@acorex-platform/framework-server 0.0.33 → 0.0.38

package/security/src/lib/oauth/oauth-client-registry.service.js

@@ -0,0 +1,201 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OAuthClientRegistryService = void 0;
+const tslib_1 = require("tslib");
+const common_1 = require("@nestjs/common");
+const core_1 = require("@nestjs/core");
+const crypto_1 = require("crypto");
+const auth_identity_provider_source_1 = require("../auth/auth-identity-provider.source");
+//#region ---- OAuth client registry ----
+const DEFAULT_REGISTERED_CLIENTS = [
+    {
+        clientId: 'acorex',
+        publicClient: true,
+        redirectUris: [
+            'http://localhost:4800/auth/oauth-callback',
+            'http://127.0.0.1:4800/auth/oauth-callback',
+        ],
+        postLogoutRedirectUris: ['http://localhost:4800/', 'http://127.0.0.1:4800/'],
+        allowedScopes: ['openid', 'profile', 'email', 'offline_access'],
+        allowedGrantTypes: ['authorization_code', 'refresh_token'],
+    },
+    {
+        clientId: 'spa-client',
+        publicClient: true,
+        redirectUris: [
+            'http://localhost:4800/auth/oauth-callback',
+            'http://127.0.0.1:4800/auth/oauth-callback',
+        ],
+        postLogoutRedirectUris: ['http://localhost:4800/', 'http://127.0.0.1:4800/'],
+        allowedScopes: ['openid', 'profile', 'email', 'offline_access'],
+        allowedGrantTypes: ['authorization_code', 'refresh_token'],
+    },
+];
+function parseExtraRedirectUris() {
+    const raw = process.env['AUTH_OAUTH_EXTRA_REDIRECT_URIS']?.trim();
+    if (!raw) {
+        return [];
+    }
+    return raw
+        .split(',')
+        .map((value) => value.trim())
+        .filter(Boolean);
+}
+function parseExtraPostLogoutRedirectUris() {
+    const raw = process.env['AUTH_OAUTH_EXTRA_POST_LOGOUT_REDIRECT_URIS']?.trim();
+    if (!raw) {
+        return [];
+    }
+    return raw
+        .split(',')
+        .map((value) => value.trim())
+        .filter(Boolean);
+}
+let OAuthClientRegistryService = class OAuthClientRegistryService {
+    constructor(moduleRef) {
+        this.moduleRef = moduleRef;
+    }
+    listClients() {
+        try {
+            const clients = this.moduleRef.get(auth_identity_provider_source_1.AUTH_OAUTH_REGISTERED_CLIENTS, {
+                strict: false,
+            });
+            if (Array.isArray(clients) && clients.length > 0) {
+                return clients;
+            }
+        }
+        catch {
+            /* module not loaded */
+        }
+        return DEFAULT_REGISTERED_CLIENTS;
+    }
+    getClient(clientId) {
+        const normalized = clientId.trim();
+        if (!normalized) {
+            return null;
+        }
+        return this.listClients().find((client) => client.clientId === normalized) ?? null;
+    }
+    assertClientId(clientId) {
+        const client = this.getClient(clientId);
+        if (!client) {
+            throw new common_1.BadRequestException(`Unsupported client_id: ${clientId}`);
+        }
+        return client;
+    }
+    /** Seeded + env-extra redirect URIs for a client (OP engine + validation). */
+    resolveRedirectUris(clientId) {
+        const client = this.assertClientId(clientId);
+        return [...new Set([...client.redirectUris, ...parseExtraRedirectUris()])];
+    }
+    /** Seeded + env-extra post-logout redirect URIs for a client. */
+    resolvePostLogoutRedirectUris(clientId) {
+        const client = this.assertClientId(clientId);
+        return [...new Set([...client.postLogoutRedirectUris, ...parseExtraPostLogoutRedirectUris()])];
+    }
+    assertRedirectUri(clientId, redirectUri) {
+        const normalized = redirectUri.trim();
+        const allowed = new Set(this.resolveRedirectUris(clientId));
+        if (!allowed.has(normalized)) {
+            throw new common_1.BadRequestException('redirect_uri is not registered for this client.');
+        }
+    }
+    assertPostLogoutRedirectUri(clientId, redirectUri) {
+        const normalized = redirectUri.trim();
+        if (!normalized) {
+            throw new common_1.BadRequestException('post_logout_redirect_uri is required.');
+        }
+        if (clientId?.trim()) {
+            const allowed = new Set(this.resolvePostLogoutRedirectUris(clientId));
+            if (!allowed.has(normalized)) {
+                throw new common_1.BadRequestException('post_logout_redirect_uri is not registered for this client.');
+            }
+            return;
+        }
+        const globalAllowed = new Set([
+            ...this.listClients().flatMap((client) => client.postLogoutRedirectUris),
+            ...parseExtraPostLogoutRedirectUris(),
+        ]);
+        if (!globalAllowed.has(normalized)) {
+            throw new common_1.BadRequestException('post_logout_redirect_uri is not registered.');
+        }
+    }
+    assertGrantType(clientId, grantType) {
+        const client = this.assertClientId(clientId);
+        const normalized = grantType.trim();
+        if (!client.allowedGrantTypes.includes(normalized)) {
+            throw new common_1.BadRequestException(`Unsupported grant_type for client: ${grantType}`);
+        }
+    }
+    assertScopes(clientId, scope) {
+        if (!scope?.trim()) {
+            return;
+        }
+        const client = this.assertClientId(clientId);
+        const requested = scope
+            .trim()
+            .split(/\s+/)
+            .map((part) => part.trim())
+            .filter(Boolean);
+        for (const part of requested) {
+            if (!client.allowedScopes.includes(part)) {
+                throw new common_1.BadRequestException(`Unsupported scope for client: ${part}`);
+            }
+        }
+    }
+    /**
+     * Validates token-endpoint client authentication.
+     * Public PKCE clients skip secret validation; confidential clients require `client_secret`.
+     */
+    assertTokenEndpointClientAuth(clientId, body) {
+        const client = this.assertClientId(clientId);
+        if (client.publicClient) {
+            return client;
+        }
+        const providedSecret = this.readClientSecret(body);
+        const expectedSecret = client.clientSecret?.trim();
+        if (!expectedSecret) {
+            throw new common_1.BadRequestException('Confidential client is missing configured client_secret.');
+        }
+        if (!providedSecret || !this.secretsEqual(providedSecret, expectedSecret)) {
+            throw new common_1.UnauthorizedException('Invalid client credentials.');
+        }
+        return client;
+    }
+    readClientSecret(body) {
+        const fromBody = body['client_secret']?.trim();
+        if (fromBody) {
+            return fromBody;
+        }
+        const authHeader = body['authorization']?.trim();
+        if (authHeader?.toLowerCase().startsWith('basic ')) {
+            const encoded = authHeader.slice(6).trim();
+            try {
+                const decoded = Buffer.from(encoded, 'base64').toString('utf8');
+                const separator = decoded.indexOf(':');
+                if (separator >= 0) {
+                    return decoded.slice(separator + 1);
+                }
+            }
+            catch {
+                return undefined;
+            }
+        }
+        return undefined;
+    }
+    secretsEqual(provided, expected) {
+        const providedBuf = Buffer.from(provided);
+        const expectedBuf = Buffer.from(expected);
+        if (providedBuf.length !== expectedBuf.length) {
+            return false;
+        }
+        return (0, crypto_1.timingSafeEqual)(providedBuf, expectedBuf);
+    }
+};
+exports.OAuthClientRegistryService = OAuthClientRegistryService;
+exports.OAuthClientRegistryService = OAuthClientRegistryService = tslib_1.__decorate([
+    (0, common_1.Injectable)(),
+    tslib_1.__metadata("design:paramtypes", [core_1.ModuleRef])
+], OAuthClientRegistryService);
+//#endregion
+//# sourceMappingURL=oauth-client-registry.service.js.map

package/security/src/lib/oauth/oauth-client-registry.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-client-registry.service.js","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/oauth/oauth-client-registry.service.ts"],"names":[],"mappings":";;;;AAAA,2CAAwF;AACxF,uCAAyC;AACzC,mCAAyC;AACzC,yFAAsF;AAGtF,yCAAyC;AAEzC,MAAM,0BAA0B,GAA4B;IAC1D;QACE,QAAQ,EAAE,QAAQ;QAClB,YAAY,EAAE,IAAI;QAClB,YAAY,EAAE;YACZ,2CAA2C;YAC3C,2CAA2C;SAC5C;QACD,sBAAsB,EAAE,CAAC,wBAAwB,EAAE,wBAAwB,CAAC;QAC5E,aAAa,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,gBAAgB,CAAC;QAC/D,iBAAiB,EAAE,CAAC,oBAAoB,EAAE,eAAe,CAAC;KAC3D;IACD;QACE,QAAQ,EAAE,YAAY;QACtB,YAAY,EAAE,IAAI;QAClB,YAAY,EAAE;YACZ,2CAA2C;YAC3C,2CAA2C;SAC5C;QACD,sBAAsB,EAAE,CAAC,wBAAwB,EAAE,wBAAwB,CAAC;QAC5E,aAAa,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,gBAAgB,CAAC;QAC/D,iBAAiB,EAAE,CAAC,oBAAoB,EAAE,eAAe,CAAC;KAC3D;CACF,CAAC;AAEF,SAAS,sBAAsB;IAC7B,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,gCAAgC,CAAC,EAAE,IAAI,EAAE,CAAC;IAClE,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,OAAO,GAAG;SACP,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;SAC5B,MAAM,CAAC,OAAO,CAAC,CAAC;AACrB,CAAC;AAED,SAAS,gCAAgC;IACvC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,4CAA4C,CAAC,EAAE,IAAI,EAAE,CAAC;IAC9E,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,OAAO,GAAG;SACP,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;SAC5B,MAAM,CAAC,OAAO,CAAC,CAAC;AACrB,CAAC;AAGM,IAAM,0BAA0B,GAAhC,MAAM,0BAA0B;IACrC,YAA6B,SAAoB;QAApB,cAAS,GAAT,SAAS,CAAW;IAAG,CAAC;IAErD,WAAW;QACT,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAA0B,6DAA6B,EAAE;gBACzF,MAAM,EAAE,KAAK;aACd,CAAC,CAAC;YACH,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACjD,OAAO,OAAO,CAAC;YACjB,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,uBAAuB;QACzB,CAAC;QACD,OAAO,0BAA0B,CAAC;IACpC,CAAC;IAED,SAAS,CAAC,QAAgB;QACxB,MAAM,UAAU,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC;QACnC,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,IAAI,CAAC,WAAW,EAAE,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,KAAK,UAAU,CAAC,IAAI,IAAI,CAAC;IACrF,CAAC;IAED,cAAc,CAAC,QAAgB;QAC7B,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QACxC,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,4BAAmB,CAAC,0BAA0B,QAAQ,EAAE,CAAC,CAAC;QACtE,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,8EAA8E;IAC9E,mBAAmB,CAAC,QAAgB;QAClC,MAAM,MAAM,GAAG,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;QAC7C,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,MAAM,CAAC,YAAY,EAAE,GAAG,sBAAsB,EAAE,CAAC,CAAC,CAAC,CAAC;IAC7E,CAAC;IAED,iEAAiE;IACjE,6BAA6B,CAAC,QAAgB;QAC5C,MAAM,MAAM,GAAG,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;QAC7C,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,MAAM,CAAC,sBAAsB,EAAE,GAAG,gCAAgC,EAAE,CAAC,CAAC,CAAC,CAAC;IACjG,CAAC;IAED,iBAAiB,CAAC,QAAgB,EAAE,WAAmB;QACrD,MAAM,UAAU,GAAG,WAAW,CAAC,IAAI,EAAE,CAAC;QACtC,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,mBAAmB,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC5D,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;YAC7B,MAAM,IAAI,4BAAmB,CAAC,iDAAiD,CAAC,CAAC;QACnF,CAAC;IACH,CAAC;IAED,2BAA2B,CAAC,QAA4B,EAAE,WAAmB;QAC3E,MAAM,UAAU,GAAG,WAAW,CAAC,IAAI,EAAE,CAAC;QACtC,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,IAAI,4BAAmB,CAAC,uCAAuC,CAAC,CAAC;QACzE,CAAC;QAED,IAAI,QAAQ,EAAE,IAAI,EAAE,EAAE,CAAC;YACrB,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,6BAA6B,CAAC,QAAQ,CAAC,CAAC,CAAC;YACtE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC7B,MAAM,IAAI,4BAAmB,CAAC,6DAA6D,CAAC,CAAC;YAC/F,CAAC;YACD,OAAO;QACT,CAAC;QAED,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC;YAC5B,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,sBAAsB,CAAC;YACxE,GAAG,gCAAgC,EAAE;SACtC,CAAC,CAAC;QACH,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;YACnC,MAAM,IAAI,4BAAmB,CAAC,6CAA6C,CAAC,CAAC;QAC/E,CAAC;IACH,CAAC;IAED,eAAe,CAAC,QAAgB,EAAE,SAAiB;QACjD,MAAM,MAAM,GAAG,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;QAC7C,MAAM,UAAU,GAAG,SAAS,CAAC,IAAI,EAAwD,CAAC;QAC1F,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;YACnD,MAAM,IAAI,4BAAmB,CAAC,sCAAsC,SAAS,EAAE,CAAC,CAAC;QACnF,CAAC;IACH,CAAC;IAED,YAAY,CAAC,QAAgB,EAAE,KAAyB;QACtD,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC;YACnB,OAAO;QACT,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;QAC7C,MAAM,SAAS,GAAG,KAAK;aACpB,IAAI,EAAE;aACN,KAAK,CAAC,KAAK,CAAC;aACZ,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;aAC1B,MAAM,CAAC,OAAO,CAAC,CAAC;QAEnB,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;YAC7B,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;gBACzC,MAAM,IAAI,4BAAmB,CAAC,iCAAiC,IAAI,EAAE,CAAC,CAAC;YACzE,CAAC;QACH,CAAC;IACH,CAAC;IAED;;;OAGG;IACH,6BAA6B,CAC3B,QAAgB,EAChB,IAAwC;QAExC,MAAM,MAAM,GAAG,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;QAE7C,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;YACxB,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,MAAM,cAAc,GAAG,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;QACnD,MAAM,cAAc,GAAG,MAAM,CAAC,YAAY,EAAE,IAAI,EAAE,CAAC;QACnD,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,MAAM,IAAI,4BAAmB,CAAC,0DAA0D,CAAC,CAAC;QAC5F,CAAC;QAED,IAAI,CAAC,cAAc,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,cAAc,EAAE,cAAc,CAAC,EAAE,CAAC;YAC1E,MAAM,IAAI,8BAAqB,CAAC,6BAA6B,CAAC,CAAC;QACjE,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,gBAAgB,CAAC,IAAwC;QAC/D,MAAM,QAAQ,GAAG,IAAI,CAAC,eAAe,CAAC,EAAE,IAAI,EAAE,CAAC;QAC/C,IAAI,QAAQ,EAAE,CAAC;YACb,OAAO,QAAQ,CAAC;QAClB,CAAC;QAED,MAAM,UAAU,GAAG,IAAI,CAAC,eAAe,CAAC,EAAE,IAAI,EAAE,CAAC;QACjD,IAAI,UAAU,EAAE,WAAW,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YACnD,MAAM,OAAO,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAC3C,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;gBAChE,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;gBACvC,IAAI,SAAS,IAAI,CAAC,EAAE,CAAC;oBACnB,OAAO,OAAO,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC;gBACtC,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,SAAS,CAAC;YACnB,CAAC;QACH,CAAC;QAED,OAAO,SAAS,CAAC;IACnB,CAAC;IAEO,YAAY,CAAC,QAAgB,EAAE,QAAgB;QACrD,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC1C,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC1C,IAAI,WAAW,CAAC,MAAM,KAAK,WAAW,CAAC,MAAM,EAAE,CAAC;YAC9C,OAAO,KAAK,CAAC;QACf,CAAC;QACD,OAAO,IAAA,wBAAe,EAAC,WAAW,EAAE,WAAW,CAAC,CAAC;IACnD,CAAC;CACF,CAAA;AAjKY,gEAA0B;qCAA1B,0BAA0B;IADtC,IAAA,mBAAU,GAAE;6CAE6B,gBAAS;GADtC,0BAA0B,CAiKtC;AAED,YAAY"}

package/security/src/lib/oauth/oauth-connect.exception-filter.d.ts

@@ -0,0 +1,10 @@
+import { ArgumentsHost, ExceptionFilter } from '@nestjs/common';
+/**
+ * Converts exceptions on OAuth/OIDC connect routes into RFC 6749 error JSON
+ * `{ error, error_description }` instead of Nest's default `{ statusCode, message }`.
+ */
+export declare class OAuthConnectExceptionFilter implements ExceptionFilter {
+    private readonly logger;
+    catch(exception: unknown, host: ArgumentsHost): void;
+}
+//# sourceMappingURL=oauth-connect.exception-filter.d.ts.map

package/security/src/lib/oauth/oauth-connect.exception-filter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-connect.exception-filter.d.ts","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/oauth/oauth-connect.exception-filter.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,aAAa,EAEb,eAAe,EAIhB,MAAM,gBAAgB,CAAC;AAQxB;;;GAGG;AACH,qBACa,2BAA4B,YAAW,eAAe;IACjE,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAgD;IAEvE,KAAK,CAAC,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,aAAa,GAAG,IAAI;CAiCrD"}

package/security/src/lib/oauth/oauth-connect.exception-filter.js

@@ -0,0 +1,59 @@
+"use strict";
+//#region ---- OAuth connect exception filter ----
+var OAuthConnectExceptionFilter_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OAuthConnectExceptionFilter = void 0;
+const tslib_1 = require("tslib");
+const common_1 = require("@nestjs/common");
+const oauth_error_util_1 = require("./oauth-error.util");
+/**
+ * Converts exceptions on OAuth/OIDC connect routes into RFC 6749 error JSON
+ * `{ error, error_description }` instead of Nest's default `{ statusCode, message }`.
+ */
+let OAuthConnectExceptionFilter = OAuthConnectExceptionFilter_1 = class OAuthConnectExceptionFilter {
+    constructor() {
+        this.logger = new common_1.Logger(OAuthConnectExceptionFilter_1.name);
+    }
+    catch(exception, host) {
+        const ctx = host.switchToHttp();
+        const res = ctx.getResponse();
+        const req = ctx.getRequest();
+        if (exception instanceof oauth_error_util_1.OAuthErrorException) {
+            const status = exception.getStatus();
+            res.status(status).json(exception.getResponse());
+            return;
+        }
+        if (exception instanceof common_1.HttpException) {
+            const status = exception.getStatus();
+            const body = exception.getResponse();
+            const message = (0, oauth_error_util_1.extractExceptionMessage)(body);
+            const mapped = (0, oauth_error_util_1.mapHttpExceptionToOAuthError)(status, message, req.path);
+            this.logger.warn(`OAuth connect error ${req.method} ${req.path}: ${mapped.error} — ${mapped.error_description}` +
+                (message === 'Request failed.' ? ` raw=${safeJson(body)}` : ''));
+            res.status(mapped.status).json({
+                error: mapped.error,
+                error_description: mapped.error_description,
+            });
+            return;
+        }
+        this.logger.error(`Unhandled OAuth connect error on ${req.method} ${req.path}`, exception);
+        res.status(common_1.HttpStatus.INTERNAL_SERVER_ERROR).json({
+            error: 'server_error',
+            error_description: 'An unexpected error occurred.',
+        });
+    }
+};
+exports.OAuthConnectExceptionFilter = OAuthConnectExceptionFilter;
+exports.OAuthConnectExceptionFilter = OAuthConnectExceptionFilter = OAuthConnectExceptionFilter_1 = tslib_1.__decorate([
+    (0, common_1.Catch)()
+], OAuthConnectExceptionFilter);
+function safeJson(value) {
+    try {
+        return JSON.stringify(value);
+    }
+    catch {
+        return String(value);
+    }
+}
+//#endregion
+//# sourceMappingURL=oauth-connect.exception-filter.js.map

package/security/src/lib/oauth/oauth-connect.exception-filter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-connect.exception-filter.js","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/oauth/oauth-connect.exception-filter.ts"],"names":[],"mappings":";AAAA,kDAAkD;;;;;AAElD,2CAOwB;AAExB,yDAI4B;AAE5B;;;GAGG;AAEI,IAAM,2BAA2B,mCAAjC,MAAM,2BAA2B;IAAjC;QACY,WAAM,GAAG,IAAI,eAAM,CAAC,6BAA2B,CAAC,IAAI,CAAC,CAAC;IAmCzE,CAAC;IAjCC,KAAK,CAAC,SAAkB,EAAE,IAAmB;QAC3C,MAAM,GAAG,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;QAChC,MAAM,GAAG,GAAG,GAAG,CAAC,WAAW,EAAY,CAAC;QACxC,MAAM,GAAG,GAAG,GAAG,CAAC,UAAU,EAAW,CAAC;QAEtC,IAAI,SAAS,YAAY,sCAAmB,EAAE,CAAC;YAC7C,MAAM,MAAM,GAAG,SAAS,CAAC,SAAS,EAAE,CAAC;YACrC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE,CAAC,CAAC;YACjD,OAAO;QACT,CAAC;QAED,IAAI,SAAS,YAAY,sBAAa,EAAE,CAAC;YACvC,MAAM,MAAM,GAAG,SAAS,CAAC,SAAS,EAAE,CAAC;YACrC,MAAM,IAAI,GAAG,SAAS,CAAC,WAAW,EAAE,CAAC;YACrC,MAAM,OAAO,GAAG,IAAA,0CAAuB,EAAC,IAAI,CAAC,CAAC;YAC9C,MAAM,MAAM,GAAG,IAAA,+CAA4B,EAAC,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;YACvE,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,uBAAuB,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,IAAI,KAAK,MAAM,CAAC,KAAK,MAAM,MAAM,CAAC,iBAAiB,EAAE;gBAC5F,CAAC,OAAO,KAAK,iBAAiB,CAAC,CAAC,CAAC,QAAQ,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAClE,CAAC;YACF,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC;gBAC7B,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;aAC5C,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,oCAAoC,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,IAAI,EAAE,EAAE,SAAS,CAAC,CAAC;QAC3F,GAAG,CAAC,MAAM,CAAC,mBAAU,CAAC,qBAAqB,CAAC,CAAC,IAAI,CAAC;YAChD,KAAK,EAAE,cAAc;YACrB,iBAAiB,EAAE,+BAA+B;SACnD,CAAC,CAAC;IACL,CAAC;CACF,CAAA;AApCY,kEAA2B;sCAA3B,2BAA2B;IADvC,IAAA,cAAK,GAAE;GACK,2BAA2B,CAoCvC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC;AACH,CAAC;AAED,YAAY"}

package/security/src/lib/oauth/oauth-error.util.d.ts

@@ -0,0 +1,23 @@
+import { HttpException } from '@nestjs/common';
+/** RFC 6749 / OIDC error codes used on `/connect/*` responses. */
+export type OAuthErrorCode = 'invalid_request' | 'invalid_client' | 'invalid_grant' | 'invalid_token' | 'unauthorized_client' | 'unsupported_grant_type' | 'invalid_scope' | 'access_denied' | 'server_error' | 'temporarily_unavailable';
+export declare class OAuthErrorException extends HttpException {
+    readonly oauthError: OAuthErrorCode;
+    constructor(oauthError: OAuthErrorCode, description: string, statusCode?: number);
+}
+export declare function oauthInvalidRequest(description: string): OAuthErrorException;
+export declare function oauthInvalidGrant(description: string): OAuthErrorException;
+export declare function oauthInvalidClient(description: string): OAuthErrorException;
+/** OIDC UserInfo / bearer access-token failures (RFC 6750). */
+export declare function oauthInvalidToken(description: string): OAuthErrorException;
+export declare function oauthUnsupportedGrantType(description: string): OAuthErrorException;
+export declare function oauthAccessDenied(description: string): OAuthErrorException;
+export declare function oauthServerError(description: string): OAuthErrorException;
+/** Map Nest HTTP exceptions thrown by OAuth code to RFC 6749 / RFC 6750 error codes. */
+export declare function mapHttpExceptionToOAuthError(status: number, message: string, path: string): {
+    error: OAuthErrorCode;
+    error_description: string;
+    status: number;
+};
+export declare function extractExceptionMessage(response: string | object): string;
+//# sourceMappingURL=oauth-error.util.d.ts.map

package/security/src/lib/oauth/oauth-error.util.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-error.util.d.ts","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/oauth/oauth-error.util.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAE/C,kEAAkE;AAClE,MAAM,MAAM,cAAc,GACtB,iBAAiB,GACjB,gBAAgB,GAChB,eAAe,GACf,eAAe,GACf,qBAAqB,GACrB,wBAAwB,GACxB,eAAe,GACf,eAAe,GACf,cAAc,GACd,yBAAyB,CAAC;AAE9B,qBAAa,mBAAoB,SAAQ,aAAa;aAElC,UAAU,EAAE,cAAc;gBAA1B,UAAU,EAAE,cAAc,EAC1C,WAAW,EAAE,MAAM,EACnB,UAAU,SAAM;CAUnB;AAED,wBAAgB,mBAAmB,CAAC,WAAW,EAAE,MAAM,GAAG,mBAAmB,CAE5E;AAED,wBAAgB,iBAAiB,CAAC,WAAW,EAAE,MAAM,GAAG,mBAAmB,CAE1E;AAED,wBAAgB,kBAAkB,CAAC,WAAW,EAAE,MAAM,GAAG,mBAAmB,CAE3E;AAED,+DAA+D;AAC/D,wBAAgB,iBAAiB,CAAC,WAAW,EAAE,MAAM,GAAG,mBAAmB,CAE1E;AAED,wBAAgB,yBAAyB,CAAC,WAAW,EAAE,MAAM,GAAG,mBAAmB,CAElF;AAED,wBAAgB,iBAAiB,CAAC,WAAW,EAAE,MAAM,GAAG,mBAAmB,CAE1E;AAED,wBAAgB,gBAAgB,CAAC,WAAW,EAAE,MAAM,GAAG,mBAAmB,CAEzE;AAED,wFAAwF;AACxF,wBAAgB,4BAA4B,CAC1C,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,MAAM,GACX;IAAE,KAAK,EAAE,cAAc,CAAC;IAAC,iBAAiB,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAyCtE;AAED,wBAAgB,uBAAuB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,CAmCzE"}

package/security/src/lib/oauth/oauth-error.util.js

@@ -0,0 +1,114 @@
+"use strict";
+//#region ---- OAuth error helpers ----
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OAuthErrorException = void 0;
+exports.oauthInvalidRequest = oauthInvalidRequest;
+exports.oauthInvalidGrant = oauthInvalidGrant;
+exports.oauthInvalidClient = oauthInvalidClient;
+exports.oauthInvalidToken = oauthInvalidToken;
+exports.oauthUnsupportedGrantType = oauthUnsupportedGrantType;
+exports.oauthAccessDenied = oauthAccessDenied;
+exports.oauthServerError = oauthServerError;
+exports.mapHttpExceptionToOAuthError = mapHttpExceptionToOAuthError;
+exports.extractExceptionMessage = extractExceptionMessage;
+const common_1 = require("@nestjs/common");
+class OAuthErrorException extends common_1.HttpException {
+    constructor(oauthError, description, statusCode = 400) {
+        super({
+            error: oauthError,
+            error_description: description,
+        }, statusCode);
+        this.oauthError = oauthError;
+    }
+}
+exports.OAuthErrorException = OAuthErrorException;
+function oauthInvalidRequest(description) {
+    return new OAuthErrorException('invalid_request', description, 400);
+}
+function oauthInvalidGrant(description) {
+    return new OAuthErrorException('invalid_grant', description, 400);
+}
+function oauthInvalidClient(description) {
+    return new OAuthErrorException('invalid_client', description, 401);
+}
+/** OIDC UserInfo / bearer access-token failures (RFC 6750). */
+function oauthInvalidToken(description) {
+    return new OAuthErrorException('invalid_token', description, 401);
+}
+function oauthUnsupportedGrantType(description) {
+    return new OAuthErrorException('unsupported_grant_type', description, 400);
+}
+function oauthAccessDenied(description) {
+    return new OAuthErrorException('access_denied', description, 403);
+}
+function oauthServerError(description) {
+    return new OAuthErrorException('server_error', description, 500);
+}
+/** Map Nest HTTP exceptions thrown by OAuth code to RFC 6749 / RFC 6750 error codes. */
+function mapHttpExceptionToOAuthError(status, message, path) {
+    const onTokenEndpoint = path.includes('/connect/token');
+    const onUserInfo = path.includes('/connect/userinfo');
+    if (status === 401) {
+        if (onUserInfo) {
+            return { error: 'invalid_token', error_description: message, status: 401 };
+        }
+        if (onTokenEndpoint && /client|client_id|credentials/i.test(message)) {
+            return { error: 'invalid_client', error_description: message, status: 401 };
+        }
+        if (/invalid.?token|bearer access token|access token is required/i.test(message)) {
+            return { error: 'invalid_token', error_description: message, status: 401 };
+        }
+        return { error: 'invalid_grant', error_description: message, status: 400 };
+    }
+    if (status === 403) {
+        if (/csrf/i.test(message)) {
+            return { error: 'access_denied', error_description: message, status: 403 };
+        }
+        return { error: 'access_denied', error_description: message, status: 403 };
+    }
+    if (status === 503) {
+        return { error: 'temporarily_unavailable', error_description: message, status: 503 };
+    }
+    if (status >= 500) {
+        return { error: 'server_error', error_description: message, status: 500 };
+    }
+    if (/unsupported grant/i.test(message)) {
+        return { error: 'unsupported_grant_type', error_description: message, status: 400 };
+    }
+    if (/scope/i.test(message)) {
+        return { error: 'invalid_scope', error_description: message, status: 400 };
+    }
+    return { error: 'invalid_request', error_description: message, status: status >= 400 ? status : 400 };
+}
+function extractExceptionMessage(response) {
+    if (typeof response === 'string') {
+        return response;
+    }
+    if (Array.isArray(response.message)) {
+        return response.message.join('; ');
+    }
+    if (typeof response.message === 'string') {
+        return response.message;
+    }
+    if (typeof response.error_description === 'string') {
+        return response.error_description;
+    }
+    // Entity middleware abort: `{ success: false, error: { message, code, ... } }`
+    const nestedError = response.error;
+    if (nestedError != null && typeof nestedError === 'object') {
+        const nestedMessage = nestedError.message;
+        if (typeof nestedMessage === 'string' && nestedMessage.trim()) {
+            return nestedMessage;
+        }
+        const nestedCode = nestedError.code;
+        if (typeof nestedCode === 'string' && nestedCode.trim()) {
+            return nestedCode;
+        }
+    }
+    if (typeof nestedError === 'string' && nestedError.trim()) {
+        return nestedError;
+    }
+    return 'Request failed.';
+}
+//#endregion
+//# sourceMappingURL=oauth-error.util.js.map

package/security/src/lib/oauth/oauth-error.util.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-error.util.js","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/oauth/oauth-error.util.ts"],"names":[],"mappings":";AAAA,uCAAuC;;;AAiCvC,kDAEC;AAED,8CAEC;AAED,gDAEC;AAGD,8CAEC;AAED,8DAEC;AAED,8CAEC;AAED,4CAEC;AAGD,oEA6CC;AAED,0DAmCC;AA/ID,2CAA+C;AAe/C,MAAa,mBAAoB,SAAQ,sBAAa;IACpD,YACkB,UAA0B,EAC1C,WAAmB,EACnB,UAAU,GAAG,GAAG;QAEhB,KAAK,CACH;YACE,KAAK,EAAE,UAAU;YACjB,iBAAiB,EAAE,WAAW;SAC/B,EACD,UAAU,CACX,CAAC;QAVc,eAAU,GAAV,UAAU,CAAgB;IAW5C,CAAC;CACF;AAdD,kDAcC;AAED,SAAgB,mBAAmB,CAAC,WAAmB;IACrD,OAAO,IAAI,mBAAmB,CAAC,iBAAiB,EAAE,WAAW,EAAE,GAAG,CAAC,CAAC;AACtE,CAAC;AAED,SAAgB,iBAAiB,CAAC,WAAmB;IACnD,OAAO,IAAI,mBAAmB,CAAC,eAAe,EAAE,WAAW,EAAE,GAAG,CAAC,CAAC;AACpE,CAAC;AAED,SAAgB,kBAAkB,CAAC,WAAmB;IACpD,OAAO,IAAI,mBAAmB,CAAC,gBAAgB,EAAE,WAAW,EAAE,GAAG,CAAC,CAAC;AACrE,CAAC;AAED,+DAA+D;AAC/D,SAAgB,iBAAiB,CAAC,WAAmB;IACnD,OAAO,IAAI,mBAAmB,CAAC,eAAe,EAAE,WAAW,EAAE,GAAG,CAAC,CAAC;AACpE,CAAC;AAED,SAAgB,yBAAyB,CAAC,WAAmB;IAC3D,OAAO,IAAI,mBAAmB,CAAC,wBAAwB,EAAE,WAAW,EAAE,GAAG,CAAC,CAAC;AAC7E,CAAC;AAED,SAAgB,iBAAiB,CAAC,WAAmB;IACnD,OAAO,IAAI,mBAAmB,CAAC,eAAe,EAAE,WAAW,EAAE,GAAG,CAAC,CAAC;AACpE,CAAC;AAED,SAAgB,gBAAgB,CAAC,WAAmB;IAClD,OAAO,IAAI,mBAAmB,CAAC,cAAc,EAAE,WAAW,EAAE,GAAG,CAAC,CAAC;AACnE,CAAC;AAED,wFAAwF;AACxF,SAAgB,4BAA4B,CAC1C,MAAc,EACd,OAAe,EACf,IAAY;IAEZ,MAAM,eAAe,GAAG,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC;IACxD,MAAM,UAAU,GAAG,IAAI,CAAC,QAAQ,CAAC,mBAAmB,CAAC,CAAC;IAEtD,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;QACnB,IAAI,UAAU,EAAE,CAAC;YACf,OAAO,EAAE,KAAK,EAAE,eAAe,EAAE,iBAAiB,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;QAC7E,CAAC;QACD,IAAI,eAAe,IAAI,+BAA+B,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YACrE,OAAO,EAAE,KAAK,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;QAC9E,CAAC;QACD,IAAI,8DAA8D,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YACjF,OAAO,EAAE,KAAK,EAAE,eAAe,EAAE,iBAAiB,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;QAC7E,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,eAAe,EAAE,iBAAiB,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;IAC7E,CAAC;IAED,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;QACnB,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAC1B,OAAO,EAAE,KAAK,EAAE,eAAe,EAAE,iBAAiB,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;QAC7E,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,eAAe,EAAE,iBAAiB,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;IAC7E,CAAC;IAED,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;QACnB,OAAO,EAAE,KAAK,EAAE,yBAAyB,EAAE,iBAAiB,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;IACvF,CAAC;IAED,IAAI,MAAM,IAAI,GAAG,EAAE,CAAC;QAClB,OAAO,EAAE,KAAK,EAAE,cAAc,EAAE,iBAAiB,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;IAC5E,CAAC;IAED,IAAI,oBAAoB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACvC,OAAO,EAAE,KAAK,EAAE,wBAAwB,EAAE,iBAAiB,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;IACtF,CAAC;IAED,IAAI,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3B,OAAO,EAAE,KAAK,EAAE,eAAe,EAAE,iBAAiB,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;IAC7E,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;AACxG,CAAC;AAED,SAAgB,uBAAuB,CAAC,QAAyB;IAC/D,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACjC,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,IAAI,KAAK,CAAC,OAAO,CAAE,QAAkC,CAAC,OAAO,CAAC,EAAE,CAAC;QAC/D,OAAQ,QAAkC,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAChE,CAAC;IAED,IAAI,OAAQ,QAAkC,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;QACpE,OAAQ,QAAgC,CAAC,OAAO,CAAC;IACnD,CAAC;IAED,IAAI,OAAQ,QAA4C,CAAC,iBAAiB,KAAK,QAAQ,EAAE,CAAC;QACxF,OAAQ,QAA0C,CAAC,iBAAiB,CAAC;IACvE,CAAC;IAED,+EAA+E;IAC/E,MAAM,WAAW,GAAI,QAAgC,CAAC,KAAK,CAAC;IAC5D,IAAI,WAAW,IAAI,IAAI,IAAI,OAAO,WAAW,KAAK,QAAQ,EAAE,CAAC;QAC3D,MAAM,aAAa,GAAI,WAAqC,CAAC,OAAO,CAAC;QACrE,IAAI,OAAO,aAAa,KAAK,QAAQ,IAAI,aAAa,CAAC,IAAI,EAAE,EAAE,CAAC;YAC9D,OAAO,aAAa,CAAC;QACvB,CAAC;QACD,MAAM,UAAU,GAAI,WAAkC,CAAC,IAAI,CAAC;QAC5D,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC;YACxD,OAAO,UAAU,CAAC;QACpB,CAAC;IACH,CAAC;IAED,IAAI,OAAO,WAAW,KAAK,QAAQ,IAAI,WAAW,CAAC,IAAI,EAAE,EAAE,CAAC;QAC1D,OAAO,WAAW,CAAC;IACrB,CAAC;IAED,OAAO,iBAAiB,CAAC;AAC3B,CAAC;AAED,YAAY"}

package/security/src/lib/oauth/oauth-grant-store.interface.d.ts

@@ -0,0 +1,16 @@
+import type { OAuthCodeRecord, OAuthExternalStateRecord } from './oauth-op.types';
+/**
+ * Shared contract for storing OAuth/OIDC authorization codes and external redirect state.
+ *
+ * Final implementation must be multi-instance safe (no process-memory-only).
+ */
+export declare abstract class OAuthGrantStore {
+    abstract saveCode(code: string, record: OAuthCodeRecord, ttlMs: number): Promise<void>;
+    abstract consumeCode(code: string): Promise<OAuthCodeRecord | null>;
+    abstract saveState(state: string, record: OAuthExternalStateRecord, ttlMs: number): Promise<void>;
+    abstract consumeState(state: string): Promise<OAuthExternalStateRecord | null>;
+    /** BFF server-side PKCE verifier keyed by `code_challenge` until authorize consumes it. */
+    abstract savePkceVerifier(codeChallenge: string, codeVerifier: string, ttlMs: number): Promise<void>;
+    abstract consumePkceVerifier(codeChallenge: string): Promise<string | null>;
+}
+//# sourceMappingURL=oauth-grant-store.interface.d.ts.map

package/security/src/lib/oauth/oauth-grant-store.interface.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-grant-store.interface.d.ts","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/oauth/oauth-grant-store.interface.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,eAAe,EAAE,wBAAwB,EAAE,MAAM,kBAAkB,CAAC;AAElF;;;;GAIG;AACH,8BAAsB,eAAe;IACnC,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,eAAe,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IACtF,QAAQ,CAAC,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC;IAEnE,QAAQ,CAAC,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,wBAAwB,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IACjG,QAAQ,CAAC,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,wBAAwB,GAAG,IAAI,CAAC;IAE9E,2FAA2F;IAC3F,QAAQ,CAAC,gBAAgB,CAAC,aAAa,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IACpG,QAAQ,CAAC,mBAAmB,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;CAC5E"}

package/security/src/lib/oauth/oauth-grant-store.interface.js

@@ -0,0 +1,14 @@
+"use strict";
+//#region ---- OAuth grant store ----
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OAuthGrantStore = void 0;
+/**
+ * Shared contract for storing OAuth/OIDC authorization codes and external redirect state.
+ *
+ * Final implementation must be multi-instance safe (no process-memory-only).
+ */
+class OAuthGrantStore {
+}
+exports.OAuthGrantStore = OAuthGrantStore;
+//#endregion
+//# sourceMappingURL=oauth-grant-store.interface.js.map

package/security/src/lib/oauth/oauth-grant-store.interface.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-grant-store.interface.js","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/oauth/oauth-grant-store.interface.ts"],"names":[],"mappings":";AAAA,qCAAqC;;;AAIrC;;;;GAIG;AACH,MAAsB,eAAe;CAUpC;AAVD,0CAUC;AAED,YAAY"}

package/security/src/lib/oauth/oauth-issuer.util.d.ts

@@ -0,0 +1,7 @@
+import type { Request } from 'express';
+/**
+ * Resolves the platform OAuth issuer URL.
+ * Prefer `AUTH_OAUTH_ISSUER` so discovery, ID Token `iss`, and authorize stay consistent.
+ */
+export declare function resolveOAuthIssuer(req?: Request): string;
+//# sourceMappingURL=oauth-issuer.util.d.ts.map

package/security/src/lib/oauth/oauth-issuer.util.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-issuer.util.d.ts","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/oauth/oauth-issuer.util.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAEvC;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,CAAC,EAAE,OAAO,GAAG,MAAM,CAgBxD"}

package/security/src/lib/oauth/oauth-issuer.util.js

@@ -0,0 +1,25 @@
+"use strict";
+//#region ---- OAuth issuer resolution ----
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolveOAuthIssuer = resolveOAuthIssuer;
+/**
+ * Resolves the platform OAuth issuer URL.
+ * Prefer `AUTH_OAUTH_ISSUER` so discovery, ID Token `iss`, and authorize stay consistent.
+ */
+function resolveOAuthIssuer(req) {
+    const configured = process.env['AUTH_OAUTH_ISSUER']?.trim()?.replace(/\/$/, '');
+    if (configured) {
+        return configured;
+    }
+    if (req) {
+        const forwardedProto = req.headers['x-forwarded-proto'];
+        const protoHeader = Array.isArray(forwardedProto) ? forwardedProto[0] : forwardedProto;
+        const proto = (protoHeader?.split(',')[0] || req.protocol || 'http').trim();
+        const host = (req.get('host') || 'localhost:5500').trim();
+        return `${proto}://${host}/api`;
+    }
+    const port = process.env['PORT']?.trim() || '5500';
+    return `http://localhost:${port}/api`;
+}
+//#endregion
+//# sourceMappingURL=oauth-issuer.util.js.map

package/security/src/lib/oauth/oauth-issuer.util.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-issuer.util.js","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/oauth/oauth-issuer.util.ts"],"names":[],"mappings":";AAAA,2CAA2C;;AAQ3C,gDAgBC;AApBD;;;GAGG;AACH,SAAgB,kBAAkB,CAAC,GAAa;IAC9C,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,EAAE,IAAI,EAAE,EAAE,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAChF,IAAI,UAAU,EAAE,CAAC;QACf,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,IAAI,GAAG,EAAE,CAAC;QACR,MAAM,cAAc,GAAG,GAAG,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC;QACxD,MAAM,WAAW,GAAG,KAAK,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC;QACvF,MAAM,KAAK,GAAG,CAAC,WAAW,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,QAAQ,IAAI,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QAC5E,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,gBAAgB,CAAC,CAAC,IAAI,EAAE,CAAC;QAC1D,OAAO,GAAG,KAAK,MAAM,IAAI,MAAM,CAAC;IAClC,CAAC;IAED,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,MAAM,CAAC;IACnD,OAAO,oBAAoB,IAAI,MAAM,CAAC;AACxC,CAAC;AAED,YAAY"}

package/security/src/lib/oauth/oauth-op.service.d.ts

@@ -0,0 +1,35 @@
+import { ModuleRef } from '@nestjs/core';
+import { OAuthClientRegistryService } from './oauth-client-registry.service';
+import { OAuthRpService } from './oauth-rp.service';
+import { OAuthGrantStore } from './oauth-grant-store.interface';
+import type { OAuthCodeRecord, OAuthExternalStateRecord } from './oauth-op.types';
+import type { PlatformOAuthAuthorizeRequest } from './platform-oauth.types';
+export declare class OAuthOpService {
+    private readonly grants;
+    private readonly rp;
+    private readonly clients;
+    private readonly moduleRef;
+    private readonly authorizationCodeTtlMs;
+    constructor(grants: OAuthGrantStore, rp: OAuthRpService, clients: OAuthClientRegistryService, moduleRef: ModuleRef);
+    beginAuthorization(request: PlatformOAuthAuthorizeRequest): Promise<{
+        externalState: string;
+        externalUrl: string;
+    }>;
+    issueCode(input: Omit<OAuthCodeRecord, 'expiresAt'> & {
+        expiresAt?: number;
+    }): Promise<string>;
+    consumeCode(input: {
+        code: string;
+        clientId: string;
+        redirectUri: string;
+        codeVerifier?: string;
+    }): Promise<OAuthCodeRecord>;
+    saveExternalState(state: string, record: OAuthExternalStateRecord): Promise<void>;
+    consumeExternalState(state: string): Promise<OAuthExternalStateRecord>;
+    stagePkceVerifier(codeChallenge: string, codeVerifier: string): Promise<void>;
+    private requireBrokerConfig;
+    private resolveIdentityProviderCatalog;
+    private assertSupportedAuthorizeRequest;
+    private verifyPkce;
+}
+//# sourceMappingURL=oauth-op.service.d.ts.map

package/security/src/lib/oauth/oauth-op.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-op.service.d.ts","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/oauth/oauth-op.service.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAOzC,OAAO,EAAE,0BAA0B,EAAE,MAAM,iCAAiC,CAAC;AAC7E,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACpD,OAAO,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAChE,OAAO,KAAK,EAAE,eAAe,EAAE,wBAAwB,EAAE,MAAM,kBAAkB,CAAC;AAGlF,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,wBAAwB,CAAC;AAQ5E,qBACa,cAAc;IAIvB,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,EAAE;IACnB,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,SAAS;IAN5B,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAA8B;gBAGlD,MAAM,EAAE,eAAe,EACvB,EAAE,EAAE,cAAc,EAClB,OAAO,EAAE,0BAA0B,EACnC,SAAS,EAAE,SAAS;IAGjC,kBAAkB,CACtB,OAAO,EAAE,6BAA6B,GACrC,OAAO,CAAC;QAAE,aAAa,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC;IAmCpD,SAAS,CACb,KAAK,EAAE,IAAI,CACT,eAAe,EACf,WAAW,CACZ,GAAG;QACF,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB,GACA,OAAO,CAAC,MAAM,CAAC;IAgBZ,WAAW,CAAC,KAAK,EAAE;QACvB,IAAI,EAAE,MAAM,CAAC;QACb,QAAQ,EAAE,MAAM,CAAC;QACjB,WAAW,EAAE,MAAM,CAAC;QACpB,YAAY,CAAC,EAAE,MAAM,CAAC;KACvB,GAAG,OAAO,CAAC,eAAe,CAAC;IAwBtB,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,wBAAwB,GAAG,OAAO,CAAC,IAAI,CAAC;IAKjF,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,wBAAwB,CAAC;IAQtE,iBAAiB,CAAC,aAAa,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;YAIrE,mBAAmB;IAgBjC,OAAO,CAAC,8BAA8B;IAQtC,OAAO,CAAC,+BAA+B;IAsBvC,OAAO,CAAC,UAAU;CAYnB"}