@acorex-platform/framework-server 0.0.33 → 0.0.37

package/security/src/lib/auth/token.service.js

@@ -6,9 +6,82 @@ const tslib_1 = require("tslib");
 const common_1 = require("@nestjs/common");
 const jwt = tslib_1.__importStar(require("jsonwebtoken"));
 const crypto_1 = require("crypto");
+const oauth_issuer_util_1 = require("../oauth/oauth-issuer.util");
+const oauth_claims_util_1 = require("../oauth/oauth-claims.util");
+const auth_config_1 = require("./auth.config");
 let TokenService = TokenService_1 = class TokenService {
     constructor() {
         this.logger = new common_1.Logger(TokenService_1.name);
+        this.idTokenKeyPair = null;
+    }
+    getIdTokenKeyPair() {
+        if (this.idTokenKeyPair) {
+            return this.idTokenKeyPair;
+        }
+        const privateKeyFromEnv = process.env['JWT_PRIVATE_KEY']?.trim();
+        const publicKeyFromEnv = process.env['JWT_PUBLIC_KEY']?.trim();
+        let privateKeyPem;
+        let publicKeyPem;
+        if (privateKeyFromEnv && publicKeyFromEnv) {
+            privateKeyPem = privateKeyFromEnv;
+            publicKeyPem = publicKeyFromEnv;
+        }
+        else {
+            // Local/dev fallback: ephemeral keypair.
+            // Production deployments should set JWT_PRIVATE_KEY/JWT_PUBLIC_KEY.
+            const generated = (0, crypto_1.generateKeyPairSync)('rsa', {
+                modulusLength: 2048,
+                publicKeyEncoding: { type: 'spki', format: 'pem' },
+                privateKeyEncoding: { type: 'pkcs8', format: 'pem' },
+            });
+            privateKeyPem = generated.privateKey;
+            publicKeyPem = generated.publicKey;
+        }
+        const publicKeyObject = (0, crypto_1.createPublicKey)(publicKeyPem);
+        const publicJwk = publicKeyObject.export({ format: 'jwk' });
+        const kid = (0, crypto_1.createHash)('sha256').update(publicKeyPem).digest('base64url');
+        this.idTokenKeyPair = {
+            privateKeyPem,
+            publicKeyPem,
+            publicJwk,
+            kid,
+        };
+        return this.idTokenKeyPair;
+    }
+    /**
+     * Public JWKS for OIDC discovery clients to validate Platform-issued `id_token`.
+     * Served by ConnectController `/.well-known/jwks.json` — never includes private material.
+     */
+    getJwks() {
+        const { publicJwk, kid } = this.getIdTokenKeyPair();
+        return {
+            keys: [
+                {
+                    ...publicJwk,
+                    use: 'sig',
+                    alg: 'RS256',
+                    kid,
+                },
+            ],
+        };
+    }
+    /**
+     * Private signing JWKS for in-process OpenID Provider engines (`oidc-provider`).
+     * Must not be exposed over HTTP.
+     */
+    getSigningJwks() {
+        const { privateKeyPem, kid } = this.getIdTokenKeyPair();
+        const privateJwk = (0, crypto_1.createPrivateKey)(privateKeyPem).export({ format: 'jwk' });
+        return {
+            keys: [
+                {
+                    ...privateJwk,
+                    use: 'sig',
+                    alg: 'RS256',
+                    kid,
+                },
+            ],
+        };
     }
     issueTokenResponse(user, context = {}) {
         const sessionId = context.sessionId ?? (0, crypto_1.randomUUID)();
@@ -17,9 +90,13 @@ let TokenService = TokenService_1 = class TokenService {
             username: user.name,
             type: 'access',
             sid: sessionId,
+            jti: (0, crypto_1.randomUUID)(),
+            typ: 'at+jwt',
+            aud: context.audience?.trim() || auth_config_1.PLATFORM_ACCESS_TOKEN_AUDIENCE,
             ...(context.tenantId ? { tid: context.tenantId } : {}),
             ...(context.applicationId ? { aid: context.applicationId } : {}),
         };
+        const persist = context.persist !== false;
         const refreshPayload = {
             sub: user.id,
             type: 'refresh',
@@ -27,6 +104,7 @@ let TokenService = TokenService_1 = class TokenService {
             sid: sessionId,
             ...(context.tenantId ? { tid: context.tenantId } : {}),
             ...(context.applicationId ? { aid: context.applicationId } : {}),
+            ...(persist ? { persist: true } : { persist: false }),
         };
         const accessToken = jwt.sign(accessPayload, this.jwtSecret(), {
             expiresIn: this.accessTokenTtl(),
@@ -39,18 +117,26 @@ let TokenService = TokenService_1 = class TokenService {
             refreshToken,
             expiresIn: this.accessTokenTtl(),
             sessionId,
+            persist,
             user,
             tenant: context.tenant ?? (context.tenantId ? { id: context.tenantId } : null),
             application: context.application ??
                 (context.applicationId ? { id: context.applicationId } : null),
         };
     }
-    verifyAccessToken(token) {
+    verifyAccessToken(token, expectedAudience) {
         try {
             const payload = jwt.verify(token, this.jwtSecret());
             if (payload.type !== 'access' || !payload.sub) {
                 throw new Error('Invalid access token');
             }
+            if (expectedAudience?.trim()) {
+                const aud = payload.aud;
+                const audiences = Array.isArray(aud) ? aud : aud ? [aud] : [];
+                if (!audiences.includes(expectedAudience.trim())) {
+                    throw new Error('Invalid access token audience');
+                }
+            }
             return payload;
         }
         catch {
@@ -69,6 +155,13 @@ let TokenService = TokenService_1 = class TokenService {
             throw new Error('Invalid or expired refresh token');
         }
     }
+    decodeIdTokenHint(token) {
+        const decoded = jwt.decode(token);
+        if (!decoded || typeof decoded !== 'object') {
+            return null;
+        }
+        return decoded;
+    }
     accessTokenMaxAgeMs() {
         return this.parseTtlToMs(this.accessTokenTtl());
     }
@@ -76,14 +169,18 @@ let TokenService = TokenService_1 = class TokenService {
         return Math.floor(this.accessTokenMaxAgeMs() / 1000);
     }
     issueIdToken(user, audience, claims = {}) {
-        const issuer = process.env['AUTH_OAUTH_ISSUER']?.trim()?.replace(/\/$/, '') ||
-            `http://localhost:${process.env['PORT']?.trim() || '5500'}/api`;
+        (0, oauth_claims_util_1.assertAllowedClaimInputs)(claims, new Set(['email', 'picture', 'nonce']), 'id_token');
+        const issuer = (0, oauth_issuer_util_1.resolveOAuthIssuer)();
+        const { privateKeyPem, kid } = this.getIdTokenKeyPair();
         return jwt.sign({
             sub: user.id,
             name: user.title,
             email: claims.email,
             picture: claims.picture,
-        }, this.jwtSecret(), {
+            ...(claims.nonce?.trim() ? { nonce: claims.nonce.trim() } : {}),
+        }, privateKeyPem, {
+            algorithm: 'RS256',
+            keyid: kid,
             expiresIn: this.accessTokenTtl(),
             issuer,
             audience,
@@ -95,6 +192,10 @@ let TokenService = TokenService_1 = class TokenService {
     jwtSecret() {
         const secret = process.env['JWT_SECRET']?.trim();
         if (!secret) {
+            const env = process.env['NODE_ENV']?.trim()?.toLowerCase() ?? '';
+            if (env === 'production') {
+                throw new Error('JWT_SECRET is not set (fail-closed in production).');
+            }
             this.logger.warn('JWT_SECRET is not set; using insecure development default');
             return 'acorex-dev-jwt-secret-change-me';
         }

package/security/src/lib/auth/token.service.js.map

@@ -1 +1 @@
-{"version":3,"file":"token.service.js","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/auth/token.service.ts"],"names":[],"mappings":";;;;;AAAA,2CAAoD;AACpD,0DAAoC;AACpC,mCAAoC;AAqB7B,IAAM,YAAY,oBAAlB,MAAM,YAAY;IAAlB;QACY,WAAM,GAAG,IAAI,eAAM,CAAC,cAAY,CAAC,IAAI,CAAC,CAAC;IAkI1D,CAAC;IAhIC,kBAAkB,CAAC,IAAiB,EAAE,UAA6B,EAAE;QACnE,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,IAAA,mBAAU,GAAE,CAAC;QACpD,MAAM,aAAa,GAAuB;YACxC,GAAG,EAAE,IAAI,CAAC,EAAE;YACZ,QAAQ,EAAE,IAAI,CAAC,IAAI;YACnB,IAAI,EAAE,QAAQ;YACd,GAAG,EAAE,SAAS;YACd,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACtD,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACjE,CAAC;QAEF,MAAM,cAAc,GAAwB;YAC1C,GAAG,EAAE,IAAI,CAAC,EAAE;YACZ,IAAI,EAAE,SAAS;YACf,GAAG,EAAE,IAAA,mBAAU,GAAE;YACjB,GAAG,EAAE,SAAS;YACd,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACtD,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACjE,CAAC;QAEF,MAAM,WAAW,GAAG,GAAG,CAAC,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,SAAS,EAAE,EAAE;YAC5D,SAAS,EAAE,IAAI,CAAC,cAAc,EAAkC;SACjE,CAAC,CAAC;QAEH,MAAM,YAAY,GAAG,GAAG,CAAC,IAAI,CAAC,cAAc,EAAE,IAAI,CAAC,SAAS,EAAE,EAAE;YAC9D,SAAS,EAAE,IAAI,CAAC,eAAe,EAAkC;SAClE,CAAC,CAAC;QAEH,OAAO;YACL,WAAW;YACX,YAAY;YACZ,SAAS,EAAE,IAAI,CAAC,cAAc,EAAE;YAChC,SAAS;YACT,IAAI;YACJ,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;YAC9E,WAAW,EACT,OAAO,CAAC,WAAW;gBACnB,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;SACjE,CAAC;IACJ,CAAC;IAED,iBAAiB,CAAC,KAAa;QAC7B,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,EAAE,CAAuB,CAAC;YAC1E,IAAI,OAAO,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;gBAC9C,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;YAC1C,CAAC;YACD,OAAO,OAAO,CAAC;QACjB,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;QACrD,CAAC;IACH,CAAC;IAED,kBAAkB,CAAC,KAAa;QAC9B,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,EAAE,CAAwB,CAAC;YAC3E,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;gBAC/D,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;YAC3C,CAAC;YACD,OAAO,OAAO,CAAC;QACjB,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;QACtD,CAAC;IACH,CAAC;IAED,mBAAmB;QACjB,OAAO,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC,CAAC;IAClD,CAAC;IAED,2BAA2B;QACzB,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,mBAAmB,EAAE,GAAG,IAAI,CAAC,CAAC;IACvD,CAAC;IAED,YAAY,CACV,IAAiB,EACjB,QAAgB,EAChB,SAA+C,EAAE;QAEjD,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,EAAE,IAAI,EAAE,EAAE,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;YACzE,oBAAoB,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,MAAM,MAAM,CAAC;QAElE,OAAO,GAAG,CAAC,IAAI,CACb;YACE,GAAG,EAAE,IAAI,CAAC,EAAE;YACZ,IAAI,EAAE,IAAI,CAAC,KAAK;YAChB,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,OAAO,EAAE,MAAM,CAAC,OAAO;SACxB,EACD,IAAI,CAAC,SAAS,EAAE,EAChB;YACE,SAAS,EAAE,IAAI,CAAC,cAAc,EAAkC;YAChE,MAAM;YACN,QAAQ;SACT,CACF,CAAC;IACJ,CAAC;IAED,oBAAoB;QAClB,OAAO,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC,CAAC;IACnD,CAAC;IAED,SAAS;QACP,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,CAAC;QACjD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,2DAA2D,CAAC,CAAC;YAC9E,OAAO,iCAAiC,CAAC;QAC3C,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,cAAc;QACZ,OAAO,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,EAAE,IAAI,EAAE,IAAI,KAAK,CAAC;IAC/D,CAAC;IAED,eAAe;QACb,OAAO,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC;IAC/D,CAAC;IAEO,YAAY,CAAC,GAAW;QAC9B,MAAM,KAAK,GAAG,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;QAClD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;QAC5B,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAC/B,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;QACpC,MAAM,WAAW,GAA2B,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC;QAChG,OAAO,KAAK,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC,CAAC;IAClD,CAAC;CACF,CAAA;AAnIY,oCAAY;uBAAZ,YAAY;IADxB,IAAA,mBAAU,GAAE;GACA,YAAY,CAmIxB;AAED,YAAY"}
+{"version":3,"file":"token.service.js","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/auth/token.service.ts"],"names":[],"mappings":";;;;;AAAA,2CAAoD;AACpD,0DAAoC;AACpC,mCAMgB;AAChB,kEAAgE;AAChE,kEAAsE;AACtE,+CAA+D;AAyBxD,IAAM,YAAY,oBAAlB,MAAM,YAAY;IAAlB;QACY,WAAM,GAAG,IAAI,eAAM,CAAC,cAAY,CAAC,IAAI,CAAC,CAAC;QAEhD,mBAAc,GAOX,IAAI,CAAC;IAyPlB,CAAC;IAvPS,iBAAiB;QACvB,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;YACxB,OAAO,IAAI,CAAC,cAAc,CAAC;QAC7B,CAAC;QAED,MAAM,iBAAiB,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,EAAE,IAAI,EAAE,CAAC;QACjE,MAAM,gBAAgB,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,EAAE,IAAI,EAAE,CAAC;QAE/D,IAAI,aAAqB,CAAC;QAC1B,IAAI,YAAoB,CAAC;QAEzB,IAAI,iBAAiB,IAAI,gBAAgB,EAAE,CAAC;YAC1C,aAAa,GAAG,iBAAiB,CAAC;YAClC,YAAY,GAAG,gBAAgB,CAAC;QAClC,CAAC;aAAM,CAAC;YACN,yCAAyC;YACzC,oEAAoE;YACpE,MAAM,SAAS,GAAG,IAAA,4BAAmB,EAAC,KAAK,EAAE;gBAC3C,aAAa,EAAE,IAAI;gBACnB,iBAAiB,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE;gBAClD,kBAAkB,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE;aACrD,CAAC,CAAC;YACH,aAAa,GAAG,SAAS,CAAC,UAAU,CAAC;YACrC,YAAY,GAAG,SAAS,CAAC,SAAS,CAAC;QACrC,CAAC;QAED,MAAM,eAAe,GAAG,IAAA,wBAAe,EAAC,YAAY,CAAC,CAAC;QACtD,MAAM,SAAS,GAAG,eAAe,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAA4B,CAAC;QAEvF,MAAM,GAAG,GAAG,IAAA,mBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QAE1E,IAAI,CAAC,cAAc,GAAG;YACpB,aAAa;YACb,YAAY;YACZ,SAAS;YACT,GAAG;SACJ,CAAC;QAEF,OAAO,IAAI,CAAC,cAAc,CAAC;IAC7B,CAAC;IAED;;;OAGG;IACH,OAAO;QACL,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACpD,OAAO;YACL,IAAI,EAAE;gBACJ;oBACE,GAAG,SAAS;oBACZ,GAAG,EAAE,KAAK;oBACV,GAAG,EAAE,OAAO;oBACZ,GAAG;iBACJ;aACF;SACF,CAAC;IACJ,CAAC;IAED;;;OAGG;IACH,cAAc;QACZ,MAAM,EAAE,aAAa,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACxD,MAAM,UAAU,GAAG,IAAA,yBAAgB,EAAC,aAAa,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAG1E,CAAC;QACF,OAAO;YACL,IAAI,EAAE;gBACJ;oBACE,GAAG,UAAU;oBACb,GAAG,EAAE,KAAK;oBACV,GAAG,EAAE,OAAO;oBACZ,GAAG;iBACJ;aACF;SACF,CAAC;IACJ,CAAC;IAED,kBAAkB,CAAC,IAAiB,EAAE,UAA6B,EAAE;QACnE,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,IAAA,mBAAU,GAAE,CAAC;QACpD,MAAM,aAAa,GAAuB;YACxC,GAAG,EAAE,IAAI,CAAC,EAAE;YACZ,QAAQ,EAAE,IAAI,CAAC,IAAI;YACnB,IAAI,EAAE,QAAQ;YACd,GAAG,EAAE,SAAS;YACd,GAAG,EAAE,IAAA,mBAAU,GAAE;YACjB,GAAG,EAAE,QAAQ;YACb,GAAG,EAAE,OAAO,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,4CAA8B;YAC/D,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACtD,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACjE,CAAC;QAEF,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,KAAK,KAAK,CAAC;QAE1C,MAAM,cAAc,GAAwB;YAC1C,GAAG,EAAE,IAAI,CAAC,EAAE;YACZ,IAAI,EAAE,SAAS;YACf,GAAG,EAAE,IAAA,mBAAU,GAAE;YACjB,GAAG,EAAE,SAAS;YACd,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACtD,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAChE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;SACtD,CAAC;QAEF,MAAM,WAAW,GAAG,GAAG,CAAC,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,SAAS,EAAE,EAAE;YAC5D,SAAS,EAAE,IAAI,CAAC,cAAc,EAAkC;SACjE,CAAC,CAAC;QAEH,MAAM,YAAY,GAAG,GAAG,CAAC,IAAI,CAAC,cAAc,EAAE,IAAI,CAAC,SAAS,EAAE,EAAE;YAC9D,SAAS,EAAE,IAAI,CAAC,eAAe,EAAkC;SAClE,CAAC,CAAC;QAEH,OAAO;YACL,WAAW;YACX,YAAY;YACZ,SAAS,EAAE,IAAI,CAAC,cAAc,EAAE;YAChC,SAAS;YACT,OAAO;YACP,IAAI;YACJ,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;YAC9E,WAAW,EACT,OAAO,CAAC,WAAW;gBACnB,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;SACjE,CAAC;IACJ,CAAC;IAED,iBAAiB,CAAC,KAAa,EAAE,gBAAyB;QACxD,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,EAAE,CAAuB,CAAC;YAC1E,IAAI,OAAO,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;gBAC9C,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;YAC1C,CAAC;YAED,IAAI,gBAAgB,EAAE,IAAI,EAAE,EAAE,CAAC;gBAC7B,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;gBACxB,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC9D,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,gBAAgB,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;oBACjD,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;gBACnD,CAAC;YACH,CAAC;YAED,OAAO,OAAO,CAAC;QACjB,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;QACrD,CAAC;IACH,CAAC;IAED,kBAAkB,CAAC,KAAa;QAC9B,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,EAAE,CAAwB,CAAC;YAC3E,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;gBAC/D,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;YAC3C,CAAC;YACD,OAAO,OAAO,CAAC;QACjB,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;QACtD,CAAC;IACH,CAAC;IAED,iBAAiB,CAAC,KAAa;QAC7B,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,CAA0C,CAAC;QAC3E,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;YAC5C,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,mBAAmB;QACjB,OAAO,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC,CAAC;IAClD,CAAC;IAED,2BAA2B;QACzB,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,mBAAmB,EAAE,GAAG,IAAI,CAAC,CAAC;IACvD,CAAC;IAED,YAAY,CACV,IAAiB,EACjB,QAAgB,EAChB,SAA+D,EAAE;QAEjE,IAAA,4CAAwB,EACtB,MAAiC,EACjC,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC,EACtC,UAAU,CACX,CAAC;QAEF,MAAM,MAAM,GAAG,IAAA,sCAAkB,GAAE,CAAC;QAEpC,MAAM,EAAE,aAAa,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAExD,OAAO,GAAG,CAAC,IAAI,CACb;YACE,GAAG,EAAE,IAAI,CAAC,EAAE;YACZ,IAAI,EAAE,IAAI,CAAC,KAAK;YAChB,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAChE,EACD,aAAa,EACb;YACE,SAAS,EAAE,OAAO;YAClB,KAAK,EAAE,GAAG;YACV,SAAS,EAAE,IAAI,CAAC,cAAc,EAAkC;YAChE,MAAM;YACN,QAAQ;SACT,CACF,CAAC;IACJ,CAAC;IAED,oBAAoB;QAClB,OAAO,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC,CAAC;IACnD,CAAC;IAED,SAAS;QACP,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,CAAC;QACjD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,IAAI,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;YACjE,IAAI,GAAG,KAAK,YAAY,EAAE,CAAC;gBACzB,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;YACxE,CAAC;YACD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,2DAA2D,CAAC,CAAC;YAC9E,OAAO,iCAAiC,CAAC;QAC3C,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,cAAc;QACZ,OAAO,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,EAAE,IAAI,EAAE,IAAI,KAAK,CAAC;IAC/D,CAAC;IAED,eAAe;QACb,OAAO,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC;IAC/D,CAAC;IAEO,YAAY,CAAC,GAAW;QAC9B,MAAM,KAAK,GAAG,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;QAClD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;QAC5B,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAC/B,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;QACpC,MAAM,WAAW,GAA2B,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC;QAChG,OAAO,KAAK,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC,CAAC;IAClD,CAAC;CACF,CAAA;AAnQY,oCAAY;uBAAZ,YAAY;IADxB,IAAA,mBAAU,GAAE;GACA,YAAY,CAmQxB;AAED,YAAY"}

package/security/src/lib/oauth/connect.controller.d.ts

@@ -1,30 +1,104 @@
 import type { Request, Response } from 'express';
+import { AuthService } from '../auth/auth.service';
+import { AuthLocalCredentialsService } from '../auth/auth-local-credentials.service';
 import { AuthCookieService } from '../auth/auth-cookie.service';
+import { TokenResolverService } from '../auth/token-resolver.service';
 import { TokenService } from '../auth/token.service';
 import { PlatformOAuthService } from './platform-oauth.service';
-import type { OAuthTokenResponse } from './platform-oauth.types';
+import { OidcProviderEngineService } from './oidc-provider-engine.service';
 export declare class ConnectController {
     private readonly oauth;
+    private readonly oidcEngine;
+    private readonly auth;
     private readonly cookies;
     private readonly tokens;
-    constructor(oauth: PlatformOAuthService, cookies: AuthCookieService, tokens: TokenService);
-    getDiscoveryDocument(req: Request): {
+    private readonly tokenResolver;
+    private readonly credentials;
+    constructor(oauth: PlatformOAuthService, oidcEngine: OidcProviderEngineService, auth: AuthService, cookies: AuthCookieService, tokens: TokenService, tokenResolver: TokenResolverService, credentials: AuthLocalCredentialsService);
+    getDiscoveryDocument(req: Request): Promise<{
         issuer: string;
         authorization_endpoint: string;
         token_endpoint: string;
         jwks_uri: string;
+        userinfo_endpoint: string;
+        revocation_endpoint: string;
+        end_session_endpoint: string;
         response_types_supported: string[];
         grant_types_supported: string[];
         code_challenge_methods_supported: string[];
         scopes_supported: string[];
-    };
+        subject_types_supported: string[];
+        id_token_signing_alg_values_supported: string[];
+    } | {
+        federation_authorize_init_endpoint: string;
+        issuer: string;
+        authorization_endpoint: string;
+        token_endpoint: string;
+        jwks_uri: string;
+        userinfo_endpoint: string;
+        revocation_endpoint: string;
+        end_session_endpoint: string;
+        response_types_supported: string[];
+        grant_types_supported: string[];
+        code_challenge_methods_supported: string[];
+        scopes_supported: string[];
+        subject_types_supported: string[];
+        id_token_signing_alg_values_supported: string[];
+    }>;
+    getOauthAuthorizationServerMetadata(req: Request): Promise<{
+        issuer: string;
+        authorization_endpoint: string;
+        token_endpoint: string;
+        jwks_uri: string;
+        userinfo_endpoint: string;
+        revocation_endpoint: string;
+        end_session_endpoint: string;
+        response_types_supported: string[];
+        grant_types_supported: string[];
+        code_challenge_methods_supported: string[];
+        scopes_supported: string[];
+        subject_types_supported: string[];
+        id_token_signing_alg_values_supported: string[];
+    } | {
+        federation_authorize_init_endpoint: string;
+        issuer: string;
+        authorization_endpoint: string;
+        token_endpoint: string;
+        jwks_uri: string;
+        userinfo_endpoint: string;
+        revocation_endpoint: string;
+        end_session_endpoint: string;
+        response_types_supported: string[];
+        grant_types_supported: string[];
+        code_challenge_methods_supported: string[];
+        scopes_supported: string[];
+        subject_types_supported: string[];
+        id_token_signing_alg_values_supported: string[];
+    }>;
     getJwksDocument(): {
-        keys: unknown[];
+        keys: Array<Record<string, unknown>>;
     };
+    authorizeInit(body: Record<string, unknown>, req: Request, res: Response): Promise<{
+        authorizeUrl: string;
+    }>;
     authorize(query: Record<string, string | undefined>, req: Request, res: Response): Promise<void>;
+    /**
+     * oidc-provider post-login resume (`GET /connect/authorize/:uid`).
+     * Must not require an identity_provider hint — this is the standard OP path.
+     */
+    authorizeResume(req: Request, res: Response): Promise<void>;
+    /**
+     * oidc-provider login/consent UI and form posts (standard OP path only).
+     * Not used by first-party Pure BFF federation broker.
+     * Explicit segments avoid Nest 11 / Express 5 wildcard matching gaps.
+     */
+    oidcInteraction(req: Request, res: Response): Promise<void>;
     externalCallback(providerKey: string, code: string | undefined, state: string | undefined, error: string | undefined, res: Response): Promise<void>;
-    token(req: Request, res: Response): Promise<OAuthTokenResponse>;
-    /** Platform API issuer from the incoming request (no hardcoded host/port). */
+    token(req: Request, res: Response): Promise<void>;
+    userInfo(req: Request, res: Response): Promise<void>;
+    revoke(req: Request, res: Response): Promise<void>;
+    endSession(query: Record<string, string | undefined>, req: Request, res: Response): Promise<void>;
+    /** Platform OAuth issuer — prefer `AUTH_OAUTH_ISSUER`, else derive from request. */
     private resolveIssuer;
     private readFormBody;
 }

package/security/src/lib/oauth/connect.controller.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"connect.controller.d.ts","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/oauth/connect.controller.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACjD,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAGhE,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAChE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAIjE,qBAGa,iBAAiB;IAE1B,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAFN,KAAK,EAAE,oBAAoB,EAC3B,OAAO,EAAE,iBAAiB,EAC1B,MAAM,EAAE,YAAY;IAKvC,oBAAoB,CAAQ,GAAG,EAAE,OAAO;;;;;;;;;;IAMxC,eAAe;;;IAMT,SAAS,CACJ,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,EAC3C,GAAG,EAAE,OAAO,EACZ,GAAG,EAAE,QAAQ,GACnB,OAAO,CAAC,IAAI,CAAC;IAuBV,gBAAgB,CACE,WAAW,EAAE,MAAM,EAC1B,IAAI,EAAE,MAAM,GAAG,SAAS,EACvB,KAAK,EAAE,MAAM,GAAG,SAAS,EACzB,KAAK,EAAE,MAAM,GAAG,SAAS,EAClC,GAAG,EAAE,QAAQ,GACnB,OAAO,CAAC,IAAI,CAAC;IAqBV,KAAK,CAAQ,GAAG,EAAE,OAAO,EAA8B,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAiBxG,8EAA8E;IAC9E,OAAO,CAAC,aAAa;IAQrB,OAAO,CAAC,YAAY;CAUrB"}
+{"version":3,"file":"connect.controller.d.ts","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/oauth/connect.controller.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACjD,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,EAAE,2BAA2B,EAAE,MAAM,wCAAwC,CAAC;AACrF,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAChE,OAAO,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AAGtE,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAChE,OAAO,EAAE,yBAAyB,EAAE,MAAM,gCAAgC,CAAC;AAc3E,qBAIa,iBAAiB;IAE1B,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,UAAU;IAC3B,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,aAAa;IAC9B,OAAO,CAAC,QAAQ,CAAC,WAAW;gBANX,KAAK,EAAE,oBAAoB,EAC3B,UAAU,EAAE,yBAAyB,EACrC,IAAI,EAAE,WAAW,EACjB,OAAO,EAAE,iBAAiB,EAC1B,MAAM,EAAE,YAAY,EACpB,aAAa,EAAE,oBAAoB,EACnC,WAAW,EAAE,2BAA2B;IAKrD,oBAAoB,CAAQ,GAAG,EAAE,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAkBxC,mCAAmC,CAAQ,GAAG,EAAE,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAM7D,eAAe;;;IAMT,aAAa,CACT,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,GAAG,EAAE,OAAO,EACS,GAAG,EAAE,QAAQ,GACxC,OAAO,CAAC;QAAE,YAAY,EAAE,MAAM,CAAA;KAAE,CAAC;IA0B9B,SAAS,CACJ,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,EAC3C,GAAG,EAAE,OAAO,EACZ,GAAG,EAAE,QAAQ,GACnB,OAAO,CAAC,IAAI,CAAC;IA6BhB;;;OAGG;IAGG,eAAe,CAAQ,GAAG,EAAE,OAAO,EAAS,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;IAO/E;;;;OAIG;IAGG,eAAe,CAAQ,GAAG,EAAE,OAAO,EAAS,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;IASzE,gBAAgB,CACE,WAAW,EAAE,MAAM,EAC1B,IAAI,EAAE,MAAM,GAAG,SAAS,EACvB,KAAK,EAAE,MAAM,GAAG,SAAS,EACzB,KAAK,EAAE,MAAM,GAAG,SAAS,EAClC,GAAG,EAAE,QAAQ,GACnB,OAAO,CAAC,IAAI,CAAC;IAqBV,KAAK,CAAQ,GAAG,EAAE,OAAO,EAAS,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;IAgC/D,QAAQ,CAAQ,GAAG,EAAE,OAAO,EAAS,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;IAkClE,MAAM,CAAQ,GAAG,EAAE,OAAO,EAAS,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;IA0BhE,UAAU,CACL,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,EAC3C,GAAG,EAAE,OAAO,EACZ,GAAG,EAAE,QAAQ,GACnB,OAAO,CAAC,IAAI,CAAC;IAiChB,oFAAoF;IACpF,OAAO,CAAC,aAAa;IAIrB,OAAO,CAAC,YAAY;CAUrB"}