@acorex-platform/framework-server 0.0.18 → 0.0.20

package/security/src/lib/auth/auth-runtime.handlers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-runtime.handlers.d.ts","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/auth/auth-runtime.handlers.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,UAAU,EAAE,0BAA0B,EAAE,8BAA8B,EAAE,MAAM,2CAA2C,CAAC;AAYxI,OAAO,EAAqC,KAAK,qBAAqB,EAAE,MAAM,mDAAmD,CAAC;AAElI,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAOzC,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC1D,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC7C,OAAO,KAAK,EACV,oBAAoB,EACpB,sBAAsB,EACtB,kBAAkB,EAClB,gBAAgB,EAChB,uBAAuB,EACxB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAE9D,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAChE,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EAAE,qBAAqB,EAAE,MAAM,oCAAoC,CAAC;AAC3E,OAAO,EAAE,qBAAqB,EAAE,MAAM,oCAAoC,CAAC;AAC3E,OAAO,EAGL,KAAK,4BAA4B,EAElC,MAAM,iCAAiC,CAAC;AACzC,OAAO,KAAK,EACV,sBAAsB,EACtB,yBAAyB,EACzB,oBAAoB,EACrB,MAAM,kCAAkC,CAAC;AAI1C,qBAEa,wBAAyB,YAAW,UAAU,CAAC,gBAAgB,EAAE,oBAAoB,CAAC;IAE/F,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,aAAa;IAC9B,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAHN,IAAI,EAAE,WAAW,EACjB,aAAa,EAAE,mBAAmB,EAClC,OAAO,EAAE,iBAAiB,EAC1B,MAAM,EAAE,YAAY;IAGjC,OAAO,CAAC,KAAK,EAAE,gBAAgB,GAAG,8BAA8B,CAAC,oBAAoB,CAAC;CAmB7F;AAED,qBAEa,0BAA2B,YAAW,UAAU,CAAC,kBAAkB,EAAE,oBAAoB,CAAC;IAEnG,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAFN,IAAI,EAAE,WAAW,EACjB,OAAO,EAAE,iBAAiB,EAC1B,MAAM,EAAE,YAAY;IAGjC,OAAO,CAAC,KAAK,EAAE,kBAAkB,GAAG,8BAA8B,CAAC,oBAAoB,CAAC;CAQ/F;AAED,qBAEa,yBACX,YAAW,UAAU,CAAC,sBAAsB,EAAE,oBAAoB,CAAC;IAGjE,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAFN,IAAI,EAAE,WAAW,EACjB,OAAO,EAAE,iBAAiB,EAC1B,MAAM,EAAE,YAAY;IAGjC,OAAO,CAAC,KAAK,EAAE,sBAAsB,GAAG,8BAA8B,CAAC,oBAAoB,CAAC;CAiBnG;AAED,qBAEa,wBAAyB,YAAW,UAAU,CAAC,sBAAsB,EAAE,IAAI,CAAC;IAErF,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,OAAO;gBADP,IAAI,EAAE,WAAW,EACjB,OAAO,EAAE,iBAAiB;IAGvC,OAAO,CAAC,KAAK,EAAE,sBAAsB,GAAG,8BAA8B,CAAC,IAAI,CAAC;CAYnF;AAED,qBAEa,+BACX,YAAW,UAAU,CAAC,uBAAuB,EAAE,oBAAoB,CAAC;IAGlE,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,aAAa;IAC9B,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAHN,IAAI,EAAE,WAAW,EACjB,aAAa,EAAE,oBAAoB,EACnC,OAAO,EAAE,iBAAiB,EAC1B,MAAM,EAAE,YAAY;IAGjC,OAAO,CAAC,KAAK,EAAE,uBAAuB,GAAG,8BAA8B,CAAC,oBAAoB,CAAC;CAiBpG;AAED,eAAO,MAAM,qBAAqB,uLAMjC,CAAC;AAMF,qBAEa,6BAA8B,YAAW,qBAAqB,CAAC,IAAI,EAAE,4BAA4B,CAAC;IACjG,OAAO,CAAC,QAAQ,CAAC,SAAS;gBAAT,SAAS,EAAE,SAAS;IAE3C,OAAO,IAAI,0BAA0B,CAAC,4BAA4B,CAAC;IAgBzE,OAAO,CAAC,8BAA8B;CASvC;AAED,qBAEa,2BACX,YAAW,qBAAqB,CAAC,IAAI,EAAE,oBAAoB,CAAC;IAG1D,OAAO,CAAC,QAAQ,CAAC,cAAc;IAC/B,OAAO,CAAC,QAAQ,CAAC,cAAc;gBADd,cAAc,EAAE,qBAAqB,EACrC,cAAc,EAAE,qBAAqB;IAGlD,OAAO,IAAI,0BAA0B,CAAC,oBAAoB,CAAC;CAKlE;AAED,qBAEa,gCACX,YAAW,qBAAqB,CAAC,IAAI,EAAE,yBAAyB,CAAC;IAG/D,OAAO,CAAC,QAAQ,CAAC,cAAc;IAC/B,OAAO,CAAC,QAAQ,CAAC,cAAc;gBADd,cAAc,EAAE,qBAAqB,EACrC,cAAc,EAAE,qBAAqB;IAGlD,OAAO,IAAI,0BAA0B,CAAC,yBAAyB,CAAC;CAQvE;AAED,qBAEa,+BAAgC,YAAW,qBAAqB,CAAC,IAAI,EAAE,sBAAsB,CAAC;IAEvG,OAAO,CAAC,QAAQ,CAAC,cAAc;IAC/B,OAAO,CAAC,QAAQ,CAAC,cAAc;gBADd,cAAc,EAAE,qBAAqB,EACrC,cAAc,EAAE,qBAAqB;IAGlD,OAAO,IAAI,0BAA0B,CAAC,sBAAsB,CAAC;CASpE;AAED,eAAO,MAAM,oBAAoB,kKAKhC,CAAC"}

package/security/src/lib/auth/auth-runtime.handlers.js

@@ -0,0 +1,254 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AUTH_RUNTIME_QUERIES = exports.AuthGetAccessPolicyRuntimeQuery = exports.AuthListApplicationsRuntimeQuery = exports.AuthListTenantsRuntimeQuery = exports.AuthListProvidersRuntimeQuery = exports.AUTH_RUNTIME_COMMANDS = exports.AuthUpdateSessionRuntimeCommand = exports.AuthLogoutRuntimeCommand = exports.AuthRefreshRuntimeCommand = exports.AuthRegisterRuntimeCommand = exports.AuthSignInRuntimeCommand = void 0;
+const tslib_1 = require("tslib");
+const core_1 = require("@acorex-platform/framework-shared/core");
+const runtime_1 = require("@acorex-platform/framework-shared/runtime");
+const abstract_1 = require("@acorex-platform/framework-server/domain/abstract");
+const common_1 = require("@nestjs/common");
+const core_2 = require("@nestjs/core");
+const auth_http_request_util_1 = require("./auth-http-request.util");
+const auth_cookie_response_util_1 = require("./auth-cookie-response.util");
+const auth_cookie_service_1 = require("./auth-cookie.service");
+const auth_service_1 = require("./auth.service");
+const login_attempt_service_1 = require("./login-attempt.service");
+const request_meta_util_1 = require("./request-meta.util");
+const token_resolver_service_1 = require("./token-resolver.service");
+const token_service_1 = require("./token.service");
+const backend_session_service_1 = require("../session/backend-session.service");
+const session_context_service_1 = require("../session/session-context.service");
+const auth_identity_provider_source_1 = require("./auth-identity-provider.source");
+//#region ---- Auth runtime commands ----
+let AuthSignInRuntimeCommand = class AuthSignInRuntimeCommand {
+    constructor(auth, loginAttempts, cookies, tokens) {
+        this.auth = auth;
+        this.loginAttempts = loginAttempts;
+        this.cookies = cookies;
+        this.tokens = tokens;
+    }
+    async execute(input) {
+        this.auth.assertSupportedSignInStrategy(input.strategy);
+        const username = String(input.username ?? '').trim();
+        const password = String(input.password ?? '');
+        const user = await this.loginAttempts.authenticateLocal(this.loginAttempts.strategyName(), username, password);
+        const request = (0, auth_http_request_util_1.resolveAuthHttpRequest)();
+        const meta = (0, request_meta_util_1.resolveAuthRequestMeta)(request);
+        const data = await this.auth.completeSignIn(user, meta);
+        (0, auth_cookie_response_util_1.applyAuthTokenCookies)(request, this.cookies, this.tokens, data);
+        return { success: true, kind: 'object', data };
+    }
+};
+exports.AuthSignInRuntimeCommand = AuthSignInRuntimeCommand;
+exports.AuthSignInRuntimeCommand = AuthSignInRuntimeCommand = tslib_1.__decorate([
+    (0, abstract_1.ServerHandler)({ key: runtime_1.AUTH_SIGN_IN_DEFAULT, auth: 'public' }),
+    (0, common_1.Injectable)(),
+    tslib_1.__metadata("design:paramtypes", [auth_service_1.AuthService,
+        login_attempt_service_1.LoginAttemptService,
+        auth_cookie_service_1.AuthCookieService,
+        token_service_1.TokenService])
+], AuthSignInRuntimeCommand);
+let AuthRegisterRuntimeCommand = class AuthRegisterRuntimeCommand {
+    constructor(auth, cookies, tokens) {
+        this.auth = auth;
+        this.cookies = cookies;
+        this.tokens = tokens;
+    }
+    async execute(input) {
+        const request = (0, auth_http_request_util_1.resolveAuthHttpRequest)();
+        const meta = (0, request_meta_util_1.resolveAuthRequestMeta)(request);
+        const data = await this.auth.register(input, meta);
+        (0, auth_cookie_response_util_1.applyAuthTokenCookies)(request, this.cookies, this.tokens, data);
+        return { success: true, kind: 'object', data };
+    }
+};
+exports.AuthRegisterRuntimeCommand = AuthRegisterRuntimeCommand;
+exports.AuthRegisterRuntimeCommand = AuthRegisterRuntimeCommand = tslib_1.__decorate([
+    (0, abstract_1.ServerHandler)({ key: runtime_1.AUTH_REGISTER_DEFAULT, auth: 'public' }),
+    (0, common_1.Injectable)(),
+    tslib_1.__metadata("design:paramtypes", [auth_service_1.AuthService,
+        auth_cookie_service_1.AuthCookieService,
+        token_service_1.TokenService])
+], AuthRegisterRuntimeCommand);
+let AuthRefreshRuntimeCommand = class AuthRefreshRuntimeCommand {
+    constructor(auth, cookies, tokens) {
+        this.auth = auth;
+        this.cookies = cookies;
+        this.tokens = tokens;
+    }
+    async execute(input) {
+        const request = (0, auth_http_request_util_1.resolveAuthHttpRequest)();
+        const refreshToken = this.cookies.readRefreshToken(request.cookies) ??
+            input.refreshToken?.trim() ??
+            null;
+        if (!refreshToken) {
+            throw new common_1.UnauthorizedException('refreshToken is required');
+        }
+        const meta = (0, request_meta_util_1.resolveAuthRequestMeta)(request);
+        const data = await this.auth.refreshSession(refreshToken, meta);
+        (0, auth_cookie_response_util_1.applyAuthTokenCookies)(request, this.cookies, this.tokens, data);
+        return { success: true, kind: 'object', data };
+    }
+};
+exports.AuthRefreshRuntimeCommand = AuthRefreshRuntimeCommand;
+exports.AuthRefreshRuntimeCommand = AuthRefreshRuntimeCommand = tslib_1.__decorate([
+    (0, abstract_1.ServerHandler)({ key: runtime_1.AUTH_REFRESH_DEFAULT, auth: 'public' }),
+    (0, common_1.Injectable)(),
+    tslib_1.__metadata("design:paramtypes", [auth_service_1.AuthService,
+        auth_cookie_service_1.AuthCookieService,
+        token_service_1.TokenService])
+], AuthRefreshRuntimeCommand);
+let AuthLogoutRuntimeCommand = class AuthLogoutRuntimeCommand {
+    constructor(auth, cookies) {
+        this.auth = auth;
+        this.cookies = cookies;
+    }
+    async execute(input) {
+        const request = (0, auth_http_request_util_1.resolveAuthHttpRequest)();
+        const refreshToken = this.cookies.readRefreshToken(request.cookies) ??
+            input.refreshToken?.trim() ??
+            null;
+        await this.auth.logout(refreshToken);
+        (0, auth_cookie_response_util_1.clearAuthTokenCookies)(request, this.cookies);
+        return (0, core_1.runtimeCommandSuccessObject)(undefined);
+    }
+};
+exports.AuthLogoutRuntimeCommand = AuthLogoutRuntimeCommand;
+exports.AuthLogoutRuntimeCommand = AuthLogoutRuntimeCommand = tslib_1.__decorate([
+    (0, abstract_1.ServerHandler)({ key: runtime_1.AUTH_LOGOUT_DEFAULT, auth: 'public' }),
+    (0, common_1.Injectable)(),
+    tslib_1.__metadata("design:paramtypes", [auth_service_1.AuthService,
+        auth_cookie_service_1.AuthCookieService])
+], AuthLogoutRuntimeCommand);
+let AuthUpdateSessionRuntimeCommand = class AuthUpdateSessionRuntimeCommand {
+    constructor(auth, tokenResolver, cookies, tokens) {
+        this.auth = auth;
+        this.tokenResolver = tokenResolver;
+        this.cookies = cookies;
+        this.tokens = tokens;
+    }
+    async execute(input) {
+        const request = (0, auth_http_request_util_1.resolveAuthHttpRequest)();
+        const resolved = this.tokenResolver.resolveAccessToken(request.headers, request.cookies);
+        if (!resolved) {
+            throw new common_1.UnauthorizedException('Access token is required');
+        }
+        const meta = (0, request_meta_util_1.resolveAuthRequestMeta)(request);
+        const data = await this.auth.updateSession(resolved.token, input, meta);
+        (0, auth_cookie_response_util_1.applyAuthTokenCookies)(request, this.cookies, this.tokens, data);
+        return { success: true, kind: 'object', data };
+    }
+};
+exports.AuthUpdateSessionRuntimeCommand = AuthUpdateSessionRuntimeCommand;
+exports.AuthUpdateSessionRuntimeCommand = AuthUpdateSessionRuntimeCommand = tslib_1.__decorate([
+    (0, abstract_1.ServerHandler)({ key: runtime_1.AUTH_UPDATE_SESSION_DEFAULT, auth: 'session' }),
+    (0, common_1.Injectable)(),
+    tslib_1.__metadata("design:paramtypes", [auth_service_1.AuthService,
+        token_resolver_service_1.TokenResolverService,
+        auth_cookie_service_1.AuthCookieService,
+        token_service_1.TokenService])
+], AuthUpdateSessionRuntimeCommand);
+exports.AUTH_RUNTIME_COMMANDS = [
+    AuthSignInRuntimeCommand,
+    AuthRegisterRuntimeCommand,
+    AuthRefreshRuntimeCommand,
+    AuthLogoutRuntimeCommand,
+    AuthUpdateSessionRuntimeCommand,
+];
+//#endregion
+//#region ---- Auth runtime queries ----
+let AuthListProvidersRuntimeQuery = class AuthListProvidersRuntimeQuery {
+    constructor(moduleRef) {
+        this.moduleRef = moduleRef;
+    }
+    async execute() {
+        const localMethods = [
+            {
+                id: 'user-pass',
+                title: 'Password',
+                protocol: 'password',
+                enabled: true,
+            },
+        ];
+        const catalog = this.resolveIdentityProviderCatalog();
+        const identityProviders = catalog ? await catalog.listEnabledForLogin() : [];
+        return (0, core_1.runtimeQuerySuccessObject)({ localMethods, identityProviders });
+    }
+    resolveIdentityProviderCatalog() {
+        try {
+            return this.moduleRef.get(auth_identity_provider_source_1.AUTH_IDENTITY_PROVIDER_CATALOG, {
+                strict: false,
+            });
+        }
+        catch {
+            return null;
+        }
+    }
+};
+exports.AuthListProvidersRuntimeQuery = AuthListProvidersRuntimeQuery;
+exports.AuthListProvidersRuntimeQuery = AuthListProvidersRuntimeQuery = tslib_1.__decorate([
+    (0, abstract_1.ServerQueryHandler)({ key: runtime_1.AUTH_LIST_PROVIDERS_DEFAULT, auth: 'public' }),
+    (0, common_1.Injectable)(),
+    tslib_1.__metadata("design:paramtypes", [core_2.ModuleRef])
+], AuthListProvidersRuntimeQuery);
+let AuthListTenantsRuntimeQuery = class AuthListTenantsRuntimeQuery {
+    constructor(sessionContext, backendSession) {
+        this.sessionContext = sessionContext;
+        this.backendSession = backendSession;
+    }
+    async execute() {
+        const session = this.backendSession.requireAuthenticated();
+        const page = await this.sessionContext.getAvailableTenantsForUser(session.userId);
+        return (0, core_1.runtimeQuerySuccessCollection)(page);
+    }
+};
+exports.AuthListTenantsRuntimeQuery = AuthListTenantsRuntimeQuery;
+exports.AuthListTenantsRuntimeQuery = AuthListTenantsRuntimeQuery = tslib_1.__decorate([
+    (0, abstract_1.ServerQueryHandler)({ key: runtime_1.AUTH_LIST_TENANTS_DEFAULT, auth: 'session' }),
+    (0, common_1.Injectable)(),
+    tslib_1.__metadata("design:paramtypes", [session_context_service_1.SessionContextService,
+        backend_session_service_1.BackendSessionService])
+], AuthListTenantsRuntimeQuery);
+let AuthListApplicationsRuntimeQuery = class AuthListApplicationsRuntimeQuery {
+    constructor(sessionContext, backendSession) {
+        this.sessionContext = sessionContext;
+        this.backendSession = backendSession;
+    }
+    async execute() {
+        const session = this.backendSession.requireAuthenticated();
+        const page = await this.sessionContext.getApplicationsForCurrentTenant(session.userId, session.tenantId);
+        return (0, core_1.runtimeQuerySuccessCollection)(page);
+    }
+};
+exports.AuthListApplicationsRuntimeQuery = AuthListApplicationsRuntimeQuery;
+exports.AuthListApplicationsRuntimeQuery = AuthListApplicationsRuntimeQuery = tslib_1.__decorate([
+    (0, abstract_1.ServerQueryHandler)({ key: runtime_1.AUTH_LIST_APPLICATIONS_DEFAULT, auth: 'session' }),
+    (0, common_1.Injectable)(),
+    tslib_1.__metadata("design:paramtypes", [session_context_service_1.SessionContextService,
+        backend_session_service_1.BackendSessionService])
+], AuthListApplicationsRuntimeQuery);
+let AuthGetAccessPolicyRuntimeQuery = class AuthGetAccessPolicyRuntimeQuery {
+    constructor(sessionContext, backendSession) {
+        this.sessionContext = sessionContext;
+        this.backendSession = backendSession;
+    }
+    async execute() {
+        const session = this.backendSession.requireAuthenticated();
+        const data = await this.sessionContext.getAccessPolicy(session.userId, session.tenantId, session.applicationId);
+        return (0, core_1.runtimeQuerySuccessObject)(data);
+    }
+};
+exports.AuthGetAccessPolicyRuntimeQuery = AuthGetAccessPolicyRuntimeQuery;
+exports.AuthGetAccessPolicyRuntimeQuery = AuthGetAccessPolicyRuntimeQuery = tslib_1.__decorate([
+    (0, abstract_1.ServerQueryHandler)({ key: runtime_1.AUTH_GET_ACCESS_POLICY_DEFAULT, auth: 'session' }),
+    (0, common_1.Injectable)(),
+    tslib_1.__metadata("design:paramtypes", [session_context_service_1.SessionContextService,
+        backend_session_service_1.BackendSessionService])
+], AuthGetAccessPolicyRuntimeQuery);
+exports.AUTH_RUNTIME_QUERIES = [
+    AuthListProvidersRuntimeQuery,
+    AuthListTenantsRuntimeQuery,
+    AuthListApplicationsRuntimeQuery,
+    AuthGetAccessPolicyRuntimeQuery,
+];
+//#endregion
+//# sourceMappingURL=auth-runtime.handlers.js.map

package/security/src/lib/auth/auth-runtime.handlers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-runtime.handlers.js","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/auth/auth-runtime.handlers.ts"],"names":[],"mappings":";;;;AACA,iEAIgD;AAEhD,uEAUmD;AACnD,gFAAkI;AAClI,2CAAmE;AACnE,uCAAyC;AAEzC,qEAAkE;AAClE,2EAGqC;AACrC,+DAA0D;AAC1D,iDAA6C;AAQ7C,mEAA8D;AAC9D,2DAA6D;AAC7D,qEAAgE;AAChE,mDAA+C;AAC/C,gFAA2E;AAC3E,gFAA2E;AAC3E,mFAKyC;AAOzC,yCAAyC;AAIlC,IAAM,wBAAwB,GAA9B,MAAM,wBAAwB;IACnC,YACmB,IAAiB,EACjB,aAAkC,EAClC,OAA0B,EAC1B,MAAoB;QAHpB,SAAI,GAAJ,IAAI,CAAa;QACjB,kBAAa,GAAb,aAAa,CAAqB;QAClC,YAAO,GAAP,OAAO,CAAmB;QAC1B,WAAM,GAAN,MAAM,CAAc;IACpC,CAAC;IAEJ,KAAK,CAAC,OAAO,CAAC,KAAuB;QACnC,IAAI,CAAC,IAAI,CAAC,6BAA6B,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAExD,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACrD,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC;QAE9C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,iBAAiB,CACrD,IAAI,CAAC,aAAa,CAAC,YAAY,EAAE,EACjC,QAAQ,EACR,QAAQ,CACT,CAAC;QAEF,MAAM,OAAO,GAAG,IAAA,+CAAsB,GAAE,CAAC;QACzC,MAAM,IAAI,GAAG,IAAA,0CAAsB,EAAC,OAAO,CAAC,CAAC;QAC7C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACxD,IAAA,iDAAqB,EAAC,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAEhE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IACjD,CAAC;CACF,CAAA;AA3BY,4DAAwB;mCAAxB,wBAAwB;IAFpC,IAAA,wBAAa,EAAC,EAAE,GAAG,EAAE,8BAAoB,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IAC5D,IAAA,mBAAU,GAAE;6CAGc,0BAAW;QACF,2CAAmB;QACzB,uCAAiB;QAClB,4BAAY;GAL5B,wBAAwB,CA2BpC;AAIM,IAAM,0BAA0B,GAAhC,MAAM,0BAA0B;IACrC,YACmB,IAAiB,EACjB,OAA0B,EAC1B,MAAoB;QAFpB,SAAI,GAAJ,IAAI,CAAa;QACjB,YAAO,GAAP,OAAO,CAAmB;QAC1B,WAAM,GAAN,MAAM,CAAc;IACpC,CAAC;IAEJ,KAAK,CAAC,OAAO,CAAC,KAAyB;QACrC,MAAM,OAAO,GAAG,IAAA,+CAAsB,GAAE,CAAC;QACzC,MAAM,IAAI,GAAG,IAAA,0CAAsB,EAAC,OAAO,CAAC,CAAC;QAC7C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QACnD,IAAA,iDAAqB,EAAC,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAEhE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IACjD,CAAC;CACF,CAAA;AAfY,gEAA0B;qCAA1B,0BAA0B;IAFtC,IAAA,wBAAa,EAAC,EAAE,GAAG,EAAE,+BAAqB,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IAC7D,IAAA,mBAAU,GAAE;6CAGc,0BAAW;QACR,uCAAiB;QAClB,4BAAY;GAJ5B,0BAA0B,CAetC;AAIM,IAAM,yBAAyB,GAA/B,MAAM,yBAAyB;IAGpC,YACmB,IAAiB,EACjB,OAA0B,EAC1B,MAAoB;QAFpB,SAAI,GAAJ,IAAI,CAAa;QACjB,YAAO,GAAP,OAAO,CAAmB;QAC1B,WAAM,GAAN,MAAM,CAAc;IACpC,CAAC;IAEJ,KAAK,CAAC,OAAO,CAAC,KAA6B;QACzC,MAAM,OAAO,GAAG,IAAA,+CAAsB,GAAE,CAAC;QACzC,MAAM,YAAY,GAChB,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,OAAO,CAAC,OAAkC,CAAC;YACzE,KAAK,CAAC,YAAY,EAAE,IAAI,EAAE;YAC1B,IAAI,CAAC;QAEP,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,MAAM,IAAI,8BAAqB,CAAC,0BAA0B,CAAC,CAAC;QAC9D,CAAC;QAED,MAAM,IAAI,GAAG,IAAA,0CAAsB,EAAC,OAAO,CAAC,CAAC;QAC7C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC;QAChE,IAAA,iDAAqB,EAAC,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAEhE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IACjD,CAAC;CACF,CAAA;AA1BY,8DAAyB;oCAAzB,yBAAyB;IAFrC,IAAA,wBAAa,EAAC,EAAE,GAAG,EAAE,8BAAoB,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IAC5D,IAAA,mBAAU,GAAE;6CAKc,0BAAW;QACR,uCAAiB;QAClB,4BAAY;GAN5B,yBAAyB,CA0BrC;AAIM,IAAM,wBAAwB,GAA9B,MAAM,wBAAwB;IACnC,YACmB,IAAiB,EACjB,OAA0B;QAD1B,SAAI,GAAJ,IAAI,CAAa;QACjB,YAAO,GAAP,OAAO,CAAmB;IAC1C,CAAC;IAEJ,KAAK,CAAC,OAAO,CAAC,KAA6B;QACzC,MAAM,OAAO,GAAG,IAAA,+CAAsB,GAAE,CAAC;QACzC,MAAM,YAAY,GAChB,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,OAAO,CAAC,OAAkC,CAAC;YACzE,KAAK,CAAC,YAAY,EAAE,IAAI,EAAE;YAC1B,IAAI,CAAC;QAEP,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QACrC,IAAA,iDAAqB,EAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;QAE7C,OAAO,IAAA,kCAA2B,EAAC,SAAS,CAAC,CAAC;IAChD,CAAC;CACF,CAAA;AAlBY,4DAAwB;mCAAxB,wBAAwB;IAFpC,IAAA,wBAAa,EAAC,EAAE,GAAG,EAAE,6BAAmB,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IAC3D,IAAA,mBAAU,GAAE;6CAGc,0BAAW;QACR,uCAAiB;GAHlC,wBAAwB,CAkBpC;AAIM,IAAM,+BAA+B,GAArC,MAAM,+BAA+B;IAG1C,YACmB,IAAiB,EACjB,aAAmC,EACnC,OAA0B,EAC1B,MAAoB;QAHpB,SAAI,GAAJ,IAAI,CAAa;QACjB,kBAAa,GAAb,aAAa,CAAsB;QACnC,YAAO,GAAP,OAAO,CAAmB;QAC1B,WAAM,GAAN,MAAM,CAAc;IACpC,CAAC;IAEJ,KAAK,CAAC,OAAO,CAAC,KAA8B;QAC1C,MAAM,OAAO,GAAG,IAAA,+CAAsB,GAAE,CAAC;QACzC,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,CAAC,kBAAkB,CACpD,OAAO,CAAC,OAAwD,EAChE,OAAO,CAAC,OAAkC,CAC3C,CAAC;QAEF,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,8BAAqB,CAAC,0BAA0B,CAAC,CAAC;QAC9D,CAAC;QAED,MAAM,IAAI,GAAG,IAAA,0CAAsB,EAAC,OAAO,CAAC,CAAC;QAC7C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;QACxE,IAAA,iDAAqB,EAAC,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAEhE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IACjD,CAAC;CACF,CAAA;AA3BY,0EAA+B;0CAA/B,+BAA+B;IAF3C,IAAA,wBAAa,EAAC,EAAE,GAAG,EAAE,qCAA2B,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IACpE,IAAA,mBAAU,GAAE;6CAKc,0BAAW;QACF,6CAAoB;QAC1B,uCAAiB;QAClB,4BAAY;GAP5B,+BAA+B,CA2B3C;AAEY,QAAA,qBAAqB,GAAG;IACnC,wBAAwB;IACxB,0BAA0B;IAC1B,yBAAyB;IACzB,wBAAwB;IACxB,+BAA+B;CAChC,CAAC;AAEF,YAAY;AAEZ,wCAAwC;AAIjC,IAAM,6BAA6B,GAAnC,MAAM,6BAA6B;IACxC,YAA6B,SAAoB;QAApB,cAAS,GAAT,SAAS,CAAW;IAAG,CAAC;IAErD,KAAK,CAAC,OAAO;QACX,MAAM,YAAY,GAA+B;YAC/C;gBACE,EAAE,EAAE,WAAW;gBACf,KAAK,EAAE,UAAU;gBACjB,QAAQ,EAAE,UAAU;gBACpB,OAAO,EAAE,IAAI;aACd;SACF,CAAC;QAEF,MAAM,OAAO,GAAG,IAAI,CAAC,8BAA8B,EAAE,CAAC;QACtD,MAAM,iBAAiB,GAAG,OAAO,CAAC,CAAC,CAAC,MAAM,OAAO,CAAC,mBAAmB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAE7E,OAAO,IAAA,gCAAyB,EAAC,EAAE,YAAY,EAAE,iBAAiB,EAAE,CAAC,CAAC;IACxE,CAAC;IAEO,8BAA8B;QACpC,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAA8B,8DAA8B,EAAE;gBACrF,MAAM,EAAE,KAAK;aACd,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;CACF,CAAA;AA5BY,sEAA6B;wCAA7B,6BAA6B;IAFzC,IAAA,6BAAkB,EAAC,EAAE,GAAG,EAAE,qCAA2B,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IACxE,IAAA,mBAAU,GAAE;6CAE6B,gBAAS;GADtC,6BAA6B,CA4BzC;AAIM,IAAM,2BAA2B,GAAjC,MAAM,2BAA2B;IAGtC,YACmB,cAAqC,EACrC,cAAqC;QADrC,mBAAc,GAAd,cAAc,CAAuB;QACrC,mBAAc,GAAd,cAAc,CAAuB;IACrD,CAAC;IAEJ,KAAK,CAAC,OAAO;QACX,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,oBAAoB,EAAE,CAAC;QAC3D,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,0BAA0B,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAClF,OAAO,IAAA,oCAA6B,EAAC,IAAI,CAAC,CAAC;IAC7C,CAAC;CACF,CAAA;AAbY,kEAA2B;sCAA3B,2BAA2B;IAFvC,IAAA,6BAAkB,EAAC,EAAE,GAAG,EAAE,mCAAyB,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IACvE,IAAA,mBAAU,GAAE;6CAKwB,+CAAqB;QACrB,+CAAqB;GAL7C,2BAA2B,CAavC;AAIM,IAAM,gCAAgC,GAAtC,MAAM,gCAAgC;IAG3C,YACmB,cAAqC,EACrC,cAAqC;QADrC,mBAAc,GAAd,cAAc,CAAuB;QACrC,mBAAc,GAAd,cAAc,CAAuB;IACrD,CAAC;IAEJ,KAAK,CAAC,OAAO;QACX,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,oBAAoB,EAAE,CAAC;QAC3D,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,+BAA+B,CACpE,OAAO,CAAC,MAAM,EACd,OAAO,CAAC,QAAQ,CACjB,CAAC;QACF,OAAO,IAAA,oCAA6B,EAAC,IAAI,CAAC,CAAC;IAC7C,CAAC;CACF,CAAA;AAhBY,4EAAgC;2CAAhC,gCAAgC;IAF5C,IAAA,6BAAkB,EAAC,EAAE,GAAG,EAAE,wCAA8B,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IAC5E,IAAA,mBAAU,GAAE;6CAKwB,+CAAqB;QACrB,+CAAqB;GAL7C,gCAAgC,CAgB5C;AAIM,IAAM,+BAA+B,GAArC,MAAM,+BAA+B;IAC1C,YACmB,cAAqC,EACrC,cAAqC;QADrC,mBAAc,GAAd,cAAc,CAAuB;QACrC,mBAAc,GAAd,cAAc,CAAuB;IACrD,CAAC;IAEJ,KAAK,CAAC,OAAO;QACX,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,oBAAoB,EAAE,CAAC;QAC3D,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,eAAe,CACpD,OAAO,CAAC,MAAM,EACd,OAAO,CAAC,QAAQ,EAChB,OAAO,CAAC,aAAa,CACtB,CAAC;QACF,OAAO,IAAA,gCAAyB,EAAC,IAAI,CAAC,CAAC;IACzC,CAAC;CACF,CAAA;AAfY,0EAA+B;0CAA/B,+BAA+B;IAF3C,IAAA,6BAAkB,EAAC,EAAE,GAAG,EAAE,wCAA8B,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IAC5E,IAAA,mBAAU,GAAE;6CAGwB,+CAAqB;QACrB,+CAAqB;GAH7C,+BAA+B,CAe3C;AAEY,QAAA,oBAAoB,GAAG;IAClC,6BAA6B;IAC7B,2BAA2B;IAC3B,gCAAgC;IAChC,+BAA+B;CAChC,CAAC;AAEF,YAAY"}

package/security/src/lib/auth/auth.config.d.ts

@@ -1,12 +1,9 @@
 export declare const AUTH_COOKIE_REFRESH_TOKEN = "acx_refresh_token";
-/** Optional short-lived access token cookie for legacy cookie-based guards. */
+/** HttpOnly access token cookie (primary SPA credential). */
 export declare const AUTH_COOKIE_ACCESS_TOKEN = "acx_access_token";
 export declare const AUTH_STRATEGY_USER_PASS = "user-pass";
-export declare const AUTH_MAX_LOGIN_ATTEMPTS: () => number;
-export declare const AUTH_LOCKOUT_DURATION_MINUTES: () => number;
-/** Failed attempts before the API signals that a login challenge may be required. */
-export declare const AUTH_CAPTCHA_ATTEMPT_THRESHOLD: () => number;
 export declare const AUTH_COOKIE_SECURE: () => boolean;
 export declare const AUTH_COOKIE_SAME_SITE: () => "lax" | "strict" | "none";
+/** Path scoped so refresh cookies are sent to all `/api` routes (incl. runtime). */
 export declare const AUTH_REFRESH_COOKIE_PATH: () => string;
 //# sourceMappingURL=auth.config.d.ts.map

package/security/src/lib/auth/auth.config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.config.d.ts","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/auth/auth.config.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,yBAAyB,sBAAsB,CAAC;AAE7D,+EAA+E;AAC/E,eAAO,MAAM,wBAAwB,qBAAqB,CAAC;AAE3D,eAAO,MAAM,uBAAuB,cAAc,CAAC;AAEnD,eAAO,MAAM,uBAAuB,QAAO,MAI1C,CAAC;AAEF,eAAO,MAAM,6BAA6B,QAAO,MAIhD,CAAC;AAEF,qFAAqF;AACrF,eAAO,MAAM,8BAA8B,QAAO,MAIjD,CAAC;AAEF,eAAO,MAAM,kBAAkB,QAAO,OACoD,CAAC;AAE3F,eAAO,MAAM,qBAAqB,QAAO,KAAK,GAAG,QAAQ,GAAG,MAM3D,CAAC;AAEF,eAAO,MAAM,wBAAwB,QAAO,MACuB,CAAC"}
+{"version":3,"file":"auth.config.d.ts","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/auth/auth.config.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,yBAAyB,sBAAsB,CAAC;AAE7D,6DAA6D;AAC7D,eAAO,MAAM,wBAAwB,qBAAqB,CAAC;AAE3D,eAAO,MAAM,uBAAuB,cAAc,CAAC;AAEnD,eAAO,MAAM,kBAAkB,QAAO,OACoD,CAAC;AAE3F,eAAO,MAAM,qBAAqB,QAAO,KAAK,GAAG,QAAQ,GAAG,MAM3D,CAAC;AAEF,oFAAoF;AACpF,eAAO,MAAM,wBAAwB,QAAO,MACe,CAAC"}

package/security/src/lib/auth/auth.config.js

@@ -1,30 +1,11 @@
 "use strict";
 //#region ---- Auth configuration ----
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.AUTH_REFRESH_COOKIE_PATH = exports.AUTH_COOKIE_SAME_SITE = exports.AUTH_COOKIE_SECURE = exports.AUTH_CAPTCHA_ATTEMPT_THRESHOLD = exports.AUTH_LOCKOUT_DURATION_MINUTES = exports.AUTH_MAX_LOGIN_ATTEMPTS = exports.AUTH_STRATEGY_USER_PASS = exports.AUTH_COOKIE_ACCESS_TOKEN = exports.AUTH_COOKIE_REFRESH_TOKEN = void 0;
+exports.AUTH_REFRESH_COOKIE_PATH = exports.AUTH_COOKIE_SAME_SITE = exports.AUTH_COOKIE_SECURE = exports.AUTH_STRATEGY_USER_PASS = exports.AUTH_COOKIE_ACCESS_TOKEN = exports.AUTH_COOKIE_REFRESH_TOKEN = void 0;
 exports.AUTH_COOKIE_REFRESH_TOKEN = 'acx_refresh_token';
-/** Optional short-lived access token cookie for legacy cookie-based guards. */
+/** HttpOnly access token cookie (primary SPA credential). */
 exports.AUTH_COOKIE_ACCESS_TOKEN = 'acx_access_token';
 exports.AUTH_STRATEGY_USER_PASS = 'user-pass';
-const AUTH_MAX_LOGIN_ATTEMPTS = () => {
-    const raw = process.env['AUTH_MAX_LOGIN_ATTEMPTS']?.trim();
-    const parsed = raw ? Number(raw) : 5;
-    return Number.isFinite(parsed) && parsed >= 1 ? parsed : 5;
-};
-exports.AUTH_MAX_LOGIN_ATTEMPTS = AUTH_MAX_LOGIN_ATTEMPTS;
-const AUTH_LOCKOUT_DURATION_MINUTES = () => {
-    const raw = process.env['AUTH_LOCKOUT_DURATION_MINUTES']?.trim();
-    const parsed = raw ? Number(raw) : 15;
-    return Number.isFinite(parsed) && parsed >= 1 ? parsed : 15;
-};
-exports.AUTH_LOCKOUT_DURATION_MINUTES = AUTH_LOCKOUT_DURATION_MINUTES;
-/** Failed attempts before the API signals that a login challenge may be required. */
-const AUTH_CAPTCHA_ATTEMPT_THRESHOLD = () => {
-    const raw = process.env['AUTH_CAPTCHA_ATTEMPT_THRESHOLD']?.trim();
-    const parsed = raw ? Number(raw) : 3;
-    return Number.isFinite(parsed) && parsed >= 1 ? parsed : 3;
-};
-exports.AUTH_CAPTCHA_ATTEMPT_THRESHOLD = AUTH_CAPTCHA_ATTEMPT_THRESHOLD;
 const AUTH_COOKIE_SECURE = () => process.env['NODE_ENV'] === 'production' || process.env['AUTH_COOKIE_SECURE'] === 'true';
 exports.AUTH_COOKIE_SECURE = AUTH_COOKIE_SECURE;
 const AUTH_COOKIE_SAME_SITE = () => {
@@ -35,7 +16,8 @@ const AUTH_COOKIE_SAME_SITE = () => {
     return 'lax';
 };
 exports.AUTH_COOKIE_SAME_SITE = AUTH_COOKIE_SAME_SITE;
-const AUTH_REFRESH_COOKIE_PATH = () => process.env['AUTH_REFRESH_COOKIE_PATH']?.trim() || '/api/v1/auth';
+/** Path scoped so refresh cookies are sent to all `/api` routes (incl. runtime). */
+const AUTH_REFRESH_COOKIE_PATH = () => process.env['AUTH_REFRESH_COOKIE_PATH']?.trim() || '/api';
 exports.AUTH_REFRESH_COOKIE_PATH = AUTH_REFRESH_COOKIE_PATH;
 //#endregion
 //# sourceMappingURL=auth.config.js.map

package/security/src/lib/auth/auth.config.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.config.js","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/auth/auth.config.ts"],"names":[],"mappings":";AAAA,sCAAsC;;;AAEzB,QAAA,yBAAyB,GAAG,mBAAmB,CAAC;AAE7D,+EAA+E;AAClE,QAAA,wBAAwB,GAAG,kBAAkB,CAAC;AAE9C,QAAA,uBAAuB,GAAG,WAAW,CAAC;AAE5C,MAAM,uBAAuB,GAAG,GAAW,EAAE;IAClD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC,EAAE,IAAI,EAAE,CAAC;IAC3D,MAAM,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACrC,OAAO,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;AAC7D,CAAC,CAAC;AAJW,QAAA,uBAAuB,2BAIlC;AAEK,MAAM,6BAA6B,GAAG,GAAW,EAAE;IACxD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,+BAA+B,CAAC,EAAE,IAAI,EAAE,CAAC;IACjE,MAAM,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACtC,OAAO,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;AAC9D,CAAC,CAAC;AAJW,QAAA,6BAA6B,iCAIxC;AAEF,qFAAqF;AAC9E,MAAM,8BAA8B,GAAG,GAAW,EAAE;IACzD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,gCAAgC,CAAC,EAAE,IAAI,EAAE,CAAC;IAClE,MAAM,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACrC,OAAO,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;AAC7D,CAAC,CAAC;AAJW,QAAA,8BAA8B,kCAIzC;AAEK,MAAM,kBAAkB,GAAG,GAAY,EAAE,CAC9C,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,YAAY,IAAI,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,KAAK,MAAM,CAAC;AAD9E,QAAA,kBAAkB,sBAC4D;AAEpF,MAAM,qBAAqB,GAAG,GAA8B,EAAE;IACnE,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACzE,IAAI,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,MAAM,EAAE,CAAC;QAC3C,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC,CAAC;AANW,QAAA,qBAAqB,yBAMhC;AAEK,MAAM,wBAAwB,GAAG,GAAW,EAAE,CACnD,OAAO,CAAC,GAAG,CAAC,0BAA0B,CAAC,EAAE,IAAI,EAAE,IAAI,cAAc,CAAC;AADvD,QAAA,wBAAwB,4BAC+B;AAEpE,YAAY"}
+{"version":3,"file":"auth.config.js","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/auth/auth.config.ts"],"names":[],"mappings":";AAAA,sCAAsC;;;AAEzB,QAAA,yBAAyB,GAAG,mBAAmB,CAAC;AAE7D,6DAA6D;AAChD,QAAA,wBAAwB,GAAG,kBAAkB,CAAC;AAE9C,QAAA,uBAAuB,GAAG,WAAW,CAAC;AAE5C,MAAM,kBAAkB,GAAG,GAAY,EAAE,CAC9C,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,YAAY,IAAI,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,KAAK,MAAM,CAAC;AAD9E,QAAA,kBAAkB,sBAC4D;AAEpF,MAAM,qBAAqB,GAAG,GAA8B,EAAE;IACnE,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACzE,IAAI,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,MAAM,EAAE,CAAC;QAC3C,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC,CAAC;AANW,QAAA,qBAAqB,yBAMhC;AAEF,oFAAoF;AAC7E,MAAM,wBAAwB,GAAG,GAAW,EAAE,CACnD,OAAO,CAAC,GAAG,CAAC,0BAA0B,CAAC,EAAE,IAAI,EAAE,IAAI,MAAM,CAAC;AAD/C,QAAA,wBAAwB,4BACuB;AAE5D,YAAY"}

package/security/src/lib/auth/auth.events.d.ts

@@ -0,0 +1,7 @@
+export declare const AUTH_LOGOUT_EVENT = "auth.logout";
+export interface AuthLogoutEventPayload {
+    userId: string;
+    tenantId?: string;
+    at: string;
+}
+//# sourceMappingURL=auth.events.d.ts.map

package/security/src/lib/auth/auth.events.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.events.d.ts","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/auth/auth.events.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,iBAAiB,gBAAgB,CAAC;AAE/C,MAAM,WAAW,sBAAsB;IACrC,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,EAAE,EAAE,MAAM,CAAC;CACZ"}

package/security/src/lib/auth/auth.events.js

@@ -0,0 +1,7 @@
+"use strict";
+//#region ----- Auth lifecycle events -----
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AUTH_LOGOUT_EVENT = void 0;
+exports.AUTH_LOGOUT_EVENT = 'auth.logout';
+//#endregion
+//# sourceMappingURL=auth.events.js.map

package/security/src/lib/auth/auth.events.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.events.js","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/auth/auth.events.ts"],"names":[],"mappings":";AAAA,2CAA2C;;;AAE9B,QAAA,iBAAiB,GAAG,aAAa,CAAC;AAQ/C,YAAY"}

package/security/src/lib/auth/auth.service.d.ts

@@ -1,16 +1,20 @@
 import { EntityStorageMiddlewareService } from '@acorex-platform/framework-server/core';
+import { EventEmitter2 } from '@nestjs/event-emitter';
 import { AuthLocalCredentialsService } from './auth-local-credentials.service';
 import { DeviceSessionService } from './device-session.service';
 import type { AuthRequestMeta } from './request-meta.util';
 import { TokenService } from './token.service';
 import type { AuthTokenResponseDto, RegisterRequestDto, SecurityManagementUserRecord, UpdateSessionRequestDto } from './auth.types';
+/** Stable client i18n mapping key — not shown raw in UI. */
+export declare const SESSION_MEMBERSHIP_DENIED_CODE = "SESSION_MEMBERSHIP_DENIED";
 export declare class AuthService {
     private readonly entityStorage;
     private readonly tokenService;
     private readonly localCredentials;
     private readonly deviceSessions;
+    private readonly events?;
     private readonly logger;
-    constructor(entityStorage: EntityStorageMiddlewareService, tokenService: TokenService, localCredentials: AuthLocalCredentialsService, deviceSessions: DeviceSessionService);
+    constructor(entityStorage: EntityStorageMiddlewareService, tokenService: TokenService, localCredentials: AuthLocalCredentialsService, deviceSessions: DeviceSessionService, events?: EventEmitter2 | undefined);
     completeSignIn(user: SecurityManagementUserRecord, meta: AuthRequestMeta): Promise<AuthTokenResponseDto>;
     assertSupportedSignInStrategy(strategy?: string): void;
     register(dto: RegisterRequestDto, meta: AuthRequestMeta): Promise<AuthTokenResponseDto>;
@@ -24,7 +28,15 @@ export declare class AuthService {
     accessTokenMaxAgeMs(): number;
     refreshTokenMaxAgeMs(): number;
     private completeAuthentication;
+    private emitLogoutEvent;
     private toAuthUser;
+    private normalizeAvatar;
+    /**
+     * Session bind requires active TenantUser for the tenant, and when an
+     * application is selected, active TenantUserAppAccess for that app.
+     * Nested reads use server-only scope bypass (membership tables filter by themselves).
+     */
+    private assertActiveMembership;
     private resolveTenantDto;
     private resolveApplicationDto;
 }

package/security/src/lib/auth/auth.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.service.d.ts","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/auth/auth.service.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,8BAA8B,EAAE,MAAM,wCAAwC,CAAC;AAKxF,OAAO,EAAE,2BAA2B,EAAE,MAAM,kCAAkC,CAAC;AAC/E,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAChE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,KAAK,EAGV,oBAAoB,EAEpB,kBAAkB,EAClB,4BAA4B,EAC5B,uBAAuB,EACxB,MAAM,cAAc,CAAC;AAUtB,qBACa,WAAW;IAIpB,OAAO,CAAC,QAAQ,CAAC,aAAa;IAC9B,OAAO,CAAC,QAAQ,CAAC,YAAY;IAC7B,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IACjC,OAAO,CAAC,QAAQ,CAAC,cAAc;IANjC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAgC;gBAGpC,aAAa,EAAE,8BAA8B,EAC7C,YAAY,EAAE,YAAY,EAC1B,gBAAgB,EAAE,2BAA2B,EAC7C,cAAc,EAAE,oBAAoB;IAGjD,cAAc,CAClB,IAAI,EAAE,4BAA4B,EAClC,IAAI,EAAE,eAAe,GACpB,OAAO,CAAC,oBAAoB,CAAC;IAIhC,6BAA6B,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI;IAOhD,QAAQ,CAAC,GAAG,EAAE,kBAAkB,EAAE,IAAI,EAAE,eAAe,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAiCvF,cAAc,CAAC,YAAY,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAuB1F,MAAM,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,IAAI,CAAA;KAAE,CAAC;IAehE,aAAa,CACjB,kBAAkB,EAAE,MAAM,EAC1B,GAAG,EAAE,uBAAuB,EAC5B,IAAI,EAAE,eAAe,GACpB,OAAO,CAAC,oBAAoB,CAAC;IAmChC,iBAAiB,CAAC,KAAK,EAAE,MAAM;IAQ/B,kBAAkB,CAAC,KAAK,EAAE,MAAM;IAQhC,mBAAmB,IAAI,MAAM;IAI7B,oBAAoB,IAAI,MAAM;YAIhB,sBAAsB;IAkCpC,OAAO,CAAC,UAAU;YAQJ,gBAAgB;YA+BhB,qBAAqB;CAkCpC"}
+{"version":3,"file":"auth.service.d.ts","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/auth/auth.service.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,8BAA8B,EAAE,MAAM,wCAAwC,CAAC;AAcxF,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAGtD,OAAO,EAAE,2BAA2B,EAAE,MAAM,kCAAkC,CAAC;AAC/E,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAChE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,KAAK,EAGV,oBAAoB,EAEpB,kBAAkB,EAClB,4BAA4B,EAC5B,uBAAuB,EACxB,MAAM,cAAc,CAAC;AAUtB,4DAA4D;AAC5D,eAAO,MAAM,8BAA8B,8BAA8B,CAAC;AAE1E,qBACa,WAAW;IAIpB,OAAO,CAAC,QAAQ,CAAC,aAAa;IAC9B,OAAO,CAAC,QAAQ,CAAC,YAAY;IAC7B,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IACjC,OAAO,CAAC,QAAQ,CAAC,cAAc;IACnB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;IAPtC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAgC;gBAGpC,aAAa,EAAE,8BAA8B,EAC7C,YAAY,EAAE,YAAY,EAC1B,gBAAgB,EAAE,2BAA2B,EAC7C,cAAc,EAAE,oBAAoB,EACxB,MAAM,CAAC,EAAE,aAAa,YAAA;IAG/C,cAAc,CAClB,IAAI,EAAE,4BAA4B,EAClC,IAAI,EAAE,eAAe,GACpB,OAAO,CAAC,oBAAoB,CAAC;IAIhC,6BAA6B,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI;IAOhD,QAAQ,CAAC,GAAG,EAAE,kBAAkB,EAAE,IAAI,EAAE,eAAe,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAqCvF,cAAc,CAAC,YAAY,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAyB1F,MAAM,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,IAAI,CAAA;KAAE,CAAC;IAoBhE,aAAa,CACjB,kBAAkB,EAAE,MAAM,EAC1B,GAAG,EAAE,uBAAuB,EAC5B,IAAI,EAAE,eAAe,GACpB,OAAO,CAAC,oBAAoB,CAAC;IAqChC,iBAAiB,CAAC,KAAK,EAAE,MAAM;IAQ/B,kBAAkB,CAAC,KAAK,EAAE,MAAM;IAQhC,mBAAmB,IAAI,MAAM;IAI7B,oBAAoB,IAAI,MAAM;YAIhB,sBAAsB;IAuDpC,OAAO,CAAC,eAAe;IAQvB,OAAO,CAAC,UAAU;IASlB,OAAO,CAAC,eAAe;IAcvB;;;;OAIG;YACW,sBAAsB;YA+FtB,gBAAgB;YAyChB,qBAAqB;CAuCpC"}