konnosDashboard
auth-enterprise-pack.ts206 lines · main
1/**
2 * Enterprise compliance / sales pack (S7).
3 *
4 * Turns compliance groundwork into a downloadable "sales kit" JSON plus
5 * standard legal templates for DPA, BAA outline, and retention.
6 * Per-project signed flags still live in `_briven_auth_compliance`.
7 */
8
9import { getComplianceSettings, type ComplianceSettings } from './auth-compliance.js';
10import { getAuthConfig } from './tenant-config-store.js';
11
12export const ENTERPRISE_PACK_VERSION = '2026-07-19';
13
14/** Static legal/sales templates (not a signed contract — templates for counsel). */
15export const ENTERPRISE_LEGAL_TEMPLATES = {
16 dpa: {
17 title: 'Data Processing Addendum (template)',
18 version: ENTERPRISE_PACK_VERSION,
19 summary:
20 'Template DPA for EU GDPR Art. 28. Briven (flndrn Limited) acts as processor for customer-end-user auth data held in the customer’s project; the customer is controller for their end users.',
21 controller: 'Customer (your company)',
22 processor: 'flndrn Limited (Cyprus) operating briven.tech',
23 subjectMatter: 'Authentication, sessions, SSO, SCIM provisioning, audit metadata',
24 duration: 'Term of the Briven subscription + retention windows below',
25 nature: 'Hosting, processing for login, security, support',
26 typesOfData: [
27 'End-user email and name',
28 'Auth session identifiers',
29 'SSO/SCIM identifiers',
30 'Hashed credentials (not plaintext passwords)',
31 'Security events (IP hashed where applicable)',
32 ],
33 subprocessorsUrl: 'https://briven.tech/subprocessors',
34 trustUrl: 'https://briven.tech/trust',
35 contact: 'legal@flndrn.com',
36 note: 'This is a sales/ops template. Final DPA is signed between flndrn Limited and the customer; enable gdprDpaSignedAt on the project after signature.',
37 },
38 hipaaBaaOutline: {
39 title: 'HIPAA Business Associate Agreement (outline)',
40 version: ENTERPRISE_PACK_VERSION,
41 summary:
42 'Outline only — not a substitute for counsel-drafted BAA. Available when PHI is in scope and both parties agree.',
43 status: 'template_outline',
44 contact: 'legal@flndrn.com',
45 prerequisites: [
46 'Customer classifies workload as PHI-relevant',
47 'Enterprise plan / written agreement',
48 'hipaaBaaSignedAt recorded on the project after wet/electronic signature',
49 ],
50 },
51 retention: {
52 title: 'Auth data retention pack',
53 version: ENTERPRISE_PACK_VERSION,
54 defaults: {
55 auditLogDays: 'configured per project (auth config retention.auditLogDays)',
56 appLogDays: 'configured per project (auth config retention.appLogDays)',
57 sessions: 'until expiry or revoke',
58 scimMappings: 'while user/group exists',
59 backups: 'see trust page (platform backups)',
60 },
61 customerControls: [
62 'Dashboard Auth → retention / purge endpoints',
63 'User delete (GDPR erasure) via admin bulk delete / SCIM DELETE User',
64 'Project disable/delete removes tenant data plane after grace (platform policy)',
65 ],
66 },
67 securityOverview: {
68 title: 'Security overview (enterprise one-pager)',
69 version: ENTERPRISE_PACK_VERSION,
70 bullets: [
71 'TLS on public endpoints',
72 'Per-project data isolation (project-scoped DB + auth tables)',
73 'Env secrets encrypted at rest (AES-256-GCM)',
74 'API / SCIM / SDK keys hashed at rest',
75 'Enterprise SSO: SAML 2.0 + OIDC',
76 'SCIM 2.0 user/group provisioning',
77 'Audit log + app logs with configurable retention',
78 'Rate limits (Redis with memory fallback)',
79 '2FA TOTP, passkeys, backup codes (where enabled)',
80 ],
81 publicTrust: 'https://briven.tech/trust',
82 statusPage: 'https://briven.tech/status',
83 },
84} as const;
85
86export interface EnterpriseSalesPack {
87 packVersion: string;
88 projectId: string;
89 generatedAt: string;
90 compliance: ComplianceSettings;
91 retention: {
92 auditLogDays: number | null;
93 appLogDays: number | null;
94 };
95 capabilities: {
96 samlSso: true;
97 oidcSso: true;
98 scim: true;
99 scimGroups: true;
100 auditLog: true;
101 encryptionAtRest: boolean;
102 };
103 endpoints: {
104 scimBase: string;
105 samlMetadataPattern: string;
106 oidcStartPattern: string;
107 complianceApi: string;
108 compliancePackApi: string;
109 };
110 templates: typeof ENTERPRISE_LEGAL_TEMPLATES;
111 checklistForSales: Array<{ id: string; label: string; done: boolean }>;
112}
113
114export async function buildEnterpriseSalesPack(
115 projectId: string,
116 apiOrigin: string,
117): Promise<EnterpriseSalesPack> {
118 const compliance = await getComplianceSettings(projectId);
119 const config = await getAuthConfig(projectId).catch(() => null);
120 const retention = {
121 auditLogDays: config?.retention?.auditLogDays ?? null,
122 appLogDays: config?.retention?.appLogDays ?? null,
123 };
124 const base = apiOrigin.replace(/\/$/, '');
125
126 const checklistForSales: EnterpriseSalesPack['checklistForSales'] = [
127 {
128 id: 'dpa',
129 label: 'GDPR DPA signed (record gdprDpaSignedAt)',
130 done: Boolean(compliance.gdprDpaSignedAt),
131 },
132 {
133 id: 'hipaa',
134 label: 'HIPAA BAA signed if PHI in scope',
135 done: Boolean(compliance.hipaaBaaSignedAt),
136 },
137 {
138 id: 'soc2_url',
139 label: 'SOC 2 controls URL published (if available)',
140 done: Boolean(compliance.soc2ControlsUrl),
141 },
142 {
143 id: 'encryption',
144 label: 'Encryption at rest affirmed',
145 done: compliance.encryptionAtRestEnabled,
146 },
147 {
148 id: 'sso',
149 label: 'Customer SSO (SAML or OIDC) configured when required',
150 done: false, // sales fills; not auto-detected here
151 },
152 {
153 id: 'scim',
154 label: 'SCIM token issued when directory sync required',
155 done: false,
156 },
157 ];
158
159 return {
160 packVersion: ENTERPRISE_PACK_VERSION,
161 projectId,
162 generatedAt: new Date().toISOString(),
163 compliance,
164 retention,
165 capabilities: {
166 samlSso: true,
167 oidcSso: true,
168 scim: true,
169 scimGroups: true,
170 auditLog: true,
171 encryptionAtRest: compliance.encryptionAtRestEnabled,
172 },
173 endpoints: {
174 scimBase: `${base}/v1/projects/${projectId}/scim/v2`,
175 samlMetadataPattern: `${base}/v1/auth-tenant/sso/saml/{connectionId}/metadata`,
176 oidcStartPattern: `${base}/v1/auth-tenant/sso/oidc/{connectionId}`,
177 complianceApi: `${base}/v1/projects/${projectId}/auth/compliance`,
178 compliancePackApi: `${base}/v1/projects/${projectId}/auth/compliance/pack`,
179 },
180 templates: ENTERPRISE_LEGAL_TEMPLATES,
181 checklistForSales,
182 };
183}
184
185/** Record DPA signature quickly from dashboard (owner). */
186export async function signGdprDpa(
187 projectId: string,
188 signedBy: string,
189): Promise<ComplianceSettings> {
190 const { setComplianceSettings } = await import('./auth-compliance.js');
191 return setComplianceSettings(projectId, {
192 gdprDpaSignedAt: new Date().toISOString(),
193 gdprDpaSignedBy: signedBy,
194 });
195}
196
197export async function signHipaaBaa(
198 projectId: string,
199 signedBy: string,
200): Promise<ComplianceSettings> {
201 const { setComplianceSettings } = await import('./auth-compliance.js');
202 return setComplianceSettings(projectId, {
203 hipaaBaaSignedAt: new Date().toISOString(),
204 hipaaBaaSignedBy: signedBy,
205 });
206}