Enterprise Authentication

// That's it - authentication is built-in
on($.User.login, async ({ user }) => {
  // User is already authenticated
  // SSO was handled automatically if configured
  // MFA was enforced if required
  // Session is created and secure

  console.log(`${user.email} logged in via ${user.authMethod}`)
})

// User logs in with their company email
// Platform automatically:
// 1. Looks up email domain (acme.com)
// 2. Finds SSO configuration for Acme Corp
// 3. Redirects to Okta (their IdP)
// 4. User authenticates with company credentials + MFA
// 5. Platform receives validated identity
// 6. User is logged into your app

on($.User.authenticated, async ({ user, authMethod }) => {
  if (authMethod === 'sso') {
    // User came through SSO
    // Their company's security policies were enforced
    // MFA was required if configured in their IdP
    console.log(`${user.email} authenticated via ${user.organization.name} SSO`)
  }
})

// Platform can send magic link emails automatically
await $.User.sendMagicLink({ email: '[email protected]' })

// User clicks link, platform validates token, creates session
// No passwords to manage or reset

// Users can generate API keys through the platform
const apiKey = await $.User.generateAPIKey({
  name: 'Production API',
  scopes: ['db:read', 'db:write'],
  expiresIn: '90d'
})

// Platform automatically validates and scopes API key requests

// Platform maintains secure sessions
// User returns within session timeout
on($.Request.received, async ({ request }) => {
  const user = await $.User.fromRequest(request)
  // Platform automatically:
  // - Validates session token
  // - Checks if still valid
  // - Verifies organization membership
  // - Returns user context

  if (user) {
    // User is authenticated
    // Proceed with request
  } else {
    // Session expired or invalid
    // Platform redirects to login
  }
})

// No MFA code to write - it's handled by the IdP
on($.User.authenticated, async ({ user, mfaVerified }) => {
  // mfaVerified is true if MFA was required and completed
  // The user's IdP (Okta, Entra, etc.) handled MFA
  // Your app doesn't need to implement anything

  if (mfaVerified) {
    console.log(`${user.email} completed MFA`)
  }
})

// All enforced by the IdP - no code needed
// - User location (country, IP range)
// - Device compliance (managed device, updated OS)
// - Risk level (impossible travel, leaked credentials)
// - Time of day (business hours only)
// - Network (corporate network, VPN required)

on($.User.authenticated, async ({ user, context }) => {
  // context includes details about the authentication
  console.log({
    ipAddress: context.ipAddress,
    location: context.location,
    userAgent: context.userAgent,
    riskLevel: context.riskLevel // If provided by IdP
  })
})

// Sessions are automatically:
// - Encrypted with secure cookies
// - Scoped to the appropriate domain
// - Expired after inactivity
// - Invalidated on logout
// - Tracked for audit compliance

// Organization can configure session timeout
await $.Organization.update(orgId, {
  settings: {
    security: {
      sessionTimeout: 3600, // 1 hour
      requireMFA: true,
      allowedIPs: ['203.0.113.0/24']
    }
  }
})

// Platform enforces automatically

on($.User.sso.firstLogin, async ({ profile, organization }) => {
  // Platform automatically creates user account
  // You can customize what happens

  const user = await $.User.create({
    email: profile.email,
    firstName: profile.firstName,
    lastName: profile.lastName,
    organizationId: organization.id,
    authMethod: 'sso'
  })

  // Assign default role
  await $.User.assign.Role({
    userId: user.id,
    roleId: 'member'
  })

  // Send welcome email
  await $.Email.send({
    to: user.email,
    template: 'welcome',
    data: { user, organization }
  })

  return user
})

// User enters: [email protected]
// Platform automatically:
// 1. Extracts domain: acme.com
// 2. Looks up organization with that domain
// 3. Checks if SSO is configured
// 4. Redirects to Okta (Acme's IdP)
// 5. User authenticates there
// 6. Returns to your app

// No routing code needed - it's automatic

on($.User.loginInitiated, async ({ email }) => {
  // Platform has already determined auth method
  // If SSO is available, user will be redirected
  // If not, falls back to magic link or other method
})

// Platform provides built-in RBAC
await $.User.assign.Role({
  userId: user.id,
  roleId: 'admin'
})

// Check permissions
on($.API.request, async ({ user, resource }) => {
  const canAccess = await $.User.can(user, 'read', resource)

  if (!canAccess) {
    throw new Error('Permission denied')
  }
})

// Platform can automatically enforce permissions
await $.Project.list() // Automatically scoped to user's permissions

// User logs in at app.yourcompany.com
// They also have access to:
// - dashboard.yourcompany.com
// - api.yourcompany.com
// - docs.yourcompany.com

// Platform manages SSO across all your domains automatically
// No need to implement session sharing

// Development mode
if (process.env.NODE_ENV === 'development') {
  // Platform provides test users automatically
  // Or use magic links for quick testing
  await $.User.sendMagicLink({ email: 'test@localhost' })
}

// Production mode
// SSO and enterprise auth work automatically

// Get authentication metrics
const metrics = await $.Analytics.get({
  metric: 'auth.success_rate',
  organizationId: orgId,
  period: 'last_30_days'
})

// Alert on unusual activity
on($.Auth.failedAttempts, async ({ user, count }) => {
  if (count >= 5) {
    await $.Alert.send({
      type: 'security',
      severity: 'high',
      message: `${user.email} had ${count} failed login attempts`,
      user
    })
  }
})

// Check authentication status
const status = await $.Organization.getAuthStatus(orgId)

console.log({
  ssoConfigured: status.sso.configured,
  ssoType: status.sso.type, // 'OktaSAML', 'AzureSAML', etc.
  domainsVerified: status.domains.filter(d => d.verified),
  activeUsers: status.users.active,
  authenticationHealth: status.health // 'healthy', 'degraded', 'error'
})

// Test SSO connection
const test = await $.Organization.testSSO(orgId)
// Platform attempts a test authentication and reports results

// Lots of authentication code to maintain
app.post('/login', async (req, res) => {
  const { email, password } = req.body
  const user = await db.users.findOne({ email })

  if (!user || !await bcrypt.compare(password, user.passwordHash)) {
    return res.status(401).json({ error: 'Invalid credentials' })
  }

  const token = jwt.sign({ userId: user.id }, SECRET, { expiresIn: '1d' })
  res.json({ token })
})

// Handle SSO separately with multiple libraries
// Implement MFA yourself
// Manage session security
// Build audit logging
// etc.

// Authentication is automatic
on($.User.authenticated, async ({ user }) => {
  // User is already authenticated (SSO, MFA, etc. handled)
  // Session is already secure
  // Audit log is already recorded
  // Just handle your application logic
})

// When user logs out, platform can notify IdP
on($.User.logout, async ({ user }) => {
  // Platform automatically:
  // - Invalidates session
  // - Clears cookies
  // - Notifies IdP (if SLO configured)
  // - Logs logout event
})

// For API requests with tokens
on($.API.request, async ({ token }) => {
  const validation = await $.Token.introspect(token)

  if (!validation.active) {
    throw new Error('Invalid or expired token')
  }

  const user = await $.User.find(validation.userId)
  // Proceed with authenticated request
})

// Add custom data to authentication context
on($.User.authenticated, async ({ user }) => {
  // Platform includes standard claims:
  // - email, name, organizationId, etc.

  // You can add custom claims to the session
  return {
    ...user,
    customData: {
      department: 'Engineering',
      employeeId: 'EMP-12345',
      permissions: await getUserPermissions(user.id)
    }
  }
})