npm - @wildo-ai/saas-models - Versions diffs - 1.1.5 → 1.1.7 - Mend

@wildo-ai/saas-models 1.1.5 → 1.1.7

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (1295) hide show

package/dist/esm/security/authentications/sso/sso-connection.shared.resources-config.schemas.js CHANGED Viewed

@@ -29,6 +29,8 @@ export var SsoConnectionTestOverallStatus;
 export var SsoConnectionDiscoverySource;
 (function (SsoConnectionDiscoverySource) {
     SsoConnectionDiscoverySource["SAML_METADATA"] = "saml-metadata";
+    /** The OpenID Provider's `/.well-known/openid-configuration` document at `issuerUrl` (#1800). */
+    SsoConnectionDiscoverySource["OIDC_DISCOVERY"] = "oidc-discovery";
 })(SsoConnectionDiscoverySource || (SsoConnectionDiscoverySource = {}));
 // ── Request DTOs ─────────────────────────────────────────────────────
 /**
@@ -40,27 +42,41 @@ export const SsoConnection_TestConnectionRequestDto = z.strictObject({});
 /**
  * Metadata discovery needs at least one protocol-specific source. The union
  * makes that invariant visible in generated JSON Schema (`anyOf`) as well as at
- * runtime; an object with both sources remains valid and SAML metadata takes
- * precedence until OIDC discovery is implemented.
+ * runtime. `metadataUrl` discovers a SAML provider and `issuerUrl` an OpenID
+ * Connect one; an object with both remains valid and SAML metadata takes
+ * precedence, since the two describe different connections and the operation
+ * answers one protocol.
  */
 export const SsoConnection_DiscoverEndpointsRequestDto = z.union([
     z.strictObject({
-        metadataUrl: z.url(),
-        issuerUrl: z.url().optional(),
+        metadataUrl: z
+            .url()
+            .describe("The URL of the identity provider's SAML metadata document. The server fetches and reads it; nothing is saved to the connection."),
+        issuerUrl: z.url().optional().describe("An OpenID Connect provider's issuer. Ignored when `metadataUrl` is given."),
     }),
     z.strictObject({
-        issuerUrl: z.url(),
-        metadataUrl: z.url().optional(),
+        issuerUrl: z
+            .url()
+            .describe("An OpenID Connect provider's issuer. The server fetches `<issuer>/.well-known/openid-configuration` and reads it; nothing is saved to the connection."),
+        metadataUrl: z
+            .url()
+            .optional()
+            .describe("The URL of the identity provider's SAML metadata document. When given, the server fetches and reads it; nothing is saved to the connection."),
     }),
 ]);
 const SsoConnection_CertificateTestResultDto = z.strictObject({
-    index: z.number().int().nonnegative(),
-    valid: z.boolean(),
-    expiresAt: z.string(),
-    daysRemaining: z.number().int(),
-    algorithm: z.string(),
-    fingerprint: z.string(),
-    warnings: z.array(z.string()),
+    index: z.number().int().nonnegative().describe("The certificate's position in the connection's certificate list, starting at 0."),
+    valid: z.boolean().describe('`true` when the certificate could be read and today falls within its validity period.'),
+    expiresAt: z.string().describe('When the certificate expires, as an ISO 8601 date-time. Empty when the certificate could not be read.'),
+    daysRemaining: z
+        .number()
+        .int()
+        .describe('Whole days until the certificate expires; negative once it has expired. `-1` when the certificate could not be read.'),
+    algorithm: z.string().describe("The certificate's signature algorithm, or `unknown` when it is not recognised."),
+    fingerprint: z.string().describe("The certificate's SHA-256 fingerprint, as colon-separated hex. Empty when the certificate could not be read."),
+    warnings: z
+        .array(z.string())
+        .describe('Problems found with this certificate: expired or not yet valid, expiring within 30 days, a SHA-1 signature, or unreadable.'),
 });
 /**
  * Protocol-discriminated result for TEST_CONNECTION. SAML diagnostics are a
@@ -70,8 +86,8 @@ const SsoConnection_CertificateTestResultDto = z.strictObject({
 export const SsoConnection_TestConnectionResponseDto = z.discriminatedUnion('protocol', [
     z.strictObject({
         protocol: z.literal(SsoProtocol.SAML),
-        supported: z.literal(true),
-        entityIdConfigured: z.boolean(),
+        supported: z.literal(true).describe('`true`: the connection was tested.'),
+        entityIdConfigured: z.boolean().describe("Whether the identity provider's entity ID is set on the connection."),
         /**
          * Did the server's probe reach the SSO URL? ABSENT when the server was not allowed to probe it — the
          * outbound-target guard refused the destination (a private address the operator has not declared in
@@ -79,21 +95,37 @@ export const SsoConnection_TestConnectionResponseDto = z.discriminatedUnion('pro
          * about the endpoint then: SAML sign-in reaches it through the user's browser, so a private IdP the
          * server may not address can still be a working SSO URL. The reason is carried in `warnings` (#516).
          */
-        ssoUrlReachable: z.boolean().optional(),
-        ssoUrlStatus: z.number().int().optional(),
-        certificates: z.array(SsoConnection_CertificateTestResultDto),
+        ssoUrlReachable: z
+            .boolean()
+            .optional()
+            .describe("Whether the server got an HTTP response from the SSO URL, whatever its status. `false` when it did not answer or no SSO URL is set. Absent when the server may not connect to that address, because sign-in reaches it through the user's browser; `warnings` says why."),
+        ssoUrlStatus: z.number().int().optional().describe('The HTTP status the SSO URL answered with. Absent when it did not answer.'),
+        certificates: z
+            .array(SsoConnection_CertificateTestResultDto)
+            .describe("One result per X.509 certificate configured for the identity provider, in the connection's order."),
         /** As `ssoUrlReachable`; also absent when no SLO URL is configured. */
-        sloUrlReachable: z.boolean().optional(),
-        sloUrlStatus: z.number().int().optional(),
-        spMetadataValid: z.boolean(),
-        overallStatus: z.enum(SsoConnectionTestOverallStatus),
-        errors: z.array(z.string()),
-        warnings: z.array(z.string()),
+        sloUrlReachable: z
+            .boolean()
+            .optional()
+            .describe('Whether the server got an HTTP response from the single-logout URL, checked like `ssoUrlReachable`. Absent when no single-logout URL is set.'),
+        sloUrlStatus: z.number().int().optional().describe('The HTTP status the single-logout URL answered with. Absent when it did not answer or none is set.'),
+        spMetadataValid: z
+            .boolean()
+            .describe("Whether this application can generate valid service-provider metadata for the connection. `false` means the application's own SAML settings are incomplete, reported as a warning."),
+        overallStatus: z
+            .enum(SsoConnectionTestOverallStatus)
+            .describe('The verdict: `fail` when there is at least one error, `warning` when there are only warnings, `pass` otherwise.'),
+        errors: z
+            .array(z.string())
+            .describe('Problems that stop sign-in from working, such as a missing entity ID or SSO URL, an unreachable SSO URL, or no valid certificate.'),
+        warnings: z
+            .array(z.string())
+            .describe('Problems worth fixing that do not by themselves stop sign-in, such as a certificate expiring soon or an unreachable single-logout URL.'),
     }),
     z.strictObject({
         protocol: z.literal(SsoProtocol.OIDC),
-        supported: z.literal(false),
-        message: z.string().min(1),
+        supported: z.literal(false).describe('`false`: OpenID Connect connections cannot be tested yet, and nothing was attempted.'),
+        message: z.string().min(1).describe('Explains why no test was run.'),
     }),
 ]);
 /**
@@ -103,18 +135,38 @@ export const SsoConnection_TestConnectionResponseDto = z.discriminatedUnion('pro
 export const SsoConnection_DiscoverEndpointsResponseDto = z.discriminatedUnion('protocol', [
     z.strictObject({
         protocol: z.literal(SsoProtocol.SAML),
-        supported: z.literal(true),
-        entityId: z.string().min(1),
-        ssoUrl: z.url(),
-        sloUrl: z.url().optional(),
-        x509Certificates: z.array(z.string()),
-        nameIdFormat: z.string().optional(),
-        source: z.literal(SsoConnectionDiscoverySource.SAML_METADATA),
+        supported: z.literal(true).describe('`true`: the metadata was fetched and read.'),
+        entityId: z.string().min(1).describe("The identity provider's entity ID, from the metadata."),
+        ssoUrl: z.url().describe("The identity provider's single sign-on URL, from the metadata."),
+        sloUrl: z.url().optional().describe("The identity provider's single-logout URL, when the metadata declares one."),
+        x509Certificates: z.array(z.string()).describe("The identity provider's X.509 certificates, from the metadata."),
+        nameIdFormat: z.string().optional().describe('The name identifier format the identity provider declares, when the metadata carries one.'),
+        source: z
+            .literal(SsoConnectionDiscoverySource.SAML_METADATA)
+            .describe('Where these values came from: the SAML metadata document at `metadataUrl`.'),
     }),
+    /*
+     * OpenID Connect discovery (#1800). `issuerUrl` was accepted and never read: the operation answered
+     * `supported: false` whatever it said. The field names are the connection's own `oidc.*` names, so a
+     * form can merge the result straight into a connection, as the SAML wizard does with `saml.*`.
+     *
+     * A failed discovery is a 400 (`oidc_discovery_failed`) naming why — not an HTTPS issuer, unreachable,
+     * not a JSON object, a required endpoint missing, or an issuer the document does not assert — rather
+     * than a response member, exactly as a SAML metadata failure is.
+     */
     z.strictObject({
         protocol: z.literal(SsoProtocol.OIDC),
-        supported: z.literal(false),
-        message: z.string().min(1),
+        supported: z.literal(true).describe('`true`: the discovery document was fetched and read.'),
+        issuer: z.url().describe("The provider's issuer exactly as its discovery document publishes it. An ID token's `iss` claim must equal this string, so store it as `oidc.issuer` unchanged."),
+        authorizationEndpoint: z.url().describe("The provider's authorization endpoint."),
+        tokenEndpoint: z.url().describe("The provider's token endpoint."),
+        userInfoEndpoint: z.url().optional().describe("The provider's userinfo endpoint, when the document declares one."),
+        jwksUri: z.url().describe('Where the provider publishes the keys its ID tokens are signed with.'),
+        endSessionEndpoint: z.url().optional().describe("The provider's logout endpoint, when the document declares one."),
+        scopesSupported: z.array(z.string()).optional().describe('The scopes the provider says it supports, when the document lists them.'),
+        source: z
+            .literal(SsoConnectionDiscoverySource.OIDC_DISCOVERY)
+            .describe("Where these values came from: the discovery document at `<issuerUrl>/.well-known/openid-configuration`."),
     }),
 ]);
 // ── Polymorphic Factory ──────────────────────────────────────────────
@@ -177,7 +229,7 @@ export const ssoConnectionPolymorphicFactories = createPolymorphicResourceConfig
                     variantType: ResourceOperationVariantType.API_CALL,
                     isDefault: true,
                     polymorphicRole: {
-                        [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],
+                        [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN, CORE_ORG_ROLES.ORG_DELEGATED_MANAGE_SSO_SCIM],
                         [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],
                     },
                     riskLevel: ResourceOperationRiskLevel.LOW,
@@ -242,7 +294,7 @@ export const ssoConnectionPolymorphicFactories = createPolymorphicResourceConfig
                     variantType: ResourceOperationVariantType.API_CALL,
                     isDefault: true,
                     polymorphicRole: {
-                        [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],
+                        [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN, CORE_ORG_ROLES.ORG_DELEGATED_MANAGE_SSO_SCIM],
                         [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],
                     },
                     riskLevel: ResourceOperationRiskLevel.MEDIUM,
@@ -258,7 +310,7 @@ export const ssoConnectionPolymorphicFactories = createPolymorphicResourceConfig
                     variantType: ResourceOperationVariantType.API_CALL,
                     isDefault: true,
                     polymorphicRole: {
-                        [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],
+                        [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN, CORE_ORG_ROLES.ORG_DELEGATED_MANAGE_SSO_SCIM],
                         [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],
                     },
                     riskLevel: ResourceOperationRiskLevel.MEDIUM,

package/dist/esm/security/authentications/sso/sso-connection.shared.resources-config.schemas.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"sso-connection.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../../../../src/security/authentications/sso/sso-connection.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,sDAAsD,CAAC;AAC/G,OAAO,EACL,0BAA0B,EAC1B,4BAA4B,GAC7B,MAAM,6CAA6C,CAAC;AACrD,OAAO,EAAE,wBAAwB,EAAE,MAAM,oDAAoD,CAAC;AAC9F,OAAO,EAAE,uCAAuC,EAAE,MAAM,wDAAwD,CAAC;AACjH,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,2CAA2C,CAAC;AAC3F,OAAO,EAAE,WAAW,EAAE,mCAAmC,EAAE,MAAM,iCAAiC,CAAC;AAEnG,wEAAwE;AAExE,MAAM,CAAN,IAAY,wBAGX;AAHD,WAAY,wBAAwB;IAClC,8DAAkC,CAAA;IAClC,oEAAwC,CAAA;AAC1C,CAAC,EAHW,wBAAwB,KAAxB,wBAAwB,QAGnC;AAED,0EAA0E;AAC1E,MAAM,CAAN,IAAY,8BAIX;AAJD,WAAY,8BAA8B;IACxC,+CAAa,CAAA;IACb,qDAAmB,CAAA;IACnB,+CAAa,CAAA;AACf,CAAC,EAJW,8BAA8B,KAA9B,8BAA8B,QAIzC;AAED,2EAA2E;AAC3E,MAAM,CAAN,IAAY,4BAEX;AAFD,WAAY,4BAA4B;IACtC,+DAA+B,CAAA;AACjC,CAAC,EAFW,4BAA4B,KAA5B,4BAA4B,QAEvC;AAED,wEAAwE;AAExE;;;;GAIG;AACH,MAAM,CAAC,MAAM,sCAAsC,GAAG,CAAC,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;AAEzE;;;;;GAKG;AACH,MAAM,CAAC,MAAM,yCAAyC,GAAG,CAAC,CAAC,KAAK,CAAC;IAC/D,CAAC,CAAC,YAAY,CAAC;QACb,WAAW,EAAE,CAAC,CAAC,GAAG,EAAE;QACpB,SAAS,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;KAC9B,CAAC;IACF,CAAC,CAAC,YAAY,CAAC;QACb,SAAS,EAAE,CAAC,CAAC,GAAG,EAAE;QAClB,WAAW,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;KAChC,CAAC;CACH,CAAC,CAAC;AAEH,MAAM,sCAAsC,GAAG,CAAC,CAAC,YAAY,CAAC;IAC5D,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IACrC,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE;IAClB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IAC/B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;CAC9B,CAAC,CAAC;AAEH;;;;GAIG;AACH,MAAM,CAAC,MAAM,uCAAuC,GAAG,CAAC,CAAC,kBAAkB,CAAC,UAAU,EAAE;IACtF,CAAC,CAAC,YAAY,CAAC;QACb,QAAQ,EAAE,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC;QACrC,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;QAC1B,kBAAkB,EAAE,CAAC,CAAC,OAAO,EAAE;QAC/B;;;;;;WAMG;QACH,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;QACvC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;QACzC,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,sCAAsC,CAAC;QAC7D,uEAAuE;QACvE,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;QACvC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;QACzC,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE;QAC5B,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC,8BAA8B,CAAC;QACrD,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;QAC3B,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;KAC9B,CAAC;IACF,CAAC,CAAC,YAAY,CAAC;QACb,QAAQ,EAAE,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC;QACrC,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;QAC3B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;KAC3B,CAAC;CACH,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,CAAC,MAAM,0CAA0C,GAAG,CAAC,CAAC,kBAAkB,CAAC,UAAU,EAAE;IACzF,CAAC,CAAC,YAAY,CAAC;QACb,QAAQ,EAAE,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC;QACrC,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;QAC1B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC3B,MAAM,EAAE,CAAC,CAAC,GAAG,EAAE;QACf,MAAM,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;QAC1B,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;QACrC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QACnC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,4BAA4B,CAAC,aAAa,CAAC;KAC9D,CAAC;IACF,CAAC,CAAC,YAAY,CAAC;QACb,QAAQ,EAAE,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC;QACrC,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;QAC3B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;KAC3B,CAAC;CACH,CAAC,CAAC;AAEH,wEAAwE;AAExE,MAAM,CAAC,MAAM,iCAAiC,GAAG,uCAAuC,CACtF,mCAAmC,EACnC;IACE,gBAAgB,EAAE,IAAI;IACtB,0EAA0E;IAC1E,+EAA+E;IAC/E,8EAA8E;IAC9E,6EAA6E;IAC7E,2EAA2E;IAC3E,8EAA8E;IAC9E,6EAA6E;IAC7E,mFAAmF;IACnF,2EAA2E;IAC3E,mEAAmE;IACnE,EAAE;IACF,sFAAsF;IACtF,2FAA2F;IAC3F,oFAAoF;IACpF,qFAAqF;IACrF,gFAAgF;IAChF,uFAAuF;IACvF,6FAA6F;IAC7F,kBAAkB,EAAE;QAClB,IAAI,EAAE,wBAAwB,CAAC,OAAO;QACtC,IAAI,EAAE,wBAAwB,CAAC,OAAO;KACvC;IACD,eAAe,EAAE,wBAAwB;IACzC,cAAc,EAAE;QACd,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;KAC7B;IACD,uBAAuB,EAAE;QACvB,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,iEAAiE;oBACjE,kEAAkE;oBAClE,wEAAwE;oBACxE,sEAAsE;oBACtE,kEAAkE;oBAClE,uEAAuE;oBACvE,sEAAsE;oBACtE,6CAA6C;oBAC7C,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aAAC;SACL;QACD,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C,CAAC;SACH;QACD,8EAA8E;QAC9E,yEAAyE;QACzE,4EAA4E;QAC5E,4EAA4E;QAC5E,EAAE;QACF,gFAAgF;QAChF,gFAAgF;QAChF,+EAA+E;QAC/E,2DAA2D;QAC3D,kEAAkE;QAClE,qEAAqE;QACrE,2DAA2D;QAC3D,EAAE;QACF,gFAAgF;QAChF,gFAAgF;QAChF,wEAAwE;QACxE,EAAE;QACF,kEAAkE;QAClE,kFAAkF;QAClF,6EAA6E;QAC7E,kFAAkF;QAClF,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,IAAI;iBAC3C,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,IAAI;iBAC3C,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,IAAI;iBAC3C,CAAC;SACH;QACD,CAAC,wBAAwB,CAAC,eAAe,CAAC,EAAE;YAC1C,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,qBAAqB,EAAE,qBAAqB,CAAC,IAAI;oBACjD,UAAU,EAAE,sCAAsC;oBAClD,qEAAqE;oBACrE,2CAA2C;oBAC3C,iBAAiB,EAAE,uCAAuC;iBAC3D,CAAC;SACH;QACD,CAAC,wBAAwB,CAAC,kBAAkB,CAAC,EAAE;YAC7C,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,yCAAyC;oBACrD,qEAAqE;oBACrE,+CAA+C;oBAC/C,iBAAiB,EAAE,0CAA0C;iBAC9D,CAAC;SACH;KACF;CACF,CACF,CAAC","sourcesContent":["/*\n SSO Connection Resource Configuration — Polymorphic\n \n Produces 2 factory functions (ORG + APP) via the polymorphic factory.\n * Spread into the registry factory map:\n * ...ssoConnectionPolymorphicFactories\n /\n\nimport { z } from 'zod';\nimport { CoreResourceOperation, CoreResourceType } from '../../../resources/resources.shared.core.definitions';\nimport {\n ResourceOperationRiskLevel,\n ResourceOperationVariantType,\n} from '../../../resources/resources.shared.schemas';\nimport { ResourceSystemAccessMode } from '../../../resources/resources-config.shared.schemas';\nimport { createPolymorphicResourceConfigurations } from '../../../resources/utils/resource-polymorphism.factory';\nimport { CORE_ORG_ROLES, CORE_APP_ROLES } from '../../authorizations/roles.shared.schemas';\nimport { SsoProtocol, ssoConnectionPolymorphicDeclaration } from './sso-connection.shared.schemas';\n\n// ── Custom Operations ────────────────────────────────────────────────\n\nexport enum SsoConnection_Operations {\n TEST_CONNECTION = 'testConnection',\n DISCOVER_ENDPOINTS = 'discoverEndpoints',\n}\n\n/* Final SAML diagnostic posture after all configured checks complete. /\nexport enum SsoConnectionTestOverallStatus {\n PASS = 'pass',\n WARNING = 'warning',\n FAIL = 'fail',\n}\n\n/* Evidence source that produced a supported endpoint-discovery result. /\nexport enum SsoConnectionDiscoverySource {\n SAML_METADATA = 'saml-metadata',\n}\n\n// ── Request DTOs ─────────────────────────────────────────────────────\n\n/\n TEST_CONNECTION addresses the connection through the resource URL. It has no\n * independent query/body input: accepting a second `connectionId` let callers\n * provide two identities while the service always used `utils.currentObject`.\n /\nexport const SsoConnection_TestConnectionRequestDto = z.strictObject({});\n\n/\n Metadata discovery needs at least one protocol-specific source. The union\n * makes that invariant visible in generated JSON Schema (`anyOf`) as well as at\n * runtime; an object with both sources remains valid and SAML metadata takes\n * precedence until OIDC discovery is implemented.\n /\nexport const SsoConnection_DiscoverEndpointsRequestDto = z.union([\n z.strictObject({\n metadataUrl: z.url(),\n issuerUrl: z.url().optional(),\n }),\n z.strictObject({\n issuerUrl: z.url(),\n metadataUrl: z.url().optional(),\n }),\n]);\n\nconst SsoConnection_CertificateTestResultDto = z.strictObject({\n index: z.number().int().nonnegative(),\n valid: z.boolean(),\n expiresAt: z.string(),\n daysRemaining: z.number().int(),\n algorithm: z.string(),\n fingerprint: z.string(),\n warnings: z.array(z.string()),\n});\n\n/\n Protocol-discriminated result for TEST_CONNECTION. SAML diagnostics are a\n * real implementation; OIDC deliberately reports its unavailable test path as\n * data instead of returning an ambiguous `{ message }` success payload.\n /\nexport const SsoConnection_TestConnectionResponseDto = z.discriminatedUnion('protocol', [\n z.strictObject({\n protocol: z.literal(SsoProtocol.SAML),\n supported: z.literal(true),\n entityIdConfigured: z.boolean(),\n /\n Did the server's probe reach the SSO URL? ABSENT when the server was not allowed to probe it — the\n * outbound-target guard refused the destination (a private address the operator has not declared in\n * `auth.federatedIdentityProviderPrivateNetworks`). Neither `true` nor `false` would be a statement\n * about the endpoint then: SAML sign-in reaches it through the user's browser, so a private IdP the\n * server may not address can still be a working SSO URL. The reason is carried in `warnings` (#516).\n /\n ssoUrlReachable: z.boolean().optional(),\n ssoUrlStatus: z.number().int().optional(),\n certificates: z.array(SsoConnection_CertificateTestResultDto),\n /* As `ssoUrlReachable`; also absent when no SLO URL is configured. /\n sloUrlReachable: z.boolean().optional(),\n sloUrlStatus: z.number().int().optional(),\n spMetadataValid: z.boolean(),\n overallStatus: z.enum(SsoConnectionTestOverallStatus),\n errors: z.array(z.string()),\n warnings: z.array(z.string()),\n }),\n z.strictObject({\n protocol: z.literal(SsoProtocol.OIDC),\n supported: z.literal(false),\n message: z.string().min(1),\n }),\n]);\n\n/\n Protocol-discriminated result for DISCOVER_ENDPOINTS. The operation returns\n * discovered metadata only; it never persists or enriches a connection row.\n /\nexport const SsoConnection_DiscoverEndpointsResponseDto = z.discriminatedUnion('protocol', [\n z.strictObject({\n protocol: z.literal(SsoProtocol.SAML),\n supported: z.literal(true),\n entityId: z.string().min(1),\n ssoUrl: z.url(),\n sloUrl: z.url().optional(),\n x509Certificates: z.array(z.string()),\n nameIdFormat: z.string().optional(),\n source: z.literal(SsoConnectionDiscoverySource.SAML_METADATA),\n }),\n z.strictObject({\n protocol: z.literal(SsoProtocol.OIDC),\n supported: z.literal(false),\n message: z.string().min(1),\n }),\n]);\n\n// ── Polymorphic Factory ──────────────────────────────────────────────\n\nexport const ssoConnectionPolymorphicFactories = createPolymorphicResourceConfigurations(\n ssoConnectionPolymorphicDeclaration,\n {\n isSystemResource: true,\n // Enterprise SSO login initiation is a PRE-AUTH flow: the enterprise OIDC\n // authorize route (`/auth/enterprise/authorize/:orgId/:connectionId`) resolves\n // the target connection BEFORE any user is authenticated, so the caller holds\n // no ORG_ADMIN / APP_ADMIN role the READ ACL demands. The resolver therefore\n // reads the connection through the sanctioned request-triggered ACL-bypass\n // primitive (`AuthOrganizationConfigurationService.loadSsoConnectionAsSystem`\n // → `SystemAccessService.readAsSystem`), which is fail-closed on this opt-in\n // and audited (`SYSTEM_CONTEXT_READ`). READ and LIST are exposed to system access;\n // connection mutation stays admin-gated over the HTTP surface. Mirrors the\n // ORGANIZATION_MEMBERS opt-in read by `resolveActiveMemberOrgIds`.\n //\n // LIST is exposed for the SAME pre-auth reason as READ, one flow later. IdP-INITIATED\n // SAML (an unsolicited assertion, or a LogoutRequest, arriving with no prior AuthnRequest)\n // must resolve the tenant by the assertion's `<Issuer>` entityId BEFORE any user is\n // authenticated — a cross-scope LIST over `saml.entityId`. The resolver reads it via\n // `AuthOrganizationConfigurationService.listSsoConnectionsByEntityIdAsSystem` →\n // `SystemAccessService.listAsSystem`. Without this opt-in, IdP-initiated login AND SLO\n // fail closed (`SAML_UNKNOWN_IDP`) exactly as SP-initiated login did before the READ opt-in.\n systemAccessPolicy: {\n read: ResourceSystemAccessMode.ALLOWED,\n list: ResourceSystemAccessMode.ALLOWED,\n },\n customOperation: SsoConnection_Operations,\n coreOperations: [\n CoreResourceOperation.READ,\n CoreResourceOperation.LIST,\n CoreResourceOperation.CREATE,\n CoreResourceOperation.UPDATE,\n CoreResourceOperation.DELETE,\n ],\n operationsConfiguration: {\n [CoreResourceOperation.READ]: {\n variants: [\n {\n // Service-transport default. The enterprise SSO login-initiation\n // resolver reads a single connection PRE-AUTH via `readAsSystem`,\n // which resolves the READ path through `getServiceOperationPathDefault`\n // — that resolver honours INTERNAL_CALL / API_CALL defaults but NOT a\n // REPOSITORY_ONLY-only op. Declaring an INTERNAL_CALL default (no\n // public HTTP surface — admins list connections via the API_CALL LIST)\n // gives the system read a resolvable service-transport path. Gated by\n // `systemAccessPolicy.read = ALLOWED` above.\n variantType: ResourceOperationVariantType.INTERNAL_CALL,\n isDefault: true,\n polymorphicRole: {\n [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n },\n riskLevel: ResourceOperationRiskLevel.LOW,\n }],\n },\n [CoreResourceOperation.LIST]: {\n variants: [{\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n polymorphicRole: {\n [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n },\n riskLevel: ResourceOperationRiskLevel.LOW,\n }],\n },\n // Writes are INTERNAL_CALL for the SAME reason the READ default above is: the\n // service transport is the only tier that carries the connection's write\n // semantics, and `getServiceOperationPathDefault` (behind every `AsSystem`\n // call) honours INTERNAL_CALL / API_CALL but NOT a REPOSITORY_ONLY-only op.\n //\n // As REPOSITORY_ONLY these three were unreachable in both directions: no system\n // write could resolve a service op-path, AND `doOperation` throws outright on a\n // REPOSITORY_ONLY operation, so the custom implementations carrying the actual\n // write semantics never ran — `connectionId` minting, SAML\n // `x509CertificatePem` → `x509Certificates` normalization, nested\n // `oidc.clientSecret` write-only-secret preservation, and the DELETE\n // last-connection / in-use guards. They are now reachable.\n //\n // Still NO public HTTP surface: only API_CALL / API_CALL_WITH_CALLBACK register\n // routes, so the external exposure is identical to REPOSITORY_ONLY. Admins list\n // via the API_CALL LIST and drive discovery through DISCOVER_ENDPOINTS.\n //\n // The `onParentDelete` cascade is unaffected — it deletes through\n // `childRepository.delete(...)` after a `supportsOperation` check that matches on\n // `operationIdentifier` + `isOperationDefault` only, never on `variantType`.\n // That path still bypasses the service tier and the DELETE custom impl by design.\n [CoreResourceOperation.CREATE]: {\n variants: [{\n variantType: ResourceOperationVariantType.INTERNAL_CALL,\n isDefault: true,\n polymorphicRole: {\n [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n },\n riskLevel: ResourceOperationRiskLevel.HIGH,\n }],\n },\n [CoreResourceOperation.UPDATE]: {\n variants: [{\n variantType: ResourceOperationVariantType.INTERNAL_CALL,\n isDefault: true,\n polymorphicRole: {\n [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n },\n riskLevel: ResourceOperationRiskLevel.HIGH,\n }],\n },\n [CoreResourceOperation.DELETE]: {\n variants: [{\n variantType: ResourceOperationVariantType.INTERNAL_CALL,\n isDefault: true,\n polymorphicRole: {\n [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n },\n riskLevel: ResourceOperationRiskLevel.HIGH,\n }],\n },\n [SsoConnection_Operations.TEST_CONNECTION]: {\n variants: [{\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n polymorphicRole: {\n [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n },\n riskLevel: ResourceOperationRiskLevel.MEDIUM,\n resourceOperationLike: CoreResourceOperation.READ,\n requestDto: SsoConnection_TestConnectionRequestDto,\n // Borrows READ for its route/verb but returns protocol-discriminated\n // diagnostics, not the SSO-connection row.\n customResponseDto: SsoConnection_TestConnectionResponseDto,\n }],\n },\n [SsoConnection_Operations.DISCOVER_ENDPOINTS]: {\n variants: [{\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n polymorphicRole: {\n [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n },\n riskLevel: ResourceOperationRiskLevel.MEDIUM,\n resourceOperationLike: CoreResourceOperation.CREATE,\n requestDto: SsoConnection_DiscoverEndpointsRequestDto,\n // Borrows CREATE for its route/verb but returns discovered metadata,\n // not a created or updated SSO-connection row.\n customResponseDto: SsoConnection_DiscoverEndpointsResponseDto,\n }],\n },\n },\n },\n);\n"]}
1	+ {"version":3,"file":"sso-connection.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../../../src/security/authentications/sso/sso-connection.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,sDAAsD,CAAC;AAC/G,OAAO,EACL,0BAA0B,EAC1B,4BAA4B,GAC7B,MAAM,6CAA6C,CAAC;AACrD,OAAO,EAAE,wBAAwB,EAAE,MAAM,oDAAoD,CAAC;AAC9F,OAAO,EAAE,uCAAuC,EAAE,MAAM,wDAAwD,CAAC;AACjH,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,2CAA2C,CAAC;AAC3F,OAAO,EAAE,WAAW,EAAE,mCAAmC,EAAE,MAAM,iCAAiC,CAAC;AAEnG,wEAAwE;AAExE,MAAM,CAAN,IAAY,wBAGX;AAHD,WAAY,wBAAwB;IAClC,8DAAkC,CAAA;IAClC,oEAAwC,CAAA;AAC1C,CAAC,EAHW,wBAAwB,KAAxB,wBAAwB,QAGnC;AAED,0EAA0E;AAC1E,MAAM,CAAN,IAAY,8BAIX;AAJD,WAAY,8BAA8B;IACxC,+CAAa,CAAA;IACb,qDAAmB,CAAA;IACnB,+CAAa,CAAA;AACf,CAAC,EAJW,8BAA8B,KAA9B,8BAA8B,QAIzC;AAED,2EAA2E;AAC3E,MAAM,CAAN,IAAY,4BAIX;AAJD,WAAY,4BAA4B;IACtC,+DAA+B,CAAA;IAC/B,iGAAiG;IACjG,iEAAiC,CAAA;AACnC,CAAC,EAJW,4BAA4B,KAA5B,4BAA4B,QAIvC;AAED,wEAAwE;AAExE;;;;GAIG;AACH,MAAM,CAAC,MAAM,sCAAsC,GAAG,CAAC,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;AAEzE;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,yCAAyC,GAAG,CAAC,CAAC,KAAK,CAAC;IAC/D,CAAC,CAAC,YAAY,CAAC;QACb,WAAW,EAAE,CAAC;aACX,GAAG,EAAE;aACL,QAAQ,CAAC,iIAAiI,CAAC;QAC9I,SAAS,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,2EAA2E,CAAC;KACpH,CAAC;IACF,CAAC,CAAC,YAAY,CAAC;QACb,SAAS,EAAE,CAAC;aACT,GAAG,EAAE;aACL,QAAQ,CAAC,uJAAuJ,CAAC;QACpK,WAAW,EAAE,CAAC;aACX,GAAG,EAAE;aACL,QAAQ,EAAE;aACV,QAAQ,CAAC,6IAA6I,CAAC;KAC3J,CAAC;CACH,CAAC,CAAC;AAEH,MAAM,sCAAsC,GAAG,CAAC,CAAC,YAAY,CAAC;IAC5D,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,iFAAiF,CAAC;IACjI,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,CAAC,uFAAuF,CAAC;IACpH,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,uGAAuG,CAAC;IACvI,aAAa,EAAE,CAAC;SACb,MAAM,EAAE;SACR,GAAG,EAAE;SACL,QAAQ,CAAC,sHAAsH,CAAC;IACnI,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,gFAAgF,CAAC;IAChH,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,8GAA8G,CAAC;IAChJ,QAAQ,EAAE,CAAC;SACR,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;SACjB,QAAQ,CAAC,4HAA4H,CAAC;CAC1I,CAAC,CAAC;AAEH;;;;GAIG;AACH,MAAM,CAAC,MAAM,uCAAuC,GAAG,CAAC,CAAC,kBAAkB,CAAC,UAAU,EAAE;IACtF,CAAC,CAAC,YAAY,CAAC;QACb,QAAQ,EAAE,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC;QACrC,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,oCAAoC,CAAC;QACzE,kBAAkB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,CAAC,qEAAqE,CAAC;QAC/G;;;;;;WAMG;QACH,eAAe,EAAE,CAAC;aACf,OAAO,EAAE;aACT,QAAQ,EAAE;aACV,QAAQ,CACP,yQAAyQ,CAC1Q;QACH,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,2EAA2E,CAAC;QAC/H,YAAY,EAAE,CAAC;aACZ,KAAK,CAAC,sCAAsC,CAAC;aAC7C,QAAQ,CAAC,mGAAmG,CAAC;QAChH,uEAAuE;QACvE,eAAe,EAAE,CAAC;aACf,OAAO,EAAE;aACT,QAAQ,EAAE;aACV,QAAQ,CAAC,8IAA8I,CAAC;QAC3J,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,oGAAoG,CAAC;QACxJ,eAAe,EAAE,CAAC;aACf,OAAO,EAAE;aACT,QAAQ,CAAC,oLAAoL,CAAC;QACjM,aAAa,EAAE,CAAC;aACb,IAAI,CAAC,8BAA8B,CAAC;aACpC,QAAQ,CAAC,iHAAiH,CAAC;QAC9H,MAAM,EAAE,CAAC;aACN,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;aACjB,QAAQ,CAAC,mIAAmI,CAAC;QAChJ,QAAQ,EAAE,CAAC;aACR,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;aACjB,QAAQ,CAAC,wIAAwI,CAAC;KACtJ,CAAC;IACF,CAAC,CAAC,YAAY,CAAC;QACb,QAAQ,EAAE,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC;QACrC,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,sFAAsF,CAAC;QAC5H,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,+BAA+B,CAAC;KACrE,CAAC;CACH,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,CAAC,MAAM,0CAA0C,GAAG,CAAC,CAAC,kBAAkB,CAAC,UAAU,EAAE;IACzF,CAAC,CAAC,YAAY,CAAC;QACb,QAAQ,EAAE,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC;QACrC,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,4CAA4C,CAAC;QACjF,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,uDAAuD,CAAC;QAC7F,MAAM,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,gEAAgE,CAAC;QAC1F,MAAM,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,4EAA4E,CAAC;QACjH,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC,gEAAgE,CAAC;QAChH,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,2FAA2F,CAAC;QACzI,MAAM,EAAE,CAAC;aACN,OAAO,CAAC,4BAA4B,CAAC,aAAa,CAAC;aACnD,QAAQ,CAAC,4EAA4E,CAAC;KAC1F,CAAC;IACF;;;;;;;;OAQG;IACH,CAAC,CAAC,YAAY,CAAC;QACb,QAAQ,EAAE,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC;QACrC,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,sDAAsD,CAAC;QAC3F,MAAM,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,iKAAiK,CAAC;QAC3L,qBAAqB,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,wCAAwC,CAAC;QACjF,aAAa,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,gCAAgC,CAAC;QACjE,gBAAgB,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,mEAAmE,CAAC;QAClH,OAAO,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,sEAAsE,CAAC;QACjG,kBAAkB,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,iEAAiE,CAAC;QAClH,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,yEAAyE,CAAC;QACnI,MAAM,EAAE,CAAC;aACN,OAAO,CAAC,4BAA4B,CAAC,cAAc,CAAC;aACpD,QAAQ,CAAC,yGAAyG,CAAC;KACvH,CAAC;CACH,CAAC,CAAC;AAEH,wEAAwE;AAExE,MAAM,CAAC,MAAM,iCAAiC,GAAG,uCAAuC,CACtF,mCAAmC,EACnC;IACE,gBAAgB,EAAE,IAAI;IACtB,0EAA0E;IAC1E,+EAA+E;IAC/E,8EAA8E;IAC9E,6EAA6E;IAC7E,2EAA2E;IAC3E,8EAA8E;IAC9E,6EAA6E;IAC7E,mFAAmF;IACnF,2EAA2E;IAC3E,mEAAmE;IACnE,EAAE;IACF,sFAAsF;IACtF,2FAA2F;IAC3F,oFAAoF;IACpF,qFAAqF;IACrF,gFAAgF;IAChF,uFAAuF;IACvF,6FAA6F;IAC7F,kBAAkB,EAAE;QAClB,IAAI,EAAE,wBAAwB,CAAC,OAAO;QACtC,IAAI,EAAE,wBAAwB,CAAC,OAAO;KACvC;IACD,eAAe,EAAE,wBAAwB;IACzC,cAAc,EAAE;QACd,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;KAC7B;IACD,uBAAuB,EAAE;QACvB,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,iEAAiE;oBACjE,kEAAkE;oBAClE,wEAAwE;oBACxE,sEAAsE;oBACtE,kEAAkE;oBAClE,uEAAuE;oBACvE,sEAAsE;oBACtE,6CAA6C;oBAC7C,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aAAC;SACL;QACD,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,6BAA6B,CAAC;wBAC1G,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C,CAAC;SACH;QACD,8EAA8E;QAC9E,yEAAyE;QACzE,4EAA4E;QAC5E,4EAA4E;QAC5E,EAAE;QACF,gFAAgF;QAChF,gFAAgF;QAChF,+EAA+E;QAC/E,2DAA2D;QAC3D,kEAAkE;QAClE,qEAAqE;QACrE,2DAA2D;QAC3D,EAAE;QACF,gFAAgF;QAChF,gFAAgF;QAChF,wEAAwE;QACxE,EAAE;QACF,kEAAkE;QAClE,kFAAkF;QAClF,6EAA6E;QAC7E,kFAAkF;QAClF,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,IAAI;iBAC3C,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,IAAI;iBAC3C,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,IAAI;iBAC3C,CAAC;SACH;QACD,CAAC,wBAAwB,CAAC,eAAe,CAAC,EAAE;YAC1C,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,6BAA6B,CAAC;wBAC1G,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,qBAAqB,EAAE,qBAAqB,CAAC,IAAI;oBACjD,UAAU,EAAE,sCAAsC;oBAClD,qEAAqE;oBACrE,2CAA2C;oBAC3C,iBAAiB,EAAE,uCAAuC;iBAC3D,CAAC;SACH;QACD,CAAC,wBAAwB,CAAC,kBAAkB,CAAC,EAAE;YAC7C,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,6BAA6B,CAAC;wBAC1G,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,yCAAyC;oBACrD,qEAAqE;oBACrE,+CAA+C;oBAC/C,iBAAiB,EAAE,0CAA0C;iBAC9D,CAAC;SACH;KACF;CACF,CACF,CAAC","sourcesContent":["/*\n SSO Connection Resource Configuration — Polymorphic\n \n Produces 2 factory functions (ORG + APP) via the polymorphic factory.\n * Spread into the registry factory map:\n * ...ssoConnectionPolymorphicFactories\n /\n\nimport { z } from 'zod';\nimport { CoreResourceOperation, CoreResourceType } from '../../../resources/resources.shared.core.definitions';\nimport {\n ResourceOperationRiskLevel,\n ResourceOperationVariantType,\n} from '../../../resources/resources.shared.schemas';\nimport { ResourceSystemAccessMode } from '../../../resources/resources-config.shared.schemas';\nimport { createPolymorphicResourceConfigurations } from '../../../resources/utils/resource-polymorphism.factory';\nimport { CORE_ORG_ROLES, CORE_APP_ROLES } from '../../authorizations/roles.shared.schemas';\nimport { SsoProtocol, ssoConnectionPolymorphicDeclaration } from './sso-connection.shared.schemas';\n\n// ── Custom Operations ────────────────────────────────────────────────\n\nexport enum SsoConnection_Operations {\n TEST_CONNECTION = 'testConnection',\n DISCOVER_ENDPOINTS = 'discoverEndpoints',\n}\n\n/* Final SAML diagnostic posture after all configured checks complete. /\nexport enum SsoConnectionTestOverallStatus {\n PASS = 'pass',\n WARNING = 'warning',\n FAIL = 'fail',\n}\n\n/* Evidence source that produced a supported endpoint-discovery result. /\nexport enum SsoConnectionDiscoverySource {\n SAML_METADATA = 'saml-metadata',\n /* The OpenID Provider's `/.well-known/openid-configuration` document at `issuerUrl` (#1800). /\n OIDC_DISCOVERY = 'oidc-discovery',\n}\n\n// ── Request DTOs ─────────────────────────────────────────────────────\n\n/\n TEST_CONNECTION addresses the connection through the resource URL. It has no\n * independent query/body input: accepting a second `connectionId` let callers\n * provide two identities while the service always used `utils.currentObject`.\n /\nexport const SsoConnection_TestConnectionRequestDto = z.strictObject({});\n\n/\n Metadata discovery needs at least one protocol-specific source. The union\n * makes that invariant visible in generated JSON Schema (`anyOf`) as well as at\n * runtime. `metadataUrl` discovers a SAML provider and `issuerUrl` an OpenID\n * Connect one; an object with both remains valid and SAML metadata takes\n * precedence, since the two describe different connections and the operation\n * answers one protocol.\n /\nexport const SsoConnection_DiscoverEndpointsRequestDto = z.union([\n z.strictObject({\n metadataUrl: z\n .url()\n .describe(\"The URL of the identity provider's SAML metadata document. The server fetches and reads it; nothing is saved to the connection.\"),\n issuerUrl: z.url().optional().describe(\"An OpenID Connect provider's issuer. Ignored when `metadataUrl` is given.\"),\n }),\n z.strictObject({\n issuerUrl: z\n .url()\n .describe(\"An OpenID Connect provider's issuer. The server fetches `<issuer>/.well-known/openid-configuration` and reads it; nothing is saved to the connection.\"),\n metadataUrl: z\n .url()\n .optional()\n .describe(\"The URL of the identity provider's SAML metadata document. When given, the server fetches and reads it; nothing is saved to the connection.\"),\n }),\n]);\n\nconst SsoConnection_CertificateTestResultDto = z.strictObject({\n index: z.number().int().nonnegative().describe(\"The certificate's position in the connection's certificate list, starting at 0.\"),\n valid: z.boolean().describe('`true` when the certificate could be read and today falls within its validity period.'),\n expiresAt: z.string().describe('When the certificate expires, as an ISO 8601 date-time. Empty when the certificate could not be read.'),\n daysRemaining: z\n .number()\n .int()\n .describe('Whole days until the certificate expires; negative once it has expired. `-1` when the certificate could not be read.'),\n algorithm: z.string().describe(\"The certificate's signature algorithm, or `unknown` when it is not recognised.\"),\n fingerprint: z.string().describe(\"The certificate's SHA-256 fingerprint, as colon-separated hex. Empty when the certificate could not be read.\"),\n warnings: z\n .array(z.string())\n .describe('Problems found with this certificate: expired or not yet valid, expiring within 30 days, a SHA-1 signature, or unreadable.'),\n});\n\n/\n Protocol-discriminated result for TEST_CONNECTION. SAML diagnostics are a\n * real implementation; OIDC deliberately reports its unavailable test path as\n * data instead of returning an ambiguous `{ message }` success payload.\n /\nexport const SsoConnection_TestConnectionResponseDto = z.discriminatedUnion('protocol', [\n z.strictObject({\n protocol: z.literal(SsoProtocol.SAML),\n supported: z.literal(true).describe('`true`: the connection was tested.'),\n entityIdConfigured: z.boolean().describe(\"Whether the identity provider's entity ID is set on the connection.\"),\n /\n Did the server's probe reach the SSO URL? ABSENT when the server was not allowed to probe it — the\n * outbound-target guard refused the destination (a private address the operator has not declared in\n * `auth.federatedIdentityProviderPrivateNetworks`). Neither `true` nor `false` would be a statement\n * about the endpoint then: SAML sign-in reaches it through the user's browser, so a private IdP the\n * server may not address can still be a working SSO URL. The reason is carried in `warnings` (#516).\n /\n ssoUrlReachable: z\n .boolean()\n .optional()\n .describe(\n \"Whether the server got an HTTP response from the SSO URL, whatever its status. `false` when it did not answer or no SSO URL is set. Absent when the server may not connect to that address, because sign-in reaches it through the user's browser; `warnings` says why.\",\n ),\n ssoUrlStatus: z.number().int().optional().describe('The HTTP status the SSO URL answered with. Absent when it did not answer.'),\n certificates: z\n .array(SsoConnection_CertificateTestResultDto)\n .describe(\"One result per X.509 certificate configured for the identity provider, in the connection's order.\"),\n /* As `ssoUrlReachable`; also absent when no SLO URL is configured. /\n sloUrlReachable: z\n .boolean()\n .optional()\n .describe('Whether the server got an HTTP response from the single-logout URL, checked like `ssoUrlReachable`. Absent when no single-logout URL is set.'),\n sloUrlStatus: z.number().int().optional().describe('The HTTP status the single-logout URL answered with. Absent when it did not answer or none is set.'),\n spMetadataValid: z\n .boolean()\n .describe(\"Whether this application can generate valid service-provider metadata for the connection. `false` means the application's own SAML settings are incomplete, reported as a warning.\"),\n overallStatus: z\n .enum(SsoConnectionTestOverallStatus)\n .describe('The verdict: `fail` when there is at least one error, `warning` when there are only warnings, `pass` otherwise.'),\n errors: z\n .array(z.string())\n .describe('Problems that stop sign-in from working, such as a missing entity ID or SSO URL, an unreachable SSO URL, or no valid certificate.'),\n warnings: z\n .array(z.string())\n .describe('Problems worth fixing that do not by themselves stop sign-in, such as a certificate expiring soon or an unreachable single-logout URL.'),\n }),\n z.strictObject({\n protocol: z.literal(SsoProtocol.OIDC),\n supported: z.literal(false).describe('`false`: OpenID Connect connections cannot be tested yet, and nothing was attempted.'),\n message: z.string().min(1).describe('Explains why no test was run.'),\n }),\n]);\n\n/\n Protocol-discriminated result for DISCOVER_ENDPOINTS. The operation returns\n * discovered metadata only; it never persists or enriches a connection row.\n /\nexport const SsoConnection_DiscoverEndpointsResponseDto = z.discriminatedUnion('protocol', [\n z.strictObject({\n protocol: z.literal(SsoProtocol.SAML),\n supported: z.literal(true).describe('`true`: the metadata was fetched and read.'),\n entityId: z.string().min(1).describe(\"The identity provider's entity ID, from the metadata.\"),\n ssoUrl: z.url().describe(\"The identity provider's single sign-on URL, from the metadata.\"),\n sloUrl: z.url().optional().describe(\"The identity provider's single-logout URL, when the metadata declares one.\"),\n x509Certificates: z.array(z.string()).describe(\"The identity provider's X.509 certificates, from the metadata.\"),\n nameIdFormat: z.string().optional().describe('The name identifier format the identity provider declares, when the metadata carries one.'),\n source: z\n .literal(SsoConnectionDiscoverySource.SAML_METADATA)\n .describe('Where these values came from: the SAML metadata document at `metadataUrl`.'),\n }),\n /\n * OpenID Connect discovery (#1800). `issuerUrl` was accepted and never read: the operation answered\n * `supported: false` whatever it said. The field names are the connection's own `oidc.` names, so a\n form can merge the result straight into a connection, as the SAML wizard does with `saml.`.\n \n * A failed discovery is a 400 (`oidc_discovery_failed`) naming why — not an HTTPS issuer, unreachable,\n * not a JSON object, a required endpoint missing, or an issuer the document does not assert — rather\n * than a response member, exactly as a SAML metadata failure is.\n /\n z.strictObject({\n protocol: z.literal(SsoProtocol.OIDC),\n supported: z.literal(true).describe('`true`: the discovery document was fetched and read.'),\n issuer: z.url().describe(\"The provider's issuer exactly as its discovery document publishes it. An ID token's `iss` claim must equal this string, so store it as `oidc.issuer` unchanged.\"),\n authorizationEndpoint: z.url().describe(\"The provider's authorization endpoint.\"),\n tokenEndpoint: z.url().describe(\"The provider's token endpoint.\"),\n userInfoEndpoint: z.url().optional().describe(\"The provider's userinfo endpoint, when the document declares one.\"),\n jwksUri: z.url().describe('Where the provider publishes the keys its ID tokens are signed with.'),\n endSessionEndpoint: z.url().optional().describe(\"The provider's logout endpoint, when the document declares one.\"),\n scopesSupported: z.array(z.string()).optional().describe('The scopes the provider says it supports, when the document lists them.'),\n source: z\n .literal(SsoConnectionDiscoverySource.OIDC_DISCOVERY)\n .describe(\"Where these values came from: the discovery document at `<issuerUrl>/.well-known/openid-configuration`.\"),\n }),\n]);\n\n// ── Polymorphic Factory ──────────────────────────────────────────────\n\nexport const ssoConnectionPolymorphicFactories = createPolymorphicResourceConfigurations(\n ssoConnectionPolymorphicDeclaration,\n {\n isSystemResource: true,\n // Enterprise SSO login initiation is a PRE-AUTH flow: the enterprise OIDC\n // authorize route (`/auth/enterprise/authorize/:orgId/:connectionId`) resolves\n // the target connection BEFORE any user is authenticated, so the caller holds\n // no ORG_ADMIN / APP_ADMIN role the READ ACL demands. The resolver therefore\n // reads the connection through the sanctioned request-triggered ACL-bypass\n // primitive (`AuthOrganizationConfigurationService.loadSsoConnectionAsSystem`\n // → `SystemAccessService.readAsSystem`), which is fail-closed on this opt-in\n // and audited (`SYSTEM_CONTEXT_READ`). READ and LIST are exposed to system access;\n // connection mutation stays admin-gated over the HTTP surface. Mirrors the\n // ORGANIZATION_MEMBERS opt-in read by `resolveActiveMemberOrgIds`.\n //\n // LIST is exposed for the SAME pre-auth reason as READ, one flow later. IdP-INITIATED\n // SAML (an unsolicited assertion, or a LogoutRequest, arriving with no prior AuthnRequest)\n // must resolve the tenant by the assertion's `<Issuer>` entityId BEFORE any user is\n // authenticated — a cross-scope LIST over `saml.entityId`. The resolver reads it via\n // `AuthOrganizationConfigurationService.listSsoConnectionsByEntityIdAsSystem` →\n // `SystemAccessService.listAsSystem`. Without this opt-in, IdP-initiated login AND SLO\n // fail closed (`SAML_UNKNOWN_IDP`) exactly as SP-initiated login did before the READ opt-in.\n systemAccessPolicy: {\n read: ResourceSystemAccessMode.ALLOWED,\n list: ResourceSystemAccessMode.ALLOWED,\n },\n customOperation: SsoConnection_Operations,\n coreOperations: [\n CoreResourceOperation.READ,\n CoreResourceOperation.LIST,\n CoreResourceOperation.CREATE,\n CoreResourceOperation.UPDATE,\n CoreResourceOperation.DELETE,\n ],\n operationsConfiguration: {\n [CoreResourceOperation.READ]: {\n variants: [\n {\n // Service-transport default. The enterprise SSO login-initiation\n // resolver reads a single connection PRE-AUTH via `readAsSystem`,\n // which resolves the READ path through `getServiceOperationPathDefault`\n // — that resolver honours INTERNAL_CALL / API_CALL defaults but NOT a\n // REPOSITORY_ONLY-only op. Declaring an INTERNAL_CALL default (no\n // public HTTP surface — admins list connections via the API_CALL LIST)\n // gives the system read a resolvable service-transport path. Gated by\n // `systemAccessPolicy.read = ALLOWED` above.\n variantType: ResourceOperationVariantType.INTERNAL_CALL,\n isDefault: true,\n polymorphicRole: {\n [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n },\n riskLevel: ResourceOperationRiskLevel.LOW,\n }],\n },\n [CoreResourceOperation.LIST]: {\n variants: [{\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n polymorphicRole: {\n [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN, CORE_ORG_ROLES.ORG_DELEGATED_MANAGE_SSO_SCIM],\n [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n },\n riskLevel: ResourceOperationRiskLevel.LOW,\n }],\n },\n // Writes are INTERNAL_CALL for the SAME reason the READ default above is: the\n // service transport is the only tier that carries the connection's write\n // semantics, and `getServiceOperationPathDefault` (behind every `AsSystem`\n // call) honours INTERNAL_CALL / API_CALL but NOT a REPOSITORY_ONLY-only op.\n //\n // As REPOSITORY_ONLY these three were unreachable in both directions: no system\n // write could resolve a service op-path, AND `doOperation` throws outright on a\n // REPOSITORY_ONLY operation, so the custom implementations carrying the actual\n // write semantics never ran — `connectionId` minting, SAML\n // `x509CertificatePem` → `x509Certificates` normalization, nested\n // `oidc.clientSecret` write-only-secret preservation, and the DELETE\n // last-connection / in-use guards. They are now reachable.\n //\n // Still NO public HTTP surface: only API_CALL / API_CALL_WITH_CALLBACK register\n // routes, so the external exposure is identical to REPOSITORY_ONLY. Admins list\n // via the API_CALL LIST and drive discovery through DISCOVER_ENDPOINTS.\n //\n // The `onParentDelete` cascade is unaffected — it deletes through\n // `childRepository.delete(...)` after a `supportsOperation` check that matches on\n // `operationIdentifier` + `isOperationDefault` only, never on `variantType`.\n // That path still bypasses the service tier and the DELETE custom impl by design.\n [CoreResourceOperation.CREATE]: {\n variants: [{\n variantType: ResourceOperationVariantType.INTERNAL_CALL,\n isDefault: true,\n polymorphicRole: {\n [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n },\n riskLevel: ResourceOperationRiskLevel.HIGH,\n }],\n },\n [CoreResourceOperation.UPDATE]: {\n variants: [{\n variantType: ResourceOperationVariantType.INTERNAL_CALL,\n isDefault: true,\n polymorphicRole: {\n [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n },\n riskLevel: ResourceOperationRiskLevel.HIGH,\n }],\n },\n [CoreResourceOperation.DELETE]: {\n variants: [{\n variantType: ResourceOperationVariantType.INTERNAL_CALL,\n isDefault: true,\n polymorphicRole: {\n [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n },\n riskLevel: ResourceOperationRiskLevel.HIGH,\n }],\n },\n [SsoConnection_Operations.TEST_CONNECTION]: {\n variants: [{\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n polymorphicRole: {\n [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN, CORE_ORG_ROLES.ORG_DELEGATED_MANAGE_SSO_SCIM],\n [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n },\n riskLevel: ResourceOperationRiskLevel.MEDIUM,\n resourceOperationLike: CoreResourceOperation.READ,\n requestDto: SsoConnection_TestConnectionRequestDto,\n // Borrows READ for its route/verb but returns protocol-discriminated\n // diagnostics, not the SSO-connection row.\n customResponseDto: SsoConnection_TestConnectionResponseDto,\n }],\n },\n [SsoConnection_Operations.DISCOVER_ENDPOINTS]: {\n variants: [{\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n polymorphicRole: {\n [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN, CORE_ORG_ROLES.ORG_DELEGATED_MANAGE_SSO_SCIM],\n [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n },\n riskLevel: ResourceOperationRiskLevel.MEDIUM,\n resourceOperationLike: CoreResourceOperation.CREATE,\n requestDto: SsoConnection_DiscoverEndpointsRequestDto,\n // Borrows CREATE for its route/verb but returns discovered metadata,\n // not a created or updated SSO-connection row.\n customResponseDto: SsoConnection_DiscoverEndpointsResponseDto,\n }],\n },\n },\n },\n);\n"]}

package/dist/esm/security/authentications/sso/sso-connection.shared.schemas.d.ts CHANGED Viewed

@@ -80,11 +80,6 @@ export declare const SsoConnectionBaseSchema: z.ZodObject<{
             readonly TRANSIENT: "urn:oasis:names:tc:SAML:2.0:nameid-format:transient";
         }>>>;
         allowIdpInitiated: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodBoolean>>;
-        auditSettings: z.ZodObject<{
-            logAuthAttempts: z.ZodDefault<z.ZodBoolean>;
-            logAttributeMapping: z.ZodDefault<z.ZodBoolean>;
-            retentionDays: z.ZodDefault<z.ZodNumber>;
-        }, z.core.$strip>;
     }, z.core.$strip>>;
     oidc: z.ZodOptional<z.ZodObject<{
         templateMode: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodEnum<{
@@ -138,15 +133,8 @@ export declare const SsoConnectionBaseSchema: z.ZodObject<{
             readonly S256: "S256";
             readonly PLAIN: "plain";
         }>>>;
-        auditSettings: z.ZodObject<{
-            logAuthAttempts: z.ZodDefault<z.ZodBoolean>;
-            logTokenExchange: z.ZodDefault<z.ZodBoolean>;
-            logClaimsMapping: z.ZodDefault<z.ZodBoolean>;
-            retentionDays: z.ZodDefault<z.ZodNumber>;
-        }, z.core.$strip>;
     }, z.core.$strip>>;
     autoCreateUsers: z.ZodDefault<z.ZodBoolean>;
-    autoVerifyEmail: z.ZodDefault<z.ZodBoolean>;
     defaultRole: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodString>>;
     allowedDomains: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodArray<z.ZodString>>>>;
     allowedDirectoryIds: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodArray<z.ZodString>>>;
@@ -191,11 +179,6 @@ export declare const ssoConnectionPolymorphicDeclaration: import("../../..").Pol
             readonly TRANSIENT: "urn:oasis:names:tc:SAML:2.0:nameid-format:transient";
         }>>>;
         allowIdpInitiated: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodBoolean>>;
-        auditSettings: z.ZodObject<{
-            logAuthAttempts: z.ZodDefault<z.ZodBoolean>;
-            logAttributeMapping: z.ZodDefault<z.ZodBoolean>;
-            retentionDays: z.ZodDefault<z.ZodNumber>;
-        }, z.core.$strip>;
     }, z.core.$strip>>;
     oidc: z.ZodOptional<z.ZodObject<{
         templateMode: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodEnum<{
@@ -249,15 +232,8 @@ export declare const ssoConnectionPolymorphicDeclaration: import("../../..").Pol
             readonly S256: "S256";
             readonly PLAIN: "plain";
         }>>>;
-        auditSettings: z.ZodObject<{
-            logAuthAttempts: z.ZodDefault<z.ZodBoolean>;
-            logTokenExchange: z.ZodDefault<z.ZodBoolean>;
-            logClaimsMapping: z.ZodDefault<z.ZodBoolean>;
-            retentionDays: z.ZodDefault<z.ZodNumber>;
-        }, z.core.$strip>;
     }, z.core.$strip>>;
     autoCreateUsers: z.ZodDefault<z.ZodBoolean>;
-    autoVerifyEmail: z.ZodDefault<z.ZodBoolean>;
     defaultRole: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodString>>;
     allowedDomains: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodArray<z.ZodString>>>>;
     allowedDirectoryIds: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodArray<z.ZodString>>>;

package/dist/esm/security/authentications/sso/sso-connection.shared.schemas.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"sso-connection.shared.schemas.d.ts","sourceRoot":"","sources":["~~../../../../../../~~src/security/authentications/sso/sso-connection.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,2EAA2E;AAC3E,oBAAY,WAAW;IACrB,IAAI,SAAS;IACb,IAAI,SAAS;CACd;AAED,eAAO,MAAM,eAAe;;;;CAIlB,CAAC;AAEX,eAAO,MAAM,eAAe;;;;CAIlB,CAAC;AAEX,eAAO,MAAM,eAAe;;;;CAIlB,CAAC;AAEX,eAAO,MAAM,SAAS;;;;;CAKZ,CAAC;AAEX,eAAO,MAAM,aAAa;;;CAGhB,CAAC;AAEX,eAAO,MAAM,gBAAgB;;;;;CAKnB,CAAC;AAEX,eAAO,MAAM,uBAAuB~~;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAqPlC~~,CAAC;AAMH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE,eAAO,MAAM,mCAAmC~~;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;~~kBAQ9C,CAAC"}
1	+ {"version":3,"file":"sso-connection.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/security/authentications/sso/sso-connection.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,2EAA2E;AAC3E,oBAAY,WAAW;IACrB,IAAI,SAAS;IACb,IAAI,SAAS;CACd;AAED,eAAO,MAAM,eAAe;;;;CAIlB,CAAC;AAEX,eAAO,MAAM,eAAe;;;;CAIlB,CAAC;AAEX,eAAO,MAAM,eAAe;;;;CAIlB,CAAC;AAEX,eAAO,MAAM,SAAS;;;;;CAKZ,CAAC;AAEX,eAAO,MAAM,aAAa;;;CAGhB,CAAC;AAEX,eAAO,MAAM,gBAAgB;;;;;CAKnB,CAAC;AAEX,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAgQlC,CAAC;AAMH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE,eAAO,MAAM,mCAAmC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAQ9C,CAAC"}

package/dist/esm/security/authentications/sso/sso-connection.shared.schemas.js CHANGED Viewed

@@ -60,7 +60,14 @@ export const SsoConnectionBaseSchema = z.object({
     // assurance-control: WILDO.IDENTITY.SESSION_ASSURANCE — the live/dead switch and the default IdP
     // decide which identity provider is trusted to authenticate this tenant.
     enabled: z.boolean().default(true).isSummaryField().isAuditEvidence(),
-    isDefault: z.boolean().default(false).isAuditEvidence(),
+    // Read by `selectSsoConnectionForRouting` (#1800): among the eligible connections equally specific to
+    // the signing-in user's domain, the default receives the sign-in. A write that makes one connection
+    // the default demotes the scope's others in the same transaction.
+    isDefault: z
+        .boolean()
+        .default(false)
+        .isAuditEvidence()
+        .describe("Whether sign-ins go to this connection when several of this organization's connections could take them. A connection that names the user's email domain in `allowedDomains` still wins over a default that accepts any domain. Making a connection the default removes the flag from the others."),
     // `.isAuditEvidence()` on the SAML leaves below — they say WHERE this connection federates
     // (`entityId` / `ssoUrl` / `sloUrl`) and HOW strictly it validates the IdP (`signRequests`,
     // `wantAssertionsSigned`, `allowedClockDrift`, `forceAuthn`, `maxAuthAge`, `nameIdFormat`,
@@ -68,33 +75,33 @@ export const SsoConnectionBaseSchema = z.object({
     // assertions — an authentication-assurance change the field NAME alone cannot evidence — so a
     // reviewer must see the before/after value. Marked per LEAF, never on the `saml` container: the
     // certificate material (`x509Certificates` / `x509CertificatePem`) sits beside these and marking the
-    // container would copy key material into an unerasable ledger. The two-level `attributeMapping` /
-    // `auditSettings` leaves are deliberately NOT marked — the evidence resolver reaches one level of
-    // nesting only, so a marker there would be inert.
+    // container would copy key material into an unerasable ledger. The two-level `attributeMapping`
+    // leaves are deliberately NOT marked — the evidence resolver reaches one level of nesting only, so a
+    // marker there would be inert.
     // assurance-control: WILDO.IDENTITY.SESSION_ASSURANCE — the IdP endpoints and signature/replay
     // validation posture decide which provider is trusted to authenticate this tenant and whether its
     // assertions are actually verified.
     saml: z.object({
-        entityId: z.string().min(1).isAuditEvidence(),
-        ssoUrl: z.url().isAuditEvidence(),
-        sloUrl: z.url().optional().isAuditEvidence(),
+        entityId: z.string().min(1).isAuditEvidence().describe("The identity provider's SAML entity ID: the issuer its assertions name, and how a sign-in the provider starts is matched to this connection."),
+        ssoUrl: z.url().isAuditEvidence().describe("The identity provider's single sign-on endpoint, where the application sends a sign-in request."),
+        sloUrl: z.url().optional().isAuditEvidence().describe("The identity provider's single logout endpoint. Absent when the provider offers none."),
         /** Frontend input: PEM-encoded certificate(s). Backend transforms to x509Certificates. */
-        x509CertificatePem: z.string().min(1).optional(),
+        x509CertificatePem: z.string().min(1).optional().describe("The identity provider's signing certificate or certificates, PEM-encoded, used to verify its signatures. Accepted on create and update, and stored parsed as `x509Certificates`, which no response includes."),
         x509Certificates: z.array(z.string()).min(1).isBackendOnly(),
         attributeMapping: z.object({
-            email: z.string().default('http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress'),
-            firstName: z.string().default('http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname'),
-            lastName: z.string().default('http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname'),
-            roles: z.string().optional(),
-            department: z.string().optional(),
-            employeeId: z.string().optional(),
-            groups: z.string().optional(),
-        }),
-        signRequests: z.boolean().default(true).isAuditEvidence(),
-        wantAssertionsSigned: z.boolean().default(true).isAuditEvidence(),
-        allowedClockDrift: z.number().min(0).max(300).default(30).isAuditEvidence(),
-        forceAuthn: z.boolean().default(false).isAuditEvidence(),
-        maxAuthAge: z.number().min(0).optional().isAuditEvidence(),
+            email: z.string().default('http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress').describe("The name of the SAML attribute carrying the user's email address."),
+            firstName: z.string().default('http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname').describe("The name of the SAML attribute carrying the user's first name."),
+            lastName: z.string().default('http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname').describe("The name of the SAML attribute carrying the user's last name."),
+            roles: z.string().optional().describe("The name of the SAML attribute carrying the user's roles, which `roleMapping` translates into application roles."),
+            department: z.string().optional().describe("The name of the SAML attribute carrying the user's department."),
+            employeeId: z.string().optional().describe("The name of the SAML attribute carrying the user's employee ID."),
+            groups: z.string().optional().describe("The name of the SAML attribute carrying the user's group memberships."),
+        }).describe('Which SAML attribute carries each user detail. A detail with no attribute named is not read.'),
+        signRequests: z.boolean().default(true).isAuditEvidence().describe('Whether the application signs the sign-in requests it sends to the identity provider.'),
+        wantAssertionsSigned: z.boolean().default(true).isAuditEvidence().describe('Whether an assertion must be signed to be accepted.'),
+        allowedClockDrift: z.number().min(0).max(300).default(30).isAuditEvidence().describe("How far, in seconds, the identity provider's clock may differ from the application's when an assertion's validity times and authentication instant are checked."),
+        forceAuthn: z.boolean().default(false).isAuditEvidence().describe('Whether every sign-in asks the identity provider to authenticate the person afresh rather than reuse its own session (`ForceAuthn`).'),
+        maxAuthAge: z.number().min(0).optional().isAuditEvidence().describe("The oldest, in seconds, the identity provider's own authentication may be: an assertion whose `AuthnInstant` is older is refused. Absent means no limit."),
         /**
          * Whether a person linked through this connection may confirm it is them by signing in again here
          * (#1441), when adding or removing a way to sign in. Off by default, like the OIDC flag.
@@ -111,14 +118,18 @@ export const SsoConnectionBaseSchema = z.object({
          * `AuthnInstant [Required]`, fetched 2026-09-21 from
          * https://docs.oasis-open.org/security/saml/v2.0/saml-core-2.0-os.pdf
          */
-        reAuthenticationEnabled: z.boolean().default(false).isAuditEvidence(),
-        nameIdFormat: z.enum(SamlNameIdFormat).default(SamlNameIdFormat.EMAIL_ADDRESS).isAuditEvidence(),
-        allowIdpInitiated: z.boolean().default(false).isAuditEvidence(),
-        auditSettings: z.object({
-            logAuthAttempts: z.boolean().default(true),
-            logAttributeMapping: z.boolean().default(true),
-            retentionDays: z.number().min(1).max(2555).default(90),
-        }),
+        reAuthenticationEnabled: z.boolean().default(false).isAuditEvidence().describe('Whether a person linked through this connection may confirm it is them by signing in here again, when adding or removing a way to sign in. Turn it on only for a provider that honours `ForceAuthn`.'),
+        nameIdFormat: z.enum(SamlNameIdFormat).default(SamlNameIdFormat.EMAIL_ADDRESS).isAuditEvidence().describe("The NameID format the application asks the identity provider to use for the person's identifier."),
+        allowIdpInitiated: z.boolean().default(false).isAuditEvidence().describe('Whether a sign-in the identity provider starts, with no request from the application, is accepted. Single logout the provider starts is accepted either way.'),
+        /*
+         * NO `auditSettings` (`logAuthAttempts` / `logAttributeMapping` / `retentionDays`), here or on the
+         * OIDC block. They were stored, shown on the settings screen, and read by nothing, so an
+         * administrator could switch authentication logging off or shorten its retention and nothing
+         * happened (#1768). Removed rather than wired, like #419 and #1236: every sign-in is recorded on the
+         * application's audit trail whatever a connection says, which is intended — a tenant switch that
+         * turns off its own authentication logging would weaken the evidence the audit trail exists for —
+         * and how long rows are kept is the application's retention schedule, not a per-connection number.
+         */
     }).optional(),
     // `.isAuditEvidence()` on the OIDC leaves below — like the SAML block, they say WHERE this connection
     // federates (`discoveryUrl` / `issuer` / the four endpoints / `jwksUri` / `endSessionEndpoint` /
@@ -128,21 +139,20 @@ export const SsoConnectionBaseSchema = z.object({
     // `issuer` / `jwksUri`, silently breaks the token trust chain, so a reviewer must see the
     // before/after — and so does a change to `acrValues`, which is an authentication-strength
     // requirement placed on the identity provider. `clientSecret` is NEVER marked (it is
-    // a write-only secret); `claimsMapping` / `auditSettings` are two-level and out of the resolver's
-    // one-level reach.
+    // a write-only secret); `claimsMapping` is two-level and out of the resolver's one-level reach.
     // assurance-control: WILDO.IDENTITY.SESSION_ASSURANCE — the OIDC endpoints, issuer and token-
     // validation posture decide which provider is trusted and whether its tokens are actually verified.
     oidc: z.object({
-        templateMode: z.enum(SSOTemplateMode).default(SSOTemplateMode.MANUAL).isAuditEvidence(),
-        templateOverrides: z.record(z.string(), z.string()).optional().isAuditEvidence(),
-        customScopes: z.array(z.string()).optional().isAuditEvidence(),
-        discoveryUrl: z.url().optional().isAuditEvidence(),
-        issuer: z.url().optional().isAuditEvidence(),
-        authorizationEndpoint: z.url().optional().isAuditEvidence(),
-        tokenEndpoint: z.url().optional().isAuditEvidence(),
-        userInfoEndpoint: z.url().optional().isAuditEvidence(),
-        jwksUri: z.url().optional().isAuditEvidence(),
-        endSessionEndpoint: z.url().optional().isAuditEvidence(),
+        templateMode: z.enum(SSOTemplateMode).default(SSOTemplateMode.MANUAL).isAuditEvidence().describe("How the provider's endpoints are found: `template` reads them from a known provider's definition, `discovery` reads them from the provider's OpenID discovery document, and `manual` uses the endpoints entered here."),
+        templateOverrides: z.record(z.string(), z.string()).optional().isAuditEvidence().describe("In `template` mode, values substituted into the provider definition's endpoint URLs, such as a tenant id."),
+        customScopes: z.array(z.string()).optional().isAuditEvidence().describe('Scopes requested in addition to `scopes`.'),
+        discoveryUrl: z.url().optional().isAuditEvidence().describe("The provider's OpenID discovery document URL. In `discovery` mode the endpoints are read from it when `issuer` is not given."),
+        issuer: z.url().optional().isAuditEvidence().describe("The provider's issuer identifier. An ID token is accepted only when its `iss` claim matches it."),
+        authorizationEndpoint: z.url().optional().isAuditEvidence().describe("The provider's authorization endpoint, where the browser is sent to sign in."),
+        tokenEndpoint: z.url().optional().isAuditEvidence().describe("The provider's token endpoint, where the application exchanges the authorization code for tokens."),
+        userInfoEndpoint: z.url().optional().isAuditEvidence().describe("The provider's userinfo endpoint, read for profile claims the ID token does not carry."),
+        jwksUri: z.url().optional().isAuditEvidence().describe('Where the provider publishes the keys its ID tokens are verified against.'),
+        endSessionEndpoint: z.url().optional().isAuditEvidence().describe("The provider's logout endpoint, used when `federatedLogoutEnabled` is on."),
         /**
          * Redirect the browser to the identity provider's `endSessionEndpoint` when this connection's
          * user logs out of Wildo — RP-initiated logout (issue #445).
@@ -157,8 +167,8 @@ export const SsoConnectionBaseSchema = z.object({
          * The endpoint is the CAPABILITY and this is the DECISION. Both are needed — a connection with
          * this on and no endpoint federates nothing, and says so in the log rather than failing a logout.
          */
-        federatedLogoutEnabled: z.boolean().default(false).isAuditEvidence(),
-        clientId: z.string().min(1).isAuditEvidence(),
+        federatedLogoutEnabled: z.boolean().default(false).isAuditEvidence().describe("Whether logging out of the application also sends the browser to the provider's `endSessionEndpoint`. Off by default."),
+        clientId: z.string().min(1).isAuditEvidence().describe('The client ID the provider issued for this application.'),
         /**
          * OIDC/OAuth2 client secret issued by the IdP, used by the backend token
          * exchange (`oauth2-connection-resolver` → `exchangeCodeForTokens`) to
@@ -178,19 +188,19 @@ export const SsoConnectionBaseSchema = z.object({
          * connection UPDATE custom-impl (`sso-connection.custom-impl` prefix). The
          * central sentinel-strip only preserves TOP-LEVEL write-only secrets.
          */
-        clientSecret: z.string().min(1).isWriteOnlySecret(),
-        scopes: z.array(z.string()).default(['openid', 'email', 'profile']).isAuditEvidence(),
-        responseType: z.enum(SSOResponseType).default(SSOResponseType.CODE).isAuditEvidence(),
-        responseMode: z.enum(SSOResponseMode).optional().isAuditEvidence(),
+        clientSecret: z.string().min(1).isWriteOnlySecret().describe('The client secret the provider issued, used at its token endpoint. Write-only: responses return it masked.'),
+        scopes: z.array(z.string()).default(['openid', 'email', 'profile']).isAuditEvidence().describe('The scopes requested at sign-in.'),
+        responseType: z.enum(SSOResponseType).default(SSOResponseType.CODE).isAuditEvidence().describe('The OAuth response type requested (`response_type`).'),
+        responseMode: z.enum(SSOResponseMode).optional().isAuditEvidence().describe('How the provider returns the result to the application (`response_mode`). Absent means `query`.'),
         claimsMapping: z.object({
-            email: z.string().default('email'),
-            firstName: z.string().default('given_name'),
-            lastName: z.string().default('family_name'),
-            roles: z.string().optional(),
-            department: z.string().optional(),
-            employeeId: z.string().optional(),
-            groups: z.string().optional(),
-        }),
+            email: z.string().default('email').describe("The name of the claim carrying the user's email address."),
+            firstName: z.string().default('given_name').describe("The name of the claim carrying the user's first name."),
+            lastName: z.string().default('family_name').describe("The name of the claim carrying the user's last name."),
+            roles: z.string().optional().describe("The name of the claim carrying the user's roles, which `roleMapping` translates into application roles."),
+            department: z.string().optional().describe("The name of the claim carrying the user's department."),
+            employeeId: z.string().optional().describe("The name of the claim carrying the user's employee ID."),
+            groups: z.string().optional().describe("The name of the claim carrying the user's group memberships."),
+        }).describe('Which ID-token or userinfo claim carries each user detail. A detail with no claim named is not read.'),
         /*
          * NO `validateIssuer` / `validateAudience` / `clockTolerance`. All three were declared here,
          * persisted and audit-marked, and read by nothing — and they were inert in the SAFE direction,
@@ -202,9 +212,9 @@ export const SsoConnectionBaseSchema = z.object({
          * break the token trust chain from a settings screen. A configuration field whose only
          * achievable effect is to weaken a security control should not exist.
          */
-        acrValues: z.array(z.string()).optional().isAuditEvidence(),
-        maxAge: z.number().min(0).optional().isAuditEvidence(),
-        prompt: z.enum(SSOPrompt).optional().isAuditEvidence(),
+        acrValues: z.array(z.string()).optional().isAuditEvidence().describe('Authentication context classes requested from the provider (`acr_values`), for example a stronger sign-in method.'),
+        maxAge: z.number().min(0).optional().isAuditEvidence().describe("The oldest, in seconds, the provider's authentication may be (`max_age`)."),
+        prompt: z.enum(SSOPrompt).optional().isAuditEvidence().describe('The `prompt` value sent with the authorization request.'),
         /**
          * May an account re-prove who it is through this identity provider (#1441)?
          *
@@ -225,18 +235,19 @@ export const SsoConnectionBaseSchema = z.object({
          * spec-cite: Google Identity, OpenID Connect documentation (`prompt` values, `auth_time`), fetched
          * 2026-09-21 from https://developers.google.com/identity/openid-connect/openid-connect
          */
-        reAuthenticationEnabled: z.boolean().default(false).isAuditEvidence(),
-        pkceEnabled: z.boolean().default(true).isAuditEvidence(),
-        pkceMethod: z.enum(SSOPKCEMethod).default(SSOPKCEMethod.S256).isAuditEvidence(),
-        auditSettings: z.object({
-            logAuthAttempts: z.boolean().default(true),
-            logTokenExchange: z.boolean().default(true),
-            logClaimsMapping: z.boolean().default(true),
-            retentionDays: z.number().min(1).max(2555).default(90),
-        }),
+        reAuthenticationEnabled: z.boolean().default(false).isAuditEvidence().describe('Whether a person linked through this connection may confirm it is them by signing in here again, when adding or removing a way to sign in. Turn it on only for a provider that honours `prompt=login` and returns `auth_time`.'),
+        pkceEnabled: z.boolean().default(true).isAuditEvidence().describe('Whether the sign-in uses PKCE to bind the authorization code to this request.'),
+        pkceMethod: z.enum(SSOPKCEMethod).default(SSOPKCEMethod.S256).isAuditEvidence().describe('The PKCE code challenge method.'),
+        // NO `auditSettings` — removed with the SAML block's, for the same reason (#1768).
     }).optional(),
     autoCreateUsers: z.boolean().default(true),
-    autoVerifyEmail: z.boolean().default(true),
+    /*
+     * NO `autoVerifyEmail` (#1769). The only reader honours it for SCIM provisioning alone — an
+     * interactive sign-in cannot stop to send the person off to verify an address — and SCIM reads the
+     * SCIM provisioning config's own `autoVerifyEmail`, never this one. So the connection's copy was a
+     * setting nothing could ever act on. The directory's assertion of an address is trusted on an
+     * enterprise connection because the tenant configured the connection for its own domain.
+     */
     /*
      * `bypassAppMFA` was REMOVED (#1236), rather than wired.
      *