@acorex-platform/module-auth-server 0.0.15 → 2.0.0-next.42

package/server/src/lib/auth-server.module.js

@@ -0,0 +1,53 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AuthServerModule = void 0;
+const tslib_1 = require("tslib");
+const common_1 = require("@nestjs/common");
+const core_1 = require("@nestjs/core");
+const core_2 = require("@acorex-platform/framework-server/core");
+const module_settings_management_contracts_1 = require("@acorex-platform/module-settings-management-client/contracts");
+const module_settings_management_server_1 = require("@acorex-platform/module-settings-management-server");
+const module_auth_contracts_1 = require("@acorex-platform/module-auth-client/contracts");
+const auth_lockout_settings_service_1 = require("./auth-lockout-settings.service");
+const auth_max_device_sessions_settings_service_1 = require("./auth-max-device-sessions-settings.service");
+const auth_device_session_activity_interceptor_1 = require("./inactive-session/auth-device-session-activity.interceptor");
+const auth_inactive_session_termination_purge_command_1 = require("./inactive-session/auth-inactive-session-termination-purge.command");
+const auth_inactive_session_termination_settings_service_1 = require("./inactive-session/auth-inactive-session-termination-settings.service");
+const auth_inactive_session_termination_service_1 = require("./inactive-session/auth-inactive-session-termination.service");
+const list_connected_captcha_providers_query_1 = require("./queries/list-connected-captcha-providers.query");
+//#region ----- Auth server module -----
+let AuthServerModule = class AuthServerModule {
+};
+exports.AuthServerModule = AuthServerModule;
+exports.AuthServerModule = AuthServerModule = tslib_1.__decorate([
+    (0, common_1.Module)({
+        imports: [module_settings_management_server_1.SettingsManagementServerModule, core_2.EntityStorageModule],
+        providers: [
+            auth_lockout_settings_service_1.AuthLockoutSettingsService,
+            auth_max_device_sessions_settings_service_1.AuthMaxDeviceSessionsSettingsService,
+            auth_inactive_session_termination_settings_service_1.AuthInactiveSessionTerminationSettingsService,
+            auth_inactive_session_termination_service_1.AuthInactiveSessionTerminationService,
+            auth_inactive_session_termination_purge_command_1.AuthInactiveSessionTerminationPurgeCommand,
+            auth_device_session_activity_interceptor_1.AuthDeviceSessionActivityInterceptor,
+            list_connected_captcha_providers_query_1.AuthListConnectedCaptchaProvidersQuery,
+            {
+                provide: core_1.APP_INTERCEPTOR,
+                useExisting: auth_device_session_activity_interceptor_1.AuthDeviceSessionActivityInterceptor,
+            },
+            (0, module_settings_management_contracts_1.provideSettingsDefaults)((0, module_settings_management_contracts_1.createStaticSettingsDefaultsProvider)({
+                scope: 'P',
+                layer: 'auth',
+                priority: module_settings_management_contracts_1.SETTINGS_DEFAULTS_PRIORITY.module,
+                values: Object.assign(Object.assign({}, module_auth_contracts_1.AXP_AUTH_LOCKOUT_SETTING_DEFAULTS), { [module_auth_contracts_1.AXPAuthSettings.SignInPageSlogan]: module_auth_contracts_1.AXP_AUTH_SIGN_IN_PAGE_SLOGAN_DEFAULT, [module_auth_contracts_1.AXPAuthSettings.SignInPageDescription]: module_auth_contracts_1.AXP_AUTH_SIGN_IN_PAGE_DESCRIPTION_DEFAULT }),
+            })),
+            (0, module_settings_management_contracts_1.provideSettingsDefaults)((0, module_settings_management_contracts_1.createStaticSettingsDefaultsProvider)({
+                scope: 'T',
+                layer: 'auth-session',
+                priority: module_settings_management_contracts_1.SETTINGS_DEFAULTS_PRIORITY.module,
+                values: Object.assign(Object.assign({}, module_auth_contracts_1.AXP_AUTH_MAX_ACTIVE_DEVICE_SESSIONS_SETTING_DEFAULTS), module_auth_contracts_1.AXP_AUTH_INACTIVE_SESSION_TERMINATION_SETTING_DEFAULTS),
+            })),
+        ],
+    })
+], AuthServerModule);
+//#endregion
+//# sourceMappingURL=auth-server.module.js.map

package/server/src/lib/auth-server.module.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-server.module.js","sourceRoot":"","sources":["../../../../../../libs/modules/auth/server/src/lib/auth-server.module.ts"],"names":[],"mappings":";;;;AAAA,2CAAwC;AACxC,uCAA+C;AAC/C,iEAA6E;AAC7E,gHAI+D;AAC/D,0GAAoG;AACpG,kFAOgD;AAChD,mFAA6E;AAC7E,2GAAmG;AACnG,0HAAmH;AACnH,wIAAgI;AAChI,8IAAsI;AACtI,4HAAqH;AACrH,6GAA0G;AAE1G,wCAAwC;AAyCjC,IAAM,gBAAgB,GAAtB,MAAM,gBAAgB;CAAG,CAAA;AAAnB,4CAAgB;2BAAhB,gBAAgB;IAvC5B,IAAA,eAAM,EAAC;QACN,OAAO,EAAE,CAAC,kEAA8B,EAAE,0BAAmB,CAAC;QAC9D,SAAS,EAAE;YACT,0DAA0B;YAC1B,gFAAoC;YACpC,kGAA6C;YAC7C,iFAAqC;YACrC,4FAA0C;YAC1C,+EAAoC;YACpC,+EAAsC;YACtC;gBACE,OAAO,EAAE,sBAAe;gBACxB,WAAW,EAAE,+EAAoC;aAClD;YACD,IAAA,8DAAuB,EACrB,IAAA,2EAAoC,EAAC;gBACnC,KAAK,EAAE,GAAG;gBACV,KAAK,EAAE,MAAM;gBACb,QAAQ,EAAE,iEAA0B,CAAC,MAAM;gBAC3C,MAAM,kCACD,yDAAiC,KACpC,CAAC,uCAAe,CAAC,gBAAgB,CAAC,EAAE,4DAAoC,EACxE,CAAC,uCAAe,CAAC,qBAAqB,CAAC,EAAE,iEAAyC,GACnF;aACF,CAAC,CACH;YACD,IAAA,8DAAuB,EACrB,IAAA,2EAAoC,EAAC;gBACnC,KAAK,EAAE,GAAG;gBACV,KAAK,EAAE,cAAc;gBACrB,QAAQ,EAAE,iEAA0B,CAAC,MAAM;gBAC3C,MAAM,kCACD,4EAAoD,GACpD,8EAAsD,CAC1D;aACF,CAAC,CACH;SACF;KACF,CAAC;GACW,gBAAgB,CAAG;AAEhC,YAAY"}

package/server/src/lib/inactive-session/auth-device-session-activity.interceptor.d.ts

@@ -0,0 +1,14 @@
+import { CallHandler, ExecutionContext, NestInterceptor } from '@nestjs/common';
+import { EntityStorageMiddlewareService } from '@acorex-platform/framework-server/core';
+import type { Observable } from 'rxjs';
+/**
+ * Refreshes DeviceSessions.lastLoginDate while the user is making authenticated API calls
+ * so InactiveSessionTermination measures real inactivity (not only original login time).
+ */
+export declare class AuthDeviceSessionActivityInterceptor implements NestInterceptor {
+    private readonly storage;
+    private readonly lastTouchBySid;
+    constructor(storage: EntityStorageMiddlewareService);
+    intercept(context: ExecutionContext, next: CallHandler): Observable<unknown>;
+    private touchActivity;
+}

package/server/src/lib/inactive-session/auth-device-session-activity.interceptor.js

@@ -0,0 +1,77 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AuthDeviceSessionActivityInterceptor = void 0;
+const tslib_1 = require("tslib");
+const common_1 = require("@nestjs/common");
+const core_1 = require("@acorex-platform/framework-server/core");
+const security_1 = require("@acorex-platform/framework-server/security");
+//#region ----- Constants -----
+const DEVICE_SESSION_ENTITY = 'SecurityManagement.DeviceSessions';
+/** Avoid writing lastLoginDate on every request; once per sid per throttle window is enough. */
+const TOUCH_THROTTLE_MS = 30000;
+//#endregion
+//#region ----- Device session activity interceptor -----
+/**
+ * Refreshes DeviceSessions.lastLoginDate while the user is making authenticated API calls
+ * so InactiveSessionTermination measures real inactivity (not only original login time).
+ */
+let AuthDeviceSessionActivityInterceptor = class AuthDeviceSessionActivityInterceptor {
+    constructor(storage) {
+        this.storage = storage;
+        this.lastTouchBySid = new Map();
+    }
+    intercept(context, next) {
+        var _a, _b;
+        if (context.getType() === 'http') {
+            const request = context.switchToHttp().getRequest();
+            const sid = (_b = (_a = request === null || request === void 0 ? void 0 : request[security_1.CURRENT_SESSION_KEY]) === null || _a === void 0 ? void 0 : _a.sid) === null || _b === void 0 ? void 0 : _b.trim();
+            if (sid) {
+                void this.touchActivity(sid);
+            }
+        }
+        return next.handle();
+    }
+    touchActivity(sessionId) {
+        return tslib_1.__awaiter(this, void 0, void 0, function* () {
+            var _a, _b, _c;
+            const now = Date.now();
+            const last = (_a = this.lastTouchBySid.get(sessionId)) !== null && _a !== void 0 ? _a : 0;
+            if (now - last < TOUCH_THROTTLE_MS) {
+                return;
+            }
+            this.lastTouchBySid.set(sessionId, now);
+            try {
+                const page = yield this.storage.queryAsEngine(DEVICE_SESSION_ENTITY, {
+                    skip: 0,
+                    take: 5,
+                    filter: {
+                        logic: 'and',
+                        filters: [
+                            { field: 'sessionId', operator: { type: 'equal' }, value: sessionId },
+                            { field: 'status', operator: { type: 'equal' }, value: 'active' },
+                        ],
+                    },
+                });
+                const items = ((_b = page.items) !== null && _b !== void 0 ? _b : []);
+                const id = typeof ((_c = items[0]) === null || _c === void 0 ? void 0 : _c.id) === 'string' ? items[0].id : '';
+                if (!id) {
+                    return;
+                }
+                yield this.storage.updateOneAsEngine(DEVICE_SESSION_ENTITY, id, {
+                    lastLoginDate: new Date(),
+                });
+            }
+            catch (_d) {
+                // Best-effort; do not fail the request if activity stamp fails.
+                this.lastTouchBySid.delete(sessionId);
+            }
+        });
+    }
+};
+exports.AuthDeviceSessionActivityInterceptor = AuthDeviceSessionActivityInterceptor;
+exports.AuthDeviceSessionActivityInterceptor = AuthDeviceSessionActivityInterceptor = tslib_1.__decorate([
+    (0, common_1.Injectable)(),
+    tslib_1.__metadata("design:paramtypes", [core_1.EntityStorageMiddlewareService])
+], AuthDeviceSessionActivityInterceptor);
+//#endregion
+//# sourceMappingURL=auth-device-session-activity.interceptor.js.map

package/server/src/lib/inactive-session/auth-device-session-activity.interceptor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-device-session-activity.interceptor.js","sourceRoot":"","sources":["../../../../../../../libs/modules/auth/server/src/lib/inactive-session/auth-device-session-activity.interceptor.ts"],"names":[],"mappings":";;;;AAAA,2CAKwB;AACxB,iEAAwF;AACxF,yEAA6G;AAG7G,+BAA+B;AAE/B,MAAM,qBAAqB,GAAG,mCAAmC,CAAC;AAClE,gGAAgG;AAChG,MAAM,iBAAiB,GAAG,KAAM,CAAC;AAEjC,YAAY;AAEZ,yDAAyD;AAEzD;;;GAGG;AAEI,IAAM,oCAAoC,GAA1C,MAAM,oCAAoC;IAG/C,YAA6B,OAAuC;QAAvC,YAAO,GAAP,OAAO,CAAgC;QAFnD,mBAAc,GAAG,IAAI,GAAG,EAAkB,CAAC;IAEW,CAAC;IAExE,SAAS,CAAC,OAAyB,EAAE,IAAiB;;QACpD,IAAI,OAAO,CAAC,OAAO,EAAE,KAAK,MAAM,EAAE,CAAC;YACjC,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAE7C,CAAC;YACL,MAAM,GAAG,GAAG,MAAA,MAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAG,8BAAmB,CAAC,0CAAE,GAAG,0CAAE,IAAI,EAAE,CAAC;YACxD,IAAI,GAAG,EAAE,CAAC;gBACR,KAAK,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC;YAC/B,CAAC;QACH,CAAC;QAED,OAAO,IAAI,CAAC,MAAM,EAAE,CAAC;IACvB,CAAC;IAEa,aAAa,CAAC,SAAiB;;;YAC3C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACvB,MAAM,IAAI,GAAG,MAAA,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,SAAS,CAAC,mCAAI,CAAC,CAAC;YACrD,IAAI,GAAG,GAAG,IAAI,GAAG,iBAAiB,EAAE,CAAC;gBACnC,OAAO;YACT,CAAC;YACD,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;YAExC,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,qBAAqB,EAAE;oBACnE,IAAI,EAAE,CAAC;oBACP,IAAI,EAAE,CAAC;oBACP,MAAM,EAAE;wBACN,KAAK,EAAE,KAAK;wBACZ,OAAO,EAAE;4BACP,EAAE,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE;4BACrE,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE;yBAClE;qBACF;iBACF,CAAC,CAAC;gBAEH,MAAM,KAAK,GAAG,CAAC,MAAA,IAAI,CAAC,KAAK,mCAAI,EAAE,CAA4B,CAAC;gBAC5D,MAAM,EAAE,GAAG,OAAO,CAAA,MAAA,KAAK,CAAC,CAAC,CAAC,0CAAE,EAAE,CAAA,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC/D,IAAI,CAAC,EAAE,EAAE,CAAC;oBACR,OAAO;gBACT,CAAC;gBAED,MAAM,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC,qBAAqB,EAAE,EAAE,EAAE;oBAC9D,aAAa,EAAE,IAAI,IAAI,EAAE;iBAC1B,CAAC,CAAC;YACL,CAAC;YAAC,WAAM,CAAC;gBACP,gEAAgE;gBAChE,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YACxC,CAAC;QACH,CAAC;KAAA;CACF,CAAA;AAtDY,oFAAoC;+CAApC,oCAAoC;IADhD,IAAA,mBAAU,GAAE;6CAI2B,qCAA8B;GAHzD,oCAAoC,CAsDhD;AAED,YAAY"}

package/server/src/lib/inactive-session/auth-inactive-session-termination-purge.command.d.ts

@@ -0,0 +1,7 @@
+import type { AXPCommand, AXPCommandExecuteResultPromise } from '@acorex-platform/framework-shared/runtime';
+import { AuthInactiveSessionTerminationService, type AuthInactiveSessionTerminationPurgeResult } from './auth-inactive-session-termination.service';
+export declare class AuthInactiveSessionTerminationPurgeCommand implements AXPCommand<Record<string, unknown>, AuthInactiveSessionTerminationPurgeResult> {
+    private readonly termination;
+    constructor(termination: AuthInactiveSessionTerminationService);
+    execute(): AXPCommandExecuteResultPromise<AuthInactiveSessionTerminationPurgeResult>;
+}

package/server/src/lib/inactive-session/auth-inactive-session-termination-purge.command.js

@@ -0,0 +1,39 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AuthInactiveSessionTerminationPurgeCommand = void 0;
+const tslib_1 = require("tslib");
+const common_1 = require("@nestjs/common");
+const background_job_1 = require("@acorex-platform/framework-server/background-job");
+const abstract_1 = require("@acorex-platform/framework-server/domain/abstract");
+const module_auth_contracts_1 = require("@acorex-platform/module-auth-client/contracts");
+const auth_inactive_session_termination_service_1 = require("./auth-inactive-session-termination.service");
+//#region ----- Inactive session termination purge command -----
+let AuthInactiveSessionTerminationPurgeCommand = class AuthInactiveSessionTerminationPurgeCommand {
+    constructor(termination) {
+        this.termination = termination;
+    }
+    execute() {
+        return tslib_1.__awaiter(this, void 0, void 0, function* () {
+            const runtime = background_job_1.BackgroundJobRuntime.current();
+            yield (runtime === null || runtime === void 0 ? void 0 : runtime.reportProgress(5, 'Scanning inactive device sessions'));
+            yield (runtime === null || runtime === void 0 ? void 0 : runtime.heartbeat());
+            const result = yield this.termination.purgeInactiveSessions();
+            const message = result.revoked > 0
+                ? `Revoked ${result.revoked} inactive session(s) (scanned ${result.scanned})`
+                : `Revoked 0 sessions — scanned ${result.scanned} active session(s)`;
+            yield (runtime === null || runtime === void 0 ? void 0 : runtime.reportProgress(100, message));
+            return { success: true, kind: 'object', data: result, message: { text: message } };
+        });
+    }
+};
+exports.AuthInactiveSessionTerminationPurgeCommand = AuthInactiveSessionTerminationPurgeCommand;
+exports.AuthInactiveSessionTerminationPurgeCommand = AuthInactiveSessionTerminationPurgeCommand = tslib_1.__decorate([
+    (0, abstract_1.ServerHandler)({
+        key: module_auth_contracts_1.AXM_AUTH_INACTIVE_SESSION_TERMINATION_PURGE_COMMAND_KEY,
+        concurrency: { policy: 'skip-if-running', scope: 'global' },
+    }),
+    (0, common_1.Injectable)(),
+    tslib_1.__metadata("design:paramtypes", [auth_inactive_session_termination_service_1.AuthInactiveSessionTerminationService])
+], AuthInactiveSessionTerminationPurgeCommand);
+//#endregion
+//# sourceMappingURL=auth-inactive-session-termination-purge.command.js.map

package/server/src/lib/inactive-session/auth-inactive-session-termination-purge.command.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-inactive-session-termination-purge.command.js","sourceRoot":"","sources":["../../../../../../../libs/modules/auth/server/src/lib/inactive-session/auth-inactive-session-termination-purge.command.ts"],"names":[],"mappings":";;;;AAAA,2CAA4C;AAE5C,qFAAwF;AACxF,gFAAkF;AAClF,kFAAiH;AACjH,2GAGqD;AAErD,gEAAgE;AAOzD,IAAM,0CAA0C,GAAhD,MAAM,0CAA0C;IAGrD,YAA6B,WAAkD;QAAlD,gBAAW,GAAX,WAAW,CAAuC;IAAG,CAAC;IAE7E,OAAO;;YACX,MAAM,OAAO,GAAG,qCAAoB,CAAC,OAAO,EAAE,CAAC;YAC/C,MAAM,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,cAAc,CAAC,CAAC,EAAE,mCAAmC,CAAC,CAAA,CAAC;YACtE,MAAM,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,SAAS,EAAE,CAAA,CAAC;YAE3B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,qBAAqB,EAAE,CAAC;YAC9D,MAAM,OAAO,GACX,MAAM,CAAC,OAAO,GAAG,CAAC;gBAChB,CAAC,CAAC,WAAW,MAAM,CAAC,OAAO,iCAAiC,MAAM,CAAC,OAAO,GAAG;gBAC7E,CAAC,CAAC,gCAAgC,MAAM,CAAC,OAAO,oBAAoB,CAAC;YAEzE,MAAM,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,cAAc,CAAC,GAAG,EAAE,OAAO,CAAC,CAAA,CAAC;YAE5C,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,CAAC;QACrF,CAAC;KAAA;CACF,CAAA;AApBY,gGAA0C;qDAA1C,0CAA0C;IALtD,IAAA,wBAAa,EAAC;QACb,GAAG,EAAE,+EAAuD;QAC5D,WAAW,EAAE,EAAE,MAAM,EAAE,iBAAiB,EAAE,KAAK,EAAE,QAAQ,EAAE;KAC5D,CAAC;IACD,IAAA,mBAAU,GAAE;6CAI+B,iFAAqC;GAHpE,0CAA0C,CAoBtD;AAED,YAAY"}

package/server/src/lib/inactive-session/auth-inactive-session-termination-settings.service.d.ts

@@ -0,0 +1,9 @@
+import { SettingsManagementStoreService } from '@acorex-platform/module-settings-management-server';
+export declare class AuthInactiveSessionTerminationSettingsService {
+    private readonly settingsStore;
+    constructor(settingsStore: SettingsManagementStoreService);
+    /**
+     * Effective inactivity window: user override → tenant default → code default.
+     */
+    resolveDurationMs(userId: string, tenantId: string | undefined | null): Promise<number>;
+}

package/server/src/lib/inactive-session/auth-inactive-session-termination-settings.service.js

@@ -0,0 +1,57 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AuthInactiveSessionTerminationSettingsService = void 0;
+const tslib_1 = require("tslib");
+const common_1 = require("@nestjs/common");
+const module_settings_management_server_1 = require("@acorex-platform/module-settings-management-server");
+const module_auth_contracts_1 = require("@acorex-platform/module-auth-client/contracts");
+//#region ----- Inactive session termination settings -----
+let AuthInactiveSessionTerminationSettingsService = class AuthInactiveSessionTerminationSettingsService {
+    constructor(settingsStore) {
+        this.settingsStore = settingsStore;
+    }
+    /**
+     * Effective inactivity window: user override → tenant default → code default.
+     */
+    resolveDurationMs(userId, tenantId) {
+        return tslib_1.__awaiter(this, void 0, void 0, function* () {
+            var _a, _b;
+            const uid = userId === null || userId === void 0 ? void 0 : userId.trim();
+            const tid = tenantId === null || tenantId === void 0 ? void 0 : tenantId.trim();
+            if (!uid) {
+                return (0, module_auth_contracts_1.resolveAuthInactiveSessionTerminationDurationMs)(module_auth_contracts_1.AXP_AUTH_INACTIVE_SESSION_TERMINATION_SETTING_DEFAULTS[module_auth_contracts_1.AXPAuthSettings.InactiveSessionTermination]);
+            }
+            if (uid) {
+                const userDocument = yield this.settingsStore.findByPartition({
+                    scope: 'U',
+                    documentId: `U:${uid}`,
+                    userId: uid,
+                    tenantId: tid || undefined,
+                });
+                const userValue = (_a = userDocument === null || userDocument === void 0 ? void 0 : userDocument.values) === null || _a === void 0 ? void 0 : _a[module_auth_contracts_1.AXPAuthSettings.InactiveSessionTermination];
+                if (userValue != null && userValue !== '') {
+                    return (0, module_auth_contracts_1.resolveAuthInactiveSessionTerminationDurationMs)(userValue);
+                }
+            }
+            if (tid) {
+                const tenantDocument = yield this.settingsStore.findByPartition({
+                    scope: 'T',
+                    documentId: `T:${tid}`,
+                    tenantId: tid,
+                });
+                const tenantValue = (_b = tenantDocument === null || tenantDocument === void 0 ? void 0 : tenantDocument.values) === null || _b === void 0 ? void 0 : _b[module_auth_contracts_1.AXPAuthSettings.InactiveSessionTermination];
+                if (tenantValue != null && tenantValue !== '') {
+                    return (0, module_auth_contracts_1.resolveAuthInactiveSessionTerminationDurationMs)(tenantValue);
+                }
+            }
+            return (0, module_auth_contracts_1.resolveAuthInactiveSessionTerminationDurationMs)(module_auth_contracts_1.AXP_AUTH_INACTIVE_SESSION_TERMINATION_SETTING_DEFAULTS[module_auth_contracts_1.AXPAuthSettings.InactiveSessionTermination]);
+        });
+    }
+};
+exports.AuthInactiveSessionTerminationSettingsService = AuthInactiveSessionTerminationSettingsService;
+exports.AuthInactiveSessionTerminationSettingsService = AuthInactiveSessionTerminationSettingsService = tslib_1.__decorate([
+    (0, common_1.Injectable)(),
+    tslib_1.__metadata("design:paramtypes", [module_settings_management_server_1.SettingsManagementStoreService])
+], AuthInactiveSessionTerminationSettingsService);
+//#endregion
+//# sourceMappingURL=auth-inactive-session-termination-settings.service.js.map

package/server/src/lib/inactive-session/auth-inactive-session-termination-settings.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-inactive-session-termination-settings.service.js","sourceRoot":"","sources":["../../../../../../../libs/modules/auth/server/src/lib/inactive-session/auth-inactive-session-termination-settings.service.ts"],"names":[],"mappings":";;;;AAAA,2CAA4C;AAC5C,0GAAoG;AACpG,kFAIgD;AAEhD,2DAA2D;AAGpD,IAAM,6CAA6C,GAAnD,MAAM,6CAA6C;IACxD,YAA6B,aAA6C;QAA7C,kBAAa,GAAb,aAAa,CAAgC;IAAG,CAAC;IAE9E;;OAEG;IACG,iBAAiB,CAAC,MAAc,EAAE,QAAmC;;;YACzE,MAAM,GAAG,GAAG,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,IAAI,EAAE,CAAC;YAC3B,MAAM,GAAG,GAAG,QAAQ,aAAR,QAAQ,uBAAR,QAAQ,CAAE,IAAI,EAAE,CAAC;YAC7B,IAAI,CAAC,GAAG,EAAE,CAAC;gBACT,OAAO,IAAA,uEAA+C,EACpD,8EAAsD,CAAC,uCAAe,CAAC,0BAA0B,CAAC,CACnG,CAAC;YACJ,CAAC;YAED,IAAI,GAAG,EAAE,CAAC;gBACR,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,eAAe,CAAC;oBAC5D,KAAK,EAAE,GAAG;oBACV,UAAU,EAAE,KAAK,GAAG,EAAE;oBACtB,MAAM,EAAE,GAAG;oBACX,QAAQ,EAAE,GAAG,IAAI,SAAS;iBAC3B,CAAC,CAAC;gBACH,MAAM,SAAS,GAAG,MAAA,YAAY,aAAZ,YAAY,uBAAZ,YAAY,CAAE,MAAM,0CAAG,uCAAe,CAAC,0BAA0B,CAAC,CAAC;gBACrF,IAAI,SAAS,IAAI,IAAI,IAAI,SAAS,KAAK,EAAE,EAAE,CAAC;oBAC1C,OAAO,IAAA,uEAA+C,EAAC,SAAS,CAAC,CAAC;gBACpE,CAAC;YACH,CAAC;YAED,IAAI,GAAG,EAAE,CAAC;gBACR,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,eAAe,CAAC;oBAC9D,KAAK,EAAE,GAAG;oBACV,UAAU,EAAE,KAAK,GAAG,EAAE;oBACtB,QAAQ,EAAE,GAAG;iBACd,CAAC,CAAC;gBACH,MAAM,WAAW,GAAG,MAAA,cAAc,aAAd,cAAc,uBAAd,cAAc,CAAE,MAAM,0CAAG,uCAAe,CAAC,0BAA0B,CAAC,CAAC;gBACzF,IAAI,WAAW,IAAI,IAAI,IAAI,WAAW,KAAK,EAAE,EAAE,CAAC;oBAC9C,OAAO,IAAA,uEAA+C,EAAC,WAAW,CAAC,CAAC;gBACtE,CAAC;YACH,CAAC;YAED,OAAO,IAAA,uEAA+C,EACpD,8EAAsD,CAAC,uCAAe,CAAC,0BAA0B,CAAC,CACnG,CAAC;QACJ,CAAC;KAAA;CACF,CAAA;AA5CY,sGAA6C;wDAA7C,6CAA6C;IADzD,IAAA,mBAAU,GAAE;6CAEiC,kEAA8B;GAD/D,6CAA6C,CA4CzD;AAED,YAAY"}

package/server/src/lib/inactive-session/auth-inactive-session-termination.service.d.ts

@@ -0,0 +1,18 @@
+import { EntityStorageMiddlewareService } from '@acorex-platform/framework-server/core';
+import { AuthInactiveSessionTerminationSettingsService } from './auth-inactive-session-termination-settings.service';
+export interface AuthInactiveSessionTerminationPurgeResult {
+    scanned: number;
+    revoked: number;
+}
+export declare class AuthInactiveSessionTerminationService {
+    private readonly storage;
+    private readonly settings;
+    private readonly logger;
+    constructor(storage: EntityStorageMiddlewareService, settings: AuthInactiveSessionTerminationSettingsService);
+    /**
+     * Revokes active DeviceSessions whose last activity (`lastLoginDate`) is older
+     * than the effective InactiveSessionTermination setting for that user/tenant.
+     * Token revoke middleware stamps Redis + emits realtime kick.
+     */
+    purgeInactiveSessions(): Promise<AuthInactiveSessionTerminationPurgeResult>;
+}

package/server/src/lib/inactive-session/auth-inactive-session-termination.service.js

@@ -0,0 +1,120 @@
+"use strict";
+var AuthInactiveSessionTerminationService_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AuthInactiveSessionTerminationService = void 0;
+const tslib_1 = require("tslib");
+const common_1 = require("@nestjs/common");
+const core_1 = require("@acorex-platform/framework-server/core");
+const module_auth_contracts_1 = require("@acorex-platform/module-auth-client/contracts");
+const auth_inactive_session_termination_settings_service_1 = require("./auth-inactive-session-termination-settings.service");
+//#region ----- Types -----
+const DEVICE_SESSION_ENTITY = 'SecurityManagement.DeviceSessions';
+const PAGE_SIZE = 100;
+//#endregion
+//#region ----- Inactive session termination purge -----
+let AuthInactiveSessionTerminationService = AuthInactiveSessionTerminationService_1 = class AuthInactiveSessionTerminationService {
+    constructor(storage, settings) {
+        this.storage = storage;
+        this.settings = settings;
+        this.logger = new common_1.Logger(AuthInactiveSessionTerminationService_1.name);
+    }
+    /**
+     * Revokes active DeviceSessions whose last activity (`lastLoginDate`) is older
+     * than the effective InactiveSessionTermination setting for that user/tenant.
+     * Token revoke middleware stamps Redis + emits realtime kick.
+     */
+    purgeInactiveSessions() {
+        return tslib_1.__awaiter(this, void 0, void 0, function* () {
+            var _a;
+            const now = Date.now();
+            // Prefilter: only rows idle at least as long as the shortest selectable option.
+            const minIdleMs = module_auth_contracts_1.AXP_AUTH_INACTIVE_SESSION_TERMINATION_DURATION_MS[module_auth_contracts_1.AXPAuthInactiveSessionTerminationOptions.OneWeek];
+            const earliestIdleCutoff = new Date(now - minIdleMs);
+            let scanned = 0;
+            let revoked = 0;
+            let skip = 0;
+            for (let pass = 0; pass < 200; pass += 1) {
+                const page = yield this.storage.queryAsEngine(DEVICE_SESSION_ENTITY, {
+                    skip,
+                    take: PAGE_SIZE,
+                    filter: {
+                        logic: 'and',
+                        filters: [
+                            { field: 'status', operator: { type: 'equal' }, value: 'active' },
+                            {
+                                field: 'lastLoginDate',
+                                operator: { type: 'lessThan' },
+                                value: earliestIdleCutoff,
+                            },
+                        ],
+                    },
+                });
+                const items = ((_a = page.items) !== null && _a !== void 0 ? _a : []);
+                if (items.length === 0) {
+                    break;
+                }
+                scanned += items.length;
+                let passRevoked = 0;
+                for (const row of items) {
+                    const id = typeof row.id === 'string' ? row.id.trim() : '';
+                    const userId = typeof row.userId === 'string' ? row.userId.trim() : '';
+                    if (!id || !userId) {
+                        continue;
+                    }
+                    const lastActivityMs = toEpochMs(row.lastLoginDate);
+                    if (lastActivityMs == null) {
+                        continue;
+                    }
+                    const tenantId = typeof row.tenantId === 'string' ? row.tenantId.trim() : '';
+                    const durationMs = yield this.settings.resolveDurationMs(userId, tenantId || undefined);
+                    if (now - lastActivityMs < durationMs) {
+                        continue;
+                    }
+                    try {
+                        yield this.storage.updateOneAsEngine(DEVICE_SESSION_ENTITY, id, {
+                            status: 'revoked',
+                            loggedOutAt: new Date(),
+                            isActiveSession: false,
+                        });
+                        revoked += 1;
+                        passRevoked += 1;
+                    }
+                    catch (error) {
+                        this.logger.warn(`Failed to revoke inactive device session ${id}: ${String(error)}`);
+                    }
+                }
+                // Deleting while paging: advance past rows that stayed active.
+                skip += items.length - passRevoked;
+                if (items.length < PAGE_SIZE) {
+                    break;
+                }
+            }
+            if (revoked > 0) {
+                this.logger.log(`Inactive session purge revoked ${revoked} of ${scanned} active session(s)`);
+            }
+            else {
+                this.logger.debug(`Inactive session purge finished with no revocations (scanned ${scanned})`);
+            }
+            return { scanned, revoked };
+        });
+    }
+};
+exports.AuthInactiveSessionTerminationService = AuthInactiveSessionTerminationService;
+exports.AuthInactiveSessionTerminationService = AuthInactiveSessionTerminationService = AuthInactiveSessionTerminationService_1 = tslib_1.__decorate([
+    (0, common_1.Injectable)(),
+    tslib_1.__metadata("design:paramtypes", [core_1.EntityStorageMiddlewareService,
+        auth_inactive_session_termination_settings_service_1.AuthInactiveSessionTerminationSettingsService])
+], AuthInactiveSessionTerminationService);
+function toEpochMs(value) {
+    if (value instanceof Date) {
+        const ms = value.getTime();
+        return Number.isNaN(ms) ? null : ms;
+    }
+    if (typeof value === 'string' || typeof value === 'number') {
+        const ms = new Date(value).getTime();
+        return Number.isNaN(ms) ? null : ms;
+    }
+    return null;
+}
+//#endregion
+//# sourceMappingURL=auth-inactive-session-termination.service.js.map

package/server/src/lib/inactive-session/auth-inactive-session-termination.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-inactive-session-termination.service.js","sourceRoot":"","sources":["../../../../../../../libs/modules/auth/server/src/lib/inactive-session/auth-inactive-session-termination.service.ts"],"names":[],"mappings":";;;;;AAAA,2CAAoD;AACpD,iEAAwF;AACxF,kFAGgD;AAChD,6HAAqH;AAErH,2BAA2B;AAE3B,MAAM,qBAAqB,GAAG,mCAAmC,CAAC;AAClE,MAAM,SAAS,GAAG,GAAG,CAAC;AAetB,YAAY;AAEZ,wDAAwD;AAGjD,IAAM,qCAAqC,6CAA3C,MAAM,qCAAqC;IAGhD,YACmB,OAAuC,EACvC,QAAuD;QADvD,YAAO,GAAP,OAAO,CAAgC;QACvC,aAAQ,GAAR,QAAQ,CAA+C;QAJzD,WAAM,GAAG,IAAI,eAAM,CAAC,uCAAqC,CAAC,IAAI,CAAC,CAAC;IAK9E,CAAC;IAEJ;;;;OAIG;IACG,qBAAqB;;;YACzB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACvB,gFAAgF;YAChF,MAAM,SAAS,GACb,yEAAiD,CAC/C,gEAAwC,CAAC,OAAO,CACjD,CAAC;YACJ,MAAM,kBAAkB,GAAG,IAAI,IAAI,CAAC,GAAG,GAAG,SAAS,CAAC,CAAC;YACrD,IAAI,OAAO,GAAG,CAAC,CAAC;YAChB,IAAI,OAAO,GAAG,CAAC,CAAC;YAChB,IAAI,IAAI,GAAG,CAAC,CAAC;YAEb,KAAK,IAAI,IAAI,GAAG,CAAC,EAAE,IAAI,GAAG,GAAG,EAAE,IAAI,IAAI,CAAC,EAAE,CAAC;gBACzC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,qBAAqB,EAAE;oBACnE,IAAI;oBACJ,IAAI,EAAE,SAAS;oBACf,MAAM,EAAE;wBACN,KAAK,EAAE,KAAK;wBACZ,OAAO,EAAE;4BACP,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE;4BACjE;gCACE,KAAK,EAAE,eAAe;gCACtB,QAAQ,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE;gCAC9B,KAAK,EAAE,kBAAkB;6BAC1B;yBACF;qBACF;iBACF,CAAC,CAAC;gBAEH,MAAM,KAAK,GAAG,CAAC,MAAA,IAAI,CAAC,KAAK,mCAAI,EAAE,CAAuB,CAAC;gBACvD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBACvB,MAAM;gBACR,CAAC;gBAED,OAAO,IAAI,KAAK,CAAC,MAAM,CAAC;gBACxB,IAAI,WAAW,GAAG,CAAC,CAAC;gBAEpB,KAAK,MAAM,GAAG,IAAI,KAAK,EAAE,CAAC;oBACxB,MAAM,EAAE,GAAG,OAAO,GAAG,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC3D,MAAM,MAAM,GAAG,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACvE,IAAI,CAAC,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;wBACnB,SAAS;oBACX,CAAC;oBAED,MAAM,cAAc,GAAG,SAAS,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;oBACpD,IAAI,cAAc,IAAI,IAAI,EAAE,CAAC;wBAC3B,SAAS;oBACX,CAAC;oBAED,MAAM,QAAQ,GAAG,OAAO,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC7E,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,iBAAiB,CAAC,MAAM,EAAE,QAAQ,IAAI,SAAS,CAAC,CAAC;oBACxF,IAAI,GAAG,GAAG,cAAc,GAAG,UAAU,EAAE,CAAC;wBACtC,SAAS;oBACX,CAAC;oBAED,IAAI,CAAC;wBACH,MAAM,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC,qBAAqB,EAAE,EAAE,EAAE;4BAC9D,MAAM,EAAE,SAAS;4BACjB,WAAW,EAAE,IAAI,IAAI,EAAE;4BACvB,eAAe,EAAE,KAAK;yBACvB,CAAC,CAAC;wBACH,OAAO,IAAI,CAAC,CAAC;wBACb,WAAW,IAAI,CAAC,CAAC;oBACnB,CAAC;oBAAC,OAAO,KAAK,EAAE,CAAC;wBACf,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,4CAA4C,EAAE,KAAK,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;oBACvF,CAAC;gBACH,CAAC;gBAED,+DAA+D;gBAC/D,IAAI,IAAI,KAAK,CAAC,MAAM,GAAG,WAAW,CAAC;gBACnC,IAAI,KAAK,CAAC,MAAM,GAAG,SAAS,EAAE,CAAC;oBAC7B,MAAM;gBACR,CAAC;YACH,CAAC;YAED,IAAI,OAAO,GAAG,CAAC,EAAE,CAAC;gBAChB,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,kCAAkC,OAAO,OAAO,OAAO,oBAAoB,CAAC,CAAC;YAC/F,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,gEAAgE,OAAO,GAAG,CAAC,CAAC;YAChG,CAAC;YAED,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;QAC9B,CAAC;KAAA;CACF,CAAA;AAhGY,sFAAqC;gDAArC,qCAAqC;IADjD,IAAA,mBAAU,GAAE;6CAKiB,qCAA8B;QAC7B,kGAA6C;GAL/D,qCAAqC,CAgGjD;AAED,SAAS,SAAS,CAAC,KAAc;IAC/B,IAAI,KAAK,YAAY,IAAI,EAAE,CAAC;QAC1B,MAAM,EAAE,GAAG,KAAK,CAAC,OAAO,EAAE,CAAC;QAC3B,OAAO,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IACtC,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC3D,MAAM,EAAE,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC;QACrC,OAAO,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IACtC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,YAAY"}

package/server/src/lib/queries/list-connected-captcha-providers.query.d.ts

@@ -0,0 +1,12 @@
+import { EntityStorageMiddlewareService } from '@acorex-platform/framework-server/core';
+import { type AXPServerQueryHandler } from '@acorex-platform/framework-server/domain/abstract';
+import type { AXPQueryFetchResultPromise } from '@acorex-platform/framework-shared/runtime';
+export interface AuthConnectedCaptchaProviderDto {
+    id: string;
+    title: string;
+}
+export declare class AuthListConnectedCaptchaProvidersQuery implements AXPServerQueryHandler<void, AuthConnectedCaptchaProviderDto> {
+    private readonly storage;
+    constructor(storage: EntityStorageMiddlewareService);
+    execute(): AXPQueryFetchResultPromise<AuthConnectedCaptchaProviderDto>;
+}

package/server/src/lib/queries/list-connected-captcha-providers.query.js

@@ -0,0 +1,96 @@
+"use strict";
+//#region ----- Imports -----
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AuthListConnectedCaptchaProvidersQuery = void 0;
+const tslib_1 = require("tslib");
+const common_1 = require("@nestjs/common");
+const core_1 = require("@acorex-platform/framework-server/core");
+const abstract_1 = require("@acorex-platform/framework-server/domain/abstract");
+const abstract_2 = require("@acorex-platform/framework-server/jql/abstract");
+const security_1 = require("@acorex-platform/framework-server/security");
+const core_2 = require("@acorex-platform/framework-shared/core");
+const module_auth_contracts_1 = require("@acorex-platform/module-auth-client/contracts");
+const module_integration_management_contracts_1 = require("@acorex-platform/module-integration-management-client/contracts");
+//#endregion
+//#region ----- List connected captcha providers -----
+const INTEGRATION_CONNECTION = module_integration_management_contracts_1.RootConfig.entities.integrationConnection.source;
+let AuthListConnectedCaptchaProvidersQuery = class AuthListConnectedCaptchaProvidersQuery {
+    constructor(storage) {
+        this.storage = storage;
+    }
+    execute() {
+        return tslib_1.__awaiter(this, void 0, void 0, function* () {
+            var _a, _b, _c, _d;
+            const registrations = (0, security_1.listAuthCaptchaProviders)();
+            if (registrations.length === 0) {
+                return (0, core_2.runtimeQuerySuccessCollection)({ items: [], total: 0 });
+            }
+            const platformTenantId = (_a = (0, abstract_2.getPrimaryPlatformTenantId)()) === null || _a === void 0 ? void 0 : _a.trim();
+            if (!platformTenantId) {
+                return (0, core_2.runtimeQuerySuccessCollection)({ items: [], total: 0 });
+            }
+            const providerIds = registrations.map((r) => r.providerId);
+            const titleById = new Map(registrations.map((r) => [r.providerId, r.titleKey]));
+            try {
+                const result = yield this.storage.queryAsEngine(INTEGRATION_CONNECTION, {
+                    skip: 0,
+                    take: 100,
+                    filter: {
+                        logic: 'and',
+                        filters: [
+                            {
+                                field: 'providerId',
+                                operator: { type: 'in' },
+                                value: providerIds,
+                            },
+                            {
+                                field: 'connectionScope',
+                                operator: { type: 'equal' },
+                                value: core_2.AXP_INTEGRATION_CONNECTION_SCOPE.Tenant,
+                            },
+                            {
+                                field: 'scopeInfo.tenantId',
+                                operator: { type: 'equal' },
+                                value: platformTenantId,
+                            },
+                            {
+                                field: 'status',
+                                operator: { type: 'equal' },
+                                value: core_2.AXP_INTEGRATION_CONNECTION_STATUS.Connected,
+                            },
+                            { field: 'isRevoked', operator: { type: 'equal' }, value: false },
+                            { field: 'isDisabled', operator: { type: 'equal' }, value: false },
+                        ],
+                    },
+                });
+                const items = [];
+                const seen = new Set();
+                for (const row of ((_b = result.items) !== null && _b !== void 0 ? _b : [])) {
+                    const id = String((_c = row.providerId) !== null && _c !== void 0 ? _c : '').trim();
+                    if (!id || seen.has(id) || !titleById.has(id)) {
+                        continue;
+                    }
+                    seen.add(id);
+                    const displayName = String((_d = row.displayName) !== null && _d !== void 0 ? _d : '').trim();
+                    items.push({
+                        id,
+                        title: displayName || titleById.get(id) || id,
+                    });
+                }
+                items.sort((a, b) => a.title.localeCompare(b.title));
+                return (0, core_2.runtimeQuerySuccessCollection)({ items, total: items.length });
+            }
+            catch (_e) {
+                return (0, core_2.runtimeQuerySuccessCollection)({ items: [], total: 0 });
+            }
+        });
+    }
+};
+exports.AuthListConnectedCaptchaProvidersQuery = AuthListConnectedCaptchaProvidersQuery;
+exports.AuthListConnectedCaptchaProvidersQuery = AuthListConnectedCaptchaProvidersQuery = tslib_1.__decorate([
+    (0, abstract_1.ServerQueryHandler)({ key: module_auth_contracts_1.AXMAuthQueryKeys.Captcha.ListConnectedProviders, auth: 'session' }),
+    (0, common_1.Injectable)(),
+    tslib_1.__metadata("design:paramtypes", [core_1.EntityStorageMiddlewareService])
+], AuthListConnectedCaptchaProvidersQuery);
+//#endregion
+//# sourceMappingURL=list-connected-captcha-providers.query.js.map

package/server/src/lib/queries/list-connected-captcha-providers.query.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"list-connected-captcha-providers.query.js","sourceRoot":"","sources":["../../../../../../../libs/modules/auth/server/src/lib/queries/list-connected-captcha-providers.query.ts"],"names":[],"mappings":";AAAA,6BAA6B;;;;AAE7B,2CAA4C;AAC5C,iEAAwF;AACxF,gFAG2D;AAC3D,6EAA4F;AAC5F,yEAAsF;AACtF,iEAIgD;AAEhD,kFAA0E;AAC1E,sHAGkE;AAWlE,YAAY;AAEZ,sDAAsD;AAEtD,MAAM,sBAAsB,GAAG,oDAAqB,CAAC,QAAQ,CAAC,qBAAqB,CAAC,MAAM,CAAC;AAIpF,IAAM,sCAAsC,GAA5C,MAAM,sCAAsC;IAGjD,YAA6B,OAAuC;QAAvC,YAAO,GAAP,OAAO,CAAgC;IAAG,CAAC;IAElE,OAAO;;;YACX,MAAM,aAAa,GAAG,IAAA,mCAAwB,GAAE,CAAC;YACjD,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC/B,OAAO,IAAA,oCAA6B,EAAC,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;YAChE,CAAC;YAED,MAAM,gBAAgB,GAAG,MAAA,IAAA,qCAA0B,GAAE,0CAAE,IAAI,EAAE,CAAC;YAC9D,IAAI,CAAC,gBAAgB,EAAE,CAAC;gBACtB,OAAO,IAAA,oCAA6B,EAAC,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;YAChE,CAAC;YAED,MAAM,WAAW,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;YAC3D,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;YAEhF,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,sBAAsB,EAAE;oBACtE,IAAI,EAAE,CAAC;oBACP,IAAI,EAAE,GAAG;oBACT,MAAM,EAAE;wBACN,KAAK,EAAE,KAAK;wBACZ,OAAO,EAAE;4BACP;gCACE,KAAK,EAAE,YAAY;gCACnB,QAAQ,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE;gCACxB,KAAK,EAAE,WAAW;6BACnB;4BACD;gCACE,KAAK,EAAE,iBAAiB;gCACxB,QAAQ,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE;gCAC3B,KAAK,EAAE,uCAAgC,CAAC,MAAM;6BAC/C;4BACD;gCACE,KAAK,EAAE,oBAAoB;gCAC3B,QAAQ,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE;gCAC3B,KAAK,EAAE,gBAAgB;6BACxB;4BACD;gCACE,KAAK,EAAE,QAAQ;gCACf,QAAQ,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE;gCAC3B,KAAK,EAAE,wCAAiC,CAAC,SAAS;6BACnD;4BACD,EAAE,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE;4BACjE,EAAE,KAAK,EAAE,YAAY,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE;yBACnE;qBACF;iBACF,CAAC,CAAC;gBAEH,MAAM,KAAK,GAAsC,EAAE,CAAC;gBACpD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;gBAE/B,KAAK,MAAM,GAAG,IAAI,CAAC,MAAA,MAAM,CAAC,KAAK,mCAC7B,EAAE,CAA+D,EAAE,CAAC;oBACpE,MAAM,EAAE,GAAG,MAAM,CAAC,MAAA,GAAG,CAAC,UAAU,mCAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;oBAC/C,IAAI,CAAC,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;wBAC9C,SAAS;oBACX,CAAC;oBACD,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;oBACb,MAAM,WAAW,GAAG,MAAM,CAAC,MAAA,GAAG,CAAC,WAAW,mCAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;oBACzD,KAAK,CAAC,IAAI,CAAC;wBACT,EAAE;wBACF,KAAK,EAAE,WAAW,IAAI,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE;qBAC9C,CAAC,CAAC;gBACL,CAAC;gBAED,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;gBACrD,OAAO,IAAA,oCAA6B,EAAC,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;YACvE,CAAC;YAAC,WAAM,CAAC;gBACP,OAAO,IAAA,oCAA6B,EAAC,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;YAChE,CAAC;QACH,CAAC;KAAA;CACF,CAAA;AA3EY,wFAAsC;iDAAtC,sCAAsC;IAFlD,IAAA,6BAAkB,EAAC,EAAE,GAAG,EAAE,wCAAgB,CAAC,OAAO,CAAC,sBAAsB,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IAC7F,IAAA,mBAAU,GAAE;6CAI2B,qCAA8B;GAHzD,sCAAsC,CA2ElD;AAED,YAAY"}

package/contracts/src/datasource.keys.d.ts

@@ -1,4 +0,0 @@
-/** Auth module datasource registry names. */
-export declare const AXMAuthDataSourceKeys: {
-    readonly UserActivity: "auth-user-activity";
-};

package/contracts/src/datasource.keys.js

@@ -1,10 +0,0 @@
-"use strict";
-//#region ---- Datasource keys ----
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.AXMAuthDataSourceKeys = void 0;
-/** Auth module datasource registry names. */
-exports.AXMAuthDataSourceKeys = {
-    UserActivity: 'auth-user-activity',
-};
-//#endregion
-//# sourceMappingURL=datasource.keys.js.map

package/contracts/src/datasource.keys.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"datasource.keys.js","sourceRoot":"","sources":["../../../../../libs/modules/auth/server/contracts/src/datasource.keys.ts"],"names":[],"mappings":";AAAA,mCAAmC;;;AAEnC,6CAA6C;AAChC,QAAA,qBAAqB,GAAG;IACnC,YAAY,EAAE,oBAAoB;CAC1B,CAAC;AAEX,YAAY"}

package/src/index.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../libs/modules/auth/server/src/index.ts"],"names":[],"mappings":";;;AAAA,mEAAyC"}

package/src/lib/auth-server.module.js

@@ -1,15 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.AuthServerModule = void 0;
-const tslib_1 = require("tslib");
-const common_1 = require("@nestjs/common");
-let AuthServerModule = class AuthServerModule {
-};
-exports.AuthServerModule = AuthServerModule;
-exports.AuthServerModule = AuthServerModule = tslib_1.__decorate([
-    (0, common_1.Module)({
-        imports: [],
-        exports: [],
-    })
-], AuthServerModule);
-//# sourceMappingURL=auth-server.module.js.map

package/src/lib/auth-server.module.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"auth-server.module.js","sourceRoot":"","sources":["../../../../../libs/modules/auth/server/src/lib/auth-server.module.ts"],"names":[],"mappings":";;;;AAAA,2CAAwC;AAOjC,IAAM,gBAAgB,GAAtB,MAAM,gBAAgB;CAAI,CAAA;AAApB,4CAAgB;2BAAhB,gBAAgB;IAJ5B,IAAA,eAAM,EAAC;QACN,OAAO,EAAE,EAAE;QACX,OAAO,EAAE,EAAE;KACZ,CAAC;GACW,gBAAgB,CAAI"}