@acorex-platform/framework-server 0.0.32 → 0.0.37

package/security/src/lib/oauth/platform-oauth.service.js

@@ -1,5 +1,4 @@
 "use strict";
-var PlatformOAuthService_1;
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.PlatformOAuthService = void 0;
 const tslib_1 = require("tslib");
@@ -9,18 +8,21 @@ const crypto_1 = require("crypto");
 const auth_identity_provider_source_1 = require("../auth/auth-identity-provider.source");
 const auth_service_1 = require("../auth/auth.service");
 const auth_local_credentials_service_1 = require("../auth/auth-local-credentials.service");
+const auth_config_1 = require("../auth/auth.config");
 const token_service_1 = require("../auth/token.service");
-const platform_oauth_config_1 = require("./platform-oauth.config");
-//#region ---- Platform OAuth service ----
-let PlatformOAuthService = PlatformOAuthService_1 = class PlatformOAuthService {
-    constructor(auth, credentials, tokens, moduleRef) {
+const oauth_bff_util_1 = require("./oauth-bff.util");
+const oauth_op_service_1 = require("./oauth-op.service");
+const oauth_rp_service_1 = require("./oauth-rp.service");
+const oauth_client_registry_service_1 = require("./oauth-client-registry.service");
+let PlatformOAuthService = class PlatformOAuthService {
+    constructor(auth, credentials, tokens, moduleRef, op, rp, clients) {
         this.auth = auth;
         this.credentials = credentials;
         this.tokens = tokens;
         this.moduleRef = moduleRef;
-        this.logger = new common_1.Logger(PlatformOAuthService_1.name);
-        this.authorizationCodes = new Map();
-        this.externalStates = new Map();
+        this.op = op;
+        this.rp = rp;
+        this.clients = clients;
     }
     getDiscoveryDocument(issuer) {
         const base = issuer.replace(/\/$/, '');
@@ -29,66 +31,96 @@ let PlatformOAuthService = PlatformOAuthService_1 = class PlatformOAuthService {
             authorization_endpoint: `${base}/connect/authorize`,
             token_endpoint: `${base}/connect/token`,
             jwks_uri: `${base}/.well-known/jwks.json`,
+            userinfo_endpoint: `${base}/connect/userinfo`,
+            revocation_endpoint: `${base}/connect/revocation`,
+            end_session_endpoint: `${base}/connect/endsession`,
             response_types_supported: ['code'],
             grant_types_supported: ['authorization_code', 'refresh_token'],
             code_challenge_methods_supported: ['S256'],
             scopes_supported: ['openid', 'profile', 'email', 'offline_access'],
+            subject_types_supported: ['public'],
+            id_token_signing_alg_values_supported: ['RS256'],
         };
     }
-    /** Dev platform broker uses HS256 id_tokens; JWKS is advertised for OIDC discovery clients only. */
+    /** JWKS document used by OIDC discovery clients to validate Platform `id_token` signatures. */
     getJwksDocument() {
-        return { keys: [] };
+        return this.tokens.getJwks();
     }
-    async beginAuthorization(request) {
-        this.assertSupportedAuthorizeRequest(request);
-        const providerKey = request.provider.trim();
-        if (!providerKey) {
-            throw new common_1.BadRequestException('acr_values (identity provider key) is required.');
+    /**
+     * Detects first-party federation broker token requests (platform auth codes + platform JWT refresh tokens).
+     */
+    isBrokerTokenRequest(body) {
+        const grantType = body['grant_type']?.trim();
+        if (grantType === 'authorization_code') {
+            const code = body['code']?.trim();
+            return !!code && /^[a-f0-9]{48}$/i.test(code);
         }
-        const broker = await this.requireBrokerConfig(providerKey);
-        const state = (0, crypto_1.randomBytes)(16).toString('hex');
-        this.externalStates.set(state, {
-            codeChallenge: request.codeChallenge,
-            codeChallengeMethod: request.codeChallengeMethod,
-            redirectUri: request.redirectUri,
-            clientId: request.clientId,
-            provider: providerKey,
-            issuer: request.issuer.replace(/\/$/, ''),
-            expiresAt: Date.now() + platform_oauth_config_1.PLATFORM_OAUTH_CODE_TTL_MS,
-        });
-        const callbackUrl = `${request.issuer.replace(/\/$/, '')}/connect/callback/${encodeURIComponent(providerKey)}`;
+        if (grantType === 'refresh_token') {
+            const refreshToken = body['refresh_token']?.trim();
+            if (!refreshToken) {
+                return false;
+            }
+            try {
+                this.tokens.verifyRefreshToken(refreshToken);
+                return true;
+            }
+            catch {
+                return false;
+            }
+        }
+        return false;
+    }
+    /**
+     * BFF entry: server generates PKCE verifier/challenge and returns platform authorize URL.
+     * Verifier is stored server-side (never in browser localStorage).
+     */
+    async initAuthorization(input) {
+        this.clients.assertClientId(input.clientId);
+        this.clients.assertRedirectUri(input.clientId, input.redirectUri);
+        this.clients.assertScopes(input.clientId, input.scope);
+        const codeVerifier = (0, crypto_1.randomBytes)(32).toString('base64url');
+        const codeChallenge = (0, crypto_1.createHash)('sha256').update(codeVerifier).digest('base64url');
+        await this.op.stagePkceVerifier(codeChallenge, codeVerifier);
+        const base = input.issuer.replace(/\/$/, '');
         const params = new URLSearchParams({
-            client_id: broker.clientId,
-            redirect_uri: callbackUrl,
             response_type: 'code',
-            scope: broker.scopes,
-            state,
-            access_type: 'online',
-            prompt: 'select_account',
+            client_id: input.clientId,
+            redirect_uri: input.redirectUri,
+            scope: input.scope,
+            code_challenge: codeChallenge,
+            code_challenge_method: 'S256',
+            identity_provider: input.provider,
         });
-        return `${broker.authorizationUrl}?${params.toString()}`;
+        return { authorizeUrl: `${base}/connect/authorize?${params.toString()}` };
+    }
+    async beginAuthorization(request) {
+        const { externalUrl } = await this.op.beginAuthorization(request);
+        return externalUrl;
     }
     async completeExternalCallback(providerKey, code, state) {
-        const externalState = this.externalStates.get(state);
-        this.externalStates.delete(state);
-        if (!externalState || externalState.expiresAt < Date.now()) {
-            throw new common_1.UnauthorizedException('Invalid or expired OAuth state.');
-        }
-        if (externalState.provider !== providerKey) {
+        const externalState = await this.op.consumeExternalState(state);
+        if (externalState.provider !== providerKey.trim()) {
             throw new common_1.UnauthorizedException('OAuth state provider mismatch.');
         }
-        const profile = await this.exchangeExternalAuthorizationCode(providerKey, code, externalState.issuer);
+        const broker = await this.requireBrokerConfig(providerKey);
+        const callbackUrl = `${externalState.issuer.replace(/\/$/, '')}/connect/callback/${encodeURIComponent(providerKey)}`;
+        const tokenResult = await this.rp.exchangeCode(broker, code, callbackUrl);
+        const profile = tokenResult.idToken
+            ? await this.rp.verifyAndNormalizeIdToken(tokenResult.idToken, broker, externalState.nonce, broker.clientId)
+            : await this.resolveProfileViaUserInfo(broker, tokenResult.accessToken);
         const user = await this.credentials.findOrCreateExternalUser({
             provider: providerKey,
+            issuer: profile.issuer,
             providerSubject: profile.sub,
             email: profile.email,
+            emailVerified: profile.emailVerified,
             displayName: profile.name,
             picture: profile.picture,
         });
-        const platformCode = (0, crypto_1.randomBytes)(24).toString('hex');
-        this.authorizationCodes.set(platformCode, {
+        const platformCode = await this.op.issueCode({
             codeChallenge: externalState.codeChallenge,
             codeChallengeMethod: externalState.codeChallengeMethod,
+            codeVerifier: externalState.codeVerifier,
             redirectUri: externalState.redirectUri,
             clientId: externalState.clientId,
             userId: user.id,
@@ -97,7 +129,7 @@ let PlatformOAuthService = PlatformOAuthService_1 = class PlatformOAuthService {
             userEmail: profile.email,
             userPicture: profile.picture,
             provider: providerKey,
-            expiresAt: Date.now() + platform_oauth_config_1.PLATFORM_OAUTH_CODE_TTL_MS,
+            nonce: externalState.nonce,
         });
         const redirect = new URL(externalState.redirectUri);
         redirect.searchParams.set('code', platformCode);
@@ -106,7 +138,7 @@ let PlatformOAuthService = PlatformOAuthService_1 = class PlatformOAuthService {
     async exchangeAuthorizationCode(body, meta) {
         const grantType = body['grant_type']?.trim();
         if (grantType === 'refresh_token') {
-            return this.exchangeRefreshToken(body['refresh_token'], body['client_id'], meta);
+            return this.exchangeRefreshToken(body['refresh_token'], body['client_id'], meta, body);
         }
         if (grantType !== 'authorization_code') {
             throw new common_1.BadRequestException('Unsupported grant_type.');
@@ -115,147 +147,95 @@ let PlatformOAuthService = PlatformOAuthService_1 = class PlatformOAuthService {
         const redirectUri = body['redirect_uri']?.trim();
         const clientId = body['client_id']?.trim();
         const codeVerifier = body['code_verifier']?.trim();
-        if (!code || !redirectUri || !clientId || !codeVerifier) {
-            throw new common_1.BadRequestException('code, redirect_uri, client_id, and code_verifier are required.');
-        }
-        this.assertClientId(clientId);
-        const record = this.authorizationCodes.get(code);
-        this.authorizationCodes.delete(code);
-        if (!record || record.expiresAt < Date.now()) {
-            throw new common_1.UnauthorizedException('Invalid or expired authorization code.');
-        }
-        if (record.clientId !== clientId || record.redirectUri !== redirectUri) {
-            throw new common_1.UnauthorizedException('Authorization code does not match client or redirect URI.');
-        }
-        if (!this.verifyPkce(codeVerifier, record.codeChallenge, record.codeChallengeMethod)) {
-            throw new common_1.UnauthorizedException('Invalid PKCE code verifier.');
+        if (!code || !redirectUri || !clientId) {
+            throw new common_1.BadRequestException('code, redirect_uri, and client_id are required.');
         }
+        this.clients.assertTokenEndpointClientAuth(clientId, body);
+        this.clients.assertGrantType(clientId, 'authorization_code');
+        const record = await this.op.consumeCode({
+            code,
+            clientId,
+            redirectUri,
+            codeVerifier,
+        });
         const user = await this.credentials.findUserById(record.userId);
         if (!user) {
             throw new common_1.UnauthorizedException('User not found.');
         }
-        const authUser = {
+        const tokenResult = await this.auth.completeSignIn(user, meta, {
+            audience: auth_config_1.PLATFORM_ACCESS_TOKEN_AUDIENCE,
+        });
+        const expiresIn = this.tokens.accessTokenExpiresInSeconds();
+        const idToken = this.tokens.issueIdToken({
             id: user.id,
             name: user.username ?? user.id,
             title: user.displayName ?? user.username ?? user.id,
             avatar: user.avatar ?? null,
-        };
-        const tokens = this.tokens.issueTokenResponse(authUser, {});
-        const expiresIn = this.tokens.accessTokenExpiresInSeconds();
-        const idToken = this.tokens.issueIdToken(authUser, clientId, {
+        }, clientId, {
             email: record.userEmail,
             picture: record.userPicture,
+            nonce: record.nonce,
+        });
+        return this.toOAuthExchangeResult({
+            accessToken: tokenResult.accessToken,
+            refreshToken: tokenResult.refreshToken,
+            idToken,
+            expiresIn,
         });
-        await this.auth.completeSignIn(user, meta);
-        return {
-            access_token: tokens.accessToken,
-            refresh_token: tokens.refreshToken,
-            id_token: idToken,
-            token_type: 'Bearer',
-            expires_in: expiresIn,
-        };
     }
-    async exchangeRefreshToken(refreshToken, clientId, meta) {
+    async endSession(input) {
+        if (input.postLogoutRedirectUri?.trim()) {
+            this.clients.assertPostLogoutRedirectUri(input.clientId, input.postLogoutRedirectUri);
+        }
+        if (input.idTokenHint?.trim()) {
+            try {
+                const payload = this.auth.decodeIdTokenHint(input.idTokenHint.trim());
+                if (payload?.sid) {
+                    await this.auth.revokeSessionById(payload.sid);
+                }
+            }
+            catch {
+                /* ignore invalid hint */
+            }
+        }
+        if (!input.postLogoutRedirectUri?.trim()) {
+            return null;
+        }
+        const redirect = new URL(input.postLogoutRedirectUri.trim());
+        if (input.state?.trim()) {
+            redirect.searchParams.set('state', input.state.trim());
+        }
+        return redirect.toString();
+    }
+    async exchangeRefreshToken(refreshToken, clientId, meta, body) {
         if (!refreshToken?.trim()) {
             throw new common_1.BadRequestException('refresh_token is required.');
         }
         if (clientId) {
-            this.assertClientId(clientId);
+            this.clients.assertTokenEndpointClientAuth(clientId, body);
+            this.clients.assertGrantType(clientId, 'refresh_token');
         }
-        const result = await this.auth.refreshSession(refreshToken.trim(), meta);
-        const expiresIn = this.tokens.accessTokenExpiresInSeconds();
-        const allowed = this.resolveAllowedClientIds();
-        const idToken = this.tokens.issueIdToken(result.user, clientId ?? allowed[0] ?? 'acorex', {});
-        return {
-            access_token: result.accessToken,
-            refresh_token: result.refreshToken,
-            id_token: idToken,
-            token_type: 'Bearer',
-            expires_in: expiresIn,
-        };
-    }
-    async exchangeExternalAuthorizationCode(providerKey, code, issuer) {
-        const broker = await this.requireBrokerConfig(providerKey);
-        const callbackUrl = `${issuer.replace(/\/$/, '')}/connect/callback/${encodeURIComponent(providerKey)}`;
-        const body = new URLSearchParams({
-            code,
-            client_id: broker.clientId,
-            client_secret: broker.clientSecret,
-            redirect_uri: callbackUrl,
-            grant_type: 'authorization_code',
+        const result = await this.auth.refreshSession(refreshToken.trim(), meta, {
+            audience: auth_config_1.PLATFORM_ACCESS_TOKEN_AUDIENCE,
         });
-        const tokenResponse = await fetch(broker.tokenUrl, {
-            method: 'POST',
-            headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
-            body: body.toString(),
-        });
-        if (!tokenResponse.ok) {
-            const detail = await tokenResponse.text();
-            this.logger.warn(`External token exchange failed (${providerKey}): ${detail}`);
-            throw new common_1.UnauthorizedException(`${providerKey} authorization failed.`);
-        }
-        const tokenData = (await tokenResponse.json());
-        if (tokenData.id_token) {
-            return this.parseIdToken(tokenData.id_token);
-        }
-        if (!tokenData.access_token || !broker.userInfoUrl) {
-            throw new common_1.UnauthorizedException(`${providerKey} authorization failed.`);
-        }
-        const profileResponse = await fetch(broker.userInfoUrl, {
-            headers: { Authorization: `Bearer ${tokenData.access_token}` },
+        const expiresIn = this.tokens.accessTokenExpiresInSeconds();
+        const resolvedClientId = clientId ?? this.clients.listClients()[0]?.clientId ?? 'acorex';
+        const idToken = this.tokens.issueIdToken(result.user, resolvedClientId, {});
+        return this.toOAuthExchangeResult({
+            accessToken: result.accessToken,
+            refreshToken: result.refreshToken,
+            idToken,
+            expiresIn,
         });
-        if (!profileResponse.ok) {
-            throw new common_1.UnauthorizedException(`${providerKey} profile lookup failed.`);
-        }
-        return (await profileResponse.json());
     }
-    parseIdToken(idToken) {
-        const parts = idToken.split('.');
-        if (parts.length < 2) {
-            throw new common_1.UnauthorizedException('Invalid id_token.');
-        }
-        const payload = JSON.parse(Buffer.from(parts[1], 'base64url').toString('utf8'));
+    toOAuthExchangeResult(tokens) {
+        const body = (0, oauth_bff_util_1.buildOAuthTokenResponseBody)(tokens);
         return {
-            sub: payload.sub,
-            email: payload.email,
-            emailVerified: payload.email_verified,
-            name: payload.name,
-            picture: payload.picture,
+            body,
+            accessToken: tokens.accessToken,
+            refreshToken: tokens.refreshToken,
         };
     }
-    assertSupportedAuthorizeRequest(request) {
-        if (request.responseType !== 'code') {
-            throw new common_1.BadRequestException('Only response_type=code is supported.');
-        }
-        this.assertClientId(request.clientId);
-        if (!request.redirectUri?.trim()) {
-            throw new common_1.BadRequestException('redirect_uri is required.');
-        }
-        if (!request.issuer?.trim()) {
-            throw new common_1.BadRequestException('issuer is required.');
-        }
-        if (!request.codeChallenge?.trim() || request.codeChallengeMethod !== 'S256') {
-            throw new common_1.BadRequestException('PKCE S256 code_challenge is required.');
-        }
-    }
-    assertClientId(clientId) {
-        const allowed = this.resolveAllowedClientIds();
-        if (!allowed.includes(clientId)) {
-            throw new common_1.BadRequestException(`Unsupported client_id: ${clientId}`);
-        }
-    }
-    resolveAllowedClientIds() {
-        try {
-            const ids = this.moduleRef.get(auth_identity_provider_source_1.AUTH_OAUTH_ALLOWED_CLIENT_IDS, { strict: false });
-            if (Array.isArray(ids) && ids.length > 0) {
-                return ids;
-            }
-        }
-        catch {
-            /* catalog not loaded */
-        }
-        return ['acorex', 'spa-client'];
-    }
     async requireBrokerConfig(key) {
         const catalog = this.resolveIdentityProviderCatalog();
         const broker = catalog ? await catalog.getBrokerConfig(key) : null;
@@ -280,26 +260,53 @@ let PlatformOAuthService = PlatformOAuthService_1 = class PlatformOAuthService {
             return null;
         }
     }
-    verifyPkce(codeVerifier, codeChallenge, method) {
-        if (method !== 'S256') {
-            return false;
+    async resolveProfileViaUserInfo(broker, accessToken) {
+        if (!broker.userInfoUrl) {
+            throw new common_1.UnauthorizedException('External authorization failed (missing userInfoUrl).');
+        }
+        const issuer = broker.issuerUrl?.trim()?.replace(/\/$/, '') ||
+            (await this.resolveIssuerFromUserInfoUrl(broker.userInfoUrl));
+        const profile = await this.rp.fetchUserInfo(accessToken, broker.userInfoUrl);
+        if (!profile.sub) {
+            throw new common_1.UnauthorizedException('External authorization failed (missing subject).');
         }
-        const digest = (0, crypto_1.createHash)('sha256').update(codeVerifier).digest('base64url');
+        return {
+            issuer,
+            sub: profile.sub,
+            email: profile.email,
+            emailVerified: profile.emailVerified,
+            name: profile.name,
+            picture: profile.picture,
+        };
+    }
+    async resolveIssuerFromUserInfoUrl(userInfoUrl) {
+        const base = new URL(userInfoUrl).origin;
+        const discoveryUrl = `${base}/.well-known/openid-configuration`;
         try {
-            return (0, crypto_1.timingSafeEqual)(Buffer.from(digest), Buffer.from(codeChallenge));
+            const response = await fetch(discoveryUrl);
+            if (response.ok) {
+                const data = (await response.json());
+                if (typeof data['issuer'] === 'string') {
+                    return data['issuer'].replace(/\/$/, '');
+                }
+            }
         }
         catch {
-            return false;
+            /* ignore discovery errors */
         }
+        return base;
     }
 };
 exports.PlatformOAuthService = PlatformOAuthService;
-exports.PlatformOAuthService = PlatformOAuthService = PlatformOAuthService_1 = tslib_1.__decorate([
+exports.PlatformOAuthService = PlatformOAuthService = tslib_1.__decorate([
     (0, common_1.Injectable)(),
     tslib_1.__metadata("design:paramtypes", [auth_service_1.AuthService,
         auth_local_credentials_service_1.AuthLocalCredentialsService,
         token_service_1.TokenService,
-        core_1.ModuleRef])
+        core_1.ModuleRef,
+        oauth_op_service_1.OAuthOpService,
+        oauth_rp_service_1.OAuthRpService,
+        oauth_client_registry_service_1.OAuthClientRegistryService])
 ], PlatformOAuthService);
 //#endregion
 //# sourceMappingURL=platform-oauth.service.js.map

package/security/src/lib/oauth/platform-oauth.service.js.map

@@ -1 +1 @@
-{"version":3,"file":"platform-oauth.service.js","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/oauth/platform-oauth.service.ts"],"names":[],"mappings":";;;;;AAAA,2CAMwB;AACxB,uCAAyC;AACzC,mCAAkE;AAClE,yFAK+C;AAC/C,uDAAmD;AACnD,2FAAqF;AACrF,yDAAqD;AAGrD,mEAAqE;AASrE,0CAA0C;AAGnC,IAAM,oBAAoB,4BAA1B,MAAM,oBAAoB;IAK/B,YACmB,IAAiB,EACjB,WAAwC,EACxC,MAAoB,EACpB,SAAoB;QAHpB,SAAI,GAAJ,IAAI,CAAa;QACjB,gBAAW,GAAX,WAAW,CAA6B;QACxC,WAAM,GAAN,MAAM,CAAc;QACpB,cAAS,GAAT,SAAS,CAAW;QARtB,WAAM,GAAG,IAAI,eAAM,CAAC,sBAAoB,CAAC,IAAI,CAAC,CAAC;QAC/C,uBAAkB,GAAG,IAAI,GAAG,EAA2C,CAAC;QACxE,mBAAc,GAAG,IAAI,GAAG,EAAuC,CAAC;IAO9E,CAAC;IAEJ,oBAAoB,CAAC,MAAc;QACjC,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACvC,OAAO;YACL,MAAM,EAAE,IAAI;YACZ,sBAAsB,EAAE,GAAG,IAAI,oBAAoB;YACnD,cAAc,EAAE,GAAG,IAAI,gBAAgB;YACvC,QAAQ,EAAE,GAAG,IAAI,wBAAwB;YACzC,wBAAwB,EAAE,CAAC,MAAM,CAAC;YAClC,qBAAqB,EAAE,CAAC,oBAAoB,EAAE,eAAe,CAAC;YAC9D,gCAAgC,EAAE,CAAC,MAAM,CAAC;YAC1C,gBAAgB,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,gBAAgB,CAAC;SACnE,CAAC;IACJ,CAAC;IAED,oGAAoG;IACpG,eAAe;QACb,OAAO,EAAE,IAAI,EAAE,EAAe,EAAE,CAAC;IACnC,CAAC;IAED,KAAK,CAAC,kBAAkB,CAAC,OAAsC;QAC7D,IAAI,CAAC,+BAA+B,CAAC,OAAO,CAAC,CAAC;QAE9C,MAAM,WAAW,GAAG,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QAC5C,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,IAAI,4BAAmB,CAAC,iDAAiD,CAAC,CAAC;QACnF,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,WAAW,CAAC,CAAC;QAE3D,MAAM,KAAK,GAAG,IAAA,oBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC9C,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,KAAK,EAAE;YAC7B,aAAa,EAAE,OAAO,CAAC,aAAa;YACpC,mBAAmB,EAAE,OAAO,CAAC,mBAAmB;YAChD,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,QAAQ,EAAE,WAAW;YACrB,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;YACzC,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,kDAA0B;SACnD,CAAC,CAAC;QAEH,MAAM,WAAW,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,qBAAqB,kBAAkB,CAAC,WAAW,CAAC,EAAE,CAAC;QAC/G,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;YACjC,SAAS,EAAE,MAAM,CAAC,QAAQ;YAC1B,YAAY,EAAE,WAAW;YACzB,aAAa,EAAE,MAAM;YACrB,KAAK,EAAE,MAAM,CAAC,MAAM;YACpB,KAAK;YACL,WAAW,EAAE,QAAQ;YACrB,MAAM,EAAE,gBAAgB;SACzB,CAAC,CAAC;QAEH,OAAO,GAAG,MAAM,CAAC,gBAAgB,IAAI,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC;IAC3D,CAAC;IAED,KAAK,CAAC,wBAAwB,CAC5B,WAAmB,EACnB,IAAY,EACZ,KAAa;QAEb,MAAM,aAAa,GAAG,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACrD,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAElC,IAAI,CAAC,aAAa,IAAI,aAAa,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YAC3D,MAAM,IAAI,8BAAqB,CAAC,iCAAiC,CAAC,CAAC;QACrE,CAAC;QAED,IAAI,aAAa,CAAC,QAAQ,KAAK,WAAW,EAAE,CAAC;YAC3C,MAAM,IAAI,8BAAqB,CAAC,gCAAgC,CAAC,CAAC;QACpE,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,iCAAiC,CAAC,WAAW,EAAE,IAAI,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;QACtG,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,wBAAwB,CAAC;YAC3D,QAAQ,EAAE,WAAW;YACrB,eAAe,EAAE,OAAO,CAAC,GAAG;YAC5B,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,WAAW,EAAE,OAAO,CAAC,IAAI;YACzB,OAAO,EAAE,OAAO,CAAC,OAAO;SACzB,CAAC,CAAC;QAEH,MAAM,YAAY,GAAG,IAAA,oBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACrD,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,YAAY,EAAE;YACxC,aAAa,EAAE,aAAa,CAAC,aAAa;YAC1C,mBAAmB,EAAE,aAAa,CAAC,mBAAmB;YACtD,WAAW,EAAE,aAAa,CAAC,WAAW;YACtC,QAAQ,EAAE,aAAa,CAAC,QAAQ;YAChC,MAAM,EAAE,IAAI,CAAC,EAAE;YACf,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,EAAE;YAClC,SAAS,EAAE,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,EAAE;YACvD,SAAS,EAAE,OAAO,CAAC,KAAK;YACxB,WAAW,EAAE,OAAO,CAAC,OAAO;YAC5B,QAAQ,EAAE,WAAW;YACrB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,kDAA0B;SACnD,CAAC,CAAC;QAEH,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,aAAa,CAAC,WAAW,CAAC,CAAC;QACpD,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;QAChD,OAAO,QAAQ,CAAC,QAAQ,EAAE,CAAC;IAC7B,CAAC;IAED,KAAK,CAAC,yBAAyB,CAC7B,IAAwC,EACxC,IAAqB;QAErB,MAAM,SAAS,GAAG,IAAI,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,CAAC;QAC7C,IAAI,SAAS,KAAK,eAAe,EAAE,CAAC;YAClC,OAAO,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE,IAAI,CAAC,WAAW,CAAC,EAAE,IAAI,CAAC,CAAC;QACnF,CAAC;QAED,IAAI,SAAS,KAAK,oBAAoB,EAAE,CAAC;YACvC,MAAM,IAAI,4BAAmB,CAAC,yBAAyB,CAAC,CAAC;QAC3D,CAAC;QAED,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC;QAClC,MAAM,WAAW,GAAG,IAAI,CAAC,cAAc,CAAC,EAAE,IAAI,EAAE,CAAC;QACjD,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,CAAC;QAC3C,MAAM,YAAY,GAAG,IAAI,CAAC,eAAe,CAAC,EAAE,IAAI,EAAE,CAAC;QAEnD,IAAI,CAAC,IAAI,IAAI,CAAC,WAAW,IAAI,CAAC,QAAQ,IAAI,CAAC,YAAY,EAAE,CAAC;YACxD,MAAM,IAAI,4BAAmB,CAAC,gEAAgE,CAAC,CAAC;QAClG,CAAC;QAED,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;QAE9B,MAAM,MAAM,GAAG,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACjD,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAErC,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YAC7C,MAAM,IAAI,8BAAqB,CAAC,wCAAwC,CAAC,CAAC;QAC5E,CAAC;QAED,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,MAAM,CAAC,WAAW,KAAK,WAAW,EAAE,CAAC;YACvE,MAAM,IAAI,8BAAqB,CAAC,2DAA2D,CAAC,CAAC;QAC/F,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,YAAY,EAAE,MAAM,CAAC,aAAa,EAAE,MAAM,CAAC,mBAAmB,CAAC,EAAE,CAAC;YACrF,MAAM,IAAI,8BAAqB,CAAC,6BAA6B,CAAC,CAAC;QACjE,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAChE,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,8BAAqB,CAAC,iBAAiB,CAAC,CAAC;QACrD,CAAC;QAED,MAAM,QAAQ,GAAgB;YAC5B,EAAE,EAAE,IAAI,CAAC,EAAE;YACX,IAAI,EAAE,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,EAAE;YAC9B,KAAK,EAAE,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,EAAE;YACnD,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,IAAI;SAC5B,CAAC;QAEF,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,kBAAkB,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;QAC5D,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,2BAA2B,EAAE,CAAC;QAC5D,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,QAAQ,EAAE,QAAQ,EAAE;YAC3D,KAAK,EAAE,MAAM,CAAC,SAAS;YACvB,OAAO,EAAE,MAAM,CAAC,WAAW;SAC5B,CAAC,CAAC;QAEH,MAAM,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAE3C,OAAO;YACL,YAAY,EAAE,MAAM,CAAC,WAAW;YAChC,aAAa,EAAE,MAAM,CAAC,YAAY;YAClC,QAAQ,EAAE,OAAO;YACjB,UAAU,EAAE,QAAQ;YACpB,UAAU,EAAE,SAAS;SACtB,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,oBAAoB,CAChC,YAAgC,EAChC,QAA4B,EAC5B,IAAqB;QAErB,IAAI,CAAC,YAAY,EAAE,IAAI,EAAE,EAAE,CAAC;YAC1B,MAAM,IAAI,4BAAmB,CAAC,4BAA4B,CAAC,CAAC;QAC9D,CAAC;QAED,IAAI,QAAQ,EAAE,CAAC;YACb,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;QAChC,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,YAAY,CAAC,IAAI,EAAE,EAAE,IAAI,CAAC,CAAC;QACzE,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,2BAA2B,EAAE,CAAC;QAC5D,MAAM,OAAO,GAAG,IAAI,CAAC,uBAAuB,EAAE,CAAC;QAC/C,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,IAAI,OAAO,CAAC,CAAC,CAAC,IAAI,QAAQ,EAAE,EAAE,CAAC,CAAC;QAE9F,OAAO;YACL,YAAY,EAAE,MAAM,CAAC,WAAW;YAChC,aAAa,EAAE,MAAM,CAAC,YAAY;YAClC,QAAQ,EAAE,OAAO;YACjB,UAAU,EAAE,QAAQ;YACpB,UAAU,EAAE,SAAS;SACtB,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,iCAAiC,CAC7C,WAAmB,EACnB,IAAY,EACZ,MAAc;QAEd,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,WAAW,CAAC,CAAC;QAC3D,MAAM,WAAW,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,qBAAqB,kBAAkB,CAAC,WAAW,CAAC,EAAE,CAAC;QAEvG,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;YAC/B,IAAI;YACJ,SAAS,EAAE,MAAM,CAAC,QAAQ;YAC1B,aAAa,EAAE,MAAM,CAAC,YAAY;YAClC,YAAY,EAAE,WAAW;YACzB,UAAU,EAAE,oBAAoB;SACjC,CAAC,CAAC;QAEH,MAAM,aAAa,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,QAAQ,EAAE;YACjD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;YAChE,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE;SACtB,CAAC,CAAC;QAEH,IAAI,CAAC,aAAa,CAAC,EAAE,EAAE,CAAC;YACtB,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,IAAI,EAAE,CAAC;YAC1C,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,mCAAmC,WAAW,MAAM,MAAM,EAAE,CAAC,CAAC;YAC/E,MAAM,IAAI,8BAAqB,CAAC,GAAG,WAAW,wBAAwB,CAAC,CAAC;QAC1E,CAAC;QAED,MAAM,SAAS,GAAG,CAAC,MAAM,aAAa,CAAC,IAAI,EAAE,CAAiD,CAAC;QAC/F,IAAI,SAAS,CAAC,QAAQ,EAAE,CAAC;YACvB,OAAO,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QAC/C,CAAC;QAED,IAAI,CAAC,SAAS,CAAC,YAAY,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;YACnD,MAAM,IAAI,8BAAqB,CAAC,GAAG,WAAW,wBAAwB,CAAC,CAAC;QAC1E,CAAC;QAED,MAAM,eAAe,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,WAAW,EAAE;YACtD,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,SAAS,CAAC,YAAY,EAAE,EAAE;SAC/D,CAAC,CAAC;QAEH,IAAI,CAAC,eAAe,CAAC,EAAE,EAAE,CAAC;YACxB,MAAM,IAAI,8BAAqB,CAAC,GAAG,WAAW,yBAAyB,CAAC,CAAC;QAC3E,CAAC;QAED,OAAO,CAAC,MAAM,eAAe,CAAC,IAAI,EAAE,CAAwB,CAAC;IAC/D,CAAC;IAEO,YAAY,CAAC,OAAe;QAClC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACrB,MAAM,IAAI,8BAAqB,CAAC,mBAAmB,CAAC,CAAC;QACvD,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAE7E,CAAC;QAEF,OAAO;YACL,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,aAAa,EAAE,OAAO,CAAC,cAAc;YACrC,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,OAAO,EAAE,OAAO,CAAC,OAAO;SACzB,CAAC;IACJ,CAAC;IAEO,+BAA+B,CAAC,OAAsC;QAC5E,IAAI,OAAO,CAAC,YAAY,KAAK,MAAM,EAAE,CAAC;YACpC,MAAM,IAAI,4BAAmB,CAAC,uCAAuC,CAAC,CAAC;QACzE,CAAC;QAED,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAEtC,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,IAAI,EAAE,EAAE,CAAC;YACjC,MAAM,IAAI,4BAAmB,CAAC,2BAA2B,CAAC,CAAC;QAC7D,CAAC;QAED,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE,CAAC;YAC5B,MAAM,IAAI,4BAAmB,CAAC,qBAAqB,CAAC,CAAC;QACvD,CAAC;QAED,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,IAAI,EAAE,IAAI,OAAO,CAAC,mBAAmB,KAAK,MAAM,EAAE,CAAC;YAC7E,MAAM,IAAI,4BAAmB,CAAC,uCAAuC,CAAC,CAAC;QACzE,CAAC;IACH,CAAC;IAEO,cAAc,CAAC,QAAgB;QACrC,MAAM,OAAO,GAAG,IAAI,CAAC,uBAAuB,EAAE,CAAC;QAC/C,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YAChC,MAAM,IAAI,4BAAmB,CAAC,0BAA0B,QAAQ,EAAE,CAAC,CAAC;QACtE,CAAC;IACH,CAAC;IAEO,uBAAuB;QAC7B,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAW,6DAA6B,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;YAC3F,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACzC,OAAO,GAAG,CAAC;YACb,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,wBAAwB;QAC1B,CAAC;QACD,OAAO,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;IAClC,CAAC;IAEO,KAAK,CAAC,mBAAmB,CAAC,GAAW;QAC3C,MAAM,OAAO,GAAG,IAAI,CAAC,8BAA8B,EAAE,CAAC;QACtD,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,MAAM,OAAO,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACnE,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,oCAA2B,CAAC;gBACpC,UAAU,EAAE,GAAG;gBACf,OAAO,EACL,sBAAsB,GAAG,+CAA+C;oBACxE,wDAAwD;oBACxD,mDAAmD;gBACrD,KAAK,EAAE,+BAA+B;aACvC,CAAC,CAAC;QACL,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,8BAA8B;QACpC,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAA8B,8DAA8B,EAAE;gBACrF,MAAM,EAAE,KAAK;aACd,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAEO,UAAU,CAAC,YAAoB,EAAE,aAAqB,EAAE,MAAc;QAC5E,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;YACtB,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,MAAM,GAAG,IAAA,mBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QAC7E,IAAI,CAAC;YACH,OAAO,IAAA,wBAAe,EAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC;QAC1E,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;CACF,CAAA;AA/VY,oDAAoB;+BAApB,oBAAoB;IADhC,IAAA,mBAAU,GAAE;6CAOc,0BAAW;QACJ,4DAA2B;QAChC,4BAAY;QACT,gBAAS;GAT5B,oBAAoB,CA+VhC;AAED,YAAY"}
+{"version":3,"file":"platform-oauth.service.js","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/oauth/platform-oauth.service.ts"],"names":[],"mappings":";;;;AAAA,2CAKwB;AACxB,uCAAyC;AACzC,mCAAiD;AACjD,yFAI+C;AAC/C,uDAAmD;AACnD,2FAAqF;AACrF,qDAAqE;AACrE,yDAAqD;AAOrD,qDAA+D;AAC/D,yDAAoD;AACpD,yDAAoD;AACpD,mFAA6E;AActE,IAAM,oBAAoB,GAA1B,MAAM,oBAAoB;IAC/B,YACmB,IAAiB,EACjB,WAAwC,EACxC,MAAoB,EACpB,SAAoB,EACpB,EAAkB,EAClB,EAAkB,EAClB,OAAmC;QANnC,SAAI,GAAJ,IAAI,CAAa;QACjB,gBAAW,GAAX,WAAW,CAA6B;QACxC,WAAM,GAAN,MAAM,CAAc;QACpB,cAAS,GAAT,SAAS,CAAW;QACpB,OAAE,GAAF,EAAE,CAAgB;QAClB,OAAE,GAAF,EAAE,CAAgB;QAClB,YAAO,GAAP,OAAO,CAA4B;IACnD,CAAC;IAEJ,oBAAoB,CAAC,MAAc;QACjC,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACvC,OAAO;YACL,MAAM,EAAE,IAAI;YACZ,sBAAsB,EAAE,GAAG,IAAI,oBAAoB;YACnD,cAAc,EAAE,GAAG,IAAI,gBAAgB;YACvC,QAAQ,EAAE,GAAG,IAAI,wBAAwB;YACzC,iBAAiB,EAAE,GAAG,IAAI,mBAAmB;YAC7C,mBAAmB,EAAE,GAAG,IAAI,qBAAqB;YACjD,oBAAoB,EAAE,GAAG,IAAI,qBAAqB;YAClD,wBAAwB,EAAE,CAAC,MAAM,CAAC;YAClC,qBAAqB,EAAE,CAAC,oBAAoB,EAAE,eAAe,CAAC;YAC9D,gCAAgC,EAAE,CAAC,MAAM,CAAC;YAC1C,gBAAgB,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,gBAAgB,CAAC;YAClE,uBAAuB,EAAE,CAAC,QAAQ,CAAC;YACnC,qCAAqC,EAAE,CAAC,OAAO,CAAC;SACjD,CAAC;IACJ,CAAC;IAED,+FAA+F;IAC/F,eAAe;QACb,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;IAC/B,CAAC;IAED;;OAEG;IACH,oBAAoB,CAAC,IAAwC;QAC3D,MAAM,SAAS,GAAG,IAAI,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,CAAC;QAC7C,IAAI,SAAS,KAAK,oBAAoB,EAAE,CAAC;YACvC,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC;YAClC,OAAO,CAAC,CAAC,IAAI,IAAI,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAChD,CAAC;QAED,IAAI,SAAS,KAAK,eAAe,EAAE,CAAC;YAClC,MAAM,YAAY,GAAG,IAAI,CAAC,eAAe,CAAC,EAAE,IAAI,EAAE,CAAC;YACnD,IAAI,CAAC,YAAY,EAAE,CAAC;gBAClB,OAAO,KAAK,CAAC;YACf,CAAC;YAED,IAAI,CAAC;gBACH,IAAI,CAAC,MAAM,CAAC,kBAAkB,CAAC,YAAY,CAAC,CAAC;gBAC7C,OAAO,IAAI,CAAC;YACd,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,iBAAiB,CAAC,KAAwC;QAC9D,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAC5C,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;QAClE,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;QAEvD,MAAM,YAAY,GAAG,IAAA,oBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QAC3D,MAAM,aAAa,GAAG,IAAA,mBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QAEpF,MAAM,IAAI,CAAC,EAAE,CAAC,iBAAiB,CAAC,aAAa,EAAE,YAAY,CAAC,CAAC;QAE7D,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAC7C,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;YACjC,aAAa,EAAE,MAAM;YACrB,SAAS,EAAE,KAAK,CAAC,QAAQ;YACzB,YAAY,EAAE,KAAK,CAAC,WAAW;YAC/B,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,cAAc,EAAE,aAAa;YAC7B,qBAAqB,EAAE,MAAM;YAC7B,iBAAiB,EAAE,KAAK,CAAC,QAAQ;SAClC,CAAC,CAAC;QAEH,OAAO,EAAE,YAAY,EAAE,GAAG,IAAI,sBAAsB,MAAM,CAAC,QAAQ,EAAE,EAAE,EAAE,CAAC;IAC5E,CAAC;IAED,KAAK,CAAC,kBAAkB,CAAC,OAAsC;QAC7D,MAAM,EAAE,WAAW,EAAE,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC;QAClE,OAAO,WAAW,CAAC;IACrB,CAAC;IAED,KAAK,CAAC,wBAAwB,CAC5B,WAAmB,EACnB,IAAY,EACZ,KAAa;QAEb,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC;QAChE,IAAI,aAAa,CAAC,QAAQ,KAAK,WAAW,CAAC,IAAI,EAAE,EAAE,CAAC;YAClD,MAAM,IAAI,8BAAqB,CAAC,gCAAgC,CAAC,CAAC;QACpE,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,WAAW,CAAC,CAAC;QAC3D,MAAM,WAAW,GAAG,GAAG,aAAa,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,qBAAqB,kBAAkB,CAAC,WAAW,CAAC,EAAE,CAAC;QAErH,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,YAAY,CAAC,MAAM,EAAE,IAAI,EAAE,WAAW,CAAC,CAAC;QAE1E,MAAM,OAAO,GAAG,WAAW,CAAC,OAAO;YACjC,CAAC,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC,yBAAyB,CAAC,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,aAAa,CAAC,KAAK,EAAE,MAAM,CAAC,QAAQ,CAAC;YAC5G,CAAC,CAAC,MAAM,IAAI,CAAC,yBAAyB,CAAC,MAAM,EAAE,WAAW,CAAC,WAAW,CAAC,CAAC;QAE1E,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,wBAAwB,CAAC;YAC3D,QAAQ,EAAE,WAAW;YACrB,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,eAAe,EAAE,OAAO,CAAC,GAAG;YAC5B,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,aAAa,EAAE,OAAO,CAAC,aAAa;YACpC,WAAW,EAAE,OAAO,CAAC,IAAI;YACzB,OAAO,EAAE,OAAO,CAAC,OAAO;SACzB,CAAC,CAAC;QAEH,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,SAAS,CAAC;YAC3C,aAAa,EAAE,aAAa,CAAC,aAAa;YAC1C,mBAAmB,EAAE,aAAa,CAAC,mBAAmB;YACtD,YAAY,EAAE,aAAa,CAAC,YAAY;YACxC,WAAW,EAAE,aAAa,CAAC,WAAW;YACtC,QAAQ,EAAE,aAAa,CAAC,QAAQ;YAChC,MAAM,EAAE,IAAI,CAAC,EAAE;YACf,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,EAAE;YAClC,SAAS,EAAE,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,EAAE;YACvD,SAAS,EAAE,OAAO,CAAC,KAAK;YACxB,WAAW,EAAE,OAAO,CAAC,OAAO;YAC5B,QAAQ,EAAE,WAAW;YACrB,KAAK,EAAE,aAAa,CAAC,KAAK;SAC3B,CAAC,CAAC;QAEH,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,aAAa,CAAC,WAAW,CAAC,CAAC;QACpD,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;QAChD,OAAO,QAAQ,CAAC,QAAQ,EAAE,CAAC;IAC7B,CAAC;IAED,KAAK,CAAC,yBAAyB,CAC7B,IAAwC,EACxC,IAAqB;QAErB,MAAM,SAAS,GAAG,IAAI,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,CAAC;QAC7C,IAAI,SAAS,KAAK,eAAe,EAAE,CAAC;YAClC,OAAO,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE,IAAI,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;QACzF,CAAC;QAED,IAAI,SAAS,KAAK,oBAAoB,EAAE,CAAC;YACvC,MAAM,IAAI,4BAAmB,CAAC,yBAAyB,CAAC,CAAC;QAC3D,CAAC;QAED,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC;QAClC,MAAM,WAAW,GAAG,IAAI,CAAC,cAAc,CAAC,EAAE,IAAI,EAAE,CAAC;QACjD,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,CAAC;QAC3C,MAAM,YAAY,GAAG,IAAI,CAAC,eAAe,CAAC,EAAE,IAAI,EAAE,CAAC;QAEnD,IAAI,CAAC,IAAI,IAAI,CAAC,WAAW,IAAI,CAAC,QAAQ,EAAE,CAAC;YACvC,MAAM,IAAI,4BAAmB,CAAC,iDAAiD,CAAC,CAAC;QACnF,CAAC;QAED,IAAI,CAAC,OAAO,CAAC,6BAA6B,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QAC3D,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,QAAQ,EAAE,oBAAoB,CAAC,CAAC;QAE7D,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC;YACvC,IAAI;YACJ,QAAQ;YACR,WAAW;YACX,YAAY;SACb,CAAC,CAAC;QAEH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAChE,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,8BAAqB,CAAC,iBAAiB,CAAC,CAAC;QACrD,CAAC;QAED,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,EAAE,IAAI,EAAE;YAC7D,QAAQ,EAAE,4CAA8B;SACzC,CAAC,CAAC;QACH,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,2BAA2B,EAAE,CAAC;QAC5D,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,CACtC;YACE,EAAE,EAAE,IAAI,CAAC,EAAE;YACX,IAAI,EAAE,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,EAAE;YAC9B,KAAK,EAAE,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,EAAE;YACnD,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,IAAI;SAC5B,EACD,QAAQ,EACR;YACE,KAAK,EAAE,MAAM,CAAC,SAAS;YACvB,OAAO,EAAE,MAAM,CAAC,WAAW;YAC3B,KAAK,EAAE,MAAM,CAAC,KAAK;SACpB,CACF,CAAC;QAEF,OAAO,IAAI,CAAC,qBAAqB,CAC/B;YACE,WAAW,EAAE,WAAW,CAAC,WAAW;YACpC,YAAY,EAAE,WAAW,CAAC,YAAY;YACtC,OAAO;YACP,SAAS;SACV,CACF,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,KAKhB;QACC,IAAI,KAAK,CAAC,qBAAqB,EAAE,IAAI,EAAE,EAAE,CAAC;YACxC,IAAI,CAAC,OAAO,CAAC,2BAA2B,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,qBAAqB,CAAC,CAAC;QACxF,CAAC;QAED,IAAI,KAAK,CAAC,WAAW,EAAE,IAAI,EAAE,EAAE,CAAC;YAC9B,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC;gBACtE,IAAI,OAAO,EAAE,GAAG,EAAE,CAAC;oBACjB,MAAM,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;gBACjD,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,yBAAyB;YAC3B,CAAC;QACH,CAAC;QAED,IAAI,CAAC,KAAK,CAAC,qBAAqB,EAAE,IAAI,EAAE,EAAE,CAAC;YACzC,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,qBAAqB,CAAC,IAAI,EAAE,CAAC,CAAC;QAC7D,IAAI,KAAK,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC;YACxB,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QACzD,CAAC;QACD,OAAO,QAAQ,CAAC,QAAQ,EAAE,CAAC;IAC7B,CAAC;IAEO,KAAK,CAAC,oBAAoB,CAChC,YAAgC,EAChC,QAA4B,EAC5B,IAAqB,EACrB,IAAwC;QAExC,IAAI,CAAC,YAAY,EAAE,IAAI,EAAE,EAAE,CAAC;YAC1B,MAAM,IAAI,4BAAmB,CAAC,4BAA4B,CAAC,CAAC;QAC9D,CAAC;QAED,IAAI,QAAQ,EAAE,CAAC;YACb,IAAI,CAAC,OAAO,CAAC,6BAA6B,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;YAC3D,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC;QAC1D,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,YAAY,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE;YACvE,QAAQ,EAAE,4CAA8B;SACzC,CAAC,CAAC;QACH,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,2BAA2B,EAAE,CAAC;QAC5D,MAAM,gBAAgB,GAAG,QAAQ,IAAI,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,IAAI,QAAQ,CAAC;QACzF,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,EAAE,gBAAgB,EAAE,EAAE,CAAC,CAAC;QAE5E,OAAO,IAAI,CAAC,qBAAqB,CAC/B;YACE,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,OAAO;YACP,SAAS;SACV,CACF,CAAC;IACJ,CAAC;IAEO,qBAAqB,CAAC,MAK7B;QACC,MAAM,IAAI,GAAuB,IAAA,4CAA2B,EAAC,MAAM,CAAC,CAAC;QAErE,OAAO;YACL,IAAI;YACJ,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,YAAY,EAAE,MAAM,CAAC,YAAY;SAClC,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,mBAAmB,CAAC,GAAW;QAC3C,MAAM,OAAO,GAAG,IAAI,CAAC,8BAA8B,EAAE,CAAC;QACtD,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,MAAM,OAAO,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACnE,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,oCAA2B,CAAC;gBACpC,UAAU,EAAE,GAAG;gBACf,OAAO,EACL,sBAAsB,GAAG,+CAA+C;oBACxE,wDAAwD;oBACxD,mDAAmD;gBACrD,KAAK,EAAE,+BAA+B;aACvC,CAAC,CAAC;QACL,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,8BAA8B;QACpC,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAA8B,8DAA8B,EAAE;gBACrF,MAAM,EAAE,KAAK;aACd,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,yBAAyB,CACrC,MAAwC,EACxC,WAAmB;QAEnB,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;YACxB,MAAM,IAAI,8BAAqB,CAAC,sDAAsD,CAAC,CAAC;QAC1F,CAAC;QAED,MAAM,MAAM,GACV,MAAM,CAAC,SAAS,EAAE,IAAI,EAAE,EAAE,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;YAC5C,CAAC,MAAM,IAAI,CAAC,4BAA4B,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC;QAChE,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,aAAa,CAAC,WAAW,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC;QAC7E,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;YACjB,MAAM,IAAI,8BAAqB,CAAC,kDAAkD,CAAC,CAAC;QACtF,CAAC;QAED,OAAO;YACL,MAAM;YACN,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,aAAa,EAAE,OAAO,CAAC,aAAa;YACpC,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,OAAO,EAAE,OAAO,CAAC,OAAO;SACzB,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,4BAA4B,CAAC,WAAmB;QAC5D,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC;QACzC,MAAM,YAAY,GAAG,GAAG,IAAI,mCAAmC,CAAC;QAEhE,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,YAAY,CAAC,CAAC;YAC3C,IAAI,QAAQ,CAAC,EAAE,EAAE,CAAC;gBAChB,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAA4B,CAAC;gBAChE,IAAI,OAAO,IAAI,CAAC,QAAQ,CAAC,KAAK,QAAQ,EAAE,CAAC;oBACvC,OAAO,IAAI,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;gBAC3C,CAAC;YACH,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,6BAA6B;QAC/B,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;CACF,CAAA;AAvWY,oDAAoB;+BAApB,oBAAoB;IADhC,IAAA,mBAAU,GAAE;6CAGc,0BAAW;QACJ,4DAA2B;QAChC,4BAAY;QACT,gBAAS;QAChB,iCAAc;QACd,iCAAc;QACT,0DAA0B;GAR3C,oBAAoB,CAuWhC;AAED,YAAY"}

package/security/src/lib/oauth/platform-oauth.types.d.ts

@@ -5,6 +5,8 @@ export interface PlatformOAuthAuthorizeRequest {
     scope: string;
     codeChallenge: string;
     codeChallengeMethod: string;
+    /** Server-side PKCE verifier when generated by `/connect/authorize/init`. */
+    codeVerifier?: string;
     /** IdentityProvider.key / acr_values (e.g. google). */
     provider: string;
     /** Platform API issuer base, e.g. http://localhost:5500/api */
@@ -41,10 +43,16 @@ export interface ExternalOidcProfile {
     picture?: string;
 }
 export interface OAuthTokenResponse {
-    access_token: string;
-    refresh_token: string;
-    id_token: string;
+    access_token?: string;
+    refresh_token?: string;
+    id_token?: string;
     token_type: 'Bearer';
     expires_in: number;
 }
+/** Internal result for BFF cookie + JSON split. */
+export interface OAuthExchangeResult {
+    body: OAuthTokenResponse;
+    accessToken: string;
+    refreshToken: string;
+}
 //# sourceMappingURL=platform-oauth.types.d.ts.map

package/security/src/lib/oauth/platform-oauth.types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"platform-oauth.types.d.ts","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/oauth/platform-oauth.types.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,6BAA6B;IAC5C,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,aAAa,EAAE,MAAM,CAAC;IACtB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,uDAAuD;IACvD,QAAQ,EAAE,MAAM,CAAC;IACjB,+DAA+D;IAC/D,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,+BAA+B;IAC9C,aAAa,EAAE,MAAM,CAAC;IACtB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,2BAA2B;IAC1C,aAAa,EAAE,MAAM,CAAC;IACtB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,mBAAmB;IAClC,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,kBAAkB;IACjC,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,QAAQ,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;CACpB"}
+{"version":3,"file":"platform-oauth.types.d.ts","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/oauth/platform-oauth.types.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,6BAA6B;IAC5C,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,aAAa,EAAE,MAAM,CAAC;IACtB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,6EAA6E;IAC7E,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,uDAAuD;IACvD,QAAQ,EAAE,MAAM,CAAC;IACjB,+DAA+D;IAC/D,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,+BAA+B;IAC9C,aAAa,EAAE,MAAM,CAAC;IACtB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,2BAA2B;IAC1C,aAAa,EAAE,MAAM,CAAC;IACtB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,mBAAmB;IAClC,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,kBAAkB;IACjC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,QAAQ,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,mDAAmD;AACnD,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,kBAAkB,CAAC;IACzB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;CACtB"}

package/security/src/lib/oauth/platform-oauth.types.js.map

@@ -1 +1 @@
-{"version":3,"file":"platform-oauth.types.js","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/oauth/platform-oauth.types.ts"],"names":[],"mappings":";AAAA,wCAAwC;;AAwDxC,YAAY"}
+{"version":3,"file":"platform-oauth.types.js","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/oauth/platform-oauth.types.ts"],"names":[],"mappings":";AAAA,wCAAwC;;AAiExC,YAAY"}

package/security/src/lib/oauth/redis-oauth-grant-store.service.d.ts

@@ -0,0 +1,22 @@
+import { OnModuleDestroy } from '@nestjs/common';
+import type { OAuthCodeRecord, OAuthExternalStateRecord } from './oauth-op.types';
+import { OAuthGrantStore } from './oauth-grant-store.interface';
+export declare class RedisOAuthGrantStore extends OAuthGrantStore implements OnModuleDestroy {
+    private readonly logger;
+    private readonly redis;
+    private readonly localCodes;
+    private readonly localStates;
+    private readonly localPkceVerifiers;
+    constructor();
+    private keyForCode;
+    private keyForState;
+    private keyForPkceVerifier;
+    saveCode(code: string, record: OAuthCodeRecord, ttlMs: number): Promise<void>;
+    consumeCode(code: string): Promise<OAuthCodeRecord | null>;
+    saveState(state: string, record: OAuthExternalStateRecord, ttlMs: number): Promise<void>;
+    consumeState(state: string): Promise<OAuthExternalStateRecord | null>;
+    savePkceVerifier(codeChallenge: string, codeVerifier: string, ttlMs: number): Promise<void>;
+    consumePkceVerifier(codeChallenge: string): Promise<string | null>;
+    onModuleDestroy(): Promise<void>;
+}
+//# sourceMappingURL=redis-oauth-grant-store.service.d.ts.map

package/security/src/lib/oauth/redis-oauth-grant-store.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"redis-oauth-grant-store.service.d.ts","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/oauth/redis-oauth-grant-store.service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAsB,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAErE,OAAO,KAAK,EAAE,eAAe,EAAE,wBAAwB,EAAE,MAAM,kBAAkB,CAAC;AAClF,OAAO,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAiChE,qBACa,oBAAqB,SAAQ,eAAgB,YAAW,eAAe;IAClF,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAyC;IAEhE,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAe;IACrC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA6B;IACxD,OAAO,CAAC,QAAQ,CAAC,WAAW,CAA6B;IACzD,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAA6B;;IAiBhE,OAAO,CAAC,UAAU;IAIlB,OAAO,CAAC,WAAW;IAInB,OAAO,CAAC,kBAAkB;IAIpB,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,eAAe,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAY7E,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC;IAgB1D,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,wBAAwB,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAYxF,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,wBAAwB,GAAG,IAAI,CAAC;IAgBrE,gBAAgB,CAAC,aAAa,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAU3F,mBAAmB,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAWlE,eAAe,IAAI,OAAO,CAAC,IAAI,CAAC;CAKvC"}