@wtfalch/foundry 0.54.0 → 0.55.0

package/dist/plan/diff.js

@@ -18,7 +18,7 @@ import { hasWildcardGate, planGates } from './gates.js';
 import { appHostname, tunnelDnsHostnames } from './hostnames.js';
 import { APP_GONE_KIND } from './live.js';
 import { lockedHostnames } from './locked-hostnames.js';
-import { LOGIN_BINDING_SCOPE_KEY, LOGIN_CLIENT_ORGS_SCOPE_KEY, agoraIssuerHostFor, clientOrganizationsState, companyLoginTunnelHost, customersClientOrganizations, inAppApps, loginBindingState, loginHostClientIds, loginHostServesAgora, loginHostnameFor, ownAuthApplied, pendingRemovalHosts, } from './login-host.js';
+import { LOGIN_BINDING_SCOPE_KEY, LOGIN_CLIENT_ORGS_SCOPE_KEY, OWN_CUSTOMERS_BASE_URI_SCOPE_KEY, agoraIssuerHostFor, clientOrganizationsState, companyLoginTunnelHost, customersClientOrganizations, inAppApps, loginBindingState, loginHostClientIds, loginHostServesAgora, loginHostnameFor, ownAuthApplied, ownCustomersAppState, pendingRemovalHosts, } from './login-host.js';
 import { MAIL_COPY_COMPLETED_SCOPE_KEY, MAIL_COPY_DONE_SCOPE_KEY, parseMailCopyCompleted, } from './mail-copy.js';
 import { mailStoreSwitchChange } from './mail-store.js';
 import { planMcp } from './mcp.js';
@@ -1394,8 +1394,13 @@ function planOwnLoginHost(org, recordedIds, gates) {
     const none = { step: null, blocked: null };
     const mapOwed = clientOrganizationsOwed(org, recordedIds, true);
     // Nothing wanted and nothing owed.
-    if (!inAppSignIn(org) && !recordedIds[SIGN_IN_IN_APP_SCOPE_KEY] && !mapOwed)
+    // A customers entry's app owes its base URI (the company's login host) until the marker names it.
+    const customersOwed = Boolean(recordedIds[SIGN_IN_LOGIN_APP_SCOPE_KEY]) &&
+        ownCustomersAppState(org, recordedIds) !==
+            (recordedIds[OWN_CUSTOMERS_BASE_URI_SCOPE_KEY] ?? '');
+    if (!inAppSignIn(org) && !recordedIds[SIGN_IN_IN_APP_SCOPE_KEY] && !mapOwed && !customersOwed) {
         return none;
+    }
     // The company's own sign-in is reported on its own line (`coolify:own-auth`).
     if (!ownAuthApplied(org, recordedIds))
         return none;
@@ -1411,6 +1416,7 @@ function planOwnLoginHost(org, recordedIds, gates) {
     if ((recordedIds[SIGN_IN_TRUSTED_SCOPE_KEY] ?? '') === targets.trusted &&
         (recordedIds[SIGN_IN_IN_APP_SCOPE_KEY] ?? '') === targets.active &&
         !mapOwed &&
+        !customersOwed &&
         pendingRemovalHosts(recordedIds).length === 0) {
         return { step: null, blocked: waiting };
     }

package/dist/plan/executor.js

@@ -37,7 +37,7 @@ import { GATE_CLAIM_NAME, gateHostnamesScopeKey, gateIdRecordKey, isBehindGate }
 import { IMAGE_HEALTHCHECK_SETTINGS, commandHealthCheckSettings, healthCheckSettings, wgetProbe, } from './health-check-settings.js';
 import { PROXY_LABEL_TOKEN_REF } from './held-key-refs.js';
 import { appHostname, cmsStudioHostnameFor, coolifyTunnelDomains, entryHostnames, siteHostnameFor, tunnelDnsHostnames, tunnelIngressHostnames, } from './hostnames.js';
-import { LOGIN_BINDING_SCOPE_KEY, LOGIN_CLIENT_ORGS_SCOPE_KEY, LOGIN_HOST_PENDING_REMOVAL_SCOPE_KEY, LOGIN_HOST_SHARED_SCOPE_KEY, clientOrganizationIds, clientOrganizationsState, customersClientOrganizations, customersEntryKeys, loginBindingState, loginHostClientIds, ownAuthApplied, pendingRemovalHosts, pendingRemovalState, } from './login-host.js';
+import { LOGIN_BINDING_SCOPE_KEY, LOGIN_CLIENT_ORGS_SCOPE_KEY, LOGIN_HOST_PENDING_REMOVAL_SCOPE_KEY, LOGIN_HOST_SHARED_SCOPE_KEY, OWN_CUSTOMERS_BASE_URI_SCOPE_KEY, clientOrganizationIds, clientOrganizationsState, customersClientOrganizations, customersEntryKeys, loginBindingState, loginHostClientIds, ownAuthApplied, pendingRemovalHosts, pendingRemovalState, } from './login-host.js';
 import { MAIL_COPY_COMPLETED_SCOPE_KEY, MAIL_COPY_DONE_SCOPE_KEY, parseMailCopyCompleted, runMailCopyStep, } from './mail-copy.js';
 import { OWN_MAIL_SMTP_INTERNAL_SCOPE_KEY, OWN_MAIL_SMTP_PORT_SCOPE_KEY, isOwnMailSmtpPort, normalizeMailTarget, } from './mail-relay.js';
 import { applyAccessTokenLifetime, applyMcpAccess, applyMcpProject } from './mcp.js';
@@ -2268,6 +2268,17 @@ export class FoundryStepExecutor {
                     customersAppIds.add(appId);
             }
         }
+        // A company's own instance: a customers entry's app signs in on the company's login host. Without a base
+        // URI of its own it falls back to the v1 login once in-app sign-in turns `loginV2.required` off.
+        const ownCustomersAppIds = new Set();
+        if (own) {
+            for (const key of customersKeys) {
+                const appId = recorded[`zitadel:app:${key}`];
+                if (appId)
+                    ownCustomersAppIds.add(appId);
+            }
+        }
+        const ownCustomersSet = [];
         if (projectId) {
             const listed = await this.ports.zitadel.listApps(zitadelOrgId, projectId);
             listingComplete = listed.complete;
@@ -2277,6 +2288,11 @@ export class FoundryStepExecutor {
                     await setOidcAppLoginBaseUri(this.ports.zitadel, zitadelOrgId, projectId, app.id, sharedBaseUri);
                     continue;
                 }
+                if (ownCustomersAppIds.has(app.id)) {
+                    await setOidcAppLoginBaseUri(this.ports.zitadel, zitadelOrgId, projectId, app.id, `https://${host}/`);
+                    ownCustomersSet.push(app.id);
+                    continue;
+                }
                 if (!boundAppIds.has(app.id))
                     continue;
                 // A company's own instance has the login host as its default; only the in-app apps move.
@@ -2317,9 +2333,11 @@ export class FoundryStepExecutor {
         for (const app of liveApps) {
             const uri = customersAppIds.has(app.id) && sharedBaseUri
                 ? sharedBaseUri
-                : boundAppIds.has(app.id)
-                    ? baseUriOf(app.id)
-                    : app.loginBaseUri;
+                : ownCustomersAppIds.has(app.id)
+                    ? `https://${host}/`
+                    : boundAppIds.has(app.id)
+                        ? baseUriOf(app.id)
+                        : app.loginBaseUri;
             if (typeof uri === 'string')
                 currentLoginBaseUris.add(normalizedLoginBaseUri(uri));
         }
@@ -2413,6 +2431,10 @@ export class FoundryStepExecutor {
         if (orgsWritable) {
             context.recordScopeId(LOGIN_CLIENT_ORGS_SCOPE_KEY, clientOrganizationsState(wantedOrgs));
         }
+        if (own) {
+            // Written last: a failed base URI write leaves it behind and the step is planned again.
+            context.recordScopeId(OWN_CUSTOMERS_BASE_URI_SCOPE_KEY, ownCustomersSet.sort().join(','));
+        }
         context.recordScopeId(LOGIN_HOST_PENDING_REMOVAL_SCOPE_KEY, pendingRemovalState(stillPending));
         return { resourceId: host };
     }

package/dist/plan/login-host.d.ts

@@ -184,6 +184,14 @@ export declare const LOGIN_CLIENT_ORGS_SCOPE_KEY = "login_client_orgs";
  * recorded. Staff clients are not here.
  */
 export declare function customersClientOrganizations(org: DeclaredOrg, recorded: Readonly<Record<string, string>>): Record<string, string>;
+/**
+ * Scope id holding the ZITADEL app ids of an own org's customers entries whose Login V2 base URI was set to the
+ * company's login host (sorted, joined by `,`). On the company's own instance an app with no base URI of its own
+ * falls back to the v1 login once in-app sign-in turns `loginV2.required` off. Absent or empty means none.
+ */
+export declare const OWN_CUSTOMERS_BASE_URI_SCOPE_KEY = "own_customers_login_base_uri";
+/** The recorded ZITADEL app ids of the org's customers entries, sorted and joined by `,` ('' when none). */
+export declare function ownCustomersAppState(org: DeclaredOrg, recorded: Readonly<Record<string, string>>): string;
 /** {@link LOGIN_CLIENT_ORGS_SCOPE_KEY}'s value for a map. */
 export declare function clientOrganizationsState(map: Readonly<Record<string, string>>): string;
 /** The client ids a recorded {@link LOGIN_CLIENT_ORGS_SCOPE_KEY} value holds. */

package/dist/plan/login-host.js

@@ -211,6 +211,20 @@ export function customersClientOrganizations(org, recorded) {
     }
     return map;
 }
+/**
+ * Scope id holding the ZITADEL app ids of an own org's customers entries whose Login V2 base URI was set to the
+ * company's login host (sorted, joined by `,`). On the company's own instance an app with no base URI of its own
+ * falls back to the v1 login once in-app sign-in turns `loginV2.required` off. Absent or empty means none.
+ */
+export const OWN_CUSTOMERS_BASE_URI_SCOPE_KEY = 'own_customers_login_base_uri';
+/** The recorded ZITADEL app ids of the org's customers entries, sorted and joined by `,` ('' when none). */
+export function ownCustomersAppState(org, recorded) {
+    return [...customersEntryKeys(org)]
+        .map((key) => recorded[`zitadel:app:${key}`])
+        .filter((id) => Boolean(id))
+        .sort()
+        .join(',');
+}
 /** {@link LOGIN_CLIENT_ORGS_SCOPE_KEY}'s value for a map. */
 export function clientOrganizationsState(map) {
     return Object.entries(map)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wtfalch/foundry",
-  "version": "0.54.0",
+  "version": "0.55.0",
   "description": "Foundry's SDK: the declared org's types, the plan and apply contracts, and the state store's interface.",
   "repository": {
     "type": "git",