@acorex-platform/framework-server 0.0.10 → 0.0.14

package/search/providers/src/lib/quick-search-sync.util.d.ts

@@ -0,0 +1,3 @@
+import type { EntityStorageContext } from '@acorex-platform/framework-server/core';
+export declare function resolveEntityStorageRecordId(ctx: EntityStorageContext): string;
+//# sourceMappingURL=quick-search-sync.util.d.ts.map

package/search/providers/src/lib/quick-search-sync.util.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"quick-search-sync.util.d.ts","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/search/providers/src/lib/quick-search-sync.util.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,wCAAwC,CAAC;AAInF,wBAAgB,4BAA4B,CAAC,GAAG,EAAE,oBAAoB,GAAG,MAAM,CAuB9E"}

package/search/providers/src/lib/quick-search-sync.util.js

@@ -0,0 +1,26 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolveEntityStorageRecordId = resolveEntityStorageRecordId;
+//#region ---- Quick search sync helpers ----
+function resolveEntityStorageRecordId(ctx) {
+    if (ctx.op === 'delete') {
+        return ctx.id ?? '';
+    }
+    const fromResult = ctx.result;
+    if (typeof fromResult === 'string' && fromResult.trim()) {
+        return fromResult.trim();
+    }
+    if (fromResult && typeof fromResult === 'object') {
+        const resultId = fromResult['id'];
+        if (typeof resultId === 'string' && resultId.trim()) {
+            return resultId.trim();
+        }
+    }
+    const fromData = ctx.data?.['id'];
+    if (typeof fromData === 'string' && fromData.trim()) {
+        return fromData.trim();
+    }
+    return ctx.id ?? '';
+}
+//#endregion
+//# sourceMappingURL=quick-search-sync.util.js.map

package/search/providers/src/lib/quick-search-sync.util.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"quick-search-sync.util.js","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/search/providers/src/lib/quick-search-sync.util.ts"],"names":[],"mappings":";;AAIA,oEAuBC;AAzBD,6CAA6C;AAE7C,SAAgB,4BAA4B,CAAC,GAAyB;IACpE,IAAI,GAAG,CAAC,EAAE,KAAK,QAAQ,EAAE,CAAC;QACxB,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC;IACtB,CAAC;IAED,MAAM,UAAU,GAAG,GAAG,CAAC,MAAM,CAAC;IAC9B,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC;QACxD,OAAO,UAAU,CAAC,IAAI,EAAE,CAAC;IAC3B,CAAC;IAED,IAAI,UAAU,IAAI,OAAO,UAAU,KAAK,QAAQ,EAAE,CAAC;QACjD,MAAM,QAAQ,GAAI,UAAsC,CAAC,IAAI,CAAC,CAAC;QAC/D,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC;YACpD,OAAO,QAAQ,CAAC,IAAI,EAAE,CAAC;QACzB,CAAC;IACH,CAAC;IAED,MAAM,QAAQ,GAAI,GAAG,CAAC,IAA4C,EAAE,CAAC,IAAI,CAAC,CAAC;IAC3E,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC;QACpD,OAAO,QAAQ,CAAC,IAAI,EAAE,CAAC;IACzB,CAAC;IAED,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC;AAED,YAAY"}

package/security/src/index.d.ts

@@ -1,6 +1,13 @@
 export * from './lib/security.module';
 export * from './lib/auth/auth.service';
+export * from './lib/auth/token.service';
+export * from './lib/auth/token-resolver.service';
+export * from './lib/auth/auth-cookie.service';
+export * from './lib/auth/login-attempt.service';
+export * from './lib/auth/auth.config';
+export * from './lib/auth/machine-token.service';
 export * from './lib/auth/auth.types';
+export * from './lib/auth/auth-providers.contributor';
 export * from './lib/auth/public.decorator';
 export * from './lib/auth/jwt-auth.guard';
 export * from './lib/session/backend-session.service';
@@ -8,6 +15,7 @@ export * from './lib/session/backend-session.types';
 export * from './lib/session/current-session.decorator';
 export * from './lib/session/session-context.service';
 export * from './lib/session/session-context.types';
-export * from './lib/authorization/platform-root-user.util';
+export * from './lib/session/optional-jwt-session.middleware';
 export * from './lib/entity-storage/visibility-filter.middleware';
 export * from './lib/entity-storage/policy-enforce.middleware';
+//# sourceMappingURL=index.d.ts.map

package/security/src/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../../libs/framework/server/security/src/index.ts"],"names":[],"mappings":"AAAA,cAAc,uBAAuB,CAAC;AACtC,cAAc,yBAAyB,CAAC;AACxC,cAAc,0BAA0B,CAAC;AACzC,cAAc,mCAAmC,CAAC;AAClD,cAAc,gCAAgC,CAAC;AAC/C,cAAc,kCAAkC,CAAC;AACjD,cAAc,wBAAwB,CAAC;AACvC,cAAc,kCAAkC,CAAC;AACjD,cAAc,uBAAuB,CAAC;AACtC,cAAc,uCAAuC,CAAC;AACtD,cAAc,6BAA6B,CAAC;AAC5C,cAAc,2BAA2B,CAAC;AAC1C,cAAc,uCAAuC,CAAC;AACtD,cAAc,qCAAqC,CAAC;AACpD,cAAc,yCAAyC,CAAC;AACxD,cAAc,uCAAuC,CAAC;AACtD,cAAc,qCAAqC,CAAC;AACpD,cAAc,+CAA+C,CAAC;AAC9D,cAAc,mDAAmD,CAAC;AAClE,cAAc,gDAAgD,CAAC"}

package/security/src/index.js

@@ -3,7 +3,14 @@ Object.defineProperty(exports, "__esModule", { value: true });
 const tslib_1 = require("tslib");
 tslib_1.__exportStar(require("./lib/security.module"), exports);
 tslib_1.__exportStar(require("./lib/auth/auth.service"), exports);
+tslib_1.__exportStar(require("./lib/auth/token.service"), exports);
+tslib_1.__exportStar(require("./lib/auth/token-resolver.service"), exports);
+tslib_1.__exportStar(require("./lib/auth/auth-cookie.service"), exports);
+tslib_1.__exportStar(require("./lib/auth/login-attempt.service"), exports);
+tslib_1.__exportStar(require("./lib/auth/auth.config"), exports);
+tslib_1.__exportStar(require("./lib/auth/machine-token.service"), exports);
 tslib_1.__exportStar(require("./lib/auth/auth.types"), exports);
+tslib_1.__exportStar(require("./lib/auth/auth-providers.contributor"), exports);
 tslib_1.__exportStar(require("./lib/auth/public.decorator"), exports);
 tslib_1.__exportStar(require("./lib/auth/jwt-auth.guard"), exports);
 tslib_1.__exportStar(require("./lib/session/backend-session.service"), exports);
@@ -11,7 +18,7 @@ tslib_1.__exportStar(require("./lib/session/backend-session.types"), exports);
 tslib_1.__exportStar(require("./lib/session/current-session.decorator"), exports);
 tslib_1.__exportStar(require("./lib/session/session-context.service"), exports);
 tslib_1.__exportStar(require("./lib/session/session-context.types"), exports);
-tslib_1.__exportStar(require("./lib/authorization/platform-root-user.util"), exports);
+tslib_1.__exportStar(require("./lib/session/optional-jwt-session.middleware"), exports);
 tslib_1.__exportStar(require("./lib/entity-storage/visibility-filter.middleware"), exports);
 tslib_1.__exportStar(require("./lib/entity-storage/policy-enforce.middleware"), exports);
 //# sourceMappingURL=index.js.map

package/security/src/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../../libs/framework/server/security/src/index.ts"],"names":[],"mappings":";;;AAAA,gEAAsC;AACtC,kEAAwC;AACxC,gEAAsC;AACtC,sEAA4C;AAC5C,oEAA0C;AAC1C,gFAAsD;AACtD,8EAAoD;AACpD,kFAAwD;AACxD,gFAAsD;AACtD,8EAAoD;AACpD,sFAA4D;AAC5D,4FAAkE;AAClE,yFAA+D"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../../libs/framework/server/security/src/index.ts"],"names":[],"mappings":";;;AAAA,gEAAsC;AACtC,kEAAwC;AACxC,mEAAyC;AACzC,4EAAkD;AAClD,yEAA+C;AAC/C,2EAAiD;AACjD,iEAAuC;AACvC,2EAAiD;AACjD,gEAAsC;AACtC,gFAAsD;AACtD,sEAA4C;AAC5C,oEAA0C;AAC1C,gFAAsD;AACtD,8EAAoD;AACpD,kFAAwD;AACxD,gFAAsD;AACtD,8EAAoD;AACpD,wFAA8D;AAC9D,4FAAkE;AAClE,yFAA+D"}

package/security/src/lib/auth/auth-cookie.service.d.ts

@@ -0,0 +1,16 @@
+import type { Response } from 'express';
+export declare class AuthCookieService {
+    applyAuthCookies(res: Response, tokens: {
+        accessToken: string;
+        refreshToken: string;
+        accessMaxAgeMs?: number;
+        refreshMaxAgeMs?: number;
+    }): void;
+    clearAuthCookies(res: Response): void;
+    readRefreshToken(cookies: Record<string, unknown> | undefined): string | null;
+    readAccessTokenCookie(cookies: Record<string, unknown> | undefined): string | null;
+    private refreshCookieOptions;
+    private accessCookieOptions;
+    private baseCookieOptions;
+}
+//# sourceMappingURL=auth-cookie.service.d.ts.map

package/security/src/lib/auth/auth-cookie.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-cookie.service.d.ts","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/auth/auth-cookie.service.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAiB,QAAQ,EAAE,MAAM,SAAS,CAAC;AAWvD,qBACa,iBAAiB;IAC5B,gBAAgB,CACd,GAAG,EAAE,QAAQ,EACb,MAAM,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,cAAc,CAAC,EAAE,MAAM,CAAC;QAAC,eAAe,CAAC,EAAE,MAAM,CAAA;KAAE,GACvG,IAAI;IAgBP,gBAAgB,CAAC,GAAG,EAAE,QAAQ,GAAG,IAAI;IAYrC,gBAAgB,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,GAAG,MAAM,GAAG,IAAI;IAQ7E,qBAAqB,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,GAAG,MAAM,GAAG,IAAI;IAQlF,OAAO,CAAC,oBAAoB;IAS5B,OAAO,CAAC,mBAAmB;IAS3B,OAAO,CAAC,iBAAiB;CAM1B"}

package/security/src/lib/auth/auth-cookie.service.js

@@ -0,0 +1,68 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AuthCookieService = void 0;
+const tslib_1 = require("tslib");
+const common_1 = require("@nestjs/common");
+const auth_config_1 = require("./auth.config");
+//#region ---- Auth cookie service ----
+let AuthCookieService = class AuthCookieService {
+    applyAuthCookies(res, tokens) {
+        res.cookie(auth_config_1.AUTH_COOKIE_REFRESH_TOKEN, tokens.refreshToken, this.refreshCookieOptions(tokens.refreshMaxAgeMs));
+        if (tokens.accessMaxAgeMs) {
+            res.cookie(auth_config_1.AUTH_COOKIE_ACCESS_TOKEN, tokens.accessToken, this.accessCookieOptions(tokens.accessMaxAgeMs));
+        }
+    }
+    clearAuthCookies(res) {
+        const base = this.baseCookieOptions();
+        res.clearCookie(auth_config_1.AUTH_COOKIE_REFRESH_TOKEN, {
+            ...base,
+            path: (0, auth_config_1.AUTH_REFRESH_COOKIE_PATH)(),
+        });
+        res.clearCookie(auth_config_1.AUTH_COOKIE_ACCESS_TOKEN, {
+            ...base,
+            path: '/',
+        });
+    }
+    readRefreshToken(cookies) {
+        const value = cookies?.[auth_config_1.AUTH_COOKIE_REFRESH_TOKEN];
+        if (typeof value !== 'string' || !value.trim()) {
+            return null;
+        }
+        return value.trim();
+    }
+    readAccessTokenCookie(cookies) {
+        const value = cookies?.[auth_config_1.AUTH_COOKIE_ACCESS_TOKEN];
+        if (typeof value !== 'string' || !value.trim()) {
+            return null;
+        }
+        return value.trim();
+    }
+    refreshCookieOptions(maxAgeMs) {
+        return {
+            ...this.baseCookieOptions(),
+            httpOnly: true,
+            path: (0, auth_config_1.AUTH_REFRESH_COOKIE_PATH)(),
+            ...(maxAgeMs ? { maxAge: maxAgeMs } : {}),
+        };
+    }
+    accessCookieOptions(maxAgeMs) {
+        return {
+            ...this.baseCookieOptions(),
+            httpOnly: true,
+            path: '/',
+            maxAge: maxAgeMs,
+        };
+    }
+    baseCookieOptions() {
+        return {
+            secure: (0, auth_config_1.AUTH_COOKIE_SECURE)(),
+            sameSite: (0, auth_config_1.AUTH_COOKIE_SAME_SITE)(),
+        };
+    }
+};
+exports.AuthCookieService = AuthCookieService;
+exports.AuthCookieService = AuthCookieService = tslib_1.__decorate([
+    (0, common_1.Injectable)()
+], AuthCookieService);
+//#endregion
+//# sourceMappingURL=auth-cookie.service.js.map

package/security/src/lib/auth/auth-cookie.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-cookie.service.js","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/auth/auth-cookie.service.ts"],"names":[],"mappings":";;;;AAAA,2CAA4C;AAE5C,+CAMuB;AAEvB,uCAAuC;AAGhC,IAAM,iBAAiB,GAAvB,MAAM,iBAAiB;IAC5B,gBAAgB,CACd,GAAa,EACb,MAAwG;QAExG,GAAG,CAAC,MAAM,CACR,uCAAyB,EACzB,MAAM,CAAC,YAAY,EACnB,IAAI,CAAC,oBAAoB,CAAC,MAAM,CAAC,eAAe,CAAC,CAClD,CAAC;QAEF,IAAI,MAAM,CAAC,cAAc,EAAE,CAAC;YAC1B,GAAG,CAAC,MAAM,CACR,sCAAwB,EACxB,MAAM,CAAC,WAAW,EAClB,IAAI,CAAC,mBAAmB,CAAC,MAAM,CAAC,cAAc,CAAC,CAChD,CAAC;QACJ,CAAC;IACH,CAAC;IAED,gBAAgB,CAAC,GAAa;QAC5B,MAAM,IAAI,GAAG,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACtC,GAAG,CAAC,WAAW,CAAC,uCAAyB,EAAE;YACzC,GAAG,IAAI;YACP,IAAI,EAAE,IAAA,sCAAwB,GAAE;SACjC,CAAC,CAAC;QACH,GAAG,CAAC,WAAW,CAAC,sCAAwB,EAAE;YACxC,GAAG,IAAI;YACP,IAAI,EAAE,GAAG;SACV,CAAC,CAAC;IACL,CAAC;IAED,gBAAgB,CAAC,OAA4C;QAC3D,MAAM,KAAK,GAAG,OAAO,EAAE,CAAC,uCAAyB,CAAC,CAAC;QACnD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;YAC/C,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC;IACtB,CAAC;IAED,qBAAqB,CAAC,OAA4C;QAChE,MAAM,KAAK,GAAG,OAAO,EAAE,CAAC,sCAAwB,CAAC,CAAC;QAClD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;YAC/C,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC;IACtB,CAAC;IAEO,oBAAoB,CAAC,QAAiB;QAC5C,OAAO;YACL,GAAG,IAAI,CAAC,iBAAiB,EAAE;YAC3B,QAAQ,EAAE,IAAI;YACd,IAAI,EAAE,IAAA,sCAAwB,GAAE;YAChC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC1C,CAAC;IACJ,CAAC;IAEO,mBAAmB,CAAC,QAAgB;QAC1C,OAAO;YACL,GAAG,IAAI,CAAC,iBAAiB,EAAE;YAC3B,QAAQ,EAAE,IAAI;YACd,IAAI,EAAE,GAAG;YACT,MAAM,EAAE,QAAQ;SACjB,CAAC;IACJ,CAAC;IAEO,iBAAiB;QACvB,OAAO;YACL,MAAM,EAAE,IAAA,gCAAkB,GAAE;YAC5B,QAAQ,EAAE,IAAA,mCAAqB,GAAE;SAClC,CAAC;IACJ,CAAC;CACF,CAAA;AAxEY,8CAAiB;4BAAjB,iBAAiB;IAD7B,IAAA,mBAAU,GAAE;GACA,iBAAiB,CAwE7B;AAED,YAAY"}

package/security/src/lib/auth/auth-local-credentials.service.d.ts

@@ -0,0 +1,22 @@
+import { EntityStorageMiddlewareService } from '@acorex-platform/framework-server/core';
+import type { SecurityManagementUserRecord } from './auth.types';
+export declare class AuthLocalCredentialsService {
+    private readonly entityStorage;
+    private readonly logger;
+    constructor(entityStorage: EntityStorageMiddlewareService);
+    validate(username: string, password: string): Promise<SecurityManagementUserRecord>;
+    findUserByUsername(username: string): Promise<SecurityManagementUserRecord | null>;
+    findUserById(userId: string): Promise<SecurityManagementUserRecord | null>;
+    listUsers(): Promise<SecurityManagementUserRecord[]>;
+    blockUserAccess(userId: string): Promise<void>;
+    restoreUserAccess(userId: string): Promise<void>;
+    findOrCreateExternalUser(input: {
+        provider: string;
+        providerSubject: string;
+        email?: string;
+        displayName?: string;
+        picture?: string;
+    }): Promise<SecurityManagementUserRecord>;
+    private invalidCredentialsBody;
+}
+//# sourceMappingURL=auth-local-credentials.service.d.ts.map

package/security/src/lib/auth/auth-local-credentials.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-local-credentials.service.d.ts","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/auth/auth-local-credentials.service.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,8BAA8B,EAAE,MAAM,wCAAwC,CAAC;AAKxF,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,cAAc,CAAC;AASjE,qBACa,2BAA2B;IAG1B,OAAO,CAAC,QAAQ,CAAC,aAAa;IAF1C,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAgD;gBAE1C,aAAa,EAAE,8BAA8B;IAEpE,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,4BAA4B,CAAC;IAkCnF,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,4BAA4B,GAAG,IAAI,CAAC;IAKlF,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,4BAA4B,GAAG,IAAI,CAAC;IAK1E,SAAS,IAAI,OAAO,CAAC,4BAA4B,EAAE,CAAC;IASpD,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAU9C,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAUhD,wBAAwB,CAAC,KAAK,EAAE;QACpC,QAAQ,EAAE,MAAM,CAAC;QACjB,eAAe,EAAE,MAAM,CAAC;QACxB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,OAAO,CAAC,EAAE,MAAM,CAAC;KAClB,GAAG,OAAO,CAAC,4BAA4B,CAAC;IAyCzC,OAAO,CAAC,sBAAsB;CAO/B"}

package/security/src/lib/auth/auth-local-credentials.service.js

@@ -0,0 +1,130 @@
+"use strict";
+var AuthLocalCredentialsService_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AuthLocalCredentialsService = void 0;
+const tslib_1 = require("tslib");
+const common_1 = require("@nestjs/common");
+const core_1 = require("@acorex-platform/framework-server/core");
+const abstract_1 = require("@acorex-platform/framework-server/jql/abstract");
+const core_2 = require("@acorex-platform/framework-shared/core");
+const lodash_es_1 = require("lodash-es");
+const crypto_1 = require("crypto");
+//#region ---- Local credentials ----
+const USER_ENTITY = 'SecurityManagement.User';
+const ACTIVE_ACCOUNT_STATE = 'active';
+const ALLOWED_ACCESS_STATE = 'allowed';
+const BLOCKED_ACCESS_STATE = 'blocked';
+let AuthLocalCredentialsService = AuthLocalCredentialsService_1 = class AuthLocalCredentialsService {
+    constructor(entityStorage) {
+        this.entityStorage = entityStorage;
+        this.logger = new common_1.Logger(AuthLocalCredentialsService_1.name);
+    }
+    async validate(username, password) {
+        const user = await this.findUserByUsername(username);
+        if (!user) {
+            throw new common_1.UnauthorizedException(this.invalidCredentialsBody());
+        }
+        if (user.accessState === BLOCKED_ACCESS_STATE) {
+            throw new common_1.UnauthorizedException({
+                statusCode: 401,
+                message: 'Sign-in is blocked for this account.',
+                error: 'AccountBlocked',
+            });
+        }
+        if (user.accountState !== ACTIVE_ACCOUNT_STATE) {
+            throw new common_1.UnauthorizedException(this.invalidCredentialsBody());
+        }
+        if (!(0, lodash_es_1.isNil)(user.accessState) && user.accessState !== ALLOWED_ACCESS_STATE) {
+            throw new common_1.UnauthorizedException({
+                statusCode: 401,
+                message: 'Sign-in is not allowed for this account.',
+                error: 'AccountNotAllowed',
+            });
+        }
+        const valid = await (0, core_2.verifyPassword)(password, user.password);
+        if (!valid) {
+            throw new common_1.UnauthorizedException(this.invalidCredentialsBody());
+        }
+        return user;
+    }
+    async findUserByUsername(username) {
+        const users = await this.listUsers();
+        return users.find((u) => u.username === username) ?? null;
+    }
+    async findUserById(userId) {
+        const record = await this.entityStorage.getOne(USER_ENTITY, userId);
+        return record ?? null;
+    }
+    async listUsers() {
+        const result = await this.entityStorage.query(USER_ENTITY, (0, abstract_1.bypassAllEntityVisibilityFilters)({ skip: 0, take: 2000 }));
+        const items = (0, lodash_es_1.get)(result, 'items', []);
+        return Array.isArray(items) ? items : [];
+    }
+    async blockUserAccess(userId) {
+        try {
+            await this.entityStorage.updateOne(USER_ENTITY, userId, {
+                accessState: BLOCKED_ACCESS_STATE,
+            });
+        }
+        catch (error) {
+            this.logger.warn(`Failed to block user ${userId}: ${String(error)}`);
+        }
+    }
+    async restoreUserAccess(userId) {
+        try {
+            await this.entityStorage.updateOne(USER_ENTITY, userId, {
+                accessState: ALLOWED_ACCESS_STATE,
+            });
+        }
+        catch (error) {
+            this.logger.warn(`Failed to restore user access ${userId}: ${String(error)}`);
+        }
+    }
+    async findOrCreateExternalUser(input) {
+        const email = input.email?.trim().toLowerCase();
+        const candidates = new Set();
+        if (email) {
+            candidates.add(email);
+            const localPart = email.split('@')[0]?.trim();
+            if (localPart) {
+                candidates.add(localPart);
+            }
+        }
+        candidates.add(`${input.provider}:${input.providerSubject}`);
+        for (const username of candidates) {
+            const existing = await this.findUserByUsername(username);
+            if (existing) {
+                return existing;
+            }
+        }
+        const username = email || `${input.provider}.${input.providerSubject.slice(0, 24)}`;
+        const displayName = input.displayName?.trim() || username;
+        const id = (0, crypto_1.randomUUID)();
+        await this.entityStorage.insertOne(USER_ENTITY, {
+            id,
+            username,
+            displayName,
+            accountState: ACTIVE_ACCOUNT_STATE,
+            accessState: ALLOWED_ACCESS_STATE,
+        });
+        const created = await this.findUserById(id);
+        if (!created) {
+            throw new common_1.UnauthorizedException('Failed to create external user account.');
+        }
+        return created;
+    }
+    invalidCredentialsBody() {
+        return {
+            statusCode: 401,
+            message: 'Invalid username or password',
+            error: 'InvalidCredentials',
+        };
+    }
+};
+exports.AuthLocalCredentialsService = AuthLocalCredentialsService;
+exports.AuthLocalCredentialsService = AuthLocalCredentialsService = AuthLocalCredentialsService_1 = tslib_1.__decorate([
+    (0, common_1.Injectable)(),
+    tslib_1.__metadata("design:paramtypes", [core_1.EntityStorageMiddlewareService])
+], AuthLocalCredentialsService);
+//#endregion
+//# sourceMappingURL=auth-local-credentials.service.js.map

package/security/src/lib/auth/auth-local-credentials.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-local-credentials.service.js","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/auth/auth-local-credentials.service.ts"],"names":[],"mappings":";;;;;AAAA,2CAIwB;AACxB,iEAAwF;AACxF,6EAAkG;AAClG,iEAAwE;AACxE,yCAAuC;AACvC,mCAAoC;AAGpC,qCAAqC;AAErC,MAAM,WAAW,GAAG,yBAAyB,CAAC;AAC9C,MAAM,oBAAoB,GAAG,QAAQ,CAAC;AACtC,MAAM,oBAAoB,GAAG,SAAS,CAAC;AACvC,MAAM,oBAAoB,GAAG,SAAS,CAAC;AAGhC,IAAM,2BAA2B,mCAAjC,MAAM,2BAA2B;IAGtC,YAA6B,aAA6C;QAA7C,kBAAa,GAAb,aAAa,CAAgC;QAFzD,WAAM,GAAG,IAAI,eAAM,CAAC,6BAA2B,CAAC,IAAI,CAAC,CAAC;IAEM,CAAC;IAE9E,KAAK,CAAC,QAAQ,CAAC,QAAgB,EAAE,QAAgB;QAC/C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC;QACrD,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,8BAAqB,CAAC,IAAI,CAAC,sBAAsB,EAAE,CAAC,CAAC;QACjE,CAAC;QAED,IAAI,IAAI,CAAC,WAAW,KAAK,oBAAoB,EAAE,CAAC;YAC9C,MAAM,IAAI,8BAAqB,CAAC;gBAC9B,UAAU,EAAE,GAAG;gBACf,OAAO,EAAE,sCAAsC;gBAC/C,KAAK,EAAE,gBAAgB;aACxB,CAAC,CAAC;QACL,CAAC;QAED,IAAI,IAAI,CAAC,YAAY,KAAK,oBAAoB,EAAE,CAAC;YAC/C,MAAM,IAAI,8BAAqB,CAAC,IAAI,CAAC,sBAAsB,EAAE,CAAC,CAAC;QACjE,CAAC;QAED,IAAI,CAAC,IAAA,iBAAK,EAAC,IAAI,CAAC,WAAW,CAAC,IAAI,IAAI,CAAC,WAAW,KAAK,oBAAoB,EAAE,CAAC;YAC1E,MAAM,IAAI,8BAAqB,CAAC;gBAC9B,UAAU,EAAE,GAAG;gBACf,OAAO,EAAE,0CAA0C;gBACnD,KAAK,EAAE,mBAAmB;aAC3B,CAAC,CAAC;QACL,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,IAAA,qBAAc,EAAC,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC5D,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,8BAAqB,CAAC,IAAI,CAAC,sBAAsB,EAAE,CAAC,CAAC;QACjE,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,CAAC,kBAAkB,CAAC,QAAgB;QACvC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;QACrC,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,IAAI,IAAI,CAAC;IAC5D,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,MAAc;QAC/B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;QACpE,OAAQ,MAAuC,IAAI,IAAI,CAAC;IAC1D,CAAC;IAED,KAAK,CAAC,SAAS;QACb,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,KAAK,CAC3C,WAAW,EACX,IAAA,2CAAgC,EAAC,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAC1D,CAAC;QACF,MAAM,KAAK,GAAG,IAAA,eAAG,EAAC,MAAM,EAAE,OAAO,EAAE,EAAE,CAAmC,CAAC;QACzE,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3C,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,MAAc;QAClC,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,WAAW,EAAE,MAAM,EAAE;gBACtD,WAAW,EAAE,oBAAoB;aAClC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,wBAAwB,MAAM,KAAK,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACvE,CAAC;IACH,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,MAAc;QACpC,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,WAAW,EAAE,MAAM,EAAE;gBACtD,WAAW,EAAE,oBAAoB;aAClC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,iCAAiC,MAAM,KAAK,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAChF,CAAC;IACH,CAAC;IAED,KAAK,CAAC,wBAAwB,CAAC,KAM9B;QACC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAChD,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;QAErC,IAAI,KAAK,EAAE,CAAC;YACV,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YACtB,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;YAC9C,IAAI,SAAS,EAAE,CAAC;gBACd,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YAC5B,CAAC;QACH,CAAC;QAED,UAAU,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,eAAe,EAAE,CAAC,CAAC;QAE7D,KAAK,MAAM,QAAQ,IAAI,UAAU,EAAE,CAAC;YAClC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC;YACzD,IAAI,QAAQ,EAAE,CAAC;gBACb,OAAO,QAAQ,CAAC;YAClB,CAAC;QACH,CAAC;QAED,MAAM,QAAQ,GAAG,KAAK,IAAI,GAAG,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;QACpF,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,EAAE,IAAI,EAAE,IAAI,QAAQ,CAAC;QAC1D,MAAM,EAAE,GAAG,IAAA,mBAAU,GAAE,CAAC;QAExB,MAAM,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,WAAW,EAAE;YAC9C,EAAE;YACF,QAAQ;YACR,WAAW;YACX,YAAY,EAAE,oBAAoB;YAClC,WAAW,EAAE,oBAAoB;SAClC,CAAC,CAAC;QAEH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;QAC5C,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,8BAAqB,CAAC,yCAAyC,CAAC,CAAC;QAC7E,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;IAEO,sBAAsB;QAC5B,OAAO;YACL,UAAU,EAAE,GAAG;YACf,OAAO,EAAE,8BAA8B;YACvC,KAAK,EAAE,oBAAoB;SAC5B,CAAC;IACJ,CAAC;CACF,CAAA;AApIY,kEAA2B;sCAA3B,2BAA2B;IADvC,IAAA,mBAAU,GAAE;6CAIiC,qCAA8B;GAH/D,2BAA2B,CAoIvC;AAED,YAAY"}

package/security/src/lib/auth/auth-providers.contributor.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Optional extension hook for `GET /v1/auth/providers`.
+ * Framework merges each contributor section by {@link key} — no extension types in framework.
+ */
+export interface AuthProvidersContributor {
+    /** Response property name, e.g. `sso`. */
+    readonly key: string;
+    getSection(): unknown | Promise<unknown>;
+}
+export declare const AUTH_PROVIDERS_CONTRIBUTOR: unique symbol;
+//# sourceMappingURL=auth-providers.contributor.d.ts.map

package/security/src/lib/auth/auth-providers.contributor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-providers.contributor.d.ts","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/auth/auth-providers.contributor.ts"],"names":[],"mappings":"AAEA;;;GAGG;AACH,MAAM,WAAW,wBAAwB;IACvC,0CAA0C;IAC1C,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,UAAU,IAAI,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CAC1C;AAED,eAAO,MAAM,0BAA0B,eAAuC,CAAC"}

package/security/src/lib/auth/auth-providers.contributor.js

@@ -0,0 +1,7 @@
+"use strict";
+//#region ---- Auth providers contributor (extensions register into GET /v1/auth/providers) ----
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AUTH_PROVIDERS_CONTRIBUTOR = void 0;
+exports.AUTH_PROVIDERS_CONTRIBUTOR = Symbol('AUTH_PROVIDERS_CONTRIBUTOR');
+//#endregion
+//# sourceMappingURL=auth-providers.contributor.js.map

package/security/src/lib/auth/auth-providers.contributor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-providers.contributor.js","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/auth/auth-providers.contributor.ts"],"names":[],"mappings":";AAAA,gGAAgG;;;AAYnF,QAAA,0BAA0B,GAAG,MAAM,CAAC,4BAA4B,CAAC,CAAC;AAE/E,YAAY"}

package/security/src/lib/auth/auth.config.d.ts

@@ -0,0 +1,12 @@
+export declare const AUTH_COOKIE_REFRESH_TOKEN = "acx_refresh_token";
+/** Optional short-lived access token cookie for legacy cookie-based guards. */
+export declare const AUTH_COOKIE_ACCESS_TOKEN = "acx_access_token";
+export declare const AUTH_STRATEGY_USER_PASS = "user-pass";
+export declare const AUTH_MAX_LOGIN_ATTEMPTS: () => number;
+export declare const AUTH_LOCKOUT_DURATION_MINUTES: () => number;
+/** Failed attempts before the API signals that a login challenge may be required. */
+export declare const AUTH_CAPTCHA_ATTEMPT_THRESHOLD: () => number;
+export declare const AUTH_COOKIE_SECURE: () => boolean;
+export declare const AUTH_COOKIE_SAME_SITE: () => "lax" | "strict" | "none";
+export declare const AUTH_REFRESH_COOKIE_PATH: () => string;
+//# sourceMappingURL=auth.config.d.ts.map

package/security/src/lib/auth/auth.config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.config.d.ts","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/auth/auth.config.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,yBAAyB,sBAAsB,CAAC;AAE7D,+EAA+E;AAC/E,eAAO,MAAM,wBAAwB,qBAAqB,CAAC;AAE3D,eAAO,MAAM,uBAAuB,cAAc,CAAC;AAEnD,eAAO,MAAM,uBAAuB,QAAO,MAI1C,CAAC;AAEF,eAAO,MAAM,6BAA6B,QAAO,MAIhD,CAAC;AAEF,qFAAqF;AACrF,eAAO,MAAM,8BAA8B,QAAO,MAIjD,CAAC;AAEF,eAAO,MAAM,kBAAkB,QAAO,OACoD,CAAC;AAE3F,eAAO,MAAM,qBAAqB,QAAO,KAAK,GAAG,QAAQ,GAAG,MAM3D,CAAC;AAEF,eAAO,MAAM,wBAAwB,QAAO,MACuB,CAAC"}

package/security/src/lib/auth/auth.config.js

@@ -0,0 +1,41 @@
+"use strict";
+//#region ---- Auth configuration ----
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AUTH_REFRESH_COOKIE_PATH = exports.AUTH_COOKIE_SAME_SITE = exports.AUTH_COOKIE_SECURE = exports.AUTH_CAPTCHA_ATTEMPT_THRESHOLD = exports.AUTH_LOCKOUT_DURATION_MINUTES = exports.AUTH_MAX_LOGIN_ATTEMPTS = exports.AUTH_STRATEGY_USER_PASS = exports.AUTH_COOKIE_ACCESS_TOKEN = exports.AUTH_COOKIE_REFRESH_TOKEN = void 0;
+exports.AUTH_COOKIE_REFRESH_TOKEN = 'acx_refresh_token';
+/** Optional short-lived access token cookie for legacy cookie-based guards. */
+exports.AUTH_COOKIE_ACCESS_TOKEN = 'acx_access_token';
+exports.AUTH_STRATEGY_USER_PASS = 'user-pass';
+const AUTH_MAX_LOGIN_ATTEMPTS = () => {
+    const raw = process.env['AUTH_MAX_LOGIN_ATTEMPTS']?.trim();
+    const parsed = raw ? Number(raw) : 5;
+    return Number.isFinite(parsed) && parsed >= 1 ? parsed : 5;
+};
+exports.AUTH_MAX_LOGIN_ATTEMPTS = AUTH_MAX_LOGIN_ATTEMPTS;
+const AUTH_LOCKOUT_DURATION_MINUTES = () => {
+    const raw = process.env['AUTH_LOCKOUT_DURATION_MINUTES']?.trim();
+    const parsed = raw ? Number(raw) : 15;
+    return Number.isFinite(parsed) && parsed >= 1 ? parsed : 15;
+};
+exports.AUTH_LOCKOUT_DURATION_MINUTES = AUTH_LOCKOUT_DURATION_MINUTES;
+/** Failed attempts before the API signals that a login challenge may be required. */
+const AUTH_CAPTCHA_ATTEMPT_THRESHOLD = () => {
+    const raw = process.env['AUTH_CAPTCHA_ATTEMPT_THRESHOLD']?.trim();
+    const parsed = raw ? Number(raw) : 3;
+    return Number.isFinite(parsed) && parsed >= 1 ? parsed : 3;
+};
+exports.AUTH_CAPTCHA_ATTEMPT_THRESHOLD = AUTH_CAPTCHA_ATTEMPT_THRESHOLD;
+const AUTH_COOKIE_SECURE = () => process.env['NODE_ENV'] === 'production' || process.env['AUTH_COOKIE_SECURE'] === 'true';
+exports.AUTH_COOKIE_SECURE = AUTH_COOKIE_SECURE;
+const AUTH_COOKIE_SAME_SITE = () => {
+    const value = process.env['AUTH_COOKIE_SAME_SITE']?.trim().toLowerCase();
+    if (value === 'strict' || value === 'none') {
+        return value;
+    }
+    return 'lax';
+};
+exports.AUTH_COOKIE_SAME_SITE = AUTH_COOKIE_SAME_SITE;
+const AUTH_REFRESH_COOKIE_PATH = () => process.env['AUTH_REFRESH_COOKIE_PATH']?.trim() || '/api/v1/auth';
+exports.AUTH_REFRESH_COOKIE_PATH = AUTH_REFRESH_COOKIE_PATH;
+//#endregion
+//# sourceMappingURL=auth.config.js.map

package/security/src/lib/auth/auth.config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.config.js","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/auth/auth.config.ts"],"names":[],"mappings":";AAAA,sCAAsC;;;AAEzB,QAAA,yBAAyB,GAAG,mBAAmB,CAAC;AAE7D,+EAA+E;AAClE,QAAA,wBAAwB,GAAG,kBAAkB,CAAC;AAE9C,QAAA,uBAAuB,GAAG,WAAW,CAAC;AAE5C,MAAM,uBAAuB,GAAG,GAAW,EAAE;IAClD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC,EAAE,IAAI,EAAE,CAAC;IAC3D,MAAM,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACrC,OAAO,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;AAC7D,CAAC,CAAC;AAJW,QAAA,uBAAuB,2BAIlC;AAEK,MAAM,6BAA6B,GAAG,GAAW,EAAE;IACxD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,+BAA+B,CAAC,EAAE,IAAI,EAAE,CAAC;IACjE,MAAM,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACtC,OAAO,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;AAC9D,CAAC,CAAC;AAJW,QAAA,6BAA6B,iCAIxC;AAEF,qFAAqF;AAC9E,MAAM,8BAA8B,GAAG,GAAW,EAAE;IACzD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,gCAAgC,CAAC,EAAE,IAAI,EAAE,CAAC;IAClE,MAAM,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACrC,OAAO,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;AAC7D,CAAC,CAAC;AAJW,QAAA,8BAA8B,kCAIzC;AAEK,MAAM,kBAAkB,GAAG,GAAY,EAAE,CAC9C,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,YAAY,IAAI,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,KAAK,MAAM,CAAC;AAD9E,QAAA,kBAAkB,sBAC4D;AAEpF,MAAM,qBAAqB,GAAG,GAA8B,EAAE;IACnE,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACzE,IAAI,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,MAAM,EAAE,CAAC;QAC3C,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC,CAAC;AANW,QAAA,qBAAqB,yBAMhC;AAEK,MAAM,wBAAwB,GAAG,GAAW,EAAE,CACnD,OAAO,CAAC,GAAG,CAAC,0BAA0B,CAAC,EAAE,IAAI,EAAE,IAAI,cAAc,CAAC;AADvD,QAAA,wBAAwB,4BAC+B;AAEpE,YAAY"}

package/security/src/lib/auth/auth.controller.d.ts

@@ -1,10 +1,27 @@
+import { ModuleRef } from '@nestjs/core';
+import type { Request, Response } from 'express';
+import { AuthCookieService } from './auth-cookie.service';
 import { AuthService } from './auth.service';
-import type { AuthTokenResponseDto, RefreshTokenRequestDto, SignInRequestDto, UpdateSessionRequestDto } from './auth.types';
+import { TokenResolverService } from './token-resolver.service';
+import type { AuthTokenResponseDto, RefreshTokenRequestDto, RegisterRequestDto, SecurityManagementUserRecord, SignInRequestDto, UpdateSessionRequestDto } from './auth.types';
 export declare class AuthController {
     private readonly auth;
-    constructor(auth: AuthService);
-    signIn(body: SignInRequestDto): Promise<AuthTokenResponseDto>;
-    refresh(body: RefreshTokenRequestDto): Promise<AuthTokenResponseDto>;
-    updateSession(authorization: string | undefined, body: UpdateSessionRequestDto): Promise<AuthTokenResponseDto>;
-    private extractBearerToken;
+    private readonly cookies;
+    private readonly tokenResolver;
+    private readonly moduleRef;
+    constructor(auth: AuthService, cookies: AuthCookieService, tokenResolver: TokenResolverService, moduleRef: ModuleRef);
+    getProviders(): Promise<Record<string, unknown>>;
+    /** Resolved at request time — extension modules register after SecurityModule boots. */
+    private resolveProviderContributors;
+    signIn(body: SignInRequestDto, req: Request & {
+        user?: SecurityManagementUserRecord;
+    }, res: Response): Promise<AuthTokenResponseDto>;
+    register(body: RegisterRequestDto, req: Request, res: Response): Promise<AuthTokenResponseDto>;
+    refresh(body: RefreshTokenRequestDto, req: Request, res: Response): Promise<AuthTokenResponseDto>;
+    logout(body: RefreshTokenRequestDto, req: Request, res: Response): Promise<{
+        success: true;
+    }>;
+    updateSession(req: Request, res: Response, body: UpdateSessionRequestDto): Promise<AuthTokenResponseDto>;
+    private applyAuthCookies;
 }
+//# sourceMappingURL=auth.controller.d.ts.map

package/security/src/lib/auth/auth.controller.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.controller.d.ts","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/auth/auth.controller.ts"],"names":[],"mappings":"AAWA,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAEzC,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACjD,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC1D,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAE7C,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAQhE,OAAO,KAAK,EACV,oBAAoB,EACpB,sBAAsB,EACtB,kBAAkB,EAClB,4BAA4B,EAC5B,gBAAgB,EAChB,uBAAuB,EACxB,MAAM,cAAc,CAAC;AAItB,qBAEa,cAAc;IAEvB,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,aAAa;IAC9B,OAAO,CAAC,QAAQ,CAAC,SAAS;gBAHT,IAAI,EAAE,WAAW,EACjB,OAAO,EAAE,iBAAiB,EAC1B,aAAa,EAAE,oBAAoB,EACnC,SAAS,EAAE,SAAS;IAMjC,YAAY,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IActD,wFAAwF;IACxF,OAAO,CAAC,2BAA2B;IA2B7B,MAAM,CACF,IAAI,EAAE,gBAAgB,EACvB,GAAG,EAAE,OAAO,GAAG;QAAE,IAAI,CAAC,EAAE,4BAA4B,CAAA;KAAE,EACjC,GAAG,EAAE,QAAQ,GACxC,OAAO,CAAC,oBAAoB,CAAC;IAsB1B,QAAQ,CACJ,IAAI,EAAE,kBAAkB,EACzB,GAAG,EAAE,OAAO,EACS,GAAG,EAAE,QAAQ,GACxC,OAAO,CAAC,oBAAoB,CAAC;IAiB1B,OAAO,CACH,IAAI,EAAE,sBAAsB,EAC7B,GAAG,EAAE,OAAO,EACS,GAAG,EAAE,QAAQ,GACxC,OAAO,CAAC,oBAAoB,CAAC;IAkB1B,MAAM,CACF,IAAI,EAAE,sBAAsB,EAC7B,GAAG,EAAE,OAAO,EACS,GAAG,EAAE,QAAQ,GACxC,OAAO,CAAC;QAAE,OAAO,EAAE,IAAI,CAAA;KAAE,CAAC;IAuCvB,aAAa,CACV,GAAG,EAAE,OAAO,EACS,GAAG,EAAE,QAAQ,EACjC,IAAI,EAAE,uBAAuB,GACpC,OAAO,CAAC,oBAAoB,CAAC;IAgBhC,OAAO,CAAC,gBAAgB;CAQzB"}