@bevel-software/platform-core-backend 0.15.1 → 0.20.0

package/dist/modules/auth/auth.service.d.ts

@@ -12,6 +12,14 @@ export interface AuthConfig {
     adminEmail: string;
     adminPassword: string;
     allowedEmailDomains: string[];
+    /**
+     * Whether password sign-in is offered at all (`LOGIN_PASSWORD`, default
+     * true). With it off, `ADMIN_PASSWORD` is a credential nothing accepts, so
+     * the deployment admin is not reported as one whose password lives in the
+     * environment — the Account page would otherwise send them to a login
+     * method the deployment has switched off.
+     */
+    loginPasswordEnabled?: boolean;
 }
 export declare class AuthService {
     private readonly db;
@@ -25,10 +33,15 @@ export declare class AuthService {
      *     variable disables it immediately. Lets a fresh deployment sign in
      *     before any account exists.
      *  2. A per-user account: the `users` row's scrypt `password_hash`
-     *     (created by an admin from Roles & Members, or set by the user on
+     *     (created by an admin from App roles, or set by the user on
      *     their Account page). Accounts that only ever signed in via SSO have
      *     no hash and are refused here.
      *
+     * The two are alternatives, not a fallback chain: source 1 never falls
+     * through to source 2, so the deployment admin is refused outright when the
+     * environment password is wrong — see the guard below for why a hash on
+     * that row must not become a second way in.
+     *
      * A generic "Invalid credentials" error for every failure mode — never
      * reveal whether the email exists or has a password.
      */
@@ -48,25 +61,85 @@ export declare class AuthService {
         user: AuthUser;
     }>;
     /**
-     * Admin-driven account provisioning (Roles & Members → Accounts). Upserts
+     * Admin-driven account provisioning (App roles → Accounts). Upserts
      * the user by email and sets their password — re-provisioning an existing
      * account (e.g. one that first arrived via SSO, or a reset for a locked-out
      * user) is deliberate admin behavior, not an error.
+     *
+     * The deployment admin is the one target this refuses, for the reason
+     * {@link changePassword} refuses it: that account's password is the
+     * environment's, so a stored hash would not replace it but ADD a second
+     * credential — one that keeps signing in after `ADMIN_PASSWORD` is rotated,
+     * and that the deployment owner never chose. The refusal belongs here and
+     * not only on the page, because this is the route any other admin reaches
+     * with an arbitrary email.
      */
     createAccount(email: string, name: string | undefined, password: string): Promise<AuthUser>;
+    /**
+     * Is `email` the deployment admin — the account whose password is set in
+     * the deployment environment (`ADMIN_EMAIL` while `ADMIN_PASSWORD` is set)
+     * rather than stored on its row? The single definition behind
+     * {@link loginWithPassword} (which accepts only the environment password
+     * for it), {@link changePassword} and {@link createAccount} (which both
+     * refuse to store a hash for it), so those three can never disagree about
+     * who the deployment admin is. `email` must already be canonical.
+     *
+     * Independent of whether password sign-in is switched on: the refusals
+     * hold while it is off too, or a hash could be stored for that address in
+     * the meantime — a credential the row is never meant to carry. What a
+     * client is TOLD does follow the switch: {@link reportsAsEnvAdmin}.
+     */
+    private isEnvAdminEmail;
+    /**
+     * Whether a client is told `email` is the deployment admin — behind
+     * {@link toClientUser} and {@link listAccounts}. The identity is
+     * {@link isEnvAdminEmail}; the switch is password sign-in: with
+     * `LOGIN_PASSWORD=false`, `ADMIN_PASSWORD` is a credential nothing accepts,
+     * and reporting the account as the environment's admin would send its
+     * owner to a login method the deployment does not offer.
+     */
+    private reportsAsEnvAdmin;
+    /**
+     * {@link toAuthUser} plus the one fact that is not on the row: whether this
+     * is the deployment admin. Computed from the configuration on each read
+     * rather than stored, so unsetting `ADMIN_PASSWORD` turns the flag off at
+     * once and the account goes back to being an ordinary one — the same
+     * reasoning that keeps the credential itself out of the database. Every
+     * path that hands a user to a client goes through here, so the Account page
+     * sees the same answer whether it came from a fresh login or `/auth/me`.
+     */
+    private toClientUser;
     /**
      * Self-service password change (the Account page). The current password is
      * required whenever one is set; an SSO-only account (no hash yet) may set
-     * its first password without one. The env bootstrap-admin credential is not
-     * affected — it lives in the environment, not in this row.
+     * its first password without one.
+     *
+     * The deployment admin is refused outright. Its password lives in the
+     * environment, so a stored hash would not replace it: both credentials
+     * would then sign in, the planted one would survive rotating
+     * `ADMIN_PASSWORD`, and every later change typing the environment password
+     * as the current one would be refused against that stray hash. Worse, the
+     * account starts with no hash, so without this guard the "SSO-only first
+     * password" path below accepts a WRONG current password — any holder of the
+     * session could plant a lasting credential without knowing one. The
+     * environment password is the platform's rescue path into a deployment and
+     * is changed there, which is what the Account page says in place of the
+     * form.
      */
     changePassword(userId: string, currentPassword: string | undefined, newPassword: string): Promise<void>;
-    /** Accounts overview for the admin management screen (never exposes hashes). */
+    /**
+     * Accounts overview for the admin management screen (never exposes hashes).
+     * The two password facts are independent: `hasPassword` is a stored hash;
+     * `isEnvAdmin` is the env bootstrap credential (`ADMIN_EMAIL` while
+     * `ADMIN_PASSWORD` is set), which signs in whether or not a hash exists —
+     * the same condition {@link loginWithPassword} checks first.
+     */
     listAccounts(): Promise<Array<{
         id: string;
         email: string;
         name: string;
         hasPassword: boolean;
+        isEnvAdmin: boolean;
         createdAt: Date;
     }>>;
     private assertPasswordPolicy;
@@ -105,6 +178,17 @@ export declare class AuthService {
         name: string;
     }>>;
     getUserById(userId: string): Promise<AuthUser | null>;
+    /**
+     * The account at this ADDRESS, or null when none answers to it.
+     *
+     * By address rather than by id because some work outlives the session that
+     * asked for it: a recorded plugin join request carries the requester's
+     * email — the same key its branch is cut from — and the sweep that resumes
+     * it after a restart has no session and no id to resolve the author from.
+     * Canonicalised on the way in, like every other lookup here, so the stored
+     * spelling of an address is never what decides whether it is found.
+     */
+    getUserByEmail(email: string): Promise<AuthUser | null>;
     /**
      * Conclude the connect-your-agent onboarding for `userId`. Idempotent by
      * construction (an UPDATE to the value it already has), so the welcome

package/dist/modules/auth/auth.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.service.d.ts","sourceRoot":"","sources":["../../../src/modules/auth/auth.service.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,2BAA2B,CAAC;AAG1D,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iCAAiC,CAAC;AA8ChE;;;;;;GAMG;AACH,MAAM,WAAW,UAAU;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;IACtB,mBAAmB,EAAE,MAAM,EAAE,CAAC;CAC/B;AAED,qBAAa,WAAW;IAEpB,OAAO,CAAC,QAAQ,CAAC,EAAE;IACnB,OAAO,CAAC,QAAQ,CAAC,MAAM;gBADN,EAAE,EAAE,QAAQ,EACZ,MAAM,EAAE,UAAU;IAGrC;;;;;;;;;;;;;;OAcG;IACG,iBAAiB,CACrB,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,QAAQ,CAAA;KAAE,CAAC;IAqC7C;;;;;;OAMG;IACG,YAAY,CAChB,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,MAAM,GACX,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,QAAQ,CAAA;KAAE,CAAC;IAW7C;;;;;OAKG;IACG,aAAa,CACjB,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,QAAQ,CAAC;IA0BpB;;;;;OAKG;IACG,cAAc,CAClB,MAAM,EAAE,MAAM,EACd,eAAe,EAAE,MAAM,GAAG,SAAS,EACnC,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,IAAI,CAAC;IAgBhB,gFAAgF;IAC1E,YAAY,IAAI,OAAO,CAC3B,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,OAAO,CAAC;QAAC,SAAS,EAAE,IAAI,CAAA;KAAE,CAAC,CAC1F;IAWD,OAAO,CAAC,oBAAoB;IAM5B,OAAO,CAAC,SAAS;IAIjB;;;;;;;OAOG;IACG,kBAAkB,CACtB,KAAK,EAAE,MAAM,EACb,IAAI,CAAC,EAAE,MAAM,GACZ,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;YAQhD,iBAAiB;IAS/B,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE;IAQ7D;;;;;;;;;OASG;IACG,oBAAoB,CACxB,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,GAClB,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAY9D,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;IAY3D;;;;;;OAMG;IACG,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAOvD;;;;;;;;OAQG;IACH,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;IAQ5C;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,mBAAmB;CAM5B"}
+{"version":3,"file":"auth.service.d.ts","sourceRoot":"","sources":["../../../src/modules/auth/auth.service.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,2BAA2B,CAAC;AAG1D,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iCAAiC,CAAC;AAuDhE;;;;;;GAMG;AACH,MAAM,WAAW,UAAU;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;IACtB,mBAAmB,EAAE,MAAM,EAAE,CAAC;IAC9B;;;;;;OAMG;IACH,oBAAoB,CAAC,EAAE,OAAO,CAAC;CAChC;AAED,qBAAa,WAAW;IAEpB,OAAO,CAAC,QAAQ,CAAC,EAAE;IACnB,OAAO,CAAC,QAAQ,CAAC,MAAM;gBADN,EAAE,EAAE,QAAQ,EACZ,MAAM,EAAE,UAAU;IAGrC;;;;;;;;;;;;;;;;;;;OAmBG;IACG,iBAAiB,CACrB,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,QAAQ,CAAA;KAAE,CAAC;IA8D7C;;;;;;OAMG;IACG,YAAY,CAChB,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,MAAM,GACX,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,QAAQ,CAAA;KAAE,CAAC;IAW7C;;;;;;;;;;;;;OAaG;IACG,aAAa,CACjB,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,QAAQ,CAAC;IA+BpB;;;;;;;;;;;;;OAaG;IACH,OAAO,CAAC,eAAe;IAQvB;;;;;;;OAOG;IACH,OAAO,CAAC,iBAAiB;IAIzB;;;;;;;;OAQG;IACH,OAAO,CAAC,YAAY;IAIpB;;;;;;;;;;;;;;;;OAgBG;IACG,cAAc,CAClB,MAAM,EAAE,MAAM,EACd,eAAe,EAAE,MAAM,GAAG,SAAS,EACnC,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,IAAI,CAAC;IAqBhB;;;;;;OAMG;IACG,YAAY,IAAI,OAAO,CAC3B,KAAK,CAAC;QACJ,EAAE,EAAE,MAAM,CAAC;QACX,KAAK,EAAE,MAAM,CAAC;QACd,IAAI,EAAE,MAAM,CAAC;QACb,WAAW,EAAE,OAAO,CAAC;QACrB,UAAU,EAAE,OAAO,CAAC;QACpB,SAAS,EAAE,IAAI,CAAC;KACjB,CAAC,CACH;IAYD,OAAO,CAAC,oBAAoB;IAM5B,OAAO,CAAC,SAAS;IAIjB;;;;;;;OAOG;IACG,kBAAkB,CACtB,KAAK,EAAE,MAAM,EACb,IAAI,CAAC,EAAE,MAAM,GACZ,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;YAQhD,iBAAiB;IAS/B,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE;IAQ7D;;;;;;;;;OASG;IACG,oBAAoB,CACxB,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,GAClB,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAY9D,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;IAY3D;;;;;;;;;OASG;IACG,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;IAY7D;;;;;;OAMG;IACG,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAOvD;;;;;;;;OAQG;IACH,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;IAQ5C;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,mBAAmB;CAM5B"}

package/dist/modules/auth/auth.service.js

@@ -1,9 +1,16 @@
 import jwt from 'jsonwebtoken';
 import { eq } from 'drizzle-orm';
 import { users } from '../database/schema.js';
-import { hashEmail } from '../../shared/hash-email.js';
+import { canonicalEmail, hashEmail } from '../../shared/email-identity.js';
 import { hashPassword, verifyPassword, timingSafeStringEqual, MIN_PASSWORD_LENGTH, } from './password-hash.js';
 const EMAIL_REGEX = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
+/**
+ * What every caller is told when it tries to give the deployment admin a
+ * stored password — the Account page's own change and an admin's "Set
+ * password" on the User Accounts page alike. One sentence in one place, so the
+ * two surfaces cannot end up explaining the same rule differently.
+ */
+const ENV_ADMIN_PASSWORD_REFUSAL = "This account's password is set in the deployment environment and cannot be changed here";
 /**
  * Decoy hash verified when the email is unknown or has no password set, so
  * those paths cost the same scrypt work as a real wrong-password attempt —
@@ -46,33 +53,63 @@ export class AuthService {
      *     variable disables it immediately. Lets a fresh deployment sign in
      *     before any account exists.
      *  2. A per-user account: the `users` row's scrypt `password_hash`
-     *     (created by an admin from Roles & Members, or set by the user on
+     *     (created by an admin from App roles, or set by the user on
      *     their Account page). Accounts that only ever signed in via SSO have
      *     no hash and are refused here.
      *
+     * The two are alternatives, not a fallback chain: source 1 never falls
+     * through to source 2, so the deployment admin is refused outright when the
+     * environment password is wrong — see the guard below for why a hash on
+     * that row must not become a second way in.
+     *
      * A generic "Invalid credentials" error for every failure mode — never
      * reveal whether the email exists or has a password.
      */
     async loginWithPassword(email, password) {
-        const normalizedEmail = (email ?? '').trim().toLowerCase();
+        const normalizedEmail = canonicalEmail(email ?? '');
         if (!EMAIL_REGEX.test(normalizedEmail)) {
             throw new Error('Invalid credentials');
         }
         const provided = password ?? '';
-        const isEnvAdmin = this.config.adminEmail.length > 0 &&
-            this.config.adminPassword.length > 0 &&
-            normalizedEmail === this.config.adminEmail &&
-            timingSafeStringEqual(provided, this.config.adminPassword);
-        if (isEnvAdmin) {
-            const defaultName = normalizedEmail.split('@')[0] || normalizedEmail;
-            const user = await this.upsertUserByEmail(normalizedEmail, defaultName);
-            return { token: this.signToken(user.id, user.email), user: toAuthUser(user) };
-        }
+        // Looked up for EVERY email, including the deployment admin's, whose hash
+        // is then ignored below. Skipping the query for that one address would
+        // make its wrong-password response measurably cheaper than every other
+        // address's — one round trip short — and repeated timings would then
+        // disclose which email the deployment configured as `ADMIN_EMAIL`. The
+        // decoy hash already buys that uniformity for the scrypt half; this keeps
+        // the database half uniform too.
         const [user] = await this.db
             .select()
             .from(users)
             .where(eq(users.email, normalizedEmail))
             .limit(1);
+        if (this.isEnvAdminEmail(normalizedEmail)) {
+            // While `ADMIN_PASSWORD` is set, the environment's password is this
+            // account's ONLY credential — the row was read above, but its hash is
+            // never consulted for this address. A hash can still be sitting on that
+            // row (planted before this rule existed, or left by an ordinary account
+            // that only later became `ADMIN_EMAIL`), and accepting it would defeat
+            // the point of refusing to write new ones: rotating `ADMIN_PASSWORD`
+            // would leave the old credential signing in.
+            //
+            // Refused rather than deleted, deliberately. The rule is reversible the
+            // same way every other env-admin fact is — unset `ADMIN_PASSWORD` and
+            // the identity goes back to being an ordinary account, stored password
+            // included, exactly as `isEnvAdmin` stops being reported — and a login
+            // path that destroys credentials would be a far worse thing to get
+            // wrong than one that ignores them.
+            if (!timingSafeStringEqual(provided, this.config.adminPassword)) {
+                // One scrypt verification here too — against the decoy, never against
+                // `user`'s hash — so that together with the lookup above a wrong
+                // password for this address costs what a wrong password for any other
+                // address does.
+                await verifyPassword(provided, await decoyHash());
+                throw new Error('Invalid credentials');
+            }
+            const defaultName = normalizedEmail.split('@')[0] || normalizedEmail;
+            const admin = await this.upsertUserByEmail(normalizedEmail, defaultName);
+            return { token: this.signToken(admin.id, admin.email), user: this.toClientUser(admin) };
+        }
         // Always run one scrypt verification — against the stored hash when there
         // is one, against the decoy otherwise — so unknown emails and
         // password-less (SSO-only) accounts take the same time as a wrong
@@ -82,7 +119,7 @@ export class AuthService {
         if (!user?.passwordHash || !matches) {
             throw new Error('Invalid credentials');
         }
-        return { token: this.signToken(user.id, user.email), user: toAuthUser(user) };
+        return { token: this.signToken(user.id, user.email), user: this.toClientUser(user) };
     }
     /**
      * Establish a session for a user whose identity an SSO provider (the
@@ -92,26 +129,39 @@ export class AuthService {
      * in via SSO (same email) keeps the same account/id.
      */
     async loginWithSso(email, name) {
-        const normalizedEmail = (email ?? '').trim().toLowerCase();
+        const normalizedEmail = canonicalEmail(email ?? '');
         if (!EMAIL_REGEX.test(normalizedEmail)) {
             throw new Error('Sign-in returned an invalid email');
         }
         this.assertAllowedDomain(normalizedEmail);
         const displayName = (name ?? '').trim() || normalizedEmail.split('@')[0] || normalizedEmail;
         const user = await this.upsertUserByEmail(normalizedEmail, displayName);
-        return { token: this.signToken(user.id, user.email), user: toAuthUser(user) };
+        return { token: this.signToken(user.id, user.email), user: this.toClientUser(user) };
     }
     /**
-     * Admin-driven account provisioning (Roles & Members → Accounts). Upserts
+     * Admin-driven account provisioning (App roles → Accounts). Upserts
      * the user by email and sets their password — re-provisioning an existing
      * account (e.g. one that first arrived via SSO, or a reset for a locked-out
      * user) is deliberate admin behavior, not an error.
+     *
+     * The deployment admin is the one target this refuses, for the reason
+     * {@link changePassword} refuses it: that account's password is the
+     * environment's, so a stored hash would not replace it but ADD a second
+     * credential — one that keeps signing in after `ADMIN_PASSWORD` is rotated,
+     * and that the deployment owner never chose. The refusal belongs here and
+     * not only on the page, because this is the route any other admin reaches
+     * with an arbitrary email.
      */
     async createAccount(email, name, password) {
-        const normalizedEmail = (email ?? '').trim().toLowerCase();
+        const normalizedEmail = canonicalEmail(email ?? '');
         if (!EMAIL_REGEX.test(normalizedEmail)) {
             throw new Error('Invalid email');
         }
+        // Before the policy check, so the refusal names the real reason rather
+        // than sending the admin off to pick a longer password first.
+        if (this.isEnvAdminEmail(normalizedEmail)) {
+            throw new Error(ENV_ADMIN_PASSWORD_REFUSAL);
+        }
         this.assertPasswordPolicy(password);
         const suppliedName = (name ?? '').trim();
         const displayName = suppliedName || normalizedEmail.split('@')[0] || normalizedEmail;
@@ -130,19 +180,77 @@ export class AuthService {
                 : { passwordHash, updatedAt: new Date() },
         })
             .returning();
-        return toAuthUser(row);
+        return this.toClientUser(row);
+    }
+    /**
+     * Is `email` the deployment admin — the account whose password is set in
+     * the deployment environment (`ADMIN_EMAIL` while `ADMIN_PASSWORD` is set)
+     * rather than stored on its row? The single definition behind
+     * {@link loginWithPassword} (which accepts only the environment password
+     * for it), {@link changePassword} and {@link createAccount} (which both
+     * refuse to store a hash for it), so those three can never disagree about
+     * who the deployment admin is. `email` must already be canonical.
+     *
+     * Independent of whether password sign-in is switched on: the refusals
+     * hold while it is off too, or a hash could be stored for that address in
+     * the meantime — a credential the row is never meant to carry. What a
+     * client is TOLD does follow the switch: {@link reportsAsEnvAdmin}.
+     */
+    isEnvAdminEmail(email) {
+        return (this.config.adminEmail.length > 0 &&
+            this.config.adminPassword.length > 0 &&
+            email === this.config.adminEmail);
+    }
+    /**
+     * Whether a client is told `email` is the deployment admin — behind
+     * {@link toClientUser} and {@link listAccounts}. The identity is
+     * {@link isEnvAdminEmail}; the switch is password sign-in: with
+     * `LOGIN_PASSWORD=false`, `ADMIN_PASSWORD` is a credential nothing accepts,
+     * and reporting the account as the environment's admin would send its
+     * owner to a login method the deployment does not offer.
+     */
+    reportsAsEnvAdmin(email) {
+        return (this.config.loginPasswordEnabled ?? true) && this.isEnvAdminEmail(email);
+    }
+    /**
+     * {@link toAuthUser} plus the one fact that is not on the row: whether this
+     * is the deployment admin. Computed from the configuration on each read
+     * rather than stored, so unsetting `ADMIN_PASSWORD` turns the flag off at
+     * once and the account goes back to being an ordinary one — the same
+     * reasoning that keeps the credential itself out of the database. Every
+     * path that hands a user to a client goes through here, so the Account page
+     * sees the same answer whether it came from a fresh login or `/auth/me`.
+     */
+    toClientUser(user) {
+        return { ...toAuthUser(user), isEnvAdmin: this.reportsAsEnvAdmin(user.email) };
     }
     /**
      * Self-service password change (the Account page). The current password is
      * required whenever one is set; an SSO-only account (no hash yet) may set
-     * its first password without one. The env bootstrap-admin credential is not
-     * affected — it lives in the environment, not in this row.
+     * its first password without one.
+     *
+     * The deployment admin is refused outright. Its password lives in the
+     * environment, so a stored hash would not replace it: both credentials
+     * would then sign in, the planted one would survive rotating
+     * `ADMIN_PASSWORD`, and every later change typing the environment password
+     * as the current one would be refused against that stray hash. Worse, the
+     * account starts with no hash, so without this guard the "SSO-only first
+     * password" path below accepts a WRONG current password — any holder of the
+     * session could plant a lasting credential without knowing one. The
+     * environment password is the platform's rescue path into a deployment and
+     * is changed there, which is what the Account page says in place of the
+     * form.
      */
     async changePassword(userId, currentPassword, newPassword) {
-        this.assertPasswordPolicy(newPassword);
         const [user] = await this.db.select().from(users).where(eq(users.id, userId)).limit(1);
         if (!user)
             throw new Error('User not found');
+        // Before the policy check, so the deployment admin is told the real reason
+        // rather than being sent to fix a password that would be refused anyway.
+        if (this.isEnvAdminEmail(user.email)) {
+            throw new Error(ENV_ADMIN_PASSWORD_REFUSAL);
+        }
+        this.assertPasswordPolicy(newPassword);
         if (user.passwordHash) {
             if (!currentPassword || !(await verifyPassword(currentPassword, user.passwordHash))) {
                 throw new Error('Current password is incorrect');
@@ -154,7 +262,13 @@ export class AuthService {
             .set({ passwordHash, updatedAt: new Date() })
             .where(eq(users.id, userId));
     }
-    /** Accounts overview for the admin management screen (never exposes hashes). */
+    /**
+     * Accounts overview for the admin management screen (never exposes hashes).
+     * The two password facts are independent: `hasPassword` is a stored hash;
+     * `isEnvAdmin` is the env bootstrap credential (`ADMIN_EMAIL` while
+     * `ADMIN_PASSWORD` is set), which signs in whether or not a hash exists —
+     * the same condition {@link loginWithPassword} checks first.
+     */
     async listAccounts() {
         const rows = await this.db.select().from(users).orderBy(users.email);
         return rows.map((row) => ({
@@ -162,6 +276,7 @@ export class AuthService {
             email: row.email,
             name: row.name,
             hasPassword: row.passwordHash != null,
+            isEnvAdmin: this.reportsAsEnvAdmin(row.email),
             createdAt: row.createdAt,
         }));
     }
@@ -182,7 +297,7 @@ export class AuthService {
      * same account/id. Returns `null` for a malformed email.
      */
     async getOrCreateByEmail(email, name) {
-        const normalizedEmail = (email ?? '').trim().toLowerCase();
+        const normalizedEmail = canonicalEmail(email ?? '');
         if (!EMAIL_REGEX.test(normalizedEmail))
             return null;
         const displayName = (name ?? '').trim() || normalizedEmail.split('@')[0] || normalizedEmail;
@@ -232,7 +347,27 @@ export class AuthService {
             .limit(1);
         if (!user)
             return null;
-        return toAuthUser(user);
+        return this.toClientUser(user);
+    }
+    /**
+     * The account at this ADDRESS, or null when none answers to it.
+     *
+     * By address rather than by id because some work outlives the session that
+     * asked for it: a recorded plugin join request carries the requester's
+     * email — the same key its branch is cut from — and the sweep that resumes
+     * it after a restart has no session and no id to resolve the author from.
+     * Canonicalised on the way in, like every other lookup here, so the stored
+     * spelling of an address is never what decides whether it is found.
+     */
+    async getUserByEmail(email) {
+        const [user] = await this.db
+            .select()
+            .from(users)
+            .where(eq(users.email, canonicalEmail(email ?? '')))
+            .limit(1);
+        if (!user)
+            return null;
+        return this.toClientUser(user);
     }
     /**
      * Conclude the connect-your-agent onboarding for `userId`. Idempotent by
@@ -260,7 +395,7 @@ export class AuthService {
         const allowed = this.config.allowedEmailDomains;
         if (allowed.length === 0)
             return true;
-        const domain = (email ?? '').trim().toLowerCase().split('@')[1] ?? '';
+        const domain = canonicalEmail(email ?? '').split('@')[1] ?? '';
         if (!domain)
             return false;
         return allowed.some((d) => domain === d || domain.endsWith(`.${d}`));

package/dist/modules/auth/auth.service.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.service.js","sourceRoot":"","sources":["../../../src/modules/auth/auth.service.ts"],"names":[],"mappings":"AAAA,OAAO,GAAG,MAAM,cAAc,CAAC;AAC/B,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AAGjC,OAAO,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAE9C,OAAO,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAC;AACvD,OAAO,EACL,YAAY,EACZ,cAAc,EACd,qBAAqB,EACrB,mBAAmB,GACpB,MAAM,oBAAoB,CAAC;AAE5B,MAAM,WAAW,GAAG,4BAA4B,CAAC;AAEjD;;;;;;GAMG;AACH,IAAI,gBAAgB,GAA2B,IAAI,CAAC;AACpD,SAAS,SAAS;IAChB,gBAAgB,KAAK,YAAY,CAAC,oCAAoC,CAAC,CAAC;IACxE,OAAO,gBAAgB,CAAC;AAC1B,CAAC;AAED;;;;;GAKG;AACH,SAAS,UAAU,CAAC,IAMnB;IACC,OAAO;QACL,EAAE,EAAE,IAAI,CAAC,EAAE;QACX,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,SAAS,EAAE,IAAI,CAAC,SAAS,IAAI,SAAS;QACtC,cAAc,EAAE,IAAI,CAAC,cAAc;KACpC,CAAC;AACJ,CAAC;AAgBD,MAAM,OAAO,WAAW;IAEH;IACA;IAFnB,YACmB,EAAY,EACZ,MAAkB;QADlB,OAAE,GAAF,EAAE,CAAU;QACZ,WAAM,GAAN,MAAM,CAAY;IAClC,CAAC;IAEJ;;;;;;;;;;;;;;OAcG;IACH,KAAK,CAAC,iBAAiB,CACrB,KAAa,EACb,QAAgB;QAEhB,MAAM,eAAe,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAE3D,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE,CAAC;YACvC,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;QACzC,CAAC;QAED,MAAM,QAAQ,GAAG,QAAQ,IAAI,EAAE,CAAC;QAChC,MAAM,UAAU,GACd,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC;YACjC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC;YACpC,eAAe,KAAK,IAAI,CAAC,MAAM,CAAC,UAAU;YAC1C,qBAAqB,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;QAE7D,IAAI,UAAU,EAAE,CAAC;YACf,MAAM,WAAW,GAAG,eAAe,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,eAAe,CAAC;YACrE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,eAAe,EAAE,WAAW,CAAC,CAAC;YACxE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QAChF,CAAC;QAED,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,IAAI,CAAC,EAAE;aACzB,MAAM,EAAE;aACR,IAAI,CAAC,KAAK,CAAC;aACX,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,eAAe,CAAC,CAAC;aACvC,KAAK,CAAC,CAAC,CAAC,CAAC;QACZ,0EAA0E;QAC1E,8DAA8D;QAC9D,kEAAkE;QAClE,wDAAwD;QACxD,MAAM,MAAM,GAAG,IAAI,EAAE,YAAY,IAAI,CAAC,MAAM,SAAS,EAAE,CAAC,CAAC;QACzD,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QACvD,IAAI,CAAC,IAAI,EAAE,YAAY,IAAI,CAAC,OAAO,EAAE,CAAC;YACpC,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;QACzC,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;IAChF,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,YAAY,CAChB,KAAa,EACb,IAAY;QAEZ,MAAM,eAAe,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAC3D,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE,CAAC;YACvC,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;QACvD,CAAC;QACD,IAAI,CAAC,mBAAmB,CAAC,eAAe,CAAC,CAAC;QAC1C,MAAM,WAAW,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,eAAe,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,eAAe,CAAC;QAC5F,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,eAAe,EAAE,WAAW,CAAC,CAAC;QACxE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;IAChF,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,aAAa,CACjB,KAAa,EACb,IAAwB,EACxB,QAAgB;QAEhB,MAAM,eAAe,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAC3D,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE,CAAC;YACvC,MAAM,IAAI,KAAK,CAAC,eAAe,CAAC,CAAC;QACnC,CAAC;QACD,IAAI,CAAC,oBAAoB,CAAC,QAAQ,CAAC,CAAC;QACpC,MAAM,YAAY,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACzC,MAAM,WAAW,GAAG,YAAY,IAAI,eAAe,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,eAAe,CAAC;QACrF,MAAM,YAAY,GAAG,MAAM,YAAY,CAAC,QAAQ,CAAC,CAAC;QAClD,0EAA0E;QAC1E,oEAAoE;QACpE,sEAAsE;QACtE,mEAAmE;QACnE,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,IAAI,CAAC,EAAE;aACxB,MAAM,CAAC,KAAK,CAAC;aACb,MAAM,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,IAAI,EAAE,WAAW,EAAE,YAAY,EAAE,CAAC;aACnE,kBAAkB,CAAC;YAClB,MAAM,EAAE,KAAK,CAAC,KAAK;YACnB,GAAG,EAAE,YAAY;gBACf,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE;gBAC7D,CAAC,CAAC,EAAE,YAAY,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE;SAC5C,CAAC;aACD,SAAS,EAAE,CAAC;QACf,OAAO,UAAU,CAAC,GAAG,CAAC,CAAC;IACzB,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,cAAc,CAClB,MAAc,EACd,eAAmC,EACnC,WAAmB;QAEnB,IAAI,CAAC,oBAAoB,CAAC,WAAW,CAAC,CAAC;QACvC,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACvF,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC;QAC7C,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACtB,IAAI,CAAC,eAAe,IAAI,CAAC,CAAC,MAAM,cAAc,CAAC,eAAe,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,EAAE,CAAC;gBACpF,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;YACnD,CAAC;QACH,CAAC;QACD,MAAM,YAAY,GAAG,MAAM,YAAY,CAAC,WAAW,CAAC,CAAC;QACrD,MAAM,IAAI,CAAC,EAAE;aACV,MAAM,CAAC,KAAK,CAAC;aACb,GAAG,CAAC,EAAE,YAAY,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC;aAC5C,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC;IACjC,CAAC;IAED,gFAAgF;IAChF,KAAK,CAAC,YAAY;QAGhB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACrE,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YACxB,EAAE,EAAE,GAAG,CAAC,EAAE;YACV,KAAK,EAAE,GAAG,CAAC,KAAK;YAChB,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,WAAW,EAAE,GAAG,CAAC,YAAY,IAAI,IAAI;YACrC,SAAS,EAAE,GAAG,CAAC,SAAS;SACzB,CAAC,CAAC,CAAC;IACN,CAAC;IAEO,oBAAoB,CAAC,QAAgB;QAC3C,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,MAAM,GAAG,mBAAmB,EAAE,CAAC;YAClD,MAAM,IAAI,KAAK,CAAC,6BAA6B,mBAAmB,aAAa,CAAC,CAAC;QACjF,CAAC;IACH,CAAC;IAEO,SAAS,CAAC,MAAc,EAAE,KAAa;QAC7C,OAAO,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACjF,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,kBAAkB,CACtB,KAAa,EACb,IAAa;QAEb,MAAM,eAAe,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAC3D,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,eAAe,CAAC;YAAE,OAAO,IAAI,CAAC;QACpD,MAAM,WAAW,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,eAAe,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,eAAe,CAAC;QAC5F,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,eAAe,EAAE,WAAW,CAAC,CAAC;QACxE,OAAO,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;IAC7D,CAAC;IAEO,KAAK,CAAC,iBAAiB,CAAC,KAAa,EAAE,IAAY;QACzD,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,IAAI,CAAC,EAAE;aACzB,MAAM,CAAC,KAAK,CAAC;aACb,MAAM,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;aACvB,kBAAkB,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE,EAAE,CAAC;aAC3E,SAAS,EAAE,CAAC;QACf,OAAO,IAAI,CAAC;IACd,CAAC;IAED,WAAW,CAAC,KAAa;QACvB,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS,CAGtD,CAAC;QACF,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC;IAC1D,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,oBAAoB,CACxB,MAAmB;QAEnB,MAAM,MAAM,GAAG,IAAI,GAAG,EAAuD,CAAC;QAC9E,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC;YAAE,OAAO,MAAM,CAAC;QACrC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAChD,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,MAAM,CAAC,GAAG,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YAC/B,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;gBAAE,SAAS;YAC7B,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;QAClE,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,MAAc;QAC9B,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,IAAI,CAAC,EAAE;aACzB,MAAM,EAAE;aACR,IAAI,CAAC,KAAK,CAAC;aACX,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;aAC3B,KAAK,CAAC,CAAC,CAAC,CAAC;QAEZ,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC;QAEvB,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,kBAAkB,CAAC,MAAc;QACrC,MAAM,IAAI,CAAC,EAAE;aACV,MAAM,CAAC,KAAK,CAAC;aACb,GAAG,CAAC,EAAE,cAAc,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC;aACpD,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC;IACjC,CAAC;IAED;;;;;;;;OAQG;IACH,oBAAoB,CAAC,KAAa;QAChC,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC;QAChD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACtC,MAAM,MAAM,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACtE,IAAI,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;QAC1B,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;IACvE,CAAC;IAED;;;;;;;;;;;;OAYG;IACK,mBAAmB,CAAC,eAAuB;QACjD,IAAI,CAAC,IAAI,CAAC,oBAAoB,CAAC,eAAe,CAAC,EAAE,CAAC;YAChD,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;QACjD,CAAC;IACH,CAAC;CAEF"}
+{"version":3,"file":"auth.service.js","sourceRoot":"","sources":["../../../src/modules/auth/auth.service.ts"],"names":[],"mappings":"AAAA,OAAO,GAAG,MAAM,cAAc,CAAC;AAC/B,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AAGjC,OAAO,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAE9C,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,gCAAgC,CAAC;AAC3E,OAAO,EACL,YAAY,EACZ,cAAc,EACd,qBAAqB,EACrB,mBAAmB,GACpB,MAAM,oBAAoB,CAAC;AAE5B,MAAM,WAAW,GAAG,4BAA4B,CAAC;AAEjD;;;;;GAKG;AACH,MAAM,0BAA0B,GAC9B,yFAAyF,CAAC;AAE5F;;;;;;GAMG;AACH,IAAI,gBAAgB,GAA2B,IAAI,CAAC;AACpD,SAAS,SAAS;IAChB,gBAAgB,KAAK,YAAY,CAAC,oCAAoC,CAAC,CAAC;IACxE,OAAO,gBAAgB,CAAC;AAC1B,CAAC;AAED;;;;;GAKG;AACH,SAAS,UAAU,CAAC,IAMnB;IACC,OAAO;QACL,EAAE,EAAE,IAAI,CAAC,EAAE;QACX,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,SAAS,EAAE,IAAI,CAAC,SAAS,IAAI,SAAS;QACtC,cAAc,EAAE,IAAI,CAAC,cAAc;KACpC,CAAC;AACJ,CAAC;AAwBD,MAAM,OAAO,WAAW;IAEH;IACA;IAFnB,YACmB,EAAY,EACZ,MAAkB;QADlB,OAAE,GAAF,EAAE,CAAU;QACZ,WAAM,GAAN,MAAM,CAAY;IAClC,CAAC;IAEJ;;;;;;;;;;;;;;;;;;;OAmBG;IACH,KAAK,CAAC,iBAAiB,CACrB,KAAa,EACb,QAAgB;QAEhB,MAAM,eAAe,GAAG,cAAc,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;QAEpD,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE,CAAC;YACvC,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;QACzC,CAAC;QAED,MAAM,QAAQ,GAAG,QAAQ,IAAI,EAAE,CAAC;QAEhC,0EAA0E;QAC1E,uEAAuE;QACvE,uEAAuE;QACvE,qEAAqE;QACrE,uEAAuE;QACvE,0EAA0E;QAC1E,iCAAiC;QACjC,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,IAAI,CAAC,EAAE;aACzB,MAAM,EAAE;aACR,IAAI,CAAC,KAAK,CAAC;aACX,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,eAAe,CAAC,CAAC;aACvC,KAAK,CAAC,CAAC,CAAC,CAAC;QAEZ,IAAI,IAAI,CAAC,eAAe,CAAC,eAAe,CAAC,EAAE,CAAC;YAC1C,oEAAoE;YACpE,sEAAsE;YACtE,wEAAwE;YACxE,wEAAwE;YACxE,uEAAuE;YACvE,qEAAqE;YACrE,6CAA6C;YAC7C,EAAE;YACF,wEAAwE;YACxE,sEAAsE;YACtE,uEAAuE;YACvE,uEAAuE;YACvE,mEAAmE;YACnE,oCAAoC;YACpC,IAAI,CAAC,qBAAqB,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,CAAC;gBAChE,sEAAsE;gBACtE,iEAAiE;gBACjE,sEAAsE;gBACtE,gBAAgB;gBAChB,MAAM,cAAc,CAAC,QAAQ,EAAE,MAAM,SAAS,EAAE,CAAC,CAAC;gBAClD,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;YACzC,CAAC;YACD,MAAM,WAAW,GAAG,eAAe,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,eAAe,CAAC;YACrE,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,eAAe,EAAE,WAAW,CAAC,CAAC;YACzE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1F,CAAC;QAED,0EAA0E;QAC1E,8DAA8D;QAC9D,kEAAkE;QAClE,wDAAwD;QACxD,MAAM,MAAM,GAAG,IAAI,EAAE,YAAY,IAAI,CAAC,MAAM,SAAS,EAAE,CAAC,CAAC;QACzD,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QACvD,IAAI,CAAC,IAAI,EAAE,YAAY,IAAI,CAAC,OAAO,EAAE,CAAC;YACpC,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;QACzC,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC;IACvF,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,YAAY,CAChB,KAAa,EACb,IAAY;QAEZ,MAAM,eAAe,GAAG,cAAc,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;QACpD,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE,CAAC;YACvC,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;QACvD,CAAC;QACD,IAAI,CAAC,mBAAmB,CAAC,eAAe,CAAC,CAAC;QAC1C,MAAM,WAAW,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,eAAe,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,eAAe,CAAC;QAC5F,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,eAAe,EAAE,WAAW,CAAC,CAAC;QACxE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC;IACvF,CAAC;IAED;;;;;;;;;;;;;OAaG;IACH,KAAK,CAAC,aAAa,CACjB,KAAa,EACb,IAAwB,EACxB,QAAgB;QAEhB,MAAM,eAAe,GAAG,cAAc,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;QACpD,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE,CAAC;YACvC,MAAM,IAAI,KAAK,CAAC,eAAe,CAAC,CAAC;QACnC,CAAC;QACD,uEAAuE;QACvE,8DAA8D;QAC9D,IAAI,IAAI,CAAC,eAAe,CAAC,eAAe,CAAC,EAAE,CAAC;YAC1C,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;QAC9C,CAAC;QACD,IAAI,CAAC,oBAAoB,CAAC,QAAQ,CAAC,CAAC;QACpC,MAAM,YAAY,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACzC,MAAM,WAAW,GAAG,YAAY,IAAI,eAAe,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,eAAe,CAAC;QACrF,MAAM,YAAY,GAAG,MAAM,YAAY,CAAC,QAAQ,CAAC,CAAC;QAClD,0EAA0E;QAC1E,oEAAoE;QACpE,sEAAsE;QACtE,mEAAmE;QACnE,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,IAAI,CAAC,EAAE;aACxB,MAAM,CAAC,KAAK,CAAC;aACb,MAAM,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,IAAI,EAAE,WAAW,EAAE,YAAY,EAAE,CAAC;aACnE,kBAAkB,CAAC;YAClB,MAAM,EAAE,KAAK,CAAC,KAAK;YACnB,GAAG,EAAE,YAAY;gBACf,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE;gBAC7D,CAAC,CAAC,EAAE,YAAY,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE;SAC5C,CAAC;aACD,SAAS,EAAE,CAAC;QACf,OAAO,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;IAChC,CAAC;IAED;;;;;;;;;;;;;OAaG;IACK,eAAe,CAAC,KAAa;QACnC,OAAO,CACL,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC;YACjC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC;YACpC,KAAK,KAAK,IAAI,CAAC,MAAM,CAAC,UAAU,CACjC,CAAC;IACJ,CAAC;IAED;;;;;;;OAOG;IACK,iBAAiB,CAAC,KAAa;QACrC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,oBAAoB,IAAI,IAAI,CAAC,IAAI,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;IACnF,CAAC;IAED;;;;;;;;OAQG;IACK,YAAY,CAAC,IAAsC;QACzD,OAAO,EAAE,GAAG,UAAU,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;IACjF,CAAC;IAED;;;;;;;;;;;;;;;;OAgBG;IACH,KAAK,CAAC,cAAc,CAClB,MAAc,EACd,eAAmC,EACnC,WAAmB;QAEnB,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACvF,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC;QAC7C,2EAA2E;QAC3E,yEAAyE;QACzE,IAAI,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YACrC,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;QAC9C,CAAC;QACD,IAAI,CAAC,oBAAoB,CAAC,WAAW,CAAC,CAAC;QACvC,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACtB,IAAI,CAAC,eAAe,IAAI,CAAC,CAAC,MAAM,cAAc,CAAC,eAAe,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,EAAE,CAAC;gBACpF,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;YACnD,CAAC;QACH,CAAC;QACD,MAAM,YAAY,GAAG,MAAM,YAAY,CAAC,WAAW,CAAC,CAAC;QACrD,MAAM,IAAI,CAAC,EAAE;aACV,MAAM,CAAC,KAAK,CAAC;aACb,GAAG,CAAC,EAAE,YAAY,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC;aAC5C,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC;IACjC,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,YAAY;QAUhB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACrE,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YACxB,EAAE,EAAE,GAAG,CAAC,EAAE;YACV,KAAK,EAAE,GAAG,CAAC,KAAK;YAChB,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,WAAW,EAAE,GAAG,CAAC,YAAY,IAAI,IAAI;YACrC,UAAU,EAAE,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,KAAK,CAAC;YAC7C,SAAS,EAAE,GAAG,CAAC,SAAS;SACzB,CAAC,CAAC,CAAC;IACN,CAAC;IAEO,oBAAoB,CAAC,QAAgB;QAC3C,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,MAAM,GAAG,mBAAmB,EAAE,CAAC;YAClD,MAAM,IAAI,KAAK,CAAC,6BAA6B,mBAAmB,aAAa,CAAC,CAAC;QACjF,CAAC;IACH,CAAC;IAEO,SAAS,CAAC,MAAc,EAAE,KAAa;QAC7C,OAAO,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACjF,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,kBAAkB,CACtB,KAAa,EACb,IAAa;QAEb,MAAM,eAAe,GAAG,cAAc,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;QACpD,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,eAAe,CAAC;YAAE,OAAO,IAAI,CAAC;QACpD,MAAM,WAAW,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,eAAe,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,eAAe,CAAC;QAC5F,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,eAAe,EAAE,WAAW,CAAC,CAAC;QACxE,OAAO,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;IAC7D,CAAC;IAEO,KAAK,CAAC,iBAAiB,CAAC,KAAa,EAAE,IAAY;QACzD,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,IAAI,CAAC,EAAE;aACzB,MAAM,CAAC,KAAK,CAAC;aACb,MAAM,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;aACvB,kBAAkB,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE,EAAE,CAAC;aAC3E,SAAS,EAAE,CAAC;QACf,OAAO,IAAI,CAAC;IACd,CAAC;IAED,WAAW,CAAC,KAAa;QACvB,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS,CAGtD,CAAC;QACF,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC;IAC1D,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,oBAAoB,CACxB,MAAmB;QAEnB,MAAM,MAAM,GAAG,IAAI,GAAG,EAAuD,CAAC;QAC9E,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC;YAAE,OAAO,MAAM,CAAC;QACrC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAChD,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,MAAM,CAAC,GAAG,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YAC/B,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;gBAAE,SAAS;YAC7B,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;QAClE,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,MAAc;QAC9B,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,IAAI,CAAC,EAAE;aACzB,MAAM,EAAE;aACR,IAAI,CAAC,KAAK,CAAC;aACX,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;aAC3B,KAAK,CAAC,CAAC,CAAC,CAAC;QAEZ,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC;QAEvB,OAAO,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;IACjC,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,cAAc,CAAC,KAAa;QAChC,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,IAAI,CAAC,EAAE;aACzB,MAAM,EAAE;aACR,IAAI,CAAC,KAAK,CAAC;aACX,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,cAAc,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC;aACnD,KAAK,CAAC,CAAC,CAAC,CAAC;QAEZ,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC;QAEvB,OAAO,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;IACjC,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,kBAAkB,CAAC,MAAc;QACrC,MAAM,IAAI,CAAC,EAAE;aACV,MAAM,CAAC,KAAK,CAAC;aACb,GAAG,CAAC,EAAE,cAAc,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC;aACpD,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC;IACjC,CAAC;IAED;;;;;;;;OAQG;IACH,oBAAoB,CAAC,KAAa;QAChC,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC;QAChD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACtC,MAAM,MAAM,GAAG,cAAc,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC/D,IAAI,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;QAC1B,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;IACvE,CAAC;IAED;;;;;;;;;;;;OAYG;IACK,mBAAmB,CAAC,eAAuB;QACjD,IAAI,CAAC,IAAI,CAAC,oBAAoB,CAAC,eAAe,CAAC,EAAE,CAAC;YAChD,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;QACjD,CAAC;IACH,CAAC;CAEF"}

package/dist/modules/auth/oidc-auth-provider.d.ts

@@ -1,7 +1,8 @@
 import type express from 'express';
 import type { AuthProviderPlugin } from './auth.routes.js';
 import type { AuthService } from './auth.service.js';
-export interface OidcAuthProviderOptions {
+/** The settings that make up one OIDC configuration. */
+export interface OidcSettings {
     /** Issuer base URL; `<issuer>/.well-known/openid-configuration` must exist. */
     issuerUrl: string;
     clientId: string;
@@ -10,17 +11,52 @@ export interface OidcAuthProviderOptions {
     scopes: string;
     /** Login-button label shown by the login screen. */
     label: string;
+}
+/**
+ * The OIDC configuration in effect, resolved through deployment settings —
+ * the environment first, then what an admin saved on the setup screen (see
+ * DeploymentSettingsService). Null unless issuer, client id and secret are
+ * all set.
+ */
+export declare function oidcSettingsFrom(settings: {
+    resolve(key: string): string;
+}): OidcSettings | null;
+export interface OidcAuthProviderOptions {
+    /**
+     * The configuration in effect, or null while it is incomplete. Called on
+     * every probe and every sign-in step rather than once at construction, so a
+     * configuration saved on a running deployment applies to the next sign-in
+     * without a restart.
+     */
+    settings(): OidcSettings | null;
     publicBackendUrl: string;
     publicFrontendUrl: string;
     /** See MicrosoftAuthDeps.cookieSecure — scheme-derived, not NODE_ENV. */
     cookieSecure: boolean;
     /** Injectable for tests; defaults to global fetch. */
     fetchImpl?: typeof fetch;
+    /**
+     * Called after someone has signed in through this provider, with the
+     * configuration that sign-in used — the proof that those values work.
+     * Failures are logged, never fail the sign-in.
+     */
+    onSignedIn?: (used: OidcSettings) => void | Promise<void>;
 }
+/**
+ * The redirect URI to register with the provider — and the one the
+ * configuration check sends. `publicBackendUrl` arrives from CoreConfig
+ * without userinfo or a trailing slash, so it is used exactly as configured.
+ */
+export declare function oidcRedirectUri(publicBackendUrl: string): string;
 /**
  * Generic OIDC single sign-on as an {@link AuthProviderPlugin} — works with
  * any spec-compliant provider (Entra, Okta, Auth0, Keycloak, Google, …),
- * configured purely from the environment (see CoreConfig `oidc*`).
+ * configured from the environment or the setup screen ({@link oidcSettingsFrom}).
+ *
+ * Registered once and LIVE: the configuration is read on every use, so the
+ * provider is advertised only while it is complete ({@link isEnabled}), its
+ * label and scopes follow the latest save, and a changed issuer is
+ * re-discovered on the next sign-in.
  *
  * Flow: authorization-code with PKCE (S256) as a confidential client.
  * Identity claims come from the `userinfo` endpoint called with the freshly
@@ -34,17 +70,24 @@ export interface OidcAuthProviderOptions {
 export declare class OidcAuthProvider implements AuthProviderPlugin {
     private readonly opts;
     readonly key = "oidc";
-    readonly label: string;
     readonly startPath = "/api/auth/oidc/login";
     private readonly fetchImpl;
+    /**
+     * The discovery for exactly one issuer — the one last asked for. Held as a
+     * promise so concurrent sign-ins share one fetch; replaced whenever the
+     * issuer differs, so no other issuer's document is ever served.
+     */
     private discovery;
     constructor(opts: OidcAuthProviderOptions);
+    get label(): string;
+    isEnabled(): boolean;
     /**
      * Fetch + cache the issuer's discovery document. Resolved lazily (not at
      * boot) so a temporarily unreachable issuer delays the first login instead
      * of failing the whole deployment; a failed attempt is not cached.
      */
     private discover;
+    private fetchDiscovery;
     private redirectUri;
     mountRoutes(router: express.Router, authService: AuthService): void;
 }

package/dist/modules/auth/oidc-auth-provider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oidc-auth-provider.d.ts","sourceRoot":"","sources":["../../../src/modules/auth/oidc-auth-provider.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,OAAO,MAAM,SAAS,CAAC;AACnC,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAG3D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAcrD,MAAM,WAAW,uBAAuB;IACtC,+EAA+E;IAC/E,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,+EAA+E;IAC/E,MAAM,EAAE,MAAM,CAAC;IACf,oDAAoD;IACpD,KAAK,EAAE,MAAM,CAAC;IACd,gBAAgB,EAAE,MAAM,CAAC;IACzB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,yEAAyE;IACzE,YAAY,EAAE,OAAO,CAAC;IACtB,sDAAsD;IACtD,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;CAC1B;AAoBD;;;;;;;;;;;;;GAaG;AACH,qBAAa,gBAAiB,YAAW,kBAAkB;IAQ7C,OAAO,CAAC,QAAQ,CAAC,IAAI;IAPjC,QAAQ,CAAC,GAAG,UAAU;IACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,SAAS,0BAA0B;IAE5C,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAe;IACzC,OAAO,CAAC,SAAS,CAA8B;gBAElB,IAAI,EAAE,uBAAuB;IAK1D;;;;OAIG;YACW,QAAQ;IAiBtB,OAAO,CAAC,WAAW;IAInB,WAAW,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,WAAW,EAAE,WAAW,GAAG,IAAI;CAyHpE"}
+{"version":3,"file":"oidc-auth-provider.d.ts","sourceRoot":"","sources":["../../../src/modules/auth/oidc-auth-provider.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,OAAO,MAAM,SAAS,CAAC;AACnC,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAG3D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAerD,wDAAwD;AACxD,MAAM,WAAW,YAAY;IAC3B,+EAA+E;IAC/E,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,+EAA+E;IAC/E,MAAM,EAAE,MAAM,CAAC;IACf,oDAAoD;IACpD,KAAK,EAAE,MAAM,CAAC;CACf;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE;IAAE,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAA;CAAE,GAAG,YAAY,GAAG,IAAI,CAehG;AAED,MAAM,WAAW,uBAAuB;IACtC;;;;;OAKG;IACH,QAAQ,IAAI,YAAY,GAAG,IAAI,CAAC;IAChC,gBAAgB,EAAE,MAAM,CAAC;IACzB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,yEAAyE;IACzE,YAAY,EAAE,OAAO,CAAC;IACtB,sDAAsD;IACtD,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB;;;;OAIG;IACH,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,YAAY,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3D;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,gBAAgB,EAAE,MAAM,GAAG,MAAM,CAEhE;AAoBD;;;;;;;;;;;;;;;;;;GAkBG;AACH,qBAAa,gBAAiB,YAAW,kBAAkB;IAY7C,OAAO,CAAC,QAAQ,CAAC,IAAI;IAXjC,QAAQ,CAAC,GAAG,UAAU;IACtB,QAAQ,CAAC,SAAS,0BAA0B;IAE5C,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAe;IACzC;;;;OAIG;IACH,OAAO,CAAC,SAAS,CAAmE;gBAEvD,IAAI,EAAE,uBAAuB;IAI1D,IAAI,KAAK,IAAI,MAAM,CAElB;IAED,SAAS,IAAI,OAAO;IAIpB;;;;OAIG;IACH,OAAO,CAAC,QAAQ;YAUF,cAAc;IAe5B,OAAO,CAAC,WAAW;IAInB,WAAW,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,WAAW,EAAE,WAAW,GAAG,IAAI;CA8IpE"}