@acorex-platform/framework-server 0.0.32 → 0.0.37

package/security/src/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../../libs/framework/server/security/src/index.ts"],"names":[],"mappings":"AAAA,cAAc,uBAAuB,CAAC;AACtC,cAAc,yBAAyB,CAAC;AACxC,cAAc,0BAA0B,CAAC;AACzC,cAAc,mCAAmC,CAAC;AAClD,cAAc,gCAAgC,CAAC;AAC/C,cAAc,kCAAkC,CAAC;AACjD,cAAc,gCAAgC,CAAC;AAC/C,cAAc,wBAAwB,CAAC;AACvC,cAAc,kCAAkC,CAAC;AACjD,cAAc,uBAAuB,CAAC;AACtC,cAAc,wBAAwB,CAAC;AACvC,cAAc,uCAAuC,CAAC;AACtD,cAAc,0CAA0C,CAAC;AACzD,cAAc,6BAA6B,CAAC;AAC5C,cAAc,2BAA2B,CAAC;AAC1C,cAAc,uCAAuC,CAAC;AACtD,cAAc,qCAAqC,CAAC;AACpD,cAAc,yCAAyC,CAAC;AACxD,cAAc,uCAAuC,CAAC;AACtD,cAAc,qCAAqC,CAAC;AACpD,cAAc,0CAA0C,CAAC;AACzD,cAAc,+CAA+C,CAAC;AAC9D,cAAc,mDAAmD,CAAC;AAClE,cAAc,kDAAkD,CAAC;AACjE,cAAc,gDAAgD,CAAC;AAC/D,cAAc,0CAA0C,CAAC;AACzD,cAAc,uCAAuC,CAAC;AACtD,cAAc,gDAAgD,CAAC;AAC/D,cAAc,gDAAgD,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../../libs/framework/server/security/src/index.ts"],"names":[],"mappings":"AAAA,cAAc,uBAAuB,CAAC;AACtC,cAAc,mCAAmC,CAAC;AAClD,cAAc,yBAAyB,CAAC;AACxC,cAAc,0BAA0B,CAAC;AACzC,cAAc,mCAAmC,CAAC;AAClD,cAAc,gCAAgC,CAAC;AAC/C,cAAc,kCAAkC,CAAC;AACjD,cAAc,gCAAgC,CAAC;AAC/C,cAAc,4CAA4C,CAAC;AAC3D,cAAc,wBAAwB,CAAC;AACvC,cAAc,kCAAkC,CAAC;AACjD,cAAc,uBAAuB,CAAC;AACtC,cAAc,wBAAwB,CAAC;AACvC,cAAc,uCAAuC,CAAC;AACtD,cAAc,0CAA0C,CAAC;AACzD,YAAY,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AACxE,OAAO,EAAE,yBAAyB,EAAE,MAAM,0CAA0C,CAAC;AACrF,cAAc,6BAA6B,CAAC;AAC5C,cAAc,2BAA2B,CAAC;AAC1C,cAAc,uCAAuC,CAAC;AACtD,cAAc,qCAAqC,CAAC;AACpD,cAAc,yCAAyC,CAAC;AACxD,cAAc,uCAAuC,CAAC;AACtD,cAAc,qCAAqC,CAAC;AACpD,cAAc,0CAA0C,CAAC;AACzD,cAAc,+CAA+C,CAAC;AAC9D,cAAc,mDAAmD,CAAC;AAClE,cAAc,kDAAkD,CAAC;AACjE,cAAc,gDAAgD,CAAC;AAC/D,cAAc,0CAA0C,CAAC;AACzD,cAAc,uCAAuC,CAAC;AACtD,cAAc,gDAAgD,CAAC;AAC/D,cAAc,gDAAgD,CAAC"}

package/security/src/index.js

@@ -1,19 +1,24 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.OidcProviderEngineService = void 0;
 const tslib_1 = require("tslib");
 tslib_1.__exportStar(require("./lib/security.module"), exports);
+tslib_1.__exportStar(require("./lib/auth/device-session.service"), exports);
 tslib_1.__exportStar(require("./lib/auth/auth.service"), exports);
 tslib_1.__exportStar(require("./lib/auth/token.service"), exports);
 tslib_1.__exportStar(require("./lib/auth/token-resolver.service"), exports);
 tslib_1.__exportStar(require("./lib/auth/auth-cookie.service"), exports);
 tslib_1.__exportStar(require("./lib/auth/login-attempt.service"), exports);
 tslib_1.__exportStar(require("./lib/auth/auth-lockout-policy"), exports);
+tslib_1.__exportStar(require("./lib/auth/auth-max-device-sessions-policy"), exports);
 tslib_1.__exportStar(require("./lib/auth/auth.config"), exports);
 tslib_1.__exportStar(require("./lib/auth/machine-token.service"), exports);
 tslib_1.__exportStar(require("./lib/auth/auth.types"), exports);
 tslib_1.__exportStar(require("./lib/auth/auth.events"), exports);
 tslib_1.__exportStar(require("./lib/auth/auth-providers.contributor"), exports);
 tslib_1.__exportStar(require("./lib/auth/auth-identity-provider.source"), exports);
+var oidc_provider_engine_service_1 = require("./lib/oauth/oidc-provider-engine.service");
+Object.defineProperty(exports, "OidcProviderEngineService", { enumerable: true, get: function () { return oidc_provider_engine_service_1.OidcProviderEngineService; } });
 tslib_1.__exportStar(require("./lib/auth/public.decorator"), exports);
 tslib_1.__exportStar(require("./lib/auth/jwt-auth.guard"), exports);
 tslib_1.__exportStar(require("./lib/session/backend-session.service"), exports);

package/security/src/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../../libs/framework/server/security/src/index.ts"],"names":[],"mappings":";;;AAAA,gEAAsC;AACtC,kEAAwC;AACxC,mEAAyC;AACzC,4EAAkD;AAClD,yEAA+C;AAC/C,2EAAiD;AACjD,yEAA+C;AAC/C,iEAAuC;AACvC,2EAAiD;AACjD,gEAAsC;AACtC,iEAAuC;AACvC,gFAAsD;AACtD,mFAAyD;AACzD,sEAA4C;AAC5C,oEAA0C;AAC1C,gFAAsD;AACtD,8EAAoD;AACpD,kFAAwD;AACxD,gFAAsD;AACtD,8EAAoD;AACpD,mFAAyD;AACzD,wFAA8D;AAC9D,4FAAkE;AAClE,2FAAiE;AACjE,yFAA+D;AAC/D,mFAAyD;AACzD,gFAAsD;AACtD,yFAA+D;AAC/D,yFAA+D"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../../libs/framework/server/security/src/index.ts"],"names":[],"mappings":";;;;AAAA,gEAAsC;AACtC,4EAAkD;AAClD,kEAAwC;AACxC,mEAAyC;AACzC,4EAAkD;AAClD,yEAA+C;AAC/C,2EAAiD;AACjD,yEAA+C;AAC/C,qFAA2D;AAC3D,iEAAuC;AACvC,2EAAiD;AACjD,gEAAsC;AACtC,iEAAuC;AACvC,gFAAsD;AACtD,mFAAyD;AAEzD,yFAAqF;AAA5E,yIAAA,yBAAyB,OAAA;AAClC,sEAA4C;AAC5C,oEAA0C;AAC1C,gFAAsD;AACtD,8EAAoD;AACpD,kFAAwD;AACxD,gFAAsD;AACtD,8EAAoD;AACpD,mFAAyD;AACzD,wFAA8D;AAC9D,4FAAkE;AAClE,2FAAiE;AACjE,yFAA+D;AAC/D,mFAAyD;AACzD,gFAAsD;AACtD,yFAA+D;AAC/D,yFAA+D"}

package/security/src/lib/auth/auth-cookie-response.util.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-cookie-response.util.d.ts","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/auth/auth-cookie-response.util.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACjD,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC1D,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AACzD,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAM/C,uEAAuE;AACvE,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,OAAO,GAAG,QAAQ,GAAG,IAAI,CAGzE;AAED,kEAAkE;AAClE,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,OAAO,EAChB,OAAO,EAAE,iBAAiB,EAC1B,MAAM,EAAE,YAAY,EACpB,IAAI,EAAE,oBAAoB,GACzB,IAAI,CAYN;AAED,8DAA8D;AAC9D,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,iBAAiB,GAAG,IAAI,CAOxF"}
+{"version":3,"file":"auth-cookie-response.util.d.ts","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/auth/auth-cookie-response.util.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACjD,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC1D,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AACzD,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAM/C,uEAAuE;AACvE,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,OAAO,GAAG,QAAQ,GAAG,IAAI,CAGzE;AAED,kEAAkE;AAClE,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,OAAO,EAChB,OAAO,EAAE,iBAAiB,EAC1B,MAAM,EAAE,YAAY,EACpB,IAAI,EAAE,oBAAoB,GACzB,IAAI,CAgBN;AAED,8DAA8D;AAC9D,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,iBAAiB,GAAG,IAAI,CAOxF"}

package/security/src/lib/auth/auth-cookie-response.util.js

@@ -17,11 +17,14 @@ function applyAuthTokenCookies(request, cookies, tokens, data) {
     if (!res) {
         return;
     }
+    // Remember-me: persistent refresh cookie. Unchecked → session cookie (no maxAge).
+    // Legacy responses omit `persist` → keep prior persistent default.
+    const persistRefresh = data.persist !== false;
     cookies.applyAuthCookies(res, {
         accessToken: data.accessToken,
         refreshToken: data.refreshToken,
         accessMaxAgeMs: tokens.accessTokenMaxAgeMs(),
-        refreshMaxAgeMs: tokens.refreshTokenMaxAgeMs(),
+        ...(persistRefresh ? { refreshMaxAgeMs: tokens.refreshTokenMaxAgeMs() } : {}),
     });
 }
 /** Clears auth cookies on logout / failed session restore. */

package/security/src/lib/auth/auth-cookie-response.util.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth-cookie-response.util.js","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/auth/auth-cookie-response.util.ts"],"names":[],"mappings":";AAAA,6BAA6B;;AAY7B,0DAGC;AAGD,sDAiBC;AAGD,sDAOC;AAtCD,YAAY;AAEZ,kDAAkD;AAElD,uEAAuE;AACvE,SAAgB,uBAAuB,CAAC,OAAgB;IACtD,MAAM,GAAG,GAAI,OAAwC,CAAC,GAAG,CAAC;IAC1D,OAAO,GAAG,IAAI,IAAI,CAAC;AACrB,CAAC;AAED,kEAAkE;AAClE,SAAgB,qBAAqB,CACnC,OAAgB,EAChB,OAA0B,EAC1B,MAAoB,EACpB,IAA0B;IAE1B,MAAM,GAAG,GAAG,uBAAuB,CAAC,OAAO,CAAC,CAAC;IAC7C,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,OAAO;IACT,CAAC;IAED,OAAO,CAAC,gBAAgB,CAAC,GAAG,EAAE;QAC5B,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,cAAc,EAAE,MAAM,CAAC,mBAAmB,EAAE;QAC5C,eAAe,EAAE,MAAM,CAAC,oBAAoB,EAAE;KAC/C,CAAC,CAAC;AACL,CAAC;AAED,8DAA8D;AAC9D,SAAgB,qBAAqB,CAAC,OAAgB,EAAE,OAA0B;IAChF,MAAM,GAAG,GAAG,uBAAuB,CAAC,OAAO,CAAC,CAAC;IAC7C,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,OAAO;IACT,CAAC;IAED,OAAO,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC;AAChC,CAAC;AAED,YAAY"}
+{"version":3,"file":"auth-cookie-response.util.js","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/auth/auth-cookie-response.util.ts"],"names":[],"mappings":";AAAA,6BAA6B;;AAY7B,0DAGC;AAGD,sDAqBC;AAGD,sDAOC;AA1CD,YAAY;AAEZ,kDAAkD;AAElD,uEAAuE;AACvE,SAAgB,uBAAuB,CAAC,OAAgB;IACtD,MAAM,GAAG,GAAI,OAAwC,CAAC,GAAG,CAAC;IAC1D,OAAO,GAAG,IAAI,IAAI,CAAC;AACrB,CAAC;AAED,kEAAkE;AAClE,SAAgB,qBAAqB,CACnC,OAAgB,EAChB,OAA0B,EAC1B,MAAoB,EACpB,IAA0B;IAE1B,MAAM,GAAG,GAAG,uBAAuB,CAAC,OAAO,CAAC,CAAC;IAC7C,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,OAAO;IACT,CAAC;IAED,kFAAkF;IAClF,mEAAmE;IACnE,MAAM,cAAc,GAAG,IAAI,CAAC,OAAO,KAAK,KAAK,CAAC;IAE9C,OAAO,CAAC,gBAAgB,CAAC,GAAG,EAAE;QAC5B,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,cAAc,EAAE,MAAM,CAAC,mBAAmB,EAAE;QAC5C,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,MAAM,CAAC,oBAAoB,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC9E,CAAC,CAAC;AACL,CAAC;AAED,8DAA8D;AAC9D,SAAgB,qBAAqB,CAAC,OAAgB,EAAE,OAA0B;IAChF,MAAM,GAAG,GAAG,uBAAuB,CAAC,OAAO,CAAC,CAAC;IAC7C,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,OAAO;IACT,CAAC;IAED,OAAO,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC;AAChC,CAAC;AAED,YAAY"}

package/security/src/lib/auth/auth-cookie.service.d.ts

@@ -9,6 +9,8 @@ export declare class AuthCookieService {
     clearAuthCookies(res: Response): void;
     readRefreshToken(cookies: Record<string, unknown> | undefined): string | null;
     readAccessTokenCookie(cookies: Record<string, unknown> | undefined): string | null;
+    applyCsrfCookie(res: Response): void;
+    readCsrfToken(cookies: Record<string, unknown> | undefined): string | null;
     private refreshCookieOptions;
     private accessCookieOptions;
     private baseCookieOptions;

package/security/src/lib/auth/auth-cookie.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-cookie.service.d.ts","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/auth/auth-cookie.service.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAiB,QAAQ,EAAE,MAAM,SAAS,CAAC;AAWvD,qBACa,iBAAiB;IAC5B,gBAAgB,CACd,GAAG,EAAE,QAAQ,EACb,MAAM,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,cAAc,CAAC,EAAE,MAAM,CAAC;QAAC,eAAe,CAAC,EAAE,MAAM,CAAA;KAAE,GACvG,IAAI;IAcP,gBAAgB,CAAC,GAAG,EAAE,QAAQ,GAAG,IAAI;IAYrC,gBAAgB,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,GAAG,MAAM,GAAG,IAAI;IAQ7E,qBAAqB,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,GAAG,MAAM,GAAG,IAAI;IAQlF,OAAO,CAAC,oBAAoB;IAS5B,OAAO,CAAC,mBAAmB;IAS3B,OAAO,CAAC,iBAAiB;CAM1B"}
+{"version":3,"file":"auth-cookie.service.d.ts","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/auth/auth-cookie.service.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAiB,QAAQ,EAAE,MAAM,SAAS,CAAC;AAavD,qBACa,iBAAiB;IAC5B,gBAAgB,CACd,GAAG,EAAE,QAAQ,EACb,MAAM,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,cAAc,CAAC,EAAE,MAAM,CAAC;QAAC,eAAe,CAAC,EAAE,MAAM,CAAA;KAAE,GACvG,IAAI;IAcP,gBAAgB,CAAC,GAAG,EAAE,QAAQ,GAAG,IAAI;IAYrC,gBAAgB,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,GAAG,MAAM,GAAG,IAAI;IAQ7E,qBAAqB,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,GAAG,MAAM,GAAG,IAAI;IAQlF,eAAe,CAAC,GAAG,EAAE,QAAQ,GAAG,IAAI;IAUpC,aAAa,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,GAAG,MAAM,GAAG,IAAI;IAQ1E,OAAO,CAAC,oBAAoB;IAS5B,OAAO,CAAC,mBAAmB;IAS3B,OAAO,CAAC,iBAAiB;CAM1B"}

package/security/src/lib/auth/auth-cookie.service.js

@@ -4,6 +4,7 @@ exports.AuthCookieService = void 0;
 const tslib_1 = require("tslib");
 const common_1 = require("@nestjs/common");
 const auth_config_1 = require("./auth.config");
+const crypto_1 = require("crypto");
 //#region ---- Auth cookie service ----
 let AuthCookieService = class AuthCookieService {
     applyAuthCookies(res, tokens) {
@@ -35,6 +36,22 @@ let AuthCookieService = class AuthCookieService {
         }
         return value.trim();
     }
+    applyCsrfCookie(res) {
+        const token = (0, crypto_1.randomBytes)(24).toString('hex');
+        res.cookie(auth_config_1.AUTH_COOKIE_CSRF_TOKEN, token, {
+            ...this.baseCookieOptions(),
+            httpOnly: false,
+            path: '/',
+            maxAge: 60 * 60 * 1000,
+        });
+    }
+    readCsrfToken(cookies) {
+        const value = cookies?.[auth_config_1.AUTH_COOKIE_CSRF_TOKEN];
+        if (typeof value !== 'string' || !value.trim()) {
+            return null;
+        }
+        return value.trim();
+    }
     refreshCookieOptions(maxAgeMs) {
         return {
             ...this.baseCookieOptions(),

package/security/src/lib/auth/auth-cookie.service.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth-cookie.service.js","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/auth/auth-cookie.service.ts"],"names":[],"mappings":";;;;AAAA,2CAA4C;AAE5C,+CAMuB;AAEvB,uCAAuC;AAGhC,IAAM,iBAAiB,GAAvB,MAAM,iBAAiB;IAC5B,gBAAgB,CACd,GAAa,EACb,MAAwG;QAExG,GAAG,CAAC,MAAM,CACR,uCAAyB,EACzB,MAAM,CAAC,YAAY,EACnB,IAAI,CAAC,oBAAoB,CAAC,MAAM,CAAC,eAAe,CAAC,CAClD,CAAC;QAEF,GAAG,CAAC,MAAM,CACR,sCAAwB,EACxB,MAAM,CAAC,WAAW,EAClB,IAAI,CAAC,mBAAmB,CAAC,MAAM,CAAC,cAAc,IAAI,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAClE,CAAC;IACJ,CAAC;IAED,gBAAgB,CAAC,GAAa;QAC5B,MAAM,IAAI,GAAG,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACtC,GAAG,CAAC,WAAW,CAAC,uCAAyB,EAAE;YACzC,GAAG,IAAI;YACP,IAAI,EAAE,IAAA,sCAAwB,GAAE;SACjC,CAAC,CAAC;QACH,GAAG,CAAC,WAAW,CAAC,sCAAwB,EAAE;YACxC,GAAG,IAAI;YACP,IAAI,EAAE,GAAG;SACV,CAAC,CAAC;IACL,CAAC;IAED,gBAAgB,CAAC,OAA4C;QAC3D,MAAM,KAAK,GAAG,OAAO,EAAE,CAAC,uCAAyB,CAAC,CAAC;QACnD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;YAC/C,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC;IACtB,CAAC;IAED,qBAAqB,CAAC,OAA4C;QAChE,MAAM,KAAK,GAAG,OAAO,EAAE,CAAC,sCAAwB,CAAC,CAAC;QAClD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;YAC/C,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC;IACtB,CAAC;IAEO,oBAAoB,CAAC,QAAiB;QAC5C,OAAO;YACL,GAAG,IAAI,CAAC,iBAAiB,EAAE;YAC3B,QAAQ,EAAE,IAAI;YACd,IAAI,EAAE,IAAA,sCAAwB,GAAE;YAChC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC1C,CAAC;IACJ,CAAC;IAEO,mBAAmB,CAAC,QAAgB;QAC1C,OAAO;YACL,GAAG,IAAI,CAAC,iBAAiB,EAAE;YAC3B,QAAQ,EAAE,IAAI;YACd,IAAI,EAAE,GAAG;YACT,MAAM,EAAE,QAAQ;SACjB,CAAC;IACJ,CAAC;IAEO,iBAAiB;QACvB,OAAO;YACL,MAAM,EAAE,IAAA,gCAAkB,GAAE;YAC5B,QAAQ,EAAE,IAAA,mCAAqB,GAAE;SAClC,CAAC;IACJ,CAAC;CACF,CAAA;AAtEY,8CAAiB;4BAAjB,iBAAiB;IAD7B,IAAA,mBAAU,GAAE;GACA,iBAAiB,CAsE7B;AAED,YAAY"}
+{"version":3,"file":"auth-cookie.service.js","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/auth/auth-cookie.service.ts"],"names":[],"mappings":";;;;AAAA,2CAA4C;AAE5C,+CAOuB;AACvB,mCAAqC;AAErC,uCAAuC;AAGhC,IAAM,iBAAiB,GAAvB,MAAM,iBAAiB;IAC5B,gBAAgB,CACd,GAAa,EACb,MAAwG;QAExG,GAAG,CAAC,MAAM,CACR,uCAAyB,EACzB,MAAM,CAAC,YAAY,EACnB,IAAI,CAAC,oBAAoB,CAAC,MAAM,CAAC,eAAe,CAAC,CAClD,CAAC;QAEF,GAAG,CAAC,MAAM,CACR,sCAAwB,EACxB,MAAM,CAAC,WAAW,EAClB,IAAI,CAAC,mBAAmB,CAAC,MAAM,CAAC,cAAc,IAAI,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAClE,CAAC;IACJ,CAAC;IAED,gBAAgB,CAAC,GAAa;QAC5B,MAAM,IAAI,GAAG,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACtC,GAAG,CAAC,WAAW,CAAC,uCAAyB,EAAE;YACzC,GAAG,IAAI;YACP,IAAI,EAAE,IAAA,sCAAwB,GAAE;SACjC,CAAC,CAAC;QACH,GAAG,CAAC,WAAW,CAAC,sCAAwB,EAAE;YACxC,GAAG,IAAI;YACP,IAAI,EAAE,GAAG;SACV,CAAC,CAAC;IACL,CAAC;IAED,gBAAgB,CAAC,OAA4C;QAC3D,MAAM,KAAK,GAAG,OAAO,EAAE,CAAC,uCAAyB,CAAC,CAAC;QACnD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;YAC/C,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC;IACtB,CAAC;IAED,qBAAqB,CAAC,OAA4C;QAChE,MAAM,KAAK,GAAG,OAAO,EAAE,CAAC,sCAAwB,CAAC,CAAC;QAClD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;YAC/C,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC;IACtB,CAAC;IAED,eAAe,CAAC,GAAa;QAC3B,MAAM,KAAK,GAAG,IAAA,oBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC9C,GAAG,CAAC,MAAM,CAAC,oCAAsB,EAAE,KAAK,EAAE;YACxC,GAAG,IAAI,CAAC,iBAAiB,EAAE;YAC3B,QAAQ,EAAE,KAAK;YACf,IAAI,EAAE,GAAG;YACT,MAAM,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI;SACvB,CAAC,CAAC;IACL,CAAC;IAED,aAAa,CAAC,OAA4C;QACxD,MAAM,KAAK,GAAG,OAAO,EAAE,CAAC,oCAAsB,CAAC,CAAC;QAChD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;YAC/C,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC;IACtB,CAAC;IAEO,oBAAoB,CAAC,QAAiB;QAC5C,OAAO;YACL,GAAG,IAAI,CAAC,iBAAiB,EAAE;YAC3B,QAAQ,EAAE,IAAI;YACd,IAAI,EAAE,IAAA,sCAAwB,GAAE;YAChC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC1C,CAAC;IACJ,CAAC;IAEO,mBAAmB,CAAC,QAAgB;QAC1C,OAAO;YACL,GAAG,IAAI,CAAC,iBAAiB,EAAE;YAC3B,QAAQ,EAAE,IAAI;YACd,IAAI,EAAE,GAAG;YACT,MAAM,EAAE,QAAQ;SACjB,CAAC;IACJ,CAAC;IAEO,iBAAiB;QACvB,OAAO;YACL,MAAM,EAAE,IAAA,gCAAkB,GAAE;YAC5B,QAAQ,EAAE,IAAA,mCAAqB,GAAE;SAClC,CAAC;IACJ,CAAC;CACF,CAAA;AAxFY,8CAAiB;4BAAjB,iBAAiB;IAD7B,IAAA,mBAAU,GAAE;GACA,iBAAiB,CAwF7B;AAED,YAAY"}

package/security/src/lib/auth/auth-csrf.middleware.d.ts

@@ -0,0 +1,14 @@
+import { NestMiddleware } from '@nestjs/common';
+import type { NextFunction, Request, Response } from 'express';
+type RequestWithBody = Request & {
+    body?: Record<string, unknown>;
+};
+/**
+ * CSRF for cookie-authenticated `/connect/token` and `/connect/revocation`.
+ * Writes RFC 6749-shaped JSON directly so middleware failures are not Nest `{ statusCode, message }`.
+ */
+export declare class AuthCsrfMiddleware implements NestMiddleware {
+    use(req: RequestWithBody, res: Response, next: NextFunction): void;
+}
+export {};
+//# sourceMappingURL=auth-csrf.middleware.d.ts.map

package/security/src/lib/auth/auth-csrf.middleware.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-csrf.middleware.d.ts","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/auth/auth-csrf.middleware.ts"],"names":[],"mappings":"AAAA,OAAO,EAAc,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAC5D,OAAO,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAK/D,KAAK,eAAe,GAAG,OAAO,GAAG;IAC/B,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAChC,CAAC;AAEF;;;GAGG;AACH,qBACa,kBAAmB,YAAW,cAAc;IACvD,GAAG,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,GAAG,IAAI;CAoDnE"}

package/security/src/lib/auth/auth-csrf.middleware.js

@@ -0,0 +1,60 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AuthCsrfMiddleware = void 0;
+const tslib_1 = require("tslib");
+const common_1 = require("@nestjs/common");
+const auth_config_1 = require("./auth.config");
+/**
+ * CSRF for cookie-authenticated `/connect/token` and `/connect/revocation`.
+ * Writes RFC 6749-shaped JSON directly so middleware failures are not Nest `{ statusCode, message }`.
+ */
+let AuthCsrfMiddleware = class AuthCsrfMiddleware {
+    use(req, res, next) {
+        if (req.method !== 'POST') {
+            next();
+            return;
+        }
+        const path = String(req.originalUrl ?? req.url ?? '').split('?')[0] ?? '';
+        const isConnectToken = path.endsWith('/connect/token');
+        const isConnectRevocation = path.endsWith('/connect/revocation');
+        if (!isConnectToken && !isConnectRevocation) {
+            next();
+            return;
+        }
+        const cookies = (req.cookies ?? {});
+        const hasAuthCookies = typeof cookies[auth_config_1.AUTH_COOKIE_ACCESS_TOKEN] === 'string' ||
+            typeof cookies[auth_config_1.AUTH_COOKIE_REFRESH_TOKEN] === 'string';
+        const body = req.body && typeof req.body === 'object' ? req.body : {};
+        const grantType = typeof body['grant_type'] === 'string' ? body['grant_type'].trim() : '';
+        // First-party authorization_code exchange (no session cookies yet) is exempt.
+        if (isConnectToken && grantType === 'authorization_code' && !hasAuthCookies) {
+            next();
+            return;
+        }
+        if (!hasAuthCookies && isConnectRevocation && !body['refresh_token'] && !body['token']) {
+            next();
+            return;
+        }
+        const cookieToken = typeof cookies[auth_config_1.AUTH_COOKIE_CSRF_TOKEN] === 'string' ? cookies[auth_config_1.AUTH_COOKIE_CSRF_TOKEN].trim() : '';
+        const headerTokenRaw = req.headers['x-csrf-token'];
+        const headerToken = Array.isArray(headerTokenRaw)
+            ? headerTokenRaw[0]?.trim()
+            : typeof headerTokenRaw === 'string'
+                ? headerTokenRaw.trim()
+                : '';
+        if (!cookieToken || !headerToken || cookieToken !== headerToken) {
+            res.status(403).json({
+                error: 'access_denied',
+                error_description: 'CSRF token is missing or invalid.',
+            });
+            return;
+        }
+        next();
+    }
+};
+exports.AuthCsrfMiddleware = AuthCsrfMiddleware;
+exports.AuthCsrfMiddleware = AuthCsrfMiddleware = tslib_1.__decorate([
+    (0, common_1.Injectable)()
+], AuthCsrfMiddleware);
+//#endregion
+//# sourceMappingURL=auth-csrf.middleware.js.map

package/security/src/lib/auth/auth-csrf.middleware.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-csrf.middleware.js","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/auth/auth-csrf.middleware.ts"],"names":[],"mappings":";;;;AAAA,2CAA4D;AAE5D,+CAA4G;AAQ5G;;;GAGG;AAEI,IAAM,kBAAkB,GAAxB,MAAM,kBAAkB;IAC7B,GAAG,CAAC,GAAoB,EAAE,GAAa,EAAE,IAAkB;QACzD,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC1B,IAAI,EAAE,CAAC;YACP,OAAO;QACT,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,WAAW,IAAI,GAAG,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC1E,MAAM,cAAc,GAAG,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC;QACvD,MAAM,mBAAmB,GAAG,IAAI,CAAC,QAAQ,CAAC,qBAAqB,CAAC,CAAC;QACjE,IAAI,CAAC,cAAc,IAAI,CAAC,mBAAmB,EAAE,CAAC;YAC5C,IAAI,EAAE,CAAC;YACP,OAAO;QACT,CAAC;QAED,MAAM,OAAO,GAAG,CAAC,GAAG,CAAC,OAAO,IAAI,EAAE,CAA4B,CAAC;QAC/D,MAAM,cAAc,GAClB,OAAO,OAAO,CAAC,sCAAwB,CAAC,KAAK,QAAQ;YACrD,OAAO,OAAO,CAAC,uCAAyB,CAAC,KAAK,QAAQ,CAAC;QAEzD,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,IAAI,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QACtE,MAAM,SAAS,GAAG,OAAO,IAAI,CAAC,YAAY,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAE1F,8EAA8E;QAC9E,IAAI,cAAc,IAAI,SAAS,KAAK,oBAAoB,IAAI,CAAC,cAAc,EAAE,CAAC;YAC5E,IAAI,EAAE,CAAC;YACP,OAAO;QACT,CAAC;QAED,IAAI,CAAC,cAAc,IAAI,mBAAmB,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YACvF,IAAI,EAAE,CAAC;YACP,OAAO;QACT,CAAC;QAED,MAAM,WAAW,GACf,OAAO,OAAO,CAAC,oCAAsB,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,oCAAsB,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpG,MAAM,cAAc,GAAG,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;QACnD,MAAM,WAAW,GAAG,KAAK,CAAC,OAAO,CAAC,cAAc,CAAC;YAC/C,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE;YAC3B,CAAC,CAAC,OAAO,cAAc,KAAK,QAAQ;gBAClC,CAAC,CAAC,cAAc,CAAC,IAAI,EAAE;gBACvB,CAAC,CAAC,EAAE,CAAC;QAET,IAAI,CAAC,WAAW,IAAI,CAAC,WAAW,IAAI,WAAW,KAAK,WAAW,EAAE,CAAC;YAChE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACnB,KAAK,EAAE,eAAe;gBACtB,iBAAiB,EAAE,mCAAmC;aACvD,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,IAAI,EAAE,CAAC;IACT,CAAC;CACF,CAAA;AArDY,gDAAkB;6BAAlB,kBAAkB;IAD9B,IAAA,mBAAU,GAAE;GACA,kBAAkB,CAqD9B;AAED,YAAY"}

package/security/src/lib/auth/auth-identity-provider.source.d.ts

@@ -43,6 +43,12 @@ export interface AuthIdentityProviderBrokerConfig {
     tokenUrl: string;
     /** Optional userinfo endpoint. */
     userInfoUrl?: string;
+    /**
+     * Expected ID Token `iss` (OIDC issuer).
+     * Prefer this over deriving issuer from `tokenUrl` — Google's token host
+     * (`oauth2.googleapis.com`) is not the ID Token issuer (`accounts.google.com`).
+     */
+    issuerUrl?: string;
     /** Scopes sent to the external IdP. */
     scopes: string;
 }
@@ -68,4 +74,9 @@ export declare const AUTH_IDENTITY_PROVIDER_CATALOG: unique symbol;
  * Provided by security-management from seed constants (not env in framework).
  */
 export declare const AUTH_OAUTH_ALLOWED_CLIENT_IDS: unique symbol;
+/**
+ * Registered OAuth/OIDC clients (redirect URIs, scopes, grant types).
+ * Provided by security-management from seed constants (not env in framework).
+ */
+export declare const AUTH_OAUTH_REGISTERED_CLIENTS: unique symbol;
 //# sourceMappingURL=auth-identity-provider.source.d.ts.map

package/security/src/lib/auth/auth-identity-provider.source.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-identity-provider.source.d.ts","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/auth/auth-identity-provider.source.ts"],"names":[],"mappings":"AAEA;;;GAGG;AACH,MAAM,WAAW,6BAA6B;IAC5C,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,wBAAwB;IACvC,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,UAAU,GAAG,KAAK,GAAG,QAAQ,CAAC;IACxC,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,qFAAqF;AACrF,MAAM,WAAW,4BAA4B;IAC3C,YAAY,EAAE,wBAAwB,EAAE,CAAC;IACzC,iBAAiB,EAAE,6BAA6B,EAAE,CAAC;CACpD;AAED,MAAM,WAAW,mCAAmC;IAClD,qDAAqD;IACrD,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,iFAAiF;AACjF,MAAM,WAAW,gCAAgC;IAC/C,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,OAAO,CAAC;IACjB,uCAAuC;IACvC,gBAAgB,EAAE,MAAM,CAAC;IACzB,mCAAmC;IACnC,QAAQ,EAAE,MAAM,CAAC;IACjB,kCAAkC;IAClC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,uCAAuC;IACvC,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;GAEG;AACH,MAAM,WAAW,2BAA2B;IAC1C,mBAAmB,IAAI,OAAO,CAAC,6BAA6B,EAAE,CAAC,CAAC;IAChE;;;OAGG;IACH,UAAU,CAAC,KAAK,EAAE,mCAAmC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACtE;;;OAGG;IACH,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,gCAAgC,GAAG,IAAI,CAAC,CAAC;CAChF;AAED,eAAO,MAAM,8BAA8B,eAA2C,CAAC;AAEvF;;;GAGG;AACH,eAAO,MAAM,6BAA6B,eAA0C,CAAC"}
+{"version":3,"file":"auth-identity-provider.source.d.ts","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/auth/auth-identity-provider.source.ts"],"names":[],"mappings":"AAEA;;;GAGG;AACH,MAAM,WAAW,6BAA6B;IAC5C,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,wBAAwB;IACvC,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,UAAU,GAAG,KAAK,GAAG,QAAQ,CAAC;IACxC,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,qFAAqF;AACrF,MAAM,WAAW,4BAA4B;IAC3C,YAAY,EAAE,wBAAwB,EAAE,CAAC;IACzC,iBAAiB,EAAE,6BAA6B,EAAE,CAAC;CACpD;AAED,MAAM,WAAW,mCAAmC;IAClD,qDAAqD;IACrD,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,iFAAiF;AACjF,MAAM,WAAW,gCAAgC;IAC/C,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,OAAO,CAAC;IACjB,uCAAuC;IACvC,gBAAgB,EAAE,MAAM,CAAC;IACzB,mCAAmC;IACnC,QAAQ,EAAE,MAAM,CAAC;IACjB,kCAAkC;IAClC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,uCAAuC;IACvC,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;GAEG;AACH,MAAM,WAAW,2BAA2B;IAC1C,mBAAmB,IAAI,OAAO,CAAC,6BAA6B,EAAE,CAAC,CAAC;IAChE;;;OAGG;IACH,UAAU,CAAC,KAAK,EAAE,mCAAmC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACtE;;;OAGG;IACH,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,gCAAgC,GAAG,IAAI,CAAC,CAAC;CAChF;AAED,eAAO,MAAM,8BAA8B,eAA2C,CAAC;AAEvF;;;GAGG;AACH,eAAO,MAAM,6BAA6B,eAA0C,CAAC;AAErF;;;GAGG;AACH,eAAO,MAAM,6BAA6B,eAA0C,CAAC"}

package/security/src/lib/auth/auth-identity-provider.source.js

@@ -1,12 +1,17 @@
 "use strict";
 //#region ---- Auth identity provider catalog (entity-backed) ----
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.AUTH_OAUTH_ALLOWED_CLIENT_IDS = exports.AUTH_IDENTITY_PROVIDER_CATALOG = void 0;
+exports.AUTH_OAUTH_REGISTERED_CLIENTS = exports.AUTH_OAUTH_ALLOWED_CLIENT_IDS = exports.AUTH_IDENTITY_PROVIDER_CATALOG = void 0;
 exports.AUTH_IDENTITY_PROVIDER_CATALOG = Symbol('AUTH_IDENTITY_PROVIDER_CATALOG');
 /**
  * Allowed SPA/machine client_ids for `/connect/*`.
  * Provided by security-management from seed constants (not env in framework).
  */
 exports.AUTH_OAUTH_ALLOWED_CLIENT_IDS = Symbol('AUTH_OAUTH_ALLOWED_CLIENT_IDS');
+/**
+ * Registered OAuth/OIDC clients (redirect URIs, scopes, grant types).
+ * Provided by security-management from seed constants (not env in framework).
+ */
+exports.AUTH_OAUTH_REGISTERED_CLIENTS = Symbol('AUTH_OAUTH_REGISTERED_CLIENTS');
 //#endregion
 //# sourceMappingURL=auth-identity-provider.source.js.map

package/security/src/lib/auth/auth-identity-provider.source.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth-identity-provider.source.js","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/auth/auth-identity-provider.source.ts"],"names":[],"mappings":";AAAA,kEAAkE;;;AAwErD,QAAA,8BAA8B,GAAG,MAAM,CAAC,gCAAgC,CAAC,CAAC;AAEvF;;;GAGG;AACU,QAAA,6BAA6B,GAAG,MAAM,CAAC,+BAA+B,CAAC,CAAC;AAErF,YAAY"}
+{"version":3,"file":"auth-identity-provider.source.js","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/auth/auth-identity-provider.source.ts"],"names":[],"mappings":";AAAA,kEAAkE;;;AA8ErD,QAAA,8BAA8B,GAAG,MAAM,CAAC,gCAAgC,CAAC,CAAC;AAEvF;;;GAGG;AACU,QAAA,6BAA6B,GAAG,MAAM,CAAC,+BAA+B,CAAC,CAAC;AAErF;;;GAGG;AACU,QAAA,6BAA6B,GAAG,MAAM,CAAC,+BAA+B,CAAC,CAAC;AAErF,YAAY"}

package/security/src/lib/auth/auth-local-credentials.service.d.ts

@@ -6,17 +6,25 @@ export declare class AuthLocalCredentialsService {
     constructor(entityStorage: EntityStorageMiddlewareService);
     validate(username: string, password: string): Promise<SecurityManagementUserRecord>;
     findUserByUsername(username: string): Promise<SecurityManagementUserRecord | null>;
+    /**
+     * OD-06 trusted email link: match by `email` field, then by username === email
+     * (legacy rows where username was the mailbox address).
+     */
+    findUserByVerifiedEmail(email: string): Promise<SecurityManagementUserRecord | null>;
     findUserById(userId: string): Promise<SecurityManagementUserRecord | null>;
     listUsers(): Promise<SecurityManagementUserRecord[]>;
     blockUserAccess(userId: string): Promise<void>;
     restoreUserAccess(userId: string): Promise<void>;
     findOrCreateExternalUser(input: {
         provider: string;
+        issuer: string;
         providerSubject: string;
         email?: string;
+        emailVerified?: boolean;
         displayName?: string;
         picture?: string;
     }): Promise<SecurityManagementUserRecord>;
+    private auditExternalIdentityLink;
     private invalidCredentialsBody;
 }
 //# sourceMappingURL=auth-local-credentials.service.d.ts.map

package/security/src/lib/auth/auth-local-credentials.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-local-credentials.service.d.ts","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/auth/auth-local-credentials.service.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,8BAA8B,EAAE,MAAM,wCAAwC,CAAC;AAKxF,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,cAAc,CAAC;AASjE,qBACa,2BAA2B;IAG1B,OAAO,CAAC,QAAQ,CAAC,aAAa;IAF1C,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAgD;gBAE1C,aAAa,EAAE,8BAA8B;IAEpE,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,4BAA4B,CAAC;IAkCnF,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,4BAA4B,GAAG,IAAI,CAAC;IAKlF,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,4BAA4B,GAAG,IAAI,CAAC;IAM1E,SAAS,IAAI,OAAO,CAAC,4BAA4B,EAAE,CAAC;IASpD,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAU9C,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAUhD,wBAAwB,CAAC,KAAK,EAAE;QACpC,QAAQ,EAAE,MAAM,CAAC;QACjB,eAAe,EAAE,MAAM,CAAC;QACxB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,OAAO,CAAC,EAAE,MAAM,CAAC;KAClB,GAAG,OAAO,CAAC,4BAA4B,CAAC;IAyCzC,OAAO,CAAC,sBAAsB;CAO/B"}
+{"version":3,"file":"auth-local-credentials.service.d.ts","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/auth/auth-local-credentials.service.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,8BAA8B,EAAE,MAAM,wCAAwC,CAAC;AAKxF,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,cAAc,CAAC;AASjE,qBACa,2BAA2B;IAG1B,OAAO,CAAC,QAAQ,CAAC,aAAa;IAF1C,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAgD;gBAE1C,aAAa,EAAE,8BAA8B;IAEpE,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,4BAA4B,CAAC;IAkCnF,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,4BAA4B,GAAG,IAAI,CAAC;IAQxF;;;OAGG;IACG,uBAAuB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,4BAA4B,GAAG,IAAI,CAAC;IAUpF,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,4BAA4B,GAAG,IAAI,CAAC;IAM1E,SAAS,IAAI,OAAO,CAAC,4BAA4B,EAAE,CAAC;IASpD,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAU9C,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAUhD,wBAAwB,CAAC,KAAK,EAAE;QACpC,QAAQ,EAAE,MAAM,CAAC;QACjB,MAAM,EAAE,MAAM,CAAC;QACf,eAAe,EAAE,MAAM,CAAC;QACxB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,aAAa,CAAC,EAAE,OAAO,CAAC;QACxB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,OAAO,CAAC,EAAE,MAAM,CAAC;KAClB,GAAG,OAAO,CAAC,4BAA4B,CAAC;IAsDzC,OAAO,CAAC,yBAAyB;IAkBjC,OAAO,CAAC,sBAAsB;CAO/B"}

package/security/src/lib/auth/auth-local-credentials.service.js

@@ -49,7 +49,19 @@ let AuthLocalCredentialsService = AuthLocalCredentialsService_1 = class AuthLoca
     }
     async findUserByUsername(username) {
         const users = await this.listUsers();
-        return users.find((u) => u.username === username) ?? null;
+        const normalized = username.trim().toLowerCase();
+        return (users.find((u) => (u.username ?? '').trim().toLowerCase() === normalized) ?? null);
+    }
+    /**
+     * OD-06 trusted email link: match by `email` field, then by username === email
+     * (legacy rows where username was the mailbox address).
+     */
+    async findUserByVerifiedEmail(email) {
+        const users = await this.listUsers();
+        const normalized = email.trim().toLowerCase();
+        return (users.find((u) => (u.email ?? '').trim().toLowerCase() === normalized) ??
+            users.find((u) => (u.username ?? '').trim().toLowerCase() === normalized) ??
+            null);
     }
     async findUserById(userId) {
         // Auth paths resolve global identities outside tenant membership filters.
@@ -83,37 +95,50 @@ let AuthLocalCredentialsService = AuthLocalCredentialsService_1 = class AuthLoca
     }
     async findOrCreateExternalUser(input) {
         const email = input.email?.trim().toLowerCase();
-        const candidates = new Set();
-        if (email) {
-            candidates.add(email);
-            const localPart = email.split('@')[0]?.trim();
-            if (localPart) {
-                candidates.add(localPart);
-            }
+        const externalUsername = `${input.issuer}:${input.providerSubject}`;
+        const byExternal = await this.findUserByUsername(externalUsername);
+        const byEmail = email && input.emailVerified === true ? await this.findUserByVerifiedEmail(email) : null;
+        if (byExternal && byEmail && byExternal.id !== byEmail.id) {
+            this.logger.warn(`External identity conflict for provider=${input.provider}: ` +
+                `issuer+subject user=${byExternal.id} email user=${byEmail.id}`);
+            throw new common_1.UnauthorizedException({
+                statusCode: 401,
+                message: 'External identity is already linked to a different account.',
+                error: 'ExternalIdentityConflict',
+            });
+        }
+        if (byExternal) {
+            this.auditExternalIdentityLink('resolve-by-issuer-subject', input, byExternal.id);
+            return byExternal;
         }
-        candidates.add(`${input.provider}:${input.providerSubject}`);
-        for (const username of candidates) {
-            const existing = await this.findUserByUsername(username);
-            if (existing) {
-                return existing;
-            }
+        if (byEmail) {
+            this.auditExternalIdentityLink('trusted-email-link', input, byEmail.id);
+            return byEmail;
         }
-        const username = email || `${input.provider}.${input.providerSubject.slice(0, 24)}`;
+        const username = email && input.emailVerified === true ? email : externalUsername;
         const displayName = input.displayName?.trim() || username;
         const id = (0, crypto_1.randomUUID)();
-        await this.entityStorage.insertOne(USER_ENTITY, {
+        await this.entityStorage.insertOneAsEngine(USER_ENTITY, {
             id,
             username,
             displayName,
             accountState: ACTIVE_ACCOUNT_STATE,
             accessState: ALLOWED_ACCESS_STATE,
+            email: email && input.emailVerified === true ? email : undefined,
+            avatar: input.picture ?? null,
         });
         const created = await this.findUserById(id);
         if (!created) {
             throw new common_1.UnauthorizedException('Failed to create external user account.');
         }
+        this.auditExternalIdentityLink('create', input, created.id);
         return created;
     }
+    auditExternalIdentityLink(action, input, userId) {
+        this.logger.log(`External identity ${action}: provider=${input.provider} issuer=${input.issuer} ` +
+            `sub=${input.providerSubject} userId=${userId} ` +
+            `emailVerified=${input.emailVerified === true}`);
+    }
     invalidCredentialsBody() {
         return {
             statusCode: 401,

package/security/src/lib/auth/auth-local-credentials.service.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth-local-credentials.service.js","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/auth/auth-local-credentials.service.ts"],"names":[],"mappings":";;;;;AAAA,2CAIwB;AACxB,iEAAwF;AACxF,6EAAkG;AAClG,iEAAwE;AACxE,yCAAuC;AACvC,mCAAoC;AAGpC,qCAAqC;AAErC,MAAM,WAAW,GAAG,yBAAyB,CAAC;AAC9C,MAAM,oBAAoB,GAAG,QAAQ,CAAC;AACtC,MAAM,oBAAoB,GAAG,SAAS,CAAC;AACvC,MAAM,oBAAoB,GAAG,SAAS,CAAC;AAGhC,IAAM,2BAA2B,mCAAjC,MAAM,2BAA2B;IAGtC,YAA6B,aAA6C;QAA7C,kBAAa,GAAb,aAAa,CAAgC;QAFzD,WAAM,GAAG,IAAI,eAAM,CAAC,6BAA2B,CAAC,IAAI,CAAC,CAAC;IAEM,CAAC;IAE9E,KAAK,CAAC,QAAQ,CAAC,QAAgB,EAAE,QAAgB;QAC/C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC;QACrD,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,8BAAqB,CAAC,IAAI,CAAC,sBAAsB,EAAE,CAAC,CAAC;QACjE,CAAC;QAED,IAAI,IAAI,CAAC,WAAW,KAAK,oBAAoB,EAAE,CAAC;YAC9C,MAAM,IAAI,8BAAqB,CAAC;gBAC9B,UAAU,EAAE,GAAG;gBACf,OAAO,EAAE,sCAAsC;gBAC/C,KAAK,EAAE,gBAAgB;aACxB,CAAC,CAAC;QACL,CAAC;QAED,IAAI,IAAI,CAAC,YAAY,KAAK,oBAAoB,EAAE,CAAC;YAC/C,MAAM,IAAI,8BAAqB,CAAC,IAAI,CAAC,sBAAsB,EAAE,CAAC,CAAC;QACjE,CAAC;QAED,IAAI,CAAC,IAAA,iBAAK,EAAC,IAAI,CAAC,WAAW,CAAC,IAAI,IAAI,CAAC,WAAW,KAAK,oBAAoB,EAAE,CAAC;YAC1E,MAAM,IAAI,8BAAqB,CAAC;gBAC9B,UAAU,EAAE,GAAG;gBACf,OAAO,EAAE,0CAA0C;gBACnD,KAAK,EAAE,mBAAmB;aAC3B,CAAC,CAAC;QACL,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,IAAA,qBAAc,EAAC,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC5D,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,8BAAqB,CAAC,IAAI,CAAC,sBAAsB,EAAE,CAAC,CAAC;QACjE,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,CAAC,kBAAkB,CAAC,QAAgB;QACvC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;QACrC,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,IAAI,IAAI,CAAC;IAC5D,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,MAAc;QAC/B,0EAA0E;QAC1E,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,cAAc,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;QAC5E,OAAQ,MAAuC,IAAI,IAAI,CAAC;IAC1D,CAAC;IAED,KAAK,CAAC,SAAS;QACb,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,KAAK,CAC3C,WAAW,EACX,IAAA,2CAAgC,EAAC,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAC1D,CAAC;QACF,MAAM,KAAK,GAAG,IAAA,eAAG,EAAC,MAAM,EAAE,OAAO,EAAE,EAAE,CAAmC,CAAC;QACzE,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3C,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,MAAc;QAClC,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,WAAW,EAAE,MAAM,EAAE;gBACtD,WAAW,EAAE,oBAAoB;aAClC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,wBAAwB,MAAM,KAAK,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACvE,CAAC;IACH,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,MAAc;QACpC,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,WAAW,EAAE,MAAM,EAAE;gBACtD,WAAW,EAAE,oBAAoB;aAClC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,iCAAiC,MAAM,KAAK,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAChF,CAAC;IACH,CAAC;IAED,KAAK,CAAC,wBAAwB,CAAC,KAM9B;QACC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAChD,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;QAErC,IAAI,KAAK,EAAE,CAAC;YACV,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YACtB,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;YAC9C,IAAI,SAAS,EAAE,CAAC;gBACd,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YAC5B,CAAC;QACH,CAAC;QAED,UAAU,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,eAAe,EAAE,CAAC,CAAC;QAE7D,KAAK,MAAM,QAAQ,IAAI,UAAU,EAAE,CAAC;YAClC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC;YACzD,IAAI,QAAQ,EAAE,CAAC;gBACb,OAAO,QAAQ,CAAC;YAClB,CAAC;QACH,CAAC;QAED,MAAM,QAAQ,GAAG,KAAK,IAAI,GAAG,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;QACpF,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,EAAE,IAAI,EAAE,IAAI,QAAQ,CAAC;QAC1D,MAAM,EAAE,GAAG,IAAA,mBAAU,GAAE,CAAC;QAExB,MAAM,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,WAAW,EAAE;YAC9C,EAAE;YACF,QAAQ;YACR,WAAW;YACX,YAAY,EAAE,oBAAoB;YAClC,WAAW,EAAE,oBAAoB;SAClC,CAAC,CAAC;QAEH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;QAC5C,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,8BAAqB,CAAC,yCAAyC,CAAC,CAAC;QAC7E,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;IAEO,sBAAsB;QAC5B,OAAO;YACL,UAAU,EAAE,GAAG;YACf,OAAO,EAAE,8BAA8B;YACvC,KAAK,EAAE,oBAAoB;SAC5B,CAAC;IACJ,CAAC;CACF,CAAA;AArIY,kEAA2B;sCAA3B,2BAA2B;IADvC,IAAA,mBAAU,GAAE;6CAIiC,qCAA8B;GAH/D,2BAA2B,CAqIvC;AAED,YAAY"}
+{"version":3,"file":"auth-local-credentials.service.js","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/auth/auth-local-credentials.service.ts"],"names":[],"mappings":";;;;;AAAA,2CAIwB;AACxB,iEAAwF;AACxF,6EAAkG;AAClG,iEAAwE;AACxE,yCAAuC;AACvC,mCAAoC;AAGpC,qCAAqC;AAErC,MAAM,WAAW,GAAG,yBAAyB,CAAC;AAC9C,MAAM,oBAAoB,GAAG,QAAQ,CAAC;AACtC,MAAM,oBAAoB,GAAG,SAAS,CAAC;AACvC,MAAM,oBAAoB,GAAG,SAAS,CAAC;AAGhC,IAAM,2BAA2B,mCAAjC,MAAM,2BAA2B;IAGtC,YAA6B,aAA6C;QAA7C,kBAAa,GAAb,aAAa,CAAgC;QAFzD,WAAM,GAAG,IAAI,eAAM,CAAC,6BAA2B,CAAC,IAAI,CAAC,CAAC;IAEM,CAAC;IAE9E,KAAK,CAAC,QAAQ,CAAC,QAAgB,EAAE,QAAgB;QAC/C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC;QACrD,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,8BAAqB,CAAC,IAAI,CAAC,sBAAsB,EAAE,CAAC,CAAC;QACjE,CAAC;QAED,IAAI,IAAI,CAAC,WAAW,KAAK,oBAAoB,EAAE,CAAC;YAC9C,MAAM,IAAI,8BAAqB,CAAC;gBAC9B,UAAU,EAAE,GAAG;gBACf,OAAO,EAAE,sCAAsC;gBAC/C,KAAK,EAAE,gBAAgB;aACxB,CAAC,CAAC;QACL,CAAC;QAED,IAAI,IAAI,CAAC,YAAY,KAAK,oBAAoB,EAAE,CAAC;YAC/C,MAAM,IAAI,8BAAqB,CAAC,IAAI,CAAC,sBAAsB,EAAE,CAAC,CAAC;QACjE,CAAC;QAED,IAAI,CAAC,IAAA,iBAAK,EAAC,IAAI,CAAC,WAAW,CAAC,IAAI,IAAI,CAAC,WAAW,KAAK,oBAAoB,EAAE,CAAC;YAC1E,MAAM,IAAI,8BAAqB,CAAC;gBAC9B,UAAU,EAAE,GAAG;gBACf,OAAO,EAAE,0CAA0C;gBACnD,KAAK,EAAE,mBAAmB;aAC3B,CAAC,CAAC;QACL,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,IAAA,qBAAc,EAAC,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC5D,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,8BAAqB,CAAC,IAAI,CAAC,sBAAsB,EAAE,CAAC,CAAC;QACjE,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,CAAC,kBAAkB,CAAC,QAAgB;QACvC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;QACrC,MAAM,UAAU,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACjD,OAAO,CACL,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,UAAU,CAAC,IAAI,IAAI,CAClF,CAAC;IACJ,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,uBAAuB,CAAC,KAAa;QACzC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;QACrC,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAC9C,OAAO,CACL,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,UAAU,CAAC;YACtE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,UAAU,CAAC;YACzE,IAAI,CACL,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,MAAc;QAC/B,0EAA0E;QAC1E,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,cAAc,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;QAC5E,OAAQ,MAAuC,IAAI,IAAI,CAAC;IAC1D,CAAC;IAED,KAAK,CAAC,SAAS;QACb,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,KAAK,CAC3C,WAAW,EACX,IAAA,2CAAgC,EAAC,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAC1D,CAAC;QACF,MAAM,KAAK,GAAG,IAAA,eAAG,EAAC,MAAM,EAAE,OAAO,EAAE,EAAE,CAAmC,CAAC;QACzE,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3C,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,MAAc;QAClC,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,WAAW,EAAE,MAAM,EAAE;gBACtD,WAAW,EAAE,oBAAoB;aAClC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,wBAAwB,MAAM,KAAK,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACvE,CAAC;IACH,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,MAAc;QACpC,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,WAAW,EAAE,MAAM,EAAE;gBACtD,WAAW,EAAE,oBAAoB;aAClC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,iCAAiC,MAAM,KAAK,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAChF,CAAC;IACH,CAAC;IAED,KAAK,CAAC,wBAAwB,CAAC,KAQ9B;QACC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAChD,MAAM,gBAAgB,GAAG,GAAG,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,eAAe,EAAE,CAAC;QAEpE,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,CAAC;QACnE,MAAM,OAAO,GACX,KAAK,IAAI,KAAK,CAAC,aAAa,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,uBAAuB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAE3F,IAAI,UAAU,IAAI,OAAO,IAAI,UAAU,CAAC,EAAE,KAAK,OAAO,CAAC,EAAE,EAAE,CAAC;YAC1D,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,2CAA2C,KAAK,CAAC,QAAQ,IAAI;gBAC3D,uBAAuB,UAAU,CAAC,EAAE,eAAe,OAAO,CAAC,EAAE,EAAE,CAClE,CAAC;YACF,MAAM,IAAI,8BAAqB,CAAC;gBAC9B,UAAU,EAAE,GAAG;gBACf,OAAO,EAAE,6DAA6D;gBACtE,KAAK,EAAE,0BAA0B;aAClC,CAAC,CAAC;QACL,CAAC;QAED,IAAI,UAAU,EAAE,CAAC;YACf,IAAI,CAAC,yBAAyB,CAAC,2BAA2B,EAAE,KAAK,EAAE,UAAU,CAAC,EAAE,CAAC,CAAC;YAClF,OAAO,UAAU,CAAC;QACpB,CAAC;QAED,IAAI,OAAO,EAAE,CAAC;YACZ,IAAI,CAAC,yBAAyB,CAAC,oBAAoB,EAAE,KAAK,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;YACxE,OAAO,OAAO,CAAC;QACjB,CAAC;QAED,MAAM,QAAQ,GACZ,KAAK,IAAI,KAAK,CAAC,aAAa,KAAK,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,gBAAgB,CAAC;QACnE,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,EAAE,IAAI,EAAE,IAAI,QAAQ,CAAC;QAC1D,MAAM,EAAE,GAAG,IAAA,mBAAU,GAAE,CAAC;QAExB,MAAM,IAAI,CAAC,aAAa,CAAC,iBAAiB,CAAC,WAAW,EAAE;YACtD,EAAE;YACF,QAAQ;YACR,WAAW;YACX,YAAY,EAAE,oBAAoB;YAClC,WAAW,EAAE,oBAAoB;YACjC,KAAK,EAAE,KAAK,IAAI,KAAK,CAAC,aAAa,KAAK,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;YAChE,MAAM,EAAE,KAAK,CAAC,OAAO,IAAI,IAAI;SAC9B,CAAC,CAAC;QAEH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;QAC5C,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,8BAAqB,CAAC,yCAAyC,CAAC,CAAC;QAC7E,CAAC;QAED,IAAI,CAAC,yBAAyB,CAAC,QAAQ,EAAE,KAAK,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;QAC5D,OAAO,OAAO,CAAC;IACjB,CAAC;IAEO,yBAAyB,CAC/B,MAAqE,EACrE,KAMC,EACD,MAAc;QAEd,IAAI,CAAC,MAAM,CAAC,GAAG,CACb,qBAAqB,MAAM,cAAc,KAAK,CAAC,QAAQ,WAAW,KAAK,CAAC,MAAM,GAAG;YAC/E,OAAO,KAAK,CAAC,eAAe,WAAW,MAAM,GAAG;YAChD,iBAAiB,KAAK,CAAC,aAAa,KAAK,IAAI,EAAE,CAClD,CAAC;IACJ,CAAC;IAEO,sBAAsB;QAC5B,OAAO;YACL,UAAU,EAAE,GAAG;YACf,OAAO,EAAE,8BAA8B;YACvC,KAAK,EAAE,oBAAoB;SAC5B,CAAC;IACJ,CAAC;CACF,CAAA;AAvLY,kEAA2B;sCAA3B,2BAA2B;IADvC,IAAA,mBAAU,GAAE;6CAIiC,qCAA8B;GAH/D,2BAA2B,CAuLvC;AAED,YAAY"}

package/security/src/lib/auth/auth-max-device-sessions-policy.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Tenant max concurrent device sessions. Defaults to 0 (unlimited) until a module
+ * registers {@link configureAuthMaxDeviceSessionsPolicyResolver} (tenant settings).
+ *
+ * Uses globalThis so Nest/webpack duplicate module instances share one resolver.
+ */
+export declare const AUTH_MAX_ACTIVE_DEVICE_SESSIONS_DEFAULT = 0;
+type AuthMaxDeviceSessionsPolicyResolver = (tenantId: string) => Promise<number>;
+/** Registers the resolver that reads tenant max-active-device-sessions settings. */
+export declare function configureAuthMaxDeviceSessionsPolicyResolver(resolver: AuthMaxDeviceSessionsPolicyResolver): void;
+/** Resolves the max active device sessions for a tenant. `0` = unlimited. */
+export declare function resolveAuthMaxDeviceSessions(tenantId: string): Promise<number>;
+export {};
+//# sourceMappingURL=auth-max-device-sessions-policy.d.ts.map

package/security/src/lib/auth/auth-max-device-sessions-policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-max-device-sessions-policy.d.ts","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/auth/auth-max-device-sessions-policy.ts"],"names":[],"mappings":"AAEA;;;;;GAKG;AAEH,eAAO,MAAM,uCAAuC,IAAI,CAAC;AAEzD,KAAK,mCAAmC,GAAG,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;AAuBjF,oFAAoF;AACpF,wBAAgB,4CAA4C,CAC1D,QAAQ,EAAE,mCAAmC,GAC5C,IAAI,CAEN;AAED,6EAA6E;AAC7E,wBAAsB,4BAA4B,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAgBpF"}

package/security/src/lib/auth/auth-max-device-sessions-policy.js

@@ -0,0 +1,48 @@
+"use strict";
+//#region ----- Auth max active device sessions policy (leaf) -----
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AUTH_MAX_ACTIVE_DEVICE_SESSIONS_DEFAULT = void 0;
+exports.configureAuthMaxDeviceSessionsPolicyResolver = configureAuthMaxDeviceSessionsPolicyResolver;
+exports.resolveAuthMaxDeviceSessions = resolveAuthMaxDeviceSessions;
+/**
+ * Tenant max concurrent device sessions. Defaults to 0 (unlimited) until a module
+ * registers {@link configureAuthMaxDeviceSessionsPolicyResolver} (tenant settings).
+ *
+ * Uses globalThis so Nest/webpack duplicate module instances share one resolver.
+ */
+exports.AUTH_MAX_ACTIVE_DEVICE_SESSIONS_DEFAULT = 0;
+const GLOBAL_KEY = '__AXP_AUTH_MAX_DEVICE_SESSIONS_POLICY__';
+function authMaxDeviceSessionsState() {
+    const g = globalThis;
+    if (!g[GLOBAL_KEY]) {
+        g[GLOBAL_KEY] = { resolver: null };
+    }
+    return g[GLOBAL_KEY];
+}
+function coerceNonNegativeInt(value, fallback) {
+    const parsed = typeof value === 'number' ? value : Number(value);
+    return Number.isFinite(parsed) && parsed >= 0 ? Math.floor(parsed) : fallback;
+}
+/** Registers the resolver that reads tenant max-active-device-sessions settings. */
+function configureAuthMaxDeviceSessionsPolicyResolver(resolver) {
+    authMaxDeviceSessionsState().resolver = resolver;
+}
+/** Resolves the max active device sessions for a tenant. `0` = unlimited. */
+async function resolveAuthMaxDeviceSessions(tenantId) {
+    const tid = tenantId?.trim();
+    if (!tid) {
+        return exports.AUTH_MAX_ACTIVE_DEVICE_SESSIONS_DEFAULT;
+    }
+    const resolver = authMaxDeviceSessionsState().resolver;
+    if (!resolver) {
+        return exports.AUTH_MAX_ACTIVE_DEVICE_SESSIONS_DEFAULT;
+    }
+    try {
+        return coerceNonNegativeInt(await resolver(tid), exports.AUTH_MAX_ACTIVE_DEVICE_SESSIONS_DEFAULT);
+    }
+    catch {
+        return exports.AUTH_MAX_ACTIVE_DEVICE_SESSIONS_DEFAULT;
+    }
+}
+//#endregion
+//# sourceMappingURL=auth-max-device-sessions-policy.js.map

package/security/src/lib/auth/auth-max-device-sessions-policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-max-device-sessions-policy.js","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/auth/auth-max-device-sessions-policy.ts"],"names":[],"mappings":";AAAA,mEAAmE;;;AAmCnE,oGAIC;AAGD,oEAgBC;AAxDD;;;;;GAKG;AAEU,QAAA,uCAAuC,GAAG,CAAC,CAAC;AAQzD,MAAM,UAAU,GAAG,yCAAyC,CAAC;AAE7D,SAAS,0BAA0B;IACjC,MAAM,CAAC,GAAG,UAET,CAAC;IACF,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,EAAE,CAAC;QACnB,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IACrC,CAAC;IACD,OAAO,CAAC,CAAC,UAAU,CAAE,CAAC;AACxB,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAc,EAAE,QAAgB;IAC5D,MAAM,MAAM,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACjE,OAAO,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;AAChF,CAAC;AAED,oFAAoF;AACpF,SAAgB,4CAA4C,CAC1D,QAA6C;IAE7C,0BAA0B,EAAE,CAAC,QAAQ,GAAG,QAAQ,CAAC;AACnD,CAAC;AAED,6EAA6E;AACtE,KAAK,UAAU,4BAA4B,CAAC,QAAgB;IACjE,MAAM,GAAG,GAAG,QAAQ,EAAE,IAAI,EAAE,CAAC;IAC7B,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,OAAO,+CAAuC,CAAC;IACjD,CAAC;IAED,MAAM,QAAQ,GAAG,0BAA0B,EAAE,CAAC,QAAQ,CAAC;IACvD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,+CAAuC,CAAC;IACjD,CAAC;IAED,IAAI,CAAC;QACH,OAAO,oBAAoB,CAAC,MAAM,QAAQ,CAAC,GAAG,CAAC,EAAE,+CAAuC,CAAC,CAAC;IAC5F,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,+CAAuC,CAAC;IACjD,CAAC;AACH,CAAC;AAED,YAAY"}

package/security/src/lib/auth/auth-runtime.handlers.d.ts

@@ -3,7 +3,7 @@ import { type AXPServerQueryHandler } from '@acorex-platform/framework-server/do
 import { ModuleRef } from '@nestjs/core';
 import { AuthCookieService } from './auth-cookie.service';
 import { AuthService } from './auth.service';
-import type { AuthTokenResponseDto, RefreshTokenRequestDto, RegisterRequestDto, SignInRequestDto, UpdateSessionRequestDto } from './auth.types';
+import type { AuthListOwnDeviceSessionsRequestDto, AuthOwnDeviceSessionDto, AuthTerminateOwnDeviceSessionRequestDto, AuthTokenResponseDto, RefreshTokenRequestDto, RegisterRequestDto, SignInRequestDto, UpdateSessionRequestDto } from './auth.types';
 import { LoginAttemptService } from './login-attempt.service';
 import { TokenResolverService } from './token-resolver.service';
 import { TokenService } from './token.service';
@@ -47,7 +47,13 @@ export declare class AuthUpdateSessionRuntimeCommand implements AXPCommand<Updat
     constructor(auth: AuthService, tokenResolver: TokenResolverService, cookies: AuthCookieService, tokens: TokenService);
     execute(input: UpdateSessionRequestDto): AXPCommandExecuteResultPromise<AuthTokenResponseDto>;
 }
-export declare const AUTH_RUNTIME_COMMANDS: (typeof AuthSignInRuntimeCommand | typeof AuthRegisterRuntimeCommand | typeof AuthRefreshRuntimeCommand | typeof AuthLogoutRuntimeCommand | typeof AuthUpdateSessionRuntimeCommand)[];
+export declare class AuthTerminateOwnDeviceSessionRuntimeCommand implements AXPCommand<AuthTerminateOwnDeviceSessionRequestDto, void> {
+    private readonly auth;
+    private readonly tokenResolver;
+    constructor(auth: AuthService, tokenResolver: TokenResolverService);
+    execute(input: AuthTerminateOwnDeviceSessionRequestDto): AXPCommandExecuteResultPromise<void>;
+}
+export declare const AUTH_RUNTIME_COMMANDS: (typeof AuthSignInRuntimeCommand | typeof AuthRegisterRuntimeCommand | typeof AuthRefreshRuntimeCommand | typeof AuthLogoutRuntimeCommand | typeof AuthUpdateSessionRuntimeCommand | typeof AuthTerminateOwnDeviceSessionRuntimeCommand)[];
 export declare class AuthListProvidersRuntimeQuery implements AXPServerQueryHandler<void, AuthListProvidersResponseDto> {
     private readonly moduleRef;
     constructor(moduleRef: ModuleRef);
@@ -66,11 +72,17 @@ export declare class AuthListApplicationsRuntimeQuery implements AXPServerQueryH
     constructor(sessionContext: SessionContextService, backendSession: BackendSessionService);
     execute(): AXPQueryFetchResultPromise<SessionApplicationItemDto>;
 }
+export declare class AuthListOwnDeviceSessionsRuntimeQuery implements AXPServerQueryHandler<AuthListOwnDeviceSessionsRequestDto, AuthOwnDeviceSessionDto> {
+    private readonly auth;
+    private readonly tokenResolver;
+    constructor(auth: AuthService, tokenResolver: TokenResolverService);
+    execute(input: AuthListOwnDeviceSessionsRequestDto): AXPQueryFetchResultPromise<AuthOwnDeviceSessionDto>;
+}
 export declare class AuthGetAccessPolicyRuntimeQuery implements AXPServerQueryHandler<void, SessionAccessPolicyDto> {
     private readonly sessionContext;
     private readonly backendSession;
     constructor(sessionContext: SessionContextService, backendSession: BackendSessionService);
     execute(): AXPQueryFetchResultPromise<SessionAccessPolicyDto>;
 }
-export declare const AUTH_RUNTIME_QUERIES: (typeof AuthListProvidersRuntimeQuery | typeof AuthListTenantsRuntimeQuery | typeof AuthListApplicationsRuntimeQuery | typeof AuthGetAccessPolicyRuntimeQuery)[];
+export declare const AUTH_RUNTIME_QUERIES: (typeof AuthListProvidersRuntimeQuery | typeof AuthListTenantsRuntimeQuery | typeof AuthListApplicationsRuntimeQuery | typeof AuthListOwnDeviceSessionsRuntimeQuery | typeof AuthGetAccessPolicyRuntimeQuery)[];
 //# sourceMappingURL=auth-runtime.handlers.d.ts.map

package/security/src/lib/auth/auth-runtime.handlers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-runtime.handlers.d.ts","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/auth/auth-runtime.handlers.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,UAAU,EAAE,0BAA0B,EAAE,8BAA8B,EAAE,MAAM,2CAA2C,CAAC;AAYxI,OAAO,EAAqC,KAAK,qBAAqB,EAAE,MAAM,mDAAmD,CAAC;AAElI,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAOzC,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC1D,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC7C,OAAO,KAAK,EACV,oBAAoB,EACpB,sBAAsB,EACtB,kBAAkB,EAClB,gBAAgB,EAChB,uBAAuB,EACxB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAE9D,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAChE,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EAAE,qBAAqB,EAAE,MAAM,oCAAoC,CAAC;AAC3E,OAAO,EAAE,qBAAqB,EAAE,MAAM,oCAAoC,CAAC;AAC3E,OAAO,EAGL,KAAK,4BAA4B,EAElC,MAAM,iCAAiC,CAAC;AACzC,OAAO,KAAK,EACV,sBAAsB,EACtB,yBAAyB,EACzB,oBAAoB,EACrB,MAAM,kCAAkC,CAAC;AAI1C,qBAEa,wBAAyB,YAAW,UAAU,CAAC,gBAAgB,EAAE,oBAAoB,CAAC;IAE/F,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,aAAa;IAC9B,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAHN,IAAI,EAAE,WAAW,EACjB,aAAa,EAAE,mBAAmB,EAClC,OAAO,EAAE,iBAAiB,EAC1B,MAAM,EAAE,YAAY;IAGjC,OAAO,CAAC,KAAK,EAAE,gBAAgB,GAAG,8BAA8B,CAAC,oBAAoB,CAAC;CAmB7F;AAED,qBAEa,0BAA2B,YAAW,UAAU,CAAC,kBAAkB,EAAE,oBAAoB,CAAC;IAEnG,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAFN,IAAI,EAAE,WAAW,EACjB,OAAO,EAAE,iBAAiB,EAC1B,MAAM,EAAE,YAAY;IAGjC,OAAO,CAAC,KAAK,EAAE,kBAAkB,GAAG,8BAA8B,CAAC,oBAAoB,CAAC;CAQ/F;AAED,qBAEa,yBACX,YAAW,UAAU,CAAC,sBAAsB,EAAE,oBAAoB,CAAC;IAGjE,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAFN,IAAI,EAAE,WAAW,EACjB,OAAO,EAAE,iBAAiB,EAC1B,MAAM,EAAE,YAAY;IAGjC,OAAO,CAAC,KAAK,EAAE,sBAAsB,GAAG,8BAA8B,CAAC,oBAAoB,CAAC;CAiBnG;AAED,qBAEa,wBAAyB,YAAW,UAAU,CAAC,sBAAsB,EAAE,IAAI,CAAC;IAErF,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,OAAO;gBADP,IAAI,EAAE,WAAW,EACjB,OAAO,EAAE,iBAAiB;IAGvC,OAAO,CAAC,KAAK,EAAE,sBAAsB,GAAG,8BAA8B,CAAC,IAAI,CAAC;CAYnF;AAED,qBAEa,+BACX,YAAW,UAAU,CAAC,uBAAuB,EAAE,oBAAoB,CAAC;IAGlE,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,aAAa;IAC9B,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAHN,IAAI,EAAE,WAAW,EACjB,aAAa,EAAE,oBAAoB,EACnC,OAAO,EAAE,iBAAiB,EAC1B,MAAM,EAAE,YAAY;IAGjC,OAAO,CAAC,KAAK,EAAE,uBAAuB,GAAG,8BAA8B,CAAC,oBAAoB,CAAC;CAiBpG;AAED,eAAO,MAAM,qBAAqB,uLAMjC,CAAC;AAMF,qBAEa,6BAA8B,YAAW,qBAAqB,CAAC,IAAI,EAAE,4BAA4B,CAAC;IACjG,OAAO,CAAC,QAAQ,CAAC,SAAS;gBAAT,SAAS,EAAE,SAAS;IAE3C,OAAO,IAAI,0BAA0B,CAAC,4BAA4B,CAAC;IAgBzE,OAAO,CAAC,8BAA8B;CASvC;AAED,qBAEa,2BACX,YAAW,qBAAqB,CAAC,IAAI,EAAE,oBAAoB,CAAC;IAG1D,OAAO,CAAC,QAAQ,CAAC,cAAc;IAC/B,OAAO,CAAC,QAAQ,CAAC,cAAc;gBADd,cAAc,EAAE,qBAAqB,EACrC,cAAc,EAAE,qBAAqB;IAGlD,OAAO,IAAI,0BAA0B,CAAC,oBAAoB,CAAC;CAKlE;AAED,qBAEa,gCACX,YAAW,qBAAqB,CAAC,IAAI,EAAE,yBAAyB,CAAC;IAG/D,OAAO,CAAC,QAAQ,CAAC,cAAc;IAC/B,OAAO,CAAC,QAAQ,CAAC,cAAc;gBADd,cAAc,EAAE,qBAAqB,EACrC,cAAc,EAAE,qBAAqB;IAGlD,OAAO,IAAI,0BAA0B,CAAC,yBAAyB,CAAC;CAQvE;AAED,qBAEa,+BAAgC,YAAW,qBAAqB,CAAC,IAAI,EAAE,sBAAsB,CAAC;IAEvG,OAAO,CAAC,QAAQ,CAAC,cAAc;IAC/B,OAAO,CAAC,QAAQ,CAAC,cAAc;gBADd,cAAc,EAAE,qBAAqB,EACrC,cAAc,EAAE,qBAAqB;IAGlD,OAAO,IAAI,0BAA0B,CAAC,sBAAsB,CAAC;CASpE;AAED,eAAO,MAAM,oBAAoB,kKAKhC,CAAC"}
+{"version":3,"file":"auth-runtime.handlers.d.ts","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/auth/auth-runtime.handlers.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,UAAU,EAAE,0BAA0B,EAAE,8BAA8B,EAAE,MAAM,2CAA2C,CAAC;AAcxI,OAAO,EAAqC,KAAK,qBAAqB,EAAE,MAAM,mDAAmD,CAAC;AAElI,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAOzC,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC1D,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC7C,OAAO,KAAK,EACV,mCAAmC,EACnC,uBAAuB,EACvB,uCAAuC,EACvC,oBAAoB,EACpB,sBAAsB,EACtB,kBAAkB,EAClB,gBAAgB,EAChB,uBAAuB,EACxB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAE9D,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAChE,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EAAE,qBAAqB,EAAE,MAAM,oCAAoC,CAAC;AAC3E,OAAO,EAAE,qBAAqB,EAAE,MAAM,oCAAoC,CAAC;AAC3E,OAAO,EAGL,KAAK,4BAA4B,EAElC,MAAM,iCAAiC,CAAC;AACzC,OAAO,KAAK,EACV,sBAAsB,EACtB,yBAAyB,EACzB,oBAAoB,EACrB,MAAM,kCAAkC,CAAC;AAI1C,qBAEa,wBAAyB,YAAW,UAAU,CAAC,gBAAgB,EAAE,oBAAoB,CAAC;IAE/F,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,aAAa;IAC9B,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAHN,IAAI,EAAE,WAAW,EACjB,aAAa,EAAE,mBAAmB,EAClC,OAAO,EAAE,iBAAiB,EAC1B,MAAM,EAAE,YAAY;IAGjC,OAAO,CAAC,KAAK,EAAE,gBAAgB,GAAG,8BAA8B,CAAC,oBAAoB,CAAC;CAsB7F;AAED,qBAEa,0BAA2B,YAAW,UAAU,CAAC,kBAAkB,EAAE,oBAAoB,CAAC;IAEnG,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAFN,IAAI,EAAE,WAAW,EACjB,OAAO,EAAE,iBAAiB,EAC1B,MAAM,EAAE,YAAY;IAGjC,OAAO,CAAC,KAAK,EAAE,kBAAkB,GAAG,8BAA8B,CAAC,oBAAoB,CAAC;CAQ/F;AAED,qBAEa,yBACX,YAAW,UAAU,CAAC,sBAAsB,EAAE,oBAAoB,CAAC;IAGjE,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAFN,IAAI,EAAE,WAAW,EACjB,OAAO,EAAE,iBAAiB,EAC1B,MAAM,EAAE,YAAY;IAGjC,OAAO,CAAC,KAAK,EAAE,sBAAsB,GAAG,8BAA8B,CAAC,oBAAoB,CAAC;CAiBnG;AAED,qBAEa,wBAAyB,YAAW,UAAU,CAAC,sBAAsB,EAAE,IAAI,CAAC;IAErF,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,OAAO;gBADP,IAAI,EAAE,WAAW,EACjB,OAAO,EAAE,iBAAiB;IAGvC,OAAO,CAAC,KAAK,EAAE,sBAAsB,GAAG,8BAA8B,CAAC,IAAI,CAAC;CAYnF;AAED,qBAEa,+BACX,YAAW,UAAU,CAAC,uBAAuB,EAAE,oBAAoB,CAAC;IAGlE,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,aAAa;IAC9B,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAHN,IAAI,EAAE,WAAW,EACjB,aAAa,EAAE,oBAAoB,EACnC,OAAO,EAAE,iBAAiB,EAC1B,MAAM,EAAE,YAAY;IAGjC,OAAO,CAAC,KAAK,EAAE,uBAAuB,GAAG,8BAA8B,CAAC,oBAAoB,CAAC;CAiBpG;AAED,qBAEa,2CACX,YAAW,UAAU,CAAC,uCAAuC,EAAE,IAAI,CAAC;IAGlE,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,aAAa;gBADb,IAAI,EAAE,WAAW,EACjB,aAAa,EAAE,oBAAoB;IAGhD,OAAO,CAAC,KAAK,EAAE,uCAAuC,GAAG,8BAA8B,CAAC,IAAI,CAAC;CAcpG;AAED,eAAO,MAAM,qBAAqB,4OAOjC,CAAC;AAMF,qBAEa,6BAA8B,YAAW,qBAAqB,CAAC,IAAI,EAAE,4BAA4B,CAAC;IACjG,OAAO,CAAC,QAAQ,CAAC,SAAS;gBAAT,SAAS,EAAE,SAAS;IAE3C,OAAO,IAAI,0BAA0B,CAAC,4BAA4B,CAAC;IAgBzE,OAAO,CAAC,8BAA8B;CASvC;AAED,qBAEa,2BACX,YAAW,qBAAqB,CAAC,IAAI,EAAE,oBAAoB,CAAC;IAG1D,OAAO,CAAC,QAAQ,CAAC,cAAc;IAC/B,OAAO,CAAC,QAAQ,CAAC,cAAc;gBADd,cAAc,EAAE,qBAAqB,EACrC,cAAc,EAAE,qBAAqB;IAGlD,OAAO,IAAI,0BAA0B,CAAC,oBAAoB,CAAC;CAKlE;AAED,qBAEa,gCACX,YAAW,qBAAqB,CAAC,IAAI,EAAE,yBAAyB,CAAC;IAG/D,OAAO,CAAC,QAAQ,CAAC,cAAc;IAC/B,OAAO,CAAC,QAAQ,CAAC,cAAc;gBADd,cAAc,EAAE,qBAAqB,EACrC,cAAc,EAAE,qBAAqB;IAGlD,OAAO,IAAI,0BAA0B,CAAC,yBAAyB,CAAC;CAQvE;AAED,qBAEa,qCACX,YAAW,qBAAqB,CAAC,mCAAmC,EAAE,uBAAuB,CAAC;IAG5F,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,aAAa;gBADb,IAAI,EAAE,WAAW,EACjB,aAAa,EAAE,oBAAoB;IAGhD,OAAO,CACX,KAAK,EAAE,mCAAmC,GACzC,0BAA0B,CAAC,uBAAuB,CAAC;CAiBvD;AAED,qBAEa,+BAAgC,YAAW,qBAAqB,CAAC,IAAI,EAAE,sBAAsB,CAAC;IAEvG,OAAO,CAAC,QAAQ,CAAC,cAAc;IAC/B,OAAO,CAAC,QAAQ,CAAC,cAAc;gBADd,cAAc,EAAE,qBAAqB,EACrC,cAAc,EAAE,qBAAqB;IAGlD,OAAO,IAAI,0BAA0B,CAAC,sBAAsB,CAAC;CASpE;AAED,eAAO,MAAM,oBAAoB,iNAMhC,CAAC"}