,\n          },\n        ],\n      },\n\n      [CoreResourceOperation.COUNT]: {\n        variants: [\n          {\n            variantType: ResourceOperationVariantType.API_CALL,\n            isDefault: true,\n            roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n            riskLevel: ResourceOperationRiskLevel.LOW,\n          },\n        ],\n      },\n\n      /**\n       * The bootstrap verb.\n       *\n       * Note what it deliberately does NOT declare: `admitsCrossTenantPlatformAdministration`. On the\n       * tenant resource that flag is what lets a non-member operator write a row inside someone else's\n       * tenant, and `requestAccess` there is exempted from the grant requirement it bootstraps. Here\n       * the resource is APPLICATION-scoped — there is no tenant boundary to cross — so the flag would\n       * be meaningless and the exemption has a different shape: the ADMISSION gate exempts this\n       * resource entirely, because an operator would otherwise need an application-wide grant in order\n       * to ask for one.\n       *\n       * What keeps that safe is the same argument the tenant resource makes: requesting is not\n       * accessing. This writes one PENDING row and reads nothing. The blast radius of an abused\n       * request is an entry in a queue that another administrator must sign.\n       *\n       * assurance-control: WILDO.ACCESS.CROSS_TENANT_ADMINISTRATION — application-wide reach is\n       * requested, never assumed.\n       * assurance-control: WILDO.ACCESS.PRIVILEGE_EVIDENCE\n       */\n      [ApplicationAccessGrants_Operations.REQUEST_ACCESS]: {\n        variants: [\n          {\n            variantType: ResourceOperationVariantType.API_CALL,\n            isDefault: true,\n            roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n            riskLevel: ResourceOperationRiskLevel.CRITICAL,\n            resourceOperationLike: CoreResourceOperation.CREATE,\n            requestDto: z.object({\n              justification: z.string().min(1).max(1000),\n              /** Minutes. Clamped server-side to the 1h ceiling; a longer ask is not refused. */\n              requestedDurationMinutes: z.number().int().positive().optional(),\n              /**\n               * Ask for the elevation ON BEHALF OF one machine credential of this application — an API key or an\n               * OAuth client, e.g. an assurance collector's (#297). The credential must exist, belong to this\n               * application, be active and unexpired, or the request is refused. Once signed, the grant admits that\n               * credential and NOT the requester.\n               */\n              grantedMachineCredential: ExecutionContext_MachineCredentialSchema.optional(),\n            }),\n          },\n        ],\n      },\n\n      /**\n       * The SECOND SIGNATURE.\n       *\n       * `enabledCondition` refuses a self-approval here as well as in the implementation, and the\n       * duplication is deliberate rather than redundant — they are two different guarantees. This one\n       * makes the affordance DISAPPEAR for the requester, so a platform console never renders an\n       * Approve button on one's own request; the implementation's `assert…` is the fail-closed half,\n       * because `enabledCondition` is evaluated against the row the framework fetched and a future\n       * variant authored without one would otherwise transition silently.\n       *\n       * Neutering either alone must not admit a self-approval. That is what the two pins assert.\n       *\n       * assurance-control: WILDO.ACCESS.SEGREGATION_OF_DUTIES — the widest operator elevation requires\n       * a second, distinct platform administrator's signature.\n       */\n      [ApplicationAccessGrants_Operations.APPROVE]: {\n        variants: [\n          {\n            variantType: ResourceOperationVariantType.API_CALL,\n            isDefault: true,\n            roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n            riskLevel: ResourceOperationRiskLevel.CRITICAL,\n            resourceOperationLike: CoreResourceOperation.UPDATE,\n            requestDto: z.object({\n              decisionReason: z.string().max(1000).optional(),\n            }),\n            enabledCondition: ({ currentObject, initiatorIds }) =>\n              currentObject.status === PlatformAccessGrantStatus.PENDING_APPROVAL\n              && applicationAccessGrantApproverIsDistinct({\n                operatorUserId: currentObject.operatorUserId,\n                approverUserId: initiatorIds?.userId,\n              }),\n          },\n        ],\n      },\n\n      /**\n       * Refusing a request. NOT gated on being a different person: an operator who thinks better of\n       * their own request should be able to withdraw it, and a denial only ever removes authority.\n       * The two-person rule constrains what an operator can GRANT themselves, never what they can\n       * refuse themselves.\n       */\n      [ApplicationAccessGrants_Operations.DENY]: {\n        variants: [\n          {\n            variantType: ResourceOperationVariantType.API_CALL,\n            isDefault: true,\n            roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n            riskLevel: ResourceOperationRiskLevel.MEDIUM,\n            resourceOperationLike: CoreResourceOperation.UPDATE,\n            requestDto: z.object({\n              decisionReason: z.string().max(1000).optional(),\n            }),\n            enabledCondition: ({ currentObject }) => currentObject.status === PlatformAccessGrantStatus.PENDING_APPROVAL,\n          },\n        ],\n      },\n\n      /** Ending an elevation early. Monotonic — it only ever removes authority — so it is unrestricted among platform administrators. */\n      [ApplicationAccessGrants_Operations.REVOKE]: {\n        variants: [\n          {\n            variantType: ResourceOperationVariantType.API_CALL,\n            isDefault: true,\n            roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n            riskLevel: ResourceOperationRiskLevel.MEDIUM,\n            resourceOperationLike: CoreResourceOperation.UPDATE,\n            requestDto: z.object({\n              decisionReason: z.string().max(1000).optional(),\n            }),\n            enabledCondition: ({ currentObject }) =>\n              currentObject.status === PlatformAccessGrantStatus.PENDING_APPROVAL\n              || currentObject.status === PlatformAccessGrantStatus.ACTIVE,\n          },\n        ],\n      },\n\n      /**\n       * ACTIVE → EXPIRED once the window has elapsed, dispatched by the credential-expiry sweep and by\n       * nothing else. INTERNAL_CALL: no route, no affordance.\n       *\n       * `requestDto: z.object({})` is EMPTY BY CONTRACT, not by omission — an operation without a\n       * `requestDto` inherits the resource's entire update contract, which would let a verb that\n       * accepts nothing advertise every field, `status` included.\n       */\n      [ApplicationAccessGrants_Operations.EXPIRE]: {\n        variants: [\n          {\n            variantType: ResourceOperationVariantType.INTERNAL_CALL,\n            isDefault: true,\n            roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n            riskLevel: ResourceOperationRiskLevel.LOW,\n            resourceOperationLike: CoreResourceOperation.UPDATE,\n            requestDto: z.object({}),\n          },\n        ],\n      },\n    },\n    // NOTE: the APPLICATION primary scope is NOT declared here. It is derived from the registry\n    // relationship carrying `isPrimaryScope: true` (APPLICATION → APPLICATION_ACCESS_GRANTS).\n  });\n"]}
+{"version":3,"file":"application-access-grants.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../../../src/security/authorizations/application-access-grants.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,wCAAwC,EAAE,MAAM,gDAAgD,CAAC;AAC1G,OAAO,EACL,4BAA4B,EAC5B,kCAAkC,EAClC,wCAAwC,GACzC,MAAM,4CAA4C,CAAC;AACpD,OAAO,EAAE,yBAAyB,EAAE,MAAM,yCAAyC,CAAC;AACpF,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,kCAAkC,EAAE,MAAM,mDAAmD,CAAC;AAChJ,OAAO,EACL,0BAA0B,EAC1B,4BAA4B,GAE7B,MAAM,0CAA0C,CAAC;AAClD,OAAO,EAAE,0CAA0C,EAAE,MAAM,iDAAiD,CAAC;AAC7G,OAAO,EAAE,wBAAwB,EAAE,MAAM,iDAAiD,CAAC;AAC3F,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AACxD,OAAO,EAAE,oBAAoB,EAAE,uBAAuB,EAAE,MAAM,2DAA2D,CAAC;AAS1H,MAAM,CAAC,MAAM,kEAAkE,GAAG,CAAC,sBAA8C,EAAE,EAAE,CACnI,0CAA0C,CAIxC;IACA,UAAU,EAAE,4BAA4B;IACxC,kBAAkB,EAAE,gBAAgB,CAAC,yBAAyB;IAC9D,uBAAuB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,yBAAyB,CAAC;IACvG,qBAAqB,EAAE,sBAAsB;IAC7C,gBAAgB,EAAE,IAAI;IAEtB;;;;;;;;;;;;;;;;OAgBG;IACH,kBAAkB,EAAE;QAClB,IAAI,EAAE,wBAAwB,CAAC,OAAO;QACtC,IAAI,EAAE,wBAAwB,CAAC,OAAO;QACtC,aAAa,EAAE,wBAAwB,CAAC,SAAS;KAClD;IAED;;;;;OAKG;IACH,eAAe,EAAE;QACf,IAAI,EAAE,oBAAoB,CAAC,wBAAwB;KACpD;IAED;;;OAGG;IACH,iBAAiB,EAAE,EAAE,IAAI,EAAE,uBAAuB,CAAC,YAAY,EAAE;IAEjE,cAAc,EAAE;QACd,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,KAAK;QAC3B,oEAAoE;QACpE,qBAAqB,CAAC,WAAW;KAClC;IAED,uBAAuB,EAAE;QAEvB;;;;;WAKG;QACH,CAAC,qBAAqB,CAAC,WAAW,CAAC,EAAE;YACnC,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,QAAQ;iBAC/C,CAAC;SACH;QAED;;;;;;;WAOG;QACH,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,KAAK,CAAC,EAAE;YAC7B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QAED;;;;;;;;;;;;;;;;;;WAkBG;QACH,CAAC,kCAAkC,CAAC,cAAc,CAAC,EAAE;YACnD,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,QAAQ;oBAC9C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;wBACnB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;wBAC1C,mFAAmF;wBACnF,wBAAwB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,6KAA6K,CAAC;wBACxP;;;;;2BAKG;wBACH,wBAAwB,EAAE,wCAAwC,CAAC,QAAQ,EAAE;qBAC9E,CAAC;iBACH;aACF;SACF;QAED;;;;;;;;;;;;;;WAcG;QACH,CAAC,kCAAkC,CAAC,OAAO,CAAC,EAAE;YAC5C,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,QAAQ;oBAC9C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;wBACnB,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;qBAChD,CAAC;oBACF,gBAAgB,EAAE,CAAC,EAAE,aAAa,EAAE,YAAY,EAAE,EAAE,EAAE,CACpD,aAAa,CAAC,MAAM,KAAK,yBAAyB,CAAC,gBAAgB;2BAChE,wCAAwC,CAAC;4BAC1C,cAAc,EAAE,aAAa,CAAC,cAAc;4BAC5C,cAAc,EAAE,YAAY,EAAE,MAAM;yBACrC,CAAC;iBACL;aACF;SACF;QAED;;;;;WAKG;QACH,CAAC,kCAAkC,CAAC,IAAI,CAAC,EAAE;YACzC,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;wBACnB,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;qBAChD,CAAC;oBACF,gBAAgB,EAAE,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE,CAAC,aAAa,CAAC,MAAM,KAAK,yBAAyB,CAAC,gBAAgB;iBAC7G;aACF;SACF;QAED,mIAAmI;QACnI,CAAC,kCAAkC,CAAC,MAAM,CAAC,EAAE;YAC3C,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;wBACnB,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;qBAChD,CAAC;oBACF,gBAAgB,EAAE,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE,CACtC,aAAa,CAAC,MAAM,KAAK,yBAAyB,CAAC,gBAAgB;2BAChE,aAAa,CAAC,MAAM,KAAK,yBAAyB,CAAC,MAAM;iBAC/D;aACF;SACF;QAED;;;;;;;WAOG;QACH,CAAC,kCAAkC,CAAC,MAAM,CAAC,EAAE;YAC3C,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;iBACzB;aACF;SACF;KACF;IACD,4FAA4F;IAC5F,0FAA0F;CAC3F,CAAC,CAAC","sourcesContent":["/**\n * Application Access Grants — resource configuration.\n *\n * The operation set mirrors `platformAccessGrants` verb for verb, and the ONE difference is the whole\n * feature: `approve` is gated on the PLATFORM's own administrators rather than a tenant's, and refuses\n * the requester. On the tenant resource the ABSENCE of `admitsCrossTenantPlatformAdministration` on\n * `approve` is what stops an operator approving their own request; here every verb is platform-tier by\n * construction, so that absence buys nothing and the refusal has to be a MEASUREMENT the\n * implementation makes — `applicationAccessGrantApproverIsDistinct`.\n *\n * See `application-access-grants.shared.schemas.ts` for why the resource exists and why it is a\n * sibling type rather than a field, and `.claude/rules/administrative-continuity-floors.md` for the\n * ladder it sits on.\n */\n\nimport { z } from 'zod';\nimport { ExecutionContext_MachineCredentialSchema } from '../../runtime/execution-context.shared.schemas';\nimport {\n  ApplicationAccessGrantSchema,\n  ApplicationAccessGrants_Operations,\n  applicationAccessGrantApproverIsDistinct,\n} from './application-access-grants.shared.schemas';\nimport { PlatformAccessGrantStatus } from './platform-access-grants.shared.schemas';\nimport { CoreResourceOperation, CoreResourceType, coreResourceShared_FieldIdentifier } from '../../resources/resources.shared.core.definitions';\nimport {\n  ResourceOperationRiskLevel,\n  ResourceOperationVariantType,\n  type ResourceRelationship,\n} from '../../resources/resources.shared.schemas';\nimport { createResourceConfiguration_Initialization } from '../../resources/resources-config.shared.factory';\nimport { ResourceSystemAccessMode } from '../../resources/resources-config.shared.schemas';\nimport { CORE_APP_ROLES } from './roles.shared.schemas';\nimport { ErasureRetentionMode, ResourceDataSubjectKind } from '../../compliance/privacy/impersonalization.shared.schemas';\n\ntype ApplicationAccessGrantsCoreOperations =\n  | CoreResourceOperation.READ\n  | CoreResourceOperation.LIST\n  | CoreResourceOperation.COUNT\n  // Route-less; `retentionPolicy` requires READ + LIST + UPDATE_MANY.\n  | CoreResourceOperation.UPDATE_MANY;\n\nexport const applicationAccessGrantsResourceConfiguration_InitializationFactory = (resourcesRelationships: ResourceRelationship[]) =>\n  createResourceConfiguration_Initialization<\n    typeof ApplicationAccessGrants_Operations,\n    ApplicationAccessGrantsCoreOperations,\n    typeof ApplicationAccessGrantSchema\n  >({\n    mainSchema: ApplicationAccessGrantSchema,\n    resourceIdentifier: CoreResourceType.APPLICATION_ACCESS_GRANTS,\n    resourceFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.APPLICATION_ACCESS_GRANTS],\n    resourceRelationships: resourcesRelationships,\n    isSystemResource: true,\n\n    /**\n     * `read`/`list` ALLOWED for the trusted path, and for exactly the reason the tenant resource\n     * allows them: the authorization layer itself resolves a caller's usable grant on a system\n     * context, before the caller's own authority has been established for the read it is gating.\n     *\n     * No trusted `create`/`update`: every transition belongs to a custom implementation that applies\n     * the two-person measurement. A system door around those would be a second way to mint an\n     * application-wide elevation, which is the one thing this resource exists to prevent.\n     *\n     * `exportSubject: FORBIDDEN`, mirrored from the tenant resource. `operatorUserId` and\n     * `approvedByUserId` are foreign keys back to USERS, so these rows sit on a user's Art. 15 graph\n     * as `INCLUDED_REFERENCES_SUBJECT`; an included resource carrying NO declaration REFUSES the whole\n     * export, so omitting this would trade a boot failure for a broken disclosure right. FORBIDDEN\n     * because this is a security-monitoring record and handing the monitoring trail to the person it\n     * monitors is self-defeating — and because it names ANOTHER data subject's decision (the second\n     * administrator), which Art. 15(4) protects.\n     */\n    systemAccessPolicy: {\n      read: ResourceSystemAccessMode.ALLOWED,\n      list: ResourceSystemAccessMode.ALLOWED,\n      exportSubject: ResourceSystemAccessMode.FORBIDDEN,\n    },\n\n    /**\n     * Subject erasure RETAINS this row and scrubs its free text — mirrored from the tenant resource\n     * because it is the same kind of record. What survives is WHO reached application-wide, WHEN, and\n     * who signed for it; what does not is `justification` and `decisionReason`, the operator- and\n     * approver-written prose most likely to name a third party in passing.\n     */\n    retentionPolicy: {\n      mode: ErasureRetentionMode.RETAIN_AND_IMPERSONALIZE,\n    },\n\n    /**\n     * Erasing one of these revokes NO session: the grant is a record ABOUT an operator's access, not\n     * the operator. Their session ends through the `USERS` row, which is `SELF_PRINCIPAL`.\n     */\n    dataSubjectPolicy: { kind: ResourceDataSubjectKind.NO_PRINCIPAL },\n\n    coreOperations: [\n      CoreResourceOperation.READ,\n      CoreResourceOperation.LIST,\n      CoreResourceOperation.COUNT,\n      // Route-less; `retentionPolicy` requires READ + LIST + UPDATE_MANY.\n      CoreResourceOperation.UPDATE_MANY,\n    ],\n\n    operationsConfiguration: {\n\n      /*\n       * Route-less retention plumbing — INTERNAL_CALL registers no route and must not be\n       * REPOSITORY_ONLY: the retention primitives resolve through `getServiceOperationPathDefault`,\n       * which matches only INTERNAL_CALL / API_CALL. CRITICAL — it is the verb the impersonalize\n       * writer uses to stamp markers.\n       */\n      [CoreResourceOperation.UPDATE_MANY]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.CRITICAL,\n        }],\n      },\n\n      /**\n       * The pending queue a second administrator works from, and the record of what was granted.\n       *\n       * `APP_ADMIN_SUPER_ADMIN` on every read: the rows name operator reach across every tenant, and\n       * there is no tenant-side reader here as there is on the platform resource — an application-wide\n       * grant has no customer to show it to. That absence is precisely why the approval had to become\n       * a second signature.\n       */\n      [CoreResourceOperation.READ]: {\n        variants: [\n          {\n            variantType: ResourceOperationVariantType.API_CALL,\n            isDefault: true,\n            roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n            riskLevel: ResourceOperationRiskLevel.LOW,\n          },\n        ],\n      },\n\n      [CoreResourceOperation.LIST]: {\n        variants: [\n          {\n            variantType: ResourceOperationVariantType.API_CALL,\n            isDefault: true,\n            roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n            riskLevel: ResourceOperationRiskLevel.LOW,\n          },\n        ],\n      },\n\n      [CoreResourceOperation.COUNT]: {\n        variants: [\n          {\n            variantType: ResourceOperationVariantType.API_CALL,\n            isDefault: true,\n            roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n            riskLevel: ResourceOperationRiskLevel.LOW,\n          },\n        ],\n      },\n\n      /**\n       * The bootstrap verb.\n       *\n       * Note what it deliberately does NOT declare: `admitsCrossTenantPlatformAdministration`. On the\n       * tenant resource that flag is what lets a non-member operator write a row inside someone else's\n       * tenant, and `requestAccess` there is exempted from the grant requirement it bootstraps. Here\n       * the resource is APPLICATION-scoped — there is no tenant boundary to cross — so the flag would\n       * be meaningless and the exemption has a different shape: the ADMISSION gate exempts this\n       * resource entirely, because an operator would otherwise need an application-wide grant in order\n       * to ask for one.\n       *\n       * What keeps that safe is the same argument the tenant resource makes: requesting is not\n       * accessing. This writes one PENDING row and reads nothing. The blast radius of an abused\n       * request is an entry in a queue that another administrator must sign.\n       *\n       * assurance-control: WILDO.ACCESS.CROSS_TENANT_ADMINISTRATION — application-wide reach is\n       * requested, never assumed.\n       * assurance-control: WILDO.ACCESS.PRIVILEGE_EVIDENCE\n       */\n      [ApplicationAccessGrants_Operations.REQUEST_ACCESS]: {\n        variants: [\n          {\n            variantType: ResourceOperationVariantType.API_CALL,\n            isDefault: true,\n            roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n            riskLevel: ResourceOperationRiskLevel.CRITICAL,\n            resourceOperationLike: CoreResourceOperation.CREATE,\n            requestDto: z.object({\n              justification: z.string().min(1).max(1000),\n              /** Minutes. Clamped server-side to the 1h ceiling; a longer ask is not refused. */\n              requestedDurationMinutes: z.number().int().positive().optional().describe(\"How long the elevation lasts, in whole minutes, counted from this request rather than from approval. Defaults to 30; a longer request is reduced to 60 rather than refused.\"),\n              /**\n               * Ask for the elevation ON BEHALF OF one machine credential of this application — an API key or an\n               * OAuth client, e.g. an assurance collector's (#297). The credential must exist, belong to this\n               * application, be active and unexpired, or the request is refused. Once signed, the grant admits that\n               * credential and NOT the requester.\n               */\n              grantedMachineCredential: ExecutionContext_MachineCredentialSchema.optional(),\n            }),\n          },\n        ],\n      },\n\n      /**\n       * The SECOND SIGNATURE.\n       *\n       * `enabledCondition` refuses a self-approval here as well as in the implementation, and the\n       * duplication is deliberate rather than redundant — they are two different guarantees. This one\n       * makes the affordance DISAPPEAR for the requester, so a platform console never renders an\n       * Approve button on one's own request; the implementation's `assert…` is the fail-closed half,\n       * because `enabledCondition` is evaluated against the row the framework fetched and a future\n       * variant authored without one would otherwise transition silently.\n       *\n       * Neutering either alone must not admit a self-approval. That is what the two pins assert.\n       *\n       * assurance-control: WILDO.ACCESS.SEGREGATION_OF_DUTIES — the widest operator elevation requires\n       * a second, distinct platform administrator's signature.\n       */\n      [ApplicationAccessGrants_Operations.APPROVE]: {\n        variants: [\n          {\n            variantType: ResourceOperationVariantType.API_CALL,\n            isDefault: true,\n            roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n            riskLevel: ResourceOperationRiskLevel.CRITICAL,\n            resourceOperationLike: CoreResourceOperation.UPDATE,\n            requestDto: z.object({\n              decisionReason: z.string().max(1000).optional(),\n            }),\n            enabledCondition: ({ currentObject, initiatorIds }) =>\n              currentObject.status === PlatformAccessGrantStatus.PENDING_APPROVAL\n              && applicationAccessGrantApproverIsDistinct({\n                operatorUserId: currentObject.operatorUserId,\n                approverUserId: initiatorIds?.userId,\n              }),\n          },\n        ],\n      },\n\n      /**\n       * Refusing a request. NOT gated on being a different person: an operator who thinks better of\n       * their own request should be able to withdraw it, and a denial only ever removes authority.\n       * The two-person rule constrains what an operator can GRANT themselves, never what they can\n       * refuse themselves.\n       */\n      [ApplicationAccessGrants_Operations.DENY]: {\n        variants: [\n          {\n            variantType: ResourceOperationVariantType.API_CALL,\n            isDefault: true,\n            roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n            riskLevel: ResourceOperationRiskLevel.MEDIUM,\n            resourceOperationLike: CoreResourceOperation.UPDATE,\n            requestDto: z.object({\n              decisionReason: z.string().max(1000).optional(),\n            }),\n            enabledCondition: ({ currentObject }) => currentObject.status === PlatformAccessGrantStatus.PENDING_APPROVAL,\n          },\n        ],\n      },\n\n      /** Ending an elevation early. Monotonic — it only ever removes authority — so it is unrestricted among platform administrators. */\n      [ApplicationAccessGrants_Operations.REVOKE]: {\n        variants: [\n          {\n            variantType: ResourceOperationVariantType.API_CALL,\n            isDefault: true,\n            roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n            riskLevel: ResourceOperationRiskLevel.MEDIUM,\n            resourceOperationLike: CoreResourceOperation.UPDATE,\n            requestDto: z.object({\n              decisionReason: z.string().max(1000).optional(),\n            }),\n            enabledCondition: ({ currentObject }) =>\n              currentObject.status === PlatformAccessGrantStatus.PENDING_APPROVAL\n              || currentObject.status === PlatformAccessGrantStatus.ACTIVE,\n          },\n        ],\n      },\n\n      /**\n       * ACTIVE → EXPIRED once the window has elapsed, dispatched by the credential-expiry sweep and by\n       * nothing else. INTERNAL_CALL: no route, no affordance.\n       *\n       * `requestDto: z.object({})` is EMPTY BY CONTRACT, not by omission — an operation without a\n       * `requestDto` inherits the resource's entire update contract, which would let a verb that\n       * accepts nothing advertise every field, `status` included.\n       */\n      [ApplicationAccessGrants_Operations.EXPIRE]: {\n        variants: [\n          {\n            variantType: ResourceOperationVariantType.INTERNAL_CALL,\n            isDefault: true,\n            roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n            riskLevel: ResourceOperationRiskLevel.LOW,\n            resourceOperationLike: CoreResourceOperation.UPDATE,\n            requestDto: z.object({}),\n          },\n        ],\n      },\n    },\n    // NOTE: the APPLICATION primary scope is NOT declared here. It is derived from the registry\n    // relationship carrying `isPrimaryScope: true` (APPLICATION → APPLICATION_ACCESS_GRANTS).\n  });\n"]}