@bevel-software/platform-core-backend 0.1.0 → 0.2.0

package/dist/modules/auth/auth.routes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.routes.d.ts","sourceRoot":"","sources":["../../../src/modules/auth/auth.routes.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAGrD;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,QAAmB,CAAC;AAEtD;;;;;;;GAOG;AACH,MAAM,WAAW,kBAAkB;IACjC,0EAA0E;IAC1E,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,iFAAiF;IACjF,WAAW,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,WAAW,EAAE,WAAW,GAAG,IAAI,CAAC;CACrE;AAED,wBAAgB,gBAAgB,CAC9B,WAAW,EAAE,WAAW,EACxB,cAAc,EAAE,OAAO,CAAC,cAAc,EACtC,SAAS,GAAE,kBAAkB,EAAO,EACpC,oBAAoB,UAAO,GAC1B,OAAO,CAAC,MAAM,CAgEhB"}
+{"version":3,"file":"auth.routes.d.ts","sourceRoot":"","sources":["../../../src/modules/auth/auth.routes.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAIrD;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,QAAmB,CAAC;AAEtD;;;;;;;;;GASG;AACH,MAAM,WAAW,kBAAkB;IACjC,gEAAgE;IAChE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,0DAA0D;IAC1D,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,oFAAoF;IACpF,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,iFAAiF;IACjF,WAAW,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,WAAW,EAAE,WAAW,GAAG,IAAI,CAAC;CACrE;AAED,wBAAgB,gBAAgB,CAC9B,WAAW,EAAE,WAAW,EACxB,cAAc,EAAE,OAAO,CAAC,cAAc,EACtC,SAAS,GAAE,kBAAkB,EAAO,EACpC,oBAAoB,UAAO,GAC1B,OAAO,CAAC,MAAM,CAmHhB"}

package/dist/modules/auth/auth.routes.js

@@ -1,5 +1,6 @@
 import express from 'express';
 import { AUTH_COOKIE_NAME } from './auth.middleware.js'; // also imports Express Request augmentation
+import { FixedWindowRateLimiter } from './rate-limit.js';
 /**
  * Max age of the JWT cookie (seconds). Matches the JWT's own `expiresIn:
  * '7d'` so the cookie expires when the token does — browsers stop
@@ -9,7 +10,19 @@ import { AUTH_COOKIE_NAME } from './auth.middleware.js'; // also imports Express
 export const AUTH_COOKIE_MAX_AGE_S = 7 * 24 * 60 * 60;
 export function createAuthRoutes(authService, authMiddleware, providers = [], passwordLoginEnabled = true) {
     const router = express.Router();
-    // POST /api/auth/login — email + shared-password login (unprotected)
+    // Brute-force guards on the password endpoints (scrypt also makes each
+    // attempt expensive server-side, so these double as DoS protection):
+    //  - login: a tight per-(ip, email) budget plus a wider per-ip budget so a
+    //    single address can't spray many emails; the pair key resets on a
+    //    successful login.
+    //  - change-password: per authenticated account (a stolen session must not
+    //    get unlimited guesses at the current password).
+    const loginPairLimiter = new FixedWindowRateLimiter(10, 15 * 60_000);
+    const loginIpLimiter = new FixedWindowRateLimiter(50, 15 * 60_000);
+    const changePasswordLimiter = new FixedWindowRateLimiter(10, 15 * 60_000);
+    const clientIp = (req) => req.ip ?? req.socket.remoteAddress ?? 'unknown';
+    // POST /api/auth/login — email + password login (unprotected): the env
+    // bootstrap admin or a per-user account password (see AuthService).
     router.post('/auth/login', async (req, res) => {
         if (!passwordLoginEnabled) {
             res.status(403).json({ error: 'Password login is disabled' });
@@ -20,8 +33,18 @@ export function createAuthRoutes(authService, authMiddleware, providers = [], pa
             res.status(400).json({ error: 'email and password are required' });
             return;
         }
+        const ip = clientIp(req);
+        const pairKey = `${ip}|${email.trim().toLowerCase()}`;
+        if (!loginPairLimiter.consume(pairKey) || !loginIpLimiter.consume(ip)) {
+            res.status(429).json({ error: 'Too many attempts. Try again later.' });
+            return;
+        }
         try {
             const result = await authService.loginWithPassword(email, password);
+            // A real login clears the pair budget — a user who fumbled a few
+            // attempts isn't rate-limited on their next visit. (The wider per-ip
+            // window intentionally keeps counting.)
+            loginPairLimiter.reset(pairKey);
             // Also set the JWT as an HttpOnly cookie so transports that can't
             // carry headers (EventSource for SSE, image tags) authenticate
             // automatically. JSON callers continue to use the Bearer header
@@ -43,15 +66,40 @@ export function createAuthRoutes(authService, authMiddleware, providers = [], pa
         }
     });
     // GET /api/auth/providers — unprotected capability probe so the login screen
-    // knows which login methods to render. SSO providers appear under their key.
+    // knows which login methods to render: the password form, plus one button
+    // per SSO provider (label + the path that starts its flow).
     router.get('/auth/providers', (_req, res) => {
         res.json({
             password: passwordLoginEnabled,
-            ...Object.fromEntries(providers.map((p) => [p.key, true])),
+            sso: providers.map((p) => ({ key: p.key, label: p.label, startPath: p.startPath })),
         });
     });
     for (const provider of providers)
         provider.mountRoutes(router, authService);
+    // POST /api/auth/change-password — self-service (protected). Requires the
+    // current password whenever one is set; an SSO-only account sets its first
+    // password without one.
+    router.post('/auth/change-password', authMiddleware, async (req, res) => {
+        const { currentPassword, newPassword } = req.body;
+        if (!newPassword) {
+            res.status(400).json({ error: 'newPassword is required' });
+            return;
+        }
+        if (!changePasswordLimiter.consume(req.userId)) {
+            res.status(429).json({ error: 'Too many attempts. Try again later.' });
+            return;
+        }
+        try {
+            await authService.changePassword(req.userId, currentPassword, newPassword);
+            res.json({ ok: true });
+        }
+        catch (error) {
+            const msg = error instanceof Error ? error.message : 'Unknown error';
+            // Policy violations and a wrong current password are caller errors, not
+            // server faults — and the message is safe to show verbatim.
+            res.status(400).json({ error: msg });
+        }
+    });
     // GET /api/auth/me — validate stored JWT, return user info (protected)
     router.get('/auth/me', authMiddleware, async (req, res) => {
         try {

package/dist/modules/auth/auth.routes.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.routes.js","sourceRoot":"","sources":["../../../src/modules/auth/auth.routes.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,MAAM,SAAS,CAAC;AAE9B,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC,CAAC,4CAA4C;AAErG;;;;;GAKG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;AAiBtD,MAAM,UAAU,gBAAgB,CAC9B,WAAwB,EACxB,cAAsC,EACtC,YAAkC,EAAE,EACpC,oBAAoB,GAAG,IAAI;IAE3B,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAEhC,qEAAqE;IACrE,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAC5C,IAAI,CAAC,oBAAoB,EAAE,CAAC;YAC1B,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,4BAA4B,EAAE,CAAC,CAAC;YAC9D,OAAO;QACT,CAAC;QACD,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,GAAG,CAAC,IAA6C,CAAC;QAC9E,IAAI,CAAC,KAAK,IAAI,CAAC,QAAQ,EAAE,CAAC;YACxB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iCAAiC,EAAE,CAAC,CAAC;YACnE,OAAO;QACT,CAAC;QAED,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,iBAAiB,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;YACpE,kEAAkE;YAClE,+DAA+D;YAC/D,gEAAgE;YAChE,gEAAgE;YAChE,+CAA+C;YAC/C,GAAG,CAAC,MAAM,CAAC,gBAAgB,EAAE,MAAM,CAAC,KAAK,EAAE;gBACzC,QAAQ,EAAE,IAAI;gBACd,QAAQ,EAAE,KAAK;gBACf,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY;gBAC7C,MAAM,EAAE,qBAAqB,GAAG,IAAI;gBACpC,IAAI,EAAE,GAAG;aACV,CAAC,CAAC;YACH,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACnB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,GAAG,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC;YACrE,OAAO,CAAC,KAAK,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC;YACnC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,6EAA6E;IAC7E,6EAA6E;IAC7E,MAAM,CAAC,GAAG,CAAC,iBAAiB,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QAC1C,GAAG,CAAC,IAAI,CAAC;YACP,QAAQ,EAAE,oBAAoB;YAC9B,GAAG,MAAM,CAAC,WAAW,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;SAC3D,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,KAAK,MAAM,QAAQ,IAAI,SAAS;QAAE,QAAQ,CAAC,WAAW,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IAE5E,uEAAuE;IACvE,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE,cAAc,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACxD,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,WAAW,CAAC,GAAG,CAAC,MAAO,CAAC,CAAC;YACxD,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;gBAClD,OAAO;YACT,CAAC;YACD,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,GAAG,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC;YACrE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;QACvC,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC"}
+{"version":3,"file":"auth.routes.js","sourceRoot":"","sources":["../../../src/modules/auth/auth.routes.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,MAAM,SAAS,CAAC;AAE9B,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC,CAAC,4CAA4C;AACrG,OAAO,EAAE,sBAAsB,EAAE,MAAM,iBAAiB,CAAC;AAEzD;;;;;GAKG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;AAuBtD,MAAM,UAAU,gBAAgB,CAC9B,WAAwB,EACxB,cAAsC,EACtC,YAAkC,EAAE,EACpC,oBAAoB,GAAG,IAAI;IAE3B,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAEhC,uEAAuE;IACvE,qEAAqE;IACrE,2EAA2E;IAC3E,sEAAsE;IACtE,uBAAuB;IACvB,2EAA2E;IAC3E,qDAAqD;IACrD,MAAM,gBAAgB,GAAG,IAAI,sBAAsB,CAAC,EAAE,EAAE,EAAE,GAAG,MAAM,CAAC,CAAC;IACrE,MAAM,cAAc,GAAG,IAAI,sBAAsB,CAAC,EAAE,EAAE,EAAE,GAAG,MAAM,CAAC,CAAC;IACnE,MAAM,qBAAqB,GAAG,IAAI,sBAAsB,CAAC,EAAE,EAAE,EAAE,GAAG,MAAM,CAAC,CAAC;IAC1E,MAAM,QAAQ,GAAG,CAAC,GAAoB,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,IAAI,GAAG,CAAC,MAAM,CAAC,aAAa,IAAI,SAAS,CAAC;IAE3F,uEAAuE;IACvE,oEAAoE;IACpE,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAC5C,IAAI,CAAC,oBAAoB,EAAE,CAAC;YAC1B,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,4BAA4B,EAAE,CAAC,CAAC;YAC9D,OAAO;QACT,CAAC;QACD,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,GAAG,CAAC,IAA6C,CAAC;QAC9E,IAAI,CAAC,KAAK,IAAI,CAAC,QAAQ,EAAE,CAAC;YACxB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iCAAiC,EAAE,CAAC,CAAC;YACnE,OAAO;QACT,CAAC;QACD,MAAM,EAAE,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;QACzB,MAAM,OAAO,GAAG,GAAG,EAAE,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;QACtD,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,CAAC;YACtE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,qCAAqC,EAAE,CAAC,CAAC;YACvE,OAAO;QACT,CAAC;QAED,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,iBAAiB,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;YACpE,iEAAiE;YACjE,qEAAqE;YACrE,wCAAwC;YACxC,gBAAgB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAChC,kEAAkE;YAClE,+DAA+D;YAC/D,gEAAgE;YAChE,gEAAgE;YAChE,+CAA+C;YAC/C,GAAG,CAAC,MAAM,CAAC,gBAAgB,EAAE,MAAM,CAAC,KAAK,EAAE;gBACzC,QAAQ,EAAE,IAAI;gBACd,QAAQ,EAAE,KAAK;gBACf,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY;gBAC7C,MAAM,EAAE,qBAAqB,GAAG,IAAI;gBACpC,IAAI,EAAE,GAAG;aACV,CAAC,CAAC;YACH,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACnB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,GAAG,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC;YACrE,OAAO,CAAC,KAAK,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC;YACnC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,6EAA6E;IAC7E,0EAA0E;IAC1E,4DAA4D;IAC5D,MAAM,CAAC,GAAG,CAAC,iBAAiB,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QAC1C,GAAG,CAAC,IAAI,CAAC;YACP,QAAQ,EAAE,oBAAoB;YAC9B,GAAG,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC;SACpF,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,KAAK,MAAM,QAAQ,IAAI,SAAS;QAAE,QAAQ,CAAC,WAAW,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IAE5E,0EAA0E;IAC1E,2EAA2E;IAC3E,wBAAwB;IACxB,MAAM,CAAC,IAAI,CAAC,uBAAuB,EAAE,cAAc,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACtE,MAAM,EAAE,eAAe,EAAE,WAAW,EAAE,GAAG,GAAG,CAAC,IAG5C,CAAC;QACF,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC,CAAC;YAC3D,OAAO;QACT,CAAC;QACD,IAAI,CAAC,qBAAqB,CAAC,OAAO,CAAC,GAAG,CAAC,MAAO,CAAC,EAAE,CAAC;YAChD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,qCAAqC,EAAE,CAAC,CAAC;YACvE,OAAO;QACT,CAAC;QACD,IAAI,CAAC;YACH,MAAM,WAAW,CAAC,cAAc,CAAC,GAAG,CAAC,MAAO,EAAE,eAAe,EAAE,WAAW,CAAC,CAAC;YAC5E,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QACzB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,GAAG,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC;YACrE,wEAAwE;YACxE,4DAA4D;YAC5D,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;QACvC,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,uEAAuE;IACvE,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE,cAAc,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACxD,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,WAAW,CAAC,GAAG,CAAC,MAAO,CAAC,CAAC;YACxD,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;gBAClD,OAAO;YACT,CAAC;YACD,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,GAAG,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC;YACrE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;QACvC,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/modules/auth/auth.service.d.ts

@@ -5,22 +5,59 @@ export declare class AuthService {
     private readonly db;
     private readonly config;
     constructor(db: Database, config: CoreConfig);
+    /**
+     * Password login. Two credential sources, in order:
+     *
+     *  1. The env bootstrap admin (`ADMIN_EMAIL` + `ADMIN_PASSWORD`), checked
+     *     directly against the environment — never stored, so unsetting either
+     *     variable disables it immediately. Lets a fresh deployment sign in
+     *     before any account exists.
+     *  2. A per-user account: the `users` row's scrypt `password_hash`
+     *     (created by an admin from Roles & Members, or set by the user on
+     *     their Account page). Accounts that only ever signed in via SSO have
+     *     no hash and are refused here.
+     *
+     * A generic "Invalid credentials" error for every failure mode — never
+     * reveal whether the email exists or has a password.
+     */
     loginWithPassword(email: string, password: string): Promise<{
         token: string;
         user: AuthUser;
     }>;
     /**
-     * Establish a session for a user who authenticated via "Sign in with
-     * Microsoft". Same upsert-by-email + JWT path as password login — the only
-     * difference is identity came from a verified Microsoft id_token instead of
-     * the shared password. Email is the idempotency key, so a user who first
-     * used password login and later signs in with Microsoft (same email) keeps
-     * the same account/id.
+     * Establish a session for a user whose identity an SSO provider (the
+     * generic OIDC plugin, or the enterprise "Sign in with Microsoft") already
+     * verified. Same upsert-by-email + JWT path as password login. Email is the
+     * idempotency key, so a user who first used password login and later signs
+     * in via SSO (same email) keeps the same account/id.
      */
-    loginWithMicrosoft(email: string, name: string): Promise<{
+    loginWithSso(email: string, name: string): Promise<{
         token: string;
         user: AuthUser;
     }>;
+    /**
+     * Admin-driven account provisioning (Roles & Members → Accounts). Upserts
+     * the user by email and sets their password — re-provisioning an existing
+     * account (e.g. one that first arrived via SSO, or a reset for a locked-out
+     * user) is deliberate admin behavior, not an error.
+     */
+    createAccount(email: string, name: string | undefined, password: string): Promise<AuthUser>;
+    /**
+     * Self-service password change (the Account page). The current password is
+     * required whenever one is set; an SSO-only account (no hash yet) may set
+     * its first password without one. The env bootstrap-admin credential is not
+     * affected — it lives in the environment, not in this row.
+     */
+    changePassword(userId: string, currentPassword: string | undefined, newPassword: string): Promise<void>;
+    /** Accounts overview for the admin management screen (never exposes hashes). */
+    listAccounts(): Promise<Array<{
+        id: string;
+        email: string;
+        name: string;
+        hasPassword: boolean;
+        createdAt: Date;
+    }>>;
+    private assertPasswordPolicy;
     private signToken;
     /**
      * Get-or-create a user record by email, without issuing a session token.
@@ -71,6 +108,5 @@ export declare class AuthService {
      * regex-validated) email.
      */
     private assertAllowedDomain;
-    private checkPassword;
 }
 //# sourceMappingURL=auth.service.d.ts.map

package/dist/modules/auth/auth.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.service.d.ts","sourceRoot":"","sources":["../../../src/modules/auth/auth.service.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,2BAA2B,CAAC;AAC1D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAEvD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iCAAiC,CAAC;AAmBhE,qBAAa,WAAW;IAEpB,OAAO,CAAC,QAAQ,CAAC,EAAE;IACnB,OAAO,CAAC,QAAQ,CAAC,MAAM;gBADN,EAAE,EAAE,QAAQ,EACZ,MAAM,EAAE,UAAU;IAG/B,iBAAiB,CACrB,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,QAAQ,CAAA;KAAE,CAAC;IAiB7C;;;;;;;OAOG;IACG,kBAAkB,CACtB,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,MAAM,GACX,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,QAAQ,CAAA;KAAE,CAAC;IAW7C,OAAO,CAAC,SAAS;IAIjB;;;;;;;OAOG;IACG,kBAAkB,CACtB,KAAK,EAAE,MAAM,EACb,IAAI,CAAC,EAAE,MAAM,GACZ,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;YAQhD,iBAAiB;IAS/B,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE;IAQ7D;;;;;;;;;OASG;IACG,oBAAoB,CACxB,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,GAClB,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAY9D,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;IAiB3D;;;;;;;OAOG;IACH,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;IAQ5C;;;;OAIG;IACH,OAAO,CAAC,mBAAmB;IAM3B,OAAO,CAAC,aAAa;CAiBtB"}
+{"version":3,"file":"auth.service.d.ts","sourceRoot":"","sources":["../../../src/modules/auth/auth.service.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,2BAA2B,CAAC;AAC1D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAEvD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iCAAiC,CAAC;AAsChE,qBAAa,WAAW;IAEpB,OAAO,CAAC,QAAQ,CAAC,EAAE;IACnB,OAAO,CAAC,QAAQ,CAAC,MAAM;gBADN,EAAE,EAAE,QAAQ,EACZ,MAAM,EAAE,UAAU;IAGrC;;;;;;;;;;;;;;OAcG;IACG,iBAAiB,CACrB,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,QAAQ,CAAA;KAAE,CAAC;IAsC7C;;;;;;OAMG;IACG,YAAY,CAChB,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,MAAM,GACX,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,QAAQ,CAAA;KAAE,CAAC;IAW7C;;;;;OAKG;IACG,aAAa,CACjB,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,QAAQ,CAAC;IA2BpB;;;;;OAKG;IACG,cAAc,CAClB,MAAM,EAAE,MAAM,EACd,eAAe,EAAE,MAAM,GAAG,SAAS,EACnC,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,IAAI,CAAC;IAgBhB,gFAAgF;IAC1E,YAAY,IAAI,OAAO,CAC3B,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,OAAO,CAAC;QAAC,SAAS,EAAE,IAAI,CAAA;KAAE,CAAC,CAC1F;IAWD,OAAO,CAAC,oBAAoB;IAM5B,OAAO,CAAC,SAAS;IAIjB;;;;;;;OAOG;IACG,kBAAkB,CACtB,KAAK,EAAE,MAAM,EACb,IAAI,CAAC,EAAE,MAAM,GACZ,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;YAQhD,iBAAiB;IAS/B,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE;IAQ7D;;;;;;;;;OASG;IACG,oBAAoB,CACxB,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,GAClB,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAY9D,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;IAiB3D;;;;;;;OAOG;IACH,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;IAQ5C;;;;OAIG;IACH,OAAO,CAAC,mBAAmB;CAM5B"}

package/dist/modules/auth/auth.service.js

@@ -1,9 +1,21 @@
-import { timingSafeEqual } from 'node:crypto';
 import jwt from 'jsonwebtoken';
 import { eq } from 'drizzle-orm';
 import { users } from '../database/schema.js';
 import { hashEmail } from '../../shared/hash-email.js';
+import { hashPassword, verifyPassword, timingSafeStringEqual, MIN_PASSWORD_LENGTH, } from './password-hash.js';
 const EMAIL_REGEX = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
+/**
+ * Decoy hash verified when the email is unknown or has no password set, so
+ * those paths cost the same scrypt work as a real wrong-password attempt —
+ * without it, response timing would reveal which emails have accounts.
+ * Lazily computed once; the compared password never matches it (verification
+ * result is discarded — those paths always refuse).
+ */
+let decoyHashPromise = null;
+function decoyHash() {
+    decoyHashPromise ??= hashPassword('bevel-decoy-password-never-matches');
+    return decoyHashPromise;
+}
 function toAuthUser(user) {
     return {
         id: user.id,
@@ -19,38 +31,140 @@ export class AuthService {
         this.db = db;
         this.config = config;
     }
+    /**
+     * Password login. Two credential sources, in order:
+     *
+     *  1. The env bootstrap admin (`ADMIN_EMAIL` + `ADMIN_PASSWORD`), checked
+     *     directly against the environment — never stored, so unsetting either
+     *     variable disables it immediately. Lets a fresh deployment sign in
+     *     before any account exists.
+     *  2. A per-user account: the `users` row's scrypt `password_hash`
+     *     (created by an admin from Roles & Members, or set by the user on
+     *     their Account page). Accounts that only ever signed in via SSO have
+     *     no hash and are refused here.
+     *
+     * A generic "Invalid credentials" error for every failure mode — never
+     * reveal whether the email exists or has a password.
+     */
     async loginWithPassword(email, password) {
         const normalizedEmail = (email ?? '').trim().toLowerCase();
         if (!EMAIL_REGEX.test(normalizedEmail)) {
-            throw new Error('Invalid email');
+            throw new Error('Invalid credentials');
         }
         this.assertAllowedDomain(normalizedEmail);
-        if (!this.checkPassword(password ?? '')) {
-            throw new Error('Invalid password');
+        const provided = password ?? '';
+        const isEnvAdmin = this.config.adminEmail.length > 0 &&
+            this.config.adminPassword.length > 0 &&
+            normalizedEmail === this.config.adminEmail &&
+            timingSafeStringEqual(provided, this.config.adminPassword);
+        if (isEnvAdmin) {
+            const defaultName = normalizedEmail.split('@')[0] || normalizedEmail;
+            const user = await this.upsertUserByEmail(normalizedEmail, defaultName);
+            return { token: this.signToken(user.id, user.email), user: toAuthUser(user) };
+        }
+        const [user] = await this.db
+            .select()
+            .from(users)
+            .where(eq(users.email, normalizedEmail))
+            .limit(1);
+        // Always run one scrypt verification — against the stored hash when there
+        // is one, against the decoy otherwise — so unknown emails and
+        // password-less (SSO-only) accounts take the same time as a wrong
+        // password and can't be enumerated via response timing.
+        const stored = user?.passwordHash ?? (await decoyHash());
+        const matches = await verifyPassword(provided, stored);
+        if (!user?.passwordHash || !matches) {
+            throw new Error('Invalid credentials');
         }
-        // Derive a default display name from the local-part of the email
-        const defaultName = normalizedEmail.split('@')[0] || normalizedEmail;
-        const user = await this.upsertUserByEmail(normalizedEmail, defaultName);
         return { token: this.signToken(user.id, user.email), user: toAuthUser(user) };
     }
     /**
-     * Establish a session for a user who authenticated via "Sign in with
-     * Microsoft". Same upsert-by-email + JWT path as password login — the only
-     * difference is identity came from a verified Microsoft id_token instead of
-     * the shared password. Email is the idempotency key, so a user who first
-     * used password login and later signs in with Microsoft (same email) keeps
-     * the same account/id.
+     * Establish a session for a user whose identity an SSO provider (the
+     * generic OIDC plugin, or the enterprise "Sign in with Microsoft") already
+     * verified. Same upsert-by-email + JWT path as password login. Email is the
+     * idempotency key, so a user who first used password login and later signs
+     * in via SSO (same email) keeps the same account/id.
      */
-    async loginWithMicrosoft(email, name) {
+    async loginWithSso(email, name) {
         const normalizedEmail = (email ?? '').trim().toLowerCase();
         if (!EMAIL_REGEX.test(normalizedEmail)) {
-            throw new Error('Microsoft sign-in returned an invalid email');
+            throw new Error('Sign-in returned an invalid email');
         }
         this.assertAllowedDomain(normalizedEmail);
         const displayName = (name ?? '').trim() || normalizedEmail.split('@')[0] || normalizedEmail;
         const user = await this.upsertUserByEmail(normalizedEmail, displayName);
         return { token: this.signToken(user.id, user.email), user: toAuthUser(user) };
     }
+    /**
+     * Admin-driven account provisioning (Roles & Members → Accounts). Upserts
+     * the user by email and sets their password — re-provisioning an existing
+     * account (e.g. one that first arrived via SSO, or a reset for a locked-out
+     * user) is deliberate admin behavior, not an error.
+     */
+    async createAccount(email, name, password) {
+        const normalizedEmail = (email ?? '').trim().toLowerCase();
+        if (!EMAIL_REGEX.test(normalizedEmail)) {
+            throw new Error('Invalid email');
+        }
+        this.assertAllowedDomain(normalizedEmail);
+        this.assertPasswordPolicy(password);
+        const suppliedName = (name ?? '').trim();
+        const displayName = suppliedName || normalizedEmail.split('@')[0] || normalizedEmail;
+        const passwordHash = await hashPassword(password);
+        // One atomic upsert. On conflict (re-provisioning an existing account) an
+        // EXPLICITLY supplied name is persisted too; a blank name keeps the
+        // existing display name rather than clobbering it with the local-part
+        // fallback. `returning()` yields the authoritative row either way.
+        const [row] = await this.db
+            .insert(users)
+            .values({ email: normalizedEmail, name: displayName, passwordHash })
+            .onConflictDoUpdate({
+            target: users.email,
+            set: suppliedName
+                ? { passwordHash, name: suppliedName, updatedAt: new Date() }
+                : { passwordHash, updatedAt: new Date() },
+        })
+            .returning();
+        return toAuthUser(row);
+    }
+    /**
+     * Self-service password change (the Account page). The current password is
+     * required whenever one is set; an SSO-only account (no hash yet) may set
+     * its first password without one. The env bootstrap-admin credential is not
+     * affected — it lives in the environment, not in this row.
+     */
+    async changePassword(userId, currentPassword, newPassword) {
+        this.assertPasswordPolicy(newPassword);
+        const [user] = await this.db.select().from(users).where(eq(users.id, userId)).limit(1);
+        if (!user)
+            throw new Error('User not found');
+        if (user.passwordHash) {
+            if (!currentPassword || !(await verifyPassword(currentPassword, user.passwordHash))) {
+                throw new Error('Current password is incorrect');
+            }
+        }
+        const passwordHash = await hashPassword(newPassword);
+        await this.db
+            .update(users)
+            .set({ passwordHash, updatedAt: new Date() })
+            .where(eq(users.id, userId));
+    }
+    /** Accounts overview for the admin management screen (never exposes hashes). */
+    async listAccounts() {
+        const rows = await this.db.select().from(users).orderBy(users.email);
+        return rows.map((row) => ({
+            id: row.id,
+            email: row.email,
+            name: row.name,
+            hasPassword: row.passwordHash != null,
+            createdAt: row.createdAt,
+        }));
+    }
+    assertPasswordPolicy(password) {
+        if ((password ?? '').length < MIN_PASSWORD_LENGTH) {
+            throw new Error(`Password must be at least ${MIN_PASSWORD_LENGTH} characters`);
+        }
+    }
     signToken(userId, email) {
         return jwt.sign({ userId, email }, this.config.jwtSecret, { expiresIn: '7d' });
     }
@@ -147,22 +261,5 @@ export class AuthService {
             throw new Error('Email domain is not allowed');
         }
     }
-    checkPassword(provided) {
-        const expected = this.config.testPassword;
-        // Reject if no password is configured on the server
-        if (!expected)
-            return false;
-        const a = Buffer.from(provided, 'utf8');
-        const b = Buffer.from(expected, 'utf8');
-        // Pad both buffers to the same length so timingSafeEqual runs unconditionally —
-        // returning early on length mismatch would leak the expected password's length via timing.
-        const len = Math.max(a.length, b.length);
-        const aPadded = Buffer.alloc(len);
-        const bPadded = Buffer.alloc(len);
-        a.copy(aPadded);
-        b.copy(bPadded);
-        const equal = timingSafeEqual(aPadded, bPadded);
-        return equal && a.length === b.length;
-    }
 }
 //# sourceMappingURL=auth.service.js.map

package/dist/modules/auth/auth.service.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.service.js","sourceRoot":"","sources":["../../../src/modules/auth/auth.service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,GAAG,MAAM,cAAc,CAAC;AAC/B,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AAGjC,OAAO,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAE9C,OAAO,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAC;AAEvD,MAAM,WAAW,GAAG,4BAA4B,CAAC;AAEjD,SAAS,UAAU,CAAC,IAKnB;IACC,OAAO;QACL,EAAE,EAAE,IAAI,CAAC,EAAE;QACX,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,SAAS,EAAE,IAAI,CAAC,SAAS,IAAI,SAAS;KACvC,CAAC;AACJ,CAAC;AAED,MAAM,OAAO,WAAW;IAEH;IACA;IAFnB,YACmB,EAAY,EACZ,MAAkB;QADlB,OAAE,GAAF,EAAE,CAAU;QACZ,WAAM,GAAN,MAAM,CAAY;IAClC,CAAC;IAEJ,KAAK,CAAC,iBAAiB,CACrB,KAAa,EACb,QAAgB;QAEhB,MAAM,eAAe,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAE3D,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE,CAAC;YACvC,MAAM,IAAI,KAAK,CAAC,eAAe,CAAC,CAAC;QACnC,CAAC;QACD,IAAI,CAAC,mBAAmB,CAAC,eAAe,CAAC,CAAC;QAC1C,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,QAAQ,IAAI,EAAE,CAAC,EAAE,CAAC;YACxC,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAC;QACtC,CAAC;QAED,iEAAiE;QACjE,MAAM,WAAW,GAAG,eAAe,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,eAAe,CAAC;QACrE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,eAAe,EAAE,WAAW,CAAC,CAAC;QACxE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;IAChF,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,kBAAkB,CACtB,KAAa,EACb,IAAY;QAEZ,MAAM,eAAe,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAC3D,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE,CAAC;YACvC,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;QACjE,CAAC;QACD,IAAI,CAAC,mBAAmB,CAAC,eAAe,CAAC,CAAC;QAC1C,MAAM,WAAW,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,eAAe,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,eAAe,CAAC;QAC5F,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,eAAe,EAAE,WAAW,CAAC,CAAC;QACxE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;IAChF,CAAC;IAEO,SAAS,CAAC,MAAc,EAAE,KAAa;QAC7C,OAAO,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACjF,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,kBAAkB,CACtB,KAAa,EACb,IAAa;QAEb,MAAM,eAAe,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAC3D,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,eAAe,CAAC;YAAE,OAAO,IAAI,CAAC;QACpD,MAAM,WAAW,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,eAAe,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,eAAe,CAAC;QAC5F,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,eAAe,EAAE,WAAW,CAAC,CAAC;QACxE,OAAO,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;IAC7D,CAAC;IAEO,KAAK,CAAC,iBAAiB,CAAC,KAAa,EAAE,IAAY;QACzD,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,IAAI,CAAC,EAAE;aACzB,MAAM,CAAC,KAAK,CAAC;aACb,MAAM,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;aACvB,kBAAkB,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE,EAAE,CAAC;aAC3E,SAAS,EAAE,CAAC;QACf,OAAO,IAAI,CAAC;IACd,CAAC;IAED,WAAW,CAAC,KAAa;QACvB,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS,CAGtD,CAAC;QACF,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC;IAC1D,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,oBAAoB,CACxB,MAAmB;QAEnB,MAAM,MAAM,GAAG,IAAI,GAAG,EAAuD,CAAC;QAC9E,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC;YAAE,OAAO,MAAM,CAAC;QACrC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAChD,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,MAAM,CAAC,GAAG,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YAC/B,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;gBAAE,SAAS;YAC7B,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;QAClE,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,MAAc;QAC9B,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,IAAI,CAAC,EAAE;aACzB,MAAM,EAAE;aACR,IAAI,CAAC,KAAK,CAAC;aACX,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;aAC3B,KAAK,CAAC,CAAC,CAAC,CAAC;QAEZ,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC;QAEvB,OAAO;YACL,EAAE,EAAE,IAAI,CAAC,EAAE;YACX,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,SAAS,EAAE,IAAI,CAAC,SAAS,IAAI,SAAS;SACvC,CAAC;IACJ,CAAC;IAED;;;;;;;OAOG;IACH,oBAAoB,CAAC,KAAa;QAChC,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC;QAChD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACtC,MAAM,MAAM,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACtE,IAAI,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;QAC1B,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;IACvE,CAAC;IAED;;;;OAIG;IACK,mBAAmB,CAAC,eAAuB;QACjD,IAAI,CAAC,IAAI,CAAC,oBAAoB,CAAC,eAAe,CAAC,EAAE,CAAC;YAChD,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;QACjD,CAAC;IACH,CAAC;IAEO,aAAa,CAAC,QAAgB;QACpC,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC;QAC1C,oDAAoD;QACpD,IAAI,CAAC,QAAQ;YAAE,OAAO,KAAK,CAAC;QAE5B,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QACxC,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QACxC,gFAAgF;QAChF,2FAA2F;QAC3F,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;QACzC,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAClC,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAClC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAChB,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAChB,MAAM,KAAK,GAAG,eAAe,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAChD,OAAO,KAAK,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,CAAC;IACxC,CAAC;CACF"}
+{"version":3,"file":"auth.service.js","sourceRoot":"","sources":["../../../src/modules/auth/auth.service.ts"],"names":[],"mappings":"AAAA,OAAO,GAAG,MAAM,cAAc,CAAC;AAC/B,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AAGjC,OAAO,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAE9C,OAAO,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAC;AACvD,OAAO,EACL,YAAY,EACZ,cAAc,EACd,qBAAqB,EACrB,mBAAmB,GACpB,MAAM,oBAAoB,CAAC;AAE5B,MAAM,WAAW,GAAG,4BAA4B,CAAC;AAEjD;;;;;;GAMG;AACH,IAAI,gBAAgB,GAA2B,IAAI,CAAC;AACpD,SAAS,SAAS;IAChB,gBAAgB,KAAK,YAAY,CAAC,oCAAoC,CAAC,CAAC;IACxE,OAAO,gBAAgB,CAAC;AAC1B,CAAC;AAED,SAAS,UAAU,CAAC,IAKnB;IACC,OAAO;QACL,EAAE,EAAE,IAAI,CAAC,EAAE;QACX,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,SAAS,EAAE,IAAI,CAAC,SAAS,IAAI,SAAS;KACvC,CAAC;AACJ,CAAC;AAED,MAAM,OAAO,WAAW;IAEH;IACA;IAFnB,YACmB,EAAY,EACZ,MAAkB;QADlB,OAAE,GAAF,EAAE,CAAU;QACZ,WAAM,GAAN,MAAM,CAAY;IAClC,CAAC;IAEJ;;;;;;;;;;;;;;OAcG;IACH,KAAK,CAAC,iBAAiB,CACrB,KAAa,EACb,QAAgB;QAEhB,MAAM,eAAe,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAE3D,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE,CAAC;YACvC,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;QACzC,CAAC;QACD,IAAI,CAAC,mBAAmB,CAAC,eAAe,CAAC,CAAC;QAE1C,MAAM,QAAQ,GAAG,QAAQ,IAAI,EAAE,CAAC;QAChC,MAAM,UAAU,GACd,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC;YACjC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC;YACpC,eAAe,KAAK,IAAI,CAAC,MAAM,CAAC,UAAU;YAC1C,qBAAqB,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;QAE7D,IAAI,UAAU,EAAE,CAAC;YACf,MAAM,WAAW,GAAG,eAAe,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,eAAe,CAAC;YACrE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,eAAe,EAAE,WAAW,CAAC,CAAC;YACxE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QAChF,CAAC;QAED,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,IAAI,CAAC,EAAE;aACzB,MAAM,EAAE;aACR,IAAI,CAAC,KAAK,CAAC;aACX,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,eAAe,CAAC,CAAC;aACvC,KAAK,CAAC,CAAC,CAAC,CAAC;QACZ,0EAA0E;QAC1E,8DAA8D;QAC9D,kEAAkE;QAClE,wDAAwD;QACxD,MAAM,MAAM,GAAG,IAAI,EAAE,YAAY,IAAI,CAAC,MAAM,SAAS,EAAE,CAAC,CAAC;QACzD,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QACvD,IAAI,CAAC,IAAI,EAAE,YAAY,IAAI,CAAC,OAAO,EAAE,CAAC;YACpC,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;QACzC,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;IAChF,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,YAAY,CAChB,KAAa,EACb,IAAY;QAEZ,MAAM,eAAe,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAC3D,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE,CAAC;YACvC,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;QACvD,CAAC;QACD,IAAI,CAAC,mBAAmB,CAAC,eAAe,CAAC,CAAC;QAC1C,MAAM,WAAW,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,eAAe,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,eAAe,CAAC;QAC5F,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,eAAe,EAAE,WAAW,CAAC,CAAC;QACxE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;IAChF,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,aAAa,CACjB,KAAa,EACb,IAAwB,EACxB,QAAgB;QAEhB,MAAM,eAAe,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAC3D,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE,CAAC;YACvC,MAAM,IAAI,KAAK,CAAC,eAAe,CAAC,CAAC;QACnC,CAAC;QACD,IAAI,CAAC,mBAAmB,CAAC,eAAe,CAAC,CAAC;QAC1C,IAAI,CAAC,oBAAoB,CAAC,QAAQ,CAAC,CAAC;QACpC,MAAM,YAAY,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACzC,MAAM,WAAW,GAAG,YAAY,IAAI,eAAe,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,eAAe,CAAC;QACrF,MAAM,YAAY,GAAG,MAAM,YAAY,CAAC,QAAQ,CAAC,CAAC;QAClD,0EAA0E;QAC1E,oEAAoE;QACpE,sEAAsE;QACtE,mEAAmE;QACnE,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,IAAI,CAAC,EAAE;aACxB,MAAM,CAAC,KAAK,CAAC;aACb,MAAM,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,IAAI,EAAE,WAAW,EAAE,YAAY,EAAE,CAAC;aACnE,kBAAkB,CAAC;YAClB,MAAM,EAAE,KAAK,CAAC,KAAK;YACnB,GAAG,EAAE,YAAY;gBACf,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE;gBAC7D,CAAC,CAAC,EAAE,YAAY,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE;SAC5C,CAAC;aACD,SAAS,EAAE,CAAC;QACf,OAAO,UAAU,CAAC,GAAG,CAAC,CAAC;IACzB,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,cAAc,CAClB,MAAc,EACd,eAAmC,EACnC,WAAmB;QAEnB,IAAI,CAAC,oBAAoB,CAAC,WAAW,CAAC,CAAC;QACvC,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACvF,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC;QAC7C,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACtB,IAAI,CAAC,eAAe,IAAI,CAAC,CAAC,MAAM,cAAc,CAAC,eAAe,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,EAAE,CAAC;gBACpF,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;YACnD,CAAC;QACH,CAAC;QACD,MAAM,YAAY,GAAG,MAAM,YAAY,CAAC,WAAW,CAAC,CAAC;QACrD,MAAM,IAAI,CAAC,EAAE;aACV,MAAM,CAAC,KAAK,CAAC;aACb,GAAG,CAAC,EAAE,YAAY,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC;aAC5C,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC;IACjC,CAAC;IAED,gFAAgF;IAChF,KAAK,CAAC,YAAY;QAGhB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACrE,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YACxB,EAAE,EAAE,GAAG,CAAC,EAAE;YACV,KAAK,EAAE,GAAG,CAAC,KAAK;YAChB,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,WAAW,EAAE,GAAG,CAAC,YAAY,IAAI,IAAI;YACrC,SAAS,EAAE,GAAG,CAAC,SAAS;SACzB,CAAC,CAAC,CAAC;IACN,CAAC;IAEO,oBAAoB,CAAC,QAAgB;QAC3C,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,MAAM,GAAG,mBAAmB,EAAE,CAAC;YAClD,MAAM,IAAI,KAAK,CAAC,6BAA6B,mBAAmB,aAAa,CAAC,CAAC;QACjF,CAAC;IACH,CAAC;IAEO,SAAS,CAAC,MAAc,EAAE,KAAa;QAC7C,OAAO,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACjF,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,kBAAkB,CACtB,KAAa,EACb,IAAa;QAEb,MAAM,eAAe,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAC3D,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,eAAe,CAAC;YAAE,OAAO,IAAI,CAAC;QACpD,MAAM,WAAW,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,eAAe,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,eAAe,CAAC;QAC5F,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,eAAe,EAAE,WAAW,CAAC,CAAC;QACxE,OAAO,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;IAC7D,CAAC;IAEO,KAAK,CAAC,iBAAiB,CAAC,KAAa,EAAE,IAAY;QACzD,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,IAAI,CAAC,EAAE;aACzB,MAAM,CAAC,KAAK,CAAC;aACb,MAAM,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;aACvB,kBAAkB,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE,EAAE,CAAC;aAC3E,SAAS,EAAE,CAAC;QACf,OAAO,IAAI,CAAC;IACd,CAAC;IAED,WAAW,CAAC,KAAa;QACvB,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS,CAGtD,CAAC;QACF,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC;IAC1D,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,oBAAoB,CACxB,MAAmB;QAEnB,MAAM,MAAM,GAAG,IAAI,GAAG,EAAuD,CAAC;QAC9E,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC;YAAE,OAAO,MAAM,CAAC;QACrC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAChD,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,MAAM,CAAC,GAAG,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YAC/B,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;gBAAE,SAAS;YAC7B,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;QAClE,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,MAAc;QAC9B,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,IAAI,CAAC,EAAE;aACzB,MAAM,EAAE;aACR,IAAI,CAAC,KAAK,CAAC;aACX,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;aAC3B,KAAK,CAAC,CAAC,CAAC,CAAC;QAEZ,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC;QAEvB,OAAO;YACL,EAAE,EAAE,IAAI,CAAC,EAAE;YACX,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,SAAS,EAAE,IAAI,CAAC,SAAS,IAAI,SAAS;SACvC,CAAC;IACJ,CAAC;IAED;;;;;;;OAOG;IACH,oBAAoB,CAAC,KAAa;QAChC,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC;QAChD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACtC,MAAM,MAAM,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACtE,IAAI,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;QAC1B,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;IACvE,CAAC;IAED;;;;OAIG;IACK,mBAAmB,CAAC,eAAuB;QACjD,IAAI,CAAC,IAAI,CAAC,oBAAoB,CAAC,eAAe,CAAC,EAAE,CAAC;YAChD,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;QACjD,CAAC;IACH,CAAC;CAEF"}

package/dist/modules/auth/oidc-auth-provider.d.ts

@@ -0,0 +1,51 @@
+import type express from 'express';
+import type { AuthProviderPlugin } from './auth.routes.js';
+import type { AuthService } from './auth.service.js';
+export interface OidcAuthProviderOptions {
+    /** Issuer base URL; `<issuer>/.well-known/openid-configuration` must exist. */
+    issuerUrl: string;
+    clientId: string;
+    clientSecret: string;
+    /** Space-separated; must include `openid` (and `email` for most providers). */
+    scopes: string;
+    /** Login-button label shown by the login screen. */
+    label: string;
+    publicBackendUrl: string;
+    publicFrontendUrl: string;
+    /** See MicrosoftAuthDeps.cookieSecure — scheme-derived, not NODE_ENV. */
+    cookieSecure: boolean;
+    /** Injectable for tests; defaults to global fetch. */
+    fetchImpl?: typeof fetch;
+}
+/**
+ * Generic OIDC single sign-on as an {@link AuthProviderPlugin} — works with
+ * any spec-compliant provider (Entra, Okta, Auth0, Keycloak, Google, …),
+ * configured purely from the environment (see CoreConfig `oidc*`).
+ *
+ * Flow: authorization-code with PKCE (S256) as a confidential client.
+ * Identity claims come from the `userinfo` endpoint called with the freshly
+ * exchanged access token — the token arrived over TLS directly from the
+ * issuer's token endpoint, so no local id_token signature verification (and
+ * no JWKS handling) is needed to trust it.
+ *
+ * Register `<PUBLIC_BACKEND_URL>/api/auth/oidc/callback` as the redirect URI
+ * with the provider.
+ */
+export declare class OidcAuthProvider implements AuthProviderPlugin {
+    private readonly opts;
+    readonly key = "oidc";
+    readonly label: string;
+    readonly startPath = "/api/auth/oidc/login";
+    private readonly fetchImpl;
+    private discovery;
+    constructor(opts: OidcAuthProviderOptions);
+    /**
+     * Fetch + cache the issuer's discovery document. Resolved lazily (not at
+     * boot) so a temporarily unreachable issuer delays the first login instead
+     * of failing the whole deployment; a failed attempt is not cached.
+     */
+    private discover;
+    private redirectUri;
+    mountRoutes(router: express.Router, authService: AuthService): void;
+}
+//# sourceMappingURL=oidc-auth-provider.d.ts.map

package/dist/modules/auth/oidc-auth-provider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oidc-auth-provider.d.ts","sourceRoot":"","sources":["../../../src/modules/auth/oidc-auth-provider.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,OAAO,MAAM,SAAS,CAAC;AACnC,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAG3D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAcrD,MAAM,WAAW,uBAAuB;IACtC,+EAA+E;IAC/E,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,+EAA+E;IAC/E,MAAM,EAAE,MAAM,CAAC;IACf,oDAAoD;IACpD,KAAK,EAAE,MAAM,CAAC;IACd,gBAAgB,EAAE,MAAM,CAAC;IACzB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,yEAAyE;IACzE,YAAY,EAAE,OAAO,CAAC;IACtB,sDAAsD;IACtD,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;CAC1B;AAoBD;;;;;;;;;;;;;GAaG;AACH,qBAAa,gBAAiB,YAAW,kBAAkB;IAQ7C,OAAO,CAAC,QAAQ,CAAC,IAAI;IAPjC,QAAQ,CAAC,GAAG,UAAU;IACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,SAAS,0BAA0B;IAE5C,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAe;IACzC,OAAO,CAAC,SAAS,CAA8B;gBAElB,IAAI,EAAE,uBAAuB;IAK1D;;;;OAIG;YACW,QAAQ;IAiBtB,OAAO,CAAC,WAAW;IAInB,WAAW,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,WAAW,EAAE,WAAW,GAAG,IAAI;CAyHpE"}