@acorex-platform/framework-server 0.0.33 → 0.0.38

package/security/src/lib/oauth/oauth-op.service.js

@@ -0,0 +1,152 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OAuthOpService = void 0;
+const tslib_1 = require("tslib");
+const common_1 = require("@nestjs/common");
+const core_1 = require("@nestjs/core");
+const crypto_1 = require("crypto");
+const auth_identity_provider_source_1 = require("../auth/auth-identity-provider.source");
+const oauth_client_registry_service_1 = require("./oauth-client-registry.service");
+const oauth_rp_service_1 = require("./oauth-rp.service");
+const oauth_grant_store_interface_1 = require("./oauth-grant-store.interface");
+const platform_oauth_config_1 = require("./platform-oauth.config");
+const oauth_error_util_1 = require("./oauth-error.util");
+//#region ---- OAuth OP (Authorization Server) service ----
+let OAuthOpService = class OAuthOpService {
+    constructor(grants, rp, clients, moduleRef) {
+        this.grants = grants;
+        this.rp = rp;
+        this.clients = clients;
+        this.moduleRef = moduleRef;
+        this.authorizationCodeTtlMs = platform_oauth_config_1.PLATFORM_OAUTH_CODE_TTL_MS;
+    }
+    async beginAuthorization(request) {
+        this.assertSupportedAuthorizeRequest(request);
+        const providerKey = request.provider.trim();
+        if (!providerKey) {
+            throw (0, oauth_error_util_1.oauthInvalidRequest)('identity_provider (or acr_values) is required.');
+        }
+        const broker = await this.requireBrokerConfig(providerKey);
+        const codeVerifier = request.codeVerifier?.trim() ||
+            (await this.grants.consumePkceVerifier(request.codeChallenge.trim())) ||
+            undefined;
+        const externalState = (0, crypto_1.randomBytes)(16).toString('hex');
+        const nonce = (0, crypto_1.randomBytes)(16).toString('hex');
+        await this.saveExternalState(externalState, {
+            codeChallenge: request.codeChallenge,
+            codeChallengeMethod: request.codeChallengeMethod,
+            codeVerifier,
+            redirectUri: request.redirectUri,
+            clientId: request.clientId,
+            provider: providerKey,
+            issuer: request.issuer.replace(/\/$/, ''),
+            nonce,
+            expiresAt: Date.now() + this.authorizationCodeTtlMs,
+        });
+        const callbackUrl = `${request.issuer.replace(/\/$/, '')}/connect/callback/${encodeURIComponent(providerKey)}`;
+        const externalUrl = this.rp.buildAuthorizationUrl(broker, callbackUrl, externalState, nonce);
+        return { externalState, externalUrl };
+    }
+    async issueCode(input) {
+        const code = (0, crypto_1.randomBytes)(24).toString('hex');
+        const expiresAt = input.expiresAt ?? Date.now() + this.authorizationCodeTtlMs;
+        await this.grants.saveCode(code, {
+            ...input,
+            expiresAt,
+        }, this.authorizationCodeTtlMs);
+        return code;
+    }
+    async consumeCode(input) {
+        const record = await this.grants.consumeCode(input.code);
+        if (!record || record.expiresAt < Date.now()) {
+            throw (0, oauth_error_util_1.oauthInvalidGrant)('Invalid or expired authorization code.');
+        }
+        this.clients.assertRedirectUri(input.clientId, input.redirectUri);
+        if (record.clientId !== input.clientId || record.redirectUri !== input.redirectUri) {
+            throw (0, oauth_error_util_1.oauthInvalidGrant)('Authorization code does not match client or redirect URI.');
+        }
+        const codeVerifier = input.codeVerifier?.trim() || record.codeVerifier?.trim();
+        if (!codeVerifier) {
+            throw (0, oauth_error_util_1.oauthInvalidGrant)('PKCE code_verifier is required.');
+        }
+        if (!this.verifyPkce(codeVerifier, record.codeChallenge, record.codeChallengeMethod)) {
+            throw (0, oauth_error_util_1.oauthInvalidGrant)('Invalid PKCE code verifier.');
+        }
+        return record;
+    }
+    async saveExternalState(state, record) {
+        const ttlMs = Math.max(1, record.expiresAt - Date.now());
+        await this.grants.saveState(state, record, ttlMs);
+    }
+    async consumeExternalState(state) {
+        const record = await this.grants.consumeState(state);
+        if (!record || record.expiresAt < Date.now()) {
+            throw (0, oauth_error_util_1.oauthInvalidGrant)('Invalid or expired OAuth state.');
+        }
+        return record;
+    }
+    async stagePkceVerifier(codeChallenge, codeVerifier) {
+        await this.grants.savePkceVerifier(codeChallenge, codeVerifier, this.authorizationCodeTtlMs);
+    }
+    async requireBrokerConfig(key) {
+        const catalog = this.resolveIdentityProviderCatalog();
+        const broker = catalog ? await catalog.getBrokerConfig(key) : null;
+        if (!broker) {
+            throw new common_1.ServiceUnavailableException({
+                statusCode: 503,
+                message: `Identity provider "${key}" is not enabled or is missing broker config ` +
+                    '(clientId, clientSecret, authorizationUrl, tokenUrl). ' +
+                    'Configure it under Security → Identity Providers.',
+                error: 'IdentityProviderNotConfigured',
+            });
+        }
+        return broker;
+    }
+    resolveIdentityProviderCatalog() {
+        try {
+            return this.moduleRef.get(auth_identity_provider_source_1.AUTH_IDENTITY_PROVIDER_CATALOG, { strict: false });
+        }
+        catch {
+            return null;
+        }
+    }
+    assertSupportedAuthorizeRequest(request) {
+        if (request.responseType !== 'code') {
+            throw (0, oauth_error_util_1.oauthInvalidRequest)('Only response_type=code is supported.');
+        }
+        this.clients.assertClientId(request.clientId);
+        this.clients.assertRedirectUri(request.clientId, request.redirectUri);
+        this.clients.assertScopes(request.clientId, request.scope);
+        if (!request.redirectUri?.trim()) {
+            throw (0, oauth_error_util_1.oauthInvalidRequest)('redirect_uri is required.');
+        }
+        if (!request.issuer?.trim()) {
+            throw (0, oauth_error_util_1.oauthInvalidRequest)('issuer is required.');
+        }
+        if (!request.codeChallenge?.trim() || request.codeChallengeMethod !== 'S256') {
+            throw (0, oauth_error_util_1.oauthInvalidRequest)('PKCE S256 code_challenge is required.');
+        }
+    }
+    verifyPkce(codeVerifier, codeChallenge, method) {
+        if (method !== 'S256') {
+            return false;
+        }
+        const digest = (0, crypto_1.createHash)('sha256').update(codeVerifier).digest('base64url');
+        try {
+            return (0, crypto_1.timingSafeEqual)(Buffer.from(digest), Buffer.from(codeChallenge));
+        }
+        catch {
+            return false;
+        }
+    }
+};
+exports.OAuthOpService = OAuthOpService;
+exports.OAuthOpService = OAuthOpService = tslib_1.__decorate([
+    (0, common_1.Injectable)(),
+    tslib_1.__metadata("design:paramtypes", [oauth_grant_store_interface_1.OAuthGrantStore,
+        oauth_rp_service_1.OAuthRpService,
+        oauth_client_registry_service_1.OAuthClientRegistryService,
+        core_1.ModuleRef])
+], OAuthOpService);
+//#endregion
+//# sourceMappingURL=oauth-op.service.js.map

package/security/src/lib/oauth/oauth-op.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-op.service.js","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/oauth/oauth-op.service.ts"],"names":[],"mappings":";;;;AAAA,2CAGwB;AACxB,uCAAyC;AACzC,mCAAkE;AAElE,yFAG+C;AAC/C,mFAA6E;AAC7E,yDAAoD;AACpD,+EAAgE;AAEhE,mEAAqE;AAGrE,yDAG4B;AAE5B,2DAA2D;AAGpD,IAAM,cAAc,GAApB,MAAM,cAAc;IAGzB,YACmB,MAAuB,EACvB,EAAkB,EAClB,OAAmC,EACnC,SAAoB;QAHpB,WAAM,GAAN,MAAM,CAAiB;QACvB,OAAE,GAAF,EAAE,CAAgB;QAClB,YAAO,GAAP,OAAO,CAA4B;QACnC,cAAS,GAAT,SAAS,CAAW;QANtB,2BAAsB,GAAG,kDAA0B,CAAC;IAOlE,CAAC;IAEJ,KAAK,CAAC,kBAAkB,CACtB,OAAsC;QAEtC,IAAI,CAAC,+BAA+B,CAAC,OAAO,CAAC,CAAC;QAE9C,MAAM,WAAW,GAAG,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QAC5C,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,IAAA,sCAAmB,EAAC,gDAAgD,CAAC,CAAC;QAC9E,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,WAAW,CAAC,CAAC;QAE3D,MAAM,YAAY,GAChB,OAAO,CAAC,YAAY,EAAE,IAAI,EAAE;YAC5B,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,OAAO,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC,CAAC;YACrE,SAAS,CAAC;QAEZ,MAAM,aAAa,GAAG,IAAA,oBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACtD,MAAM,KAAK,GAAG,IAAA,oBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC9C,MAAM,IAAI,CAAC,iBAAiB,CAAC,aAAa,EAAE;YAC1C,aAAa,EAAE,OAAO,CAAC,aAAa;YACpC,mBAAmB,EAAE,OAAO,CAAC,mBAAmB;YAChD,YAAY;YACZ,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,QAAQ,EAAE,WAAW;YACrB,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;YACzC,KAAK;YACL,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,sBAAsB;SACpD,CAAC,CAAC;QAEH,MAAM,WAAW,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,qBAAqB,kBAAkB,CAAC,WAAW,CAAC,EAAE,CAAC;QAC/G,MAAM,WAAW,GAAG,IAAI,CAAC,EAAE,CAAC,qBAAqB,CAAC,MAAM,EAAE,WAAW,EAAE,aAAa,EAAE,KAAK,CAAC,CAAC;QAE7F,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,CAAC;IACxC,CAAC;IAED,KAAK,CAAC,SAAS,CACb,KAKC;QAED,MAAM,IAAI,GAAG,IAAA,oBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC7C,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,sBAAsB,CAAC;QAE9E,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,CACxB,IAAI,EACJ;YACE,GAAG,KAAK;YACR,SAAS;SACV,EACD,IAAI,CAAC,sBAAsB,CAC5B,CAAC;QAEF,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,KAKjB;QACC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACzD,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YAC7C,MAAM,IAAA,oCAAiB,EAAC,wCAAwC,CAAC,CAAC;QACpE,CAAC;QAED,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;QAElE,IAAI,MAAM,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ,IAAI,MAAM,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW,EAAE,CAAC;YACnF,MAAM,IAAA,oCAAiB,EAAC,2DAA2D,CAAC,CAAC;QACvF,CAAC;QAED,MAAM,YAAY,GAAG,KAAK,CAAC,YAAY,EAAE,IAAI,EAAE,IAAI,MAAM,CAAC,YAAY,EAAE,IAAI,EAAE,CAAC;QAC/E,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,MAAM,IAAA,oCAAiB,EAAC,iCAAiC,CAAC,CAAC;QAC7D,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,YAAY,EAAE,MAAM,CAAC,aAAa,EAAE,MAAM,CAAC,mBAAmB,CAAC,EAAE,CAAC;YACrF,MAAM,IAAA,oCAAiB,EAAC,6BAA6B,CAAC,CAAC;QACzD,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,KAAa,EAAE,MAAgC;QACrE,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QACzD,MAAM,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;IACpD,CAAC;IAED,KAAK,CAAC,oBAAoB,CAAC,KAAa;QACtC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;QACrD,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YAC7C,MAAM,IAAA,oCAAiB,EAAC,iCAAiC,CAAC,CAAC;QAC7D,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,aAAqB,EAAE,YAAoB;QACjE,MAAM,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,aAAa,EAAE,YAAY,EAAE,IAAI,CAAC,sBAAsB,CAAC,CAAC;IAC/F,CAAC;IAEO,KAAK,CAAC,mBAAmB,CAAC,GAAW;QAC3C,MAAM,OAAO,GAAG,IAAI,CAAC,8BAA8B,EAAE,CAAC;QACtD,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,MAAM,OAAO,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACnE,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,oCAA2B,CAAC;gBACpC,UAAU,EAAE,GAAG;gBACf,OAAO,EACL,sBAAsB,GAAG,+CAA+C;oBACxE,wDAAwD;oBACxD,mDAAmD;gBACrD,KAAK,EAAE,+BAA+B;aACvC,CAAC,CAAC;QACL,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,8BAA8B;QACpC,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAA8B,8DAA8B,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QAC5G,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAEO,+BAA+B,CAAC,OAAsC;QAC5E,IAAI,OAAO,CAAC,YAAY,KAAK,MAAM,EAAE,CAAC;YACpC,MAAM,IAAA,sCAAmB,EAAC,uCAAuC,CAAC,CAAC;QACrE,CAAC;QAED,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC9C,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;QACtE,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;QAE3D,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,IAAI,EAAE,EAAE,CAAC;YACjC,MAAM,IAAA,sCAAmB,EAAC,2BAA2B,CAAC,CAAC;QACzD,CAAC;QAED,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE,CAAC;YAC5B,MAAM,IAAA,sCAAmB,EAAC,qBAAqB,CAAC,CAAC;QACnD,CAAC;QAED,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,IAAI,EAAE,IAAI,OAAO,CAAC,mBAAmB,KAAK,MAAM,EAAE,CAAC;YAC7E,MAAM,IAAA,sCAAmB,EAAC,uCAAuC,CAAC,CAAC;QACrE,CAAC;IACH,CAAC;IAEO,UAAU,CAAC,YAAoB,EAAE,aAAqB,EAAE,MAAc;QAC5E,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;YACtB,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,MAAM,GAAG,IAAA,mBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QAC7E,IAAI,CAAC;YACH,OAAO,IAAA,wBAAe,EAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC;QAC1E,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;CACF,CAAA;AA9KY,wCAAc;yBAAd,cAAc;IAD1B,IAAA,mBAAU,GAAE;6CAKgB,6CAAe;QACnB,iCAAc;QACT,0DAA0B;QACxB,gBAAS;GAP5B,cAAc,CA8K1B;AAED,YAAY"}

package/security/src/lib/oauth/oauth-op.types.d.ts

@@ -0,0 +1,73 @@
+import type { VerifiedExternalOidcProfile } from './oauth-rp.types';
+/**
+ * Internal record stored per issued authorization code.
+ * Must be safe for multi-instance deployments (no in-memory Map in final shape).
+ */
+export interface OAuthCodeRecord {
+    codeChallenge: string;
+    codeChallengeMethod: string;
+    /** Server-side PKCE verifier (BFF); optional when SPA sends verifier at token exchange. */
+    codeVerifier?: string;
+    redirectUri: string;
+    clientId: string;
+    userId: string;
+    /**
+     * User/display data needed to mint tokens without re-calling the external IdP.
+     * (Kept intentionally because the legacy implementation stores it in the
+     * in-process authorization-code record.)
+     */
+    userName: string;
+    userTitle: string;
+    userEmail?: string;
+    userPicture?: string;
+    provider: string;
+    /**
+     * Token/ID-token replay protection context.
+     */
+    nonce?: string;
+    sessionId?: string;
+    /**
+     * Absolute expiration timestamp (epoch ms).
+     */
+    expiresAt: number;
+}
+/**
+ * State stored during browser redirect to an external IdP.
+ */
+export interface OAuthExternalStateRecord {
+    codeChallenge: string;
+    codeChallengeMethod: string;
+    /** Server-side PKCE verifier when generated by `/connect/authorize/init`. */
+    codeVerifier?: string;
+    redirectUri: string;
+    clientId: string;
+    provider: string;
+    issuer: string;
+    nonce?: string;
+    expiresAt: number;
+}
+/**
+ * Registered OAuth/OIDC client definition.
+ * Seeded via tenant/application configuration in a later step.
+ */
+export interface OAuthRegisteredClient {
+    clientId: string;
+    /**
+     * Whether the client is allowed to use PKCE public client flow only.
+     * Confidential/public determination is required by OAuth/OIDC metadata.
+     */
+    publicClient: boolean;
+    /** Required for confidential clients at the token endpoint (`client_secret`). */
+    clientSecret?: string;
+    redirectUris: string[];
+    postLogoutRedirectUris: string[];
+    allowedScopes: string[];
+    allowedGrantTypes: Array<'authorization_code' | 'refresh_token'>;
+}
+/**
+ * Normalized output from RP-side verified federation.
+ * This is kept as a separate alias so OP can consume RP output cleanly.
+ */
+export interface VerifiedExternalProfileForLinking extends VerifiedExternalOidcProfile {
+}
+//# sourceMappingURL=oauth-op.types.d.ts.map

package/security/src/lib/oauth/oauth-op.types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-op.types.d.ts","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/oauth/oauth-op.types.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,kBAAkB,CAAC;AAEpE;;;GAGG;AACH,MAAM,WAAW,eAAe;IAC9B,aAAa,EAAE,MAAM,CAAC;IACtB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,2FAA2F;IAC3F,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IAEf;;;;OAIG;IACH,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IAEjB;;OAEG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB;;OAEG;IACH,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;GAEG;AACH,MAAM,WAAW,wBAAwB;IACvC,aAAa,EAAE,MAAM,CAAC;IACtB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,6EAA6E;IAC7E,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IAEf,KAAK,CAAC,EAAE,MAAM,CAAC;IAEf,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;GAGG;AACH,MAAM,WAAW,qBAAqB;IACpC,QAAQ,EAAE,MAAM,CAAC;IACjB;;;OAGG;IACH,YAAY,EAAE,OAAO,CAAC;IAEtB,iFAAiF;IACjF,YAAY,CAAC,EAAE,MAAM,CAAC;IAEtB,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,sBAAsB,EAAE,MAAM,EAAE,CAAC;IACjC,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,iBAAiB,EAAE,KAAK,CAAC,oBAAoB,GAAG,eAAe,CAAC,CAAC;CAClE;AAED;;;GAGG;AACH,MAAM,WAAW,iCAAkC,SAAQ,2BAA2B;CAAG"}

package/security/src/lib/oauth/oauth-op.types.js

@@ -0,0 +1,5 @@
+"use strict";
+//#region ---- OAuth OP (Authorization Server) types ----
+Object.defineProperty(exports, "__esModule", { value: true });
+//#endregion
+//# sourceMappingURL=oauth-op.types.js.map

package/security/src/lib/oauth/oauth-op.types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-op.types.js","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/oauth/oauth-op.types.ts"],"names":[],"mappings":";AAAA,yDAAyD;;AAqFzD,YAAY"}

package/security/src/lib/oauth/oauth-provider-hint.util.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Resolves the external IdP routing hint from authorize/init parameters.
+ *
+ * `identity_provider` is the canonical provider routing hint.
+ * `acr_values` is accepted only as a legacy alias when `identity_provider` is absent.
+ */
+export declare function resolveOAuthProviderHint(input: Record<string, string | undefined>): string | undefined;
+//# sourceMappingURL=oauth-provider-hint.util.d.ts.map

package/security/src/lib/oauth/oauth-provider-hint.util.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-provider-hint.util.d.ts","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/oauth/oauth-provider-hint.util.ts"],"names":[],"mappings":"AAEA;;;;;GAKG;AACH,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,GACxC,MAAM,GAAG,SAAS,CAapB"}

package/security/src/lib/oauth/oauth-provider-hint.util.js

@@ -0,0 +1,24 @@
+"use strict";
+//#region ---- OAuth provider hint resolution ----
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolveOAuthProviderHint = resolveOAuthProviderHint;
+/**
+ * Resolves the external IdP routing hint from authorize/init parameters.
+ *
+ * `identity_provider` is the canonical provider routing hint.
+ * `acr_values` is accepted only as a legacy alias when `identity_provider` is absent.
+ */
+function resolveOAuthProviderHint(input) {
+    const identityProvider = input['identity_provider']?.trim();
+    if (identityProvider) {
+        return identityProvider;
+    }
+    const legacyAcr = input['acr_values']?.trim();
+    if (legacyAcr) {
+        return legacyAcr;
+    }
+    const provider = input['provider']?.trim();
+    return provider || undefined;
+}
+//#endregion
+//# sourceMappingURL=oauth-provider-hint.util.js.map

package/security/src/lib/oauth/oauth-provider-hint.util.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-provider-hint.util.js","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/oauth/oauth-provider-hint.util.ts"],"names":[],"mappings":";AAAA,kDAAkD;;AAQlD,4DAeC;AArBD;;;;;GAKG;AACH,SAAgB,wBAAwB,CACtC,KAAyC;IAEzC,MAAM,gBAAgB,GAAG,KAAK,CAAC,mBAAmB,CAAC,EAAE,IAAI,EAAE,CAAC;IAC5D,IAAI,gBAAgB,EAAE,CAAC;QACrB,OAAO,gBAAgB,CAAC;IAC1B,CAAC;IAED,MAAM,SAAS,GAAG,KAAK,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,CAAC;IAC9C,IAAI,SAAS,EAAE,CAAC;QACd,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,QAAQ,GAAG,KAAK,CAAC,UAAU,CAAC,EAAE,IAAI,EAAE,CAAC;IAC3C,OAAO,QAAQ,IAAI,SAAS,CAAC;AAC/B,CAAC;AAED,YAAY"}

package/security/src/lib/oauth/oauth-redis-oidc-adapter.d.ts

@@ -0,0 +1,27 @@
+type OidcAdapterPayload = Record<string, unknown> & {
+    consumed?: unknown;
+};
+/**
+ * Redis-backed oidc-provider adapter (multi-instance safe).
+ * Falls back to in-memory Map when Redis is unavailable (dev single instance).
+ */
+export declare class OAuthRedisOidcAdapter {
+    private readonly redis;
+    private readonly localStore;
+    private readonly modelName;
+    constructor(name: string);
+    private key;
+    /** Secondary index: Session (and similar) `uid` → primary id. */
+    private uidKey;
+    private grantKey;
+    upsert(id: string, payload: OidcAdapterPayload, expiresIn: number): Promise<void>;
+    find(id: string): Promise<OidcAdapterPayload | undefined>;
+    findByUserCode(_userCode: string): Promise<OidcAdapterPayload | undefined>;
+    findByUid(uid: string): Promise<OidcAdapterPayload | undefined>;
+    private ensureRedis;
+    consume(id: string): Promise<void>;
+    destroy(id: string): Promise<void>;
+    revokeByGrantId(grantId: string): Promise<void>;
+}
+export {};
+//# sourceMappingURL=oauth-redis-oidc-adapter.d.ts.map

package/security/src/lib/oauth/oauth-redis-oidc-adapter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-redis-oidc-adapter.d.ts","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/oauth/oauth-redis-oidc-adapter.ts"],"names":[],"mappings":"AAIA,KAAK,kBAAkB,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG;IAAE,QAAQ,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC;AAyB3E;;;GAGG;AACH,qBAAa,qBAAqB;IAChC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAe;IACrC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA6B;IACxD,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;gBAEvB,IAAI,EAAE,MAAM;IAcxB,OAAO,CAAC,GAAG;IAIX,iEAAiE;IACjE,OAAO,CAAC,MAAM;IAId,OAAO,CAAC,QAAQ;IAIV,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,kBAAkB,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IA2BjF,IAAI,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,GAAG,SAAS,CAAC;IAgBzD,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,GAAG,SAAS,CAAC;IAI1E,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,GAAG,SAAS,CAAC;YAqBvD,WAAW;IASnB,OAAO,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAqBlC,OAAO,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAUlC,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAetD"}

package/security/src/lib/oauth/oauth-redis-oidc-adapter.js

@@ -0,0 +1,159 @@
+"use strict";
+//#region ---- oidc-provider Redis storage adapter ----
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OAuthRedisOidcAdapter = void 0;
+const tslib_1 = require("tslib");
+const ioredis_1 = tslib_1.__importDefault(require("ioredis"));
+function resolveOauthRedisConnection() {
+    const url = process.env['REDIS_URL']?.trim();
+    if (url) {
+        return { url };
+    }
+    const host = process.env['REDIS_HOST']?.trim();
+    const portRaw = Number(process.env['REDIS_PORT'] ?? 6379);
+    if (host) {
+        return { host, port: Number.isFinite(portRaw) ? portRaw : 6379 };
+    }
+    return null;
+}
+const GETDEL_SCRIPT = `
+local v = redis.call('GET', KEYS[1])
+if v then
+  redis.call('DEL', KEYS[1])
+end
+return v
+`;
+/**
+ * Redis-backed oidc-provider adapter (multi-instance safe).
+ * Falls back to in-memory Map when Redis is unavailable (dev single instance).
+ */
+class OAuthRedisOidcAdapter {
+    constructor(name) {
+        this.localStore = new Map();
+        this.modelName = name;
+        const connection = resolveOauthRedisConnection();
+        if (!connection) {
+            this.redis = null;
+            return;
+        }
+        this.redis =
+            'url' in connection
+                ? new ioredis_1.default(connection.url, { maxRetriesPerRequest: null, lazyConnect: true })
+                : new ioredis_1.default({ ...connection, maxRetriesPerRequest: null, lazyConnect: true });
+    }
+    key(id) {
+        return `axp:oidc:${this.modelName}:${id}`;
+    }
+    /** Secondary index: Session (and similar) `uid` → primary id. */
+    uidKey(uid) {
+        return `axp:oidc:${this.modelName}:uid:${uid}`;
+    }
+    grantKey(grantId) {
+        return `axp:oidc:grant:${grantId}:${this.modelName}`;
+    }
+    async upsert(id, payload, expiresIn) {
+        const key = this.key(id);
+        const value = JSON.stringify(payload);
+        const ttlMs = Math.max(1, expiresIn * 1000);
+        if (!this.redis) {
+            this.localStore.set(key, value);
+            if (typeof payload['uid'] === 'string' && payload['uid'].trim()) {
+                this.localStore.set(this.uidKey(payload['uid'].trim()), id);
+            }
+            return;
+        }
+        await this.ensureRedis();
+        await this.redis.set(key, value, 'PX', ttlMs);
+        if (typeof payload['uid'] === 'string' && payload['uid'].trim()) {
+            await this.redis.set(this.uidKey(payload['uid'].trim()), id, 'PX', ttlMs);
+        }
+        const grantId = typeof payload['grantId'] === 'string' ? payload['grantId'] : null;
+        if (grantId) {
+            await this.redis.sadd(this.grantKey(grantId), key);
+            await this.redis.pexpire(this.grantKey(grantId), ttlMs);
+        }
+    }
+    async find(id) {
+        const key = this.key(id);
+        if (this.redis) {
+            await this.ensureRedis();
+        }
+        const raw = this.redis
+            ? (await this.redis.get(key))
+            : (this.localStore.get(key) ?? null);
+        if (!raw) {
+            return undefined;
+        }
+        return JSON.parse(raw);
+    }
+    async findByUserCode(_userCode) {
+        return undefined;
+    }
+    async findByUid(uid) {
+        const normalized = uid.trim();
+        if (!normalized) {
+            return undefined;
+        }
+        const indexKey = this.uidKey(normalized);
+        if (this.redis) {
+            await this.ensureRedis();
+        }
+        const id = this.redis
+            ? (await this.redis.get(indexKey))
+            : (this.localStore.get(indexKey) ?? null);
+        if (!id) {
+            return undefined;
+        }
+        return this.find(id);
+    }
+    async ensureRedis() {
+        if (!this.redis) {
+            return;
+        }
+        if (this.redis.status === 'wait') {
+            await this.redis.connect();
+        }
+    }
+    async consume(id) {
+        const record = await this.find(id);
+        if (!record) {
+            return;
+        }
+        record.consumed = Math.floor(Date.now() / 1000);
+        const key = this.key(id);
+        const value = JSON.stringify(record);
+        if (!this.redis) {
+            this.localStore.set(key, value);
+            return;
+        }
+        const ttl = await this.redis.pttl(key);
+        if (ttl > 0) {
+            await this.redis.set(key, value, 'PX', ttl);
+        }
+    }
+    async destroy(id) {
+        const key = this.key(id);
+        if (!this.redis) {
+            this.localStore.delete(key);
+            return;
+        }
+        await this.redis.del(key);
+    }
+    async revokeByGrantId(grantId) {
+        if (!this.redis) {
+            for (const [key] of this.localStore) {
+                if (key.includes(grantId)) {
+                    this.localStore.delete(key);
+                }
+            }
+            return;
+        }
+        const keys = await this.redis.smembers(this.grantKey(grantId));
+        if (keys.length > 0) {
+            await this.redis.del(...keys, this.grantKey(grantId));
+        }
+    }
+}
+exports.OAuthRedisOidcAdapter = OAuthRedisOidcAdapter;
+//#endregion
+//# sourceMappingURL=oauth-redis-oidc-adapter.js.map

package/security/src/lib/oauth/oauth-redis-oidc-adapter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-redis-oidc-adapter.js","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/oauth/oauth-redis-oidc-adapter.ts"],"names":[],"mappings":";AAAA,uDAAuD;;;;AAEvD,8DAA4B;AAI5B,SAAS,2BAA2B;IAClC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,CAAC;IAC7C,IAAI,GAAG,EAAE,CAAC;QACR,OAAO,EAAE,GAAG,EAAE,CAAC;IACjB,CAAC;IAED,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,CAAC;IAC/C,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,IAAI,CAAC,CAAC;IAC1D,IAAI,IAAI,EAAE,CAAC;QACT,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACnE,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,aAAa,GAAG;;;;;;CAMrB,CAAC;AAEF;;;GAGG;AACH,MAAa,qBAAqB;IAKhC,YAAY,IAAY;QAHP,eAAU,GAAG,IAAI,GAAG,EAAkB,CAAC;QAItD,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC;QACtB,MAAM,UAAU,GAAG,2BAA2B,EAAE,CAAC;QACjD,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;YAClB,OAAO;QACT,CAAC;QAED,IAAI,CAAC,KAAK;YACR,KAAK,IAAI,UAAU;gBACjB,CAAC,CAAC,IAAI,iBAAK,CAAC,UAAU,CAAC,GAAG,EAAE,EAAE,oBAAoB,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;gBAC9E,CAAC,CAAC,IAAI,iBAAK,CAAC,EAAE,GAAG,UAAU,EAAE,oBAAoB,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;IACpF,CAAC;IAEO,GAAG,CAAC,EAAU;QACpB,OAAO,YAAY,IAAI,CAAC,SAAS,IAAI,EAAE,EAAE,CAAC;IAC5C,CAAC;IAED,iEAAiE;IACzD,MAAM,CAAC,GAAW;QACxB,OAAO,YAAY,IAAI,CAAC,SAAS,QAAQ,GAAG,EAAE,CAAC;IACjD,CAAC;IAEO,QAAQ,CAAC,OAAe;QAC9B,OAAO,kBAAkB,OAAO,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;IACvD,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,EAAU,EAAE,OAA2B,EAAE,SAAiB;QACrE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACzB,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QACtC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,SAAS,GAAG,IAAI,CAAC,CAAC;QAE5C,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;YAChB,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAChC,IAAI,OAAO,OAAO,CAAC,KAAK,CAAC,KAAK,QAAQ,IAAI,OAAO,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;gBAChE,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;YAC9D,CAAC;YACD,OAAO;QACT,CAAC;QAED,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC;QACzB,MAAM,IAAI,CAAC,KAAM,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;QAE/C,IAAI,OAAO,OAAO,CAAC,KAAK,CAAC,KAAK,QAAQ,IAAI,OAAO,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;YAChE,MAAM,IAAI,CAAC,KAAM,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;QAC7E,CAAC;QAED,MAAM,OAAO,GAAG,OAAO,OAAO,CAAC,SAAS,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACnF,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,IAAI,CAAC,KAAM,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,GAAG,CAAC,CAAC;YACpD,MAAM,IAAI,CAAC,KAAM,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,EAAU;QACnB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACzB,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC;QAC3B,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK;YACpB,CAAC,CAAE,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAmB;YAChD,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,CAAC;QAEvC,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAuB,CAAC;IAC/C,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,SAAiB;QACpC,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,GAAW;QACzB,MAAM,UAAU,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;QAC9B,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QACzC,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC;QAC3B,CAAC;QACD,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK;YACnB,CAAC,CAAE,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAmB;YACrD,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,CAAC;QAE5C,IAAI,CAAC,EAAE,EAAE,CAAC;YACR,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,OAAO,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACvB,CAAC;IAEO,KAAK,CAAC,WAAW;QACvB,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;YAChB,OAAO;QACT,CAAC;QACD,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YACjC,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;QAC7B,CAAC;IACH,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,EAAU;QACtB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACnC,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO;QACT,CAAC;QAED,MAAM,CAAC,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAChD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACzB,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QAErC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;YAChB,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAChC,OAAO;QACT,CAAC;QAED,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACvC,IAAI,GAAG,GAAG,CAAC,EAAE,CAAC;YACZ,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;QAC9C,CAAC;IACH,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,EAAU;QACtB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACzB,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;YAChB,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC5B,OAAO;QACT,CAAC;QAED,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC5B,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,OAAe;QACnC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;YAChB,KAAK,MAAM,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;gBACpC,IAAI,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;oBAC1B,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBAC9B,CAAC;YACH,CAAC;YACD,OAAO;QACT,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;QAC/D,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACpB,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;QACxD,CAAC;IACH,CAAC;CACF;AA3JD,sDA2JC;AAED,YAAY"}

package/security/src/lib/oauth/oauth-rp.service.d.ts

@@ -0,0 +1,53 @@
+import type { AuthIdentityProviderBrokerConfig } from '../auth/auth-identity-provider.source';
+import type { VerifiedExternalOidcProfile } from './oauth-rp.types';
+export declare class OAuthRpService {
+    private readonly logger;
+    private readonly jwksCache;
+    private readonly jwksTtlMs;
+    /**
+     * Builds external IdP authorization URL.
+     * This service is RP-only: no session/token issuance.
+     */
+    buildAuthorizationUrl(broker: AuthIdentityProviderBrokerConfig, callbackUrl: string, state: string, nonce?: string): string;
+    /**
+     * Exchanges external authorization code for token response.
+     * Returns raw id_token (if present) and access_token (for UserInfo fallback).
+     */
+    exchangeCode(broker: AuthIdentityProviderBrokerConfig, code: string, callbackUrl: string): Promise<{
+        idToken?: string;
+        accessToken: string;
+    }>;
+    /**
+     * Verifies external id_token using external JWKS (fetched from issuer).
+     * Validates audience + nonce (when expectedNonce is provided) and returns normalized profile.
+     * When JWKS is unreachable for Google (common corporate/geo blocks on
+     * `www.googleapis.com/.../certs`), falls back to Google `tokeninfo` over
+     * `oauth2.googleapis.com` which still cryptographically validates the JWT.
+     */
+    verifyAndNormalizeIdToken(rawJwt: string, _broker: AuthIdentityProviderBrokerConfig, expectedNonce?: string, expectedAudience?: string): Promise<VerifiedExternalOidcProfile>;
+    private verifyIdTokenWithJwks;
+    /**
+     * Google tokeninfo validates the ID Token when local JWKS download is blocked
+     * (e.g. 403 on www.googleapis.com/oauth2/v3/certs).
+     * Prefer POST body so long JWTs are not truncated in the query string.
+     */
+    private verifyGoogleIdTokenViaTokenInfo;
+    private assertNonce;
+    fetchUserInfo(accessToken: string, userInfoUrl: string): Promise<Partial<VerifiedExternalOidcProfile>>;
+    /**
+     * Resolves the OIDC issuer to compare against ID Token `iss`.
+     * Prefer configured `issuerUrl` — token endpoint origin is often wrong
+     * (Google: token at oauth2.googleapis.com, iss = accounts.google.com).
+     */
+    private resolveExpectedIssuer;
+    /**
+     * Google historically issues both `https://accounts.google.com` and `accounts.google.com`.
+     */
+    private issuersMatch;
+    private normalizeIssuerUrl;
+    private isGoogleIssuer;
+    private fetchJwksWithRotation;
+    private fetchJwks;
+    private fetchJwksFromUrl;
+}
+//# sourceMappingURL=oauth-rp.service.d.ts.map

package/security/src/lib/oauth/oauth-rp.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-rp.service.d.ts","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/oauth/oauth-rp.service.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,gCAAgC,EAAE,MAAM,uCAAuC,CAAC;AAC9F,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,kBAAkB,CAAC;AA4BpE,qBACa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAmC;IAC1D,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAiC;IAC3D,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAkE;IAE5F;;;OAGG;IACH,qBAAqB,CACnB,MAAM,EAAE,gCAAgC,EACxC,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,MAAM,EACb,KAAK,CAAC,EAAE,MAAM,GACb,MAAM;IAkBT;;;OAGG;IACG,YAAY,CAChB,MAAM,EAAE,gCAAgC,EACxC,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC;QAAE,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC;IAkCrD;;;;;;OAMG;IACG,yBAAyB,CAC7B,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,gCAAgC,EACzC,aAAa,CAAC,EAAE,MAAM,EACtB,gBAAgB,CAAC,EAAE,MAAM,GACxB,OAAO,CAAC,2BAA2B,CAAC;YAoEzB,qBAAqB;IAoDnC;;;;OAIG;YACW,+BAA+B;IA+E7C,OAAO,CAAC,WAAW;IASb,aAAa,CAAC,WAAW,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,2BAA2B,CAAC,CAAC;IAuB5G;;;;OAIG;YACW,qBAAqB;IAwCnC;;OAEG;IACH,OAAO,CAAC,YAAY;IAIpB,OAAO,CAAC,kBAAkB;IAW1B,OAAO,CAAC,cAAc;YAIR,qBAAqB;YA+BrB,SAAS;YA6BT,gBAAgB;CA0B/B"}