@acorex-platform/framework-server 0.0.15 → 0.0.20

package/security/src/lib/auth/auth-identity-provider.source.d.ts

@@ -0,0 +1,71 @@
+/**
+ * Public IdP projection for Auth:ListProviders (never includes secrets).
+ * `id` is the IdP key and is sent as OAuth `acr_values` by login strategies.
+ */
+export interface AuthIdentityProviderPublicDto {
+    id: string;
+    title: string;
+    icon?: string;
+    priority: number;
+}
+export interface AuthLocalSignInMethodDto {
+    id: string;
+    title: string;
+    protocol: 'password' | 'otp' | 'custom';
+    enabled: boolean;
+}
+/** Full public Auth:ListProviders response (no legacy google/microsoft/sso keys). */
+export interface AuthListProvidersResponseDto {
+    localMethods: AuthLocalSignInMethodDto[];
+    identityProviders: AuthIdentityProviderPublicDto[];
+}
+export interface AuthIdentityProviderEnsureStubInput {
+    /** Stable business key, e.g. `google`, `okta-hr`. */
+    key: string;
+    title: string;
+    icon?: string;
+    priority?: number;
+    authorizationUrl?: string;
+    tokenUrl?: string;
+    userInfoUrl?: string;
+    scopes?: string;
+    issuerUrl?: string;
+}
+/** Broker config for platform `/connect/*` (never returned by ListProviders). */
+export interface AuthIdentityProviderBrokerConfig {
+    key: string;
+    clientId: string;
+    clientSecret: string;
+    enabled: boolean;
+    /** External IdP authorize endpoint. */
+    authorizationUrl: string;
+    /** External IdP token endpoint. */
+    tokenUrl: string;
+    /** Optional userinfo endpoint. */
+    userInfoUrl?: string;
+    /** Scopes sent to the external IdP. */
+    scopes: string;
+}
+/**
+ * Implemented by security-management; framework ListProviders + extensions call this.
+ */
+export interface AuthIdentityProviderCatalog {
+    listEnabledForLogin(): Promise<AuthIdentityProviderPublicDto[]>;
+    /**
+     * Insert stub row when missing. Never overwrites admin-filled fields
+     * (clientId, clientSecret, title, endpoints) on an existing row.
+     */
+    ensureStub(input: AuthIdentityProviderEnsureStubInput): Promise<void>;
+    /**
+     * Resolve IdP broker credentials by key (e.g. `google`).
+     * Returns null when missing, disabled, or credentials incomplete.
+     */
+    getBrokerConfig(key: string): Promise<AuthIdentityProviderBrokerConfig | null>;
+}
+export declare const AUTH_IDENTITY_PROVIDER_CATALOG: unique symbol;
+/**
+ * Allowed SPA/machine client_ids for `/connect/*`.
+ * Provided by security-management from seed constants (not env in framework).
+ */
+export declare const AUTH_OAUTH_ALLOWED_CLIENT_IDS: unique symbol;
+//# sourceMappingURL=auth-identity-provider.source.d.ts.map

package/security/src/lib/auth/auth-identity-provider.source.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-identity-provider.source.d.ts","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/auth/auth-identity-provider.source.ts"],"names":[],"mappings":"AAEA;;;GAGG;AACH,MAAM,WAAW,6BAA6B;IAC5C,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,wBAAwB;IACvC,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,UAAU,GAAG,KAAK,GAAG,QAAQ,CAAC;IACxC,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,qFAAqF;AACrF,MAAM,WAAW,4BAA4B;IAC3C,YAAY,EAAE,wBAAwB,EAAE,CAAC;IACzC,iBAAiB,EAAE,6BAA6B,EAAE,CAAC;CACpD;AAED,MAAM,WAAW,mCAAmC;IAClD,qDAAqD;IACrD,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,iFAAiF;AACjF,MAAM,WAAW,gCAAgC;IAC/C,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,OAAO,CAAC;IACjB,uCAAuC;IACvC,gBAAgB,EAAE,MAAM,CAAC;IACzB,mCAAmC;IACnC,QAAQ,EAAE,MAAM,CAAC;IACjB,kCAAkC;IAClC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,uCAAuC;IACvC,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;GAEG;AACH,MAAM,WAAW,2BAA2B;IAC1C,mBAAmB,IAAI,OAAO,CAAC,6BAA6B,EAAE,CAAC,CAAC;IAChE;;;OAGG;IACH,UAAU,CAAC,KAAK,EAAE,mCAAmC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACtE;;;OAGG;IACH,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,gCAAgC,GAAG,IAAI,CAAC,CAAC;CAChF;AAED,eAAO,MAAM,8BAA8B,eAA2C,CAAC;AAEvF;;;GAGG;AACH,eAAO,MAAM,6BAA6B,eAA0C,CAAC"}

package/security/src/lib/auth/auth-identity-provider.source.js

@@ -0,0 +1,12 @@
+"use strict";
+//#region ---- Auth identity provider catalog (entity-backed) ----
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AUTH_OAUTH_ALLOWED_CLIENT_IDS = exports.AUTH_IDENTITY_PROVIDER_CATALOG = void 0;
+exports.AUTH_IDENTITY_PROVIDER_CATALOG = Symbol('AUTH_IDENTITY_PROVIDER_CATALOG');
+/**
+ * Allowed SPA/machine client_ids for `/connect/*`.
+ * Provided by security-management from seed constants (not env in framework).
+ */
+exports.AUTH_OAUTH_ALLOWED_CLIENT_IDS = Symbol('AUTH_OAUTH_ALLOWED_CLIENT_IDS');
+//#endregion
+//# sourceMappingURL=auth-identity-provider.source.js.map

package/security/src/lib/auth/auth-identity-provider.source.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-identity-provider.source.js","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/auth/auth-identity-provider.source.ts"],"names":[],"mappings":";AAAA,kEAAkE;;;AAwErD,QAAA,8BAA8B,GAAG,MAAM,CAAC,gCAAgC,CAAC,CAAC;AAEvF;;;GAGG;AACU,QAAA,6BAA6B,GAAG,MAAM,CAAC,+BAA+B,CAAC,CAAC;AAErF,YAAY"}

package/security/src/lib/auth/auth-local-credentials.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-local-credentials.service.d.ts","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/auth/auth-local-credentials.service.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,8BAA8B,EAAE,MAAM,wCAAwC,CAAC;AAKxF,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,cAAc,CAAC;AASjE,qBACa,2BAA2B;IAG1B,OAAO,CAAC,QAAQ,CAAC,aAAa;IAF1C,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAgD;gBAE1C,aAAa,EAAE,8BAA8B;IAEpE,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,4BAA4B,CAAC;IAkCnF,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,4BAA4B,GAAG,IAAI,CAAC;IAKlF,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,4BAA4B,GAAG,IAAI,CAAC;IAK1E,SAAS,IAAI,OAAO,CAAC,4BAA4B,EAAE,CAAC;IASpD,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAU9C,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAUhD,wBAAwB,CAAC,KAAK,EAAE;QACpC,QAAQ,EAAE,MAAM,CAAC;QACjB,eAAe,EAAE,MAAM,CAAC;QACxB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,OAAO,CAAC,EAAE,MAAM,CAAC;KAClB,GAAG,OAAO,CAAC,4BAA4B,CAAC;IAyCzC,OAAO,CAAC,sBAAsB;CAO/B"}
+{"version":3,"file":"auth-local-credentials.service.d.ts","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/auth/auth-local-credentials.service.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,8BAA8B,EAAE,MAAM,wCAAwC,CAAC;AAKxF,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,cAAc,CAAC;AASjE,qBACa,2BAA2B;IAG1B,OAAO,CAAC,QAAQ,CAAC,aAAa;IAF1C,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAgD;gBAE1C,aAAa,EAAE,8BAA8B;IAEpE,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,4BAA4B,CAAC;IAkCnF,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,4BAA4B,GAAG,IAAI,CAAC;IAKlF,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,4BAA4B,GAAG,IAAI,CAAC;IAM1E,SAAS,IAAI,OAAO,CAAC,4BAA4B,EAAE,CAAC;IASpD,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAU9C,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAUhD,wBAAwB,CAAC,KAAK,EAAE;QACpC,QAAQ,EAAE,MAAM,CAAC;QACjB,eAAe,EAAE,MAAM,CAAC;QACxB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,OAAO,CAAC,EAAE,MAAM,CAAC;KAClB,GAAG,OAAO,CAAC,4BAA4B,CAAC;IAyCzC,OAAO,CAAC,sBAAsB;CAO/B"}

package/security/src/lib/auth/auth-local-credentials.service.js

@@ -52,7 +52,8 @@ let AuthLocalCredentialsService = AuthLocalCredentialsService_1 = class AuthLoca
         return users.find((u) => u.username === username) ?? null;
     }
     async findUserById(userId) {
-        const record = await this.entityStorage.getOne(USER_ENTITY, userId);
+        // Auth paths resolve global identities outside tenant membership filters.
+        const record = await this.entityStorage.getOneAsEngine(USER_ENTITY, userId);
         return record ?? null;
     }
     async listUsers() {

package/security/src/lib/auth/auth-local-credentials.service.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth-local-credentials.service.js","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/auth/auth-local-credentials.service.ts"],"names":[],"mappings":";;;;;AAAA,2CAIwB;AACxB,iEAAwF;AACxF,6EAAkG;AAClG,iEAAwE;AACxE,yCAAuC;AACvC,mCAAoC;AAGpC,qCAAqC;AAErC,MAAM,WAAW,GAAG,yBAAyB,CAAC;AAC9C,MAAM,oBAAoB,GAAG,QAAQ,CAAC;AACtC,MAAM,oBAAoB,GAAG,SAAS,CAAC;AACvC,MAAM,oBAAoB,GAAG,SAAS,CAAC;AAGhC,IAAM,2BAA2B,mCAAjC,MAAM,2BAA2B;IAGtC,YAA6B,aAA6C;QAA7C,kBAAa,GAAb,aAAa,CAAgC;QAFzD,WAAM,GAAG,IAAI,eAAM,CAAC,6BAA2B,CAAC,IAAI,CAAC,CAAC;IAEM,CAAC;IAE9E,KAAK,CAAC,QAAQ,CAAC,QAAgB,EAAE,QAAgB;QAC/C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC;QACrD,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,8BAAqB,CAAC,IAAI,CAAC,sBAAsB,EAAE,CAAC,CAAC;QACjE,CAAC;QAED,IAAI,IAAI,CAAC,WAAW,KAAK,oBAAoB,EAAE,CAAC;YAC9C,MAAM,IAAI,8BAAqB,CAAC;gBAC9B,UAAU,EAAE,GAAG;gBACf,OAAO,EAAE,sCAAsC;gBAC/C,KAAK,EAAE,gBAAgB;aACxB,CAAC,CAAC;QACL,CAAC;QAED,IAAI,IAAI,CAAC,YAAY,KAAK,oBAAoB,EAAE,CAAC;YAC/C,MAAM,IAAI,8BAAqB,CAAC,IAAI,CAAC,sBAAsB,EAAE,CAAC,CAAC;QACjE,CAAC;QAED,IAAI,CAAC,IAAA,iBAAK,EAAC,IAAI,CAAC,WAAW,CAAC,IAAI,IAAI,CAAC,WAAW,KAAK,oBAAoB,EAAE,CAAC;YAC1E,MAAM,IAAI,8BAAqB,CAAC;gBAC9B,UAAU,EAAE,GAAG;gBACf,OAAO,EAAE,0CAA0C;gBACnD,KAAK,EAAE,mBAAmB;aAC3B,CAAC,CAAC;QACL,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,IAAA,qBAAc,EAAC,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC5D,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,8BAAqB,CAAC,IAAI,CAAC,sBAAsB,EAAE,CAAC,CAAC;QACjE,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,CAAC,kBAAkB,CAAC,QAAgB;QACvC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;QACrC,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,IAAI,IAAI,CAAC;IAC5D,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,MAAc;QAC/B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;QACpE,OAAQ,MAAuC,IAAI,IAAI,CAAC;IAC1D,CAAC;IAED,KAAK,CAAC,SAAS;QACb,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,KAAK,CAC3C,WAAW,EACX,IAAA,2CAAgC,EAAC,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAC1D,CAAC;QACF,MAAM,KAAK,GAAG,IAAA,eAAG,EAAC,MAAM,EAAE,OAAO,EAAE,EAAE,CAAmC,CAAC;QACzE,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3C,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,MAAc;QAClC,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,WAAW,EAAE,MAAM,EAAE;gBACtD,WAAW,EAAE,oBAAoB;aAClC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,wBAAwB,MAAM,KAAK,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACvE,CAAC;IACH,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,MAAc;QACpC,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,WAAW,EAAE,MAAM,EAAE;gBACtD,WAAW,EAAE,oBAAoB;aAClC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,iCAAiC,MAAM,KAAK,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAChF,CAAC;IACH,CAAC;IAED,KAAK,CAAC,wBAAwB,CAAC,KAM9B;QACC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAChD,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;QAErC,IAAI,KAAK,EAAE,CAAC;YACV,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YACtB,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;YAC9C,IAAI,SAAS,EAAE,CAAC;gBACd,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YAC5B,CAAC;QACH,CAAC;QAED,UAAU,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,eAAe,EAAE,CAAC,CAAC;QAE7D,KAAK,MAAM,QAAQ,IAAI,UAAU,EAAE,CAAC;YAClC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC;YACzD,IAAI,QAAQ,EAAE,CAAC;gBACb,OAAO,QAAQ,CAAC;YAClB,CAAC;QACH,CAAC;QAED,MAAM,QAAQ,GAAG,KAAK,IAAI,GAAG,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;QACpF,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,EAAE,IAAI,EAAE,IAAI,QAAQ,CAAC;QAC1D,MAAM,EAAE,GAAG,IAAA,mBAAU,GAAE,CAAC;QAExB,MAAM,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,WAAW,EAAE;YAC9C,EAAE;YACF,QAAQ;YACR,WAAW;YACX,YAAY,EAAE,oBAAoB;YAClC,WAAW,EAAE,oBAAoB;SAClC,CAAC,CAAC;QAEH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;QAC5C,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,8BAAqB,CAAC,yCAAyC,CAAC,CAAC;QAC7E,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;IAEO,sBAAsB;QAC5B,OAAO;YACL,UAAU,EAAE,GAAG;YACf,OAAO,EAAE,8BAA8B;YACvC,KAAK,EAAE,oBAAoB;SAC5B,CAAC;IACJ,CAAC;CACF,CAAA;AApIY,kEAA2B;sCAA3B,2BAA2B;IADvC,IAAA,mBAAU,GAAE;6CAIiC,qCAA8B;GAH/D,2BAA2B,CAoIvC;AAED,YAAY"}
+{"version":3,"file":"auth-local-credentials.service.js","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/auth/auth-local-credentials.service.ts"],"names":[],"mappings":";;;;;AAAA,2CAIwB;AACxB,iEAAwF;AACxF,6EAAkG;AAClG,iEAAwE;AACxE,yCAAuC;AACvC,mCAAoC;AAGpC,qCAAqC;AAErC,MAAM,WAAW,GAAG,yBAAyB,CAAC;AAC9C,MAAM,oBAAoB,GAAG,QAAQ,CAAC;AACtC,MAAM,oBAAoB,GAAG,SAAS,CAAC;AACvC,MAAM,oBAAoB,GAAG,SAAS,CAAC;AAGhC,IAAM,2BAA2B,mCAAjC,MAAM,2BAA2B;IAGtC,YAA6B,aAA6C;QAA7C,kBAAa,GAAb,aAAa,CAAgC;QAFzD,WAAM,GAAG,IAAI,eAAM,CAAC,6BAA2B,CAAC,IAAI,CAAC,CAAC;IAEM,CAAC;IAE9E,KAAK,CAAC,QAAQ,CAAC,QAAgB,EAAE,QAAgB;QAC/C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC;QACrD,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,8BAAqB,CAAC,IAAI,CAAC,sBAAsB,EAAE,CAAC,CAAC;QACjE,CAAC;QAED,IAAI,IAAI,CAAC,WAAW,KAAK,oBAAoB,EAAE,CAAC;YAC9C,MAAM,IAAI,8BAAqB,CAAC;gBAC9B,UAAU,EAAE,GAAG;gBACf,OAAO,EAAE,sCAAsC;gBAC/C,KAAK,EAAE,gBAAgB;aACxB,CAAC,CAAC;QACL,CAAC;QAED,IAAI,IAAI,CAAC,YAAY,KAAK,oBAAoB,EAAE,CAAC;YAC/C,MAAM,IAAI,8BAAqB,CAAC,IAAI,CAAC,sBAAsB,EAAE,CAAC,CAAC;QACjE,CAAC;QAED,IAAI,CAAC,IAAA,iBAAK,EAAC,IAAI,CAAC,WAAW,CAAC,IAAI,IAAI,CAAC,WAAW,KAAK,oBAAoB,EAAE,CAAC;YAC1E,MAAM,IAAI,8BAAqB,CAAC;gBAC9B,UAAU,EAAE,GAAG;gBACf,OAAO,EAAE,0CAA0C;gBACnD,KAAK,EAAE,mBAAmB;aAC3B,CAAC,CAAC;QACL,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,IAAA,qBAAc,EAAC,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC5D,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,8BAAqB,CAAC,IAAI,CAAC,sBAAsB,EAAE,CAAC,CAAC;QACjE,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,CAAC,kBAAkB,CAAC,QAAgB;QACvC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;QACrC,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,IAAI,IAAI,CAAC;IAC5D,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,MAAc;QAC/B,0EAA0E;QAC1E,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,cAAc,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;QAC5E,OAAQ,MAAuC,IAAI,IAAI,CAAC;IAC1D,CAAC;IAED,KAAK,CAAC,SAAS;QACb,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,KAAK,CAC3C,WAAW,EACX,IAAA,2CAAgC,EAAC,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAC1D,CAAC;QACF,MAAM,KAAK,GAAG,IAAA,eAAG,EAAC,MAAM,EAAE,OAAO,EAAE,EAAE,CAAmC,CAAC;QACzE,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3C,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,MAAc;QAClC,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,WAAW,EAAE,MAAM,EAAE;gBACtD,WAAW,EAAE,oBAAoB;aAClC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,wBAAwB,MAAM,KAAK,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACvE,CAAC;IACH,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,MAAc;QACpC,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,WAAW,EAAE,MAAM,EAAE;gBACtD,WAAW,EAAE,oBAAoB;aAClC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,iCAAiC,MAAM,KAAK,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAChF,CAAC;IACH,CAAC;IAED,KAAK,CAAC,wBAAwB,CAAC,KAM9B;QACC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAChD,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;QAErC,IAAI,KAAK,EAAE,CAAC;YACV,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YACtB,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;YAC9C,IAAI,SAAS,EAAE,CAAC;gBACd,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YAC5B,CAAC;QACH,CAAC;QAED,UAAU,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,eAAe,EAAE,CAAC,CAAC;QAE7D,KAAK,MAAM,QAAQ,IAAI,UAAU,EAAE,CAAC;YAClC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC;YACzD,IAAI,QAAQ,EAAE,CAAC;gBACb,OAAO,QAAQ,CAAC;YAClB,CAAC;QACH,CAAC;QAED,MAAM,QAAQ,GAAG,KAAK,IAAI,GAAG,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;QACpF,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,EAAE,IAAI,EAAE,IAAI,QAAQ,CAAC;QAC1D,MAAM,EAAE,GAAG,IAAA,mBAAU,GAAE,CAAC;QAExB,MAAM,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,WAAW,EAAE;YAC9C,EAAE;YACF,QAAQ;YACR,WAAW;YACX,YAAY,EAAE,oBAAoB;YAClC,WAAW,EAAE,oBAAoB;SAClC,CAAC,CAAC;QAEH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;QAC5C,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,8BAAqB,CAAC,yCAAyC,CAAC,CAAC;QAC7E,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;IAEO,sBAAsB;QAC5B,OAAO;YACL,UAAU,EAAE,GAAG;YACf,OAAO,EAAE,8BAA8B;YACvC,KAAK,EAAE,oBAAoB;SAC5B,CAAC;IACJ,CAAC;CACF,CAAA;AArIY,kEAA2B;sCAA3B,2BAA2B;IADvC,IAAA,mBAAU,GAAE;6CAIiC,qCAA8B;GAH/D,2BAA2B,CAqIvC;AAED,YAAY"}

package/security/src/lib/auth/auth-lockout-policy.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Sign-in lockout / challenge thresholds. Defaults apply until a module
+ * registers {@link configureAuthLockoutPolicyResolver} (platform settings).
+ *
+ * Uses globalThis so Nest/webpack duplicate module instances share one resolver.
+ */
+export interface AuthLockoutPolicy {
+    maxLoginAttempts: number;
+    lockoutDurationMinutes: number;
+    captchaAttemptThreshold: number;
+}
+export declare const AUTH_LOCKOUT_POLICY_DEFAULTS: AuthLockoutPolicy;
+type AuthLockoutPolicyResolver = () => Promise<AuthLockoutPolicy>;
+/** Registers the resolver that reads platform lockout settings. */
+export declare function configureAuthLockoutPolicyResolver(resolver: AuthLockoutPolicyResolver): void;
+export declare function resolveAuthLockoutPolicy(): Promise<AuthLockoutPolicy>;
+export {};
+//# sourceMappingURL=auth-lockout-policy.d.ts.map

package/security/src/lib/auth/auth-lockout-policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-lockout-policy.d.ts","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/auth/auth-lockout-policy.ts"],"names":[],"mappings":"AAEA;;;;;GAKG;AAEH,MAAM,WAAW,iBAAiB;IAChC,gBAAgB,EAAE,MAAM,CAAC;IACzB,sBAAsB,EAAE,MAAM,CAAC;IAC/B,uBAAuB,EAAE,MAAM,CAAC;CACjC;AAED,eAAO,MAAM,4BAA4B,EAAE,iBAI1C,CAAC;AAEF,KAAK,yBAAyB,GAAG,MAAM,OAAO,CAAC,iBAAiB,CAAC,CAAC;AAuBlE,mEAAmE;AACnE,wBAAgB,kCAAkC,CAAC,QAAQ,EAAE,yBAAyB,GAAG,IAAI,CAE5F;AAED,wBAAsB,wBAAwB,IAAI,OAAO,CAAC,iBAAiB,CAAC,CAyB3E"}

package/security/src/lib/auth/auth-lockout-policy.js

@@ -0,0 +1,46 @@
+"use strict";
+//#region ----- Auth lockout policy (leaf) -----
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AUTH_LOCKOUT_POLICY_DEFAULTS = void 0;
+exports.configureAuthLockoutPolicyResolver = configureAuthLockoutPolicyResolver;
+exports.resolveAuthLockoutPolicy = resolveAuthLockoutPolicy;
+exports.AUTH_LOCKOUT_POLICY_DEFAULTS = {
+    maxLoginAttempts: 5,
+    lockoutDurationMinutes: 3,
+    captchaAttemptThreshold: 3,
+};
+const GLOBAL_KEY = '__AXP_AUTH_LOCKOUT_POLICY__';
+function authLockoutState() {
+    const g = globalThis;
+    if (!g[GLOBAL_KEY]) {
+        g[GLOBAL_KEY] = { resolver: null };
+    }
+    return g[GLOBAL_KEY];
+}
+function coerceMin1(value, fallback) {
+    const parsed = typeof value === 'number' ? value : Number(value);
+    return Number.isFinite(parsed) && parsed >= 1 ? Math.floor(parsed) : fallback;
+}
+/** Registers the resolver that reads platform lockout settings. */
+function configureAuthLockoutPolicyResolver(resolver) {
+    authLockoutState().resolver = resolver;
+}
+async function resolveAuthLockoutPolicy() {
+    const resolver = authLockoutState().resolver;
+    if (!resolver) {
+        return exports.AUTH_LOCKOUT_POLICY_DEFAULTS;
+    }
+    try {
+        const resolved = await resolver();
+        return {
+            maxLoginAttempts: coerceMin1(resolved.maxLoginAttempts, exports.AUTH_LOCKOUT_POLICY_DEFAULTS.maxLoginAttempts),
+            lockoutDurationMinutes: coerceMin1(resolved.lockoutDurationMinutes, exports.AUTH_LOCKOUT_POLICY_DEFAULTS.lockoutDurationMinutes),
+            captchaAttemptThreshold: coerceMin1(resolved.captchaAttemptThreshold, exports.AUTH_LOCKOUT_POLICY_DEFAULTS.captchaAttemptThreshold),
+        };
+    }
+    catch {
+        return exports.AUTH_LOCKOUT_POLICY_DEFAULTS;
+    }
+}
+//#endregion
+//# sourceMappingURL=auth-lockout-policy.js.map

package/security/src/lib/auth/auth-lockout-policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-lockout-policy.js","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/auth/auth-lockout-policy.ts"],"names":[],"mappings":";AAAA,gDAAgD;;;AA6ChD,gFAEC;AAED,4DAyBC;AA3DY,QAAA,4BAA4B,GAAsB;IAC7D,gBAAgB,EAAE,CAAC;IACnB,sBAAsB,EAAE,CAAC;IACzB,uBAAuB,EAAE,CAAC;CAC3B,CAAC;AAQF,MAAM,UAAU,GAAG,6BAA6B,CAAC;AAEjD,SAAS,gBAAgB;IACvB,MAAM,CAAC,GAAG,UAET,CAAC;IACF,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,EAAE,CAAC;QACnB,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IACrC,CAAC;IACD,OAAO,CAAC,CAAC,UAAU,CAAE,CAAC;AACxB,CAAC;AAED,SAAS,UAAU,CAAC,KAAc,EAAE,QAAgB;IAClD,MAAM,MAAM,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACjE,OAAO,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;AAChF,CAAC;AAED,mEAAmE;AACnE,SAAgB,kCAAkC,CAAC,QAAmC;IACpF,gBAAgB,EAAE,CAAC,QAAQ,GAAG,QAAQ,CAAC;AACzC,CAAC;AAEM,KAAK,UAAU,wBAAwB;IAC5C,MAAM,QAAQ,GAAG,gBAAgB,EAAE,CAAC,QAAQ,CAAC;IAC7C,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,oCAA4B,CAAC;IACtC,CAAC;IAED,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,QAAQ,EAAE,CAAC;QAClC,OAAO;YACL,gBAAgB,EAAE,UAAU,CAC1B,QAAQ,CAAC,gBAAgB,EACzB,oCAA4B,CAAC,gBAAgB,CAC9C;YACD,sBAAsB,EAAE,UAAU,CAChC,QAAQ,CAAC,sBAAsB,EAC/B,oCAA4B,CAAC,sBAAsB,CACpD;YACD,uBAAuB,EAAE,UAAU,CACjC,QAAQ,CAAC,uBAAuB,EAChC,oCAA4B,CAAC,uBAAuB,CACrD;SACF,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,oCAA4B,CAAC;IACtC,CAAC;AACH,CAAC;AAED,YAAY"}

package/security/src/lib/auth/auth-providers.contributor.d.ts

@@ -1,11 +1,12 @@
 /**
- * Optional extension hook for `GET /v1/auth/providers`.
- * Framework merges each contributor section by {@link key} — no extension types in framework.
+ * @deprecated Use {@link AUTH_IDENTITY_PROVIDER_CATALOG} / IdentityProvider entity instead.
+ * Legacy extension hook for `Auth:ListProviders` — no longer merged into the response.
  */
 export interface AuthProvidersContributor {
     /** Response property name, e.g. `sso`. */
     readonly key: string;
     getSection(): unknown | Promise<unknown>;
 }
+/** @deprecated See {@link AUTH_IDENTITY_PROVIDER_CATALOG}. */
 export declare const AUTH_PROVIDERS_CONTRIBUTOR: unique symbol;
 //# sourceMappingURL=auth-providers.contributor.d.ts.map

package/security/src/lib/auth/auth-providers.contributor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-providers.contributor.d.ts","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/auth/auth-providers.contributor.ts"],"names":[],"mappings":"AAEA;;;GAGG;AACH,MAAM,WAAW,wBAAwB;IACvC,0CAA0C;IAC1C,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,UAAU,IAAI,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CAC1C;AAED,eAAO,MAAM,0BAA0B,eAAuC,CAAC"}
+{"version":3,"file":"auth-providers.contributor.d.ts","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/auth/auth-providers.contributor.ts"],"names":[],"mappings":"AAEA;;;GAGG;AACH,MAAM,WAAW,wBAAwB;IACvC,0CAA0C;IAC1C,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,UAAU,IAAI,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CAC1C;AAED,8DAA8D;AAC9D,eAAO,MAAM,0BAA0B,eAAuC,CAAC"}

package/security/src/lib/auth/auth-providers.contributor.js

@@ -1,7 +1,8 @@
 "use strict";
-//#region ---- Auth providers contributor (extensions register into GET /v1/auth/providers) ----
+//#region ---- Auth providers contributor (deprecated) ----
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.AUTH_PROVIDERS_CONTRIBUTOR = void 0;
+/** @deprecated See {@link AUTH_IDENTITY_PROVIDER_CATALOG}. */
 exports.AUTH_PROVIDERS_CONTRIBUTOR = Symbol('AUTH_PROVIDERS_CONTRIBUTOR');
 //#endregion
 //# sourceMappingURL=auth-providers.contributor.js.map

package/security/src/lib/auth/auth-providers.contributor.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth-providers.contributor.js","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/auth/auth-providers.contributor.ts"],"names":[],"mappings":";AAAA,gGAAgG;;;AAYnF,QAAA,0BAA0B,GAAG,MAAM,CAAC,4BAA4B,CAAC,CAAC;AAE/E,YAAY"}
+{"version":3,"file":"auth-providers.contributor.js","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/auth/auth-providers.contributor.ts"],"names":[],"mappings":";AAAA,2DAA2D;;;AAY3D,8DAA8D;AACjD,QAAA,0BAA0B,GAAG,MAAM,CAAC,4BAA4B,CAAC,CAAC;AAE/E,YAAY"}

package/security/src/lib/auth/auth-runtime.handlers.d.ts

@@ -0,0 +1,76 @@
+import type { AXPCommand, AXPQueryFetchResultPromise, AXPCommandExecuteResultPromise } from '@acorex-platform/framework-shared/runtime';
+import { type AXPServerQueryHandler } from '@acorex-platform/framework-server/domain/abstract';
+import { ModuleRef } from '@nestjs/core';
+import { AuthCookieService } from './auth-cookie.service';
+import { AuthService } from './auth.service';
+import type { AuthTokenResponseDto, RefreshTokenRequestDto, RegisterRequestDto, SignInRequestDto, UpdateSessionRequestDto } from './auth.types';
+import { LoginAttemptService } from './login-attempt.service';
+import { TokenResolverService } from './token-resolver.service';
+import { TokenService } from './token.service';
+import { BackendSessionService } from '../session/backend-session.service';
+import { SessionContextService } from '../session/session-context.service';
+import { type AuthListProvidersResponseDto } from './auth-identity-provider.source';
+import type { SessionAccessPolicyDto, SessionApplicationItemDto, SessionTenantItemDto } from '../session/session-context.types';
+export declare class AuthSignInRuntimeCommand implements AXPCommand<SignInRequestDto, AuthTokenResponseDto> {
+    private readonly auth;
+    private readonly loginAttempts;
+    private readonly cookies;
+    private readonly tokens;
+    constructor(auth: AuthService, loginAttempts: LoginAttemptService, cookies: AuthCookieService, tokens: TokenService);
+    execute(input: SignInRequestDto): AXPCommandExecuteResultPromise<AuthTokenResponseDto>;
+}
+export declare class AuthRegisterRuntimeCommand implements AXPCommand<RegisterRequestDto, AuthTokenResponseDto> {
+    private readonly auth;
+    private readonly cookies;
+    private readonly tokens;
+    constructor(auth: AuthService, cookies: AuthCookieService, tokens: TokenService);
+    execute(input: RegisterRequestDto): AXPCommandExecuteResultPromise<AuthTokenResponseDto>;
+}
+export declare class AuthRefreshRuntimeCommand implements AXPCommand<RefreshTokenRequestDto, AuthTokenResponseDto> {
+    private readonly auth;
+    private readonly cookies;
+    private readonly tokens;
+    constructor(auth: AuthService, cookies: AuthCookieService, tokens: TokenService);
+    execute(input: RefreshTokenRequestDto): AXPCommandExecuteResultPromise<AuthTokenResponseDto>;
+}
+export declare class AuthLogoutRuntimeCommand implements AXPCommand<RefreshTokenRequestDto, void> {
+    private readonly auth;
+    private readonly cookies;
+    constructor(auth: AuthService, cookies: AuthCookieService);
+    execute(input: RefreshTokenRequestDto): AXPCommandExecuteResultPromise<void>;
+}
+export declare class AuthUpdateSessionRuntimeCommand implements AXPCommand<UpdateSessionRequestDto, AuthTokenResponseDto> {
+    private readonly auth;
+    private readonly tokenResolver;
+    private readonly cookies;
+    private readonly tokens;
+    constructor(auth: AuthService, tokenResolver: TokenResolverService, cookies: AuthCookieService, tokens: TokenService);
+    execute(input: UpdateSessionRequestDto): AXPCommandExecuteResultPromise<AuthTokenResponseDto>;
+}
+export declare const AUTH_RUNTIME_COMMANDS: (typeof AuthSignInRuntimeCommand | typeof AuthRegisterRuntimeCommand | typeof AuthRefreshRuntimeCommand | typeof AuthLogoutRuntimeCommand | typeof AuthUpdateSessionRuntimeCommand)[];
+export declare class AuthListProvidersRuntimeQuery implements AXPServerQueryHandler<void, AuthListProvidersResponseDto> {
+    private readonly moduleRef;
+    constructor(moduleRef: ModuleRef);
+    execute(): AXPQueryFetchResultPromise<AuthListProvidersResponseDto>;
+    private resolveIdentityProviderCatalog;
+}
+export declare class AuthListTenantsRuntimeQuery implements AXPServerQueryHandler<void, SessionTenantItemDto> {
+    private readonly sessionContext;
+    private readonly backendSession;
+    constructor(sessionContext: SessionContextService, backendSession: BackendSessionService);
+    execute(): AXPQueryFetchResultPromise<SessionTenantItemDto>;
+}
+export declare class AuthListApplicationsRuntimeQuery implements AXPServerQueryHandler<void, SessionApplicationItemDto> {
+    private readonly sessionContext;
+    private readonly backendSession;
+    constructor(sessionContext: SessionContextService, backendSession: BackendSessionService);
+    execute(): AXPQueryFetchResultPromise<SessionApplicationItemDto>;
+}
+export declare class AuthGetAccessPolicyRuntimeQuery implements AXPServerQueryHandler<void, SessionAccessPolicyDto> {
+    private readonly sessionContext;
+    private readonly backendSession;
+    constructor(sessionContext: SessionContextService, backendSession: BackendSessionService);
+    execute(): AXPQueryFetchResultPromise<SessionAccessPolicyDto>;
+}
+export declare const AUTH_RUNTIME_QUERIES: (typeof AuthListProvidersRuntimeQuery | typeof AuthListTenantsRuntimeQuery | typeof AuthListApplicationsRuntimeQuery | typeof AuthGetAccessPolicyRuntimeQuery)[];
+//# sourceMappingURL=auth-runtime.handlers.d.ts.map

package/security/src/lib/auth/auth-runtime.handlers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-runtime.handlers.d.ts","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/auth/auth-runtime.handlers.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,UAAU,EAAE,0BAA0B,EAAE,8BAA8B,EAAE,MAAM,2CAA2C,CAAC;AAYxI,OAAO,EAAqC,KAAK,qBAAqB,EAAE,MAAM,mDAAmD,CAAC;AAElI,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAOzC,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC1D,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC7C,OAAO,KAAK,EACV,oBAAoB,EACpB,sBAAsB,EACtB,kBAAkB,EAClB,gBAAgB,EAChB,uBAAuB,EACxB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAE9D,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAChE,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EAAE,qBAAqB,EAAE,MAAM,oCAAoC,CAAC;AAC3E,OAAO,EAAE,qBAAqB,EAAE,MAAM,oCAAoC,CAAC;AAC3E,OAAO,EAGL,KAAK,4BAA4B,EAElC,MAAM,iCAAiC,CAAC;AACzC,OAAO,KAAK,EACV,sBAAsB,EACtB,yBAAyB,EACzB,oBAAoB,EACrB,MAAM,kCAAkC,CAAC;AAI1C,qBAEa,wBAAyB,YAAW,UAAU,CAAC,gBAAgB,EAAE,oBAAoB,CAAC;IAE/F,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,aAAa;IAC9B,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAHN,IAAI,EAAE,WAAW,EACjB,aAAa,EAAE,mBAAmB,EAClC,OAAO,EAAE,iBAAiB,EAC1B,MAAM,EAAE,YAAY;IAGjC,OAAO,CAAC,KAAK,EAAE,gBAAgB,GAAG,8BAA8B,CAAC,oBAAoB,CAAC;CAmB7F;AAED,qBAEa,0BAA2B,YAAW,UAAU,CAAC,kBAAkB,EAAE,oBAAoB,CAAC;IAEnG,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAFN,IAAI,EAAE,WAAW,EACjB,OAAO,EAAE,iBAAiB,EAC1B,MAAM,EAAE,YAAY;IAGjC,OAAO,CAAC,KAAK,EAAE,kBAAkB,GAAG,8BAA8B,CAAC,oBAAoB,CAAC;CAQ/F;AAED,qBAEa,yBACX,YAAW,UAAU,CAAC,sBAAsB,EAAE,oBAAoB,CAAC;IAGjE,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAFN,IAAI,EAAE,WAAW,EACjB,OAAO,EAAE,iBAAiB,EAC1B,MAAM,EAAE,YAAY;IAGjC,OAAO,CAAC,KAAK,EAAE,sBAAsB,GAAG,8BAA8B,CAAC,oBAAoB,CAAC;CAiBnG;AAED,qBAEa,wBAAyB,YAAW,UAAU,CAAC,sBAAsB,EAAE,IAAI,CAAC;IAErF,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,OAAO;gBADP,IAAI,EAAE,WAAW,EACjB,OAAO,EAAE,iBAAiB;IAGvC,OAAO,CAAC,KAAK,EAAE,sBAAsB,GAAG,8BAA8B,CAAC,IAAI,CAAC;CAYnF;AAED,qBAEa,+BACX,YAAW,UAAU,CAAC,uBAAuB,EAAE,oBAAoB,CAAC;IAGlE,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,aAAa;IAC9B,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAHN,IAAI,EAAE,WAAW,EACjB,aAAa,EAAE,oBAAoB,EACnC,OAAO,EAAE,iBAAiB,EAC1B,MAAM,EAAE,YAAY;IAGjC,OAAO,CAAC,KAAK,EAAE,uBAAuB,GAAG,8BAA8B,CAAC,oBAAoB,CAAC;CAiBpG;AAED,eAAO,MAAM,qBAAqB,uLAMjC,CAAC;AAMF,qBAEa,6BAA8B,YAAW,qBAAqB,CAAC,IAAI,EAAE,4BAA4B,CAAC;IACjG,OAAO,CAAC,QAAQ,CAAC,SAAS;gBAAT,SAAS,EAAE,SAAS;IAE3C,OAAO,IAAI,0BAA0B,CAAC,4BAA4B,CAAC;IAgBzE,OAAO,CAAC,8BAA8B;CASvC;AAED,qBAEa,2BACX,YAAW,qBAAqB,CAAC,IAAI,EAAE,oBAAoB,CAAC;IAG1D,OAAO,CAAC,QAAQ,CAAC,cAAc;IAC/B,OAAO,CAAC,QAAQ,CAAC,cAAc;gBADd,cAAc,EAAE,qBAAqB,EACrC,cAAc,EAAE,qBAAqB;IAGlD,OAAO,IAAI,0BAA0B,CAAC,oBAAoB,CAAC;CAKlE;AAED,qBAEa,gCACX,YAAW,qBAAqB,CAAC,IAAI,EAAE,yBAAyB,CAAC;IAG/D,OAAO,CAAC,QAAQ,CAAC,cAAc;IAC/B,OAAO,CAAC,QAAQ,CAAC,cAAc;gBADd,cAAc,EAAE,qBAAqB,EACrC,cAAc,EAAE,qBAAqB;IAGlD,OAAO,IAAI,0BAA0B,CAAC,yBAAyB,CAAC;CAQvE;AAED,qBAEa,+BAAgC,YAAW,qBAAqB,CAAC,IAAI,EAAE,sBAAsB,CAAC;IAEvG,OAAO,CAAC,QAAQ,CAAC,cAAc;IAC/B,OAAO,CAAC,QAAQ,CAAC,cAAc;gBADd,cAAc,EAAE,qBAAqB,EACrC,cAAc,EAAE,qBAAqB;IAGlD,OAAO,IAAI,0BAA0B,CAAC,sBAAsB,CAAC;CASpE;AAED,eAAO,MAAM,oBAAoB,kKAKhC,CAAC"}

package/security/src/lib/auth/auth-runtime.handlers.js

@@ -0,0 +1,254 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AUTH_RUNTIME_QUERIES = exports.AuthGetAccessPolicyRuntimeQuery = exports.AuthListApplicationsRuntimeQuery = exports.AuthListTenantsRuntimeQuery = exports.AuthListProvidersRuntimeQuery = exports.AUTH_RUNTIME_COMMANDS = exports.AuthUpdateSessionRuntimeCommand = exports.AuthLogoutRuntimeCommand = exports.AuthRefreshRuntimeCommand = exports.AuthRegisterRuntimeCommand = exports.AuthSignInRuntimeCommand = void 0;
+const tslib_1 = require("tslib");
+const core_1 = require("@acorex-platform/framework-shared/core");
+const runtime_1 = require("@acorex-platform/framework-shared/runtime");
+const abstract_1 = require("@acorex-platform/framework-server/domain/abstract");
+const common_1 = require("@nestjs/common");
+const core_2 = require("@nestjs/core");
+const auth_http_request_util_1 = require("./auth-http-request.util");
+const auth_cookie_response_util_1 = require("./auth-cookie-response.util");
+const auth_cookie_service_1 = require("./auth-cookie.service");
+const auth_service_1 = require("./auth.service");
+const login_attempt_service_1 = require("./login-attempt.service");
+const request_meta_util_1 = require("./request-meta.util");
+const token_resolver_service_1 = require("./token-resolver.service");
+const token_service_1 = require("./token.service");
+const backend_session_service_1 = require("../session/backend-session.service");
+const session_context_service_1 = require("../session/session-context.service");
+const auth_identity_provider_source_1 = require("./auth-identity-provider.source");
+//#region ---- Auth runtime commands ----
+let AuthSignInRuntimeCommand = class AuthSignInRuntimeCommand {
+    constructor(auth, loginAttempts, cookies, tokens) {
+        this.auth = auth;
+        this.loginAttempts = loginAttempts;
+        this.cookies = cookies;
+        this.tokens = tokens;
+    }
+    async execute(input) {
+        this.auth.assertSupportedSignInStrategy(input.strategy);
+        const username = String(input.username ?? '').trim();
+        const password = String(input.password ?? '');
+        const user = await this.loginAttempts.authenticateLocal(this.loginAttempts.strategyName(), username, password);
+        const request = (0, auth_http_request_util_1.resolveAuthHttpRequest)();
+        const meta = (0, request_meta_util_1.resolveAuthRequestMeta)(request);
+        const data = await this.auth.completeSignIn(user, meta);
+        (0, auth_cookie_response_util_1.applyAuthTokenCookies)(request, this.cookies, this.tokens, data);
+        return { success: true, kind: 'object', data };
+    }
+};
+exports.AuthSignInRuntimeCommand = AuthSignInRuntimeCommand;
+exports.AuthSignInRuntimeCommand = AuthSignInRuntimeCommand = tslib_1.__decorate([
+    (0, abstract_1.ServerHandler)({ key: runtime_1.AUTH_SIGN_IN_DEFAULT, auth: 'public' }),
+    (0, common_1.Injectable)(),
+    tslib_1.__metadata("design:paramtypes", [auth_service_1.AuthService,
+        login_attempt_service_1.LoginAttemptService,
+        auth_cookie_service_1.AuthCookieService,
+        token_service_1.TokenService])
+], AuthSignInRuntimeCommand);
+let AuthRegisterRuntimeCommand = class AuthRegisterRuntimeCommand {
+    constructor(auth, cookies, tokens) {
+        this.auth = auth;
+        this.cookies = cookies;
+        this.tokens = tokens;
+    }
+    async execute(input) {
+        const request = (0, auth_http_request_util_1.resolveAuthHttpRequest)();
+        const meta = (0, request_meta_util_1.resolveAuthRequestMeta)(request);
+        const data = await this.auth.register(input, meta);
+        (0, auth_cookie_response_util_1.applyAuthTokenCookies)(request, this.cookies, this.tokens, data);
+        return { success: true, kind: 'object', data };
+    }
+};
+exports.AuthRegisterRuntimeCommand = AuthRegisterRuntimeCommand;
+exports.AuthRegisterRuntimeCommand = AuthRegisterRuntimeCommand = tslib_1.__decorate([
+    (0, abstract_1.ServerHandler)({ key: runtime_1.AUTH_REGISTER_DEFAULT, auth: 'public' }),
+    (0, common_1.Injectable)(),
+    tslib_1.__metadata("design:paramtypes", [auth_service_1.AuthService,
+        auth_cookie_service_1.AuthCookieService,
+        token_service_1.TokenService])
+], AuthRegisterRuntimeCommand);
+let AuthRefreshRuntimeCommand = class AuthRefreshRuntimeCommand {
+    constructor(auth, cookies, tokens) {
+        this.auth = auth;
+        this.cookies = cookies;
+        this.tokens = tokens;
+    }
+    async execute(input) {
+        const request = (0, auth_http_request_util_1.resolveAuthHttpRequest)();
+        const refreshToken = this.cookies.readRefreshToken(request.cookies) ??
+            input.refreshToken?.trim() ??
+            null;
+        if (!refreshToken) {
+            throw new common_1.UnauthorizedException('refreshToken is required');
+        }
+        const meta = (0, request_meta_util_1.resolveAuthRequestMeta)(request);
+        const data = await this.auth.refreshSession(refreshToken, meta);
+        (0, auth_cookie_response_util_1.applyAuthTokenCookies)(request, this.cookies, this.tokens, data);
+        return { success: true, kind: 'object', data };
+    }
+};
+exports.AuthRefreshRuntimeCommand = AuthRefreshRuntimeCommand;
+exports.AuthRefreshRuntimeCommand = AuthRefreshRuntimeCommand = tslib_1.__decorate([
+    (0, abstract_1.ServerHandler)({ key: runtime_1.AUTH_REFRESH_DEFAULT, auth: 'public' }),
+    (0, common_1.Injectable)(),
+    tslib_1.__metadata("design:paramtypes", [auth_service_1.AuthService,
+        auth_cookie_service_1.AuthCookieService,
+        token_service_1.TokenService])
+], AuthRefreshRuntimeCommand);
+let AuthLogoutRuntimeCommand = class AuthLogoutRuntimeCommand {
+    constructor(auth, cookies) {
+        this.auth = auth;
+        this.cookies = cookies;
+    }
+    async execute(input) {
+        const request = (0, auth_http_request_util_1.resolveAuthHttpRequest)();
+        const refreshToken = this.cookies.readRefreshToken(request.cookies) ??
+            input.refreshToken?.trim() ??
+            null;
+        await this.auth.logout(refreshToken);
+        (0, auth_cookie_response_util_1.clearAuthTokenCookies)(request, this.cookies);
+        return (0, core_1.runtimeCommandSuccessObject)(undefined);
+    }
+};
+exports.AuthLogoutRuntimeCommand = AuthLogoutRuntimeCommand;
+exports.AuthLogoutRuntimeCommand = AuthLogoutRuntimeCommand = tslib_1.__decorate([
+    (0, abstract_1.ServerHandler)({ key: runtime_1.AUTH_LOGOUT_DEFAULT, auth: 'public' }),
+    (0, common_1.Injectable)(),
+    tslib_1.__metadata("design:paramtypes", [auth_service_1.AuthService,
+        auth_cookie_service_1.AuthCookieService])
+], AuthLogoutRuntimeCommand);
+let AuthUpdateSessionRuntimeCommand = class AuthUpdateSessionRuntimeCommand {
+    constructor(auth, tokenResolver, cookies, tokens) {
+        this.auth = auth;
+        this.tokenResolver = tokenResolver;
+        this.cookies = cookies;
+        this.tokens = tokens;
+    }
+    async execute(input) {
+        const request = (0, auth_http_request_util_1.resolveAuthHttpRequest)();
+        const resolved = this.tokenResolver.resolveAccessToken(request.headers, request.cookies);
+        if (!resolved) {
+            throw new common_1.UnauthorizedException('Access token is required');
+        }
+        const meta = (0, request_meta_util_1.resolveAuthRequestMeta)(request);
+        const data = await this.auth.updateSession(resolved.token, input, meta);
+        (0, auth_cookie_response_util_1.applyAuthTokenCookies)(request, this.cookies, this.tokens, data);
+        return { success: true, kind: 'object', data };
+    }
+};
+exports.AuthUpdateSessionRuntimeCommand = AuthUpdateSessionRuntimeCommand;
+exports.AuthUpdateSessionRuntimeCommand = AuthUpdateSessionRuntimeCommand = tslib_1.__decorate([
+    (0, abstract_1.ServerHandler)({ key: runtime_1.AUTH_UPDATE_SESSION_DEFAULT, auth: 'session' }),
+    (0, common_1.Injectable)(),
+    tslib_1.__metadata("design:paramtypes", [auth_service_1.AuthService,
+        token_resolver_service_1.TokenResolverService,
+        auth_cookie_service_1.AuthCookieService,
+        token_service_1.TokenService])
+], AuthUpdateSessionRuntimeCommand);
+exports.AUTH_RUNTIME_COMMANDS = [
+    AuthSignInRuntimeCommand,
+    AuthRegisterRuntimeCommand,
+    AuthRefreshRuntimeCommand,
+    AuthLogoutRuntimeCommand,
+    AuthUpdateSessionRuntimeCommand,
+];
+//#endregion
+//#region ---- Auth runtime queries ----
+let AuthListProvidersRuntimeQuery = class AuthListProvidersRuntimeQuery {
+    constructor(moduleRef) {
+        this.moduleRef = moduleRef;
+    }
+    async execute() {
+        const localMethods = [
+            {
+                id: 'user-pass',
+                title: 'Password',
+                protocol: 'password',
+                enabled: true,
+            },
+        ];
+        const catalog = this.resolveIdentityProviderCatalog();
+        const identityProviders = catalog ? await catalog.listEnabledForLogin() : [];
+        return (0, core_1.runtimeQuerySuccessObject)({ localMethods, identityProviders });
+    }
+    resolveIdentityProviderCatalog() {
+        try {
+            return this.moduleRef.get(auth_identity_provider_source_1.AUTH_IDENTITY_PROVIDER_CATALOG, {
+                strict: false,
+            });
+        }
+        catch {
+            return null;
+        }
+    }
+};
+exports.AuthListProvidersRuntimeQuery = AuthListProvidersRuntimeQuery;
+exports.AuthListProvidersRuntimeQuery = AuthListProvidersRuntimeQuery = tslib_1.__decorate([
+    (0, abstract_1.ServerQueryHandler)({ key: runtime_1.AUTH_LIST_PROVIDERS_DEFAULT, auth: 'public' }),
+    (0, common_1.Injectable)(),
+    tslib_1.__metadata("design:paramtypes", [core_2.ModuleRef])
+], AuthListProvidersRuntimeQuery);
+let AuthListTenantsRuntimeQuery = class AuthListTenantsRuntimeQuery {
+    constructor(sessionContext, backendSession) {
+        this.sessionContext = sessionContext;
+        this.backendSession = backendSession;
+    }
+    async execute() {
+        const session = this.backendSession.requireAuthenticated();
+        const page = await this.sessionContext.getAvailableTenantsForUser(session.userId);
+        return (0, core_1.runtimeQuerySuccessCollection)(page);
+    }
+};
+exports.AuthListTenantsRuntimeQuery = AuthListTenantsRuntimeQuery;
+exports.AuthListTenantsRuntimeQuery = AuthListTenantsRuntimeQuery = tslib_1.__decorate([
+    (0, abstract_1.ServerQueryHandler)({ key: runtime_1.AUTH_LIST_TENANTS_DEFAULT, auth: 'session' }),
+    (0, common_1.Injectable)(),
+    tslib_1.__metadata("design:paramtypes", [session_context_service_1.SessionContextService,
+        backend_session_service_1.BackendSessionService])
+], AuthListTenantsRuntimeQuery);
+let AuthListApplicationsRuntimeQuery = class AuthListApplicationsRuntimeQuery {
+    constructor(sessionContext, backendSession) {
+        this.sessionContext = sessionContext;
+        this.backendSession = backendSession;
+    }
+    async execute() {
+        const session = this.backendSession.requireAuthenticated();
+        const page = await this.sessionContext.getApplicationsForCurrentTenant(session.userId, session.tenantId);
+        return (0, core_1.runtimeQuerySuccessCollection)(page);
+    }
+};
+exports.AuthListApplicationsRuntimeQuery = AuthListApplicationsRuntimeQuery;
+exports.AuthListApplicationsRuntimeQuery = AuthListApplicationsRuntimeQuery = tslib_1.__decorate([
+    (0, abstract_1.ServerQueryHandler)({ key: runtime_1.AUTH_LIST_APPLICATIONS_DEFAULT, auth: 'session' }),
+    (0, common_1.Injectable)(),
+    tslib_1.__metadata("design:paramtypes", [session_context_service_1.SessionContextService,
+        backend_session_service_1.BackendSessionService])
+], AuthListApplicationsRuntimeQuery);
+let AuthGetAccessPolicyRuntimeQuery = class AuthGetAccessPolicyRuntimeQuery {
+    constructor(sessionContext, backendSession) {
+        this.sessionContext = sessionContext;
+        this.backendSession = backendSession;
+    }
+    async execute() {
+        const session = this.backendSession.requireAuthenticated();
+        const data = await this.sessionContext.getAccessPolicy(session.userId, session.tenantId, session.applicationId);
+        return (0, core_1.runtimeQuerySuccessObject)(data);
+    }
+};
+exports.AuthGetAccessPolicyRuntimeQuery = AuthGetAccessPolicyRuntimeQuery;
+exports.AuthGetAccessPolicyRuntimeQuery = AuthGetAccessPolicyRuntimeQuery = tslib_1.__decorate([
+    (0, abstract_1.ServerQueryHandler)({ key: runtime_1.AUTH_GET_ACCESS_POLICY_DEFAULT, auth: 'session' }),
+    (0, common_1.Injectable)(),
+    tslib_1.__metadata("design:paramtypes", [session_context_service_1.SessionContextService,
+        backend_session_service_1.BackendSessionService])
+], AuthGetAccessPolicyRuntimeQuery);
+exports.AUTH_RUNTIME_QUERIES = [
+    AuthListProvidersRuntimeQuery,
+    AuthListTenantsRuntimeQuery,
+    AuthListApplicationsRuntimeQuery,
+    AuthGetAccessPolicyRuntimeQuery,
+];
+//#endregion
+//# sourceMappingURL=auth-runtime.handlers.js.map

package/security/src/lib/auth/auth-runtime.handlers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-runtime.handlers.js","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/auth/auth-runtime.handlers.ts"],"names":[],"mappings":";;;;AACA,iEAIgD;AAEhD,uEAUmD;AACnD,gFAAkI;AAClI,2CAAmE;AACnE,uCAAyC;AAEzC,qEAAkE;AAClE,2EAGqC;AACrC,+DAA0D;AAC1D,iDAA6C;AAQ7C,mEAA8D;AAC9D,2DAA6D;AAC7D,qEAAgE;AAChE,mDAA+C;AAC/C,gFAA2E;AAC3E,gFAA2E;AAC3E,mFAKyC;AAOzC,yCAAyC;AAIlC,IAAM,wBAAwB,GAA9B,MAAM,wBAAwB;IACnC,YACmB,IAAiB,EACjB,aAAkC,EAClC,OAA0B,EAC1B,MAAoB;QAHpB,SAAI,GAAJ,IAAI,CAAa;QACjB,kBAAa,GAAb,aAAa,CAAqB;QAClC,YAAO,GAAP,OAAO,CAAmB;QAC1B,WAAM,GAAN,MAAM,CAAc;IACpC,CAAC;IAEJ,KAAK,CAAC,OAAO,CAAC,KAAuB;QACnC,IAAI,CAAC,IAAI,CAAC,6BAA6B,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAExD,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACrD,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC;QAE9C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,iBAAiB,CACrD,IAAI,CAAC,aAAa,CAAC,YAAY,EAAE,EACjC,QAAQ,EACR,QAAQ,CACT,CAAC;QAEF,MAAM,OAAO,GAAG,IAAA,+CAAsB,GAAE,CAAC;QACzC,MAAM,IAAI,GAAG,IAAA,0CAAsB,EAAC,OAAO,CAAC,CAAC;QAC7C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACxD,IAAA,iDAAqB,EAAC,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAEhE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IACjD,CAAC;CACF,CAAA;AA3BY,4DAAwB;mCAAxB,wBAAwB;IAFpC,IAAA,wBAAa,EAAC,EAAE,GAAG,EAAE,8BAAoB,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IAC5D,IAAA,mBAAU,GAAE;6CAGc,0BAAW;QACF,2CAAmB;QACzB,uCAAiB;QAClB,4BAAY;GAL5B,wBAAwB,CA2BpC;AAIM,IAAM,0BAA0B,GAAhC,MAAM,0BAA0B;IACrC,YACmB,IAAiB,EACjB,OAA0B,EAC1B,MAAoB;QAFpB,SAAI,GAAJ,IAAI,CAAa;QACjB,YAAO,GAAP,OAAO,CAAmB;QAC1B,WAAM,GAAN,MAAM,CAAc;IACpC,CAAC;IAEJ,KAAK,CAAC,OAAO,CAAC,KAAyB;QACrC,MAAM,OAAO,GAAG,IAAA,+CAAsB,GAAE,CAAC;QACzC,MAAM,IAAI,GAAG,IAAA,0CAAsB,EAAC,OAAO,CAAC,CAAC;QAC7C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QACnD,IAAA,iDAAqB,EAAC,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAEhE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IACjD,CAAC;CACF,CAAA;AAfY,gEAA0B;qCAA1B,0BAA0B;IAFtC,IAAA,wBAAa,EAAC,EAAE,GAAG,EAAE,+BAAqB,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IAC7D,IAAA,mBAAU,GAAE;6CAGc,0BAAW;QACR,uCAAiB;QAClB,4BAAY;GAJ5B,0BAA0B,CAetC;AAIM,IAAM,yBAAyB,GAA/B,MAAM,yBAAyB;IAGpC,YACmB,IAAiB,EACjB,OAA0B,EAC1B,MAAoB;QAFpB,SAAI,GAAJ,IAAI,CAAa;QACjB,YAAO,GAAP,OAAO,CAAmB;QAC1B,WAAM,GAAN,MAAM,CAAc;IACpC,CAAC;IAEJ,KAAK,CAAC,OAAO,CAAC,KAA6B;QACzC,MAAM,OAAO,GAAG,IAAA,+CAAsB,GAAE,CAAC;QACzC,MAAM,YAAY,GAChB,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,OAAO,CAAC,OAAkC,CAAC;YACzE,KAAK,CAAC,YAAY,EAAE,IAAI,EAAE;YAC1B,IAAI,CAAC;QAEP,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,MAAM,IAAI,8BAAqB,CAAC,0BAA0B,CAAC,CAAC;QAC9D,CAAC;QAED,MAAM,IAAI,GAAG,IAAA,0CAAsB,EAAC,OAAO,CAAC,CAAC;QAC7C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC;QAChE,IAAA,iDAAqB,EAAC,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAEhE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IACjD,CAAC;CACF,CAAA;AA1BY,8DAAyB;oCAAzB,yBAAyB;IAFrC,IAAA,wBAAa,EAAC,EAAE,GAAG,EAAE,8BAAoB,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IAC5D,IAAA,mBAAU,GAAE;6CAKc,0BAAW;QACR,uCAAiB;QAClB,4BAAY;GAN5B,yBAAyB,CA0BrC;AAIM,IAAM,wBAAwB,GAA9B,MAAM,wBAAwB;IACnC,YACmB,IAAiB,EACjB,OAA0B;QAD1B,SAAI,GAAJ,IAAI,CAAa;QACjB,YAAO,GAAP,OAAO,CAAmB;IAC1C,CAAC;IAEJ,KAAK,CAAC,OAAO,CAAC,KAA6B;QACzC,MAAM,OAAO,GAAG,IAAA,+CAAsB,GAAE,CAAC;QACzC,MAAM,YAAY,GAChB,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,OAAO,CAAC,OAAkC,CAAC;YACzE,KAAK,CAAC,YAAY,EAAE,IAAI,EAAE;YAC1B,IAAI,CAAC;QAEP,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QACrC,IAAA,iDAAqB,EAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;QAE7C,OAAO,IAAA,kCAA2B,EAAC,SAAS,CAAC,CAAC;IAChD,CAAC;CACF,CAAA;AAlBY,4DAAwB;mCAAxB,wBAAwB;IAFpC,IAAA,wBAAa,EAAC,EAAE,GAAG,EAAE,6BAAmB,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IAC3D,IAAA,mBAAU,GAAE;6CAGc,0BAAW;QACR,uCAAiB;GAHlC,wBAAwB,CAkBpC;AAIM,IAAM,+BAA+B,GAArC,MAAM,+BAA+B;IAG1C,YACmB,IAAiB,EACjB,aAAmC,EACnC,OAA0B,EAC1B,MAAoB;QAHpB,SAAI,GAAJ,IAAI,CAAa;QACjB,kBAAa,GAAb,aAAa,CAAsB;QACnC,YAAO,GAAP,OAAO,CAAmB;QAC1B,WAAM,GAAN,MAAM,CAAc;IACpC,CAAC;IAEJ,KAAK,CAAC,OAAO,CAAC,KAA8B;QAC1C,MAAM,OAAO,GAAG,IAAA,+CAAsB,GAAE,CAAC;QACzC,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,CAAC,kBAAkB,CACpD,OAAO,CAAC,OAAwD,EAChE,OAAO,CAAC,OAAkC,CAC3C,CAAC;QAEF,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,8BAAqB,CAAC,0BAA0B,CAAC,CAAC;QAC9D,CAAC;QAED,MAAM,IAAI,GAAG,IAAA,0CAAsB,EAAC,OAAO,CAAC,CAAC;QAC7C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;QACxE,IAAA,iDAAqB,EAAC,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAEhE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IACjD,CAAC;CACF,CAAA;AA3BY,0EAA+B;0CAA/B,+BAA+B;IAF3C,IAAA,wBAAa,EAAC,EAAE,GAAG,EAAE,qCAA2B,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IACpE,IAAA,mBAAU,GAAE;6CAKc,0BAAW;QACF,6CAAoB;QAC1B,uCAAiB;QAClB,4BAAY;GAP5B,+BAA+B,CA2B3C;AAEY,QAAA,qBAAqB,GAAG;IACnC,wBAAwB;IACxB,0BAA0B;IAC1B,yBAAyB;IACzB,wBAAwB;IACxB,+BAA+B;CAChC,CAAC;AAEF,YAAY;AAEZ,wCAAwC;AAIjC,IAAM,6BAA6B,GAAnC,MAAM,6BAA6B;IACxC,YAA6B,SAAoB;QAApB,cAAS,GAAT,SAAS,CAAW;IAAG,CAAC;IAErD,KAAK,CAAC,OAAO;QACX,MAAM,YAAY,GAA+B;YAC/C;gBACE,EAAE,EAAE,WAAW;gBACf,KAAK,EAAE,UAAU;gBACjB,QAAQ,EAAE,UAAU;gBACpB,OAAO,EAAE,IAAI;aACd;SACF,CAAC;QAEF,MAAM,OAAO,GAAG,IAAI,CAAC,8BAA8B,EAAE,CAAC;QACtD,MAAM,iBAAiB,GAAG,OAAO,CAAC,CAAC,CAAC,MAAM,OAAO,CAAC,mBAAmB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAE7E,OAAO,IAAA,gCAAyB,EAAC,EAAE,YAAY,EAAE,iBAAiB,EAAE,CAAC,CAAC;IACxE,CAAC;IAEO,8BAA8B;QACpC,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAA8B,8DAA8B,EAAE;gBACrF,MAAM,EAAE,KAAK;aACd,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;CACF,CAAA;AA5BY,sEAA6B;wCAA7B,6BAA6B;IAFzC,IAAA,6BAAkB,EAAC,EAAE,GAAG,EAAE,qCAA2B,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IACxE,IAAA,mBAAU,GAAE;6CAE6B,gBAAS;GADtC,6BAA6B,CA4BzC;AAIM,IAAM,2BAA2B,GAAjC,MAAM,2BAA2B;IAGtC,YACmB,cAAqC,EACrC,cAAqC;QADrC,mBAAc,GAAd,cAAc,CAAuB;QACrC,mBAAc,GAAd,cAAc,CAAuB;IACrD,CAAC;IAEJ,KAAK,CAAC,OAAO;QACX,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,oBAAoB,EAAE,CAAC;QAC3D,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,0BAA0B,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAClF,OAAO,IAAA,oCAA6B,EAAC,IAAI,CAAC,CAAC;IAC7C,CAAC;CACF,CAAA;AAbY,kEAA2B;sCAA3B,2BAA2B;IAFvC,IAAA,6BAAkB,EAAC,EAAE,GAAG,EAAE,mCAAyB,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IACvE,IAAA,mBAAU,GAAE;6CAKwB,+CAAqB;QACrB,+CAAqB;GAL7C,2BAA2B,CAavC;AAIM,IAAM,gCAAgC,GAAtC,MAAM,gCAAgC;IAG3C,YACmB,cAAqC,EACrC,cAAqC;QADrC,mBAAc,GAAd,cAAc,CAAuB;QACrC,mBAAc,GAAd,cAAc,CAAuB;IACrD,CAAC;IAEJ,KAAK,CAAC,OAAO;QACX,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,oBAAoB,EAAE,CAAC;QAC3D,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,+BAA+B,CACpE,OAAO,CAAC,MAAM,EACd,OAAO,CAAC,QAAQ,CACjB,CAAC;QACF,OAAO,IAAA,oCAA6B,EAAC,IAAI,CAAC,CAAC;IAC7C,CAAC;CACF,CAAA;AAhBY,4EAAgC;2CAAhC,gCAAgC;IAF5C,IAAA,6BAAkB,EAAC,EAAE,GAAG,EAAE,wCAA8B,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IAC5E,IAAA,mBAAU,GAAE;6CAKwB,+CAAqB;QACrB,+CAAqB;GAL7C,gCAAgC,CAgB5C;AAIM,IAAM,+BAA+B,GAArC,MAAM,+BAA+B;IAC1C,YACmB,cAAqC,EACrC,cAAqC;QADrC,mBAAc,GAAd,cAAc,CAAuB;QACrC,mBAAc,GAAd,cAAc,CAAuB;IACrD,CAAC;IAEJ,KAAK,CAAC,OAAO;QACX,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,oBAAoB,EAAE,CAAC;QAC3D,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,eAAe,CACpD,OAAO,CAAC,MAAM,EACd,OAAO,CAAC,QAAQ,EAChB,OAAO,CAAC,aAAa,CACtB,CAAC;QACF,OAAO,IAAA,gCAAyB,EAAC,IAAI,CAAC,CAAC;IACzC,CAAC;CACF,CAAA;AAfY,0EAA+B;0CAA/B,+BAA+B;IAF3C,IAAA,6BAAkB,EAAC,EAAE,GAAG,EAAE,wCAA8B,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IAC5E,IAAA,mBAAU,GAAE;6CAGwB,+CAAqB;QACrB,+CAAqB;GAH7C,+BAA+B,CAe3C;AAEY,QAAA,oBAAoB,GAAG;IAClC,6BAA6B;IAC7B,2BAA2B;IAC3B,gCAAgC;IAChC,+BAA+B;CAChC,CAAC;AAEF,YAAY"}

package/security/src/lib/auth/auth.config.d.ts

@@ -1,12 +1,9 @@
 export declare const AUTH_COOKIE_REFRESH_TOKEN = "acx_refresh_token";
-/** Optional short-lived access token cookie for legacy cookie-based guards. */
+/** HttpOnly access token cookie (primary SPA credential). */
 export declare const AUTH_COOKIE_ACCESS_TOKEN = "acx_access_token";
 export declare const AUTH_STRATEGY_USER_PASS = "user-pass";
-export declare const AUTH_MAX_LOGIN_ATTEMPTS: () => number;
-export declare const AUTH_LOCKOUT_DURATION_MINUTES: () => number;
-/** Failed attempts before the API signals that a login challenge may be required. */
-export declare const AUTH_CAPTCHA_ATTEMPT_THRESHOLD: () => number;
 export declare const AUTH_COOKIE_SECURE: () => boolean;
 export declare const AUTH_COOKIE_SAME_SITE: () => "lax" | "strict" | "none";
+/** Path scoped so refresh cookies are sent to all `/api` routes (incl. runtime). */
 export declare const AUTH_REFRESH_COOKIE_PATH: () => string;
 //# sourceMappingURL=auth.config.d.ts.map

package/security/src/lib/auth/auth.config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.config.d.ts","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/auth/auth.config.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,yBAAyB,sBAAsB,CAAC;AAE7D,+EAA+E;AAC/E,eAAO,MAAM,wBAAwB,qBAAqB,CAAC;AAE3D,eAAO,MAAM,uBAAuB,cAAc,CAAC;AAEnD,eAAO,MAAM,uBAAuB,QAAO,MAI1C,CAAC;AAEF,eAAO,MAAM,6BAA6B,QAAO,MAIhD,CAAC;AAEF,qFAAqF;AACrF,eAAO,MAAM,8BAA8B,QAAO,MAIjD,CAAC;AAEF,eAAO,MAAM,kBAAkB,QAAO,OACoD,CAAC;AAE3F,eAAO,MAAM,qBAAqB,QAAO,KAAK,GAAG,QAAQ,GAAG,MAM3D,CAAC;AAEF,eAAO,MAAM,wBAAwB,QAAO,MACuB,CAAC"}
+{"version":3,"file":"auth.config.d.ts","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/auth/auth.config.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,yBAAyB,sBAAsB,CAAC;AAE7D,6DAA6D;AAC7D,eAAO,MAAM,wBAAwB,qBAAqB,CAAC;AAE3D,eAAO,MAAM,uBAAuB,cAAc,CAAC;AAEnD,eAAO,MAAM,kBAAkB,QAAO,OACoD,CAAC;AAE3F,eAAO,MAAM,qBAAqB,QAAO,KAAK,GAAG,QAAQ,GAAG,MAM3D,CAAC;AAEF,oFAAoF;AACpF,eAAO,MAAM,wBAAwB,QAAO,MACe,CAAC"}