@acorex-platform/framework-server 0.0.33 → 0.0.38

package/security/src/lib/auth/auth.events.d.ts

@@ -4,4 +4,26 @@ export interface AuthLogoutEventPayload {
     tenantId?: string;
     at: string;
 }
+/** Cross-session security signal (login success/failure) → realtime fan-out. */
+export declare const AUTH_SECURITY_ALERT_EVENT = "auth.security-alert";
+export type AuthSecurityAlertKind = 'login_success' | 'login_failed' | 'account_locked' | 'logout'
+/** Remote DeviceSessions terminate — force the target browser to leave after OK. */
+ | 'session_terminated';
+export interface AuthSecurityAlertEventPayload {
+    kind: AuthSecurityAlertKind;
+    userId: string;
+    at: string;
+    /** Login `sid` for this attempt (success only) — other sessions should toast. */
+    actorSessionId?: string;
+    /**
+     * JWT `sid` of the session that was revoked.
+     * For `session_terminated`, realtime delivers only to that session’s socket room.
+     */
+    targetSessionId?: string;
+    deviceSummary?: string;
+    ipAddress?: string;
+    browser?: string;
+    deviceName?: string;
+    operatingSystem?: string;
+}
 //# sourceMappingURL=auth.events.d.ts.map

package/security/src/lib/auth/auth.events.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.events.d.ts","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/auth/auth.events.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,iBAAiB,gBAAgB,CAAC;AAE/C,MAAM,WAAW,sBAAsB;IACrC,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,EAAE,EAAE,MAAM,CAAC;CACZ"}
+{"version":3,"file":"auth.events.d.ts","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/auth/auth.events.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,iBAAiB,gBAAgB,CAAC;AAE/C,MAAM,WAAW,sBAAsB;IACrC,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,EAAE,EAAE,MAAM,CAAC;CACZ;AAED,gFAAgF;AAChF,eAAO,MAAM,yBAAyB,wBAAwB,CAAC;AAE/D,MAAM,MAAM,qBAAqB,GAC7B,eAAe,GACf,cAAc,GACd,gBAAgB,GAChB,QAAQ;AACV,oFAAoF;GAClF,oBAAoB,CAAC;AAEzB,MAAM,WAAW,6BAA6B;IAC5C,IAAI,EAAE,qBAAqB,CAAC;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,EAAE,EAAE,MAAM,CAAC;IACX,iFAAiF;IACjF,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;OAGG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B"}

package/security/src/lib/auth/auth.events.js

@@ -1,7 +1,9 @@
 "use strict";
 //#region ----- Auth lifecycle events -----
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.AUTH_LOGOUT_EVENT = void 0;
+exports.AUTH_SECURITY_ALERT_EVENT = exports.AUTH_LOGOUT_EVENT = void 0;
 exports.AUTH_LOGOUT_EVENT = 'auth.logout';
+/** Cross-session security signal (login success/failure) → realtime fan-out. */
+exports.AUTH_SECURITY_ALERT_EVENT = 'auth.security-alert';
 //#endregion
 //# sourceMappingURL=auth.events.js.map

package/security/src/lib/auth/auth.events.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.events.js","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/auth/auth.events.ts"],"names":[],"mappings":";AAAA,2CAA2C;;;AAE9B,QAAA,iBAAiB,GAAG,aAAa,CAAC;AAQ/C,YAAY"}
+{"version":3,"file":"auth.events.js","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/auth/auth.events.ts"],"names":[],"mappings":";AAAA,2CAA2C;;;AAE9B,QAAA,iBAAiB,GAAG,aAAa,CAAC;AAQ/C,gFAAgF;AACnE,QAAA,yBAAyB,GAAG,qBAAqB,CAAC;AA4B/D,YAAY"}

package/security/src/lib/auth/auth.service.d.ts

@@ -1,34 +1,83 @@
+import { OnModuleDestroy } from '@nestjs/common';
 import { EntityStorageMiddlewareService } from '@acorex-platform/framework-server/core';
 import { EventEmitter2 } from '@nestjs/event-emitter';
 import { AuthLocalCredentialsService } from './auth-local-credentials.service';
 import { DeviceSessionService } from './device-session.service';
 import type { AuthRequestMeta } from './request-meta.util';
 import { TokenService } from './token.service';
-import type { AuthTokenResponseDto, RegisterRequestDto, SecurityManagementUserRecord, UpdateSessionRequestDto } from './auth.types';
+import type { AccessTokenPayload, AuthOwnDeviceSessionDto, AuthTokenResponseDto, RegisterRequestDto, SecurityManagementUserRecord, UpdateSessionRequestDto } from './auth.types';
 /** Stable client i18n mapping key — not shown raw in UI. */
 export declare const SESSION_MEMBERSHIP_DENIED_CODE = "SESSION_MEMBERSHIP_DENIED";
-export declare class AuthService {
+/** Stable client i18n mapping key — tenant max active device sessions exceeded. */
+export declare const MAX_ACTIVE_DEVICE_SESSIONS_CODE = "MAX_ACTIVE_DEVICE_SESSIONS";
+export declare class AuthService implements OnModuleDestroy {
     private readonly entityStorage;
     private readonly tokenService;
     private readonly localCredentials;
     private readonly deviceSessions;
     private readonly events?;
     private readonly logger;
+    private readonly refreshReplayRedis;
     constructor(entityStorage: EntityStorageMiddlewareService, tokenService: TokenService, localCredentials: AuthLocalCredentialsService, deviceSessions: DeviceSessionService, events?: EventEmitter2 | undefined);
-    completeSignIn(user: SecurityManagementUserRecord, meta: AuthRequestMeta): Promise<AuthTokenResponseDto>;
+    onModuleDestroy(): Promise<void>;
+    completeSignIn(user: SecurityManagementUserRecord, meta: AuthRequestMeta, options?: {
+        audience?: string;
+        persist?: boolean;
+    }): Promise<AuthTokenResponseDto>;
     assertSupportedSignInStrategy(strategy?: string): void;
     register(dto: RegisterRequestDto, meta: AuthRequestMeta): Promise<AuthTokenResponseDto>;
-    refreshSession(refreshToken: string, meta: AuthRequestMeta): Promise<AuthTokenResponseDto>;
+    refreshSession(refreshToken: string, meta: AuthRequestMeta, options?: {
+        audience?: string;
+    }): Promise<AuthTokenResponseDto>;
     logout(refreshToken?: string | null): Promise<{
         success: true;
     }>;
     updateSession(currentAccessToken: string, dto: UpdateSessionRequestDto, meta: AuthRequestMeta): Promise<AuthTokenResponseDto>;
-    verifyAccessToken(token: string): import("./auth.types").AccessTokenPayload;
+    /**
+     * Cryptographic verify only (signature / exp / type / aud).
+     * Prefer {@link validateAccessToken} for request auth (OD-09 sid/jti checks).
+     */
+    verifyAccessToken(token: string, expectedAudience?: string): AccessTokenPayload;
+    /**
+     * OD-09 access-token validation: signature → expiration → `sid` → `jti`.
+     */
+    validateAccessToken(token: string, expectedAudience?: string): Promise<AccessTokenPayload>;
     verifyRefreshToken(token: string): import("./auth.types").RefreshTokenPayload;
     accessTokenMaxAgeMs(): number;
     refreshTokenMaxAgeMs(): number;
+    revokeSessionById(sessionId: string): Promise<void>;
+    /**
+     * Projects DeviceSessions revoke (SoT) onto Redis for the JWT `sid` family.
+     * Request paths check Redis only — this stamp is required for terminate to take effect.
+     */
+    invalidateLoginSession(sessionId: string): Promise<void>;
+    /**
+     * Realtime kick for a remote DeviceSessions terminate (Active Sessions UI, etc.).
+     * Does not change Redis revoke — call after {@link invalidateLoginSession}.
+     */
+    notifyRemoteSessionTerminated(userId: string, sessionId: string): void;
+    decodeIdTokenHint(token: string): {
+        sub?: string;
+        sid?: string;
+    } | null;
     private completeAuthentication;
+    /**
+     * Tenant setting MaxActiveDeviceSessions — per user + tenant.
+     * Enforced when a real tenant is known (tenant chooser bind / auto-bind, or create with tid).
+     * Same device upsert (create) and re-bind of the current session to the same tenant are allowed.
+     */
+    private assertMaxActiveDeviceSessionsAllowed;
+    /**
+     * Active DeviceSessions for the authenticated user in a tenant (session-limit chooser).
+     */
+    listOwnActiveDeviceSessions(accessToken: string, tenantId: string): Promise<AuthOwnDeviceSessionDto[]>;
+    /**
+     * Terminate one of the caller's DeviceSessions (by entity id) during session-limit recovery.
+     */
+    terminateOwnDeviceSession(accessToken: string, deviceSessionId: string): Promise<void>;
     private emitLogoutEvent;
+    private emitSecurityAlert;
+    private securityAlertDeviceFields;
     private toAuthUser;
     private normalizeAvatar;
     /**
@@ -39,5 +88,16 @@ export declare class AuthService {
     private assertActiveMembership;
     private resolveTenantDto;
     private resolveApplicationDto;
+    private assertRefreshNotRevoked;
+    private markRefreshRevoked;
+    private markSessionRevoked;
+    /** Invalidates prior login families when the same device row is reused (per-device upsert). */
+    private revokeReplacedDeviceSessions;
+    /**
+     * OD-09 hot path: Redis projection only. DeviceSessions is SoT on write;
+     * do not query Mongo here (see device-session-revocation.mdc).
+     */
+    private assertSessionAllowed;
+    private assertAccessJtiNotRevoked;
 }
 //# sourceMappingURL=auth.service.d.ts.map

package/security/src/lib/auth/auth.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.service.d.ts","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/auth/auth.service.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,8BAA8B,EAAE,MAAM,wCAAwC,CAAC;AAcxF,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAGtD,OAAO,EAAE,2BAA2B,EAAE,MAAM,kCAAkC,CAAC;AAC/E,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAChE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,KAAK,EAGV,oBAAoB,EAEpB,kBAAkB,EAClB,4BAA4B,EAC5B,uBAAuB,EACxB,MAAM,cAAc,CAAC;AAUtB,4DAA4D;AAC5D,eAAO,MAAM,8BAA8B,8BAA8B,CAAC;AAE1E,qBACa,WAAW;IAIpB,OAAO,CAAC,QAAQ,CAAC,aAAa;IAC9B,OAAO,CAAC,QAAQ,CAAC,YAAY;IAC7B,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IACjC,OAAO,CAAC,QAAQ,CAAC,cAAc;IACnB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;IAPtC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAgC;gBAGpC,aAAa,EAAE,8BAA8B,EAC7C,YAAY,EAAE,YAAY,EAC1B,gBAAgB,EAAE,2BAA2B,EAC7C,cAAc,EAAE,oBAAoB,EACxB,MAAM,CAAC,EAAE,aAAa,YAAA;IAG/C,cAAc,CAClB,IAAI,EAAE,4BAA4B,EAClC,IAAI,EAAE,eAAe,GACpB,OAAO,CAAC,oBAAoB,CAAC;IAIhC,6BAA6B,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI;IAOhD,QAAQ,CAAC,GAAG,EAAE,kBAAkB,EAAE,IAAI,EAAE,eAAe,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAqCvF,cAAc,CAAC,YAAY,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAyB1F,MAAM,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,IAAI,CAAA;KAAE,CAAC;IAoBhE,aAAa,CACjB,kBAAkB,EAAE,MAAM,EAC1B,GAAG,EAAE,uBAAuB,EAC5B,IAAI,EAAE,eAAe,GACpB,OAAO,CAAC,oBAAoB,CAAC;IAqChC,iBAAiB,CAAC,KAAK,EAAE,MAAM;IAQ/B,kBAAkB,CAAC,KAAK,EAAE,MAAM;IAQhC,mBAAmB,IAAI,MAAM;IAI7B,oBAAoB,IAAI,MAAM;YAIhB,sBAAsB;IAuDpC,OAAO,CAAC,eAAe;IAQvB,OAAO,CAAC,UAAU;IASlB,OAAO,CAAC,eAAe;IAcvB;;;;OAIG;YACW,sBAAsB;YA+FtB,gBAAgB;YAyChB,qBAAqB;CAuCpC"}
+{"version":3,"file":"auth.service.d.ts","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/auth/auth.service.ts"],"names":[],"mappings":"AAAA,OAAO,EAKL,eAAe,EAIhB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,8BAA8B,EAAE,MAAM,wCAAwC,CAAC;AAexF,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAGtD,OAAO,EAAE,2BAA2B,EAAE,MAAM,kCAAkC,CAAC;AAE/E,OAAO,EAAE,oBAAoB,EAAkC,MAAM,0BAA0B,CAAC;AAChG,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAE3D,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAO/C,OAAO,KAAK,EACV,kBAAkB,EAElB,uBAAuB,EAEvB,oBAAoB,EAEpB,kBAAkB,EAClB,4BAA4B,EAC5B,uBAAuB,EACxB,MAAM,cAAc,CAAC;AAUtB,4DAA4D;AAC5D,eAAO,MAAM,8BAA8B,8BAA8B,CAAC;AAC1E,mFAAmF;AACnF,eAAO,MAAM,+BAA+B,+BAA+B,CAAC;AA4B5E,qBACa,WAAY,YAAW,eAAe;IAK/C,OAAO,CAAC,QAAQ,CAAC,aAAa;IAC9B,OAAO,CAAC,QAAQ,CAAC,YAAY;IAC7B,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IACjC,OAAO,CAAC,QAAQ,CAAC,cAAc;IACnB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;IARtC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAgC;IACvD,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAe;gBAG/B,aAAa,EAAE,8BAA8B,EAC7C,YAAY,EAAE,YAAY,EAC1B,gBAAgB,EAAE,2BAA2B,EAC7C,cAAc,EAAE,oBAAoB,EACxB,MAAM,CAAC,EAAE,aAAa,YAAA;IAM/C,eAAe,IAAI,OAAO,CAAC,IAAI,CAAC;IAIhC,cAAc,CAClB,IAAI,EAAE,4BAA4B,EAClC,IAAI,EAAE,eAAe,EACrB,OAAO,CAAC,EAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,OAAO,CAAA;KAAE,GACjD,OAAO,CAAC,oBAAoB,CAAC;IAOhC,6BAA6B,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI;IAOhD,QAAQ,CAAC,GAAG,EAAE,kBAAkB,EAAE,IAAI,EAAE,eAAe,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAqCvF,cAAc,CAClB,YAAY,EAAE,MAAM,EACpB,IAAI,EAAE,eAAe,EACrB,OAAO,CAAC,EAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,GAC9B,OAAO,CAAC,oBAAoB,CAAC;IAsD1B,MAAM,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,IAAI,CAAA;KAAE,CAAC;IA8BhE,aAAa,CACjB,kBAAkB,EAAE,MAAM,EAC1B,GAAG,EAAE,uBAAuB,EAC5B,IAAI,EAAE,eAAe,GACpB,OAAO,CAAC,oBAAoB,CAAC;IAqChC;;;OAGG;IACH,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,gBAAgB,CAAC,EAAE,MAAM,GAAG,kBAAkB;IAQ/E;;OAEG;IACG,mBAAmB,CACvB,KAAK,EAAE,MAAM,EACb,gBAAgB,CAAC,EAAE,MAAM,GACxB,OAAO,CAAC,kBAAkB,CAAC;IAO9B,kBAAkB,CAAC,KAAK,EAAE,MAAM;IAQhC,mBAAmB,IAAI,MAAM;IAI7B,oBAAoB,IAAI,MAAM;IAIxB,iBAAiB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAMzD;;;OAGG;IACG,sBAAsB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAI9D;;;OAGG;IACH,6BAA6B,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI;IActE,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG;QAAE,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI;YAIzD,sBAAsB;IA6EpC;;;;OAIG;YACW,oCAAoC;IAoDlD;;OAEG;IACG,2BAA2B,CAC/B,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,uBAAuB,EAAE,CAAC;IAsBrC;;OAEG;IACG,yBAAyB,CAAC,WAAW,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAiB5F,OAAO,CAAC,eAAe;IAQvB,OAAO,CAAC,iBAAiB;IAQzB,OAAO,CAAC,yBAAyB;IAcjC,OAAO,CAAC,UAAU;IASlB,OAAO,CAAC,eAAe;IAcvB;;;;OAIG;YACW,sBAAsB;YA+FtB,gBAAgB;YAyChB,qBAAqB;YAwCrB,uBAAuB;YAWvB,kBAAkB;YASlB,kBAAkB;IA0BhC,+FAA+F;YACjF,4BAA4B;IAM1C;;;OAGG;YACW,oBAAoB;YAiBpB,yBAAyB;CAWxC"}

package/security/src/lib/auth/auth.service.js

@@ -1,7 +1,7 @@
 "use strict";
 var AuthService_1;
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.AuthService = exports.SESSION_MEMBERSHIP_DENIED_CODE = void 0;
+exports.AuthService = exports.MAX_ACTIVE_DEVICE_SESSIONS_CODE = exports.SESSION_MEMBERSHIP_DENIED_CODE = void 0;
 const tslib_1 = require("tslib");
 const common_1 = require("@nestjs/common");
 const core_1 = require("@acorex-platform/framework-server/core");
@@ -9,12 +9,16 @@ const abstract_1 = require("@acorex-platform/framework-server/jql/abstract");
 const core_2 = require("@acorex-platform/framework-shared/core");
 const lodash_es_1 = require("lodash-es");
 const crypto_1 = require("crypto");
+const ioredis_1 = tslib_1.__importDefault(require("ioredis"));
 const event_emitter_1 = require("@nestjs/event-emitter");
 const auth_config_1 = require("./auth.config");
 const auth_events_1 = require("./auth.events");
 const auth_local_credentials_service_1 = require("./auth-local-credentials.service");
+const auth_max_device_sessions_policy_1 = require("./auth-max-device-sessions-policy");
 const device_session_service_1 = require("./device-session.service");
+const request_meta_util_1 = require("./request-meta.util");
 const token_service_1 = require("./token.service");
+const token_revocation_constants_1 = require("./token-revocation.constants");
 //#region ---- Auth service ----
 const USER_ENTITY = 'SecurityManagement.User';
 const TENANT_ENTITY = 'TenantManagement.Tenant';
@@ -24,6 +28,26 @@ const ALLOWED_ACCESS_STATE = 'allowed';
 const ACTIVE_MEMBERSHIP_STATUS = 'active';
 /** Stable client i18n mapping key — not shown raw in UI. */
 exports.SESSION_MEMBERSHIP_DENIED_CODE = 'SESSION_MEMBERSHIP_DENIED';
+/** Stable client i18n mapping key — tenant max active device sessions exceeded. */
+exports.MAX_ACTIVE_DEVICE_SESSIONS_CODE = 'MAX_ACTIVE_DEVICE_SESSIONS';
+function resolveRefreshReplayRedisConnection() {
+    const url = process.env['REDIS_URL']?.trim();
+    if (url) {
+        return { url };
+    }
+    const host = process.env['REDIS_HOST']?.trim();
+    const portRaw = Number(process.env['REDIS_PORT'] ?? 6379);
+    if (host) {
+        return { host, port: Number.isFinite(portRaw) ? portRaw : 6379 };
+    }
+    return null;
+}
+function createRefreshReplayRedisClient(connection) {
+    if ('url' in connection) {
+        return new ioredis_1.default(connection.url, { maxRetriesPerRequest: 2, lazyConnect: true });
+    }
+    return new ioredis_1.default({ ...connection, maxRetriesPerRequest: 2, lazyConnect: true });
+}
 let AuthService = AuthService_1 = class AuthService {
     constructor(entityStorage, tokenService, localCredentials, deviceSessions, events) {
         this.entityStorage = entityStorage;
@@ -32,9 +56,17 @@ let AuthService = AuthService_1 = class AuthService {
         this.deviceSessions = deviceSessions;
         this.events = events;
         this.logger = new common_1.Logger(AuthService_1.name);
+        const connection = resolveRefreshReplayRedisConnection();
+        this.refreshReplayRedis = connection ? createRefreshReplayRedisClient(connection) : null;
     }
-    async completeSignIn(user, meta) {
-        return this.completeAuthentication(this.toAuthUser(user), meta, {});
+    async onModuleDestroy() {
+        await this.refreshReplayRedis?.quit().catch(() => this.refreshReplayRedis?.disconnect());
+    }
+    async completeSignIn(user, meta, options) {
+        return this.completeAuthentication(this.toAuthUser(user), meta, {
+            audience: options?.audience,
+            ...(options?.persist !== undefined ? { persist: options.persist } : {}),
+        });
     }
     assertSupportedSignInStrategy(strategy) {
         const resolved = strategy ?? auth_config_1.AUTH_STRATEGY_USER_PASS;
@@ -69,13 +101,35 @@ let AuthService = AuthService_1 = class AuthService {
         });
         return this.completeAuthentication({ id, name: username, title: displayName, avatar: null }, meta, {});
     }
-    async refreshSession(refreshToken, meta) {
+    async refreshSession(refreshToken, meta, options) {
         const payload = this.verifyRefreshToken(refreshToken);
+        await this.assertRefreshNotRevoked(payload.jti);
+        // Refresh-token reuse detection:
+        // If the same refresh token `jti` is replayed, it has already been consumed once.
+        // In that case revoke the whole refresh chain (same `sid`) and reject.
+        const reuseKey = `${token_revocation_constants_1.OAUTH_REFRESH_REPLAY_KEY_PREFIX}${payload.jti}`;
+        const ttlMs = this.refreshTokenMaxAgeMs();
+        if (this.refreshReplayRedis) {
+            const firstUse = await this.refreshReplayRedis.set(reuseKey, '1', 'PX', ttlMs, 'NX');
+            if (firstUse === null) {
+                // DB SoT first, then Redis projection (middleware + explicit stamp).
+                await this.deviceSessions.revokeBySessionId(payload.sid);
+                await this.deviceSessions.revokeByAuthorizationId(payload.jti);
+                await this.markSessionRevoked(payload.sid, { required: true });
+                throw new common_1.UnauthorizedException('Refresh token reuse detected.');
+            }
+        }
         const user = await this.localCredentials.findUserById(payload.sub);
         if (!user) {
             throw new common_1.UnauthorizedException('User not found');
         }
-        await this.deviceSessions.revokeByAuthorizationId(payload.jti);
+        await this.assertSessionAllowed(payload.sid);
+        // Do NOT revoke the DeviceSessions row on refresh rotation.
+        // revokeByAuthorizationId → status:revoked projects Redis session-revoked:{sid}
+        // (device-sessions-token-revoke middleware). Tokens keep the same sid, so the next
+        // request would 401 ("logged out after refresh"). Old refresh jti is consumed via
+        // the replay key above; real terminates (logout / Active Sessions / reuse) still
+        // revoke the row + sid. update-binding below only rotates authorizationId (new jti).
         await this.assertActiveMembership(user.id, payload.tid, payload.aid);
         const [tenant, application] = await Promise.all([
             this.resolveTenantDto(payload.tid),
@@ -87,6 +141,9 @@ let AuthService = AuthService_1 = class AuthService {
             tenant,
             application,
             sessionId: payload.sid,
+            audience: options?.audience,
+            // Legacy refresh JWTs omit `persist` → keep persistent cookies (prior default).
+            persist: payload.persist !== false,
         }, 'update-binding');
     }
     async logout(refreshToken) {
@@ -95,12 +152,22 @@ let AuthService = AuthService_1 = class AuthService {
         }
         try {
             const payload = this.verifyRefreshToken(refreshToken);
+            await this.markRefreshRevoked(payload.jti);
+            // DeviceSessions SoT, then Redis sid projection.
             await this.deviceSessions.revokeByAuthorizationId(payload.jti);
+            await this.deviceSessions.revokeBySessionId(payload.sid);
+            await this.markSessionRevoked(payload.sid, { required: true });
             this.emitLogoutEvent({
                 userId: payload.sub,
                 tenantId: payload.tid,
                 at: new Date().toISOString(),
             });
+            this.emitSecurityAlert({
+                kind: 'logout',
+                userId: payload.sub,
+                at: new Date().toISOString(),
+                actorSessionId: payload.sid,
+            });
         }
         catch (error) {
             this.logger.debug(`Logout ignored invalid refresh token: ${String(error)}`);
@@ -108,7 +175,7 @@ let AuthService = AuthService_1 = class AuthService {
         return { success: true };
     }
     async updateSession(currentAccessToken, dto, meta) {
-        const current = this.verifyAccessToken(currentAccessToken);
+        const current = await this.validateAccessToken(currentAccessToken);
         const user = await this.localCredentials.findUserById(current.sub);
         if (!user) {
             throw new common_1.UnauthorizedException('User not found');
@@ -140,14 +207,27 @@ let AuthService = AuthService_1 = class AuthService {
             sessionId: current.sid,
         }, 'update-binding');
     }
-    verifyAccessToken(token) {
+    /**
+     * Cryptographic verify only (signature / exp / type / aud).
+     * Prefer {@link validateAccessToken} for request auth (OD-09 sid/jti checks).
+     */
+    verifyAccessToken(token, expectedAudience) {
         try {
-            return this.tokenService.verifyAccessToken(token);
+            return this.tokenService.verifyAccessToken(token, expectedAudience);
         }
         catch {
             throw new common_1.UnauthorizedException('Invalid or expired access token');
         }
     }
+    /**
+     * OD-09 access-token validation: signature → expiration → `sid` → `jti`.
+     */
+    async validateAccessToken(token, expectedAudience) {
+        const payload = this.verifyAccessToken(token, expectedAudience);
+        await this.assertSessionAllowed(payload.sid);
+        await this.assertAccessJtiNotRevoked(payload.jti);
+        return payload;
+    }
     verifyRefreshToken(token) {
         try {
             return this.tokenService.verifyRefreshToken(token);
@@ -162,7 +242,50 @@ let AuthService = AuthService_1 = class AuthService {
     refreshTokenMaxAgeMs() {
         return this.tokenService.refreshTokenMaxAgeMs();
     }
+    async revokeSessionById(sessionId) {
+        // DB SoT first; entity middleware projects Redis. Explicit stamp covers missing rows.
+        await this.deviceSessions.revokeBySessionId(sessionId);
+        await this.markSessionRevoked(sessionId, { required: true });
+    }
+    /**
+     * Projects DeviceSessions revoke (SoT) onto Redis for the JWT `sid` family.
+     * Request paths check Redis only — this stamp is required for terminate to take effect.
+     */
+    async invalidateLoginSession(sessionId) {
+        await this.markSessionRevoked(sessionId, { required: true });
+    }
+    /**
+     * Realtime kick for a remote DeviceSessions terminate (Active Sessions UI, etc.).
+     * Does not change Redis revoke — call after {@link invalidateLoginSession}.
+     */
+    notifyRemoteSessionTerminated(userId, sessionId) {
+        const uid = userId.trim();
+        const sid = sessionId.trim();
+        if (!uid || !sid) {
+            return;
+        }
+        this.emitSecurityAlert({
+            kind: 'session_terminated',
+            userId: uid,
+            at: new Date().toISOString(),
+            targetSessionId: sid,
+        });
+    }
+    decodeIdTokenHint(token) {
+        return this.tokenService.decodeIdTokenHint(token);
+    }
     async completeAuthentication(user, meta, context, deviceSessionMode = 'create') {
+        if (deviceSessionMode === 'create') {
+            await this.assertMaxActiveDeviceSessionsAllowed(user.id, meta, context.tenantId, {
+                mode: 'create',
+            });
+        }
+        else {
+            await this.assertMaxActiveDeviceSessionsAllowed(user.id, meta, context.tenantId, {
+                mode: 'update-binding',
+                sessionId: context.sessionId,
+            });
+        }
         const tokens = this.tokenService.issueTokenResponse(user, context);
         const refreshPayload = this.tokenService.verifyRefreshToken(tokens.refreshToken);
         const sessionId = tokens.sessionId ?? refreshPayload.sid;
@@ -174,7 +297,7 @@ let AuthService = AuthService_1 = class AuthService {
                 applicationId: context.applicationId,
             });
             if (!updated) {
-                await this.deviceSessions.createSession({
+                const created = await this.deviceSessions.createSession({
                     user,
                     authorizationId: refreshPayload.jti,
                     sessionId,
@@ -182,10 +305,11 @@ let AuthService = AuthService_1 = class AuthService {
                     tenantId: context.tenantId,
                     applicationId: context.applicationId,
                 });
+                await this.revokeReplacedDeviceSessions(created.replacedSessionIds);
             }
         }
         else {
-            await this.deviceSessions.createSession({
+            const created = await this.deviceSessions.createSession({
                 user,
                 authorizationId: refreshPayload.jti,
                 sessionId,
@@ -193,6 +317,14 @@ let AuthService = AuthService_1 = class AuthService {
                 tenantId: context.tenantId,
                 applicationId: context.applicationId,
             });
+            await this.revokeReplacedDeviceSessions(created.replacedSessionIds);
+            this.emitSecurityAlert({
+                kind: 'login_success',
+                userId: user.id,
+                at: new Date().toISOString(),
+                actorSessionId: sessionId,
+                ...this.securityAlertDeviceFields(meta),
+            });
         }
         try {
             await this.entityStorage.updateOneAsEngine(USER_ENTITY, user.id, {
@@ -204,6 +336,87 @@ let AuthService = AuthService_1 = class AuthService {
         }
         return tokens;
     }
+    /**
+     * Tenant setting MaxActiveDeviceSessions — per user + tenant.
+     * Enforced when a real tenant is known (tenant chooser bind / auto-bind, or create with tid).
+     * Same device upsert (create) and re-bind of the current session to the same tenant are allowed.
+     */
+    async assertMaxActiveDeviceSessionsAllowed(userId, meta, tenantId, options) {
+        const tid = tenantId?.trim();
+        if (!tid || (0, device_session_service_1.isUnboundDeviceSessionTenantId)(tid)) {
+            return;
+        }
+        const max = await (0, auth_max_device_sessions_policy_1.resolveAuthMaxDeviceSessions)(tid);
+        if (max <= 0) {
+            return;
+        }
+        if (options.mode === 'update-binding' && options.sessionId) {
+            const boundTenantId = await this.deviceSessions.getActiveTenantIdForSession(options.sessionId);
+            if (boundTenantId === tid) {
+                return;
+            }
+            const activeCount = await this.deviceSessions.countActiveForUserTenant(userId, tid, {
+                excludeSessionIds: [options.sessionId],
+            });
+            if (activeCount >= max) {
+                throw new common_1.ForbiddenException({
+                    code: exports.MAX_ACTIVE_DEVICE_SESSIONS_CODE,
+                    message: exports.MAX_ACTIVE_DEVICE_SESSIONS_CODE,
+                    error: exports.MAX_ACTIVE_DEVICE_SESSIONS_CODE,
+                });
+            }
+            return;
+        }
+        if (await this.deviceSessions.hasActiveDeviceForUser(userId, meta)) {
+            return;
+        }
+        const activeCount = await this.deviceSessions.countActiveForUserTenant(userId, tid);
+        if (activeCount >= max) {
+            throw new common_1.ForbiddenException({
+                code: exports.MAX_ACTIVE_DEVICE_SESSIONS_CODE,
+                message: exports.MAX_ACTIVE_DEVICE_SESSIONS_CODE,
+                error: exports.MAX_ACTIVE_DEVICE_SESSIONS_CODE,
+            });
+        }
+    }
+    /**
+     * Active DeviceSessions for the authenticated user in a tenant (session-limit chooser).
+     */
+    async listOwnActiveDeviceSessions(accessToken, tenantId) {
+        const current = await this.validateAccessToken(accessToken);
+        const tid = tenantId.trim();
+        if (!tid || (0, device_session_service_1.isUnboundDeviceSessionTenantId)(tid)) {
+            return [];
+        }
+        const rows = await this.deviceSessions.listActiveSessionsForUserTenant(current.sub, tid);
+        return rows
+            .filter((row) => row.sessionId !== current.sid)
+            .map((row) => ({
+            id: row.id,
+            sessionId: row.sessionId,
+            tenantId: row.tenantId,
+            deviceName: row.deviceName,
+            browser: row.browser,
+            operatingSystem: row.operatingSystem,
+            ipAddress: row.ipAddress,
+            lastLoginAt: row.lastLoginAt,
+        }));
+    }
+    /**
+     * Terminate one of the caller's DeviceSessions (by entity id) during session-limit recovery.
+     */
+    async terminateOwnDeviceSession(accessToken, deviceSessionId) {
+        const current = await this.validateAccessToken(accessToken);
+        const revokedSid = await this.deviceSessions.revokeOwnedSessionById(current.sub, deviceSessionId);
+        if (revokedSid == null) {
+            throw new common_1.BadRequestException('Device session not found');
+        }
+        // Engine update skips DeviceSessionsTokenRevokeMiddleware — stamp Redis here.
+        if (revokedSid !== '' && revokedSid !== current.sid) {
+            await this.markSessionRevoked(revokedSid, { required: true });
+            this.notifyRemoteSessionTerminated(current.sub, revokedSid);
+        }
+    }
     emitLogoutEvent(payload) {
         try {
             this.events?.emit(auth_events_1.AUTH_LOGOUT_EVENT, payload);
@@ -212,6 +425,24 @@ let AuthService = AuthService_1 = class AuthService {
             this.logger.debug(`Auth logout event emit failed: ${String(error)}`);
         }
     }
+    emitSecurityAlert(payload) {
+        try {
+            this.events?.emit(auth_events_1.AUTH_SECURITY_ALERT_EVENT, payload);
+        }
+        catch (error) {
+            this.logger.debug(`Auth security alert emit failed: ${String(error)}`);
+        }
+    }
+    securityAlertDeviceFields(meta) {
+        const parsed = (0, request_meta_util_1.parseUserAgent)(meta.userAgent);
+        return {
+            deviceSummary: `${parsed.deviceName} · ${parsed.browser}`,
+            ipAddress: meta.ipAddress,
+            browser: parsed.browser,
+            deviceName: parsed.deviceName,
+            operatingSystem: parsed.operatingSystem,
+        };
+    }
     toAuthUser(user) {
         return {
             id: user.id,
@@ -377,6 +608,76 @@ let AuthService = AuthService_1 = class AuthService {
             'default-name';
         return { id: applicationId, name: routeName, title };
     }
+    async assertRefreshNotRevoked(jti) {
+        if (!this.refreshReplayRedis || !jti.trim()) {
+            return;
+        }
+        const revoked = await this.refreshReplayRedis.get(`${token_revocation_constants_1.OAUTH_REFRESH_REVOKED_KEY_PREFIX}${jti}`);
+        if (revoked) {
+            throw new common_1.UnauthorizedException('Refresh token has been revoked.');
+        }
+    }
+    async markRefreshRevoked(jti) {
+        if (!this.refreshReplayRedis || !jti.trim()) {
+            return;
+        }
+        const ttlMs = this.refreshTokenMaxAgeMs();
+        await this.refreshReplayRedis.set(`${token_revocation_constants_1.OAUTH_REFRESH_REVOKED_KEY_PREFIX}${jti}`, '1', 'PX', ttlMs);
+    }
+    async markSessionRevoked(sessionId, options) {
+        const sid = sessionId?.trim();
+        if (!sid) {
+            if (options?.required) {
+                throw new common_1.BadRequestException('sessionId is required to invalidate a login session.');
+            }
+            return;
+        }
+        if (!this.refreshReplayRedis) {
+            const message = 'Session revoke store (Redis) is unavailable; cannot project DeviceSessions revoke.';
+            if (options?.required) {
+                throw new common_1.ServiceUnavailableException(message);
+            }
+            this.logger.warn(message);
+            return;
+        }
+        // Cover remaining access-token TTL after logout (refresh TTL is an upper bound).
+        const ttlMs = Math.max(this.refreshTokenMaxAgeMs(), this.accessTokenMaxAgeMs());
+        await this.refreshReplayRedis.set(`${token_revocation_constants_1.OAUTH_SESSION_REVOKED_KEY_PREFIX}${sid}`, '1', 'PX', ttlMs);
+    }
+    /** Invalidates prior login families when the same device row is reused (per-device upsert). */
+    async revokeReplacedDeviceSessions(sessionIds) {
+        for (const sid of sessionIds) {
+            await this.markSessionRevoked(sid, { required: true });
+        }
+    }
+    /**
+     * OD-09 hot path: Redis projection only. DeviceSessions is SoT on write;
+     * do not query Mongo here (see device-session-revocation.mdc).
+     */
+    async assertSessionAllowed(sessionId) {
+        const sid = sessionId?.trim();
+        if (!sid) {
+            // Legacy access tokens without `sid` — signature/exp only.
+            return;
+        }
+        if (!this.refreshReplayRedis) {
+            throw new common_1.ServiceUnavailableException('Session store (Redis) is unavailable.');
+        }
+        const revoked = await this.refreshReplayRedis.get(`${token_revocation_constants_1.OAUTH_SESSION_REVOKED_KEY_PREFIX}${sid}`);
+        if (revoked) {
+            throw new common_1.UnauthorizedException('Session has been revoked.');
+        }
+    }
+    async assertAccessJtiNotRevoked(jti) {
+        const id = jti?.trim();
+        if (!this.refreshReplayRedis || !id) {
+            return;
+        }
+        const revoked = await this.refreshReplayRedis.get(`${token_revocation_constants_1.OAUTH_ACCESS_REVOKED_KEY_PREFIX}${id}`);
+        if (revoked) {
+            throw new common_1.UnauthorizedException('Access token has been revoked.');
+        }
+    }
 };
 exports.AuthService = AuthService;
 exports.AuthService = AuthService = AuthService_1 = tslib_1.__decorate([