@acorex-platform/framework-server 0.0.18 → 0.0.20

package/security/src/lib/auth/device-session.service.js

@@ -9,6 +9,7 @@ const crypto_1 = require("crypto");
 const request_meta_util_1 = require("./request-meta.util");
 //#region ---- Device session service ----
 const DEVICE_SESSION_ENTITY = 'SecurityManagement.DeviceSessions';
+const SESSION_QUERY_PAGE = 100;
 let DeviceSessionService = DeviceSessionService_1 = class DeviceSessionService {
     constructor(entityStorage) {
         this.entityStorage = entityStorage;
@@ -42,6 +43,7 @@ let DeviceSessionService = DeviceSessionService_1 = class DeviceSessionService {
             browser: parsed.browser,
             location: 'Unknown',
             lastLoginDate: now,
+            sessionId: input.sessionId,
             config: { sessionId: input.sessionId },
         };
         try {
@@ -52,6 +54,42 @@ let DeviceSessionService = DeviceSessionService_1 = class DeviceSessionService {
             return record.id;
         }
     }
+    /**
+     * Tenant/app/token rotation during an existing sign-in journey.
+     * Updates the primary row for {@link sessionId} and revokes duplicate legacy rows.
+     */
+    async updateSessionBinding(input) {
+        const sessionId = input.sessionId.trim();
+        if (!sessionId) {
+            return false;
+        }
+        const rows = await this.findBySessionId(sessionId);
+        if (rows.length === 0) {
+            return false;
+        }
+        const primary = pickPrimarySessionRow(rows);
+        await this.revokeDuplicateSessionRows(rows, primary.id);
+        const tenantId = input.tenantId ?? primary.tenantId;
+        const applicationId = input.applicationId ?? primary.applicationId;
+        try {
+            await this.entityStorage.updateOne(DEVICE_SESSION_ENTITY, primary.id, {
+                authorizationId: input.authorizationId,
+                tenantId,
+                tenant: { id: tenantId, name: tenantId },
+                applicationId,
+                application: { id: applicationId, name: applicationId },
+                sessionId,
+                config: { sessionId },
+                status: 'active',
+                isActiveSession: true,
+            });
+            return true;
+        }
+        catch (error) {
+            this.logger.warn(`Failed to update device session binding: ${String(error)}`);
+            return false;
+        }
+    }
     async revokeByAuthorizationId(authorizationId) {
         try {
             const result = await this.entityStorage.query(DEVICE_SESSION_ENTITY, {
@@ -69,15 +107,87 @@ let DeviceSessionService = DeviceSessionService_1 = class DeviceSessionService {
                 },
             });
             const items = (result.items ?? []);
-            await Promise.all(items.map((item) => this.entityStorage.updateOne(DEVICE_SESSION_ENTITY, item.id, {
-                status: 'revoked',
-                isActiveSession: false,
-            })));
+            await Promise.all(items.map((item) => this.revokeSessionRow(item.id)));
         }
         catch (error) {
             this.logger.warn(`Failed to revoke device session: ${String(error)}`);
         }
     }
+    async findBySessionId(sessionId) {
+        const items = [];
+        let skip = 0;
+        for (;;) {
+            const page = await this.entityStorage.query(DEVICE_SESSION_ENTITY, {
+                skip,
+                take: SESSION_QUERY_PAGE,
+                filter: {
+                    logic: 'and',
+                    filters: [
+                        {
+                            field: 'sessionId',
+                            operator: { type: 'equal' },
+                            value: sessionId,
+                        },
+                    ],
+                },
+            });
+            const batch = (page.items ?? []);
+            items.push(...batch);
+            if (batch.length < SESSION_QUERY_PAGE) {
+                break;
+            }
+            skip += SESSION_QUERY_PAGE;
+        }
+        if (items.length === 0) {
+            return this.findBySessionIdFromConfig(sessionId);
+        }
+        return items
+            .map(asStoredDeviceSessionRow)
+            .filter((row) => row != null);
+    }
+    /** Legacy rows stored only under `config.sessionId`. */
+    async findBySessionIdFromConfig(sessionId) {
+        const items = [];
+        let skip = 0;
+        for (;;) {
+            const page = await this.entityStorage.query(DEVICE_SESSION_ENTITY, {
+                skip,
+                take: SESSION_QUERY_PAGE,
+                filter: {
+                    logic: 'and',
+                    filters: [
+                        {
+                            field: 'config.sessionId',
+                            operator: { type: 'equal' },
+                            value: sessionId,
+                        },
+                    ],
+                },
+            });
+            const batch = (page.items ?? []);
+            items.push(...batch);
+            if (batch.length < SESSION_QUERY_PAGE) {
+                break;
+            }
+            skip += SESSION_QUERY_PAGE;
+        }
+        return items
+            .map(asStoredDeviceSessionRow)
+            .filter((row) => row != null);
+    }
+    async revokeDuplicateSessionRows(rows, keepId) {
+        await Promise.all(rows
+            .filter((row) => row.id !== keepId && row.status.toLowerCase() === 'active')
+            .map((row) => this.revokeSessionRow(row.id)));
+    }
+    async revokeSessionRow(id) {
+        const loggedOutAt = new Date();
+        await this.entityStorage.updateOne(DEVICE_SESSION_ENTITY, id, {
+            status: 'revoked',
+            isActiveSession: false,
+            loggedOutAt,
+        });
+    }
 };
 exports.DeviceSessionService = DeviceSessionService;
 exports.DeviceSessionService = DeviceSessionService = DeviceSessionService_1 = tslib_1.__decorate([
@@ -85,4 +195,38 @@ exports.DeviceSessionService = DeviceSessionService = DeviceSessionService_1 = t
     tslib_1.__metadata("design:paramtypes", [core_1.EntityStorageMiddlewareService])
 ], DeviceSessionService);
 //#endregion
+//#region ----- Helpers -----
+function pickPrimarySessionRow(rows) {
+    const sorted = [...rows].sort((a, b) => (b.lastLoginDate?.getTime() ?? 0) - (a.lastLoginDate?.getTime() ?? 0));
+    return sorted.find((row) => row.status.toLowerCase() === 'active') ?? sorted[0];
+}
+function asStoredDeviceSessionRow(raw) {
+    const id = typeof raw['id'] === 'string' ? raw['id'] : '';
+    if (!id) {
+        return null;
+    }
+    const config = raw['config'];
+    const sessionId = (typeof raw['sessionId'] === 'string' && raw['sessionId'].trim()) ||
+        (typeof config?.sessionId === 'string' && config.sessionId.trim()) ||
+        '';
+    return {
+        id,
+        status: typeof raw['status'] === 'string' ? raw['status'] : 'unknown',
+        lastLoginDate: toDate(raw['lastLoginDate']),
+        tenantId: typeof raw['tenantId'] === 'string' ? raw['tenantId'] : 'default',
+        applicationId: typeof raw['applicationId'] === 'string' ? raw['applicationId'] : 'default',
+        sessionId,
+    };
+}
+function toDate(value) {
+    if (value instanceof Date && !Number.isNaN(value.getTime())) {
+        return value;
+    }
+    if (typeof value === 'string' && value.trim()) {
+        const parsed = new Date(value);
+        return Number.isNaN(parsed.getTime()) ? null : parsed;
+    }
+    return null;
+}
+//#endregion
 //# sourceMappingURL=device-session.service.js.map

package/security/src/lib/auth/device-session.service.js.map

@@ -1 +1 @@
-{"version":3,"file":"device-session.service.js","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/auth/device-session.service.ts"],"names":[],"mappings":";;;;;AAAA,2CAAoD;AACpD,iEAAwF;AACxF,mCAAoC;AAEpC,2DAAqD;AAGrD,0CAA0C;AAE1C,MAAM,qBAAqB,GAAG,mCAAmC,CAAC;AAY3D,IAAM,oBAAoB,4BAA1B,MAAM,oBAAoB;IAG/B,YAA6B,aAA6C;QAA7C,kBAAa,GAAb,aAAa,CAAgC;QAFzD,WAAM,GAAG,IAAI,eAAM,CAAC,sBAAoB,CAAC,IAAI,CAAC,CAAC;IAEa,CAAC;IAE9E,KAAK,CAAC,aAAa,CAAC,KAA+B;QACjD,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7B,MAAM,QAAQ,GACZ,MAAM,IAAI,KAAK,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,CAAC,IAAI;YAC3C,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI;YACjB,CAAC,CAAE,KAAK,CAAC,IAAqC,CAAC,QAAQ,IAAI,MAAM,CAAC;QACtE,MAAM,MAAM,GAAG,IAAA,kCAAc,EAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACpD,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,IAAI,SAAS,CAAC;QAC7C,MAAM,aAAa,GAAG,KAAK,CAAC,aAAa,IAAI,SAAS,CAAC;QACvD,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;QAEvB,MAAM,MAAM,GAAG;YACb,EAAE,EAAE,IAAA,mBAAU,GAAE;YAChB,UAAU,EAAE,KAAK,CAAC,IAAI,CAAC,UAAU;YACjC,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC,SAAS;YAC/B,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC,SAAS;YAC/B,eAAe,EAAE,KAAK,CAAC,eAAe;YACtC,MAAM,EAAE,QAAQ;YAChB,MAAM;YACN,IAAI,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE;YACpC,aAAa;YACb,WAAW,EAAE,EAAE,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,aAAa,EAAE;YACvD,QAAQ;YACR,MAAM,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE;YACxC,eAAe,EAAE,IAAI;YACrB,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,eAAe,EAAE,MAAM,CAAC,eAAe;YACvC,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,QAAQ,EAAE,SAAS;YACnB,aAAa,EAAE,GAAG;YAClB,MAAM,EAAE,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE;SACvC,CAAC;QAEF,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;QAC3E,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,oCAAoC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YACtE,OAAO,MAAM,CAAC,EAAE,CAAC;QACnB,CAAC;IACH,CAAC;IAED,KAAK,CAAC,uBAAuB,CAAC,eAAuB;QACnD,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,qBAAqB,EAAE;gBACnE,IAAI,EAAE,CAAC;gBACP,IAAI,EAAE,CAAC;gBACP,MAAM,EAAE;oBACN,KAAK,EAAE,KAAK;oBACZ,OAAO,EAAE;wBACP;4BACE,KAAK,EAAE,iBAAiB;4BACxB,QAAQ,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE;4BAC3B,KAAK,EAAE,eAAe;yBACvB;qBACF;iBACF;aACF,CAAC,CAAC;YAEH,MAAM,KAAK,GAAG,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAA0B,CAAC;YAC5D,MAAM,OAAO,CAAC,GAAG,CACf,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CACjB,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,qBAAqB,EAAE,IAAI,CAAC,EAAE,EAAE;gBAC3D,MAAM,EAAE,SAAS;gBACjB,eAAe,EAAE,KAAK;aACvB,CAAC,CACH,CACF,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,oCAAoC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACxE,CAAC;IACH,CAAC;CACF,CAAA;AA5EY,oDAAoB;+BAApB,oBAAoB;IADhC,IAAA,mBAAU,GAAE;6CAIiC,qCAA8B;GAH/D,oBAAoB,CA4EhC;AAED,YAAY"}
+{"version":3,"file":"device-session.service.js","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/auth/device-session.service.ts"],"names":[],"mappings":";;;;;AAAA,2CAAoD;AACpD,iEAAwF;AACxF,mCAAoC;AAEpC,2DAAqD;AAGrD,0CAA0C;AAE1C,MAAM,qBAAqB,GAAG,mCAAmC,CAAC;AAClE,MAAM,kBAAkB,GAAG,GAAG,CAAC;AA4BxB,IAAM,oBAAoB,4BAA1B,MAAM,oBAAoB;IAG/B,YAA6B,aAA6C;QAA7C,kBAAa,GAAb,aAAa,CAAgC;QAFzD,WAAM,GAAG,IAAI,eAAM,CAAC,sBAAoB,CAAC,IAAI,CAAC,CAAC;IAEa,CAAC;IAE9E,KAAK,CAAC,aAAa,CAAC,KAA+B;QACjD,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7B,MAAM,QAAQ,GACZ,MAAM,IAAI,KAAK,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,CAAC,IAAI;YAC3C,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI;YACjB,CAAC,CAAE,KAAK,CAAC,IAAqC,CAAC,QAAQ,IAAI,MAAM,CAAC;QACtE,MAAM,MAAM,GAAG,IAAA,kCAAc,EAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACpD,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,IAAI,SAAS,CAAC;QAC7C,MAAM,aAAa,GAAG,KAAK,CAAC,aAAa,IAAI,SAAS,CAAC;QACvD,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;QAEvB,MAAM,MAAM,GAAG;YACb,EAAE,EAAE,IAAA,mBAAU,GAAE;YAChB,UAAU,EAAE,KAAK,CAAC,IAAI,CAAC,UAAU;YACjC,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC,SAAS;YAC/B,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC,SAAS;YAC/B,eAAe,EAAE,KAAK,CAAC,eAAe;YACtC,MAAM,EAAE,QAAQ;YAChB,MAAM;YACN,IAAI,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE;YACpC,aAAa;YACb,WAAW,EAAE,EAAE,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,aAAa,EAAE;YACvD,QAAQ;YACR,MAAM,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE;YACxC,eAAe,EAAE,IAAI;YACrB,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,eAAe,EAAE,MAAM,CAAC,eAAe;YACvC,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,QAAQ,EAAE,SAAS;YACnB,aAAa,EAAE,GAAG;YAClB,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,MAAM,EAAE,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE;SACvC,CAAC;QAEF,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;QAC3E,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,oCAAoC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YACtE,OAAO,MAAM,CAAC,EAAE,CAAC;QACnB,CAAC;IACH,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,oBAAoB,CAAC,KAAsC;QAC/D,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;QACzC,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC;QACnD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtB,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,OAAO,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC;QAC5C,MAAM,IAAI,CAAC,0BAA0B,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;QAExD,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC;QACpD,MAAM,aAAa,GAAG,KAAK,CAAC,aAAa,IAAI,OAAO,CAAC,aAAa,CAAC;QAEnE,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,qBAAqB,EAAE,OAAO,CAAC,EAAE,EAAE;gBACpE,eAAe,EAAE,KAAK,CAAC,eAAe;gBACtC,QAAQ;gBACR,MAAM,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE;gBACxC,aAAa;gBACb,WAAW,EAAE,EAAE,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,aAAa,EAAE;gBACvD,SAAS;gBACT,MAAM,EAAE,EAAE,SAAS,EAAE;gBACrB,MAAM,EAAE,QAAQ;gBAChB,eAAe,EAAE,IAAI;aACtB,CAAC,CAAC;YACH,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,4CAA4C,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YAC9E,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED,KAAK,CAAC,uBAAuB,CAAC,eAAuB;QACnD,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,qBAAqB,EAAE;gBACnE,IAAI,EAAE,CAAC;gBACP,IAAI,EAAE,CAAC;gBACP,MAAM,EAAE;oBACN,KAAK,EAAE,KAAK;oBACZ,OAAO,EAAE;wBACP;4BACE,KAAK,EAAE,iBAAiB;4BACxB,QAAQ,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE;4BAC3B,KAAK,EAAE,eAAe;yBACvB;qBACF;iBACF;aACF,CAAC,CAAC;YAEH,MAAM,KAAK,GAAG,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAA0B,CAAC;YAC5D,MAAM,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QACzE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,oCAAoC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACxE,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,eAAe,CAAC,SAAiB;QAC7C,MAAM,KAAK,GAA8B,EAAE,CAAC;QAC5C,IAAI,IAAI,GAAG,CAAC,CAAC;QAEb,SAAS,CAAC;YACR,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,qBAAqB,EAAE;gBACjE,IAAI;gBACJ,IAAI,EAAE,kBAAkB;gBACxB,MAAM,EAAE;oBACN,KAAK,EAAE,KAAK;oBACZ,OAAO,EAAE;wBACP;4BACE,KAAK,EAAE,WAAW;4BAClB,QAAQ,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE;4BAC3B,KAAK,EAAE,SAAS;yBACjB;qBACF;iBACF;aACF,CAAC,CAAC;YACH,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAA8B,CAAC;YAC9D,KAAK,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC;YACrB,IAAI,KAAK,CAAC,MAAM,GAAG,kBAAkB,EAAE,CAAC;gBACtC,MAAM;YACR,CAAC;YACD,IAAI,IAAI,kBAAkB,CAAC;QAC7B,CAAC;QAED,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,OAAO,IAAI,CAAC,yBAAyB,CAAC,SAAS,CAAC,CAAC;QACnD,CAAC;QAED,OAAO,KAAK;aACT,GAAG,CAAC,wBAAwB,CAAC;aAC7B,MAAM,CAAC,CAAC,GAAG,EAAiC,EAAE,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC;IACjE,CAAC;IAED,wDAAwD;IAChD,KAAK,CAAC,yBAAyB,CAAC,SAAiB;QACvD,MAAM,KAAK,GAA8B,EAAE,CAAC;QAC5C,IAAI,IAAI,GAAG,CAAC,CAAC;QAEb,SAAS,CAAC;YACR,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,qBAAqB,EAAE;gBACjE,IAAI;gBACJ,IAAI,EAAE,kBAAkB;gBACxB,MAAM,EAAE;oBACN,KAAK,EAAE,KAAK;oBACZ,OAAO,EAAE;wBACP;4BACE,KAAK,EAAE,kBAAkB;4BACzB,QAAQ,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE;4BAC3B,KAAK,EAAE,SAAS;yBACjB;qBACF;iBACF;aACF,CAAC,CAAC;YACH,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAA8B,CAAC;YAC9D,KAAK,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC;YACrB,IAAI,KAAK,CAAC,MAAM,GAAG,kBAAkB,EAAE,CAAC;gBACtC,MAAM;YACR,CAAC;YACD,IAAI,IAAI,kBAAkB,CAAC;QAC7B,CAAC;QAED,OAAO,KAAK;aACT,GAAG,CAAC,wBAAwB,CAAC;aAC7B,MAAM,CAAC,CAAC,GAAG,EAAiC,EAAE,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC;IACjE,CAAC;IAEO,KAAK,CAAC,0BAA0B,CACtC,IAA8B,EAC9B,MAAc;QAEd,MAAM,OAAO,CAAC,GAAG,CACf,IAAI;aACD,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,KAAK,MAAM,IAAI,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,KAAK,QAAQ,CAAC;aAC3E,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAC/C,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,gBAAgB,CAAC,EAAU;QACvC,MAAM,WAAW,GAAG,IAAI,IAAI,EAAE,CAAC;QAC/B,MAAM,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,qBAAqB,EAAE,EAAE,EAAE;YAC5D,MAAM,EAAE,SAAS;YACjB,eAAe,EAAE,KAAK;YACtB,WAAW;SACZ,CAAC,CAAC;IACL,CAAC;CACF,CAAA;AAvMY,oDAAoB;+BAApB,oBAAoB;IADhC,IAAA,mBAAU,GAAE;6CAIiC,qCAA8B;GAH/D,oBAAoB,CAuMhC;AAED,YAAY;AAEZ,6BAA6B;AAE7B,SAAS,qBAAqB,CAAC,IAA8B;IAC3D,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC,IAAI,CAC3B,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,aAAa,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,aAAa,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,CAChF,CAAC;IACF,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,KAAK,QAAQ,CAAC,IAAI,MAAM,CAAC,CAAC,CAAE,CAAC;AACnF,CAAC;AAED,SAAS,wBAAwB,CAAC,GAA4B;IAC5D,MAAM,EAAE,GAAG,OAAO,GAAG,CAAC,IAAI,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC1D,IAAI,CAAC,EAAE,EAAE,CAAC;QACR,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,MAAM,GAAG,GAAG,CAAC,QAAQ,CAAwC,CAAC;IACpE,MAAM,SAAS,GACb,CAAC,OAAO,GAAG,CAAC,WAAW,CAAC,KAAK,QAAQ,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC,IAAI,EAAE,CAAC;QACjE,CAAC,OAAO,MAAM,EAAE,SAAS,KAAK,QAAQ,IAAI,MAAM,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;QAClE,EAAE,CAAC;IAEL,OAAO;QACL,EAAE;QACF,MAAM,EAAE,OAAO,GAAG,CAAC,QAAQ,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS;QACrE,aAAa,EAAE,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;QAC3C,QAAQ,EAAE,OAAO,GAAG,CAAC,UAAU,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS;QAC3E,aAAa,EAAE,OAAO,GAAG,CAAC,eAAe,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,SAAS;QAC1F,SAAS;KACV,CAAC;AACJ,CAAC;AAED,SAAS,MAAM,CAAC,KAAc;IAC5B,IAAI,KAAK,YAAY,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;QAC5D,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;QAC9C,MAAM,MAAM,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC;QAC/B,OAAO,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC;IACxD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,YAAY"}

package/security/src/lib/auth/login-attempt.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"login-attempt.service.d.ts","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/auth/login-attempt.service.ts"],"names":[],"mappings":"AAYA,OAAO,EAAE,2BAA2B,EAAE,MAAM,kCAAkC,CAAC;AAW/E,MAAM,WAAW,yBAAyB;IACxC,QAAQ,EAAE,MAAM,CAAC;IACjB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,eAAe,EAAE,OAAO,CAAC;IACzB,MAAM,EAAE,OAAO,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,qBACa,mBAAmB;IAIlB,OAAO,CAAC,QAAQ,CAAC,WAAW;IAHxC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAwC;IAC/D,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAmC;gBAE/B,WAAW,EAAE,2BAA2B;IAErE,eAAe,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM;IAIrD,eAAe,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IA2BlE,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAUhE,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC;IAwCjE,iBAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM;IAsB5E,YAAY,IAAI,MAAM;CAGvB"}
+{"version":3,"file":"login-attempt.service.d.ts","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/auth/login-attempt.service.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,2BAA2B,EAAE,MAAM,kCAAkC,CAAC;AAW/E,MAAM,WAAW,yBAAyB;IACxC,QAAQ,EAAE,MAAM,CAAC;IACjB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,eAAe,EAAE,OAAO,CAAC;IACzB,MAAM,EAAE,OAAO,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,qBACa,mBAAmB;IAIlB,OAAO,CAAC,QAAQ,CAAC,WAAW;IAHxC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAwC;IAC/D,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAmC;gBAE/B,WAAW,EAAE,2BAA2B;IAErE,eAAe,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM;IAIrD,eAAe,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IA+BlE,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAUhE,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC;IA4CjE,iBAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM;IAsB5E,YAAY,IAAI,MAAM;CAGvB"}

package/security/src/lib/auth/login-attempt.service.js

@@ -5,6 +5,7 @@ exports.LoginAttemptService = void 0;
 const tslib_1 = require("tslib");
 const common_1 = require("@nestjs/common");
 const auth_config_1 = require("./auth.config");
+const auth_lockout_policy_1 = require("./auth-lockout-policy");
 const auth_local_credentials_service_1 = require("./auth-local-credentials.service");
 let LoginAttemptService = LoginAttemptService_1 = class LoginAttemptService {
     constructor(credentials) {
@@ -24,10 +25,14 @@ let LoginAttemptService = LoginAttemptService_1 = class LoginAttemptService {
         if (state.lockedUntil.getTime() > Date.now()) {
             throw new common_1.HttpException({
                 statusCode: 401,
-                message: `Account is temporarily locked. Try again after ${state.lockedUntil.toISOString()}.`,
+                message: 'Account is temporarily locked. Try again later.',
+                code: 'AccountLocked',
                 error: 'AccountLocked',
-                lockedUntil: state.lockedUntil.toISOString(),
-                requiresCaptcha: true,
+                details: {
+                    locked: true,
+                    lockedUntil: state.lockedUntil.toISOString(),
+                    requiresCaptcha: true,
+                },
             }, 401);
         }
         this.attempts.delete(key);
@@ -48,14 +53,15 @@ let LoginAttemptService = LoginAttemptService_1 = class LoginAttemptService {
         const key = this.buildAttemptKey(strategy, username);
         const previous = this.attempts.get(key);
         const failures = (previous?.failures ?? 0) + 1;
-        const maxAttempts = (0, auth_config_1.AUTH_MAX_LOGIN_ATTEMPTS)();
+        const policy = await (0, auth_lockout_policy_1.resolveAuthLockoutPolicy)();
+        const maxAttempts = policy.maxLoginAttempts;
         const locked = failures >= maxAttempts;
         const state = {
             failures,
             lastAttemptAt: new Date(),
             strategy,
             ...(locked
-                ? { lockedUntil: new Date(Date.now() + (0, auth_config_1.AUTH_LOCKOUT_DURATION_MINUTES)() * 60_000) }
+                ? { lockedUntil: new Date(Date.now() + policy.lockoutDurationMinutes * 60_000) }
                 : {}),
         };
         this.attempts.set(key, state);
@@ -69,14 +75,17 @@ let LoginAttemptService = LoginAttemptService_1 = class LoginAttemptService {
         throw new common_1.UnauthorizedException({
             statusCode: 401,
             message: locked
-                ? `Too many failed login attempts. Account locked for ${(0, auth_config_1.AUTH_LOCKOUT_DURATION_MINUTES)()} minutes.`
+                ? `Too many failed login attempts. Account locked for ${policy.lockoutDurationMinutes} minutes.`
                 : 'Invalid username or password',
+            code: locked ? 'AccountLocked' : 'InvalidCredentials',
             error: locked ? 'AccountLocked' : 'InvalidCredentials',
-            failures,
-            remainingAttempts: Math.max(0, maxAttempts - failures),
-            requiresCaptcha: failures >= (0, auth_config_1.AUTH_CAPTCHA_ATTEMPT_THRESHOLD)(),
-            locked,
-            lockedUntil: state.lockedUntil?.toISOString(),
+            details: {
+                failures,
+                remainingAttempts: Math.max(0, maxAttempts - failures),
+                requiresCaptcha: failures >= policy.captchaAttemptThreshold,
+                locked,
+                lockedUntil: state.lockedUntil?.toISOString(),
+            },
         });
     }
     async authenticateLocal(strategy, username, password) {

package/security/src/lib/auth/login-attempt.service.js.map

@@ -1 +1 @@
-{"version":3,"file":"login-attempt.service.js","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/auth/login-attempt.service.ts"],"names":[],"mappings":";;;;;AAAA,2CAKwB;AACxB,+CAKuB;AACvB,qFAA+E;AAoBxE,IAAM,mBAAmB,2BAAzB,MAAM,mBAAmB;IAI9B,YAA6B,WAAwC;QAAxC,gBAAW,GAAX,WAAW,CAA6B;QAHpD,WAAM,GAAG,IAAI,eAAM,CAAC,qBAAmB,CAAC,IAAI,CAAC,CAAC;QAC9C,aAAQ,GAAG,IAAI,GAAG,EAAwB,CAAC;IAEY,CAAC;IAEzE,eAAe,CAAC,QAAgB,EAAE,QAAgB;QAChD,OAAO,GAAG,QAAQ,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;IACxD,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,QAAgB,EAAE,QAAgB;QACtD,MAAM,GAAG,GAAG,IAAI,CAAC,eAAe,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QACrD,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACrC,IAAI,CAAC,KAAK,EAAE,WAAW,EAAE,CAAC;YACxB,OAAO;QACT,CAAC;QAED,IAAI,KAAK,CAAC,WAAW,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YAC7C,MAAM,IAAI,sBAAa,CACrB;gBACE,UAAU,EAAE,GAAG;gBACf,OAAO,EAAE,kDAAkD,KAAK,CAAC,WAAW,CAAC,WAAW,EAAE,GAAG;gBAC7F,KAAK,EAAE,eAAe;gBACtB,WAAW,EAAE,KAAK,CAAC,WAAW,CAAC,WAAW,EAAE;gBAC5C,eAAe,EAAE,IAAI;aACtB,EACD,GAAG,CACJ,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC1B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC;QACjE,IAAI,IAAI,EAAE,WAAW,KAAK,SAAS,EAAE,CAAC;YACpC,MAAM,IAAI,CAAC,WAAW,CAAC,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACpD,CAAC;IACH,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,QAAgB,EAAE,QAAgB;QACpD,MAAM,GAAG,GAAG,IAAI,CAAC,eAAe,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QACrD,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAE1B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC;QACjE,IAAI,IAAI,EAAE,WAAW,KAAK,SAAS,EAAE,CAAC;YACpC,MAAM,IAAI,CAAC,WAAW,CAAC,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACpD,CAAC;IACH,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,QAAgB,EAAE,QAAgB;QACpD,MAAM,GAAG,GAAG,IAAI,CAAC,eAAe,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QACrD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACxC,MAAM,QAAQ,GAAG,CAAC,QAAQ,EAAE,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;QAC/C,MAAM,WAAW,GAAG,IAAA,qCAAuB,GAAE,CAAC;QAC9C,MAAM,MAAM,GAAG,QAAQ,IAAI,WAAW,CAAC;QAEvC,MAAM,KAAK,GAAiB;YAC1B,QAAQ;YACR,aAAa,EAAE,IAAI,IAAI,EAAE;YACzB,QAAQ;YACR,GAAG,CAAC,MAAM;gBACR,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAA,2CAA6B,GAAE,GAAG,MAAM,CAAC,EAAE;gBAClF,CAAC,CAAC,EAAE,CAAC;SACR,CAAC;QAEF,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAE9B,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC;YACjE,IAAI,IAAI,EAAE,CAAC;gBACT,MAAM,IAAI,CAAC,WAAW,CAAC,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAClD,CAAC;YACD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,wBAAwB,QAAQ,wBAAwB,QAAQ,EAAE,CAAC,CAAC;QACvF,CAAC;QAED,MAAM,IAAI,8BAAqB,CAAC;YAC9B,UAAU,EAAE,GAAG;YACf,OAAO,EAAE,MAAM;gBACb,CAAC,CAAC,sDAAsD,IAAA,2CAA6B,GAAE,WAAW;gBAClG,CAAC,CAAC,8BAA8B;YAClC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,oBAAoB;YACtD,QAAQ;YACR,iBAAiB,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,WAAW,GAAG,QAAQ,CAAC;YACtD,eAAe,EAAE,QAAQ,IAAI,IAAA,4CAA8B,GAAE;YAC7D,MAAM;YACN,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,WAAW,EAAE;SAC9C,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,QAAgB,EAAE,QAAgB,EAAE,QAAgB;QAC1E,MAAM,IAAI,CAAC,eAAe,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QAE/C,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;YACjE,MAAM,IAAI,CAAC,aAAa,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;YAC7C,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,8BAAqB,EAAE,CAAC;gBAC3C,MAAM,QAAQ,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;gBACrC,IACE,OAAO,QAAQ,KAAK,QAAQ;oBAC5B,QAAQ,KAAK,IAAI;oBAChB,QAAoC,CAAC,OAAO,CAAC,KAAK,oBAAoB,EACvE,CAAC;oBACD,MAAM,IAAI,CAAC,aAAa,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;gBAC/C,CAAC;YACH,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED,YAAY;QACV,OAAO,qCAAuB,CAAC;IACjC,CAAC;CACF,CAAA;AAhHY,kDAAmB;8BAAnB,mBAAmB;IAD/B,IAAA,mBAAU,GAAE;6CAK+B,4DAA2B;GAJ1D,mBAAmB,CAgH/B;AAED,YAAY"}
+{"version":3,"file":"login-attempt.service.js","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/auth/login-attempt.service.ts"],"names":[],"mappings":";;;;;AAAA,2CAKwB;AACxB,+CAAwD;AACxD,+DAAiE;AACjE,qFAA+E;AAoBxE,IAAM,mBAAmB,2BAAzB,MAAM,mBAAmB;IAI9B,YAA6B,WAAwC;QAAxC,gBAAW,GAAX,WAAW,CAA6B;QAHpD,WAAM,GAAG,IAAI,eAAM,CAAC,qBAAmB,CAAC,IAAI,CAAC,CAAC;QAC9C,aAAQ,GAAG,IAAI,GAAG,EAAwB,CAAC;IAEY,CAAC;IAEzE,eAAe,CAAC,QAAgB,EAAE,QAAgB;QAChD,OAAO,GAAG,QAAQ,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;IACxD,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,QAAgB,EAAE,QAAgB;QACtD,MAAM,GAAG,GAAG,IAAI,CAAC,eAAe,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QACrD,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACrC,IAAI,CAAC,KAAK,EAAE,WAAW,EAAE,CAAC;YACxB,OAAO;QACT,CAAC;QAED,IAAI,KAAK,CAAC,WAAW,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YAC7C,MAAM,IAAI,sBAAa,CACrB;gBACE,UAAU,EAAE,GAAG;gBACf,OAAO,EAAE,iDAAiD;gBAC1D,IAAI,EAAE,eAAe;gBACrB,KAAK,EAAE,eAAe;gBACtB,OAAO,EAAE;oBACP,MAAM,EAAE,IAAI;oBACZ,WAAW,EAAE,KAAK,CAAC,WAAW,CAAC,WAAW,EAAE;oBAC5C,eAAe,EAAE,IAAI;iBACtB;aACF,EACD,GAAG,CACJ,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC1B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC;QACjE,IAAI,IAAI,EAAE,WAAW,KAAK,SAAS,EAAE,CAAC;YACpC,MAAM,IAAI,CAAC,WAAW,CAAC,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACpD,CAAC;IACH,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,QAAgB,EAAE,QAAgB;QACpD,MAAM,GAAG,GAAG,IAAI,CAAC,eAAe,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QACrD,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAE1B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC;QACjE,IAAI,IAAI,EAAE,WAAW,KAAK,SAAS,EAAE,CAAC;YACpC,MAAM,IAAI,CAAC,WAAW,CAAC,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACpD,CAAC;IACH,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,QAAgB,EAAE,QAAgB;QACpD,MAAM,GAAG,GAAG,IAAI,CAAC,eAAe,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QACrD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACxC,MAAM,QAAQ,GAAG,CAAC,QAAQ,EAAE,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;QAC/C,MAAM,MAAM,GAAG,MAAM,IAAA,8CAAwB,GAAE,CAAC;QAChD,MAAM,WAAW,GAAG,MAAM,CAAC,gBAAgB,CAAC;QAC5C,MAAM,MAAM,GAAG,QAAQ,IAAI,WAAW,CAAC;QAEvC,MAAM,KAAK,GAAiB;YAC1B,QAAQ;YACR,aAAa,EAAE,IAAI,IAAI,EAAE;YACzB,QAAQ;YACR,GAAG,CAAC,MAAM;gBACR,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,sBAAsB,GAAG,MAAM,CAAC,EAAE;gBAChF,CAAC,CAAC,EAAE,CAAC;SACR,CAAC;QAEF,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAE9B,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC;YACjE,IAAI,IAAI,EAAE,CAAC;gBACT,MAAM,IAAI,CAAC,WAAW,CAAC,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAClD,CAAC;YACD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,wBAAwB,QAAQ,wBAAwB,QAAQ,EAAE,CAAC,CAAC;QACvF,CAAC;QAED,MAAM,IAAI,8BAAqB,CAAC;YAC9B,UAAU,EAAE,GAAG;YACf,OAAO,EAAE,MAAM;gBACb,CAAC,CAAC,sDAAsD,MAAM,CAAC,sBAAsB,WAAW;gBAChG,CAAC,CAAC,8BAA8B;YAClC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,oBAAoB;YACrD,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,oBAAoB;YACtD,OAAO,EAAE;gBACP,QAAQ;gBACR,iBAAiB,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,WAAW,GAAG,QAAQ,CAAC;gBACtD,eAAe,EAAE,QAAQ,IAAI,MAAM,CAAC,uBAAuB;gBAC3D,MAAM;gBACN,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,WAAW,EAAE;aAC9C;SACF,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,QAAgB,EAAE,QAAgB,EAAE,QAAgB;QAC1E,MAAM,IAAI,CAAC,eAAe,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QAE/C,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;YACjE,MAAM,IAAI,CAAC,aAAa,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;YAC7C,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,8BAAqB,EAAE,CAAC;gBAC3C,MAAM,QAAQ,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;gBACrC,IACE,OAAO,QAAQ,KAAK,QAAQ;oBAC5B,QAAQ,KAAK,IAAI;oBAChB,QAAoC,CAAC,OAAO,CAAC,KAAK,oBAAoB,EACvE,CAAC;oBACD,MAAM,IAAI,CAAC,aAAa,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;gBAC/C,CAAC;YACH,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED,YAAY;QACV,OAAO,qCAAuB,CAAC;IACjC,CAAC;CACF,CAAA;AAxHY,kDAAmB;8BAAnB,mBAAmB;IAD/B,IAAA,mBAAU,GAAE;6CAK+B,4DAA2B;GAJ1D,mBAAmB,CAwH/B;AAED,YAAY"}

package/security/src/lib/auth/machine-token.service.d.ts

@@ -2,7 +2,7 @@ import type { BackendRequestSession } from '../session/backend-session.types';
 export declare class MachineTokenService {
     private readonly logger;
     private readonly token;
-    private readonly session;
+    private readonly baseSession;
     constructor();
     isEnabled(): boolean;
     resolveSession(headers?: Record<string, string | string[] | undefined>): BackendRequestSession | null;

package/security/src/lib/auth/machine-token.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"machine-token.service.d.ts","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/auth/machine-token.service.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,kCAAkC,CAAC;AAW9E,qBACa,mBAAmB;IAC9B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAwC;IAC/D,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAgB;IACtC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAwB;;IA0BhD,SAAS,IAAI,OAAO;IAIpB,cAAc,CACZ,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,GACtD,qBAAqB,GAAG,IAAI;IAa/B,OAAO,CAAC,mBAAmB;IAK3B,OAAO,CAAC,YAAY;IA8BpB,OAAO,CAAC,WAAW;CAOpB"}
+{"version":3,"file":"machine-token.service.d.ts","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/auth/machine-token.service.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,kCAAkC,CAAC;AAU9E,qBACa,mBAAmB;IAC9B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAwC;IAC/D,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAgB;IACtC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAE1B;;IAyBF,SAAS,IAAI,OAAO;IAIpB,cAAc,CACZ,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,GACtD,qBAAqB,GAAG,IAAI;IAmB/B,OAAO,CAAC,mBAAmB;IAK3B,OAAO,CAAC,YAAY;IAqBpB,OAAO,CAAC,WAAW;CAQpB"}

package/security/src/lib/auth/machine-token.service.js

@@ -4,29 +4,29 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.MachineTokenService = void 0;
 const tslib_1 = require("tslib");
 const common_1 = require("@nestjs/common");
+const abstract_1 = require("@acorex-platform/framework-server/jql/abstract");
 //#region ---- Machine token auth ----
-/** super-root — platform operator used for MCP / automation. */
+/** super-root — platform operator used for MCP / automation (seed user id). */
 const DEFAULT_MACHINE_USER_ID = 'f0000001-0000-4000-a000-000000000003';
 const DEFAULT_MACHINE_USERNAME = 'super-root';
-const DEFAULT_MACHINE_TENANT_ID = 'f0000002-0000-4000-a000-000000000001';
 /** Platform Console application (seed: application-tree.data.ts). */
 const DEFAULT_MACHINE_APPLICATION_ID = '00000000-0000-0000-0000-000000000004';
 let MachineTokenService = MachineTokenService_1 = class MachineTokenService {
     constructor() {
         this.logger = new common_1.Logger(MachineTokenService_1.name);
         this.token = this.readConfiguredToken();
-        this.session = {
+        this.baseSession = {
             userId: process.env['ACOREX_MACHINE_TOKEN_USER_ID']?.trim() ||
                 DEFAULT_MACHINE_USER_ID,
             username: process.env['ACOREX_MACHINE_TOKEN_USERNAME']?.trim() ||
                 DEFAULT_MACHINE_USERNAME,
-            tenantId: process.env['ACOREX_MACHINE_TOKEN_TENANT_ID']?.trim() ||
-                DEFAULT_MACHINE_TENANT_ID,
+            // Prefer env; otherwise resolve lazily from Tenant.isPlatform at request time.
+            tenantId: process.env['ACOREX_MACHINE_TOKEN_TENANT_ID']?.trim() || undefined,
             applicationId: process.env['ACOREX_MACHINE_TOKEN_APPLICATION_ID']?.trim() ||
                 DEFAULT_MACHINE_APPLICATION_ID,
         };
         if (this.token) {
-            this.logger.log(`Machine token authentication is enabled (user=${this.session.username}, tenant=${this.session.tenantId}, application=${this.session.applicationId})`);
+            this.logger.log(`Machine token authentication is enabled (user=${this.baseSession.username}, application=${this.baseSession.applicationId})`);
         }
     }
     isEnabled() {
@@ -40,7 +40,11 @@ let MachineTokenService = MachineTokenService_1 = class MachineTokenService {
         if (!candidate || candidate !== this.token) {
             return null;
         }
-        return { ...this.session };
+        const tenantId = this.baseSession.tenantId || (0, abstract_1.getPrimaryPlatformTenantId)() || undefined;
+        return {
+            ...this.baseSession,
+            tenantId,
+        };
     }
     readConfiguredToken() {
         const token = process.env['ACOREX_MACHINE_TOKEN']?.trim();
@@ -58,22 +62,14 @@ let MachineTokenService = MachineTokenService_1 = class MachineTokenService {
         if (!authorization) {
             return null;
         }
-        if (authorization.startsWith('Machine ')) {
-            const token = authorization.slice('Machine '.length).trim();
-            return token.length > 0 ? token : null;
-        }
-        if (authorization.startsWith('Bearer ')) {
-            const token = authorization.slice('Bearer '.length).trim();
-            return token.length > 0 ? token : null;
-        }
-        return null;
+        const match = /^Bearer\s+(.+)$/i.exec(authorization);
+        return match?.[1]?.trim() || null;
     }
     headerValue(value) {
-        const header = Array.isArray(value) ? value[0] : value;
-        if (!header?.trim()) {
-            return null;
+        if (Array.isArray(value)) {
+            return value[0];
         }
-        return header.trim();
+        return value;
     }
 };
 exports.MachineTokenService = MachineTokenService;

package/security/src/lib/auth/machine-token.service.js.map

@@ -1 +1 @@
-{"version":3,"file":"machine-token.service.js","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/auth/machine-token.service.ts"],"names":[],"mappings":";;;;;AAAA,2CAAoD;AAGpD,sCAAsC;AAEtC,gEAAgE;AAChE,MAAM,uBAAuB,GAAG,sCAAsC,CAAC;AACvE,MAAM,wBAAwB,GAAG,YAAY,CAAC;AAC9C,MAAM,yBAAyB,GAAG,sCAAsC,CAAC;AACzE,qEAAqE;AACrE,MAAM,8BAA8B,GAAG,sCAAsC,CAAC;AAGvE,IAAM,mBAAmB,2BAAzB,MAAM,mBAAmB;IAK9B;QAJiB,WAAM,GAAG,IAAI,eAAM,CAAC,qBAAmB,CAAC,IAAI,CAAC,CAAC;QAK7D,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,mBAAmB,EAAE,CAAC;QACxC,IAAI,CAAC,OAAO,GAAG;YACb,MAAM,EACJ,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAAC,EAAE,IAAI,EAAE;gBACnD,uBAAuB;YACzB,QAAQ,EACN,OAAO,CAAC,GAAG,CAAC,+BAA+B,CAAC,EAAE,IAAI,EAAE;gBACpD,wBAAwB;YAC1B,QAAQ,EACN,OAAO,CAAC,GAAG,CAAC,gCAAgC,CAAC,EAAE,IAAI,EAAE;gBACrD,yBAAyB;YAC3B,aAAa,EACX,OAAO,CAAC,GAAG,CAAC,qCAAqC,CAAC,EAAE,IAAI,EAAE;gBAC1D,8BAA8B;SACjC,CAAC;QAEF,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,GAAG,CACb,iDAAiD,IAAI,CAAC,OAAO,CAAC,QAAQ,YAAY,IAAI,CAAC,OAAO,CAAC,QAAQ,iBAAiB,IAAI,CAAC,OAAO,CAAC,aAAa,GAAG,CACtJ,CAAC;QACJ,CAAC;IACH,CAAC;IAED,SAAS;QACP,OAAO,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC;IAC5B,CAAC;IAED,cAAc,CACZ,OAAuD;QAEvD,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;YAChB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,SAAS,GAAG,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;QAC7C,IAAI,CAAC,SAAS,IAAI,SAAS,KAAK,IAAI,CAAC,KAAK,EAAE,CAAC;YAC3C,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,EAAE,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;IAC7B,CAAC;IAEO,mBAAmB;QACzB,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,EAAE,IAAI,EAAE,CAAC;QAC1D,OAAO,KAAK,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;IAClD,CAAC;IAEO,YAAY,CAClB,OAAuD;QAEvD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,aAAa,GAAG,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC,CAAC;QACnE,IAAI,aAAa,EAAE,CAAC;YAClB,OAAO,aAAa,CAAC;QACvB,CAAC;QAED,MAAM,aAAa,GAAG,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC;QACjE,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,aAAa,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YACzC,MAAM,KAAK,GAAG,aAAa,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;YAC5D,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;QACzC,CAAC;QAED,IAAI,aAAa,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YACxC,MAAM,KAAK,GAAG,aAAa,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;YAC3D,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;QACzC,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,WAAW,CAAC,KAAyB;QAC3C,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;QACvD,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE,CAAC;YACpB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,MAAM,CAAC,IAAI,EAAE,CAAC;IACvB,CAAC;CACF,CAAA;AA1FY,kDAAmB;8BAAnB,mBAAmB;IAD/B,IAAA,mBAAU,GAAE;;GACA,mBAAmB,CA0F/B;AAED,YAAY"}
+{"version":3,"file":"machine-token.service.js","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/auth/machine-token.service.ts"],"names":[],"mappings":";;;;;AAAA,2CAAoD;AACpD,6EAA4F;AAG5F,sCAAsC;AAEtC,+EAA+E;AAC/E,MAAM,uBAAuB,GAAG,sCAAsC,CAAC;AACvE,MAAM,wBAAwB,GAAG,YAAY,CAAC;AAC9C,qEAAqE;AACrE,MAAM,8BAA8B,GAAG,sCAAsC,CAAC;AAGvE,IAAM,mBAAmB,2BAAzB,MAAM,mBAAmB;IAO9B;QANiB,WAAM,GAAG,IAAI,eAAM,CAAC,qBAAmB,CAAC,IAAI,CAAC,CAAC;QAO7D,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,mBAAmB,EAAE,CAAC;QACxC,IAAI,CAAC,WAAW,GAAG;YACjB,MAAM,EACJ,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAAC,EAAE,IAAI,EAAE;gBACnD,uBAAuB;YACzB,QAAQ,EACN,OAAO,CAAC,GAAG,CAAC,+BAA+B,CAAC,EAAE,IAAI,EAAE;gBACpD,wBAAwB;YAC1B,+EAA+E;YAC/E,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,gCAAgC,CAAC,EAAE,IAAI,EAAE,IAAI,SAAS;YAC5E,aAAa,EACX,OAAO,CAAC,GAAG,CAAC,qCAAqC,CAAC,EAAE,IAAI,EAAE;gBAC1D,8BAA8B;SACjC,CAAC;QAEF,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,GAAG,CACb,iDAAiD,IAAI,CAAC,WAAW,CAAC,QAAQ,iBAAiB,IAAI,CAAC,WAAW,CAAC,aAAa,GAAG,CAC7H,CAAC;QACJ,CAAC;IACH,CAAC;IAED,SAAS;QACP,OAAO,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC;IAC5B,CAAC;IAED,cAAc,CACZ,OAAuD;QAEvD,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;YAChB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,SAAS,GAAG,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;QAC7C,IAAI,CAAC,SAAS,IAAI,SAAS,KAAK,IAAI,CAAC,KAAK,EAAE,CAAC;YAC3C,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,QAAQ,GACZ,IAAI,CAAC,WAAW,CAAC,QAAQ,IAAI,IAAA,qCAA0B,GAAE,IAAI,SAAS,CAAC;QAEzE,OAAO;YACL,GAAG,IAAI,CAAC,WAAW;YACnB,QAAQ;SACT,CAAC;IACJ,CAAC;IAEO,mBAAmB;QACzB,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,EAAE,IAAI,EAAE,CAAC;QAC1D,OAAO,KAAK,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;IAClD,CAAC;IAEO,YAAY,CAClB,OAAuD;QAEvD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,aAAa,GAAG,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC,CAAC;QACnE,IAAI,aAAa,EAAE,CAAC;YAClB,OAAO,aAAa,CAAC;QACvB,CAAC;QAED,MAAM,aAAa,GAAG,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC;QACjE,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,KAAK,GAAG,kBAAkB,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QACrD,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC;IACpC,CAAC;IAEO,WAAW,CACjB,KAAoC;QAEpC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACzB,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;CACF,CAAA;AAzFY,kDAAmB;8BAAnB,mBAAmB;IAD/B,IAAA,mBAAU,GAAE;;GACA,mBAAmB,CAyF/B;AAED,YAAY"}

package/security/src/lib/auth/request-meta.util.d.ts

@@ -4,7 +4,7 @@ export interface AuthRequestMeta {
     userAgent: string;
     clientName: string;
 }
-export declare function resolveAuthRequestMeta(req: Request): AuthRequestMeta;
+export declare function resolveAuthRequestMeta(req: Request | undefined): AuthRequestMeta;
 export declare function parseUserAgent(userAgent: string): {
     browser: string;
     operatingSystem: string;

package/security/src/lib/auth/request-meta.util.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"request-meta.util.d.ts","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/auth/request-meta.util.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAIvC,MAAM,WAAW,eAAe;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,OAAO,GAAG,eAAe,CAYpE;AAOD,wBAAgB,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG;IACjD,OAAO,EAAE,MAAM,CAAC;IAChB,eAAe,EAAE,MAAM,CAAC;IACxB,UAAU,EAAE,MAAM,CAAC;CACpB,CAmCA"}
+{"version":3,"file":"request-meta.util.d.ts","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/auth/request-meta.util.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAIvC,MAAM,WAAW,eAAe;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,OAAO,GAAG,SAAS,GAAG,eAAe,CAoBhF;AAOD,wBAAgB,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG;IACjD,OAAO,EAAE,MAAM,CAAC;IAChB,eAAe,EAAE,MAAM,CAAC;IACxB,UAAU,EAAE,MAAM,CAAC;CACpB,CAmCA"}

package/security/src/lib/auth/request-meta.util.js

@@ -3,6 +3,13 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.resolveAuthRequestMeta = resolveAuthRequestMeta;
 exports.parseUserAgent = parseUserAgent;
 function resolveAuthRequestMeta(req) {
+    if (!req?.headers) {
+        return {
+            ipAddress: 'unknown',
+            userAgent: 'unknown',
+            clientName: 'Unknown Browser on Unknown OS',
+        };
+    }
     const userAgent = String(req.headers['user-agent'] ?? 'unknown');
     const forwarded = req.headers['x-forwarded-for'];
     const ipAddress = Array.isArray(forwarded)

package/security/src/lib/auth/request-meta.util.js.map

@@ -1 +1 @@
-{"version":3,"file":"request-meta.util.js","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/auth/request-meta.util.ts"],"names":[],"mappings":";;AAUA,wDAYC;AAOD,wCAuCC;AA1DD,SAAgB,sBAAsB,CAAC,GAAY;IACjD,MAAM,SAAS,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,YAAY,CAAC,IAAI,SAAS,CAAC,CAAC;IACjE,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;IACjD,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC;QACxC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,EAAE,IAAI,SAAS,CAAC;QAC7C,CAAC,CAAC,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,GAAG,CAAC,EAAE,IAAI,SAAS,CAAC,CAAC;IAEpE,OAAO;QACL,SAAS;QACT,SAAS;QACT,UAAU,EAAE,iBAAiB,CAAC,SAAS,CAAC;KACzC,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,SAAiB;IAC1C,MAAM,MAAM,GAAG,cAAc,CAAC,SAAS,CAAC,CAAC;IACzC,OAAO,GAAG,MAAM,CAAC,OAAO,OAAO,MAAM,CAAC,eAAe,EAAE,CAAC;AAC1D,CAAC;AAED,SAAgB,cAAc,CAAC,SAAiB;IAK9C,MAAM,EAAE,GAAG,SAAS,CAAC,WAAW,EAAE,CAAC;IAEnC,IAAI,OAAO,GAAG,iBAAiB,CAAC;IAChC,IAAI,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACxB,OAAO,GAAG,MAAM,CAAC;IACnB,CAAC;SAAM,IAAI,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QAClC,OAAO,GAAG,QAAQ,CAAC;IACrB,CAAC;SAAM,IAAI,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;QACnC,OAAO,GAAG,SAAS,CAAC;IACtB,CAAC;SAAM,IAAI,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QAC7D,OAAO,GAAG,QAAQ,CAAC;IACrB,CAAC;IAED,IAAI,eAAe,GAAG,YAAY,CAAC;IACnC,IAAI,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QAC3B,eAAe,GAAG,SAAS,CAAC;IAC9B,CAAC;SAAM,IAAI,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QACjC,eAAe,GAAG,OAAO,CAAC;IAC5B,CAAC;SAAM,IAAI,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QAClC,eAAe,GAAG,SAAS,CAAC;IAC9B,CAAC;SAAM,IAAI,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACxD,eAAe,GAAG,KAAK,CAAC;IAC1B,CAAC;SAAM,IAAI,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QAChC,eAAe,GAAG,OAAO,CAAC;IAC5B,CAAC;IAED,IAAI,UAAU,GAAG,SAAS,CAAC;IAC3B,IAAI,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC1B,UAAU,GAAG,QAAQ,CAAC;IACxB,CAAC;SAAM,IAAI,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACxD,UAAU,GAAG,QAAQ,CAAC;IACxB,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,UAAU,EAAE,CAAC;AAClD,CAAC;AAED,YAAY"}
+{"version":3,"file":"request-meta.util.js","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/auth/request-meta.util.ts"],"names":[],"mappings":";;AAUA,wDAoBC;AAOD,wCAuCC;AAlED,SAAgB,sBAAsB,CAAC,GAAwB;IAC7D,IAAI,CAAC,GAAG,EAAE,OAAO,EAAE,CAAC;QAClB,OAAO;YACL,SAAS,EAAE,SAAS;YACpB,SAAS,EAAE,SAAS;YACpB,UAAU,EAAE,+BAA+B;SAC5C,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,YAAY,CAAC,IAAI,SAAS,CAAC,CAAC;IACjE,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;IACjD,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC;QACxC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,EAAE,IAAI,SAAS,CAAC;QAC7C,CAAC,CAAC,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,GAAG,CAAC,EAAE,IAAI,SAAS,CAAC,CAAC;IAEpE,OAAO;QACL,SAAS;QACT,SAAS;QACT,UAAU,EAAE,iBAAiB,CAAC,SAAS,CAAC;KACzC,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,SAAiB;IAC1C,MAAM,MAAM,GAAG,cAAc,CAAC,SAAS,CAAC,CAAC;IACzC,OAAO,GAAG,MAAM,CAAC,OAAO,OAAO,MAAM,CAAC,eAAe,EAAE,CAAC;AAC1D,CAAC;AAED,SAAgB,cAAc,CAAC,SAAiB;IAK9C,MAAM,EAAE,GAAG,SAAS,CAAC,WAAW,EAAE,CAAC;IAEnC,IAAI,OAAO,GAAG,iBAAiB,CAAC;IAChC,IAAI,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACxB,OAAO,GAAG,MAAM,CAAC;IACnB,CAAC;SAAM,IAAI,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QAClC,OAAO,GAAG,QAAQ,CAAC;IACrB,CAAC;SAAM,IAAI,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;QACnC,OAAO,GAAG,SAAS,CAAC;IACtB,CAAC;SAAM,IAAI,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QAC7D,OAAO,GAAG,QAAQ,CAAC;IACrB,CAAC;IAED,IAAI,eAAe,GAAG,YAAY,CAAC;IACnC,IAAI,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QAC3B,eAAe,GAAG,SAAS,CAAC;IAC9B,CAAC;SAAM,IAAI,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QACjC,eAAe,GAAG,OAAO,CAAC;IAC5B,CAAC;SAAM,IAAI,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QAClC,eAAe,GAAG,SAAS,CAAC;IAC9B,CAAC;SAAM,IAAI,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACxD,eAAe,GAAG,KAAK,CAAC;IAC1B,CAAC;SAAM,IAAI,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QAChC,eAAe,GAAG,OAAO,CAAC;IAC5B,CAAC;IAED,IAAI,UAAU,GAAG,SAAS,CAAC;IAC3B,IAAI,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC1B,UAAU,GAAG,QAAQ,CAAC;IACxB,CAAC;SAAM,IAAI,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACxD,UAAU,GAAG,QAAQ,CAAC;IACxB,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,UAAU,EAAE,CAAC;AAClD,CAAC;AAED,YAAY"}

package/security/src/lib/auth/saml/saml-sp.service.d.ts

@@ -0,0 +1,12 @@
+import type { AXPSamlAuthnRequestResult, AXPSamlIdentityProviderDefinition } from './saml-sp.types';
+/**
+ * Platform SAML service provider (SP) skeleton.
+ * IdP list is env/config driven; ACS completion issues the same cookie session as OIDC/password.
+ */
+export declare class SamlSpService {
+    private readonly logger;
+    listProviders(): AXPSamlIdentityProviderDefinition[];
+    beginAuthn(providerId: string, relayState?: string): AXPSamlAuthnRequestResult;
+    private readProvidersFromEnv;
+}
+//# sourceMappingURL=saml-sp.service.d.ts.map

package/security/src/lib/auth/saml/saml-sp.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"saml-sp.service.d.ts","sourceRoot":"","sources":["../../../../../../../../../libs/framework/server/security/src/lib/auth/saml/saml-sp.service.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EACV,yBAAyB,EACzB,iCAAiC,EAClC,MAAM,iBAAiB,CAAC;AAIzB;;;GAGG;AACH,qBACa,aAAa;IACxB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAkC;IAEzD,aAAa,IAAI,iCAAiC,EAAE;IAIpD,UAAU,CAAC,UAAU,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,yBAAyB;IAa9E,OAAO,CAAC,oBAAoB;CAc7B"}

package/security/src/lib/auth/saml/saml-sp.service.js

@@ -0,0 +1,51 @@
+"use strict";
+var SamlSpService_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SamlSpService = void 0;
+const tslib_1 = require("tslib");
+const common_1 = require("@nestjs/common");
+const crypto_1 = require("crypto");
+//#region ----- SAML SP service -----
+/**
+ * Platform SAML service provider (SP) skeleton.
+ * IdP list is env/config driven; ACS completion issues the same cookie session as OIDC/password.
+ */
+let SamlSpService = SamlSpService_1 = class SamlSpService {
+    constructor() {
+        this.logger = new common_1.Logger(SamlSpService_1.name);
+    }
+    listProviders() {
+        return this.readProvidersFromEnv().filter((p) => p.enabled !== false);
+    }
+    beginAuthn(providerId, relayState) {
+        const provider = this.listProviders().find((p) => p.id === providerId);
+        if (!provider) {
+            throw new common_1.BadRequestException(`Unknown SAML provider: ${providerId}`);
+        }
+        const state = relayState?.trim() || (0, crypto_1.randomUUID)();
+        // Full AuthnRequest XML + Redirect/POST binding is implemented when IdP certs are configured.
+        const redirectUrl = `${provider.ssoUrl}?RelayState=${encodeURIComponent(state)}&provider=${encodeURIComponent(provider.id)}`;
+        this.logger.debug(`SAML AuthnRequest started for provider ${provider.id}`);
+        return { redirectUrl, relayState: state };
+    }
+    readProvidersFromEnv() {
+        const raw = process.env['AUTH_SAML_PROVIDERS_JSON']?.trim();
+        if (!raw) {
+            return [];
+        }
+        try {
+            const parsed = JSON.parse(raw);
+            return Array.isArray(parsed) ? parsed : [];
+        }
+        catch {
+            this.logger.warn('AUTH_SAML_PROVIDERS_JSON is invalid JSON');
+            return [];
+        }
+    }
+};
+exports.SamlSpService = SamlSpService;
+exports.SamlSpService = SamlSpService = SamlSpService_1 = tslib_1.__decorate([
+    (0, common_1.Injectable)()
+], SamlSpService);
+//#endregion
+//# sourceMappingURL=saml-sp.service.js.map

package/security/src/lib/auth/saml/saml-sp.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"saml-sp.service.js","sourceRoot":"","sources":["../../../../../../../../../libs/framework/server/security/src/lib/auth/saml/saml-sp.service.ts"],"names":[],"mappings":";;;;;AAAA,2CAAyE;AACzE,mCAAoC;AAMpC,qCAAqC;AAErC;;;GAGG;AAEI,IAAM,aAAa,qBAAnB,MAAM,aAAa;IAAnB;QACY,WAAM,GAAG,IAAI,eAAM,CAAC,eAAa,CAAC,IAAI,CAAC,CAAC;IAiC3D,CAAC;IA/BC,aAAa;QACX,OAAO,IAAI,CAAC,oBAAoB,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,KAAK,CAAC,CAAC;IACxE,CAAC;IAED,UAAU,CAAC,UAAkB,EAAE,UAAmB;QAChD,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,UAAU,CAAC,CAAC;QACvE,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,4BAAmB,CAAC,0BAA0B,UAAU,EAAE,CAAC,CAAC;QACxE,CAAC;QAED,MAAM,KAAK,GAAG,UAAU,EAAE,IAAI,EAAE,IAAI,IAAA,mBAAU,GAAE,CAAC;QACjD,8FAA8F;QAC9F,MAAM,WAAW,GAAG,GAAG,QAAQ,CAAC,MAAM,eAAe,kBAAkB,CAAC,KAAK,CAAC,aAAa,kBAAkB,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC;QAC7H,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,0CAA0C,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAC;QAC3E,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;IAC5C,CAAC;IAEO,oBAAoB;QAC1B,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,0BAA0B,CAAC,EAAE,IAAI,EAAE,CAAC;QAC5D,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAwC,CAAC;YACtE,OAAO,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7C,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,0CAA0C,CAAC,CAAC;YAC7D,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;CACF,CAAA;AAlCY,sCAAa;wBAAb,aAAa;IADzB,IAAA,mBAAU,GAAE;GACA,aAAa,CAkCzB;AAED,YAAY"}

package/security/src/lib/auth/saml/saml-sp.types.d.ts

@@ -0,0 +1,15 @@
+/** Configured SAML identity provider for platform login. */
+export interface AXPSamlIdentityProviderDefinition {
+    readonly id: string;
+    readonly title: string;
+    readonly entityId: string;
+    readonly ssoUrl: string;
+    readonly certificatePem: string;
+    readonly enabled?: boolean;
+    readonly icon?: string;
+}
+export interface AXPSamlAuthnRequestResult {
+    readonly redirectUrl: string;
+    readonly relayState: string;
+}
+//# sourceMappingURL=saml-sp.types.d.ts.map

package/security/src/lib/auth/saml/saml-sp.types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"saml-sp.types.d.ts","sourceRoot":"","sources":["../../../../../../../../../libs/framework/server/security/src/lib/auth/saml/saml-sp.types.ts"],"names":[],"mappings":"AAEA,4DAA4D;AAC5D,MAAM,WAAW,iCAAiC;IAChD,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B"}

package/security/src/lib/auth/saml/saml-sp.types.js

@@ -0,0 +1,5 @@
+"use strict";
+//#region ----- SAML SP types -----
+Object.defineProperty(exports, "__esModule", { value: true });
+//#endregion
+//# sourceMappingURL=saml-sp.types.js.map

package/security/src/lib/auth/saml/saml-sp.types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"saml-sp.types.js","sourceRoot":"","sources":["../../../../../../../../../libs/framework/server/security/src/lib/auth/saml/saml-sp.types.ts"],"names":[],"mappings":";AAAA,mCAAmC;;AAkBnC,YAAY"}

package/security/src/lib/auth/token.service.js

@@ -101,7 +101,7 @@ let TokenService = TokenService_1 = class TokenService {
         return secret;
     }
     accessTokenTtl() {
-        return process.env['JWT_ACCESS_EXPIRES_IN']?.trim() || '8h';
+        return process.env['JWT_ACCESS_EXPIRES_IN']?.trim() || '30m';
     }
     refreshTokenTtl() {
         return process.env['JWT_REFRESH_EXPIRES_IN']?.trim() || '7d';

package/security/src/lib/auth/token.service.js.map

@@ -1 +1 @@
-{"version":3,"file":"token.service.js","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/auth/token.service.ts"],"names":[],"mappings":";;;;;AAAA,2CAAoD;AACpD,0DAAoC;AACpC,mCAAoC;AAqB7B,IAAM,YAAY,oBAAlB,MAAM,YAAY;IAAlB;QACY,WAAM,GAAG,IAAI,eAAM,CAAC,cAAY,CAAC,IAAI,CAAC,CAAC;IAkI1D,CAAC;IAhIC,kBAAkB,CAAC,IAAiB,EAAE,UAA6B,EAAE;QACnE,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,IAAA,mBAAU,GAAE,CAAC;QACpD,MAAM,aAAa,GAAuB;YACxC,GAAG,EAAE,IAAI,CAAC,EAAE;YACZ,QAAQ,EAAE,IAAI,CAAC,IAAI;YACnB,IAAI,EAAE,QAAQ;YACd,GAAG,EAAE,SAAS;YACd,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACtD,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACjE,CAAC;QAEF,MAAM,cAAc,GAAwB;YAC1C,GAAG,EAAE,IAAI,CAAC,EAAE;YACZ,IAAI,EAAE,SAAS;YACf,GAAG,EAAE,IAAA,mBAAU,GAAE;YACjB,GAAG,EAAE,SAAS;YACd,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACtD,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACjE,CAAC;QAEF,MAAM,WAAW,GAAG,GAAG,CAAC,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,SAAS,EAAE,EAAE;YAC5D,SAAS,EAAE,IAAI,CAAC,cAAc,EAAkC;SACjE,CAAC,CAAC;QAEH,MAAM,YAAY,GAAG,GAAG,CAAC,IAAI,CAAC,cAAc,EAAE,IAAI,CAAC,SAAS,EAAE,EAAE;YAC9D,SAAS,EAAE,IAAI,CAAC,eAAe,EAAkC;SAClE,CAAC,CAAC;QAEH,OAAO;YACL,WAAW;YACX,YAAY;YACZ,SAAS,EAAE,IAAI,CAAC,cAAc,EAAE;YAChC,SAAS;YACT,IAAI;YACJ,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;YAC9E,WAAW,EACT,OAAO,CAAC,WAAW;gBACnB,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;SACjE,CAAC;IACJ,CAAC;IAED,iBAAiB,CAAC,KAAa;QAC7B,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,EAAE,CAAuB,CAAC;YAC1E,IAAI,OAAO,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;gBAC9C,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;YAC1C,CAAC;YACD,OAAO,OAAO,CAAC;QACjB,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;QACrD,CAAC;IACH,CAAC;IAED,kBAAkB,CAAC,KAAa;QAC9B,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,EAAE,CAAwB,CAAC;YAC3E,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;gBAC/D,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;YAC3C,CAAC;YACD,OAAO,OAAO,CAAC;QACjB,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;QACtD,CAAC;IACH,CAAC;IAED,mBAAmB;QACjB,OAAO,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC,CAAC;IAClD,CAAC;IAED,2BAA2B;QACzB,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,mBAAmB,EAAE,GAAG,IAAI,CAAC,CAAC;IACvD,CAAC;IAED,YAAY,CACV,IAAiB,EACjB,QAAgB,EAChB,SAA+C,EAAE;QAEjD,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,EAAE,IAAI,EAAE,EAAE,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;YACzE,oBAAoB,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,MAAM,MAAM,CAAC;QAElE,OAAO,GAAG,CAAC,IAAI,CACb;YACE,GAAG,EAAE,IAAI,CAAC,EAAE;YACZ,IAAI,EAAE,IAAI,CAAC,KAAK;YAChB,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,OAAO,EAAE,MAAM,CAAC,OAAO;SACxB,EACD,IAAI,CAAC,SAAS,EAAE,EAChB;YACE,SAAS,EAAE,IAAI,CAAC,cAAc,EAAkC;YAChE,MAAM;YACN,QAAQ;SACT,CACF,CAAC;IACJ,CAAC;IAED,oBAAoB;QAClB,OAAO,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC,CAAC;IACnD,CAAC;IAED,SAAS;QACP,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,CAAC;QACjD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,2DAA2D,CAAC,CAAC;YAC9E,OAAO,iCAAiC,CAAC;QAC3C,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,cAAc;QACZ,OAAO,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC;IAC9D,CAAC;IAED,eAAe;QACb,OAAO,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC;IAC/D,CAAC;IAEO,YAAY,CAAC,GAAW;QAC9B,MAAM,KAAK,GAAG,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;QAClD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;QAC5B,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAC/B,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;QACpC,MAAM,WAAW,GAA2B,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC;QAChG,OAAO,KAAK,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC,CAAC;IAClD,CAAC;CACF,CAAA;AAnIY,oCAAY;uBAAZ,YAAY;IADxB,IAAA,mBAAU,GAAE;GACA,YAAY,CAmIxB;AAED,YAAY"}
+{"version":3,"file":"token.service.js","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/auth/token.service.ts"],"names":[],"mappings":";;;;;AAAA,2CAAoD;AACpD,0DAAoC;AACpC,mCAAoC;AAqB7B,IAAM,YAAY,oBAAlB,MAAM,YAAY;IAAlB;QACY,WAAM,GAAG,IAAI,eAAM,CAAC,cAAY,CAAC,IAAI,CAAC,CAAC;IAkI1D,CAAC;IAhIC,kBAAkB,CAAC,IAAiB,EAAE,UAA6B,EAAE;QACnE,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,IAAA,mBAAU,GAAE,CAAC;QACpD,MAAM,aAAa,GAAuB;YACxC,GAAG,EAAE,IAAI,CAAC,EAAE;YACZ,QAAQ,EAAE,IAAI,CAAC,IAAI;YACnB,IAAI,EAAE,QAAQ;YACd,GAAG,EAAE,SAAS;YACd,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACtD,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACjE,CAAC;QAEF,MAAM,cAAc,GAAwB;YAC1C,GAAG,EAAE,IAAI,CAAC,EAAE;YACZ,IAAI,EAAE,SAAS;YACf,GAAG,EAAE,IAAA,mBAAU,GAAE;YACjB,GAAG,EAAE,SAAS;YACd,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACtD,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACjE,CAAC;QAEF,MAAM,WAAW,GAAG,GAAG,CAAC,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,SAAS,EAAE,EAAE;YAC5D,SAAS,EAAE,IAAI,CAAC,cAAc,EAAkC;SACjE,CAAC,CAAC;QAEH,MAAM,YAAY,GAAG,GAAG,CAAC,IAAI,CAAC,cAAc,EAAE,IAAI,CAAC,SAAS,EAAE,EAAE;YAC9D,SAAS,EAAE,IAAI,CAAC,eAAe,EAAkC;SAClE,CAAC,CAAC;QAEH,OAAO;YACL,WAAW;YACX,YAAY;YACZ,SAAS,EAAE,IAAI,CAAC,cAAc,EAAE;YAChC,SAAS;YACT,IAAI;YACJ,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;YAC9E,WAAW,EACT,OAAO,CAAC,WAAW;gBACnB,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;SACjE,CAAC;IACJ,CAAC;IAED,iBAAiB,CAAC,KAAa;QAC7B,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,EAAE,CAAuB,CAAC;YAC1E,IAAI,OAAO,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;gBAC9C,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;YAC1C,CAAC;YACD,OAAO,OAAO,CAAC;QACjB,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;QACrD,CAAC;IACH,CAAC;IAED,kBAAkB,CAAC,KAAa;QAC9B,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,EAAE,CAAwB,CAAC;YAC3E,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;gBAC/D,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;YAC3C,CAAC;YACD,OAAO,OAAO,CAAC;QACjB,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;QACtD,CAAC;IACH,CAAC;IAED,mBAAmB;QACjB,OAAO,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC,CAAC;IAClD,CAAC;IAED,2BAA2B;QACzB,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,mBAAmB,EAAE,GAAG,IAAI,CAAC,CAAC;IACvD,CAAC;IAED,YAAY,CACV,IAAiB,EACjB,QAAgB,EAChB,SAA+C,EAAE;QAEjD,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,EAAE,IAAI,EAAE,EAAE,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;YACzE,oBAAoB,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,MAAM,MAAM,CAAC;QAElE,OAAO,GAAG,CAAC,IAAI,CACb;YACE,GAAG,EAAE,IAAI,CAAC,EAAE;YACZ,IAAI,EAAE,IAAI,CAAC,KAAK;YAChB,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,OAAO,EAAE,MAAM,CAAC,OAAO;SACxB,EACD,IAAI,CAAC,SAAS,EAAE,EAChB;YACE,SAAS,EAAE,IAAI,CAAC,cAAc,EAAkC;YAChE,MAAM;YACN,QAAQ;SACT,CACF,CAAC;IACJ,CAAC;IAED,oBAAoB;QAClB,OAAO,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC,CAAC;IACnD,CAAC;IAED,SAAS;QACP,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,CAAC;QACjD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,2DAA2D,CAAC,CAAC;YAC9E,OAAO,iCAAiC,CAAC;QAC3C,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,cAAc;QACZ,OAAO,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,EAAE,IAAI,EAAE,IAAI,KAAK,CAAC;IAC/D,CAAC;IAED,eAAe;QACb,OAAO,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC;IAC/D,CAAC;IAEO,YAAY,CAAC,GAAW;QAC9B,MAAM,KAAK,GAAG,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;QAClD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;QAC5B,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAC/B,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;QACpC,MAAM,WAAW,GAA2B,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC;QAChG,OAAO,KAAK,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC,CAAC;IAClD,CAAC;CACF,CAAA;AAnIY,oCAAY;uBAAZ,YAAY;IADxB,IAAA,mBAAU,GAAE;GACA,YAAY,CAmIxB;AAED,YAAY"}

package/security/src/lib/entity-storage/entity-access-policy.loader.d.ts

@@ -0,0 +1,14 @@
+import { OnModuleInit } from '@nestjs/common';
+import { EntityStorageMiddlewareService } from '@acorex-platform/framework-server/core';
+/**
+ * Loads PlatformManagement.EntityAccessPolicy into the in-memory cache at boot.
+ * Uses server-only scope bypass so the self-policy row does not block the load.
+ */
+export declare class EntityAccessPolicyLoader implements OnModuleInit {
+    private readonly entityStorage;
+    private readonly logger;
+    constructor(entityStorage: EntityStorageMiddlewareService);
+    onModuleInit(): Promise<void>;
+    reload(): Promise<void>;
+}
+//# sourceMappingURL=entity-access-policy.loader.d.ts.map