@acorex-platform/framework-server 0.0.18 → 0.0.20

package/search/elasticsearch/src/lib/elasticsearch-quick-search.mapping.js

@@ -0,0 +1,43 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.QUICK_SEARCH_INDEX_PROPERTIES = void 0;
+exports.isQuickSearchMappingCompatible = isQuickSearchMappingCompatible;
+exports.getMissingQuickSearchIndexProperties = getMissingQuickSearchIndexProperties;
+const elasticsearch_quick_search_query_1 = require("./elasticsearch-quick-search.query");
+//#endregion
+//#region ----- Mapping helpers -----
+exports.QUICK_SEARCH_INDEX_PROPERTIES = {
+    refId: { type: 'keyword' },
+    refType: { type: 'keyword' },
+    content: { type: 'text' },
+    [elasticsearch_quick_search_query_1.QUICK_SEARCH_FOLDED_FIELD]: { type: 'wildcard' },
+};
+/**
+ * Elasticsearch rejects putMapping when an existing field type differs (e.g. dynamic `text` vs `keyword`).
+ * Detect legacy or drifted indexes before attempting updates.
+ */
+function isQuickSearchMappingCompatible(properties) {
+    if (!properties) {
+        return false;
+    }
+    return (properties.refId?.type === 'keyword' &&
+        properties.refType?.type === 'keyword' &&
+        properties.content?.type === 'text' &&
+        properties[elasticsearch_quick_search_query_1.QUICK_SEARCH_FOLDED_FIELD]?.type === 'wildcard');
+}
+/** Returns only properties that are absent from the current index mapping. */
+function getMissingQuickSearchIndexProperties(existing) {
+    const missing = {};
+    copyMissingIndexProperty('refId', existing, missing);
+    copyMissingIndexProperty('refType', existing, missing);
+    copyMissingIndexProperty('content', existing, missing);
+    copyMissingIndexProperty(elasticsearch_quick_search_query_1.QUICK_SEARCH_FOLDED_FIELD, existing, missing);
+    return missing;
+}
+function copyMissingIndexProperty(field, existing, missing) {
+    if (!existing?.[field]) {
+        missing[field] = exports.QUICK_SEARCH_INDEX_PROPERTIES[field];
+    }
+}
+//#endregion
+//# sourceMappingURL=elasticsearch-quick-search.mapping.js.map

package/search/elasticsearch/src/lib/elasticsearch-quick-search.mapping.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"elasticsearch-quick-search.mapping.js","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/search/elasticsearch/src/lib/elasticsearch-quick-search.mapping.ts"],"names":[],"mappings":";;;AAyBA,wEAaC;AAGD,oFAWC;AApDD,yFAA+E;AAU/E,YAAY;AAEZ,qCAAqC;AAExB,QAAA,6BAA6B,GAAG;IAC3C,KAAK,EAAE,EAAE,IAAI,EAAE,SAAkB,EAAE;IACnC,OAAO,EAAE,EAAE,IAAI,EAAE,SAAkB,EAAE;IACrC,OAAO,EAAE,EAAE,IAAI,EAAE,MAAe,EAAE;IAClC,CAAC,4DAAyB,CAAC,EAAE,EAAE,IAAI,EAAE,UAAmB,EAAE;CAC3D,CAAC;AAEF;;;GAGG;AACH,SAAgB,8BAA8B,CAC5C,UAAkD;IAElD,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO,CACL,UAAU,CAAC,KAAK,EAAE,IAAI,KAAK,SAAS;QACpC,UAAU,CAAC,OAAO,EAAE,IAAI,KAAK,SAAS;QACtC,UAAU,CAAC,OAAO,EAAE,IAAI,KAAK,MAAM;QACnC,UAAU,CAAC,4DAAyB,CAAC,EAAE,IAAI,KAAK,UAAU,CAC3D,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,SAAgB,oCAAoC,CAClD,QAAgD;IAEhD,MAAM,OAAO,GAAkD,EAAE,CAAC;IAElE,wBAAwB,CAAC,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;IACrD,wBAAwB,CAAC,SAAS,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;IACvD,wBAAwB,CAAC,SAAS,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;IACvD,wBAAwB,CAAC,4DAAyB,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;IAEvE,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,wBAAwB,CAC/B,KAAQ,EACR,QAAgD,EAChD,OAAsD;IAEtD,IAAI,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,CAAC,KAAK,CAAC,GAAG,qCAA6B,CAAC,KAAK,CAAC,CAAC;IACxD,CAAC;AACH,CAAC;AAED,YAAY"}

package/search/providers/src/lib/quick-search-provider.module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"quick-search-provider.module.d.ts","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/search/providers/src/lib/quick-search-provider.module.ts"],"names":[],"mappings":"AAMA,OAAO,EAKL,KAAK,iBAAiB,EACvB,MAAM,mDAAmD,CAAC;AAK3D,OAAO,EACL,aAAa,EAKd,MAAM,gBAAgB,CAAC;AAiBxB,MAAM,WAAW,gCAAgC;IAC/C,4CAA4C;IAC5C,QAAQ,CAAC,EAAE,iBAAiB,CAAC,UAAU,CAAC,CAAC;CAC1C;AAMD,qBAEa,yBAAyB;IACpC,MAAM,CAAC,OAAO,CACZ,OAAO,GAAE,gCAAqC,GAC7C,aAAa;CAmFjB"}
+{"version":3,"file":"quick-search-provider.module.d.ts","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/search/providers/src/lib/quick-search-provider.module.ts"],"names":[],"mappings":"AAMA,OAAO,EAKL,KAAK,iBAAiB,EACvB,MAAM,mDAAmD,CAAC;AAK3D,OAAO,EACL,aAAa,EAKd,MAAM,gBAAgB,CAAC;AAiBxB,MAAM,WAAW,gCAAgC;IAC/C,4CAA4C;IAC5C,QAAQ,CAAC,EAAE,iBAAiB,CAAC,UAAU,CAAC,CAAC;CAC1C;AAMD,qBAEa,yBAAyB;IACpC,MAAM,CAAC,OAAO,CACZ,OAAO,GAAE,gCAAqC,GAC7C,aAAa;CAoFjB"}

package/search/providers/src/lib/quick-search-provider.module.js

@@ -63,6 +63,7 @@ let QuickSearchProviderModule = QuickSearchProviderModule_1 = class QuickSearchP
             });
             providers.push({
                 provide: seed_1.JQL_SEED_AFTER_ENTITY_HOOK,
+                multi: true,
                 useFactory: (reindex) => (entityName, _context) => reindex.reindexEntity(entityName),
                 inject: [quick_search_reindex_service_1.QuickSearchReindexService],
             });

package/search/providers/src/lib/quick-search-provider.module.js.map

@@ -1 +1 @@
-{"version":3,"file":"quick-search-provider.module.js","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/search/providers/src/lib/quick-search-provider.module.ts"],"names":[],"mappings":";;;;;AAAA,iEAGgD;AAChD,kFAA0F;AAC1F,yEAA+E;AAC/E,gFAM2D;AAC3D,0FAGgE;AAChE,2CAMwB;AACxB,mFAIyC;AACzC,iFAA2E;AAC3E,iFAA2E;AAC3E,6EAAuE;AACvE,qEAIoD;AASpD,YAAY;AAEZ,gDAAgD;AAIzC,IAAM,yBAAyB,iCAA/B,MAAM,yBAAyB;IACpC,MAAM,CAAC,OAAO,CACZ,UAA4C,EAAE;QAE9C,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,IAAA,0DAA0B,GAAE,CAAC;QAClE,MAAM,MAAM,GAAG,IAAI,eAAM,CAAC,2BAAyB,CAAC,IAAI,CAAC,CAAC;QAC1D,MAAM,CAAC,GAAG,CAAC,0BAA0B,QAAQ,EAAE,CAAC,CAAC;QAEjD,MAAM,MAAM,GAAsB;YAChC,QAAQ;YACR,SAAS,EAAE,IAAA,2DAA2B,GAAE;YACxC,OAAO,EAAE,IAAA,2DAA2B,GAAE;SACvC,CAAC;QAEF,MAAM,OAAO,GACX,QAAQ,KAAK,eAAe;YAC1B,CAAC,CAAC;gBACE,0BAAmB;gBACnB,wBAAe;gBACf,gCAAoB;gBACpB,8CAA8B;aAC/B;YACH,CAAC,CAAC,CAAC,wBAAe,CAAC,CAAC;QAExB,MAAM,SAAS,GAAe;YAC5B,EAAE,OAAO,EAAE,8BAAmB,EAAE,QAAQ,EAAE,MAAM,EAAE;YAClD,EAAE,OAAO,EAAE,qCAA0B,EAAE,QAAQ,EAAE,QAAQ,EAAE;YAC3D,oDAAuB;YACvB,wDAAyB;YACzB,wDAAyB;YACzB;gBACE,OAAO,EAAE,gCAAyB;gBAClC,WAAW,EAAE,wDAAyB;gBACtC,KAAK,EAAE,IAAI;aACA;SACd,CAAC;QAEF,IAAI,QAAQ,KAAK,eAAe,EAAE,CAAC;YACjC,SAAS,CAAC,IAAI,CAAC;gBACb,OAAO,EAAE,+BAAoB;gBAC7B,WAAW,EAAE,+CAA+B;aAC7C,CAAC,CAAC;YACH,SAAS,CAAC,IAAI,CAAC;gBACb,OAAO,EAAE,gCAAyB;gBAClC,UAAU,EACR,CAAC,OAAkC,EAAE,EAAE,CACvC,KAAK,EAAE,OAAgC,EAAE,EAAE;oBACzC,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;wBACtB,OAAO;oBACT,CAAC;oBAED,MAAM,OAAO,CAAC,qBAAqB,EAAE,CAAC;gBACxC,CAAC;gBACH,MAAM,EAAE,CAAC,wDAAyB,CAAC;aACpC,CAAC,CAAC;YACH,SAAS,CAAC,IAAI,CAAC;gBACb,OAAO,EAAE,iCAA0B;gBACnC,UAAU,EACR,CAAC,OAAkC,EAAE,EAAE,CACvC,CAAC,UAAkB,EAAE,QAAiC,EAAE,EAAE,CACxD,OAAO,CAAC,aAAa,CAAC,UAAU,CAAC;gBACrC,MAAM,EAAE,CAAC,wDAAyB,CAAC;aACpC,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,SAAS,CAAC,IAAI,CAAC;gBACb,OAAO,EAAE,+BAAoB;gBAC7B,QAAQ,EAAE,iCAAsB;aACjC,CAAC,CAAC;QACL,CAAC;QAED,OAAO;YACL,MAAM,EAAE,2BAAyB;YACjC,OAAO;YACP,SAAS;YACT,OAAO,EAAE;gBACP,+BAAoB;gBACpB,qCAA0B;gBAC1B,8BAAmB;gBACnB,oDAAuB;gBACvB,wDAAyB;gBACzB,gCAAyB;gBACzB,gCAAyB;gBACzB,iCAA0B;aAC3B;SACF,CAAC;IACJ,CAAC;CACF,CAAA;AAtFY,8DAAyB;oCAAzB,yBAAyB;IAFrC,IAAA,eAAM,GAAE;IACR,IAAA,eAAM,EAAC,EAAE,CAAC;GACE,yBAAyB,CAsFrC;AAED,YAAY"}
+{"version":3,"file":"quick-search-provider.module.js","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/search/providers/src/lib/quick-search-provider.module.ts"],"names":[],"mappings":";;;;;AAAA,iEAGgD;AAChD,kFAA0F;AAC1F,yEAA+E;AAC/E,gFAM2D;AAC3D,0FAGgE;AAChE,2CAMwB;AACxB,mFAIyC;AACzC,iFAA2E;AAC3E,iFAA2E;AAC3E,6EAAuE;AACvE,qEAIoD;AASpD,YAAY;AAEZ,gDAAgD;AAIzC,IAAM,yBAAyB,iCAA/B,MAAM,yBAAyB;IACpC,MAAM,CAAC,OAAO,CACZ,UAA4C,EAAE;QAE9C,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,IAAA,0DAA0B,GAAE,CAAC;QAClE,MAAM,MAAM,GAAG,IAAI,eAAM,CAAC,2BAAyB,CAAC,IAAI,CAAC,CAAC;QAC1D,MAAM,CAAC,GAAG,CAAC,0BAA0B,QAAQ,EAAE,CAAC,CAAC;QAEjD,MAAM,MAAM,GAAsB;YAChC,QAAQ;YACR,SAAS,EAAE,IAAA,2DAA2B,GAAE;YACxC,OAAO,EAAE,IAAA,2DAA2B,GAAE;SACvC,CAAC;QAEF,MAAM,OAAO,GACX,QAAQ,KAAK,eAAe;YAC1B,CAAC,CAAC;gBACE,0BAAmB;gBACnB,wBAAe;gBACf,gCAAoB;gBACpB,8CAA8B;aAC/B;YACH,CAAC,CAAC,CAAC,wBAAe,CAAC,CAAC;QAExB,MAAM,SAAS,GAAe;YAC5B,EAAE,OAAO,EAAE,8BAAmB,EAAE,QAAQ,EAAE,MAAM,EAAE;YAClD,EAAE,OAAO,EAAE,qCAA0B,EAAE,QAAQ,EAAE,QAAQ,EAAE;YAC3D,oDAAuB;YACvB,wDAAyB;YACzB,wDAAyB;YACzB;gBACE,OAAO,EAAE,gCAAyB;gBAClC,WAAW,EAAE,wDAAyB;gBACtC,KAAK,EAAE,IAAI;aACA;SACd,CAAC;QAEF,IAAI,QAAQ,KAAK,eAAe,EAAE,CAAC;YACjC,SAAS,CAAC,IAAI,CAAC;gBACb,OAAO,EAAE,+BAAoB;gBAC7B,WAAW,EAAE,+CAA+B;aAC7C,CAAC,CAAC;YACH,SAAS,CAAC,IAAI,CAAC;gBACb,OAAO,EAAE,gCAAyB;gBAClC,UAAU,EACR,CAAC,OAAkC,EAAE,EAAE,CACvC,KAAK,EAAE,OAAgC,EAAE,EAAE;oBACzC,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;wBACtB,OAAO;oBACT,CAAC;oBAED,MAAM,OAAO,CAAC,qBAAqB,EAAE,CAAC;gBACxC,CAAC;gBACH,MAAM,EAAE,CAAC,wDAAyB,CAAC;aACpC,CAAC,CAAC;YACH,SAAS,CAAC,IAAI,CAAC;gBACb,OAAO,EAAE,iCAA0B;gBACnC,KAAK,EAAE,IAAI;gBACX,UAAU,EACR,CAAC,OAAkC,EAAE,EAAE,CACvC,CAAC,UAAkB,EAAE,QAAiC,EAAE,EAAE,CACxD,OAAO,CAAC,aAAa,CAAC,UAAU,CAAC;gBACrC,MAAM,EAAE,CAAC,wDAAyB,CAAC;aACxB,CAAC,CAAC;QACjB,CAAC;aAAM,CAAC;YACN,SAAS,CAAC,IAAI,CAAC;gBACb,OAAO,EAAE,+BAAoB;gBAC7B,QAAQ,EAAE,iCAAsB;aACjC,CAAC,CAAC;QACL,CAAC;QAED,OAAO;YACL,MAAM,EAAE,2BAAyB;YACjC,OAAO;YACP,SAAS;YACT,OAAO,EAAE;gBACP,+BAAoB;gBACpB,qCAA0B;gBAC1B,8BAAmB;gBACnB,oDAAuB;gBACvB,wDAAyB;gBACzB,gCAAyB;gBACzB,gCAAyB;gBACzB,iCAA0B;aAC3B;SACF,CAAC;IACJ,CAAC;CACF,CAAA;AAvFY,8DAAyB;oCAAzB,yBAAyB;IAFrC,IAAA,eAAM,GAAE;IACR,IAAA,eAAM,EAAC,EAAE,CAAC;GACE,yBAAyB,CAuFrC;AAED,YAAY"}

package/security/src/index.d.ts

@@ -4,10 +4,13 @@ export * from './lib/auth/token.service';
 export * from './lib/auth/token-resolver.service';
 export * from './lib/auth/auth-cookie.service';
 export * from './lib/auth/login-attempt.service';
+export * from './lib/auth/auth-lockout-policy';
 export * from './lib/auth/auth.config';
 export * from './lib/auth/machine-token.service';
 export * from './lib/auth/auth.types';
+export * from './lib/auth/auth.events';
 export * from './lib/auth/auth-providers.contributor';
+export * from './lib/auth/auth-identity-provider.source';
 export * from './lib/auth/public.decorator';
 export * from './lib/auth/jwt-auth.guard';
 export * from './lib/session/backend-session.service';
@@ -15,7 +18,13 @@ export * from './lib/session/backend-session.types';
 export * from './lib/session/current-session.decorator';
 export * from './lib/session/session-context.service';
 export * from './lib/session/session-context.types';
+export * from './lib/session/session-access-policy.util';
 export * from './lib/session/optional-jwt-session.middleware';
 export * from './lib/entity-storage/visibility-filter.middleware';
+export * from './lib/entity-storage/entity-access-policy.loader';
 export * from './lib/entity-storage/policy-enforce.middleware';
+export * from './lib/runtime/runtime-permission.service';
+export * from './lib/runtime/runtime-permission.util';
+export * from './lib/runtime/runtime-permission-checker.token';
+export * from './lib/runtime/runtime-permission-checker.types';
 //# sourceMappingURL=index.d.ts.map

package/security/src/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../../libs/framework/server/security/src/index.ts"],"names":[],"mappings":"AAAA,cAAc,uBAAuB,CAAC;AACtC,cAAc,yBAAyB,CAAC;AACxC,cAAc,0BAA0B,CAAC;AACzC,cAAc,mCAAmC,CAAC;AAClD,cAAc,gCAAgC,CAAC;AAC/C,cAAc,kCAAkC,CAAC;AACjD,cAAc,wBAAwB,CAAC;AACvC,cAAc,kCAAkC,CAAC;AACjD,cAAc,uBAAuB,CAAC;AACtC,cAAc,uCAAuC,CAAC;AACtD,cAAc,6BAA6B,CAAC;AAC5C,cAAc,2BAA2B,CAAC;AAC1C,cAAc,uCAAuC,CAAC;AACtD,cAAc,qCAAqC,CAAC;AACpD,cAAc,yCAAyC,CAAC;AACxD,cAAc,uCAAuC,CAAC;AACtD,cAAc,qCAAqC,CAAC;AACpD,cAAc,+CAA+C,CAAC;AAC9D,cAAc,mDAAmD,CAAC;AAClE,cAAc,gDAAgD,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../../libs/framework/server/security/src/index.ts"],"names":[],"mappings":"AAAA,cAAc,uBAAuB,CAAC;AACtC,cAAc,yBAAyB,CAAC;AACxC,cAAc,0BAA0B,CAAC;AACzC,cAAc,mCAAmC,CAAC;AAClD,cAAc,gCAAgC,CAAC;AAC/C,cAAc,kCAAkC,CAAC;AACjD,cAAc,gCAAgC,CAAC;AAC/C,cAAc,wBAAwB,CAAC;AACvC,cAAc,kCAAkC,CAAC;AACjD,cAAc,uBAAuB,CAAC;AACtC,cAAc,wBAAwB,CAAC;AACvC,cAAc,uCAAuC,CAAC;AACtD,cAAc,0CAA0C,CAAC;AACzD,cAAc,6BAA6B,CAAC;AAC5C,cAAc,2BAA2B,CAAC;AAC1C,cAAc,uCAAuC,CAAC;AACtD,cAAc,qCAAqC,CAAC;AACpD,cAAc,yCAAyC,CAAC;AACxD,cAAc,uCAAuC,CAAC;AACtD,cAAc,qCAAqC,CAAC;AACpD,cAAc,0CAA0C,CAAC;AACzD,cAAc,+CAA+C,CAAC;AAC9D,cAAc,mDAAmD,CAAC;AAClE,cAAc,kDAAkD,CAAC;AACjE,cAAc,gDAAgD,CAAC;AAC/D,cAAc,0CAA0C,CAAC;AACzD,cAAc,uCAAuC,CAAC;AACtD,cAAc,gDAAgD,CAAC;AAC/D,cAAc,gDAAgD,CAAC"}

package/security/src/index.js

@@ -7,10 +7,13 @@ tslib_1.__exportStar(require("./lib/auth/token.service"), exports);
 tslib_1.__exportStar(require("./lib/auth/token-resolver.service"), exports);
 tslib_1.__exportStar(require("./lib/auth/auth-cookie.service"), exports);
 tslib_1.__exportStar(require("./lib/auth/login-attempt.service"), exports);
+tslib_1.__exportStar(require("./lib/auth/auth-lockout-policy"), exports);
 tslib_1.__exportStar(require("./lib/auth/auth.config"), exports);
 tslib_1.__exportStar(require("./lib/auth/machine-token.service"), exports);
 tslib_1.__exportStar(require("./lib/auth/auth.types"), exports);
+tslib_1.__exportStar(require("./lib/auth/auth.events"), exports);
 tslib_1.__exportStar(require("./lib/auth/auth-providers.contributor"), exports);
+tslib_1.__exportStar(require("./lib/auth/auth-identity-provider.source"), exports);
 tslib_1.__exportStar(require("./lib/auth/public.decorator"), exports);
 tslib_1.__exportStar(require("./lib/auth/jwt-auth.guard"), exports);
 tslib_1.__exportStar(require("./lib/session/backend-session.service"), exports);
@@ -18,7 +21,13 @@ tslib_1.__exportStar(require("./lib/session/backend-session.types"), exports);
 tslib_1.__exportStar(require("./lib/session/current-session.decorator"), exports);
 tslib_1.__exportStar(require("./lib/session/session-context.service"), exports);
 tslib_1.__exportStar(require("./lib/session/session-context.types"), exports);
+tslib_1.__exportStar(require("./lib/session/session-access-policy.util"), exports);
 tslib_1.__exportStar(require("./lib/session/optional-jwt-session.middleware"), exports);
 tslib_1.__exportStar(require("./lib/entity-storage/visibility-filter.middleware"), exports);
+tslib_1.__exportStar(require("./lib/entity-storage/entity-access-policy.loader"), exports);
 tslib_1.__exportStar(require("./lib/entity-storage/policy-enforce.middleware"), exports);
+tslib_1.__exportStar(require("./lib/runtime/runtime-permission.service"), exports);
+tslib_1.__exportStar(require("./lib/runtime/runtime-permission.util"), exports);
+tslib_1.__exportStar(require("./lib/runtime/runtime-permission-checker.token"), exports);
+tslib_1.__exportStar(require("./lib/runtime/runtime-permission-checker.types"), exports);
 //# sourceMappingURL=index.js.map

package/security/src/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../../libs/framework/server/security/src/index.ts"],"names":[],"mappings":";;;AAAA,gEAAsC;AACtC,kEAAwC;AACxC,mEAAyC;AACzC,4EAAkD;AAClD,yEAA+C;AAC/C,2EAAiD;AACjD,iEAAuC;AACvC,2EAAiD;AACjD,gEAAsC;AACtC,gFAAsD;AACtD,sEAA4C;AAC5C,oEAA0C;AAC1C,gFAAsD;AACtD,8EAAoD;AACpD,kFAAwD;AACxD,gFAAsD;AACtD,8EAAoD;AACpD,wFAA8D;AAC9D,4FAAkE;AAClE,yFAA+D"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../../libs/framework/server/security/src/index.ts"],"names":[],"mappings":";;;AAAA,gEAAsC;AACtC,kEAAwC;AACxC,mEAAyC;AACzC,4EAAkD;AAClD,yEAA+C;AAC/C,2EAAiD;AACjD,yEAA+C;AAC/C,iEAAuC;AACvC,2EAAiD;AACjD,gEAAsC;AACtC,iEAAuC;AACvC,gFAAsD;AACtD,mFAAyD;AACzD,sEAA4C;AAC5C,oEAA0C;AAC1C,gFAAsD;AACtD,8EAAoD;AACpD,kFAAwD;AACxD,gFAAsD;AACtD,8EAAoD;AACpD,mFAAyD;AACzD,wFAA8D;AAC9D,4FAAkE;AAClE,2FAAiE;AACjE,yFAA+D;AAC/D,mFAAyD;AACzD,gFAAsD;AACtD,yFAA+D;AAC/D,yFAA+D"}

package/security/src/lib/auth/auth-cookie-response.util.d.ts

@@ -0,0 +1,11 @@
+import type { Request, Response } from 'express';
+import { AuthCookieService } from './auth-cookie.service';
+import type { AuthTokenResponseDto } from './auth.types';
+import { TokenService } from './token.service';
+/** Express response attached to the active request, when available. */
+export declare function resolveAuthHttpResponse(request: Request): Response | null;
+/** Sets HttpOnly access + refresh cookies for the SPA session. */
+export declare function applyAuthTokenCookies(request: Request, cookies: AuthCookieService, tokens: TokenService, data: AuthTokenResponseDto): void;
+/** Clears auth cookies on logout / failed session restore. */
+export declare function clearAuthTokenCookies(request: Request, cookies: AuthCookieService): void;
+//# sourceMappingURL=auth-cookie-response.util.d.ts.map

package/security/src/lib/auth/auth-cookie-response.util.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-cookie-response.util.d.ts","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/auth/auth-cookie-response.util.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACjD,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC1D,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AACzD,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAM/C,uEAAuE;AACvE,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,OAAO,GAAG,QAAQ,GAAG,IAAI,CAGzE;AAED,kEAAkE;AAClE,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,OAAO,EAChB,OAAO,EAAE,iBAAiB,EAC1B,MAAM,EAAE,YAAY,EACpB,IAAI,EAAE,oBAAoB,GACzB,IAAI,CAYN;AAED,8DAA8D;AAC9D,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,iBAAiB,GAAG,IAAI,CAOxF"}

package/security/src/lib/auth/auth-cookie-response.util.js

@@ -0,0 +1,36 @@
+"use strict";
+//#region ----- Imports -----
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolveAuthHttpResponse = resolveAuthHttpResponse;
+exports.applyAuthTokenCookies = applyAuthTokenCookies;
+exports.clearAuthTokenCookies = clearAuthTokenCookies;
+//#endregion
+//#region ----- Auth cookie response helpers -----
+/** Express response attached to the active request, when available. */
+function resolveAuthHttpResponse(request) {
+    const res = request.res;
+    return res ?? null;
+}
+/** Sets HttpOnly access + refresh cookies for the SPA session. */
+function applyAuthTokenCookies(request, cookies, tokens, data) {
+    const res = resolveAuthHttpResponse(request);
+    if (!res) {
+        return;
+    }
+    cookies.applyAuthCookies(res, {
+        accessToken: data.accessToken,
+        refreshToken: data.refreshToken,
+        accessMaxAgeMs: tokens.accessTokenMaxAgeMs(),
+        refreshMaxAgeMs: tokens.refreshTokenMaxAgeMs(),
+    });
+}
+/** Clears auth cookies on logout / failed session restore. */
+function clearAuthTokenCookies(request, cookies) {
+    const res = resolveAuthHttpResponse(request);
+    if (!res) {
+        return;
+    }
+    cookies.clearAuthCookies(res);
+}
+//#endregion
+//# sourceMappingURL=auth-cookie-response.util.js.map

package/security/src/lib/auth/auth-cookie-response.util.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-cookie-response.util.js","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/auth/auth-cookie-response.util.ts"],"names":[],"mappings":";AAAA,6BAA6B;;AAY7B,0DAGC;AAGD,sDAiBC;AAGD,sDAOC;AAtCD,YAAY;AAEZ,kDAAkD;AAElD,uEAAuE;AACvE,SAAgB,uBAAuB,CAAC,OAAgB;IACtD,MAAM,GAAG,GAAI,OAAwC,CAAC,GAAG,CAAC;IAC1D,OAAO,GAAG,IAAI,IAAI,CAAC;AACrB,CAAC;AAED,kEAAkE;AAClE,SAAgB,qBAAqB,CACnC,OAAgB,EAChB,OAA0B,EAC1B,MAAoB,EACpB,IAA0B;IAE1B,MAAM,GAAG,GAAG,uBAAuB,CAAC,OAAO,CAAC,CAAC;IAC7C,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,OAAO;IACT,CAAC;IAED,OAAO,CAAC,gBAAgB,CAAC,GAAG,EAAE;QAC5B,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,cAAc,EAAE,MAAM,CAAC,mBAAmB,EAAE;QAC5C,eAAe,EAAE,MAAM,CAAC,oBAAoB,EAAE;KAC/C,CAAC,CAAC;AACL,CAAC;AAED,8DAA8D;AAC9D,SAAgB,qBAAqB,CAAC,OAAgB,EAAE,OAA0B;IAChF,MAAM,GAAG,GAAG,uBAAuB,CAAC,OAAO,CAAC,CAAC;IAC7C,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,OAAO;IACT,CAAC;IAED,OAAO,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC;AAChC,CAAC;AAED,YAAY"}

package/security/src/lib/auth/auth-cookie.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-cookie.service.d.ts","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/auth/auth-cookie.service.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAiB,QAAQ,EAAE,MAAM,SAAS,CAAC;AAWvD,qBACa,iBAAiB;IAC5B,gBAAgB,CACd,GAAG,EAAE,QAAQ,EACb,MAAM,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,cAAc,CAAC,EAAE,MAAM,CAAC;QAAC,eAAe,CAAC,EAAE,MAAM,CAAA;KAAE,GACvG,IAAI;IAgBP,gBAAgB,CAAC,GAAG,EAAE,QAAQ,GAAG,IAAI;IAYrC,gBAAgB,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,GAAG,MAAM,GAAG,IAAI;IAQ7E,qBAAqB,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,GAAG,MAAM,GAAG,IAAI;IAQlF,OAAO,CAAC,oBAAoB;IAS5B,OAAO,CAAC,mBAAmB;IAS3B,OAAO,CAAC,iBAAiB;CAM1B"}
+{"version":3,"file":"auth-cookie.service.d.ts","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/auth/auth-cookie.service.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAiB,QAAQ,EAAE,MAAM,SAAS,CAAC;AAWvD,qBACa,iBAAiB;IAC5B,gBAAgB,CACd,GAAG,EAAE,QAAQ,EACb,MAAM,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,cAAc,CAAC,EAAE,MAAM,CAAC;QAAC,eAAe,CAAC,EAAE,MAAM,CAAA;KAAE,GACvG,IAAI;IAcP,gBAAgB,CAAC,GAAG,EAAE,QAAQ,GAAG,IAAI;IAYrC,gBAAgB,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,GAAG,MAAM,GAAG,IAAI;IAQ7E,qBAAqB,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,GAAG,MAAM,GAAG,IAAI;IAQlF,OAAO,CAAC,oBAAoB;IAS5B,OAAO,CAAC,mBAAmB;IAS3B,OAAO,CAAC,iBAAiB;CAM1B"}

package/security/src/lib/auth/auth-cookie.service.js

@@ -8,9 +8,7 @@ const auth_config_1 = require("./auth.config");
 let AuthCookieService = class AuthCookieService {
     applyAuthCookies(res, tokens) {
         res.cookie(auth_config_1.AUTH_COOKIE_REFRESH_TOKEN, tokens.refreshToken, this.refreshCookieOptions(tokens.refreshMaxAgeMs));
-        if (tokens.accessMaxAgeMs) {
-            res.cookie(auth_config_1.AUTH_COOKIE_ACCESS_TOKEN, tokens.accessToken, this.accessCookieOptions(tokens.accessMaxAgeMs));
-        }
+        res.cookie(auth_config_1.AUTH_COOKIE_ACCESS_TOKEN, tokens.accessToken, this.accessCookieOptions(tokens.accessMaxAgeMs ?? 30 * 60 * 1000));
     }
     clearAuthCookies(res) {
         const base = this.baseCookieOptions();

package/security/src/lib/auth/auth-cookie.service.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth-cookie.service.js","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/auth/auth-cookie.service.ts"],"names":[],"mappings":";;;;AAAA,2CAA4C;AAE5C,+CAMuB;AAEvB,uCAAuC;AAGhC,IAAM,iBAAiB,GAAvB,MAAM,iBAAiB;IAC5B,gBAAgB,CACd,GAAa,EACb,MAAwG;QAExG,GAAG,CAAC,MAAM,CACR,uCAAyB,EACzB,MAAM,CAAC,YAAY,EACnB,IAAI,CAAC,oBAAoB,CAAC,MAAM,CAAC,eAAe,CAAC,CAClD,CAAC;QAEF,IAAI,MAAM,CAAC,cAAc,EAAE,CAAC;YAC1B,GAAG,CAAC,MAAM,CACR,sCAAwB,EACxB,MAAM,CAAC,WAAW,EAClB,IAAI,CAAC,mBAAmB,CAAC,MAAM,CAAC,cAAc,CAAC,CAChD,CAAC;QACJ,CAAC;IACH,CAAC;IAED,gBAAgB,CAAC,GAAa;QAC5B,MAAM,IAAI,GAAG,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACtC,GAAG,CAAC,WAAW,CAAC,uCAAyB,EAAE;YACzC,GAAG,IAAI;YACP,IAAI,EAAE,IAAA,sCAAwB,GAAE;SACjC,CAAC,CAAC;QACH,GAAG,CAAC,WAAW,CAAC,sCAAwB,EAAE;YACxC,GAAG,IAAI;YACP,IAAI,EAAE,GAAG;SACV,CAAC,CAAC;IACL,CAAC;IAED,gBAAgB,CAAC,OAA4C;QAC3D,MAAM,KAAK,GAAG,OAAO,EAAE,CAAC,uCAAyB,CAAC,CAAC;QACnD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;YAC/C,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC;IACtB,CAAC;IAED,qBAAqB,CAAC,OAA4C;QAChE,MAAM,KAAK,GAAG,OAAO,EAAE,CAAC,sCAAwB,CAAC,CAAC;QAClD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;YAC/C,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC;IACtB,CAAC;IAEO,oBAAoB,CAAC,QAAiB;QAC5C,OAAO;YACL,GAAG,IAAI,CAAC,iBAAiB,EAAE;YAC3B,QAAQ,EAAE,IAAI;YACd,IAAI,EAAE,IAAA,sCAAwB,GAAE;YAChC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC1C,CAAC;IACJ,CAAC;IAEO,mBAAmB,CAAC,QAAgB;QAC1C,OAAO;YACL,GAAG,IAAI,CAAC,iBAAiB,EAAE;YAC3B,QAAQ,EAAE,IAAI;YACd,IAAI,EAAE,GAAG;YACT,MAAM,EAAE,QAAQ;SACjB,CAAC;IACJ,CAAC;IAEO,iBAAiB;QACvB,OAAO;YACL,MAAM,EAAE,IAAA,gCAAkB,GAAE;YAC5B,QAAQ,EAAE,IAAA,mCAAqB,GAAE;SAClC,CAAC;IACJ,CAAC;CACF,CAAA;AAxEY,8CAAiB;4BAAjB,iBAAiB;IAD7B,IAAA,mBAAU,GAAE;GACA,iBAAiB,CAwE7B;AAED,YAAY"}
+{"version":3,"file":"auth-cookie.service.js","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/auth/auth-cookie.service.ts"],"names":[],"mappings":";;;;AAAA,2CAA4C;AAE5C,+CAMuB;AAEvB,uCAAuC;AAGhC,IAAM,iBAAiB,GAAvB,MAAM,iBAAiB;IAC5B,gBAAgB,CACd,GAAa,EACb,MAAwG;QAExG,GAAG,CAAC,MAAM,CACR,uCAAyB,EACzB,MAAM,CAAC,YAAY,EACnB,IAAI,CAAC,oBAAoB,CAAC,MAAM,CAAC,eAAe,CAAC,CAClD,CAAC;QAEF,GAAG,CAAC,MAAM,CACR,sCAAwB,EACxB,MAAM,CAAC,WAAW,EAClB,IAAI,CAAC,mBAAmB,CAAC,MAAM,CAAC,cAAc,IAAI,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAClE,CAAC;IACJ,CAAC;IAED,gBAAgB,CAAC,GAAa;QAC5B,MAAM,IAAI,GAAG,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACtC,GAAG,CAAC,WAAW,CAAC,uCAAyB,EAAE;YACzC,GAAG,IAAI;YACP,IAAI,EAAE,IAAA,sCAAwB,GAAE;SACjC,CAAC,CAAC;QACH,GAAG,CAAC,WAAW,CAAC,sCAAwB,EAAE;YACxC,GAAG,IAAI;YACP,IAAI,EAAE,GAAG;SACV,CAAC,CAAC;IACL,CAAC;IAED,gBAAgB,CAAC,OAA4C;QAC3D,MAAM,KAAK,GAAG,OAAO,EAAE,CAAC,uCAAyB,CAAC,CAAC;QACnD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;YAC/C,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC;IACtB,CAAC;IAED,qBAAqB,CAAC,OAA4C;QAChE,MAAM,KAAK,GAAG,OAAO,EAAE,CAAC,sCAAwB,CAAC,CAAC;QAClD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;YAC/C,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC;IACtB,CAAC;IAEO,oBAAoB,CAAC,QAAiB;QAC5C,OAAO;YACL,GAAG,IAAI,CAAC,iBAAiB,EAAE;YAC3B,QAAQ,EAAE,IAAI;YACd,IAAI,EAAE,IAAA,sCAAwB,GAAE;YAChC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC1C,CAAC;IACJ,CAAC;IAEO,mBAAmB,CAAC,QAAgB;QAC1C,OAAO;YACL,GAAG,IAAI,CAAC,iBAAiB,EAAE;YAC3B,QAAQ,EAAE,IAAI;YACd,IAAI,EAAE,GAAG;YACT,MAAM,EAAE,QAAQ;SACjB,CAAC;IACJ,CAAC;IAEO,iBAAiB;QACvB,OAAO;YACL,MAAM,EAAE,IAAA,gCAAkB,GAAE;YAC5B,QAAQ,EAAE,IAAA,mCAAqB,GAAE;SAClC,CAAC;IACJ,CAAC;CACF,CAAA;AAtEY,8CAAiB;4BAAjB,iBAAiB;IAD7B,IAAA,mBAAU,GAAE;GACA,iBAAiB,CAsE7B;AAED,YAAY"}

package/security/src/lib/auth/auth-http-request.util.d.ts

@@ -0,0 +1,4 @@
+import type { Request } from 'express';
+/** Resolves the active Express request for auth runtime handlers. */
+export declare function resolveAuthHttpRequest(): Request;
+//# sourceMappingURL=auth-http-request.util.d.ts.map

package/security/src/lib/auth/auth-http-request.util.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-http-request.util.d.ts","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/auth/auth-http-request.util.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAOvC,qEAAqE;AACrE,wBAAgB,sBAAsB,IAAI,OAAO,CAMhD"}

package/security/src/lib/auth/auth-http-request.util.js

@@ -0,0 +1,17 @@
+"use strict";
+//#region ---- Imports ----
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolveAuthHttpRequest = resolveAuthHttpRequest;
+const core_1 = require("@acorex-platform/framework-server/core");
+//#endregion
+//#region ---- Auth HTTP request ----
+/** Resolves the active Express request for auth runtime handlers. */
+function resolveAuthHttpRequest() {
+    const request = (0, core_1.getEntityStorageRequest)();
+    if (!request) {
+        throw new Error('HTTP request context is not available');
+    }
+    return request;
+}
+//#endregion
+//# sourceMappingURL=auth-http-request.util.js.map

package/security/src/lib/auth/auth-http-request.util.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-http-request.util.js","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/auth/auth-http-request.util.ts"],"names":[],"mappings":";AAAA,2BAA2B;;AAU3B,wDAMC;AAbD,iEAAiF;AAEjF,YAAY;AAEZ,qCAAqC;AAErC,qEAAqE;AACrE,SAAgB,sBAAsB;IACpC,MAAM,OAAO,GAAG,IAAA,8BAAuB,GAAE,CAAC;IAC1C,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IAC3D,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,YAAY"}

package/security/src/lib/auth/auth-identity-provider.source.d.ts

@@ -0,0 +1,71 @@
+/**
+ * Public IdP projection for Auth:ListProviders (never includes secrets).
+ * `id` is the IdP key and is sent as OAuth `acr_values` by login strategies.
+ */
+export interface AuthIdentityProviderPublicDto {
+    id: string;
+    title: string;
+    icon?: string;
+    priority: number;
+}
+export interface AuthLocalSignInMethodDto {
+    id: string;
+    title: string;
+    protocol: 'password' | 'otp' | 'custom';
+    enabled: boolean;
+}
+/** Full public Auth:ListProviders response (no legacy google/microsoft/sso keys). */
+export interface AuthListProvidersResponseDto {
+    localMethods: AuthLocalSignInMethodDto[];
+    identityProviders: AuthIdentityProviderPublicDto[];
+}
+export interface AuthIdentityProviderEnsureStubInput {
+    /** Stable business key, e.g. `google`, `okta-hr`. */
+    key: string;
+    title: string;
+    icon?: string;
+    priority?: number;
+    authorizationUrl?: string;
+    tokenUrl?: string;
+    userInfoUrl?: string;
+    scopes?: string;
+    issuerUrl?: string;
+}
+/** Broker config for platform `/connect/*` (never returned by ListProviders). */
+export interface AuthIdentityProviderBrokerConfig {
+    key: string;
+    clientId: string;
+    clientSecret: string;
+    enabled: boolean;
+    /** External IdP authorize endpoint. */
+    authorizationUrl: string;
+    /** External IdP token endpoint. */
+    tokenUrl: string;
+    /** Optional userinfo endpoint. */
+    userInfoUrl?: string;
+    /** Scopes sent to the external IdP. */
+    scopes: string;
+}
+/**
+ * Implemented by security-management; framework ListProviders + extensions call this.
+ */
+export interface AuthIdentityProviderCatalog {
+    listEnabledForLogin(): Promise<AuthIdentityProviderPublicDto[]>;
+    /**
+     * Insert stub row when missing. Never overwrites admin-filled fields
+     * (clientId, clientSecret, title, endpoints) on an existing row.
+     */
+    ensureStub(input: AuthIdentityProviderEnsureStubInput): Promise<void>;
+    /**
+     * Resolve IdP broker credentials by key (e.g. `google`).
+     * Returns null when missing, disabled, or credentials incomplete.
+     */
+    getBrokerConfig(key: string): Promise<AuthIdentityProviderBrokerConfig | null>;
+}
+export declare const AUTH_IDENTITY_PROVIDER_CATALOG: unique symbol;
+/**
+ * Allowed SPA/machine client_ids for `/connect/*`.
+ * Provided by security-management from seed constants (not env in framework).
+ */
+export declare const AUTH_OAUTH_ALLOWED_CLIENT_IDS: unique symbol;
+//# sourceMappingURL=auth-identity-provider.source.d.ts.map

package/security/src/lib/auth/auth-identity-provider.source.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-identity-provider.source.d.ts","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/auth/auth-identity-provider.source.ts"],"names":[],"mappings":"AAEA;;;GAGG;AACH,MAAM,WAAW,6BAA6B;IAC5C,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,wBAAwB;IACvC,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,UAAU,GAAG,KAAK,GAAG,QAAQ,CAAC;IACxC,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,qFAAqF;AACrF,MAAM,WAAW,4BAA4B;IAC3C,YAAY,EAAE,wBAAwB,EAAE,CAAC;IACzC,iBAAiB,EAAE,6BAA6B,EAAE,CAAC;CACpD;AAED,MAAM,WAAW,mCAAmC;IAClD,qDAAqD;IACrD,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,iFAAiF;AACjF,MAAM,WAAW,gCAAgC;IAC/C,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,OAAO,CAAC;IACjB,uCAAuC;IACvC,gBAAgB,EAAE,MAAM,CAAC;IACzB,mCAAmC;IACnC,QAAQ,EAAE,MAAM,CAAC;IACjB,kCAAkC;IAClC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,uCAAuC;IACvC,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;GAEG;AACH,MAAM,WAAW,2BAA2B;IAC1C,mBAAmB,IAAI,OAAO,CAAC,6BAA6B,EAAE,CAAC,CAAC;IAChE;;;OAGG;IACH,UAAU,CAAC,KAAK,EAAE,mCAAmC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACtE;;;OAGG;IACH,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,gCAAgC,GAAG,IAAI,CAAC,CAAC;CAChF;AAED,eAAO,MAAM,8BAA8B,eAA2C,CAAC;AAEvF;;;GAGG;AACH,eAAO,MAAM,6BAA6B,eAA0C,CAAC"}

package/security/src/lib/auth/auth-identity-provider.source.js

@@ -0,0 +1,12 @@
+"use strict";
+//#region ---- Auth identity provider catalog (entity-backed) ----
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AUTH_OAUTH_ALLOWED_CLIENT_IDS = exports.AUTH_IDENTITY_PROVIDER_CATALOG = void 0;
+exports.AUTH_IDENTITY_PROVIDER_CATALOG = Symbol('AUTH_IDENTITY_PROVIDER_CATALOG');
+/**
+ * Allowed SPA/machine client_ids for `/connect/*`.
+ * Provided by security-management from seed constants (not env in framework).
+ */
+exports.AUTH_OAUTH_ALLOWED_CLIENT_IDS = Symbol('AUTH_OAUTH_ALLOWED_CLIENT_IDS');
+//#endregion
+//# sourceMappingURL=auth-identity-provider.source.js.map

package/security/src/lib/auth/auth-identity-provider.source.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-identity-provider.source.js","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/auth/auth-identity-provider.source.ts"],"names":[],"mappings":";AAAA,kEAAkE;;;AAwErD,QAAA,8BAA8B,GAAG,MAAM,CAAC,gCAAgC,CAAC,CAAC;AAEvF;;;GAGG;AACU,QAAA,6BAA6B,GAAG,MAAM,CAAC,+BAA+B,CAAC,CAAC;AAErF,YAAY"}

package/security/src/lib/auth/auth-local-credentials.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-local-credentials.service.d.ts","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/auth/auth-local-credentials.service.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,8BAA8B,EAAE,MAAM,wCAAwC,CAAC;AAKxF,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,cAAc,CAAC;AASjE,qBACa,2BAA2B;IAG1B,OAAO,CAAC,QAAQ,CAAC,aAAa;IAF1C,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAgD;gBAE1C,aAAa,EAAE,8BAA8B;IAEpE,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,4BAA4B,CAAC;IAkCnF,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,4BAA4B,GAAG,IAAI,CAAC;IAKlF,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,4BAA4B,GAAG,IAAI,CAAC;IAK1E,SAAS,IAAI,OAAO,CAAC,4BAA4B,EAAE,CAAC;IASpD,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAU9C,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAUhD,wBAAwB,CAAC,KAAK,EAAE;QACpC,QAAQ,EAAE,MAAM,CAAC;QACjB,eAAe,EAAE,MAAM,CAAC;QACxB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,OAAO,CAAC,EAAE,MAAM,CAAC;KAClB,GAAG,OAAO,CAAC,4BAA4B,CAAC;IAyCzC,OAAO,CAAC,sBAAsB;CAO/B"}
+{"version":3,"file":"auth-local-credentials.service.d.ts","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/auth/auth-local-credentials.service.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,8BAA8B,EAAE,MAAM,wCAAwC,CAAC;AAKxF,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,cAAc,CAAC;AASjE,qBACa,2BAA2B;IAG1B,OAAO,CAAC,QAAQ,CAAC,aAAa;IAF1C,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAgD;gBAE1C,aAAa,EAAE,8BAA8B;IAEpE,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,4BAA4B,CAAC;IAkCnF,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,4BAA4B,GAAG,IAAI,CAAC;IAKlF,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,4BAA4B,GAAG,IAAI,CAAC;IAM1E,SAAS,IAAI,OAAO,CAAC,4BAA4B,EAAE,CAAC;IASpD,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAU9C,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAUhD,wBAAwB,CAAC,KAAK,EAAE;QACpC,QAAQ,EAAE,MAAM,CAAC;QACjB,eAAe,EAAE,MAAM,CAAC;QACxB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,OAAO,CAAC,EAAE,MAAM,CAAC;KAClB,GAAG,OAAO,CAAC,4BAA4B,CAAC;IAyCzC,OAAO,CAAC,sBAAsB;CAO/B"}

package/security/src/lib/auth/auth-local-credentials.service.js

@@ -52,7 +52,8 @@ let AuthLocalCredentialsService = AuthLocalCredentialsService_1 = class AuthLoca
         return users.find((u) => u.username === username) ?? null;
     }
     async findUserById(userId) {
-        const record = await this.entityStorage.getOne(USER_ENTITY, userId);
+        // Auth paths resolve global identities outside tenant membership filters.
+        const record = await this.entityStorage.getOneAsEngine(USER_ENTITY, userId);
         return record ?? null;
     }
     async listUsers() {

package/security/src/lib/auth/auth-local-credentials.service.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth-local-credentials.service.js","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/auth/auth-local-credentials.service.ts"],"names":[],"mappings":";;;;;AAAA,2CAIwB;AACxB,iEAAwF;AACxF,6EAAkG;AAClG,iEAAwE;AACxE,yCAAuC;AACvC,mCAAoC;AAGpC,qCAAqC;AAErC,MAAM,WAAW,GAAG,yBAAyB,CAAC;AAC9C,MAAM,oBAAoB,GAAG,QAAQ,CAAC;AACtC,MAAM,oBAAoB,GAAG,SAAS,CAAC;AACvC,MAAM,oBAAoB,GAAG,SAAS,CAAC;AAGhC,IAAM,2BAA2B,mCAAjC,MAAM,2BAA2B;IAGtC,YAA6B,aAA6C;QAA7C,kBAAa,GAAb,aAAa,CAAgC;QAFzD,WAAM,GAAG,IAAI,eAAM,CAAC,6BAA2B,CAAC,IAAI,CAAC,CAAC;IAEM,CAAC;IAE9E,KAAK,CAAC,QAAQ,CAAC,QAAgB,EAAE,QAAgB;QAC/C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC;QACrD,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,8BAAqB,CAAC,IAAI,CAAC,sBAAsB,EAAE,CAAC,CAAC;QACjE,CAAC;QAED,IAAI,IAAI,CAAC,WAAW,KAAK,oBAAoB,EAAE,CAAC;YAC9C,MAAM,IAAI,8BAAqB,CAAC;gBAC9B,UAAU,EAAE,GAAG;gBACf,OAAO,EAAE,sCAAsC;gBAC/C,KAAK,EAAE,gBAAgB;aACxB,CAAC,CAAC;QACL,CAAC;QAED,IAAI,IAAI,CAAC,YAAY,KAAK,oBAAoB,EAAE,CAAC;YAC/C,MAAM,IAAI,8BAAqB,CAAC,IAAI,CAAC,sBAAsB,EAAE,CAAC,CAAC;QACjE,CAAC;QAED,IAAI,CAAC,IAAA,iBAAK,EAAC,IAAI,CAAC,WAAW,CAAC,IAAI,IAAI,CAAC,WAAW,KAAK,oBAAoB,EAAE,CAAC;YAC1E,MAAM,IAAI,8BAAqB,CAAC;gBAC9B,UAAU,EAAE,GAAG;gBACf,OAAO,EAAE,0CAA0C;gBACnD,KAAK,EAAE,mBAAmB;aAC3B,CAAC,CAAC;QACL,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,IAAA,qBAAc,EAAC,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC5D,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,8BAAqB,CAAC,IAAI,CAAC,sBAAsB,EAAE,CAAC,CAAC;QACjE,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,CAAC,kBAAkB,CAAC,QAAgB;QACvC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;QACrC,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,IAAI,IAAI,CAAC;IAC5D,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,MAAc;QAC/B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;QACpE,OAAQ,MAAuC,IAAI,IAAI,CAAC;IAC1D,CAAC;IAED,KAAK,CAAC,SAAS;QACb,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,KAAK,CAC3C,WAAW,EACX,IAAA,2CAAgC,EAAC,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAC1D,CAAC;QACF,MAAM,KAAK,GAAG,IAAA,eAAG,EAAC,MAAM,EAAE,OAAO,EAAE,EAAE,CAAmC,CAAC;QACzE,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3C,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,MAAc;QAClC,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,WAAW,EAAE,MAAM,EAAE;gBACtD,WAAW,EAAE,oBAAoB;aAClC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,wBAAwB,MAAM,KAAK,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACvE,CAAC;IACH,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,MAAc;QACpC,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,WAAW,EAAE,MAAM,EAAE;gBACtD,WAAW,EAAE,oBAAoB;aAClC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,iCAAiC,MAAM,KAAK,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAChF,CAAC;IACH,CAAC;IAED,KAAK,CAAC,wBAAwB,CAAC,KAM9B;QACC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAChD,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;QAErC,IAAI,KAAK,EAAE,CAAC;YACV,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YACtB,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;YAC9C,IAAI,SAAS,EAAE,CAAC;gBACd,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YAC5B,CAAC;QACH,CAAC;QAED,UAAU,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,eAAe,EAAE,CAAC,CAAC;QAE7D,KAAK,MAAM,QAAQ,IAAI,UAAU,EAAE,CAAC;YAClC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC;YACzD,IAAI,QAAQ,EAAE,CAAC;gBACb,OAAO,QAAQ,CAAC;YAClB,CAAC;QACH,CAAC;QAED,MAAM,QAAQ,GAAG,KAAK,IAAI,GAAG,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;QACpF,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,EAAE,IAAI,EAAE,IAAI,QAAQ,CAAC;QAC1D,MAAM,EAAE,GAAG,IAAA,mBAAU,GAAE,CAAC;QAExB,MAAM,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,WAAW,EAAE;YAC9C,EAAE;YACF,QAAQ;YACR,WAAW;YACX,YAAY,EAAE,oBAAoB;YAClC,WAAW,EAAE,oBAAoB;SAClC,CAAC,CAAC;QAEH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;QAC5C,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,8BAAqB,CAAC,yCAAyC,CAAC,CAAC;QAC7E,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;IAEO,sBAAsB;QAC5B,OAAO;YACL,UAAU,EAAE,GAAG;YACf,OAAO,EAAE,8BAA8B;YACvC,KAAK,EAAE,oBAAoB;SAC5B,CAAC;IACJ,CAAC;CACF,CAAA;AApIY,kEAA2B;sCAA3B,2BAA2B;IADvC,IAAA,mBAAU,GAAE;6CAIiC,qCAA8B;GAH/D,2BAA2B,CAoIvC;AAED,YAAY"}
+{"version":3,"file":"auth-local-credentials.service.js","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/auth/auth-local-credentials.service.ts"],"names":[],"mappings":";;;;;AAAA,2CAIwB;AACxB,iEAAwF;AACxF,6EAAkG;AAClG,iEAAwE;AACxE,yCAAuC;AACvC,mCAAoC;AAGpC,qCAAqC;AAErC,MAAM,WAAW,GAAG,yBAAyB,CAAC;AAC9C,MAAM,oBAAoB,GAAG,QAAQ,CAAC;AACtC,MAAM,oBAAoB,GAAG,SAAS,CAAC;AACvC,MAAM,oBAAoB,GAAG,SAAS,CAAC;AAGhC,IAAM,2BAA2B,mCAAjC,MAAM,2BAA2B;IAGtC,YAA6B,aAA6C;QAA7C,kBAAa,GAAb,aAAa,CAAgC;QAFzD,WAAM,GAAG,IAAI,eAAM,CAAC,6BAA2B,CAAC,IAAI,CAAC,CAAC;IAEM,CAAC;IAE9E,KAAK,CAAC,QAAQ,CAAC,QAAgB,EAAE,QAAgB;QAC/C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC;QACrD,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,8BAAqB,CAAC,IAAI,CAAC,sBAAsB,EAAE,CAAC,CAAC;QACjE,CAAC;QAED,IAAI,IAAI,CAAC,WAAW,KAAK,oBAAoB,EAAE,CAAC;YAC9C,MAAM,IAAI,8BAAqB,CAAC;gBAC9B,UAAU,EAAE,GAAG;gBACf,OAAO,EAAE,sCAAsC;gBAC/C,KAAK,EAAE,gBAAgB;aACxB,CAAC,CAAC;QACL,CAAC;QAED,IAAI,IAAI,CAAC,YAAY,KAAK,oBAAoB,EAAE,CAAC;YAC/C,MAAM,IAAI,8BAAqB,CAAC,IAAI,CAAC,sBAAsB,EAAE,CAAC,CAAC;QACjE,CAAC;QAED,IAAI,CAAC,IAAA,iBAAK,EAAC,IAAI,CAAC,WAAW,CAAC,IAAI,IAAI,CAAC,WAAW,KAAK,oBAAoB,EAAE,CAAC;YAC1E,MAAM,IAAI,8BAAqB,CAAC;gBAC9B,UAAU,EAAE,GAAG;gBACf,OAAO,EAAE,0CAA0C;gBACnD,KAAK,EAAE,mBAAmB;aAC3B,CAAC,CAAC;QACL,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,IAAA,qBAAc,EAAC,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC5D,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,8BAAqB,CAAC,IAAI,CAAC,sBAAsB,EAAE,CAAC,CAAC;QACjE,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,CAAC,kBAAkB,CAAC,QAAgB;QACvC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;QACrC,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,IAAI,IAAI,CAAC;IAC5D,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,MAAc;QAC/B,0EAA0E;QAC1E,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,cAAc,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;QAC5E,OAAQ,MAAuC,IAAI,IAAI,CAAC;IAC1D,CAAC;IAED,KAAK,CAAC,SAAS;QACb,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,KAAK,CAC3C,WAAW,EACX,IAAA,2CAAgC,EAAC,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAC1D,CAAC;QACF,MAAM,KAAK,GAAG,IAAA,eAAG,EAAC,MAAM,EAAE,OAAO,EAAE,EAAE,CAAmC,CAAC;QACzE,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3C,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,MAAc;QAClC,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,WAAW,EAAE,MAAM,EAAE;gBACtD,WAAW,EAAE,oBAAoB;aAClC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,wBAAwB,MAAM,KAAK,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACvE,CAAC;IACH,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,MAAc;QACpC,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,WAAW,EAAE,MAAM,EAAE;gBACtD,WAAW,EAAE,oBAAoB;aAClC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,iCAAiC,MAAM,KAAK,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAChF,CAAC;IACH,CAAC;IAED,KAAK,CAAC,wBAAwB,CAAC,KAM9B;QACC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAChD,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;QAErC,IAAI,KAAK,EAAE,CAAC;YACV,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YACtB,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;YAC9C,IAAI,SAAS,EAAE,CAAC;gBACd,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YAC5B,CAAC;QACH,CAAC;QAED,UAAU,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,eAAe,EAAE,CAAC,CAAC;QAE7D,KAAK,MAAM,QAAQ,IAAI,UAAU,EAAE,CAAC;YAClC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC;YACzD,IAAI,QAAQ,EAAE,CAAC;gBACb,OAAO,QAAQ,CAAC;YAClB,CAAC;QACH,CAAC;QAED,MAAM,QAAQ,GAAG,KAAK,IAAI,GAAG,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;QACpF,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,EAAE,IAAI,EAAE,IAAI,QAAQ,CAAC;QAC1D,MAAM,EAAE,GAAG,IAAA,mBAAU,GAAE,CAAC;QAExB,MAAM,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,WAAW,EAAE;YAC9C,EAAE;YACF,QAAQ;YACR,WAAW;YACX,YAAY,EAAE,oBAAoB;YAClC,WAAW,EAAE,oBAAoB;SAClC,CAAC,CAAC;QAEH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;QAC5C,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,8BAAqB,CAAC,yCAAyC,CAAC,CAAC;QAC7E,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;IAEO,sBAAsB;QAC5B,OAAO;YACL,UAAU,EAAE,GAAG;YACf,OAAO,EAAE,8BAA8B;YACvC,KAAK,EAAE,oBAAoB;SAC5B,CAAC;IACJ,CAAC;CACF,CAAA;AArIY,kEAA2B;sCAA3B,2BAA2B;IADvC,IAAA,mBAAU,GAAE;6CAIiC,qCAA8B;GAH/D,2BAA2B,CAqIvC;AAED,YAAY"}

package/security/src/lib/auth/auth-lockout-policy.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Sign-in lockout / challenge thresholds. Defaults apply until a module
+ * registers {@link configureAuthLockoutPolicyResolver} (platform settings).
+ *
+ * Uses globalThis so Nest/webpack duplicate module instances share one resolver.
+ */
+export interface AuthLockoutPolicy {
+    maxLoginAttempts: number;
+    lockoutDurationMinutes: number;
+    captchaAttemptThreshold: number;
+}
+export declare const AUTH_LOCKOUT_POLICY_DEFAULTS: AuthLockoutPolicy;
+type AuthLockoutPolicyResolver = () => Promise<AuthLockoutPolicy>;
+/** Registers the resolver that reads platform lockout settings. */
+export declare function configureAuthLockoutPolicyResolver(resolver: AuthLockoutPolicyResolver): void;
+export declare function resolveAuthLockoutPolicy(): Promise<AuthLockoutPolicy>;
+export {};
+//# sourceMappingURL=auth-lockout-policy.d.ts.map

package/security/src/lib/auth/auth-lockout-policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-lockout-policy.d.ts","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/auth/auth-lockout-policy.ts"],"names":[],"mappings":"AAEA;;;;;GAKG;AAEH,MAAM,WAAW,iBAAiB;IAChC,gBAAgB,EAAE,MAAM,CAAC;IACzB,sBAAsB,EAAE,MAAM,CAAC;IAC/B,uBAAuB,EAAE,MAAM,CAAC;CACjC;AAED,eAAO,MAAM,4BAA4B,EAAE,iBAI1C,CAAC;AAEF,KAAK,yBAAyB,GAAG,MAAM,OAAO,CAAC,iBAAiB,CAAC,CAAC;AAuBlE,mEAAmE;AACnE,wBAAgB,kCAAkC,CAAC,QAAQ,EAAE,yBAAyB,GAAG,IAAI,CAE5F;AAED,wBAAsB,wBAAwB,IAAI,OAAO,CAAC,iBAAiB,CAAC,CAyB3E"}

package/security/src/lib/auth/auth-lockout-policy.js

@@ -0,0 +1,46 @@
+"use strict";
+//#region ----- Auth lockout policy (leaf) -----
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AUTH_LOCKOUT_POLICY_DEFAULTS = void 0;
+exports.configureAuthLockoutPolicyResolver = configureAuthLockoutPolicyResolver;
+exports.resolveAuthLockoutPolicy = resolveAuthLockoutPolicy;
+exports.AUTH_LOCKOUT_POLICY_DEFAULTS = {
+    maxLoginAttempts: 5,
+    lockoutDurationMinutes: 3,
+    captchaAttemptThreshold: 3,
+};
+const GLOBAL_KEY = '__AXP_AUTH_LOCKOUT_POLICY__';
+function authLockoutState() {
+    const g = globalThis;
+    if (!g[GLOBAL_KEY]) {
+        g[GLOBAL_KEY] = { resolver: null };
+    }
+    return g[GLOBAL_KEY];
+}
+function coerceMin1(value, fallback) {
+    const parsed = typeof value === 'number' ? value : Number(value);
+    return Number.isFinite(parsed) && parsed >= 1 ? Math.floor(parsed) : fallback;
+}
+/** Registers the resolver that reads platform lockout settings. */
+function configureAuthLockoutPolicyResolver(resolver) {
+    authLockoutState().resolver = resolver;
+}
+async function resolveAuthLockoutPolicy() {
+    const resolver = authLockoutState().resolver;
+    if (!resolver) {
+        return exports.AUTH_LOCKOUT_POLICY_DEFAULTS;
+    }
+    try {
+        const resolved = await resolver();
+        return {
+            maxLoginAttempts: coerceMin1(resolved.maxLoginAttempts, exports.AUTH_LOCKOUT_POLICY_DEFAULTS.maxLoginAttempts),
+            lockoutDurationMinutes: coerceMin1(resolved.lockoutDurationMinutes, exports.AUTH_LOCKOUT_POLICY_DEFAULTS.lockoutDurationMinutes),
+            captchaAttemptThreshold: coerceMin1(resolved.captchaAttemptThreshold, exports.AUTH_LOCKOUT_POLICY_DEFAULTS.captchaAttemptThreshold),
+        };
+    }
+    catch {
+        return exports.AUTH_LOCKOUT_POLICY_DEFAULTS;
+    }
+}
+//#endregion
+//# sourceMappingURL=auth-lockout-policy.js.map

package/security/src/lib/auth/auth-lockout-policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-lockout-policy.js","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/auth/auth-lockout-policy.ts"],"names":[],"mappings":";AAAA,gDAAgD;;;AA6ChD,gFAEC;AAED,4DAyBC;AA3DY,QAAA,4BAA4B,GAAsB;IAC7D,gBAAgB,EAAE,CAAC;IACnB,sBAAsB,EAAE,CAAC;IACzB,uBAAuB,EAAE,CAAC;CAC3B,CAAC;AAQF,MAAM,UAAU,GAAG,6BAA6B,CAAC;AAEjD,SAAS,gBAAgB;IACvB,MAAM,CAAC,GAAG,UAET,CAAC;IACF,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,EAAE,CAAC;QACnB,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IACrC,CAAC;IACD,OAAO,CAAC,CAAC,UAAU,CAAE,CAAC;AACxB,CAAC;AAED,SAAS,UAAU,CAAC,KAAc,EAAE,QAAgB;IAClD,MAAM,MAAM,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACjE,OAAO,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;AAChF,CAAC;AAED,mEAAmE;AACnE,SAAgB,kCAAkC,CAAC,QAAmC;IACpF,gBAAgB,EAAE,CAAC,QAAQ,GAAG,QAAQ,CAAC;AACzC,CAAC;AAEM,KAAK,UAAU,wBAAwB;IAC5C,MAAM,QAAQ,GAAG,gBAAgB,EAAE,CAAC,QAAQ,CAAC;IAC7C,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,oCAA4B,CAAC;IACtC,CAAC;IAED,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,QAAQ,EAAE,CAAC;QAClC,OAAO;YACL,gBAAgB,EAAE,UAAU,CAC1B,QAAQ,CAAC,gBAAgB,EACzB,oCAA4B,CAAC,gBAAgB,CAC9C;YACD,sBAAsB,EAAE,UAAU,CAChC,QAAQ,CAAC,sBAAsB,EAC/B,oCAA4B,CAAC,sBAAsB,CACpD;YACD,uBAAuB,EAAE,UAAU,CACjC,QAAQ,CAAC,uBAAuB,EAChC,oCAA4B,CAAC,uBAAuB,CACrD;SACF,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,oCAA4B,CAAC;IACtC,CAAC;AACH,CAAC;AAED,YAAY"}

package/security/src/lib/auth/auth-providers.contributor.d.ts

@@ -1,11 +1,12 @@
 /**
- * Optional extension hook for `GET /v1/auth/providers`.
- * Framework merges each contributor section by {@link key} — no extension types in framework.
+ * @deprecated Use {@link AUTH_IDENTITY_PROVIDER_CATALOG} / IdentityProvider entity instead.
+ * Legacy extension hook for `Auth:ListProviders` — no longer merged into the response.
  */
 export interface AuthProvidersContributor {
     /** Response property name, e.g. `sso`. */
     readonly key: string;
     getSection(): unknown | Promise<unknown>;
 }
+/** @deprecated See {@link AUTH_IDENTITY_PROVIDER_CATALOG}. */
 export declare const AUTH_PROVIDERS_CONTRIBUTOR: unique symbol;
 //# sourceMappingURL=auth-providers.contributor.d.ts.map

package/security/src/lib/auth/auth-providers.contributor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-providers.contributor.d.ts","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/auth/auth-providers.contributor.ts"],"names":[],"mappings":"AAEA;;;GAGG;AACH,MAAM,WAAW,wBAAwB;IACvC,0CAA0C;IAC1C,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,UAAU,IAAI,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CAC1C;AAED,eAAO,MAAM,0BAA0B,eAAuC,CAAC"}
+{"version":3,"file":"auth-providers.contributor.d.ts","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/auth/auth-providers.contributor.ts"],"names":[],"mappings":"AAEA;;;GAGG;AACH,MAAM,WAAW,wBAAwB;IACvC,0CAA0C;IAC1C,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,UAAU,IAAI,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CAC1C;AAED,8DAA8D;AAC9D,eAAO,MAAM,0BAA0B,eAAuC,CAAC"}

package/security/src/lib/auth/auth-providers.contributor.js

@@ -1,7 +1,8 @@
 "use strict";
-//#region ---- Auth providers contributor (extensions register into GET /v1/auth/providers) ----
+//#region ---- Auth providers contributor (deprecated) ----
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.AUTH_PROVIDERS_CONTRIBUTOR = void 0;
+/** @deprecated See {@link AUTH_IDENTITY_PROVIDER_CATALOG}. */
 exports.AUTH_PROVIDERS_CONTRIBUTOR = Symbol('AUTH_PROVIDERS_CONTRIBUTOR');
 //#endregion
 //# sourceMappingURL=auth-providers.contributor.js.map

package/security/src/lib/auth/auth-providers.contributor.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth-providers.contributor.js","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/auth/auth-providers.contributor.ts"],"names":[],"mappings":";AAAA,gGAAgG;;;AAYnF,QAAA,0BAA0B,GAAG,MAAM,CAAC,4BAA4B,CAAC,CAAC;AAE/E,YAAY"}
+{"version":3,"file":"auth-providers.contributor.js","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/auth/auth-providers.contributor.ts"],"names":[],"mappings":";AAAA,2DAA2D;;;AAY3D,8DAA8D;AACjD,QAAA,0BAA0B,GAAG,MAAM,CAAC,4BAA4B,CAAC,CAAC;AAE/E,YAAY"}

package/security/src/lib/auth/auth-runtime.handlers.d.ts

@@ -0,0 +1,76 @@
+import type { AXPCommand, AXPQueryFetchResultPromise, AXPCommandExecuteResultPromise } from '@acorex-platform/framework-shared/runtime';
+import { type AXPServerQueryHandler } from '@acorex-platform/framework-server/domain/abstract';
+import { ModuleRef } from '@nestjs/core';
+import { AuthCookieService } from './auth-cookie.service';
+import { AuthService } from './auth.service';
+import type { AuthTokenResponseDto, RefreshTokenRequestDto, RegisterRequestDto, SignInRequestDto, UpdateSessionRequestDto } from './auth.types';
+import { LoginAttemptService } from './login-attempt.service';
+import { TokenResolverService } from './token-resolver.service';
+import { TokenService } from './token.service';
+import { BackendSessionService } from '../session/backend-session.service';
+import { SessionContextService } from '../session/session-context.service';
+import { type AuthListProvidersResponseDto } from './auth-identity-provider.source';
+import type { SessionAccessPolicyDto, SessionApplicationItemDto, SessionTenantItemDto } from '../session/session-context.types';
+export declare class AuthSignInRuntimeCommand implements AXPCommand<SignInRequestDto, AuthTokenResponseDto> {
+    private readonly auth;
+    private readonly loginAttempts;
+    private readonly cookies;
+    private readonly tokens;
+    constructor(auth: AuthService, loginAttempts: LoginAttemptService, cookies: AuthCookieService, tokens: TokenService);
+    execute(input: SignInRequestDto): AXPCommandExecuteResultPromise<AuthTokenResponseDto>;
+}
+export declare class AuthRegisterRuntimeCommand implements AXPCommand<RegisterRequestDto, AuthTokenResponseDto> {
+    private readonly auth;
+    private readonly cookies;
+    private readonly tokens;
+    constructor(auth: AuthService, cookies: AuthCookieService, tokens: TokenService);
+    execute(input: RegisterRequestDto): AXPCommandExecuteResultPromise<AuthTokenResponseDto>;
+}
+export declare class AuthRefreshRuntimeCommand implements AXPCommand<RefreshTokenRequestDto, AuthTokenResponseDto> {
+    private readonly auth;
+    private readonly cookies;
+    private readonly tokens;
+    constructor(auth: AuthService, cookies: AuthCookieService, tokens: TokenService);
+    execute(input: RefreshTokenRequestDto): AXPCommandExecuteResultPromise<AuthTokenResponseDto>;
+}
+export declare class AuthLogoutRuntimeCommand implements AXPCommand<RefreshTokenRequestDto, void> {
+    private readonly auth;
+    private readonly cookies;
+    constructor(auth: AuthService, cookies: AuthCookieService);
+    execute(input: RefreshTokenRequestDto): AXPCommandExecuteResultPromise<void>;
+}
+export declare class AuthUpdateSessionRuntimeCommand implements AXPCommand<UpdateSessionRequestDto, AuthTokenResponseDto> {
+    private readonly auth;
+    private readonly tokenResolver;
+    private readonly cookies;
+    private readonly tokens;
+    constructor(auth: AuthService, tokenResolver: TokenResolverService, cookies: AuthCookieService, tokens: TokenService);
+    execute(input: UpdateSessionRequestDto): AXPCommandExecuteResultPromise<AuthTokenResponseDto>;
+}
+export declare const AUTH_RUNTIME_COMMANDS: (typeof AuthSignInRuntimeCommand | typeof AuthRegisterRuntimeCommand | typeof AuthRefreshRuntimeCommand | typeof AuthLogoutRuntimeCommand | typeof AuthUpdateSessionRuntimeCommand)[];
+export declare class AuthListProvidersRuntimeQuery implements AXPServerQueryHandler<void, AuthListProvidersResponseDto> {
+    private readonly moduleRef;
+    constructor(moduleRef: ModuleRef);
+    execute(): AXPQueryFetchResultPromise<AuthListProvidersResponseDto>;
+    private resolveIdentityProviderCatalog;
+}
+export declare class AuthListTenantsRuntimeQuery implements AXPServerQueryHandler<void, SessionTenantItemDto> {
+    private readonly sessionContext;
+    private readonly backendSession;
+    constructor(sessionContext: SessionContextService, backendSession: BackendSessionService);
+    execute(): AXPQueryFetchResultPromise<SessionTenantItemDto>;
+}
+export declare class AuthListApplicationsRuntimeQuery implements AXPServerQueryHandler<void, SessionApplicationItemDto> {
+    private readonly sessionContext;
+    private readonly backendSession;
+    constructor(sessionContext: SessionContextService, backendSession: BackendSessionService);
+    execute(): AXPQueryFetchResultPromise<SessionApplicationItemDto>;
+}
+export declare class AuthGetAccessPolicyRuntimeQuery implements AXPServerQueryHandler<void, SessionAccessPolicyDto> {
+    private readonly sessionContext;
+    private readonly backendSession;
+    constructor(sessionContext: SessionContextService, backendSession: BackendSessionService);
+    execute(): AXPQueryFetchResultPromise<SessionAccessPolicyDto>;
+}
+export declare const AUTH_RUNTIME_QUERIES: (typeof AuthListProvidersRuntimeQuery | typeof AuthListTenantsRuntimeQuery | typeof AuthListApplicationsRuntimeQuery | typeof AuthGetAccessPolicyRuntimeQuery)[];
+//# sourceMappingURL=auth-runtime.handlers.d.ts.map