@acorex-platform/framework-server 0.0.15 → 0.0.20

package/security/src/lib/entity-storage/visibility-filter.middleware.js

@@ -3,82 +3,328 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.VisibilityFilterMiddleware = void 0;
 const tslib_1 = require("tslib");
 const common_1 = require("@nestjs/common");
-const core_1 = require("@nestjs/core");
 const lodash_es_1 = require("lodash-es");
+const core_1 = require("@acorex-platform/framework-server/core");
 const abstract_1 = require("@acorex-platform/framework-server/jql/abstract");
 const current_session_decorator_1 = require("../session/current-session.decorator");
-//#region ---- Visibility filter middleware (server) ----
-const USER_ENTITY = 'SecurityManagement.User';
+const MUTATE_OPS = ['update', 'delete'];
+const READ_FILTER_OPS = ['query', 'aggregate'];
 /**
-
- * Injects SQL/JQL-level visibility filters before query execution.
-
- * - Hides records with stateInfo.isHidden === true (unless bypassed)
-
- * - Scopes by ownershipInfo.tenantId / applicationId from session (unless bypassed)
-
- * - getOne is not filtered (direct access allowed, matching mock)
-
+ * Injects scope + visibility filters and authorizes getOne / update / delete.
+ *
+ * - Expression policies from PlatformManagement.EntityAccessPolicy
+ * - Strict attribute filters (no soft-null leak)
+ * - Platform-only write policies are readonly for non-platform sessions
+ * - HTTP clients cannot pass scope bypass (stripped at controller); server locals still can
+ *
+ * Singleton + ALS request (not Nest REQUEST DI). Registered via
+ * {@link SecurityEntityStorageBootstrap}.
  */
 let VisibilityFilterMiddleware = class VisibilityFilterMiddleware {
-    constructor(request) {
-        this.request = request;
+    constructor() {
         this.target = {
-            ops: ['query'],
+            ops: ['query', 'aggregate', 'getOne', 'create', 'update', 'delete'],
             order: 8,
         };
     }
     async execute(ctx, next) {
-        if (!ctx.request) {
+        if (!ctx.request &&
+            READ_FILTER_OPS.includes(ctx.op) === false &&
+            ctx.op !== 'getOne' &&
+            ctx.op !== 'create' &&
+            !MUTATE_OPS.includes(ctx.op)) {
             await next();
             return;
         }
-        const params = ctx.request.params;
+        // Engine workers and trusted system-command writers (schedule sync, scanners)
+        // operate without an HTTP session tenant — do not apply scope gates.
+        if ((0, abstract_1.isEngineStorageBypass)(ctx.locals) || (0, abstract_1.isSystemCommandBypass)(ctx.locals)) {
+            await next();
+            if (ctx.entityName === abstract_1.ENTITY_ACCESS_POLICY_ENTITY && (ctx.op === 'create' || MUTATE_OPS.includes(ctx.op))) {
+                await this.reloadPolicyCache(ctx);
+            }
+            return;
+        }
+        const params = ctx.request?.params;
+        // Bypass is for trusted server callers (login, password-reset, nested lookups).
+        // HTTP no longer accepts these query params — see EntityStorageController.
         const bypassVisibility = (0, abstract_1.isFilterBypassed)(params, abstract_1.VISIBILITY_FILTER_BYPASS) ||
             ctx.locals.get(abstract_1.VISIBILITY_FILTER_BYPASS) === true;
-        const bypassOwnership = (0, abstract_1.isFilterBypassed)(params, abstract_1.OWNERSHIP_FILTER_BYPASS) ||
-            ctx.locals.get(abstract_1.OWNERSHIP_FILTER_BYPASS) === true;
-        if (bypassVisibility && bypassOwnership) {
+        const bypassScope = (0, abstract_1.isFilterBypassed)(params, abstract_1.SCOPE_FILTER_BYPASS) ||
+            ctx.locals.get(abstract_1.SCOPE_FILTER_BYPASS) === true;
+        if (bypassVisibility && bypassScope) {
             await next();
             return;
         }
-        const session = this.request?.[current_session_decorator_1.CURRENT_SESSION_KEY];
+        const session = this.resolveSession();
         const sessionTenantId = session?.tenantId;
         const sessionApplicationId = session?.applicationId;
-        let effectiveTenantId = sessionTenantId;
-        if (!bypassOwnership && !effectiveTenantId && session?.userId) {
-            effectiveTenantId = await this.resolveUserTenantId(ctx, session.userId);
-        }
-        const systemFilter = (0, abstract_1.buildEntityVisibilityAxpFilter)({
-            tenantId: effectiveTenantId,
-            applicationId: sessionApplicationId,
-            bypassVisibility,
-            bypassOwnership,
-        });
-        if (systemFilter) {
-            ctx.request = {
-                ...ctx.request,
-                filter: (0, abstract_1.mergeAxpQueryFilters)(ctx.request.filter, systemFilter),
-            };
+        const policy = (0, abstract_1.resolveEntityAccessPolicy)(ctx.entityName);
+        let membershipUserIds;
+        let sharedResourceIds;
+        if (!bypassScope && sessionTenantId) {
+            if (policy.read === 'identity-read') {
+                membershipUserIds = await this.resolveIdentityMembershipUserIds(ctx, sessionTenantId, sessionApplicationId);
+            }
+            if (policy.read === 'tenant-or-share-read') {
+                sharedResourceIds = await this.resolveSharedResourceIds(ctx, sessionTenantId, ctx.entityName);
+            }
+        }
+        if (READ_FILTER_OPS.includes(ctx.op) && ctx.request) {
+            const systemFilter = (0, abstract_1.buildEntityVisibilityAxpFilter)({
+                tenantId: sessionTenantId,
+                applicationId: sessionApplicationId,
+                userId: session?.userId,
+                bypassVisibility,
+                bypassScope,
+                policy,
+                membershipUserIds,
+                sharedResourceIds,
+            });
+            if (systemFilter) {
+                ctx.request = {
+                    ...ctx.request,
+                    filter: (0, abstract_1.mergeAxpQueryFilters)(ctx.request.filter, systemFilter),
+                };
+            }
+            await next();
+            return;
+        }
+        if (ctx.op === 'getOne') {
+            await next();
+            if (bypassScope) {
+                return;
+            }
+            const record = ctx.result;
+            if (!(0, abstract_1.evaluateRecordAccess)({
+                record,
+                policy,
+                mode: 'read',
+                session: {
+                    tenantId: sessionTenantId,
+                    applicationId: sessionApplicationId,
+                    userId: session?.userId,
+                },
+                membershipUserIds,
+                sharedResourceIds,
+            })) {
+                ctx.result = null;
+            }
+            return;
+        }
+        if (ctx.op === 'create') {
+            if (!bypassScope && (0, abstract_1.isPlatformOnlyWrite)(policy)) {
+                // Fail closed: missing session must not skip the platform-only gate.
+                if (!sessionTenantId || !(0, abstract_1.isPlatformSessionTenant)(sessionTenantId)) {
+                    throw new core_1.MiddlewareAbortError('Only the platform tenant may manage this resource.', {
+                        code: 'SCOPE_READONLY',
+                        status: 403,
+                    });
+                }
+            }
+            await next();
+            if (ctx.entityName === abstract_1.ENTITY_ACCESS_POLICY_ENTITY) {
+                await this.reloadPolicyCache(ctx);
+            }
+            return;
+        }
+        if (MUTATE_OPS.includes(ctx.op)) {
+            if (!bypassScope) {
+                const existing = await this.loadExisting(ctx);
+                if (!(0, abstract_1.evaluateRecordAccess)({
+                    record: existing,
+                    policy,
+                    mode: 'write',
+                    session: {
+                        tenantId: sessionTenantId,
+                        applicationId: sessionApplicationId,
+                        userId: session?.userId,
+                    },
+                    membershipUserIds,
+                    sharedResourceIds,
+                })) {
+                    throw new core_1.MiddlewareAbortError('Record not found or not accessible in current scope.', {
+                        code: 'SCOPE_ACCESS_DENIED',
+                        status: 404,
+                    });
+                }
+                const stateInfo = (0, lodash_es_1.get)(existing, 'stateInfo');
+                const platformWriter = (0, abstract_1.isPlatformSessionTenant)(sessionTenantId);
+                const platformManagedReadonly = (0, abstract_1.isPlatformOnlyWrite)(policy) && !platformWriter;
+                const immutableBlocked = stateInfo?.['isImmutable'] === true && !platformWriter;
+                if (immutableBlocked || platformManagedReadonly) {
+                    throw new core_1.MiddlewareAbortError('This record is readonly and cannot be modified.', {
+                        code: 'SCOPE_READONLY',
+                        status: 403,
+                    });
+                }
+                // Never trust client-supplied scopeInfo on update.
+                if (ctx.data && typeof ctx.data === 'object') {
+                    const data = { ...ctx.data };
+                    delete data['scopeInfo'];
+                    ctx.data = data;
+                }
+            }
+            await next();
+            if (ctx.entityName === abstract_1.ENTITY_ACCESS_POLICY_ENTITY) {
+                await this.reloadPolicyCache(ctx);
+            }
+            return;
         }
         await next();
     }
-    async resolveUserTenantId(ctx, userId) {
+    resolveSession() {
+        const req = (0, core_1.getEntityStorageRequest)();
+        return req?.[current_session_decorator_1.CURRENT_SESSION_KEY] ?? null;
+    }
+    async loadExisting(ctx) {
+        if (ctx.previous && typeof ctx.previous === 'object') {
+            return ctx.previous;
+        }
+        if (!ctx.id) {
+            return null;
+        }
+        try {
+            return (await ctx.backend.getOne(ctx.entityName, ctx.id));
+        }
+        catch {
+            return null;
+        }
+    }
+    /**
+     * identity-read: users with active TenantUser for session tenant AND
+     * active TenantUserAppAccess for session application (when configured).
+     * Always includes the signed-in user via expression self-check on getOne;
+     * list filter uses membership ids only (self still appears if they have membership).
+     */
+    async resolveIdentityMembershipUserIds(ctx, tenantId, applicationId) {
+        const runtime = (0, abstract_1.getIsolationRuntimeConfig)();
+        const membershipEntity = runtime.tenantUserEntityName;
+        if (!membershipEntity) {
+            return [];
+        }
+        try {
+            const result = await ctx.backend.query(membershipEntity, {
+                skip: 0,
+                take: 10_000,
+                filter: {
+                    logic: 'and',
+                    filters: [
+                        { field: 'tenantId', operator: { type: 'equal' }, value: tenantId },
+                        {
+                            logic: 'or',
+                            filters: [
+                                { field: 'statusId', operator: { type: 'equal' }, value: 'active' },
+                                { field: 'statusId', operator: { type: 'isNull' } },
+                                { field: 'statusId', operator: { type: 'isEmpty' } },
+                            ],
+                        },
+                    ],
+                },
+                params: {
+                    [abstract_1.SCOPE_FILTER_BYPASS]: true,
+                    [abstract_1.VISIBILITY_FILTER_BYPASS]: true,
+                },
+            });
+            const tenantUsers = (result?.items ?? []);
+            let userIds = tenantUsers
+                .map((row) => row['userId'])
+                .filter((id) => typeof id === 'string' && !!id);
+            const appAccessEntity = runtime.tenantUserAppAccessEntityName;
+            if (applicationId && appAccessEntity && userIds.length) {
+                const tenantUserIds = tenantUsers
+                    .map((row) => row['id'])
+                    .filter((id) => typeof id === 'string' && !!id);
+                const appAccess = await ctx.backend.query(appAccessEntity, {
+                    skip: 0,
+                    take: 10_000,
+                    filter: {
+                        logic: 'and',
+                        filters: [
+                            { field: 'tenantUserId', operator: { type: 'in' }, value: tenantUserIds },
+                            { field: 'applicationId', operator: { type: 'equal' }, value: applicationId },
+                            {
+                                logic: 'or',
+                                filters: [
+                                    { field: 'statusId', operator: { type: 'equal' }, value: 'active' },
+                                    { field: 'statusId', operator: { type: 'isNull' } },
+                                    { field: 'statusId', operator: { type: 'isEmpty' } },
+                                ],
+                            },
+                        ],
+                    },
+                    params: {
+                        [abstract_1.SCOPE_FILTER_BYPASS]: true,
+                        [abstract_1.VISIBILITY_FILTER_BYPASS]: true,
+                    },
+                });
+                const allowedTenantUserIds = new Set((appAccess?.items ?? [])
+                    .map((row) => row['tenantUserId'])
+                    .filter((id) => typeof id === 'string' && !!id));
+                userIds = tenantUsers
+                    .filter((row) => allowedTenantUserIds.has(String(row['id'] ?? '')))
+                    .map((row) => row['userId'])
+                    .filter((id) => typeof id === 'string' && !!id);
+            }
+            return [...new Set(userIds)];
+        }
+        catch {
+            return [];
+        }
+    }
+    async resolveSharedResourceIds(ctx, tenantId, resourceType) {
+        const resourceShareEntityName = (0, abstract_1.getIsolationRuntimeConfig)().resourceShareEntityName;
+        if (!resourceShareEntityName) {
+            return [];
+        }
+        try {
+            const result = await ctx.backend.query(resourceShareEntityName, {
+                skip: 0,
+                take: 10_000,
+                filter: {
+                    logic: 'and',
+                    filters: [
+                        { field: 'resourceInfo.type', operator: { type: 'equal' }, value: resourceType },
+                        { field: 'shareInfo.sharedWithTenantId', operator: { type: 'equal' }, value: tenantId },
+                        { field: 'shareInfo.status', operator: { type: 'equal' }, value: 'active' },
+                    ],
+                },
+                params: {
+                    [abstract_1.SCOPE_FILTER_BYPASS]: true,
+                    [abstract_1.VISIBILITY_FILTER_BYPASS]: true,
+                },
+            });
+            const items = (result?.items ?? []);
+            const ids = items
+                .map((row) => (0, lodash_es_1.get)(row, 'resourceInfo.id'))
+                .filter((id) => typeof id === 'string' && !!id);
+            return [...new Set(ids)];
+        }
+        catch {
+            return [];
+        }
+    }
+    async reloadPolicyCache(ctx) {
         try {
-            const user = (await ctx.backend.getOne(USER_ENTITY, userId));
-            const tenantId = (0, lodash_es_1.get)(user, 'ownershipInfo.tenantId');
-            return typeof tenantId === 'string' && tenantId ? tenantId : undefined;
+            const result = await ctx.backend.query(abstract_1.ENTITY_ACCESS_POLICY_ENTITY, {
+                skip: 0,
+                take: 10_000,
+                params: {
+                    [abstract_1.SCOPE_FILTER_BYPASS]: true,
+                    [abstract_1.VISIBILITY_FILTER_BYPASS]: true,
+                },
+            });
+            const items = (result?.items ?? []);
+            (0, abstract_1.setEntityAccessPolicyCache)(items);
         }
         catch {
-            return undefined;
+            // Schema may not be registered yet during early boot.
         }
     }
 };
 exports.VisibilityFilterMiddleware = VisibilityFilterMiddleware;
 exports.VisibilityFilterMiddleware = VisibilityFilterMiddleware = tslib_1.__decorate([
-    (0, common_1.Injectable)({ scope: common_1.Scope.REQUEST }),
-    tslib_1.__param(0, (0, common_1.Inject)(core_1.REQUEST)),
-    tslib_1.__metadata("design:paramtypes", [Object])
+    (0, common_1.Injectable)()
 ], VisibilityFilterMiddleware);
 //#endregion
 //# sourceMappingURL=visibility-filter.middleware.js.map

package/security/src/lib/entity-storage/visibility-filter.middleware.js.map

@@ -1 +1 @@
-{"version":3,"file":"visibility-filter.middleware.js","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/entity-storage/visibility-filter.middleware.ts"],"names":[],"mappings":";;;;AAAA,2CAA2D;AAE3D,uCAAuC;AAIvC,yCAAgC;AAYhC,6EAYwD;AAExD,oFAA2E;AAM3E,yDAAyD;AAIzD,MAAM,WAAW,GAAG,yBAAyB,CAAC;AAY9C;;;;;;;;;;GAUG;AAII,IAAM,0BAA0B,GAAhC,MAAM,0BAA0B;IAYrC,YAA6B,OAA4C;QAA3B,YAAO,GAAP,OAAO,CAAoB;QAVhE,WAAM,GAAG;YAEhB,GAAG,EAAE,CAAC,OAAO,CAAkB;YAE/B,KAAK,EAAE,CAAC;SAET,CAAC;IAI0E,CAAC;IAI7E,KAAK,CAAC,OAAO,CAAC,GAAyB,EAAE,IAAyB;QAEhE,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;YAEjB,MAAM,IAAI,EAAE,CAAC;YAEb,OAAO;QAET,CAAC;QAID,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC;QAElC,MAAM,gBAAgB,GAEpB,IAAA,2BAAgB,EAAC,MAAM,EAAE,mCAAwB,CAAC;YAElD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,mCAAwB,CAAC,KAAK,IAAI,CAAC;QAEpD,MAAM,eAAe,GAEnB,IAAA,2BAAgB,EAAC,MAAM,EAAE,kCAAuB,CAAC;YAEjD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,kCAAuB,CAAC,KAAK,IAAI,CAAC;QAInD,IAAI,gBAAgB,IAAI,eAAe,EAAE,CAAC;YAExC,MAAM,IAAI,EAAE,CAAC;YAEb,OAAO;QAET,CAAC;QAID,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC,+CAAmB,CAAC,CAAC;QAEpD,MAAM,eAAe,GAAG,OAAO,EAAE,QAAQ,CAAC;QAE1C,MAAM,oBAAoB,GAAG,OAAO,EAAE,aAAa,CAAC;QAEpD,IAAI,iBAAiB,GAAG,eAAe,CAAC;QAIxC,IAAI,CAAC,eAAe,IAAI,CAAC,iBAAiB,IAAI,OAAO,EAAE,MAAM,EAAE,CAAC;YAE9D,iBAAiB,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,GAAG,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;QAE1E,CAAC;QAID,MAAM,YAAY,GAAG,IAAA,yCAA8B,EAAC;YAElD,QAAQ,EAAE,iBAAiB;YAE3B,aAAa,EAAE,oBAAoB;YAEnC,gBAAgB;YAEhB,eAAe;SAEhB,CAAC,CAAC;QAIH,IAAI,YAAY,EAAE,CAAC;YAEjB,GAAG,CAAC,OAAO,GAAG;gBAEZ,GAAG,GAAG,CAAC,OAAO;gBAEd,MAAM,EAAE,IAAA,+BAAoB,EAAC,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,YAAY,CAAC;aAE/D,CAAC;QAEJ,CAAC;QAID,MAAM,IAAI,EAAE,CAAC;IAEf,CAAC;IAIO,KAAK,CAAC,mBAAmB,CAE/B,GAAyB,EAEzB,MAAc;QAId,IAAI,CAAC;YAEH,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,CAAmC,CAAC;YAE/F,MAAM,QAAQ,GAAG,IAAA,eAAG,EAAC,IAAI,EAAE,wBAAwB,CAAC,CAAC;YAErD,OAAO,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;QAEzE,CAAC;QAAC,MAAM,CAAC;YAEP,OAAO,SAAS,CAAC;QAEnB,CAAC;IAEH,CAAC;CAEF,CAAA;AAlIY,gEAA0B;qCAA1B,0BAA0B;IAFtC,IAAA,mBAAU,EAAC,EAAE,KAAK,EAAE,cAAK,CAAC,OAAO,EAAE,CAAC;IActB,mBAAA,IAAA,eAAM,EAAC,cAAO,CAAC,CAAA;;GAZjB,0BAA0B,CAkItC;AAID,YAAY"}
+{"version":3,"file":"visibility-filter.middleware.js","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/entity-storage/visibility-filter.middleware.ts"],"names":[],"mappings":";;;;AAAA,2CAA4C;AAE5C,yCAAgC;AAChC,iEAMgD;AAChD,6EAgBwD;AACxD,oFAA2E;AAS3E,MAAM,UAAU,GAAkB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;AACvD,MAAM,eAAe,GAAkB,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;AAE9D;;;;;;;;;;GAUG;AAEI,IAAM,0BAA0B,GAAhC,MAAM,0BAA0B;IAAhC;QACI,WAAM,GAAG;YAChB,GAAG,EAAE,CAAC,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAkB;YACpF,KAAK,EAAE,CAAC;SACT,CAAC;IA+UJ,CAAC;IA7UC,KAAK,CAAC,OAAO,CAAC,GAAyB,EAAE,IAAyB;QAChE,IACE,CAAC,GAAG,CAAC,OAAO;YACZ,eAAe,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,KAAK,KAAK;YAC1C,GAAG,CAAC,EAAE,KAAK,QAAQ;YACnB,GAAG,CAAC,EAAE,KAAK,QAAQ;YACnB,CAAC,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,EAC5B,CAAC;YACD,MAAM,IAAI,EAAE,CAAC;YACb,OAAO;QACT,CAAC;QAED,8EAA8E;QAC9E,qEAAqE;QACrE,IAAI,IAAA,gCAAqB,EAAC,GAAG,CAAC,MAAM,CAAC,IAAI,IAAA,gCAAqB,EAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YAC3E,MAAM,IAAI,EAAE,CAAC;YACb,IAAI,GAAG,CAAC,UAAU,KAAK,sCAA2B,IAAI,CAAC,GAAG,CAAC,EAAE,KAAK,QAAQ,IAAI,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;gBAC3G,MAAM,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC;YACpC,CAAC;YACD,OAAO;QACT,CAAC;QAED,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC;QACnC,gFAAgF;QAChF,2EAA2E;QAC3E,MAAM,gBAAgB,GACpB,IAAA,2BAAgB,EAAC,MAAM,EAAE,mCAAwB,CAAC;YAClD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,mCAAwB,CAAC,KAAK,IAAI,CAAC;QACpD,MAAM,WAAW,GACf,IAAA,2BAAgB,EAAC,MAAM,EAAE,8BAAmB,CAAC;YAC7C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,8BAAmB,CAAC,KAAK,IAAI,CAAC;QAE/C,IAAI,gBAAgB,IAAI,WAAW,EAAE,CAAC;YACpC,MAAM,IAAI,EAAE,CAAC;YACb,OAAO;QACT,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;QACtC,MAAM,eAAe,GAAG,OAAO,EAAE,QAAQ,CAAC;QAC1C,MAAM,oBAAoB,GAAG,OAAO,EAAE,aAAa,CAAC;QACpD,MAAM,MAAM,GAAG,IAAA,oCAAyB,EAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAEzD,IAAI,iBAAuC,CAAC;QAC5C,IAAI,iBAAuC,CAAC;QAE5C,IAAI,CAAC,WAAW,IAAI,eAAe,EAAE,CAAC;YACpC,IAAI,MAAM,CAAC,IAAI,KAAK,eAAe,EAAE,CAAC;gBACpC,iBAAiB,GAAG,MAAM,IAAI,CAAC,gCAAgC,CAC7D,GAAG,EACH,eAAe,EACf,oBAAoB,CACrB,CAAC;YACJ,CAAC;YACD,IAAI,MAAM,CAAC,IAAI,KAAK,sBAAsB,EAAE,CAAC;gBAC3C,iBAAiB,GAAG,MAAM,IAAI,CAAC,wBAAwB,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC;YAChG,CAAC;QACH,CAAC;QAED,IAAI,eAAe,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC;YACpD,MAAM,YAAY,GAAG,IAAA,yCAA8B,EAAC;gBAClD,QAAQ,EAAE,eAAe;gBACzB,aAAa,EAAE,oBAAoB;gBACnC,MAAM,EAAE,OAAO,EAAE,MAAM;gBACvB,gBAAgB;gBAChB,WAAW;gBACX,MAAM;gBACN,iBAAiB;gBACjB,iBAAiB;aAClB,CAAC,CAAC;YAEH,IAAI,YAAY,EAAE,CAAC;gBACjB,GAAG,CAAC,OAAO,GAAG;oBACZ,GAAG,GAAG,CAAC,OAAO;oBACd,MAAM,EAAE,IAAA,+BAAoB,EAAC,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,YAAY,CAAC;iBAC/D,CAAC;YACJ,CAAC;YACD,MAAM,IAAI,EAAE,CAAC;YACb,OAAO;QACT,CAAC;QAED,IAAI,GAAG,CAAC,EAAE,KAAK,QAAQ,EAAE,CAAC;YACxB,MAAM,IAAI,EAAE,CAAC;YACb,IAAI,WAAW,EAAE,CAAC;gBAChB,OAAO;YACT,CAAC;YACD,MAAM,MAAM,GAAG,GAAG,CAAC,MAAoD,CAAC;YACxE,IACE,CAAC,IAAA,+BAAoB,EAAC;gBACpB,MAAM;gBACN,MAAM;gBACN,IAAI,EAAE,MAAM;gBACZ,OAAO,EAAE;oBACP,QAAQ,EAAE,eAAe;oBACzB,aAAa,EAAE,oBAAoB;oBACnC,MAAM,EAAE,OAAO,EAAE,MAAM;iBACxB;gBACD,iBAAiB;gBACjB,iBAAiB;aAClB,CAAC,EACF,CAAC;gBACD,GAAG,CAAC,MAAM,GAAG,IAAI,CAAC;YACpB,CAAC;YACD,OAAO;QACT,CAAC;QAED,IAAI,GAAG,CAAC,EAAE,KAAK,QAAQ,EAAE,CAAC;YACxB,IAAI,CAAC,WAAW,IAAI,IAAA,8BAAmB,EAAC,MAAM,CAAC,EAAE,CAAC;gBAChD,qEAAqE;gBACrE,IAAI,CAAC,eAAe,IAAI,CAAC,IAAA,kCAAuB,EAAC,eAAe,CAAC,EAAE,CAAC;oBAClE,MAAM,IAAI,2BAAoB,CAAC,oDAAoD,EAAE;wBACnF,IAAI,EAAE,gBAAgB;wBACtB,MAAM,EAAE,GAAG;qBACZ,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YACD,MAAM,IAAI,EAAE,CAAC;YACb,IAAI,GAAG,CAAC,UAAU,KAAK,sCAA2B,EAAE,CAAC;gBACnD,MAAM,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC;YACpC,CAAC;YACD,OAAO;QACT,CAAC;QAED,IAAI,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;YAChC,IAAI,CAAC,WAAW,EAAE,CAAC;gBACjB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;gBAC9C,IACE,CAAC,IAAA,+BAAoB,EAAC;oBACpB,MAAM,EAAE,QAAQ;oBAChB,MAAM;oBACN,IAAI,EAAE,OAAO;oBACb,OAAO,EAAE;wBACP,QAAQ,EAAE,eAAe;wBACzB,aAAa,EAAE,oBAAoB;wBACnC,MAAM,EAAE,OAAO,EAAE,MAAM;qBACxB;oBACD,iBAAiB;oBACjB,iBAAiB;iBAClB,CAAC,EACF,CAAC;oBACD,MAAM,IAAI,2BAAoB,CAAC,sDAAsD,EAAE;wBACrF,IAAI,EAAE,qBAAqB;wBAC3B,MAAM,EAAE,GAAG;qBACZ,CAAC,CAAC;gBACL,CAAC;gBAED,MAAM,SAAS,GAAG,IAAA,eAAG,EAAC,QAAQ,EAAE,WAAW,CAAwC,CAAC;gBACpF,MAAM,cAAc,GAAG,IAAA,kCAAuB,EAAC,eAAe,CAAC,CAAC;gBAChE,MAAM,uBAAuB,GAAG,IAAA,8BAAmB,EAAC,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC;gBAC/E,MAAM,gBAAgB,GAAG,SAAS,EAAE,CAAC,aAAa,CAAC,KAAK,IAAI,IAAI,CAAC,cAAc,CAAC;gBAChF,IAAI,gBAAgB,IAAI,uBAAuB,EAAE,CAAC;oBAChD,MAAM,IAAI,2BAAoB,CAAC,iDAAiD,EAAE;wBAChF,IAAI,EAAE,gBAAgB;wBACtB,MAAM,EAAE,GAAG;qBACZ,CAAC,CAAC;gBACL,CAAC;gBAED,mDAAmD;gBACnD,IAAI,GAAG,CAAC,IAAI,IAAI,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;oBAC7C,MAAM,IAAI,GAAG,EAAE,GAAI,GAAG,CAAC,IAAgC,EAAE,CAAC;oBAC1D,OAAO,IAAI,CAAC,WAAW,CAAC,CAAC;oBACzB,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC;gBAClB,CAAC;YACH,CAAC;YACD,MAAM,IAAI,EAAE,CAAC;YACb,IAAI,GAAG,CAAC,UAAU,KAAK,sCAA2B,EAAE,CAAC;gBACnD,MAAM,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC;YACpC,CAAC;YACD,OAAO;QACT,CAAC;QAED,MAAM,IAAI,EAAE,CAAC;IACf,CAAC;IAEO,cAAc;QACpB,MAAM,GAAG,GAAG,IAAA,8BAAuB,GAAoC,CAAC;QACxE,OAAO,GAAG,EAAE,CAAC,+CAAmB,CAAC,IAAI,IAAI,CAAC;IAC5C,CAAC;IAEO,KAAK,CAAC,YAAY,CAAC,GAAyB;QAClD,IAAI,GAAG,CAAC,QAAQ,IAAI,OAAO,GAAG,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YACrD,OAAO,GAAG,CAAC,QAAmC,CAAC;QACjD,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,CAAC;YACH,OAAO,CAAC,MAAM,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,EAAE,CAAC,CAAmC,CAAC;QAC9F,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACK,KAAK,CAAC,gCAAgC,CAC5C,GAAyB,EACzB,QAAgB,EAChB,aAAiC;QAEjC,MAAM,OAAO,GAAG,IAAA,oCAAyB,GAAE,CAAC;QAC5C,MAAM,gBAAgB,GAAG,OAAO,CAAC,oBAAoB,CAAC;QACtD,IAAI,CAAC,gBAAgB,EAAE,CAAC;YACtB,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,gBAAgB,EAAE;gBACvD,IAAI,EAAE,CAAC;gBACP,IAAI,EAAE,MAAM;gBACZ,MAAM,EAAE;oBACN,KAAK,EAAE,KAAK;oBACZ,OAAO,EAAE;wBACP,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE;wBACnE;4BACE,KAAK,EAAE,IAAI;4BACX,OAAO,EAAE;gCACP,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE;gCACnE,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE;gCACnD,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE;6BACrD;yBACF;qBACF;iBACF;gBACD,MAAM,EAAE;oBACN,CAAC,8BAAmB,CAAC,EAAE,IAAI;oBAC3B,CAAC,mCAAwB,CAAC,EAAE,IAAI;iBACjC;aACF,CAAC,CAAC;YACH,MAAM,WAAW,GAAG,CAAC,MAAM,EAAE,KAAK,IAAI,EAAE,CAA8B,CAAC;YACvE,IAAI,OAAO,GAAG,WAAW;iBACtB,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;iBAC3B,MAAM,CAAC,CAAC,EAAE,EAAgB,EAAE,CAAC,OAAO,EAAE,KAAK,QAAQ,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC;YAEhE,MAAM,eAAe,GAAG,OAAO,CAAC,6BAA6B,CAAC;YAC9D,IAAI,aAAa,IAAI,eAAe,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;gBACvD,MAAM,aAAa,GAAG,WAAW;qBAC9B,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;qBACvB,MAAM,CAAC,CAAC,EAAE,EAAgB,EAAE,CAAC,OAAO,EAAE,KAAK,QAAQ,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC;gBAChE,MAAM,SAAS,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,eAAe,EAAE;oBACzD,IAAI,EAAE,CAAC;oBACP,IAAI,EAAE,MAAM;oBACZ,MAAM,EAAE;wBACN,KAAK,EAAE,KAAK;wBACZ,OAAO,EAAE;4BACP,EAAE,KAAK,EAAE,cAAc,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,aAAa,EAAE;4BACzE,EAAE,KAAK,EAAE,eAAe,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,aAAa,EAAE;4BAC7E;gCACE,KAAK,EAAE,IAAI;gCACX,OAAO,EAAE;oCACP,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE;oCACnE,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE;oCACnD,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE;iCACrD;6BACF;yBACF;qBACF;oBACD,MAAM,EAAE;wBACN,CAAC,8BAAmB,CAAC,EAAE,IAAI;wBAC3B,CAAC,mCAAwB,CAAC,EAAE,IAAI;qBACjC;iBACF,CAAC,CAAC;gBACH,MAAM,oBAAoB,GAAG,IAAI,GAAG,CACjC,CAAC,SAAS,EAAE,KAAK,IAAI,EAAE,CAA+B;qBACpD,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;qBACjC,MAAM,CAAC,CAAC,EAAE,EAAgB,EAAE,CAAC,OAAO,EAAE,KAAK,QAAQ,IAAI,CAAC,CAAC,EAAE,CAAC,CAChE,CAAC;gBACF,OAAO,GAAG,WAAW;qBAClB,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,oBAAoB,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;qBAClE,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;qBAC3B,MAAM,CAAC,CAAC,EAAE,EAAgB,EAAE,CAAC,OAAO,EAAE,KAAK,QAAQ,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC;YAClE,CAAC;YAED,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;QAC/B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,wBAAwB,CACpC,GAAyB,EACzB,QAAgB,EAChB,YAAoB;QAEpB,MAAM,uBAAuB,GAAG,IAAA,oCAAyB,GAAE,CAAC,uBAAuB,CAAC;QACpF,IAAI,CAAC,uBAAuB,EAAE,CAAC;YAC7B,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,uBAAuB,EAAE;gBAC9D,IAAI,EAAE,CAAC;gBACP,IAAI,EAAE,MAAM;gBACZ,MAAM,EAAE;oBACN,KAAK,EAAE,KAAK;oBACZ,OAAO,EAAE;wBACP,EAAE,KAAK,EAAE,mBAAmB,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE;wBAChF,EAAE,KAAK,EAAE,8BAA8B,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE;wBACvF,EAAE,KAAK,EAAE,kBAAkB,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE;qBAC5E;iBACF;gBACD,MAAM,EAAE;oBACN,CAAC,8BAAmB,CAAC,EAAE,IAAI;oBAC3B,CAAC,mCAAwB,CAAC,EAAE,IAAI;iBACjC;aACF,CAAC,CAAC;YACH,MAAM,KAAK,GAAG,CAAC,MAAM,EAAE,KAAK,IAAI,EAAE,CAA8B,CAAC;YACjE,MAAM,GAAG,GAAG,KAAK;iBACd,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAA,eAAG,EAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC;iBACzC,MAAM,CAAC,CAAC,EAAE,EAAgB,EAAE,CAAC,OAAO,EAAE,KAAK,QAAQ,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC;YAChE,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;QAC3B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,iBAAiB,CAAC,GAAyB;QACvD,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,sCAA2B,EAAE;gBAClE,IAAI,EAAE,CAAC;gBACP,IAAI,EAAE,MAAM;gBACZ,MAAM,EAAE;oBACN,CAAC,8BAAmB,CAAC,EAAE,IAAI;oBAC3B,CAAC,mCAAwB,CAAC,EAAE,IAAI;iBACjC;aACF,CAAC,CAAC;YACH,MAAM,KAAK,GAAG,CAAC,MAAM,EAAE,KAAK,IAAI,EAAE,CAAkC,CAAC;YACrE,IAAA,qCAA0B,EAAC,KAAK,CAAC,CAAC;QACpC,CAAC;QAAC,MAAM,CAAC;YACP,sDAAsD;QACxD,CAAC;IACH,CAAC;CACF,CAAA;AAnVY,gEAA0B;qCAA1B,0BAA0B;IADtC,IAAA,mBAAU,GAAE;GACA,0BAA0B,CAmVtC;AAED,YAAY"}

package/security/src/lib/oauth/connect.controller.d.ts

@@ -1,10 +1,14 @@
 import type { Request, Response } from 'express';
+import { AuthCookieService } from '../auth/auth-cookie.service';
+import { TokenService } from '../auth/token.service';
 import { PlatformOAuthService } from './platform-oauth.service';
 import type { OAuthTokenResponse } from './platform-oauth.types';
 export declare class ConnectController {
     private readonly oauth;
-    constructor(oauth: PlatformOAuthService);
-    getDiscoveryDocument(): {
+    private readonly cookies;
+    private readonly tokens;
+    constructor(oauth: PlatformOAuthService, cookies: AuthCookieService, tokens: TokenService);
+    getDiscoveryDocument(req: Request): {
         issuer: string;
         authorization_endpoint: string;
         token_endpoint: string;
@@ -17,9 +21,11 @@ export declare class ConnectController {
     getJwksDocument(): {
         keys: unknown[];
     };
-    authorize(query: Record<string, string | undefined>, res: Response): void;
-    googleCallback(code: string | undefined, state: string | undefined, error: string | undefined, req: Request, res: Response): Promise<void>;
-    token(req: Request): Promise<OAuthTokenResponse>;
+    authorize(query: Record<string, string | undefined>, req: Request, res: Response): Promise<void>;
+    externalCallback(providerKey: string, code: string | undefined, state: string | undefined, error: string | undefined, res: Response): Promise<void>;
+    token(req: Request, res: Response): Promise<OAuthTokenResponse>;
+    /** Platform API issuer from the incoming request (no hardcoded host/port). */
+    private resolveIssuer;
     private readFormBody;
 }
 //# sourceMappingURL=connect.controller.d.ts.map

package/security/src/lib/oauth/connect.controller.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"connect.controller.d.ts","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/oauth/connect.controller.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAGjD,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAChE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAIjE,qBAGa,iBAAiB;IAChB,OAAO,CAAC,QAAQ,CAAC,KAAK;gBAAL,KAAK,EAAE,oBAAoB;IAIxD,oBAAoB;;;;;;;;;;IAMpB,eAAe;;;IAMf,SAAS,CAAU,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,EAAS,GAAG,EAAE,QAAQ,GAAG,IAAI;IAkBnF,cAAc,CACH,IAAI,EAAE,MAAM,GAAG,SAAS,EACvB,KAAK,EAAE,MAAM,GAAG,SAAS,EACzB,KAAK,EAAE,MAAM,GAAG,SAAS,EAClC,GAAG,EAAE,OAAO,EACZ,GAAG,EAAE,QAAQ,GACnB,OAAO,CAAC,IAAI,CAAC;IAiBV,KAAK,CAAQ,GAAG,EAAE,OAAO,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAM7D,OAAO,CAAC,YAAY;CAUrB"}
+{"version":3,"file":"connect.controller.d.ts","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/oauth/connect.controller.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACjD,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAGhE,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAChE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAIjE,qBAGa,iBAAiB;IAE1B,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAFN,KAAK,EAAE,oBAAoB,EAC3B,OAAO,EAAE,iBAAiB,EAC1B,MAAM,EAAE,YAAY;IAKvC,oBAAoB,CAAQ,GAAG,EAAE,OAAO;;;;;;;;;;IAMxC,eAAe;;;IAMT,SAAS,CACJ,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,EAC3C,GAAG,EAAE,OAAO,EACZ,GAAG,EAAE,QAAQ,GACnB,OAAO,CAAC,IAAI,CAAC;IAuBV,gBAAgB,CACE,WAAW,EAAE,MAAM,EAC1B,IAAI,EAAE,MAAM,GAAG,SAAS,EACvB,KAAK,EAAE,MAAM,GAAG,SAAS,EACzB,KAAK,EAAE,MAAM,GAAG,SAAS,EAClC,GAAG,EAAE,QAAQ,GACnB,OAAO,CAAC,IAAI,CAAC;IAqBV,KAAK,CAAQ,GAAG,EAAE,OAAO,EAA8B,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAiBxG,8EAA8E;IAC9E,OAAO,CAAC,aAAa;IAQrB,OAAO,CAAC,YAAY;CAUrB"}

package/security/src/lib/oauth/connect.controller.js

@@ -4,23 +4,30 @@ exports.ConnectController = void 0;
 const tslib_1 = require("tslib");
 const common_1 = require("@nestjs/common");
 const swagger_1 = require("@nestjs/swagger");
+const auth_cookie_service_1 = require("../auth/auth-cookie.service");
 const public_decorator_1 = require("../auth/public.decorator");
 const request_meta_util_1 = require("../auth/request-meta.util");
+const token_service_1 = require("../auth/token.service");
 const platform_oauth_service_1 = require("./platform-oauth.service");
 //#region ---- Platform OAuth connect endpoints ----
 let ConnectController = class ConnectController {
-    constructor(oauth) {
+    constructor(oauth, cookies, tokens) {
         this.oauth = oauth;
+        this.cookies = cookies;
+        this.tokens = tokens;
     }
-    getDiscoveryDocument() {
-        return this.oauth.getDiscoveryDocument();
+    getDiscoveryDocument(req) {
+        return this.oauth.getDiscoveryDocument(this.resolveIssuer(req));
     }
     getJwksDocument() {
         return this.oauth.getJwksDocument();
     }
-    authorize(query, res) {
-        const provider = query['acr_values']?.trim() || 'google';
-        const redirectUrl = this.oauth.beginAuthorization({
+    async authorize(query, req, res) {
+        const provider = query['acr_values']?.trim();
+        if (!provider) {
+            throw new common_1.BadRequestException('acr_values (identity provider key) is required.');
+        }
+        const redirectUrl = await this.oauth.beginAuthorization({
             responseType: query['response_type']?.trim() || '',
             clientId: query['client_id']?.trim() || '',
             redirectUri: query['redirect_uri']?.trim() || '',
@@ -28,26 +35,47 @@ let ConnectController = class ConnectController {
             codeChallenge: query['code_challenge']?.trim() || '',
             codeChallengeMethod: query['code_challenge_method']?.trim() || '',
             provider,
+            issuer: this.resolveIssuer(req),
             state: query['state']?.trim(),
         });
         res.redirect(redirectUrl);
     }
-    async googleCallback(code, state, error, req, res) {
+    async externalCallback(providerKey, code, state, error, res) {
+        const key = providerKey?.trim();
+        if (!key) {
+            throw new common_1.BadRequestException('providerKey is required.');
+        }
         if (error) {
-            res.status(400).send(`Google authorization failed: ${error}`);
+            res.status(400).send(`${key} authorization failed: ${error}`);
             return;
         }
         if (!code?.trim() || !state?.trim()) {
             throw new common_1.BadRequestException('code and state are required.');
         }
-        const meta = (0, request_meta_util_1.resolveAuthRequestMeta)(req);
-        const redirectUrl = await this.oauth.completeGoogleCallback(code.trim(), state.trim());
+        const redirectUrl = await this.oauth.completeExternalCallback(key, code.trim(), state.trim());
         res.redirect(redirectUrl);
     }
-    async token(req) {
+    async token(req, res) {
         const body = this.readFormBody(req);
         const meta = (0, request_meta_util_1.resolveAuthRequestMeta)(req);
-        return this.oauth.exchangeAuthorizationCode(body, meta);
+        const result = await this.oauth.exchangeAuthorizationCode(body, meta);
+        if (result.access_token && result.refresh_token) {
+            this.cookies.applyAuthCookies(res, {
+                accessToken: result.access_token,
+                refreshToken: result.refresh_token,
+                accessMaxAgeMs: this.tokens.accessTokenMaxAgeMs(),
+                refreshMaxAgeMs: this.tokens.refreshTokenMaxAgeMs(),
+            });
+        }
+        return result;
+    }
+    /** Platform API issuer from the incoming request (no hardcoded host/port). */
+    resolveIssuer(req) {
+        const forwardedProto = req.headers['x-forwarded-proto'];
+        const protoHeader = Array.isArray(forwardedProto) ? forwardedProto[0] : forwardedProto;
+        const proto = (protoHeader?.split(',')[0] || req.protocol || 'http').trim();
+        const host = (req.get('host') || 'localhost:5500').trim();
+        return `${proto}://${host}/api`;
     }
     readFormBody(req) {
         const body = req.body;
@@ -61,8 +89,9 @@ exports.ConnectController = ConnectController;
 tslib_1.__decorate([
     (0, common_1.Get)('.well-known/openid-configuration'),
     (0, swagger_1.ApiOperation)({ summary: 'OpenID Connect discovery document' }),
+    tslib_1.__param(0, (0, common_1.Req)()),
     tslib_1.__metadata("design:type", Function),
-    tslib_1.__metadata("design:paramtypes", []),
+    tslib_1.__metadata("design:paramtypes", [Object]),
     tslib_1.__metadata("design:returntype", void 0)
 ], ConnectController.prototype, "getDiscoveryDocument", null);
 tslib_1.__decorate([
@@ -74,38 +103,42 @@ tslib_1.__decorate([
 ], ConnectController.prototype, "getJwksDocument", null);
 tslib_1.__decorate([
     (0, common_1.Get)('connect/authorize'),
-    (0, swagger_1.ApiOperation)({ summary: 'Begin external provider authorization (Google platform login)' }),
+    (0, swagger_1.ApiOperation)({ summary: 'Begin external IdP authorization (IdentityProvider key via acr_values)' }),
     tslib_1.__param(0, (0, common_1.Query)()),
-    tslib_1.__param(1, (0, common_1.Res)()),
+    tslib_1.__param(1, (0, common_1.Req)()),
+    tslib_1.__param(2, (0, common_1.Res)()),
     tslib_1.__metadata("design:type", Function),
-    tslib_1.__metadata("design:paramtypes", [Object, Object]),
-    tslib_1.__metadata("design:returntype", void 0)
+    tslib_1.__metadata("design:paramtypes", [Object, Object, Object]),
+    tslib_1.__metadata("design:returntype", Promise)
 ], ConnectController.prototype, "authorize", null);
 tslib_1.__decorate([
-    (0, common_1.Get)('connect/callback/google'),
-    (0, swagger_1.ApiOperation)({ summary: 'Google OAuth callback for platform login' }),
-    tslib_1.__param(0, (0, common_1.Query)('code')),
-    tslib_1.__param(1, (0, common_1.Query)('state')),
-    tslib_1.__param(2, (0, common_1.Query)('error')),
-    tslib_1.__param(3, (0, common_1.Req)()),
+    (0, common_1.Get)('connect/callback/:providerKey'),
+    (0, swagger_1.ApiOperation)({ summary: 'External IdP OAuth callback for platform login' }),
+    tslib_1.__param(0, (0, common_1.Param)('providerKey')),
+    tslib_1.__param(1, (0, common_1.Query)('code')),
+    tslib_1.__param(2, (0, common_1.Query)('state')),
+    tslib_1.__param(3, (0, common_1.Query)('error')),
     tslib_1.__param(4, (0, common_1.Res)()),
     tslib_1.__metadata("design:type", Function),
-    tslib_1.__metadata("design:paramtypes", [Object, Object, Object, Object, Object]),
+    tslib_1.__metadata("design:paramtypes", [String, Object, Object, Object, Object]),
     tslib_1.__metadata("design:returntype", Promise)
-], ConnectController.prototype, "googleCallback", null);
+], ConnectController.prototype, "externalCallback", null);
 tslib_1.__decorate([
     (0, common_1.Post)('connect/token'),
     (0, swagger_1.ApiOperation)({ summary: 'Exchange authorization code or refresh token for platform tokens' }),
     tslib_1.__param(0, (0, common_1.Req)()),
+    tslib_1.__param(1, (0, common_1.Res)({ passthrough: true })),
     tslib_1.__metadata("design:type", Function),
-    tslib_1.__metadata("design:paramtypes", [Object]),
+    tslib_1.__metadata("design:paramtypes", [Object, Object]),
     tslib_1.__metadata("design:returntype", Promise)
 ], ConnectController.prototype, "token", null);
 exports.ConnectController = ConnectController = tslib_1.__decorate([
     (0, swagger_1.ApiTags)('connect'),
     (0, public_decorator_1.Public)(),
     (0, common_1.Controller)(),
-    tslib_1.__metadata("design:paramtypes", [platform_oauth_service_1.PlatformOAuthService])
+    tslib_1.__metadata("design:paramtypes", [platform_oauth_service_1.PlatformOAuthService,
+        auth_cookie_service_1.AuthCookieService,
+        token_service_1.TokenService])
 ], ConnectController);
 //#endregion
 //# sourceMappingURL=connect.controller.js.map

package/security/src/lib/oauth/connect.controller.js.map

@@ -1 +1 @@
-{"version":3,"file":"connect.controller.js","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/oauth/connect.controller.ts"],"names":[],"mappings":";;;;AAAA,2CAQwB;AACxB,6CAAwD;AAExD,+DAAkD;AAClD,iEAAmE;AACnE,qEAAgE;AAGhE,oDAAoD;AAK7C,IAAM,iBAAiB,GAAvB,MAAM,iBAAiB;IAC5B,YAA6B,KAA2B;QAA3B,UAAK,GAAL,KAAK,CAAsB;IAAG,CAAC;IAI5D,oBAAoB;QAClB,OAAO,IAAI,CAAC,KAAK,CAAC,oBAAoB,EAAE,CAAC;IAC3C,CAAC;IAID,eAAe;QACb,OAAO,IAAI,CAAC,KAAK,CAAC,eAAe,EAAE,CAAC;IACtC,CAAC;IAID,SAAS,CAAU,KAAyC,EAAS,GAAa;QAChF,MAAM,QAAQ,GAAG,KAAK,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,IAAI,QAAQ,CAAC;QACzD,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC;YAChD,YAAY,EAAE,KAAK,CAAC,eAAe,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE;YAClD,QAAQ,EAAE,KAAK,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE;YAC1C,WAAW,EAAE,KAAK,CAAC,cAAc,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE;YAChD,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,IAAI,sBAAsB;YACvD,aAAa,EAAE,KAAK,CAAC,gBAAgB,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE;YACpD,mBAAmB,EAAE,KAAK,CAAC,uBAAuB,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE;YACjE,QAAQ;YACR,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE;SAC9B,CAAC,CAAC;QAEH,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC5B,CAAC;IAIK,AAAN,KAAK,CAAC,cAAc,CACH,IAAwB,EACvB,KAAyB,EACzB,KAAyB,EAClC,GAAY,EACZ,GAAa;QAEpB,IAAI,KAAK,EAAE,CAAC;YACV,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,gCAAgC,KAAK,EAAE,CAAC,CAAC;YAC9D,OAAO;QACT,CAAC;QAED,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC;YACpC,MAAM,IAAI,4BAAmB,CAAC,8BAA8B,CAAC,CAAC;QAChE,CAAC;QAED,MAAM,IAAI,GAAG,IAAA,0CAAsB,EAAC,GAAG,CAAC,CAAC;QACzC,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,sBAAsB,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QACvF,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC5B,CAAC;IAIK,AAAN,KAAK,CAAC,KAAK,CAAQ,GAAY;QAC7B,MAAM,IAAI,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;QACpC,MAAM,IAAI,GAAG,IAAA,0CAAsB,EAAC,GAAG,CAAC,CAAC;QACzC,OAAO,IAAI,CAAC,KAAK,CAAC,yBAAyB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAC1D,CAAC;IAEO,YAAY,CAAC,GAAY;QAC/B,MAAM,IAAI,GAAG,GAAG,CAAC,IAA2C,CAAC;QAC7D,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YACtC,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,OAAO,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAC7F,CAAC;IACJ,CAAC;CACF,CAAA;AA1EY,8CAAiB;AAK5B;IAFC,IAAA,YAAG,EAAC,kCAAkC,CAAC;IACvC,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,mCAAmC,EAAE,CAAC;;;;6DAG9D;AAID;IAFC,IAAA,YAAG,EAAC,uBAAuB,CAAC;IAC5B,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,gFAAgF,EAAE,CAAC;;;;wDAG3G;AAID;IAFC,IAAA,YAAG,EAAC,mBAAmB,CAAC;IACxB,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,+DAA+D,EAAE,CAAC;IAChF,mBAAA,IAAA,cAAK,GAAE,CAAA;IAA6C,mBAAA,IAAA,YAAG,GAAE,CAAA;;;;kDAcnE;AAIK;IAFL,IAAA,YAAG,EAAC,yBAAyB,CAAC;IAC9B,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,0CAA0C,EAAE,CAAC;IAEnE,mBAAA,IAAA,cAAK,EAAC,MAAM,CAAC,CAAA;IACb,mBAAA,IAAA,cAAK,EAAC,OAAO,CAAC,CAAA;IACd,mBAAA,IAAA,cAAK,EAAC,OAAO,CAAC,CAAA;IACd,mBAAA,IAAA,YAAG,GAAE,CAAA;IACL,mBAAA,IAAA,YAAG,GAAE,CAAA;;;;uDAcP;AAIK;IAFL,IAAA,aAAI,EAAC,eAAe,CAAC;IACrB,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,kEAAkE,EAAE,CAAC;IACjF,mBAAA,IAAA,YAAG,GAAE,CAAA;;;;8CAIjB;4BA9DU,iBAAiB;IAH7B,IAAA,iBAAO,EAAC,SAAS,CAAC;IAClB,IAAA,yBAAM,GAAE;IACR,IAAA,mBAAU,GAAE;6CAEyB,6CAAoB;GAD7C,iBAAiB,CA0E7B;AAED,YAAY"}
+{"version":3,"file":"connect.controller.js","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/oauth/connect.controller.ts"],"names":[],"mappings":";;;;AAAA,2CASwB;AACxB,6CAAwD;AAExD,qEAAgE;AAChE,+DAAkD;AAClD,iEAAmE;AACnE,yDAAqD;AACrD,qEAAgE;AAGhE,oDAAoD;AAK7C,IAAM,iBAAiB,GAAvB,MAAM,iBAAiB;IAC5B,YACmB,KAA2B,EAC3B,OAA0B,EAC1B,MAAoB;QAFpB,UAAK,GAAL,KAAK,CAAsB;QAC3B,YAAO,GAAP,OAAO,CAAmB;QAC1B,WAAM,GAAN,MAAM,CAAc;IACpC,CAAC;IAIJ,oBAAoB,CAAQ,GAAY;QACtC,OAAO,IAAI,CAAC,KAAK,CAAC,oBAAoB,CAAC,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC;IAClE,CAAC;IAID,eAAe;QACb,OAAO,IAAI,CAAC,KAAK,CAAC,eAAe,EAAE,CAAC;IACtC,CAAC;IAIK,AAAN,KAAK,CAAC,SAAS,CACJ,KAAyC,EAC3C,GAAY,EACZ,GAAa;QAEpB,MAAM,QAAQ,GAAG,KAAK,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,CAAC;QAC7C,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,4BAAmB,CAAC,iDAAiD,CAAC,CAAC;QACnF,CAAC;QAED,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC;YACtD,YAAY,EAAE,KAAK,CAAC,eAAe,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE;YAClD,QAAQ,EAAE,KAAK,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE;YAC1C,WAAW,EAAE,KAAK,CAAC,cAAc,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE;YAChD,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,IAAI,sBAAsB;YACvD,aAAa,EAAE,KAAK,CAAC,gBAAgB,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE;YACpD,mBAAmB,EAAE,KAAK,CAAC,uBAAuB,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE;YACjE,QAAQ;YACR,MAAM,EAAE,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC;YAC/B,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE;SAC9B,CAAC,CAAC;QAEH,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC5B,CAAC;IAIK,AAAN,KAAK,CAAC,gBAAgB,CACE,WAAmB,EAC1B,IAAwB,EACvB,KAAyB,EACzB,KAAyB,EAClC,GAAa;QAEpB,MAAM,GAAG,GAAG,WAAW,EAAE,IAAI,EAAE,CAAC;QAChC,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,MAAM,IAAI,4BAAmB,CAAC,0BAA0B,CAAC,CAAC;QAC5D,CAAC;QAED,IAAI,KAAK,EAAE,CAAC;YACV,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,GAAG,0BAA0B,KAAK,EAAE,CAAC,CAAC;YAC9D,OAAO;QACT,CAAC;QAED,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC;YACpC,MAAM,IAAI,4BAAmB,CAAC,8BAA8B,CAAC,CAAC;QAChE,CAAC;QAED,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,wBAAwB,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QAC9F,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC5B,CAAC;IAIK,AAAN,KAAK,CAAC,KAAK,CAAQ,GAAY,EAA8B,GAAa;QACxE,MAAM,IAAI,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;QACpC,MAAM,IAAI,GAAG,IAAA,0CAAsB,EAAC,GAAG,CAAC,CAAC;QACzC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,yBAAyB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAEtE,IAAI,MAAM,CAAC,YAAY,IAAI,MAAM,CAAC,aAAa,EAAE,CAAC;YAChD,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,GAAG,EAAE;gBACjC,WAAW,EAAE,MAAM,CAAC,YAAY;gBAChC,YAAY,EAAE,MAAM,CAAC,aAAa;gBAClC,cAAc,EAAE,IAAI,CAAC,MAAM,CAAC,mBAAmB,EAAE;gBACjD,eAAe,EAAE,IAAI,CAAC,MAAM,CAAC,oBAAoB,EAAE;aACpD,CAAC,CAAC;QACL,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,8EAA8E;IACtE,aAAa,CAAC,GAAY;QAChC,MAAM,cAAc,GAAG,GAAG,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC;QACxD,MAAM,WAAW,GAAG,KAAK,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC;QACvF,MAAM,KAAK,GAAG,CAAC,WAAW,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,QAAQ,IAAI,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QAC5E,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,gBAAgB,CAAC,CAAC,IAAI,EAAE,CAAC;QAC1D,OAAO,GAAG,KAAK,MAAM,IAAI,MAAM,CAAC;IAClC,CAAC;IAEO,YAAY,CAAC,GAAY;QAC/B,MAAM,IAAI,GAAG,GAAG,CAAC,IAA2C,CAAC;QAC7D,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YACtC,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,OAAO,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAC7F,CAAC;IACJ,CAAC;CACF,CAAA;AA/GY,8CAAiB;AAS5B;IAFC,IAAA,YAAG,EAAC,kCAAkC,CAAC;IACvC,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,mCAAmC,EAAE,CAAC;IACzC,mBAAA,IAAA,YAAG,GAAE,CAAA;;;;6DAE1B;AAID;IAFC,IAAA,YAAG,EAAC,uBAAuB,CAAC;IAC5B,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,gFAAgF,EAAE,CAAC;;;;wDAG3G;AAIK;IAFL,IAAA,YAAG,EAAC,mBAAmB,CAAC;IACxB,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,wEAAwE,EAAE,CAAC;IAEjG,mBAAA,IAAA,cAAK,GAAE,CAAA;IACP,mBAAA,IAAA,YAAG,GAAE,CAAA;IACL,mBAAA,IAAA,YAAG,GAAE,CAAA;;;;kDAoBP;AAIK;IAFL,IAAA,YAAG,EAAC,+BAA+B,CAAC;IACpC,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,gDAAgD,EAAE,CAAC;IAEzE,mBAAA,IAAA,cAAK,EAAC,aAAa,CAAC,CAAA;IACpB,mBAAA,IAAA,cAAK,EAAC,MAAM,CAAC,CAAA;IACb,mBAAA,IAAA,cAAK,EAAC,OAAO,CAAC,CAAA;IACd,mBAAA,IAAA,cAAK,EAAC,OAAO,CAAC,CAAA;IACd,mBAAA,IAAA,YAAG,GAAE,CAAA;;;;yDAkBP;AAIK;IAFL,IAAA,aAAI,EAAC,eAAe,CAAC;IACrB,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,kEAAkE,EAAE,CAAC;IACjF,mBAAA,IAAA,YAAG,GAAE,CAAA;IAAgB,mBAAA,IAAA,YAAG,EAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAA;;;;8CAe3D;4BA1FU,iBAAiB;IAH7B,IAAA,iBAAO,EAAC,SAAS,CAAC;IAClB,IAAA,yBAAM,GAAE;IACR,IAAA,mBAAU,GAAE;6CAGe,6CAAoB;QAClB,uCAAiB;QAClB,4BAAY;GAJ5B,iBAAiB,CA+G7B;AAED,YAAY"}

package/security/src/lib/oauth/platform-oauth.config.d.ts

@@ -1,10 +1,7 @@
-export declare const AUTH_OAUTH_CLIENT_IDS: () => string[];
-export declare const GOOGLE_OAUTH_CLIENT_ID: () => string | undefined;
-export declare const GOOGLE_OAUTH_CLIENT_SECRET: () => string | undefined;
-export declare const MICROSOFT_OAUTH_CLIENT_ID: () => string | undefined;
-export declare const MICROSOFT_OAUTH_CLIENT_SECRET: () => string | undefined;
-export declare const isGooglePlatformLoginConfigured: () => boolean;
-export declare const isMicrosoftPlatformLoginConfigured: () => boolean;
-export declare const PLATFORM_OAUTH_ISSUER: () => string;
-export declare const PLATFORM_OAUTH_CODE_TTL_MS: () => number;
+/**
+ * Authorization-code TTL for in-memory platform broker state.
+ * IdP endpoints, credentials, and SPA client ids live on seed/entity providers —
+ * not in this file.
+ */
+export declare const PLATFORM_OAUTH_CODE_TTL_MS = 300000;
 //# sourceMappingURL=platform-oauth.config.d.ts.map