Oskar Otwinowski
de65370fb9
Extend the SSO plugin contract for directory sync and apply membership effects from the accounts webhook worker: provision users in mapped groups (role from group mapping, else the org default role), deprovision on removal, and keep a sticky-removal tombstone so JIT never silently re-adds a removed user. JIT and Directory Sync coexist; roles default to Developer (the JIT default-role picker has no 'None'). Changing a group's role in the dashboard re-applies it to that group's current members immediately. The Directory Sync settings section (group→role mapping, external-domain + manual-membership policy, deferred Save) appears once a domain is verified — independent of SSO — gated by the hasSso flag. The settings page polls the whole page while entitled with override-aware drafts so in-progress edits are never clobbered.
57 lines
1.0 KiB
TypeScript
57 lines
1.0 KiB
TypeScript
export type {
|
|
RoleBasedAccessControlPlugin,
|
|
RoleBaseAccessController,
|
|
RoleAssignmentResult,
|
|
RoleMutationResult,
|
|
Permission,
|
|
Role,
|
|
RbacAbility,
|
|
RbacSubject,
|
|
RbacResource,
|
|
RbacEnvironment,
|
|
RbacUser,
|
|
BearerAuthResult,
|
|
SessionAuthResult,
|
|
PatAuthResult,
|
|
UserActorAuthResult,
|
|
UserActorClaims,
|
|
RbacPluginConfig,
|
|
SystemRole,
|
|
AuthenticatedEnvironment,
|
|
} from "./rbac.js";
|
|
|
|
export { buildJwtAbility } from "./rbac.js";
|
|
export {
|
|
isUserActorToken,
|
|
signUserActorToken,
|
|
verifyUserActorToken,
|
|
USER_ACTOR_TOKEN_PREFIX,
|
|
} from "./rbac.js";
|
|
|
|
export type {
|
|
SsoPlugin,
|
|
SsoController,
|
|
OrgSsoStatus,
|
|
SsoRouteDecision,
|
|
SsoFlow,
|
|
SsoProfile,
|
|
SsoConnectionState,
|
|
SsoDomainState,
|
|
SsoDomainStatus,
|
|
SsoResolutionDecision,
|
|
SsoDecisionError,
|
|
SsoBeginError,
|
|
SsoCompleteError,
|
|
SsoMutationError,
|
|
SsoPortalError,
|
|
SsoValidateError,
|
|
SsoWebhookError,
|
|
SsoWebhookEvent,
|
|
DirectoryState,
|
|
DirectoryGroupMapping,
|
|
DirectorySyncStatus,
|
|
DirectorySyncEffect,
|
|
} from "./sso.js";
|
|
|
|
export { SSO_FLOWS } from "./sso.js";
|