slotlock 0.8.0 → 0.10.0

package/workspace-scim.d.ts

@@ -0,0 +1,89 @@
+import type { SlotlockScimGroupAttributes, SlotlockScimUserAttributes } from './scim.js';
+import type { SlotlockSql } from './store.js';
+/** A SCIM token: `slk_scim_` and 256 random bits in hex. */
+export declare const SLOTLOCK_SCIM_TOKEN: RegExp;
+export type SlotlockScimRefusal = 'not_found' | 'not_allowed' | 'not_enabled' | 'no_verified_domain' | 'key_policy' | 'token_limit' | 'bad_token' | 'wrong_workspace' | 'domain_not_verified' | 'uniqueness' | 'owner_protected' | 'invalid_member' | 'owner_not_mappable' | 'role_not_allowed';
+/** A directory user as kept, with its id and times. */
+export interface SlotlockScimUser extends SlotlockScimUserAttributes {
+    id: string;
+    createdAt: Date;
+    updatedAt: Date;
+}
+export interface SlotlockScimGroup extends SlotlockScimGroupAttributes {
+    id: string;
+    createdAt: Date;
+    updatedAt: Date;
+    /** The role an Owner mapped the group to (reserved names map themselves), or null. Not part of SCIM. */
+    role: string | null;
+}
+/** A filter as the endpoint passes it: one attribute (username, externalid, id, email / displayname). */
+export type SlotlockScimLookup = {
+    attribute: string;
+    value: string;
+} | null;
+export interface SlotlockWorkspaceScim {
+    enable(tenantRef: string, actor: string, keyPolicy: 'keep' | 'revoke'): Promise<SlotlockScimRefusal | null>;
+    disable(tenantRef: string, actor: string): Promise<SlotlockScimRefusal | null>;
+    /** A new token, shown once: the raw value, or why not. */
+    createToken(tenantRef: string, actor: string): Promise<{
+        token: string;
+        prefix: string;
+    } | {
+        refusal: SlotlockScimRefusal;
+    }>;
+    revokeToken(tenantRef: string, actor: string, id: string): Promise<SlotlockScimRefusal | null>;
+    state(tenantRef: string): Promise<{
+        enabled: boolean;
+        keyPolicy: 'keep' | 'revoke' | null;
+        tokens: {
+            id: string;
+            prefix: string;
+            createdAt: Date;
+            lastUsedAt: Date | null;
+        }[];
+    }>;
+    /** A request's token, for the team its address names. */
+    authenticate(token: string, teamId: string): Promise<{
+        tenantRef: string;
+        prefix: string;
+        keyPolicy: 'keep' | 'revoke';
+    } | {
+        refusal: 'bad_token' | 'wrong_workspace';
+        tenantRef?: string;
+        prefix?: string;
+    }>;
+    putUser(tenantRef: string, id: string | null, newId: string, user: SlotlockScimUserAttributes): Promise<{
+        id: string;
+        membership: 'none' | 'deactivated' | 'activated';
+        person: string | null;
+    } | {
+        refusal: SlotlockScimRefusal;
+        person?: string | null;
+    }>;
+    users(tenantRef: string, lookup: SlotlockScimLookup, startIndex: number, count: number, id?: string): Promise<{
+        users: SlotlockScimUser[];
+        total: number;
+    }>;
+    deleteUser(tenantRef: string, id: string): Promise<{
+        refusal: SlotlockScimRefusal | null;
+        person: string | null;
+    }>;
+    putGroup(tenantRef: string, id: string | null, newId: string, group: SlotlockScimGroupAttributes): Promise<{
+        id: string;
+    } | {
+        refusal: SlotlockScimRefusal;
+    }>;
+    groups(tenantRef: string, lookup: SlotlockScimLookup, startIndex: number, count: number, id?: string): Promise<{
+        groups: SlotlockScimGroup[];
+        total: number;
+    }>;
+    deleteGroup(tenantRef: string, id: string): Promise<SlotlockScimRefusal | null>;
+    mapGroup(tenantRef: string, actor: string, id: string, role: string | null): Promise<SlotlockScimRefusal | null>;
+    /**
+     * A sign-in holding addresses the domain vouches for: the directory users at them bind to the
+     * person. `freeCap` is the member cap of a team on the free plan, where plans apply, else null.
+     */
+    bind(person: string, emails: readonly string[], freeCap?: number | null): Promise<string[]>;
+}
+/** Through the functions of ddl-scim.ts. */
+export declare function createSlotlockWorkspaceScim(sql: SlotlockSql): SlotlockWorkspaceScim;

package/workspace-scim.js

@@ -0,0 +1,157 @@
+// A team's directory (SCIM 2.0) as the dashboard and its SCIM endpoint reach it (teams phase
+// 5.6–5.7): through the SECURITY DEFINER functions of ddl-scim.ts. Tokens are made here and shown
+// once; only their SHA-256 reaches the database.
+import { createHash, randomBytes } from 'node:crypto';
+const TEAM = /^team:[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
+const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+/** A SCIM token: `slk_scim_` and 256 random bits in hex. */
+export const SLOTLOCK_SCIM_TOKEN = /^slk_scim_[0-9a-f]{64}$/;
+const digest = (token) => createHash('sha256').update(token, 'utf8').digest();
+const refusalOf = (value) => value === null || value === undefined ? null : value;
+/** Through the functions of ddl-scim.ts. */
+export function createSlotlockWorkspaceScim(sql) {
+    return {
+        async enable(tenantRef, actor, keyPolicy) {
+            const [row] = await sql `SELECT slotlock.enable_scim(${tenantRef}::text, ${actor}::text, ${keyPolicy}::text) AS refusal`;
+            return refusalOf(row?.refusal);
+        },
+        async disable(tenantRef, actor) {
+            const [row] = await sql `SELECT slotlock.disable_scim(${tenantRef}::text, ${actor}::text) AS refusal`;
+            return refusalOf(row?.refusal);
+        },
+        async createToken(tenantRef, actor) {
+            const token = `slk_scim_${randomBytes(32).toString('hex')}`;
+            const prefix = token.slice(0, 'slk_scim_'.length + 4);
+            const [row] = await sql `
+        SELECT slotlock.create_scim_token(${tenantRef}::text, ${actor}::text, ${digest(token)}::bytea, ${prefix}::text) AS refusal`;
+            return row?.refusal ? { refusal: refusalOf(row.refusal) ?? 'not_allowed' } : { token, prefix };
+        },
+        async revokeToken(tenantRef, actor, id) {
+            if (!UUID.test(id))
+                return 'not_found';
+            const [row] = await sql `SELECT slotlock.revoke_scim_token(${tenantRef}::text, ${actor}::text, ${id}::uuid) AS refusal`;
+            return refusalOf(row?.refusal);
+        },
+        async state(tenantRef) {
+            const rows = await sql `
+        SELECT * FROM slotlock.scim_state(${tenantRef}::text)`;
+            return {
+                enabled: rows[0]?.enabled === true,
+                keyPolicy: rows[0]?.key_policy ?? null,
+                tokens: rows.flatMap((row) => row.token_id && row.prefix && row.created_at ? [{ id: row.token_id, prefix: row.prefix, createdAt: row.created_at, lastUsedAt: row.last_used_at }] : []),
+            };
+        },
+        async authenticate(token, teamId) {
+            if (!SLOTLOCK_SCIM_TOKEN.test(token) || !UUID.test(teamId))
+                return { refusal: 'bad_token' };
+            const [row] = await sql `
+        SELECT * FROM slotlock.scim_authenticate(${digest(token)}::bytea, ${`team:${teamId.toLowerCase()}`}::text)`;
+            if (!row || row.refusal === 'bad_token' || (row.refusal === null && (!row.team_ref || !row.key_policy)))
+                return { refusal: 'bad_token' };
+            if (row.refusal === 'wrong_workspace') {
+                return { refusal: 'wrong_workspace', ...(row.team_ref ? { tenantRef: row.team_ref } : {}), ...(row.token_prefix ? { prefix: row.token_prefix } : {}) };
+            }
+            return { tenantRef: row.team_ref, prefix: row.token_prefix, keyPolicy: row.key_policy };
+        },
+        async putUser(tenantRef, id, newId, user) {
+            if (!TEAM.test(tenantRef) || (id !== null && !UUID.test(id)) || !UUID.test(newId))
+                return { refusal: 'not_found' };
+            const [row] = await sql `
+        SELECT * FROM slotlock.scim_put_user(${tenantRef}::text, ${id}::uuid, ${newId}::uuid, ${user.userName}::text,
+          ${user.externalId}::text, ${user.active}::boolean, ${user.givenName}::text, ${user.familyName}::text,
+          ${user.displayName}::text, ${user.workEmail}::text)`;
+            if (!row || row.refusal)
+                return { refusal: refusalOf(row?.refusal) ?? 'not_found', person: row?.person ?? null };
+            return {
+                id: row.user_id,
+                membership: row.membership === 'deactivated' || row.membership === 'activated' ? row.membership : 'none',
+                person: row.person,
+            };
+        },
+        async users(tenantRef, lookup, startIndex, count, id) {
+            if (!TEAM.test(tenantRef) || (id !== undefined && !UUID.test(id)))
+                return { users: [], total: 0 };
+            const rows = await sql `SELECT * FROM slotlock.scim_users_list(${tenantRef}::text, ${lookup?.attribute ?? null}::text, ${lookup?.value ?? null}::text,
+          ${startIndex}::integer, ${count}::integer, ${id ?? null}::uuid)`;
+            // A page past the end (or count=0) has no rows to carry the total: one row from the start does.
+            const total = rows[0]?.total ??
+                (startIndex > 1 || count === 0
+                    ? ((await sql `SELECT total FROM slotlock.scim_users_list(${tenantRef}::text, ${lookup?.attribute ?? null}::text,
+                ${lookup?.value ?? null}::text, 1, 1, ${id ?? null}::uuid)`)[0]?.total ?? 0)
+                    : 0);
+            return {
+                total: Number(total),
+                users: rows.map((row) => ({
+                    id: row.user_id,
+                    userName: row.user_name,
+                    externalId: row.external_id,
+                    active: row.active,
+                    givenName: row.given_name,
+                    familyName: row.family_name,
+                    displayName: row.display_name,
+                    workEmail: row.work_email,
+                    createdAt: row.created_at,
+                    updatedAt: row.updated_at,
+                })),
+            };
+        },
+        async deleteUser(tenantRef, id) {
+            if (!UUID.test(id))
+                return { refusal: 'not_found', person: null };
+            const [row] = await sql `SELECT * FROM slotlock.scim_delete_user(${tenantRef}::text, ${id}::uuid)`;
+            return { refusal: refusalOf(row?.refusal), person: row?.person ?? null };
+        },
+        async putGroup(tenantRef, id, newId, group) {
+            if (!TEAM.test(tenantRef) || (id !== null && !UUID.test(id)) || !UUID.test(newId))
+                return { refusal: 'not_found' };
+            if (!group.members.every((member) => UUID.test(member)))
+                return { refusal: 'invalid_member' };
+            const [row] = await sql `
+        SELECT * FROM slotlock.scim_put_group(${tenantRef}::text, ${id}::uuid, ${newId}::uuid, ${group.displayName}::text,
+          ${group.externalId}::text, ${group.members}::uuid[])`;
+            return row?.group_id && !row.refusal ? { id: row.group_id } : { refusal: refusalOf(row?.refusal) ?? 'not_found' };
+        },
+        async groups(tenantRef, lookup, startIndex, count, id) {
+            if (!TEAM.test(tenantRef) || (id !== undefined && !UUID.test(id)))
+                return { groups: [], total: 0 };
+            const rows = await sql `SELECT * FROM slotlock.scim_groups_list(${tenantRef}::text, ${lookup?.attribute ?? null}::text, ${lookup?.value ?? null}::text,
+          ${startIndex}::integer, ${count}::integer, ${id ?? null}::uuid)`;
+            const total = rows[0]?.total ??
+                (startIndex > 1 || count === 0
+                    ? ((await sql `SELECT total FROM slotlock.scim_groups_list(${tenantRef}::text, ${lookup?.attribute ?? null}::text,
+                ${lookup?.value ?? null}::text, 1, 1, ${id ?? null}::uuid)`)[0]?.total ?? 0)
+                    : 0);
+            return {
+                total: Number(total),
+                groups: rows.map((row) => ({
+                    id: row.group_id,
+                    displayName: row.display_name,
+                    externalId: row.external_id,
+                    members: row.members,
+                    createdAt: row.created_at,
+                    updatedAt: row.updated_at,
+                    role: row.mapped_role,
+                })),
+            };
+        },
+        async deleteGroup(tenantRef, id) {
+            if (!UUID.test(id))
+                return 'not_found';
+            const [row] = await sql `SELECT slotlock.scim_delete_group(${tenantRef}::text, ${id}::uuid) AS refusal`;
+            return refusalOf(row?.refusal);
+        },
+        async mapGroup(tenantRef, actor, id, role) {
+            if (!UUID.test(id))
+                return 'not_found';
+            const [row] = await sql `
+        SELECT slotlock.map_scim_group_role(${tenantRef}::text, ${actor}::text, ${id}::uuid, ${role}::text) AS refusal`;
+            return refusalOf(row?.refusal);
+        },
+        async bind(person, emails, freeCap) {
+            if (emails.length === 0)
+                return [];
+            const rows = await sql `SELECT team_ref FROM slotlock.scim_bind(${person}::text, ${[...emails].slice(0, 10)}::text[], ${freeCap ?? null}::integer)`;
+            return rows.map((row) => row.team_ref);
+        },
+    };
+}

package/workspace-sso.d.ts

@@ -0,0 +1,131 @@
+import type { SlotlockOidcAlgorithm } from './oidc.js';
+import type { SlotlockSql } from './store.js';
+import { type SlotlockWorkspaceRole } from './workspace-roles.js';
+/** The providers a team may connect: their own rules apply (oidc.ts, dashboard). */
+export type SlotlockSsoKind = 'okta' | 'entra' | 'google_workspace' | 'oidc';
+/** Why a change to a team's single sign-on, or a sign-in through it, was refused. */
+export type SlotlockSsoRefusal = 'not_found' | 'not_allowed' | 'no_verified_domain' | 'secret_required' | 'conflict' | 'stale_config' | 'untested' | 'no_breakglass_owner' | 'role_not_allowed' | 'owner_not_mappable' | 'invalid_value' | 'mapping_limit' | 'connection_inactive' | 'guest_refused' | 'not_member' | 'identity_taken' | 'identity_untrusted' | 'hd_mismatch' | 'member_cap' | 'invalid_max_age' | 'no_active_connection' | 'stale_sso_proof';
+/** A team's connection, as saved. */
+export interface SlotlockSsoConnection {
+    id: string;
+    kind: SlotlockSsoKind;
+    status: 'draft' | 'tested' | 'active' | 'disabled';
+    issuer: string;
+    clientId: string;
+    /** The client secret as sealed (null for Google Workspace, which uses Slotlock's own client). */
+    secretSealed: string | null;
+    secretLast4: string | null;
+    authorizationEndpoint: string;
+    tokenEndpoint: string;
+    jwksUri: string;
+    algorithms: SlotlockOidcAlgorithm[];
+    issParameter: boolean;
+    entraTenant: string | null;
+    groupsClaim: string;
+    jitEnabled: boolean;
+    defaultRole: 'viewer' | 'member' | 'developer';
+    configVersion: number;
+    testedVersion: number | null;
+    lastTestedAt: Date | null;
+    lastTestClaims: Record<string, unknown> | null;
+    requireSso: boolean;
+    maxAgeHours: number;
+}
+/** A connection as its callback reads it: with its team. */
+export interface SlotlockSsoConnectionForSignIn {
+    id: string;
+    tenantRef: string;
+    handle: string;
+    name: string;
+    kind: SlotlockSsoKind;
+    status: SlotlockSsoConnection['status'];
+    issuer: string;
+    clientId: string;
+    secretSealed: string | null;
+    tokenEndpoint: string;
+    jwksUri: string;
+    algorithms: SlotlockOidcAlgorithm[];
+    issParameter: boolean;
+    entraTenant: string | null;
+    groupsClaim: string;
+    configVersion: number;
+}
+/** What a sign-in through a team's provider gave: who, and what happened. */
+export interface SlotlockSsoSignIn {
+    person: string | null;
+    /** `joined`, `signed_in`, `role_changed` (alone); `linked`, `proof` (signed in already). */
+    outcome: 'joined' | 'signed_in' | 'role_changed' | 'linked' | 'proof' | null;
+    refusal: SlotlockSsoRefusal | null;
+    role: SlotlockWorkspaceRole | null;
+}
+export interface SlotlockWorkspaceSso {
+    connection(tenantRef: string): Promise<SlotlockSsoConnection | null>;
+    connectionById(id: string): Promise<SlotlockSsoConnectionForSignIn | null>;
+    /** A team's active connection, by its handle or a domain it holds verified. */
+    route(by: {
+        handle?: string;
+        domain?: string;
+    }): Promise<{
+        id: string;
+        tenantRef: string;
+        handle: string;
+        name: string;
+        authorizationEndpoint: string;
+        clientId: string;
+        kind: SlotlockSsoKind;
+        entraTenant: string | null;
+    } | null>;
+    save(params: {
+        tenantRef: string;
+        actor: string;
+        id: string;
+        kind: SlotlockSsoKind;
+        issuer: string;
+        clientId: string;
+        secretSealed: string | null;
+        secretLast4: string | null;
+        authorizationEndpoint: string;
+        tokenEndpoint: string;
+        jwksUri: string;
+        algorithms: readonly SlotlockOidcAlgorithm[];
+        issParameter: boolean;
+        entraTenant: string | null;
+    }): Promise<{
+        id: string;
+        enforcementOff: boolean;
+    } | {
+        refusal: SlotlockSsoRefusal;
+        id?: string;
+    }>;
+    recordTest(tenantRef: string, actor: string, id: string, version: number, claims: Record<string, unknown>): Promise<SlotlockSsoRefusal | null>;
+    setStatus(tenantRef: string, actor: string, id: string, status: 'active' | 'disabled'): Promise<SlotlockSsoRefusal | null>;
+    remove(tenantRef: string, actor: string, id: string): Promise<SlotlockSsoRefusal | null>;
+    setProvisioning(tenantRef: string, actor: string, jit: boolean, defaultRole: string, groupsClaim: string): Promise<SlotlockSsoRefusal | null>;
+    setMapping(tenantRef: string, actor: string, value: string, role: string | null): Promise<SlotlockSsoRefusal | null>;
+    mappings(tenantRef: string): Promise<{
+        value: string;
+        role: SlotlockWorkspaceRole;
+    }[]>;
+    signIn(params: {
+        connectionId: string;
+        issuer: string;
+        subject: string;
+        entraTid: string | null;
+        entraOid: string | null;
+        email: string | null;
+        emailOk: boolean;
+        groups: readonly string[];
+        overage: boolean;
+        guest: boolean;
+        sessionPerson: string | null;
+        memberCap: number | null;
+    }): Promise<SlotlockSsoSignIn>;
+    /** A session's proof from the connection, now; `scoped` for a session begun through it alone. */
+    /** `configVersion`: the connection's configuration the sign-in went through, where known. */
+    recordProof(sid: string, person: string, connectionId: string, scoped: boolean, configVersion?: number): Promise<boolean>;
+    requireSso(tenantRef: string, actor: string, sid: string, on: boolean, maxAgeHours: number): Promise<SlotlockSsoRefusal | null>;
+    bypass(tenantRef: string, person: string, sid: string): Promise<SlotlockSsoRefusal | null>;
+    prune(): Promise<number>;
+}
+/** Through the functions of ddl-sso.ts. */
+export declare function createSlotlockWorkspaceSso(sql: SlotlockSql): SlotlockWorkspaceSso;

package/workspace-sso.js

@@ -0,0 +1,180 @@
+// A team's single sign-on as the dashboard reaches it (teams phase 5.3–5.5): through the SECURITY
+// DEFINER functions of ddl-sso.ts, which check the actor's role, lock the team and decide whom a
+// provider's sign-in is. Tokens are checked before (oidc.ts); secrets are sealed before (oidc.ts
+// createSlotlockSecretBox), so only a sealed secret ever reaches the database.
+import { createHash } from 'node:crypto';
+import { isSlotlockWorkspaceRole } from './workspace-roles.js';
+const TEAM = /^team:[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
+const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+const sessionDigest = (sid) => createHash('sha256').update(sid, 'utf8').digest();
+const refusalOf = (value) => value === null || value === undefined ? null : value;
+/** Through the functions of ddl-sso.ts. */
+export function createSlotlockWorkspaceSso(sql) {
+    return {
+        async connection(tenantRef) {
+            if (!TEAM.test(tenantRef))
+                return null;
+            const [row] = await sql `SELECT * FROM slotlock.sso_connection_of(${tenantRef}::text)`;
+            if (!row)
+                return null;
+            return {
+                id: row.connection_id,
+                kind: row.kind,
+                status: row.status,
+                issuer: row.issuer,
+                clientId: row.client_id,
+                secretSealed: row.secret_sealed,
+                secretLast4: row.secret_last4,
+                authorizationEndpoint: row.authorization_endpoint,
+                tokenEndpoint: row.token_endpoint,
+                jwksUri: row.jwks_uri,
+                algorithms: row.algorithms,
+                issParameter: row.iss_parameter,
+                entraTenant: row.entra_tenant,
+                groupsClaim: row.groups_claim,
+                jitEnabled: row.jit_enabled,
+                defaultRole: row.default_role,
+                configVersion: Number(row.config_version),
+                testedVersion: row.tested_version === null ? null : Number(row.tested_version),
+                lastTestedAt: row.last_tested_at,
+                lastTestClaims: row.last_test_claims,
+                requireSso: row.require_sso,
+                maxAgeHours: Number(row.sso_max_age_hours),
+            };
+        },
+        async connectionById(id) {
+            if (!UUID.test(id))
+                return null;
+            const [row] = await sql `SELECT * FROM slotlock.sso_connection_by_id(${id}::uuid)`;
+            if (!row)
+                return null;
+            return {
+                id,
+                tenantRef: row.team_ref,
+                handle: row.handle,
+                name: row.name,
+                kind: row.kind,
+                status: row.status,
+                issuer: row.issuer,
+                clientId: row.client_id,
+                secretSealed: row.secret_sealed,
+                tokenEndpoint: row.token_endpoint,
+                jwksUri: row.jwks_uri,
+                algorithms: row.algorithms,
+                issParameter: row.iss_parameter,
+                entraTenant: row.entra_tenant,
+                groupsClaim: row.groups_claim,
+                configVersion: Number(row.config_version),
+            };
+        },
+        async route(by) {
+            const handle = by.handle?.trim().toLowerCase() || null;
+            const domain = by.domain?.trim().toLowerCase() || null;
+            if (handle === null && domain === null)
+                return null;
+            const [row] = await sql `SELECT * FROM slotlock.sso_connection_route(${handle}::text, ${domain}::text)`;
+            return row
+                ? {
+                    id: row.connection_id,
+                    tenantRef: row.team_ref,
+                    handle: row.handle,
+                    name: row.name,
+                    authorizationEndpoint: row.authorization_endpoint,
+                    clientId: row.client_id,
+                    kind: row.kind,
+                    entraTenant: row.entra_tenant,
+                }
+                : null;
+        },
+        async save(params) {
+            if (!TEAM.test(params.tenantRef) || !UUID.test(params.id))
+                return { refusal: 'not_found' };
+            const [row] = await sql `
+        SELECT connection_id, refusal, enforcement_off FROM slotlock.save_sso_connection(
+          ${params.tenantRef}::text, ${params.actor}::text, ${params.id}::uuid, ${params.kind}::text, ${params.issuer}::text,
+          ${params.clientId}::text, ${params.secretSealed}::text, ${params.secretLast4}::text,
+          ${params.authorizationEndpoint}::text, ${params.tokenEndpoint}::text, ${params.jwksUri}::text,
+          ${[...params.algorithms]}::text[], ${params.issParameter}::boolean, ${params.entraTenant}::text)`;
+            if (row?.refusal)
+                return { refusal: refusalOf(row.refusal) ?? 'not_allowed', ...(row.connection_id ? { id: row.connection_id } : {}) };
+            return row?.connection_id ? { id: row.connection_id, enforcementOff: row.enforcement_off } : { refusal: 'not_allowed' };
+        },
+        async recordTest(tenantRef, actor, id, version, claims) {
+            if (!UUID.test(id))
+                return 'not_found';
+            const [row] = await sql `
+        SELECT slotlock.record_sso_test(${tenantRef}::text, ${actor}::text, ${id}::uuid, ${version}::integer,
+          ${JSON.stringify(claims)}::text::jsonb) AS refusal`;
+            return refusalOf(row?.refusal);
+        },
+        async setStatus(tenantRef, actor, id, status) {
+            if (!UUID.test(id))
+                return 'not_found';
+            const [row] = await sql `
+        SELECT slotlock.set_sso_connection_status(${tenantRef}::text, ${actor}::text, ${id}::uuid, ${status}::text) AS refusal`;
+            return refusalOf(row?.refusal);
+        },
+        async remove(tenantRef, actor, id) {
+            if (!UUID.test(id))
+                return 'not_found';
+            const [row] = await sql `
+        SELECT slotlock.delete_sso_connection(${tenantRef}::text, ${actor}::text, ${id}::uuid) AS refusal`;
+            return refusalOf(row?.refusal);
+        },
+        async setProvisioning(tenantRef, actor, jit, defaultRole, groupsClaim) {
+            const [row] = await sql `
+        SELECT slotlock.set_sso_provisioning(${tenantRef}::text, ${actor}::text, ${jit}::boolean, ${defaultRole}::text,
+          ${groupsClaim}::text) AS refusal`;
+            return refusalOf(row?.refusal);
+        },
+        async setMapping(tenantRef, actor, value, role) {
+            const [row] = await sql `
+        SELECT slotlock.set_sso_role_mapping(${tenantRef}::text, ${actor}::text, ${value}::text, ${role}::text) AS refusal`;
+            return refusalOf(row?.refusal);
+        },
+        async mappings(tenantRef) {
+            if (!TEAM.test(tenantRef))
+                return [];
+            const rows = await sql `SELECT * FROM slotlock.sso_role_mappings_of(${tenantRef}::text)`;
+            return rows.flatMap((row) => (isSlotlockWorkspaceRole(row.role) ? [{ value: row.idp_value, role: row.role }] : []));
+        },
+        async signIn(params) {
+            if (!UUID.test(params.connectionId))
+                return { person: null, outcome: null, refusal: 'connection_inactive', role: null };
+            const [row] = await sql `
+        SELECT person, outcome, refusal, member_role FROM slotlock.sso_sign_in(
+          ${params.connectionId}::uuid, ${params.issuer}::text, ${params.subject}::text, ${params.entraTid}::text,
+          ${params.entraOid}::text, ${params.email}::text, ${params.emailOk}::boolean, ${[...params.groups].slice(0, 200)}::text[],
+          ${params.overage}::boolean, ${params.guest}::boolean, ${params.sessionPerson}::text, ${params.memberCap}::integer)`;
+            return {
+                person: row?.person ?? null,
+                outcome: row?.outcome ?? null,
+                refusal: refusalOf(row?.refusal),
+                role: isSlotlockWorkspaceRole(row?.member_role) ? row?.member_role : null,
+            };
+        },
+        async recordProof(sid, person, connectionId, scoped, configVersion) {
+            if (!UUID.test(connectionId))
+                return false;
+            const [row] = await sql `
+        SELECT slotlock.record_sso_proof(${sessionDigest(sid)}::bytea, ${person}::text, ${connectionId}::uuid, ${scoped}::boolean,
+          ${configVersion ?? null}::integer) AS recorded`;
+            return row?.recorded === true;
+        },
+        async requireSso(tenantRef, actor, sid, on, maxAgeHours) {
+            const [row] = await sql `
+        SELECT slotlock.set_require_sso(${tenantRef}::text, ${actor}::text, ${sessionDigest(sid)}::bytea, ${on}::boolean,
+          ${maxAgeHours}::integer) AS refusal`;
+            return refusalOf(row?.refusal);
+        },
+        async bypass(tenantRef, person, sid) {
+            const [row] = await sql `
+        SELECT slotlock.sso_owner_bypass(${tenantRef}::text, ${person}::text, ${sessionDigest(sid)}::bytea) AS refusal`;
+            return refusalOf(row?.refusal);
+        },
+        async prune() {
+            const [row] = await sql `SELECT slotlock.prune_sso() AS pruned`;
+            return Number(row?.pruned ?? 0);
+        },
+    };
+}