@acorex-platform/framework-server 0.0.10 → 0.0.15

package/security/src/lib/oauth/platform-oauth.config.d.ts

@@ -0,0 +1,10 @@
+export declare const AUTH_OAUTH_CLIENT_IDS: () => string[];
+export declare const GOOGLE_OAUTH_CLIENT_ID: () => string | undefined;
+export declare const GOOGLE_OAUTH_CLIENT_SECRET: () => string | undefined;
+export declare const MICROSOFT_OAUTH_CLIENT_ID: () => string | undefined;
+export declare const MICROSOFT_OAUTH_CLIENT_SECRET: () => string | undefined;
+export declare const isGooglePlatformLoginConfigured: () => boolean;
+export declare const isMicrosoftPlatformLoginConfigured: () => boolean;
+export declare const PLATFORM_OAUTH_ISSUER: () => string;
+export declare const PLATFORM_OAUTH_CODE_TTL_MS: () => number;
+//# sourceMappingURL=platform-oauth.config.d.ts.map

package/security/src/lib/oauth/platform-oauth.config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform-oauth.config.d.ts","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/oauth/platform-oauth.config.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,qBAAqB,QAAO,MAAM,EAO9C,CAAC;AAEF,eAAO,MAAM,sBAAsB,QAAO,MAAM,GAAG,SACS,CAAC;AAE7D,eAAO,MAAM,0BAA0B,QAAO,MAAM,GAAG,SACS,CAAC;AAEjE,eAAO,MAAM,yBAAyB,QAAO,MAAM,GAAG,SACS,CAAC;AAEhE,eAAO,MAAM,6BAA6B,QAAO,MAAM,GAAG,SACS,CAAC;AAEpE,eAAO,MAAM,+BAA+B,QAAO,OACgB,CAAC;AAEpE,eAAO,MAAM,kCAAkC,QAAO,OACmB,CAAC;AAE1E,eAAO,MAAM,qBAAqB,QAAO,MAQxC,CAAC;AAEF,eAAO,MAAM,0BAA0B,QAAO,MAI7C,CAAC"}

package/security/src/lib/oauth/platform-oauth.config.js

@@ -0,0 +1,42 @@
+"use strict";
+//#region ---- Platform OAuth configuration ----
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PLATFORM_OAUTH_CODE_TTL_MS = exports.PLATFORM_OAUTH_ISSUER = exports.isMicrosoftPlatformLoginConfigured = exports.isGooglePlatformLoginConfigured = exports.MICROSOFT_OAUTH_CLIENT_SECRET = exports.MICROSOFT_OAUTH_CLIENT_ID = exports.GOOGLE_OAUTH_CLIENT_SECRET = exports.GOOGLE_OAUTH_CLIENT_ID = exports.AUTH_OAUTH_CLIENT_IDS = void 0;
+const AUTH_OAUTH_CLIENT_IDS = () => {
+    const raw = process.env['AUTH_OAUTH_CLIENT_IDS']?.trim();
+    const defaults = ['acorex', 'spa-client'];
+    if (!raw) {
+        return defaults;
+    }
+    return [...new Set([...raw.split(',').map((v) => v.trim()).filter(Boolean), ...defaults])];
+};
+exports.AUTH_OAUTH_CLIENT_IDS = AUTH_OAUTH_CLIENT_IDS;
+const GOOGLE_OAUTH_CLIENT_ID = () => process.env['GOOGLE_OAUTH_CLIENT_ID']?.trim() || undefined;
+exports.GOOGLE_OAUTH_CLIENT_ID = GOOGLE_OAUTH_CLIENT_ID;
+const GOOGLE_OAUTH_CLIENT_SECRET = () => process.env['GOOGLE_OAUTH_CLIENT_SECRET']?.trim() || undefined;
+exports.GOOGLE_OAUTH_CLIENT_SECRET = GOOGLE_OAUTH_CLIENT_SECRET;
+const MICROSOFT_OAUTH_CLIENT_ID = () => process.env['MICROSOFT_OAUTH_CLIENT_ID']?.trim() || undefined;
+exports.MICROSOFT_OAUTH_CLIENT_ID = MICROSOFT_OAUTH_CLIENT_ID;
+const MICROSOFT_OAUTH_CLIENT_SECRET = () => process.env['MICROSOFT_OAUTH_CLIENT_SECRET']?.trim() || undefined;
+exports.MICROSOFT_OAUTH_CLIENT_SECRET = MICROSOFT_OAUTH_CLIENT_SECRET;
+const isGooglePlatformLoginConfigured = () => Boolean((0, exports.GOOGLE_OAUTH_CLIENT_ID)() && (0, exports.GOOGLE_OAUTH_CLIENT_SECRET)());
+exports.isGooglePlatformLoginConfigured = isGooglePlatformLoginConfigured;
+const isMicrosoftPlatformLoginConfigured = () => Boolean((0, exports.MICROSOFT_OAUTH_CLIENT_ID)() && (0, exports.MICROSOFT_OAUTH_CLIENT_SECRET)());
+exports.isMicrosoftPlatformLoginConfigured = isMicrosoftPlatformLoginConfigured;
+const PLATFORM_OAUTH_ISSUER = () => {
+    const explicit = process.env['AUTH_OAUTH_ISSUER']?.trim();
+    if (explicit) {
+        return explicit.replace(/\/$/, '');
+    }
+    const port = process.env['PORT']?.trim() || '5500';
+    return `http://localhost:${port}/api`;
+};
+exports.PLATFORM_OAUTH_ISSUER = PLATFORM_OAUTH_ISSUER;
+const PLATFORM_OAUTH_CODE_TTL_MS = () => {
+    const raw = process.env['AUTH_OAUTH_CODE_TTL_MS']?.trim();
+    const parsed = raw ? Number(raw) : 300_000;
+    return Number.isFinite(parsed) && parsed >= 30_000 ? parsed : 300_000;
+};
+exports.PLATFORM_OAUTH_CODE_TTL_MS = PLATFORM_OAUTH_CODE_TTL_MS;
+//#endregion
+//# sourceMappingURL=platform-oauth.config.js.map

package/security/src/lib/oauth/platform-oauth.config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform-oauth.config.js","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/oauth/platform-oauth.config.ts"],"names":[],"mappings":";AAAA,gDAAgD;;;AAEzC,MAAM,qBAAqB,GAAG,GAAa,EAAE;IAClD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,EAAE,IAAI,EAAE,CAAC;IACzD,MAAM,QAAQ,GAAG,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;IAC1C,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;AAC7F,CAAC,CAAC;AAPW,QAAA,qBAAqB,yBAOhC;AAEK,MAAM,sBAAsB,GAAG,GAAuB,EAAE,CAC7D,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC,EAAE,IAAI,EAAE,IAAI,SAAS,CAAC;AADhD,QAAA,sBAAsB,0BAC0B;AAEtD,MAAM,0BAA0B,GAAG,GAAuB,EAAE,CACjE,OAAO,CAAC,GAAG,CAAC,4BAA4B,CAAC,EAAE,IAAI,EAAE,IAAI,SAAS,CAAC;AADpD,QAAA,0BAA0B,8BAC0B;AAE1D,MAAM,yBAAyB,GAAG,GAAuB,EAAE,CAChE,OAAO,CAAC,GAAG,CAAC,2BAA2B,CAAC,EAAE,IAAI,EAAE,IAAI,SAAS,CAAC;AADnD,QAAA,yBAAyB,6BAC0B;AAEzD,MAAM,6BAA6B,GAAG,GAAuB,EAAE,CACpE,OAAO,CAAC,GAAG,CAAC,+BAA+B,CAAC,EAAE,IAAI,EAAE,IAAI,SAAS,CAAC;AADvD,QAAA,6BAA6B,iCAC0B;AAE7D,MAAM,+BAA+B,GAAG,GAAY,EAAE,CAC3D,OAAO,CAAC,IAAA,8BAAsB,GAAE,IAAI,IAAA,kCAA0B,GAAE,CAAC,CAAC;AADvD,QAAA,+BAA+B,mCACwB;AAE7D,MAAM,kCAAkC,GAAG,GAAY,EAAE,CAC9D,OAAO,CAAC,IAAA,iCAAyB,GAAE,IAAI,IAAA,qCAA6B,GAAE,CAAC,CAAC;AAD7D,QAAA,kCAAkC,sCAC2B;AAEnE,MAAM,qBAAqB,GAAG,GAAW,EAAE;IAChD,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,EAAE,IAAI,EAAE,CAAC;IAC1D,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACrC,CAAC;IAED,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,MAAM,CAAC;IACnD,OAAO,oBAAoB,IAAI,MAAM,CAAC;AACxC,CAAC,CAAC;AARW,QAAA,qBAAqB,yBAQhC;AAEK,MAAM,0BAA0B,GAAG,GAAW,EAAE;IACrD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC,EAAE,IAAI,EAAE,CAAC;IAC1D,MAAM,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;IAC3C,OAAO,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,IAAI,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;AACxE,CAAC,CAAC;AAJW,QAAA,0BAA0B,8BAIrC;AAEF,YAAY"}

package/security/src/lib/oauth/platform-oauth.service.d.ts

@@ -0,0 +1,38 @@
+import { AuthService } from '../auth/auth.service';
+import { AuthLocalCredentialsService } from '../auth/auth-local-credentials.service';
+import { TokenService } from '../auth/token.service';
+import type { AuthRequestMeta } from '../auth/request-meta.util';
+import type { OAuthTokenResponse, PlatformOAuthAuthorizeRequest } from './platform-oauth.types';
+export declare class PlatformOAuthService {
+    private readonly auth;
+    private readonly credentials;
+    private readonly tokens;
+    private readonly logger;
+    private readonly authorizationCodes;
+    private readonly googleStates;
+    constructor(auth: AuthService, credentials: AuthLocalCredentialsService, tokens: TokenService);
+    getDiscoveryDocument(): {
+        issuer: string;
+        authorization_endpoint: string;
+        token_endpoint: string;
+        jwks_uri: string;
+        response_types_supported: string[];
+        grant_types_supported: string[];
+        code_challenge_methods_supported: string[];
+        scopes_supported: string[];
+    };
+    /** Dev platform broker uses HS256 id_tokens; JWKS is advertised for OIDC discovery clients only. */
+    getJwksDocument(): {
+        keys: unknown[];
+    };
+    beginAuthorization(request: PlatformOAuthAuthorizeRequest): string;
+    completeGoogleCallback(code: string, state: string): Promise<string>;
+    exchangeAuthorizationCode(body: Record<string, string | undefined>, meta: AuthRequestMeta): Promise<OAuthTokenResponse>;
+    private exchangeRefreshToken;
+    private exchangeGoogleAuthorizationCode;
+    private parseGoogleIdToken;
+    private assertSupportedAuthorizeRequest;
+    private assertClientId;
+    private verifyPkce;
+}
+//# sourceMappingURL=platform-oauth.service.d.ts.map

package/security/src/lib/oauth/platform-oauth.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform-oauth.service.d.ts","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/oauth/platform-oauth.service.ts"],"names":[],"mappings":"AASA,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,EAAE,2BAA2B,EAAE,MAAM,wCAAwC,CAAC;AACrF,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AASjE,OAAO,KAAK,EAEV,kBAAkB,EAGlB,6BAA6B,EAC9B,MAAM,wBAAwB,CAAC;AAIhC,qBACa,oBAAoB;IAM7B,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,WAAW;IAC5B,OAAO,CAAC,QAAQ,CAAC,MAAM;IAPzB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAyC;IAChE,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAsD;IACzF,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAgD;gBAG1D,IAAI,EAAE,WAAW,EACjB,WAAW,EAAE,2BAA2B,EACxC,MAAM,EAAE,YAAY;IAGvC,oBAAoB;;;;;;;;;;IAcpB,oGAAoG;IACpG,eAAe;cACQ,OAAO,EAAE;;IAGhC,kBAAkB,CAAC,OAAO,EAAE,6BAA6B,GAAG,MAAM;IA0C5D,sBAAsB,CAC1B,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,MAAM,CAAC;IAoCZ,yBAAyB,CAC7B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,EACxC,IAAI,EAAE,eAAe,GACpB,OAAO,CAAC,kBAAkB,CAAC;YAiEhB,oBAAoB;YA0BpB,+BAA+B;IAiD7C,OAAO,CAAC,kBAAkB;IAmB1B,OAAO,CAAC,+BAA+B;IAgBvC,OAAO,CAAC,cAAc;IAMtB,OAAO,CAAC,UAAU;CAYnB"}

package/security/src/lib/oauth/platform-oauth.service.js

@@ -0,0 +1,266 @@
+"use strict";
+var PlatformOAuthService_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PlatformOAuthService = void 0;
+const tslib_1 = require("tslib");
+const common_1 = require("@nestjs/common");
+const crypto_1 = require("crypto");
+const auth_service_1 = require("../auth/auth.service");
+const auth_local_credentials_service_1 = require("../auth/auth-local-credentials.service");
+const token_service_1 = require("../auth/token.service");
+const platform_oauth_config_1 = require("./platform-oauth.config");
+//#region ---- Platform OAuth service ----
+let PlatformOAuthService = PlatformOAuthService_1 = class PlatformOAuthService {
+    constructor(auth, credentials, tokens) {
+        this.auth = auth;
+        this.credentials = credentials;
+        this.tokens = tokens;
+        this.logger = new common_1.Logger(PlatformOAuthService_1.name);
+        this.authorizationCodes = new Map();
+        this.googleStates = new Map();
+    }
+    getDiscoveryDocument() {
+        const issuer = (0, platform_oauth_config_1.PLATFORM_OAUTH_ISSUER)();
+        return {
+            issuer,
+            authorization_endpoint: `${issuer}/connect/authorize`,
+            token_endpoint: `${issuer}/connect/token`,
+            jwks_uri: `${issuer}/.well-known/jwks.json`,
+            response_types_supported: ['code'],
+            grant_types_supported: ['authorization_code', 'refresh_token'],
+            code_challenge_methods_supported: ['S256'],
+            scopes_supported: ['openid', 'profile', 'email', 'offline_access'],
+        };
+    }
+    /** Dev platform broker uses HS256 id_tokens; JWKS is advertised for OIDC discovery clients only. */
+    getJwksDocument() {
+        return { keys: [] };
+    }
+    beginAuthorization(request) {
+        this.assertSupportedAuthorizeRequest(request);
+        if (request.provider !== 'google') {
+            throw new common_1.BadRequestException(`Unsupported external provider: ${request.provider}`);
+        }
+        const clientId = (0, platform_oauth_config_1.GOOGLE_OAUTH_CLIENT_ID)();
+        const clientSecret = (0, platform_oauth_config_1.GOOGLE_OAUTH_CLIENT_SECRET)();
+        if (!clientId || !clientSecret) {
+            throw new common_1.ServiceUnavailableException({
+                statusCode: 503,
+                message: 'Google platform login is not configured on the server. Set GOOGLE_OAUTH_CLIENT_ID and GOOGLE_OAUTH_CLIENT_SECRET in the workspace .env file, then restart demo-api. Google Cloud redirect URI must be http://localhost:5500/api/connect/callback/google',
+                error: 'GoogleLoginNotConfigured',
+            });
+        }
+        const state = (0, crypto_1.randomBytes)(16).toString('hex');
+        this.googleStates.set(state, {
+            codeChallenge: request.codeChallenge,
+            codeChallengeMethod: request.codeChallengeMethod,
+            redirectUri: request.redirectUri,
+            clientId: request.clientId,
+            provider: request.provider,
+            expiresAt: Date.now() + (0, platform_oauth_config_1.PLATFORM_OAUTH_CODE_TTL_MS)(),
+        });
+        const callbackUrl = `${(0, platform_oauth_config_1.PLATFORM_OAUTH_ISSUER)()}/connect/callback/google`;
+        const params = new URLSearchParams({
+            client_id: clientId,
+            redirect_uri: callbackUrl,
+            response_type: 'code',
+            scope: 'openid email profile',
+            state,
+            access_type: 'online',
+            prompt: 'select_account',
+        });
+        return `https://accounts.google.com/o/oauth2/v2/auth?${params.toString()}`;
+    }
+    async completeGoogleCallback(code, state) {
+        const googleState = this.googleStates.get(state);
+        this.googleStates.delete(state);
+        if (!googleState || googleState.expiresAt < Date.now()) {
+            throw new common_1.UnauthorizedException('Invalid or expired OAuth state.');
+        }
+        const profile = await this.exchangeGoogleAuthorizationCode(code);
+        const user = await this.credentials.findOrCreateExternalUser({
+            provider: 'google',
+            providerSubject: profile.sub,
+            email: profile.email,
+            displayName: profile.name,
+            picture: profile.picture,
+        });
+        const platformCode = (0, crypto_1.randomBytes)(24).toString('hex');
+        this.authorizationCodes.set(platformCode, {
+            codeChallenge: googleState.codeChallenge,
+            codeChallengeMethod: googleState.codeChallengeMethod,
+            redirectUri: googleState.redirectUri,
+            clientId: googleState.clientId,
+            userId: user.id,
+            userName: user.username ?? user.id,
+            userTitle: user.displayName ?? user.username ?? user.id,
+            userEmail: profile.email,
+            userPicture: profile.picture,
+            expiresAt: Date.now() + (0, platform_oauth_config_1.PLATFORM_OAUTH_CODE_TTL_MS)(),
+        });
+        const redirect = new URL(googleState.redirectUri);
+        redirect.searchParams.set('code', platformCode);
+        return redirect.toString();
+    }
+    async exchangeAuthorizationCode(body, meta) {
+        const grantType = body['grant_type']?.trim();
+        if (grantType === 'refresh_token') {
+            return this.exchangeRefreshToken(body['refresh_token'], body['client_id'], meta);
+        }
+        if (grantType !== 'authorization_code') {
+            throw new common_1.BadRequestException('Unsupported grant_type.');
+        }
+        const code = body['code']?.trim();
+        const redirectUri = body['redirect_uri']?.trim();
+        const clientId = body['client_id']?.trim();
+        const codeVerifier = body['code_verifier']?.trim();
+        if (!code || !redirectUri || !clientId || !codeVerifier) {
+            throw new common_1.BadRequestException('code, redirect_uri, client_id, and code_verifier are required.');
+        }
+        this.assertClientId(clientId);
+        const record = this.authorizationCodes.get(code);
+        this.authorizationCodes.delete(code);
+        if (!record || record.expiresAt < Date.now()) {
+            throw new common_1.UnauthorizedException('Invalid or expired authorization code.');
+        }
+        if (record.clientId !== clientId || record.redirectUri !== redirectUri) {
+            throw new common_1.UnauthorizedException('Authorization code does not match client or redirect URI.');
+        }
+        if (!this.verifyPkce(codeVerifier, record.codeChallenge, record.codeChallengeMethod)) {
+            throw new common_1.UnauthorizedException('Invalid PKCE code verifier.');
+        }
+        const user = await this.credentials.findUserById(record.userId);
+        if (!user) {
+            throw new common_1.UnauthorizedException('User not found.');
+        }
+        const authUser = {
+            id: user.id,
+            name: user.username ?? user.id,
+            title: user.displayName ?? user.username ?? user.id,
+        };
+        const tokens = this.tokens.issueTokenResponse(authUser, {});
+        const expiresIn = this.tokens.accessTokenExpiresInSeconds();
+        const idToken = this.tokens.issueIdToken(authUser, clientId, {
+            email: record.userEmail,
+            picture: record.userPicture,
+        });
+        await this.auth.completeSignIn(user, meta);
+        return {
+            access_token: tokens.accessToken,
+            refresh_token: tokens.refreshToken,
+            id_token: idToken,
+            token_type: 'Bearer',
+            expires_in: expiresIn,
+        };
+    }
+    async exchangeRefreshToken(refreshToken, clientId, meta) {
+        if (!refreshToken?.trim()) {
+            throw new common_1.BadRequestException('refresh_token is required.');
+        }
+        if (clientId) {
+            this.assertClientId(clientId);
+        }
+        const result = await this.auth.refreshSession(refreshToken.trim(), meta);
+        const expiresIn = this.tokens.accessTokenExpiresInSeconds();
+        const idToken = this.tokens.issueIdToken(result.user, clientId ?? (0, platform_oauth_config_1.AUTH_OAUTH_CLIENT_IDS)()[0], {});
+        return {
+            access_token: result.accessToken,
+            refresh_token: result.refreshToken,
+            id_token: idToken,
+            token_type: 'Bearer',
+            expires_in: expiresIn,
+        };
+    }
+    async exchangeGoogleAuthorizationCode(code) {
+        const clientId = (0, platform_oauth_config_1.GOOGLE_OAUTH_CLIENT_ID)();
+        const clientSecret = (0, platform_oauth_config_1.GOOGLE_OAUTH_CLIENT_SECRET)();
+        if (!clientId || !clientSecret) {
+            throw new common_1.InternalServerErrorException('Google OAuth is not configured.');
+        }
+        const callbackUrl = `${(0, platform_oauth_config_1.PLATFORM_OAUTH_ISSUER)()}/connect/callback/google`;
+        const body = new URLSearchParams({
+            code,
+            client_id: clientId,
+            client_secret: clientSecret,
+            redirect_uri: callbackUrl,
+            grant_type: 'authorization_code',
+        });
+        const tokenResponse = await fetch('https://oauth2.googleapis.com/token', {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+            body: body.toString(),
+        });
+        if (!tokenResponse.ok) {
+            const detail = await tokenResponse.text();
+            this.logger.warn(`Google token exchange failed: ${detail}`);
+            throw new common_1.UnauthorizedException('Google authorization failed.');
+        }
+        const tokenData = (await tokenResponse.json());
+        if (tokenData.id_token) {
+            return this.parseGoogleIdToken(tokenData.id_token);
+        }
+        if (!tokenData.access_token) {
+            throw new common_1.UnauthorizedException('Google authorization failed.');
+        }
+        const profileResponse = await fetch('https://openidconnect.googleapis.com/v1/userinfo', {
+            headers: { Authorization: `Bearer ${tokenData.access_token}` },
+        });
+        if (!profileResponse.ok) {
+            throw new common_1.UnauthorizedException('Google profile lookup failed.');
+        }
+        const profile = (await profileResponse.json());
+        return profile;
+    }
+    parseGoogleIdToken(idToken) {
+        const parts = idToken.split('.');
+        if (parts.length < 2) {
+            throw new common_1.UnauthorizedException('Invalid Google id_token.');
+        }
+        const payload = JSON.parse(Buffer.from(parts[1], 'base64url').toString('utf8'));
+        return {
+            sub: payload.sub,
+            email: payload.email,
+            emailVerified: payload.email_verified,
+            name: payload.name,
+            picture: payload.picture,
+        };
+    }
+    assertSupportedAuthorizeRequest(request) {
+        if (request.responseType !== 'code') {
+            throw new common_1.BadRequestException('Only response_type=code is supported.');
+        }
+        this.assertClientId(request.clientId);
+        if (!request.redirectUri?.trim()) {
+            throw new common_1.BadRequestException('redirect_uri is required.');
+        }
+        if (!request.codeChallenge?.trim() || request.codeChallengeMethod !== 'S256') {
+            throw new common_1.BadRequestException('PKCE S256 code_challenge is required.');
+        }
+    }
+    assertClientId(clientId) {
+        if (!(0, platform_oauth_config_1.AUTH_OAUTH_CLIENT_IDS)().includes(clientId)) {
+            throw new common_1.BadRequestException(`Unsupported client_id: ${clientId}`);
+        }
+    }
+    verifyPkce(codeVerifier, codeChallenge, method) {
+        if (method !== 'S256') {
+            return false;
+        }
+        const digest = (0, crypto_1.createHash)('sha256').update(codeVerifier).digest('base64url');
+        try {
+            return (0, crypto_1.timingSafeEqual)(Buffer.from(digest), Buffer.from(codeChallenge));
+        }
+        catch {
+            return false;
+        }
+    }
+};
+exports.PlatformOAuthService = PlatformOAuthService;
+exports.PlatformOAuthService = PlatformOAuthService = PlatformOAuthService_1 = tslib_1.__decorate([
+    (0, common_1.Injectable)(),
+    tslib_1.__metadata("design:paramtypes", [auth_service_1.AuthService,
+        auth_local_credentials_service_1.AuthLocalCredentialsService,
+        token_service_1.TokenService])
+], PlatformOAuthService);
+//#endregion
+//# sourceMappingURL=platform-oauth.service.js.map

package/security/src/lib/oauth/platform-oauth.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform-oauth.service.js","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/oauth/platform-oauth.service.ts"],"names":[],"mappings":";;;;;AAAA,2CAOwB;AACxB,mCAA8E;AAC9E,uDAAmD;AACnD,2FAAqF;AACrF,yDAAqD;AAGrD,mEAMiC;AASjC,0CAA0C;AAGnC,IAAM,oBAAoB,4BAA1B,MAAM,oBAAoB;IAK/B,YACmB,IAAiB,EACjB,WAAwC,EACxC,MAAoB;QAFpB,SAAI,GAAJ,IAAI,CAAa;QACjB,gBAAW,GAAX,WAAW,CAA6B;QACxC,WAAM,GAAN,MAAM,CAAc;QAPtB,WAAM,GAAG,IAAI,eAAM,CAAC,sBAAoB,CAAC,IAAI,CAAC,CAAC;QAC/C,uBAAkB,GAAG,IAAI,GAAG,EAA2C,CAAC;QACxE,iBAAY,GAAG,IAAI,GAAG,EAAqC,CAAC;IAM1E,CAAC;IAEJ,oBAAoB;QAClB,MAAM,MAAM,GAAG,IAAA,6CAAqB,GAAE,CAAC;QACvC,OAAO;YACL,MAAM;YACN,sBAAsB,EAAE,GAAG,MAAM,oBAAoB;YACrD,cAAc,EAAE,GAAG,MAAM,gBAAgB;YACzC,QAAQ,EAAE,GAAG,MAAM,wBAAwB;YAC3C,wBAAwB,EAAE,CAAC,MAAM,CAAC;YAClC,qBAAqB,EAAE,CAAC,oBAAoB,EAAE,eAAe,CAAC;YAC9D,gCAAgC,EAAE,CAAC,MAAM,CAAC;YAC1C,gBAAgB,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,gBAAgB,CAAC;SACnE,CAAC;IACJ,CAAC;IAED,oGAAoG;IACpG,eAAe;QACb,OAAO,EAAE,IAAI,EAAE,EAAe,EAAE,CAAC;IACnC,CAAC;IAED,kBAAkB,CAAC,OAAsC;QACvD,IAAI,CAAC,+BAA+B,CAAC,OAAO,CAAC,CAAC;QAE9C,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAClC,MAAM,IAAI,4BAAmB,CAAC,kCAAkC,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;QACtF,CAAC;QAED,MAAM,QAAQ,GAAG,IAAA,8CAAsB,GAAE,CAAC;QAC1C,MAAM,YAAY,GAAG,IAAA,kDAA0B,GAAE,CAAC;QAClD,IAAI,CAAC,QAAQ,IAAI,CAAC,YAAY,EAAE,CAAC;YAC/B,MAAM,IAAI,oCAA2B,CAAC;gBACpC,UAAU,EAAE,GAAG;gBACf,OAAO,EACL,yPAAyP;gBAC3P,KAAK,EAAE,0BAA0B;aAClC,CAAC,CAAC;QACL,CAAC;QAED,MAAM,KAAK,GAAG,IAAA,oBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC9C,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,EAAE;YAC3B,aAAa,EAAE,OAAO,CAAC,aAAa;YACpC,mBAAmB,EAAE,OAAO,CAAC,mBAAmB;YAChD,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,IAAA,kDAA0B,GAAE;SACrD,CAAC,CAAC;QAEH,MAAM,WAAW,GAAG,GAAG,IAAA,6CAAqB,GAAE,0BAA0B,CAAC;QACzE,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;YACjC,SAAS,EAAE,QAAQ;YACnB,YAAY,EAAE,WAAW;YACzB,aAAa,EAAE,MAAM;YACrB,KAAK,EAAE,sBAAsB;YAC7B,KAAK;YACL,WAAW,EAAE,QAAQ;YACrB,MAAM,EAAE,gBAAgB;SACzB,CAAC,CAAC;QAEH,OAAO,gDAAgD,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC;IAC7E,CAAC;IAED,KAAK,CAAC,sBAAsB,CAC1B,IAAY,EACZ,KAAa;QAEb,MAAM,WAAW,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACjD,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAEhC,IAAI,CAAC,WAAW,IAAI,WAAW,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YACvD,MAAM,IAAI,8BAAqB,CAAC,iCAAiC,CAAC,CAAC;QACrE,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,+BAA+B,CAAC,IAAI,CAAC,CAAC;QACjE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,wBAAwB,CAAC;YAC3D,QAAQ,EAAE,QAAQ;YAClB,eAAe,EAAE,OAAO,CAAC,GAAG;YAC5B,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,WAAW,EAAE,OAAO,CAAC,IAAI;YACzB,OAAO,EAAE,OAAO,CAAC,OAAO;SACzB,CAAC,CAAC;QAEH,MAAM,YAAY,GAAG,IAAA,oBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACrD,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,YAAY,EAAE;YACxC,aAAa,EAAE,WAAW,CAAC,aAAa;YACxC,mBAAmB,EAAE,WAAW,CAAC,mBAAmB;YACpD,WAAW,EAAE,WAAW,CAAC,WAAW;YACpC,QAAQ,EAAE,WAAW,CAAC,QAAQ;YAC9B,MAAM,EAAE,IAAI,CAAC,EAAE;YACf,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,EAAE;YAClC,SAAS,EAAE,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,EAAE;YACvD,SAAS,EAAE,OAAO,CAAC,KAAK;YACxB,WAAW,EAAE,OAAO,CAAC,OAAO;YAC5B,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,IAAA,kDAA0B,GAAE;SACrD,CAAC,CAAC;QAEH,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC;QAClD,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;QAChD,OAAO,QAAQ,CAAC,QAAQ,EAAE,CAAC;IAC7B,CAAC;IAED,KAAK,CAAC,yBAAyB,CAC7B,IAAwC,EACxC,IAAqB;QAErB,MAAM,SAAS,GAAG,IAAI,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,CAAC;QAC7C,IAAI,SAAS,KAAK,eAAe,EAAE,CAAC;YAClC,OAAO,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE,IAAI,CAAC,WAAW,CAAC,EAAE,IAAI,CAAC,CAAC;QACnF,CAAC;QAED,IAAI,SAAS,KAAK,oBAAoB,EAAE,CAAC;YACvC,MAAM,IAAI,4BAAmB,CAAC,yBAAyB,CAAC,CAAC;QAC3D,CAAC;QAED,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC;QAClC,MAAM,WAAW,GAAG,IAAI,CAAC,cAAc,CAAC,EAAE,IAAI,EAAE,CAAC;QACjD,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,CAAC;QAC3C,MAAM,YAAY,GAAG,IAAI,CAAC,eAAe,CAAC,EAAE,IAAI,EAAE,CAAC;QAEnD,IAAI,CAAC,IAAI,IAAI,CAAC,WAAW,IAAI,CAAC,QAAQ,IAAI,CAAC,YAAY,EAAE,CAAC;YACxD,MAAM,IAAI,4BAAmB,CAAC,gEAAgE,CAAC,CAAC;QAClG,CAAC;QAED,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;QAE9B,MAAM,MAAM,GAAG,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACjD,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAErC,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YAC7C,MAAM,IAAI,8BAAqB,CAAC,wCAAwC,CAAC,CAAC;QAC5E,CAAC;QAED,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,MAAM,CAAC,WAAW,KAAK,WAAW,EAAE,CAAC;YACvE,MAAM,IAAI,8BAAqB,CAAC,2DAA2D,CAAC,CAAC;QAC/F,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,YAAY,EAAE,MAAM,CAAC,aAAa,EAAE,MAAM,CAAC,mBAAmB,CAAC,EAAE,CAAC;YACrF,MAAM,IAAI,8BAAqB,CAAC,6BAA6B,CAAC,CAAC;QACjE,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAChE,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,8BAAqB,CAAC,iBAAiB,CAAC,CAAC;QACrD,CAAC;QAED,MAAM,QAAQ,GAAgB;YAC5B,EAAE,EAAE,IAAI,CAAC,EAAE;YACX,IAAI,EAAE,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,EAAE;YAC9B,KAAK,EAAE,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,EAAE;SACpD,CAAC;QAEF,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,kBAAkB,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;QAC5D,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,2BAA2B,EAAE,CAAC;QAC5D,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,QAAQ,EAAE,QAAQ,EAAE;YAC3D,KAAK,EAAE,MAAM,CAAC,SAAS;YACvB,OAAO,EAAE,MAAM,CAAC,WAAW;SAC5B,CAAC,CAAC;QAEH,MAAM,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAE3C,OAAO;YACL,YAAY,EAAE,MAAM,CAAC,WAAW;YAChC,aAAa,EAAE,MAAM,CAAC,YAAY;YAClC,QAAQ,EAAE,OAAO;YACjB,UAAU,EAAE,QAAQ;YACpB,UAAU,EAAE,SAAS;SACtB,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,oBAAoB,CAChC,YAAgC,EAChC,QAA4B,EAC5B,IAAqB;QAErB,IAAI,CAAC,YAAY,EAAE,IAAI,EAAE,EAAE,CAAC;YAC1B,MAAM,IAAI,4BAAmB,CAAC,4BAA4B,CAAC,CAAC;QAC9D,CAAC;QAED,IAAI,QAAQ,EAAE,CAAC;YACb,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;QAChC,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,YAAY,CAAC,IAAI,EAAE,EAAE,IAAI,CAAC,CAAC;QACzE,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,2BAA2B,EAAE,CAAC;QAC5D,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,IAAI,IAAA,6CAAqB,GAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAElG,OAAO;YACL,YAAY,EAAE,MAAM,CAAC,WAAW;YAChC,aAAa,EAAE,MAAM,CAAC,YAAY;YAClC,QAAQ,EAAE,OAAO;YACjB,UAAU,EAAE,QAAQ;YACpB,UAAU,EAAE,SAAS;SACtB,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,+BAA+B,CAAC,IAAY;QACxD,MAAM,QAAQ,GAAG,IAAA,8CAAsB,GAAE,CAAC;QAC1C,MAAM,YAAY,GAAG,IAAA,kDAA0B,GAAE,CAAC;QAClD,IAAI,CAAC,QAAQ,IAAI,CAAC,YAAY,EAAE,CAAC;YAC/B,MAAM,IAAI,qCAA4B,CAAC,iCAAiC,CAAC,CAAC;QAC5E,CAAC;QAED,MAAM,WAAW,GAAG,GAAG,IAAA,6CAAqB,GAAE,0BAA0B,CAAC;QACzE,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;YAC/B,IAAI;YACJ,SAAS,EAAE,QAAQ;YACnB,aAAa,EAAE,YAAY;YAC3B,YAAY,EAAE,WAAW;YACzB,UAAU,EAAE,oBAAoB;SACjC,CAAC,CAAC;QAEH,MAAM,aAAa,GAAG,MAAM,KAAK,CAAC,qCAAqC,EAAE;YACvE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;YAChE,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE;SACtB,CAAC,CAAC;QAEH,IAAI,CAAC,aAAa,CAAC,EAAE,EAAE,CAAC;YACtB,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,IAAI,EAAE,CAAC;YAC1C,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,iCAAiC,MAAM,EAAE,CAAC,CAAC;YAC5D,MAAM,IAAI,8BAAqB,CAAC,8BAA8B,CAAC,CAAC;QAClE,CAAC;QAED,MAAM,SAAS,GAAG,CAAC,MAAM,aAAa,CAAC,IAAI,EAAE,CAAiD,CAAC;QAC/F,IAAI,SAAS,CAAC,QAAQ,EAAE,CAAC;YACvB,OAAO,IAAI,CAAC,kBAAkB,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QACrD,CAAC;QAED,IAAI,CAAC,SAAS,CAAC,YAAY,EAAE,CAAC;YAC5B,MAAM,IAAI,8BAAqB,CAAC,8BAA8B,CAAC,CAAC;QAClE,CAAC;QAED,MAAM,eAAe,GAAG,MAAM,KAAK,CAAC,kDAAkD,EAAE;YACtF,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,SAAS,CAAC,YAAY,EAAE,EAAE;SAC/D,CAAC,CAAC;QAEH,IAAI,CAAC,eAAe,CAAC,EAAE,EAAE,CAAC;YACxB,MAAM,IAAI,8BAAqB,CAAC,+BAA+B,CAAC,CAAC;QACnE,CAAC;QAED,MAAM,OAAO,GAAG,CAAC,MAAM,eAAe,CAAC,IAAI,EAAE,CAAkB,CAAC;QAChE,OAAO,OAAO,CAAC;IACjB,CAAC;IAEO,kBAAkB,CAAC,OAAe;QACxC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACrB,MAAM,IAAI,8BAAqB,CAAC,0BAA0B,CAAC,CAAC;QAC9D,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAE7E,CAAC;QAEF,OAAO;YACL,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,aAAa,EAAE,OAAO,CAAC,cAAc;YACrC,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,OAAO,EAAE,OAAO,CAAC,OAAO;SACzB,CAAC;IACJ,CAAC;IAEO,+BAA+B,CAAC,OAAsC;QAC5E,IAAI,OAAO,CAAC,YAAY,KAAK,MAAM,EAAE,CAAC;YACpC,MAAM,IAAI,4BAAmB,CAAC,uCAAuC,CAAC,CAAC;QACzE,CAAC;QAED,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAEtC,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,IAAI,EAAE,EAAE,CAAC;YACjC,MAAM,IAAI,4BAAmB,CAAC,2BAA2B,CAAC,CAAC;QAC7D,CAAC;QAED,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,IAAI,EAAE,IAAI,OAAO,CAAC,mBAAmB,KAAK,MAAM,EAAE,CAAC;YAC7E,MAAM,IAAI,4BAAmB,CAAC,uCAAuC,CAAC,CAAC;QACzE,CAAC;IACH,CAAC;IAEO,cAAc,CAAC,QAAgB;QACrC,IAAI,CAAC,IAAA,6CAAqB,GAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YAChD,MAAM,IAAI,4BAAmB,CAAC,0BAA0B,QAAQ,EAAE,CAAC,CAAC;QACtE,CAAC;IACH,CAAC;IAEO,UAAU,CAAC,YAAoB,EAAE,aAAqB,EAAE,MAAc;QAC5E,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;YACtB,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,MAAM,GAAG,IAAA,mBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QAC7E,IAAI,CAAC;YACH,OAAO,IAAA,wBAAe,EAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC;QAC1E,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;CACF,CAAA;AAnTY,oDAAoB;+BAApB,oBAAoB;IADhC,IAAA,mBAAU,GAAE;6CAOc,0BAAW;QACJ,4DAA2B;QAChC,4BAAY;GAR5B,oBAAoB,CAmThC;AAED,YAAY"}

package/security/src/lib/oauth/platform-oauth.types.d.ts

@@ -0,0 +1,45 @@
+export interface PlatformOAuthAuthorizeRequest {
+    responseType: string;
+    clientId: string;
+    redirectUri: string;
+    scope: string;
+    codeChallenge: string;
+    codeChallengeMethod: string;
+    provider: string;
+    state?: string;
+}
+export interface PlatformAuthorizationCodeRecord {
+    codeChallenge: string;
+    codeChallengeMethod: string;
+    redirectUri: string;
+    clientId: string;
+    userId: string;
+    userName: string;
+    userTitle: string;
+    userEmail?: string;
+    userPicture?: string;
+    expiresAt: number;
+}
+export interface PlatformGoogleStateRecord {
+    codeChallenge: string;
+    codeChallengeMethod: string;
+    redirectUri: string;
+    clientId: string;
+    provider: string;
+    expiresAt: number;
+}
+export interface GoogleProfile {
+    sub: string;
+    email?: string;
+    emailVerified?: boolean;
+    name?: string;
+    picture?: string;
+}
+export interface OAuthTokenResponse {
+    access_token: string;
+    refresh_token: string;
+    id_token: string;
+    token_type: 'Bearer';
+    expires_in: number;
+}
+//# sourceMappingURL=platform-oauth.types.d.ts.map

package/security/src/lib/oauth/platform-oauth.types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform-oauth.types.d.ts","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/oauth/platform-oauth.types.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,6BAA6B;IAC5C,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,aAAa,EAAE,MAAM,CAAC;IACtB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,+BAA+B;IAC9C,aAAa,EAAE,MAAM,CAAC;IACtB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,yBAAyB;IACxC,aAAa,EAAE,MAAM,CAAC;IACtB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,aAAa;IAC5B,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,kBAAkB;IACjC,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,QAAQ,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;CACpB"}

package/security/src/lib/oauth/platform-oauth.types.js

@@ -0,0 +1,5 @@
+"use strict";
+//#region ---- Platform OAuth types ----
+Object.defineProperty(exports, "__esModule", { value: true });
+//#endregion
+//# sourceMappingURL=platform-oauth.types.js.map

package/security/src/lib/oauth/platform-oauth.types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform-oauth.types.js","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/oauth/platform-oauth.types.ts"],"names":[],"mappings":";AAAA,wCAAwC;;AAmDxC,YAAY"}

package/security/src/lib/security.module.d.ts

@@ -6,3 +6,4 @@ import { MiddlewareConsumer, NestModule } from '@nestjs/common';
 export declare class SecurityModule implements NestModule {
     configure(consumer: MiddlewareConsumer): void;
 }
+//# sourceMappingURL=security.module.d.ts.map

package/security/src/lib/security.module.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"security.module.d.ts","sourceRoot":"","sources":["../../../../../../../libs/framework/server/security/src/lib/security.module.ts"],"names":[],"mappings":"AAAA,OAAO,EAAU,kBAAkB,EAAU,UAAU,EAAgC,MAAM,gBAAgB,CAAC;AAyB9G;;;GAGG;AACH,qBA8Ca,cAAe,YAAW,UAAU;IAC/C,SAAS,CAAC,QAAQ,EAAE,kBAAkB,GAAG,IAAI;CAK9C"}

package/security/src/lib/security.module.js

@@ -3,18 +3,27 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.SecurityModule = void 0;
 const tslib_1 = require("tslib");
 const common_1 = require("@nestjs/common");
+const passport_1 = require("@nestjs/passport");
 const core_1 = require("@acorex-platform/framework-server/core");
 const auth_controller_1 = require("./auth/auth.controller");
+const auth_cookie_service_1 = require("./auth/auth-cookie.service");
+const auth_local_credentials_service_1 = require("./auth/auth-local-credentials.service");
 const auth_service_1 = require("./auth/auth.service");
+const device_session_service_1 = require("./auth/device-session.service");
+const login_attempt_service_1 = require("./auth/login-attempt.service");
+const machine_token_service_1 = require("./auth/machine-token.service");
+const token_resolver_service_1 = require("./auth/token-resolver.service");
+const token_service_1 = require("./auth/token.service");
 const jwt_auth_guard_1 = require("./auth/jwt-auth.guard");
+const local_strategy_1 = require("./auth/strategies/local.strategy");
+const connect_controller_1 = require("./oauth/connect.controller");
+const platform_oauth_service_1 = require("./oauth/platform-oauth.service");
 const policy_enforce_middleware_1 = require("./entity-storage/policy-enforce.middleware");
 const visibility_filter_middleware_1 = require("./entity-storage/visibility-filter.middleware");
-const abp_controller_1 = require("./session/abp.controller");
-const applications_controller_1 = require("./session/applications.controller");
+const session_controller_1 = require("./session/session.controller");
 const backend_session_service_1 = require("./session/backend-session.service");
 const optional_jwt_session_middleware_1 = require("./session/optional-jwt-session.middleware");
 const session_context_service_1 = require("./session/session-context.service");
-const tenants_controller_1 = require("./session/tenants.controller");
 //#region ---- Platform security module ----
 /**
  * JWT authentication and per-request session context.
@@ -22,17 +31,28 @@ const tenants_controller_1 = require("./session/tenants.controller");
  */
 let SecurityModule = class SecurityModule {
     configure(consumer) {
-        consumer.apply(optional_jwt_session_middleware_1.OptionalJwtSessionMiddleware).forRoutes('*');
+        consumer
+            .apply(optional_jwt_session_middleware_1.OptionalJwtSessionMiddleware)
+            .forRoutes({ path: '*splat', method: common_1.RequestMethod.ALL });
     }
 };
 exports.SecurityModule = SecurityModule;
 exports.SecurityModule = SecurityModule = tslib_1.__decorate([
     (0, common_1.Global)(),
     (0, common_1.Module)({
-        imports: [core_1.EntityStorageModule],
-        controllers: [auth_controller_1.AuthController, tenants_controller_1.TenantsController, applications_controller_1.ApplicationsController, abp_controller_1.AbpController],
+        imports: [core_1.EntityStorageModule, passport_1.PassportModule.register({ session: false })],
+        controllers: [auth_controller_1.AuthController, connect_controller_1.ConnectController, session_controller_1.SessionController],
         providers: [
             auth_service_1.AuthService,
+            platform_oauth_service_1.PlatformOAuthService,
+            auth_local_credentials_service_1.AuthLocalCredentialsService,
+            login_attempt_service_1.LoginAttemptService,
+            token_service_1.TokenService,
+            token_resolver_service_1.TokenResolverService,
+            auth_cookie_service_1.AuthCookieService,
+            device_session_service_1.DeviceSessionService,
+            local_strategy_1.LocalStrategy,
+            machine_token_service_1.MachineTokenService,
             backend_session_service_1.BackendSessionService,
             session_context_service_1.SessionContextService,
             jwt_auth_guard_1.JwtAuthGuard,
@@ -52,6 +72,10 @@ exports.SecurityModule = SecurityModule = tslib_1.__decorate([
         ],
         exports: [
             auth_service_1.AuthService,
+            token_service_1.TokenService,
+            token_resolver_service_1.TokenResolverService,
+            auth_cookie_service_1.AuthCookieService,
+            machine_token_service_1.MachineTokenService,
             backend_session_service_1.BackendSessionService,
             session_context_service_1.SessionContextService,
             jwt_auth_guard_1.JwtAuthGuard,

package/security/src/lib/security.module.js.map

@@ -1 +1 @@
-{"version":3,"file":"security.module.js","sourceRoot":"","sources":["../../../../../../../libs/framework/server/security/src/lib/security.module.ts"],"names":[],"mappings":";;;;AAAA,2CAA+F;AAC/F,iEAAwG;AACxG,4DAAwD;AACxD,sDAAkD;AAClD,0DAAqD;AACrD,0FAAqF;AACrF,gGAA2F;AAC3F,6DAAyD;AACzD,+EAA2E;AAC3E,+EAA0E;AAC1E,+FAAyF;AACzF,+EAA0E;AAC1E,qEAAiE;AAEjE,4CAA4C;AAE5C;;;GAGG;AAkCI,IAAM,cAAc,GAApB,MAAM,cAAc;IACzB,SAAS,CAAC,QAA4B;QACpC,QAAQ,CAAC,KAAK,CAAC,8DAA4B,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IAC9D,CAAC;CACF,CAAA;AAJY,wCAAc;yBAAd,cAAc;IAjC1B,IAAA,eAAM,GAAE;IACR,IAAA,eAAM,EAAC;QACN,OAAO,EAAE,CAAC,0BAAmB,CAAC;QAC9B,WAAW,EAAE,CAAC,gCAAc,EAAE,sCAAiB,EAAE,gDAAsB,EAAE,8BAAa,CAAC;QACvF,SAAS,EAAE;YACT,0BAAW;YACX,+CAAqB;YACrB,+CAAqB;YACrB,6BAAY;YACZ,8DAA4B;YAC5B,yDAA0B;YAC1B,mDAAuB;YACvB;gBACE,OAAO,EAAE,gCAAyB;gBAClC,WAAW,EAAE,yDAA0B;gBACvC,KAAK,EAAE,IAAI;aACA;YACb;gBACE,OAAO,EAAE,gCAAyB;gBAClC,WAAW,EAAE,mDAAuB;gBACpC,KAAK,EAAE,IAAI;aACA;SACd;QACD,OAAO,EAAE;YACP,0BAAW;YACX,+CAAqB;YACrB,+CAAqB;YACrB,6BAAY;YACZ,yDAA0B;YAC1B,mDAAuB;YACvB,gCAAyB;SAC1B;KACF,CAAC;GACW,cAAc,CAI1B;AAED,YAAY"}
+{"version":3,"file":"security.module.js","sourceRoot":"","sources":["../../../../../../../libs/framework/server/security/src/lib/security.module.ts"],"names":[],"mappings":";;;;AAAA,2CAA8G;AAC9G,+CAAkD;AAClD,iEAAwG;AACxG,4DAAwD;AACxD,oEAA+D;AAC/D,0FAAoF;AACpF,sDAAkD;AAClD,0EAAqE;AACrE,wEAAmE;AACnE,wEAAmE;AACnE,0EAAqE;AACrE,wDAAoD;AACpD,0DAAqD;AACrD,qEAAiE;AACjE,mEAA+D;AAC/D,2EAAsE;AACtE,0FAAqF;AACrF,gGAA2F;AAC3F,qEAAiE;AACjE,+EAA0E;AAC1E,+FAAyF;AACzF,+EAA0E;AAE1E,4CAA4C;AAE5C;;;GAGG;AA+CI,IAAM,cAAc,GAApB,MAAM,cAAc;IACzB,SAAS,CAAC,QAA4B;QACpC,QAAQ;aACL,KAAK,CAAC,8DAA4B,CAAC;aACnC,SAAS,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,sBAAa,CAAC,GAAG,EAAE,CAAC,CAAC;IAC9D,CAAC;CACF,CAAA;AANY,wCAAc;yBAAd,cAAc;IA9C1B,IAAA,eAAM,GAAE;IACR,IAAA,eAAM,EAAC;QACN,OAAO,EAAE,CAAC,0BAAmB,EAAE,yBAAc,CAAC,QAAQ,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;QAC3E,WAAW,EAAE,CAAC,gCAAc,EAAE,sCAAiB,EAAE,sCAAiB,CAAC;QACnE,SAAS,EAAE;YACT,0BAAW;YACX,6CAAoB;YACpB,4DAA2B;YAC3B,2CAAmB;YACnB,4BAAY;YACZ,6CAAoB;YACpB,uCAAiB;YACjB,6CAAoB;YACpB,8BAAa;YACb,2CAAmB;YACnB,+CAAqB;YACrB,+CAAqB;YACrB,6BAAY;YACZ,8DAA4B;YAC5B,yDAA0B;YAC1B,mDAAuB;YACvB;gBACE,OAAO,EAAE,gCAAyB;gBAClC,WAAW,EAAE,yDAA0B;gBACvC,KAAK,EAAE,IAAI;aACA;YACb;gBACE,OAAO,EAAE,gCAAyB;gBAClC,WAAW,EAAE,mDAAuB;gBACpC,KAAK,EAAE,IAAI;aACA;SACd;QACD,OAAO,EAAE;YACP,0BAAW;YACX,4BAAY;YACZ,6CAAoB;YACpB,uCAAiB;YACjB,2CAAmB;YACnB,+CAAqB;YACrB,+CAAqB;YACrB,6BAAY;YACZ,yDAA0B;YAC1B,mDAAuB;YACvB,gCAAyB;SAC1B;KACF,CAAC;GACW,cAAc,CAM1B;AAED,YAAY"}

package/security/src/lib/session/backend-session.service.d.ts

@@ -19,3 +19,4 @@ export declare class BackendSessionService {
     requireAuthenticated(): BackendRequestSession;
 }
 export {};
+//# sourceMappingURL=backend-session.service.d.ts.map

package/security/src/lib/session/backend-session.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"backend-session.service.d.ts","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/session/backend-session.service.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAEvC,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AACrE,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAIlE,KAAK,kBAAkB,GAAG,OAAO,GAAG;IAClC,CAAC,mBAAmB,CAAC,CAAC,EAAE,qBAAqB,CAAC;CAC/C,CAAC;AAEF;;;GAGG;AACH,qBACa,qBAAqB;IACH,OAAO,CAAC,QAAQ,CAAC,OAAO;gBAAP,OAAO,EAAE,kBAAkB;IAEzE,OAAO,CAAC,cAAc;IAWtB,UAAU,IAAI,qBAAqB,GAAG,IAAI;IAQ1C,IAAI,MAAM,IAAI,MAAM,GAAG,SAAS,CAE/B;IAED,IAAI,QAAQ,IAAI,MAAM,GAAG,SAAS,CAEjC;IAED,IAAI,aAAa,IAAI,MAAM,GAAG,SAAS,CAEtC;IAED,oBAAoB,IAAI,qBAAqB;CAO9C"}

package/security/src/lib/session/backend-session.service.js

@@ -15,7 +15,14 @@ let BackendSessionService = class BackendSessionService {
         this.request = request;
     }
     resolveRequest() {
-        return this.request ?? (0, core_2.getEntityStorageRequest)();
+        const active = (0, core_2.getEntityStorageRequest)();
+        if (active?.[current_session_decorator_1.CURRENT_SESSION_KEY]) {
+            return active;
+        }
+        if (this.request?.[current_session_decorator_1.CURRENT_SESSION_KEY]) {
+            return this.request;
+        }
+        return active ?? this.request;
     }
     getSession() {
         const request = this.resolveRequest();

package/security/src/lib/session/backend-session.service.js.map

@@ -1 +1 @@
-{"version":3,"file":"backend-session.service.js","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/session/backend-session.service.ts"],"names":[],"mappings":";;;;AAAA,2CAA2D;AAC3D,uCAAuC;AAEvC,iEAAiF;AAEjF,2EAAkE;AAQlE;;;GAGG;AAEI,IAAM,qBAAqB,GAA3B,MAAM,qBAAqB;IAChC,YAA8C,OAA2B;QAA3B,YAAO,GAAP,OAAO,CAAoB;IAAG,CAAC;IAErE,cAAc;QACpB,OAAO,IAAI,CAAC,OAAO,IAAK,IAAA,8BAAuB,GAAqC,CAAC;IACvF,CAAC;IAED,UAAU;QACR,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;QACtC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,OAAO,CAAC,+CAAmB,CAAC,IAAI,IAAI,CAAC;IAC9C,CAAC;IAED,IAAI,MAAM;QACR,OAAO,IAAI,CAAC,UAAU,EAAE,EAAE,MAAM,CAAC;IACnC,CAAC;IAED,IAAI,QAAQ;QACV,OAAO,IAAI,CAAC,UAAU,EAAE,EAAE,QAAQ,CAAC;IACrC,CAAC;IAED,IAAI,aAAa;QACf,OAAO,IAAI,CAAC,UAAU,EAAE,EAAE,aAAa,CAAC;IAC1C,CAAC;IAED,oBAAoB;QAClB,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC;QAClC,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;QAClD,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;CACF,CAAA;AAlCY,sDAAqB;gCAArB,qBAAqB;IADjC,IAAA,mBAAU,EAAC,EAAE,KAAK,EAAE,cAAK,CAAC,OAAO,EAAE,CAAC;IAEtB,mBAAA,IAAA,eAAM,EAAC,cAAO,CAAC,CAAA;;GADjB,qBAAqB,CAkCjC;AAED,YAAY"}
+{"version":3,"file":"backend-session.service.js","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/session/backend-session.service.ts"],"names":[],"mappings":";;;;AAAA,2CAA2D;AAC3D,uCAAuC;AAEvC,iEAAiF;AAEjF,2EAAkE;AAQlE;;;GAGG;AAEI,IAAM,qBAAqB,GAA3B,MAAM,qBAAqB;IAChC,YAA8C,OAA2B;QAA3B,YAAO,GAAP,OAAO,CAAoB;IAAG,CAAC;IAErE,cAAc;QACpB,MAAM,MAAM,GAAG,IAAA,8BAAuB,GAAoC,CAAC;QAC3E,IAAI,MAAM,EAAE,CAAC,+CAAmB,CAAC,EAAE,CAAC;YAClC,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC,+CAAmB,CAAC,EAAE,CAAC;YACxC,OAAO,IAAI,CAAC,OAAO,CAAC;QACtB,CAAC;QACD,OAAO,MAAM,IAAI,IAAI,CAAC,OAAO,CAAC;IAChC,CAAC;IAED,UAAU;QACR,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;QACtC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,OAAO,CAAC,+CAAmB,CAAC,IAAI,IAAI,CAAC;IAC9C,CAAC;IAED,IAAI,MAAM;QACR,OAAO,IAAI,CAAC,UAAU,EAAE,EAAE,MAAM,CAAC;IACnC,CAAC;IAED,IAAI,QAAQ;QACV,OAAO,IAAI,CAAC,UAAU,EAAE,EAAE,QAAQ,CAAC;IACrC,CAAC;IAED,IAAI,aAAa;QACf,OAAO,IAAI,CAAC,UAAU,EAAE,EAAE,aAAa,CAAC;IAC1C,CAAC;IAED,oBAAoB;QAClB,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC;QAClC,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;QAClD,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;CACF,CAAA;AAzCY,sDAAqB;gCAArB,qBAAqB;IADjC,IAAA,mBAAU,EAAC,EAAE,KAAK,EAAE,cAAK,CAAC,OAAO,EAAE,CAAC;IAEtB,mBAAA,IAAA,eAAM,EAAC,cAAO,CAAC,CAAA;;GADjB,qBAAqB,CAyCjC;AAED,YAAY"}

package/security/src/lib/session/backend-session.types.d.ts

@@ -5,3 +5,4 @@ export interface BackendRequestSession {
     tenantId?: string;
     applicationId?: string;
 }
+//# sourceMappingURL=backend-session.types.d.ts.map

package/security/src/lib/session/backend-session.types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"backend-session.types.d.ts","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/session/backend-session.types.ts"],"names":[],"mappings":"AAEA,8EAA8E;AAC9E,MAAM,WAAW,qBAAqB;IACpC,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB"}

package/security/src/lib/session/current-session.decorator.d.ts

@@ -1,2 +1,3 @@
 export declare const CURRENT_SESSION_KEY = "acxRequestSession";
 export declare const CurrentSession: (...dataOrPipes: unknown[]) => ParameterDecorator;
+//# sourceMappingURL=current-session.decorator.d.ts.map

package/security/src/lib/session/current-session.decorator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"current-session.decorator.d.ts","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/session/current-session.decorator.ts"],"names":[],"mappings":"AAKA,eAAO,MAAM,mBAAmB,sBAAsB,CAAC;AAEvD,eAAO,MAAM,cAAc,mDAK1B,CAAC"}