@acorex-platform/framework-server 0.0.15 → 0.0.20

package/security/src/lib/oauth/platform-oauth.config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"platform-oauth.config.d.ts","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/oauth/platform-oauth.config.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,qBAAqB,QAAO,MAAM,EAO9C,CAAC;AAEF,eAAO,MAAM,sBAAsB,QAAO,MAAM,GAAG,SACS,CAAC;AAE7D,eAAO,MAAM,0BAA0B,QAAO,MAAM,GAAG,SACS,CAAC;AAEjE,eAAO,MAAM,yBAAyB,QAAO,MAAM,GAAG,SACS,CAAC;AAEhE,eAAO,MAAM,6BAA6B,QAAO,MAAM,GAAG,SACS,CAAC;AAEpE,eAAO,MAAM,+BAA+B,QAAO,OACgB,CAAC;AAEpE,eAAO,MAAM,kCAAkC,QAAO,OACmB,CAAC;AAE1E,eAAO,MAAM,qBAAqB,QAAO,MAQxC,CAAC;AAEF,eAAO,MAAM,0BAA0B,QAAO,MAI7C,CAAC"}
+{"version":3,"file":"platform-oauth.config.d.ts","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/oauth/platform-oauth.config.ts"],"names":[],"mappings":"AAEA;;;;GAIG;AACH,eAAO,MAAM,0BAA0B,SAAU,CAAC"}

package/security/src/lib/oauth/platform-oauth.config.js

@@ -1,42 +1,12 @@
 "use strict";
-//#region ---- Platform OAuth configuration ----
+//#region ---- Platform OAuth runtime constants ----
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.PLATFORM_OAUTH_CODE_TTL_MS = exports.PLATFORM_OAUTH_ISSUER = exports.isMicrosoftPlatformLoginConfigured = exports.isGooglePlatformLoginConfigured = exports.MICROSOFT_OAUTH_CLIENT_SECRET = exports.MICROSOFT_OAUTH_CLIENT_ID = exports.GOOGLE_OAUTH_CLIENT_SECRET = exports.GOOGLE_OAUTH_CLIENT_ID = exports.AUTH_OAUTH_CLIENT_IDS = void 0;
-const AUTH_OAUTH_CLIENT_IDS = () => {
-    const raw = process.env['AUTH_OAUTH_CLIENT_IDS']?.trim();
-    const defaults = ['acorex', 'spa-client'];
-    if (!raw) {
-        return defaults;
-    }
-    return [...new Set([...raw.split(',').map((v) => v.trim()).filter(Boolean), ...defaults])];
-};
-exports.AUTH_OAUTH_CLIENT_IDS = AUTH_OAUTH_CLIENT_IDS;
-const GOOGLE_OAUTH_CLIENT_ID = () => process.env['GOOGLE_OAUTH_CLIENT_ID']?.trim() || undefined;
-exports.GOOGLE_OAUTH_CLIENT_ID = GOOGLE_OAUTH_CLIENT_ID;
-const GOOGLE_OAUTH_CLIENT_SECRET = () => process.env['GOOGLE_OAUTH_CLIENT_SECRET']?.trim() || undefined;
-exports.GOOGLE_OAUTH_CLIENT_SECRET = GOOGLE_OAUTH_CLIENT_SECRET;
-const MICROSOFT_OAUTH_CLIENT_ID = () => process.env['MICROSOFT_OAUTH_CLIENT_ID']?.trim() || undefined;
-exports.MICROSOFT_OAUTH_CLIENT_ID = MICROSOFT_OAUTH_CLIENT_ID;
-const MICROSOFT_OAUTH_CLIENT_SECRET = () => process.env['MICROSOFT_OAUTH_CLIENT_SECRET']?.trim() || undefined;
-exports.MICROSOFT_OAUTH_CLIENT_SECRET = MICROSOFT_OAUTH_CLIENT_SECRET;
-const isGooglePlatformLoginConfigured = () => Boolean((0, exports.GOOGLE_OAUTH_CLIENT_ID)() && (0, exports.GOOGLE_OAUTH_CLIENT_SECRET)());
-exports.isGooglePlatformLoginConfigured = isGooglePlatformLoginConfigured;
-const isMicrosoftPlatformLoginConfigured = () => Boolean((0, exports.MICROSOFT_OAUTH_CLIENT_ID)() && (0, exports.MICROSOFT_OAUTH_CLIENT_SECRET)());
-exports.isMicrosoftPlatformLoginConfigured = isMicrosoftPlatformLoginConfigured;
-const PLATFORM_OAUTH_ISSUER = () => {
-    const explicit = process.env['AUTH_OAUTH_ISSUER']?.trim();
-    if (explicit) {
-        return explicit.replace(/\/$/, '');
-    }
-    const port = process.env['PORT']?.trim() || '5500';
-    return `http://localhost:${port}/api`;
-};
-exports.PLATFORM_OAUTH_ISSUER = PLATFORM_OAUTH_ISSUER;
-const PLATFORM_OAUTH_CODE_TTL_MS = () => {
-    const raw = process.env['AUTH_OAUTH_CODE_TTL_MS']?.trim();
-    const parsed = raw ? Number(raw) : 300_000;
-    return Number.isFinite(parsed) && parsed >= 30_000 ? parsed : 300_000;
-};
-exports.PLATFORM_OAUTH_CODE_TTL_MS = PLATFORM_OAUTH_CODE_TTL_MS;
+exports.PLATFORM_OAUTH_CODE_TTL_MS = void 0;
+/**
+ * Authorization-code TTL for in-memory platform broker state.
+ * IdP endpoints, credentials, and SPA client ids live on seed/entity providers —
+ * not in this file.
+ */
+exports.PLATFORM_OAUTH_CODE_TTL_MS = 300_000;
 //#endregion
 //# sourceMappingURL=platform-oauth.config.js.map

package/security/src/lib/oauth/platform-oauth.config.js.map

@@ -1 +1 @@
-{"version":3,"file":"platform-oauth.config.js","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/oauth/platform-oauth.config.ts"],"names":[],"mappings":";AAAA,gDAAgD;;;AAEzC,MAAM,qBAAqB,GAAG,GAAa,EAAE;IAClD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,EAAE,IAAI,EAAE,CAAC;IACzD,MAAM,QAAQ,GAAG,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;IAC1C,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;AAC7F,CAAC,CAAC;AAPW,QAAA,qBAAqB,yBAOhC;AAEK,MAAM,sBAAsB,GAAG,GAAuB,EAAE,CAC7D,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC,EAAE,IAAI,EAAE,IAAI,SAAS,CAAC;AADhD,QAAA,sBAAsB,0BAC0B;AAEtD,MAAM,0BAA0B,GAAG,GAAuB,EAAE,CACjE,OAAO,CAAC,GAAG,CAAC,4BAA4B,CAAC,EAAE,IAAI,EAAE,IAAI,SAAS,CAAC;AADpD,QAAA,0BAA0B,8BAC0B;AAE1D,MAAM,yBAAyB,GAAG,GAAuB,EAAE,CAChE,OAAO,CAAC,GAAG,CAAC,2BAA2B,CAAC,EAAE,IAAI,EAAE,IAAI,SAAS,CAAC;AADnD,QAAA,yBAAyB,6BAC0B;AAEzD,MAAM,6BAA6B,GAAG,GAAuB,EAAE,CACpE,OAAO,CAAC,GAAG,CAAC,+BAA+B,CAAC,EAAE,IAAI,EAAE,IAAI,SAAS,CAAC;AADvD,QAAA,6BAA6B,iCAC0B;AAE7D,MAAM,+BAA+B,GAAG,GAAY,EAAE,CAC3D,OAAO,CAAC,IAAA,8BAAsB,GAAE,IAAI,IAAA,kCAA0B,GAAE,CAAC,CAAC;AADvD,QAAA,+BAA+B,mCACwB;AAE7D,MAAM,kCAAkC,GAAG,GAAY,EAAE,CAC9D,OAAO,CAAC,IAAA,iCAAyB,GAAE,IAAI,IAAA,qCAA6B,GAAE,CAAC,CAAC;AAD7D,QAAA,kCAAkC,sCAC2B;AAEnE,MAAM,qBAAqB,GAAG,GAAW,EAAE;IAChD,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,EAAE,IAAI,EAAE,CAAC;IAC1D,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACrC,CAAC;IAED,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,MAAM,CAAC;IACnD,OAAO,oBAAoB,IAAI,MAAM,CAAC;AACxC,CAAC,CAAC;AARW,QAAA,qBAAqB,yBAQhC;AAEK,MAAM,0BAA0B,GAAG,GAAW,EAAE;IACrD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC,EAAE,IAAI,EAAE,CAAC;IAC1D,MAAM,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;IAC3C,OAAO,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,IAAI,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;AACxE,CAAC,CAAC;AAJW,QAAA,0BAA0B,8BAIrC;AAEF,YAAY"}
+{"version":3,"file":"platform-oauth.config.js","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/oauth/platform-oauth.config.ts"],"names":[],"mappings":";AAAA,oDAAoD;;;AAEpD;;;;GAIG;AACU,QAAA,0BAA0B,GAAG,OAAO,CAAC;AAElD,YAAY"}

package/security/src/lib/oauth/platform-oauth.service.d.ts

@@ -1,3 +1,4 @@
+import { ModuleRef } from '@nestjs/core';
 import { AuthService } from '../auth/auth.service';
 import { AuthLocalCredentialsService } from '../auth/auth-local-credentials.service';
 import { TokenService } from '../auth/token.service';
@@ -7,11 +8,12 @@ export declare class PlatformOAuthService {
     private readonly auth;
     private readonly credentials;
     private readonly tokens;
+    private readonly moduleRef;
     private readonly logger;
     private readonly authorizationCodes;
-    private readonly googleStates;
-    constructor(auth: AuthService, credentials: AuthLocalCredentialsService, tokens: TokenService);
-    getDiscoveryDocument(): {
+    private readonly externalStates;
+    constructor(auth: AuthService, credentials: AuthLocalCredentialsService, tokens: TokenService, moduleRef: ModuleRef);
+    getDiscoveryDocument(issuer: string): {
         issuer: string;
         authorization_endpoint: string;
         token_endpoint: string;
@@ -25,14 +27,17 @@ export declare class PlatformOAuthService {
     getJwksDocument(): {
         keys: unknown[];
     };
-    beginAuthorization(request: PlatformOAuthAuthorizeRequest): string;
-    completeGoogleCallback(code: string, state: string): Promise<string>;
+    beginAuthorization(request: PlatformOAuthAuthorizeRequest): Promise<string>;
+    completeExternalCallback(providerKey: string, code: string, state: string): Promise<string>;
     exchangeAuthorizationCode(body: Record<string, string | undefined>, meta: AuthRequestMeta): Promise<OAuthTokenResponse>;
     private exchangeRefreshToken;
-    private exchangeGoogleAuthorizationCode;
-    private parseGoogleIdToken;
+    private exchangeExternalAuthorizationCode;
+    private parseIdToken;
     private assertSupportedAuthorizeRequest;
     private assertClientId;
+    private resolveAllowedClientIds;
+    private requireBrokerConfig;
+    private resolveIdentityProviderCatalog;
     private verifyPkce;
 }
 //# sourceMappingURL=platform-oauth.service.d.ts.map

package/security/src/lib/oauth/platform-oauth.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"platform-oauth.service.d.ts","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/oauth/platform-oauth.service.ts"],"names":[],"mappings":"AASA,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,EAAE,2BAA2B,EAAE,MAAM,wCAAwC,CAAC;AACrF,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AASjE,OAAO,KAAK,EAEV,kBAAkB,EAGlB,6BAA6B,EAC9B,MAAM,wBAAwB,CAAC;AAIhC,qBACa,oBAAoB;IAM7B,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,WAAW;IAC5B,OAAO,CAAC,QAAQ,CAAC,MAAM;IAPzB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAyC;IAChE,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAsD;IACzF,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAgD;gBAG1D,IAAI,EAAE,WAAW,EACjB,WAAW,EAAE,2BAA2B,EACxC,MAAM,EAAE,YAAY;IAGvC,oBAAoB;;;;;;;;;;IAcpB,oGAAoG;IACpG,eAAe;cACQ,OAAO,EAAE;;IAGhC,kBAAkB,CAAC,OAAO,EAAE,6BAA6B,GAAG,MAAM;IA0C5D,sBAAsB,CAC1B,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,MAAM,CAAC;IAoCZ,yBAAyB,CAC7B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,EACxC,IAAI,EAAE,eAAe,GACpB,OAAO,CAAC,kBAAkB,CAAC;YAiEhB,oBAAoB;YA0BpB,+BAA+B;IAiD7C,OAAO,CAAC,kBAAkB;IAmB1B,OAAO,CAAC,+BAA+B;IAgBvC,OAAO,CAAC,cAAc;IAMtB,OAAO,CAAC,UAAU;CAYnB"}
+{"version":3,"file":"platform-oauth.service.d.ts","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/oauth/platform-oauth.service.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAQzC,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,EAAE,2BAA2B,EAAE,MAAM,wCAAwC,CAAC;AACrF,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAGjE,OAAO,KAAK,EAEV,kBAAkB,EAGlB,6BAA6B,EAC9B,MAAM,wBAAwB,CAAC;AAIhC,qBACa,oBAAoB;IAM7B,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,WAAW;IAC5B,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,SAAS;IAR5B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAyC;IAChE,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAsD;IACzF,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAkD;gBAG9D,IAAI,EAAE,WAAW,EACjB,WAAW,EAAE,2BAA2B,EACxC,MAAM,EAAE,YAAY,EACpB,SAAS,EAAE,SAAS;IAGvC,oBAAoB,CAAC,MAAM,EAAE,MAAM;;;;;;;;;;IAcnC,oGAAoG;IACpG,eAAe;cACQ,OAAO,EAAE;;IAG1B,kBAAkB,CAAC,OAAO,EAAE,6BAA6B,GAAG,OAAO,CAAC,MAAM,CAAC;IAmC3E,wBAAwB,CAC5B,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,MAAM,CAAC;IAyCZ,yBAAyB,CAC7B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,EACxC,IAAI,EAAE,eAAe,GACpB,OAAO,CAAC,kBAAkB,CAAC;YAkEhB,oBAAoB;YA2BpB,iCAAiC;IAgD/C,OAAO,CAAC,YAAY;IAmBpB,OAAO,CAAC,+BAA+B;IAoBvC,OAAO,CAAC,cAAc;IAOtB,OAAO,CAAC,uBAAuB;YAYjB,mBAAmB;IAgBjC,OAAO,CAAC,8BAA8B;IAUtC,OAAO,CAAC,UAAU;CAYnB"}

package/security/src/lib/oauth/platform-oauth.service.js

@@ -4,28 +4,31 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.PlatformOAuthService = void 0;
 const tslib_1 = require("tslib");
 const common_1 = require("@nestjs/common");
+const core_1 = require("@nestjs/core");
 const crypto_1 = require("crypto");
+const auth_identity_provider_source_1 = require("../auth/auth-identity-provider.source");
 const auth_service_1 = require("../auth/auth.service");
 const auth_local_credentials_service_1 = require("../auth/auth-local-credentials.service");
 const token_service_1 = require("../auth/token.service");
 const platform_oauth_config_1 = require("./platform-oauth.config");
 //#region ---- Platform OAuth service ----
 let PlatformOAuthService = PlatformOAuthService_1 = class PlatformOAuthService {
-    constructor(auth, credentials, tokens) {
+    constructor(auth, credentials, tokens, moduleRef) {
         this.auth = auth;
         this.credentials = credentials;
         this.tokens = tokens;
+        this.moduleRef = moduleRef;
         this.logger = new common_1.Logger(PlatformOAuthService_1.name);
         this.authorizationCodes = new Map();
-        this.googleStates = new Map();
+        this.externalStates = new Map();
     }
-    getDiscoveryDocument() {
-        const issuer = (0, platform_oauth_config_1.PLATFORM_OAUTH_ISSUER)();
+    getDiscoveryDocument(issuer) {
+        const base = issuer.replace(/\/$/, '');
         return {
-            issuer,
-            authorization_endpoint: `${issuer}/connect/authorize`,
-            token_endpoint: `${issuer}/connect/token`,
-            jwks_uri: `${issuer}/.well-known/jwks.json`,
+            issuer: base,
+            authorization_endpoint: `${base}/connect/authorize`,
+            token_endpoint: `${base}/connect/token`,
+            jwks_uri: `${base}/.well-known/jwks.json`,
             response_types_supported: ['code'],
             grant_types_supported: ['authorization_code', 'refresh_token'],
             code_challenge_methods_supported: ['S256'],
@@ -36,50 +39,47 @@ let PlatformOAuthService = PlatformOAuthService_1 = class PlatformOAuthService {
     getJwksDocument() {
         return { keys: [] };
     }
-    beginAuthorization(request) {
+    async beginAuthorization(request) {
         this.assertSupportedAuthorizeRequest(request);
-        if (request.provider !== 'google') {
-            throw new common_1.BadRequestException(`Unsupported external provider: ${request.provider}`);
-        }
-        const clientId = (0, platform_oauth_config_1.GOOGLE_OAUTH_CLIENT_ID)();
-        const clientSecret = (0, platform_oauth_config_1.GOOGLE_OAUTH_CLIENT_SECRET)();
-        if (!clientId || !clientSecret) {
-            throw new common_1.ServiceUnavailableException({
-                statusCode: 503,
-                message: 'Google platform login is not configured on the server. Set GOOGLE_OAUTH_CLIENT_ID and GOOGLE_OAUTH_CLIENT_SECRET in the workspace .env file, then restart demo-api. Google Cloud redirect URI must be http://localhost:5500/api/connect/callback/google',
-                error: 'GoogleLoginNotConfigured',
-            });
+        const providerKey = request.provider.trim();
+        if (!providerKey) {
+            throw new common_1.BadRequestException('acr_values (identity provider key) is required.');
         }
+        const broker = await this.requireBrokerConfig(providerKey);
         const state = (0, crypto_1.randomBytes)(16).toString('hex');
-        this.googleStates.set(state, {
+        this.externalStates.set(state, {
             codeChallenge: request.codeChallenge,
             codeChallengeMethod: request.codeChallengeMethod,
             redirectUri: request.redirectUri,
             clientId: request.clientId,
-            provider: request.provider,
-            expiresAt: Date.now() + (0, platform_oauth_config_1.PLATFORM_OAUTH_CODE_TTL_MS)(),
+            provider: providerKey,
+            issuer: request.issuer.replace(/\/$/, ''),
+            expiresAt: Date.now() + platform_oauth_config_1.PLATFORM_OAUTH_CODE_TTL_MS,
         });
-        const callbackUrl = `${(0, platform_oauth_config_1.PLATFORM_OAUTH_ISSUER)()}/connect/callback/google`;
+        const callbackUrl = `${request.issuer.replace(/\/$/, '')}/connect/callback/${encodeURIComponent(providerKey)}`;
         const params = new URLSearchParams({
-            client_id: clientId,
+            client_id: broker.clientId,
             redirect_uri: callbackUrl,
             response_type: 'code',
-            scope: 'openid email profile',
+            scope: broker.scopes,
             state,
             access_type: 'online',
             prompt: 'select_account',
         });
-        return `https://accounts.google.com/o/oauth2/v2/auth?${params.toString()}`;
+        return `${broker.authorizationUrl}?${params.toString()}`;
     }
-    async completeGoogleCallback(code, state) {
-        const googleState = this.googleStates.get(state);
-        this.googleStates.delete(state);
-        if (!googleState || googleState.expiresAt < Date.now()) {
+    async completeExternalCallback(providerKey, code, state) {
+        const externalState = this.externalStates.get(state);
+        this.externalStates.delete(state);
+        if (!externalState || externalState.expiresAt < Date.now()) {
             throw new common_1.UnauthorizedException('Invalid or expired OAuth state.');
         }
-        const profile = await this.exchangeGoogleAuthorizationCode(code);
+        if (externalState.provider !== providerKey) {
+            throw new common_1.UnauthorizedException('OAuth state provider mismatch.');
+        }
+        const profile = await this.exchangeExternalAuthorizationCode(providerKey, code, externalState.issuer);
         const user = await this.credentials.findOrCreateExternalUser({
-            provider: 'google',
+            provider: providerKey,
             providerSubject: profile.sub,
             email: profile.email,
             displayName: profile.name,
@@ -87,18 +87,19 @@ let PlatformOAuthService = PlatformOAuthService_1 = class PlatformOAuthService {
         });
         const platformCode = (0, crypto_1.randomBytes)(24).toString('hex');
         this.authorizationCodes.set(platformCode, {
-            codeChallenge: googleState.codeChallenge,
-            codeChallengeMethod: googleState.codeChallengeMethod,
-            redirectUri: googleState.redirectUri,
-            clientId: googleState.clientId,
+            codeChallenge: externalState.codeChallenge,
+            codeChallengeMethod: externalState.codeChallengeMethod,
+            redirectUri: externalState.redirectUri,
+            clientId: externalState.clientId,
             userId: user.id,
             userName: user.username ?? user.id,
             userTitle: user.displayName ?? user.username ?? user.id,
             userEmail: profile.email,
             userPicture: profile.picture,
-            expiresAt: Date.now() + (0, platform_oauth_config_1.PLATFORM_OAUTH_CODE_TTL_MS)(),
+            provider: providerKey,
+            expiresAt: Date.now() + platform_oauth_config_1.PLATFORM_OAUTH_CODE_TTL_MS,
         });
-        const redirect = new URL(googleState.redirectUri);
+        const redirect = new URL(externalState.redirectUri);
         redirect.searchParams.set('code', platformCode);
         return redirect.toString();
     }
@@ -137,6 +138,7 @@ let PlatformOAuthService = PlatformOAuthService_1 = class PlatformOAuthService {
             id: user.id,
             name: user.username ?? user.id,
             title: user.displayName ?? user.username ?? user.id,
+            avatar: user.avatar ?? null,
         };
         const tokens = this.tokens.issueTokenResponse(authUser, {});
         const expiresIn = this.tokens.accessTokenExpiresInSeconds();
@@ -162,7 +164,8 @@ let PlatformOAuthService = PlatformOAuthService_1 = class PlatformOAuthService {
         }
         const result = await this.auth.refreshSession(refreshToken.trim(), meta);
         const expiresIn = this.tokens.accessTokenExpiresInSeconds();
-        const idToken = this.tokens.issueIdToken(result.user, clientId ?? (0, platform_oauth_config_1.AUTH_OAUTH_CLIENT_IDS)()[0], {});
+        const allowed = this.resolveAllowedClientIds();
+        const idToken = this.tokens.issueIdToken(result.user, clientId ?? allowed[0] ?? 'acorex', {});
         return {
             access_token: result.accessToken,
             refresh_token: result.refreshToken,
@@ -171,50 +174,45 @@ let PlatformOAuthService = PlatformOAuthService_1 = class PlatformOAuthService {
             expires_in: expiresIn,
         };
     }
-    async exchangeGoogleAuthorizationCode(code) {
-        const clientId = (0, platform_oauth_config_1.GOOGLE_OAUTH_CLIENT_ID)();
-        const clientSecret = (0, platform_oauth_config_1.GOOGLE_OAUTH_CLIENT_SECRET)();
-        if (!clientId || !clientSecret) {
-            throw new common_1.InternalServerErrorException('Google OAuth is not configured.');
-        }
-        const callbackUrl = `${(0, platform_oauth_config_1.PLATFORM_OAUTH_ISSUER)()}/connect/callback/google`;
+    async exchangeExternalAuthorizationCode(providerKey, code, issuer) {
+        const broker = await this.requireBrokerConfig(providerKey);
+        const callbackUrl = `${issuer.replace(/\/$/, '')}/connect/callback/${encodeURIComponent(providerKey)}`;
         const body = new URLSearchParams({
             code,
-            client_id: clientId,
-            client_secret: clientSecret,
+            client_id: broker.clientId,
+            client_secret: broker.clientSecret,
             redirect_uri: callbackUrl,
             grant_type: 'authorization_code',
         });
-        const tokenResponse = await fetch('https://oauth2.googleapis.com/token', {
+        const tokenResponse = await fetch(broker.tokenUrl, {
             method: 'POST',
             headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
             body: body.toString(),
         });
         if (!tokenResponse.ok) {
             const detail = await tokenResponse.text();
-            this.logger.warn(`Google token exchange failed: ${detail}`);
-            throw new common_1.UnauthorizedException('Google authorization failed.');
+            this.logger.warn(`External token exchange failed (${providerKey}): ${detail}`);
+            throw new common_1.UnauthorizedException(`${providerKey} authorization failed.`);
         }
         const tokenData = (await tokenResponse.json());
         if (tokenData.id_token) {
-            return this.parseGoogleIdToken(tokenData.id_token);
+            return this.parseIdToken(tokenData.id_token);
         }
-        if (!tokenData.access_token) {
-            throw new common_1.UnauthorizedException('Google authorization failed.');
+        if (!tokenData.access_token || !broker.userInfoUrl) {
+            throw new common_1.UnauthorizedException(`${providerKey} authorization failed.`);
         }
-        const profileResponse = await fetch('https://openidconnect.googleapis.com/v1/userinfo', {
+        const profileResponse = await fetch(broker.userInfoUrl, {
             headers: { Authorization: `Bearer ${tokenData.access_token}` },
         });
         if (!profileResponse.ok) {
-            throw new common_1.UnauthorizedException('Google profile lookup failed.');
+            throw new common_1.UnauthorizedException(`${providerKey} profile lookup failed.`);
         }
-        const profile = (await profileResponse.json());
-        return profile;
+        return (await profileResponse.json());
     }
-    parseGoogleIdToken(idToken) {
+    parseIdToken(idToken) {
         const parts = idToken.split('.');
         if (parts.length < 2) {
-            throw new common_1.UnauthorizedException('Invalid Google id_token.');
+            throw new common_1.UnauthorizedException('Invalid id_token.');
         }
         const payload = JSON.parse(Buffer.from(parts[1], 'base64url').toString('utf8'));
         return {
@@ -233,15 +231,55 @@ let PlatformOAuthService = PlatformOAuthService_1 = class PlatformOAuthService {
         if (!request.redirectUri?.trim()) {
             throw new common_1.BadRequestException('redirect_uri is required.');
         }
+        if (!request.issuer?.trim()) {
+            throw new common_1.BadRequestException('issuer is required.');
+        }
         if (!request.codeChallenge?.trim() || request.codeChallengeMethod !== 'S256') {
             throw new common_1.BadRequestException('PKCE S256 code_challenge is required.');
         }
     }
     assertClientId(clientId) {
-        if (!(0, platform_oauth_config_1.AUTH_OAUTH_CLIENT_IDS)().includes(clientId)) {
+        const allowed = this.resolveAllowedClientIds();
+        if (!allowed.includes(clientId)) {
             throw new common_1.BadRequestException(`Unsupported client_id: ${clientId}`);
         }
     }
+    resolveAllowedClientIds() {
+        try {
+            const ids = this.moduleRef.get(auth_identity_provider_source_1.AUTH_OAUTH_ALLOWED_CLIENT_IDS, { strict: false });
+            if (Array.isArray(ids) && ids.length > 0) {
+                return ids;
+            }
+        }
+        catch {
+            /* catalog not loaded */
+        }
+        return ['acorex', 'spa-client'];
+    }
+    async requireBrokerConfig(key) {
+        const catalog = this.resolveIdentityProviderCatalog();
+        const broker = catalog ? await catalog.getBrokerConfig(key) : null;
+        if (!broker) {
+            throw new common_1.ServiceUnavailableException({
+                statusCode: 503,
+                message: `Identity provider "${key}" is not enabled or is missing broker config ` +
+                    '(clientId, clientSecret, authorizationUrl, tokenUrl). ' +
+                    'Configure it under Security → Identity Providers.',
+                error: 'IdentityProviderNotConfigured',
+            });
+        }
+        return broker;
+    }
+    resolveIdentityProviderCatalog() {
+        try {
+            return this.moduleRef.get(auth_identity_provider_source_1.AUTH_IDENTITY_PROVIDER_CATALOG, {
+                strict: false,
+            });
+        }
+        catch {
+            return null;
+        }
+    }
     verifyPkce(codeVerifier, codeChallenge, method) {
         if (method !== 'S256') {
             return false;
@@ -260,7 +298,8 @@ exports.PlatformOAuthService = PlatformOAuthService = PlatformOAuthService_1 = t
     (0, common_1.Injectable)(),
     tslib_1.__metadata("design:paramtypes", [auth_service_1.AuthService,
         auth_local_credentials_service_1.AuthLocalCredentialsService,
-        token_service_1.TokenService])
+        token_service_1.TokenService,
+        core_1.ModuleRef])
 ], PlatformOAuthService);
 //#endregion
 //# sourceMappingURL=platform-oauth.service.js.map

package/security/src/lib/oauth/platform-oauth.service.js.map

@@ -1 +1 @@
-{"version":3,"file":"platform-oauth.service.js","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/oauth/platform-oauth.service.ts"],"names":[],"mappings":";;;;;AAAA,2CAOwB;AACxB,mCAA8E;AAC9E,uDAAmD;AACnD,2FAAqF;AACrF,yDAAqD;AAGrD,mEAMiC;AASjC,0CAA0C;AAGnC,IAAM,oBAAoB,4BAA1B,MAAM,oBAAoB;IAK/B,YACmB,IAAiB,EACjB,WAAwC,EACxC,MAAoB;QAFpB,SAAI,GAAJ,IAAI,CAAa;QACjB,gBAAW,GAAX,WAAW,CAA6B;QACxC,WAAM,GAAN,MAAM,CAAc;QAPtB,WAAM,GAAG,IAAI,eAAM,CAAC,sBAAoB,CAAC,IAAI,CAAC,CAAC;QAC/C,uBAAkB,GAAG,IAAI,GAAG,EAA2C,CAAC;QACxE,iBAAY,GAAG,IAAI,GAAG,EAAqC,CAAC;IAM1E,CAAC;IAEJ,oBAAoB;QAClB,MAAM,MAAM,GAAG,IAAA,6CAAqB,GAAE,CAAC;QACvC,OAAO;YACL,MAAM;YACN,sBAAsB,EAAE,GAAG,MAAM,oBAAoB;YACrD,cAAc,EAAE,GAAG,MAAM,gBAAgB;YACzC,QAAQ,EAAE,GAAG,MAAM,wBAAwB;YAC3C,wBAAwB,EAAE,CAAC,MAAM,CAAC;YAClC,qBAAqB,EAAE,CAAC,oBAAoB,EAAE,eAAe,CAAC;YAC9D,gCAAgC,EAAE,CAAC,MAAM,CAAC;YAC1C,gBAAgB,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,gBAAgB,CAAC;SACnE,CAAC;IACJ,CAAC;IAED,oGAAoG;IACpG,eAAe;QACb,OAAO,EAAE,IAAI,EAAE,EAAe,EAAE,CAAC;IACnC,CAAC;IAED,kBAAkB,CAAC,OAAsC;QACvD,IAAI,CAAC,+BAA+B,CAAC,OAAO,CAAC,CAAC;QAE9C,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAClC,MAAM,IAAI,4BAAmB,CAAC,kCAAkC,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;QACtF,CAAC;QAED,MAAM,QAAQ,GAAG,IAAA,8CAAsB,GAAE,CAAC;QAC1C,MAAM,YAAY,GAAG,IAAA,kDAA0B,GAAE,CAAC;QAClD,IAAI,CAAC,QAAQ,IAAI,CAAC,YAAY,EAAE,CAAC;YAC/B,MAAM,IAAI,oCAA2B,CAAC;gBACpC,UAAU,EAAE,GAAG;gBACf,OAAO,EACL,yPAAyP;gBAC3P,KAAK,EAAE,0BAA0B;aAClC,CAAC,CAAC;QACL,CAAC;QAED,MAAM,KAAK,GAAG,IAAA,oBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC9C,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,EAAE;YAC3B,aAAa,EAAE,OAAO,CAAC,aAAa;YACpC,mBAAmB,EAAE,OAAO,CAAC,mBAAmB;YAChD,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,IAAA,kDAA0B,GAAE;SACrD,CAAC,CAAC;QAEH,MAAM,WAAW,GAAG,GAAG,IAAA,6CAAqB,GAAE,0BAA0B,CAAC;QACzE,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;YACjC,SAAS,EAAE,QAAQ;YACnB,YAAY,EAAE,WAAW;YACzB,aAAa,EAAE,MAAM;YACrB,KAAK,EAAE,sBAAsB;YAC7B,KAAK;YACL,WAAW,EAAE,QAAQ;YACrB,MAAM,EAAE,gBAAgB;SACzB,CAAC,CAAC;QAEH,OAAO,gDAAgD,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC;IAC7E,CAAC;IAED,KAAK,CAAC,sBAAsB,CAC1B,IAAY,EACZ,KAAa;QAEb,MAAM,WAAW,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACjD,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAEhC,IAAI,CAAC,WAAW,IAAI,WAAW,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YACvD,MAAM,IAAI,8BAAqB,CAAC,iCAAiC,CAAC,CAAC;QACrE,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,+BAA+B,CAAC,IAAI,CAAC,CAAC;QACjE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,wBAAwB,CAAC;YAC3D,QAAQ,EAAE,QAAQ;YAClB,eAAe,EAAE,OAAO,CAAC,GAAG;YAC5B,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,WAAW,EAAE,OAAO,CAAC,IAAI;YACzB,OAAO,EAAE,OAAO,CAAC,OAAO;SACzB,CAAC,CAAC;QAEH,MAAM,YAAY,GAAG,IAAA,oBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACrD,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,YAAY,EAAE;YACxC,aAAa,EAAE,WAAW,CAAC,aAAa;YACxC,mBAAmB,EAAE,WAAW,CAAC,mBAAmB;YACpD,WAAW,EAAE,WAAW,CAAC,WAAW;YACpC,QAAQ,EAAE,WAAW,CAAC,QAAQ;YAC9B,MAAM,EAAE,IAAI,CAAC,EAAE;YACf,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,EAAE;YAClC,SAAS,EAAE,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,EAAE;YACvD,SAAS,EAAE,OAAO,CAAC,KAAK;YACxB,WAAW,EAAE,OAAO,CAAC,OAAO;YAC5B,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,IAAA,kDAA0B,GAAE;SACrD,CAAC,CAAC;QAEH,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC;QAClD,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;QAChD,OAAO,QAAQ,CAAC,QAAQ,EAAE,CAAC;IAC7B,CAAC;IAED,KAAK,CAAC,yBAAyB,CAC7B,IAAwC,EACxC,IAAqB;QAErB,MAAM,SAAS,GAAG,IAAI,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,CAAC;QAC7C,IAAI,SAAS,KAAK,eAAe,EAAE,CAAC;YAClC,OAAO,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE,IAAI,CAAC,WAAW,CAAC,EAAE,IAAI,CAAC,CAAC;QACnF,CAAC;QAED,IAAI,SAAS,KAAK,oBAAoB,EAAE,CAAC;YACvC,MAAM,IAAI,4BAAmB,CAAC,yBAAyB,CAAC,CAAC;QAC3D,CAAC;QAED,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC;QAClC,MAAM,WAAW,GAAG,IAAI,CAAC,cAAc,CAAC,EAAE,IAAI,EAAE,CAAC;QACjD,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,CAAC;QAC3C,MAAM,YAAY,GAAG,IAAI,CAAC,eAAe,CAAC,EAAE,IAAI,EAAE,CAAC;QAEnD,IAAI,CAAC,IAAI,IAAI,CAAC,WAAW,IAAI,CAAC,QAAQ,IAAI,CAAC,YAAY,EAAE,CAAC;YACxD,MAAM,IAAI,4BAAmB,CAAC,gEAAgE,CAAC,CAAC;QAClG,CAAC;QAED,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;QAE9B,MAAM,MAAM,GAAG,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACjD,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAErC,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YAC7C,MAAM,IAAI,8BAAqB,CAAC,wCAAwC,CAAC,CAAC;QAC5E,CAAC;QAED,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,MAAM,CAAC,WAAW,KAAK,WAAW,EAAE,CAAC;YACvE,MAAM,IAAI,8BAAqB,CAAC,2DAA2D,CAAC,CAAC;QAC/F,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,YAAY,EAAE,MAAM,CAAC,aAAa,EAAE,MAAM,CAAC,mBAAmB,CAAC,EAAE,CAAC;YACrF,MAAM,IAAI,8BAAqB,CAAC,6BAA6B,CAAC,CAAC;QACjE,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAChE,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,8BAAqB,CAAC,iBAAiB,CAAC,CAAC;QACrD,CAAC;QAED,MAAM,QAAQ,GAAgB;YAC5B,EAAE,EAAE,IAAI,CAAC,EAAE;YACX,IAAI,EAAE,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,EAAE;YAC9B,KAAK,EAAE,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,EAAE;SACpD,CAAC;QAEF,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,kBAAkB,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;QAC5D,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,2BAA2B,EAAE,CAAC;QAC5D,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,QAAQ,EAAE,QAAQ,EAAE;YAC3D,KAAK,EAAE,MAAM,CAAC,SAAS;YACvB,OAAO,EAAE,MAAM,CAAC,WAAW;SAC5B,CAAC,CAAC;QAEH,MAAM,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAE3C,OAAO;YACL,YAAY,EAAE,MAAM,CAAC,WAAW;YAChC,aAAa,EAAE,MAAM,CAAC,YAAY;YAClC,QAAQ,EAAE,OAAO;YACjB,UAAU,EAAE,QAAQ;YACpB,UAAU,EAAE,SAAS;SACtB,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,oBAAoB,CAChC,YAAgC,EAChC,QAA4B,EAC5B,IAAqB;QAErB,IAAI,CAAC,YAAY,EAAE,IAAI,EAAE,EAAE,CAAC;YAC1B,MAAM,IAAI,4BAAmB,CAAC,4BAA4B,CAAC,CAAC;QAC9D,CAAC;QAED,IAAI,QAAQ,EAAE,CAAC;YACb,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;QAChC,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,YAAY,CAAC,IAAI,EAAE,EAAE,IAAI,CAAC,CAAC;QACzE,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,2BAA2B,EAAE,CAAC;QAC5D,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,IAAI,IAAA,6CAAqB,GAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAElG,OAAO;YACL,YAAY,EAAE,MAAM,CAAC,WAAW;YAChC,aAAa,EAAE,MAAM,CAAC,YAAY;YAClC,QAAQ,EAAE,OAAO;YACjB,UAAU,EAAE,QAAQ;YACpB,UAAU,EAAE,SAAS;SACtB,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,+BAA+B,CAAC,IAAY;QACxD,MAAM,QAAQ,GAAG,IAAA,8CAAsB,GAAE,CAAC;QAC1C,MAAM,YAAY,GAAG,IAAA,kDAA0B,GAAE,CAAC;QAClD,IAAI,CAAC,QAAQ,IAAI,CAAC,YAAY,EAAE,CAAC;YAC/B,MAAM,IAAI,qCAA4B,CAAC,iCAAiC,CAAC,CAAC;QAC5E,CAAC;QAED,MAAM,WAAW,GAAG,GAAG,IAAA,6CAAqB,GAAE,0BAA0B,CAAC;QACzE,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;YAC/B,IAAI;YACJ,SAAS,EAAE,QAAQ;YACnB,aAAa,EAAE,YAAY;YAC3B,YAAY,EAAE,WAAW;YACzB,UAAU,EAAE,oBAAoB;SACjC,CAAC,CAAC;QAEH,MAAM,aAAa,GAAG,MAAM,KAAK,CAAC,qCAAqC,EAAE;YACvE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;YAChE,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE;SACtB,CAAC,CAAC;QAEH,IAAI,CAAC,aAAa,CAAC,EAAE,EAAE,CAAC;YACtB,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,IAAI,EAAE,CAAC;YAC1C,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,iCAAiC,MAAM,EAAE,CAAC,CAAC;YAC5D,MAAM,IAAI,8BAAqB,CAAC,8BAA8B,CAAC,CAAC;QAClE,CAAC;QAED,MAAM,SAAS,GAAG,CAAC,MAAM,aAAa,CAAC,IAAI,EAAE,CAAiD,CAAC;QAC/F,IAAI,SAAS,CAAC,QAAQ,EAAE,CAAC;YACvB,OAAO,IAAI,CAAC,kBAAkB,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QACrD,CAAC;QAED,IAAI,CAAC,SAAS,CAAC,YAAY,EAAE,CAAC;YAC5B,MAAM,IAAI,8BAAqB,CAAC,8BAA8B,CAAC,CAAC;QAClE,CAAC;QAED,MAAM,eAAe,GAAG,MAAM,KAAK,CAAC,kDAAkD,EAAE;YACtF,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,SAAS,CAAC,YAAY,EAAE,EAAE;SAC/D,CAAC,CAAC;QAEH,IAAI,CAAC,eAAe,CAAC,EAAE,EAAE,CAAC;YACxB,MAAM,IAAI,8BAAqB,CAAC,+BAA+B,CAAC,CAAC;QACnE,CAAC;QAED,MAAM,OAAO,GAAG,CAAC,MAAM,eAAe,CAAC,IAAI,EAAE,CAAkB,CAAC;QAChE,OAAO,OAAO,CAAC;IACjB,CAAC;IAEO,kBAAkB,CAAC,OAAe;QACxC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACrB,MAAM,IAAI,8BAAqB,CAAC,0BAA0B,CAAC,CAAC;QAC9D,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAE7E,CAAC;QAEF,OAAO;YACL,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,aAAa,EAAE,OAAO,CAAC,cAAc;YACrC,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,OAAO,EAAE,OAAO,CAAC,OAAO;SACzB,CAAC;IACJ,CAAC;IAEO,+BAA+B,CAAC,OAAsC;QAC5E,IAAI,OAAO,CAAC,YAAY,KAAK,MAAM,EAAE,CAAC;YACpC,MAAM,IAAI,4BAAmB,CAAC,uCAAuC,CAAC,CAAC;QACzE,CAAC;QAED,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAEtC,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,IAAI,EAAE,EAAE,CAAC;YACjC,MAAM,IAAI,4BAAmB,CAAC,2BAA2B,CAAC,CAAC;QAC7D,CAAC;QAED,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,IAAI,EAAE,IAAI,OAAO,CAAC,mBAAmB,KAAK,MAAM,EAAE,CAAC;YAC7E,MAAM,IAAI,4BAAmB,CAAC,uCAAuC,CAAC,CAAC;QACzE,CAAC;IACH,CAAC;IAEO,cAAc,CAAC,QAAgB;QACrC,IAAI,CAAC,IAAA,6CAAqB,GAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YAChD,MAAM,IAAI,4BAAmB,CAAC,0BAA0B,QAAQ,EAAE,CAAC,CAAC;QACtE,CAAC;IACH,CAAC;IAEO,UAAU,CAAC,YAAoB,EAAE,aAAqB,EAAE,MAAc;QAC5E,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;YACtB,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,MAAM,GAAG,IAAA,mBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QAC7E,IAAI,CAAC;YACH,OAAO,IAAA,wBAAe,EAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC;QAC1E,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;CACF,CAAA;AAnTY,oDAAoB;+BAApB,oBAAoB;IADhC,IAAA,mBAAU,GAAE;6CAOc,0BAAW;QACJ,4DAA2B;QAChC,4BAAY;GAR5B,oBAAoB,CAmThC;AAED,YAAY"}
+{"version":3,"file":"platform-oauth.service.js","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/oauth/platform-oauth.service.ts"],"names":[],"mappings":";;;;;AAAA,2CAMwB;AACxB,uCAAyC;AACzC,mCAAkE;AAClE,yFAK+C;AAC/C,uDAAmD;AACnD,2FAAqF;AACrF,yDAAqD;AAGrD,mEAAqE;AASrE,0CAA0C;AAGnC,IAAM,oBAAoB,4BAA1B,MAAM,oBAAoB;IAK/B,YACmB,IAAiB,EACjB,WAAwC,EACxC,MAAoB,EACpB,SAAoB;QAHpB,SAAI,GAAJ,IAAI,CAAa;QACjB,gBAAW,GAAX,WAAW,CAA6B;QACxC,WAAM,GAAN,MAAM,CAAc;QACpB,cAAS,GAAT,SAAS,CAAW;QARtB,WAAM,GAAG,IAAI,eAAM,CAAC,sBAAoB,CAAC,IAAI,CAAC,CAAC;QAC/C,uBAAkB,GAAG,IAAI,GAAG,EAA2C,CAAC;QACxE,mBAAc,GAAG,IAAI,GAAG,EAAuC,CAAC;IAO9E,CAAC;IAEJ,oBAAoB,CAAC,MAAc;QACjC,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACvC,OAAO;YACL,MAAM,EAAE,IAAI;YACZ,sBAAsB,EAAE,GAAG,IAAI,oBAAoB;YACnD,cAAc,EAAE,GAAG,IAAI,gBAAgB;YACvC,QAAQ,EAAE,GAAG,IAAI,wBAAwB;YACzC,wBAAwB,EAAE,CAAC,MAAM,CAAC;YAClC,qBAAqB,EAAE,CAAC,oBAAoB,EAAE,eAAe,CAAC;YAC9D,gCAAgC,EAAE,CAAC,MAAM,CAAC;YAC1C,gBAAgB,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,gBAAgB,CAAC;SACnE,CAAC;IACJ,CAAC;IAED,oGAAoG;IACpG,eAAe;QACb,OAAO,EAAE,IAAI,EAAE,EAAe,EAAE,CAAC;IACnC,CAAC;IAED,KAAK,CAAC,kBAAkB,CAAC,OAAsC;QAC7D,IAAI,CAAC,+BAA+B,CAAC,OAAO,CAAC,CAAC;QAE9C,MAAM,WAAW,GAAG,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QAC5C,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,IAAI,4BAAmB,CAAC,iDAAiD,CAAC,CAAC;QACnF,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,WAAW,CAAC,CAAC;QAE3D,MAAM,KAAK,GAAG,IAAA,oBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC9C,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,KAAK,EAAE;YAC7B,aAAa,EAAE,OAAO,CAAC,aAAa;YACpC,mBAAmB,EAAE,OAAO,CAAC,mBAAmB;YAChD,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,QAAQ,EAAE,WAAW;YACrB,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;YACzC,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,kDAA0B;SACnD,CAAC,CAAC;QAEH,MAAM,WAAW,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,qBAAqB,kBAAkB,CAAC,WAAW,CAAC,EAAE,CAAC;QAC/G,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;YACjC,SAAS,EAAE,MAAM,CAAC,QAAQ;YAC1B,YAAY,EAAE,WAAW;YACzB,aAAa,EAAE,MAAM;YACrB,KAAK,EAAE,MAAM,CAAC,MAAM;YACpB,KAAK;YACL,WAAW,EAAE,QAAQ;YACrB,MAAM,EAAE,gBAAgB;SACzB,CAAC,CAAC;QAEH,OAAO,GAAG,MAAM,CAAC,gBAAgB,IAAI,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC;IAC3D,CAAC;IAED,KAAK,CAAC,wBAAwB,CAC5B,WAAmB,EACnB,IAAY,EACZ,KAAa;QAEb,MAAM,aAAa,GAAG,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACrD,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAElC,IAAI,CAAC,aAAa,IAAI,aAAa,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YAC3D,MAAM,IAAI,8BAAqB,CAAC,iCAAiC,CAAC,CAAC;QACrE,CAAC;QAED,IAAI,aAAa,CAAC,QAAQ,KAAK,WAAW,EAAE,CAAC;YAC3C,MAAM,IAAI,8BAAqB,CAAC,gCAAgC,CAAC,CAAC;QACpE,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,iCAAiC,CAAC,WAAW,EAAE,IAAI,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;QACtG,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,wBAAwB,CAAC;YAC3D,QAAQ,EAAE,WAAW;YACrB,eAAe,EAAE,OAAO,CAAC,GAAG;YAC5B,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,WAAW,EAAE,OAAO,CAAC,IAAI;YACzB,OAAO,EAAE,OAAO,CAAC,OAAO;SACzB,CAAC,CAAC;QAEH,MAAM,YAAY,GAAG,IAAA,oBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACrD,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,YAAY,EAAE;YACxC,aAAa,EAAE,aAAa,CAAC,aAAa;YAC1C,mBAAmB,EAAE,aAAa,CAAC,mBAAmB;YACtD,WAAW,EAAE,aAAa,CAAC,WAAW;YACtC,QAAQ,EAAE,aAAa,CAAC,QAAQ;YAChC,MAAM,EAAE,IAAI,CAAC,EAAE;YACf,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,EAAE;YAClC,SAAS,EAAE,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,EAAE;YACvD,SAAS,EAAE,OAAO,CAAC,KAAK;YACxB,WAAW,EAAE,OAAO,CAAC,OAAO;YAC5B,QAAQ,EAAE,WAAW;YACrB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,kDAA0B;SACnD,CAAC,CAAC;QAEH,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,aAAa,CAAC,WAAW,CAAC,CAAC;QACpD,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;QAChD,OAAO,QAAQ,CAAC,QAAQ,EAAE,CAAC;IAC7B,CAAC;IAED,KAAK,CAAC,yBAAyB,CAC7B,IAAwC,EACxC,IAAqB;QAErB,MAAM,SAAS,GAAG,IAAI,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,CAAC;QAC7C,IAAI,SAAS,KAAK,eAAe,EAAE,CAAC;YAClC,OAAO,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE,IAAI,CAAC,WAAW,CAAC,EAAE,IAAI,CAAC,CAAC;QACnF,CAAC;QAED,IAAI,SAAS,KAAK,oBAAoB,EAAE,CAAC;YACvC,MAAM,IAAI,4BAAmB,CAAC,yBAAyB,CAAC,CAAC;QAC3D,CAAC;QAED,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC;QAClC,MAAM,WAAW,GAAG,IAAI,CAAC,cAAc,CAAC,EAAE,IAAI,EAAE,CAAC;QACjD,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,CAAC;QAC3C,MAAM,YAAY,GAAG,IAAI,CAAC,eAAe,CAAC,EAAE,IAAI,EAAE,CAAC;QAEnD,IAAI,CAAC,IAAI,IAAI,CAAC,WAAW,IAAI,CAAC,QAAQ,IAAI,CAAC,YAAY,EAAE,CAAC;YACxD,MAAM,IAAI,4BAAmB,CAAC,gEAAgE,CAAC,CAAC;QAClG,CAAC;QAED,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;QAE9B,MAAM,MAAM,GAAG,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACjD,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAErC,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YAC7C,MAAM,IAAI,8BAAqB,CAAC,wCAAwC,CAAC,CAAC;QAC5E,CAAC;QAED,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,MAAM,CAAC,WAAW,KAAK,WAAW,EAAE,CAAC;YACvE,MAAM,IAAI,8BAAqB,CAAC,2DAA2D,CAAC,CAAC;QAC/F,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,YAAY,EAAE,MAAM,CAAC,aAAa,EAAE,MAAM,CAAC,mBAAmB,CAAC,EAAE,CAAC;YACrF,MAAM,IAAI,8BAAqB,CAAC,6BAA6B,CAAC,CAAC;QACjE,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAChE,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,8BAAqB,CAAC,iBAAiB,CAAC,CAAC;QACrD,CAAC;QAED,MAAM,QAAQ,GAAgB;YAC5B,EAAE,EAAE,IAAI,CAAC,EAAE;YACX,IAAI,EAAE,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,EAAE;YAC9B,KAAK,EAAE,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,EAAE;YACnD,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,IAAI;SAC5B,CAAC;QAEF,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,kBAAkB,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;QAC5D,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,2BAA2B,EAAE,CAAC;QAC5D,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,QAAQ,EAAE,QAAQ,EAAE;YAC3D,KAAK,EAAE,MAAM,CAAC,SAAS;YACvB,OAAO,EAAE,MAAM,CAAC,WAAW;SAC5B,CAAC,CAAC;QAEH,MAAM,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAE3C,OAAO;YACL,YAAY,EAAE,MAAM,CAAC,WAAW;YAChC,aAAa,EAAE,MAAM,CAAC,YAAY;YAClC,QAAQ,EAAE,OAAO;YACjB,UAAU,EAAE,QAAQ;YACpB,UAAU,EAAE,SAAS;SACtB,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,oBAAoB,CAChC,YAAgC,EAChC,QAA4B,EAC5B,IAAqB;QAErB,IAAI,CAAC,YAAY,EAAE,IAAI,EAAE,EAAE,CAAC;YAC1B,MAAM,IAAI,4BAAmB,CAAC,4BAA4B,CAAC,CAAC;QAC9D,CAAC;QAED,IAAI,QAAQ,EAAE,CAAC;YACb,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;QAChC,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,YAAY,CAAC,IAAI,EAAE,EAAE,IAAI,CAAC,CAAC;QACzE,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,2BAA2B,EAAE,CAAC;QAC5D,MAAM,OAAO,GAAG,IAAI,CAAC,uBAAuB,EAAE,CAAC;QAC/C,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,IAAI,OAAO,CAAC,CAAC,CAAC,IAAI,QAAQ,EAAE,EAAE,CAAC,CAAC;QAE9F,OAAO;YACL,YAAY,EAAE,MAAM,CAAC,WAAW;YAChC,aAAa,EAAE,MAAM,CAAC,YAAY;YAClC,QAAQ,EAAE,OAAO;YACjB,UAAU,EAAE,QAAQ;YACpB,UAAU,EAAE,SAAS;SACtB,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,iCAAiC,CAC7C,WAAmB,EACnB,IAAY,EACZ,MAAc;QAEd,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,WAAW,CAAC,CAAC;QAC3D,MAAM,WAAW,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,qBAAqB,kBAAkB,CAAC,WAAW,CAAC,EAAE,CAAC;QAEvG,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;YAC/B,IAAI;YACJ,SAAS,EAAE,MAAM,CAAC,QAAQ;YAC1B,aAAa,EAAE,MAAM,CAAC,YAAY;YAClC,YAAY,EAAE,WAAW;YACzB,UAAU,EAAE,oBAAoB;SACjC,CAAC,CAAC;QAEH,MAAM,aAAa,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,QAAQ,EAAE;YACjD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;YAChE,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE;SACtB,CAAC,CAAC;QAEH,IAAI,CAAC,aAAa,CAAC,EAAE,EAAE,CAAC;YACtB,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,IAAI,EAAE,CAAC;YAC1C,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,mCAAmC,WAAW,MAAM,MAAM,EAAE,CAAC,CAAC;YAC/E,MAAM,IAAI,8BAAqB,CAAC,GAAG,WAAW,wBAAwB,CAAC,CAAC;QAC1E,CAAC;QAED,MAAM,SAAS,GAAG,CAAC,MAAM,aAAa,CAAC,IAAI,EAAE,CAAiD,CAAC;QAC/F,IAAI,SAAS,CAAC,QAAQ,EAAE,CAAC;YACvB,OAAO,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QAC/C,CAAC;QAED,IAAI,CAAC,SAAS,CAAC,YAAY,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;YACnD,MAAM,IAAI,8BAAqB,CAAC,GAAG,WAAW,wBAAwB,CAAC,CAAC;QAC1E,CAAC;QAED,MAAM,eAAe,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,WAAW,EAAE;YACtD,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,SAAS,CAAC,YAAY,EAAE,EAAE;SAC/D,CAAC,CAAC;QAEH,IAAI,CAAC,eAAe,CAAC,EAAE,EAAE,CAAC;YACxB,MAAM,IAAI,8BAAqB,CAAC,GAAG,WAAW,yBAAyB,CAAC,CAAC;QAC3E,CAAC;QAED,OAAO,CAAC,MAAM,eAAe,CAAC,IAAI,EAAE,CAAwB,CAAC;IAC/D,CAAC;IAEO,YAAY,CAAC,OAAe;QAClC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACrB,MAAM,IAAI,8BAAqB,CAAC,mBAAmB,CAAC,CAAC;QACvD,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAE7E,CAAC;QAEF,OAAO;YACL,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,aAAa,EAAE,OAAO,CAAC,cAAc;YACrC,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,OAAO,EAAE,OAAO,CAAC,OAAO;SACzB,CAAC;IACJ,CAAC;IAEO,+BAA+B,CAAC,OAAsC;QAC5E,IAAI,OAAO,CAAC,YAAY,KAAK,MAAM,EAAE,CAAC;YACpC,MAAM,IAAI,4BAAmB,CAAC,uCAAuC,CAAC,CAAC;QACzE,CAAC;QAED,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAEtC,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,IAAI,EAAE,EAAE,CAAC;YACjC,MAAM,IAAI,4BAAmB,CAAC,2BAA2B,CAAC,CAAC;QAC7D,CAAC;QAED,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE,CAAC;YAC5B,MAAM,IAAI,4BAAmB,CAAC,qBAAqB,CAAC,CAAC;QACvD,CAAC;QAED,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,IAAI,EAAE,IAAI,OAAO,CAAC,mBAAmB,KAAK,MAAM,EAAE,CAAC;YAC7E,MAAM,IAAI,4BAAmB,CAAC,uCAAuC,CAAC,CAAC;QACzE,CAAC;IACH,CAAC;IAEO,cAAc,CAAC,QAAgB;QACrC,MAAM,OAAO,GAAG,IAAI,CAAC,uBAAuB,EAAE,CAAC;QAC/C,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YAChC,MAAM,IAAI,4BAAmB,CAAC,0BAA0B,QAAQ,EAAE,CAAC,CAAC;QACtE,CAAC;IACH,CAAC;IAEO,uBAAuB;QAC7B,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAW,6DAA6B,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;YAC3F,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACzC,OAAO,GAAG,CAAC;YACb,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,wBAAwB;QAC1B,CAAC;QACD,OAAO,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;IAClC,CAAC;IAEO,KAAK,CAAC,mBAAmB,CAAC,GAAW;QAC3C,MAAM,OAAO,GAAG,IAAI,CAAC,8BAA8B,EAAE,CAAC;QACtD,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,MAAM,OAAO,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACnE,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,oCAA2B,CAAC;gBACpC,UAAU,EAAE,GAAG;gBACf,OAAO,EACL,sBAAsB,GAAG,+CAA+C;oBACxE,wDAAwD;oBACxD,mDAAmD;gBACrD,KAAK,EAAE,+BAA+B;aACvC,CAAC,CAAC;QACL,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,8BAA8B;QACpC,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAA8B,8DAA8B,EAAE;gBACrF,MAAM,EAAE,KAAK;aACd,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAEO,UAAU,CAAC,YAAoB,EAAE,aAAqB,EAAE,MAAc;QAC5E,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;YACtB,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,MAAM,GAAG,IAAA,mBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QAC7E,IAAI,CAAC;YACH,OAAO,IAAA,wBAAe,EAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC;QAC1E,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;CACF,CAAA;AA/VY,oDAAoB;+BAApB,oBAAoB;IADhC,IAAA,mBAAU,GAAE;6CAOc,0BAAW;QACJ,4DAA2B;QAChC,4BAAY;QACT,gBAAS;GAT5B,oBAAoB,CA+VhC;AAED,YAAY"}

package/security/src/lib/oauth/platform-oauth.types.d.ts

@@ -5,7 +5,10 @@ export interface PlatformOAuthAuthorizeRequest {
     scope: string;
     codeChallenge: string;
     codeChallengeMethod: string;
+    /** IdentityProvider.key / acr_values (e.g. google). */
     provider: string;
+    /** Platform API issuer base, e.g. http://localhost:5500/api */
+    issuer: string;
     state?: string;
 }
 export interface PlatformAuthorizationCodeRecord {
@@ -18,17 +21,19 @@ export interface PlatformAuthorizationCodeRecord {
     userTitle: string;
     userEmail?: string;
     userPicture?: string;
+    provider: string;
     expiresAt: number;
 }
-export interface PlatformGoogleStateRecord {
+export interface PlatformExternalStateRecord {
     codeChallenge: string;
     codeChallengeMethod: string;
     redirectUri: string;
     clientId: string;
     provider: string;
+    issuer: string;
     expiresAt: number;
 }
-export interface GoogleProfile {
+export interface ExternalOidcProfile {
     sub: string;
     email?: string;
     emailVerified?: boolean;

package/security/src/lib/oauth/platform-oauth.types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"platform-oauth.types.d.ts","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/oauth/platform-oauth.types.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,6BAA6B;IAC5C,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,aAAa,EAAE,MAAM,CAAC;IACtB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,+BAA+B;IAC9C,aAAa,EAAE,MAAM,CAAC;IACtB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,yBAAyB;IACxC,aAAa,EAAE,MAAM,CAAC;IACtB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,aAAa;IAC5B,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,kBAAkB;IACjC,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,QAAQ,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;CACpB"}
+{"version":3,"file":"platform-oauth.types.d.ts","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/oauth/platform-oauth.types.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,6BAA6B;IAC5C,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,aAAa,EAAE,MAAM,CAAC;IACtB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,uDAAuD;IACvD,QAAQ,EAAE,MAAM,CAAC;IACjB,+DAA+D;IAC/D,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,+BAA+B;IAC9C,aAAa,EAAE,MAAM,CAAC;IACtB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,2BAA2B;IAC1C,aAAa,EAAE,MAAM,CAAC;IACtB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,mBAAmB;IAClC,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,kBAAkB;IACjC,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,QAAQ,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;CACpB"}

package/security/src/lib/oauth/platform-oauth.types.js.map

@@ -1 +1 @@
-{"version":3,"file":"platform-oauth.types.js","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/oauth/platform-oauth.types.ts"],"names":[],"mappings":";AAAA,wCAAwC;;AAmDxC,YAAY"}
+{"version":3,"file":"platform-oauth.types.js","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/oauth/platform-oauth.types.ts"],"names":[],"mappings":";AAAA,wCAAwC;;AAwDxC,YAAY"}

package/security/src/lib/runtime/runtime-permission-checker.token.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Optional Nest provider token for a single {@link RuntimePermissionChecker}.
+ * Register with `{ provide: RUNTIME_PERMISSION_CHECKER, useClass: ... }` (or `useExisting`).
+ */
+export declare const RUNTIME_PERMISSION_CHECKER: unique symbol;
+//# sourceMappingURL=runtime-permission-checker.token.d.ts.map

package/security/src/lib/runtime/runtime-permission-checker.token.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime-permission-checker.token.d.ts","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/runtime/runtime-permission-checker.token.ts"],"names":[],"mappings":"AAEA;;;GAGG;AACH,eAAO,MAAM,0BAA0B,eAAuC,CAAC"}

package/security/src/lib/runtime/runtime-permission-checker.token.js

@@ -0,0 +1,11 @@
+"use strict";
+//#region ----- Injection token -----
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RUNTIME_PERMISSION_CHECKER = void 0;
+/**
+ * Optional Nest provider token for a single {@link RuntimePermissionChecker}.
+ * Register with `{ provide: RUNTIME_PERMISSION_CHECKER, useClass: ... }` (or `useExisting`).
+ */
+exports.RUNTIME_PERMISSION_CHECKER = Symbol('RUNTIME_PERMISSION_CHECKER');
+//#endregion
+//# sourceMappingURL=runtime-permission-checker.token.js.map

package/security/src/lib/runtime/runtime-permission-checker.token.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime-permission-checker.token.js","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/runtime/runtime-permission-checker.token.ts"],"names":[],"mappings":";AAAA,qCAAqC;;;AAErC;;;GAGG;AACU,QAAA,0BAA0B,GAAG,MAAM,CAAC,4BAA4B,CAAC,CAAC;AAE/E,YAAY"}

package/security/src/lib/runtime/runtime-permission-checker.types.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Optional override for {@link RuntimePermissionService} authorization results.
+ * Apps (e.g. demo-api) can provide a single implementation via {@link RUNTIME_PERMISSION_CHECKER}.
+ */
+export interface RuntimePermissionChecker {
+    /**
+     * @param keys - Permission keys being checked (already normalized / non-empty)
+     * @param userId - Authenticated user id
+     * @param baseResult - Result from role → permission lookup
+     */
+    check(keys: string[], userId: string, baseResult: boolean): boolean | Promise<boolean>;
+}
+//# sourceMappingURL=runtime-permission-checker.types.d.ts.map

package/security/src/lib/runtime/runtime-permission-checker.types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime-permission-checker.types.d.ts","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/runtime/runtime-permission-checker.types.ts"],"names":[],"mappings":"AAEA;;;GAGG;AACH,MAAM,WAAW,wBAAwB;IACvC;;;;OAIG;IACH,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,GAAG,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACxF"}

package/security/src/lib/runtime/runtime-permission-checker.types.js

@@ -0,0 +1,5 @@
+"use strict";
+//#region ----- Runtime permission checker -----
+Object.defineProperty(exports, "__esModule", { value: true });
+//#endregion
+//# sourceMappingURL=runtime-permission-checker.types.js.map

package/security/src/lib/runtime/runtime-permission-checker.types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime-permission-checker.types.js","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/runtime/runtime-permission-checker.types.ts"],"names":[],"mappings":";AAAA,gDAAgD;;AAehD,YAAY"}

package/security/src/lib/runtime/runtime-permission.service.d.ts

@@ -0,0 +1,31 @@
+import { EntityStorageMiddlewareService } from '@acorex-platform/framework-server/core';
+import type { RuntimePermissionChecker } from './runtime-permission-checker.types';
+/**
+ * Resolves platform user permissions from scoped UserRole assignments for runtime authz.
+ * Per-request cache (on the HTTP request object) avoids repeated role lookups during bulk runtime operations.
+ * Apps may override results via an optional {@link RUNTIME_PERMISSION_CHECKER} provider.
+ */
+export declare class RuntimePermissionService {
+    private readonly entityStorage;
+    private readonly permissionChecker?;
+    private readonly fallbackCache;
+    constructor(entityStorage: EntityStorageMiddlewareService, permissionChecker?: (RuntimePermissionChecker | null) | undefined);
+    /**
+     * Returns true when the user has all requested permission keys.
+     */
+    authorize(userId: string | undefined, ...keys: string[]): Promise<boolean>;
+    /**
+     * Ensures the user has all requested permission keys; throws {@link ForbiddenException} otherwise.
+     */
+    requirePermissions(userId: string | undefined, ...keys: string[]): Promise<void>;
+    /**
+     * Loads deduplicated permission keys for a platform user.
+     */
+    loadUserPermissions(userId: string): Promise<string[]>;
+    private buildCacheKey;
+    private resolveSession;
+    private resolveCache;
+    private resolvePermissionsForUser;
+    private findActiveTenantMembership;
+}
+//# sourceMappingURL=runtime-permission.service.d.ts.map

package/security/src/lib/runtime/runtime-permission.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime-permission.service.d.ts","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/runtime/runtime-permission.service.ts"],"names":[],"mappings":"AACA,OAAO,EACL,8BAA8B,EAE/B,MAAM,wCAAwC,CAAC;AAWhD,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,oCAAoC,CAAC;AAwBnF;;;;GAIG;AACH,qBACa,wBAAwB;IAIjC,OAAO,CAAC,QAAQ,CAAC,aAAa;IAG9B,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAC;IANrC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAA+B;gBAG1C,aAAa,EAAE,8BAA8B,EAG7C,iBAAiB,CAAC,GAAE,wBAAwB,GAAG,IAAI,aAAA;IAGtE;;OAEG;IACG,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC;IAmBhF;;OAEG;IACG,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAUtF;;OAEG;IACG,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAoB5D,OAAO,CAAC,aAAa;IAKrB,OAAO,CAAC,cAAc;IAKtB,OAAO,CAAC,YAAY;YASN,yBAAyB;YAmEzB,0BAA0B;CAiCzC"}