Organization Sync Events¶

interface TenantSettings {
  allow_signups: boolean;                    // Whether self-signup is enabled
  require_mfa: boolean;                      // Whether MFA is required for all users
  allowed_email_domains: string[];           // Restrict signups to specific domains
  session_lifetime_minutes: number;          // Session duration
  password_policy: 'standard' | 'strict';    // Password requirements
}

interface TenantData {
  tenant_id: string;                         // Unique tenant identifier
  name: string;                              // Display name
  slug: string;                              // URL-safe identifier
  plan: 'free' | 'starter' | 'pro' | 'enterprise'; // Subscription plan
  settings: TenantSettings;                  // Tenant configuration
}

interface TenantCreatedData extends TenantData {
  created_by_sub: string;                    // Subject ID of creator
  created_at: string;                        // ISO timestamp
}

interface TenantUpdatedData extends TenantData {
  changed_fields: string[];                  // Fields that changed
  previous_values: Record<string, unknown>;  // Previous field values
  updated_by_sub: string;                    // Subject ID of updater
}

interface TenantDeletedData {
  tenant_id: string;
  name: string;
  slug: string;
  deleted_by_sub: string;
  deleted_at: string;
}

interface TenantSuspendedData extends TenantData {
  suspended_by_sub: string;
  suspended_at: string;
  reason?: string;
}

// Event types
type TenantCreatedEvent = BaseEvent<'tenant.created', TenantCreatedData>;
type TenantUpdatedEvent = BaseEvent<'tenant.updated', TenantUpdatedData>;
type TenantDeletedEvent = BaseEvent<'tenant.deleted', TenantDeletedData>;
type TenantSuspendedEvent = BaseEvent<'tenant.suspended', TenantSuspendedData>;

// Handler creates organization record
await prisma.organization.create({
  data: {
    id: 'tnt_acme123',
    name: 'Acme Corporation',
    slug: 'acme-corp',
    plan: 'pro',
    createdBySub: 'usr_founder001',
    allowSignups: true,
    requireMfa: false,
    allowedEmailDomains: ['acme.com', 'acme.io'],
    sessionLifetimeMinutes: 480,
    passwordPolicy: 'standard',
    status: 'active',
    syncedAt: new Date(),
  },
});

// Handler updates changed fields and logs audit entry
await prisma.organization.update({
  where: { id: 'tnt_acme123' },
  data: {
    plan: 'enterprise',
    requireMfa: true,
    passwordPolicy: 'strict',
    syncedAt: new Date(),
  },
});

// Optional: Create audit log entry
await prisma.organizationAuditLog.create({
  data: {
    organizationId: 'tnt_acme123',
    eventType: 'tenant.updated',
    changedFields: ['plan', 'settings.require_mfa'],
    previousValues: { plan: 'pro', 'settings.require_mfa': false },
    changedBySub: 'usr_admin001',
  },
});

// Handler deletes organization (cascades to apps and SSO providers)
await prisma.organization.delete({
  where: { id: 'tnt_oldcorp456' },
});

// Handler sets status to suspended
await prisma.organization.update({
  where: { id: 'tnt_suspended789' },
  data: {
    status: 'suspended',
    suspendedAt: new Date('2024-01-25T16:00:00.000Z'),
    suspendedBySub: 'usr_superadmin001',
    suspendedReason: 'Payment failed after 3 retry attempts',
    syncedAt: new Date(),
  },
});

interface ApplicationConfig {
  redirect_uris: string[];                   // Allowed redirect URIs
  post_logout_redirect_uris: string[];       // Allowed post-logout URIs
  allowed_scopes: string[];                  // Permitted OAuth scopes
  grant_types: ('authorization_code' | 'refresh_token' | 'client_credentials')[];
  token_endpoint_auth_method: 'client_secret_basic' | 'client_secret_post' | 'none';
  access_token_ttl_seconds: number;          // Access token lifetime
  refresh_token_ttl_seconds: number;         // Refresh token lifetime
}

interface ApplicationData {
  application_id: string;                    // Unique application ID
  tenant_id: string;                         // Parent tenant ID
  name: string;                              // Display name
  description?: string;                      // Optional description
  client_id: string;                         // OAuth client ID
  application_type: 'web' | 'spa' | 'native' | 'machine';
  config: ApplicationConfig;
  is_active: boolean;
}

interface ApplicationCreatedData extends ApplicationData {
  created_by_sub: string;
  created_at: string;
}

interface ApplicationUpdatedData extends ApplicationData {
  changed_fields: string[];
  previous_values: Record<string, unknown>;
  updated_by_sub: string;
}

interface ApplicationDeletedData {
  application_id: string;
  tenant_id: string;
  name: string;
  client_id: string;
  deleted_by_sub: string;
  deleted_at: string;
}

// Event types
type ApplicationCreatedEvent = BaseEvent<'application.created', ApplicationCreatedData>;
type ApplicationUpdatedEvent = BaseEvent<'application.updated', ApplicationUpdatedData>;
type ApplicationDeletedEvent = BaseEvent<'application.deleted', ApplicationDeletedData>;

// Handler creates application record
await prisma.application.create({
  data: {
    id: 'app_dashboard456',
    organizationId: 'tnt_acme123',
    name: 'Acme Dashboard',
    description: 'Main customer dashboard',
    clientId: 'acme_dashboard_prod',
    applicationType: 'spa',
    isActive: true,
    createdBySub: 'usr_admin001',
    redirectUris: [
      'https://dashboard.acme.com/callback',
      'http://localhost:3000/callback',
    ],
    postLogoutRedirectUris: ['https://dashboard.acme.com'],
    allowedScopes: ['openid', 'profile', 'email'],
    grantTypes: ['authorization_code', 'refresh_token'],
    tokenEndpointAuthMethod: 'none',
    accessTokenTtlSeconds: 3600,
    refreshTokenTtlSeconds: 604800,
    syncedAt: new Date(),
  },
});

// Handler updates changed configuration
await prisma.application.update({
  where: { id: 'app_dashboard456' },
  data: {
    redirectUris: [
      'https://dashboard.acme.com/callback',
      'https://staging.dashboard.acme.com/callback',
      'http://localhost:3000/callback',
    ],
    allowedScopes: ['openid', 'profile', 'email', 'offline_access'],
    syncedAt: new Date(),
  },
});

// Handler deletes application record
await prisma.application.delete({
  where: { id: 'app_legacy789' },
});

interface SsoProviderConfig {
  client_id: string;                        // OAuth client ID for the provider
  issuer?: string;                          // OIDC issuer URL (for OIDC/SAML)
  authorization_endpoint?: string;          // OAuth authorization URL
  token_endpoint?: string;                  // OAuth token URL
  userinfo_endpoint?: string;               // OIDC userinfo URL
  domains: string[];                        // Email domains that trigger this SSO
  attribute_mapping: Record<string, string>; // Map provider claims to AuthVital claims
}

interface SsoProviderData {
  provider_id: string;                      // Unique provider ID
  tenant_id: string;                        // Parent tenant ID
  provider_type: 'google' | 'microsoft' | 'okta' | 'saml' | 'oidc';
  display_name: string;                     // Display name for login UI
  is_enabled: boolean;                      // Whether SSO is active
  config: SsoProviderConfig;
}

interface SsoProviderAddedData extends SsoProviderData {
  created_by_sub: string;
  created_at: string;
}

interface SsoProviderUpdatedData extends SsoProviderData {
  changed_fields: string[];
  previous_values: Record<string, unknown>;
  updated_by_sub: string;
}

interface SsoProviderRemovedData {
  provider_id: string;
  tenant_id: string;
  provider_type: string;
  display_name: string;
  removed_by_sub: string;
  removed_at: string;
}

// Event types
type SsoProviderAddedEvent = BaseEvent<'sso.provider_added', SsoProviderAddedData>;
type SsoProviderUpdatedEvent = BaseEvent<'sso.provider_updated', SsoProviderUpdatedData>;
type SsoProviderRemovedEvent = BaseEvent<'sso.provider_removed', SsoProviderRemovedData>;

// Handler creates SSO provider record
await prisma.ssoProvider.create({
  data: {
    id: 'sso_google001',
    organizationId: 'tnt_acme123',
    providerType: 'google',
    displayName: 'Sign in with Google',
    isEnabled: true,
    createdBySub: 'usr_admin001',
    clientId: '123456789.apps.googleusercontent.com',
    domains: ['acme.com'],
    attributeMapping: {
      email: 'email',
      given_name: 'given_name',
      family_name: 'family_name',
      picture: 'picture',
    },
    syncedAt: new Date(),
  },
});

// Handler updates changed SSO configuration
await prisma.ssoProvider.update({
  where: { id: 'sso_google001' },
  data: {
    displayName: 'Sign in with Google Workspace',
    domains: ['acme.com', 'acme.io'],
    syncedAt: new Date(),
  },
});

// Handler deletes SSO provider record
await prisma.ssoProvider.delete({
  where: { id: 'sso_okta001' },
});