@acorex-platform/framework-server 0.0.33 → 0.0.38

package/security/src/lib/oauth/oidc-provider-engine.service.js

@@ -0,0 +1,208 @@
+"use strict";
+var OidcProviderEngineService_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OidcProviderEngineService = void 0;
+const tslib_1 = require("tslib");
+const common_1 = require("@nestjs/common");
+const oidc_provider_1 = tslib_1.__importDefault(require("oidc-provider"));
+const auth_local_credentials_service_1 = require("../auth/auth-local-credentials.service");
+const auth_config_1 = require("../auth/auth.config");
+const token_service_1 = require("../auth/token.service");
+const oauth_client_registry_service_1 = require("./oauth-client-registry.service");
+const oauth_issuer_util_1 = require("./oauth-issuer.util");
+const oauth_redis_oidc_adapter_1 = require("./oauth-redis-oidc-adapter");
+const Provider = oidc_provider_1.default;
+function isOidcProviderEngineEnabled() {
+    const raw = process.env['AUTH_OIDC_PROVIDER_ENGINE']?.trim()?.toLowerCase();
+    if (raw === 'false' || raw === '0') {
+        return false;
+    }
+    return true;
+}
+let OidcProviderEngineService = OidcProviderEngineService_1 = class OidcProviderEngineService {
+    constructor(clients, credentials, tokens) {
+        this.clients = clients;
+        this.credentials = credentials;
+        this.tokens = tokens;
+        this.logger = new common_1.Logger(OidcProviderEngineService_1.name);
+        this.provider = null;
+        this.callbackHandler = null;
+        this.issuer = '';
+    }
+    async onModuleInit() {
+        if (!isOidcProviderEngineEnabled()) {
+            this.logger.log('oidc-provider engine disabled (AUTH_OIDC_PROVIDER_ENGINE=false).');
+            return;
+        }
+        try {
+            await this.bootstrapProvider();
+            this.logger.log(`oidc-provider engine ready (issuer=${this.issuer}).`);
+        }
+        catch (error) {
+            this.logger.error(`Failed to bootstrap oidc-provider: ${String(error)}`);
+        }
+    }
+    isEnabled() {
+        return this.provider != null && this.callbackHandler != null;
+    }
+    getIssuer() {
+        return this.issuer;
+    }
+    async getDiscoveryDocument() {
+        if (!this.provider) {
+            return null;
+        }
+        return this.provider.metadata;
+    }
+    /**
+     * Forwards an Express request to oidc-provider (paths must be issuer-relative, without `/api` prefix).
+     */
+    async forward(req, res) {
+        if (!this.callbackHandler) {
+            res.status(503).json({ error: 'oidc_provider_unavailable' });
+            return;
+        }
+        const originalUrl = req.originalUrl || req.url;
+        const relative = originalUrl.replace(/^\/api(?=\/|$)/, '') || originalUrl;
+        const previousUrl = req.url;
+        req.url = relative;
+        await new Promise((resolve, reject) => {
+            this.callbackHandler(req, res, (error) => {
+                req.url = previousUrl;
+                if (error) {
+                    reject(error);
+                    return;
+                }
+                resolve();
+            });
+        });
+    }
+    async bootstrapProvider() {
+        this.issuer = (0, oauth_issuer_util_1.resolveOAuthIssuer)();
+        // oidc-provider requires private RSA material (`d`); public JWKS must stay HTTP-only.
+        const jwks = this.tokens.getSigningJwks();
+        const credentials = this.credentials;
+        const registeredClients = this.clients.listClients().map((client) => {
+            const entry = {
+                client_id: client.clientId,
+                token_endpoint_auth_method: client.publicClient ? 'none' : 'client_secret_post',
+                redirect_uris: this.clients.resolveRedirectUris(client.clientId),
+                post_logout_redirect_uris: this.clients.resolvePostLogoutRedirectUris(client.clientId),
+                grant_types: [...client.allowedGrantTypes],
+                response_types: ['code'],
+                scope: client.allowedScopes.join(' '),
+            };
+            if (!client.publicClient && client.clientSecret?.trim()) {
+                entry['client_secret'] = client.clientSecret.trim();
+            }
+            return entry;
+        });
+        const cookieKey = process.env['AUTH_OIDC_COOKIE_KEYS']?.trim() || process.env['JWT_SECRET']?.trim() || 'dev-oidc-provider-cookie-key';
+        /** Absolute URI resource indicator (RFC 8707); JWT `aud` stays fixed `platform`. */
+        const platformResource = 'urn:acorex:platform';
+        const provider = new Provider(this.issuer, {
+            adapter: oauth_redis_oidc_adapter_1.OAuthRedisOidcAdapter,
+            clients: registeredClients,
+            jwks,
+            cookies: {
+                keys: [cookieKey],
+            },
+            // Must include every scope registered on clients (invalid_client_metadata otherwise).
+            scopes: ['openid', 'offline_access', 'profile', 'email'],
+            routes: {
+                authorization: '/connect/authorize',
+                token: '/connect/token',
+                userinfo: '/connect/userinfo',
+                revocation: '/connect/revocation',
+                end_session: '/connect/endsession',
+                jwks: '/.well-known/jwks.json',
+            },
+            claims: {
+                openid: ['sub'],
+                profile: ['name', 'picture'],
+                email: ['email'],
+            },
+            features: {
+                // Built-in OP login/consent UI for standard clients (Keycloak, etc.).
+                // First-party SPA continues to use federation broker + Pure BFF cookies.
+                devInteractions: { enabled: process.env['NODE_ENV'] !== 'production' },
+                revocation: { enabled: true },
+                introspection: { enabled: false },
+                rpInitiatedLogout: { enabled: true },
+                resourceIndicators: {
+                    enabled: true,
+                    defaultResource: async () => platformResource,
+                    useGrantedResource: async () => true,
+                    getResourceServerInfo: async () => ({
+                        scope: 'openid profile email offline_access',
+                        audience: auth_config_1.PLATFORM_ACCESS_TOKEN_AUDIENCE,
+                        accessTokenFormat: 'jwt',
+                    }),
+                },
+            },
+            pkce: {
+                required: () => true,
+            },
+            findAccount: async (_ctx, id) => {
+                const looksLikeUuid = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(id.trim());
+                let user = null;
+                if (looksLikeUuid) {
+                    try {
+                        user = await credentials.findUserById(id);
+                    }
+                    catch {
+                        user = null;
+                    }
+                }
+                if (!user) {
+                    user = await credentials.findUserByUsername(id);
+                }
+                if (!user) {
+                    return undefined;
+                }
+                const email = typeof user.email === 'string' ? user.email : undefined;
+                return {
+                    // Must match session.accountId (login form may submit username, not UUID).
+                    accountId: id,
+                    async claims() {
+                        return {
+                            sub: user.id,
+                            email,
+                            name: user.displayName ?? user.username ?? user.id,
+                            picture: user.avatar ?? undefined,
+                        };
+                    },
+                };
+            },
+            extraTokenClaims: async (_ctx, token) => {
+                if (token.kind !== 'AccessToken') {
+                    return undefined;
+                }
+                return {
+                    typ: 'at+jwt',
+                };
+            },
+            renderError: async (ctx, out, error) => {
+                this.logger.error(`oidc-provider renderError: ${error?.name || 'Error'}: ${error?.message || String(error)}`);
+                if (error?.stack) {
+                    this.logger.error(error.stack);
+                }
+                ctx.type = 'html';
+                ctx.body = `<!DOCTYPE html><html><body><pre>${JSON.stringify(out, null, 2)}\n\n${String(error?.stack || error)}</pre></body></html>`;
+                ctx.status = 500;
+            },
+        });
+        provider.proxy = true;
+        this.provider = provider;
+        this.callbackHandler = provider.callback();
+    }
+};
+exports.OidcProviderEngineService = OidcProviderEngineService;
+exports.OidcProviderEngineService = OidcProviderEngineService = OidcProviderEngineService_1 = tslib_1.__decorate([
+    (0, common_1.Injectable)(),
+    tslib_1.__metadata("design:paramtypes", [oauth_client_registry_service_1.OAuthClientRegistryService,
+        auth_local_credentials_service_1.AuthLocalCredentialsService,
+        token_service_1.TokenService])
+], OidcProviderEngineService);
+//#endregion
+//# sourceMappingURL=oidc-provider-engine.service.js.map

package/security/src/lib/oauth/oidc-provider-engine.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oidc-provider-engine.service.js","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/oauth/oidc-provider-engine.service.ts"],"names":[],"mappings":";;;;;AAAA,2CAAkE;AAGlE,0EAAyC;AACzC,2FAAqF;AACrF,qDAAqE;AACrE,yDAAqD;AACrD,mFAA6E;AAC7E,2DAAyD;AACzD,yEAAmE;AAcnE,MAAM,QAAQ,GAAG,uBAAkD,CAAC;AAEpE,SAAS,2BAA2B;IAClC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,2BAA2B,CAAC,EAAE,IAAI,EAAE,EAAE,WAAW,EAAE,CAAC;IAC5E,IAAI,GAAG,KAAK,OAAO,IAAI,GAAG,KAAK,GAAG,EAAE,CAAC;QACnC,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAGM,IAAM,yBAAyB,iCAA/B,MAAM,yBAAyB;IAMpC,YACmB,OAAmC,EACnC,WAAwC,EACxC,MAAoB;QAFpB,YAAO,GAAP,OAAO,CAA4B;QACnC,gBAAW,GAAX,WAAW,CAA6B;QACxC,WAAM,GAAN,MAAM,CAAc;QARtB,WAAM,GAAG,IAAI,eAAM,CAAC,2BAAyB,CAAC,IAAI,CAAC,CAAC;QAC7D,aAAQ,GAAgC,IAAI,CAAC;QAC7C,oBAAe,GAAgC,IAAI,CAAC;QACpD,WAAM,GAAG,EAAE,CAAC;IAMjB,CAAC;IAEJ,KAAK,CAAC,YAAY;QAChB,IAAI,CAAC,2BAA2B,EAAE,EAAE,CAAC;YACnC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,kEAAkE,CAAC,CAAC;YACpF,OAAO;QACT,CAAC;QAED,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;YAC/B,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,sCAAsC,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC;QACzE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,sCAAsC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAC3E,CAAC;IACH,CAAC;IAED,SAAS;QACP,OAAO,IAAI,CAAC,QAAQ,IAAI,IAAI,IAAI,IAAI,CAAC,eAAe,IAAI,IAAI,CAAC;IAC/D,CAAC;IAED,SAAS;QACP,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;IAED,KAAK,CAAC,oBAAoB;QACxB,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACnB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC;IAChC,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,OAAO,CAAC,GAAY,EAAE,GAAa;QACvC,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC;YAC1B,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,2BAA2B,EAAE,CAAC,CAAC;YAC7D,OAAO;QACT,CAAC;QAED,MAAM,WAAW,GAAG,GAAG,CAAC,WAAW,IAAI,GAAG,CAAC,GAAG,CAAC;QAC/C,MAAM,QAAQ,GAAG,WAAW,CAAC,OAAO,CAAC,gBAAgB,EAAE,EAAE,CAAC,IAAI,WAAW,CAAC;QAC1E,MAAM,WAAW,GAAG,GAAG,CAAC,GAAG,CAAC;QAC5B,GAAG,CAAC,GAAG,GAAG,QAAQ,CAAC;QAEnB,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC1C,IAAI,CAAC,eAAgB,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,KAAe,EAAE,EAAE;gBAClD,GAAG,CAAC,GAAG,GAAG,WAAW,CAAC;gBACtB,IAAI,KAAK,EAAE,CAAC;oBACV,MAAM,CAAC,KAAK,CAAC,CAAC;oBACd,OAAO;gBACT,CAAC;gBACD,OAAO,EAAE,CAAC;YACZ,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,KAAK,CAAC,iBAAiB;QAC7B,IAAI,CAAC,MAAM,GAAG,IAAA,sCAAkB,GAAE,CAAC;QACnC,sFAAsF;QACtF,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC;QAC1C,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC;QAErC,MAAM,iBAAiB,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE;YAClE,MAAM,KAAK,GAA4B;gBACrC,SAAS,EAAE,MAAM,CAAC,QAAQ;gBAC1B,0BAA0B,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,oBAAoB;gBAC/E,aAAa,EAAE,IAAI,CAAC,OAAO,CAAC,mBAAmB,CAAC,MAAM,CAAC,QAAQ,CAAC;gBAChE,yBAAyB,EAAE,IAAI,CAAC,OAAO,CAAC,6BAA6B,CAAC,MAAM,CAAC,QAAQ,CAAC;gBACtF,WAAW,EAAE,CAAC,GAAG,MAAM,CAAC,iBAAiB,CAAC;gBAC1C,cAAc,EAAE,CAAC,MAAM,CAAC;gBACxB,KAAK,EAAE,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC;aACtC,CAAC;YACF,IAAI,CAAC,MAAM,CAAC,YAAY,IAAI,MAAM,CAAC,YAAY,EAAE,IAAI,EAAE,EAAE,CAAC;gBACxD,KAAK,CAAC,eAAe,CAAC,GAAG,MAAM,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC;YACtD,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC,CAAC,CAAC;QAEH,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,EAAE,IAAI,EAAE,IAAI,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,IAAI,8BAA8B,CAAC;QAEtI,oFAAoF;QACpF,MAAM,gBAAgB,GAAG,qBAAqB,CAAC;QAE/C,MAAM,QAAQ,GAAG,IAAI,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE;YACzC,OAAO,EAAE,gDAAqB;YAC9B,OAAO,EAAE,iBAAiB;YAC1B,IAAI;YACJ,OAAO,EAAE;gBACP,IAAI,EAAE,CAAC,SAAS,CAAC;aAClB;YACD,sFAAsF;YACtF,MAAM,EAAE,CAAC,QAAQ,EAAE,gBAAgB,EAAE,SAAS,EAAE,OAAO,CAAC;YACxD,MAAM,EAAE;gBACN,aAAa,EAAE,oBAAoB;gBACnC,KAAK,EAAE,gBAAgB;gBACvB,QAAQ,EAAE,mBAAmB;gBAC7B,UAAU,EAAE,qBAAqB;gBACjC,WAAW,EAAE,qBAAqB;gBAClC,IAAI,EAAE,wBAAwB;aAC/B;YACD,MAAM,EAAE;gBACN,MAAM,EAAE,CAAC,KAAK,CAAC;gBACf,OAAO,EAAE,CAAC,MAAM,EAAE,SAAS,CAAC;gBAC5B,KAAK,EAAE,CAAC,OAAO,CAAC;aACjB;YACD,QAAQ,EAAE;gBACR,sEAAsE;gBACtE,yEAAyE;gBACzE,eAAe,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,YAAY,EAAE;gBACtE,UAAU,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE;gBAC7B,aAAa,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE;gBACjC,iBAAiB,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE;gBACpC,kBAAkB,EAAE;oBAClB,OAAO,EAAE,IAAI;oBACb,eAAe,EAAE,KAAK,IAAI,EAAE,CAAC,gBAAgB;oBAC7C,kBAAkB,EAAE,KAAK,IAAI,EAAE,CAAC,IAAI;oBACpC,qBAAqB,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;wBAClC,KAAK,EAAE,qCAAqC;wBAC5C,QAAQ,EAAE,4CAA8B;wBACxC,iBAAiB,EAAE,KAAK;qBACzB,CAAC;iBACH;aACF;YACD,IAAI,EAAE;gBACJ,QAAQ,EAAE,GAAG,EAAE,CAAC,IAAI;aACrB;YACD,WAAW,EAAE,KAAK,EAAE,IAAa,EAAE,EAAU,EAAE,EAAE;gBAC/C,MAAM,aAAa,GAAG,4EAA4E,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC;gBACnH,IAAI,IAAI,GAAG,IAAwE,CAAC;gBACpF,IAAI,aAAa,EAAE,CAAC;oBAClB,IAAI,CAAC;wBACH,IAAI,GAAG,MAAM,WAAW,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;oBAC5C,CAAC;oBAAC,MAAM,CAAC;wBACP,IAAI,GAAG,IAAI,CAAC;oBACd,CAAC;gBACH,CAAC;gBACD,IAAI,CAAC,IAAI,EAAE,CAAC;oBACV,IAAI,GAAG,MAAM,WAAW,CAAC,kBAAkB,CAAC,EAAE,CAAC,CAAC;gBAClD,CAAC;gBACD,IAAI,CAAC,IAAI,EAAE,CAAC;oBACV,OAAO,SAAS,CAAC;gBACnB,CAAC;gBAED,MAAM,KAAK,GAAG,OAAQ,IAA4B,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAE,IAA2B,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;gBAEvH,OAAO;oBACL,2EAA2E;oBAC3E,SAAS,EAAE,EAAE;oBACb,KAAK,CAAC,MAAM;wBACV,OAAO;4BACL,GAAG,EAAE,IAAK,CAAC,EAAE;4BACb,KAAK;4BACL,IAAI,EAAE,IAAK,CAAC,WAAW,IAAI,IAAK,CAAC,QAAQ,IAAI,IAAK,CAAC,EAAE;4BACrD,OAAO,EAAE,IAAK,CAAC,MAAM,IAAI,SAAS;yBACnC,CAAC;oBACJ,CAAC;iBACF,CAAC;YACJ,CAAC;YACD,gBAAgB,EAAE,KAAK,EAAE,IAAa,EAAE,KAAwB,EAAE,EAAE;gBAClE,IAAI,KAAK,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;oBACjC,OAAO,SAAS,CAAC;gBACnB,CAAC;gBAED,OAAO;oBACL,GAAG,EAAE,QAAQ;iBACd,CAAC;YACJ,CAAC;YACD,WAAW,EAAE,KAAK,EAAE,GAAuD,EAAE,GAA4B,EAAE,KAAY,EAAE,EAAE;gBACzH,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,8BAA8B,KAAK,EAAE,IAAI,IAAI,OAAO,KAAK,KAAK,EAAE,OAAO,IAAI,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;gBAC9G,IAAI,KAAK,EAAE,KAAK,EAAE,CAAC;oBACjB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;gBACjC,CAAC;gBACD,GAAG,CAAC,IAAI,GAAG,MAAM,CAAC;gBAClB,GAAG,CAAC,IAAI,GAAG,mCAAmC,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,MAAM,CAAC,KAAK,EAAE,KAAK,IAAI,KAAK,CAAC,sBAAsB,CAAC;gBACrI,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;YACnB,CAAC;SACF,CAAC,CAAC;QAEH,QAAQ,CAAC,KAAK,GAAG,IAAI,CAAC;QAEtB,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,eAAe,GAAG,QAAQ,CAAC,QAAQ,EAAE,CAAC;IAC7C,CAAC;CACF,CAAA;AAnMY,8DAAyB;oCAAzB,yBAAyB;IADrC,IAAA,mBAAU,GAAE;6CAQiB,0DAA0B;QACtB,4DAA2B;QAChC,4BAAY;GAT5B,yBAAyB,CAmMrC;AAED,YAAY"}

package/security/src/lib/oauth/platform-oauth.service.d.ts

@@ -3,41 +3,70 @@ import { AuthService } from '../auth/auth.service';
 import { AuthLocalCredentialsService } from '../auth/auth-local-credentials.service';
 import { TokenService } from '../auth/token.service';
 import type { AuthRequestMeta } from '../auth/request-meta.util';
-import type { OAuthTokenResponse, PlatformOAuthAuthorizeRequest } from './platform-oauth.types';
+import type { OAuthExchangeResult, PlatformOAuthAuthorizeRequest } from './platform-oauth.types';
+import { OAuthOpService } from './oauth-op.service';
+import { OAuthRpService } from './oauth-rp.service';
+import { OAuthClientRegistryService } from './oauth-client-registry.service';
+export interface PlatformOAuthAuthorizeInitRequest {
+    clientId: string;
+    redirectUri: string;
+    scope: string;
+    provider: string;
+    issuer: string;
+}
 export declare class PlatformOAuthService {
     private readonly auth;
     private readonly credentials;
     private readonly tokens;
     private readonly moduleRef;
-    private readonly logger;
-    private readonly authorizationCodes;
-    private readonly externalStates;
-    constructor(auth: AuthService, credentials: AuthLocalCredentialsService, tokens: TokenService, moduleRef: ModuleRef);
+    private readonly op;
+    private readonly rp;
+    private readonly clients;
+    constructor(auth: AuthService, credentials: AuthLocalCredentialsService, tokens: TokenService, moduleRef: ModuleRef, op: OAuthOpService, rp: OAuthRpService, clients: OAuthClientRegistryService);
     getDiscoveryDocument(issuer: string): {
         issuer: string;
         authorization_endpoint: string;
         token_endpoint: string;
         jwks_uri: string;
+        userinfo_endpoint: string;
+        revocation_endpoint: string;
+        end_session_endpoint: string;
         response_types_supported: string[];
         grant_types_supported: string[];
         code_challenge_methods_supported: string[];
         scopes_supported: string[];
+        subject_types_supported: string[];
+        id_token_signing_alg_values_supported: string[];
     };
-    /** Dev platform broker uses HS256 id_tokens; JWKS is advertised for OIDC discovery clients only. */
+    /** JWKS document used by OIDC discovery clients to validate Platform `id_token` signatures. */
     getJwksDocument(): {
-        keys: unknown[];
+        keys: Array<Record<string, unknown>>;
     };
+    /**
+     * Detects first-party federation broker token requests (platform auth codes + platform JWT refresh tokens).
+     */
+    isBrokerTokenRequest(body: Record<string, string | undefined>): boolean;
+    /**
+     * BFF entry: server generates PKCE verifier/challenge and returns platform authorize URL.
+     * Verifier is stored server-side (never in browser localStorage).
+     */
+    initAuthorization(input: PlatformOAuthAuthorizeInitRequest): Promise<{
+        authorizeUrl: string;
+    }>;
     beginAuthorization(request: PlatformOAuthAuthorizeRequest): Promise<string>;
     completeExternalCallback(providerKey: string, code: string, state: string): Promise<string>;
-    exchangeAuthorizationCode(body: Record<string, string | undefined>, meta: AuthRequestMeta): Promise<OAuthTokenResponse>;
+    exchangeAuthorizationCode(body: Record<string, string | undefined>, meta: AuthRequestMeta): Promise<OAuthExchangeResult>;
+    endSession(input: {
+        idTokenHint?: string;
+        postLogoutRedirectUri?: string;
+        clientId?: string;
+        state?: string;
+    }): Promise<string | null>;
     private exchangeRefreshToken;
-    private exchangeExternalAuthorizationCode;
-    private parseIdToken;
-    private assertSupportedAuthorizeRequest;
-    private assertClientId;
-    private resolveAllowedClientIds;
+    private toOAuthExchangeResult;
     private requireBrokerConfig;
     private resolveIdentityProviderCatalog;
-    private verifyPkce;
+    private resolveProfileViaUserInfo;
+    private resolveIssuerFromUserInfoUrl;
 }
 //# sourceMappingURL=platform-oauth.service.d.ts.map

package/security/src/lib/oauth/platform-oauth.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"platform-oauth.service.d.ts","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/oauth/platform-oauth.service.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAQzC,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,EAAE,2BAA2B,EAAE,MAAM,wCAAwC,CAAC;AACrF,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAGjE,OAAO,KAAK,EAEV,kBAAkB,EAGlB,6BAA6B,EAC9B,MAAM,wBAAwB,CAAC;AAIhC,qBACa,oBAAoB;IAM7B,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,WAAW;IAC5B,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,SAAS;IAR5B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAyC;IAChE,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAsD;IACzF,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAkD;gBAG9D,IAAI,EAAE,WAAW,EACjB,WAAW,EAAE,2BAA2B,EACxC,MAAM,EAAE,YAAY,EACpB,SAAS,EAAE,SAAS;IAGvC,oBAAoB,CAAC,MAAM,EAAE,MAAM;;;;;;;;;;IAcnC,oGAAoG;IACpG,eAAe;cACQ,OAAO,EAAE;;IAG1B,kBAAkB,CAAC,OAAO,EAAE,6BAA6B,GAAG,OAAO,CAAC,MAAM,CAAC;IAmC3E,wBAAwB,CAC5B,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,MAAM,CAAC;IAyCZ,yBAAyB,CAC7B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,EACxC,IAAI,EAAE,eAAe,GACpB,OAAO,CAAC,kBAAkB,CAAC;YAkEhB,oBAAoB;YA2BpB,iCAAiC;IAgD/C,OAAO,CAAC,YAAY;IAmBpB,OAAO,CAAC,+BAA+B;IAoBvC,OAAO,CAAC,cAAc;IAOtB,OAAO,CAAC,uBAAuB;YAYjB,mBAAmB;IAgBjC,OAAO,CAAC,8BAA8B;IAUtC,OAAO,CAAC,UAAU;CAYnB"}
+{"version":3,"file":"platform-oauth.service.d.ts","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/oauth/platform-oauth.service.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAOzC,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,EAAE,2BAA2B,EAAE,MAAM,wCAAwC,CAAC;AAErF,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AACjE,OAAO,KAAK,EACV,mBAAmB,EAEnB,6BAA6B,EAC9B,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACpD,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACpD,OAAO,EAAE,0BAA0B,EAAE,MAAM,iCAAiC,CAAC;AAK7E,MAAM,WAAW,iCAAiC;IAChD,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,qBACa,oBAAoB;IAE7B,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,WAAW;IAC5B,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,EAAE;IACnB,OAAO,CAAC,QAAQ,CAAC,EAAE;IACnB,OAAO,CAAC,QAAQ,CAAC,OAAO;gBANP,IAAI,EAAE,WAAW,EACjB,WAAW,EAAE,2BAA2B,EACxC,MAAM,EAAE,YAAY,EACpB,SAAS,EAAE,SAAS,EACpB,EAAE,EAAE,cAAc,EAClB,EAAE,EAAE,cAAc,EAClB,OAAO,EAAE,0BAA0B;IAGtD,oBAAoB,CAAC,MAAM,EAAE,MAAM;;;;;;;;;;;;;;;IAmBnC,+FAA+F;IAC/F,eAAe;;;IAIf;;OAEG;IACH,oBAAoB,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,GAAG,OAAO;IAwBvE;;;OAGG;IACG,iBAAiB,CAAC,KAAK,EAAE,iCAAiC,GAAG,OAAO,CAAC;QAAE,YAAY,EAAE,MAAM,CAAA;KAAE,CAAC;IAwB9F,kBAAkB,CAAC,OAAO,EAAE,6BAA6B,GAAG,OAAO,CAAC,MAAM,CAAC;IAK3E,wBAAwB,CAC5B,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,MAAM,CAAC;IA6CZ,yBAAyB,CAC7B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,EACxC,IAAI,EAAE,eAAe,GACpB,OAAO,CAAC,mBAAmB,CAAC;IA+DzB,UAAU,CAAC,KAAK,EAAE;QACtB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,qBAAqB,CAAC,EAAE,MAAM,CAAC;QAC/B,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;YA2BZ,oBAAoB;IAgClC,OAAO,CAAC,qBAAqB;YAef,mBAAmB;IAgBjC,OAAO,CAAC,8BAA8B;YAUxB,yBAAyB;YA0BzB,4BAA4B;CAkB3C"}