@wtfalch/foundry 0.41.2 → 0.42.1

package/dist/plan/login-host.js

@@ -1,6 +1,7 @@
 import { ownsServices } from '../org.js';
-import { AGORA_CLIENT_ID_SCOPE_KEY, APP_CLIENT_ID_SCOPE_KEY, CMS_CLIENT_ID_SCOPE_KEY, ENTRY_CLIENT_ID_SCOPE_PREFIX, } from './agora.js';
-import { BOULE_CLIENT_ID_SCOPE_KEY } from './boule.js';
+import { AGORA_CLIENT_ID_SCOPE_KEY, APP_CLIENT_ID_SCOPE_KEY, CMS_CLIENT_ID_SCOPE_KEY, ENTRY_CLIENT_ID_SCOPE_PREFIX, agoraHostnameFor, } from './agora.js';
+import { BOULE_CLIENT_ID_SCOPE_KEY, bouleHostnameFor } from './boule.js';
+import { SIGN_IN_IN_APP_SCOPE_KEY, inAppSignIn, inAppStatePairs, } from './sign-in.js';
 /**
  * #267: what both the planner (`diff.ts`) and the executor (`executor.ts`)
  * need to agree on for an org's own company login host -- the hostname and
@@ -120,7 +121,10 @@ export function loginHostServesAgora(host, org, recorded) {
     if (!bound?.startsWith(`${host} `))
         return false;
     const clientId = recorded[AGORA_CLIENT_ID_SCOPE_KEY];
+    // Agora's client moves to its own host's binding once that host signs in on the app's address.
+    const movedToAppHost = inAppStatePairs(recorded[SIGN_IN_IN_APP_SCOPE_KEY]).some((pair) => pair.clientId === clientId);
     return (!clientId ||
+        movedToAppHost ||
         bound
             .slice(host.length + 1)
             .split(',')
@@ -132,6 +136,23 @@ export function loginHostServesAgora(host, org, recorded) {
  * instance, so `destroy` must not remove it.
  */
 export const LOGIN_HOST_SHARED_SCOPE_KEY = 'zitadel_login_host_shared';
+/**
+ * The app hosts that sign in on their own address when the company has `signIn.inApp`: Agora's and
+ * Boule's, each only once its client id is recorded. Empty with the switch off. Archon (owner company
+ * only) is not here: the platform's Archon step owns its host (`sign-in-archon.ts`).
+ */
+export function inAppApps(org, recorded) {
+    if (!inAppSignIn(org))
+        return [];
+    const apps = [];
+    const agora = recorded[AGORA_CLIENT_ID_SCOPE_KEY];
+    if (agora)
+        apps.push({ app: 'agora', host: agoraHostnameFor(org), clientId: agora });
+    const boule = recorded[BOULE_CLIENT_ID_SCOPE_KEY];
+    if (boule)
+        apps.push({ app: 'boule', host: bouleHostnameFor(org), clientId: boule });
+    return apps.sort((a, b) => (a.host < b.host ? -1 : 1));
+}
 /**
  * Scope id holding what the binding was last written with
  * ({@link loginBindingState}). Client ids are not secrets. The planner
@@ -149,8 +170,12 @@ export const LOGIN_BINDING_SCOPE_KEY = 'login_host_binding';
 export function customersEntryKeys(org) {
     return new Set(org.hosting.entries.filter((e) => e.uses?.auth?.users === 'customers').map((e) => e.key));
 }
-/** The org's recorded app client ids (hosted app, each entry's own bar a customers entry, cms, agora, boule), deduplicated and sorted. */
-export function loginHostClientIds(org, recorded) {
+/**
+ * The org's recorded app client ids (hosted app, each entry's own bar a customers entry, cms, agora, boule),
+ * deduplicated and sorted, bar `except`: the login refuses a client id held by two bindings, so the ids of the
+ * app hosts that have their own binding (in-app sign-in) are not in the company's.
+ */
+export function loginHostClientIds(org, recorded, except = []) {
     const customers = customersEntryKeys(org);
     const ids = [
         recorded[APP_CLIENT_ID_SCOPE_KEY],
@@ -162,7 +187,7 @@ export function loginHostClientIds(org, recorded) {
             !customers.has(key.slice(ENTRY_CLIENT_ID_SCOPE_PREFIX.length)))
             .map(([, id]) => id),
     ].filter((id) => Boolean(id));
-    return [...new Set(ids)].sort();
+    return [...new Set(ids)].filter((id) => !except.includes(id)).sort();
 }
 /** The host plus its sorted client ids, as recorded under {@link LOGIN_BINDING_SCOPE_KEY}. */
 export function loginBindingState(host, clientIds) {

package/dist/plan/own-diff.js

@@ -13,6 +13,7 @@ import { OWN_SFU_APPLIED_HOSTNAME_SCOPE_KEY, OWN_SFU_APPLIED_NODE_IP_SCOPE_KEY,
 import { AUTH_ZITADEL_RUN_OPTIONS, JOBS_DEPLOY_PENDING_SCOPE_KEY, JOBS_INTERNAL_URL_SCOPE_KEY, PLATFORM_AUTH_ADMIN_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_ADMIN_USER_SCOPE_KEY, PLATFORM_AUTH_BROKER_SCOPE_KEY, PLATFORM_AUTH_CONNECTOR_APP_SCOPE_KEY, PLATFORM_AUTH_INSTANCE_SCOPE_KEY, PLATFORM_AUTH_INSTANCE_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_LOGIN_CLIENT_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_LOGIN_CLIENT_USER_SCOPE_KEY, PLATFORM_AUTH_SMTP_SCOPE_KEY, PLATFORM_AUTH_ZITADEL_RUN_OPTIONS_SCOPE_KEY, PLATFORM_FILES_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_FILES_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, PLATFORM_FILES_INTROSPECTION_SCOPE_KEY, PLATFORM_FILES_INTROSPECTION_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_FILES_MANAGEMENT_UNDELIVERED_SCOPE_KEY, PLATFORM_MAIL_ADMIN_KEY_SCOPE_KEY, PLATFORM_MAIL_ADMIN_UNDELIVERED_SCOPE_KEY, PLATFORM_MAIL_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_MAIL_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY, platformMailMxHost, } from './platform-diff.js';
 import { OWN_FILES_RUNNER_SCOPE_KEY } from './platform-org.js';
 import { JOBS_ADMIN_TOKEN_UNDELIVERED_SCOPE_KEY, JOBS_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_AUTH_DB_SCOPE_KEY, PLATFORM_AUTH_ZITADEL_SCOPE_KEY, PLATFORM_FILES_SHARE_DOMAINS_SCOPE_KEY, filesShareDomains, } from './platform-providers.js';
+import { SIGN_IN_LOGIN_APP_SCOPE_KEY, inAppSignIn } from './sign-in.js';
 import { signinDbBackupMissing } from './signin-db-backup.js';
 import { SIGNIN_DB_ZITADEL_PENDING_SCOPE_KEY, signinDbCertDue } from './signin-db-tls.js';
 import { SIGNIN_DB_TLS_SCOPE_KEY } from './signin-db.js';
@@ -162,6 +163,11 @@ export function planOwnAuth(options) {
         recordedIds[PLATFORM_AUTH_SMTP_SCOPE_KEY] &&
         recordedIds[PLATFORM_AUTH_ZITADEL_RUN_OPTIONS_SCOPE_KEY] === AUTH_ZITADEL_RUN_OPTIONS &&
         (Boolean(recordedIds[PLATFORM_AUTH_LOGIN_CLIENT_USER_SCOPE_KEY]) || !brokerHoldsAnEntry) &&
+        // In-app sign-in: the second login app is recorded once it is deployed and holds the token, which
+        // needs the login client; until the broker holds an entry that cannot be, so the step waits.
+        (!inAppSignIn(org) ||
+            Boolean(recordedIds[SIGN_IN_LOGIN_APP_SCOPE_KEY]) ||
+            !brokerHoldsAnEntry) &&
         !signinDbCertDue(recordedIds, options.now ?? Date.now()) &&
         !signinDbBackupMissing(recordedIds) &&
         // ZITADEL was started on the TLS database and never seen healthy there: the step starts it again.

package/dist/plan/platform-diff.js

@@ -11,6 +11,7 @@ import { PLATFORM_MAIL_RELAY_KEY, planMailRelay } from './mail-relay.js';
 import { MAIL_DATABASE_SCOPE_KEY, mailStoreIsLegacy, mailStoreSwitchChange, mailStoreSwitchDescription, } from './mail-store.js';
 import { planOikosIngress } from './oikos-ingress.js';
 import { callsSfuAppliedFingerprint } from './platform-sfu.js';
+import { archonInAppHost } from './sign-in-archon.js';
 import { signInDomainBlockedText } from './sign-in-org.js';
 import { withStepSystem } from './step-system.js';
 /**
@@ -3055,6 +3056,9 @@ function planArchon(platform, recordedIds, executorBlocked, ownerSignIn, ownerFi
         recordedIds[PLATFORM_ARCHON_APPLIED_CI_ORG_SCOPE_KEY] === ownerSignIn.organisationId &&
         (recordedIds[PLATFORM_ARCHON_APPLIED_FIRST_OWNER_LINK_SCOPE_KEY] ?? '') ===
             archonFirstOwnerLink(recordedIds, ownerSignIn) &&
+        // In-app sign-in: Archon's own address is the sign-in address only once the owner company has the
+        // switch on and its in-app login is applied, and goes back to the company's login host when it does not.
+        archonInAppHost(recordedIds) === (ownerSignIn.signInInApp ? platform.archon.hostname : '') &&
         recordedIds[PLATFORM_ARCHON_APP_KEY_ORG_SCOPE_KEY] === archonOrgId &&
         !recordedIds[PLATFORM_ARCHON_RETIRED_CLIENT_SCOPE_KEY] &&
         Boolean(recordedIds[PLATFORM_ARCHON_ACCESS_PIN_SCOPE_KEY]) &&

package/dist/plan/platform-org.d.ts

@@ -102,6 +102,8 @@ export interface OrgPlatformReadiness {
      * platform's, not as strangers. Absent when none is recorded.
      */
     platformZitadelIds?: readonly string[];
+    /** The second login app that serves `/sign-in` for companies with `signIn.inApp` is applied. Absent reads as false. */
+    signInLoginReady?: boolean;
     /** The platform's own sign-in (#168), which every org's own ZITADEL org lives inside. */
     authReady: boolean;
     /**
@@ -310,6 +312,10 @@ export interface OwnerSignIn {
      * is declared, absent while the owner step has recorded nothing.
      */
     firstOwnerUserId?: string | null;
+    /** The company's in-app login app (`<slug>-auth-login-sign-in`), once it is applied. Absent before. */
+    signInLoginAppId?: string;
+    /** True when the company has `signIn.inApp` and that login app is applied: Archon signs in on its own address. */
+    signInInApp?: true;
 }
 /** The owner company's own files host, as Archon's `FILES_*` env reads it. */
 export interface OwnerFiles {

package/dist/plan/platform-org.js

@@ -7,6 +7,7 @@ import { oikosIngressApplied } from './oikos-ingress.js';
 import { ownHostnames } from './own-hostnames.js';
 import { OWN_SERVICES_APPLIED_SCOPE_KEY, orgTarget } from './own-services.js';
 import { JOBS_INTERNAL_URL_SCOPE_KEY, JOBS_SCHEDULER_KEY, PLATFORM_ACCESS_ZITADEL_APP_SCOPE_KEY, PLATFORM_ACCESS_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_AI_KEY, PLATFORM_AI_TUNNEL_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_BROKER_SCOPE_KEY, PLATFORM_ARCHON_ZITADEL_APP_SCOPE_KEY, PLATFORM_ARCHON_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_AUTH_BROKER_SCOPE_KEY, PLATFORM_AUTH_KEY, PLATFORM_EDGE_KEY, PLATFORM_FILES_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, PLATFORM_FILES_KEY, PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY, PLATFORM_MAIL_KEY, PLATFORM_MAIL_ZITADEL_PROJECT_SCOPE_KEY, platformMailMxHost, } from './platform-diff.js';
+import { SIGN_IN_LOGIN_APP_SCOPE_KEY, inAppSignIn } from './sign-in.js';
 /**
  * #443: the no-domain company mail apex -- `<slug>.oikos.host`, the same
  * fixed suffix `agora.ts`'s `agoraHostnameFor`, `boule.ts`'s
@@ -159,6 +160,7 @@ edgePortPresent = false) {
         ...(coolifyAppApplied(platformRecordedIds, PLATFORM_AUTH_KEY)
             ? { platformAuthRecordedHost: platform.auth.hostname }
             : {}),
+        ...(platformRecordedIds[SIGN_IN_LOGIN_APP_SCOPE_KEY] ? { signInLoginReady: true } : {}),
         authReady,
         authIssuer: authReady ? `https://${platform.auth.hostname}` : null,
         jobsReady: jobsApplied && jobsUrl !== undefined && missingKeys.jobs === null,
@@ -314,6 +316,7 @@ export function ownerSignInFrom(owner, recorded) {
     if (!applied || applied !== ownHostnames(owner).auth)
         return null;
     const hostname = applied;
+    const signInLoginAppId = recorded[SIGN_IN_LOGIN_APP_SCOPE_KEY];
     return {
         issuerUrl: `https://${applied}`,
         organisationId,
@@ -321,6 +324,8 @@ export function ownerSignInFrom(owner, recorded) {
         bearerRef: orgTarget(owner).refs.instanceBearer,
         hostname,
         firstOwnerUserId: platformOwnerUserIdFrom(owner, recorded),
+        ...(signInLoginAppId ? { signInLoginAppId } : {}),
+        ...(signInLoginAppId && inAppSignIn(owner) ? { signInInApp: true } : {}),
     };
 }
 /**

package/dist/plan/platform-providers.d.ts

@@ -408,6 +408,14 @@ export declare class FoundryPlatformStepExecutor implements PlatformStepExecutor
      * (or the runner was never applied).
      */
     refreshFilesShare(_platform: DeclaredPlatform, recordedIds: Readonly<Record<string, string>>): Promise<Record<string, string> | null>;
+    /** True while a company signs in on its apps' own addresses through the platform's login. */
+    private signInLoginWanted;
+    /**
+     * In-app sign-in: the login app that serves `/sign-in` is wanted and either not recorded, gone from
+     * Coolify, or holding a host table other than the login's. The step then plans again and repairs it.
+     * A Coolify read that fails counts as not drifted, with one fixed log line (the error can carry values).
+     */
+    private signInLoginDrifted;
     execute(action: StepAction, context: PlatformStepExecutionContext): Promise<{
         resourceId?: string;
     } | undefined>;
@@ -510,6 +518,13 @@ export interface AuthStackInput {
     defaultRedirectUri: string | null;
     /** The company whose owner is invited into its own sign-in org; null for a company's own stack. */
     ownerCompany: DeclaredOrg | null;
+    /**
+     * In-app sign-in: a second login app serves `/sign-in` next to the login app. Absent: none is made.
+     * `bindings` is its `LOGIN_HOST_BINDINGS` document; `null` copies the login app's live one.
+     */
+    signInLogin?: {
+        bindings: string | null;
+    };
 }
 /**
  * #168: makes `coolify:app` keyed {@link PLATFORM_AUTH_KEY} true -- a Coolify
@@ -890,7 +905,7 @@ export interface PlatformArchonDeps {
     access: PlatformAccessFactory;
     cloudflare: Pick<CloudflarePort, 'findZoneByApex'>;
     /** Must target the platform's own ZITADEL instance, or `zitadelForInstance` must be set. */
-    zitadel: Pick<ZitadelPort, 'findOrCreateOrg' | 'findOrCreateProject' | 'createOidcApp' | 'listApps' | 'deleteApp' | 'updateOidcAppIdTokenUserinfoAssertion'>;
+    zitadel: Pick<ZitadelPort, 'findOrCreateOrg' | 'findOrCreateProject' | 'createOidcApp' | 'listApps' | 'deleteApp' | 'updateOidcAppIdTokenUserinfoAssertion'> & Partial<Pick<ZitadelPort, 'ensureTrustedDomain' | 'deleteTrustedDomain' | 'updateOidcAppLoginBaseUri' | 'allowPerAppLoginBaseUri'>>;
     /**
      * {@link PlatformAuthDeps.zitadelForInstance}, for Archon's sign-in client:
      * the owner company's own ZITADEL, by its issuer and the held-key reference of