sso-admin.controller.ts

sso-admin.controller.tsapps/api/src/modules/sso/sso-admin.controller.tsraw ← sso2,379 B← Back to the app
1/**
2 * TASK-0131 — SSO provider ADMIN endpoints (org-owner gated now; TASK-0133
3 * swaps to the shared `requireOrgAdmin` guard — the route surface is stable):
4 *
5 *   GET    /api/v1/orgs/:orgId/sso        — provider + masked secrets flags
6 *   POST   /api/v1/orgs/:orgId/sso        — create (one per org)
7 *   PATCH  /api/v1/orgs/:orgId/sso        — update (+ cert/secret rotation)
8 *   DELETE /api/v1/orgs/:orgId/sso        — remove provider + secrets
9 *   PATCH  /api/v1/orgs/:orgId/sso/enforce— enforce toggle (mirror-writes policy)
10 *   POST   /api/v1/orgs/:orgId/sso/test   — test connection (metadata / JWKS)
11 *
12 * These live UNDER the `api/v1` prefix (org sub-resource), so they are in the
13 * OpenAPI contract surface (TASK-0127 generator + `liveRoutes()` both see
14 * them).
15 */
16import { Body, Controller, Delete, Get, Inject, Param, Patch, Post, Req } from "@nestjs/common";
17import type { Request } from "express";
18import { ZodValidate } from "../../common/pipes/zod-validation.pipe.js";
19import { SsoAdminService } from "./sso-admin.service.js";
20import {
21  SsoProviderAdminInputSchema,
22  SsoProviderUpdateSchema,
23  SsoEnforceSchema,
24  type SsoProviderAdminInput
25} from "./schemas.js";
26 
27@Controller("orgs/:orgId/sso")
28export class SsoAdminController {
29  constructor(@Inject(SsoAdminService) private readonly sso: SsoAdminService) {}
30 
31  @Get()
32  get(@Param("orgId") orgId: string, @Req() req: Request) {
33    return this.sso.get(orgId, req);
34  }
35 
36  @Post()
37  create(
38    @Param("orgId") orgId: string,
39    @Body(ZodValidate(SsoProviderAdminInputSchema)) body: SsoProviderAdminInput,
40    @Req() req: Request
41  ) {
42    return this.sso.create(orgId, body, req);
43  }
44 
45  @Patch()
46  update(
47    @Param("orgId") orgId: string,
48    @Body(ZodValidate(SsoProviderUpdateSchema)) body: Parameters<SsoAdminService["update"]>[1],
49    @Req() req: Request
50  ) {
51    return this.sso.update(orgId, body, req);
52  }
53 
54  @Delete()
55  remove(@Param("orgId") orgId: string, @Req() req: Request) {
56    return this.sso.remove(orgId, req);
57  }
58 
59  @Patch("enforce")
60  enforce(
61    @Param("orgId") orgId: string,
62    @Body(ZodValidate(SsoEnforceSchema)) body: { enforce: boolean },
63    @Req() req: Request
64  ) {
65    return this.sso.setEnforce(orgId, body, req);
66  }
67 
68  @Post("test")
69  test(@Param("orgId") orgId: string, @Req() req: Request) {
70    return this.sso.test(orgId, req);
71  }
72}
73