@acorex-platform/framework-server 0.0.33 → 0.0.38

package/security/src/lib/auth/auth-csrf.middleware.js

@@ -0,0 +1,60 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AuthCsrfMiddleware = void 0;
+const tslib_1 = require("tslib");
+const common_1 = require("@nestjs/common");
+const auth_config_1 = require("./auth.config");
+/**
+ * CSRF for cookie-authenticated `/connect/token` and `/connect/revocation`.
+ * Writes RFC 6749-shaped JSON directly so middleware failures are not Nest `{ statusCode, message }`.
+ */
+let AuthCsrfMiddleware = class AuthCsrfMiddleware {
+    use(req, res, next) {
+        if (req.method !== 'POST') {
+            next();
+            return;
+        }
+        const path = String(req.originalUrl ?? req.url ?? '').split('?')[0] ?? '';
+        const isConnectToken = path.endsWith('/connect/token');
+        const isConnectRevocation = path.endsWith('/connect/revocation');
+        if (!isConnectToken && !isConnectRevocation) {
+            next();
+            return;
+        }
+        const cookies = (req.cookies ?? {});
+        const hasAuthCookies = typeof cookies[auth_config_1.AUTH_COOKIE_ACCESS_TOKEN] === 'string' ||
+            typeof cookies[auth_config_1.AUTH_COOKIE_REFRESH_TOKEN] === 'string';
+        const body = req.body && typeof req.body === 'object' ? req.body : {};
+        const grantType = typeof body['grant_type'] === 'string' ? body['grant_type'].trim() : '';
+        // First-party authorization_code exchange (no session cookies yet) is exempt.
+        if (isConnectToken && grantType === 'authorization_code' && !hasAuthCookies) {
+            next();
+            return;
+        }
+        if (!hasAuthCookies && isConnectRevocation && !body['refresh_token'] && !body['token']) {
+            next();
+            return;
+        }
+        const cookieToken = typeof cookies[auth_config_1.AUTH_COOKIE_CSRF_TOKEN] === 'string' ? cookies[auth_config_1.AUTH_COOKIE_CSRF_TOKEN].trim() : '';
+        const headerTokenRaw = req.headers['x-csrf-token'];
+        const headerToken = Array.isArray(headerTokenRaw)
+            ? headerTokenRaw[0]?.trim()
+            : typeof headerTokenRaw === 'string'
+                ? headerTokenRaw.trim()
+                : '';
+        if (!cookieToken || !headerToken || cookieToken !== headerToken) {
+            res.status(403).json({
+                error: 'access_denied',
+                error_description: 'CSRF token is missing or invalid.',
+            });
+            return;
+        }
+        next();
+    }
+};
+exports.AuthCsrfMiddleware = AuthCsrfMiddleware;
+exports.AuthCsrfMiddleware = AuthCsrfMiddleware = tslib_1.__decorate([
+    (0, common_1.Injectable)()
+], AuthCsrfMiddleware);
+//#endregion
+//# sourceMappingURL=auth-csrf.middleware.js.map

package/security/src/lib/auth/auth-csrf.middleware.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-csrf.middleware.js","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/auth/auth-csrf.middleware.ts"],"names":[],"mappings":";;;;AAAA,2CAA4D;AAE5D,+CAA4G;AAQ5G;;;GAGG;AAEI,IAAM,kBAAkB,GAAxB,MAAM,kBAAkB;IAC7B,GAAG,CAAC,GAAoB,EAAE,GAAa,EAAE,IAAkB;QACzD,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC1B,IAAI,EAAE,CAAC;YACP,OAAO;QACT,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,WAAW,IAAI,GAAG,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC1E,MAAM,cAAc,GAAG,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC;QACvD,MAAM,mBAAmB,GAAG,IAAI,CAAC,QAAQ,CAAC,qBAAqB,CAAC,CAAC;QACjE,IAAI,CAAC,cAAc,IAAI,CAAC,mBAAmB,EAAE,CAAC;YAC5C,IAAI,EAAE,CAAC;YACP,OAAO;QACT,CAAC;QAED,MAAM,OAAO,GAAG,CAAC,GAAG,CAAC,OAAO,IAAI,EAAE,CAA4B,CAAC;QAC/D,MAAM,cAAc,GAClB,OAAO,OAAO,CAAC,sCAAwB,CAAC,KAAK,QAAQ;YACrD,OAAO,OAAO,CAAC,uCAAyB,CAAC,KAAK,QAAQ,CAAC;QAEzD,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,IAAI,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QACtE,MAAM,SAAS,GAAG,OAAO,IAAI,CAAC,YAAY,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAE1F,8EAA8E;QAC9E,IAAI,cAAc,IAAI,SAAS,KAAK,oBAAoB,IAAI,CAAC,cAAc,EAAE,CAAC;YAC5E,IAAI,EAAE,CAAC;YACP,OAAO;QACT,CAAC;QAED,IAAI,CAAC,cAAc,IAAI,mBAAmB,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YACvF,IAAI,EAAE,CAAC;YACP,OAAO;QACT,CAAC;QAED,MAAM,WAAW,GACf,OAAO,OAAO,CAAC,oCAAsB,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,oCAAsB,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpG,MAAM,cAAc,GAAG,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;QACnD,MAAM,WAAW,GAAG,KAAK,CAAC,OAAO,CAAC,cAAc,CAAC;YAC/C,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE;YAC3B,CAAC,CAAC,OAAO,cAAc,KAAK,QAAQ;gBAClC,CAAC,CAAC,cAAc,CAAC,IAAI,EAAE;gBACvB,CAAC,CAAC,EAAE,CAAC;QAET,IAAI,CAAC,WAAW,IAAI,CAAC,WAAW,IAAI,WAAW,KAAK,WAAW,EAAE,CAAC;YAChE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACnB,KAAK,EAAE,eAAe;gBACtB,iBAAiB,EAAE,mCAAmC;aACvD,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,IAAI,EAAE,CAAC;IACT,CAAC;CACF,CAAA;AArDY,gDAAkB;6BAAlB,kBAAkB;IAD9B,IAAA,mBAAU,GAAE;GACA,kBAAkB,CAqD9B;AAED,YAAY"}

package/security/src/lib/auth/auth-identity-provider.source.d.ts

@@ -43,6 +43,12 @@ export interface AuthIdentityProviderBrokerConfig {
     tokenUrl: string;
     /** Optional userinfo endpoint. */
     userInfoUrl?: string;
+    /**
+     * Expected ID Token `iss` (OIDC issuer).
+     * Prefer this over deriving issuer from `tokenUrl` — Google's token host
+     * (`oauth2.googleapis.com`) is not the ID Token issuer (`accounts.google.com`).
+     */
+    issuerUrl?: string;
     /** Scopes sent to the external IdP. */
     scopes: string;
 }
@@ -68,4 +74,9 @@ export declare const AUTH_IDENTITY_PROVIDER_CATALOG: unique symbol;
  * Provided by security-management from seed constants (not env in framework).
  */
 export declare const AUTH_OAUTH_ALLOWED_CLIENT_IDS: unique symbol;
+/**
+ * Registered OAuth/OIDC clients (redirect URIs, scopes, grant types).
+ * Provided by security-management from seed constants (not env in framework).
+ */
+export declare const AUTH_OAUTH_REGISTERED_CLIENTS: unique symbol;
 //# sourceMappingURL=auth-identity-provider.source.d.ts.map

package/security/src/lib/auth/auth-identity-provider.source.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-identity-provider.source.d.ts","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/auth/auth-identity-provider.source.ts"],"names":[],"mappings":"AAEA;;;GAGG;AACH,MAAM,WAAW,6BAA6B;IAC5C,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,wBAAwB;IACvC,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,UAAU,GAAG,KAAK,GAAG,QAAQ,CAAC;IACxC,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,qFAAqF;AACrF,MAAM,WAAW,4BAA4B;IAC3C,YAAY,EAAE,wBAAwB,EAAE,CAAC;IACzC,iBAAiB,EAAE,6BAA6B,EAAE,CAAC;CACpD;AAED,MAAM,WAAW,mCAAmC;IAClD,qDAAqD;IACrD,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,iFAAiF;AACjF,MAAM,WAAW,gCAAgC;IAC/C,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,OAAO,CAAC;IACjB,uCAAuC;IACvC,gBAAgB,EAAE,MAAM,CAAC;IACzB,mCAAmC;IACnC,QAAQ,EAAE,MAAM,CAAC;IACjB,kCAAkC;IAClC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,uCAAuC;IACvC,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;GAEG;AACH,MAAM,WAAW,2BAA2B;IAC1C,mBAAmB,IAAI,OAAO,CAAC,6BAA6B,EAAE,CAAC,CAAC;IAChE;;;OAGG;IACH,UAAU,CAAC,KAAK,EAAE,mCAAmC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACtE;;;OAGG;IACH,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,gCAAgC,GAAG,IAAI,CAAC,CAAC;CAChF;AAED,eAAO,MAAM,8BAA8B,eAA2C,CAAC;AAEvF;;;GAGG;AACH,eAAO,MAAM,6BAA6B,eAA0C,CAAC"}
+{"version":3,"file":"auth-identity-provider.source.d.ts","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/auth/auth-identity-provider.source.ts"],"names":[],"mappings":"AAEA;;;GAGG;AACH,MAAM,WAAW,6BAA6B;IAC5C,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,wBAAwB;IACvC,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,UAAU,GAAG,KAAK,GAAG,QAAQ,CAAC;IACxC,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,qFAAqF;AACrF,MAAM,WAAW,4BAA4B;IAC3C,YAAY,EAAE,wBAAwB,EAAE,CAAC;IACzC,iBAAiB,EAAE,6BAA6B,EAAE,CAAC;CACpD;AAED,MAAM,WAAW,mCAAmC;IAClD,qDAAqD;IACrD,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,iFAAiF;AACjF,MAAM,WAAW,gCAAgC;IAC/C,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,OAAO,CAAC;IACjB,uCAAuC;IACvC,gBAAgB,EAAE,MAAM,CAAC;IACzB,mCAAmC;IACnC,QAAQ,EAAE,MAAM,CAAC;IACjB,kCAAkC;IAClC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,uCAAuC;IACvC,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;GAEG;AACH,MAAM,WAAW,2BAA2B;IAC1C,mBAAmB,IAAI,OAAO,CAAC,6BAA6B,EAAE,CAAC,CAAC;IAChE;;;OAGG;IACH,UAAU,CAAC,KAAK,EAAE,mCAAmC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACtE;;;OAGG;IACH,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,gCAAgC,GAAG,IAAI,CAAC,CAAC;CAChF;AAED,eAAO,MAAM,8BAA8B,eAA2C,CAAC;AAEvF;;;GAGG;AACH,eAAO,MAAM,6BAA6B,eAA0C,CAAC;AAErF;;;GAGG;AACH,eAAO,MAAM,6BAA6B,eAA0C,CAAC"}

package/security/src/lib/auth/auth-identity-provider.source.js

@@ -1,12 +1,17 @@
 "use strict";
 //#region ---- Auth identity provider catalog (entity-backed) ----
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.AUTH_OAUTH_ALLOWED_CLIENT_IDS = exports.AUTH_IDENTITY_PROVIDER_CATALOG = void 0;
+exports.AUTH_OAUTH_REGISTERED_CLIENTS = exports.AUTH_OAUTH_ALLOWED_CLIENT_IDS = exports.AUTH_IDENTITY_PROVIDER_CATALOG = void 0;
 exports.AUTH_IDENTITY_PROVIDER_CATALOG = Symbol('AUTH_IDENTITY_PROVIDER_CATALOG');
 /**
  * Allowed SPA/machine client_ids for `/connect/*`.
  * Provided by security-management from seed constants (not env in framework).
  */
 exports.AUTH_OAUTH_ALLOWED_CLIENT_IDS = Symbol('AUTH_OAUTH_ALLOWED_CLIENT_IDS');
+/**
+ * Registered OAuth/OIDC clients (redirect URIs, scopes, grant types).
+ * Provided by security-management from seed constants (not env in framework).
+ */
+exports.AUTH_OAUTH_REGISTERED_CLIENTS = Symbol('AUTH_OAUTH_REGISTERED_CLIENTS');
 //#endregion
 //# sourceMappingURL=auth-identity-provider.source.js.map

package/security/src/lib/auth/auth-identity-provider.source.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth-identity-provider.source.js","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/auth/auth-identity-provider.source.ts"],"names":[],"mappings":";AAAA,kEAAkE;;;AAwErD,QAAA,8BAA8B,GAAG,MAAM,CAAC,gCAAgC,CAAC,CAAC;AAEvF;;;GAGG;AACU,QAAA,6BAA6B,GAAG,MAAM,CAAC,+BAA+B,CAAC,CAAC;AAErF,YAAY"}
+{"version":3,"file":"auth-identity-provider.source.js","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/auth/auth-identity-provider.source.ts"],"names":[],"mappings":";AAAA,kEAAkE;;;AA8ErD,QAAA,8BAA8B,GAAG,MAAM,CAAC,gCAAgC,CAAC,CAAC;AAEvF;;;GAGG;AACU,QAAA,6BAA6B,GAAG,MAAM,CAAC,+BAA+B,CAAC,CAAC;AAErF;;;GAGG;AACU,QAAA,6BAA6B,GAAG,MAAM,CAAC,+BAA+B,CAAC,CAAC;AAErF,YAAY"}

package/security/src/lib/auth/auth-local-credentials.service.d.ts

@@ -6,17 +6,25 @@ export declare class AuthLocalCredentialsService {
     constructor(entityStorage: EntityStorageMiddlewareService);
     validate(username: string, password: string): Promise<SecurityManagementUserRecord>;
     findUserByUsername(username: string): Promise<SecurityManagementUserRecord | null>;
+    /**
+     * OD-06 trusted email link: match by `email` field, then by username === email
+     * (legacy rows where username was the mailbox address).
+     */
+    findUserByVerifiedEmail(email: string): Promise<SecurityManagementUserRecord | null>;
     findUserById(userId: string): Promise<SecurityManagementUserRecord | null>;
     listUsers(): Promise<SecurityManagementUserRecord[]>;
     blockUserAccess(userId: string): Promise<void>;
     restoreUserAccess(userId: string): Promise<void>;
     findOrCreateExternalUser(input: {
         provider: string;
+        issuer: string;
         providerSubject: string;
         email?: string;
+        emailVerified?: boolean;
         displayName?: string;
         picture?: string;
     }): Promise<SecurityManagementUserRecord>;
+    private auditExternalIdentityLink;
     private invalidCredentialsBody;
 }
 //# sourceMappingURL=auth-local-credentials.service.d.ts.map

package/security/src/lib/auth/auth-local-credentials.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-local-credentials.service.d.ts","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/auth/auth-local-credentials.service.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,8BAA8B,EAAE,MAAM,wCAAwC,CAAC;AAKxF,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,cAAc,CAAC;AASjE,qBACa,2BAA2B;IAG1B,OAAO,CAAC,QAAQ,CAAC,aAAa;IAF1C,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAgD;gBAE1C,aAAa,EAAE,8BAA8B;IAEpE,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,4BAA4B,CAAC;IAkCnF,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,4BAA4B,GAAG,IAAI,CAAC;IAKlF,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,4BAA4B,GAAG,IAAI,CAAC;IAM1E,SAAS,IAAI,OAAO,CAAC,4BAA4B,EAAE,CAAC;IASpD,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAU9C,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAUhD,wBAAwB,CAAC,KAAK,EAAE;QACpC,QAAQ,EAAE,MAAM,CAAC;QACjB,eAAe,EAAE,MAAM,CAAC;QACxB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,OAAO,CAAC,EAAE,MAAM,CAAC;KAClB,GAAG,OAAO,CAAC,4BAA4B,CAAC;IAyCzC,OAAO,CAAC,sBAAsB;CAO/B"}
+{"version":3,"file":"auth-local-credentials.service.d.ts","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/auth/auth-local-credentials.service.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,8BAA8B,EAAE,MAAM,wCAAwC,CAAC;AAKxF,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,cAAc,CAAC;AASjE,qBACa,2BAA2B;IAG1B,OAAO,CAAC,QAAQ,CAAC,aAAa;IAF1C,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAgD;gBAE1C,aAAa,EAAE,8BAA8B;IAEpE,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,4BAA4B,CAAC;IAkCnF,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,4BAA4B,GAAG,IAAI,CAAC;IAQxF;;;OAGG;IACG,uBAAuB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,4BAA4B,GAAG,IAAI,CAAC;IAUpF,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,4BAA4B,GAAG,IAAI,CAAC;IAM1E,SAAS,IAAI,OAAO,CAAC,4BAA4B,EAAE,CAAC;IASpD,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAU9C,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAUhD,wBAAwB,CAAC,KAAK,EAAE;QACpC,QAAQ,EAAE,MAAM,CAAC;QACjB,MAAM,EAAE,MAAM,CAAC;QACf,eAAe,EAAE,MAAM,CAAC;QACxB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,aAAa,CAAC,EAAE,OAAO,CAAC;QACxB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,OAAO,CAAC,EAAE,MAAM,CAAC;KAClB,GAAG,OAAO,CAAC,4BAA4B,CAAC;IAsDzC,OAAO,CAAC,yBAAyB;IAkBjC,OAAO,CAAC,sBAAsB;CAO/B"}

package/security/src/lib/auth/auth-local-credentials.service.js

@@ -49,7 +49,19 @@ let AuthLocalCredentialsService = AuthLocalCredentialsService_1 = class AuthLoca
     }
     async findUserByUsername(username) {
         const users = await this.listUsers();
-        return users.find((u) => u.username === username) ?? null;
+        const normalized = username.trim().toLowerCase();
+        return (users.find((u) => (u.username ?? '').trim().toLowerCase() === normalized) ?? null);
+    }
+    /**
+     * OD-06 trusted email link: match by `email` field, then by username === email
+     * (legacy rows where username was the mailbox address).
+     */
+    async findUserByVerifiedEmail(email) {
+        const users = await this.listUsers();
+        const normalized = email.trim().toLowerCase();
+        return (users.find((u) => (u.email ?? '').trim().toLowerCase() === normalized) ??
+            users.find((u) => (u.username ?? '').trim().toLowerCase() === normalized) ??
+            null);
     }
     async findUserById(userId) {
         // Auth paths resolve global identities outside tenant membership filters.
@@ -83,37 +95,50 @@ let AuthLocalCredentialsService = AuthLocalCredentialsService_1 = class AuthLoca
     }
     async findOrCreateExternalUser(input) {
         const email = input.email?.trim().toLowerCase();
-        const candidates = new Set();
-        if (email) {
-            candidates.add(email);
-            const localPart = email.split('@')[0]?.trim();
-            if (localPart) {
-                candidates.add(localPart);
-            }
+        const externalUsername = `${input.issuer}:${input.providerSubject}`;
+        const byExternal = await this.findUserByUsername(externalUsername);
+        const byEmail = email && input.emailVerified === true ? await this.findUserByVerifiedEmail(email) : null;
+        if (byExternal && byEmail && byExternal.id !== byEmail.id) {
+            this.logger.warn(`External identity conflict for provider=${input.provider}: ` +
+                `issuer+subject user=${byExternal.id} email user=${byEmail.id}`);
+            throw new common_1.UnauthorizedException({
+                statusCode: 401,
+                message: 'External identity is already linked to a different account.',
+                error: 'ExternalIdentityConflict',
+            });
+        }
+        if (byExternal) {
+            this.auditExternalIdentityLink('resolve-by-issuer-subject', input, byExternal.id);
+            return byExternal;
         }
-        candidates.add(`${input.provider}:${input.providerSubject}`);
-        for (const username of candidates) {
-            const existing = await this.findUserByUsername(username);
-            if (existing) {
-                return existing;
-            }
+        if (byEmail) {
+            this.auditExternalIdentityLink('trusted-email-link', input, byEmail.id);
+            return byEmail;
         }
-        const username = email || `${input.provider}.${input.providerSubject.slice(0, 24)}`;
+        const username = email && input.emailVerified === true ? email : externalUsername;
         const displayName = input.displayName?.trim() || username;
         const id = (0, crypto_1.randomUUID)();
-        await this.entityStorage.insertOne(USER_ENTITY, {
+        await this.entityStorage.insertOneAsEngine(USER_ENTITY, {
             id,
             username,
             displayName,
             accountState: ACTIVE_ACCOUNT_STATE,
             accessState: ALLOWED_ACCESS_STATE,
+            email: email && input.emailVerified === true ? email : undefined,
+            avatar: input.picture ?? null,
         });
         const created = await this.findUserById(id);
         if (!created) {
             throw new common_1.UnauthorizedException('Failed to create external user account.');
         }
+        this.auditExternalIdentityLink('create', input, created.id);
         return created;
     }
+    auditExternalIdentityLink(action, input, userId) {
+        this.logger.log(`External identity ${action}: provider=${input.provider} issuer=${input.issuer} ` +
+            `sub=${input.providerSubject} userId=${userId} ` +
+            `emailVerified=${input.emailVerified === true}`);
+    }
     invalidCredentialsBody() {
         return {
             statusCode: 401,

package/security/src/lib/auth/auth-local-credentials.service.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth-local-credentials.service.js","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/auth/auth-local-credentials.service.ts"],"names":[],"mappings":";;;;;AAAA,2CAIwB;AACxB,iEAAwF;AACxF,6EAAkG;AAClG,iEAAwE;AACxE,yCAAuC;AACvC,mCAAoC;AAGpC,qCAAqC;AAErC,MAAM,WAAW,GAAG,yBAAyB,CAAC;AAC9C,MAAM,oBAAoB,GAAG,QAAQ,CAAC;AACtC,MAAM,oBAAoB,GAAG,SAAS,CAAC;AACvC,MAAM,oBAAoB,GAAG,SAAS,CAAC;AAGhC,IAAM,2BAA2B,mCAAjC,MAAM,2BAA2B;IAGtC,YAA6B,aAA6C;QAA7C,kBAAa,GAAb,aAAa,CAAgC;QAFzD,WAAM,GAAG,IAAI,eAAM,CAAC,6BAA2B,CAAC,IAAI,CAAC,CAAC;IAEM,CAAC;IAE9E,KAAK,CAAC,QAAQ,CAAC,QAAgB,EAAE,QAAgB;QAC/C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC;QACrD,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,8BAAqB,CAAC,IAAI,CAAC,sBAAsB,EAAE,CAAC,CAAC;QACjE,CAAC;QAED,IAAI,IAAI,CAAC,WAAW,KAAK,oBAAoB,EAAE,CAAC;YAC9C,MAAM,IAAI,8BAAqB,CAAC;gBAC9B,UAAU,EAAE,GAAG;gBACf,OAAO,EAAE,sCAAsC;gBAC/C,KAAK,EAAE,gBAAgB;aACxB,CAAC,CAAC;QACL,CAAC;QAED,IAAI,IAAI,CAAC,YAAY,KAAK,oBAAoB,EAAE,CAAC;YAC/C,MAAM,IAAI,8BAAqB,CAAC,IAAI,CAAC,sBAAsB,EAAE,CAAC,CAAC;QACjE,CAAC;QAED,IAAI,CAAC,IAAA,iBAAK,EAAC,IAAI,CAAC,WAAW,CAAC,IAAI,IAAI,CAAC,WAAW,KAAK,oBAAoB,EAAE,CAAC;YAC1E,MAAM,IAAI,8BAAqB,CAAC;gBAC9B,UAAU,EAAE,GAAG;gBACf,OAAO,EAAE,0CAA0C;gBACnD,KAAK,EAAE,mBAAmB;aAC3B,CAAC,CAAC;QACL,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,IAAA,qBAAc,EAAC,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC5D,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,8BAAqB,CAAC,IAAI,CAAC,sBAAsB,EAAE,CAAC,CAAC;QACjE,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,CAAC,kBAAkB,CAAC,QAAgB;QACvC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;QACrC,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,IAAI,IAAI,CAAC;IAC5D,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,MAAc;QAC/B,0EAA0E;QAC1E,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,cAAc,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;QAC5E,OAAQ,MAAuC,IAAI,IAAI,CAAC;IAC1D,CAAC;IAED,KAAK,CAAC,SAAS;QACb,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,KAAK,CAC3C,WAAW,EACX,IAAA,2CAAgC,EAAC,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAC1D,CAAC;QACF,MAAM,KAAK,GAAG,IAAA,eAAG,EAAC,MAAM,EAAE,OAAO,EAAE,EAAE,CAAmC,CAAC;QACzE,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3C,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,MAAc;QAClC,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,WAAW,EAAE,MAAM,EAAE;gBACtD,WAAW,EAAE,oBAAoB;aAClC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,wBAAwB,MAAM,KAAK,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACvE,CAAC;IACH,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,MAAc;QACpC,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,WAAW,EAAE,MAAM,EAAE;gBACtD,WAAW,EAAE,oBAAoB;aAClC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,iCAAiC,MAAM,KAAK,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAChF,CAAC;IACH,CAAC;IAED,KAAK,CAAC,wBAAwB,CAAC,KAM9B;QACC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAChD,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;QAErC,IAAI,KAAK,EAAE,CAAC;YACV,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YACtB,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;YAC9C,IAAI,SAAS,EAAE,CAAC;gBACd,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YAC5B,CAAC;QACH,CAAC;QAED,UAAU,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,eAAe,EAAE,CAAC,CAAC;QAE7D,KAAK,MAAM,QAAQ,IAAI,UAAU,EAAE,CAAC;YAClC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC;YACzD,IAAI,QAAQ,EAAE,CAAC;gBACb,OAAO,QAAQ,CAAC;YAClB,CAAC;QACH,CAAC;QAED,MAAM,QAAQ,GAAG,KAAK,IAAI,GAAG,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;QACpF,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,EAAE,IAAI,EAAE,IAAI,QAAQ,CAAC;QAC1D,MAAM,EAAE,GAAG,IAAA,mBAAU,GAAE,CAAC;QAExB,MAAM,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,WAAW,EAAE;YAC9C,EAAE;YACF,QAAQ;YACR,WAAW;YACX,YAAY,EAAE,oBAAoB;YAClC,WAAW,EAAE,oBAAoB;SAClC,CAAC,CAAC;QAEH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;QAC5C,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,8BAAqB,CAAC,yCAAyC,CAAC,CAAC;QAC7E,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;IAEO,sBAAsB;QAC5B,OAAO;YACL,UAAU,EAAE,GAAG;YACf,OAAO,EAAE,8BAA8B;YACvC,KAAK,EAAE,oBAAoB;SAC5B,CAAC;IACJ,CAAC;CACF,CAAA;AArIY,kEAA2B;sCAA3B,2BAA2B;IADvC,IAAA,mBAAU,GAAE;6CAIiC,qCAA8B;GAH/D,2BAA2B,CAqIvC;AAED,YAAY"}
+{"version":3,"file":"auth-local-credentials.service.js","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/auth/auth-local-credentials.service.ts"],"names":[],"mappings":";;;;;AAAA,2CAIwB;AACxB,iEAAwF;AACxF,6EAAkG;AAClG,iEAAwE;AACxE,yCAAuC;AACvC,mCAAoC;AAGpC,qCAAqC;AAErC,MAAM,WAAW,GAAG,yBAAyB,CAAC;AAC9C,MAAM,oBAAoB,GAAG,QAAQ,CAAC;AACtC,MAAM,oBAAoB,GAAG,SAAS,CAAC;AACvC,MAAM,oBAAoB,GAAG,SAAS,CAAC;AAGhC,IAAM,2BAA2B,mCAAjC,MAAM,2BAA2B;IAGtC,YAA6B,aAA6C;QAA7C,kBAAa,GAAb,aAAa,CAAgC;QAFzD,WAAM,GAAG,IAAI,eAAM,CAAC,6BAA2B,CAAC,IAAI,CAAC,CAAC;IAEM,CAAC;IAE9E,KAAK,CAAC,QAAQ,CAAC,QAAgB,EAAE,QAAgB;QAC/C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC;QACrD,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,8BAAqB,CAAC,IAAI,CAAC,sBAAsB,EAAE,CAAC,CAAC;QACjE,CAAC;QAED,IAAI,IAAI,CAAC,WAAW,KAAK,oBAAoB,EAAE,CAAC;YAC9C,MAAM,IAAI,8BAAqB,CAAC;gBAC9B,UAAU,EAAE,GAAG;gBACf,OAAO,EAAE,sCAAsC;gBAC/C,KAAK,EAAE,gBAAgB;aACxB,CAAC,CAAC;QACL,CAAC;QAED,IAAI,IAAI,CAAC,YAAY,KAAK,oBAAoB,EAAE,CAAC;YAC/C,MAAM,IAAI,8BAAqB,CAAC,IAAI,CAAC,sBAAsB,EAAE,CAAC,CAAC;QACjE,CAAC;QAED,IAAI,CAAC,IAAA,iBAAK,EAAC,IAAI,CAAC,WAAW,CAAC,IAAI,IAAI,CAAC,WAAW,KAAK,oBAAoB,EAAE,CAAC;YAC1E,MAAM,IAAI,8BAAqB,CAAC;gBAC9B,UAAU,EAAE,GAAG;gBACf,OAAO,EAAE,0CAA0C;gBACnD,KAAK,EAAE,mBAAmB;aAC3B,CAAC,CAAC;QACL,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,IAAA,qBAAc,EAAC,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC5D,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,8BAAqB,CAAC,IAAI,CAAC,sBAAsB,EAAE,CAAC,CAAC;QACjE,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,CAAC,kBAAkB,CAAC,QAAgB;QACvC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;QACrC,MAAM,UAAU,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACjD,OAAO,CACL,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,UAAU,CAAC,IAAI,IAAI,CAClF,CAAC;IACJ,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,uBAAuB,CAAC,KAAa;QACzC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;QACrC,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAC9C,OAAO,CACL,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,UAAU,CAAC;YACtE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,UAAU,CAAC;YACzE,IAAI,CACL,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,MAAc;QAC/B,0EAA0E;QAC1E,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,cAAc,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;QAC5E,OAAQ,MAAuC,IAAI,IAAI,CAAC;IAC1D,CAAC;IAED,KAAK,CAAC,SAAS;QACb,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,KAAK,CAC3C,WAAW,EACX,IAAA,2CAAgC,EAAC,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAC1D,CAAC;QACF,MAAM,KAAK,GAAG,IAAA,eAAG,EAAC,MAAM,EAAE,OAAO,EAAE,EAAE,CAAmC,CAAC;QACzE,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3C,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,MAAc;QAClC,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,WAAW,EAAE,MAAM,EAAE;gBACtD,WAAW,EAAE,oBAAoB;aAClC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,wBAAwB,MAAM,KAAK,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACvE,CAAC;IACH,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,MAAc;QACpC,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,WAAW,EAAE,MAAM,EAAE;gBACtD,WAAW,EAAE,oBAAoB;aAClC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,iCAAiC,MAAM,KAAK,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAChF,CAAC;IACH,CAAC;IAED,KAAK,CAAC,wBAAwB,CAAC,KAQ9B;QACC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAChD,MAAM,gBAAgB,GAAG,GAAG,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,eAAe,EAAE,CAAC;QAEpE,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,CAAC;QACnE,MAAM,OAAO,GACX,KAAK,IAAI,KAAK,CAAC,aAAa,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,uBAAuB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAE3F,IAAI,UAAU,IAAI,OAAO,IAAI,UAAU,CAAC,EAAE,KAAK,OAAO,CAAC,EAAE,EAAE,CAAC;YAC1D,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,2CAA2C,KAAK,CAAC,QAAQ,IAAI;gBAC3D,uBAAuB,UAAU,CAAC,EAAE,eAAe,OAAO,CAAC,EAAE,EAAE,CAClE,CAAC;YACF,MAAM,IAAI,8BAAqB,CAAC;gBAC9B,UAAU,EAAE,GAAG;gBACf,OAAO,EAAE,6DAA6D;gBACtE,KAAK,EAAE,0BAA0B;aAClC,CAAC,CAAC;QACL,CAAC;QAED,IAAI,UAAU,EAAE,CAAC;YACf,IAAI,CAAC,yBAAyB,CAAC,2BAA2B,EAAE,KAAK,EAAE,UAAU,CAAC,EAAE,CAAC,CAAC;YAClF,OAAO,UAAU,CAAC;QACpB,CAAC;QAED,IAAI,OAAO,EAAE,CAAC;YACZ,IAAI,CAAC,yBAAyB,CAAC,oBAAoB,EAAE,KAAK,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;YACxE,OAAO,OAAO,CAAC;QACjB,CAAC;QAED,MAAM,QAAQ,GACZ,KAAK,IAAI,KAAK,CAAC,aAAa,KAAK,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,gBAAgB,CAAC;QACnE,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,EAAE,IAAI,EAAE,IAAI,QAAQ,CAAC;QAC1D,MAAM,EAAE,GAAG,IAAA,mBAAU,GAAE,CAAC;QAExB,MAAM,IAAI,CAAC,aAAa,CAAC,iBAAiB,CAAC,WAAW,EAAE;YACtD,EAAE;YACF,QAAQ;YACR,WAAW;YACX,YAAY,EAAE,oBAAoB;YAClC,WAAW,EAAE,oBAAoB;YACjC,KAAK,EAAE,KAAK,IAAI,KAAK,CAAC,aAAa,KAAK,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;YAChE,MAAM,EAAE,KAAK,CAAC,OAAO,IAAI,IAAI;SAC9B,CAAC,CAAC;QAEH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;QAC5C,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,8BAAqB,CAAC,yCAAyC,CAAC,CAAC;QAC7E,CAAC;QAED,IAAI,CAAC,yBAAyB,CAAC,QAAQ,EAAE,KAAK,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;QAC5D,OAAO,OAAO,CAAC;IACjB,CAAC;IAEO,yBAAyB,CAC/B,MAAqE,EACrE,KAMC,EACD,MAAc;QAEd,IAAI,CAAC,MAAM,CAAC,GAAG,CACb,qBAAqB,MAAM,cAAc,KAAK,CAAC,QAAQ,WAAW,KAAK,CAAC,MAAM,GAAG;YAC/E,OAAO,KAAK,CAAC,eAAe,WAAW,MAAM,GAAG;YAChD,iBAAiB,KAAK,CAAC,aAAa,KAAK,IAAI,EAAE,CAClD,CAAC;IACJ,CAAC;IAEO,sBAAsB;QAC5B,OAAO;YACL,UAAU,EAAE,GAAG;YACf,OAAO,EAAE,8BAA8B;YACvC,KAAK,EAAE,oBAAoB;SAC5B,CAAC;IACJ,CAAC;CACF,CAAA;AAvLY,kEAA2B;sCAA3B,2BAA2B;IADvC,IAAA,mBAAU,GAAE;6CAIiC,qCAA8B;GAH/D,2BAA2B,CAuLvC;AAED,YAAY"}

package/security/src/lib/auth/auth-max-device-sessions-policy.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Tenant max concurrent device sessions. Defaults to 0 (unlimited) until a module
+ * registers {@link configureAuthMaxDeviceSessionsPolicyResolver} (tenant settings).
+ *
+ * Uses globalThis so Nest/webpack duplicate module instances share one resolver.
+ */
+export declare const AUTH_MAX_ACTIVE_DEVICE_SESSIONS_DEFAULT = 0;
+type AuthMaxDeviceSessionsPolicyResolver = (tenantId: string) => Promise<number>;
+/** Registers the resolver that reads tenant max-active-device-sessions settings. */
+export declare function configureAuthMaxDeviceSessionsPolicyResolver(resolver: AuthMaxDeviceSessionsPolicyResolver): void;
+/** Resolves the max active device sessions for a tenant. `0` = unlimited. */
+export declare function resolveAuthMaxDeviceSessions(tenantId: string): Promise<number>;
+export {};
+//# sourceMappingURL=auth-max-device-sessions-policy.d.ts.map

package/security/src/lib/auth/auth-max-device-sessions-policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-max-device-sessions-policy.d.ts","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/auth/auth-max-device-sessions-policy.ts"],"names":[],"mappings":"AAEA;;;;;GAKG;AAEH,eAAO,MAAM,uCAAuC,IAAI,CAAC;AAEzD,KAAK,mCAAmC,GAAG,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;AAuBjF,oFAAoF;AACpF,wBAAgB,4CAA4C,CAC1D,QAAQ,EAAE,mCAAmC,GAC5C,IAAI,CAEN;AAED,6EAA6E;AAC7E,wBAAsB,4BAA4B,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAgBpF"}

package/security/src/lib/auth/auth-max-device-sessions-policy.js

@@ -0,0 +1,48 @@
+"use strict";
+//#region ----- Auth max active device sessions policy (leaf) -----
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AUTH_MAX_ACTIVE_DEVICE_SESSIONS_DEFAULT = void 0;
+exports.configureAuthMaxDeviceSessionsPolicyResolver = configureAuthMaxDeviceSessionsPolicyResolver;
+exports.resolveAuthMaxDeviceSessions = resolveAuthMaxDeviceSessions;
+/**
+ * Tenant max concurrent device sessions. Defaults to 0 (unlimited) until a module
+ * registers {@link configureAuthMaxDeviceSessionsPolicyResolver} (tenant settings).
+ *
+ * Uses globalThis so Nest/webpack duplicate module instances share one resolver.
+ */
+exports.AUTH_MAX_ACTIVE_DEVICE_SESSIONS_DEFAULT = 0;
+const GLOBAL_KEY = '__AXP_AUTH_MAX_DEVICE_SESSIONS_POLICY__';
+function authMaxDeviceSessionsState() {
+    const g = globalThis;
+    if (!g[GLOBAL_KEY]) {
+        g[GLOBAL_KEY] = { resolver: null };
+    }
+    return g[GLOBAL_KEY];
+}
+function coerceNonNegativeInt(value, fallback) {
+    const parsed = typeof value === 'number' ? value : Number(value);
+    return Number.isFinite(parsed) && parsed >= 0 ? Math.floor(parsed) : fallback;
+}
+/** Registers the resolver that reads tenant max-active-device-sessions settings. */
+function configureAuthMaxDeviceSessionsPolicyResolver(resolver) {
+    authMaxDeviceSessionsState().resolver = resolver;
+}
+/** Resolves the max active device sessions for a tenant. `0` = unlimited. */
+async function resolveAuthMaxDeviceSessions(tenantId) {
+    const tid = tenantId?.trim();
+    if (!tid) {
+        return exports.AUTH_MAX_ACTIVE_DEVICE_SESSIONS_DEFAULT;
+    }
+    const resolver = authMaxDeviceSessionsState().resolver;
+    if (!resolver) {
+        return exports.AUTH_MAX_ACTIVE_DEVICE_SESSIONS_DEFAULT;
+    }
+    try {
+        return coerceNonNegativeInt(await resolver(tid), exports.AUTH_MAX_ACTIVE_DEVICE_SESSIONS_DEFAULT);
+    }
+    catch {
+        return exports.AUTH_MAX_ACTIVE_DEVICE_SESSIONS_DEFAULT;
+    }
+}
+//#endregion
+//# sourceMappingURL=auth-max-device-sessions-policy.js.map

package/security/src/lib/auth/auth-max-device-sessions-policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-max-device-sessions-policy.js","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/auth/auth-max-device-sessions-policy.ts"],"names":[],"mappings":";AAAA,mEAAmE;;;AAmCnE,oGAIC;AAGD,oEAgBC;AAxDD;;;;;GAKG;AAEU,QAAA,uCAAuC,GAAG,CAAC,CAAC;AAQzD,MAAM,UAAU,GAAG,yCAAyC,CAAC;AAE7D,SAAS,0BAA0B;IACjC,MAAM,CAAC,GAAG,UAET,CAAC;IACF,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,EAAE,CAAC;QACnB,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IACrC,CAAC;IACD,OAAO,CAAC,CAAC,UAAU,CAAE,CAAC;AACxB,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAc,EAAE,QAAgB;IAC5D,MAAM,MAAM,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACjE,OAAO,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;AAChF,CAAC;AAED,oFAAoF;AACpF,SAAgB,4CAA4C,CAC1D,QAA6C;IAE7C,0BAA0B,EAAE,CAAC,QAAQ,GAAG,QAAQ,CAAC;AACnD,CAAC;AAED,6EAA6E;AACtE,KAAK,UAAU,4BAA4B,CAAC,QAAgB;IACjE,MAAM,GAAG,GAAG,QAAQ,EAAE,IAAI,EAAE,CAAC;IAC7B,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,OAAO,+CAAuC,CAAC;IACjD,CAAC;IAED,MAAM,QAAQ,GAAG,0BAA0B,EAAE,CAAC,QAAQ,CAAC;IACvD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,+CAAuC,CAAC;IACjD,CAAC;IAED,IAAI,CAAC;QACH,OAAO,oBAAoB,CAAC,MAAM,QAAQ,CAAC,GAAG,CAAC,EAAE,+CAAuC,CAAC,CAAC;IAC5F,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,+CAAuC,CAAC;IACjD,CAAC;AACH,CAAC;AAED,YAAY"}

package/security/src/lib/auth/auth-runtime.handlers.d.ts

@@ -3,7 +3,7 @@ import { type AXPServerQueryHandler } from '@acorex-platform/framework-server/do
 import { ModuleRef } from '@nestjs/core';
 import { AuthCookieService } from './auth-cookie.service';
 import { AuthService } from './auth.service';
-import type { AuthTokenResponseDto, RefreshTokenRequestDto, RegisterRequestDto, SignInRequestDto, UpdateSessionRequestDto } from './auth.types';
+import type { AuthListOwnDeviceSessionsRequestDto, AuthOwnDeviceSessionDto, AuthTerminateOwnDeviceSessionRequestDto, AuthTokenResponseDto, RefreshTokenRequestDto, RegisterRequestDto, SignInRequestDto, UpdateSessionRequestDto } from './auth.types';
 import { LoginAttemptService } from './login-attempt.service';
 import { TokenResolverService } from './token-resolver.service';
 import { TokenService } from './token.service';
@@ -47,7 +47,13 @@ export declare class AuthUpdateSessionRuntimeCommand implements AXPCommand<Updat
     constructor(auth: AuthService, tokenResolver: TokenResolverService, cookies: AuthCookieService, tokens: TokenService);
     execute(input: UpdateSessionRequestDto): AXPCommandExecuteResultPromise<AuthTokenResponseDto>;
 }
-export declare const AUTH_RUNTIME_COMMANDS: (typeof AuthSignInRuntimeCommand | typeof AuthRegisterRuntimeCommand | typeof AuthRefreshRuntimeCommand | typeof AuthLogoutRuntimeCommand | typeof AuthUpdateSessionRuntimeCommand)[];
+export declare class AuthTerminateOwnDeviceSessionRuntimeCommand implements AXPCommand<AuthTerminateOwnDeviceSessionRequestDto, void> {
+    private readonly auth;
+    private readonly tokenResolver;
+    constructor(auth: AuthService, tokenResolver: TokenResolverService);
+    execute(input: AuthTerminateOwnDeviceSessionRequestDto): AXPCommandExecuteResultPromise<void>;
+}
+export declare const AUTH_RUNTIME_COMMANDS: (typeof AuthSignInRuntimeCommand | typeof AuthRegisterRuntimeCommand | typeof AuthRefreshRuntimeCommand | typeof AuthLogoutRuntimeCommand | typeof AuthUpdateSessionRuntimeCommand | typeof AuthTerminateOwnDeviceSessionRuntimeCommand)[];
 export declare class AuthListProvidersRuntimeQuery implements AXPServerQueryHandler<void, AuthListProvidersResponseDto> {
     private readonly moduleRef;
     constructor(moduleRef: ModuleRef);
@@ -66,11 +72,17 @@ export declare class AuthListApplicationsRuntimeQuery implements AXPServerQueryH
     constructor(sessionContext: SessionContextService, backendSession: BackendSessionService);
     execute(): AXPQueryFetchResultPromise<SessionApplicationItemDto>;
 }
+export declare class AuthListOwnDeviceSessionsRuntimeQuery implements AXPServerQueryHandler<AuthListOwnDeviceSessionsRequestDto, AuthOwnDeviceSessionDto> {
+    private readonly auth;
+    private readonly tokenResolver;
+    constructor(auth: AuthService, tokenResolver: TokenResolverService);
+    execute(input: AuthListOwnDeviceSessionsRequestDto): AXPQueryFetchResultPromise<AuthOwnDeviceSessionDto>;
+}
 export declare class AuthGetAccessPolicyRuntimeQuery implements AXPServerQueryHandler<void, SessionAccessPolicyDto> {
     private readonly sessionContext;
     private readonly backendSession;
     constructor(sessionContext: SessionContextService, backendSession: BackendSessionService);
     execute(): AXPQueryFetchResultPromise<SessionAccessPolicyDto>;
 }
-export declare const AUTH_RUNTIME_QUERIES: (typeof AuthListProvidersRuntimeQuery | typeof AuthListTenantsRuntimeQuery | typeof AuthListApplicationsRuntimeQuery | typeof AuthGetAccessPolicyRuntimeQuery)[];
+export declare const AUTH_RUNTIME_QUERIES: (typeof AuthListProvidersRuntimeQuery | typeof AuthListTenantsRuntimeQuery | typeof AuthListApplicationsRuntimeQuery | typeof AuthListOwnDeviceSessionsRuntimeQuery | typeof AuthGetAccessPolicyRuntimeQuery)[];
 //# sourceMappingURL=auth-runtime.handlers.d.ts.map

package/security/src/lib/auth/auth-runtime.handlers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-runtime.handlers.d.ts","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/auth/auth-runtime.handlers.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,UAAU,EAAE,0BAA0B,EAAE,8BAA8B,EAAE,MAAM,2CAA2C,CAAC;AAYxI,OAAO,EAAqC,KAAK,qBAAqB,EAAE,MAAM,mDAAmD,CAAC;AAElI,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAOzC,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC1D,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC7C,OAAO,KAAK,EACV,oBAAoB,EACpB,sBAAsB,EACtB,kBAAkB,EAClB,gBAAgB,EAChB,uBAAuB,EACxB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAE9D,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAChE,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EAAE,qBAAqB,EAAE,MAAM,oCAAoC,CAAC;AAC3E,OAAO,EAAE,qBAAqB,EAAE,MAAM,oCAAoC,CAAC;AAC3E,OAAO,EAGL,KAAK,4BAA4B,EAElC,MAAM,iCAAiC,CAAC;AACzC,OAAO,KAAK,EACV,sBAAsB,EACtB,yBAAyB,EACzB,oBAAoB,EACrB,MAAM,kCAAkC,CAAC;AAI1C,qBAEa,wBAAyB,YAAW,UAAU,CAAC,gBAAgB,EAAE,oBAAoB,CAAC;IAE/F,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,aAAa;IAC9B,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAHN,IAAI,EAAE,WAAW,EACjB,aAAa,EAAE,mBAAmB,EAClC,OAAO,EAAE,iBAAiB,EAC1B,MAAM,EAAE,YAAY;IAGjC,OAAO,CAAC,KAAK,EAAE,gBAAgB,GAAG,8BAA8B,CAAC,oBAAoB,CAAC;CAmB7F;AAED,qBAEa,0BAA2B,YAAW,UAAU,CAAC,kBAAkB,EAAE,oBAAoB,CAAC;IAEnG,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAFN,IAAI,EAAE,WAAW,EACjB,OAAO,EAAE,iBAAiB,EAC1B,MAAM,EAAE,YAAY;IAGjC,OAAO,CAAC,KAAK,EAAE,kBAAkB,GAAG,8BAA8B,CAAC,oBAAoB,CAAC;CAQ/F;AAED,qBAEa,yBACX,YAAW,UAAU,CAAC,sBAAsB,EAAE,oBAAoB,CAAC;IAGjE,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAFN,IAAI,EAAE,WAAW,EACjB,OAAO,EAAE,iBAAiB,EAC1B,MAAM,EAAE,YAAY;IAGjC,OAAO,CAAC,KAAK,EAAE,sBAAsB,GAAG,8BAA8B,CAAC,oBAAoB,CAAC;CAiBnG;AAED,qBAEa,wBAAyB,YAAW,UAAU,CAAC,sBAAsB,EAAE,IAAI,CAAC;IAErF,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,OAAO;gBADP,IAAI,EAAE,WAAW,EACjB,OAAO,EAAE,iBAAiB;IAGvC,OAAO,CAAC,KAAK,EAAE,sBAAsB,GAAG,8BAA8B,CAAC,IAAI,CAAC;CAYnF;AAED,qBAEa,+BACX,YAAW,UAAU,CAAC,uBAAuB,EAAE,oBAAoB,CAAC;IAGlE,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,aAAa;IAC9B,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAHN,IAAI,EAAE,WAAW,EACjB,aAAa,EAAE,oBAAoB,EACnC,OAAO,EAAE,iBAAiB,EAC1B,MAAM,EAAE,YAAY;IAGjC,OAAO,CAAC,KAAK,EAAE,uBAAuB,GAAG,8BAA8B,CAAC,oBAAoB,CAAC;CAiBpG;AAED,eAAO,MAAM,qBAAqB,uLAMjC,CAAC;AAMF,qBAEa,6BAA8B,YAAW,qBAAqB,CAAC,IAAI,EAAE,4BAA4B,CAAC;IACjG,OAAO,CAAC,QAAQ,CAAC,SAAS;gBAAT,SAAS,EAAE,SAAS;IAE3C,OAAO,IAAI,0BAA0B,CAAC,4BAA4B,CAAC;IAgBzE,OAAO,CAAC,8BAA8B;CASvC;AAED,qBAEa,2BACX,YAAW,qBAAqB,CAAC,IAAI,EAAE,oBAAoB,CAAC;IAG1D,OAAO,CAAC,QAAQ,CAAC,cAAc;IAC/B,OAAO,CAAC,QAAQ,CAAC,cAAc;gBADd,cAAc,EAAE,qBAAqB,EACrC,cAAc,EAAE,qBAAqB;IAGlD,OAAO,IAAI,0BAA0B,CAAC,oBAAoB,CAAC;CAKlE;AAED,qBAEa,gCACX,YAAW,qBAAqB,CAAC,IAAI,EAAE,yBAAyB,CAAC;IAG/D,OAAO,CAAC,QAAQ,CAAC,cAAc;IAC/B,OAAO,CAAC,QAAQ,CAAC,cAAc;gBADd,cAAc,EAAE,qBAAqB,EACrC,cAAc,EAAE,qBAAqB;IAGlD,OAAO,IAAI,0BAA0B,CAAC,yBAAyB,CAAC;CAQvE;AAED,qBAEa,+BAAgC,YAAW,qBAAqB,CAAC,IAAI,EAAE,sBAAsB,CAAC;IAEvG,OAAO,CAAC,QAAQ,CAAC,cAAc;IAC/B,OAAO,CAAC,QAAQ,CAAC,cAAc;gBADd,cAAc,EAAE,qBAAqB,EACrC,cAAc,EAAE,qBAAqB;IAGlD,OAAO,IAAI,0BAA0B,CAAC,sBAAsB,CAAC;CASpE;AAED,eAAO,MAAM,oBAAoB,kKAKhC,CAAC"}
+{"version":3,"file":"auth-runtime.handlers.d.ts","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/auth/auth-runtime.handlers.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,UAAU,EAAE,0BAA0B,EAAE,8BAA8B,EAAE,MAAM,2CAA2C,CAAC;AAcxI,OAAO,EAAqC,KAAK,qBAAqB,EAAE,MAAM,mDAAmD,CAAC;AAElI,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAOzC,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC1D,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC7C,OAAO,KAAK,EACV,mCAAmC,EACnC,uBAAuB,EACvB,uCAAuC,EACvC,oBAAoB,EACpB,sBAAsB,EACtB,kBAAkB,EAClB,gBAAgB,EAChB,uBAAuB,EACxB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAE9D,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAChE,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EAAE,qBAAqB,EAAE,MAAM,oCAAoC,CAAC;AAC3E,OAAO,EAAE,qBAAqB,EAAE,MAAM,oCAAoC,CAAC;AAC3E,OAAO,EAGL,KAAK,4BAA4B,EAElC,MAAM,iCAAiC,CAAC;AACzC,OAAO,KAAK,EACV,sBAAsB,EACtB,yBAAyB,EACzB,oBAAoB,EACrB,MAAM,kCAAkC,CAAC;AAI1C,qBAEa,wBAAyB,YAAW,UAAU,CAAC,gBAAgB,EAAE,oBAAoB,CAAC;IAE/F,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,aAAa;IAC9B,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAHN,IAAI,EAAE,WAAW,EACjB,aAAa,EAAE,mBAAmB,EAClC,OAAO,EAAE,iBAAiB,EAC1B,MAAM,EAAE,YAAY;IAGjC,OAAO,CAAC,KAAK,EAAE,gBAAgB,GAAG,8BAA8B,CAAC,oBAAoB,CAAC;CAsB7F;AAED,qBAEa,0BAA2B,YAAW,UAAU,CAAC,kBAAkB,EAAE,oBAAoB,CAAC;IAEnG,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAFN,IAAI,EAAE,WAAW,EACjB,OAAO,EAAE,iBAAiB,EAC1B,MAAM,EAAE,YAAY;IAGjC,OAAO,CAAC,KAAK,EAAE,kBAAkB,GAAG,8BAA8B,CAAC,oBAAoB,CAAC;CAQ/F;AAED,qBAEa,yBACX,YAAW,UAAU,CAAC,sBAAsB,EAAE,oBAAoB,CAAC;IAGjE,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAFN,IAAI,EAAE,WAAW,EACjB,OAAO,EAAE,iBAAiB,EAC1B,MAAM,EAAE,YAAY;IAGjC,OAAO,CAAC,KAAK,EAAE,sBAAsB,GAAG,8BAA8B,CAAC,oBAAoB,CAAC;CAiBnG;AAED,qBAEa,wBAAyB,YAAW,UAAU,CAAC,sBAAsB,EAAE,IAAI,CAAC;IAErF,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,OAAO;gBADP,IAAI,EAAE,WAAW,EACjB,OAAO,EAAE,iBAAiB;IAGvC,OAAO,CAAC,KAAK,EAAE,sBAAsB,GAAG,8BAA8B,CAAC,IAAI,CAAC;CAYnF;AAED,qBAEa,+BACX,YAAW,UAAU,CAAC,uBAAuB,EAAE,oBAAoB,CAAC;IAGlE,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,aAAa;IAC9B,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAHN,IAAI,EAAE,WAAW,EACjB,aAAa,EAAE,oBAAoB,EACnC,OAAO,EAAE,iBAAiB,EAC1B,MAAM,EAAE,YAAY;IAGjC,OAAO,CAAC,KAAK,EAAE,uBAAuB,GAAG,8BAA8B,CAAC,oBAAoB,CAAC;CAiBpG;AAED,qBAEa,2CACX,YAAW,UAAU,CAAC,uCAAuC,EAAE,IAAI,CAAC;IAGlE,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,aAAa;gBADb,IAAI,EAAE,WAAW,EACjB,aAAa,EAAE,oBAAoB;IAGhD,OAAO,CAAC,KAAK,EAAE,uCAAuC,GAAG,8BAA8B,CAAC,IAAI,CAAC;CAcpG;AAED,eAAO,MAAM,qBAAqB,4OAOjC,CAAC;AAMF,qBAEa,6BAA8B,YAAW,qBAAqB,CAAC,IAAI,EAAE,4BAA4B,CAAC;IACjG,OAAO,CAAC,QAAQ,CAAC,SAAS;gBAAT,SAAS,EAAE,SAAS;IAE3C,OAAO,IAAI,0BAA0B,CAAC,4BAA4B,CAAC;IAgBzE,OAAO,CAAC,8BAA8B;CASvC;AAED,qBAEa,2BACX,YAAW,qBAAqB,CAAC,IAAI,EAAE,oBAAoB,CAAC;IAG1D,OAAO,CAAC,QAAQ,CAAC,cAAc;IAC/B,OAAO,CAAC,QAAQ,CAAC,cAAc;gBADd,cAAc,EAAE,qBAAqB,EACrC,cAAc,EAAE,qBAAqB;IAGlD,OAAO,IAAI,0BAA0B,CAAC,oBAAoB,CAAC;CAKlE;AAED,qBAEa,gCACX,YAAW,qBAAqB,CAAC,IAAI,EAAE,yBAAyB,CAAC;IAG/D,OAAO,CAAC,QAAQ,CAAC,cAAc;IAC/B,OAAO,CAAC,QAAQ,CAAC,cAAc;gBADd,cAAc,EAAE,qBAAqB,EACrC,cAAc,EAAE,qBAAqB;IAGlD,OAAO,IAAI,0BAA0B,CAAC,yBAAyB,CAAC;CAQvE;AAED,qBAEa,qCACX,YAAW,qBAAqB,CAAC,mCAAmC,EAAE,uBAAuB,CAAC;IAG5F,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,aAAa;gBADb,IAAI,EAAE,WAAW,EACjB,aAAa,EAAE,oBAAoB;IAGhD,OAAO,CACX,KAAK,EAAE,mCAAmC,GACzC,0BAA0B,CAAC,uBAAuB,CAAC;CAiBvD;AAED,qBAEa,+BAAgC,YAAW,qBAAqB,CAAC,IAAI,EAAE,sBAAsB,CAAC;IAEvG,OAAO,CAAC,QAAQ,CAAC,cAAc;IAC/B,OAAO,CAAC,QAAQ,CAAC,cAAc;gBADd,cAAc,EAAE,qBAAqB,EACrC,cAAc,EAAE,qBAAqB;IAGlD,OAAO,IAAI,0BAA0B,CAAC,sBAAsB,CAAC;CASpE;AAED,eAAO,MAAM,oBAAoB,iNAMhC,CAAC"}

package/security/src/lib/auth/auth-runtime.handlers.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.AUTH_RUNTIME_QUERIES = exports.AuthGetAccessPolicyRuntimeQuery = exports.AuthListApplicationsRuntimeQuery = exports.AuthListTenantsRuntimeQuery = exports.AuthListProvidersRuntimeQuery = exports.AUTH_RUNTIME_COMMANDS = exports.AuthUpdateSessionRuntimeCommand = exports.AuthLogoutRuntimeCommand = exports.AuthRefreshRuntimeCommand = exports.AuthRegisterRuntimeCommand = exports.AuthSignInRuntimeCommand = void 0;
+exports.AUTH_RUNTIME_QUERIES = exports.AuthGetAccessPolicyRuntimeQuery = exports.AuthListOwnDeviceSessionsRuntimeQuery = exports.AuthListApplicationsRuntimeQuery = exports.AuthListTenantsRuntimeQuery = exports.AuthListProvidersRuntimeQuery = exports.AUTH_RUNTIME_COMMANDS = exports.AuthTerminateOwnDeviceSessionRuntimeCommand = exports.AuthUpdateSessionRuntimeCommand = exports.AuthLogoutRuntimeCommand = exports.AuthRefreshRuntimeCommand = exports.AuthRegisterRuntimeCommand = exports.AuthSignInRuntimeCommand = void 0;
 const tslib_1 = require("tslib");
 const core_1 = require("@acorex-platform/framework-shared/core");
 const runtime_1 = require("@acorex-platform/framework-shared/runtime");
@@ -30,10 +30,12 @@ let AuthSignInRuntimeCommand = class AuthSignInRuntimeCommand {
         this.auth.assertSupportedSignInStrategy(input.strategy);
         const username = String(input.username ?? '').trim();
         const password = String(input.password ?? '');
-        const user = await this.loginAttempts.authenticateLocal(this.loginAttempts.strategyName(), username, password);
         const request = (0, auth_http_request_util_1.resolveAuthHttpRequest)();
         const meta = (0, request_meta_util_1.resolveAuthRequestMeta)(request);
-        const data = await this.auth.completeSignIn(user, meta);
+        const user = await this.loginAttempts.authenticateLocal(this.loginAttempts.strategyName(), username, password, meta);
+        const data = await this.auth.completeSignIn(user, meta, {
+            ...(typeof input.rememberMe === 'boolean' ? { persist: input.rememberMe } : {}),
+        });
         (0, auth_cookie_response_util_1.applyAuthTokenCookies)(request, this.cookies, this.tokens, data);
         return { success: true, kind: 'object', data };
     }
@@ -147,12 +149,35 @@ exports.AuthUpdateSessionRuntimeCommand = AuthUpdateSessionRuntimeCommand = tsli
         auth_cookie_service_1.AuthCookieService,
         token_service_1.TokenService])
 ], AuthUpdateSessionRuntimeCommand);
+let AuthTerminateOwnDeviceSessionRuntimeCommand = class AuthTerminateOwnDeviceSessionRuntimeCommand {
+    constructor(auth, tokenResolver) {
+        this.auth = auth;
+        this.tokenResolver = tokenResolver;
+    }
+    async execute(input) {
+        const request = (0, auth_http_request_util_1.resolveAuthHttpRequest)();
+        const resolved = this.tokenResolver.resolveAccessToken(request.headers, request.cookies);
+        if (!resolved) {
+            throw new common_1.UnauthorizedException('Access token is required');
+        }
+        await this.auth.terminateOwnDeviceSession(resolved.token, String(input.id ?? ''));
+        return (0, core_1.runtimeCommandSuccessObject)(undefined);
+    }
+};
+exports.AuthTerminateOwnDeviceSessionRuntimeCommand = AuthTerminateOwnDeviceSessionRuntimeCommand;
+exports.AuthTerminateOwnDeviceSessionRuntimeCommand = AuthTerminateOwnDeviceSessionRuntimeCommand = tslib_1.__decorate([
+    (0, abstract_1.ServerHandler)({ key: runtime_1.AUTH_TERMINATE_OWN_DEVICE_SESSION_DEFAULT, auth: 'session' }),
+    (0, common_1.Injectable)(),
+    tslib_1.__metadata("design:paramtypes", [auth_service_1.AuthService,
+        token_resolver_service_1.TokenResolverService])
+], AuthTerminateOwnDeviceSessionRuntimeCommand);
 exports.AUTH_RUNTIME_COMMANDS = [
     AuthSignInRuntimeCommand,
     AuthRegisterRuntimeCommand,
     AuthRefreshRuntimeCommand,
     AuthLogoutRuntimeCommand,
     AuthUpdateSessionRuntimeCommand,
+    AuthTerminateOwnDeviceSessionRuntimeCommand,
 ];
 //#endregion
 //#region ---- Auth runtime queries ----
@@ -226,6 +251,28 @@ exports.AuthListApplicationsRuntimeQuery = AuthListApplicationsRuntimeQuery = ts
     tslib_1.__metadata("design:paramtypes", [session_context_service_1.SessionContextService,
         backend_session_service_1.BackendSessionService])
 ], AuthListApplicationsRuntimeQuery);
+let AuthListOwnDeviceSessionsRuntimeQuery = class AuthListOwnDeviceSessionsRuntimeQuery {
+    constructor(auth, tokenResolver) {
+        this.auth = auth;
+        this.tokenResolver = tokenResolver;
+    }
+    async execute(input) {
+        const request = (0, auth_http_request_util_1.resolveAuthHttpRequest)();
+        const resolved = this.tokenResolver.resolveAccessToken(request.headers, request.cookies);
+        if (!resolved) {
+            throw new common_1.UnauthorizedException('Access token is required');
+        }
+        const items = await this.auth.listOwnActiveDeviceSessions(resolved.token, String(input?.tenantId ?? ''));
+        return (0, core_1.runtimeQuerySuccessCollection)(items);
+    }
+};
+exports.AuthListOwnDeviceSessionsRuntimeQuery = AuthListOwnDeviceSessionsRuntimeQuery;
+exports.AuthListOwnDeviceSessionsRuntimeQuery = AuthListOwnDeviceSessionsRuntimeQuery = tslib_1.__decorate([
+    (0, abstract_1.ServerQueryHandler)({ key: runtime_1.AUTH_LIST_OWN_DEVICE_SESSIONS_DEFAULT, auth: 'session' }),
+    (0, common_1.Injectable)(),
+    tslib_1.__metadata("design:paramtypes", [auth_service_1.AuthService,
+        token_resolver_service_1.TokenResolverService])
+], AuthListOwnDeviceSessionsRuntimeQuery);
 let AuthGetAccessPolicyRuntimeQuery = class AuthGetAccessPolicyRuntimeQuery {
     constructor(sessionContext, backendSession) {
         this.sessionContext = sessionContext;
@@ -248,6 +295,7 @@ exports.AUTH_RUNTIME_QUERIES = [
     AuthListProvidersRuntimeQuery,
     AuthListTenantsRuntimeQuery,
     AuthListApplicationsRuntimeQuery,
+    AuthListOwnDeviceSessionsRuntimeQuery,
     AuthGetAccessPolicyRuntimeQuery,
 ];
 //#endregion

package/security/src/lib/auth/auth-runtime.handlers.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth-runtime.handlers.js","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/auth/auth-runtime.handlers.ts"],"names":[],"mappings":";;;;AACA,iEAIgD;AAEhD,uEAUmD;AACnD,gFAAkI;AAClI,2CAAmE;AACnE,uCAAyC;AAEzC,qEAAkE;AAClE,2EAGqC;AACrC,+DAA0D;AAC1D,iDAA6C;AAQ7C,mEAA8D;AAC9D,2DAA6D;AAC7D,qEAAgE;AAChE,mDAA+C;AAC/C,gFAA2E;AAC3E,gFAA2E;AAC3E,mFAKyC;AAOzC,yCAAyC;AAIlC,IAAM,wBAAwB,GAA9B,MAAM,wBAAwB;IACnC,YACmB,IAAiB,EACjB,aAAkC,EAClC,OAA0B,EAC1B,MAAoB;QAHpB,SAAI,GAAJ,IAAI,CAAa;QACjB,kBAAa,GAAb,aAAa,CAAqB;QAClC,YAAO,GAAP,OAAO,CAAmB;QAC1B,WAAM,GAAN,MAAM,CAAc;IACpC,CAAC;IAEJ,KAAK,CAAC,OAAO,CAAC,KAAuB;QACnC,IAAI,CAAC,IAAI,CAAC,6BAA6B,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAExD,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACrD,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC;QAE9C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,iBAAiB,CACrD,IAAI,CAAC,aAAa,CAAC,YAAY,EAAE,EACjC,QAAQ,EACR,QAAQ,CACT,CAAC;QAEF,MAAM,OAAO,GAAG,IAAA,+CAAsB,GAAE,CAAC;QACzC,MAAM,IAAI,GAAG,IAAA,0CAAsB,EAAC,OAAO,CAAC,CAAC;QAC7C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACxD,IAAA,iDAAqB,EAAC,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAEhE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IACjD,CAAC;CACF,CAAA;AA3BY,4DAAwB;mCAAxB,wBAAwB;IAFpC,IAAA,wBAAa,EAAC,EAAE,GAAG,EAAE,8BAAoB,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IAC5D,IAAA,mBAAU,GAAE;6CAGc,0BAAW;QACF,2CAAmB;QACzB,uCAAiB;QAClB,4BAAY;GAL5B,wBAAwB,CA2BpC;AAIM,IAAM,0BAA0B,GAAhC,MAAM,0BAA0B;IACrC,YACmB,IAAiB,EACjB,OAA0B,EAC1B,MAAoB;QAFpB,SAAI,GAAJ,IAAI,CAAa;QACjB,YAAO,GAAP,OAAO,CAAmB;QAC1B,WAAM,GAAN,MAAM,CAAc;IACpC,CAAC;IAEJ,KAAK,CAAC,OAAO,CAAC,KAAyB;QACrC,MAAM,OAAO,GAAG,IAAA,+CAAsB,GAAE,CAAC;QACzC,MAAM,IAAI,GAAG,IAAA,0CAAsB,EAAC,OAAO,CAAC,CAAC;QAC7C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QACnD,IAAA,iDAAqB,EAAC,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAEhE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IACjD,CAAC;CACF,CAAA;AAfY,gEAA0B;qCAA1B,0BAA0B;IAFtC,IAAA,wBAAa,EAAC,EAAE,GAAG,EAAE,+BAAqB,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IAC7D,IAAA,mBAAU,GAAE;6CAGc,0BAAW;QACR,uCAAiB;QAClB,4BAAY;GAJ5B,0BAA0B,CAetC;AAIM,IAAM,yBAAyB,GAA/B,MAAM,yBAAyB;IAGpC,YACmB,IAAiB,EACjB,OAA0B,EAC1B,MAAoB;QAFpB,SAAI,GAAJ,IAAI,CAAa;QACjB,YAAO,GAAP,OAAO,CAAmB;QAC1B,WAAM,GAAN,MAAM,CAAc;IACpC,CAAC;IAEJ,KAAK,CAAC,OAAO,CAAC,KAA6B;QACzC,MAAM,OAAO,GAAG,IAAA,+CAAsB,GAAE,CAAC;QACzC,MAAM,YAAY,GAChB,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,OAAO,CAAC,OAAkC,CAAC;YACzE,KAAK,CAAC,YAAY,EAAE,IAAI,EAAE;YAC1B,IAAI,CAAC;QAEP,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,MAAM,IAAI,8BAAqB,CAAC,0BAA0B,CAAC,CAAC;QAC9D,CAAC;QAED,MAAM,IAAI,GAAG,IAAA,0CAAsB,EAAC,OAAO,CAAC,CAAC;QAC7C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC;QAChE,IAAA,iDAAqB,EAAC,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAEhE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IACjD,CAAC;CACF,CAAA;AA1BY,8DAAyB;oCAAzB,yBAAyB;IAFrC,IAAA,wBAAa,EAAC,EAAE,GAAG,EAAE,8BAAoB,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IAC5D,IAAA,mBAAU,GAAE;6CAKc,0BAAW;QACR,uCAAiB;QAClB,4BAAY;GAN5B,yBAAyB,CA0BrC;AAIM,IAAM,wBAAwB,GAA9B,MAAM,wBAAwB;IACnC,YACmB,IAAiB,EACjB,OAA0B;QAD1B,SAAI,GAAJ,IAAI,CAAa;QACjB,YAAO,GAAP,OAAO,CAAmB;IAC1C,CAAC;IAEJ,KAAK,CAAC,OAAO,CAAC,KAA6B;QACzC,MAAM,OAAO,GAAG,IAAA,+CAAsB,GAAE,CAAC;QACzC,MAAM,YAAY,GAChB,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,OAAO,CAAC,OAAkC,CAAC;YACzE,KAAK,CAAC,YAAY,EAAE,IAAI,EAAE;YAC1B,IAAI,CAAC;QAEP,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QACrC,IAAA,iDAAqB,EAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;QAE7C,OAAO,IAAA,kCAA2B,EAAC,SAAS,CAAC,CAAC;IAChD,CAAC;CACF,CAAA;AAlBY,4DAAwB;mCAAxB,wBAAwB;IAFpC,IAAA,wBAAa,EAAC,EAAE,GAAG,EAAE,6BAAmB,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IAC3D,IAAA,mBAAU,GAAE;6CAGc,0BAAW;QACR,uCAAiB;GAHlC,wBAAwB,CAkBpC;AAIM,IAAM,+BAA+B,GAArC,MAAM,+BAA+B;IAG1C,YACmB,IAAiB,EACjB,aAAmC,EACnC,OAA0B,EAC1B,MAAoB;QAHpB,SAAI,GAAJ,IAAI,CAAa;QACjB,kBAAa,GAAb,aAAa,CAAsB;QACnC,YAAO,GAAP,OAAO,CAAmB;QAC1B,WAAM,GAAN,MAAM,CAAc;IACpC,CAAC;IAEJ,KAAK,CAAC,OAAO,CAAC,KAA8B;QAC1C,MAAM,OAAO,GAAG,IAAA,+CAAsB,GAAE,CAAC;QACzC,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,CAAC,kBAAkB,CACpD,OAAO,CAAC,OAAwD,EAChE,OAAO,CAAC,OAAkC,CAC3C,CAAC;QAEF,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,8BAAqB,CAAC,0BAA0B,CAAC,CAAC;QAC9D,CAAC;QAED,MAAM,IAAI,GAAG,IAAA,0CAAsB,EAAC,OAAO,CAAC,CAAC;QAC7C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;QACxE,IAAA,iDAAqB,EAAC,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAEhE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IACjD,CAAC;CACF,CAAA;AA3BY,0EAA+B;0CAA/B,+BAA+B;IAF3C,IAAA,wBAAa,EAAC,EAAE,GAAG,EAAE,qCAA2B,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IACpE,IAAA,mBAAU,GAAE;6CAKc,0BAAW;QACF,6CAAoB;QAC1B,uCAAiB;QAClB,4BAAY;GAP5B,+BAA+B,CA2B3C;AAEY,QAAA,qBAAqB,GAAG;IACnC,wBAAwB;IACxB,0BAA0B;IAC1B,yBAAyB;IACzB,wBAAwB;IACxB,+BAA+B;CAChC,CAAC;AAEF,YAAY;AAEZ,wCAAwC;AAIjC,IAAM,6BAA6B,GAAnC,MAAM,6BAA6B;IACxC,YAA6B,SAAoB;QAApB,cAAS,GAAT,SAAS,CAAW;IAAG,CAAC;IAErD,KAAK,CAAC,OAAO;QACX,MAAM,YAAY,GAA+B;YAC/C;gBACE,EAAE,EAAE,WAAW;gBACf,KAAK,EAAE,UAAU;gBACjB,QAAQ,EAAE,UAAU;gBACpB,OAAO,EAAE,IAAI;aACd;SACF,CAAC;QAEF,MAAM,OAAO,GAAG,IAAI,CAAC,8BAA8B,EAAE,CAAC;QACtD,MAAM,iBAAiB,GAAG,OAAO,CAAC,CAAC,CAAC,MAAM,OAAO,CAAC,mBAAmB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAE7E,OAAO,IAAA,gCAAyB,EAAC,EAAE,YAAY,EAAE,iBAAiB,EAAE,CAAC,CAAC;IACxE,CAAC;IAEO,8BAA8B;QACpC,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAA8B,8DAA8B,EAAE;gBACrF,MAAM,EAAE,KAAK;aACd,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;CACF,CAAA;AA5BY,sEAA6B;wCAA7B,6BAA6B;IAFzC,IAAA,6BAAkB,EAAC,EAAE,GAAG,EAAE,qCAA2B,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IACxE,IAAA,mBAAU,GAAE;6CAE6B,gBAAS;GADtC,6BAA6B,CA4BzC;AAIM,IAAM,2BAA2B,GAAjC,MAAM,2BAA2B;IAGtC,YACmB,cAAqC,EACrC,cAAqC;QADrC,mBAAc,GAAd,cAAc,CAAuB;QACrC,mBAAc,GAAd,cAAc,CAAuB;IACrD,CAAC;IAEJ,KAAK,CAAC,OAAO;QACX,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,oBAAoB,EAAE,CAAC;QAC3D,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,0BAA0B,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAClF,OAAO,IAAA,oCAA6B,EAAC,IAAI,CAAC,CAAC;IAC7C,CAAC;CACF,CAAA;AAbY,kEAA2B;sCAA3B,2BAA2B;IAFvC,IAAA,6BAAkB,EAAC,EAAE,GAAG,EAAE,mCAAyB,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IACvE,IAAA,mBAAU,GAAE;6CAKwB,+CAAqB;QACrB,+CAAqB;GAL7C,2BAA2B,CAavC;AAIM,IAAM,gCAAgC,GAAtC,MAAM,gCAAgC;IAG3C,YACmB,cAAqC,EACrC,cAAqC;QADrC,mBAAc,GAAd,cAAc,CAAuB;QACrC,mBAAc,GAAd,cAAc,CAAuB;IACrD,CAAC;IAEJ,KAAK,CAAC,OAAO;QACX,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,oBAAoB,EAAE,CAAC;QAC3D,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,+BAA+B,CACpE,OAAO,CAAC,MAAM,EACd,OAAO,CAAC,QAAQ,CACjB,CAAC;QACF,OAAO,IAAA,oCAA6B,EAAC,IAAI,CAAC,CAAC;IAC7C,CAAC;CACF,CAAA;AAhBY,4EAAgC;2CAAhC,gCAAgC;IAF5C,IAAA,6BAAkB,EAAC,EAAE,GAAG,EAAE,wCAA8B,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IAC5E,IAAA,mBAAU,GAAE;6CAKwB,+CAAqB;QACrB,+CAAqB;GAL7C,gCAAgC,CAgB5C;AAIM,IAAM,+BAA+B,GAArC,MAAM,+BAA+B;IAC1C,YACmB,cAAqC,EACrC,cAAqC;QADrC,mBAAc,GAAd,cAAc,CAAuB;QACrC,mBAAc,GAAd,cAAc,CAAuB;IACrD,CAAC;IAEJ,KAAK,CAAC,OAAO;QACX,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,oBAAoB,EAAE,CAAC;QAC3D,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,eAAe,CACpD,OAAO,CAAC,MAAM,EACd,OAAO,CAAC,QAAQ,EAChB,OAAO,CAAC,aAAa,CACtB,CAAC;QACF,OAAO,IAAA,gCAAyB,EAAC,IAAI,CAAC,CAAC;IACzC,CAAC;CACF,CAAA;AAfY,0EAA+B;0CAA/B,+BAA+B;IAF3C,IAAA,6BAAkB,EAAC,EAAE,GAAG,EAAE,wCAA8B,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IAC5E,IAAA,mBAAU,GAAE;6CAGwB,+CAAqB;QACrB,+CAAqB;GAH7C,+BAA+B,CAe3C;AAEY,QAAA,oBAAoB,GAAG;IAClC,6BAA6B;IAC7B,2BAA2B;IAC3B,gCAAgC;IAChC,+BAA+B;CAChC,CAAC;AAEF,YAAY"}
+{"version":3,"file":"auth-runtime.handlers.js","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/auth/auth-runtime.handlers.ts"],"names":[],"mappings":";;;;AACA,iEAIgD;AAEhD,uEAYmD;AACnD,gFAAkI;AAClI,2CAAmE;AACnE,uCAAyC;AAEzC,qEAAkE;AAClE,2EAGqC;AACrC,+DAA0D;AAC1D,iDAA6C;AAW7C,mEAA8D;AAC9D,2DAA6D;AAC7D,qEAAgE;AAChE,mDAA+C;AAC/C,gFAA2E;AAC3E,gFAA2E;AAC3E,mFAKyC;AAOzC,yCAAyC;AAIlC,IAAM,wBAAwB,GAA9B,MAAM,wBAAwB;IACnC,YACmB,IAAiB,EACjB,aAAkC,EAClC,OAA0B,EAC1B,MAAoB;QAHpB,SAAI,GAAJ,IAAI,CAAa;QACjB,kBAAa,GAAb,aAAa,CAAqB;QAClC,YAAO,GAAP,OAAO,CAAmB;QAC1B,WAAM,GAAN,MAAM,CAAc;IACpC,CAAC;IAEJ,KAAK,CAAC,OAAO,CAAC,KAAuB;QACnC,IAAI,CAAC,IAAI,CAAC,6BAA6B,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAExD,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACrD,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC;QAE9C,MAAM,OAAO,GAAG,IAAA,+CAAsB,GAAE,CAAC;QACzC,MAAM,IAAI,GAAG,IAAA,0CAAsB,EAAC,OAAO,CAAC,CAAC;QAC7C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,iBAAiB,CACrD,IAAI,CAAC,aAAa,CAAC,YAAY,EAAE,EACjC,QAAQ,EACR,QAAQ,EACR,IAAI,CACL,CAAC;QAEF,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,EAAE,IAAI,EAAE;YACtD,GAAG,CAAC,OAAO,KAAK,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAChF,CAAC,CAAC;QACH,IAAA,iDAAqB,EAAC,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAEhE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IACjD,CAAC;CACF,CAAA;AA9BY,4DAAwB;mCAAxB,wBAAwB;IAFpC,IAAA,wBAAa,EAAC,EAAE,GAAG,EAAE,8BAAoB,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IAC5D,IAAA,mBAAU,GAAE;6CAGc,0BAAW;QACF,2CAAmB;QACzB,uCAAiB;QAClB,4BAAY;GAL5B,wBAAwB,CA8BpC;AAIM,IAAM,0BAA0B,GAAhC,MAAM,0BAA0B;IACrC,YACmB,IAAiB,EACjB,OAA0B,EAC1B,MAAoB;QAFpB,SAAI,GAAJ,IAAI,CAAa;QACjB,YAAO,GAAP,OAAO,CAAmB;QAC1B,WAAM,GAAN,MAAM,CAAc;IACpC,CAAC;IAEJ,KAAK,CAAC,OAAO,CAAC,KAAyB;QACrC,MAAM,OAAO,GAAG,IAAA,+CAAsB,GAAE,CAAC;QACzC,MAAM,IAAI,GAAG,IAAA,0CAAsB,EAAC,OAAO,CAAC,CAAC;QAC7C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QACnD,IAAA,iDAAqB,EAAC,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAEhE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IACjD,CAAC;CACF,CAAA;AAfY,gEAA0B;qCAA1B,0BAA0B;IAFtC,IAAA,wBAAa,EAAC,EAAE,GAAG,EAAE,+BAAqB,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IAC7D,IAAA,mBAAU,GAAE;6CAGc,0BAAW;QACR,uCAAiB;QAClB,4BAAY;GAJ5B,0BAA0B,CAetC;AAIM,IAAM,yBAAyB,GAA/B,MAAM,yBAAyB;IAGpC,YACmB,IAAiB,EACjB,OAA0B,EAC1B,MAAoB;QAFpB,SAAI,GAAJ,IAAI,CAAa;QACjB,YAAO,GAAP,OAAO,CAAmB;QAC1B,WAAM,GAAN,MAAM,CAAc;IACpC,CAAC;IAEJ,KAAK,CAAC,OAAO,CAAC,KAA6B;QACzC,MAAM,OAAO,GAAG,IAAA,+CAAsB,GAAE,CAAC;QACzC,MAAM,YAAY,GAChB,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,OAAO,CAAC,OAAkC,CAAC;YACzE,KAAK,CAAC,YAAY,EAAE,IAAI,EAAE;YAC1B,IAAI,CAAC;QAEP,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,MAAM,IAAI,8BAAqB,CAAC,0BAA0B,CAAC,CAAC;QAC9D,CAAC;QAED,MAAM,IAAI,GAAG,IAAA,0CAAsB,EAAC,OAAO,CAAC,CAAC;QAC7C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC;QAChE,IAAA,iDAAqB,EAAC,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAEhE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IACjD,CAAC;CACF,CAAA;AA1BY,8DAAyB;oCAAzB,yBAAyB;IAFrC,IAAA,wBAAa,EAAC,EAAE,GAAG,EAAE,8BAAoB,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IAC5D,IAAA,mBAAU,GAAE;6CAKc,0BAAW;QACR,uCAAiB;QAClB,4BAAY;GAN5B,yBAAyB,CA0BrC;AAIM,IAAM,wBAAwB,GAA9B,MAAM,wBAAwB;IACnC,YACmB,IAAiB,EACjB,OAA0B;QAD1B,SAAI,GAAJ,IAAI,CAAa;QACjB,YAAO,GAAP,OAAO,CAAmB;IAC1C,CAAC;IAEJ,KAAK,CAAC,OAAO,CAAC,KAA6B;QACzC,MAAM,OAAO,GAAG,IAAA,+CAAsB,GAAE,CAAC;QACzC,MAAM,YAAY,GAChB,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,OAAO,CAAC,OAAkC,CAAC;YACzE,KAAK,CAAC,YAAY,EAAE,IAAI,EAAE;YAC1B,IAAI,CAAC;QAEP,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QACrC,IAAA,iDAAqB,EAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;QAE7C,OAAO,IAAA,kCAA2B,EAAC,SAAS,CAAC,CAAC;IAChD,CAAC;CACF,CAAA;AAlBY,4DAAwB;mCAAxB,wBAAwB;IAFpC,IAAA,wBAAa,EAAC,EAAE,GAAG,EAAE,6BAAmB,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IAC3D,IAAA,mBAAU,GAAE;6CAGc,0BAAW;QACR,uCAAiB;GAHlC,wBAAwB,CAkBpC;AAIM,IAAM,+BAA+B,GAArC,MAAM,+BAA+B;IAG1C,YACmB,IAAiB,EACjB,aAAmC,EACnC,OAA0B,EAC1B,MAAoB;QAHpB,SAAI,GAAJ,IAAI,CAAa;QACjB,kBAAa,GAAb,aAAa,CAAsB;QACnC,YAAO,GAAP,OAAO,CAAmB;QAC1B,WAAM,GAAN,MAAM,CAAc;IACpC,CAAC;IAEJ,KAAK,CAAC,OAAO,CAAC,KAA8B;QAC1C,MAAM,OAAO,GAAG,IAAA,+CAAsB,GAAE,CAAC;QACzC,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,CAAC,kBAAkB,CACpD,OAAO,CAAC,OAAwD,EAChE,OAAO,CAAC,OAAkC,CAC3C,CAAC;QAEF,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,8BAAqB,CAAC,0BAA0B,CAAC,CAAC;QAC9D,CAAC;QAED,MAAM,IAAI,GAAG,IAAA,0CAAsB,EAAC,OAAO,CAAC,CAAC;QAC7C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;QACxE,IAAA,iDAAqB,EAAC,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAEhE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IACjD,CAAC;CACF,CAAA;AA3BY,0EAA+B;0CAA/B,+BAA+B;IAF3C,IAAA,wBAAa,EAAC,EAAE,GAAG,EAAE,qCAA2B,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IACpE,IAAA,mBAAU,GAAE;6CAKc,0BAAW;QACF,6CAAoB;QAC1B,uCAAiB;QAClB,4BAAY;GAP5B,+BAA+B,CA2B3C;AAIM,IAAM,2CAA2C,GAAjD,MAAM,2CAA2C;IAGtD,YACmB,IAAiB,EACjB,aAAmC;QADnC,SAAI,GAAJ,IAAI,CAAa;QACjB,kBAAa,GAAb,aAAa,CAAsB;IACnD,CAAC;IAEJ,KAAK,CAAC,OAAO,CAAC,KAA8C;QAC1D,MAAM,OAAO,GAAG,IAAA,+CAAsB,GAAE,CAAC;QACzC,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,CAAC,kBAAkB,CACpD,OAAO,CAAC,OAAwD,EAChE,OAAO,CAAC,OAAkC,CAC3C,CAAC;QAEF,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,8BAAqB,CAAC,0BAA0B,CAAC,CAAC;QAC9D,CAAC;QAED,MAAM,IAAI,CAAC,IAAI,CAAC,yBAAyB,CAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QAClF,OAAO,IAAA,kCAA2B,EAAC,SAAS,CAAC,CAAC;IAChD,CAAC;CACF,CAAA;AAtBY,kGAA2C;sDAA3C,2CAA2C;IAFvD,IAAA,wBAAa,EAAC,EAAE,GAAG,EAAE,mDAAyC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IAClF,IAAA,mBAAU,GAAE;6CAKc,0BAAW;QACF,6CAAoB;GAL3C,2CAA2C,CAsBvD;AAEY,QAAA,qBAAqB,GAAG;IACnC,wBAAwB;IACxB,0BAA0B;IAC1B,yBAAyB;IACzB,wBAAwB;IACxB,+BAA+B;IAC/B,2CAA2C;CAC5C,CAAC;AAEF,YAAY;AAEZ,wCAAwC;AAIjC,IAAM,6BAA6B,GAAnC,MAAM,6BAA6B;IACxC,YAA6B,SAAoB;QAApB,cAAS,GAAT,SAAS,CAAW;IAAG,CAAC;IAErD,KAAK,CAAC,OAAO;QACX,MAAM,YAAY,GAA+B;YAC/C;gBACE,EAAE,EAAE,WAAW;gBACf,KAAK,EAAE,UAAU;gBACjB,QAAQ,EAAE,UAAU;gBACpB,OAAO,EAAE,IAAI;aACd;SACF,CAAC;QAEF,MAAM,OAAO,GAAG,IAAI,CAAC,8BAA8B,EAAE,CAAC;QACtD,MAAM,iBAAiB,GAAG,OAAO,CAAC,CAAC,CAAC,MAAM,OAAO,CAAC,mBAAmB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAE7E,OAAO,IAAA,gCAAyB,EAAC,EAAE,YAAY,EAAE,iBAAiB,EAAE,CAAC,CAAC;IACxE,CAAC;IAEO,8BAA8B;QACpC,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAA8B,8DAA8B,EAAE;gBACrF,MAAM,EAAE,KAAK;aACd,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;CACF,CAAA;AA5BY,sEAA6B;wCAA7B,6BAA6B;IAFzC,IAAA,6BAAkB,EAAC,EAAE,GAAG,EAAE,qCAA2B,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IACxE,IAAA,mBAAU,GAAE;6CAE6B,gBAAS;GADtC,6BAA6B,CA4BzC;AAIM,IAAM,2BAA2B,GAAjC,MAAM,2BAA2B;IAGtC,YACmB,cAAqC,EACrC,cAAqC;QADrC,mBAAc,GAAd,cAAc,CAAuB;QACrC,mBAAc,GAAd,cAAc,CAAuB;IACrD,CAAC;IAEJ,KAAK,CAAC,OAAO;QACX,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,oBAAoB,EAAE,CAAC;QAC3D,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,0BAA0B,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAClF,OAAO,IAAA,oCAA6B,EAAC,IAAI,CAAC,CAAC;IAC7C,CAAC;CACF,CAAA;AAbY,kEAA2B;sCAA3B,2BAA2B;IAFvC,IAAA,6BAAkB,EAAC,EAAE,GAAG,EAAE,mCAAyB,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IACvE,IAAA,mBAAU,GAAE;6CAKwB,+CAAqB;QACrB,+CAAqB;GAL7C,2BAA2B,CAavC;AAIM,IAAM,gCAAgC,GAAtC,MAAM,gCAAgC;IAG3C,YACmB,cAAqC,EACrC,cAAqC;QADrC,mBAAc,GAAd,cAAc,CAAuB;QACrC,mBAAc,GAAd,cAAc,CAAuB;IACrD,CAAC;IAEJ,KAAK,CAAC,OAAO;QACX,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,oBAAoB,EAAE,CAAC;QAC3D,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,+BAA+B,CACpE,OAAO,CAAC,MAAM,EACd,OAAO,CAAC,QAAQ,CACjB,CAAC;QACF,OAAO,IAAA,oCAA6B,EAAC,IAAI,CAAC,CAAC;IAC7C,CAAC;CACF,CAAA;AAhBY,4EAAgC;2CAAhC,gCAAgC;IAF5C,IAAA,6BAAkB,EAAC,EAAE,GAAG,EAAE,wCAA8B,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IAC5E,IAAA,mBAAU,GAAE;6CAKwB,+CAAqB;QACrB,+CAAqB;GAL7C,gCAAgC,CAgB5C;AAIM,IAAM,qCAAqC,GAA3C,MAAM,qCAAqC;IAGhD,YACmB,IAAiB,EACjB,aAAmC;QADnC,SAAI,GAAJ,IAAI,CAAa;QACjB,kBAAa,GAAb,aAAa,CAAsB;IACnD,CAAC;IAEJ,KAAK,CAAC,OAAO,CACX,KAA0C;QAE1C,MAAM,OAAO,GAAG,IAAA,+CAAsB,GAAE,CAAC;QACzC,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,CAAC,kBAAkB,CACpD,OAAO,CAAC,OAAwD,EAChE,OAAO,CAAC,OAAkC,CAC3C,CAAC;QAEF,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,8BAAqB,CAAC,0BAA0B,CAAC,CAAC;QAC9D,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,2BAA2B,CACvD,QAAQ,CAAC,KAAK,EACd,MAAM,CAAC,KAAK,EAAE,QAAQ,IAAI,EAAE,CAAC,CAC9B,CAAC;QACF,OAAO,IAAA,oCAA6B,EAAC,KAAK,CAAC,CAAC;IAC9C,CAAC;CACF,CAAA;AA3BY,sFAAqC;gDAArC,qCAAqC;IAFjD,IAAA,6BAAkB,EAAC,EAAE,GAAG,EAAE,+CAAqC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IACnF,IAAA,mBAAU,GAAE;6CAKc,0BAAW;QACF,6CAAoB;GAL3C,qCAAqC,CA2BjD;AAIM,IAAM,+BAA+B,GAArC,MAAM,+BAA+B;IAC1C,YACmB,cAAqC,EACrC,cAAqC;QADrC,mBAAc,GAAd,cAAc,CAAuB;QACrC,mBAAc,GAAd,cAAc,CAAuB;IACrD,CAAC;IAEJ,KAAK,CAAC,OAAO;QACX,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,oBAAoB,EAAE,CAAC;QAC3D,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,eAAe,CACpD,OAAO,CAAC,MAAM,EACd,OAAO,CAAC,QAAQ,EAChB,OAAO,CAAC,aAAa,CACtB,CAAC;QACF,OAAO,IAAA,gCAAyB,EAAC,IAAI,CAAC,CAAC;IACzC,CAAC;CACF,CAAA;AAfY,0EAA+B;0CAA/B,+BAA+B;IAF3C,IAAA,6BAAkB,EAAC,EAAE,GAAG,EAAE,wCAA8B,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IAC5E,IAAA,mBAAU,GAAE;6CAGwB,+CAAqB;QACrB,+CAAqB;GAH7C,+BAA+B,CAe3C;AAEY,QAAA,oBAAoB,GAAG;IAClC,6BAA6B;IAC7B,2BAA2B;IAC3B,gCAAgC;IAChC,qCAAqC;IACrC,+BAA+B;CAChC,CAAC;AAEF,YAAY"}

package/security/src/lib/auth/auth.config.d.ts

@@ -1,7 +1,14 @@
 export declare const AUTH_COOKIE_REFRESH_TOKEN = "acx_refresh_token";
 /** HttpOnly access token cookie (primary SPA credential). */
 export declare const AUTH_COOKIE_ACCESS_TOKEN = "acx_access_token";
+/** Double-submit CSRF cookie (readable by SPA for `X-CSRF-Token`). */
+export declare const AUTH_COOKIE_CSRF_TOKEN = "acx_csrf_token";
 export declare const AUTH_STRATEGY_USER_PASS = "user-pass";
+/**
+ * Fixed audience for Platform-issued access tokens (OP / application auth).
+ * Not a Resource Server selector — Entity/Business APIs are not split by `aud`.
+ */
+export declare const PLATFORM_ACCESS_TOKEN_AUDIENCE = "platform";
 export declare const AUTH_COOKIE_SECURE: () => boolean;
 export declare const AUTH_COOKIE_SAME_SITE: () => "lax" | "strict" | "none";
 /** Path scoped so refresh cookies are sent to all `/api` routes (incl. runtime). */

package/security/src/lib/auth/auth.config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.config.d.ts","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/auth/auth.config.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,yBAAyB,sBAAsB,CAAC;AAE7D,6DAA6D;AAC7D,eAAO,MAAM,wBAAwB,qBAAqB,CAAC;AAE3D,eAAO,MAAM,uBAAuB,cAAc,CAAC;AAEnD,eAAO,MAAM,kBAAkB,QAAO,OACoD,CAAC;AAE3F,eAAO,MAAM,qBAAqB,QAAO,KAAK,GAAG,QAAQ,GAAG,MAM3D,CAAC;AAEF,oFAAoF;AACpF,eAAO,MAAM,wBAAwB,QAAO,MACe,CAAC"}
+{"version":3,"file":"auth.config.d.ts","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/auth/auth.config.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,yBAAyB,sBAAsB,CAAC;AAE7D,6DAA6D;AAC7D,eAAO,MAAM,wBAAwB,qBAAqB,CAAC;AAE3D,sEAAsE;AACtE,eAAO,MAAM,sBAAsB,mBAAmB,CAAC;AAEvD,eAAO,MAAM,uBAAuB,cAAc,CAAC;AAEnD;;;GAGG;AACH,eAAO,MAAM,8BAA8B,aAAa,CAAC;AAEzD,eAAO,MAAM,kBAAkB,QAAO,OACoD,CAAC;AAE3F,eAAO,MAAM,qBAAqB,QAAO,KAAK,GAAG,QAAQ,GAAG,MAM3D,CAAC;AAEF,oFAAoF;AACpF,eAAO,MAAM,wBAAwB,QAAO,MACe,CAAC"}

package/security/src/lib/auth/auth.config.js

@@ -1,11 +1,18 @@
 "use strict";
 //#region ---- Auth configuration ----
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.AUTH_REFRESH_COOKIE_PATH = exports.AUTH_COOKIE_SAME_SITE = exports.AUTH_COOKIE_SECURE = exports.AUTH_STRATEGY_USER_PASS = exports.AUTH_COOKIE_ACCESS_TOKEN = exports.AUTH_COOKIE_REFRESH_TOKEN = void 0;
+exports.AUTH_REFRESH_COOKIE_PATH = exports.AUTH_COOKIE_SAME_SITE = exports.AUTH_COOKIE_SECURE = exports.PLATFORM_ACCESS_TOKEN_AUDIENCE = exports.AUTH_STRATEGY_USER_PASS = exports.AUTH_COOKIE_CSRF_TOKEN = exports.AUTH_COOKIE_ACCESS_TOKEN = exports.AUTH_COOKIE_REFRESH_TOKEN = void 0;
 exports.AUTH_COOKIE_REFRESH_TOKEN = 'acx_refresh_token';
 /** HttpOnly access token cookie (primary SPA credential). */
 exports.AUTH_COOKIE_ACCESS_TOKEN = 'acx_access_token';
+/** Double-submit CSRF cookie (readable by SPA for `X-CSRF-Token`). */
+exports.AUTH_COOKIE_CSRF_TOKEN = 'acx_csrf_token';
 exports.AUTH_STRATEGY_USER_PASS = 'user-pass';
+/**
+ * Fixed audience for Platform-issued access tokens (OP / application auth).
+ * Not a Resource Server selector — Entity/Business APIs are not split by `aud`.
+ */
+exports.PLATFORM_ACCESS_TOKEN_AUDIENCE = 'platform';
 const AUTH_COOKIE_SECURE = () => process.env['NODE_ENV'] === 'production' || process.env['AUTH_COOKIE_SECURE'] === 'true';
 exports.AUTH_COOKIE_SECURE = AUTH_COOKIE_SECURE;
 const AUTH_COOKIE_SAME_SITE = () => {

package/security/src/lib/auth/auth.config.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.config.js","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/auth/auth.config.ts"],"names":[],"mappings":";AAAA,sCAAsC;;;AAEzB,QAAA,yBAAyB,GAAG,mBAAmB,CAAC;AAE7D,6DAA6D;AAChD,QAAA,wBAAwB,GAAG,kBAAkB,CAAC;AAE9C,QAAA,uBAAuB,GAAG,WAAW,CAAC;AAE5C,MAAM,kBAAkB,GAAG,GAAY,EAAE,CAC9C,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,YAAY,IAAI,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,KAAK,MAAM,CAAC;AAD9E,QAAA,kBAAkB,sBAC4D;AAEpF,MAAM,qBAAqB,GAAG,GAA8B,EAAE;IACnE,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACzE,IAAI,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,MAAM,EAAE,CAAC;QAC3C,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC,CAAC;AANW,QAAA,qBAAqB,yBAMhC;AAEF,oFAAoF;AAC7E,MAAM,wBAAwB,GAAG,GAAW,EAAE,CACnD,OAAO,CAAC,GAAG,CAAC,0BAA0B,CAAC,EAAE,IAAI,EAAE,IAAI,MAAM,CAAC;AAD/C,QAAA,wBAAwB,4BACuB;AAE5D,YAAY"}
+{"version":3,"file":"auth.config.js","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/auth/auth.config.ts"],"names":[],"mappings":";AAAA,sCAAsC;;;AAEzB,QAAA,yBAAyB,GAAG,mBAAmB,CAAC;AAE7D,6DAA6D;AAChD,QAAA,wBAAwB,GAAG,kBAAkB,CAAC;AAE3D,sEAAsE;AACzD,QAAA,sBAAsB,GAAG,gBAAgB,CAAC;AAE1C,QAAA,uBAAuB,GAAG,WAAW,CAAC;AAEnD;;;GAGG;AACU,QAAA,8BAA8B,GAAG,UAAU,CAAC;AAElD,MAAM,kBAAkB,GAAG,GAAY,EAAE,CAC9C,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,YAAY,IAAI,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,KAAK,MAAM,CAAC;AAD9E,QAAA,kBAAkB,sBAC4D;AAEpF,MAAM,qBAAqB,GAAG,GAA8B,EAAE;IACnE,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACzE,IAAI,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,MAAM,EAAE,CAAC;QAC3C,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC,CAAC;AANW,QAAA,qBAAqB,yBAMhC;AAEF,oFAAoF;AAC7E,MAAM,wBAAwB,GAAG,GAAW,EAAE,CACnD,OAAO,CAAC,GAAG,CAAC,0BAA0B,CAAC,EAAE,IAAI,EAAE,IAAI,MAAM,CAAC;AAD/C,QAAA,wBAAwB,4BACuB;AAE5D,YAAY"}