@acorex-platform/framework-server 0.0.32 → 0.0.37

package/security/src/lib/oauth/connect.controller.d.ts

@@ -1,30 +1,104 @@
 import type { Request, Response } from 'express';
+import { AuthService } from '../auth/auth.service';
+import { AuthLocalCredentialsService } from '../auth/auth-local-credentials.service';
 import { AuthCookieService } from '../auth/auth-cookie.service';
+import { TokenResolverService } from '../auth/token-resolver.service';
 import { TokenService } from '../auth/token.service';
 import { PlatformOAuthService } from './platform-oauth.service';
-import type { OAuthTokenResponse } from './platform-oauth.types';
+import { OidcProviderEngineService } from './oidc-provider-engine.service';
 export declare class ConnectController {
     private readonly oauth;
+    private readonly oidcEngine;
+    private readonly auth;
     private readonly cookies;
     private readonly tokens;
-    constructor(oauth: PlatformOAuthService, cookies: AuthCookieService, tokens: TokenService);
-    getDiscoveryDocument(req: Request): {
+    private readonly tokenResolver;
+    private readonly credentials;
+    constructor(oauth: PlatformOAuthService, oidcEngine: OidcProviderEngineService, auth: AuthService, cookies: AuthCookieService, tokens: TokenService, tokenResolver: TokenResolverService, credentials: AuthLocalCredentialsService);
+    getDiscoveryDocument(req: Request): Promise<{
         issuer: string;
         authorization_endpoint: string;
         token_endpoint: string;
         jwks_uri: string;
+        userinfo_endpoint: string;
+        revocation_endpoint: string;
+        end_session_endpoint: string;
         response_types_supported: string[];
         grant_types_supported: string[];
         code_challenge_methods_supported: string[];
         scopes_supported: string[];
-    };
+        subject_types_supported: string[];
+        id_token_signing_alg_values_supported: string[];
+    } | {
+        federation_authorize_init_endpoint: string;
+        issuer: string;
+        authorization_endpoint: string;
+        token_endpoint: string;
+        jwks_uri: string;
+        userinfo_endpoint: string;
+        revocation_endpoint: string;
+        end_session_endpoint: string;
+        response_types_supported: string[];
+        grant_types_supported: string[];
+        code_challenge_methods_supported: string[];
+        scopes_supported: string[];
+        subject_types_supported: string[];
+        id_token_signing_alg_values_supported: string[];
+    }>;
+    getOauthAuthorizationServerMetadata(req: Request): Promise<{
+        issuer: string;
+        authorization_endpoint: string;
+        token_endpoint: string;
+        jwks_uri: string;
+        userinfo_endpoint: string;
+        revocation_endpoint: string;
+        end_session_endpoint: string;
+        response_types_supported: string[];
+        grant_types_supported: string[];
+        code_challenge_methods_supported: string[];
+        scopes_supported: string[];
+        subject_types_supported: string[];
+        id_token_signing_alg_values_supported: string[];
+    } | {
+        federation_authorize_init_endpoint: string;
+        issuer: string;
+        authorization_endpoint: string;
+        token_endpoint: string;
+        jwks_uri: string;
+        userinfo_endpoint: string;
+        revocation_endpoint: string;
+        end_session_endpoint: string;
+        response_types_supported: string[];
+        grant_types_supported: string[];
+        code_challenge_methods_supported: string[];
+        scopes_supported: string[];
+        subject_types_supported: string[];
+        id_token_signing_alg_values_supported: string[];
+    }>;
     getJwksDocument(): {
-        keys: unknown[];
+        keys: Array<Record<string, unknown>>;
     };
+    authorizeInit(body: Record<string, unknown>, req: Request, res: Response): Promise<{
+        authorizeUrl: string;
+    }>;
     authorize(query: Record<string, string | undefined>, req: Request, res: Response): Promise<void>;
+    /**
+     * oidc-provider post-login resume (`GET /connect/authorize/:uid`).
+     * Must not require an identity_provider hint — this is the standard OP path.
+     */
+    authorizeResume(req: Request, res: Response): Promise<void>;
+    /**
+     * oidc-provider login/consent UI and form posts (standard OP path only).
+     * Not used by first-party Pure BFF federation broker.
+     * Explicit segments avoid Nest 11 / Express 5 wildcard matching gaps.
+     */
+    oidcInteraction(req: Request, res: Response): Promise<void>;
     externalCallback(providerKey: string, code: string | undefined, state: string | undefined, error: string | undefined, res: Response): Promise<void>;
-    token(req: Request, res: Response): Promise<OAuthTokenResponse>;
-    /** Platform API issuer from the incoming request (no hardcoded host/port). */
+    token(req: Request, res: Response): Promise<void>;
+    userInfo(req: Request, res: Response): Promise<void>;
+    revoke(req: Request, res: Response): Promise<void>;
+    endSession(query: Record<string, string | undefined>, req: Request, res: Response): Promise<void>;
+    /** Platform OAuth issuer — prefer `AUTH_OAUTH_ISSUER`, else derive from request. */
     private resolveIssuer;
     private readFormBody;
 }

package/security/src/lib/oauth/connect.controller.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"connect.controller.d.ts","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/oauth/connect.controller.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACjD,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAGhE,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAChE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAIjE,qBAGa,iBAAiB;IAE1B,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAFN,KAAK,EAAE,oBAAoB,EAC3B,OAAO,EAAE,iBAAiB,EAC1B,MAAM,EAAE,YAAY;IAKvC,oBAAoB,CAAQ,GAAG,EAAE,OAAO;;;;;;;;;;IAMxC,eAAe;;;IAMT,SAAS,CACJ,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,EAC3C,GAAG,EAAE,OAAO,EACZ,GAAG,EAAE,QAAQ,GACnB,OAAO,CAAC,IAAI,CAAC;IAuBV,gBAAgB,CACE,WAAW,EAAE,MAAM,EAC1B,IAAI,EAAE,MAAM,GAAG,SAAS,EACvB,KAAK,EAAE,MAAM,GAAG,SAAS,EACzB,KAAK,EAAE,MAAM,GAAG,SAAS,EAClC,GAAG,EAAE,QAAQ,GACnB,OAAO,CAAC,IAAI,CAAC;IAqBV,KAAK,CAAQ,GAAG,EAAE,OAAO,EAA8B,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAiBxG,8EAA8E;IAC9E,OAAO,CAAC,aAAa;IAQrB,OAAO,CAAC,YAAY;CAUrB"}
+{"version":3,"file":"connect.controller.d.ts","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/oauth/connect.controller.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACjD,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,EAAE,2BAA2B,EAAE,MAAM,wCAAwC,CAAC;AACrF,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAChE,OAAO,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AAGtE,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAChE,OAAO,EAAE,yBAAyB,EAAE,MAAM,gCAAgC,CAAC;AAc3E,qBAIa,iBAAiB;IAE1B,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,UAAU;IAC3B,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,aAAa;IAC9B,OAAO,CAAC,QAAQ,CAAC,WAAW;gBANX,KAAK,EAAE,oBAAoB,EAC3B,UAAU,EAAE,yBAAyB,EACrC,IAAI,EAAE,WAAW,EACjB,OAAO,EAAE,iBAAiB,EAC1B,MAAM,EAAE,YAAY,EACpB,aAAa,EAAE,oBAAoB,EACnC,WAAW,EAAE,2BAA2B;IAKrD,oBAAoB,CAAQ,GAAG,EAAE,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAkBxC,mCAAmC,CAAQ,GAAG,EAAE,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAM7D,eAAe;;;IAMT,aAAa,CACT,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,GAAG,EAAE,OAAO,EACS,GAAG,EAAE,QAAQ,GACxC,OAAO,CAAC;QAAE,YAAY,EAAE,MAAM,CAAA;KAAE,CAAC;IA0B9B,SAAS,CACJ,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,EAC3C,GAAG,EAAE,OAAO,EACZ,GAAG,EAAE,QAAQ,GACnB,OAAO,CAAC,IAAI,CAAC;IA6BhB;;;OAGG;IAGG,eAAe,CAAQ,GAAG,EAAE,OAAO,EAAS,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;IAO/E;;;;OAIG;IAGG,eAAe,CAAQ,GAAG,EAAE,OAAO,EAAS,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;IASzE,gBAAgB,CACE,WAAW,EAAE,MAAM,EAC1B,IAAI,EAAE,MAAM,GAAG,SAAS,EACvB,KAAK,EAAE,MAAM,GAAG,SAAS,EACzB,KAAK,EAAE,MAAM,GAAG,SAAS,EAClC,GAAG,EAAE,QAAQ,GACnB,OAAO,CAAC,IAAI,CAAC;IAqBV,KAAK,CAAQ,GAAG,EAAE,OAAO,EAAS,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;IAgC/D,QAAQ,CAAQ,GAAG,EAAE,OAAO,EAAS,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;IAkClE,MAAM,CAAQ,GAAG,EAAE,OAAO,EAAS,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;IA0BhE,UAAU,CACL,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,EAC3C,GAAG,EAAE,OAAO,EACZ,GAAG,EAAE,QAAQ,GACnB,OAAO,CAAC,IAAI,CAAC;IAiChB,oFAAoF;IACpF,OAAO,CAAC,aAAa;IAIrB,OAAO,CAAC,YAAY;CAUrB"}

package/security/src/lib/oauth/connect.controller.js

@@ -4,78 +4,237 @@ exports.ConnectController = void 0;
 const tslib_1 = require("tslib");
 const common_1 = require("@nestjs/common");
 const swagger_1 = require("@nestjs/swagger");
+const auth_service_1 = require("../auth/auth.service");
+const auth_local_credentials_service_1 = require("../auth/auth-local-credentials.service");
 const auth_cookie_service_1 = require("../auth/auth-cookie.service");
+const token_resolver_service_1 = require("../auth/token-resolver.service");
 const public_decorator_1 = require("../auth/public.decorator");
 const request_meta_util_1 = require("../auth/request-meta.util");
 const token_service_1 = require("../auth/token.service");
 const platform_oauth_service_1 = require("./platform-oauth.service");
+const oidc_provider_engine_service_1 = require("./oidc-provider-engine.service");
+const oauth_issuer_util_1 = require("./oauth-issuer.util");
+const oauth_connect_exception_filter_1 = require("./oauth-connect.exception-filter");
+const oauth_provider_hint_util_1 = require("./oauth-provider-hint.util");
+const oauth_error_util_1 = require("./oauth-error.util");
+const auth_config_1 = require("../auth/auth.config");
 //#region ---- Platform OAuth connect endpoints ----
 let ConnectController = class ConnectController {
-    constructor(oauth, cookies, tokens) {
+    constructor(oauth, oidcEngine, auth, cookies, tokens, tokenResolver, credentials) {
         this.oauth = oauth;
+        this.oidcEngine = oidcEngine;
+        this.auth = auth;
         this.cookies = cookies;
         this.tokens = tokens;
+        this.tokenResolver = tokenResolver;
+        this.credentials = credentials;
     }
-    getDiscoveryDocument(req) {
-        return this.oauth.getDiscoveryDocument(this.resolveIssuer(req));
+    async getDiscoveryDocument(req) {
+        const issuer = this.resolveIssuer(req);
+        const platformDoc = this.oauth.getDiscoveryDocument(issuer);
+        const engineDoc = await this.oidcEngine.getDiscoveryDocument();
+        if (engineDoc) {
+            return {
+                ...engineDoc,
+                ...platformDoc,
+                federation_authorize_init_endpoint: `${issuer}/connect/authorize/init`,
+            };
+        }
+        return platformDoc;
+    }
+    async getOauthAuthorizationServerMetadata(req) {
+        return this.getDiscoveryDocument(req);
     }
     getJwksDocument() {
         return this.oauth.getJwksDocument();
     }
-    async authorize(query, req, res) {
-        const provider = query['acr_values']?.trim();
-        if (!provider) {
-            throw new common_1.BadRequestException('acr_values (identity provider key) is required.');
-        }
-        const redirectUrl = await this.oauth.beginAuthorization({
-            responseType: query['response_type']?.trim() || '',
-            clientId: query['client_id']?.trim() || '',
-            redirectUri: query['redirect_uri']?.trim() || '',
-            scope: query['scope']?.trim() || 'openid profile email',
-            codeChallenge: query['code_challenge']?.trim() || '',
-            codeChallengeMethod: query['code_challenge_method']?.trim() || '',
+    async authorizeInit(body, req, res) {
+        this.cookies.applyCsrfCookie(res);
+        const clientId = String(body['client_id'] ?? body['clientId'] ?? '').trim();
+        const redirectUri = String(body['redirect_uri'] ?? body['redirectUri'] ?? '').trim();
+        const scope = String(body['scope'] ?? 'openid profile email offline_access').trim();
+        const provider = (0, oauth_provider_hint_util_1.resolveOAuthProviderHint)({
+            identity_provider: String(body['identity_provider'] ?? body['provider'] ?? ''),
+            acr_values: String(body['acr_values'] ?? ''),
+        }) ?? '';
+        if (!clientId || !redirectUri || !provider) {
+            throw (0, oauth_error_util_1.oauthInvalidRequest)('client_id, redirect_uri, and identity_provider are required.');
+        }
+        return this.oauth.initAuthorization({
+            clientId,
+            redirectUri,
+            scope,
             provider,
             issuer: this.resolveIssuer(req),
-            state: query['state']?.trim(),
         });
-        res.redirect(redirectUrl);
+    }
+    async authorize(query, req, res) {
+        const provider = (0, oauth_provider_hint_util_1.resolveOAuthProviderHint)(query);
+        if (provider) {
+            this.cookies.applyCsrfCookie(res);
+            const redirectUrl = await this.oauth.beginAuthorization({
+                responseType: query['response_type']?.trim() || '',
+                clientId: query['client_id']?.trim() || '',
+                redirectUri: query['redirect_uri']?.trim() || '',
+                scope: query['scope']?.trim() || 'openid profile email offline_access',
+                codeChallenge: query['code_challenge']?.trim() || '',
+                codeChallengeMethod: query['code_challenge_method']?.trim() || '',
+                provider,
+                issuer: this.resolveIssuer(req),
+                state: query['state']?.trim(),
+            });
+            res.redirect(redirectUrl);
+            return;
+        }
+        if (this.oidcEngine.isEnabled()) {
+            await this.oidcEngine.forward(req, res);
+            return;
+        }
+        throw (0, oauth_error_util_1.oauthInvalidRequest)('identity_provider (or acr_values) is required.');
+    }
+    /**
+     * oidc-provider post-login resume (`GET /connect/authorize/:uid`).
+     * Must not require an identity_provider hint — this is the standard OP path.
+     */
+    async authorizeResume(req, res) {
+        if (!this.oidcEngine.isEnabled()) {
+            throw (0, oauth_error_util_1.oauthInvalidRequest)('oidc provider unavailable.');
+        }
+        await this.oidcEngine.forward(req, res);
+    }
+    /**
+     * oidc-provider login/consent UI and form posts (standard OP path only).
+     * Not used by first-party Pure BFF federation broker.
+     * Explicit segments avoid Nest 11 / Express 5 wildcard matching gaps.
+     */
+    async oidcInteraction(req, res) {
+        if (!this.oidcEngine.isEnabled()) {
+            throw (0, oauth_error_util_1.oauthInvalidRequest)('oidc provider unavailable.');
+        }
+        await this.oidcEngine.forward(req, res);
     }
     async externalCallback(providerKey, code, state, error, res) {
         const key = providerKey?.trim();
         if (!key) {
-            throw new common_1.BadRequestException('providerKey is required.');
+            throw (0, oauth_error_util_1.oauthInvalidRequest)('providerKey is required.');
         }
         if (error) {
             res.status(400).send(`${key} authorization failed: ${error}`);
             return;
         }
         if (!code?.trim() || !state?.trim()) {
-            throw new common_1.BadRequestException('code and state are required.');
+            throw (0, oauth_error_util_1.oauthInvalidRequest)('code and state are required.');
         }
         const redirectUrl = await this.oauth.completeExternalCallback(key, code.trim(), state.trim());
         res.redirect(redirectUrl);
     }
     async token(req, res) {
         const body = this.readFormBody(req);
-        const meta = (0, request_meta_util_1.resolveAuthRequestMeta)(req);
-        const result = await this.oauth.exchangeAuthorizationCode(body, meta);
-        if (result.access_token && result.refresh_token) {
+        if (typeof req.headers.authorization === 'string') {
+            body['authorization'] = req.headers.authorization;
+        }
+        if (this.oauth.isBrokerTokenRequest(body)) {
+            const meta = (0, request_meta_util_1.resolveAuthRequestMeta)(req);
+            const result = await this.oauth.exchangeAuthorizationCode(body, meta);
             this.cookies.applyAuthCookies(res, {
-                accessToken: result.access_token,
-                refreshToken: result.refresh_token,
+                accessToken: result.accessToken,
+                refreshToken: result.refreshToken,
                 accessMaxAgeMs: this.tokens.accessTokenMaxAgeMs(),
                 refreshMaxAgeMs: this.tokens.refreshTokenMaxAgeMs(),
             });
+            this.cookies.applyCsrfCookie(res);
+            res.json(result.body);
+            return;
         }
-        return result;
+        if (this.oidcEngine.isEnabled()) {
+            await this.oidcEngine.forward(req, res);
+            return;
+        }
+        throw (0, oauth_error_util_1.oauthUnsupportedGrantType)('Unsupported grant_type.');
+    }
+    async userInfo(req, res) {
+        const resolved = this.tokenResolver.resolveAccessToken(req.headers, req.cookies);
+        if (!resolved) {
+            if (this.oidcEngine.isEnabled()) {
+                await this.oidcEngine.forward(req, res);
+                return;
+            }
+            throw (0, oauth_error_util_1.oauthInvalidToken)('Bearer access token is required.');
+        }
+        try {
+            const payload = await this.auth.validateAccessToken(resolved.token, auth_config_1.PLATFORM_ACCESS_TOKEN_AUDIENCE);
+            const user = await this.credentials.findUserById(payload.sub);
+            res.json({
+                sub: payload.sub,
+                name: payload.username,
+                picture: user?.avatar ?? null,
+                email: typeof user?.email === 'string' ? user.email : undefined,
+            });
+            return;
+        }
+        catch {
+            if (this.oidcEngine.isEnabled()) {
+                await this.oidcEngine.forward(req, res);
+                return;
+            }
+            throw (0, oauth_error_util_1.oauthInvalidToken)('Invalid or expired access token.');
+        }
+    }
+    async revoke(req, res) {
+        const body = this.readFormBody(req);
+        const refreshToken = body['refresh_token'] ?? body['token'] ?? this.cookies.readRefreshToken(req.cookies);
+        if (refreshToken) {
+            try {
+                this.tokens.verifyRefreshToken(refreshToken);
+                await this.auth.logout(refreshToken);
+                this.cookies.clearAuthCookies(res);
+                res.json({ success: true });
+                return;
+            }
+            catch {
+                /* fall through to oidc-provider */
+            }
+        }
+        if (this.oidcEngine.isEnabled()) {
+            await this.oidcEngine.forward(req, res);
+            return;
+        }
+        res.json({ success: true });
     }
-    /** Platform API issuer from the incoming request (no hardcoded host/port). */
+    async endSession(query, req, res) {
+        const refreshToken = this.cookies.readRefreshToken(req.cookies);
+        if (refreshToken) {
+            try {
+                this.tokens.verifyRefreshToken(refreshToken);
+                await this.auth.logout(refreshToken);
+                const redirectUrl = await this.oauth.endSession({
+                    idTokenHint: query['id_token_hint'],
+                    postLogoutRedirectUri: query['post_logout_redirect_uri'],
+                    clientId: query['client_id'],
+                    state: query['state'],
+                });
+                this.cookies.clearAuthCookies(res);
+                if (redirectUrl) {
+                    res.redirect(redirectUrl);
+                    return;
+                }
+                res.status(204).send();
+                return;
+            }
+            catch {
+                /* fall through */
+            }
+        }
+        if (this.oidcEngine.isEnabled()) {
+            await this.oidcEngine.forward(req, res);
+            return;
+        }
+        this.cookies.clearAuthCookies(res);
+        res.status(204).send();
+    }
+    /** Platform OAuth issuer — prefer `AUTH_OAUTH_ISSUER`, else derive from request. */
     resolveIssuer(req) {
-        const forwardedProto = req.headers['x-forwarded-proto'];
-        const protoHeader = Array.isArray(forwardedProto) ? forwardedProto[0] : forwardedProto;
-        const proto = (protoHeader?.split(',')[0] || req.protocol || 'http').trim();
-        const host = (req.get('host') || 'localhost:5500').trim();
-        return `${proto}://${host}/api`;
+        return (0, oauth_issuer_util_1.resolveOAuthIssuer)(req);
     }
     readFormBody(req) {
         const body = req.body;
@@ -92,18 +251,36 @@ tslib_1.__decorate([
     tslib_1.__param(0, (0, common_1.Req)()),
     tslib_1.__metadata("design:type", Function),
     tslib_1.__metadata("design:paramtypes", [Object]),
-    tslib_1.__metadata("design:returntype", void 0)
+    tslib_1.__metadata("design:returntype", Promise)
 ], ConnectController.prototype, "getDiscoveryDocument", null);
+tslib_1.__decorate([
+    (0, common_1.Get)('.well-known/oauth-authorization-server'),
+    (0, swagger_1.ApiOperation)({ summary: 'OAuth 2.0 Authorization Server metadata (RFC 8414)' }),
+    tslib_1.__param(0, (0, common_1.Req)()),
+    tslib_1.__metadata("design:type", Function),
+    tslib_1.__metadata("design:paramtypes", [Object]),
+    tslib_1.__metadata("design:returntype", Promise)
+], ConnectController.prototype, "getOauthAuthorizationServerMetadata", null);
 tslib_1.__decorate([
     (0, common_1.Get)('.well-known/jwks.json'),
-    (0, swagger_1.ApiOperation)({ summary: 'JSON Web Key Set (platform broker — HS256 tokens, empty for discovery clients)' }),
+    (0, swagger_1.ApiOperation)({ summary: 'JSON Web Key Set (platform broker signing keys for id_token)' }),
     tslib_1.__metadata("design:type", Function),
     tslib_1.__metadata("design:paramtypes", []),
     tslib_1.__metadata("design:returntype", void 0)
 ], ConnectController.prototype, "getJwksDocument", null);
+tslib_1.__decorate([
+    (0, common_1.Post)('connect/authorize/init'),
+    (0, swagger_1.ApiOperation)({ summary: 'BFF: server-side PKCE + platform authorize URL' }),
+    tslib_1.__param(0, (0, common_1.Body)()),
+    tslib_1.__param(1, (0, common_1.Req)()),
+    tslib_1.__param(2, (0, common_1.Res)({ passthrough: true })),
+    tslib_1.__metadata("design:type", Function),
+    tslib_1.__metadata("design:paramtypes", [Object, Object, Object]),
+    tslib_1.__metadata("design:returntype", Promise)
+], ConnectController.prototype, "authorizeInit", null);
 tslib_1.__decorate([
     (0, common_1.Get)('connect/authorize'),
-    (0, swagger_1.ApiOperation)({ summary: 'Begin external IdP authorization (IdentityProvider key via acr_values)' }),
+    (0, swagger_1.ApiOperation)({ summary: 'Authorization endpoint (federation broker or oidc-provider engine)' }),
     tslib_1.__param(0, (0, common_1.Query)()),
     tslib_1.__param(1, (0, common_1.Req)()),
     tslib_1.__param(2, (0, common_1.Res)()),
@@ -111,6 +288,24 @@ tslib_1.__decorate([
     tslib_1.__metadata("design:paramtypes", [Object, Object, Object]),
     tslib_1.__metadata("design:returntype", Promise)
 ], ConnectController.prototype, "authorize", null);
+tslib_1.__decorate([
+    (0, common_1.All)('connect/authorize/:uid'),
+    (0, swagger_1.ApiOperation)({ summary: 'OpenID Provider authorize resume (oidc-provider engine)' }),
+    tslib_1.__param(0, (0, common_1.Req)()),
+    tslib_1.__param(1, (0, common_1.Res)()),
+    tslib_1.__metadata("design:type", Function),
+    tslib_1.__metadata("design:paramtypes", [Object, Object]),
+    tslib_1.__metadata("design:returntype", Promise)
+], ConnectController.prototype, "authorizeResume", null);
+tslib_1.__decorate([
+    (0, common_1.All)(['interaction/:uid', 'interaction/:uid/:action']),
+    (0, swagger_1.ApiOperation)({ summary: 'OpenID Provider interaction (oidc-provider engine)' }),
+    tslib_1.__param(0, (0, common_1.Req)()),
+    tslib_1.__param(1, (0, common_1.Res)()),
+    tslib_1.__metadata("design:type", Function),
+    tslib_1.__metadata("design:paramtypes", [Object, Object]),
+    tslib_1.__metadata("design:returntype", Promise)
+], ConnectController.prototype, "oidcInteraction", null);
 tslib_1.__decorate([
     (0, common_1.Get)('connect/callback/:providerKey'),
     (0, swagger_1.ApiOperation)({ summary: 'External IdP OAuth callback for platform login' }),
@@ -127,18 +322,51 @@ tslib_1.__decorate([
     (0, common_1.Post)('connect/token'),
     (0, swagger_1.ApiOperation)({ summary: 'Exchange authorization code or refresh token for platform tokens' }),
     tslib_1.__param(0, (0, common_1.Req)()),
-    tslib_1.__param(1, (0, common_1.Res)({ passthrough: true })),
+    tslib_1.__param(1, (0, common_1.Res)()),
     tslib_1.__metadata("design:type", Function),
     tslib_1.__metadata("design:paramtypes", [Object, Object]),
     tslib_1.__metadata("design:returntype", Promise)
 ], ConnectController.prototype, "token", null);
+tslib_1.__decorate([
+    (0, common_1.Get)('connect/userinfo'),
+    (0, swagger_1.ApiOperation)({ summary: 'UserInfo endpoint for access tokens' }),
+    tslib_1.__param(0, (0, common_1.Req)()),
+    tslib_1.__param(1, (0, common_1.Res)()),
+    tslib_1.__metadata("design:type", Function),
+    tslib_1.__metadata("design:paramtypes", [Object, Object]),
+    tslib_1.__metadata("design:returntype", Promise)
+], ConnectController.prototype, "userInfo", null);
+tslib_1.__decorate([
+    (0, common_1.Post)('connect/revocation'),
+    (0, swagger_1.ApiOperation)({ summary: 'Token revocation endpoint (refresh token revoke)' }),
+    tslib_1.__param(0, (0, common_1.Req)()),
+    tslib_1.__param(1, (0, common_1.Res)()),
+    tslib_1.__metadata("design:type", Function),
+    tslib_1.__metadata("design:paramtypes", [Object, Object]),
+    tslib_1.__metadata("design:returntype", Promise)
+], ConnectController.prototype, "revoke", null);
+tslib_1.__decorate([
+    (0, common_1.Get)('connect/endsession'),
+    (0, swagger_1.ApiOperation)({ summary: 'RP-Initiated Logout (OpenID Connect)' }),
+    tslib_1.__param(0, (0, common_1.Query)()),
+    tslib_1.__param(1, (0, common_1.Req)()),
+    tslib_1.__param(2, (0, common_1.Res)()),
+    tslib_1.__metadata("design:type", Function),
+    tslib_1.__metadata("design:paramtypes", [Object, Object, Object]),
+    tslib_1.__metadata("design:returntype", Promise)
+], ConnectController.prototype, "endSession", null);
 exports.ConnectController = ConnectController = tslib_1.__decorate([
     (0, swagger_1.ApiTags)('connect'),
     (0, public_decorator_1.Public)(),
+    (0, common_1.UseFilters)(oauth_connect_exception_filter_1.OAuthConnectExceptionFilter),
     (0, common_1.Controller)(),
     tslib_1.__metadata("design:paramtypes", [platform_oauth_service_1.PlatformOAuthService,
+        oidc_provider_engine_service_1.OidcProviderEngineService,
+        auth_service_1.AuthService,
         auth_cookie_service_1.AuthCookieService,
-        token_service_1.TokenService])
+        token_service_1.TokenService,
+        token_resolver_service_1.TokenResolverService,
+        auth_local_credentials_service_1.AuthLocalCredentialsService])
 ], ConnectController);
 //#endregion
 //# sourceMappingURL=connect.controller.js.map

package/security/src/lib/oauth/connect.controller.js.map

@@ -1 +1 @@
-{"version":3,"file":"connect.controller.js","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/oauth/connect.controller.ts"],"names":[],"mappings":";;;;AAAA,2CASwB;AACxB,6CAAwD;AAExD,qEAAgE;AAChE,+DAAkD;AAClD,iEAAmE;AACnE,yDAAqD;AACrD,qEAAgE;AAGhE,oDAAoD;AAK7C,IAAM,iBAAiB,GAAvB,MAAM,iBAAiB;IAC5B,YACmB,KAA2B,EAC3B,OAA0B,EAC1B,MAAoB;QAFpB,UAAK,GAAL,KAAK,CAAsB;QAC3B,YAAO,GAAP,OAAO,CAAmB;QAC1B,WAAM,GAAN,MAAM,CAAc;IACpC,CAAC;IAIJ,oBAAoB,CAAQ,GAAY;QACtC,OAAO,IAAI,CAAC,KAAK,CAAC,oBAAoB,CAAC,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC;IAClE,CAAC;IAID,eAAe;QACb,OAAO,IAAI,CAAC,KAAK,CAAC,eAAe,EAAE,CAAC;IACtC,CAAC;IAIK,AAAN,KAAK,CAAC,SAAS,CACJ,KAAyC,EAC3C,GAAY,EACZ,GAAa;QAEpB,MAAM,QAAQ,GAAG,KAAK,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,CAAC;QAC7C,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,4BAAmB,CAAC,iDAAiD,CAAC,CAAC;QACnF,CAAC;QAED,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC;YACtD,YAAY,EAAE,KAAK,CAAC,eAAe,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE;YAClD,QAAQ,EAAE,KAAK,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE;YAC1C,WAAW,EAAE,KAAK,CAAC,cAAc,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE;YAChD,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,IAAI,sBAAsB;YACvD,aAAa,EAAE,KAAK,CAAC,gBAAgB,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE;YACpD,mBAAmB,EAAE,KAAK,CAAC,uBAAuB,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE;YACjE,QAAQ;YACR,MAAM,EAAE,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC;YAC/B,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE;SAC9B,CAAC,CAAC;QAEH,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC5B,CAAC;IAIK,AAAN,KAAK,CAAC,gBAAgB,CACE,WAAmB,EAC1B,IAAwB,EACvB,KAAyB,EACzB,KAAyB,EAClC,GAAa;QAEpB,MAAM,GAAG,GAAG,WAAW,EAAE,IAAI,EAAE,CAAC;QAChC,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,MAAM,IAAI,4BAAmB,CAAC,0BAA0B,CAAC,CAAC;QAC5D,CAAC;QAED,IAAI,KAAK,EAAE,CAAC;YACV,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,GAAG,0BAA0B,KAAK,EAAE,CAAC,CAAC;YAC9D,OAAO;QACT,CAAC;QAED,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC;YACpC,MAAM,IAAI,4BAAmB,CAAC,8BAA8B,CAAC,CAAC;QAChE,CAAC;QAED,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,wBAAwB,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QAC9F,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC5B,CAAC;IAIK,AAAN,KAAK,CAAC,KAAK,CAAQ,GAAY,EAA8B,GAAa;QACxE,MAAM,IAAI,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;QACpC,MAAM,IAAI,GAAG,IAAA,0CAAsB,EAAC,GAAG,CAAC,CAAC;QACzC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,yBAAyB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAEtE,IAAI,MAAM,CAAC,YAAY,IAAI,MAAM,CAAC,aAAa,EAAE,CAAC;YAChD,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,GAAG,EAAE;gBACjC,WAAW,EAAE,MAAM,CAAC,YAAY;gBAChC,YAAY,EAAE,MAAM,CAAC,aAAa;gBAClC,cAAc,EAAE,IAAI,CAAC,MAAM,CAAC,mBAAmB,EAAE;gBACjD,eAAe,EAAE,IAAI,CAAC,MAAM,CAAC,oBAAoB,EAAE;aACpD,CAAC,CAAC;QACL,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,8EAA8E;IACtE,aAAa,CAAC,GAAY;QAChC,MAAM,cAAc,GAAG,GAAG,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC;QACxD,MAAM,WAAW,GAAG,KAAK,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC;QACvF,MAAM,KAAK,GAAG,CAAC,WAAW,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,QAAQ,IAAI,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QAC5E,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,gBAAgB,CAAC,CAAC,IAAI,EAAE,CAAC;QAC1D,OAAO,GAAG,KAAK,MAAM,IAAI,MAAM,CAAC;IAClC,CAAC;IAEO,YAAY,CAAC,GAAY;QAC/B,MAAM,IAAI,GAAG,GAAG,CAAC,IAA2C,CAAC;QAC7D,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YACtC,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,OAAO,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAC7F,CAAC;IACJ,CAAC;CACF,CAAA;AA/GY,8CAAiB;AAS5B;IAFC,IAAA,YAAG,EAAC,kCAAkC,CAAC;IACvC,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,mCAAmC,EAAE,CAAC;IACzC,mBAAA,IAAA,YAAG,GAAE,CAAA;;;;6DAE1B;AAID;IAFC,IAAA,YAAG,EAAC,uBAAuB,CAAC;IAC5B,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,gFAAgF,EAAE,CAAC;;;;wDAG3G;AAIK;IAFL,IAAA,YAAG,EAAC,mBAAmB,CAAC;IACxB,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,wEAAwE,EAAE,CAAC;IAEjG,mBAAA,IAAA,cAAK,GAAE,CAAA;IACP,mBAAA,IAAA,YAAG,GAAE,CAAA;IACL,mBAAA,IAAA,YAAG,GAAE,CAAA;;;;kDAoBP;AAIK;IAFL,IAAA,YAAG,EAAC,+BAA+B,CAAC;IACpC,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,gDAAgD,EAAE,CAAC;IAEzE,mBAAA,IAAA,cAAK,EAAC,aAAa,CAAC,CAAA;IACpB,mBAAA,IAAA,cAAK,EAAC,MAAM,CAAC,CAAA;IACb,mBAAA,IAAA,cAAK,EAAC,OAAO,CAAC,CAAA;IACd,mBAAA,IAAA,cAAK,EAAC,OAAO,CAAC,CAAA;IACd,mBAAA,IAAA,YAAG,GAAE,CAAA;;;;yDAkBP;AAIK;IAFL,IAAA,aAAI,EAAC,eAAe,CAAC;IACrB,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,kEAAkE,EAAE,CAAC;IACjF,mBAAA,IAAA,YAAG,GAAE,CAAA;IAAgB,mBAAA,IAAA,YAAG,EAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAA;;;;8CAe3D;4BA1FU,iBAAiB;IAH7B,IAAA,iBAAO,EAAC,SAAS,CAAC;IAClB,IAAA,yBAAM,GAAE;IACR,IAAA,mBAAU,GAAE;6CAGe,6CAAoB;QAClB,uCAAiB;QAClB,4BAAY;GAJ5B,iBAAiB,CA+G7B;AAED,YAAY"}
+{"version":3,"file":"connect.controller.js","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/oauth/connect.controller.ts"],"names":[],"mappings":";;;;AAAA,2CAWwB;AACxB,6CAAwD;AAExD,uDAAmD;AACnD,2FAAqF;AACrF,qEAAgE;AAChE,2EAAsE;AACtE,+DAAkD;AAClD,iEAAmE;AACnE,yDAAqD;AACrD,qEAAgE;AAChE,iFAA2E;AAC3E,2DAAyD;AACzD,qFAA+E;AAC/E,yEAAsE;AACtE,yDAI4B;AAC5B,qDAAqE;AAGrE,oDAAoD;AAM7C,IAAM,iBAAiB,GAAvB,MAAM,iBAAiB;IAC5B,YACmB,KAA2B,EAC3B,UAAqC,EACrC,IAAiB,EACjB,OAA0B,EAC1B,MAAoB,EACpB,aAAmC,EACnC,WAAwC;QANxC,UAAK,GAAL,KAAK,CAAsB;QAC3B,eAAU,GAAV,UAAU,CAA2B;QACrC,SAAI,GAAJ,IAAI,CAAa;QACjB,YAAO,GAAP,OAAO,CAAmB;QAC1B,WAAM,GAAN,MAAM,CAAc;QACpB,kBAAa,GAAb,aAAa,CAAsB;QACnC,gBAAW,GAAX,WAAW,CAA6B;IACxD,CAAC;IAIE,AAAN,KAAK,CAAC,oBAAoB,CAAQ,GAAY;QAC5C,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC;QACvC,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,oBAAoB,CAAC,MAAM,CAAC,CAAC;QAC5D,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,oBAAoB,EAAE,CAAC;QAE/D,IAAI,SAAS,EAAE,CAAC;YACd,OAAO;gBACL,GAAG,SAAS;gBACZ,GAAG,WAAW;gBACd,kCAAkC,EAAE,GAAG,MAAM,yBAAyB;aACvE,CAAC;QACJ,CAAC;QAED,OAAO,WAAW,CAAC;IACrB,CAAC;IAIK,AAAN,KAAK,CAAC,mCAAmC,CAAQ,GAAY;QAC3D,OAAO,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,CAAC;IACxC,CAAC;IAID,eAAe;QACb,OAAO,IAAI,CAAC,KAAK,CAAC,eAAe,EAAE,CAAC;IACtC,CAAC;IAIK,AAAN,KAAK,CAAC,aAAa,CACT,IAA6B,EAC9B,GAAY,EACS,GAAa;QAEzC,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;QAElC,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAC5E,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACrF,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,qCAAqC,CAAC,CAAC,IAAI,EAAE,CAAC;QACpF,MAAM,QAAQ,GAAG,IAAA,mDAAwB,EAAC;YACxC,iBAAiB,EAAE,MAAM,CAAC,IAAI,CAAC,mBAAmB,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;YAC9E,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC;SAC7C,CAAC,IAAI,EAAE,CAAC;QAET,IAAI,CAAC,QAAQ,IAAI,CAAC,WAAW,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC3C,MAAM,IAAA,sCAAmB,EAAC,8DAA8D,CAAC,CAAC;QAC5F,CAAC;QAED,OAAO,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC;YAClC,QAAQ;YACR,WAAW;YACX,KAAK;YACL,QAAQ;YACR,MAAM,EAAE,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC;SAChC,CAAC,CAAC;IACL,CAAC;IAIK,AAAN,KAAK,CAAC,SAAS,CACJ,KAAyC,EAC3C,GAAY,EACZ,GAAa;QAEpB,MAAM,QAAQ,GAAG,IAAA,mDAAwB,EAAC,KAAK,CAAC,CAAC;QACjD,IAAI,QAAQ,EAAE,CAAC;YACb,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;YAElC,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC;gBACtD,YAAY,EAAE,KAAK,CAAC,eAAe,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE;gBAClD,QAAQ,EAAE,KAAK,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE;gBAC1C,WAAW,EAAE,KAAK,CAAC,cAAc,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE;gBAChD,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,IAAI,qCAAqC;gBACtE,aAAa,EAAE,KAAK,CAAC,gBAAgB,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE;gBACpD,mBAAmB,EAAE,KAAK,CAAC,uBAAuB,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE;gBACjE,QAAQ;gBACR,MAAM,EAAE,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC;gBAC/B,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE;aAC9B,CAAC,CAAC;YAEH,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;YAC1B,OAAO;QACT,CAAC;QAED,IAAI,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,EAAE,CAAC;YAChC,MAAM,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YACxC,OAAO;QACT,CAAC;QAED,MAAM,IAAA,sCAAmB,EAAC,gDAAgD,CAAC,CAAC;IAC9E,CAAC;IAED;;;OAGG;IAGG,AAAN,KAAK,CAAC,eAAe,CAAQ,GAAY,EAAS,GAAa;QAC7D,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,EAAE,CAAC;YACjC,MAAM,IAAA,sCAAmB,EAAC,4BAA4B,CAAC,CAAC;QAC1D,CAAC;QACD,MAAM,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAC1C,CAAC;IAED;;;;OAIG;IAGG,AAAN,KAAK,CAAC,eAAe,CAAQ,GAAY,EAAS,GAAa;QAC7D,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,EAAE,CAAC;YACjC,MAAM,IAAA,sCAAmB,EAAC,4BAA4B,CAAC,CAAC;QAC1D,CAAC;QACD,MAAM,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAC1C,CAAC;IAIK,AAAN,KAAK,CAAC,gBAAgB,CACE,WAAmB,EAC1B,IAAwB,EACvB,KAAyB,EACzB,KAAyB,EAClC,GAAa;QAEpB,MAAM,GAAG,GAAG,WAAW,EAAE,IAAI,EAAE,CAAC;QAChC,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,MAAM,IAAA,sCAAmB,EAAC,0BAA0B,CAAC,CAAC;QACxD,CAAC;QAED,IAAI,KAAK,EAAE,CAAC;YACV,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,GAAG,0BAA0B,KAAK,EAAE,CAAC,CAAC;YAC9D,OAAO;QACT,CAAC;QAED,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC;YACpC,MAAM,IAAA,sCAAmB,EAAC,8BAA8B,CAAC,CAAC;QAC5D,CAAC;QAED,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,wBAAwB,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QAC9F,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC5B,CAAC;IAIK,AAAN,KAAK,CAAC,KAAK,CAAQ,GAAY,EAAS,GAAa;QACnD,MAAM,IAAI,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;QACpC,IAAI,OAAO,GAAG,CAAC,OAAO,CAAC,aAAa,KAAK,QAAQ,EAAE,CAAC;YAClD,IAAI,CAAC,eAAe,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC;QACpD,CAAC;QAED,IAAI,IAAI,CAAC,KAAK,CAAC,oBAAoB,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1C,MAAM,IAAI,GAAG,IAAA,0CAAsB,EAAC,GAAG,CAAC,CAAC;YACzC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,yBAAyB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YAEtE,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,GAAG,EAAE;gBACjC,WAAW,EAAE,MAAM,CAAC,WAAW;gBAC/B,YAAY,EAAE,MAAM,CAAC,YAAY;gBACjC,cAAc,EAAE,IAAI,CAAC,MAAM,CAAC,mBAAmB,EAAE;gBACjD,eAAe,EAAE,IAAI,CAAC,MAAM,CAAC,oBAAoB,EAAE;aACpD,CAAC,CAAC;YACH,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;YAElC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,IAAiC,CAAC,CAAC;YACnD,OAAO;QACT,CAAC;QAED,IAAI,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,EAAE,CAAC;YAChC,MAAM,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YACxC,OAAO;QACT,CAAC;QAED,MAAM,IAAA,4CAAyB,EAAC,yBAAyB,CAAC,CAAC;IAC7D,CAAC;IAIK,AAAN,KAAK,CAAC,QAAQ,CAAQ,GAAY,EAAS,GAAa;QACtD,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,CAAC,kBAAkB,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;QACjF,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,IAAI,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,EAAE,CAAC;gBAChC,MAAM,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;gBACxC,OAAO;YACT,CAAC;YACD,MAAM,IAAA,oCAAiB,EAAC,kCAAkC,CAAC,CAAC;QAC9D,CAAC;QAED,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,mBAAmB,CACjD,QAAQ,CAAC,KAAK,EACd,4CAA8B,CAC/B,CAAC;YACF,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YAC9D,GAAG,CAAC,IAAI,CAAC;gBACP,GAAG,EAAE,OAAO,CAAC,GAAG;gBAChB,IAAI,EAAE,OAAO,CAAC,QAAQ;gBACtB,OAAO,EAAE,IAAI,EAAE,MAAM,IAAI,IAAI;gBAC7B,KAAK,EAAE,OAAO,IAAI,EAAE,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;aAChE,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,EAAE,CAAC;gBAChC,MAAM,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;gBACxC,OAAO;YACT,CAAC;YACD,MAAM,IAAA,oCAAiB,EAAC,kCAAkC,CAAC,CAAC;QAC9D,CAAC;IACH,CAAC;IAIK,AAAN,KAAK,CAAC,MAAM,CAAQ,GAAY,EAAS,GAAa;QACpD,MAAM,IAAI,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;QACpC,MAAM,YAAY,GAAG,IAAI,CAAC,eAAe,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAE1G,IAAI,YAAY,EAAE,CAAC;YACjB,IAAI,CAAC;gBACH,IAAI,CAAC,MAAM,CAAC,kBAAkB,CAAC,YAAY,CAAC,CAAC;gBAC7C,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;gBACrC,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC;gBACnC,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;gBAC5B,OAAO;YACT,CAAC;YAAC,MAAM,CAAC;gBACP,mCAAmC;YACrC,CAAC;QACH,CAAC;QAED,IAAI,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,EAAE,CAAC;YAChC,MAAM,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YACxC,OAAO;QACT,CAAC;QAED,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9B,CAAC;IAIK,AAAN,KAAK,CAAC,UAAU,CACL,KAAyC,EAC3C,GAAY,EACZ,GAAa;QAEpB,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAChE,IAAI,YAAY,EAAE,CAAC;YACjB,IAAI,CAAC;gBACH,IAAI,CAAC,MAAM,CAAC,kBAAkB,CAAC,YAAY,CAAC,CAAC;gBAC7C,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;gBACrC,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC;oBAC9C,WAAW,EAAE,KAAK,CAAC,eAAe,CAAC;oBACnC,qBAAqB,EAAE,KAAK,CAAC,0BAA0B,CAAC;oBACxD,QAAQ,EAAE,KAAK,CAAC,WAAW,CAAC;oBAC5B,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC;iBACtB,CAAC,CAAC;gBACH,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC;gBACnC,IAAI,WAAW,EAAE,CAAC;oBAChB,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;oBAC1B,OAAO;gBACT,CAAC;gBACD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;gBACvB,OAAO;YACT,CAAC;YAAC,MAAM,CAAC;gBACP,kBAAkB;YACpB,CAAC;QACH,CAAC;QAED,IAAI,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,EAAE,CAAC;YAChC,MAAM,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YACxC,OAAO;QACT,CAAC;QAED,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC;QACnC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IACzB,CAAC;IAED,oFAAoF;IAC5E,aAAa,CAAC,GAAY;QAChC,OAAO,IAAA,sCAAkB,EAAC,GAAG,CAAC,CAAC;IACjC,CAAC;IAEO,YAAY,CAAC,GAAY;QAC/B,MAAM,IAAI,GAAG,GAAG,CAAC,IAA2C,CAAC;QAC7D,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YACtC,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,OAAO,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAC7F,CAAC;IACJ,CAAC;CACF,CAAA;AAlTY,8CAAiB;AAatB;IAFL,IAAA,YAAG,EAAC,kCAAkC,CAAC;IACvC,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,mCAAmC,EAAE,CAAC;IACnC,mBAAA,IAAA,YAAG,GAAE,CAAA;;;;6DAchC;AAIK;IAFL,IAAA,YAAG,EAAC,wCAAwC,CAAC;IAC7C,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,oDAAoD,EAAE,CAAC;IACrC,mBAAA,IAAA,YAAG,GAAE,CAAA;;;;4EAE/C;AAID;IAFC,IAAA,YAAG,EAAC,uBAAuB,CAAC;IAC5B,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,8DAA8D,EAAE,CAAC;;;;wDAGzF;AAIK;IAFL,IAAA,aAAI,EAAC,wBAAwB,CAAC;IAC9B,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,gDAAgD,EAAE,CAAC;IAEzE,mBAAA,IAAA,aAAI,GAAE,CAAA;IACN,mBAAA,IAAA,YAAG,GAAE,CAAA;IACL,mBAAA,IAAA,YAAG,EAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAA;;;;sDAuB5B;AAIK;IAFL,IAAA,YAAG,EAAC,mBAAmB,CAAC;IACxB,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,oEAAoE,EAAE,CAAC;IAE7F,mBAAA,IAAA,cAAK,GAAE,CAAA;IACP,mBAAA,IAAA,YAAG,GAAE,CAAA;IACL,mBAAA,IAAA,YAAG,GAAE,CAAA;;;;kDA4BP;AAQK;IAFL,IAAA,YAAG,EAAC,wBAAwB,CAAC;IAC7B,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,yDAAyD,EAAE,CAAC;IAC9D,mBAAA,IAAA,YAAG,GAAE,CAAA;IAAgB,mBAAA,IAAA,YAAG,GAAE,CAAA;;;;wDAKhD;AASK;IAFL,IAAA,YAAG,EAAC,CAAC,kBAAkB,EAAE,0BAA0B,CAAC,CAAC;IACrD,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,oDAAoD,EAAE,CAAC;IACzD,mBAAA,IAAA,YAAG,GAAE,CAAA;IAAgB,mBAAA,IAAA,YAAG,GAAE,CAAA;;;;wDAKhD;AAIK;IAFL,IAAA,YAAG,EAAC,+BAA+B,CAAC;IACpC,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,gDAAgD,EAAE,CAAC;IAEzE,mBAAA,IAAA,cAAK,EAAC,aAAa,CAAC,CAAA;IACpB,mBAAA,IAAA,cAAK,EAAC,MAAM,CAAC,CAAA;IACb,mBAAA,IAAA,cAAK,EAAC,OAAO,CAAC,CAAA;IACd,mBAAA,IAAA,cAAK,EAAC,OAAO,CAAC,CAAA;IACd,mBAAA,IAAA,YAAG,GAAE,CAAA;;;;yDAkBP;AAIK;IAFL,IAAA,aAAI,EAAC,eAAe,CAAC;IACrB,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,kEAAkE,EAAE,CAAC;IACjF,mBAAA,IAAA,YAAG,GAAE,CAAA;IAAgB,mBAAA,IAAA,YAAG,GAAE,CAAA;;;;8CA4BtC;AAIK;IAFL,IAAA,YAAG,EAAC,kBAAkB,CAAC;IACvB,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,qCAAqC,EAAE,CAAC;IACjD,mBAAA,IAAA,YAAG,GAAE,CAAA;IAAgB,mBAAA,IAAA,YAAG,GAAE,CAAA;;;;iDA8BzC;AAIK;IAFL,IAAA,aAAI,EAAC,oBAAoB,CAAC;IAC1B,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,kDAAkD,EAAE,CAAC;IAChE,mBAAA,IAAA,YAAG,GAAE,CAAA;IAAgB,mBAAA,IAAA,YAAG,GAAE,CAAA;;;;+CAsBvC;AAIK;IAFL,IAAA,YAAG,EAAC,oBAAoB,CAAC;IACzB,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,sCAAsC,EAAE,CAAC;IAE/D,mBAAA,IAAA,cAAK,GAAE,CAAA;IACP,mBAAA,IAAA,YAAG,GAAE,CAAA;IACL,mBAAA,IAAA,YAAG,GAAE,CAAA;;;;mDAgCP;4BAjSU,iBAAiB;IAJ7B,IAAA,iBAAO,EAAC,SAAS,CAAC;IAClB,IAAA,yBAAM,GAAE;IACR,IAAA,mBAAU,EAAC,4DAA2B,CAAC;IACvC,IAAA,mBAAU,GAAE;6CAGe,6CAAoB;QACf,wDAAyB;QAC/B,0BAAW;QACR,uCAAiB;QAClB,4BAAY;QACL,6CAAoB;QACtB,4DAA2B;GARhD,iBAAiB,CAkT7B;AAED,YAAY"}

package/security/src/lib/oauth/oauth-bff.util.d.ts

@@ -0,0 +1,9 @@
+import type { OAuthTokenResponse } from './platform-oauth.types';
+export declare function isBffPureModeEnabled(): boolean;
+export declare function buildOAuthTokenResponseBody(input: {
+    accessToken: string;
+    refreshToken: string;
+    idToken: string;
+    expiresIn: number;
+}): OAuthTokenResponse;
+//# sourceMappingURL=oauth-bff.util.d.ts.map

package/security/src/lib/oauth/oauth-bff.util.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-bff.util.d.ts","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/oauth/oauth-bff.util.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAEjE,wBAAgB,oBAAoB,IAAI,OAAO,CAM9C;AAED,wBAAgB,2BAA2B,CAAC,KAAK,EAAE;IACjD,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;CACnB,GAAG,kBAAkB,CAgBrB"}

package/security/src/lib/oauth/oauth-bff.util.js

@@ -0,0 +1,30 @@
+"use strict";
+//#region ---- Pure BFF OAuth token response helpers ----
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isBffPureModeEnabled = isBffPureModeEnabled;
+exports.buildOAuthTokenResponseBody = buildOAuthTokenResponseBody;
+function isBffPureModeEnabled() {
+    const raw = process.env['AUTH_BFF_PURE']?.trim()?.toLowerCase();
+    if (raw === 'false' || raw === '0') {
+        return false;
+    }
+    return true;
+}
+function buildOAuthTokenResponseBody(input) {
+    if (isBffPureModeEnabled()) {
+        return {
+            token_type: 'Bearer',
+            expires_in: input.expiresIn,
+            id_token: input.idToken,
+        };
+    }
+    return {
+        access_token: input.accessToken,
+        refresh_token: input.refreshToken,
+        id_token: input.idToken,
+        token_type: 'Bearer',
+        expires_in: input.expiresIn,
+    };
+}
+//#endregion
+//# sourceMappingURL=oauth-bff.util.js.map

package/security/src/lib/oauth/oauth-bff.util.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-bff.util.js","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/oauth/oauth-bff.util.ts"],"names":[],"mappings":";AAAA,yDAAyD;;AAIzD,oDAMC;AAED,kEAqBC;AA7BD,SAAgB,oBAAoB;IAClC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,IAAI,EAAE,EAAE,WAAW,EAAE,CAAC;IAChE,IAAI,GAAG,KAAK,OAAO,IAAI,GAAG,KAAK,GAAG,EAAE,CAAC;QACnC,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAgB,2BAA2B,CAAC,KAK3C;IACC,IAAI,oBAAoB,EAAE,EAAE,CAAC;QAC3B,OAAO;YACL,UAAU,EAAE,QAAQ;YACpB,UAAU,EAAE,KAAK,CAAC,SAAS;YAC3B,QAAQ,EAAE,KAAK,CAAC,OAAO;SACxB,CAAC;IACJ,CAAC;IAED,OAAO;QACL,YAAY,EAAE,KAAK,CAAC,WAAW;QAC/B,aAAa,EAAE,KAAK,CAAC,YAAY;QACjC,QAAQ,EAAE,KAAK,CAAC,OAAO;QACvB,UAAU,EAAE,QAAQ;QACpB,UAAU,EAAE,KAAK,CAAC,SAAS;KAC5B,CAAC;AACJ,CAAC;AAED,YAAY"}

package/security/src/lib/oauth/oauth-claims.util.d.ts

@@ -0,0 +1,6 @@
+/** OIDC reserved claims that must not be overridden by organization adapters. */
+export declare const RESERVED_OIDC_CLAIMS: Set<string>;
+/** RFC 9068 reserved access-token claims. */
+export declare const RESERVED_ACCESS_TOKEN_CLAIMS: Set<string>;
+export declare function assertAllowedClaimInputs(claims: Record<string, unknown>, allowed: Set<string>, context: string): void;
+//# sourceMappingURL=oauth-claims.util.d.ts.map

package/security/src/lib/oauth/oauth-claims.util.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-claims.util.d.ts","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/oauth/oauth-claims.util.ts"],"names":[],"mappings":"AAEA,iFAAiF;AACjF,eAAO,MAAM,oBAAoB,aAa/B,CAAC;AAEH,6CAA6C;AAC7C,eAAO,MAAM,4BAA4B,aAKvC,CAAC;AAEH,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,EACpB,OAAO,EAAE,MAAM,GACd,IAAI,CAMN"}

package/security/src/lib/oauth/oauth-claims.util.js

@@ -0,0 +1,36 @@
+"use strict";
+//#region ---- OAuth token claims helpers ----
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RESERVED_ACCESS_TOKEN_CLAIMS = exports.RESERVED_OIDC_CLAIMS = void 0;
+exports.assertAllowedClaimInputs = assertAllowedClaimInputs;
+/** OIDC reserved claims that must not be overridden by organization adapters. */
+exports.RESERVED_OIDC_CLAIMS = new Set([
+    'iss',
+    'sub',
+    'aud',
+    'exp',
+    'iat',
+    'auth_time',
+    'nonce',
+    'acr',
+    'amr',
+    'azp',
+    'at_hash',
+    'c_hash',
+]);
+/** RFC 9068 reserved access-token claims. */
+exports.RESERVED_ACCESS_TOKEN_CLAIMS = new Set([
+    ...exports.RESERVED_OIDC_CLAIMS,
+    'typ',
+    'client_id',
+    'scope',
+]);
+function assertAllowedClaimInputs(claims, allowed, context) {
+    for (const key of Object.keys(claims)) {
+        if (!allowed.has(key)) {
+            throw new Error(`Claim "${key}" is not allowed (${context}).`);
+        }
+    }
+}
+//#endregion
+//# sourceMappingURL=oauth-claims.util.js.map