@acorex-platform/framework-server 0.0.33 → 0.0.37

package/security/src/lib/oauth/oauth-rp.service.js

@@ -0,0 +1,371 @@
+"use strict";
+var OAuthRpService_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OAuthRpService = void 0;
+const tslib_1 = require("tslib");
+const common_1 = require("@nestjs/common");
+const crypto_1 = require("crypto");
+const jwt = tslib_1.__importStar(require("jsonwebtoken"));
+let OAuthRpService = OAuthRpService_1 = class OAuthRpService {
+    constructor() {
+        this.logger = new common_1.Logger(OAuthRpService_1.name);
+        this.jwksCache = new Map();
+        this.jwksTtlMs = Number(process.env['AUTH_OAUTH_JWKS_CACHE_TTL_MS'] ?? 900_000);
+    }
+    /**
+     * Builds external IdP authorization URL.
+     * This service is RP-only: no session/token issuance.
+     */
+    buildAuthorizationUrl(broker, callbackUrl, state, nonce) {
+        const params = new URLSearchParams({
+            client_id: broker.clientId,
+            redirect_uri: callbackUrl,
+            response_type: 'code',
+            scope: broker.scopes,
+            state,
+            access_type: 'online',
+            prompt: 'select_account',
+        });
+        if (nonce?.trim()) {
+            params.set('nonce', nonce.trim());
+        }
+        return `${broker.authorizationUrl}?${params.toString()}`;
+    }
+    /**
+     * Exchanges external authorization code for token response.
+     * Returns raw id_token (if present) and access_token (for UserInfo fallback).
+     */
+    async exchangeCode(broker, code, callbackUrl) {
+        const body = new URLSearchParams({
+            code,
+            client_id: broker.clientId,
+            client_secret: broker.clientSecret,
+            redirect_uri: callbackUrl,
+            grant_type: 'authorization_code',
+        });
+        const tokenResponse = await fetch(broker.tokenUrl, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+            body: body.toString(),
+        });
+        if (!tokenResponse.ok) {
+            const detail = await tokenResponse.text().catch(() => '');
+            this.logger.warn(`External token exchange failed: ${detail}`);
+            throw new common_1.UnauthorizedException('External authorization failed.');
+        }
+        const tokenData = (await tokenResponse.json());
+        const accessToken = tokenData.access_token;
+        if (!accessToken) {
+            throw new common_1.UnauthorizedException('External authorization failed (missing access_token).');
+        }
+        return { idToken: tokenData.id_token, accessToken };
+    }
+    /**
+     * Verifies external id_token using external JWKS (fetched from issuer).
+     * Validates audience + nonce (when expectedNonce is provided) and returns normalized profile.
+     * When JWKS is unreachable for Google (common corporate/geo blocks on
+     * `www.googleapis.com/.../certs`), falls back to Google `tokeninfo` over
+     * `oauth2.googleapis.com` which still cryptographically validates the JWT.
+     */
+    async verifyAndNormalizeIdToken(rawJwt, _broker, expectedNonce, expectedAudience) {
+        const parts = rawJwt.split('.');
+        if (parts.length < 2) {
+            throw new common_1.UnauthorizedException('Invalid id_token.');
+        }
+        const header = JSON.parse(Buffer.from(parts[0], 'base64url').toString('utf8'));
+        const payload = JSON.parse(Buffer.from(parts[1], 'base64url').toString('utf8'));
+        const sub = payload.sub;
+        const issuer = payload.iss;
+        if (!sub || !issuer) {
+            throw new common_1.UnauthorizedException('Invalid id_token (missing sub/iss).');
+        }
+        const expectedIssuer = await this.resolveExpectedIssuer(_broker);
+        if (!this.issuersMatch(issuer, expectedIssuer)) {
+            this.logger.warn(`External id_token iss mismatch: token=${issuer} expected=${expectedIssuer}`);
+            throw new common_1.UnauthorizedException('Invalid issuer.');
+        }
+        const issuerUrl = this.normalizeIssuerUrl(issuer);
+        const kid = header.kid?.trim();
+        const alg = header.alg?.trim();
+        if (!alg) {
+            throw new common_1.UnauthorizedException('Invalid id_token (missing alg).');
+        }
+        try {
+            return await this.verifyIdTokenWithJwks(rawJwt, issuerUrl, alg, kid, expectedAudience, expectedNonce);
+        }
+        catch (error) {
+            if (!this.isGoogleIssuer(issuerUrl)) {
+                throw error;
+            }
+            this.logger.warn(`Google JWKS verify failed; falling back to tokeninfo: ${error instanceof Error ? error.message : String(error)}`);
+            try {
+                const profile = await this.verifyGoogleIdTokenViaTokenInfo(rawJwt, payload, issuerUrl, expectedAudience, expectedNonce);
+                this.logger.log('Google id_token verified via tokeninfo fallback');
+                return profile;
+            }
+            catch (fallbackError) {
+                this.logger.warn(`Google tokeninfo fallback failed: ${fallbackError instanceof Error ? fallbackError.message : String(fallbackError)}`);
+                throw fallbackError;
+            }
+        }
+    }
+    async verifyIdTokenWithJwks(rawJwt, issuerUrl, alg, kid, expectedAudience, expectedNonce) {
+        const jwks = await this.fetchJwksWithRotation(issuerUrl, kid);
+        const jwk = kid ? jwks.keys.find((k) => k.kid === kid) : jwks.keys[0];
+        if (!jwk) {
+            throw new common_1.UnauthorizedException('JWKS does not contain the expected key.');
+        }
+        let publicKey;
+        try {
+            publicKey = (0, crypto_1.createPublicKey)({ key: jwk, format: 'jwk' });
+        }
+        catch {
+            throw new common_1.UnauthorizedException('Invalid JWKS key.');
+        }
+        let verified;
+        try {
+            const verifyOptions = {
+                algorithms: [alg],
+                issuer: [issuerUrl, issuerUrl.replace(/^https:\/\//, '')],
+            };
+            if (expectedAudience?.trim()) {
+                verifyOptions.audience = expectedAudience.trim();
+            }
+            verified = jwt.verify(rawJwt, publicKey, verifyOptions);
+        }
+        catch (error) {
+            this.logger.warn(`External id_token verification failed: ${error instanceof Error ? error.message : String(error)}`);
+            throw new common_1.UnauthorizedException('Invalid or untrusted id_token.');
+        }
+        this.assertNonce(verified.nonce, expectedNonce);
+        return {
+            sub: verified.sub,
+            issuer: issuerUrl,
+            email: verified.email,
+            emailVerified: verified.email_verified,
+            name: verified.name,
+            picture: verified.picture,
+        };
+    }
+    /**
+     * Google tokeninfo validates the ID Token when local JWKS download is blocked
+     * (e.g. 403 on www.googleapis.com/oauth2/v3/certs).
+     * Prefer POST body so long JWTs are not truncated in the query string.
+     */
+    async verifyGoogleIdTokenViaTokenInfo(rawJwt, payload, issuerUrl, expectedAudience, expectedNonce) {
+        let response;
+        try {
+            response = await fetch('https://oauth2.googleapis.com/tokeninfo', {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+                body: new URLSearchParams({ id_token: rawJwt }).toString(),
+            });
+        }
+        catch (error) {
+            this.logger.warn(`Google tokeninfo request failed: ${error instanceof Error ? error.message : String(error)}`);
+            throw new common_1.UnauthorizedException('Google tokeninfo verification failed.');
+        }
+        let data;
+        try {
+            data = (await response.json());
+        }
+        catch {
+            throw new common_1.UnauthorizedException('Google tokeninfo verification failed.');
+        }
+        if (!response.ok || typeof data['error'] === 'string') {
+            this.logger.warn(`Google tokeninfo rejected id_token: HTTP ${response.status} error=${String(data['error'] ?? '')}`);
+            throw new common_1.UnauthorizedException('Invalid or untrusted id_token.');
+        }
+        const sub = typeof data['sub'] === 'string' ? data['sub'] : payload.sub;
+        if (!sub) {
+            throw new common_1.UnauthorizedException('Invalid id_token (missing sub/iss).');
+        }
+        const aud = data['aud'];
+        if (expectedAudience?.trim()) {
+            const audiences = Array.isArray(aud) ? aud : [aud];
+            if (!audiences.some((value) => value === expectedAudience.trim())) {
+                this.logger.warn(`Google tokeninfo aud mismatch: got=${JSON.stringify(aud)} expected=${expectedAudience}`);
+                throw new common_1.UnauthorizedException('Invalid or untrusted id_token.');
+            }
+        }
+        const expRaw = data['exp'] ?? payload.exp;
+        const exp = typeof expRaw === 'string' ? Number(expRaw) : typeof expRaw === 'number' ? expRaw : NaN;
+        if (!Number.isFinite(exp) || exp * 1000 <= Date.now()) {
+            throw new common_1.UnauthorizedException('Invalid or untrusted id_token.');
+        }
+        this.assertNonce(payload.nonce, expectedNonce);
+        const emailVerifiedRaw = data['email_verified'] ?? payload.email_verified;
+        const emailVerified = typeof emailVerifiedRaw === 'boolean'
+            ? emailVerifiedRaw
+            : emailVerifiedRaw === 'true'
+                ? true
+                : emailVerifiedRaw === 'false'
+                    ? false
+                    : undefined;
+        return {
+            sub,
+            issuer: issuerUrl,
+            email: typeof data['email'] === 'string' ? data['email'] : payload.email,
+            emailVerified,
+            name: typeof data['name'] === 'string' ? data['name'] : payload.name,
+            picture: typeof data['picture'] === 'string' ? data['picture'] : payload.picture,
+        };
+    }
+    assertNonce(actual, expectedNonce) {
+        if (!expectedNonce?.trim()) {
+            return;
+        }
+        if (!actual || actual !== expectedNonce.trim()) {
+            throw new common_1.UnauthorizedException('Invalid nonce.');
+        }
+    }
+    async fetchUserInfo(accessToken, userInfoUrl) {
+        const profileResponse = await fetch(userInfoUrl, {
+            headers: { Authorization: `Bearer ${accessToken}` },
+        });
+        if (!profileResponse.ok) {
+            throw new common_1.UnauthorizedException('External profile lookup failed.');
+        }
+        const data = (await profileResponse.json());
+        const emailVerifiedRaw = data['email_verified'];
+        const emailVerified = typeof emailVerifiedRaw === 'boolean' ? emailVerifiedRaw : undefined;
+        return {
+            sub: typeof data['sub'] === 'string' ? data['sub'] : undefined,
+            email: typeof data['email'] === 'string' ? data['email'] : undefined,
+            emailVerified,
+            name: typeof data['name'] === 'string' ? data['name'] : undefined,
+            picture: typeof data['picture'] === 'string' ? data['picture'] : undefined,
+        };
+    }
+    /**
+     * Resolves the OIDC issuer to compare against ID Token `iss`.
+     * Prefer configured `issuerUrl` — token endpoint origin is often wrong
+     * (Google: token at oauth2.googleapis.com, iss = accounts.google.com).
+     */
+    async resolveExpectedIssuer(broker) {
+        const configured = broker.issuerUrl?.trim()?.replace(/\/$/, '');
+        if (configured) {
+            return configured;
+        }
+        const discoveryOrigins = [];
+        for (const raw of [broker.authorizationUrl, broker.tokenUrl]) {
+            try {
+                const origin = new URL(raw).origin;
+                if (!discoveryOrigins.includes(origin)) {
+                    discoveryOrigins.push(origin);
+                }
+            }
+            catch {
+                /* ignore malformed URLs */
+            }
+        }
+        for (const origin of discoveryOrigins) {
+            try {
+                const response = await fetch(`${origin}/.well-known/openid-configuration`);
+                if (!response.ok) {
+                    continue;
+                }
+                const data = (await response.json());
+                if (typeof data['issuer'] === 'string' && data['issuer'].trim()) {
+                    return data['issuer'].replace(/\/$/, '');
+                }
+            }
+            catch (error) {
+                this.logger.warn(`External issuer discovery failed for ${origin}: ${error instanceof Error ? error.message : String(error)}`);
+            }
+        }
+        return discoveryOrigins[0] ?? new URL(broker.tokenUrl).origin;
+    }
+    /**
+     * Google historically issues both `https://accounts.google.com` and `accounts.google.com`.
+     */
+    issuersMatch(actual, expected) {
+        return this.normalizeIssuerUrl(actual) === this.normalizeIssuerUrl(expected);
+    }
+    normalizeIssuerUrl(issuer) {
+        const trimmed = issuer.trim().replace(/\/$/, '');
+        if (trimmed === 'accounts.google.com') {
+            return 'https://accounts.google.com';
+        }
+        if (!/^https?:\/\//i.test(trimmed) && trimmed.includes('.')) {
+            return `https://${trimmed}`;
+        }
+        return trimmed;
+    }
+    isGoogleIssuer(issuerUrl) {
+        return this.normalizeIssuerUrl(issuerUrl) === 'https://accounts.google.com';
+    }
+    async fetchJwksWithRotation(issuer, kid) {
+        const normalizedIssuer = this.normalizeIssuerUrl(issuer);
+        const cached = this.jwksCache.get(normalizedIssuer);
+        if (cached && cached.expiresAt > Date.now()) {
+            if (!kid || cached.keys.some((key) => key.kid === kid)) {
+                return { keys: cached.keys };
+            }
+        }
+        const fresh = await this.fetchJwks(normalizedIssuer);
+        this.jwksCache.set(normalizedIssuer, {
+            keys: fresh.keys,
+            expiresAt: Date.now() + this.jwksTtlMs,
+        });
+        if (kid && !fresh.keys.some((key) => key.kid === kid)) {
+            this.jwksCache.delete(normalizedIssuer);
+            const rotated = await this.fetchJwks(normalizedIssuer);
+            this.jwksCache.set(normalizedIssuer, {
+                keys: rotated.keys,
+                expiresAt: Date.now() + this.jwksTtlMs,
+            });
+            return rotated;
+        }
+        return fresh;
+    }
+    async fetchJwks(issuer) {
+        const base = this.normalizeIssuerUrl(issuer);
+        const discoveryUrl = `${base}/.well-known/openid-configuration`;
+        try {
+            const discovery = await fetch(discoveryUrl);
+            if (discovery.ok) {
+                const discoveryJson = (await discovery.json());
+                const jwksUri = typeof discoveryJson['jwks_uri'] === 'string' ? discoveryJson['jwks_uri'] : null;
+                if (jwksUri) {
+                    // Do not swallow JWKS URI failures — fall through to issuer jwks.json only when
+                    // discovery itself failed or omitted jwks_uri.
+                    return await this.fetchJwksFromUrl(jwksUri);
+                }
+            }
+        }
+        catch (error) {
+            if (error instanceof common_1.UnauthorizedException) {
+                throw error;
+            }
+            this.logger.warn(`External JWKS discovery failed for ${base}: ${error instanceof Error ? error.message : String(error)}`);
+        }
+        return await this.fetchJwksFromUrl(`${base}/.well-known/jwks.json`);
+    }
+    async fetchJwksFromUrl(jwksUrl) {
+        let response;
+        try {
+            response = await fetch(jwksUrl);
+        }
+        catch (error) {
+            this.logger.warn(`External JWKS request failed for ${jwksUrl}: ${error instanceof Error ? error.message : String(error)}`);
+            throw new common_1.UnauthorizedException('Failed to fetch external JWKS.');
+        }
+        if (!response.ok) {
+            this.logger.warn(`External JWKS HTTP ${response.status} for ${jwksUrl}`);
+            throw new common_1.UnauthorizedException('Failed to fetch external JWKS.');
+        }
+        const data = (await response.json());
+        const keys = Array.isArray(data.keys) ? data.keys : [];
+        if (keys.length === 0) {
+            throw new common_1.UnauthorizedException('External JWKS is empty.');
+        }
+        return { keys };
+    }
+};
+exports.OAuthRpService = OAuthRpService;
+exports.OAuthRpService = OAuthRpService = OAuthRpService_1 = tslib_1.__decorate([
+    (0, common_1.Injectable)()
+], OAuthRpService);
+//#endregion
+//# sourceMappingURL=oauth-rp.service.js.map

package/security/src/lib/oauth/oauth-rp.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-rp.service.js","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/oauth/oauth-rp.service.ts"],"names":[],"mappings":";;;;;AAAA,2CAA2E;AAC3E,mCAAyC;AACzC,0DAAoC;AA+B7B,IAAM,cAAc,sBAApB,MAAM,cAAc;IAApB;QACY,WAAM,GAAG,IAAI,eAAM,CAAC,gBAAc,CAAC,IAAI,CAAC,CAAC;QACzC,cAAS,GAAG,IAAI,GAAG,EAAsB,CAAC;QAC1C,cAAS,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAAC,IAAI,OAAO,CAAC,CAAC;IAwd9F,CAAC;IAtdC;;;OAGG;IACH,qBAAqB,CACnB,MAAwC,EACxC,WAAmB,EACnB,KAAa,EACb,KAAc;QAEd,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;YACjC,SAAS,EAAE,MAAM,CAAC,QAAQ;YAC1B,YAAY,EAAE,WAAW;YACzB,aAAa,EAAE,MAAM;YACrB,KAAK,EAAE,MAAM,CAAC,MAAM;YACpB,KAAK;YACL,WAAW,EAAE,QAAQ;YACrB,MAAM,EAAE,gBAAgB;SACzB,CAAC,CAAC;QAEH,IAAI,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC;YAClB,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QACpC,CAAC;QAED,OAAO,GAAG,MAAM,CAAC,gBAAgB,IAAI,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC;IAC3D,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,YAAY,CAChB,MAAwC,EACxC,IAAY,EACZ,WAAmB;QAEnB,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;YAC/B,IAAI;YACJ,SAAS,EAAE,MAAM,CAAC,QAAQ;YAC1B,aAAa,EAAE,MAAM,CAAC,YAAY;YAClC,YAAY,EAAE,WAAW;YACzB,UAAU,EAAE,oBAAoB;SACjC,CAAC,CAAC;QAEH,MAAM,aAAa,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,QAAQ,EAAE;YACjD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;YAChE,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE;SACtB,CAAC,CAAC;QAEH,IAAI,CAAC,aAAa,CAAC,EAAE,EAAE,CAAC;YACtB,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;YAC1D,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,mCAAmC,MAAM,EAAE,CAAC,CAAC;YAC9D,MAAM,IAAI,8BAAqB,CAAC,gCAAgC,CAAC,CAAC;QACpE,CAAC;QAED,MAAM,SAAS,GAAG,CAAC,MAAM,aAAa,CAAC,IAAI,EAAE,CAG5C,CAAC;QAEF,MAAM,WAAW,GAAG,SAAS,CAAC,YAAY,CAAC;QAC3C,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,IAAI,8BAAqB,CAAC,uDAAuD,CAAC,CAAC;QAC3F,CAAC;QAED,OAAO,EAAE,OAAO,EAAE,SAAS,CAAC,QAAQ,EAAE,WAAW,EAAE,CAAC;IACtD,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,yBAAyB,CAC7B,MAAc,EACd,OAAyC,EACzC,aAAsB,EACtB,gBAAyB;QAEzB,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACrB,MAAM,IAAI,8BAAqB,CAAC,mBAAmB,CAAC,CAAC;QACvD,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAc,CAAC;QAC5F,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAe,CAAC;QAE9F,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;QACxB,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC;QAC3B,IAAI,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;YACpB,MAAM,IAAI,8BAAqB,CAAC,qCAAqC,CAAC,CAAC;QACzE,CAAC;QAED,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,OAAO,CAAC,CAAC;QACjE,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,cAAc,CAAC,EAAE,CAAC;YAC/C,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,yCAAyC,MAAM,aAAa,cAAc,EAAE,CAAC,CAAC;YAC/F,MAAM,IAAI,8BAAqB,CAAC,iBAAiB,CAAC,CAAC;QACrD,CAAC;QAED,MAAM,SAAS,GAAG,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC;QAClD,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC;QAC/B,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC;QAC/B,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,MAAM,IAAI,8BAAqB,CAAC,iCAAiC,CAAC,CAAC;QACrE,CAAC;QAED,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,qBAAqB,CACrC,MAAM,EACN,SAAS,EACT,GAAG,EACH,GAAG,EACH,gBAAgB,EAChB,aAAa,CACd,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,CAAC;gBACpC,MAAM,KAAK,CAAC;YACd,CAAC;YAED,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,yDACE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CACvD,EAAE,CACH,CAAC;YACF,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,+BAA+B,CACxD,MAAM,EACN,OAAO,EACP,SAAS,EACT,gBAAgB,EAChB,aAAa,CACd,CAAC;gBACF,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,iDAAiD,CAAC,CAAC;gBACnE,OAAO,OAAO,CAAC;YACjB,CAAC;YAAC,OAAO,aAAa,EAAE,CAAC;gBACvB,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,qCACE,aAAa,YAAY,KAAK,CAAC,CAAC,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,aAAa,CAC/E,EAAE,CACH,CAAC;gBACF,MAAM,aAAa,CAAC;YACtB,CAAC;QACH,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,qBAAqB,CACjC,MAAc,EACd,SAAiB,EACjB,GAAW,EACX,GAAuB,EACvB,gBAAoC,EACpC,aAAiC;QAEjC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;QAC9D,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACtE,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,MAAM,IAAI,8BAAqB,CAAC,yCAAyC,CAAC,CAAC;QAC7E,CAAC;QAED,IAAI,SAAS,CAAC;QACd,IAAI,CAAC;YACH,SAAS,GAAG,IAAA,wBAAe,EAAC,EAAE,GAAG,EAAE,GAAU,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QAClE,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,8BAAqB,CAAC,mBAAmB,CAAC,CAAC;QACvD,CAAC;QAED,IAAI,QAA8C,CAAC;QACnD,IAAI,CAAC;YACH,MAAM,aAAa,GAAsB;gBACvC,UAAU,EAAE,CAAC,GAAoB,CAAC;gBAClC,MAAM,EAAE,CAAC,SAAS,EAAE,SAAS,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC;aAC1D,CAAC;YAEF,IAAI,gBAAgB,EAAE,IAAI,EAAE,EAAE,CAAC;gBAC7B,aAAa,CAAC,QAAQ,GAAG,gBAAgB,CAAC,IAAI,EAAE,CAAC;YACnD,CAAC;YAED,QAAQ,GAAG,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,EAAE,aAAa,CAAyC,CAAC;QAClG,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,0CAA0C,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CACnG,CAAC;YACF,MAAM,IAAI,8BAAqB,CAAC,gCAAgC,CAAC,CAAC;QACpE,CAAC;QAED,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC;QAEhD,OAAO;YACL,GAAG,EAAE,QAAQ,CAAC,GAAI;YAClB,MAAM,EAAE,SAAS;YACjB,KAAK,EAAE,QAAQ,CAAC,KAAK;YACrB,aAAa,EAAE,QAAQ,CAAC,cAAc;YACtC,IAAI,EAAE,QAAQ,CAAC,IAAI;YACnB,OAAO,EAAE,QAAQ,CAAC,OAAO;SAC1B,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,+BAA+B,CAC3C,MAAc,EACd,OAAmB,EACnB,SAAiB,EACjB,gBAAoC,EACpC,aAAiC;QAEjC,IAAI,QAAkB,CAAC;QACvB,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,KAAK,CAAC,yCAAyC,EAAE;gBAChE,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;gBAChE,IAAI,EAAE,IAAI,eAAe,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;aAC3D,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,oCAAoC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAC7F,CAAC;YACF,MAAM,IAAI,8BAAqB,CAAC,uCAAuC,CAAC,CAAC;QAC3E,CAAC;QAED,IAAI,IAA6B,CAAC;QAClC,IAAI,CAAC;YACH,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAA4B,CAAC;QAC5D,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,8BAAqB,CAAC,uCAAuC,CAAC,CAAC;QAC3E,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;YACtD,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,4CAA4C,QAAQ,CAAC,MAAM,UAAU,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,EAAE,CACnG,CAAC;YACF,MAAM,IAAI,8BAAqB,CAAC,gCAAgC,CAAC,CAAC;QACpE,CAAC;QAED,MAAM,GAAG,GAAG,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC;QACxE,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,MAAM,IAAI,8BAAqB,CAAC,qCAAqC,CAAC,CAAC;QACzE,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;QACxB,IAAI,gBAAgB,EAAE,IAAI,EAAE,EAAE,CAAC;YAC7B,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YACnD,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,gBAAgB,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;gBAClE,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,sCAAsC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,aAAa,gBAAgB,EAAE,CACzF,CAAC;gBACF,MAAM,IAAI,8BAAqB,CAAC,gCAAgC,CAAC,CAAC;YACpE,CAAC;QACH,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC;QAC1C,MAAM,GAAG,GAAG,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC;QACpG,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,IAAI,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YACtD,MAAM,IAAI,8BAAqB,CAAC,gCAAgC,CAAC,CAAC;QACpE,CAAC;QAED,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC;QAE/C,MAAM,gBAAgB,GAAG,IAAI,CAAC,gBAAgB,CAAC,IAAI,OAAO,CAAC,cAAc,CAAC;QAC1E,MAAM,aAAa,GACjB,OAAO,gBAAgB,KAAK,SAAS;YACnC,CAAC,CAAC,gBAAgB;YAClB,CAAC,CAAC,gBAAgB,KAAK,MAAM;gBAC3B,CAAC,CAAC,IAAI;gBACN,CAAC,CAAC,gBAAgB,KAAK,OAAO;oBAC5B,CAAC,CAAC,KAAK;oBACP,CAAC,CAAC,SAAS,CAAC;QAEpB,OAAO;YACL,GAAG;YACH,MAAM,EAAE,SAAS;YACjB,KAAK,EAAE,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK;YACxE,aAAa;YACb,IAAI,EAAE,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI;YACpE,OAAO,EAAE,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO;SACjF,CAAC;IACJ,CAAC;IAEO,WAAW,CAAC,MAA0B,EAAE,aAAiC;QAC/E,IAAI,CAAC,aAAa,EAAE,IAAI,EAAE,EAAE,CAAC;YAC3B,OAAO;QACT,CAAC;QACD,IAAI,CAAC,MAAM,IAAI,MAAM,KAAK,aAAa,CAAC,IAAI,EAAE,EAAE,CAAC;YAC/C,MAAM,IAAI,8BAAqB,CAAC,gBAAgB,CAAC,CAAC;QACpD,CAAC;IACH,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,WAAmB,EAAE,WAAmB;QAC1D,MAAM,eAAe,GAAG,MAAM,KAAK,CAAC,WAAW,EAAE;YAC/C,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,WAAW,EAAE,EAAE;SACpD,CAAC,CAAC;QAEH,IAAI,CAAC,eAAe,CAAC,EAAE,EAAE,CAAC;YACxB,MAAM,IAAI,8BAAqB,CAAC,iCAAiC,CAAC,CAAC;QACrE,CAAC;QAED,MAAM,IAAI,GAAG,CAAC,MAAM,eAAe,CAAC,IAAI,EAAE,CAA4B,CAAC;QAEvE,MAAM,gBAAgB,GAAG,IAAI,CAAC,gBAAgB,CAAC,CAAC;QAChD,MAAM,aAAa,GAAG,OAAO,gBAAgB,KAAK,SAAS,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,SAAS,CAAC;QAE3F,OAAO;YACL,GAAG,EAAE,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS;YAC9D,KAAK,EAAE,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS;YACpE,aAAa;YACb,IAAI,EAAE,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS;YACjE,OAAO,EAAE,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS;SAC3E,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,qBAAqB,CAAC,MAAwC;QAC1E,MAAM,UAAU,GAAG,MAAM,CAAC,SAAS,EAAE,IAAI,EAAE,EAAE,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAChE,IAAI,UAAU,EAAE,CAAC;YACf,OAAO,UAAU,CAAC;QACpB,CAAC;QAED,MAAM,gBAAgB,GAAa,EAAE,CAAC;QACtC,KAAK,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,gBAAgB,EAAE,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC7D,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;gBACnC,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;oBACvC,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBAChC,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,2BAA2B;YAC7B,CAAC;QACH,CAAC;QAED,KAAK,MAAM,MAAM,IAAI,gBAAgB,EAAE,CAAC;YACtC,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,MAAM,mCAAmC,CAAC,CAAC;gBAC3E,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;oBACjB,SAAS;gBACX,CAAC;gBACD,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAA4B,CAAC;gBAChE,IAAI,OAAO,IAAI,CAAC,QAAQ,CAAC,KAAK,QAAQ,IAAI,IAAI,CAAC,QAAQ,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;oBAChE,OAAO,IAAI,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;gBAC3C,CAAC;YACH,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,wCAAwC,MAAM,KAC5C,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CACvD,EAAE,CACH,CAAC;YACJ,CAAC;QACH,CAAC;QAED,OAAO,gBAAgB,CAAC,CAAC,CAAC,IAAI,IAAI,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC;IAChE,CAAC;IAED;;OAEG;IACK,YAAY,CAAC,MAAc,EAAE,QAAgB;QACnD,OAAO,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC;IAC/E,CAAC;IAEO,kBAAkB,CAAC,MAAc;QACvC,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACjD,IAAI,OAAO,KAAK,qBAAqB,EAAE,CAAC;YACtC,OAAO,6BAA6B,CAAC;QACvC,CAAC;QACD,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAC5D,OAAO,WAAW,OAAO,EAAE,CAAC;QAC9B,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAEO,cAAc,CAAC,SAAiB;QACtC,OAAO,IAAI,CAAC,kBAAkB,CAAC,SAAS,CAAC,KAAK,6BAA6B,CAAC;IAC9E,CAAC;IAEO,KAAK,CAAC,qBAAqB,CACjC,MAAc,EACd,GAAY;QAEZ,MAAM,gBAAgB,GAAG,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC;QACzD,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;QACpD,IAAI,MAAM,IAAI,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YAC5C,IAAI,CAAC,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,KAAK,GAAG,CAAC,EAAE,CAAC;gBACvD,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;YAC/B,CAAC;QACH,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC;QACrD,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,gBAAgB,EAAE;YACnC,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,SAAS;SACvC,CAAC,CAAC;QAEH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,KAAK,GAAG,CAAC,EAAE,CAAC;YACtD,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;YACxC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC;YACvD,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,gBAAgB,EAAE;gBACnC,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,SAAS;aACvC,CAAC,CAAC;YACH,OAAO,OAAO,CAAC;QACjB,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAEO,KAAK,CAAC,SAAS,CAAC,MAAc;QACpC,MAAM,IAAI,GAAG,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC;QAC7C,MAAM,YAAY,GAAG,GAAG,IAAI,mCAAmC,CAAC;QAEhE,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC,YAAY,CAAC,CAAC;YAC5C,IAAI,SAAS,CAAC,EAAE,EAAE,CAAC;gBACjB,MAAM,aAAa,GAAG,CAAC,MAAM,SAAS,CAAC,IAAI,EAAE,CAA4B,CAAC;gBAC1E,MAAM,OAAO,GAAG,OAAO,aAAa,CAAC,UAAU,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,aAAa,CAAC,UAAU,CAAY,CAAC,CAAC,CAAC,IAAI,CAAC;gBAC7G,IAAI,OAAO,EAAE,CAAC;oBACZ,gFAAgF;oBAChF,+CAA+C;oBAC/C,OAAO,MAAM,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;gBAC9C,CAAC;YACH,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,8BAAqB,EAAE,CAAC;gBAC3C,MAAM,KAAK,CAAC;YACd,CAAC;YACD,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,sCAAsC,IAAI,KACxC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CACvD,EAAE,CACH,CAAC;QACJ,CAAC;QAED,OAAO,MAAM,IAAI,CAAC,gBAAgB,CAAC,GAAG,IAAI,wBAAwB,CAAC,CAAC;IACtE,CAAC;IAEO,KAAK,CAAC,gBAAgB,CAAC,OAAe;QAC5C,IAAI,QAAkB,CAAC;QACvB,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,CAAC;QAClC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,oCAAoC,OAAO,KACzC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CACvD,EAAE,CACH,CAAC;YACF,MAAM,IAAI,8BAAqB,CAAC,gCAAgC,CAAC,CAAC;QACpE,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,sBAAsB,QAAQ,CAAC,MAAM,QAAQ,OAAO,EAAE,CAAC,CAAC;YACzE,MAAM,IAAI,8BAAqB,CAAC,gCAAgC,CAAC,CAAC;QACpE,CAAC;QAED,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAyB,CAAC;QAC7D,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QACvD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtB,MAAM,IAAI,8BAAqB,CAAC,yBAAyB,CAAC,CAAC;QAC7D,CAAC;QAED,OAAO,EAAE,IAAI,EAAE,CAAC;IAClB,CAAC;CACF,CAAA;AA3dY,wCAAc;yBAAd,cAAc;IAD1B,IAAA,mBAAU,GAAE;GACA,cAAc,CA2d1B;AAED,YAAY"}

package/security/src/lib/oauth/oauth-rp.types.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Output of the RP after full cryptographic verification + normalization.
+ * This must not depend on OAuth/OpenID provider protocol engine packages.
+ */
+export interface VerifiedExternalOidcProfile {
+    /**
+     * Subject identifier (OIDC `sub`) from the external IdP.
+     */
+    sub: string;
+    /**
+     * External issuer (`iss`) after strict validation.
+     */
+    issuer: string;
+    /**
+     * Primary email (if provided by the external profile).
+     */
+    email?: string;
+    /**
+     * External `email_verified` claim (if present).
+     */
+    emailVerified?: boolean;
+    name?: string;
+    picture?: string;
+}
+//# sourceMappingURL=oauth-rp.types.d.ts.map

package/security/src/lib/oauth/oauth-rp.types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-rp.types.d.ts","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/oauth/oauth-rp.types.ts"],"names":[],"mappings":"AAEA;;;GAGG;AACH,MAAM,WAAW,2BAA2B;IAC1C;;OAEG;IACH,GAAG,EAAE,MAAM,CAAC;IAEZ;;OAEG;IACH,MAAM,EAAE,MAAM,CAAC;IAEf;;OAEG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IAEf;;OAEG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC;IAExB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB"}

package/security/src/lib/oauth/oauth-rp.types.js

@@ -0,0 +1,5 @@
+"use strict";
+//#region ---- OAuth RP (Relying Party) types ----
+Object.defineProperty(exports, "__esModule", { value: true });
+//#endregion
+//# sourceMappingURL=oauth-rp.types.js.map

package/security/src/lib/oauth/oauth-rp.types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-rp.types.js","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/oauth/oauth-rp.types.ts"],"names":[],"mappings":";AAAA,kDAAkD;;AA+BlD,YAAY"}

package/security/src/lib/oauth/oidc-provider-engine.service.d.ts

@@ -0,0 +1,25 @@
+import { OnModuleInit } from '@nestjs/common';
+import type { Request, Response } from 'express';
+import { AuthLocalCredentialsService } from '../auth/auth-local-credentials.service';
+import { TokenService } from '../auth/token.service';
+import { OAuthClientRegistryService } from './oauth-client-registry.service';
+export declare class OidcProviderEngineService implements OnModuleInit {
+    private readonly clients;
+    private readonly credentials;
+    private readonly tokens;
+    private readonly logger;
+    private provider;
+    private callbackHandler;
+    private issuer;
+    constructor(clients: OAuthClientRegistryService, credentials: AuthLocalCredentialsService, tokens: TokenService);
+    onModuleInit(): Promise<void>;
+    isEnabled(): boolean;
+    getIssuer(): string;
+    getDiscoveryDocument(): Promise<Record<string, unknown> | null>;
+    /**
+     * Forwards an Express request to oidc-provider (paths must be issuer-relative, without `/api` prefix).
+     */
+    forward(req: Request, res: Response): Promise<void>;
+    private bootstrapProvider;
+}
+//# sourceMappingURL=oidc-provider-engine.service.d.ts.map

package/security/src/lib/oauth/oidc-provider-engine.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oidc-provider-engine.service.d.ts","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/oauth/oidc-provider-engine.service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAsB,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAClE,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAGjD,OAAO,EAAE,2BAA2B,EAAE,MAAM,wCAAwC,CAAC;AAErF,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,EAAE,0BAA0B,EAAE,MAAM,iCAAiC,CAAC;AA0B7E,qBACa,yBAA0B,YAAW,YAAY;IAO1D,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,WAAW;IAC5B,OAAO,CAAC,QAAQ,CAAC,MAAM;IARzB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA8C;IACrE,OAAO,CAAC,QAAQ,CAAqC;IACrD,OAAO,CAAC,eAAe,CAAqC;IAC5D,OAAO,CAAC,MAAM,CAAM;gBAGD,OAAO,EAAE,0BAA0B,EACnC,WAAW,EAAE,2BAA2B,EACxC,MAAM,EAAE,YAAY;IAGjC,YAAY,IAAI,OAAO,CAAC,IAAI,CAAC;IAcnC,SAAS,IAAI,OAAO;IAIpB,SAAS,IAAI,MAAM;IAIb,oBAAoB,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAQrE;;OAEG;IACG,OAAO,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;YAuB3C,iBAAiB;CA+HhC"}