@acorex-platform/framework-server 0.0.33 → 0.0.38

package/security/src/lib/oauth/redis-oauth-grant-store.service.js

@@ -0,0 +1,132 @@
+"use strict";
+var RedisOAuthGrantStore_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RedisOAuthGrantStore = void 0;
+const tslib_1 = require("tslib");
+const common_1 = require("@nestjs/common");
+const ioredis_1 = tslib_1.__importDefault(require("ioredis"));
+const oauth_grant_store_interface_1 = require("./oauth-grant-store.interface");
+function resolveOauthRedisConnection() {
+    const url = process.env['REDIS_URL']?.trim();
+    if (url) {
+        return { url };
+    }
+    const host = process.env['REDIS_HOST']?.trim();
+    const portRaw = Number(process.env['REDIS_PORT'] ?? 6379);
+    if (host) {
+        return { host, port: Number.isFinite(portRaw) ? portRaw : 6379 };
+    }
+    return null;
+}
+/**
+ * Atomic "GET then DEL" (GETDEL) semantics.
+ * Some Redis versions may not support GETDEL, so we emulate it via a Lua script.
+ */
+const GETDEL_SCRIPT = `
+local v = redis.call('GET', KEYS[1])
+if v then
+  redis.call('DEL', KEYS[1])
+end
+return v
+`;
+let RedisOAuthGrantStore = RedisOAuthGrantStore_1 = class RedisOAuthGrantStore extends oauth_grant_store_interface_1.OAuthGrantStore {
+    constructor() {
+        super();
+        this.logger = new common_1.Logger(RedisOAuthGrantStore_1.name);
+        this.localCodes = new Map();
+        this.localStates = new Map();
+        this.localPkceVerifiers = new Map();
+        const connection = resolveOauthRedisConnection();
+        if (!connection) {
+            this.logger.warn('Redis not configured; OAuth grant store falls back to in-process Map (single instance only).');
+            this.redis = null;
+            return;
+        }
+        this.redis =
+            'url' in connection
+                ? new ioredis_1.default(connection.url, { maxRetriesPerRequest: null, lazyConnect: true })
+                : new ioredis_1.default({ ...connection, maxRetriesPerRequest: null, lazyConnect: true });
+    }
+    keyForCode(code) {
+        return `axp:oauth:code:${code}`;
+    }
+    keyForState(state) {
+        return `axp:oauth:state:${state}`;
+    }
+    keyForPkceVerifier(codeChallenge) {
+        return `axp:oauth:pkce:${codeChallenge}`;
+    }
+    async saveCode(code, record, ttlMs) {
+        const key = this.keyForCode(code);
+        const value = JSON.stringify(record);
+        if (!this.redis) {
+            this.localCodes.set(key, value);
+            return;
+        }
+        await this.redis.set(key, value, 'PX', ttlMs);
+    }
+    async consumeCode(code) {
+        const key = this.keyForCode(code);
+        if (!this.redis) {
+            const raw = this.localCodes.get(key) ?? null;
+            this.localCodes.delete(key);
+            return raw ? JSON.parse(raw) : null;
+        }
+        const raw = (await this.redis.eval(GETDEL_SCRIPT, 1, key));
+        if (!raw) {
+            return null;
+        }
+        return JSON.parse(raw);
+    }
+    async saveState(state, record, ttlMs) {
+        const key = this.keyForState(state);
+        const value = JSON.stringify(record);
+        if (!this.redis) {
+            this.localStates.set(key, value);
+            return;
+        }
+        await this.redis.set(key, value, 'PX', ttlMs);
+    }
+    async consumeState(state) {
+        const key = this.keyForState(state);
+        if (!this.redis) {
+            const raw = this.localStates.get(key) ?? null;
+            this.localStates.delete(key);
+            return raw ? JSON.parse(raw) : null;
+        }
+        const raw = (await this.redis.eval(GETDEL_SCRIPT, 1, key));
+        if (!raw) {
+            return null;
+        }
+        return JSON.parse(raw);
+    }
+    async savePkceVerifier(codeChallenge, codeVerifier, ttlMs) {
+        const key = this.keyForPkceVerifier(codeChallenge);
+        if (!this.redis) {
+            this.localPkceVerifiers.set(key, codeVerifier);
+            return;
+        }
+        await this.redis.set(key, codeVerifier, 'PX', ttlMs);
+    }
+    async consumePkceVerifier(codeChallenge) {
+        const key = this.keyForPkceVerifier(codeChallenge);
+        if (!this.redis) {
+            const value = this.localPkceVerifiers.get(key) ?? null;
+            this.localPkceVerifiers.delete(key);
+            return value;
+        }
+        return (await this.redis.eval(GETDEL_SCRIPT, 1, key));
+    }
+    async onModuleDestroy() {
+        if (this.redis) {
+            await this.redis.quit().catch(() => this.redis?.disconnect());
+        }
+    }
+};
+exports.RedisOAuthGrantStore = RedisOAuthGrantStore;
+exports.RedisOAuthGrantStore = RedisOAuthGrantStore = RedisOAuthGrantStore_1 = tslib_1.__decorate([
+    (0, common_1.Injectable)(),
+    tslib_1.__metadata("design:paramtypes", [])
+], RedisOAuthGrantStore);
+//#endregion
+//# sourceMappingURL=redis-oauth-grant-store.service.js.map

package/security/src/lib/oauth/redis-oauth-grant-store.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redis-oauth-grant-store.service.js","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/oauth/redis-oauth-grant-store.service.ts"],"names":[],"mappings":";;;;;AAAA,2CAAqE;AACrE,8DAA4B;AAE5B,+EAAgE;AAMhE,SAAS,2BAA2B;IAClC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,CAAC;IAC7C,IAAI,GAAG,EAAE,CAAC;QACR,OAAO,EAAE,GAAG,EAAE,CAAC;IACjB,CAAC;IAED,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,CAAC;IAC/C,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,IAAI,CAAC,CAAC;IAC1D,IAAI,IAAI,EAAE,CAAC;QACT,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACnE,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;GAGG;AACH,MAAM,aAAa,GAAG;;;;;;CAMrB,CAAC;AAGK,IAAM,oBAAoB,4BAA1B,MAAM,oBAAqB,SAAQ,6CAAe;IAQvD;QACE,KAAK,EAAE,CAAC;QARO,WAAM,GAAG,IAAI,eAAM,CAAC,sBAAoB,CAAC,IAAI,CAAC,CAAC;QAG/C,eAAU,GAAG,IAAI,GAAG,EAAkB,CAAC;QACvC,gBAAW,GAAG,IAAI,GAAG,EAAkB,CAAC;QACxC,uBAAkB,GAAG,IAAI,GAAG,EAAkB,CAAC;QAI9D,MAAM,UAAU,GAAG,2BAA2B,EAAE,CAAC;QACjD,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,8FAA8F,CAAC,CAAC;YACjH,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;YAClB,OAAO;QACT,CAAC;QAED,IAAI,CAAC,KAAK;YACR,KAAK,IAAI,UAAU;gBACjB,CAAC,CAAC,IAAI,iBAAK,CAAC,UAAU,CAAC,GAAG,EAAE,EAAE,oBAAoB,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;gBAC9E,CAAC,CAAC,IAAI,iBAAK,CAAC,EAAE,GAAG,UAAU,EAAE,oBAAoB,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;IACpF,CAAC;IAEO,UAAU,CAAC,IAAY;QAC7B,OAAO,kBAAkB,IAAI,EAAE,CAAC;IAClC,CAAC;IAEO,WAAW,CAAC,KAAa;QAC/B,OAAO,mBAAmB,KAAK,EAAE,CAAC;IACpC,CAAC;IAEO,kBAAkB,CAAC,aAAqB;QAC9C,OAAO,kBAAkB,aAAa,EAAE,CAAC;IAC3C,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,IAAY,EAAE,MAAuB,EAAE,KAAa;QACjE,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QAClC,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QAErC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;YAChB,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAChC,OAAO;QACT,CAAC;QAED,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;IAChD,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,IAAY;QAC5B,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QAClC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;YAChB,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC;YAC7C,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC5B,OAAO,GAAG,CAAC,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAqB,CAAC,CAAC,CAAC,IAAI,CAAC;QAC3D,CAAC;QAED,MAAM,GAAG,GAAG,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC,EAAE,GAAG,CAAC,CAAkB,CAAC;QAC5E,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAoB,CAAC;IAC5C,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,KAAa,EAAE,MAAgC,EAAE,KAAa;QAC5E,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;QACpC,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QAErC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;YAChB,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YACjC,OAAO;QACT,CAAC;QAED,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;IAChD,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,KAAa;QAC9B,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;QACpC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;YAChB,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC;YAC9C,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC7B,OAAO,GAAG,CAAC,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAA8B,CAAC,CAAC,CAAC,IAAI,CAAC;QACpE,CAAC;QAED,MAAM,GAAG,GAAG,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC,EAAE,GAAG,CAAC,CAAkB,CAAC;QAC5E,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAA6B,CAAC;IACrD,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,aAAqB,EAAE,YAAoB,EAAE,KAAa;QAC/E,MAAM,GAAG,GAAG,IAAI,CAAC,kBAAkB,CAAC,aAAa,CAAC,CAAC;QACnD,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;YAChB,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;YAC/C,OAAO;QACT,CAAC;QAED,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,YAAY,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;IACvD,CAAC;IAED,KAAK,CAAC,mBAAmB,CAAC,aAAqB;QAC7C,MAAM,GAAG,GAAG,IAAI,CAAC,kBAAkB,CAAC,aAAa,CAAC,CAAC;QACnD,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;YAChB,MAAM,KAAK,GAAG,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC;YACvD,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACpC,OAAO,KAAK,CAAC;QACf,CAAC;QAED,OAAO,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC,EAAE,GAAG,CAAC,CAAkB,CAAC;IACzE,CAAC;IAED,KAAK,CAAC,eAAe;QACnB,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC;QAChE,CAAC;IACH,CAAC;CACF,CAAA;AArHY,oDAAoB;+BAApB,oBAAoB;IADhC,IAAA,mBAAU,GAAE;;GACA,oBAAoB,CAqHhC;AAED,YAAY"}

package/security/src/lib/oauth/testing/in-memory-oauth-grant-store.d.ts

@@ -0,0 +1,14 @@
+import type { OAuthCodeRecord, OAuthExternalStateRecord } from '../oauth-op.types';
+import { OAuthGrantStore } from '../oauth-grant-store.interface';
+export declare class InMemoryOAuthGrantStore extends OAuthGrantStore {
+    private readonly codes;
+    private readonly states;
+    private readonly pkceVerifiers;
+    saveCode(code: string, record: OAuthCodeRecord, _ttlMs: number): Promise<void>;
+    consumeCode(code: string): Promise<OAuthCodeRecord | null>;
+    saveState(state: string, record: OAuthExternalStateRecord, _ttlMs: number): Promise<void>;
+    consumeState(state: string): Promise<OAuthExternalStateRecord | null>;
+    savePkceVerifier(codeChallenge: string, codeVerifier: string, _ttlMs: number): Promise<void>;
+    consumePkceVerifier(codeChallenge: string): Promise<string | null>;
+}
+//# sourceMappingURL=in-memory-oauth-grant-store.d.ts.map

package/security/src/lib/oauth/testing/in-memory-oauth-grant-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"in-memory-oauth-grant-store.d.ts","sourceRoot":"","sources":["../../../../../../../../../libs/framework/server/security/src/lib/oauth/testing/in-memory-oauth-grant-store.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,eAAe,EAAE,wBAAwB,EAAE,MAAM,mBAAmB,CAAC;AACnF,OAAO,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AAEjE,qBAAa,uBAAwB,SAAQ,eAAe;IAC1D,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAsC;IAC5D,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA+C;IACtE,OAAO,CAAC,QAAQ,CAAC,aAAa,CAA6B;IAErD,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAI9E,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC;IAQ1D,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,wBAAwB,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIzF,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,wBAAwB,GAAG,IAAI,CAAC;IAQrE,gBAAgB,CAAC,aAAa,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAI5F,mBAAmB,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;CAOzE"}

package/security/src/lib/oauth/testing/in-memory-oauth-grant-store.js

@@ -0,0 +1,46 @@
+"use strict";
+//#region ---- In-memory OAuth grant store (tests only) ----
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.InMemoryOAuthGrantStore = void 0;
+const oauth_grant_store_interface_1 = require("../oauth-grant-store.interface");
+class InMemoryOAuthGrantStore extends oauth_grant_store_interface_1.OAuthGrantStore {
+    constructor() {
+        super(...arguments);
+        this.codes = new Map();
+        this.states = new Map();
+        this.pkceVerifiers = new Map();
+    }
+    async saveCode(code, record, _ttlMs) {
+        this.codes.set(code, record);
+    }
+    async consumeCode(code) {
+        const record = this.codes.get(code) ?? null;
+        if (record) {
+            this.codes.delete(code);
+        }
+        return record;
+    }
+    async saveState(state, record, _ttlMs) {
+        this.states.set(state, record);
+    }
+    async consumeState(state) {
+        const record = this.states.get(state) ?? null;
+        if (record) {
+            this.states.delete(state);
+        }
+        return record;
+    }
+    async savePkceVerifier(codeChallenge, codeVerifier, _ttlMs) {
+        this.pkceVerifiers.set(codeChallenge, codeVerifier);
+    }
+    async consumePkceVerifier(codeChallenge) {
+        const verifier = this.pkceVerifiers.get(codeChallenge) ?? null;
+        if (verifier) {
+            this.pkceVerifiers.delete(codeChallenge);
+        }
+        return verifier;
+    }
+}
+exports.InMemoryOAuthGrantStore = InMemoryOAuthGrantStore;
+//#endregion
+//# sourceMappingURL=in-memory-oauth-grant-store.js.map

package/security/src/lib/oauth/testing/in-memory-oauth-grant-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"in-memory-oauth-grant-store.js","sourceRoot":"","sources":["../../../../../../../../../libs/framework/server/security/src/lib/oauth/testing/in-memory-oauth-grant-store.ts"],"names":[],"mappings":";AAAA,4DAA4D;;;AAG5D,gFAAiE;AAEjE,MAAa,uBAAwB,SAAQ,6CAAe;IAA5D;;QACmB,UAAK,GAAG,IAAI,GAAG,EAA2B,CAAC;QAC3C,WAAM,GAAG,IAAI,GAAG,EAAoC,CAAC;QACrD,kBAAa,GAAG,IAAI,GAAG,EAAkB,CAAC;IAqC7D,CAAC;IAnCC,KAAK,CAAC,QAAQ,CAAC,IAAY,EAAE,MAAuB,EAAE,MAAc;QAClE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC/B,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,IAAY;QAC5B,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC;QAC5C,IAAI,MAAM,EAAE,CAAC;YACX,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC1B,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,KAAa,EAAE,MAAgC,EAAE,MAAc;QAC7E,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACjC,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,KAAa;QAC9B,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC;QAC9C,IAAI,MAAM,EAAE,CAAC;YACX,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC5B,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,aAAqB,EAAE,YAAoB,EAAE,MAAc;QAChF,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,aAAa,EAAE,YAAY,CAAC,CAAC;IACtD,CAAC;IAED,KAAK,CAAC,mBAAmB,CAAC,aAAqB;QAC7C,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,IAAI,CAAC;QAC/D,IAAI,QAAQ,EAAE,CAAC;YACb,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;QAC3C,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF;AAxCD,0DAwCC;AAED,YAAY"}

package/security/src/lib/oauth/testing/jest-empty-module.d.ts

@@ -0,0 +1,4 @@
+export declare class EntityStorageMiddlewareService {
+}
+export declare function bypassAllEntityVisibilityFilters<T>(query: T): T;
+//# sourceMappingURL=jest-empty-module.d.ts.map

package/security/src/lib/oauth/testing/jest-empty-module.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"jest-empty-module.d.ts","sourceRoot":"","sources":["../../../../../../../../../libs/framework/server/security/src/lib/oauth/testing/jest-empty-module.ts"],"names":[],"mappings":"AAAA,qBAAa,8BAA8B;CAAG;AAE9C,wBAAgB,gCAAgC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,GAAG,CAAC,CAE/D"}

package/security/src/lib/oauth/testing/jest-empty-module.js

@@ -0,0 +1,11 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.EntityStorageMiddlewareService = void 0;
+exports.bypassAllEntityVisibilityFilters = bypassAllEntityVisibilityFilters;
+class EntityStorageMiddlewareService {
+}
+exports.EntityStorageMiddlewareService = EntityStorageMiddlewareService;
+function bypassAllEntityVisibilityFilters(query) {
+    return query;
+}
+//# sourceMappingURL=jest-empty-module.js.map

package/security/src/lib/oauth/testing/jest-empty-module.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jest-empty-module.js","sourceRoot":"","sources":["../../../../../../../../../libs/framework/server/security/src/lib/oauth/testing/jest-empty-module.ts"],"names":[],"mappings":";;;AAEA,4EAEC;AAJD,MAAa,8BAA8B;CAAG;AAA9C,wEAA8C;AAE9C,SAAgB,gCAAgC,CAAI,KAAQ;IAC1D,OAAO,KAAK,CAAC;AACf,CAAC"}

package/security/src/lib/oauth/testing/mock-oidc-provider.d.ts

@@ -0,0 +1,49 @@
+export type MockOidcProviderOptions = {
+    issuer: string;
+    audience?: string;
+    invalidSignature?: boolean;
+    wrongIssuer?: string;
+    wrongAudience?: string;
+    expired?: boolean;
+    wrongNonce?: string;
+};
+export declare class MockOidcProvider {
+    readonly issuer: string;
+    readonly clientId = "mock-client";
+    readonly clientSecret = "mock-secret";
+    readonly authorizationUrl: string;
+    readonly tokenUrl: string;
+    readonly userInfoUrl: string;
+    private readonly privateKeyPem;
+    private readonly publicJwk;
+    private readonly kid;
+    private server;
+    private port;
+    private options;
+    constructor(options?: Partial<MockOidcProviderOptions>);
+    start(): Promise<void>;
+    stop(): Promise<void>;
+    get runningIssuer(): string;
+    getBrokerConfig(): {
+        key: string;
+        enabled: boolean;
+        clientId: string;
+        clientSecret: string;
+        authorizationUrl: string;
+        tokenUrl: string;
+        userInfoUrl: string;
+        scopes: string;
+    };
+    signIdToken(input: {
+        sub: string;
+        email?: string;
+        emailVerified?: boolean;
+        name?: string;
+        nonce?: string;
+        overrideOptions?: Partial<MockOidcProviderOptions>;
+    }): string;
+    private baseUrl;
+    private sendJson;
+    private readBody;
+}
+//# sourceMappingURL=mock-oidc-provider.d.ts.map

package/security/src/lib/oauth/testing/mock-oidc-provider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mock-oidc-provider.d.ts","sourceRoot":"","sources":["../../../../../../../../../libs/framework/server/security/src/lib/oauth/testing/mock-oidc-provider.ts"],"names":[],"mappings":"AAMA,MAAM,MAAM,uBAAuB,GAAG;IACpC,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF,qBAAa,gBAAgB;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,iBAAiB;IAClC,QAAQ,CAAC,YAAY,iBAAiB;IACtC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAE7B,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAS;IACvC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAA0B;IACpD,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAS;IAC7B,OAAO,CAAC,MAAM,CAAuB;IACrC,OAAO,CAAC,IAAI,CAAK;IACjB,OAAO,CAAC,OAAO,CAA0B;gBAE7B,OAAO,CAAC,EAAE,OAAO,CAAC,uBAAuB,CAAC;IAwBhD,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAgEtB,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAW3B,IAAI,aAAa,IAAI,MAAM,CAE1B;IAED,eAAe;;;;;;;;;;IAcf,WAAW,CAAC,KAAK,EAAE;QACjB,GAAG,EAAE,MAAM,CAAC;QACZ,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,aAAa,CAAC,EAAE,OAAO,CAAC;QACxB,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,eAAe,CAAC,EAAE,OAAO,CAAC,uBAAuB,CAAC,CAAC;KACpD,GAAG,MAAM;IAgCV,OAAO,CAAC,OAAO;IAIf,OAAO,CAAC,QAAQ;IAMhB,OAAO,CAAC,QAAQ;CAQjB"}

package/security/src/lib/oauth/testing/mock-oidc-provider.js

@@ -0,0 +1,158 @@
+"use strict";
+//#region ---- Mock OIDC Provider (tests only) ----
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MockOidcProvider = void 0;
+const tslib_1 = require("tslib");
+const http_1 = require("http");
+const crypto_1 = require("crypto");
+const jwt = tslib_1.__importStar(require("jsonwebtoken"));
+class MockOidcProvider {
+    constructor(options) {
+        this.clientId = 'mock-client';
+        this.clientSecret = 'mock-secret';
+        this.server = null;
+        this.port = 0;
+        this.issuer = (options?.issuer ?? 'http://127.0.0.1:0/mock-issuer').replace(/\/$/, '');
+        this.options = {
+            issuer: this.issuer,
+            audience: options?.audience ?? this.clientId,
+            ...options,
+        };
+        const generated = (0, crypto_1.generateKeyPairSync)('rsa', {
+            modulusLength: 2048,
+            publicKeyEncoding: { type: 'spki', format: 'pem' },
+            privateKeyEncoding: { type: 'pkcs8', format: 'pem' },
+        });
+        this.privateKeyPem = generated.privateKey;
+        const publicKeyObject = (0, crypto_1.createPublicKey)(generated.publicKey);
+        this.publicJwk = publicKeyObject.export({ format: 'jwk' });
+        this.kid = (0, crypto_1.createHash)('sha256').update(generated.publicKey).digest('base64url');
+        this.authorizationUrl = `${this.issuer}/authorize`;
+        this.tokenUrl = `${this.issuer}/token`;
+        this.userInfoUrl = `${this.issuer}/userinfo`;
+    }
+    async start() {
+        if (this.server) {
+            return;
+        }
+        this.server = (0, http_1.createServer)(async (req, res) => {
+            const url = new URL(req.url ?? '/', this.baseUrl());
+            if (url.pathname === '/.well-known/openid-configuration') {
+                this.sendJson(res, 200, {
+                    issuer: this.runningIssuer,
+                    authorization_endpoint: `${this.runningIssuer}/authorize`,
+                    token_endpoint: `${this.runningIssuer}/token`,
+                    userinfo_endpoint: `${this.runningIssuer}/userinfo`,
+                    jwks_uri: `${this.runningIssuer}/.well-known/jwks.json`,
+                });
+                return;
+            }
+            if (url.pathname === '/.well-known/jwks.json') {
+                this.sendJson(res, 200, {
+                    keys: [{ ...this.publicJwk, use: 'sig', alg: 'RS256', kid: this.kid }],
+                });
+                return;
+            }
+            if (url.pathname === '/token' && req.method === 'POST') {
+                const body = await this.readBody(req);
+                const params = new URLSearchParams(body);
+                const code = params.get('code') ?? 'mock-code';
+                const idToken = this.signIdToken({
+                    sub: 'external-subject-1',
+                    email: 'verified@example.com',
+                    emailVerified: true,
+                    name: 'Verified User',
+                    nonce: params.get('nonce') ?? undefined,
+                });
+                this.sendJson(res, 200, {
+                    access_token: `mock-access-${code}`,
+                    id_token: idToken,
+                    token_type: 'Bearer',
+                    expires_in: 3600,
+                });
+                return;
+            }
+            res.statusCode = 404;
+            res.end('not found');
+        });
+        await new Promise((resolve) => {
+            this.server.listen(0, '127.0.0.1', () => {
+                const address = this.server.address();
+                this.port = typeof address === 'object' && address ? address.port : 0;
+                this.options = {
+                    ...this.options,
+                    issuer: `http://127.0.0.1:${this.port}`,
+                };
+                resolve();
+            });
+        });
+    }
+    async stop() {
+        if (!this.server) {
+            return;
+        }
+        await new Promise((resolve, reject) => {
+            this.server.close((error) => (error ? reject(error) : resolve()));
+        });
+        this.server = null;
+    }
+    get runningIssuer() {
+        return `http://127.0.0.1:${this.port}`;
+    }
+    getBrokerConfig() {
+        const issuer = this.runningIssuer;
+        return {
+            key: 'mock',
+            enabled: true,
+            clientId: this.clientId,
+            clientSecret: this.clientSecret,
+            authorizationUrl: `${issuer}/authorize`,
+            tokenUrl: `${issuer}/token`,
+            userInfoUrl: `${issuer}/userinfo`,
+            scopes: 'openid profile email',
+        };
+    }
+    signIdToken(input) {
+        const opts = { ...this.options, ...input.overrideOptions };
+        const issuer = opts.wrongIssuer ?? this.runningIssuer;
+        const audience = opts.wrongAudience ?? opts.audience ?? this.clientId;
+        const expiresIn = opts.expired ? -60 : 3600;
+        const nonce = opts.wrongNonce ?? input.nonce;
+        const token = jwt.sign({
+            sub: input.sub,
+            email: input.email,
+            email_verified: input.emailVerified,
+            name: input.name,
+            ...(nonce ? { nonce } : {}),
+        }, this.privateKeyPem, {
+            algorithm: 'RS256',
+            keyid: this.kid,
+            issuer,
+            audience,
+            expiresIn,
+        });
+        if (opts.invalidSignature) {
+            return `${token}x`;
+        }
+        return token;
+    }
+    baseUrl() {
+        return `http://127.0.0.1:${this.port}`;
+    }
+    sendJson(res, status, body) {
+        res.statusCode = status;
+        res.setHeader('content-type', 'application/json');
+        res.end(JSON.stringify(body));
+    }
+    readBody(req) {
+        return new Promise((resolve, reject) => {
+            const chunks = [];
+            req.on('data', (chunk) => chunks.push(Buffer.from(chunk)));
+            req.on('end', () => resolve(Buffer.concat(chunks).toString('utf8')));
+            req.on('error', reject);
+        });
+    }
+}
+exports.MockOidcProvider = MockOidcProvider;
+//#endregion
+//# sourceMappingURL=mock-oidc-provider.js.map

package/security/src/lib/oauth/testing/mock-oidc-provider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mock-oidc-provider.js","sourceRoot":"","sources":["../../../../../../../../../libs/framework/server/security/src/lib/oauth/testing/mock-oidc-provider.ts"],"names":[],"mappings":";AAAA,mDAAmD;;;;AAEnD,+BAAiD;AACjD,mCAA0E;AAC1E,0DAAoC;AAYpC,MAAa,gBAAgB;IAe3B,YAAY,OAA0C;QAb7C,aAAQ,GAAG,aAAa,CAAC;QACzB,iBAAY,GAAG,aAAa,CAAC;QAQ9B,WAAM,GAAkB,IAAI,CAAC;QAC7B,SAAI,GAAG,CAAC,CAAC;QAIf,IAAI,CAAC,MAAM,GAAG,CAAC,OAAO,EAAE,MAAM,IAAI,gCAAgC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACvF,IAAI,CAAC,OAAO,GAAG;YACb,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,QAAQ,EAAE,OAAO,EAAE,QAAQ,IAAI,IAAI,CAAC,QAAQ;YAC5C,GAAG,OAAO;SACX,CAAC;QAEF,MAAM,SAAS,GAAG,IAAA,4BAAmB,EAAC,KAAK,EAAE;YAC3C,aAAa,EAAE,IAAI;YACnB,iBAAiB,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE;YAClD,kBAAkB,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE;SACrD,CAAC,CAAC;QAEH,IAAI,CAAC,aAAa,GAAG,SAAS,CAAC,UAAU,CAAC;QAC1C,MAAM,eAAe,GAAG,IAAA,wBAAe,EAAC,SAAS,CAAC,SAAS,CAAC,CAAC;QAC7D,IAAI,CAAC,SAAS,GAAG,eAAe,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAA4B,CAAC;QACtF,IAAI,CAAC,GAAG,GAAG,IAAA,mBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QAEhF,IAAI,CAAC,gBAAgB,GAAG,GAAG,IAAI,CAAC,MAAM,YAAY,CAAC;QACnD,IAAI,CAAC,QAAQ,GAAG,GAAG,IAAI,CAAC,MAAM,QAAQ,CAAC;QACvC,IAAI,CAAC,WAAW,GAAG,GAAG,IAAI,CAAC,MAAM,WAAW,CAAC;IAC/C,CAAC;IAED,KAAK,CAAC,KAAK;QACT,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,OAAO;QACT,CAAC;QAED,IAAI,CAAC,MAAM,GAAG,IAAA,mBAAY,EAAC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;YAC5C,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;YAEpD,IAAI,GAAG,CAAC,QAAQ,KAAK,mCAAmC,EAAE,CAAC;gBACzD,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE;oBACtB,MAAM,EAAE,IAAI,CAAC,aAAa;oBAC1B,sBAAsB,EAAE,GAAG,IAAI,CAAC,aAAa,YAAY;oBACzD,cAAc,EAAE,GAAG,IAAI,CAAC,aAAa,QAAQ;oBAC7C,iBAAiB,EAAE,GAAG,IAAI,CAAC,aAAa,WAAW;oBACnD,QAAQ,EAAE,GAAG,IAAI,CAAC,aAAa,wBAAwB;iBACxD,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YAED,IAAI,GAAG,CAAC,QAAQ,KAAK,wBAAwB,EAAE,CAAC;gBAC9C,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE;oBACtB,IAAI,EAAE,CAAC,EAAE,GAAG,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC;iBACvE,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YAED,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBACvD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;gBACtC,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC;gBACzC,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,WAAW,CAAC;gBAC/C,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,CAAC;oBAC/B,GAAG,EAAE,oBAAoB;oBACzB,KAAK,EAAE,sBAAsB;oBAC7B,aAAa,EAAE,IAAI;oBACnB,IAAI,EAAE,eAAe;oBACrB,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,SAAS;iBACxC,CAAC,CAAC;gBAEH,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE;oBACtB,YAAY,EAAE,eAAe,IAAI,EAAE;oBACnC,QAAQ,EAAE,OAAO;oBACjB,UAAU,EAAE,QAAQ;oBACpB,UAAU,EAAE,IAAI;iBACjB,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YAED,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC;YACrB,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACvB,CAAC,CAAC,CAAC;QAEH,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;YAClC,IAAI,CAAC,MAAO,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE;gBACvC,MAAM,OAAO,GAAG,IAAI,CAAC,MAAO,CAAC,OAAO,EAAE,CAAC;gBACvC,IAAI,CAAC,IAAI,GAAG,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;gBACtE,IAAI,CAAC,OAAO,GAAG;oBACb,GAAG,IAAI,CAAC,OAAO;oBACf,MAAM,EAAE,oBAAoB,IAAI,CAAC,IAAI,EAAE;iBACxC,CAAC;gBACF,OAAO,EAAE,CAAC;YACZ,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,IAAI;QACR,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YACjB,OAAO;QACT,CAAC;QAED,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC1C,IAAI,CAAC,MAAO,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QACrE,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;IACrB,CAAC;IAED,IAAI,aAAa;QACf,OAAO,oBAAoB,IAAI,CAAC,IAAI,EAAE,CAAC;IACzC,CAAC;IAED,eAAe;QACb,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC;QAClC,OAAO;YACL,GAAG,EAAE,MAAM;YACX,OAAO,EAAE,IAAI;YACb,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,gBAAgB,EAAE,GAAG,MAAM,YAAY;YACvC,QAAQ,EAAE,GAAG,MAAM,QAAQ;YAC3B,WAAW,EAAE,GAAG,MAAM,WAAW;YACjC,MAAM,EAAE,sBAAsB;SAC/B,CAAC;IACJ,CAAC;IAED,WAAW,CAAC,KAOX;QACC,MAAM,IAAI,GAAG,EAAE,GAAG,IAAI,CAAC,OAAO,EAAE,GAAG,KAAK,CAAC,eAAe,EAAE,CAAC;QAC3D,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,aAAa,CAAC;QACtD,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,IAAI,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,QAAQ,CAAC;QACtE,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QAC5C,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,IAAI,KAAK,CAAC,KAAK,CAAC;QAE7C,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,CACpB;YACE,GAAG,EAAE,KAAK,CAAC,GAAG;YACd,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,cAAc,EAAE,KAAK,CAAC,aAAa;YACnC,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC5B,EACD,IAAI,CAAC,aAAa,EAClB;YACE,SAAS,EAAE,OAAO;YAClB,KAAK,EAAE,IAAI,CAAC,GAAG;YACf,MAAM;YACN,QAAQ;YACR,SAAS;SACV,CACF,CAAC;QAEF,IAAI,IAAI,CAAC,gBAAgB,EAAE,CAAC;YAC1B,OAAO,GAAG,KAAK,GAAG,CAAC;QACrB,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAEO,OAAO;QACb,OAAO,oBAAoB,IAAI,CAAC,IAAI,EAAE,CAAC;IACzC,CAAC;IAEO,QAAQ,CAAC,GAAkC,EAAE,MAAc,EAAE,IAAa;QAChF,GAAG,CAAC,UAAU,GAAG,MAAM,CAAC;QACxB,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;QAClD,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;IAChC,CAAC;IAEO,QAAQ,CAAC,GAAmC;QAClD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACrC,MAAM,MAAM,GAAa,EAAE,CAAC;YAC5B,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAC3D,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YACrE,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC1B,CAAC,CAAC,CAAC;IACL,CAAC;CACF;AA7LD,4CA6LC;AAED,YAAY"}

package/security/src/lib/security.module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"security.module.d.ts","sourceRoot":"","sources":["../../../../../../../libs/framework/server/security/src/lib/security.module.ts"],"names":[],"mappings":"AAAA,OAAO,EAAU,kBAAkB,EAAU,UAAU,EAAgC,MAAM,gBAAgB,CAAC;AA4B9G;;;GAGG;AACH,qBAuDa,cAAe,YAAW,UAAU;IAC/C,SAAS,CAAC,QAAQ,EAAE,kBAAkB,GAAG,IAAI;CAK9C"}
+{"version":3,"file":"security.module.d.ts","sourceRoot":"","sources":["../../../../../../../libs/framework/server/security/src/lib/security.module.ts"],"names":[],"mappings":"AAAA,OAAO,EAAU,kBAAkB,EAAU,UAAU,EAAgC,MAAM,gBAAgB,CAAC;AAmC9G;;;GAGG;AACH,qBA6Ea,cAAe,YAAW,UAAU;IAC/C,SAAS,CAAC,QAAQ,EAAE,kBAAkB,GAAG,IAAI;CAY9C"}

package/security/src/lib/security.module.js

@@ -17,6 +17,13 @@ const jwt_auth_guard_1 = require("./auth/jwt-auth.guard");
 const local_strategy_1 = require("./auth/strategies/local.strategy");
 const connect_controller_1 = require("./oauth/connect.controller");
 const platform_oauth_service_1 = require("./oauth/platform-oauth.service");
+const oauth_op_service_1 = require("./oauth/oauth-op.service");
+const oauth_rp_service_1 = require("./oauth/oauth-rp.service");
+const oauth_client_registry_service_1 = require("./oauth/oauth-client-registry.service");
+const oidc_provider_engine_service_1 = require("./oauth/oidc-provider-engine.service");
+const redis_oauth_grant_store_service_1 = require("./oauth/redis-oauth-grant-store.service");
+const oauth_grant_store_interface_1 = require("./oauth/oauth-grant-store.interface");
+const auth_csrf_middleware_1 = require("./auth/auth-csrf.middleware");
 const saml_sp_service_1 = require("./auth/saml/saml-sp.service");
 const entity_access_policy_loader_1 = require("./entity-storage/entity-access-policy.loader");
 const policy_enforce_middleware_1 = require("./entity-storage/policy-enforce.middleware");
@@ -34,6 +41,9 @@ const auth_runtime_handlers_1 = require("./auth/auth-runtime.handlers");
  */
 let SecurityModule = class SecurityModule {
     configure(consumer) {
+        consumer
+            .apply(auth_csrf_middleware_1.AuthCsrfMiddleware)
+            .forRoutes({ path: 'connect/token', method: common_1.RequestMethod.POST }, { path: 'connect/revocation', method: common_1.RequestMethod.POST });
         consumer
             .apply(optional_jwt_session_middleware_1.OptionalJwtSessionMiddleware)
             .forRoutes({ path: '*splat', method: common_1.RequestMethod.ALL });
@@ -48,6 +58,11 @@ exports.SecurityModule = SecurityModule = tslib_1.__decorate([
         providers: [
             auth_service_1.AuthService,
             platform_oauth_service_1.PlatformOAuthService,
+            oauth_rp_service_1.OAuthRpService,
+            oauth_op_service_1.OAuthOpService,
+            oauth_client_registry_service_1.OAuthClientRegistryService,
+            oidc_provider_engine_service_1.OidcProviderEngineService,
+            redis_oauth_grant_store_service_1.RedisOAuthGrantStore,
             saml_sp_service_1.SamlSpService,
             auth_local_credentials_service_1.AuthLocalCredentialsService,
             login_attempt_service_1.LoginAttemptService,
@@ -61,11 +76,21 @@ exports.SecurityModule = SecurityModule = tslib_1.__decorate([
             session_context_service_1.SessionContextService,
             jwt_auth_guard_1.JwtAuthGuard,
             optional_jwt_session_middleware_1.OptionalJwtSessionMiddleware,
+            auth_csrf_middleware_1.AuthCsrfMiddleware,
             visibility_filter_middleware_1.VisibilityFilterMiddleware,
             policy_enforce_middleware_1.PolicyEnforceMiddleware,
             security_entity_storage_bootstrap_1.SecurityEntityStorageBootstrap,
             entity_access_policy_loader_1.EntityAccessPolicyLoader,
             runtime_permission_service_1.RuntimePermissionService,
+            {
+                provide: oauth_grant_store_interface_1.OAuthGrantStore,
+                useExisting: redis_oauth_grant_store_service_1.RedisOAuthGrantStore,
+            },
+            {
+                provide: 'AUTH_ENTITY_API_REQUIRE_AUTH',
+                useValue: process.env['AUTH_ENTITY_API_REQUIRE_AUTH']?.trim()?.toLowerCase() === 'true' ||
+                    process.env['NODE_ENV']?.trim()?.toLowerCase() === 'production',
+            },
             ...auth_runtime_handlers_1.AUTH_RUNTIME_COMMANDS,
             ...auth_runtime_handlers_1.AUTH_RUNTIME_QUERIES,
             {
@@ -83,6 +108,7 @@ exports.SecurityModule = SecurityModule = tslib_1.__decorate([
             auth_service_1.AuthService,
             token_service_1.TokenService,
             token_resolver_service_1.TokenResolverService,
+            device_session_service_1.DeviceSessionService,
             auth_cookie_service_1.AuthCookieService,
             saml_sp_service_1.SamlSpService,
             machine_token_service_1.MachineTokenService,
@@ -93,6 +119,11 @@ exports.SecurityModule = SecurityModule = tslib_1.__decorate([
             policy_enforce_middleware_1.PolicyEnforceMiddleware,
             entity_access_policy_loader_1.EntityAccessPolicyLoader,
             runtime_permission_service_1.RuntimePermissionService,
+            oauth_rp_service_1.OAuthRpService,
+            oauth_op_service_1.OAuthOpService,
+            oauth_client_registry_service_1.OAuthClientRegistryService,
+            oidc_provider_engine_service_1.OidcProviderEngineService,
+            redis_oauth_grant_store_service_1.RedisOAuthGrantStore,
             core_1.ENTITY_STORAGE_MIDDLEWARE,
         ],
     })

package/security/src/lib/security.module.js.map

@@ -1 +1 @@
-{"version":3,"file":"security.module.js","sourceRoot":"","sources":["../../../../../../../libs/framework/server/security/src/lib/security.module.ts"],"names":[],"mappings":";;;;AAAA,2CAA8G;AAC9G,+CAAkD;AAClD,iEAAwG;AACxG,oEAA+D;AAC/D,0FAAoF;AACpF,sDAAkD;AAClD,0EAAqE;AACrE,wEAAmE;AACnE,wEAAmE;AACnE,0EAAqE;AACrE,wDAAoD;AACpD,0DAAqD;AACrD,qEAAiE;AACjE,mEAA+D;AAC/D,2EAAsE;AACtE,iEAA4D;AAC5D,8FAAwF;AACxF,0FAAqF;AACrF,0GAAoG;AACpG,gGAA2F;AAC3F,+EAA0E;AAC1E,+FAAyF;AACzF,+EAA0E;AAC1E,qFAAgF;AAChF,wEAA2F;AAE3F,4CAA4C;AAE5C;;;GAGG;AAwDI,IAAM,cAAc,GAApB,MAAM,cAAc;IACzB,SAAS,CAAC,QAA4B;QACpC,QAAQ;aACL,KAAK,CAAC,8DAA4B,CAAC;aACnC,SAAS,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,sBAAa,CAAC,GAAG,EAAE,CAAC,CAAC;IAC9D,CAAC;CACF,CAAA;AANY,wCAAc;yBAAd,cAAc;IAvD1B,IAAA,eAAM,GAAE;IACR,IAAA,eAAM,EAAC;QACN,OAAO,EAAE,CAAC,0BAAmB,EAAE,yBAAc,CAAC,QAAQ,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;QAC3E,WAAW,EAAE,CAAC,sCAAiB,CAAC;QAChC,SAAS,EAAE;YACT,0BAAW;YACX,6CAAoB;YACpB,+BAAa;YACb,4DAA2B;YAC3B,2CAAmB;YACnB,4BAAY;YACZ,6CAAoB;YACpB,uCAAiB;YACjB,6CAAoB;YACpB,8BAAa;YACb,2CAAmB;YACnB,+CAAqB;YACrB,+CAAqB;YACrB,6BAAY;YACZ,8DAA4B;YAC5B,yDAA0B;YAC1B,mDAAuB;YACvB,kEAA8B;YAC9B,sDAAwB;YACxB,qDAAwB;YACxB,GAAG,6CAAqB;YACxB,GAAG,4CAAoB;YACvB;gBACE,OAAO,EAAE,gCAAyB;gBAClC,WAAW,EAAE,yDAA0B;gBACvC,KAAK,EAAE,IAAI;aACA;YACb;gBACE,OAAO,EAAE,gCAAyB;gBAClC,WAAW,EAAE,mDAAuB;gBACpC,KAAK,EAAE,IAAI;aACA;SACd;QACD,OAAO,EAAE;YACP,0BAAW;YACX,4BAAY;YACZ,6CAAoB;YACpB,uCAAiB;YACjB,+BAAa;YACb,2CAAmB;YACnB,+CAAqB;YACrB,+CAAqB;YACrB,6BAAY;YACZ,yDAA0B;YAC1B,mDAAuB;YACvB,sDAAwB;YACxB,qDAAwB;YACxB,gCAAyB;SAC1B;KACF,CAAC;GACW,cAAc,CAM1B;AAED,YAAY"}
+{"version":3,"file":"security.module.js","sourceRoot":"","sources":["../../../../../../../libs/framework/server/security/src/lib/security.module.ts"],"names":[],"mappings":";;;;AAAA,2CAA8G;AAC9G,+CAAkD;AAClD,iEAAwG;AACxG,oEAA+D;AAC/D,0FAAoF;AACpF,sDAAkD;AAClD,0EAAqE;AACrE,wEAAmE;AACnE,wEAAmE;AACnE,0EAAqE;AACrE,wDAAoD;AACpD,0DAAqD;AACrD,qEAAiE;AACjE,mEAA+D;AAC/D,2EAAsE;AACtE,+DAA0D;AAC1D,+DAA0D;AAC1D,yFAAmF;AACnF,uFAAiF;AACjF,6FAA+E;AAC/E,qFAAsE;AACtE,sEAAiE;AACjE,iEAA4D;AAC5D,8FAAwF;AACxF,0FAAqF;AACrF,0GAAoG;AACpG,gGAA2F;AAC3F,+EAA0E;AAC1E,+FAAyF;AACzF,+EAA0E;AAC1E,qFAAgF;AAChF,wEAA2F;AAE3F,4CAA4C;AAE5C;;;GAGG;AA8EI,IAAM,cAAc,GAApB,MAAM,cAAc;IACzB,SAAS,CAAC,QAA4B;QACpC,QAAQ;aACL,KAAK,CAAC,yCAAkB,CAAC;aACzB,SAAS,CACR,EAAE,IAAI,EAAE,eAAe,EAAE,MAAM,EAAE,sBAAa,CAAC,IAAI,EAAE,EACrD,EAAE,IAAI,EAAE,oBAAoB,EAAE,MAAM,EAAE,sBAAa,CAAC,IAAI,EAAE,CAC3D,CAAC;QAEJ,QAAQ;aACL,KAAK,CAAC,8DAA4B,CAAC;aACnC,SAAS,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,sBAAa,CAAC,GAAG,EAAE,CAAC,CAAC;IAC9D,CAAC;CACF,CAAA;AAbY,wCAAc;yBAAd,cAAc;IA7E1B,IAAA,eAAM,GAAE;IACR,IAAA,eAAM,EAAC;QACN,OAAO,EAAE,CAAC,0BAAmB,EAAE,yBAAc,CAAC,QAAQ,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;QAC3E,WAAW,EAAE,CAAC,sCAAiB,CAAC;QAChC,SAAS,EAAE;YACT,0BAAW;YACX,6CAAoB;YACpB,iCAAc;YACd,iCAAc;YACd,0DAA0B;YAC1B,wDAAyB;YACzB,sDAAoB;YACpB,+BAAa;YACb,4DAA2B;YAC3B,2CAAmB;YACnB,4BAAY;YACZ,6CAAoB;YACpB,uCAAiB;YACjB,6CAAoB;YACpB,8BAAa;YACb,2CAAmB;YACnB,+CAAqB;YACrB,+CAAqB;YACrB,6BAAY;YACZ,8DAA4B;YAC5B,yCAAkB;YAClB,yDAA0B;YAC1B,mDAAuB;YACvB,kEAA8B;YAC9B,sDAAwB;YACxB,qDAAwB;YACxB;gBACE,OAAO,EAAE,6CAAe;gBACxB,WAAW,EAAE,sDAAoB;aAClC;YACD;gBACE,OAAO,EAAE,8BAA8B;gBACvC,QAAQ,EACN,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAAC,EAAE,IAAI,EAAE,EAAE,WAAW,EAAE,KAAK,MAAM;oBAC7E,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,IAAI,EAAE,EAAE,WAAW,EAAE,KAAK,YAAY;aAClE;YACD,GAAG,6CAAqB;YACxB,GAAG,4CAAoB;YACvB;gBACE,OAAO,EAAE,gCAAyB;gBAClC,WAAW,EAAE,yDAA0B;gBACvC,KAAK,EAAE,IAAI;aACA;YACb;gBACE,OAAO,EAAE,gCAAyB;gBAClC,WAAW,EAAE,mDAAuB;gBACpC,KAAK,EAAE,IAAI;aACA;SACd;QACD,OAAO,EAAE;YACP,0BAAW;YACX,4BAAY;YACZ,6CAAoB;YACpB,6CAAoB;YACpB,uCAAiB;YACjB,+BAAa;YACb,2CAAmB;YACnB,+CAAqB;YACrB,+CAAqB;YACrB,6BAAY;YACZ,yDAA0B;YAC1B,mDAAuB;YACvB,sDAAwB;YACxB,qDAAwB;YACxB,iCAAc;YACd,iCAAc;YACd,0DAA0B;YAC1B,wDAAyB;YACzB,sDAAoB;YACpB,gCAAyB;SAC1B;KACF,CAAC;GACW,cAAc,CAa1B;AAED,YAAY"}

package/security/src/lib/session/backend-session.types.d.ts

@@ -4,5 +4,7 @@ export interface BackendRequestSession {
     username: string;
     tenantId?: string;
     applicationId?: string;
+    /** Login/session id from access-token `sid` (device session matching). */
+    sid?: string;
 }
 //# sourceMappingURL=backend-session.types.d.ts.map

package/security/src/lib/session/backend-session.types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"backend-session.types.d.ts","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/session/backend-session.types.ts"],"names":[],"mappings":"AAEA,8EAA8E;AAC9E,MAAM,WAAW,qBAAqB;IACpC,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB"}
+{"version":3,"file":"backend-session.types.d.ts","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/session/backend-session.types.ts"],"names":[],"mappings":"AAEA,8EAA8E;AAC9E,MAAM,WAAW,qBAAqB;IACpC,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,0EAA0E;IAC1E,GAAG,CAAC,EAAE,MAAM,CAAC;CACd"}

package/security/src/lib/session/backend-session.types.js.map

@@ -1 +1 @@
-{"version":3,"file":"backend-session.types.js","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/session/backend-session.types.ts"],"names":[],"mappings":";AAAA,2CAA2C;;AAU3C,YAAY"}
+{"version":3,"file":"backend-session.types.js","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/session/backend-session.types.ts"],"names":[],"mappings":";AAAA,2CAA2C;;AAY3C,YAAY"}

package/security/src/lib/session/optional-jwt-session.middleware.d.ts

@@ -11,16 +11,18 @@ type RequestWithSession = Request & {
 /**
  * Populates {@link CURRENT_SESSION_KEY} when a valid access token is present.
  * Routes stay public when no token is sent (entity storage, optional auth reads).
- * Invalid or expired tokens are ignored here so unauthenticated flows (e.g. token
- * refresh) still work; routes needing enforcement use {@link JwtAuthGuard}.
+ * Invalid, expired, or OD-09-revoked tokens are ignored here so unauthenticated
+ * flows (e.g. token refresh) still work; routes needing enforcement use
+ * {@link JwtAuthGuard}.
  */
 export declare class OptionalJwtSessionMiddleware implements NestMiddleware {
+    private readonly requireEntityApiAuth;
     private readonly authService;
     private readonly machineTokenService;
     private readonly tokenResolver;
     private readonly logger;
-    constructor(authService: AuthService, machineTokenService: MachineTokenService, tokenResolver: TokenResolverService);
-    use(req: RequestWithSession, _res: Response, next: NextFunction): void;
+    constructor(requireEntityApiAuth: boolean, authService: AuthService, machineTokenService: MachineTokenService, tokenResolver: TokenResolverService);
+    use(req: RequestWithSession, _res: Response, next: NextFunction): Promise<void>;
 }
 export {};
 //# sourceMappingURL=optional-jwt-session.middleware.d.ts.map

package/security/src/lib/session/optional-jwt-session.middleware.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"optional-jwt-session.middleware.d.ts","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/session/optional-jwt-session.middleware.ts"],"names":[],"mappings":"AAAA,OAAO,EAAsB,cAAc,EAAE,MAAM,gBAAgB,CAAC;AACpE,OAAO,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC/D,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,EAAE,mBAAmB,EAAE,MAAM,+BAA+B,CAAC;AACpE,OAAO,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AACtE,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAIrE,KAAK,kBAAkB,GAAG,OAAO,GAAG;IAClC,CAAC,mBAAmB,CAAC,CAAC,EAAE,qBAAqB,CAAC;CAC/C,CAAC;AAEF;;;;;GAKG;AACH,qBACa,4BAA6B,YAAW,cAAc;IAI/D,OAAO,CAAC,QAAQ,CAAC,WAAW;IAC5B,OAAO,CAAC,QAAQ,CAAC,mBAAmB;IACpC,OAAO,CAAC,QAAQ,CAAC,aAAa;IALhC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAiD;gBAGrD,WAAW,EAAE,WAAW,EACxB,mBAAmB,EAAE,mBAAmB,EACxC,aAAa,EAAE,oBAAoB;IAGtD,GAAG,CAAC,GAAG,EAAE,kBAAkB,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,GAAG,IAAI;CAoCvE"}
+{"version":3,"file":"optional-jwt-session.middleware.d.ts","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/session/optional-jwt-session.middleware.ts"],"names":[],"mappings":"AAAA,OAAO,EAA8B,cAAc,EAAyB,MAAM,gBAAgB,CAAC;AACnG,OAAO,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC/D,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,EAAE,mBAAmB,EAAE,MAAM,+BAA+B,CAAC;AACpE,OAAO,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AACtE,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAIrE,KAAK,kBAAkB,GAAG,OAAO,GAAG;IAClC,CAAC,mBAAmB,CAAC,CAAC,EAAE,qBAAqB,CAAC;CAC/C,CAAC;AAEF;;;;;;GAMG;AACH,qBACa,4BAA6B,YAAW,cAAc;IAIvB,OAAO,CAAC,QAAQ,CAAC,oBAAoB;IAC7E,OAAO,CAAC,QAAQ,CAAC,WAAW;IAC5B,OAAO,CAAC,QAAQ,CAAC,mBAAmB;IACpC,OAAO,CAAC,QAAQ,CAAC,aAAa;IANhC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAiD;gBAGb,oBAAoB,EAAE,OAAO,EACrE,WAAW,EAAE,WAAW,EACxB,mBAAmB,EAAE,mBAAmB,EACxC,aAAa,EAAE,oBAAoB;IAGhD,GAAG,CAAC,GAAG,EAAE,kBAAkB,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC;CA+CtF"}