npm - @wildo-ai/saas-models - Versions diffs - 1.1.7 → 1.1.8 - Mend

@wildo-ai/saas-models 1.1.7 → 1.1.8

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (861) hide show

package/dist/esm/security/authentications/registration.shared.dto.schemas.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"registration.shared.dto.schemas.js","sourceRoot":"","sources":["../../../../src/security/authentications/registration.shared.dto.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,2BAA2B,EAAE,MAAM,0BAA0B,CAAC;AACvE,OAAO,EAAE,UAAU,EAAE,MAAM,iCAAiC,CAAC;AAC7D,OAAO,EAAE,mBAAmB,EAAE,MAAM,qCAAqC,CAAC;AAE1E,kEAAkE;AAClE,8BAA8B;AAC9B,kEAAkE;AAElE;;;;;;;;;;GAUG;AACH;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,MAAM,CACtD,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EACjB,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAC/C,CAAC;AAaF;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,iCAAiC,CAC/C,iBAAkE,EAClE,SAAiD;IAEjD,MAAM,SAAS,GAAG,iBAAiB,IAAI,EAAE,CAAC;IAC1C,MAAM,OAAO,GAAG,SAAS,IAAI,EAAE,CAAC;IAChC,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC;IAE3E,MAAM,qBAAqB,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;IACjF,MAAM,aAAa,GAA8C,EAAE,CAAC;IACpE,MAAM,0BAA0B,GAAa,EAAE,CAAC;IAEhD,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;QACjC,MAAM,KAAK,GAAG,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QACnC,MAAM,UAAU,GAAG,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE,CAAC;QACvD,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,IAAI,QAAQ,CAAC,QAAQ;gBAAE,0BAA0B,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;YACpE,SAAS;QACX,CAAC;QACD,6FAA6F;QAC7F,0FAA0F;QAC1F,IAAI,QAAQ,CAAC,WAAW;YAAE,aAAa,CAAC,QAAQ,CAAC,WAAW,CAAC,GAAG,KAAK,CAAC;IACxE,CAAC;IAED,OAAO,EAAE,aAAa,EAAE,qBAAqB,EAAE,0BAA0B,EAAE,CAAC;AAC9E,CAAC;AAED,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC;QACtC,IAAI,EAAE,EAAE,YAAY,EAAE,2BAA2B,CAAC,KAAK,EAAE;KAC1D,CAAC;IACF,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC;QAC5C,IAAI,EAAE,EAAE,YAAY,EAAE,2BAA2B,CAAC,UAAU,EAAE;KAC/D,CAAC;IACF,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC;QAC3C,IAAI,EAAE,EAAE,YAAY,EAAE,2BAA2B,CAAC,WAAW,EAAE;KAChE,CAAC;IACF,mFAAmF;IACnF,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC;QACpD,IAAI,EAAE,EAAE,YAAY,EAAE,2BAA2B,CAAC,YAAY,EAAE;KACjE,CAAC,CAAC,QAAQ,EAAE;IACb,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,QAAQ,CAAC;QAChD,IAAI,EAAE,EAAE,YAAY,EAAE,2BAA2B,CAAC,YAAY,EAAE;KACjE,CAAC,CAAC,QAAQ,EAAE;IACb,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,QAAQ,CAAC;QACvD,IAAI,EAAE,EAAE,YAAY,EAAE,2BAA2B,CAAC,YAAY,EAAE;KACjE,CAAC,CAAC,QAAQ,EAAE;CACd,CAAC,CAAC;AAKH;;;;GAIG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE;IAC9B;;;;OAIG;IACH,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC/C,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC9C,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACtC,kDAAkD;IAClD,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IACvD;;;;;;;;;OASG;IACH,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,QAAQ,EAAE;IACrC;;;;;;;;;;;;;;OAcG;IACH,kCAAkC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;IACjF;;;;;OAKG;IACH,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,SAAS,CAAC,mBAAmB,CAAC;IAC9D;;;;;;;OAOG;IACH,cAAc,EAAE,gCAAgC,CAAC,QAAQ,EAAE;CAC5D,CAAC,CAAC;AAKH,kEAAkE;AAClE,6BAA6B;AAC7B,kEAAkE;AAElE;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;IAClD,8FAA8F;IAC9F,mFAAmF;IACnF,+FAA+F;IAC/F,+FAA+F;IAC/F,wFAAwF;IACxF,0FAA0F;IAC1F,6FAA6F;IAC7F,6FAA6F;IAC7F,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC;QACxD,IAAI,EAAE,EAAE,YAAY,EAAE,2BAA2B,CAAC,UAAU,EAAE;KAC/D,CAAC;IACF,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC;QACvD,IAAI,EAAE,EAAE,YAAY,EAAE,2BAA2B,CAAC,WAAW,EAAE;KAChE,CAAC;IACF,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,UAAU,EAAE,CAAC,QAAQ,CAAC;QACzC,IAAI,EAAE,EAAE,YAAY,EAAE,2BAA2B,CAAC,YAAY,EAAE;KACjE,CAAC,CAAC,QAAQ,EAAE;IACb,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,UAAU,EAAE,CAAC,QAAQ,CAAC;QAChD,IAAI,EAAE,EAAE,YAAY,EAAE,2BAA2B,CAAC,YAAY,EAAE;KACjE,CAAC,CAAC,QAAQ,EAAE;CACd,CAAC,CAAC;AAIH;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,oCAAoC,GAAG;IAClD,UAAU,CAAC,QAAQ;IACnB,UAAU,CAAC,UAAU;IACrB,UAAU,CAAC,OAAO;CACV,CAAC;AAWX;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAClC,8EAA8E;IAC9E,gFAAgF;IAChF,yDAAyD;IACzD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;IAC3C,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;IAC1C,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,gBAAgB,EAAE,CAAC,CAAC,IAAI,CAAC,oCAAoC,CAAC,CAAC,QAAQ,EAAE;IACzE;;;;;OAKG;IACH,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,SAAS,CAAC,mBAAmB,CAAC;CAC/D,CAAC,CAAC;AAIH;;GAEG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,MAAM,CAAC;IACvD,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAClC,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;CAChD,CAAC,CAAC;AAIH,kEAAkE;AAClE,6BAA6B;AAC7B,kEAAkE;AAElE;;;;GAIG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE;CAC/B,CAAC,CAAC;AAIH,kEAAkE;AAClE,yCAAyC;AACzC,kEAAkE;AAElE;;;;GAIG;AACH,MAAM,uCAAuC,GAAW,oBAAoB,CAAC;AAE7E;;;;GAIG;AACH,MAAM,gCAAgC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,uCAAuC,CAAC,CAAC;AAE1H;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,mCAAmC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1D,gBAAgB,EAAE,gCAAgC,CAAC,QAAQ,CAAC;QAC1D,IAAI,EAAE,EAAE,YAAY,EAAE,2BAA2B,CAAC,YAAY,EAAE;KACjE,CAAC;CACH,CAAC,CAAC;AAIH;;;GAGG;AACH,MAAM,CAAC,MAAM,0CAA0C,GAAG,CAAC,CAAC,MAAM,CAAC;IACjE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,gBAAgB,EAAE,gCAAgC;CACnD,CAAC,CAAC;AAIH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,qCAAqC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5D,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;IAC3C,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;CAC3C,CAAC,CAAC;AAIH;;;GAGG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG,yBAAyB,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC","sourcesContent":["/*\n User Registration — Shared DTO Schemas\n \n Single source of truth for user registration validation.\n * Used by both frontend (AutomatedForm component) and backend (req.body parsing).\n /\n\nimport { z } from 'zod';\nimport type { OnboardingSurveyQuestion } from '../../config/frontend/onboarding.shared.schemas';\nimport { AutocompleteFieldIdentifier } from '@wildo-ai/zod-decorators';\nimport { AuthMethod } from './authentication.shared.schemas';\nimport { carriedAuthRedirect } from './authentication.shared.dto.schemas';\n\n// ═══════════════════════════════════════════════════════════════\n// Registration Form + API DTO\n// ═══════════════════════════════════════════════════════════════\n\n/\n POST /auth/register — registration form fields.\n * Used as:\n * - Frontend: AutomatedForm schema (all 5 fields rendered)\n * - Backend: req.body parsing (minus confirmPassword)\n \n confirmPassword is a frontend-only field for client-side match validation.\n * The .refine() for password match is applied at the component level\n * (not here) because the error message needs i18n.\n * The .isPassword() decorator tells FormField to render password inputs.\n /\n/\n Answers to the extra profile questions a user type declares for sign-up (#1371).\n \n Keyed by the question's `id`, valued by the scalar kinds a bindable question can produce. It is\n * NOT a free-form bag: the server validates every key against the resolved user type's own\n * `registration.additionalProfileQuestions` and refuses anything undeclared, so a client cannot use\n * it to write a profile field the application never asked about.\n /\nexport const RegistrationProfileAnswersSchema = z.record(\n z.string().min(1),\n z.union([z.string(), z.number(), z.boolean()]),\n);\nexport type RegistrationProfileAnswers = z.infer<typeof RegistrationProfileAnswersSchema>;\n\n/* What the declaration made of the answers a registrant submitted. /\nexport interface ResolvedRegistrationProfileAnswers {\n /* Profile FIELD → value, ready to ride the composition seed. Keyed by `bindToField`, not by question id. /\n readonly profileFields: Record<string, string \| number \| boolean>;\n /* Submitted keys this user type never declared. Non-empty means the payload is refused. /\n readonly undeclaredQuestionIds: readonly string[];\n /* Declared-and-required questions with no usable answer. Non-empty means the payload is refused. /\n readonly missingRequiredQuestionIds: readonly string[];\n}\n\n/\n Reconcile submitted sign-up answers against the questions the user type actually declares (#1371).\n \n Shared rather than written in the controller, because the FORM builds its fields from the same\n * declaration: one function decides what a question means, so the screen and the server cannot\n * disagree about which answers are legitimate.\n \n ## Undeclared keys are REFUSED, not dropped\n \n Dropping would make `profileAnswers` a silent no-op for a client that names a field the\n * application never asked about — and silence is exactly how a write reaches a place nobody\n * intended. Refusing keeps the transport a projection of the declaration rather than a door onto\n * the profile.\n \n ## An empty string is not an answer\n \n A required question submitted as `''` is MISSING, not answered. Without that, a required question\n * is satisfied by a field the person tabbed through, which is the opposite of what `required` means.\n /\nexport function resolveRegistrationProfileAnswers(\n declaredQuestions: readonly OnboardingSurveyQuestion[] \| undefined,\n submitted: RegistrationProfileAnswers \| undefined,\n): ResolvedRegistrationProfileAnswers {\n const questions = declaredQuestions ?? [];\n const answers = submitted ?? {};\n const byId = new Map(questions.map((question) => [question.id, question]));\n\n const undeclaredQuestionIds = Object.keys(answers).filter((id) => !byId.has(id));\n const profileFields: Record<string, string \| number \| boolean> = {};\n const missingRequiredQuestionIds: string[] = [];\n\n for (const question of questions) {\n const value = answers[question.id];\n const isAnswered = value !== undefined && value !== '';\n if (!isAnswered) {\n if (question.required) missingRequiredQuestionIds.push(question.id);\n continue;\n }\n // `bindToField` is guaranteed by the config schema, which refuses a sign-up question without\n // one. Guarded anyway: this function is exported and a caller may hold a hand-built list.\n if (question.bindToField) profileFields[question.bindToField] = value;\n }\n\n return { profileFields, undeclaredQuestionIds, missingRequiredQuestionIds };\n}\n\nexport const UserRegisterFormDtoSchema = z.object({\n email: z.email().toLowerCase().stringUI({\n edit: { autoComplete: AutocompleteFieldIdentifier.EMAIL },\n }),\n firstName: z.string().min(1).max(50).stringUI({\n edit: { autoComplete: AutocompleteFieldIdentifier.GIVEN_NAME },\n }),\n lastName: z.string().min(1).max(50).stringUI({\n edit: { autoComplete: AutocompleteFieldIdentifier.FAMILY_NAME },\n }),\n /* W6.2: Org name when orgNameSource is 'ask'. Conditionally shown on frontend. /\n organizationName: z.string().min(1).max(200).stringUI({\n edit: { autoComplete: AutocompleteFieldIdentifier.ORGANIZATION },\n }).optional(),\n password: z.string().min(1).isPassword().stringUI({\n edit: { autoComplete: AutocompleteFieldIdentifier.NEW_PASSWORD },\n }).optional(),\n confirmPassword: z.string().min(1).isPassword().stringUI({\n edit: { autoComplete: AutocompleteFieldIdentifier.NEW_PASSWORD },\n }).optional(),\n});\n\n\nexport type UserRegisterFormDto = z.infer<typeof UserRegisterFormDtoSchema>;\n\n/\n POST /auth/register — API contract (what goes over the wire).\n * Backend uses this for req.body parsing.\n * confirmPassword is NOT sent to the backend.\n /\nexport const UserRegisterApiDtoSchema = z.object({\n email: z.email().toLowerCase(),\n /\n Optional on the WIRE because a user type may collect the names at onboarding instead (#1374,\n * `ProfileNamesCollectionMoment.ONBOARDING`). Whether they are required is decided per user type by the\n * registration service — a `REGISTRATION`-moment user type is refused without them, exactly as before.\n /\n firstName: z.string().min(1).max(50).optional(),\n lastName: z.string().min(1).max(50).optional(),\n password: z.string().min(1).optional(),\n /* W6.2: Org name when orgNameSource is 'ask'. /\n organizationName: z.string().min(1).max(200).optional(),\n /\n How the registrant will authenticate afterwards (#463). Absent ⇒ PASSWORD, so a client that\n * predates password-less signup keeps working unchanged.\n \n Typed as the whole `AuthMethod` vocabulary rather than a narrowed subset, deliberately: the set\n * a given application accepts is `registration.allowedMethods`, which is per user type and\n * authored, and duplicating a narrower list here would be a second place for it to drift. A method\n * this application does not allow is refused by the service with the allowed set in the message,\n * which is a better answer than a schema rejection that cannot say what IS allowed.\n /\n method: z.enum(AuthMethod).optional(),\n /\n Which governed-document releases the registrant AFFIRMATIVELY accepted (issue #54).\n \n Release IDS only, and the asymmetry is the security property: the client supplies WHETHER a box\n * was ticked, and the SERVER supplies everything else. It resolves the in-force releases from\n * `compliance.governedDocumentReleases`, matches these ids against them, and records the matches.\n * An id naming nothing in force is ignored rather than refused — a stale form is a stale form, and\n * a registration is not the place to fail on one. So a caller cannot choose which VERSION of the\n * terms they accepted, cannot invent a release, and cannot accept a document the application does\n * not publish.\n \n Absent ⇒ nothing was accepted, which is what a client predating this field means and also what a\n * registrant who ticked nothing means. Those two are deliberately the same answer: the record says\n * what was accepted, never what was refused.\n /\n acceptedGovernedDocumentReleaseIds: z.array(z.string().min(1)).max(20).optional(),\n /\n The deep link the registration screen was opened with, carried into the emailed sign-in link of a\n * PASSWORD-LESS signup (#1086) — the one register outcome that signs the person in on another page.\n * Decided by {@link carriedAuthRedirect}, the same rule as the magic-link send and the invitation accept:\n * kept only when same-origin and within bounds, otherwise dropped, never refused.\n /\n redirect: z.string().optional().transform(carriedAuthRedirect),\n /\n Answers to the user type's declared sign-up profile questions (#1371), keyed by question id.\n \n Validated SERVER-SIDE against that user type's own declaration — an undeclared key is refused\n * rather than ignored, so this cannot become a door onto arbitrary profile fields. The form half\n * is built at render time, because the questions are runtime configuration and a module-scope Zod\n * object cannot carry a field per application.\n /\n profileAnswers: RegistrationProfileAnswersSchema.optional(),\n});\n\n\nexport type UserRegisterApiDto = z.infer<typeof UserRegisterApiDtoSchema>;\n\n// ═══════════════════════════════════════════════════════════════\n// Invitation Acceptance DTOs\n// ═══════════════════════════════════════════════════════════════\n\n/\n POST /auth/invitation/accept — public invitation-acceptance form fields.\n \n The invitation token identifies the target invitation. Name/password fields are optional\n * because an existing invited user may only need to confirm the invitation, while a new\n * invited user can provide profile/password data in the same flow.\n \n confirmPassword is frontend-only and excluded from the API DTO.\n /\nexport const UserInvitationFormDtoSchema = z.object({\n // Required, mirroring registration: the invitee establishes their identity at acceptance, and\n // the profile seed keys on non-empty first+last (UserProfileSchema requires both).\n // `.regex(/\\S/)` rejects a WHITESPACE-ONLY name client-side — which `.min(1)` alone would PASS\n // (\" \" has length 2), then the frontend `normalizeText`/`.trim()` collapses it to `undefined`\n // and the required API DTO 400s AFTER the form said the field was valid. It is a CHECK,\n // deliberately NOT a `.trim()` TRANSFORM: a transform ahead of `.stringUI()` disrupts the\n // decorator's introspection surface (`getFieldUIEditConfig`). Trailing/leading whitespace is\n // normalized at the authoritative boundary (`UserInvitationApiDtoSchema`, `.trim().min(1)`).\n firstName: z.string().min(1).max(50).regex(/\\S/).stringUI({\n edit: { autoComplete: AutocompleteFieldIdentifier.GIVEN_NAME },\n }),\n lastName: z.string().min(1).max(50).regex(/\\S/).stringUI({\n edit: { autoComplete: AutocompleteFieldIdentifier.FAMILY_NAME },\n }),\n password: z.string().isPassword().stringUI({\n edit: { autoComplete: AutocompleteFieldIdentifier.NEW_PASSWORD },\n }).optional(),\n confirmPassword: z.string().isPassword().stringUI({\n edit: { autoComplete: AutocompleteFieldIdentifier.NEW_PASSWORD },\n }).optional(),\n});\n\nexport type UserInvitationFormDto = z.infer<typeof UserInvitationFormDtoSchema>;\n\n/\n The first-factor credential the invitee chooses to establish at acceptance.\n \n The invitation-accept endpoint supports exactly three establishment paths (SSO-managed\n * invitees are routed to the IdP's enterprise-authorize flow, NOT this endpoint):\n * - `PASSWORD` — set a password now. When both `credentialMethod` and\n * `password` are omitted, intentionally activate with no local credential;\n * another configured authentication method can establish later sessions.\n * - `MAGIC_LINK` — activate with no local credential; a magic link is emailed and the\n * session is established when the invitee clicks it.\n * - `PASSKEY` — enroll a NEW WebAuthn credential at accept; the invitation token bootstraps\n * the session and the passkey is registered as the go-forward credential.\n /\nexport const INVITATION_ACCEPT_CREDENTIAL_METHODS = [\n AuthMethod.PASSWORD,\n AuthMethod.MAGIC_LINK,\n AuthMethod.PASSKEY,\n] as const;\n\n/\n The subset of {@link AuthMethod} an invitee may establish at accept time. Enterprise-SSO / social-\n * OAuth invitees are routed to the IdP authorize flow, NOT the accept endpoint, so those members are\n * intentionally absent. Single source of truth for BOTH the request DTO (`credentialMethod` enum) and\n * the backend `AcceptInvitationParams.credentialMethod` — so the service signature can never drift\n * wider than the wire contract it is fed from.\n /\nexport type InvitationAcceptCredentialMethod = (typeof INVITATION_ACCEPT_CREDENTIAL_METHODS)[number];\n\n/\n POST /auth/invitation/accept — API contract.\n \n `credentialMethod` is optional by design. When absent, a provided `password`\n * establishes a password credential; without one, acceptance activates the\n * membership without a local credential. `MAGIC_LINK` and `PASSKEY` are\n * explicit because they initiate method-specific work.\n /\nexport const UserInvitationApiDtoSchema = z.object({\n invitationToken: z.string().min(1),\n // Required (min 1), mirroring registration — see UserInvitationFormDtoSchema.\n // `.trim()` before `.min(1)` fail-closes a whitespace-only name at the boundary\n // (a direct API caller can't seed a blank profile name).\n firstName: z.string().trim().min(1).max(50),\n lastName: z.string().trim().min(1).max(50),\n password: z.string().optional(),\n credentialMethod: z.enum(INVITATION_ACCEPT_CREDENTIAL_METHODS).optional(),\n /\n The deep link the invitation was opened with, carried into the emailed link when `credentialMethod` is\n * `MAGIC_LINK` (#1014) — the one accept outcome that signs the invitee in on another page. Decided by\n * {@link carriedAuthRedirect}, the same rule as the magic-link send: kept only when same-origin and within\n * bounds, otherwise dropped, never refused.\n /\n redirect: z.string().optional().transform(carriedAuthRedirect),\n});\n\nexport type UserInvitationApiDto = z.infer<typeof UserInvitationApiDtoSchema>;\n\n/\n POST /auth/invitation/reject — API contract.\n /\nexport const UserInvitationRejectApiDtoSchema = z.object({\n invitationToken: z.string().min(1),\n rejectionReason: z.string().max(500).optional(),\n});\n\nexport type UserInvitationRejectApiDto = z.infer<typeof UserInvitationRejectApiDtoSchema>;\n\n// ═══════════════════════════════════════════════════════════════\n// Email Verification API DTO\n// ═══════════════════════════════════════════════════════════════\n\n/\n POST /auth/verify-email — API contract.\n * Token and email are extracted from URL query parameters on the frontend.\n * Email is required for defense-in-depth constant-time comparison against token metadata.\n /\nexport const EmailVerifyDtoSchema = z.object({\n token: z.string().min(1),\n email: z.email().toLowerCase(),\n});\n\nexport type EmailVerifyDto = z.infer<typeof EmailVerifyDtoSchema>;\n\n// ═══════════════════════════════════════════════════════════════\n// Organization Onboarding Form + API DTO\n// ═══════════════════════════════════════════════════════════════\n\n/\n The characters an organization name may not contain. Markup delimiters, quotes and code punctuation are\n * refused so a name renders as text wherever it is shown. One definition, so the onboarding form refuses\n * exactly what `POST /auth/onboarding/complete-org` refuses.\n /\nconst ORGANIZATION_NAME_DISALLOWED_CHARACTERS: RegExp = /^[^<>\"'`;{}()\\\\]+$/;\n\n/\n An organization name, as onboarding accepts it: trimmed FIRST, so a whitespace-only name fails `min(1)` at\n * the boundary rather than trimming to empty after it. The ONE definition — the form and the API contract\n * below both use it, so the form refuses exactly what `POST /auth/onboarding/complete-org` refuses.\n /\nconst OnboardingOrganizationNameSchema = z.string().trim().min(1).max(200).regex(ORGANIZATION_NAME_DISALLOWED_CHARACTERS);\n\n/\n POST /auth/onboarding/complete-org — the organization-name step (#1090).\n \n Shown to an account whose authentication session is parked at `ONBOARDING_PENDING`: after registration, email\n * verification or enrollment when its user type names its organization at onboarding, or after a sign-in answered\n * `nextStep: onboarding` because the account still owes one (#1091). The frontend AutomatedForm schema; the API\n * contract below adds the session id.\n /\nexport const OrganizationOnboardingFormDtoSchema = z.object({\n organizationName: OnboardingOrganizationNameSchema.stringUI({\n edit: { autoComplete: AutocompleteFieldIdentifier.ORGANIZATION },\n }),\n});\n\nexport type OrganizationOnboardingFormDto = z.infer<typeof OrganizationOnboardingFormDtoSchema>;\n\n/\n POST /auth/onboarding/complete-org — API contract. `sessionId` is the parked session the answer that led\n * here carried; it is what authorizes the completion, and the completion consumes it.\n /\nexport const OrganizationOnboardingCompleteApiDtoSchema = z.object({\n sessionId: z.string().min(1),\n organizationName: OnboardingOrganizationNameSchema,\n});\n\nexport type OrganizationOnboardingCompleteApiDto = z.infer<typeof OrganizationOnboardingCompleteApiDtoSchema>;\n\n/\n POST /auth/onboarding/complete-profile — API contract (#1374). Discharges\n * `OnboardingObligation.PROFILE_NAMES` on the parked session: the person's first and last name, collected after\n * the address and credential were proven. Same bounds as the sign-up form's name fields, and trimmed, so a name\n * of spaces is refused rather than stored.\n /\nexport const ProfileOnboardingCompleteApiDtoSchema = z.object({\n sessionId: z.string().min(1),\n firstName: z.string().trim().min(1).max(50),\n lastName: z.string().trim().min(1).max(50),\n});\n\nexport type ProfileOnboardingCompleteApiDto = z.infer<typeof ProfileOnboardingCompleteApiDtoSchema>;\n\n/\n The onboarding step's names form (#1374) — the sign-up form's own two name fields, so the same bounds and the\n * same autocomplete hints apply wherever the names are asked.\n */\nexport const ProfileOnboardingFormDtoSchema = UserRegisterFormDtoSchema.pick({ firstName: true, lastName: true });\n\nexport type ProfileOnboardingFormDto = z.infer<typeof ProfileOnboardingFormDtoSchema>;\n"]}
1	+ {"version":3,"file":"registration.shared.dto.schemas.js","sourceRoot":"","sources":["../../../../../src/security/authentications/registration.shared.dto.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,2BAA2B,EAAE,MAAM,0BAA0B,CAAC;AACvE,OAAO,EAAE,UAAU,EAAE,MAAM,iCAAiC,CAAC;AAC7D,OAAO,EAAE,mBAAmB,EAAE,MAAM,qCAAqC,CAAC;AAE1E,kEAAkE;AAClE,8BAA8B;AAC9B,kEAAkE;AAElE;;;;;;;;;;GAUG;AACH;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,MAAM,CACtD,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EACjB,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAC/C,CAAC;AAaF;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,iCAAiC,CAC/C,iBAAkE,EAClE,SAAiD;IAEjD,MAAM,SAAS,GAAG,iBAAiB,IAAI,EAAE,CAAC;IAC1C,MAAM,OAAO,GAAG,SAAS,IAAI,EAAE,CAAC;IAChC,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC;IAE3E,MAAM,qBAAqB,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;IACjF,MAAM,aAAa,GAA8C,EAAE,CAAC;IACpE,MAAM,0BAA0B,GAAa,EAAE,CAAC;IAEhD,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;QACjC,MAAM,KAAK,GAAG,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QACnC,MAAM,UAAU,GAAG,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE,CAAC;QACvD,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,IAAI,QAAQ,CAAC,QAAQ;gBAAE,0BAA0B,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;YACpE,SAAS;QACX,CAAC;QACD,6FAA6F;QAC7F,0FAA0F;QAC1F,IAAI,QAAQ,CAAC,WAAW;YAAE,aAAa,CAAC,QAAQ,CAAC,WAAW,CAAC,GAAG,KAAK,CAAC;IACxE,CAAC;IAED,OAAO,EAAE,aAAa,EAAE,qBAAqB,EAAE,0BAA0B,EAAE,CAAC;AAC9E,CAAC;AAED,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC;QACtC,IAAI,EAAE,EAAE,YAAY,EAAE,2BAA2B,CAAC,KAAK,EAAE;KAC1D,CAAC;IACF,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC;QAC5C,IAAI,EAAE,EAAE,YAAY,EAAE,2BAA2B,CAAC,UAAU,EAAE;KAC/D,CAAC;IACF,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC;QAC3C,IAAI,EAAE,EAAE,YAAY,EAAE,2BAA2B,CAAC,WAAW,EAAE;KAChE,CAAC;IACF,mFAAmF;IACnF,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC;QACpD,IAAI,EAAE,EAAE,YAAY,EAAE,2BAA2B,CAAC,YAAY,EAAE;KACjE,CAAC,CAAC,QAAQ,EAAE;IACb,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,QAAQ,CAAC;QAChD,IAAI,EAAE,EAAE,YAAY,EAAE,2BAA2B,CAAC,YAAY,EAAE;KACjE,CAAC,CAAC,QAAQ,EAAE;IACb,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,QAAQ,CAAC;QACvD,IAAI,EAAE,EAAE,YAAY,EAAE,2BAA2B,CAAC,YAAY,EAAE;KACjE,CAAC,CAAC,QAAQ,EAAE;CACd,CAAC,CAAC;AAKH;;;;GAIG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE;IAC9B;;;;OAIG;IACH,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC/C,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC9C,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACtC,kDAAkD;IAClD,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IACvD;;;;;;;;;OASG;IACH,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,QAAQ,EAAE;IACrC;;;;;;;;;;;;;;OAcG;IACH,kCAAkC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;IACjF;;;;;OAKG;IACH,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,SAAS,CAAC,mBAAmB,CAAC;IAC9D;;;;;;;OAOG;IACH,cAAc,EAAE,gCAAgC,CAAC,QAAQ,EAAE;CAC5D,CAAC,CAAC;AAKH,kEAAkE;AAClE,6BAA6B;AAC7B,kEAAkE;AAElE;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;IAClD,8FAA8F;IAC9F,mFAAmF;IACnF,+FAA+F;IAC/F,+FAA+F;IAC/F,wFAAwF;IACxF,0FAA0F;IAC1F,6FAA6F;IAC7F,6FAA6F;IAC7F,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC;QACxD,IAAI,EAAE,EAAE,YAAY,EAAE,2BAA2B,CAAC,UAAU,EAAE;KAC/D,CAAC;IACF,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC;QACvD,IAAI,EAAE,EAAE,YAAY,EAAE,2BAA2B,CAAC,WAAW,EAAE;KAChE,CAAC;IACF,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,UAAU,EAAE,CAAC,QAAQ,CAAC;QACzC,IAAI,EAAE,EAAE,YAAY,EAAE,2BAA2B,CAAC,YAAY,EAAE;KACjE,CAAC,CAAC,QAAQ,EAAE;IACb,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,UAAU,EAAE,CAAC,QAAQ,CAAC;QAChD,IAAI,EAAE,EAAE,YAAY,EAAE,2BAA2B,CAAC,YAAY,EAAE;KACjE,CAAC,CAAC,QAAQ,EAAE;CACd,CAAC,CAAC;AAIH;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,oCAAoC,GAAG;IAClD,UAAU,CAAC,QAAQ;IACnB,UAAU,CAAC,UAAU;IACrB,UAAU,CAAC,OAAO;CACV,CAAC;AAWX;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAClC,8EAA8E;IAC9E,gFAAgF;IAChF,yDAAyD;IACzD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;IAC3C,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;IAC1C,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,gBAAgB,EAAE,CAAC,CAAC,IAAI,CAAC,oCAAoC,CAAC,CAAC,QAAQ,EAAE;IACzE;;;;;OAKG;IACH,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,SAAS,CAAC,mBAAmB,CAAC;CAC/D,CAAC,CAAC;AAIH;;GAEG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,MAAM,CAAC;IACvD,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAClC,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;CAChD,CAAC,CAAC;AAIH,kEAAkE;AAClE,6BAA6B;AAC7B,kEAAkE;AAElE;;;;GAIG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE;CAC/B,CAAC,CAAC;AAIH,kEAAkE;AAClE,yCAAyC;AACzC,kEAAkE;AAElE;;;;GAIG;AACH,MAAM,uCAAuC,GAAW,oBAAoB,CAAC;AAE7E;;;;GAIG;AACH,MAAM,gCAAgC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,uCAAuC,CAAC,CAAC;AAE1H;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,mCAAmC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1D,gBAAgB,EAAE,gCAAgC,CAAC,QAAQ,CAAC;QAC1D,IAAI,EAAE,EAAE,YAAY,EAAE,2BAA2B,CAAC,YAAY,EAAE;KACjE,CAAC;CACH,CAAC,CAAC;AAIH;;;GAGG;AACH,MAAM,CAAC,MAAM,0CAA0C,GAAG,CAAC,CAAC,MAAM,CAAC;IACjE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,gBAAgB,EAAE,gCAAgC;CACnD,CAAC,CAAC;AAIH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,qCAAqC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5D,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;IAC3C,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;CAC3C,CAAC,CAAC;AAIH;;;GAGG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG,yBAAyB,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC","sourcesContent":["/*\n User Registration — Shared DTO Schemas\n \n Single source of truth for user registration validation.\n * Used by both frontend (AutomatedForm component) and backend (req.body parsing).\n /\n\nimport { z } from 'zod';\nimport type { OnboardingSurveyQuestion } from '../../config/frontend/onboarding.shared.schemas';\nimport { AutocompleteFieldIdentifier } from '@wildo-ai/zod-decorators';\nimport { AuthMethod } from './authentication.shared.schemas';\nimport { carriedAuthRedirect } from './authentication.shared.dto.schemas';\n\n// ═══════════════════════════════════════════════════════════════\n// Registration Form + API DTO\n// ═══════════════════════════════════════════════════════════════\n\n/\n POST /auth/register — registration form fields.\n * Used as:\n * - Frontend: AutomatedForm schema (all 5 fields rendered)\n * - Backend: req.body parsing (minus confirmPassword)\n \n confirmPassword is a frontend-only field for client-side match validation.\n * The .refine() for password match is applied at the component level\n * (not here) because the error message needs i18n.\n * The .isPassword() decorator tells FormField to render password inputs.\n /\n/\n Answers to the extra profile questions a user type declares for sign-up (#1371).\n \n Keyed by the question's `id`, valued by the scalar kinds a bindable question can produce. It is\n * NOT a free-form bag: the server validates every key against the resolved user type's own\n * `registration.additionalProfileQuestions` and refuses anything undeclared, so a client cannot use\n * it to write a profile field the application never asked about.\n /\nexport const RegistrationProfileAnswersSchema = z.record(\n z.string().min(1),\n z.union([z.string(), z.number(), z.boolean()]),\n);\nexport type RegistrationProfileAnswers = z.infer<typeof RegistrationProfileAnswersSchema>;\n\n/* What the declaration made of the answers a registrant submitted. /\nexport interface ResolvedRegistrationProfileAnswers {\n /* Profile FIELD → value, ready to ride the composition seed. Keyed by `bindToField`, not by question id. /\n readonly profileFields: Record<string, string \| number \| boolean>;\n /* Submitted keys this user type never declared. Non-empty means the payload is refused. /\n readonly undeclaredQuestionIds: readonly string[];\n /* Declared-and-required questions with no usable answer. Non-empty means the payload is refused. /\n readonly missingRequiredQuestionIds: readonly string[];\n}\n\n/\n Reconcile submitted sign-up answers against the questions the user type actually declares (#1371).\n \n Shared rather than written in the controller, because the FORM builds its fields from the same\n * declaration: one function decides what a question means, so the screen and the server cannot\n * disagree about which answers are legitimate.\n \n ## Undeclared keys are REFUSED, not dropped\n \n Dropping would make `profileAnswers` a silent no-op for a client that names a field the\n * application never asked about — and silence is exactly how a write reaches a place nobody\n * intended. Refusing keeps the transport a projection of the declaration rather than a door onto\n * the profile.\n \n ## An empty string is not an answer\n \n A required question submitted as `''` is MISSING, not answered. Without that, a required question\n * is satisfied by a field the person tabbed through, which is the opposite of what `required` means.\n /\nexport function resolveRegistrationProfileAnswers(\n declaredQuestions: readonly OnboardingSurveyQuestion[] \| undefined,\n submitted: RegistrationProfileAnswers \| undefined,\n): ResolvedRegistrationProfileAnswers {\n const questions = declaredQuestions ?? [];\n const answers = submitted ?? {};\n const byId = new Map(questions.map((question) => [question.id, question]));\n\n const undeclaredQuestionIds = Object.keys(answers).filter((id) => !byId.has(id));\n const profileFields: Record<string, string \| number \| boolean> = {};\n const missingRequiredQuestionIds: string[] = [];\n\n for (const question of questions) {\n const value = answers[question.id];\n const isAnswered = value !== undefined && value !== '';\n if (!isAnswered) {\n if (question.required) missingRequiredQuestionIds.push(question.id);\n continue;\n }\n // `bindToField` is guaranteed by the config schema, which refuses a sign-up question without\n // one. Guarded anyway: this function is exported and a caller may hold a hand-built list.\n if (question.bindToField) profileFields[question.bindToField] = value;\n }\n\n return { profileFields, undeclaredQuestionIds, missingRequiredQuestionIds };\n}\n\nexport const UserRegisterFormDtoSchema = z.object({\n email: z.email().toLowerCase().stringUI({\n edit: { autoComplete: AutocompleteFieldIdentifier.EMAIL },\n }),\n firstName: z.string().min(1).max(50).stringUI({\n edit: { autoComplete: AutocompleteFieldIdentifier.GIVEN_NAME },\n }),\n lastName: z.string().min(1).max(50).stringUI({\n edit: { autoComplete: AutocompleteFieldIdentifier.FAMILY_NAME },\n }),\n /* W6.2: Org name when orgNameSource is 'ask'. Conditionally shown on frontend. /\n organizationName: z.string().min(1).max(200).stringUI({\n edit: { autoComplete: AutocompleteFieldIdentifier.ORGANIZATION },\n }).optional(),\n password: z.string().min(1).isPassword().stringUI({\n edit: { autoComplete: AutocompleteFieldIdentifier.NEW_PASSWORD },\n }).optional(),\n confirmPassword: z.string().min(1).isPassword().stringUI({\n edit: { autoComplete: AutocompleteFieldIdentifier.NEW_PASSWORD },\n }).optional(),\n});\n\n\nexport type UserRegisterFormDto = z.infer<typeof UserRegisterFormDtoSchema>;\n\n/\n POST /auth/register — API contract (what goes over the wire).\n * Backend uses this for req.body parsing.\n * confirmPassword is NOT sent to the backend.\n /\nexport const UserRegisterApiDtoSchema = z.object({\n email: z.email().toLowerCase(),\n /\n Optional on the WIRE because a user type may collect the names at onboarding instead (#1374,\n * `ProfileNamesCollectionMoment.ONBOARDING`). Whether they are required is decided per user type by the\n * registration service — a `REGISTRATION`-moment user type is refused without them, exactly as before.\n /\n firstName: z.string().min(1).max(50).optional(),\n lastName: z.string().min(1).max(50).optional(),\n password: z.string().min(1).optional(),\n /* W6.2: Org name when orgNameSource is 'ask'. /\n organizationName: z.string().min(1).max(200).optional(),\n /\n How the registrant will authenticate afterwards (#463). Absent ⇒ PASSWORD, so a client that\n * predates password-less signup keeps working unchanged.\n \n Typed as the whole `AuthMethod` vocabulary rather than a narrowed subset, deliberately: the set\n * a given application accepts is `registration.allowedMethods`, which is per user type and\n * authored, and duplicating a narrower list here would be a second place for it to drift. A method\n * this application does not allow is refused by the service with the allowed set in the message,\n * which is a better answer than a schema rejection that cannot say what IS allowed.\n /\n method: z.enum(AuthMethod).optional(),\n /\n Which governed-document releases the registrant AFFIRMATIVELY accepted (issue #54).\n \n Release IDS only, and the asymmetry is the security property: the client supplies WHETHER a box\n * was ticked, and the SERVER supplies everything else. It resolves the in-force releases from\n * `compliance.governedDocumentReleases`, matches these ids against them, and records the matches.\n * An id naming nothing in force is ignored rather than refused — a stale form is a stale form, and\n * a registration is not the place to fail on one. So a caller cannot choose which VERSION of the\n * terms they accepted, cannot invent a release, and cannot accept a document the application does\n * not publish.\n \n Absent ⇒ nothing was accepted, which is what a client predating this field means and also what a\n * registrant who ticked nothing means. Those two are deliberately the same answer: the record says\n * what was accepted, never what was refused.\n /\n acceptedGovernedDocumentReleaseIds: z.array(z.string().min(1)).max(20).optional(),\n /\n The deep link the registration screen was opened with, carried into the emailed sign-in link of a\n * PASSWORD-LESS signup (#1086) — the one register outcome that signs the person in on another page.\n * Decided by {@link carriedAuthRedirect}, the same rule as the magic-link send and the invitation accept:\n * kept only when same-origin and within bounds, otherwise dropped, never refused.\n /\n redirect: z.string().optional().transform(carriedAuthRedirect),\n /\n Answers to the user type's declared sign-up profile questions (#1371), keyed by question id.\n \n Validated SERVER-SIDE against that user type's own declaration — an undeclared key is refused\n * rather than ignored, so this cannot become a door onto arbitrary profile fields. The form half\n * is built at render time, because the questions are runtime configuration and a module-scope Zod\n * object cannot carry a field per application.\n /\n profileAnswers: RegistrationProfileAnswersSchema.optional(),\n});\n\n\nexport type UserRegisterApiDto = z.infer<typeof UserRegisterApiDtoSchema>;\n\n// ═══════════════════════════════════════════════════════════════\n// Invitation Acceptance DTOs\n// ═══════════════════════════════════════════════════════════════\n\n/\n POST /auth/invitation/accept — public invitation-acceptance form fields.\n \n The invitation token identifies the target invitation. Name/password fields are optional\n * because an existing invited user may only need to confirm the invitation, while a new\n * invited user can provide profile/password data in the same flow.\n \n confirmPassword is frontend-only and excluded from the API DTO.\n /\nexport const UserInvitationFormDtoSchema = z.object({\n // Required, mirroring registration: the invitee establishes their identity at acceptance, and\n // the profile seed keys on non-empty first+last (UserProfileSchema requires both).\n // `.regex(/\\S/)` rejects a WHITESPACE-ONLY name client-side — which `.min(1)` alone would PASS\n // (\" \" has length 2), then the frontend `normalizeText`/`.trim()` collapses it to `undefined`\n // and the required API DTO 400s AFTER the form said the field was valid. It is a CHECK,\n // deliberately NOT a `.trim()` TRANSFORM: a transform ahead of `.stringUI()` disrupts the\n // decorator's introspection surface (`getFieldUIEditConfig`). Trailing/leading whitespace is\n // normalized at the authoritative boundary (`UserInvitationApiDtoSchema`, `.trim().min(1)`).\n firstName: z.string().min(1).max(50).regex(/\\S/).stringUI({\n edit: { autoComplete: AutocompleteFieldIdentifier.GIVEN_NAME },\n }),\n lastName: z.string().min(1).max(50).regex(/\\S/).stringUI({\n edit: { autoComplete: AutocompleteFieldIdentifier.FAMILY_NAME },\n }),\n password: z.string().isPassword().stringUI({\n edit: { autoComplete: AutocompleteFieldIdentifier.NEW_PASSWORD },\n }).optional(),\n confirmPassword: z.string().isPassword().stringUI({\n edit: { autoComplete: AutocompleteFieldIdentifier.NEW_PASSWORD },\n }).optional(),\n});\n\nexport type UserInvitationFormDto = z.infer<typeof UserInvitationFormDtoSchema>;\n\n/\n The first-factor credential the invitee chooses to establish at acceptance.\n \n The invitation-accept endpoint supports exactly three establishment paths (SSO-managed\n * invitees are routed to the IdP's enterprise-authorize flow, NOT this endpoint):\n * - `PASSWORD` — set a password now. When both `credentialMethod` and\n * `password` are omitted, intentionally activate with no local credential;\n * another configured authentication method can establish later sessions.\n * - `MAGIC_LINK` — activate with no local credential; a magic link is emailed and the\n * session is established when the invitee clicks it.\n * - `PASSKEY` — enroll a NEW WebAuthn credential at accept; the invitation token bootstraps\n * the session and the passkey is registered as the go-forward credential.\n /\nexport const INVITATION_ACCEPT_CREDENTIAL_METHODS = [\n AuthMethod.PASSWORD,\n AuthMethod.MAGIC_LINK,\n AuthMethod.PASSKEY,\n] as const;\n\n/\n The subset of {@link AuthMethod} an invitee may establish at accept time. Enterprise-SSO / social-\n * OAuth invitees are routed to the IdP authorize flow, NOT the accept endpoint, so those members are\n * intentionally absent. Single source of truth for BOTH the request DTO (`credentialMethod` enum) and\n * the backend `AcceptInvitationParams.credentialMethod` — so the service signature can never drift\n * wider than the wire contract it is fed from.\n /\nexport type InvitationAcceptCredentialMethod = (typeof INVITATION_ACCEPT_CREDENTIAL_METHODS)[number];\n\n/\n POST /auth/invitation/accept — API contract.\n \n `credentialMethod` is optional by design. When absent, a provided `password`\n * establishes a password credential; without one, acceptance activates the\n * membership without a local credential. `MAGIC_LINK` and `PASSKEY` are\n * explicit because they initiate method-specific work.\n /\nexport const UserInvitationApiDtoSchema = z.object({\n invitationToken: z.string().min(1),\n // Required (min 1), mirroring registration — see UserInvitationFormDtoSchema.\n // `.trim()` before `.min(1)` fail-closes a whitespace-only name at the boundary\n // (a direct API caller can't seed a blank profile name).\n firstName: z.string().trim().min(1).max(50),\n lastName: z.string().trim().min(1).max(50),\n password: z.string().optional(),\n credentialMethod: z.enum(INVITATION_ACCEPT_CREDENTIAL_METHODS).optional(),\n /\n The deep link the invitation was opened with, carried into the emailed link when `credentialMethod` is\n * `MAGIC_LINK` (#1014) — the one accept outcome that signs the invitee in on another page. Decided by\n * {@link carriedAuthRedirect}, the same rule as the magic-link send: kept only when same-origin and within\n * bounds, otherwise dropped, never refused.\n /\n redirect: z.string().optional().transform(carriedAuthRedirect),\n});\n\nexport type UserInvitationApiDto = z.infer<typeof UserInvitationApiDtoSchema>;\n\n/\n POST /auth/invitation/reject — API contract.\n /\nexport const UserInvitationRejectApiDtoSchema = z.object({\n invitationToken: z.string().min(1),\n rejectionReason: z.string().max(500).optional(),\n});\n\nexport type UserInvitationRejectApiDto = z.infer<typeof UserInvitationRejectApiDtoSchema>;\n\n// ═══════════════════════════════════════════════════════════════\n// Email Verification API DTO\n// ═══════════════════════════════════════════════════════════════\n\n/\n POST /auth/verify-email — API contract.\n * Token and email are extracted from URL query parameters on the frontend.\n * Email is required for defense-in-depth constant-time comparison against token metadata.\n /\nexport const EmailVerifyDtoSchema = z.object({\n token: z.string().min(1),\n email: z.email().toLowerCase(),\n});\n\nexport type EmailVerifyDto = z.infer<typeof EmailVerifyDtoSchema>;\n\n// ═══════════════════════════════════════════════════════════════\n// Organization Onboarding Form + API DTO\n// ═══════════════════════════════════════════════════════════════\n\n/\n The characters an organization name may not contain. Markup delimiters, quotes and code punctuation are\n * refused so a name renders as text wherever it is shown. One definition, so the onboarding form refuses\n * exactly what `POST /auth/onboarding/complete-org` refuses.\n /\nconst ORGANIZATION_NAME_DISALLOWED_CHARACTERS: RegExp = /^[^<>\"'`;{}()\\\\]+$/;\n\n/\n An organization name, as onboarding accepts it: trimmed FIRST, so a whitespace-only name fails `min(1)` at\n * the boundary rather than trimming to empty after it. The ONE definition — the form and the API contract\n * below both use it, so the form refuses exactly what `POST /auth/onboarding/complete-org` refuses.\n /\nconst OnboardingOrganizationNameSchema = z.string().trim().min(1).max(200).regex(ORGANIZATION_NAME_DISALLOWED_CHARACTERS);\n\n/\n POST /auth/onboarding/complete-org — the organization-name step (#1090).\n \n Shown to an account whose authentication session is parked at `ONBOARDING_PENDING`: after registration, email\n * verification or enrollment when its user type names its organization at onboarding, or after a sign-in answered\n * `nextStep: onboarding` because the account still owes one (#1091). The frontend AutomatedForm schema; the API\n * contract below adds the session id.\n /\nexport const OrganizationOnboardingFormDtoSchema = z.object({\n organizationName: OnboardingOrganizationNameSchema.stringUI({\n edit: { autoComplete: AutocompleteFieldIdentifier.ORGANIZATION },\n }),\n});\n\nexport type OrganizationOnboardingFormDto = z.infer<typeof OrganizationOnboardingFormDtoSchema>;\n\n/\n POST /auth/onboarding/complete-org — API contract. `sessionId` is the parked session the answer that led\n * here carried; it is what authorizes the completion, and the completion consumes it.\n /\nexport const OrganizationOnboardingCompleteApiDtoSchema = z.object({\n sessionId: z.string().min(1),\n organizationName: OnboardingOrganizationNameSchema,\n});\n\nexport type OrganizationOnboardingCompleteApiDto = z.infer<typeof OrganizationOnboardingCompleteApiDtoSchema>;\n\n/\n POST /auth/onboarding/complete-profile — API contract (#1374). Discharges\n * `OnboardingObligation.PROFILE_NAMES` on the parked session: the person's first and last name, collected after\n * the address and credential were proven. Same bounds as the sign-up form's name fields, and trimmed, so a name\n * of spaces is refused rather than stored.\n /\nexport const ProfileOnboardingCompleteApiDtoSchema = z.object({\n sessionId: z.string().min(1),\n firstName: z.string().trim().min(1).max(50),\n lastName: z.string().trim().min(1).max(50),\n});\n\nexport type ProfileOnboardingCompleteApiDto = z.infer<typeof ProfileOnboardingCompleteApiDtoSchema>;\n\n/\n The onboarding step's names form (#1374) — the sign-up form's own two name fields, so the same bounds and the\n * same autocomplete hints apply wherever the names are asked.\n */\nexport const ProfileOnboardingFormDtoSchema = UserRegisterFormDtoSchema.pick({ firstName: true, lastName: true });\n\nexport type ProfileOnboardingFormDto = z.infer<typeof ProfileOnboardingFormDtoSchema>;\n"]}

package/dist/esm/security/authentications/same-origin-redirect-path.shared.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"same-origin-redirect-path.shared.d.ts","sourceRoot":"","sources":["~~../../../../~~src/security/authentications/same-origin-redirect-path.shared.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoDG;AAcH;;;;;;;;;;;;;GAaG;AACH,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,KAAK,IAAI,MAAM,CAc1F"}
1	+ {"version":3,"file":"same-origin-redirect-path.shared.d.ts","sourceRoot":"","sources":["../../../../../src/security/authentications/same-origin-redirect-path.shared.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoDG;AAcH;;;;;;;;;;;;;GAaG;AACH,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,KAAK,IAAI,MAAM,CAc1F"}

package/dist/esm/security/authentications/same-origin-redirect-path.shared.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"same-origin-redirect-path.shared.js","sourceRoot":"","sources":["~~../../../../~~src/security/authentications/same-origin-redirect-path.shared.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoDG;AAEH;;;;;;;;;GASG;AACH,MAAM,2BAA2B,GAAG,6CAA6C,CAAC;AAElF;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,wBAAwB,CAAC,KAAgC;IACvE,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACrD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,KAAK,EAAE,2BAA2B,CAAC,CAAC,MAAM,KAAK,IAAI,GAAG,CAAC,2BAA2B,CAAC,CAAC,MAAM,CAAC;IAC5G,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC","sourcesContent":["/*\n The ONE answer to \"may the browser be navigated to this string after authentication?\".\n \n ## Why this atom exists\n \n Four independent implementations of this question shipped in this repository, each a hand-written\n * deny-list of characters, and on 2026-08-15 all four admitted the same family of hostile inputs:\n \n \| Site \| Shape \|\n * \|---\|---\|\n * \| `saas-frontend-lib` — `isSafeAuthRedirectTarget` \| `startsWith('/') && !startsWith('//')` \|\n * \| `saas-frontend-lib` — `Auth_OneOffSession.sanitizeReturnPath` \| the above + `..` / `\\` / `://` / `<>\"` / length \|\n * \| `saas-technical-doc` — `AuthExchangePage.sanitizeReturnPath` \| a verbatim copy of the previous row \|\n * \| `saas-models` — `RETURN_PATH_REFINES` (issuer AND receiver schema) \| the same rules as Zod refines \|\n \n The three deny-list copies were written to \"mirror\" each other and did — including the hole. That\n * is the failure mode `.claude/rules/invariant-call-site-enumeration.md` exists for, and the reason\n * this predicate is an importable atom rather than a fifth copy: a policy expressed as a private\n * constant reaches exactly the file that declares it.\n \n ## Why a PARSE, not a character deny-list\n \n A deny-list tests the bytes a human reads. The browser navigates to what its URL PARSER produces,\n * and the two disagree through two normalisation rules that no reasonable author remembers:\n \n - For a SPECIAL scheme (http/https) a backslash is treated as a slash while the authority is being\n * consumed, so `/\\evil.com` is `//evil.com`.\n * - ASCII tab, LF and CR are removed from the input before parsing, anywhere in the string — so\n * `/<TAB>/evil.com` is also `//evil.com`.\n \n The second rule is what defeated every deny-list here: they all banned `\\` and none of them banned\n * the whitespace that becomes a `/`. Banning three more characters would leave the next parser rule\n * uncovered, so the check asks the parser itself instead.\n \n Measured with `new URL(target, base)` — the same algorithm a browser applies to `location.href`,\n * `location.assign` and `<Navigate to>` — these SEVEN targets resolve to `https://evil.com/` while\n * passing a `startsWith('/') && !startsWith('//')` test:\n * `/\\evil.com`, `/\\\\evil.com`, `/\\/evil.com`, `/<TAB>/evil.com`, `/<TAB>\\evil.com`,\n * `/<LF>/evil.com`, `/<CR>/evil.com`.\n \n spec-cite: WHATWG URL Standard — the basic URL parser removes all ASCII tab and newline from the\n * input, and the \"special authority ignore slashes state\" consumes `\\` interchangeably with `/`.\n \n ## Scope boundary\n \n This atom answers the ORIGIN question only. Path traversal (`..`), markup injection (`<>\"`) and\n * length ceilings are separate concerns owned by the callers that need them — collapsing them in\n * here would make one predicate answer four questions and give a caller no way to say which one it\n * failed.\n \n Import-free by construction (`/public-runtime` bundle budget): no `zod`, no decorators, nothing\n * beyond the platform `URL` global, which every browser and every supported Node version provides.\n /\n\n/\n A synthetic origin no deployment can ever be served from, used ONLY as the resolution base.\n \n Deliberately not the live origin. The question — \"does this reference stay inside the site it is\n * resolved against?\" — has the same answer for every base, so binding it to ambient browser state\n * would make the predicate untestable as a pure function and unusable on the server, where this same\n * atom validates the issuer's request body. `.invalid` is reserved by RFC 6761 §6.4 and guaranteed\n * never to resolve, so the sentinel can never collide with a real origin — which matters precisely\n * because \"resolved origin EQUALS the base\" is the accepting condition.\n /\nconst SAME_ORIGIN_RESOLUTION_BASE = 'https://same-origin-redirect-guard.invalid/';\n\n/\n Does `value` denote a location on the app's OWN origin?\n \n Accepts absolute-path references only (`/dashboard`, `/a/b?c=1#d`). Everything else is refused:\n * absolute URLs, protocol-relative references, bare-relative paths, and every input whose parsed form\n * escapes the base by a mechanism the caller did not anticipate.\n \n The two prefix conditions are a PRECONDITION, not a duplicate of the parse: they refuse an absolute\n * reference before it reaches the parser, so nothing can be admitted by coincidentally resolving onto\n * the sentinel origin itself.\n \n Returns `false` — never throws — for any input, including one the URL parser rejects outright\n * (`/\\` produces an authority-less special URL and throws).\n */\nexport function isSameOriginRedirectPath(value: string \| null \| undefined): value is string {\n if (!value) {\n return false;\n }\n\n if (!value.startsWith('/') \|\| value.startsWith('//')) {\n return false;\n }\n\n try {\n return new URL(value, SAME_ORIGIN_RESOLUTION_BASE).origin === new URL(SAME_ORIGIN_RESOLUTION_BASE).origin;\n } catch {\n return false;\n }\n}\n"]}
1	+ {"version":3,"file":"same-origin-redirect-path.shared.js","sourceRoot":"","sources":["../../../../../src/security/authentications/same-origin-redirect-path.shared.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoDG;AAEH;;;;;;;;;GASG;AACH,MAAM,2BAA2B,GAAG,6CAA6C,CAAC;AAElF;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,wBAAwB,CAAC,KAAgC;IACvE,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACrD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,KAAK,EAAE,2BAA2B,CAAC,CAAC,MAAM,KAAK,IAAI,GAAG,CAAC,2BAA2B,CAAC,CAAC,MAAM,CAAC;IAC5G,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC","sourcesContent":["/*\n The ONE answer to \"may the browser be navigated to this string after authentication?\".\n \n ## Why this atom exists\n \n Four independent implementations of this question shipped in this repository, each a hand-written\n * deny-list of characters, and on 2026-08-15 all four admitted the same family of hostile inputs:\n \n \| Site \| Shape \|\n * \|---\|---\|\n * \| `saas-frontend-lib` — `isSafeAuthRedirectTarget` \| `startsWith('/') && !startsWith('//')` \|\n * \| `saas-frontend-lib` — `Auth_OneOffSession.sanitizeReturnPath` \| the above + `..` / `\\` / `://` / `<>\"` / length \|\n * \| `saas-technical-doc` — `AuthExchangePage.sanitizeReturnPath` \| a verbatim copy of the previous row \|\n * \| `saas-models` — `RETURN_PATH_REFINES` (issuer AND receiver schema) \| the same rules as Zod refines \|\n \n The three deny-list copies were written to \"mirror\" each other and did — including the hole. That\n * is the failure mode `.claude/rules/invariant-call-site-enumeration.md` exists for, and the reason\n * this predicate is an importable atom rather than a fifth copy: a policy expressed as a private\n * constant reaches exactly the file that declares it.\n \n ## Why a PARSE, not a character deny-list\n \n A deny-list tests the bytes a human reads. The browser navigates to what its URL PARSER produces,\n * and the two disagree through two normalisation rules that no reasonable author remembers:\n \n - For a SPECIAL scheme (http/https) a backslash is treated as a slash while the authority is being\n * consumed, so `/\\evil.com` is `//evil.com`.\n * - ASCII tab, LF and CR are removed from the input before parsing, anywhere in the string — so\n * `/<TAB>/evil.com` is also `//evil.com`.\n \n The second rule is what defeated every deny-list here: they all banned `\\` and none of them banned\n * the whitespace that becomes a `/`. Banning three more characters would leave the next parser rule\n * uncovered, so the check asks the parser itself instead.\n \n Measured with `new URL(target, base)` — the same algorithm a browser applies to `location.href`,\n * `location.assign` and `<Navigate to>` — these SEVEN targets resolve to `https://evil.com/` while\n * passing a `startsWith('/') && !startsWith('//')` test:\n * `/\\evil.com`, `/\\\\evil.com`, `/\\/evil.com`, `/<TAB>/evil.com`, `/<TAB>\\evil.com`,\n * `/<LF>/evil.com`, `/<CR>/evil.com`.\n \n spec-cite: WHATWG URL Standard — the basic URL parser removes all ASCII tab and newline from the\n * input, and the \"special authority ignore slashes state\" consumes `\\` interchangeably with `/`.\n \n ## Scope boundary\n \n This atom answers the ORIGIN question only. Path traversal (`..`), markup injection (`<>\"`) and\n * length ceilings are separate concerns owned by the callers that need them — collapsing them in\n * here would make one predicate answer four questions and give a caller no way to say which one it\n * failed.\n \n Import-free by construction (`/public-runtime` bundle budget): no `zod`, no decorators, nothing\n * beyond the platform `URL` global, which every browser and every supported Node version provides.\n /\n\n/\n A synthetic origin no deployment can ever be served from, used ONLY as the resolution base.\n \n Deliberately not the live origin. The question — \"does this reference stay inside the site it is\n * resolved against?\" — has the same answer for every base, so binding it to ambient browser state\n * would make the predicate untestable as a pure function and unusable on the server, where this same\n * atom validates the issuer's request body. `.invalid` is reserved by RFC 6761 §6.4 and guaranteed\n * never to resolve, so the sentinel can never collide with a real origin — which matters precisely\n * because \"resolved origin EQUALS the base\" is the accepting condition.\n /\nconst SAME_ORIGIN_RESOLUTION_BASE = 'https://same-origin-redirect-guard.invalid/';\n\n/\n Does `value` denote a location on the app's OWN origin?\n \n Accepts absolute-path references only (`/dashboard`, `/a/b?c=1#d`). Everything else is refused:\n * absolute URLs, protocol-relative references, bare-relative paths, and every input whose parsed form\n * escapes the base by a mechanism the caller did not anticipate.\n \n The two prefix conditions are a PRECONDITION, not a duplicate of the parse: they refuse an absolute\n * reference before it reaches the parser, so nothing can be admitted by coincidentally resolving onto\n * the sentinel origin itself.\n \n Returns `false` — never throws — for any input, including one the URL parser rejects outright\n * (`/\\` produces an authority-less special URL and throws).\n */\nexport function isSameOriginRedirectPath(value: string \| null \| undefined): value is string {\n if (!value) {\n return false;\n }\n\n if (!value.startsWith('/') \|\| value.startsWith('//')) {\n return false;\n }\n\n try {\n return new URL(value, SAME_ORIGIN_RESOLUTION_BASE).origin === new URL(SAME_ORIGIN_RESOLUTION_BASE).origin;\n } catch {\n return false;\n }\n}\n"]}

package/dist/esm/security/authentications/scim/scim-organization-unit-mapping.shared.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"scim-organization-unit-mapping.shared.d.ts","sourceRoot":"","sources":["~~../../../../../~~src/security/authentications/scim/scim-organization-unit-mapping.shared.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;GAMG;AACH,eAAO,MAAM,sCAAsC;;;iBAKjD,CAAC;AAEH,MAAM,MAAM,gCAAgC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sCAAsC,CAAC,CAAC;AAEtG,0GAA0G;AAC1G,MAAM,MAAM,oCAAoC,GAAG;IACjD,QAAQ,CAAC,uBAAuB,CAAC,EAAE,SAAS,gCAAgC,EAAE,GAAG,IAAI,CAAC;IACtF,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1C,CAAC;AAEF;;;;;;;GAOG;AACH,wBAAgB,uCAAuC,CAAC,MAAM,EAAE,oCAAoC,GAAG,SAAS,GAAG,IAAI,GAAG,OAAO,CAEhI;AAED;;;;;;;GAOG;AACH,wBAAgB,6BAA6B,CAC3C,cAAc,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,EACzC,OAAO,EAAE,SAAS,gCAAgC,EAAE,GAAG,SAAS,GAAG,IAAI,GACtE,MAAM,GAAG,SAAS,CAKpB;AAED,qDAAqD;AACrD,MAAM,MAAM,8BAA8B,GAAG;IAC3C,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC;;;;;OAKG;IACH,QAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,CAAC;CACxC,CAAC;AAEF;;;;;;;GAOG;AACH,oBAAY,sCAAsC;IAChD,kGAAkG;IAClG,YAAY,iBAAiB;IAC7B,uGAAuG;IACvG,YAAY,iBAAiB;CAC9B;AAED,2FAA2F;AAC3F,MAAM,MAAM,kCAAkC,GAAG;IAC/C;;;;OAIG;IACH,QAAQ,CAAC,sBAAsB,EAAE,MAAM,EAAE,CAAC;IAC1C,2GAA2G;IAC3G,QAAQ,CAAC,qBAAqB,EAAE,MAAM,EAAE,CAAC;CAC1C,CAAC;AAEF,MAAM,MAAM,yCAAyC,GAAG;IACtD,oGAAoG;IACpG,QAAQ,CAAC,IAAI,CAAC,EAAE,sCAAsC,CAAC;IACvD;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,8BAA8B,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC7D,CAAC;AAEF;;;;;;;;;;GAUG;AACH,wBAAgB,yCAAyC,CACvD,qBAAqB,EAAE,SAAS,MAAM,EAAE,EACxC,kBAAkB,EAAE,SAAS,8BAA8B,EAAE,EAC7D,OAAO,CAAC,EAAE,yCAAyC,GAClD,kCAAkC,CA8BpC"}
1	+ {"version":3,"file":"scim-organization-unit-mapping.shared.d.ts","sourceRoot":"","sources":["../../../../../../src/security/authentications/scim/scim-organization-unit-mapping.shared.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;GAMG;AACH,eAAO,MAAM,sCAAsC;;;iBAKjD,CAAC;AAEH,MAAM,MAAM,gCAAgC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sCAAsC,CAAC,CAAC;AAEtG,0GAA0G;AAC1G,MAAM,MAAM,oCAAoC,GAAG;IACjD,QAAQ,CAAC,uBAAuB,CAAC,EAAE,SAAS,gCAAgC,EAAE,GAAG,IAAI,CAAC;IACtF,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1C,CAAC;AAEF;;;;;;;GAOG;AACH,wBAAgB,uCAAuC,CAAC,MAAM,EAAE,oCAAoC,GAAG,SAAS,GAAG,IAAI,GAAG,OAAO,CAEhI;AAED;;;;;;;GAOG;AACH,wBAAgB,6BAA6B,CAC3C,cAAc,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,EACzC,OAAO,EAAE,SAAS,gCAAgC,EAAE,GAAG,SAAS,GAAG,IAAI,GACtE,MAAM,GAAG,SAAS,CAKpB;AAED,qDAAqD;AACrD,MAAM,MAAM,8BAA8B,GAAG;IAC3C,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC;;;;;OAKG;IACH,QAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,CAAC;CACxC,CAAC;AAEF;;;;;;;GAOG;AACH,oBAAY,sCAAsC;IAChD,kGAAkG;IAClG,YAAY,iBAAiB;IAC7B,uGAAuG;IACvG,YAAY,iBAAiB;CAC9B;AAED,2FAA2F;AAC3F,MAAM,MAAM,kCAAkC,GAAG;IAC/C;;;;OAIG;IACH,QAAQ,CAAC,sBAAsB,EAAE,MAAM,EAAE,CAAC;IAC1C,2GAA2G;IAC3G,QAAQ,CAAC,qBAAqB,EAAE,MAAM,EAAE,CAAC;CAC1C,CAAC;AAEF,MAAM,MAAM,yCAAyC,GAAG;IACtD,oGAAoG;IACpG,QAAQ,CAAC,IAAI,CAAC,EAAE,sCAAsC,CAAC;IACvD;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,8BAA8B,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC7D,CAAC;AAEF;;;;;;;;;;GAUG;AACH,wBAAgB,yCAAyC,CACvD,qBAAqB,EAAE,SAAS,MAAM,EAAE,EACxC,kBAAkB,EAAE,SAAS,8BAA8B,EAAE,EAC7D,OAAO,CAAC,EAAE,yCAAyC,GAClD,kCAAkC,CA8BpC"}

package/dist/esm/security/authentications/scim/scim-organization-unit-mapping.shared.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"scim-organization-unit-mapping.shared.js","sourceRoot":"","sources":["../../../../../src/security/authentications/scim/scim-organization-unit-mapping.shared.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,sCAAsC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7D,2FAA2F;IAC3F,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,iLAAiL,CAAC;IACtO,wDAAwD;IACxD,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,qEAAqE,CAAC;CACtH,CAAC,CAAC;AAUH;;;;;;;GAOG;AACH,MAAM,UAAU,uCAAuC,CAAC,MAA+D;IACrH,OAAO,CAAC,CAAC,MAAM,EAAE,eAAe,IAAI,CAAC,MAAM,CAAC,uBAAuB,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;AACxF,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,6BAA6B,CAC3C,cAAyC,EACzC,OAAuE;IAEvE,MAAM,eAAe,GAAG,OAAO,cAAc,KAAK,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACxF,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAEnD,OAAO,OAAO,EAAE,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,cAAc,CAAC,IAAI,EAAE,KAAK,eAAe,CAAC,EAAE,kBAAkB,CAAC;AACvG,CAAC;AAeD;;;;;;;GAOG;AACH,MAAM,CAAN,IAAY,sCAKX;AALD,WAAY,sCAAsC;IAChD,kGAAkG;IAClG,uEAA6B,CAAA;IAC7B,uGAAuG;IACvG,uEAA6B,CAAA;AAC/B,CAAC,EALW,sCAAsC,KAAtC,sCAAsC,QAKjD;AAmCD;;;;;;;;;;GAUG;AACH,MAAM,UAAU,yCAAyC,CACvD,qBAAwC,EACxC,kBAA6D,EAC7D,OAAmD;IAEnD,MAAM,IAAI,GAAG,OAAO,EAAE,IAAI,IAAI,sCAAsC,CAAC,YAAY,CAAC;IAClF,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,OAAO,EAAE,8BAA8B,IAAI,EAAE,CAAC,CAAC;IAEhF,MAAM,eAAe,GAAG,CAAC,UAA0C,EAAU,EAAE;QAC7E,IAAI,IAAI,KAAK,sCAAsC,CAAC,YAAY;YAAE,OAAO,UAAU,CAAC,kBAAkB,CAAC;QACvG,6FAA6F;QAC7F,8FAA8F;QAC9F,wEAAwE;QACxE,IAAI,UAAU,CAAC,oBAAoB,KAAK,SAAS,EAAE,CAAC;YAClD,MAAM,IAAI,KAAK,CACb,yDAAyD,UAAU,CAAC,GAAG,gCAAgC;kBACrG,SAAS,sCAAsC,CAAC,YAAY,YAAY,CAC3E,CAAC;QACJ,CAAC;QACD,OAAO,UAAU,CAAC,oBAAoB,CAAC;IACzC,CAAC,CAAC;IAEF,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,qBAAqB,CAAC,CAAC;IAC/C,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,kBAAkB,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC;IAE9D,OAAO;QACL,sBAAsB,EAAE,CAAC,GAAG,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC/F,qBAAqB,EAAE,kBAAkB;aACtC,MAAM,CAAC,CAAC,UAAU,EAAE,EAAE;YACrB,MAAM,aAAa,GAAG,eAAe,CAAC,UAAU,CAAC,CAAC;YAClD,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;QAC7E,CAAC,CAAC;aACD,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;KACvC,CAAC;AACJ,CAAC","sourcesContent":["/*\n SCIM directory value → organization-unit assignment (WS-C).\n \n assurance-control: WILDO.IDENTITY.DIRECTORY_PROVISIONING — binds a directory-declared department to\n * an organization unit, and keeps that binding authoritative rather than accumulating.\n \n ## What this decides, and why it is EXPLICIT rather than inferred\n \n An IdP pushes a flat string (`department: \"Sales\"`). Units live in a TREE where `code` is unique\n * only among siblings and `name` is freeform, so \"Sales\" can legitimately match several nodes. Since\n * units became an authorization axis, resolving that string to the wrong node does not mislabel a\n * user — it grants them the wrong data.\n \n So there is no fuzzy matching, no name/code search, and no auto-creation. An organization admin\n * declares the binding explicitly, unit id by unit id, and a directory value with no declared binding\n * is IGNORED. The person who owns the org chart is the one who says what \"Sales\" means; nothing here\n * guesses on their behalf.\n \n ## Authoritative reconciliation\n \n Each push replaces the member's unit assignments with exactly what the directory currently says\n * (approved decision). A user who moves Sales → Legal LOSES Sales: keeping it would be privilege\n * accretion, where access only ever grows and an offboarded department is never actually left.\n \n ⚠️ The consequence, stated because it is not obvious: assignments made by hand in the application\n * are ALSO removed on the next push, because SCIM is authoritative over the whole set rather than\n * over a subset it can distinguish as its own. An organization that wants manual unit assignments\n * should not enable this mapping. This is why {@link isScimOrganizationUnitManagementEnabled}\n * requires an explicit, non-empty declaration before ANY reconciliation runs — an organization that\n * never opted in can never have its assignments deleted by a push.\n /\n\nimport { z } from 'zod';\n\n/\n One declared binding: the directory's own value for a department, and the unit it means.\n \n `directoryValue` is matched EXACTLY (after trimming) against what the IdP sends. It is deliberately\n * not normalised beyond whitespace — case and punctuation are part of what a directory actually\n * pushes, and silently folding them would make two distinct departments collide onto one unit.\n /\nexport const ScimOrganizationUnitMappingEntrySchema = z.object({\n /* The value the directory pushes, e.g. `\"Sales\"`. Matched exactly, whitespace-trimmed. /\n directoryValue: z.string().min(1).max(200).describe(\"A department value the directory sends, such as `Sales`, up to 200 characters. It must match exactly, apart from surrounding whitespace; a department with no entry is ignored.\"),\n /* The `ORGANIZATION_UNITS` row this value binds to. /\n organizationUnitId: z.string().min(1).describe(\"The organization unit a member with this department is assigned to.\"),\n});\n\nexport type ScimOrganizationUnitMappingEntry = z.infer<typeof ScimOrganizationUnitMappingEntrySchema>;\n\n/* The provisioning-config surface this module reads, kept structural so callers pass their row as-is. /\nexport type ScimOrganizationUnitManagementSignal = {\n readonly organizationUnitMapping?: readonly ScimOrganizationUnitMappingEntry[] \| null;\n readonly defaultUnitRole?: string \| null;\n};\n\n/\n Is this organization managing unit assignments through SCIM at all?\n \n Requires BOTH a non-empty mapping and a role to grant — an assignment cannot be created without a\n * role, so a mapping without one could only ever delete. That is exactly the failure mode this gate\n * exists to prevent: a half-configured row must never make a push authoritative over assignments it\n * has no way to recreate.\n /\nexport function isScimOrganizationUnitManagementEnabled(config: ScimOrganizationUnitManagementSignal \| undefined \| null): boolean {\n return !!config?.defaultUnitRole && (config.organizationUnitMapping?.length ?? 0) > 0;\n}\n\n/\n Resolve one directory value to the unit it was declared to mean, or `undefined` when nothing\n * declares it.\n \n `undefined` means UNMAPPED, not \"no unit\": the caller treats an unmapped value as \"the directory\n * says nothing about units for this user\", which under authoritative reconciliation removes their\n * directory-managed assignments rather than inventing one.\n /\nexport function resolveScimOrganizationUnitId(\n directoryValue: string \| undefined \| null,\n mapping: readonly ScimOrganizationUnitMappingEntry[] \| undefined \| null,\n): string \| undefined {\n const normalizedValue = typeof directoryValue === 'string' ? directoryValue.trim() : '';\n if (normalizedValue.length === 0) return undefined;\n\n return mapping?.find((entry) => entry.directoryValue.trim() === normalizedValue)?.organizationUnitId;\n}\n\n/* An existing assignment row, read structurally. /\nexport type ScimOrganizationUnitAssignment = {\n readonly _id: string;\n readonly organizationUnitId: string;\n /\n The membership side of the edge. A real junction row ALWAYS carries it; it is optional here only\n * because the department axis never projects it, and requiring it would make every caller and pin\n * on that axis supply a value nothing reads. Required in practice on\n * {@link ScimOrganizationUnitReconciliationAxis.UNIT_MEMBERS} — see the contract check there.\n /\n readonly organizationMemberId?: string;\n};\n\n/\n Which side of the (member, unit) edge the directory is currently speaking about.\n \n Both SCIM paths reconcile the SAME junction and the same way — \"make the edges incident to ONE\n * anchor match exactly what the directory says\" — and differ only in which node is the anchor. That\n * is one concept seen from two sides, not two concepts, so it is one function; the axis names the\n * side so neither call site has to re-derive the transposition.\n /\nexport enum ScimOrganizationUnitReconciliationAxis {\n /* Anchored on ONE member; the units vary. The `/Users` department push (`department` → unit). /\n MEMBER_UNITS = 'member_units',\n /* Anchored on ONE unit; the members vary. The `/Groups` membership push (`members` → memberships). /\n UNIT_MEMBERS = 'unit_members',\n}\n\n/* The writes a push must perform to make the anchor's assignments match the directory. /\nexport type ScimOrganizationUnitReconciliation = {\n /\n Counterparts to assign that the anchor does not already hold — unit ids on\n * {@link ScimOrganizationUnitReconciliationAxis.MEMBER_UNITS}, organization-member ids on\n * {@link ScimOrganizationUnitReconciliationAxis.UNIT_MEMBERS}.\n /\n readonly counterpartIdsToCreate: string[];\n /* Assignment rows to delete — everything the directory no longer says, minus what it cannot speak for. /\n readonly assignmentIdsToRemove: string[];\n};\n\nexport type ScimOrganizationUnitReconciliationOptions = {\n /* Defaults to {@link ScimOrganizationUnitReconciliationAxis.MEMBER_UNITS}, the department push. /\n readonly axis?: ScimOrganizationUnitReconciliationAxis;\n /\n Counterparts this push has NO authority over: neither created nor removed, whatever the directory\n * says about them.\n \n The department push supplies the member's units that a `/Groups` push owns\n * (`OrganizationUnit.externalSource === SCIM`). Without it the two directory paths silently fight:\n * department reconciliation is authoritative over the member's WHOLE set, so every `/Users` push\n * would delete the assignments `/Groups` made — and Entra sends group membership as DELTAS\n * (`PATCH … op: Add\|Remove`), so nothing would ever restore them. The member would quietly lose the\n * group's access on their next attribute sync, which is under-privilege nobody is told about.\n \n It is NOT a general \"leave this alone\" hatch: an id belongs here only when ANOTHER directory-owned\n * path is authoritative for it. A hand-made assignment is still removed, which is the documented\n * cost of opting an organization into `organizationUnitMapping`.\n /\n readonly counterpartIdsOutsideAuthority?: readonly string[];\n};\n\n/\n Compute the exact writes that make one anchor's unit assignments match the directory.\n \n Idempotent by construction: an unchanged department — or an unchanged group membership — produces\n * no writes at all, so a directory that re-pushes everything nightly does not churn the junction\n * table or its audit trail.\n \n A `desiredCounterpartIds` of `[]` removes every assignment the caller has authority over. That is\n * the authoritative half, and it is what makes leaving a department (or a group) actually revoke its\n * access rather than accumulate it.\n */\nexport function resolveScimOrganizationUnitReconciliation(\n desiredCounterpartIds: readonly string[],\n currentAssignments: readonly ScimOrganizationUnitAssignment[],\n options?: ScimOrganizationUnitReconciliationOptions,\n): ScimOrganizationUnitReconciliation {\n const axis = options?.axis ?? ScimOrganizationUnitReconciliationAxis.MEMBER_UNITS;\n const outsideAuthority = new Set(options?.counterpartIdsOutsideAuthority ?? []);\n\n const counterpartIdOf = (assignment: ScimOrganizationUnitAssignment): string => {\n if (axis === ScimOrganizationUnitReconciliationAxis.MEMBER_UNITS) return assignment.organizationUnitId;\n // A junction row without its membership FK cannot be placed on this axis, and GUESSING would\n // silently withhold a revocation — the one outcome this reconciliation exists to guarantee. A\n // contract violation by the caller, so it is loud rather than absorbed.\n if (assignment.organizationMemberId === undefined) {\n throw new Error(\n `resolveScimOrganizationUnitReconciliation: assignment ${assignment._id} has no organizationMemberId, `\n + `which ${ScimOrganizationUnitReconciliationAxis.UNIT_MEMBERS} requires.`,\n );\n }\n return assignment.organizationMemberId;\n };\n\n const desired = new Set(desiredCounterpartIds);\n const held = new Set(currentAssignments.map(counterpartIdOf));\n\n return {\n counterpartIdsToCreate: [...desired].filter((id) => !held.has(id) && !outsideAuthority.has(id)),\n assignmentIdsToRemove: currentAssignments\n .filter((assignment) => {\n const counterpartId = counterpartIdOf(assignment);\n return !desired.has(counterpartId) && !outsideAuthority.has(counterpartId);\n })\n .map((assignment) => assignment._id),\n };\n}\n"]}
1	+ {"version":3,"file":"scim-organization-unit-mapping.shared.js","sourceRoot":"","sources":["../../../../../../src/security/authentications/scim/scim-organization-unit-mapping.shared.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,sCAAsC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7D,2FAA2F;IAC3F,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,iLAAiL,CAAC;IACtO,wDAAwD;IACxD,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,qEAAqE,CAAC;CACtH,CAAC,CAAC;AAUH;;;;;;;GAOG;AACH,MAAM,UAAU,uCAAuC,CAAC,MAA+D;IACrH,OAAO,CAAC,CAAC,MAAM,EAAE,eAAe,IAAI,CAAC,MAAM,CAAC,uBAAuB,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;AACxF,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,6BAA6B,CAC3C,cAAyC,EACzC,OAAuE;IAEvE,MAAM,eAAe,GAAG,OAAO,cAAc,KAAK,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACxF,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAEnD,OAAO,OAAO,EAAE,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,cAAc,CAAC,IAAI,EAAE,KAAK,eAAe,CAAC,EAAE,kBAAkB,CAAC;AACvG,CAAC;AAeD;;;;;;;GAOG;AACH,MAAM,CAAN,IAAY,sCAKX;AALD,WAAY,sCAAsC;IAChD,kGAAkG;IAClG,uEAA6B,CAAA;IAC7B,uGAAuG;IACvG,uEAA6B,CAAA;AAC/B,CAAC,EALW,sCAAsC,KAAtC,sCAAsC,QAKjD;AAmCD;;;;;;;;;;GAUG;AACH,MAAM,UAAU,yCAAyC,CACvD,qBAAwC,EACxC,kBAA6D,EAC7D,OAAmD;IAEnD,MAAM,IAAI,GAAG,OAAO,EAAE,IAAI,IAAI,sCAAsC,CAAC,YAAY,CAAC;IAClF,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,OAAO,EAAE,8BAA8B,IAAI,EAAE,CAAC,CAAC;IAEhF,MAAM,eAAe,GAAG,CAAC,UAA0C,EAAU,EAAE;QAC7E,IAAI,IAAI,KAAK,sCAAsC,CAAC,YAAY;YAAE,OAAO,UAAU,CAAC,kBAAkB,CAAC;QACvG,6FAA6F;QAC7F,8FAA8F;QAC9F,wEAAwE;QACxE,IAAI,UAAU,CAAC,oBAAoB,KAAK,SAAS,EAAE,CAAC;YAClD,MAAM,IAAI,KAAK,CACb,yDAAyD,UAAU,CAAC,GAAG,gCAAgC;kBACrG,SAAS,sCAAsC,CAAC,YAAY,YAAY,CAC3E,CAAC;QACJ,CAAC;QACD,OAAO,UAAU,CAAC,oBAAoB,CAAC;IACzC,CAAC,CAAC;IAEF,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,qBAAqB,CAAC,CAAC;IAC/C,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,kBAAkB,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC;IAE9D,OAAO;QACL,sBAAsB,EAAE,CAAC,GAAG,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC/F,qBAAqB,EAAE,kBAAkB;aACtC,MAAM,CAAC,CAAC,UAAU,EAAE,EAAE;YACrB,MAAM,aAAa,GAAG,eAAe,CAAC,UAAU,CAAC,CAAC;YAClD,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;QAC7E,CAAC,CAAC;aACD,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;KACvC,CAAC;AACJ,CAAC","sourcesContent":["/*\n SCIM directory value → organization-unit assignment (WS-C).\n \n assurance-control: WILDO.IDENTITY.DIRECTORY_PROVISIONING — binds a directory-declared department to\n * an organization unit, and keeps that binding authoritative rather than accumulating.\n \n ## What this decides, and why it is EXPLICIT rather than inferred\n \n An IdP pushes a flat string (`department: \"Sales\"`). Units live in a TREE where `code` is unique\n * only among siblings and `name` is freeform, so \"Sales\" can legitimately match several nodes. Since\n * units became an authorization axis, resolving that string to the wrong node does not mislabel a\n * user — it grants them the wrong data.\n \n So there is no fuzzy matching, no name/code search, and no auto-creation. An organization admin\n * declares the binding explicitly, unit id by unit id, and a directory value with no declared binding\n * is IGNORED. The person who owns the org chart is the one who says what \"Sales\" means; nothing here\n * guesses on their behalf.\n \n ## Authoritative reconciliation\n \n Each push replaces the member's unit assignments with exactly what the directory currently says\n * (approved decision). A user who moves Sales → Legal LOSES Sales: keeping it would be privilege\n * accretion, where access only ever grows and an offboarded department is never actually left.\n \n ⚠️ The consequence, stated because it is not obvious: assignments made by hand in the application\n * are ALSO removed on the next push, because SCIM is authoritative over the whole set rather than\n * over a subset it can distinguish as its own. An organization that wants manual unit assignments\n * should not enable this mapping. This is why {@link isScimOrganizationUnitManagementEnabled}\n * requires an explicit, non-empty declaration before ANY reconciliation runs — an organization that\n * never opted in can never have its assignments deleted by a push.\n /\n\nimport { z } from 'zod';\n\n/\n One declared binding: the directory's own value for a department, and the unit it means.\n \n `directoryValue` is matched EXACTLY (after trimming) against what the IdP sends. It is deliberately\n * not normalised beyond whitespace — case and punctuation are part of what a directory actually\n * pushes, and silently folding them would make two distinct departments collide onto one unit.\n /\nexport const ScimOrganizationUnitMappingEntrySchema = z.object({\n /* The value the directory pushes, e.g. `\"Sales\"`. Matched exactly, whitespace-trimmed. /\n directoryValue: z.string().min(1).max(200).describe(\"A department value the directory sends, such as `Sales`, up to 200 characters. It must match exactly, apart from surrounding whitespace; a department with no entry is ignored.\"),\n /* The `ORGANIZATION_UNITS` row this value binds to. /\n organizationUnitId: z.string().min(1).describe(\"The organization unit a member with this department is assigned to.\"),\n});\n\nexport type ScimOrganizationUnitMappingEntry = z.infer<typeof ScimOrganizationUnitMappingEntrySchema>;\n\n/* The provisioning-config surface this module reads, kept structural so callers pass their row as-is. /\nexport type ScimOrganizationUnitManagementSignal = {\n readonly organizationUnitMapping?: readonly ScimOrganizationUnitMappingEntry[] \| null;\n readonly defaultUnitRole?: string \| null;\n};\n\n/\n Is this organization managing unit assignments through SCIM at all?\n \n Requires BOTH a non-empty mapping and a role to grant — an assignment cannot be created without a\n * role, so a mapping without one could only ever delete. That is exactly the failure mode this gate\n * exists to prevent: a half-configured row must never make a push authoritative over assignments it\n * has no way to recreate.\n /\nexport function isScimOrganizationUnitManagementEnabled(config: ScimOrganizationUnitManagementSignal \| undefined \| null): boolean {\n return !!config?.defaultUnitRole && (config.organizationUnitMapping?.length ?? 0) > 0;\n}\n\n/\n Resolve one directory value to the unit it was declared to mean, or `undefined` when nothing\n * declares it.\n \n `undefined` means UNMAPPED, not \"no unit\": the caller treats an unmapped value as \"the directory\n * says nothing about units for this user\", which under authoritative reconciliation removes their\n * directory-managed assignments rather than inventing one.\n /\nexport function resolveScimOrganizationUnitId(\n directoryValue: string \| undefined \| null,\n mapping: readonly ScimOrganizationUnitMappingEntry[] \| undefined \| null,\n): string \| undefined {\n const normalizedValue = typeof directoryValue === 'string' ? directoryValue.trim() : '';\n if (normalizedValue.length === 0) return undefined;\n\n return mapping?.find((entry) => entry.directoryValue.trim() === normalizedValue)?.organizationUnitId;\n}\n\n/* An existing assignment row, read structurally. /\nexport type ScimOrganizationUnitAssignment = {\n readonly _id: string;\n readonly organizationUnitId: string;\n /\n The membership side of the edge. A real junction row ALWAYS carries it; it is optional here only\n * because the department axis never projects it, and requiring it would make every caller and pin\n * on that axis supply a value nothing reads. Required in practice on\n * {@link ScimOrganizationUnitReconciliationAxis.UNIT_MEMBERS} — see the contract check there.\n /\n readonly organizationMemberId?: string;\n};\n\n/\n Which side of the (member, unit) edge the directory is currently speaking about.\n \n Both SCIM paths reconcile the SAME junction and the same way — \"make the edges incident to ONE\n * anchor match exactly what the directory says\" — and differ only in which node is the anchor. That\n * is one concept seen from two sides, not two concepts, so it is one function; the axis names the\n * side so neither call site has to re-derive the transposition.\n /\nexport enum ScimOrganizationUnitReconciliationAxis {\n /* Anchored on ONE member; the units vary. The `/Users` department push (`department` → unit). /\n MEMBER_UNITS = 'member_units',\n /* Anchored on ONE unit; the members vary. The `/Groups` membership push (`members` → memberships). /\n UNIT_MEMBERS = 'unit_members',\n}\n\n/* The writes a push must perform to make the anchor's assignments match the directory. /\nexport type ScimOrganizationUnitReconciliation = {\n /\n Counterparts to assign that the anchor does not already hold — unit ids on\n * {@link ScimOrganizationUnitReconciliationAxis.MEMBER_UNITS}, organization-member ids on\n * {@link ScimOrganizationUnitReconciliationAxis.UNIT_MEMBERS}.\n /\n readonly counterpartIdsToCreate: string[];\n /* Assignment rows to delete — everything the directory no longer says, minus what it cannot speak for. /\n readonly assignmentIdsToRemove: string[];\n};\n\nexport type ScimOrganizationUnitReconciliationOptions = {\n /* Defaults to {@link ScimOrganizationUnitReconciliationAxis.MEMBER_UNITS}, the department push. /\n readonly axis?: ScimOrganizationUnitReconciliationAxis;\n /\n Counterparts this push has NO authority over: neither created nor removed, whatever the directory\n * says about them.\n \n The department push supplies the member's units that a `/Groups` push owns\n * (`OrganizationUnit.externalSource === SCIM`). Without it the two directory paths silently fight:\n * department reconciliation is authoritative over the member's WHOLE set, so every `/Users` push\n * would delete the assignments `/Groups` made — and Entra sends group membership as DELTAS\n * (`PATCH … op: Add\|Remove`), so nothing would ever restore them. The member would quietly lose the\n * group's access on their next attribute sync, which is under-privilege nobody is told about.\n \n It is NOT a general \"leave this alone\" hatch: an id belongs here only when ANOTHER directory-owned\n * path is authoritative for it. A hand-made assignment is still removed, which is the documented\n * cost of opting an organization into `organizationUnitMapping`.\n /\n readonly counterpartIdsOutsideAuthority?: readonly string[];\n};\n\n/\n Compute the exact writes that make one anchor's unit assignments match the directory.\n \n Idempotent by construction: an unchanged department — or an unchanged group membership — produces\n * no writes at all, so a directory that re-pushes everything nightly does not churn the junction\n * table or its audit trail.\n \n A `desiredCounterpartIds` of `[]` removes every assignment the caller has authority over. That is\n * the authoritative half, and it is what makes leaving a department (or a group) actually revoke its\n * access rather than accumulate it.\n */\nexport function resolveScimOrganizationUnitReconciliation(\n desiredCounterpartIds: readonly string[],\n currentAssignments: readonly ScimOrganizationUnitAssignment[],\n options?: ScimOrganizationUnitReconciliationOptions,\n): ScimOrganizationUnitReconciliation {\n const axis = options?.axis ?? ScimOrganizationUnitReconciliationAxis.MEMBER_UNITS;\n const outsideAuthority = new Set(options?.counterpartIdsOutsideAuthority ?? []);\n\n const counterpartIdOf = (assignment: ScimOrganizationUnitAssignment): string => {\n if (axis === ScimOrganizationUnitReconciliationAxis.MEMBER_UNITS) return assignment.organizationUnitId;\n // A junction row without its membership FK cannot be placed on this axis, and GUESSING would\n // silently withhold a revocation — the one outcome this reconciliation exists to guarantee. A\n // contract violation by the caller, so it is loud rather than absorbed.\n if (assignment.organizationMemberId === undefined) {\n throw new Error(\n `resolveScimOrganizationUnitReconciliation: assignment ${assignment._id} has no organizationMemberId, `\n + `which ${ScimOrganizationUnitReconciliationAxis.UNIT_MEMBERS} requires.`,\n );\n }\n return assignment.organizationMemberId;\n };\n\n const desired = new Set(desiredCounterpartIds);\n const held = new Set(currentAssignments.map(counterpartIdOf));\n\n return {\n counterpartIdsToCreate: [...desired].filter((id) => !held.has(id) && !outsideAuthority.has(id)),\n assignmentIdsToRemove: currentAssignments\n .filter((assignment) => {\n const counterpartId = counterpartIdOf(assignment);\n return !desired.has(counterpartId) && !outsideAuthority.has(counterpartId);\n })\n .map((assignment) => assignment._id),\n };\n}\n"]}

package/dist/esm/security/authentications/scim/scim-provisioning-config.shared.resources-config.schemas.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"scim-provisioning-config.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["~~../../../../../~~src/security/authentications/scim/scim-provisioning-config.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,qBAAqB,EAAoB,MAAM,sDAAsD,CAAC;AAC/G,OAAO,EAEL,4BAA4B,EAC7B,MAAM,6CAA6C,CAAC;AAMrD;;;;;GAKG;AACH,eAAO,MAAM,2CAA2C;;;CAG9C,CAAC;AAIX,eAAO,MAAM,0CAA0C,yNA2GtD,CAAC"}
1	+ {"version":3,"file":"scim-provisioning-config.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../../../src/security/authentications/scim/scim-provisioning-config.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,qBAAqB,EAAoB,MAAM,sDAAsD,CAAC;AAC/G,OAAO,EAEL,4BAA4B,EAC7B,MAAM,6CAA6C,CAAC;AAMrD;;;;;GAKG;AACH,eAAO,MAAM,2CAA2C;;;CAG9C,CAAC;AAIX,eAAO,MAAM,0CAA0C,yNA2GtD,CAAC"}

package/dist/esm/security/authentications/scim/scim-provisioning-config.shared.resources-config.schemas.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"scim-provisioning-config.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../../../src/security/authentications/scim/scim-provisioning-config.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,sDAAsD,CAAC;AAC/G,OAAO,EACL,0BAA0B,EAC1B,4BAA4B,GAC7B,MAAM,6CAA6C,CAAC;AACrD,OAAO,EAAE,uCAAuC,EAAE,MAAM,wDAAwD,CAAC;AACjH,OAAO,EAAE,wBAAwB,EAAE,MAAM,oDAAoD,CAAC;AAC9F,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,2CAA2C,CAAC;AAC3F,OAAO,EAAE,4CAA4C,EAAE,MAAM,2CAA2C,CAAC;AAEzG;;;;;GAKG;AACH,MAAM,CAAC,MAAM,2CAA2C,GAAG;IACzD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE,4BAA4B,CAAC,aAAa;IAC1E,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE,4BAA4B,CAAC,QAAQ;CAC7D,CAAC;AAEX,wEAAwE;AAExE,MAAM,CAAC,MAAM,0CAA0C,GAAG,uCAAuC,CAC/F,4CAA4C,EAC5C;IACE,gBAAgB,EAAE,IAAI;IACtB,8EAA8E;IAC9E,8EAA8E;IAC9E,4EAA4E;IAC5E,gEAAgE;IAChE,0DAA0D;IAC1D,8EAA8E;IAC9E,sDAAsD;IACtD,kBAAkB,EAAE;QAClB,IAAI,EAAE,wBAAwB,CAAC,OAAO;QACtC,MAAM,EAAE,wBAAwB,CAAC,OAAO;KACzC;IACD,cAAc,EAAE,CAAC,qBAAqB,CAAC,IAAI,EAAE,qBAAqB,CAAC,MAAM,EAAE,qBAAqB,CAAC,MAAM,EAAE,qBAAqB,CAAC,MAAM,CAAC;IACtI,uBAAuB,EAAE;QACvB,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,6BAA6B,CAAC;wBAC1G,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C,CAAC;SACH;QACD,4EAA4E;QAC5E,8EAA8E;QAC9E,uEAAuE;QACvE,4EAA4E;QAC5E,4EAA4E;QAC5E,+EAA+E;QAC/E,wDAAwD;QACxD,0EAA0E;QAC1E,6EAA6E;QAC7E,yEAAyE;QACzE,kCAAkC;QAClC,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,2CAA2C,CAAC,qBAAqB,CAAC,MAAM,CAAC;oBACtF,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,IAAI;iBAC3C,CAAC;SACH;QACD,2FAA2F;QAC3F,0FAA0F;QAC1F,+FAA+F;QAC/F,mFAAmF;QACnF,4EAA4E;QAC5E,mFAAmF;QACnF,oDAAoD;QACpD,wFAAwF;QACxF,yFAAyF;QACzF,sFAAsF;QACtF,0FAA0F;QAC1F,2FAA2F;QAC3F,uFAAuF;QACvF,EAAE;QACF,gGAAgG;QAChG,4FAA4F;QAC5F,4FAA4F;QAC5F,+FAA+F;QAC/F,6FAA6F;QAC7F,2FAA2F;QAC3F,qFAAqF;QACrF,EAAE;QACF,uGAAuG;QACvG,wGAAwG;QACxG,wFAAwF;QACxF,gGAAgG;QAChG,mEAAmE;QACnE,qBAAqB;QACrB,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,2CAA2C,CAAC,qBAAqB,CAAC,MAAM,CAAC;oBACtF,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,6BAA6B,CAAC;wBAC1G,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,IAAI;iBAC3C,CAAC;SACH;QACD,yEAAyE;QACzE,+EAA+E;QAC/E,iFAAiF;QACjF,gFAAgF;QAChF,sEAAsE;QACtE,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,eAAe;oBACzD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,IAAI;iBAC3C,CAAC;SACH;KACF;CACF,CACF,CAAC","sourcesContent":["/*\n SCIM Provisioning Config Resource Configuration — Polymorphic\n \n Produces 2 factory functions (ORG + APP) via the polymorphic factory.\n * Spread into the registry factory map:\n * ...scimProvisioningConfigPolymorphicFactories\n /\n\nimport { CoreResourceOperation, CoreResourceType } from '../../../resources/resources.shared.core.definitions';\nimport {\n ResourceOperationRiskLevel,\n ResourceOperationVariantType,\n} from '../../../resources/resources.shared.schemas';\nimport { createPolymorphicResourceConfigurations } from '../../../resources/utils/resource-polymorphism.factory';\nimport { ResourceSystemAccessMode } from '../../../resources/resources-config.shared.schemas';\nimport { CORE_ORG_ROLES, CORE_APP_ROLES } from '../../authorizations/roles.shared.schemas';\nimport { scimProvisioningConfigPolymorphicDeclaration } from './scim-provisioning-config.shared.schemas';\n\n/\n The variant each SCIM configuration WRITE is declared with — the one source the resource configuration and the\n * custom-implementation prefix (the writer's role ceiling, #1631) both read, because the implementation registry keys\n * on the full operation path. CREATE is INTERNAL_CALL (materialised by the framework), UPDATE is API_CALL (the\n * administrator's settings door).\n /\nexport const SCIM_PROVISIONING_CONFIG_WRITE_VARIANT_TYPE = {\n [CoreResourceOperation.CREATE]: ResourceOperationVariantType.INTERNAL_CALL,\n [CoreResourceOperation.UPDATE]: ResourceOperationVariantType.API_CALL,\n} as const;\n\n// ── Polymorphic Factory ──────────────────────────────────────────────\n\nexport const scimProvisioningConfigPolymorphicFactories = createPolymorphicResourceConfigurations(\n scimProvisioningConfigPolymorphicDeclaration,\n {\n isSystemResource: true,\n // SCIM provisioning loads its config via `readAsSystem` on the directory-sync\n // path (system-driven, no end user in context) (READ). When the row is absent\n // — a provisioned / migrated / pre-seed org that bypassed the `afterCreate`\n // default-seed — the userless load path lazily materialises the\n // disabled-default row via `createAsSystem` (CREATE); see\n // `AuthOrganizationConfigurationService.loadScimProvisioningConfig`. Both are\n // system-context, so the resource opts BOTH verbs in.\n systemAccessPolicy: {\n read: ResourceSystemAccessMode.ALLOWED,\n create: ResourceSystemAccessMode.ALLOWED,\n },\n coreOperations: [CoreResourceOperation.READ, CoreResourceOperation.CREATE, CoreResourceOperation.UPDATE, CoreResourceOperation.DELETE],\n operationsConfiguration: {\n [CoreResourceOperation.READ]: {\n variants: [{\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n polymorphicRole: {\n [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN, CORE_ORG_ROLES.ORG_DELEGATED_MANAGE_SSO_SCIM],\n [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n },\n riskLevel: ResourceOperationRiskLevel.LOW,\n }],\n },\n // Internal-only (INTERNAL_CALL, NO HTTP route): the per-scope config row is\n // materialised by the framework default-seed (repository tier) OR — when that\n // was bypassed (provisioned / migrated / pre-seed org) — lazily by the\n // userless load path via `createAsSystem` (`systemAccessPolicy.create` opts\n // it in). Must NOT be REPOSITORY_ONLY: `createAsSystem` resolves CREATE via\n // `getServiceOperationPathDefault`, which honours INTERNAL_CALL / API_CALL but\n // NOT REPOSITORY_ONLY — a repository-only CREATE throws\n // `RESOURCES_REGISTRY_OPERATION_PATH_NOT_FOUND` (INTERNAL / critical, and\n // self-alerting on mere construction). No public HTTP create surface (config\n // is seeded/bootstrapped, never self-serve). Same fix as the SCIM-tokens\n // READ/UPDATE. Admin tier / HIGH.\n [CoreResourceOperation.CREATE]: {\n variants: [{\n variantType: SCIM_PROVISIONING_CONFIG_WRITE_VARIANT_TYPE[CoreResourceOperation.CREATE],\n isDefault: true,\n polymorphicRole: {\n [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n },\n riskLevel: ResourceOperationRiskLevel.HIGH,\n }],\n },\n // Two kinds of caller reach this write and both resolve the SAME default: an administrator\n // editing the settings pane, over the HTTP route this variant now carries; and the config\n // service path — `AuthOrganizationConfigurationService.saveScimProvisioningConfig` dispatching\n // via `ServicesRegistryHandler.update` with the ADMIN's EC, preserving admin audit\n // attribution. Must NOT be REPOSITORY_ONLY: `.update()` resolves the op via\n // `getServiceOperationPathDefault`, which honours INTERNAL_CALL / API_CALL but NOT\n // REPOSITORY_ONLY — a repository-only UPDATE throws\n // `RESOURCES_REGISTRY_OPERATION_PATH_NOT_FOUND` (INTERNAL / critical) whenever the save\n // method runs. This completes the enterprise-config trio: SSO and SIEM were flipped when\n // their `save` helpers were fixed, leaving SCIM the last REPOSITORY_ONLY writer-less\n // config — a latent copy of the same FATAL, armed for whoever wrote the save method next.\n // (No UPDATE custom-impl to keep in lockstep: the read-only computed fields are framework-\n // driven via `.isVirtual()` on the schema, which is variant-agnostic by construction.)\n //\n // API_CALL — the administrator's edit door, flipped from INTERNAL_CALL alongside SSO config and\n // following SIEM export config (#953). Route-less, this policy was something only a backend\n // service could change, which contradicts the plainest reading of a settings pane: the four\n // decisions on this row — create users, verify their email, deactivate on deprovision, and the\n // role they land with — are exactly what an operator opens SCIM settings to set. The comment\n // that stood here said the config was \"admin-service-owned, never self-serve\"; the door is\n // gated on ORG_ADMIN / APP super-admin, so it is not self-serve, it is admin-served.\n //\n // One thing moves in lockstep since #1631: CREATE and UPDATE carry a custom-implementation prefix (the\n // writer's role ceiling over `defaultRole` / `defaultUnitRole`), and the custom-implementation registry\n // keys on the FULL operation path, variantType included. So both variants are read from\n // `SCIM_PROVISIONING_CONFIG_WRITE_VARIANT_TYPE`, the one source the prefix registers against; a\n // variant changed here without it would silently skip the ceiling.\n // Admin tier / HIGH.\n [CoreResourceOperation.UPDATE]: {\n variants: [{\n variantType: SCIM_PROVISIONING_CONFIG_WRITE_VARIANT_TYPE[CoreResourceOperation.UPDATE],\n isDefault: true,\n polymorphicRole: {\n [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN, CORE_ORG_ROLES.ORG_DELEGATED_MANAGE_SSO_SCIM],\n [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n },\n riskLevel: ResourceOperationRiskLevel.HIGH,\n }],\n },\n // Internal-only (REPOSITORY_ONLY, no HTTP route): powers the composition\n // onParentDelete cascade so this one-per-scope SCIM-provisioning-config row is\n // physically removed when its owning org/app is deleted. Without a DELETE op the\n // cascade (deleteChildrenImmediate) throws ErrorType.CONFIGURATION on any scope\n // with a config row. Admin tier (ORG_ADMIN / APP super-admin) / HIGH.\n [CoreResourceOperation.DELETE]: {\n variants: [{\n variantType: ResourceOperationVariantType.REPOSITORY_ONLY,\n isDefault: true,\n polymorphicRole: {\n [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n },\n riskLevel: ResourceOperationRiskLevel.HIGH,\n }],\n },\n },\n },\n);\n"]}
1	+ {"version":3,"file":"scim-provisioning-config.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../../../../src/security/authentications/scim/scim-provisioning-config.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,sDAAsD,CAAC;AAC/G,OAAO,EACL,0BAA0B,EAC1B,4BAA4B,GAC7B,MAAM,6CAA6C,CAAC;AACrD,OAAO,EAAE,uCAAuC,EAAE,MAAM,wDAAwD,CAAC;AACjH,OAAO,EAAE,wBAAwB,EAAE,MAAM,oDAAoD,CAAC;AAC9F,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,2CAA2C,CAAC;AAC3F,OAAO,EAAE,4CAA4C,EAAE,MAAM,2CAA2C,CAAC;AAEzG;;;;;GAKG;AACH,MAAM,CAAC,MAAM,2CAA2C,GAAG;IACzD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE,4BAA4B,CAAC,aAAa;IAC1E,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE,4BAA4B,CAAC,QAAQ;CAC7D,CAAC;AAEX,wEAAwE;AAExE,MAAM,CAAC,MAAM,0CAA0C,GAAG,uCAAuC,CAC/F,4CAA4C,EAC5C;IACE,gBAAgB,EAAE,IAAI;IACtB,8EAA8E;IAC9E,8EAA8E;IAC9E,4EAA4E;IAC5E,gEAAgE;IAChE,0DAA0D;IAC1D,8EAA8E;IAC9E,sDAAsD;IACtD,kBAAkB,EAAE;QAClB,IAAI,EAAE,wBAAwB,CAAC,OAAO;QACtC,MAAM,EAAE,wBAAwB,CAAC,OAAO;KACzC;IACD,cAAc,EAAE,CAAC,qBAAqB,CAAC,IAAI,EAAE,qBAAqB,CAAC,MAAM,EAAE,qBAAqB,CAAC,MAAM,EAAE,qBAAqB,CAAC,MAAM,CAAC;IACtI,uBAAuB,EAAE;QACvB,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,6BAA6B,CAAC;wBAC1G,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C,CAAC;SACH;QACD,4EAA4E;QAC5E,8EAA8E;QAC9E,uEAAuE;QACvE,4EAA4E;QAC5E,4EAA4E;QAC5E,+EAA+E;QAC/E,wDAAwD;QACxD,0EAA0E;QAC1E,6EAA6E;QAC7E,yEAAyE;QACzE,kCAAkC;QAClC,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,2CAA2C,CAAC,qBAAqB,CAAC,MAAM,CAAC;oBACtF,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,IAAI;iBAC3C,CAAC;SACH;QACD,2FAA2F;QAC3F,0FAA0F;QAC1F,+FAA+F;QAC/F,mFAAmF;QACnF,4EAA4E;QAC5E,mFAAmF;QACnF,oDAAoD;QACpD,wFAAwF;QACxF,yFAAyF;QACzF,sFAAsF;QACtF,0FAA0F;QAC1F,2FAA2F;QAC3F,uFAAuF;QACvF,EAAE;QACF,gGAAgG;QAChG,4FAA4F;QAC5F,4FAA4F;QAC5F,+FAA+F;QAC/F,6FAA6F;QAC7F,2FAA2F;QAC3F,qFAAqF;QACrF,EAAE;QACF,uGAAuG;QACvG,wGAAwG;QACxG,wFAAwF;QACxF,gGAAgG;QAChG,mEAAmE;QACnE,qBAAqB;QACrB,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,2CAA2C,CAAC,qBAAqB,CAAC,MAAM,CAAC;oBACtF,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,6BAA6B,CAAC;wBAC1G,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,IAAI;iBAC3C,CAAC;SACH;QACD,yEAAyE;QACzE,+EAA+E;QAC/E,iFAAiF;QACjF,gFAAgF;QAChF,sEAAsE;QACtE,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,eAAe;oBACzD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,IAAI;iBAC3C,CAAC;SACH;KACF;CACF,CACF,CAAC","sourcesContent":["/*\n SCIM Provisioning Config Resource Configuration — Polymorphic\n \n Produces 2 factory functions (ORG + APP) via the polymorphic factory.\n * Spread into the registry factory map:\n * ...scimProvisioningConfigPolymorphicFactories\n /\n\nimport { CoreResourceOperation, CoreResourceType } from '../../../resources/resources.shared.core.definitions';\nimport {\n ResourceOperationRiskLevel,\n ResourceOperationVariantType,\n} from '../../../resources/resources.shared.schemas';\nimport { createPolymorphicResourceConfigurations } from '../../../resources/utils/resource-polymorphism.factory';\nimport { ResourceSystemAccessMode } from '../../../resources/resources-config.shared.schemas';\nimport { CORE_ORG_ROLES, CORE_APP_ROLES } from '../../authorizations/roles.shared.schemas';\nimport { scimProvisioningConfigPolymorphicDeclaration } from './scim-provisioning-config.shared.schemas';\n\n/\n The variant each SCIM configuration WRITE is declared with — the one source the resource configuration and the\n * custom-implementation prefix (the writer's role ceiling, #1631) both read, because the implementation registry keys\n * on the full operation path. CREATE is INTERNAL_CALL (materialised by the framework), UPDATE is API_CALL (the\n * administrator's settings door).\n /\nexport const SCIM_PROVISIONING_CONFIG_WRITE_VARIANT_TYPE = {\n [CoreResourceOperation.CREATE]: ResourceOperationVariantType.INTERNAL_CALL,\n [CoreResourceOperation.UPDATE]: ResourceOperationVariantType.API_CALL,\n} as const;\n\n// ── Polymorphic Factory ──────────────────────────────────────────────\n\nexport const scimProvisioningConfigPolymorphicFactories = createPolymorphicResourceConfigurations(\n scimProvisioningConfigPolymorphicDeclaration,\n {\n isSystemResource: true,\n // SCIM provisioning loads its config via `readAsSystem` on the directory-sync\n // path (system-driven, no end user in context) (READ). When the row is absent\n // — a provisioned / migrated / pre-seed org that bypassed the `afterCreate`\n // default-seed — the userless load path lazily materialises the\n // disabled-default row via `createAsSystem` (CREATE); see\n // `AuthOrganizationConfigurationService.loadScimProvisioningConfig`. Both are\n // system-context, so the resource opts BOTH verbs in.\n systemAccessPolicy: {\n read: ResourceSystemAccessMode.ALLOWED,\n create: ResourceSystemAccessMode.ALLOWED,\n },\n coreOperations: [CoreResourceOperation.READ, CoreResourceOperation.CREATE, CoreResourceOperation.UPDATE, CoreResourceOperation.DELETE],\n operationsConfiguration: {\n [CoreResourceOperation.READ]: {\n variants: [{\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n polymorphicRole: {\n [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN, CORE_ORG_ROLES.ORG_DELEGATED_MANAGE_SSO_SCIM],\n [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n },\n riskLevel: ResourceOperationRiskLevel.LOW,\n }],\n },\n // Internal-only (INTERNAL_CALL, NO HTTP route): the per-scope config row is\n // materialised by the framework default-seed (repository tier) OR — when that\n // was bypassed (provisioned / migrated / pre-seed org) — lazily by the\n // userless load path via `createAsSystem` (`systemAccessPolicy.create` opts\n // it in). Must NOT be REPOSITORY_ONLY: `createAsSystem` resolves CREATE via\n // `getServiceOperationPathDefault`, which honours INTERNAL_CALL / API_CALL but\n // NOT REPOSITORY_ONLY — a repository-only CREATE throws\n // `RESOURCES_REGISTRY_OPERATION_PATH_NOT_FOUND` (INTERNAL / critical, and\n // self-alerting on mere construction). No public HTTP create surface (config\n // is seeded/bootstrapped, never self-serve). Same fix as the SCIM-tokens\n // READ/UPDATE. Admin tier / HIGH.\n [CoreResourceOperation.CREATE]: {\n variants: [{\n variantType: SCIM_PROVISIONING_CONFIG_WRITE_VARIANT_TYPE[CoreResourceOperation.CREATE],\n isDefault: true,\n polymorphicRole: {\n [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n },\n riskLevel: ResourceOperationRiskLevel.HIGH,\n }],\n },\n // Two kinds of caller reach this write and both resolve the SAME default: an administrator\n // editing the settings pane, over the HTTP route this variant now carries; and the config\n // service path — `AuthOrganizationConfigurationService.saveScimProvisioningConfig` dispatching\n // via `ServicesRegistryHandler.update` with the ADMIN's EC, preserving admin audit\n // attribution. Must NOT be REPOSITORY_ONLY: `.update()` resolves the op via\n // `getServiceOperationPathDefault`, which honours INTERNAL_CALL / API_CALL but NOT\n // REPOSITORY_ONLY — a repository-only UPDATE throws\n // `RESOURCES_REGISTRY_OPERATION_PATH_NOT_FOUND` (INTERNAL / critical) whenever the save\n // method runs. This completes the enterprise-config trio: SSO and SIEM were flipped when\n // their `save` helpers were fixed, leaving SCIM the last REPOSITORY_ONLY writer-less\n // config — a latent copy of the same FATAL, armed for whoever wrote the save method next.\n // (No UPDATE custom-impl to keep in lockstep: the read-only computed fields are framework-\n // driven via `.isVirtual()` on the schema, which is variant-agnostic by construction.)\n //\n // API_CALL — the administrator's edit door, flipped from INTERNAL_CALL alongside SSO config and\n // following SIEM export config (#953). Route-less, this policy was something only a backend\n // service could change, which contradicts the plainest reading of a settings pane: the four\n // decisions on this row — create users, verify their email, deactivate on deprovision, and the\n // role they land with — are exactly what an operator opens SCIM settings to set. The comment\n // that stood here said the config was \"admin-service-owned, never self-serve\"; the door is\n // gated on ORG_ADMIN / APP super-admin, so it is not self-serve, it is admin-served.\n //\n // One thing moves in lockstep since #1631: CREATE and UPDATE carry a custom-implementation prefix (the\n // writer's role ceiling over `defaultRole` / `defaultUnitRole`), and the custom-implementation registry\n // keys on the FULL operation path, variantType included. So both variants are read from\n // `SCIM_PROVISIONING_CONFIG_WRITE_VARIANT_TYPE`, the one source the prefix registers against; a\n // variant changed here without it would silently skip the ceiling.\n // Admin tier / HIGH.\n [CoreResourceOperation.UPDATE]: {\n variants: [{\n variantType: SCIM_PROVISIONING_CONFIG_WRITE_VARIANT_TYPE[CoreResourceOperation.UPDATE],\n isDefault: true,\n polymorphicRole: {\n [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN, CORE_ORG_ROLES.ORG_DELEGATED_MANAGE_SSO_SCIM],\n [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n },\n riskLevel: ResourceOperationRiskLevel.HIGH,\n }],\n },\n // Internal-only (REPOSITORY_ONLY, no HTTP route): powers the composition\n // onParentDelete cascade so this one-per-scope SCIM-provisioning-config row is\n // physically removed when its owning org/app is deleted. Without a DELETE op the\n // cascade (deleteChildrenImmediate) throws ErrorType.CONFIGURATION on any scope\n // with a config row. Admin tier (ORG_ADMIN / APP super-admin) / HIGH.\n [CoreResourceOperation.DELETE]: {\n variants: [{\n variantType: ResourceOperationVariantType.REPOSITORY_ONLY,\n isDefault: true,\n polymorphicRole: {\n [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n },\n riskLevel: ResourceOperationRiskLevel.HIGH,\n }],\n },\n },\n },\n);\n"]}

package/dist/esm/security/authentications/scim/scim-provisioning-config.shared.schemas.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"scim-provisioning-config.shared.schemas.d.ts","sourceRoot":"","sources":["~~../../../../../~~src/security/authentications/scim/scim-provisioning-config.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAQxB;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,0BAA0B;;;;;iBAKrC,CAAC;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAa9E;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,sBAAsB,EAAE,MAAwC,CAAC;AAE9E,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;;;;;;;;iBAsK3C,CAAC;AAEH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC;AAE1F,eAAO,MAAM,4CAA4C;;;;;;;;;;;;;;;;;;;;;kBAMvD,CAAC"}
1	+ {"version":3,"file":"scim-provisioning-config.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../../../src/security/authentications/scim/scim-provisioning-config.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAQxB;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,0BAA0B;;;;;iBAKrC,CAAC;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAa9E;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,sBAAsB,EAAE,MAAwC,CAAC;AAE9E,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;;;;;;;;iBAsK3C,CAAC;AAEH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC;AAE1F,eAAO,MAAM,4CAA4C;;;;;;;;;;;;;;;;;;;;;kBAMvD,CAAC"}

package/dist/esm/security/authentications/scim/scim-provisioning-config.shared.schemas.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"scim-provisioning-config.shared.schemas.js","sourceRoot":"","sources":["../../../../../src/security/authentications/scim/scim-provisioning-config.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AACvE,OAAO,EAAE,yBAAyB,EAAE,MAAM,wDAAwD,CAAC;AACnG,OAAO,EAAE,gBAAgB,EAAE,MAAM,sDAAsD,CAAC;AACxF,OAAO,EAAE,kBAAkB,EAAE,MAAM,kDAAkD,CAAC;AACtF,OAAO,EAAE,sBAAsB,EAAE,MAAM,kCAAkC,CAAC;AAC1E,OAAO,EAAE,sCAAsC,EAAE,MAAM,yCAAyC,CAAC;AAEjG;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC,QAAQ,CAAC,iOAAiO,CAAC;IACxR,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,QAAQ,CAAC,4FAA4F,CAAC;IACtJ,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC,QAAQ,CAAC,4FAA4F,CAAC;IACtJ,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,QAAQ,CAAC,2FAA2F,CAAC;CACrJ,CAAC,CAAC;AAGH;;;;GAIG;AACH,MAAM,2BAA2B,GAA4E;IAC3G,CAAC,gBAAgB,EAAE,gBAAgB,CAAC,uBAAuB,CAAC;IAC5D,CAAC,eAAe,EAAE,gBAAgB,CAAC,sBAAsB,CAAC;CAClD,CAAC;AAGX;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAW,GAAG,kBAAkB,UAAU,CAAC;AAE9E,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,MAAM,CAAC;IACvD,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IAEtD,gGAAgG;IAChG,kGAAkG;IAClG,4EAA4E;IAC5E,gGAAgG;IAChG,mFAAmF;IACnF,6FAA6F;IAC7F,4FAA4F;IAC5F,gGAAgG;IAChG,4FAA4F;IAC5F,iGAAiG;IACjG,+FAA+F;IAC/F,8FAA8F;IAC9F,+FAA+F;IAC/F,+FAA+F;IAC/F,+FAA+F;IAC/F,6FAA6F;IAC7F,4FAA4F;IAC5F,mGAAmG;IACnG,sBAAsB;IACtB,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,cAAc,EAAE,CAAC,eAAe,EAAE;IAC7E,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAC1C,mBAAmB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,eAAe,EAAE;IAChE,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE;IACpD,gBAAgB,EAAE,0BAA0B,CAAC,QAAQ,EAAE;IAEvD;;;;;;;;;;;;;;;;;OAiBG;IACH,4FAA4F;IAC5F,6FAA6F;IAC7F,uBAAuB,EAAE,CAAC,CAAC,KAAK,CAAC,sCAAsC,CAAC,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE;IAErG;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACH,gGAAgG;IAChG,0EAA0E;IAC1E,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE;IAExD;;;;;;;;;;;;;;;;;;;OAmBG;IACH,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,SAAS,CAAC;QAC/C,SAAS,EAAE,GAAG,EAAE,CAAC,sBAAsB;KACxC,CAAC;IAEF;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,SAAS,CAAC;QACvD,YAAY,EAAE,2BAA2B,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;QAC3D,SAAS,EAAE,KAAK,EAAE,EAAE,aAAa,EAAE,KAAK,EAAE,EAAE,EAAE;YAC5C,MAAM,GAAG,GAAG,aAAoD,CAAC;YAEjE,MAAM,KAAK,GAAG,2BAA2B;iBACtC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,eAAe,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,eAAe,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;iBAC3E,IAAI,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;YAC1F,IAAI,CAAC,KAAK;gBAAE,OAAO,SAAS,CAAC;YAE7B,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YACpC,MAAM,aAAa,GAAG,KAAK,EAAE,YAAY,EAAE,aAAa,EAAE,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;YAClF,IAAI,CAAC,aAAa,IAAI,OAAO,aAAa,CAAC,0BAA0B,KAAK,UAAU;gBAAE,OAAO,SAAS,CAAC;YAEvG,IAAI,CAAC;gBACH,MAAM,aAAa,GACjB,MAAM,aAAa,CAAC,0BAA0B,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC;gBACnF,MAAM,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,SAAS,CAEzC,CAAC;gBACd,IAAI,CAAC,OAAO;oBAAE,OAAO,SAAS,CAAC;gBAE/B,uFAAuF;gBACvF,yFAAyF;gBACzF,0FAA0F;gBAC1F,OAAO,sBAAsB,CAAC,OAAO,CAAC,CAAC;YACzC,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,CACnB,sEAAsE,KAAK,CAAC,EAAE,IAAI,OAAO,0BAA0B,EACnH,KAAK,CACN,CAAC;gBACF,OAAO,SAAS,CAAC;YACnB,CAAC;QACH,CAAC;KACF,CAAC;IAEF,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IACrF,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;CACtF,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,4CAA4C,GAAG,yBAAyB,CAAC;IACpF,gBAAgB,EAAE,wBAAwB;IAC1C,mBAAmB,EAAE,0BAA0B;IAC/C,WAAW,EAAE,0BAA0B;IACvC,UAAU,EAAE,gCAAgC;IAC5C,QAAQ,EAAE,mBAAmB;CAC9B,CAAC,CAAC","sourcesContent":["/*\n SCIM Provisioning Config Schema (Shared) — Polymorphic\n \n SCIM provisioning settings: auto-create, auto-deactivate, attribute mapping.\n \n ONE of the two provisioning authorities, and the boundary is the TRIGGER rather than the feature.\n * This row governs a DIRECTORY PUSH — the IdP calling `/scim/v2`, read by\n * `scim.backend.controller._getProvisioningConfig`. Per organization, because a tenant has one\n * directory relationship.\n \n The other is the CONNECTION: an interactive sign-in through OIDC or SAML reads\n * `SsoConnection.{autoCreateUsers, defaultRole, roleMapping, groupMapping}`. Per\n * connection, because two IdPs bound to one tenant may legitimately differ. Both funnel into\n * `provisionEnterpriseUser`, which is why the two configurations look alike and are not\n * interchangeable — an organization can run either without the other.\n \n This comment used to point at `SsoConfig.provisioning` as the JIT half. That block existed, was\n * rendered on the SSO settings pane, and had no readers at all; it has been removed. Nothing here\n * changed with it.\n \n Scope FK (organizationId / applicationId) is injected by the polymorphism engine.\n \n @see auth-data-model-audit.md §2G\n /\n\nimport { z } from 'zod';\nimport { AUTH_SCOPE_VARIANTS } from '../authentication.shared.schemas';\nimport { declarePolymorphicSchemas } from '../../../resources/utils/resource-polymorphism.schemas';\nimport { CoreResourceType } from '../../../resources/resources.shared.core.definitions';\nimport { MAIN_API_BASE_PATH } from '../../../requests/manual-controllers-routes-urls';\nimport { resolveVerifiedDomains } from '../sso/sso-config.shared.schemas';\nimport { ScimOrganizationUnitMappingEntrySchema } from './scim-organization-unit-mapping.shared';\n\n/\n Maps a Wildo profile field to a PATH into the inbound SCIM User JSON. Each value is a\n * path expression resolved against the SCIM body at push time by the backend\n * `resolveScimAttributePath` — the row's authoritative source for how a directory's payload\n * shape translates to Wildo's `{email, firstName, lastName, displayName}` (Okta, Azure AD, etc.\n * differ). The defaults reproduce the framework's built-in mapping exactly, so an org that never\n * customises this behaves identically to the hardcoded normalisation it replaces.\n \n Supported path grammar (what `resolveScimAttributePath` understands):\n * - dotted traversal — `name.givenName`\n * - array index — `emails[0].value`\n * - array filter — `emails[primary eq true].value` (first element whose `primary` equals `true`;\n * also `emails[type eq \"work\"].value`) — the SCIM-style selector the spec examples use.\n /\nexport const ScimAttributeMappingSchema = z.object({\n email: z.string().default('emails[0].value').describe(\"Where to read the member's email in a pushed SCIM User, as a path such as `emails[type eq \\\"work\\\"].value`. Defaults to `emails[0].value`; when the path finds nothing, `userName` and then the primary email are used instead.\"),\n firstName: z.string().default('name.givenName').describe(\"Where to read the member's first name in a pushed SCIM User. Defaults to `name.givenName`.\"),\n lastName: z.string().default('name.familyName').describe(\"Where to read the member's last name in a pushed SCIM User. Defaults to `name.familyName`.\"),\n displayName: z.string().default('displayName').describe(\"Where to read the member's display name in a pushed SCIM User. Defaults to `displayName`.\"),\n});\nexport type ScimAttributeMapping = z.infer<typeof ScimAttributeMappingSchema>;\n\n/\n The scope FKs the polymorphism engine injects onto the two variants. Declared here\n * (rather than read off a variant schema) because this BASE schema's virtual fields run\n * for both variants and must discover which scope the row belongs to at read time.\n /\nconst SCIM_SCOPE_FK_TO_SSO_CONFIG: ReadonlyArray<readonly [fk: string, ssoResourceType: CoreResourceType]> = [\n ['organizationId', CoreResourceType.ORGANIZATION_SSO_CONFIG],\n ['applicationId', CoreResourceType.APPLICATION_SSO_CONFIG],\n] as const;\n\n\n/\n The API-relative base an external identity provider pushes SCIM traffic to.\n \n ONE named source for a path that four different surfaces need to agree on: the virtual\n * `scimEndpointUrl` below, the SCIM controller's own mount, the specification that documents the\n * field, and the customer documentation that tells an administrator what to paste into their IdP.\n * Before this existed the documentation's worked example was `https://api.example.com/api/v1/scim/v2`\n * — a real path under a host that does not exist, which an administrator cannot tell from a value\n * they are meant to use.\n \n Built from {@link MAIN_API_BASE_PATH}, so a mount change moves every consumer with it rather than\n * stranding a literal. That is not hypothetical here: this field replaced a dead custom\n * implementation that hardcoded `/api/scim/v2` and was simply wrong for missing the version prefix.\n /\nexport const SCIM_SERVICE_BASE_PATH: string = `${MAIN_API_BASE_PATH}/scim/v2`;\n\nexport const ScimProvisioningConfigBaseSchema = z.object({\n _id: z.string().min(1).isPrimaryKey().isSummaryField(),\n\n // NOTE: there is deliberately NO `scimEnabled` field. Whether SCIM is AVAILABLE for an org is a\n // per-ORG-TYPE decision at `organizationTypes[type].scimProvisioning.enabled` in the app config —\n // the authority the app-global MOUNT gate and the SCIM controller auth gate\n // (`isScimProvisioningEnabledForOrg`) consult. NB: the invitation `managementMode` resolver and\n // the invite-accept credential block key instead on per-org ACTIVE management (the\n // DIRECTORY_PROVISIONING feature + a live SCIM token — see `isOrgActivelyDirectoryManaged` /\n // AUTH-23), so a SCIM-capable type does not by itself forbid local credentials. A per-scope\n // `scimEnabled` on this row would duplicate the type-level authority, could silently drift from\n // it, and was read by nothing. This row governs only WHAT HAPPENS to users once SCIM is on.\n // `.isAuditEvidence()` on the four below — every one decides what the DIRECTORY is allowed to do\n // to member accounts and with what standing. `defaultRole` in particular is a role GRANT: SCIM\n // provisions through an internal execution context, so it is NOT bounded by any caller's role\n // ceiling (see `defaultUnitRole`'s note below) — configuring it IS granting the role, which is\n // exactly the class of change an auditor must be able to reconstruct with before/after values.\n // `autoDeactivateUsers` is the deprovisioning switch; flipping it off silently strands access.\n // None of these is personal data — they are flags and role names — so recording their values\n // does not conflict with the minimisation rule that keeps user-identifying fields unmarked.\n // assurance-control: WILDO.IDENTITY.DIRECTORY_PROVISIONING — the switches that create accounts and\n // deprovision access.\n autoCreateUsers: z.boolean().default(true).isSummaryField().isAuditEvidence(),\n autoVerifyEmail: z.boolean().default(true),\n autoDeactivateUsers: z.boolean().default(true).isAuditEvidence(),\n defaultRole: z.string().optional().isAuditEvidence(),\n attributeMapping: ScimAttributeMappingSchema.optional(),\n\n /\n Declared bindings from the directory's `department` value to an ORGANIZATION UNIT.\n \n assurance-control: WILDO.IDENTITY.DIRECTORY_PROVISIONING — the directory becomes the authority\n * for which unit a member belongs to.\n \n Explicit and unit-id-addressed on purpose. Since units are an authorization axis, resolving a\n * flat directory string to the wrong node in the tree grants the wrong DATA — and `code` is unique\n * only among siblings while `name` is freeform, so a search-based match is genuinely ambiguous.\n * Nothing here guesses: a value with no declared binding is ignored, and no unit is ever created.\n \n ⚠️ Declaring this makes SCIM AUTHORITATIVE over the member's unit assignments. Every push\n * replaces the member's assignments with exactly what the directory says, so leaving a department\n * actually revokes its access — and assignments made BY HAND in the application are removed too.\n * An organization that wants manual unit assignments should leave this empty. Reconciliation only\n * runs when this list is non-empty AND {@link ScimProvisioningConfigBaseSchema.shape.defaultUnitRole}\n * is set, so an organization that never opted in can never have assignments deleted by a push.\n /\n // `.isAuditEvidence()` — declaring a binding makes SCIM AUTHORITATIVE over unit assignments\n // (see the warning above), so the mapping list is an authorization surface, not preferences.\n organizationUnitMapping: z.array(ScimOrganizationUnitMappingEntrySchema).optional().isAuditEvidence(),\n\n /\n The role every SCIM-created unit assignment carries.\n \n Deliberately SEPARATE from {@link ScimProvisioningConfigBaseSchema.shape.defaultRole}, which is the\n * ORGANIZATION-wide role. A unit grant and an organization grant are different authority over\n * different row sets; one field meaning both would merge two scopes that the whole narrowing model\n * exists to keep apart.\n \n ⚠️ SCIM provisions through an internal execution context, so this value is NOT bounded by a\n * caller's role ceiling — exactly as `defaultRole` is not. The gate is the write to THIS row, which\n * is organization-admin-gated. Treat configuring it as granting the role.\n \n ⚠️ *On its own it now ENABLES `/scim/v2/Groups` (#1378), and that is a change from what this\n field used to mean.** It is required by BOTH directory paths, and they need different companions:\n \n - the `department` path needs it AND a non-empty\n * {@link ScimProvisioningConfigBaseSchema.shape.organizationUnitMapping} — see\n * `isScimOrganizationUnitManagementEnabled`, which is why this field alone used to do nothing;\n * - the GROUPS path needs only this. A directory group carries its own identity, so there is no\n * mapping to declare — the group becomes a unit and its members become assignments carrying this\n * role.\n \n So setting it \"ready for later\", which was harmless before, now lets the directory create units\n * and grant this role in them. It also gates every `/Groups` verb INCLUDING READS: with no value\n * here, all six answer `403` naming this field, because an assignment cannot exist without a role\n * and a directory that could create groups it can never populate is the half-configured state the\n * department path already refuses.\n /\n // `.isAuditEvidence()` — a role grant on a DIFFERENT authority axis than `defaultRole`, and the\n // JSDoc above says it plainly: treat configuring it as granting the role.\n defaultUnitRole: z.string().optional().isAuditEvidence(),\n\n /\n The API-relative path an external IdP pushes SCIM traffic to, e.g. `/api/v1/scim/v2`.\n \n VIRTUAL (computed per read, never persisted, never accepted on write) because it is\n * derived deployment routing — not tenant data. Storing it would let a row drift from the\n * route the server actually mounts, which is precisely the class of lie this field replaces:\n * it supersedes a dead custom-implementation that injected a hardcoded `/api/scim/v2`,\n * missing the `/api/v1` mount prefix and therefore simply wrong. Built from\n * {@link MAIN_API_BASE_PATH} — the documented single source of truth for the prefix — so a\n * future mount change moves this field with it instead of stranding a literal.\n \n PATH, not an absolute URL: the host lives in `runtime.endPoints.main_backend_api.publicUrl`,\n * reachable only through `AppConfigService`, whose DI symbol lives in `saas-backend-lib` —\n * unreachable from this shared package without inverting the dependency direction. `publicUrl`\n * is also optional, so an absolute form would frequently resolve to nothing. Callers that need\n * the absolute endpoint compose it against their own API base (the frontend already knows it).\n \n Identical on both scope variants: the SCIM controller mounts ONE app-global router and\n * separates tenants by bearer token, not by path.\n /\n scimEndpointUrl: z.string().optional().isVirtual({\n calculate: () => SCIM_SERVICE_BASE_PATH,\n }),\n\n /\n The email domains SCIM provisioning will accept, mirroring the gate actually enforced at\n * push time — `EnterpriseUserProvisioningBackendService.provisionEnterpriseUser` rejects an IdP profile\n * whose email domain is absent from this list.\n \n VIRTUAL and read live from the scope's SSO config rather than stored here: the domains are\n * OWNED by `SsoConfig.domains` (verified via DNS there), so persisting a copy on this row\n * would denormalize a security-relevant allow-list and let it go stale against the owner —\n * exactly the drift `forwardedLabel` exists to avoid. Same predicate as the enforcement path\n * (`SCIMControllerBackendService._getProvisioningConfig`): a domain counts only once DNS\n * verification has actually passed, so `verifiedDomains` is filtered by\n * `domainVerificationStatus`. Deliberately NOT the looser `verifiedDomains \|\| ssoEnabledDomains`\n * union used by domain→org lookup — widening this list would widen a security gate.\n \n `[]` and `undefined` are DISTINCT and both meaningful:\n * - `[]` — the SSO config exists and has no verified domain ⇒ unrestricted (the enforcement\n * check is skipped entirely when the list is empty). This is the honest reading of the value.\n * - `undefined` — the SSO config could not be read ⇒ undetermined. Degrading to `[]` here\n * would render an unread config as \"unrestricted\", overstating what we know.\n \n Fail-safe: never throws — this is a display mirror, not the enforcement point.\n */\n allowedDomains: z.array(z.string()).optional().isVirtual({\n dependencies: SCIM_SCOPE_FK_TO_SSO_CONFIG.map(([fk]) => fk),\n calculate: async ({ currentObject, utils }) => {\n const row = currentObject as Record<string, unknown> \| undefined;\n\n const scope = SCIM_SCOPE_FK_TO_SSO_CONFIG\n .map(([fk, ssoResourceType]) => ({ fk, ssoResourceType, value: row?.[fk] }))\n .find(({ value }) => value !== null && value !== undefined && String(value).length > 0);\n if (!scope) return undefined;\n\n const scopeId = String(scope.value);\n const ssoRepository = utils?.repositories?.getRepository?.(scope.ssoResourceType);\n if (!ssoRepository \|\| typeof ssoRepository.findFieldValuesByJoinField !== 'function') return undefined;\n\n try {\n const rowsByScopeId: Map<string, Record<string, unknown>> =\n await ssoRepository.findFieldValuesByJoinField(scope.fk, [scopeId], ['domains']);\n const domains = rowsByScopeId.get(scopeId)?.['domains'] as\n \| { verifiedDomains?: string[]; domainVerificationStatus?: Record<string, string> }\n \| undefined;\n if (!domains) return undefined;\n\n // The one derivation (#457), not a sixth hand-written join. `undefined` above is still\n // DISTINCT from the `[]` this can return — see the field's docstring; the helper answers\n // \"which are verified\", and only the caller knows whether the config was readable at all.\n return resolveVerifiedDomains(domains);\n } catch (error) {\n utils?.logger?.warn?.(\n `[scimProvisioningConfig.allowedDomains] SSO config read failed for ${scope.fk}=${scopeId}; reporting undetermined`,\n error,\n );\n return undefined;\n }\n },\n }),\n\n createdAt: z.date().default(() => new Date()).excludeFromCreate().excludeFromUpdate(),\n updatedAt: z.date().default(() => new Date()).excludeFromCreate().excludeFromUpdate(),\n});\n\nexport type ScimProvisioningConfigBase = z.infer<typeof ScimProvisioningConfigBaseSchema>;\n\nexport const scimProvisioningConfigPolymorphicDeclaration = declarePolymorphicSchemas({\n baseResourceType: 'scimProvisioningConfig',\n baseFieldIdentifier: 'scimProvisioningConfigId',\n baseEnumKey: 'SCIM_PROVISIONING_CONFIG',\n baseSchema: ScimProvisioningConfigBaseSchema,\n variants: AUTH_SCOPE_VARIANTS,\n});\n"]}
1	+ {"version":3,"file":"scim-provisioning-config.shared.schemas.js","sourceRoot":"","sources":["../../../../../../src/security/authentications/scim/scim-provisioning-config.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AACvE,OAAO,EAAE,yBAAyB,EAAE,MAAM,wDAAwD,CAAC;AACnG,OAAO,EAAE,gBAAgB,EAAE,MAAM,sDAAsD,CAAC;AACxF,OAAO,EAAE,kBAAkB,EAAE,MAAM,kDAAkD,CAAC;AACtF,OAAO,EAAE,sBAAsB,EAAE,MAAM,kCAAkC,CAAC;AAC1E,OAAO,EAAE,sCAAsC,EAAE,MAAM,yCAAyC,CAAC;AAEjG;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC,QAAQ,CAAC,iOAAiO,CAAC;IACxR,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,QAAQ,CAAC,4FAA4F,CAAC;IACtJ,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC,QAAQ,CAAC,4FAA4F,CAAC;IACtJ,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,QAAQ,CAAC,2FAA2F,CAAC;CACrJ,CAAC,CAAC;AAGH;;;;GAIG;AACH,MAAM,2BAA2B,GAA4E;IAC3G,CAAC,gBAAgB,EAAE,gBAAgB,CAAC,uBAAuB,CAAC;IAC5D,CAAC,eAAe,EAAE,gBAAgB,CAAC,sBAAsB,CAAC;CAClD,CAAC;AAGX;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAW,GAAG,kBAAkB,UAAU,CAAC;AAE9E,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,MAAM,CAAC;IACvD,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IAEtD,gGAAgG;IAChG,kGAAkG;IAClG,4EAA4E;IAC5E,gGAAgG;IAChG,mFAAmF;IACnF,6FAA6F;IAC7F,4FAA4F;IAC5F,gGAAgG;IAChG,4FAA4F;IAC5F,iGAAiG;IACjG,+FAA+F;IAC/F,8FAA8F;IAC9F,+FAA+F;IAC/F,+FAA+F;IAC/F,+FAA+F;IAC/F,6FAA6F;IAC7F,4FAA4F;IAC5F,mGAAmG;IACnG,sBAAsB;IACtB,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,cAAc,EAAE,CAAC,eAAe,EAAE;IAC7E,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAC1C,mBAAmB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,eAAe,EAAE;IAChE,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE;IACpD,gBAAgB,EAAE,0BAA0B,CAAC,QAAQ,EAAE;IAEvD;;;;;;;;;;;;;;;;;OAiBG;IACH,4FAA4F;IAC5F,6FAA6F;IAC7F,uBAAuB,EAAE,CAAC,CAAC,KAAK,CAAC,sCAAsC,CAAC,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE;IAErG;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACH,gGAAgG;IAChG,0EAA0E;IAC1E,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE;IAExD;;;;;;;;;;;;;;;;;;;OAmBG;IACH,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,SAAS,CAAC;QAC/C,SAAS,EAAE,GAAG,EAAE,CAAC,sBAAsB;KACxC,CAAC;IAEF;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,SAAS,CAAC;QACvD,YAAY,EAAE,2BAA2B,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;QAC3D,SAAS,EAAE,KAAK,EAAE,EAAE,aAAa,EAAE,KAAK,EAAE,EAAE,EAAE;YAC5C,MAAM,GAAG,GAAG,aAAoD,CAAC;YAEjE,MAAM,KAAK,GAAG,2BAA2B;iBACtC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,eAAe,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,eAAe,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;iBAC3E,IAAI,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;YAC1F,IAAI,CAAC,KAAK;gBAAE,OAAO,SAAS,CAAC;YAE7B,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YACpC,MAAM,aAAa,GAAG,KAAK,EAAE,YAAY,EAAE,aAAa,EAAE,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;YAClF,IAAI,CAAC,aAAa,IAAI,OAAO,aAAa,CAAC,0BAA0B,KAAK,UAAU;gBAAE,OAAO,SAAS,CAAC;YAEvG,IAAI,CAAC;gBACH,MAAM,aAAa,GACjB,MAAM,aAAa,CAAC,0BAA0B,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC;gBACnF,MAAM,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,SAAS,CAEzC,CAAC;gBACd,IAAI,CAAC,OAAO;oBAAE,OAAO,SAAS,CAAC;gBAE/B,uFAAuF;gBACvF,yFAAyF;gBACzF,0FAA0F;gBAC1F,OAAO,sBAAsB,CAAC,OAAO,CAAC,CAAC;YACzC,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,CACnB,sEAAsE,KAAK,CAAC,EAAE,IAAI,OAAO,0BAA0B,EACnH,KAAK,CACN,CAAC;gBACF,OAAO,SAAS,CAAC;YACnB,CAAC;QACH,CAAC;KACF,CAAC;IAEF,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IACrF,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;CACtF,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,4CAA4C,GAAG,yBAAyB,CAAC;IACpF,gBAAgB,EAAE,wBAAwB;IAC1C,mBAAmB,EAAE,0BAA0B;IAC/C,WAAW,EAAE,0BAA0B;IACvC,UAAU,EAAE,gCAAgC;IAC5C,QAAQ,EAAE,mBAAmB;CAC9B,CAAC,CAAC","sourcesContent":["/*\n SCIM Provisioning Config Schema (Shared) — Polymorphic\n \n SCIM provisioning settings: auto-create, auto-deactivate, attribute mapping.\n \n ONE of the two provisioning authorities, and the boundary is the TRIGGER rather than the feature.\n * This row governs a DIRECTORY PUSH — the IdP calling `/scim/v2`, read by\n * `scim.backend.controller._getProvisioningConfig`. Per organization, because a tenant has one\n * directory relationship.\n \n The other is the CONNECTION: an interactive sign-in through OIDC or SAML reads\n * `SsoConnection.{autoCreateUsers, defaultRole, roleMapping, groupMapping}`. Per\n * connection, because two IdPs bound to one tenant may legitimately differ. Both funnel into\n * `provisionEnterpriseUser`, which is why the two configurations look alike and are not\n * interchangeable — an organization can run either without the other.\n \n This comment used to point at `SsoConfig.provisioning` as the JIT half. That block existed, was\n * rendered on the SSO settings pane, and had no readers at all; it has been removed. Nothing here\n * changed with it.\n \n Scope FK (organizationId / applicationId) is injected by the polymorphism engine.\n \n @see auth-data-model-audit.md §2G\n /\n\nimport { z } from 'zod';\nimport { AUTH_SCOPE_VARIANTS } from '../authentication.shared.schemas';\nimport { declarePolymorphicSchemas } from '../../../resources/utils/resource-polymorphism.schemas';\nimport { CoreResourceType } from '../../../resources/resources.shared.core.definitions';\nimport { MAIN_API_BASE_PATH } from '../../../requests/manual-controllers-routes-urls';\nimport { resolveVerifiedDomains } from '../sso/sso-config.shared.schemas';\nimport { ScimOrganizationUnitMappingEntrySchema } from './scim-organization-unit-mapping.shared';\n\n/\n Maps a Wildo profile field to a PATH into the inbound SCIM User JSON. Each value is a\n * path expression resolved against the SCIM body at push time by the backend\n * `resolveScimAttributePath` — the row's authoritative source for how a directory's payload\n * shape translates to Wildo's `{email, firstName, lastName, displayName}` (Okta, Azure AD, etc.\n * differ). The defaults reproduce the framework's built-in mapping exactly, so an org that never\n * customises this behaves identically to the hardcoded normalisation it replaces.\n \n Supported path grammar (what `resolveScimAttributePath` understands):\n * - dotted traversal — `name.givenName`\n * - array index — `emails[0].value`\n * - array filter — `emails[primary eq true].value` (first element whose `primary` equals `true`;\n * also `emails[type eq \"work\"].value`) — the SCIM-style selector the spec examples use.\n /\nexport const ScimAttributeMappingSchema = z.object({\n email: z.string().default('emails[0].value').describe(\"Where to read the member's email in a pushed SCIM User, as a path such as `emails[type eq \\\"work\\\"].value`. Defaults to `emails[0].value`; when the path finds nothing, `userName` and then the primary email are used instead.\"),\n firstName: z.string().default('name.givenName').describe(\"Where to read the member's first name in a pushed SCIM User. Defaults to `name.givenName`.\"),\n lastName: z.string().default('name.familyName').describe(\"Where to read the member's last name in a pushed SCIM User. Defaults to `name.familyName`.\"),\n displayName: z.string().default('displayName').describe(\"Where to read the member's display name in a pushed SCIM User. Defaults to `displayName`.\"),\n});\nexport type ScimAttributeMapping = z.infer<typeof ScimAttributeMappingSchema>;\n\n/\n The scope FKs the polymorphism engine injects onto the two variants. Declared here\n * (rather than read off a variant schema) because this BASE schema's virtual fields run\n * for both variants and must discover which scope the row belongs to at read time.\n /\nconst SCIM_SCOPE_FK_TO_SSO_CONFIG: ReadonlyArray<readonly [fk: string, ssoResourceType: CoreResourceType]> = [\n ['organizationId', CoreResourceType.ORGANIZATION_SSO_CONFIG],\n ['applicationId', CoreResourceType.APPLICATION_SSO_CONFIG],\n] as const;\n\n\n/\n The API-relative base an external identity provider pushes SCIM traffic to.\n \n ONE named source for a path that four different surfaces need to agree on: the virtual\n * `scimEndpointUrl` below, the SCIM controller's own mount, the specification that documents the\n * field, and the customer documentation that tells an administrator what to paste into their IdP.\n * Before this existed the documentation's worked example was `https://api.example.com/api/v1/scim/v2`\n * — a real path under a host that does not exist, which an administrator cannot tell from a value\n * they are meant to use.\n \n Built from {@link MAIN_API_BASE_PATH}, so a mount change moves every consumer with it rather than\n * stranding a literal. That is not hypothetical here: this field replaced a dead custom\n * implementation that hardcoded `/api/scim/v2` and was simply wrong for missing the version prefix.\n /\nexport const SCIM_SERVICE_BASE_PATH: string = `${MAIN_API_BASE_PATH}/scim/v2`;\n\nexport const ScimProvisioningConfigBaseSchema = z.object({\n _id: z.string().min(1).isPrimaryKey().isSummaryField(),\n\n // NOTE: there is deliberately NO `scimEnabled` field. Whether SCIM is AVAILABLE for an org is a\n // per-ORG-TYPE decision at `organizationTypes[type].scimProvisioning.enabled` in the app config —\n // the authority the app-global MOUNT gate and the SCIM controller auth gate\n // (`isScimProvisioningEnabledForOrg`) consult. NB: the invitation `managementMode` resolver and\n // the invite-accept credential block key instead on per-org ACTIVE management (the\n // DIRECTORY_PROVISIONING feature + a live SCIM token — see `isOrgActivelyDirectoryManaged` /\n // AUTH-23), so a SCIM-capable type does not by itself forbid local credentials. A per-scope\n // `scimEnabled` on this row would duplicate the type-level authority, could silently drift from\n // it, and was read by nothing. This row governs only WHAT HAPPENS to users once SCIM is on.\n // `.isAuditEvidence()` on the four below — every one decides what the DIRECTORY is allowed to do\n // to member accounts and with what standing. `defaultRole` in particular is a role GRANT: SCIM\n // provisions through an internal execution context, so it is NOT bounded by any caller's role\n // ceiling (see `defaultUnitRole`'s note below) — configuring it IS granting the role, which is\n // exactly the class of change an auditor must be able to reconstruct with before/after values.\n // `autoDeactivateUsers` is the deprovisioning switch; flipping it off silently strands access.\n // None of these is personal data — they are flags and role names — so recording their values\n // does not conflict with the minimisation rule that keeps user-identifying fields unmarked.\n // assurance-control: WILDO.IDENTITY.DIRECTORY_PROVISIONING — the switches that create accounts and\n // deprovision access.\n autoCreateUsers: z.boolean().default(true).isSummaryField().isAuditEvidence(),\n autoVerifyEmail: z.boolean().default(true),\n autoDeactivateUsers: z.boolean().default(true).isAuditEvidence(),\n defaultRole: z.string().optional().isAuditEvidence(),\n attributeMapping: ScimAttributeMappingSchema.optional(),\n\n /\n Declared bindings from the directory's `department` value to an ORGANIZATION UNIT.\n \n assurance-control: WILDO.IDENTITY.DIRECTORY_PROVISIONING — the directory becomes the authority\n * for which unit a member belongs to.\n \n Explicit and unit-id-addressed on purpose. Since units are an authorization axis, resolving a\n * flat directory string to the wrong node in the tree grants the wrong DATA — and `code` is unique\n * only among siblings while `name` is freeform, so a search-based match is genuinely ambiguous.\n * Nothing here guesses: a value with no declared binding is ignored, and no unit is ever created.\n \n ⚠️ Declaring this makes SCIM AUTHORITATIVE over the member's unit assignments. Every push\n * replaces the member's assignments with exactly what the directory says, so leaving a department\n * actually revokes its access — and assignments made BY HAND in the application are removed too.\n * An organization that wants manual unit assignments should leave this empty. Reconciliation only\n * runs when this list is non-empty AND {@link ScimProvisioningConfigBaseSchema.shape.defaultUnitRole}\n * is set, so an organization that never opted in can never have assignments deleted by a push.\n /\n // `.isAuditEvidence()` — declaring a binding makes SCIM AUTHORITATIVE over unit assignments\n // (see the warning above), so the mapping list is an authorization surface, not preferences.\n organizationUnitMapping: z.array(ScimOrganizationUnitMappingEntrySchema).optional().isAuditEvidence(),\n\n /\n The role every SCIM-created unit assignment carries.\n \n Deliberately SEPARATE from {@link ScimProvisioningConfigBaseSchema.shape.defaultRole}, which is the\n * ORGANIZATION-wide role. A unit grant and an organization grant are different authority over\n * different row sets; one field meaning both would merge two scopes that the whole narrowing model\n * exists to keep apart.\n \n ⚠️ SCIM provisions through an internal execution context, so this value is NOT bounded by a\n * caller's role ceiling — exactly as `defaultRole` is not. The gate is the write to THIS row, which\n * is organization-admin-gated. Treat configuring it as granting the role.\n \n ⚠️ *On its own it now ENABLES `/scim/v2/Groups` (#1378), and that is a change from what this\n field used to mean.** It is required by BOTH directory paths, and they need different companions:\n \n - the `department` path needs it AND a non-empty\n * {@link ScimProvisioningConfigBaseSchema.shape.organizationUnitMapping} — see\n * `isScimOrganizationUnitManagementEnabled`, which is why this field alone used to do nothing;\n * - the GROUPS path needs only this. A directory group carries its own identity, so there is no\n * mapping to declare — the group becomes a unit and its members become assignments carrying this\n * role.\n \n So setting it \"ready for later\", which was harmless before, now lets the directory create units\n * and grant this role in them. It also gates every `/Groups` verb INCLUDING READS: with no value\n * here, all six answer `403` naming this field, because an assignment cannot exist without a role\n * and a directory that could create groups it can never populate is the half-configured state the\n * department path already refuses.\n /\n // `.isAuditEvidence()` — a role grant on a DIFFERENT authority axis than `defaultRole`, and the\n // JSDoc above says it plainly: treat configuring it as granting the role.\n defaultUnitRole: z.string().optional().isAuditEvidence(),\n\n /\n The API-relative path an external IdP pushes SCIM traffic to, e.g. `/api/v1/scim/v2`.\n \n VIRTUAL (computed per read, never persisted, never accepted on write) because it is\n * derived deployment routing — not tenant data. Storing it would let a row drift from the\n * route the server actually mounts, which is precisely the class of lie this field replaces:\n * it supersedes a dead custom-implementation that injected a hardcoded `/api/scim/v2`,\n * missing the `/api/v1` mount prefix and therefore simply wrong. Built from\n * {@link MAIN_API_BASE_PATH} — the documented single source of truth for the prefix — so a\n * future mount change moves this field with it instead of stranding a literal.\n \n PATH, not an absolute URL: the host lives in `runtime.endPoints.main_backend_api.publicUrl`,\n * reachable only through `AppConfigService`, whose DI symbol lives in `saas-backend-lib` —\n * unreachable from this shared package without inverting the dependency direction. `publicUrl`\n * is also optional, so an absolute form would frequently resolve to nothing. Callers that need\n * the absolute endpoint compose it against their own API base (the frontend already knows it).\n \n Identical on both scope variants: the SCIM controller mounts ONE app-global router and\n * separates tenants by bearer token, not by path.\n /\n scimEndpointUrl: z.string().optional().isVirtual({\n calculate: () => SCIM_SERVICE_BASE_PATH,\n }),\n\n /\n The email domains SCIM provisioning will accept, mirroring the gate actually enforced at\n * push time — `EnterpriseUserProvisioningBackendService.provisionEnterpriseUser` rejects an IdP profile\n * whose email domain is absent from this list.\n \n VIRTUAL and read live from the scope's SSO config rather than stored here: the domains are\n * OWNED by `SsoConfig.domains` (verified via DNS there), so persisting a copy on this row\n * would denormalize a security-relevant allow-list and let it go stale against the owner —\n * exactly the drift `forwardedLabel` exists to avoid. Same predicate as the enforcement path\n * (`SCIMControllerBackendService._getProvisioningConfig`): a domain counts only once DNS\n * verification has actually passed, so `verifiedDomains` is filtered by\n * `domainVerificationStatus`. Deliberately NOT the looser `verifiedDomains \|\| ssoEnabledDomains`\n * union used by domain→org lookup — widening this list would widen a security gate.\n \n `[]` and `undefined` are DISTINCT and both meaningful:\n * - `[]` — the SSO config exists and has no verified domain ⇒ unrestricted (the enforcement\n * check is skipped entirely when the list is empty). This is the honest reading of the value.\n * - `undefined` — the SSO config could not be read ⇒ undetermined. Degrading to `[]` here\n * would render an unread config as \"unrestricted\", overstating what we know.\n \n Fail-safe: never throws — this is a display mirror, not the enforcement point.\n */\n allowedDomains: z.array(z.string()).optional().isVirtual({\n dependencies: SCIM_SCOPE_FK_TO_SSO_CONFIG.map(([fk]) => fk),\n calculate: async ({ currentObject, utils }) => {\n const row = currentObject as Record<string, unknown> \| undefined;\n\n const scope = SCIM_SCOPE_FK_TO_SSO_CONFIG\n .map(([fk, ssoResourceType]) => ({ fk, ssoResourceType, value: row?.[fk] }))\n .find(({ value }) => value !== null && value !== undefined && String(value).length > 0);\n if (!scope) return undefined;\n\n const scopeId = String(scope.value);\n const ssoRepository = utils?.repositories?.getRepository?.(scope.ssoResourceType);\n if (!ssoRepository \|\| typeof ssoRepository.findFieldValuesByJoinField !== 'function') return undefined;\n\n try {\n const rowsByScopeId: Map<string, Record<string, unknown>> =\n await ssoRepository.findFieldValuesByJoinField(scope.fk, [scopeId], ['domains']);\n const domains = rowsByScopeId.get(scopeId)?.['domains'] as\n \| { verifiedDomains?: string[]; domainVerificationStatus?: Record<string, string> }\n \| undefined;\n if (!domains) return undefined;\n\n // The one derivation (#457), not a sixth hand-written join. `undefined` above is still\n // DISTINCT from the `[]` this can return — see the field's docstring; the helper answers\n // \"which are verified\", and only the caller knows whether the config was readable at all.\n return resolveVerifiedDomains(domains);\n } catch (error) {\n utils?.logger?.warn?.(\n `[scimProvisioningConfig.allowedDomains] SSO config read failed for ${scope.fk}=${scopeId}; reporting undetermined`,\n error,\n );\n return undefined;\n }\n },\n }),\n\n createdAt: z.date().default(() => new Date()).excludeFromCreate().excludeFromUpdate(),\n updatedAt: z.date().default(() => new Date()).excludeFromCreate().excludeFromUpdate(),\n});\n\nexport type ScimProvisioningConfigBase = z.infer<typeof ScimProvisioningConfigBaseSchema>;\n\nexport const scimProvisioningConfigPolymorphicDeclaration = declarePolymorphicSchemas({\n baseResourceType: 'scimProvisioningConfig',\n baseFieldIdentifier: 'scimProvisioningConfigId',\n baseEnumKey: 'SCIM_PROVISIONING_CONFIG',\n baseSchema: ScimProvisioningConfigBaseSchema,\n variants: AUTH_SCOPE_VARIANTS,\n});\n"]}

package/dist/esm/security/authentications/scim/scim-tokens.shared.resources-config.schemas.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"scim-tokens.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["~~../../../../../~~src/security/authentications/scim/scim-tokens.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,qBAAqB,EAAoB,MAAM,sDAAsD,CAAC;AAa/G,oBAAY,qBAAqB;IAC/B,cAAc,kBAAkB;IAChC,YAAY,gBAAgB;IAC5B,YAAY,gBAAgB;CAC7B;AAID,eAAO,MAAM,kCAAkC;;;kBAG7C,CAAC;AAEH,eAAO,MAAM,gCAAgC,iCAAqB,CAAC;AAEnE;;;GAGG;AACH,eAAO,MAAM,gCAAgC,iCAAqB,CAAC;AAEnE,eAAO,MAAM,iCAAiC;;;;kBAI5C,CAAC;AAEH,eAAO,MAAM,iCAAiC;;;;;kBAK5C,CAAC;AAIH,eAAO,MAAM,8BAA8B,yQAoK1C,CAAC"}
1	+ {"version":3,"file":"scim-tokens.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../../../src/security/authentications/scim/scim-tokens.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,qBAAqB,EAAoB,MAAM,sDAAsD,CAAC;AAa/G,oBAAY,qBAAqB;IAC/B,cAAc,kBAAkB;IAChC,YAAY,gBAAgB;IAC5B,YAAY,gBAAgB;CAC7B;AAID,eAAO,MAAM,kCAAkC;;;kBAG7C,CAAC;AAEH,eAAO,MAAM,gCAAgC,iCAAqB,CAAC;AAEnE;;;GAGG;AACH,eAAO,MAAM,gCAAgC,iCAAqB,CAAC;AAEnE,eAAO,MAAM,iCAAiC;;;;kBAI5C,CAAC;AAEH,eAAO,MAAM,iCAAiC;;;;;kBAK5C,CAAC;AAIH,eAAO,MAAM,8BAA8B,yQAoK1C,CAAC"}

package/dist/esm/security/authentications/scim/scim-tokens.shared.resources-config.schemas.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"scim-tokens.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../../../src/security/authentications/scim/scim-tokens.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,sDAAsD,CAAC;AAC/G,OAAO,EACL,0BAA0B,EAC1B,8BAA8B,EAC9B,4BAA4B,GAC7B,MAAM,6CAA6C,CAAC;AACrD,OAAO,EAAE,wBAAwB,EAAE,MAAM,oDAAoD,CAAC;AAC9F,OAAO,EAAE,uCAAuC,EAAE,MAAM,wDAAwD,CAAC;AACjH,OAAO,EAAE,cAAc,EAAE,MAAM,2CAA2C,CAAC;AAC3E,OAAO,EAAE,gCAAgC,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AAErG,wEAAwE;AAExE,MAAM,CAAN,IAAY,qBAIX;AAJD,WAAY,qBAAqB;IAC/B,yDAAgC,CAAA;IAChC,qDAA4B,CAAA;IAC5B,qDAA4B,CAAA;AAC9B,CAAC,EAJW,qBAAqB,KAArB,qBAAqB,QAIhC;AAED,wEAAwE;AAExE,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAAC,CAAC,YAAY,CAAC;IAC/D,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CAC5C,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;AAEnE;;;GAGG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;AAEnE,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC,CAAC,YAAY,CAAC;IAC9D,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,0GAA0G,CAAC;IACxI,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,wCAAwC,CAAC;CACvE,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC,CAAC,YAAY,CAAC;IAC9D,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,iNAAiN,CAAC;IAC9P,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,4GAA4G,CAAC;IAC7I,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,kFAAkF,CAAC;IACrH,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,wCAAwC,CAAC;CACvE,CAAC,CAAC;AAEH,wEAAwE;AAExE,MAAM,CAAC,MAAM,8BAA8B,GAAG,uCAAuC,CACnF,gCAAgC,EAChC;IACE,gBAAgB,EAAE,IAAI;IACtB,eAAe,EAAE,qBAAqB;IACtC,+EAA+E;IAC/E,6DAA6D;IAC7D,sFAAsF;IACtF,mFAAmF;IACnF,qFAAqF;IACrF,sDAAsD;IACtD,kBAAkB,EAAE;QAClB,IAAI,EAAE,wBAAwB,CAAC,OAAO;KACvC;IACD,cAAc,EAAE;QACd,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;KAC7B;IACD,uBAAuB,EAAE;QACvB,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE,CAAC;oBACT,8EAA8E;oBAC9E,oEAAoE;oBACpE,6EAA6E;oBAC7E,yEAAyE;oBACzE,iFAAiF;oBACjF,oEAAoE;oBACpE,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;qBAC7D;oBACD,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,6BAA6B,CAAC;qBAC3G;oBACD,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,eAAe;oBACzD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;qBAC7D;oBACD,SAAS,EAAE,0BAA0B,CAAC,IAAI;iBAC3C,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,8EAA8E;oBAC9E,+EAA+E;oBAC/E,kFAAkF;oBAClF,uFAAuF;oBACvF,kFAAkF;oBAClF,uEAAuE;oBACvE,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;qBAC7D;oBACD,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,eAAe;oBACzD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;qBAC7D;oBACD,SAAS,EAAE,0BAA0B,CAAC,IAAI;iBAC3C,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,cAAc,CAAC,EAAE;YACtC,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,6BAA6B,CAAC;qBAC3G;oBACD,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,kCAAkC;oBAC9C,wEAAwE;oBACxE,yEAAyE;oBACzE,2EAA2E;oBAC3E,0EAA0E;oBAC1E,0EAA0E;oBAC1E,iEAAiE;oBACjE,yEAAyE;oBACzE,uEAAuE;oBACvE,kEAAkE;oBAClE,uDAAuD;oBACvD,iBAAiB,EAAE,mBAAmB,CAAC,MAAM,CAAC;wBAC5C,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,oMAAoM,CAAC;qBAC/O,CAAC;iBACH,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,YAAY,CAAC,EAAE;YACpC,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,6BAA6B,CAAC;qBAC3G;oBACD,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,mGAAmG;oBACnG,wEAAwE;oBACxE,aAAa,EAAE,8BAA8B,CAAC,YAAY;oBAC1D,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,gCAAgC;oBAC5C,iFAAiF;oBACjF,iFAAiF;oBACjF,qFAAqF;oBACrF,oFAAoF;oBACpF,yEAAyE;oBACzE,qFAAqF;oBACrF,mFAAmF;oBACnF,+DAA+D;oBAC/D,iBAAiB,EAAE,iCAAiC;iBACrD,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,YAAY,CAAC,EAAE;YACpC,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,6BAA6B,CAAC;qBAC3G;oBACD,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,4FAA4F;oBAC5F,wEAAwE;oBACxE,aAAa,EAAE,8BAA8B,CAAC,YAAY;oBAC1D,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,gCAAgC;oBAC5C,qFAAqF;oBACrF,qFAAqF;oBACrF,0EAA0E;oBAC1E,mFAAmF;oBACnF,uFAAuF;oBACvF,kFAAkF;oBAClF,yDAAyD;oBACzD,EAAE;oBACF,uFAAuF;oBACvF,mFAAmF;oBACnF,iFAAiF;oBACjF,uFAAuF;oBACvF,6CAA6C;oBAC7C,iBAAiB,EAAE,iCAAiC;iBACrD,CAAC;SACH;KACF;CACF,CACF,CAAC","sourcesContent":["/*\n SCIM Tokens Resource Configuration — Polymorphic\n \n Produces the organization-scoped factory used by the SCIM bearer protocol.\n * Spread into the registry factory map:\n * ...scimTokensPolymorphicFactories\n /\n\nimport { z } from 'zod';\nimport { CoreResourceOperation, CoreResourceType } from '../../../resources/resources.shared.core.definitions';\nimport {\n ResourceOperationRiskLevel,\n ResourceOperationReversibility,\n ResourceOperationVariantType,\n} from '../../../resources/resources.shared.schemas';\nimport { ResourceSystemAccessMode } from '../../../resources/resources-config.shared.schemas';\nimport { createPolymorphicResourceConfigurations } from '../../../resources/utils/resource-polymorphism.factory';\nimport { CORE_ORG_ROLES } from '../../authorizations/roles.shared.schemas';\nimport { scimTokensPolymorphicDeclaration, ScimTokenBaseSchema } from './scim-tokens.shared.schemas';\n\n// ── Custom Operations ────────────────────────────────────────────────\n\nexport enum ScimTokens_Operations {\n GENERATE_TOKEN = 'generateToken',\n REVOKE_TOKEN = 'revokeToken',\n ROTATE_TOKEN = 'rotateToken',\n}\n\n// ── Request DTOs ─────────────────────────────────────────────────────\n\nexport const ScimTokens_GenerateTokenRequestDto = z.strictObject({\n displayName: z.string().min(1),\n expiresAt: z.string().datetime().optional(),\n});\n\nexport const ScimTokens_RevokeTokenRequestDto = z.strictObject({});\n\n/\n Rotation is an immediate cutover because the persisted token schema has no previous-hash grace slot.\n * Keep the request strictly empty rather than accepting a migration-window option the runtime cannot honor.\n /\nexport const ScimTokens_RotateTokenRequestDto = z.strictObject({});\n\nexport const ScimTokens_RevokeTokenResponseDto = z.strictObject({\n isActive: z.boolean(),\n revokedAt: z.date().describe(\"When this request revoked the token. The time is not stored on the token, so later reads do not show it.\"),\n message: z.string().describe(\"A fixed confirmation: `Token revoked`.\"),\n});\n\nexport const ScimTokens_RotateTokenResponseDto = z.strictObject({\n newToken: z.string().isEphemeral().describe(\"The new token value, returned only in this response: only its hash is stored, so it cannot be read again. The previous value stops working immediately; the directory sends this one as a bearer token instead.\"),\n newTokenId: z.string().describe(\"The id of the rotated token. Rotation replaces the value on the same token, so this is the token's own id.\"),\n newTokenHash: z.string().describe(\"The SHA-256 hash of the new token value, in hex: the form in which it is stored.\"),\n message: z.string().describe(\"A fixed confirmation: `Token rotated`.\"),\n});\n\n// ── Polymorphic Factory ──────────────────────────────────────────────\n\nexport const scimTokensPolymorphicFactories = createPolymorphicResourceConfigurations(\n scimTokensPolymorphicDeclaration,\n {\n isSystemResource: true,\n customOperation: ScimTokens_Operations,\n // The SCIM bearer-auth middleware resolves an inbound token by its `tokenHash`\n // on EVERY /scim/v2/ request via a system-context read (see\n // `scim.backend.controller.ts` `_authenticateBearer` → `servicesRegistryHandler.read`\n // with the `createForSystemAuthOperation` EC). That read is PRE-USER (the token IS\n // the credential), so it opts into `systemAccessPolicy.read = ALLOWED` — mirrors the\n // enterprise SSO-connection resolver's pre-auth read.\n systemAccessPolicy: {\n read: ResourceSystemAccessMode.ALLOWED,\n },\n coreOperations: [\n CoreResourceOperation.READ,\n CoreResourceOperation.LIST,\n CoreResourceOperation.CREATE,\n CoreResourceOperation.UPDATE,\n CoreResourceOperation.DELETE,\n ],\n operationsConfiguration: {\n [CoreResourceOperation.READ]: {\n variants: [{\n // Service-transport default (INTERNAL_CALL — internal-only, NO HTTP surface).\n // The bearer-auth token lookup reads this through the service layer\n // (`servicesRegistryHandler.read` → `getServiceOperationPathDefault`), which\n // honours INTERNAL_CALL / API_CALL defaults but NOT `REPOSITORY_ONLY`; a\n // repository-only READ here throws `RESOURCES_REGISTRY_OPERATION_PATH_NOT_FOUND`\n // and 500s every SCIM request. Same fix as the SSO-connection READ.\n variantType: ResourceOperationVariantType.INTERNAL_CALL,\n isDefault: true,\n polymorphicRole: {\n [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n },\n riskLevel: ResourceOperationRiskLevel.LOW,\n }],\n },\n [CoreResourceOperation.LIST]: {\n variants: [{\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n polymorphicRole: {\n [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN, CORE_ORG_ROLES.ORG_DELEGATED_MANAGE_SSO_SCIM],\n },\n riskLevel: ResourceOperationRiskLevel.LOW,\n }],\n },\n [CoreResourceOperation.CREATE]: {\n variants: [{\n variantType: ResourceOperationVariantType.REPOSITORY_ONLY,\n isDefault: true,\n polymorphicRole: {\n [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n },\n riskLevel: ResourceOperationRiskLevel.HIGH,\n }],\n },\n [CoreResourceOperation.UPDATE]: {\n variants: [{\n // Service-transport default (INTERNAL_CALL — internal-only, NO HTTP surface).\n // The SCIM bearer-auth middleware stamps `lastUsedAt` on the resolved token on\n // every /scim/v2/* request via a fire-and-forget system-context update. Without a\n // resolvable UPDATE op that write throws `RESOURCES_REGISTRY_OPERATION_PATH_NOT_FOUND`\n // (logged FATAL, though swallowed) on every SCIM call. Token metadata mutation is\n // internal-only; operators rotate/revoke via the dedicated custom ops.\n variantType: ResourceOperationVariantType.INTERNAL_CALL,\n isDefault: true,\n polymorphicRole: {\n [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n },\n riskLevel: ResourceOperationRiskLevel.LOW,\n }],\n },\n [CoreResourceOperation.DELETE]: {\n variants: [{\n variantType: ResourceOperationVariantType.REPOSITORY_ONLY,\n isDefault: true,\n polymorphicRole: {\n [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n },\n riskLevel: ResourceOperationRiskLevel.HIGH,\n }],\n },\n [ScimTokens_Operations.GENERATE_TOKEN]: {\n variants: [{\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n polymorphicRole: {\n [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN, CORE_ORG_ROLES.ORG_DELEGATED_MANAGE_SSO_SCIM],\n },\n riskLevel: ResourceOperationRiskLevel.HIGH,\n resourceOperationLike: CoreResourceOperation.CREATE,\n requestDto: ScimTokens_GenerateTokenRequestDto,\n // GENERATE_TOKEN borrows CREATE and PERSISTS a real SCIM-token row (the\n // SCIM bearer-auth middleware resolves inbound tokens by their persisted\n // `tokenHash`), then returns that row PLUS the one-time plaintext `token`.\n // This mirrors the api-key mint contract exactly: the response DTO is the\n // resource schema extended with an ephemeral secret field — NOT a bespoke\n // shape. The mint runs as a CREATE prefix (injects `tokenHash` +\n // `createdByUserId` so the core create persists) + postfix (attaches the\n // one-time `token`); see `scim-tokens.custom-impl.backend.service.ts`.\n // `token` is `.isEphemeral()` (secret display, revealed once, not\n // persisted — same decorator api-key `plainKey` uses).\n customResponseDto: ScimTokenBaseSchema.extend({\n token: z.string().isEphemeral().describe(\"The token value, returned only in this response: only its hash is stored, so it cannot be read again. The directory sends it as a bearer token in the `Authorization` header of its SCIM requests.\"),\n }),\n }],\n },\n [ScimTokens_Operations.REVOKE_TOKEN]: {\n variants: [{\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n polymorphicRole: {\n [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN, CORE_ORG_ROLES.ORG_DELEGATED_MANAGE_SSO_SCIM],\n },\n riskLevel: ResourceOperationRiskLevel.HIGH,\n // IRREVERSIBLE: A revoked token can never be un-revoked; the integration must be issued a new one.\n // This is what admits it to the danger zone; risk alone no longer does.\n reversibility: ResourceOperationReversibility.IRREVERSIBLE,\n resourceOperationLike: CoreResourceOperation.UPDATE,\n requestDto: ScimTokens_RevokeTokenRequestDto,\n // Borrows UPDATE (NOT DELETE) for its route/verb: revocation RETAINS the row for\n // audit and merely flips `isActive` to false — so the borrowed core op must be a\n // persisting UPDATE, not a DELETE. (Borrowing DELETE physically removed the row: the\n // dispatch runs the borrowed core op FIRST, before any replace/postfix, so the core\n // DELETE deleted the token before the handler could intervene — the same\n // `replaceCoreOperations`-runs-after-core antipattern fixed for GENERATE_TOKEN.) The\n // custom impl marks the row inactive via a CREATE-like UPDATE prefix and returns a\n // revocation acknowledgement, NOT the SCIM-token resource row.\n customResponseDto: ScimTokens_RevokeTokenResponseDto,\n }],\n },\n [ScimTokens_Operations.ROTATE_TOKEN]: {\n variants: [{\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n polymorphicRole: {\n [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN, CORE_ORG_ROLES.ORG_DELEGATED_MANAGE_SSO_SCIM],\n },\n riskLevel: ResourceOperationRiskLevel.HIGH,\n // IRREVERSIBLE: Replaces the token value. The previous one is gone the moment this returns.\n // This is what admits it to the danger zone; risk alone no longer does.\n reversibility: ResourceOperationReversibility.IRREVERSIBLE,\n resourceOperationLike: CoreResourceOperation.UPDATE,\n requestDto: ScimTokens_RotateTokenRequestDto,\n // Borrows UPDATE and re-mints the secret IN PLACE on the same row: the custom impl's\n // UPDATE prefix injects a fresh `tokenHash` (mirroring the api-key rotate contract —\n // `tokenHash` is `.excludeFromUpdate()`, carried past the strict parse by\n // `preserveServerInjectedFields`) and the postfix surfaces the one-time plaintext.\n // Returns the newly-rotated token (plaintext + hash), NOT the SCIM-token resource row.\n // `newToken` is the one-time secret → `.isEphemeral()` (secret display, initially\n // revealed, not editable), mirroring api-key `plainKey`.\n //\n // Unlike api-keys (which keep the outgoing secret alive in a `previousHashedKey` grace\n // slot), the SCIM-token schema has NO previous-hash slot. Rotation is therefore an\n // IMMEDIATE cutover: the new hash replaces the old and the prior plaintext stops\n // authenticating at once. Do not expose a migration-window request or response until a\n // real persisted grace-slot contract exists.\n customResponseDto: ScimTokens_RotateTokenResponseDto,\n }],\n },\n },\n },\n);\n"]}
1	+ {"version":3,"file":"scim-tokens.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../../../../src/security/authentications/scim/scim-tokens.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,sDAAsD,CAAC;AAC/G,OAAO,EACL,0BAA0B,EAC1B,8BAA8B,EAC9B,4BAA4B,GAC7B,MAAM,6CAA6C,CAAC;AACrD,OAAO,EAAE,wBAAwB,EAAE,MAAM,oDAAoD,CAAC;AAC9F,OAAO,EAAE,uCAAuC,EAAE,MAAM,wDAAwD,CAAC;AACjH,OAAO,EAAE,cAAc,EAAE,MAAM,2CAA2C,CAAC;AAC3E,OAAO,EAAE,gCAAgC,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AAErG,wEAAwE;AAExE,MAAM,CAAN,IAAY,qBAIX;AAJD,WAAY,qBAAqB;IAC/B,yDAAgC,CAAA;IAChC,qDAA4B,CAAA;IAC5B,qDAA4B,CAAA;AAC9B,CAAC,EAJW,qBAAqB,KAArB,qBAAqB,QAIhC;AAED,wEAAwE;AAExE,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAAC,CAAC,YAAY,CAAC;IAC/D,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CAC5C,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;AAEnE;;;GAGG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;AAEnE,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC,CAAC,YAAY,CAAC;IAC9D,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,0GAA0G,CAAC;IACxI,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,wCAAwC,CAAC;CACvE,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC,CAAC,YAAY,CAAC;IAC9D,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,iNAAiN,CAAC;IAC9P,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,4GAA4G,CAAC;IAC7I,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,kFAAkF,CAAC;IACrH,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,wCAAwC,CAAC;CACvE,CAAC,CAAC;AAEH,wEAAwE;AAExE,MAAM,CAAC,MAAM,8BAA8B,GAAG,uCAAuC,CACnF,gCAAgC,EAChC;IACE,gBAAgB,EAAE,IAAI;IACtB,eAAe,EAAE,qBAAqB;IACtC,+EAA+E;IAC/E,6DAA6D;IAC7D,sFAAsF;IACtF,mFAAmF;IACnF,qFAAqF;IACrF,sDAAsD;IACtD,kBAAkB,EAAE;QAClB,IAAI,EAAE,wBAAwB,CAAC,OAAO;KACvC;IACD,cAAc,EAAE;QACd,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;KAC7B;IACD,uBAAuB,EAAE;QACvB,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE,CAAC;oBACT,8EAA8E;oBAC9E,oEAAoE;oBACpE,6EAA6E;oBAC7E,yEAAyE;oBACzE,iFAAiF;oBACjF,oEAAoE;oBACpE,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;qBAC7D;oBACD,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,6BAA6B,CAAC;qBAC3G;oBACD,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,eAAe;oBACzD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;qBAC7D;oBACD,SAAS,EAAE,0BAA0B,CAAC,IAAI;iBAC3C,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,8EAA8E;oBAC9E,+EAA+E;oBAC/E,kFAAkF;oBAClF,uFAAuF;oBACvF,kFAAkF;oBAClF,uEAAuE;oBACvE,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;qBAC7D;oBACD,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,eAAe;oBACzD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;qBAC7D;oBACD,SAAS,EAAE,0BAA0B,CAAC,IAAI;iBAC3C,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,cAAc,CAAC,EAAE;YACtC,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,6BAA6B,CAAC;qBAC3G;oBACD,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,kCAAkC;oBAC9C,wEAAwE;oBACxE,yEAAyE;oBACzE,2EAA2E;oBAC3E,0EAA0E;oBAC1E,0EAA0E;oBAC1E,iEAAiE;oBACjE,yEAAyE;oBACzE,uEAAuE;oBACvE,kEAAkE;oBAClE,uDAAuD;oBACvD,iBAAiB,EAAE,mBAAmB,CAAC,MAAM,CAAC;wBAC5C,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,oMAAoM,CAAC;qBAC/O,CAAC;iBACH,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,YAAY,CAAC,EAAE;YACpC,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,6BAA6B,CAAC;qBAC3G;oBACD,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,mGAAmG;oBACnG,wEAAwE;oBACxE,aAAa,EAAE,8BAA8B,CAAC,YAAY;oBAC1D,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,gCAAgC;oBAC5C,iFAAiF;oBACjF,iFAAiF;oBACjF,qFAAqF;oBACrF,oFAAoF;oBACpF,yEAAyE;oBACzE,qFAAqF;oBACrF,mFAAmF;oBACnF,+DAA+D;oBAC/D,iBAAiB,EAAE,iCAAiC;iBACrD,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,YAAY,CAAC,EAAE;YACpC,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,6BAA6B,CAAC;qBAC3G;oBACD,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,4FAA4F;oBAC5F,wEAAwE;oBACxE,aAAa,EAAE,8BAA8B,CAAC,YAAY;oBAC1D,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,gCAAgC;oBAC5C,qFAAqF;oBACrF,qFAAqF;oBACrF,0EAA0E;oBAC1E,mFAAmF;oBACnF,uFAAuF;oBACvF,kFAAkF;oBAClF,yDAAyD;oBACzD,EAAE;oBACF,uFAAuF;oBACvF,mFAAmF;oBACnF,iFAAiF;oBACjF,uFAAuF;oBACvF,6CAA6C;oBAC7C,iBAAiB,EAAE,iCAAiC;iBACrD,CAAC;SACH;KACF;CACF,CACF,CAAC","sourcesContent":["/*\n SCIM Tokens Resource Configuration — Polymorphic\n \n Produces the organization-scoped factory used by the SCIM bearer protocol.\n * Spread into the registry factory map:\n * ...scimTokensPolymorphicFactories\n /\n\nimport { z } from 'zod';\nimport { CoreResourceOperation, CoreResourceType } from '../../../resources/resources.shared.core.definitions';\nimport {\n ResourceOperationRiskLevel,\n ResourceOperationReversibility,\n ResourceOperationVariantType,\n} from '../../../resources/resources.shared.schemas';\nimport { ResourceSystemAccessMode } from '../../../resources/resources-config.shared.schemas';\nimport { createPolymorphicResourceConfigurations } from '../../../resources/utils/resource-polymorphism.factory';\nimport { CORE_ORG_ROLES } from '../../authorizations/roles.shared.schemas';\nimport { scimTokensPolymorphicDeclaration, ScimTokenBaseSchema } from './scim-tokens.shared.schemas';\n\n// ── Custom Operations ────────────────────────────────────────────────\n\nexport enum ScimTokens_Operations {\n GENERATE_TOKEN = 'generateToken',\n REVOKE_TOKEN = 'revokeToken',\n ROTATE_TOKEN = 'rotateToken',\n}\n\n// ── Request DTOs ─────────────────────────────────────────────────────\n\nexport const ScimTokens_GenerateTokenRequestDto = z.strictObject({\n displayName: z.string().min(1),\n expiresAt: z.string().datetime().optional(),\n});\n\nexport const ScimTokens_RevokeTokenRequestDto = z.strictObject({});\n\n/\n Rotation is an immediate cutover because the persisted token schema has no previous-hash grace slot.\n * Keep the request strictly empty rather than accepting a migration-window option the runtime cannot honor.\n /\nexport const ScimTokens_RotateTokenRequestDto = z.strictObject({});\n\nexport const ScimTokens_RevokeTokenResponseDto = z.strictObject({\n isActive: z.boolean(),\n revokedAt: z.date().describe(\"When this request revoked the token. The time is not stored on the token, so later reads do not show it.\"),\n message: z.string().describe(\"A fixed confirmation: `Token revoked`.\"),\n});\n\nexport const ScimTokens_RotateTokenResponseDto = z.strictObject({\n newToken: z.string().isEphemeral().describe(\"The new token value, returned only in this response: only its hash is stored, so it cannot be read again. The previous value stops working immediately; the directory sends this one as a bearer token instead.\"),\n newTokenId: z.string().describe(\"The id of the rotated token. Rotation replaces the value on the same token, so this is the token's own id.\"),\n newTokenHash: z.string().describe(\"The SHA-256 hash of the new token value, in hex: the form in which it is stored.\"),\n message: z.string().describe(\"A fixed confirmation: `Token rotated`.\"),\n});\n\n// ── Polymorphic Factory ──────────────────────────────────────────────\n\nexport const scimTokensPolymorphicFactories = createPolymorphicResourceConfigurations(\n scimTokensPolymorphicDeclaration,\n {\n isSystemResource: true,\n customOperation: ScimTokens_Operations,\n // The SCIM bearer-auth middleware resolves an inbound token by its `tokenHash`\n // on EVERY /scim/v2/ request via a system-context read (see\n // `scim.backend.controller.ts` `_authenticateBearer` → `servicesRegistryHandler.read`\n // with the `createForSystemAuthOperation` EC). That read is PRE-USER (the token IS\n // the credential), so it opts into `systemAccessPolicy.read = ALLOWED` — mirrors the\n // enterprise SSO-connection resolver's pre-auth read.\n systemAccessPolicy: {\n read: ResourceSystemAccessMode.ALLOWED,\n },\n coreOperations: [\n CoreResourceOperation.READ,\n CoreResourceOperation.LIST,\n CoreResourceOperation.CREATE,\n CoreResourceOperation.UPDATE,\n CoreResourceOperation.DELETE,\n ],\n operationsConfiguration: {\n [CoreResourceOperation.READ]: {\n variants: [{\n // Service-transport default (INTERNAL_CALL — internal-only, NO HTTP surface).\n // The bearer-auth token lookup reads this through the service layer\n // (`servicesRegistryHandler.read` → `getServiceOperationPathDefault`), which\n // honours INTERNAL_CALL / API_CALL defaults but NOT `REPOSITORY_ONLY`; a\n // repository-only READ here throws `RESOURCES_REGISTRY_OPERATION_PATH_NOT_FOUND`\n // and 500s every SCIM request. Same fix as the SSO-connection READ.\n variantType: ResourceOperationVariantType.INTERNAL_CALL,\n isDefault: true,\n polymorphicRole: {\n [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n },\n riskLevel: ResourceOperationRiskLevel.LOW,\n }],\n },\n [CoreResourceOperation.LIST]: {\n variants: [{\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n polymorphicRole: {\n [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN, CORE_ORG_ROLES.ORG_DELEGATED_MANAGE_SSO_SCIM],\n },\n riskLevel: ResourceOperationRiskLevel.LOW,\n }],\n },\n [CoreResourceOperation.CREATE]: {\n variants: [{\n variantType: ResourceOperationVariantType.REPOSITORY_ONLY,\n isDefault: true,\n polymorphicRole: {\n [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n },\n riskLevel: ResourceOperationRiskLevel.HIGH,\n }],\n },\n [CoreResourceOperation.UPDATE]: {\n variants: [{\n // Service-transport default (INTERNAL_CALL — internal-only, NO HTTP surface).\n // The SCIM bearer-auth middleware stamps `lastUsedAt` on the resolved token on\n // every /scim/v2/* request via a fire-and-forget system-context update. Without a\n // resolvable UPDATE op that write throws `RESOURCES_REGISTRY_OPERATION_PATH_NOT_FOUND`\n // (logged FATAL, though swallowed) on every SCIM call. Token metadata mutation is\n // internal-only; operators rotate/revoke via the dedicated custom ops.\n variantType: ResourceOperationVariantType.INTERNAL_CALL,\n isDefault: true,\n polymorphicRole: {\n [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n },\n riskLevel: ResourceOperationRiskLevel.LOW,\n }],\n },\n [CoreResourceOperation.DELETE]: {\n variants: [{\n variantType: ResourceOperationVariantType.REPOSITORY_ONLY,\n isDefault: true,\n polymorphicRole: {\n [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n },\n riskLevel: ResourceOperationRiskLevel.HIGH,\n }],\n },\n [ScimTokens_Operations.GENERATE_TOKEN]: {\n variants: [{\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n polymorphicRole: {\n [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN, CORE_ORG_ROLES.ORG_DELEGATED_MANAGE_SSO_SCIM],\n },\n riskLevel: ResourceOperationRiskLevel.HIGH,\n resourceOperationLike: CoreResourceOperation.CREATE,\n requestDto: ScimTokens_GenerateTokenRequestDto,\n // GENERATE_TOKEN borrows CREATE and PERSISTS a real SCIM-token row (the\n // SCIM bearer-auth middleware resolves inbound tokens by their persisted\n // `tokenHash`), then returns that row PLUS the one-time plaintext `token`.\n // This mirrors the api-key mint contract exactly: the response DTO is the\n // resource schema extended with an ephemeral secret field — NOT a bespoke\n // shape. The mint runs as a CREATE prefix (injects `tokenHash` +\n // `createdByUserId` so the core create persists) + postfix (attaches the\n // one-time `token`); see `scim-tokens.custom-impl.backend.service.ts`.\n // `token` is `.isEphemeral()` (secret display, revealed once, not\n // persisted — same decorator api-key `plainKey` uses).\n customResponseDto: ScimTokenBaseSchema.extend({\n token: z.string().isEphemeral().describe(\"The token value, returned only in this response: only its hash is stored, so it cannot be read again. The directory sends it as a bearer token in the `Authorization` header of its SCIM requests.\"),\n }),\n }],\n },\n [ScimTokens_Operations.REVOKE_TOKEN]: {\n variants: [{\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n polymorphicRole: {\n [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN, CORE_ORG_ROLES.ORG_DELEGATED_MANAGE_SSO_SCIM],\n },\n riskLevel: ResourceOperationRiskLevel.HIGH,\n // IRREVERSIBLE: A revoked token can never be un-revoked; the integration must be issued a new one.\n // This is what admits it to the danger zone; risk alone no longer does.\n reversibility: ResourceOperationReversibility.IRREVERSIBLE,\n resourceOperationLike: CoreResourceOperation.UPDATE,\n requestDto: ScimTokens_RevokeTokenRequestDto,\n // Borrows UPDATE (NOT DELETE) for its route/verb: revocation RETAINS the row for\n // audit and merely flips `isActive` to false — so the borrowed core op must be a\n // persisting UPDATE, not a DELETE. (Borrowing DELETE physically removed the row: the\n // dispatch runs the borrowed core op FIRST, before any replace/postfix, so the core\n // DELETE deleted the token before the handler could intervene — the same\n // `replaceCoreOperations`-runs-after-core antipattern fixed for GENERATE_TOKEN.) The\n // custom impl marks the row inactive via a CREATE-like UPDATE prefix and returns a\n // revocation acknowledgement, NOT the SCIM-token resource row.\n customResponseDto: ScimTokens_RevokeTokenResponseDto,\n }],\n },\n [ScimTokens_Operations.ROTATE_TOKEN]: {\n variants: [{\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n polymorphicRole: {\n [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN, CORE_ORG_ROLES.ORG_DELEGATED_MANAGE_SSO_SCIM],\n },\n riskLevel: ResourceOperationRiskLevel.HIGH,\n // IRREVERSIBLE: Replaces the token value. The previous one is gone the moment this returns.\n // This is what admits it to the danger zone; risk alone no longer does.\n reversibility: ResourceOperationReversibility.IRREVERSIBLE,\n resourceOperationLike: CoreResourceOperation.UPDATE,\n requestDto: ScimTokens_RotateTokenRequestDto,\n // Borrows UPDATE and re-mints the secret IN PLACE on the same row: the custom impl's\n // UPDATE prefix injects a fresh `tokenHash` (mirroring the api-key rotate contract —\n // `tokenHash` is `.excludeFromUpdate()`, carried past the strict parse by\n // `preserveServerInjectedFields`) and the postfix surfaces the one-time plaintext.\n // Returns the newly-rotated token (plaintext + hash), NOT the SCIM-token resource row.\n // `newToken` is the one-time secret → `.isEphemeral()` (secret display, initially\n // revealed, not editable), mirroring api-key `plainKey`.\n //\n // Unlike api-keys (which keep the outgoing secret alive in a `previousHashedKey` grace\n // slot), the SCIM-token schema has NO previous-hash slot. Rotation is therefore an\n // IMMEDIATE cutover: the new hash replaces the old and the prior plaintext stops\n // authenticating at once. Do not expose a migration-window request or response until a\n // real persisted grace-slot contract exists.\n customResponseDto: ScimTokens_RotateTokenResponseDto,\n }],\n },\n },\n },\n);\n"]}

package/dist/esm/security/authentications/scim/scim-tokens.shared.schemas.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"scim-tokens.shared.schemas.d.ts","sourceRoot":"","sources":["~~../../../../../~~src/security/authentications/scim/scim-tokens.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB,eAAO,MAAM,mBAAmB;;;;;;;;;;;iBAmC9B,CAAC;AAEH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEhE,eAAO,MAAM,gCAAgC;;;;;;;;;;;kBAY3C,CAAC"}
1	+ {"version":3,"file":"scim-tokens.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../../../src/security/authentications/scim/scim-tokens.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB,eAAO,MAAM,mBAAmB;;;;;;;;;;;iBAmC9B,CAAC;AAEH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEhE,eAAO,MAAM,gCAAgC;;;;;;;;;;;kBAY3C,CAAC"}

package/dist/esm/security/authentications/scim/scim-tokens.shared.schemas.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"scim-tokens.shared.schemas.js","sourceRoot":"","sources":["~~../../../../../~~src/security/authentications/scim/scim-tokens.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AACvE,OAAO,EAAE,gBAAgB,EAAE,MAAM,sDAAsD,CAAC;AACxF,OAAO,EAAE,yBAAyB,EAAE,gCAAgC,EAAE,MAAM,wDAAwD,CAAC;AAErI,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IAEtD,4EAA4E;IAC5E,6EAA6E;IAC7E,+EAA+E;IAC/E,qEAAqE;IACrE,8EAA8E;IAC9E,gFAAgF;IAChF,+EAA+E;IAC/E,8EAA8E;IAC9E,oEAAoE;IACpE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,EAAE,oBAAoB,EAAE,IAAI,EAAE,CAAC,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IAClH,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,cAAc,EAAE;IACxD,8EAA8E;IAC9E,+EAA+E;IAC/E,0DAA0D;IAC1D,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IAC1E,UAAU,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IAC/B,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IAC9B;;;;;;OAMG;IACH,0BAA0B,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE,CAAC,eAAe,EAAE;SAC7H,QAAQ,CAAC,8UAA8U,CAAC;IAC3V,8FAA8F;IAC9F,mGAAmG;IACnG,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,cAAc,EAAE,CAAC,eAAe,EAAE;IAEtE,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IACrF,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;CACtF,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,gCAAgC,GAAG,yBAAyB,CAAC;IACxE,gBAAgB,EAAE,YAAY;IAC9B,mBAAmB,EAAE,aAAa;IAClC,WAAW,EAAE,aAAa;IAC1B,UAAU,EAAE,mBAAmB;IAC/B,8DAA8D;IAC9D,0DAA0D;IAC1D,kFAAkF;IAClF,sFAAsF;IACtF,QAAQ,EAAE,mBAAmB;SAC1B,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,kBAAkB,KAAK,gBAAgB,CAAC,aAAa,CAAC;SAClF,GAAG,CAAC,gCAAgC,CAAC;CACzC,CAAC,CAAC","sourcesContent":["/*\n SCIM Tokens Schema (Shared) — Polymorphic\n \n API bearer tokens for SCIM provisioning endpoints.\n * Naturally flat — no structural nesting needed.\n * The organization scope FK is injected by the polymorphism engine. There is deliberately\n * no application variant because the current SCIM protocol is tenant-scoped.\n \n Field renames from old flat schema: label → displayName, createdBy → createdByUserId.\n \n @see auth-data-model-audit.md §2F\n /\n\nimport { z } from 'zod';\nimport { AUTH_SCOPE_VARIANTS } from '../authentication.shared.schemas';\nimport { CoreResourceType } from '../../../resources/resources.shared.core.definitions';\nimport { declarePolymorphicSchemas, optOutPolymorphicAutoBusinessKey } from '../../../resources/utils/resource-polymorphism.schemas';\n\nexport const ScimTokenBaseSchema = z.object({\n _id: z.string().min(1).isPrimaryKey().isSummaryField(),\n\n // The SHA-256 of the plaintext bearer — the server-side lookup key the SCIM\n // bearer-auth middleware resolves an inbound token by. The client MUST NEVER\n // supply it (`.excludeFrom{Create,Update}()`); the `generateToken` custom op's\n // mint prefix injects it. `isReturnedAtCreation` lets it survive the\n // backend-only strip so the mint POSTFIX can correlate the one-time plaintext\n // by hash — mirrors the api-key `hashedKey` contract (which minted secrets rely\n // on identically). Without `.excludeFromCreate()`, a bare CREATE would require\n // the client to send `tokenHash`, and without the mint prefix the CREATE that\n // `generateToken` borrows would fail on the missing required field.\n tokenHash: z.string().min(1).isBackendOnly({ isReturnedAtCreation: true }).excludeFromCreate().excludeFromUpdate(),\n displayName: z.string().min(1).max(100).isSummaryField(),\n // Server-authoritative audit field: the id of the admin who minted the token.\n // Stamped by the `generateToken` mint prefix from the execution context, never\n // client-supplied (the custom op's request DTO omits it).\n createdByUserId: z.string().min(1).excludeFromCreate().excludeFromUpdate(),\n lastUsedAt: z.date().optional(),\n expiresAt: z.date().optional(),\n /\n The capability grant this token was generated or rotated under (#1631), when a service firm's expert did it through\n * a lent `MANAGE_SSO_SCIM`. Its `expiresAt` is capped at the grant's end, and it is deactivated when the grant is\n * revoked or its relationship ends. Absent for a token the organization's own administrators handled. Server-written.\n \n assurance-control: WILDO.ACCESS.LEAST_PRIVILEGE — a directory credential obtained through delegated administration cannot outlive the delegation.\n */\n lentUnderCapabilityGrantId: z.string().min(1).optional().isDBIndexed().excludeFromCreate().excludeFromUpdate().isAuditEvidence()\n .describe('The capability grant a service firm\\'s expert generated or rotated this token under, through directory administration the organization lent the firm. Such a token expires no later than the grant and is deactivated when the grant is revoked or the relationship ends. Absent for a token the organization\\'s own administrators handled.'),\n // `.isAuditEvidence()` — a SCIM token governs directory provisioning for the whole tenant, so\n // whether it is live is an access-control fact. assurance-control: WILDO.ACCESS.PRIVILEGE_EVIDENCE\n isActive: z.boolean().default(true).isSummaryField().isAuditEvidence(),\n\n createdAt: z.date().default(() => new Date()).excludeFromCreate().excludeFromUpdate(),\n updatedAt: z.date().default(() => new Date()).excludeFromCreate().excludeFromUpdate(),\n});\n\nexport type ScimTokenBase = z.infer<typeof ScimTokenBaseSchema>;\n\nexport const scimTokensPolymorphicDeclaration = declarePolymorphicSchemas({\n baseResourceType: 'scimTokens',\n baseFieldIdentifier: 'scimTokenId',\n baseEnumKey: 'SCIM_TOKENS',\n baseSchema: ScimTokenBaseSchema,\n // Many tokens per scope (LIST/CREATE/DELETE) — opt out of the\n // polymorphism engine's singleton-per-scope auto-default.\n // SCIM endpoints authenticate tenant directory credentials only. Do not derive an\n // application variant until an application-scoped SCIM protocol and authorizer exist.\n variants: AUTH_SCOPE_VARIANTS\n .filter((variant) => variant.parentResourceType === CoreResourceType.ORGANIZATIONS)\n .map(optOutPolymorphicAutoBusinessKey),\n});\n"]}
1	+ {"version":3,"file":"scim-tokens.shared.schemas.js","sourceRoot":"","sources":["../../../../../../src/security/authentications/scim/scim-tokens.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AACvE,OAAO,EAAE,gBAAgB,EAAE,MAAM,sDAAsD,CAAC;AACxF,OAAO,EAAE,yBAAyB,EAAE,gCAAgC,EAAE,MAAM,wDAAwD,CAAC;AAErI,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IAEtD,4EAA4E;IAC5E,6EAA6E;IAC7E,+EAA+E;IAC/E,qEAAqE;IACrE,8EAA8E;IAC9E,gFAAgF;IAChF,+EAA+E;IAC/E,8EAA8E;IAC9E,oEAAoE;IACpE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,EAAE,oBAAoB,EAAE,IAAI,EAAE,CAAC,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IAClH,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,cAAc,EAAE;IACxD,8EAA8E;IAC9E,+EAA+E;IAC/E,0DAA0D;IAC1D,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IAC1E,UAAU,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IAC/B,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IAC9B;;;;;;OAMG;IACH,0BAA0B,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE,CAAC,eAAe,EAAE;SAC7H,QAAQ,CAAC,8UAA8U,CAAC;IAC3V,8FAA8F;IAC9F,mGAAmG;IACnG,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,cAAc,EAAE,CAAC,eAAe,EAAE;IAEtE,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IACrF,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;CACtF,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,gCAAgC,GAAG,yBAAyB,CAAC;IACxE,gBAAgB,EAAE,YAAY;IAC9B,mBAAmB,EAAE,aAAa;IAClC,WAAW,EAAE,aAAa;IAC1B,UAAU,EAAE,mBAAmB;IAC/B,8DAA8D;IAC9D,0DAA0D;IAC1D,kFAAkF;IAClF,sFAAsF;IACtF,QAAQ,EAAE,mBAAmB;SAC1B,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,kBAAkB,KAAK,gBAAgB,CAAC,aAAa,CAAC;SAClF,GAAG,CAAC,gCAAgC,CAAC;CACzC,CAAC,CAAC","sourcesContent":["/*\n SCIM Tokens Schema (Shared) — Polymorphic\n \n API bearer tokens for SCIM provisioning endpoints.\n * Naturally flat — no structural nesting needed.\n * The organization scope FK is injected by the polymorphism engine. There is deliberately\n * no application variant because the current SCIM protocol is tenant-scoped.\n \n Field renames from old flat schema: label → displayName, createdBy → createdByUserId.\n \n @see auth-data-model-audit.md §2F\n /\n\nimport { z } from 'zod';\nimport { AUTH_SCOPE_VARIANTS } from '../authentication.shared.schemas';\nimport { CoreResourceType } from '../../../resources/resources.shared.core.definitions';\nimport { declarePolymorphicSchemas, optOutPolymorphicAutoBusinessKey } from '../../../resources/utils/resource-polymorphism.schemas';\n\nexport const ScimTokenBaseSchema = z.object({\n _id: z.string().min(1).isPrimaryKey().isSummaryField(),\n\n // The SHA-256 of the plaintext bearer — the server-side lookup key the SCIM\n // bearer-auth middleware resolves an inbound token by. The client MUST NEVER\n // supply it (`.excludeFrom{Create,Update}()`); the `generateToken` custom op's\n // mint prefix injects it. `isReturnedAtCreation` lets it survive the\n // backend-only strip so the mint POSTFIX can correlate the one-time plaintext\n // by hash — mirrors the api-key `hashedKey` contract (which minted secrets rely\n // on identically). Without `.excludeFromCreate()`, a bare CREATE would require\n // the client to send `tokenHash`, and without the mint prefix the CREATE that\n // `generateToken` borrows would fail on the missing required field.\n tokenHash: z.string().min(1).isBackendOnly({ isReturnedAtCreation: true }).excludeFromCreate().excludeFromUpdate(),\n displayName: z.string().min(1).max(100).isSummaryField(),\n // Server-authoritative audit field: the id of the admin who minted the token.\n // Stamped by the `generateToken` mint prefix from the execution context, never\n // client-supplied (the custom op's request DTO omits it).\n createdByUserId: z.string().min(1).excludeFromCreate().excludeFromUpdate(),\n lastUsedAt: z.date().optional(),\n expiresAt: z.date().optional(),\n /\n The capability grant this token was generated or rotated under (#1631), when a service firm's expert did it through\n * a lent `MANAGE_SSO_SCIM`. Its `expiresAt` is capped at the grant's end, and it is deactivated when the grant is\n * revoked or its relationship ends. Absent for a token the organization's own administrators handled. Server-written.\n \n assurance-control: WILDO.ACCESS.LEAST_PRIVILEGE — a directory credential obtained through delegated administration cannot outlive the delegation.\n */\n lentUnderCapabilityGrantId: z.string().min(1).optional().isDBIndexed().excludeFromCreate().excludeFromUpdate().isAuditEvidence()\n .describe('The capability grant a service firm\\'s expert generated or rotated this token under, through directory administration the organization lent the firm. Such a token expires no later than the grant and is deactivated when the grant is revoked or the relationship ends. Absent for a token the organization\\'s own administrators handled.'),\n // `.isAuditEvidence()` — a SCIM token governs directory provisioning for the whole tenant, so\n // whether it is live is an access-control fact. assurance-control: WILDO.ACCESS.PRIVILEGE_EVIDENCE\n isActive: z.boolean().default(true).isSummaryField().isAuditEvidence(),\n\n createdAt: z.date().default(() => new Date()).excludeFromCreate().excludeFromUpdate(),\n updatedAt: z.date().default(() => new Date()).excludeFromCreate().excludeFromUpdate(),\n});\n\nexport type ScimTokenBase = z.infer<typeof ScimTokenBaseSchema>;\n\nexport const scimTokensPolymorphicDeclaration = declarePolymorphicSchemas({\n baseResourceType: 'scimTokens',\n baseFieldIdentifier: 'scimTokenId',\n baseEnumKey: 'SCIM_TOKENS',\n baseSchema: ScimTokenBaseSchema,\n // Many tokens per scope (LIST/CREATE/DELETE) — opt out of the\n // polymorphism engine's singleton-per-scope auto-default.\n // SCIM endpoints authenticate tenant directory credentials only. Do not derive an\n // application variant until an application-scoped SCIM protocol and authorizer exist.\n variants: AUTH_SCOPE_VARIANTS\n .filter((variant) => variant.parentResourceType === CoreResourceType.ORGANIZATIONS)\n .map(optOutPolymorphicAutoBusinessKey),\n});\n"]}

package/dist/esm/security/authentications/service-provider-client-authentication.shared.schemas.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"service-provider-client-authentication.shared.schemas.d.ts","sourceRoot":"","sources":["~~../../../../~~src/security/authentications/service-provider-client-authentication.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,UAAU,EAAE,MAAM,iCAAiC,CAAC;AAE7D,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,oDAAoD,CAAC;AAC7F,OAAO,EAAE,uBAAuB,EAAE,MAAM,qEAAqE,CAAC;AAE9G,uIAAuI;AACvI,4FAA4F;AAC5F,oBAAY,wBAAwB;IAClC,uGAAuG;IACvG,gBAAgB,qBAAqB;IACrC;;;OAGG;IACH,oBAAoB,yBAAyB;CAC9C;AAED,+DAA+D;AAC/D,eAAO,MAAM,4BAA4B;IACvC,2EAA2E;;;;;IAK3E,+GAA+G;;kBAE/G,CAAC;AACH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAElF;;;;GAIG;AACH,eAAO,MAAM,iCAAiC;IAC5C,iFAAiF;;IAEjF,wFAAwF;;;kBAGxF,CAAC;AACH,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC;AAE5F,iEAAiE;AACjE,eAAO,MAAM,uCAAuC;;QAzBlD,2EAA2E;;;;;QAK3E,+GAA+G;;;;QAW/G,iFAAiF;;QAEjF,wFAAwF;;;;kBAUxF,CAAC;AACH,MAAM,MAAM,iCAAiC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uCAAuC,CAAC,CAAC;AAExG;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,0BAA0B,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAI3E,CAAC;AAEF,oFAAoF;AACpF,MAAM,WAAW,oCAAoC;IACnD,oFAAoF;IACpF,QAAQ,CAAC,oBAAoB,EAAE,OAAO,CAAC;IACvC,gHAAgH;IAChH,QAAQ,CAAC,eAAe,EAAE,SAAS,UAAU,EAAE,CAAC;IAChD;;;OAGG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;CACjC;AAED;;;;;;GAMG;AACH,wBAAgB,2CAA2C,CAAC,YAAY,EAAE,kBAAkB,GAAG,oCAAoC,CAOlI;AAQD;;;;;;;;;;;;GAYG;AACH,wBAAgB,yBAAyB,CAAC,KAAK,EAAE;IAC/C,QAAQ,CAAC,WAAW,EAAE,oCAAoC,CAAC;IAC3D,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,gBAAgB,EAAE,SAAS,sBAAsB,EAAE,CAAC;IAC7D,sHAAsH;IACtH,QAAQ,CAAC,YAAY,EAAE;QAAE,QAAQ,CAAC,sBAAsB,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,uBAAuB,CAAA;KAAE,CAAC;IACxH,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC;CACpB,GAAG,sBAAsB,GAAG,SAAS,CAUrC;AAED;;;;;;;GAOG;AACH,wBAAgB,0BAA0B,CAAC,KAAK,EAAE;IAChD,QAAQ,CAAC,WAAW,EAAE,oCAAoC,CAAC;IAC3D,QAAQ,CAAC,YAAY,EAAE;QAAE,QAAQ,CAAC,sBAAsB,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,uBAAuB,CAAA;KAAE,CAAC;IACxH,QAAQ,CAAC,QAAQ,EAAE,2BAA2B,GAAG,SAAS,CAAC;IAC3D,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC;CACpB,GAAG,UAAU,GAAG,SAAS,CAWzB;AACD,qFAAqF"}
1	+ {"version":3,"file":"service-provider-client-authentication.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/security/authentications/service-provider-client-authentication.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,UAAU,EAAE,MAAM,iCAAiC,CAAC;AAE7D,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,oDAAoD,CAAC;AAC7F,OAAO,EAAE,uBAAuB,EAAE,MAAM,qEAAqE,CAAC;AAE9G,uIAAuI;AACvI,4FAA4F;AAC5F,oBAAY,wBAAwB;IAClC,uGAAuG;IACvG,gBAAgB,qBAAqB;IACrC;;;OAGG;IACH,oBAAoB,yBAAyB;CAC9C;AAED,+DAA+D;AAC/D,eAAO,MAAM,4BAA4B;IACvC,2EAA2E;;;;;IAK3E,+GAA+G;;kBAE/G,CAAC;AACH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAElF;;;;GAIG;AACH,eAAO,MAAM,iCAAiC;IAC5C,iFAAiF;;IAEjF,wFAAwF;;;kBAGxF,CAAC;AACH,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC;AAE5F,iEAAiE;AACjE,eAAO,MAAM,uCAAuC;;QAzBlD,2EAA2E;;;;;QAK3E,+GAA+G;;;;QAW/G,iFAAiF;;QAEjF,wFAAwF;;;;kBAUxF,CAAC;AACH,MAAM,MAAM,iCAAiC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uCAAuC,CAAC,CAAC;AAExG;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,0BAA0B,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAI3E,CAAC;AAEF,oFAAoF;AACpF,MAAM,WAAW,oCAAoC;IACnD,oFAAoF;IACpF,QAAQ,CAAC,oBAAoB,EAAE,OAAO,CAAC;IACvC,gHAAgH;IAChH,QAAQ,CAAC,eAAe,EAAE,SAAS,UAAU,EAAE,CAAC;IAChD;;;OAGG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;CACjC;AAED;;;;;;GAMG;AACH,wBAAgB,2CAA2C,CAAC,YAAY,EAAE,kBAAkB,GAAG,oCAAoC,CAOlI;AAQD;;;;;;;;;;;;GAYG;AACH,wBAAgB,yBAAyB,CAAC,KAAK,EAAE;IAC/C,QAAQ,CAAC,WAAW,EAAE,oCAAoC,CAAC;IAC3D,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,gBAAgB,EAAE,SAAS,sBAAsB,EAAE,CAAC;IAC7D,sHAAsH;IACtH,QAAQ,CAAC,YAAY,EAAE;QAAE,QAAQ,CAAC,sBAAsB,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,uBAAuB,CAAA;KAAE,CAAC;IACxH,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC;CACpB,GAAG,sBAAsB,GAAG,SAAS,CAUrC;AAED;;;;;;;GAOG;AACH,wBAAgB,0BAA0B,CAAC,KAAK,EAAE;IAChD,QAAQ,CAAC,WAAW,EAAE,oCAAoC,CAAC;IAC3D,QAAQ,CAAC,YAAY,EAAE;QAAE,QAAQ,CAAC,sBAAsB,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,uBAAuB,CAAA;KAAE,CAAC;IACxH,QAAQ,CAAC,QAAQ,EAAE,2BAA2B,GAAG,SAAS,CAAC;IAC3D,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC;CACpB,GAAG,UAAU,GAAG,SAAS,CAWzB;AACD,qFAAqF"}