@contember/engine-tenant-api 2.1.0-beta.2 → 2.2.0-alpha.1

package/dist/development/src/model/service/idp/providers/OIDCHelpers.js.map

@@ -1 +1 @@
-{"version":3,"file":"OIDCHelpers.js","sources":["../../../../../../../../packages/engine-tenant-api/src/model/service/idp/providers/OIDCHelpers.ts"],"sourcesContent":["import { Client, custom, errors, generators } from 'openid-client'\nimport { OIDCResponseData } from './OIDCTypes'\nimport { IDPValidationError } from '../IDPValidationError'\nimport { IDPResponseError } from '../IDPResponseError'\nimport { IDPResponse, InitIDPAuthResult } from '../IdentityProviderHandler'\n\nexport const initOIDCAuth = async (\n\tclient: Client,\n\t{ redirectUrl, scope, responseMode }: { redirectUrl: string; scope?: string; responseMode?: string },\n): Promise<InitIDPAuthResult> => {\n\tconst nonce = generators.nonce()\n\tconst state = generators.state()\n\tconst url = client.authorizationUrl({\n\t\tredirect_uri: redirectUrl,\n\t\tresponse_mode: responseMode,\n\t\tscope: scope ?? 'openid email',\n\t\tnonce,\n\t\tstate,\n\t})\n\n\treturn {\n\t\tauthUrl: url,\n\t\tsessionData: { nonce, state },\n\t}\n}\n\nexport const handleOIDCResponse = async (\n\tclient: Client,\n\t{ sessionData, redirectUrl, ...otherData }: OIDCResponseData,\n\tfetchUserInfo?: boolean,\n\treturnOIDCResult?: boolean,\n): Promise<IDPResponse> => {\n\tconst params = 'parameters' in otherData ? otherData.parameters : client.callbackParams(otherData.url)\n\tif (params.state && !sessionData?.state) {\n\t\tthrow new IDPValidationError(`state is present in parameters, but missing in session data`)\n\t}\n\ttry {\n\t\tconst result = await client.callback(redirectUrl, params, sessionData)\n\t\tconst claims = result.claims()\n\t\tconst { at_hash, c_hash, nonce, ...claimsWithoutHashes } = claims\n\t\tconst userInfo = result.access_token && fetchUserInfo ? await client.userinfo(result) : {}\n\t\tconst oidcResult = returnOIDCResult ? result : {}\n\n\t\treturn {\n\t\t\texternalIdentifier: claims.sub,\n\t\t\t...oidcResult,\n\t\t\t...claimsWithoutHashes,\n\t\t\t...userInfo,\n\t\t}\n\t} catch (e: any) {\n\t\tif (e instanceof errors.RPError) {\n\t\t\tthrow new IDPValidationError(e.message)\n\t\t}\n\t\tif (e instanceof errors.OPError) {\n\t\t\tconst body = e.response?.body as any\n\t\t\tif (typeof body === 'object' && typeof body?.error === 'object' && typeof body.error?.message === 'string') {\n\t\t\t\tthrow new IDPResponseError(body.error.message)\n\t\t\t}\n\t\t\tthrow new IDPResponseError(e.message)\n\t\t}\n\t\tthrow e\n\t}\n}\n"],"names":[],"mappings":";;;AAMO,MAAM,eAAe,OAC3B,QACA,EAAE,aAAa,OAAO,mBACU;AAChC,QAAM,QAAQ,WAAW,MAAA;AACzB,QAAM,QAAQ,WAAW,MAAA;AACzB,QAAM,MAAM,OAAO,iBAAiB;AAAA,IACnC,cAAc;AAAA,IACd,eAAe;AAAA,IACf,OAAO,SAAS;AAAA,IAChB;AAAA,IACA;AAAA,EAAA,CACA;AAED,SAAO;AAAA,IACN,SAAS;AAAA,IACT,aAAa,EAAE,OAAO,MAAA;AAAA,EAAM;AAE9B;AAEO,MAAM,qBAAqB,OACjC,QACA,EAAE,aAAa,aAAa,GAAG,UAAA,GAC/B,eACA,qBAC0B;AAC1B,QAAM,SAAS,gBAAgB,YAAY,UAAU,aAAa,OAAO,eAAe,UAAU,GAAG;AACrG,MAAI,OAAO,SAAS,CAAC,aAAa,OAAO;AACxC,UAAM,IAAI,mBAAmB,6DAA6D;AAAA,EAC3F;AACA,MAAI;AACH,UAAM,SAAS,MAAM,OAAO,SAAS,aAAa,QAAQ,WAAW;AACrE,UAAM,SAAS,OAAO,OAAA;AACtB,UAAM,EAAE,SAAS,QAAQ,OAAO,GAAG,wBAAwB;AAC3D,UAAM,WAAW,OAAO,gBAAgB,gBAAgB,MAAM,OAAO,SAAS,MAAM,IAAI,CAAA;AACxF,UAAM,aAAa,mBAAmB,SAAS,CAAA;AAE/C,WAAO;AAAA,MACN,oBAAoB,OAAO;AAAA,MAC3B,GAAG;AAAA,MACH,GAAG;AAAA,MACH,GAAG;AAAA,IAAA;AAAA,EAEL,SAAS,GAAQ;AAChB,QAAI,aAAa,OAAO,SAAS;AAChC,YAAM,IAAI,mBAAmB,EAAE,OAAO;AAAA,IACvC;AACA,QAAI,aAAa,OAAO,SAAS;AAChC,YAAM,OAAO,EAAE,UAAU;AACzB,UAAI,OAAO,SAAS,YAAY,OAAO,MAAM,UAAU,YAAY,OAAO,KAAK,OAAO,YAAY,UAAU;AAC3G,cAAM,IAAI,iBAAiB,KAAK,MAAM,OAAO;AAAA,MAC9C;AACA,YAAM,IAAI,iBAAiB,EAAE,OAAO;AAAA,IACrC;AACA,UAAM;AAAA,EACP;AACD;"}
+{"version":3,"file":"OIDCHelpers.js","sources":["../../../../../../../../packages/engine-tenant-api/src/model/service/idp/providers/OIDCHelpers.ts"],"sourcesContent":["import { Client, custom, errors, generators, Issuer, TokenSet } from 'openid-client'\nimport { createRemoteJWKSet, jwtVerify } from 'jose'\nimport { OIDCClaimMapping, OIDCResponseData } from './OIDCTypes.js'\nimport { IDPValidationError } from '../IDPValidationError.js'\nimport { IDPResponseError } from '../IDPResponseError.js'\nimport {\n\tIDPResponse,\n\tIDPSessionState,\n\tInitIDPAuthResult,\n\tLogoutTokenClaims,\n\tLogoutUrlRequest,\n\tRevalidationResult,\n} from '../IdentityProviderHandler.js'\n\n/**\n * Build the persisted session state from an OIDC token set. Stores the tokens needed for\n * later re-validation (refresh/access) and SLO (id_token); the whole `tokens` blob is\n * encrypted at rest by the command layer.\n *\n * `prevTokens` carries the previously stored tokens forward: a refresh-grant response MAY omit\n * the refresh token (RFC 6749 §6 — IdPs that don't rotate just don't re-send it), in which case\n * the client must keep using the old one. Without this fallback a non-rotating IdP would persist\n * a session with no refresh token and be revoked (`no_refresh_token`) on the very next tick.\n */\nexport const tokenSetToSessionState = (tokenSet: TokenSet, sessionId?: string, prevTokens?: Record<string, unknown>): IDPSessionState => {\n\tconst refreshToken = tokenSet.refresh_token ?? (typeof prevTokens?.refresh_token === 'string' ? prevTokens.refresh_token : undefined)\n\tconst idToken = tokenSet.id_token ?? (typeof prevTokens?.id_token === 'string' ? prevTokens.id_token : undefined)\n\treturn {\n\t\tsessionId,\n\t\ttokens: {\n\t\t\t...(refreshToken ? { refresh_token: refreshToken } : {}),\n\t\t\t...(tokenSet.access_token ? { access_token: tokenSet.access_token } : {}),\n\t\t\t...(idToken ? { id_token: idToken } : {}),\n\t\t},\n\t\texpiresAt: tokenSet.expires_at ? new Date(tokenSet.expires_at * 1000) : undefined,\n\t}\n}\n\nexport const initOIDCAuth = async (\n\tclient: Client,\n\t{ redirectUrl, scope, responseMode }: { redirectUrl: string; scope?: string; responseMode?: string },\n): Promise<InitIDPAuthResult> => {\n\tconst nonce = generators.nonce()\n\tconst state = generators.state()\n\tconst url = client.authorizationUrl({\n\t\tredirect_uri: redirectUrl,\n\t\tresponse_mode: responseMode,\n\t\tscope: scope ?? 'openid email',\n\t\tnonce,\n\t\tstate,\n\t})\n\n\treturn {\n\t\tauthUrl: url,\n\t\tsessionData: { nonce, state },\n\t}\n}\n\nexport type HandleOIDCResponseOptions = {\n\tfetchUserInfo?: boolean\n\treturnOIDCResult?: boolean\n\tcaptureSession?: boolean\n\tclaimMapping?: OIDCClaimMapping\n}\n\n/** Read a claim by name, supporting dot-paths into nested objects (`a.b.c`). */\nconst getClaim = (source: Record<string, unknown>, path: string): unknown =>\n\tpath.split('.').reduce<unknown>(\n\t\t(acc, key) => (acc != null && typeof acc === 'object' ? (acc as Record<string, unknown>)[key] : undefined),\n\t\tsource,\n\t)\n\nexport const handleOIDCResponse = async (\n\tclient: Client,\n\t{ sessionData, redirectUrl, ...otherData }: OIDCResponseData,\n\t{ fetchUserInfo, returnOIDCResult, captureSession, claimMapping }: HandleOIDCResponseOptions = {},\n): Promise<IDPResponse> => {\n\tconst params = 'parameters' in otherData ? otherData.parameters : client.callbackParams(otherData.url)\n\tif (params.state && !sessionData?.state) {\n\t\tthrow new IDPValidationError(`state is present in parameters, but missing in session data`)\n\t}\n\ttry {\n\t\tconst result = await client.callback(redirectUrl, params, sessionData)\n\t\tconst claims = result.claims()\n\t\tconst { at_hash, c_hash, nonce, ...claimsWithoutHashes } = claims\n\t\tconst userInfo = result.access_token && fetchUserInfo ? await client.userinfo(result) : {}\n\t\tconst oidcResult = returnOIDCResult ? result : {}\n\t\tconst idpSession = captureSession ? tokenSetToSessionState(result, typeof claims.sid === 'string' ? claims.sid : undefined) : undefined\n\n\t\t// Merge ID-token claims with userInfo (userInfo wins, per spec). Then optionally lift a\n\t\t// nested attributes object to the top level so providers that nest their claims (notably\n\t\t// Apereo CAS userinfo, which returns them under `attributes`) map without a code change.\n\t\t// The nested attributes are UNSIGNED, so they must not override a claim already present in\n\t\t// the (signature-verified) ID-token / userInfo merge — spread them UNDER `source`, not over\n\t\t// it, so a signed `sub` / `email_verified` keeps precedence over an attributes-level value.\n\t\tlet source: Record<string, unknown> = { ...claimsWithoutHashes, ...userInfo }\n\t\tconst attributesKey = claimMapping?.attributesKey\n\t\tif (attributesKey) {\n\t\t\tconst nested = source[attributesKey]\n\t\t\tif (nested && typeof nested === 'object' && !Array.isArray(nested)) {\n\t\t\t\tsource = { ...(nested as Record<string, unknown>), ...source }\n\t\t\t}\n\t\t}\n\n\t\t// The OIDC `email_verified` claim is a boolean per spec, but some providers send the\n\t\t// string \"true\". userInfo (and any unwrapped attributes) take precedence over the ID token.\n\t\tconst rawEmailVerified = source.email_verified\n\t\tconst emailVerified = rawEmailVerified === true || rawEmailVerified === 'true'\n\n\t\t// `externalIdentifier` is the federation key persisted in `person_identity_provider` and\n\t\t// matched on the next sign-in, so it must be a stable scalar. A `claimMapping` that pointed\n\t\t// it at an object/array would otherwise be coerced by `String(...)` to `'[object Object]'` /\n\t\t// a comma-join — collapsing every user of the provider onto one key (account takeover). Fail\n\t\t// closed instead. The default `sub` path is safe (openid-client guarantees `sub` is a string).\n\t\tconst mappedSubject = getClaim(source, claimMapping?.externalIdentifier ?? 'sub')\n\t\tlet externalIdentifier: string\n\t\tif (mappedSubject === undefined || mappedSubject === null) {\n\t\t\texternalIdentifier = claims.sub\n\t\t} else if (typeof mappedSubject === 'string' || typeof mappedSubject === 'number') {\n\t\t\texternalIdentifier = String(mappedSubject)\n\t\t} else {\n\t\t\tthrow new IDPValidationError(`The mapped externalIdentifier claim is not a scalar value`)\n\t\t}\n\t\tif (externalIdentifier === '') {\n\t\t\tthrow new IDPValidationError(`The mapped externalIdentifier claim resolved to an empty value`)\n\t\t}\n\n\t\t// `email` / `name` are typed `string | undefined` on IDPResponse and feed the by-e-mail\n\t\t// account lookup (which crashes on a non-string). `...source` already placed the raw claim\n\t\t// of whatever type, so OVERWRITE (don't conditionally add) with the mapped value when it is\n\t\t// a string, otherwise `undefined` — a non-string claim must not leak through `...source`.\n\t\tconst email = getClaim(source, claimMapping?.email ?? 'email')\n\t\tconst name = getClaim(source, claimMapping?.name ?? 'name')\n\n\t\treturn {\n\t\t\t...oidcResult,\n\t\t\t...source,\n\t\t\texternalIdentifier,\n\t\t\temail: typeof email === 'string' ? email : undefined,\n\t\t\tname: typeof name === 'string' ? name : undefined,\n\t\t\temailVerified,\n\t\t\t...(idpSession ? { idpSession } : {}),\n\t\t}\n\t} catch (e: any) {\n\t\tif (e instanceof errors.RPError) {\n\t\t\tthrow new IDPValidationError(e.message)\n\t\t}\n\t\tif (e instanceof errors.OPError) {\n\t\t\tconst body = e.response?.body as any\n\t\t\tif (typeof body === 'object' && typeof body?.error === 'object' && typeof body.error?.message === 'string') {\n\t\t\t\tthrow new IDPResponseError(body.error.message)\n\t\t\t}\n\t\t\tthrow new IDPResponseError(e.message)\n\t\t}\n\t\tthrow e\n\t}\n}\n\n/** OIDC errors that definitively mean \"this session is no longer valid at the IdP\". */\nconst REVOKED_OIDC_ERRORS = new Set(['invalid_grant', 'invalid_token', 'expired_token'])\n\n/**\n * Re-validate a stored OIDC session against the IdP. Returns `revoked` only for definitive\n * IdP responses (invalid/expired grant or inactive introspection). Transient failures\n * (network, IdP down) re-throw so the caller can fail-open and keep the session — IdP\n * downtime must not log everyone out.\n */\nexport const revalidateOIDC = async (\n\tclient: Client,\n\tmethod: 'refresh' | 'userinfo' | 'introspection',\n\tsession: IDPSessionState,\n): Promise<RevalidationResult> => {\n\tconst tokens = session.tokens ?? {}\n\tconst refreshToken = typeof tokens.refresh_token === 'string' ? tokens.refresh_token : undefined\n\tconst accessToken = typeof tokens.access_token === 'string' ? tokens.access_token : undefined\n\ttry {\n\t\tif (method === 'refresh') {\n\t\t\tif (!refreshToken) {\n\t\t\t\treturn { status: 'revoked', reason: 'no_refresh_token' }\n\t\t\t}\n\t\t\tconst tokenSet = await client.refresh(refreshToken)\n\t\t\tlet claims: Record<string, unknown> | undefined\n\t\t\ttry {\n\t\t\t\tclaims = tokenSet.id_token ? tokenSet.claims() : undefined\n\t\t\t} catch {\n\t\t\t\tclaims = undefined\n\t\t\t}\n\t\t\treturn {\n\t\t\t\tstatus: 'valid',\n\t\t\t\tclaims,\n\t\t\t\t// carry the stored tokens forward: a non-rotating IdP omits the refresh token here\n\t\t\t\tidpSession: tokenSetToSessionState(tokenSet, session.sessionId, tokens),\n\t\t\t}\n\t\t}\n\t\tif (method === 'userinfo') {\n\t\t\tif (!accessToken) {\n\t\t\t\treturn { status: 'revoked', reason: 'no_access_token' }\n\t\t\t}\n\t\t\tconst userInfo = await client.userinfo(accessToken)\n\t\t\treturn { status: 'valid', claims: userInfo }\n\t\t}\n\t\t// introspection\n\t\tconst token = accessToken ?? refreshToken\n\t\tif (!token) {\n\t\t\treturn { status: 'revoked', reason: 'no_token' }\n\t\t}\n\t\tconst result = await client.introspect(token, accessToken ? 'access_token' : 'refresh_token')\n\t\tif (!result.active) {\n\t\t\treturn { status: 'revoked', reason: 'inactive' }\n\t\t}\n\t\treturn { status: 'valid' }\n\t} catch (e: any) {\n\t\tif (e instanceof errors.OPError) {\n\t\t\tif (typeof e.error === 'string' && REVOKED_OIDC_ERRORS.has(e.error)) {\n\t\t\t\treturn { status: 'revoked', reason: e.error }\n\t\t\t}\n\t\t\t// The userinfo endpoint signals a rejected access token with a bare HTTP 401 — per\n\t\t\t// RFC 6750 the `WWW-Authenticate` error code is optional, so openid-client may not\n\t\t\t// surface a parseable `error` here. A 401 is still definitive: the token is no\n\t\t\t// longer accepted → revoked. (Introspection is NOT treated this way: it returns 200\n\t\t\t// `{active:false}` for revoked tokens, so a 401/400 there means client-auth/config\n\t\t\t// failure — transient, must not log users out.)\n\t\t\tif (method === 'userinfo' && e.response?.statusCode === 401) {\n\t\t\t\treturn { status: 'revoked', reason: 'userinfo_unauthorized' }\n\t\t\t}\n\t\t}\n\t\t// transient (network / IdP unavailable) — propagate, do not revoke\n\t\tthrow e\n\t}\n}\n\n/**\n * Build an RP-initiated (front-channel) logout URL (OIDC RP-Initiated Logout 1.0). Returns null\n * when the IdP advertises no `end_session_endpoint` — the caller then degrades to a local-only\n * logout (legacy-IdP graceful fallback). The `id_token_hint` lets the IdP identify and confirm the\n * session to terminate; `post_logout_redirect_uri` is where the IdP returns the browser afterwards.\n */\nexport const buildOIDCLogoutUrl = (client: Client, { idToken, postLogoutRedirectUri }: LogoutUrlRequest): string | null => {\n\tif (!client.issuer.metadata.end_session_endpoint) {\n\t\treturn null\n\t}\n\treturn client.endSessionUrl({\n\t\t...(idToken ? { id_token_hint: idToken } : {}),\n\t\t...(postLogoutRedirectUri ? { post_logout_redirect_uri: postLogoutRedirectUri } : {}),\n\t})\n}\n\n/**\n * The OIDC Back-Channel Logout 1.0 event member that MUST be present in a logout token's `events`\n * claim. Its presence (and the absence of a `nonce`) is what distinguishes a logout token from an\n * ID token — both are signed by the same IdP, so without this check an ID token could be replayed\n * to forcibly log a user out.\n */\nconst BACKCHANNEL_LOGOUT_EVENT = 'http://schemas.openid.net/event/backchannel-logout'\n\n/**\n * Max accepted age of a back-channel logout token, derived from its `iat`. OIDC Back-Channel Logout\n * tokens are single-use and short-lived; bounding the age (together with requiring `exp`) limits the\n * window in which a captured token could be replayed to force a logout.\n */\nconst LOGOUT_TOKEN_MAX_AGE_SECONDS = 120\nconst LOGOUT_TOKEN_CLOCK_TOLERANCE_SECONDS = 5\n\n/**\n * Remote JWKS sets keyed by `jwks_uri`. `createRemoteJWKSet` returns a function with its own internal\n * key cache + fetch cooldown, so it MUST be reused across requests — re-creating it per call (as the\n * unauthenticated back-channel endpoint would otherwise do) defeats the cache and turns every request\n * into a potential outbound JWKS fetch. Keyed by URL, so two providers sharing an IdP share the set.\n */\nconst remoteJwksCache = new Map<string, ReturnType<typeof createRemoteJWKSet>>()\n\nconst getRemoteJwks = (jwksUri: string): ReturnType<typeof createRemoteJWKSet> => {\n\tlet jwks = remoteJwksCache.get(jwksUri)\n\tif (!jwks) {\n\t\tjwks = createRemoteJWKSet(new URL(jwksUri))\n\t\tremoteJwksCache.set(jwksUri, jwks)\n\t}\n\treturn jwks\n}\n\n/**\n * Validate an OIDC back-channel logout token (OIDC Back-Channel Logout 1.0 §2.4–2.6) and extract\n * the targeted `sid` / `sub`. The token is a JWT signed by the IdP; we verify the signature against\n * the issuer's JWKS and enforce the issuer + audience (client_id) the same way ID tokens are\n * verified, pinning the signing algorithm to the provider's configured one, then assert the\n * back-channel-specific claims:\n *   - `iat` is present and recent and `exp` is present (§2.4 requires both) — bounds the replay window;\n *   - `events` contains the back-channel-logout member (it really is a logout token);\n *   - it carries a `sid` and/or `sub` (otherwise there is nothing to act on);\n *   - it does NOT carry a `nonce` (a `nonce` means it is an ID token being replayed).\n * Throws {@link IDPValidationError} on any failure so the caller can answer 400.\n */\nexport const validateOIDCLogoutToken = async (client: Client, issuer: Issuer<Client>, logoutToken: string): Promise<LogoutTokenClaims> => {\n\tconst jwksUri = issuer.metadata.jwks_uri\n\tif (!jwksUri) {\n\t\tthrow new IDPValidationError('IdP has no jwks_uri; cannot verify logout token')\n\t}\n\tconst clientId = client.metadata.client_id\n\tif (typeof clientId !== 'string' || clientId === '') {\n\t\t// The `aud` check is a core anti-token-substitution defence on this unauthenticated endpoint.\n\t\t// jose treats `audience: undefined` as \"skip the aud check entirely\", so a missing client_id\n\t\t// must fail closed (reject the token) rather than fall through and accept any audience.\n\t\tthrow new IDPValidationError('cannot verify logout token audience: client_id is missing')\n\t}\n\tconst expectedAlg = typeof client.metadata.id_token_signed_response_alg === 'string'\n\t\t? client.metadata.id_token_signed_response_alg\n\t\t: 'RS256'\n\tconst jwks = getRemoteJwks(jwksUri)\n\tlet payload: Record<string, unknown>\n\ttry {\n\t\tconst verified = await jwtVerify(logoutToken, jwks, {\n\t\t\tissuer: issuer.metadata.issuer,\n\t\t\taudience: clientId,\n\t\t\t// pin to the provider's configured signing alg so a JWKS containing a symmetric/none key\n\t\t\t// can never be selected (defence-in-depth on top of jose's own key-type check).\n\t\t\talgorithms: [expectedAlg],\n\t\t\t// §2.4: `iat` and `exp` are REQUIRED. `maxTokenAge` makes `iat` required + bounds freshness;\n\t\t\t// `requiredClaims` makes `exp` required (jose only checks `exp` when present).\n\t\t\tmaxTokenAge: LOGOUT_TOKEN_MAX_AGE_SECONDS,\n\t\t\trequiredClaims: ['exp'],\n\t\t\tclockTolerance: LOGOUT_TOKEN_CLOCK_TOLERANCE_SECONDS,\n\t\t})\n\t\tpayload = verified.payload as Record<string, unknown>\n\t} catch (e: any) {\n\t\tthrow new IDPValidationError(`Invalid logout token: ${e?.message ?? 'verification failed'}`)\n\t}\n\n\t// A logout token MUST NOT contain a nonce; its presence means an ID token is being replayed.\n\tif ('nonce' in payload) {\n\t\tthrow new IDPValidationError('Logout token must not contain a nonce')\n\t}\n\n\tconst events = payload.events\n\tconst hasLogoutEvent = typeof events === 'object' && events !== null && BACKCHANNEL_LOGOUT_EVENT in (events as Record<string, unknown>)\n\tif (!hasLogoutEvent) {\n\t\tthrow new IDPValidationError('Logout token is missing the back-channel-logout event')\n\t}\n\n\tconst sid = typeof payload.sid === 'string' ? payload.sid : undefined\n\tconst sub = typeof payload.sub === 'string' ? payload.sub : undefined\n\tif (!sid && !sub) {\n\t\tthrow new IDPValidationError('Logout token must contain a sid or sub claim')\n\t}\n\n\treturn { sid, sub }\n}\n"],"names":[],"mappings":";;;;AAwBO,MAAM,yBAAyB,CAAC,UAAoB,WAAoB,eAA0D;AACxI,QAAM,eAAe,SAAS,kBAAkB,OAAO,YAAY,kBAAkB,WAAW,WAAW,gBAAgB;AAC3H,QAAM,UAAU,SAAS,aAAa,OAAO,YAAY,aAAa,WAAW,WAAW,WAAW;AACvG,SAAO;AAAA,IACN;AAAA,IACA,QAAQ;AAAA,MACP,GAAI,eAAe,EAAE,eAAe,aAAA,IAAiB,CAAA;AAAA,MACrD,GAAI,SAAS,eAAe,EAAE,cAAc,SAAS,aAAA,IAAiB,CAAA;AAAA,MACtE,GAAI,UAAU,EAAE,UAAU,YAAY,CAAA;AAAA,IAAC;AAAA,IAExC,WAAW,SAAS,aAAa,IAAI,KAAK,SAAS,aAAa,GAAI,IAAI;AAAA,EAAA;AAE1E;AAEO,MAAM,eAAe,OAC3B,QACA,EAAE,aAAa,OAAO,mBACU;AAChC,QAAM,QAAQ,WAAW,MAAA;AACzB,QAAM,QAAQ,WAAW,MAAA;AACzB,QAAM,MAAM,OAAO,iBAAiB;AAAA,IACnC,cAAc;AAAA,IACd,eAAe;AAAA,IACf,OAAO,SAAS;AAAA,IAChB;AAAA,IACA;AAAA,EAAA,CACA;AAED,SAAO;AAAA,IACN,SAAS;AAAA,IACT,aAAa,EAAE,OAAO,MAAA;AAAA,EAAM;AAE9B;AAUA,MAAM,WAAW,CAAC,QAAiC,SAClD,KAAK,MAAM,GAAG,EAAE;AAAA,EACf,CAAC,KAAK,QAAS,OAAO,QAAQ,OAAO,QAAQ,WAAY,IAAgC,GAAG,IAAI;AAAA,EAChG;AACD;AAEM,MAAM,qBAAqB,OACjC,QACA,EAAE,aAAa,aAAa,GAAG,aAC/B,EAAE,eAAe,kBAAkB,gBAAgB,aAAA,IAA4C,CAAA,MACrE;AAC1B,QAAM,SAAS,gBAAgB,YAAY,UAAU,aAAa,OAAO,eAAe,UAAU,GAAG;AACrG,MAAI,OAAO,SAAS,CAAC,aAAa,OAAO;AACxC,UAAM,IAAI,mBAAmB,6DAA6D;AAAA,EAC3F;AACA,MAAI;AACH,UAAM,SAAS,MAAM,OAAO,SAAS,aAAa,QAAQ,WAAW;AACrE,UAAM,SAAS,OAAO,OAAA;AACtB,UAAM,EAAE,SAAS,QAAQ,OAAO,GAAG,wBAAwB;AAC3D,UAAM,WAAW,OAAO,gBAAgB,gBAAgB,MAAM,OAAO,SAAS,MAAM,IAAI,CAAA;AACxF,UAAM,aAAa,mBAAmB,SAAS,CAAA;AAC/C,UAAM,aAAa,iBAAiB,uBAAuB,QAAQ,OAAO,OAAO,QAAQ,WAAW,OAAO,MAAM,MAAS,IAAI;AAQ9H,QAAI,SAAkC,EAAE,GAAG,qBAAqB,GAAG,SAAA;AACnE,UAAM,gBAAgB,cAAc;AACpC,QAAI,eAAe;AAClB,YAAM,SAAS,OAAO,aAAa;AACnC,UAAI,UAAU,OAAO,WAAW,YAAY,CAAC,MAAM,QAAQ,MAAM,GAAG;AACnE,iBAAS,EAAE,GAAI,QAAoC,GAAG,OAAA;AAAA,MACvD;AAAA,IACD;AAIA,UAAM,mBAAmB,OAAO;AAChC,UAAM,gBAAgB,qBAAqB,QAAQ,qBAAqB;AAOxE,UAAM,gBAAgB,SAAS,QAAQ,cAAc,sBAAsB,KAAK;AAChF,QAAI;AACJ,QAAI,kBAAkB,UAAa,kBAAkB,MAAM;AAC1D,2BAAqB,OAAO;AAAA,IAC7B,WAAW,OAAO,kBAAkB,YAAY,OAAO,kBAAkB,UAAU;AAClF,2BAAqB,OAAO,aAAa;AAAA,IAC1C,OAAO;AACN,YAAM,IAAI,mBAAmB,2DAA2D;AAAA,IACzF;AACA,QAAI,uBAAuB,IAAI;AAC9B,YAAM,IAAI,mBAAmB,gEAAgE;AAAA,IAC9F;AAMA,UAAM,QAAQ,SAAS,QAAQ,cAAc,SAAS,OAAO;AAC7D,UAAM,OAAO,SAAS,QAAQ,cAAc,QAAQ,MAAM;AAE1D,WAAO;AAAA,MACN,GAAG;AAAA,MACH,GAAG;AAAA,MACH;AAAA,MACA,OAAO,OAAO,UAAU,WAAW,QAAQ;AAAA,MAC3C,MAAM,OAAO,SAAS,WAAW,OAAO;AAAA,MACxC;AAAA,MACA,GAAI,aAAa,EAAE,eAAe,CAAA;AAAA,IAAC;AAAA,EAErC,SAAS,GAAQ;AAChB,QAAI,aAAa,OAAO,SAAS;AAChC,YAAM,IAAI,mBAAmB,EAAE,OAAO;AAAA,IACvC;AACA,QAAI,aAAa,OAAO,SAAS;AAChC,YAAM,OAAO,EAAE,UAAU;AACzB,UAAI,OAAO,SAAS,YAAY,OAAO,MAAM,UAAU,YAAY,OAAO,KAAK,OAAO,YAAY,UAAU;AAC3G,cAAM,IAAI,iBAAiB,KAAK,MAAM,OAAO;AAAA,MAC9C;AACA,YAAM,IAAI,iBAAiB,EAAE,OAAO;AAAA,IACrC;AACA,UAAM;AAAA,EACP;AACD;AAGA,MAAM,sBAAsB,oBAAI,IAAI,CAAC,iBAAiB,iBAAiB,eAAe,CAAC;AAQhF,MAAM,iBAAiB,OAC7B,QACA,QACA,YACiC;AACjC,QAAM,SAAS,QAAQ,UAAU,CAAA;AACjC,QAAM,eAAe,OAAO,OAAO,kBAAkB,WAAW,OAAO,gBAAgB;AACvF,QAAM,cAAc,OAAO,OAAO,iBAAiB,WAAW,OAAO,eAAe;AACpF,MAAI;AACH,QAAI,WAAW,WAAW;AACzB,UAAI,CAAC,cAAc;AAClB,eAAO,EAAE,QAAQ,WAAW,QAAQ,mBAAA;AAAA,MACrC;AACA,YAAM,WAAW,MAAM,OAAO,QAAQ,YAAY;AAClD,UAAI;AACJ,UAAI;AACH,iBAAS,SAAS,WAAW,SAAS,OAAA,IAAW;AAAA,MAClD,QAAQ;AACP,iBAAS;AAAA,MACV;AACA,aAAO;AAAA,QACN,QAAQ;AAAA,QACR;AAAA;AAAA,QAEA,YAAY,uBAAuB,UAAU,QAAQ,WAAW,MAAM;AAAA,MAAA;AAAA,IAExE;AACA,QAAI,WAAW,YAAY;AAC1B,UAAI,CAAC,aAAa;AACjB,eAAO,EAAE,QAAQ,WAAW,QAAQ,kBAAA;AAAA,MACrC;AACA,YAAM,WAAW,MAAM,OAAO,SAAS,WAAW;AAClD,aAAO,EAAE,QAAQ,SAAS,QAAQ,SAAA;AAAA,IACnC;AAEA,UAAM,QAAQ,eAAe;AAC7B,QAAI,CAAC,OAAO;AACX,aAAO,EAAE,QAAQ,WAAW,QAAQ,WAAA;AAAA,IACrC;AACA,UAAM,SAAS,MAAM,OAAO,WAAW,OAAO,cAAc,iBAAiB,eAAe;AAC5F,QAAI,CAAC,OAAO,QAAQ;AACnB,aAAO,EAAE,QAAQ,WAAW,QAAQ,WAAA;AAAA,IACrC;AACA,WAAO,EAAE,QAAQ,QAAA;AAAA,EAClB,SAAS,GAAQ;AAChB,QAAI,aAAa,OAAO,SAAS;AAChC,UAAI,OAAO,EAAE,UAAU,YAAY,oBAAoB,IAAI,EAAE,KAAK,GAAG;AACpE,eAAO,EAAE,QAAQ,WAAW,QAAQ,EAAE,MAAA;AAAA,MACvC;AAOA,UAAI,WAAW,cAAc,EAAE,UAAU,eAAe,KAAK;AAC5D,eAAO,EAAE,QAAQ,WAAW,QAAQ,wBAAA;AAAA,MACrC;AAAA,IACD;AAEA,UAAM;AAAA,EACP;AACD;AAQO,MAAM,qBAAqB,CAAC,QAAgB,EAAE,SAAS,4BAA6D;AAC1H,MAAI,CAAC,OAAO,OAAO,SAAS,sBAAsB;AACjD,WAAO;AAAA,EACR;AACA,SAAO,OAAO,cAAc;AAAA,IAC3B,GAAI,UAAU,EAAE,eAAe,QAAA,IAAY,CAAA;AAAA,IAC3C,GAAI,wBAAwB,EAAE,0BAA0B,0BAA0B,CAAA;AAAA,EAAC,CACnF;AACF;AAQA,MAAM,2BAA2B;AAOjC,MAAM,+BAA+B;AACrC,MAAM,uCAAuC;AAQ7C,MAAM,sCAAsB,IAAA;AAE5B,MAAM,gBAAgB,CAAC,YAA2D;AACjF,MAAI,OAAO,gBAAgB,IAAI,OAAO;AACtC,MAAI,CAAC,MAAM;AACV,WAAO,mBAAmB,IAAI,IAAI,OAAO,CAAC;AAC1C,oBAAgB,IAAI,SAAS,IAAI;AAAA,EAClC;AACA,SAAO;AACR;AAcO,MAAM,0BAA0B,OAAO,QAAgB,QAAwB,gBAAoD;AACzI,QAAM,UAAU,OAAO,SAAS;AAChC,MAAI,CAAC,SAAS;AACb,UAAM,IAAI,mBAAmB,iDAAiD;AAAA,EAC/E;AACA,QAAM,WAAW,OAAO,SAAS;AACjC,MAAI,OAAO,aAAa,YAAY,aAAa,IAAI;AAIpD,UAAM,IAAI,mBAAmB,2DAA2D;AAAA,EACzF;AACA,QAAM,cAAc,OAAO,OAAO,SAAS,iCAAiC,WACzE,OAAO,SAAS,+BAChB;AACH,QAAM,OAAO,cAAc,OAAO;AAClC,MAAI;AACJ,MAAI;AACH,UAAM,WAAW,MAAM,UAAU,aAAa,MAAM;AAAA,MACnD,QAAQ,OAAO,SAAS;AAAA,MACxB,UAAU;AAAA;AAAA;AAAA,MAGV,YAAY,CAAC,WAAW;AAAA;AAAA;AAAA,MAGxB,aAAa;AAAA,MACb,gBAAgB,CAAC,KAAK;AAAA,MACtB,gBAAgB;AAAA,IAAA,CAChB;AACD,cAAU,SAAS;AAAA,EACpB,SAAS,GAAQ;AAChB,UAAM,IAAI,mBAAmB,yBAAyB,GAAG,WAAW,qBAAqB,EAAE;AAAA,EAC5F;AAGA,MAAI,WAAW,SAAS;AACvB,UAAM,IAAI,mBAAmB,uCAAuC;AAAA,EACrE;AAEA,QAAM,SAAS,QAAQ;AACvB,QAAM,iBAAiB,OAAO,WAAW,YAAY,WAAW,QAAQ,4BAA6B;AACrG,MAAI,CAAC,gBAAgB;AACpB,UAAM,IAAI,mBAAmB,uDAAuD;AAAA,EACrF;AAEA,QAAM,MAAM,OAAO,QAAQ,QAAQ,WAAW,QAAQ,MAAM;AAC5D,QAAM,MAAM,OAAO,QAAQ,QAAQ,WAAW,QAAQ,MAAM;AAC5D,MAAI,CAAC,OAAO,CAAC,KAAK;AACjB,UAAM,IAAI,mBAAmB,8CAA8C;AAAA,EAC5E;AAEA,SAAO,EAAE,KAAK,IAAA;AACf;"}

package/dist/development/src/model/service/idp/providers/OIDCProvider.cjs

@@ -10,6 +10,7 @@ var __defProp = Object.defineProperty;
 var __defNormalProp = (obj, key, value) => key in obj ? __defProp(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
 var __publicField = (obj, key, value) => __defNormalProp(obj, typeof key !== "symbol" ? key + "" : key, value);
 const DEFAULT_OIDC_TIMEOUT = 5e3;
+const OFFLINE_ACCESS_SCOPE = "offline_access";
 class OIDCProvider {
   constructor() {
     __publicField(this, "issuerCache", {});
@@ -19,7 +20,7 @@ class OIDCProvider {
     const initData = helpers.catchTypesafe(OIDCTypes.OIDCInitData, IDPValidationError.IDPValidationError)(data);
     const client = await this.createOIDCClient(configuration);
     return await OIDCHelpers.initOIDCAuth(client, {
-      scope: configuration.scope ?? configuration.claims,
+      scope: this.resolveScope(configuration),
       ...initData
     });
   }
@@ -29,10 +30,38 @@ class OIDCProvider {
     return await OIDCHelpers.handleOIDCResponse(
       client,
       responseData,
-      configuration.fetchUserInfo,
-      configuration.returnOIDCResult
+      {
+        fetchUserInfo: configuration.fetchUserInfo,
+        returnOIDCResult: configuration.returnOIDCResult,
+        captureSession: configuration.revalidation?.enabled === true,
+        claimMapping: configuration.claimMapping
+      }
     );
   }
+  async revalidate(configuration, session) {
+    const client = await this.createOIDCClient(configuration);
+    return await OIDCHelpers.revalidateOIDC(client, configuration.revalidation?.method ?? "refresh", session);
+  }
+  async buildLogoutUrl(configuration, request) {
+    const client = await this.createOIDCClient(configuration);
+    return OIDCHelpers.buildOIDCLogoutUrl(client, request);
+  }
+  async validateLogoutToken(configuration, logoutToken) {
+    const client = await this.createOIDCClient(configuration);
+    return await OIDCHelpers.validateOIDCLogoutToken(client, client.issuer, logoutToken);
+  }
+  /**
+   * Resolve the requested scope, appending `offline_access` when refresh-token
+   * re-validation is enabled (so the IdP issues a refresh token to revalidate against).
+   */
+  resolveScope(configuration) {
+    const baseScope = configuration.scope ?? configuration.claims ?? "openid email";
+    const needsOfflineAccess = configuration.revalidation?.enabled === true && (configuration.revalidation.method ?? "refresh") === "refresh";
+    if (needsOfflineAccess && !baseScope.split(/\s+/).includes(OFFLINE_ACCESS_SCOPE)) {
+      return `${baseScope} ${OFFLINE_ACCESS_SCOPE}`;
+    }
+    return baseScope;
+  }
   getPublicConfiguration({ clientSecret, ...config }) {
     return config;
   }
@@ -44,7 +73,8 @@ class OIDCProvider {
         client_id: configuration.clientId,
         client_secret: configuration.clientSecret,
         response_types: [configuration.responseType || "code"],
-        id_token_signed_response_alg: configuration.idTokenSignedResponseAlg ?? "RS256"
+        id_token_signed_response_alg: configuration.idTokenSignedResponseAlg ?? "RS256",
+        ...configuration.tokenEndpointAuthMethod ? { token_endpoint_auth_method: configuration.tokenEndpointAuthMethod } : {}
       },
       void 0,
       {

package/dist/development/src/model/service/idp/providers/OIDCProvider.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"OIDCProvider.cjs","sources":["../../../../../../../../packages/engine-tenant-api/src/model/service/idp/providers/OIDCProvider.ts"],"sourcesContent":["import { Client, custom, Issuer } from 'openid-client'\nimport { IdentityProviderHandler, IDPResponse, InitIDPAuthResult } from '../IdentityProviderHandler'\nimport { InvalidIDPConfigurationError } from '../InvalidIDPConfigurationError'\nimport { catchTypesafe } from './helpers'\nimport { OIDCConfiguration, OIDCInitData, OIDCResponseData } from './OIDCTypes'\nimport { handleOIDCResponse, initOIDCAuth } from './OIDCHelpers'\nimport { IDPValidationError } from '../IDPValidationError'\n\nconst DEFAULT_OIDC_TIMEOUT = 5000\n\nexport class OIDCProvider implements IdentityProviderHandler<OIDCConfiguration> {\n\tprivate issuerCache: Record<string, Issuer<Client>> = {}\n\n\tvalidateConfiguration = catchTypesafe(OIDCConfiguration, InvalidIDPConfigurationError)\n\n\tpublic async initAuth(configuration: OIDCConfiguration, data: unknown): Promise<InitIDPAuthResult> {\n\t\tconst initData = catchTypesafe(OIDCInitData, IDPValidationError)(data)\n\t\tconst client = await this.createOIDCClient(configuration)\n\t\treturn await initOIDCAuth(client, {\n\t\t\tscope: configuration.scope ?? configuration.claims,\n\t\t\t...initData,\n\t\t})\n\t}\n\n\tpublic async processResponse(configuration: OIDCConfiguration, data: unknown): Promise<IDPResponse> {\n\t\tconst responseData = catchTypesafe(OIDCResponseData, IDPValidationError)(data)\n\t\tconst client = await this.createOIDCClient(configuration)\n\t\treturn await handleOIDCResponse(\n\t\t\tclient,\n\t\t\tresponseData,\n\t\t\tconfiguration.fetchUserInfo,\n\t\t\tconfiguration.returnOIDCResult,\n\t\t)\n\t}\n\n\tgetPublicConfiguration({ clientSecret, ...config }: OIDCConfiguration): Partial<OIDCConfiguration> {\n\t\treturn config\n\t}\n\n\tprivate async createOIDCClient(configuration: OIDCConfiguration): Promise<Client> {\n\t\tthis.issuerCache[configuration.url] ??= await Issuer.discover(configuration.url)\n\n\t\tconst client = new this.issuerCache[configuration.url].Client(\n\t\t\t{\n\t\t\t\tclient_id: configuration.clientId,\n\t\t\t\tclient_secret: configuration.clientSecret,\n\t\t\t\tresponse_types: [configuration.responseType || 'code'],\n\t\t\t\tid_token_signed_response_alg: configuration.idTokenSignedResponseAlg ?? 'RS256',\n\t\t\t},\n\t\t\tundefined,\n\t\t\t{\n\t\t\t\tadditionalAuthorizedParties: [...(configuration.additionalAuthorizedParties ?? [])],\n\t\t\t},\n\t\t)\n\n\t\tclient[custom.http_options] = () => ({ timeout: configuration.timeout ?? DEFAULT_OIDC_TIMEOUT })\n\n\t\treturn client\n\t}\n}\n"],"names":["catchTypesafe","OIDCConfiguration","InvalidIDPConfigurationError","OIDCInitData","IDPValidationError","initOIDCAuth","OIDCResponseData","handleOIDCResponse","Issuer","custom"],"mappings":";;;;;;;;;;;AAQA,MAAM,uBAAuB;AAEtB,MAAM,aAAmE;AAAA,EAAzE,cAAA;AACN,kBAAA,MAAQ,eAA8C,EAAC;AAEvD,kBAAA,MAAA,yBAAwBA,QAAAA,cAAcC,UAAAA,mBAAmBC,6BAAAA,4BAA4B,CAAA;AAAA,EAAA;AAAA,EAErF,MAAa,SAAS,eAAkC,MAA2C;AAClG,UAAM,WAAWF,QAAAA,cAAcG,UAAAA,cAAcC,mBAAAA,kBAAkB,EAAE,IAAI;AACrE,UAAM,SAAS,MAAM,KAAK,iBAAiB,aAAa;AACxD,WAAO,MAAMC,YAAAA,aAAa,QAAQ;AAAA,MACjC,OAAO,cAAc,SAAS,cAAc;AAAA,MAC5C,GAAG;AAAA,IAAA,CACH;AAAA,EACF;AAAA,EAEA,MAAa,gBAAgB,eAAkC,MAAqC;AACnG,UAAM,eAAeL,QAAAA,cAAcM,UAAAA,kBAAkBF,mBAAAA,kBAAkB,EAAE,IAAI;AAC7E,UAAM,SAAS,MAAM,KAAK,iBAAiB,aAAa;AACxD,WAAO,MAAMG,YAAAA;AAAAA,MACZ;AAAA,MACA;AAAA,MACA,cAAc;AAAA,MACd,cAAc;AAAA,IAAA;AAAA,EAEhB;AAAA,EAEA,uBAAuB,EAAE,cAAc,GAAG,UAAyD;AAClG,WAAO;AAAA,EACR;AAAA,EAEA,MAAc,iBAAiB,eAAmD;AAvCnF,QAAA,IAAA;AAwCE,KAAA,KAAA,KAAK,aAAL,KAAiB,cAAc,GAAA,MAA/B,SAAwC,MAAMC,aAAAA,OAAO,SAAS,cAAc,GAAG;AAE/E,UAAM,SAAS,IAAI,KAAK,YAAY,cAAc,GAAG,EAAE;AAAA,MACtD;AAAA,QACC,WAAW,cAAc;AAAA,QACzB,eAAe,cAAc;AAAA,QAC7B,gBAAgB,CAAC,cAAc,gBAAgB,MAAM;AAAA,QACrD,8BAA8B,cAAc,4BAA4B;AAAA,MAAA;AAAA,MAEzE;AAAA,MACA;AAAA,QACC,6BAA6B,CAAC,GAAI,cAAc,+BAA+B,CAAA,CAAG;AAAA,MAAA;AAAA,IACnF;AAGD,WAAOC,aAAAA,OAAO,YAAY,IAAI,OAAO,EAAE,SAAS,cAAc,WAAW;AAEzE,WAAO;AAAA,EACR;AACD;;"}
+{"version":3,"file":"OIDCProvider.cjs","sources":["../../../../../../../../packages/engine-tenant-api/src/model/service/idp/providers/OIDCProvider.ts"],"sourcesContent":["import { Client, custom, Issuer } from 'openid-client'\nimport {\n\tIdentityProviderHandler,\n\tIDPResponse,\n\tIDPSessionState,\n\tInitIDPAuthResult,\n\tLogoutTokenClaims,\n\tLogoutUrlRequest,\n\tRevalidationResult,\n} from '../IdentityProviderHandler.js'\nimport { InvalidIDPConfigurationError } from '../InvalidIDPConfigurationError.js'\nimport { catchTypesafe } from './helpers.js'\nimport { OIDCConfiguration, OIDCInitData, OIDCResponseData } from './OIDCTypes.js'\nimport { buildOIDCLogoutUrl, handleOIDCResponse, initOIDCAuth, revalidateOIDC, validateOIDCLogoutToken } from './OIDCHelpers.js'\nimport { IDPValidationError } from '../IDPValidationError.js'\n\nconst DEFAULT_OIDC_TIMEOUT = 5000\nconst OFFLINE_ACCESS_SCOPE = 'offline_access'\n\nexport class OIDCProvider implements IdentityProviderHandler<OIDCConfiguration> {\n\tprivate issuerCache: Record<string, Issuer<Client>> = {}\n\n\tvalidateConfiguration = catchTypesafe(OIDCConfiguration, InvalidIDPConfigurationError)\n\n\tpublic async initAuth(configuration: OIDCConfiguration, data: unknown): Promise<InitIDPAuthResult> {\n\t\tconst initData = catchTypesafe(OIDCInitData, IDPValidationError)(data)\n\t\tconst client = await this.createOIDCClient(configuration)\n\t\treturn await initOIDCAuth(client, {\n\t\t\tscope: this.resolveScope(configuration),\n\t\t\t...initData,\n\t\t})\n\t}\n\n\tpublic async processResponse(configuration: OIDCConfiguration, data: unknown): Promise<IDPResponse> {\n\t\tconst responseData = catchTypesafe(OIDCResponseData, IDPValidationError)(data)\n\t\tconst client = await this.createOIDCClient(configuration)\n\t\treturn await handleOIDCResponse(\n\t\t\tclient,\n\t\t\tresponseData,\n\t\t\t{\n\t\t\t\tfetchUserInfo: configuration.fetchUserInfo,\n\t\t\t\treturnOIDCResult: configuration.returnOIDCResult,\n\t\t\t\tcaptureSession: configuration.revalidation?.enabled === true,\n\t\t\t\tclaimMapping: configuration.claimMapping,\n\t\t\t},\n\t\t)\n\t}\n\n\tpublic async revalidate(configuration: OIDCConfiguration, session: IDPSessionState): Promise<RevalidationResult> {\n\t\tconst client = await this.createOIDCClient(configuration)\n\t\treturn await revalidateOIDC(client, configuration.revalidation?.method ?? 'refresh', session)\n\t}\n\n\tpublic async buildLogoutUrl(configuration: OIDCConfiguration, request: LogoutUrlRequest): Promise<string | null> {\n\t\tconst client = await this.createOIDCClient(configuration)\n\t\treturn buildOIDCLogoutUrl(client, request)\n\t}\n\n\tpublic async validateLogoutToken(configuration: OIDCConfiguration, logoutToken: string): Promise<LogoutTokenClaims> {\n\t\tconst client = await this.createOIDCClient(configuration)\n\t\treturn await validateOIDCLogoutToken(client, client.issuer, logoutToken)\n\t}\n\n\t/**\n\t * Resolve the requested scope, appending `offline_access` when refresh-token\n\t * re-validation is enabled (so the IdP issues a refresh token to revalidate against).\n\t */\n\tprivate resolveScope(configuration: OIDCConfiguration): string {\n\t\tconst baseScope = configuration.scope ?? configuration.claims ?? 'openid email'\n\t\tconst needsOfflineAccess = configuration.revalidation?.enabled === true\n\t\t\t&& (configuration.revalidation.method ?? 'refresh') === 'refresh'\n\t\tif (needsOfflineAccess && !baseScope.split(/\\s+/).includes(OFFLINE_ACCESS_SCOPE)) {\n\t\t\treturn `${baseScope} ${OFFLINE_ACCESS_SCOPE}`\n\t\t}\n\t\treturn baseScope\n\t}\n\n\tgetPublicConfiguration({ clientSecret, ...config }: OIDCConfiguration): Partial<OIDCConfiguration> {\n\t\treturn config\n\t}\n\n\tprivate async createOIDCClient(configuration: OIDCConfiguration): Promise<Client> {\n\t\tthis.issuerCache[configuration.url] ??= await Issuer.discover(configuration.url)\n\n\t\tconst client = new this.issuerCache[configuration.url].Client(\n\t\t\t{\n\t\t\t\tclient_id: configuration.clientId,\n\t\t\t\tclient_secret: configuration.clientSecret,\n\t\t\t\tresponse_types: [configuration.responseType || 'code'],\n\t\t\t\tid_token_signed_response_alg: configuration.idTokenSignedResponseAlg ?? 'RS256',\n\t\t\t\t...(configuration.tokenEndpointAuthMethod ? { token_endpoint_auth_method: configuration.tokenEndpointAuthMethod } : {}),\n\t\t\t},\n\t\t\tundefined,\n\t\t\t{\n\t\t\t\tadditionalAuthorizedParties: [...(configuration.additionalAuthorizedParties ?? [])],\n\t\t\t},\n\t\t)\n\n\t\tclient[custom.http_options] = () => ({ timeout: configuration.timeout ?? DEFAULT_OIDC_TIMEOUT })\n\n\t\treturn client\n\t}\n}\n"],"names":["catchTypesafe","OIDCConfiguration","InvalidIDPConfigurationError","OIDCInitData","IDPValidationError","initOIDCAuth","OIDCResponseData","handleOIDCResponse","revalidateOIDC","buildOIDCLogoutUrl","validateOIDCLogoutToken","Issuer","custom"],"mappings":";;;;;;;;;;;AAgBA,MAAM,uBAAuB;AAC7B,MAAM,uBAAuB;AAEtB,MAAM,aAAmE;AAAA,EAAzE,cAAA;AACN,kBAAA,MAAQ,eAA8C,EAAC;AAEvD,kBAAA,MAAA,yBAAwBA,QAAAA,cAAcC,UAAAA,mBAAmBC,6BAAAA,4BAA4B,CAAA;AAAA,EAAA;AAAA,EAErF,MAAa,SAAS,eAAkC,MAA2C;AAClG,UAAM,WAAWF,QAAAA,cAAcG,UAAAA,cAAcC,mBAAAA,kBAAkB,EAAE,IAAI;AACrE,UAAM,SAAS,MAAM,KAAK,iBAAiB,aAAa;AACxD,WAAO,MAAMC,YAAAA,aAAa,QAAQ;AAAA,MACjC,OAAO,KAAK,aAAa,aAAa;AAAA,MACtC,GAAG;AAAA,IAAA,CACH;AAAA,EACF;AAAA,EAEA,MAAa,gBAAgB,eAAkC,MAAqC;AACnG,UAAM,eAAeL,QAAAA,cAAcM,UAAAA,kBAAkBF,mBAAAA,kBAAkB,EAAE,IAAI;AAC7E,UAAM,SAAS,MAAM,KAAK,iBAAiB,aAAa;AACxD,WAAO,MAAMG,YAAAA;AAAAA,MACZ;AAAA,MACA;AAAA,MACA;AAAA,QACC,eAAe,cAAc;AAAA,QAC7B,kBAAkB,cAAc;AAAA,QAChC,gBAAgB,cAAc,cAAc,YAAY;AAAA,QACxD,cAAc,cAAc;AAAA,MAAA;AAAA,IAC7B;AAAA,EAEF;AAAA,EAEA,MAAa,WAAW,eAAkC,SAAuD;AAChH,UAAM,SAAS,MAAM,KAAK,iBAAiB,aAAa;AACxD,WAAO,MAAMC,YAAAA,eAAe,QAAQ,cAAc,cAAc,UAAU,WAAW,OAAO;AAAA,EAC7F;AAAA,EAEA,MAAa,eAAe,eAAkC,SAAmD;AAChH,UAAM,SAAS,MAAM,KAAK,iBAAiB,aAAa;AACxD,WAAOC,YAAAA,mBAAmB,QAAQ,OAAO;AAAA,EAC1C;AAAA,EAEA,MAAa,oBAAoB,eAAkC,aAAiD;AACnH,UAAM,SAAS,MAAM,KAAK,iBAAiB,aAAa;AACxD,WAAO,MAAMC,YAAAA,wBAAwB,QAAQ,OAAO,QAAQ,WAAW;AAAA,EACxE;AAAA;AAAA;AAAA;AAAA;AAAA,EAMQ,aAAa,eAA0C;AAC9D,UAAM,YAAY,cAAc,SAAS,cAAc,UAAU;AACjE,UAAM,qBAAqB,cAAc,cAAc,YAAY,SAC9D,cAAc,aAAa,UAAU,eAAe;AACzD,QAAI,sBAAsB,CAAC,UAAU,MAAM,KAAK,EAAE,SAAS,oBAAoB,GAAG;AACjF,aAAO,GAAG,SAAS,IAAI,oBAAoB;AAAA,IAC5C;AACA,WAAO;AAAA,EACR;AAAA,EAEA,uBAAuB,EAAE,cAAc,GAAG,UAAyD;AAClG,WAAO;AAAA,EACR;AAAA,EAEA,MAAc,iBAAiB,eAAmD;AAjFnF,QAAA,IAAA;AAkFE,KAAA,KAAA,KAAK,aAAL,KAAiB,cAAc,GAAA,MAA/B,SAAwC,MAAMC,aAAAA,OAAO,SAAS,cAAc,GAAG;AAE/E,UAAM,SAAS,IAAI,KAAK,YAAY,cAAc,GAAG,EAAE;AAAA,MACtD;AAAA,QACC,WAAW,cAAc;AAAA,QACzB,eAAe,cAAc;AAAA,QAC7B,gBAAgB,CAAC,cAAc,gBAAgB,MAAM;AAAA,QACrD,8BAA8B,cAAc,4BAA4B;AAAA,QACxE,GAAI,cAAc,0BAA0B,EAAE,4BAA4B,cAAc,wBAAA,IAA4B,CAAA;AAAA,MAAC;AAAA,MAEtH;AAAA,MACA;AAAA,QACC,6BAA6B,CAAC,GAAI,cAAc,+BAA+B,CAAA,CAAG;AAAA,MAAA;AAAA,IACnF;AAGD,WAAOC,aAAAA,OAAO,YAAY,IAAI,OAAO,EAAE,SAAS,cAAc,WAAW;AAEzE,WAAO;AAAA,EACR;AACD;;"}

package/dist/development/src/model/service/idp/providers/OIDCProvider.js

@@ -2,12 +2,13 @@ import { Issuer, custom } from "openid-client";
 import { InvalidIDPConfigurationError } from "../InvalidIDPConfigurationError.js";
 import { catchTypesafe } from "./helpers.js";
 import { OIDCInitData, OIDCResponseData, OIDCConfiguration } from "./OIDCTypes.js";
-import { initOIDCAuth, handleOIDCResponse } from "./OIDCHelpers.js";
+import { initOIDCAuth, handleOIDCResponse, revalidateOIDC, buildOIDCLogoutUrl, validateOIDCLogoutToken } from "./OIDCHelpers.js";
 import { IDPValidationError } from "../IDPValidationError.js";
 var __defProp = Object.defineProperty;
 var __defNormalProp = (obj, key, value) => key in obj ? __defProp(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
 var __publicField = (obj, key, value) => __defNormalProp(obj, typeof key !== "symbol" ? key + "" : key, value);
 const DEFAULT_OIDC_TIMEOUT = 5e3;
+const OFFLINE_ACCESS_SCOPE = "offline_access";
 class OIDCProvider {
   constructor() {
     __publicField(this, "issuerCache", {});
@@ -17,7 +18,7 @@ class OIDCProvider {
     const initData = catchTypesafe(OIDCInitData, IDPValidationError)(data);
     const client = await this.createOIDCClient(configuration);
     return await initOIDCAuth(client, {
-      scope: configuration.scope ?? configuration.claims,
+      scope: this.resolveScope(configuration),
       ...initData
     });
   }
@@ -27,10 +28,38 @@ class OIDCProvider {
     return await handleOIDCResponse(
       client,
       responseData,
-      configuration.fetchUserInfo,
-      configuration.returnOIDCResult
+      {
+        fetchUserInfo: configuration.fetchUserInfo,
+        returnOIDCResult: configuration.returnOIDCResult,
+        captureSession: configuration.revalidation?.enabled === true,
+        claimMapping: configuration.claimMapping
+      }
     );
   }
+  async revalidate(configuration, session) {
+    const client = await this.createOIDCClient(configuration);
+    return await revalidateOIDC(client, configuration.revalidation?.method ?? "refresh", session);
+  }
+  async buildLogoutUrl(configuration, request) {
+    const client = await this.createOIDCClient(configuration);
+    return buildOIDCLogoutUrl(client, request);
+  }
+  async validateLogoutToken(configuration, logoutToken) {
+    const client = await this.createOIDCClient(configuration);
+    return await validateOIDCLogoutToken(client, client.issuer, logoutToken);
+  }
+  /**
+   * Resolve the requested scope, appending `offline_access` when refresh-token
+   * re-validation is enabled (so the IdP issues a refresh token to revalidate against).
+   */
+  resolveScope(configuration) {
+    const baseScope = configuration.scope ?? configuration.claims ?? "openid email";
+    const needsOfflineAccess = configuration.revalidation?.enabled === true && (configuration.revalidation.method ?? "refresh") === "refresh";
+    if (needsOfflineAccess && !baseScope.split(/\s+/).includes(OFFLINE_ACCESS_SCOPE)) {
+      return `${baseScope} ${OFFLINE_ACCESS_SCOPE}`;
+    }
+    return baseScope;
+  }
   getPublicConfiguration({ clientSecret, ...config }) {
     return config;
   }
@@ -42,7 +71,8 @@ class OIDCProvider {
         client_id: configuration.clientId,
         client_secret: configuration.clientSecret,
         response_types: [configuration.responseType || "code"],
-        id_token_signed_response_alg: configuration.idTokenSignedResponseAlg ?? "RS256"
+        id_token_signed_response_alg: configuration.idTokenSignedResponseAlg ?? "RS256",
+        ...configuration.tokenEndpointAuthMethod ? { token_endpoint_auth_method: configuration.tokenEndpointAuthMethod } : {}
       },
       void 0,
       {

package/dist/development/src/model/service/idp/providers/OIDCProvider.js.map

@@ -1 +1 @@
-{"version":3,"file":"OIDCProvider.js","sources":["../../../../../../../../packages/engine-tenant-api/src/model/service/idp/providers/OIDCProvider.ts"],"sourcesContent":["import { Client, custom, Issuer } from 'openid-client'\nimport { IdentityProviderHandler, IDPResponse, InitIDPAuthResult } from '../IdentityProviderHandler'\nimport { InvalidIDPConfigurationError } from '../InvalidIDPConfigurationError'\nimport { catchTypesafe } from './helpers'\nimport { OIDCConfiguration, OIDCInitData, OIDCResponseData } from './OIDCTypes'\nimport { handleOIDCResponse, initOIDCAuth } from './OIDCHelpers'\nimport { IDPValidationError } from '../IDPValidationError'\n\nconst DEFAULT_OIDC_TIMEOUT = 5000\n\nexport class OIDCProvider implements IdentityProviderHandler<OIDCConfiguration> {\n\tprivate issuerCache: Record<string, Issuer<Client>> = {}\n\n\tvalidateConfiguration = catchTypesafe(OIDCConfiguration, InvalidIDPConfigurationError)\n\n\tpublic async initAuth(configuration: OIDCConfiguration, data: unknown): Promise<InitIDPAuthResult> {\n\t\tconst initData = catchTypesafe(OIDCInitData, IDPValidationError)(data)\n\t\tconst client = await this.createOIDCClient(configuration)\n\t\treturn await initOIDCAuth(client, {\n\t\t\tscope: configuration.scope ?? configuration.claims,\n\t\t\t...initData,\n\t\t})\n\t}\n\n\tpublic async processResponse(configuration: OIDCConfiguration, data: unknown): Promise<IDPResponse> {\n\t\tconst responseData = catchTypesafe(OIDCResponseData, IDPValidationError)(data)\n\t\tconst client = await this.createOIDCClient(configuration)\n\t\treturn await handleOIDCResponse(\n\t\t\tclient,\n\t\t\tresponseData,\n\t\t\tconfiguration.fetchUserInfo,\n\t\t\tconfiguration.returnOIDCResult,\n\t\t)\n\t}\n\n\tgetPublicConfiguration({ clientSecret, ...config }: OIDCConfiguration): Partial<OIDCConfiguration> {\n\t\treturn config\n\t}\n\n\tprivate async createOIDCClient(configuration: OIDCConfiguration): Promise<Client> {\n\t\tthis.issuerCache[configuration.url] ??= await Issuer.discover(configuration.url)\n\n\t\tconst client = new this.issuerCache[configuration.url].Client(\n\t\t\t{\n\t\t\t\tclient_id: configuration.clientId,\n\t\t\t\tclient_secret: configuration.clientSecret,\n\t\t\t\tresponse_types: [configuration.responseType || 'code'],\n\t\t\t\tid_token_signed_response_alg: configuration.idTokenSignedResponseAlg ?? 'RS256',\n\t\t\t},\n\t\t\tundefined,\n\t\t\t{\n\t\t\t\tadditionalAuthorizedParties: [...(configuration.additionalAuthorizedParties ?? [])],\n\t\t\t},\n\t\t)\n\n\t\tclient[custom.http_options] = () => ({ timeout: configuration.timeout ?? DEFAULT_OIDC_TIMEOUT })\n\n\t\treturn client\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;AAQA,MAAM,uBAAuB;AAEtB,MAAM,aAAmE;AAAA,EAAzE,cAAA;AACN,kBAAA,MAAQ,eAA8C,EAAC;AAEvD,kBAAA,MAAA,yBAAwB,cAAc,mBAAmB,4BAA4B,CAAA;AAAA,EAAA;AAAA,EAErF,MAAa,SAAS,eAAkC,MAA2C;AAClG,UAAM,WAAW,cAAc,cAAc,kBAAkB,EAAE,IAAI;AACrE,UAAM,SAAS,MAAM,KAAK,iBAAiB,aAAa;AACxD,WAAO,MAAM,aAAa,QAAQ;AAAA,MACjC,OAAO,cAAc,SAAS,cAAc;AAAA,MAC5C,GAAG;AAAA,IAAA,CACH;AAAA,EACF;AAAA,EAEA,MAAa,gBAAgB,eAAkC,MAAqC;AACnG,UAAM,eAAe,cAAc,kBAAkB,kBAAkB,EAAE,IAAI;AAC7E,UAAM,SAAS,MAAM,KAAK,iBAAiB,aAAa;AACxD,WAAO,MAAM;AAAA,MACZ;AAAA,MACA;AAAA,MACA,cAAc;AAAA,MACd,cAAc;AAAA,IAAA;AAAA,EAEhB;AAAA,EAEA,uBAAuB,EAAE,cAAc,GAAG,UAAyD;AAClG,WAAO;AAAA,EACR;AAAA,EAEA,MAAc,iBAAiB,eAAmD;AAvCnF,QAAA,IAAA;AAwCE,KAAA,KAAA,KAAK,aAAL,KAAiB,cAAc,GAAA,MAA/B,SAAwC,MAAM,OAAO,SAAS,cAAc,GAAG;AAE/E,UAAM,SAAS,IAAI,KAAK,YAAY,cAAc,GAAG,EAAE;AAAA,MACtD;AAAA,QACC,WAAW,cAAc;AAAA,QACzB,eAAe,cAAc;AAAA,QAC7B,gBAAgB,CAAC,cAAc,gBAAgB,MAAM;AAAA,QACrD,8BAA8B,cAAc,4BAA4B;AAAA,MAAA;AAAA,MAEzE;AAAA,MACA;AAAA,QACC,6BAA6B,CAAC,GAAI,cAAc,+BAA+B,CAAA,CAAG;AAAA,MAAA;AAAA,IACnF;AAGD,WAAO,OAAO,YAAY,IAAI,OAAO,EAAE,SAAS,cAAc,WAAW;AAEzE,WAAO;AAAA,EACR;AACD;"}
+{"version":3,"file":"OIDCProvider.js","sources":["../../../../../../../../packages/engine-tenant-api/src/model/service/idp/providers/OIDCProvider.ts"],"sourcesContent":["import { Client, custom, Issuer } from 'openid-client'\nimport {\n\tIdentityProviderHandler,\n\tIDPResponse,\n\tIDPSessionState,\n\tInitIDPAuthResult,\n\tLogoutTokenClaims,\n\tLogoutUrlRequest,\n\tRevalidationResult,\n} from '../IdentityProviderHandler.js'\nimport { InvalidIDPConfigurationError } from '../InvalidIDPConfigurationError.js'\nimport { catchTypesafe } from './helpers.js'\nimport { OIDCConfiguration, OIDCInitData, OIDCResponseData } from './OIDCTypes.js'\nimport { buildOIDCLogoutUrl, handleOIDCResponse, initOIDCAuth, revalidateOIDC, validateOIDCLogoutToken } from './OIDCHelpers.js'\nimport { IDPValidationError } from '../IDPValidationError.js'\n\nconst DEFAULT_OIDC_TIMEOUT = 5000\nconst OFFLINE_ACCESS_SCOPE = 'offline_access'\n\nexport class OIDCProvider implements IdentityProviderHandler<OIDCConfiguration> {\n\tprivate issuerCache: Record<string, Issuer<Client>> = {}\n\n\tvalidateConfiguration = catchTypesafe(OIDCConfiguration, InvalidIDPConfigurationError)\n\n\tpublic async initAuth(configuration: OIDCConfiguration, data: unknown): Promise<InitIDPAuthResult> {\n\t\tconst initData = catchTypesafe(OIDCInitData, IDPValidationError)(data)\n\t\tconst client = await this.createOIDCClient(configuration)\n\t\treturn await initOIDCAuth(client, {\n\t\t\tscope: this.resolveScope(configuration),\n\t\t\t...initData,\n\t\t})\n\t}\n\n\tpublic async processResponse(configuration: OIDCConfiguration, data: unknown): Promise<IDPResponse> {\n\t\tconst responseData = catchTypesafe(OIDCResponseData, IDPValidationError)(data)\n\t\tconst client = await this.createOIDCClient(configuration)\n\t\treturn await handleOIDCResponse(\n\t\t\tclient,\n\t\t\tresponseData,\n\t\t\t{\n\t\t\t\tfetchUserInfo: configuration.fetchUserInfo,\n\t\t\t\treturnOIDCResult: configuration.returnOIDCResult,\n\t\t\t\tcaptureSession: configuration.revalidation?.enabled === true,\n\t\t\t\tclaimMapping: configuration.claimMapping,\n\t\t\t},\n\t\t)\n\t}\n\n\tpublic async revalidate(configuration: OIDCConfiguration, session: IDPSessionState): Promise<RevalidationResult> {\n\t\tconst client = await this.createOIDCClient(configuration)\n\t\treturn await revalidateOIDC(client, configuration.revalidation?.method ?? 'refresh', session)\n\t}\n\n\tpublic async buildLogoutUrl(configuration: OIDCConfiguration, request: LogoutUrlRequest): Promise<string | null> {\n\t\tconst client = await this.createOIDCClient(configuration)\n\t\treturn buildOIDCLogoutUrl(client, request)\n\t}\n\n\tpublic async validateLogoutToken(configuration: OIDCConfiguration, logoutToken: string): Promise<LogoutTokenClaims> {\n\t\tconst client = await this.createOIDCClient(configuration)\n\t\treturn await validateOIDCLogoutToken(client, client.issuer, logoutToken)\n\t}\n\n\t/**\n\t * Resolve the requested scope, appending `offline_access` when refresh-token\n\t * re-validation is enabled (so the IdP issues a refresh token to revalidate against).\n\t */\n\tprivate resolveScope(configuration: OIDCConfiguration): string {\n\t\tconst baseScope = configuration.scope ?? configuration.claims ?? 'openid email'\n\t\tconst needsOfflineAccess = configuration.revalidation?.enabled === true\n\t\t\t&& (configuration.revalidation.method ?? 'refresh') === 'refresh'\n\t\tif (needsOfflineAccess && !baseScope.split(/\\s+/).includes(OFFLINE_ACCESS_SCOPE)) {\n\t\t\treturn `${baseScope} ${OFFLINE_ACCESS_SCOPE}`\n\t\t}\n\t\treturn baseScope\n\t}\n\n\tgetPublicConfiguration({ clientSecret, ...config }: OIDCConfiguration): Partial<OIDCConfiguration> {\n\t\treturn config\n\t}\n\n\tprivate async createOIDCClient(configuration: OIDCConfiguration): Promise<Client> {\n\t\tthis.issuerCache[configuration.url] ??= await Issuer.discover(configuration.url)\n\n\t\tconst client = new this.issuerCache[configuration.url].Client(\n\t\t\t{\n\t\t\t\tclient_id: configuration.clientId,\n\t\t\t\tclient_secret: configuration.clientSecret,\n\t\t\t\tresponse_types: [configuration.responseType || 'code'],\n\t\t\t\tid_token_signed_response_alg: configuration.idTokenSignedResponseAlg ?? 'RS256',\n\t\t\t\t...(configuration.tokenEndpointAuthMethod ? { token_endpoint_auth_method: configuration.tokenEndpointAuthMethod } : {}),\n\t\t\t},\n\t\t\tundefined,\n\t\t\t{\n\t\t\t\tadditionalAuthorizedParties: [...(configuration.additionalAuthorizedParties ?? [])],\n\t\t\t},\n\t\t)\n\n\t\tclient[custom.http_options] = () => ({ timeout: configuration.timeout ?? DEFAULT_OIDC_TIMEOUT })\n\n\t\treturn client\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;AAgBA,MAAM,uBAAuB;AAC7B,MAAM,uBAAuB;AAEtB,MAAM,aAAmE;AAAA,EAAzE,cAAA;AACN,kBAAA,MAAQ,eAA8C,EAAC;AAEvD,kBAAA,MAAA,yBAAwB,cAAc,mBAAmB,4BAA4B,CAAA;AAAA,EAAA;AAAA,EAErF,MAAa,SAAS,eAAkC,MAA2C;AAClG,UAAM,WAAW,cAAc,cAAc,kBAAkB,EAAE,IAAI;AACrE,UAAM,SAAS,MAAM,KAAK,iBAAiB,aAAa;AACxD,WAAO,MAAM,aAAa,QAAQ;AAAA,MACjC,OAAO,KAAK,aAAa,aAAa;AAAA,MACtC,GAAG;AAAA,IAAA,CACH;AAAA,EACF;AAAA,EAEA,MAAa,gBAAgB,eAAkC,MAAqC;AACnG,UAAM,eAAe,cAAc,kBAAkB,kBAAkB,EAAE,IAAI;AAC7E,UAAM,SAAS,MAAM,KAAK,iBAAiB,aAAa;AACxD,WAAO,MAAM;AAAA,MACZ;AAAA,MACA;AAAA,MACA;AAAA,QACC,eAAe,cAAc;AAAA,QAC7B,kBAAkB,cAAc;AAAA,QAChC,gBAAgB,cAAc,cAAc,YAAY;AAAA,QACxD,cAAc,cAAc;AAAA,MAAA;AAAA,IAC7B;AAAA,EAEF;AAAA,EAEA,MAAa,WAAW,eAAkC,SAAuD;AAChH,UAAM,SAAS,MAAM,KAAK,iBAAiB,aAAa;AACxD,WAAO,MAAM,eAAe,QAAQ,cAAc,cAAc,UAAU,WAAW,OAAO;AAAA,EAC7F;AAAA,EAEA,MAAa,eAAe,eAAkC,SAAmD;AAChH,UAAM,SAAS,MAAM,KAAK,iBAAiB,aAAa;AACxD,WAAO,mBAAmB,QAAQ,OAAO;AAAA,EAC1C;AAAA,EAEA,MAAa,oBAAoB,eAAkC,aAAiD;AACnH,UAAM,SAAS,MAAM,KAAK,iBAAiB,aAAa;AACxD,WAAO,MAAM,wBAAwB,QAAQ,OAAO,QAAQ,WAAW;AAAA,EACxE;AAAA;AAAA;AAAA;AAAA;AAAA,EAMQ,aAAa,eAA0C;AAC9D,UAAM,YAAY,cAAc,SAAS,cAAc,UAAU;AACjE,UAAM,qBAAqB,cAAc,cAAc,YAAY,SAC9D,cAAc,aAAa,UAAU,eAAe;AACzD,QAAI,sBAAsB,CAAC,UAAU,MAAM,KAAK,EAAE,SAAS,oBAAoB,GAAG;AACjF,aAAO,GAAG,SAAS,IAAI,oBAAoB;AAAA,IAC5C;AACA,WAAO;AAAA,EACR;AAAA,EAEA,uBAAuB,EAAE,cAAc,GAAG,UAAyD;AAClG,WAAO;AAAA,EACR;AAAA,EAEA,MAAc,iBAAiB,eAAmD;AAjFnF,QAAA,IAAA;AAkFE,KAAA,KAAA,KAAK,aAAL,KAAiB,cAAc,GAAA,MAA/B,SAAwC,MAAM,OAAO,SAAS,cAAc,GAAG;AAE/E,UAAM,SAAS,IAAI,KAAK,YAAY,cAAc,GAAG,EAAE;AAAA,MACtD;AAAA,QACC,WAAW,cAAc;AAAA,QACzB,eAAe,cAAc;AAAA,QAC7B,gBAAgB,CAAC,cAAc,gBAAgB,MAAM;AAAA,QACrD,8BAA8B,cAAc,4BAA4B;AAAA,QACxE,GAAI,cAAc,0BAA0B,EAAE,4BAA4B,cAAc,wBAAA,IAA4B,CAAA;AAAA,MAAC;AAAA,MAEtH;AAAA,MACA;AAAA,QACC,6BAA6B,CAAC,GAAI,cAAc,+BAA+B,CAAA,CAAG;AAAA,MAAA;AAAA,IACnF;AAGD,WAAO,OAAO,YAAY,IAAI,OAAO,EAAE,SAAS,cAAc,WAAW;AAEzE,WAAO;AAAA,EACR;AACD;"}

package/dist/development/src/model/service/idp/providers/OIDCTypes.cjs

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const Typesafe = require("@contember/typesafe");
+const IDPRevalidation = require("../IDPRevalidation.cjs");
 function _interopNamespaceDefault(e) {
   const n = Object.create(null, { [Symbol.toStringTag]: { value: "Module" } });
   if (e) {
@@ -18,6 +19,31 @@ function _interopNamespaceDefault(e) {
   return Object.freeze(n);
 }
 const Typesafe__namespace = /* @__PURE__ */ _interopNamespaceDefault(Typesafe);
+const OIDCRevalidationConfig = Typesafe__namespace.intersection(
+  IDPRevalidation.IDPRevalidationConfig,
+  Typesafe__namespace.partial({
+    /** How to probe the IdP. `refresh` needs `offline_access`; default `refresh`. */
+    method: Typesafe__namespace.enumeration("refresh", "userinfo", "introspection")
+  })
+);
+const OIDCClaimMapping = Typesafe__namespace.partial({
+  /**
+   * Claim used as the stable external identifier (the IdP subject). Default `sub`.
+   * Must resolve to a scalar (string/number) — a non-scalar claim is rejected at sign-in.
+   * Mapping this to a claim that only appears in userInfo / `attributes` takes the federation
+   * key off the signature-verified ID-token subject; prefer a signed claim where possible.
+   */
+  externalIdentifier: Typesafe__namespace.string,
+  /** Claim used as the e-mail address. Default `email`. */
+  email: Typesafe__namespace.string,
+  /** Claim used as the display name. Default `name`. */
+  name: Typesafe__namespace.string,
+  /**
+   * Key of a nested object whose properties are lifted to the top level before mapping.
+   * Some providers (notably Apereo CAS userinfo) nest the actual claims under `attributes`.
+   */
+  attributesKey: Typesafe__namespace.string
+});
 const OIDCConfigurationOptions = Typesafe__namespace.partial({
   responseType: Typesafe__namespace.enumeration("code", "code id_token", "code id_token token", "code token", "id_token", "id_token token", "none"),
   claims: Typesafe__namespace.string,
@@ -25,9 +51,31 @@ const OIDCConfigurationOptions = Typesafe__namespace.partial({
   scope: Typesafe__namespace.string,
   additionalAuthorizedParties: Typesafe__namespace.array(Typesafe__namespace.string),
   idTokenSignedResponseAlg: Typesafe__namespace.string,
+  /**
+   * How the client authenticates to the token endpoint. `openid-client` defaults to
+   * `client_secret_basic`; set `client_secret_post` for providers (e.g. some Apereo CAS
+   * registrations) that only accept the secret in the request body.
+   */
+  tokenEndpointAuthMethod: Typesafe__namespace.enumeration(
+    "client_secret_basic",
+    "client_secret_post",
+    "client_secret_jwt",
+    "private_key_jwt",
+    "tls_client_auth",
+    "self_signed_tls_client_auth",
+    "none"
+  ),
   fetchUserInfo: Typesafe__namespace.boolean,
   returnOIDCResult: Typesafe__namespace.boolean,
-  timeout: Typesafe__namespace.number
+  timeout: Typesafe__namespace.number,
+  revalidation: OIDCRevalidationConfig,
+  claimMapping: OIDCClaimMapping,
+  /**
+   * Where the IdP should send the browser back after an RP-initiated (front-channel) logout
+   * (A10). Used as `post_logout_redirect_uri` in the end-session URL; must be registered at the
+   * IdP. When unset, the IdP applies its own default post-logout behavior.
+   */
+  postLogoutRedirectUri: Typesafe__namespace.string
 });
 const BaseOIDCConfiguration = Typesafe__namespace.intersection(
   Typesafe__namespace.object({
@@ -69,8 +117,10 @@ const OIDCInitData = Typesafe__namespace.noExtraProps(Typesafe__namespace.inters
   })
 ));
 exports.BaseOIDCConfiguration = BaseOIDCConfiguration;
+exports.OIDCClaimMapping = OIDCClaimMapping;
 exports.OIDCConfiguration = OIDCConfiguration;
 exports.OIDCConfigurationOptions = OIDCConfigurationOptions;
 exports.OIDCInitData = OIDCInitData;
 exports.OIDCResponseData = OIDCResponseData;
+exports.OIDCRevalidationConfig = OIDCRevalidationConfig;
 //# sourceMappingURL=OIDCTypes.cjs.map

package/dist/development/src/model/service/idp/providers/OIDCTypes.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"OIDCTypes.cjs","sources":["../../../../../../../../packages/engine-tenant-api/src/model/service/idp/providers/OIDCTypes.ts"],"sourcesContent":["import * as Typesafe from '@contember/typesafe'\nimport { ResponseType } from 'openid-client'\n\nexport interface OIDCSessionData {\n\tnonce: string\n\tstate: string\n}\n\nexport const OIDCConfigurationOptions = Typesafe.partial({\n\tresponseType: Typesafe.enumeration<ResponseType>('code', 'code id_token', 'code id_token token', 'code token', 'id_token', 'id_token token', 'none'),\n\tclaims: Typesafe.string, // deprecated, use scope instead\n\tscope: Typesafe.string,\n\tadditionalAuthorizedParties: Typesafe.array(Typesafe.string),\n\tidTokenSignedResponseAlg: Typesafe.string,\n\tfetchUserInfo: Typesafe.boolean,\n\treturnOIDCResult: Typesafe.boolean,\n\ttimeout: Typesafe.number,\n})\nexport const BaseOIDCConfiguration = Typesafe.intersection(\n\tTypesafe.object({\n\t\turl: Typesafe.string,\n\t\tclientId: Typesafe.string,\n\t\tclientSecret: Typesafe.string,\n\t}),\n\tOIDCConfigurationOptions,\n)\n\nexport const OIDCConfiguration = Typesafe.intersection(\n\tBaseOIDCConfiguration,\n\tTypesafe.object({\n\t\turl: Typesafe.string,\n\t}),\n)\n\nexport type OIDCConfiguration = ReturnType<typeof OIDCConfiguration>\n\nexport const OIDCResponseData = Typesafe.intersection(\n\tTypesafe.union(\n\t\tTypesafe.object({\n\t\t\turl: Typesafe.string,\n\t\t}),\n\t\tTypesafe.object({\n\t\t\tparameters: Typesafe.record(Typesafe.string, Typesafe.string),\n\t\t}),\n\t),\n\tTypesafe.partial({\n\t\tredirectUrl: Typesafe.string,\n\t\tsessionData: Typesafe.partial({\n\t\t\tnonce: Typesafe.string,\n\t\t\tstate: Typesafe.string,\n\t\t}),\n\t}),\n)\n\nexport type OIDCResponseData = ReturnType<typeof OIDCResponseData>\n\nexport const OIDCInitData = Typesafe.noExtraProps(Typesafe.intersection(\n\tTypesafe.object({\n\t\tredirectUrl: Typesafe.string,\n\t}),\n\tTypesafe.partial({\n\t\tresponseMode: Typesafe.string,\n\t}),\n))\n\nexport type OIDCInitData = ReturnType<typeof OIDCInitData>\n"],"names":["Typesafe"],"mappings":";;;;;;;;;;;;;;;;;;;;AAQO,MAAM,2BAA2BA,oBAAS,QAAQ;AAAA,EACxD,cAAcA,oBAAS,YAA0B,QAAQ,iBAAiB,uBAAuB,cAAc,YAAY,kBAAkB,MAAM;AAAA,EACnJ,QAAQA,oBAAS;AAAA;AAAA,EACjB,OAAOA,oBAAS;AAAA,EAChB,6BAA6BA,oBAAS,MAAMA,oBAAS,MAAM;AAAA,EAC3D,0BAA0BA,oBAAS;AAAA,EACnC,eAAeA,oBAAS;AAAA,EACxB,kBAAkBA,oBAAS;AAAA,EAC3B,SAASA,oBAAS;AACnB,CAAC;AACM,MAAM,wBAAwBA,oBAAS;AAAA,EAC7CA,oBAAS,OAAO;AAAA,IACf,KAAKA,oBAAS;AAAA,IACd,UAAUA,oBAAS;AAAA,IACnB,cAAcA,oBAAS;AAAA,EAAA,CACvB;AAAA,EACD;AACD;AAEO,MAAM,oBAAoBA,oBAAS;AAAA,EACzC;AAAA,EACAA,oBAAS,OAAO;AAAA,IACf,KAAKA,oBAAS;AAAA,EAAA,CACd;AACF;AAIO,MAAM,mBAAmBA,oBAAS;AAAA,EACxCA,oBAAS;AAAA,IACRA,oBAAS,OAAO;AAAA,MACf,KAAKA,oBAAS;AAAA,IAAA,CACd;AAAA,IACDA,oBAAS,OAAO;AAAA,MACf,YAAYA,oBAAS,OAAOA,oBAAS,QAAQA,oBAAS,MAAM;AAAA,IAAA,CAC5D;AAAA,EAAA;AAAA,EAEFA,oBAAS,QAAQ;AAAA,IAChB,aAAaA,oBAAS;AAAA,IACtB,aAAaA,oBAAS,QAAQ;AAAA,MAC7B,OAAOA,oBAAS;AAAA,MAChB,OAAOA,oBAAS;AAAA,IAAA,CAChB;AAAA,EAAA,CACD;AACF;AAIO,MAAM,eAAeA,oBAAS,aAAaA,oBAAS;AAAA,EAC1DA,oBAAS,OAAO;AAAA,IACf,aAAaA,oBAAS;AAAA,EAAA,CACtB;AAAA,EACDA,oBAAS,QAAQ;AAAA,IAChB,cAAcA,oBAAS;AAAA,EAAA,CACvB;AACF,CAAC;;;;;;"}
+{"version":3,"file":"OIDCTypes.cjs","sources":["../../../../../../../../packages/engine-tenant-api/src/model/service/idp/providers/OIDCTypes.ts"],"sourcesContent":["import * as Typesafe from '@contember/typesafe'\nimport { ClientAuthMethod, ResponseType } from 'openid-client'\nimport { IDPRevalidationConfig } from '../IDPRevalidation.js'\n\nexport interface OIDCSessionData {\n\tnonce: string\n\tstate: string\n}\n\n/** OIDC re-validation config: the generic settings plus the OIDC-specific probe method. */\nexport const OIDCRevalidationConfig = Typesafe.intersection(\n\tIDPRevalidationConfig,\n\tTypesafe.partial({\n\t\t/** How to probe the IdP. `refresh` needs `offline_access`; default `refresh`. */\n\t\tmethod: Typesafe.enumeration('refresh', 'userinfo', 'introspection'),\n\t}),\n)\n\nexport type OIDCRevalidationConfig = ReturnType<typeof OIDCRevalidationConfig>\n\n/**\n * Maps provider claims onto the normalized {@link IDPResponse} fields. Each value is a claim\n * name, dot-path supported (e.g. `address.region`). Lets a provider whose claims don't follow\n * the OIDC defaults still be consumed without a per-provider code change.\n */\nexport const OIDCClaimMapping = Typesafe.partial({\n\t/**\n\t * Claim used as the stable external identifier (the IdP subject). Default `sub`.\n\t * Must resolve to a scalar (string/number) — a non-scalar claim is rejected at sign-in.\n\t * Mapping this to a claim that only appears in userInfo / `attributes` takes the federation\n\t * key off the signature-verified ID-token subject; prefer a signed claim where possible.\n\t */\n\texternalIdentifier: Typesafe.string,\n\t/** Claim used as the e-mail address. Default `email`. */\n\temail: Typesafe.string,\n\t/** Claim used as the display name. Default `name`. */\n\tname: Typesafe.string,\n\t/**\n\t * Key of a nested object whose properties are lifted to the top level before mapping.\n\t * Some providers (notably Apereo CAS userinfo) nest the actual claims under `attributes`.\n\t */\n\tattributesKey: Typesafe.string,\n})\n\nexport type OIDCClaimMapping = ReturnType<typeof OIDCClaimMapping>\n\nexport const OIDCConfigurationOptions = Typesafe.partial({\n\tresponseType: Typesafe.enumeration<ResponseType>('code', 'code id_token', 'code id_token token', 'code token', 'id_token', 'id_token token', 'none'),\n\tclaims: Typesafe.string, // deprecated, use scope instead\n\tscope: Typesafe.string,\n\tadditionalAuthorizedParties: Typesafe.array(Typesafe.string),\n\tidTokenSignedResponseAlg: Typesafe.string,\n\t/**\n\t * How the client authenticates to the token endpoint. `openid-client` defaults to\n\t * `client_secret_basic`; set `client_secret_post` for providers (e.g. some Apereo CAS\n\t * registrations) that only accept the secret in the request body.\n\t */\n\ttokenEndpointAuthMethod: Typesafe.enumeration<ClientAuthMethod>(\n\t\t'client_secret_basic',\n\t\t'client_secret_post',\n\t\t'client_secret_jwt',\n\t\t'private_key_jwt',\n\t\t'tls_client_auth',\n\t\t'self_signed_tls_client_auth',\n\t\t'none',\n\t),\n\tfetchUserInfo: Typesafe.boolean,\n\treturnOIDCResult: Typesafe.boolean,\n\ttimeout: Typesafe.number,\n\trevalidation: OIDCRevalidationConfig,\n\tclaimMapping: OIDCClaimMapping,\n\t/**\n\t * Where the IdP should send the browser back after an RP-initiated (front-channel) logout\n\t * (A10). Used as `post_logout_redirect_uri` in the end-session URL; must be registered at the\n\t * IdP. When unset, the IdP applies its own default post-logout behavior.\n\t */\n\tpostLogoutRedirectUri: Typesafe.string,\n})\nexport const BaseOIDCConfiguration = Typesafe.intersection(\n\tTypesafe.object({\n\t\turl: Typesafe.string,\n\t\tclientId: Typesafe.string,\n\t\tclientSecret: Typesafe.string,\n\t}),\n\tOIDCConfigurationOptions,\n)\n\nexport const OIDCConfiguration = Typesafe.intersection(\n\tBaseOIDCConfiguration,\n\tTypesafe.object({\n\t\turl: Typesafe.string,\n\t}),\n)\n\nexport type OIDCConfiguration = ReturnType<typeof OIDCConfiguration>\n\nexport const OIDCResponseData = Typesafe.intersection(\n\tTypesafe.union(\n\t\tTypesafe.object({\n\t\t\turl: Typesafe.string,\n\t\t}),\n\t\tTypesafe.object({\n\t\t\tparameters: Typesafe.record(Typesafe.string, Typesafe.string),\n\t\t}),\n\t),\n\tTypesafe.partial({\n\t\tredirectUrl: Typesafe.string,\n\t\tsessionData: Typesafe.partial({\n\t\t\tnonce: Typesafe.string,\n\t\t\tstate: Typesafe.string,\n\t\t}),\n\t}),\n)\n\nexport type OIDCResponseData = ReturnType<typeof OIDCResponseData>\n\nexport const OIDCInitData = Typesafe.noExtraProps(Typesafe.intersection(\n\tTypesafe.object({\n\t\tredirectUrl: Typesafe.string,\n\t}),\n\tTypesafe.partial({\n\t\tresponseMode: Typesafe.string,\n\t}),\n))\n\nexport type OIDCInitData = ReturnType<typeof OIDCInitData>\n"],"names":["Typesafe","IDPRevalidationConfig"],"mappings":";;;;;;;;;;;;;;;;;;;;;AAUO,MAAM,yBAAyBA,oBAAS;AAAA,EAC9CC,gBAAAA;AAAAA,EACAD,oBAAS,QAAQ;AAAA;AAAA,IAEhB,QAAQA,oBAAS,YAAY,WAAW,YAAY,eAAe;AAAA,EAAA,CACnE;AACF;AASO,MAAM,mBAAmBA,oBAAS,QAAQ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOhD,oBAAoBA,oBAAS;AAAA;AAAA,EAE7B,OAAOA,oBAAS;AAAA;AAAA,EAEhB,MAAMA,oBAAS;AAAA;AAAA;AAAA;AAAA;AAAA,EAKf,eAAeA,oBAAS;AACzB,CAAC;AAIM,MAAM,2BAA2BA,oBAAS,QAAQ;AAAA,EACxD,cAAcA,oBAAS,YAA0B,QAAQ,iBAAiB,uBAAuB,cAAc,YAAY,kBAAkB,MAAM;AAAA,EACnJ,QAAQA,oBAAS;AAAA;AAAA,EACjB,OAAOA,oBAAS;AAAA,EAChB,6BAA6BA,oBAAS,MAAMA,oBAAS,MAAM;AAAA,EAC3D,0BAA0BA,oBAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMnC,yBAAyBA,oBAAS;AAAA,IACjC;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EAAA;AAAA,EAED,eAAeA,oBAAS;AAAA,EACxB,kBAAkBA,oBAAS;AAAA,EAC3B,SAASA,oBAAS;AAAA,EAClB,cAAc;AAAA,EACd,cAAc;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMd,uBAAuBA,oBAAS;AACjC,CAAC;AACM,MAAM,wBAAwBA,oBAAS;AAAA,EAC7CA,oBAAS,OAAO;AAAA,IACf,KAAKA,oBAAS;AAAA,IACd,UAAUA,oBAAS;AAAA,IACnB,cAAcA,oBAAS;AAAA,EAAA,CACvB;AAAA,EACD;AACD;AAEO,MAAM,oBAAoBA,oBAAS;AAAA,EACzC;AAAA,EACAA,oBAAS,OAAO;AAAA,IACf,KAAKA,oBAAS;AAAA,EAAA,CACd;AACF;AAIO,MAAM,mBAAmBA,oBAAS;AAAA,EACxCA,oBAAS;AAAA,IACRA,oBAAS,OAAO;AAAA,MACf,KAAKA,oBAAS;AAAA,IAAA,CACd;AAAA,IACDA,oBAAS,OAAO;AAAA,MACf,YAAYA,oBAAS,OAAOA,oBAAS,QAAQA,oBAAS,MAAM;AAAA,IAAA,CAC5D;AAAA,EAAA;AAAA,EAEFA,oBAAS,QAAQ;AAAA,IAChB,aAAaA,oBAAS;AAAA,IACtB,aAAaA,oBAAS,QAAQ;AAAA,MAC7B,OAAOA,oBAAS;AAAA,MAChB,OAAOA,oBAAS;AAAA,IAAA,CAChB;AAAA,EAAA,CACD;AACF;AAIO,MAAM,eAAeA,oBAAS,aAAaA,oBAAS;AAAA,EAC1DA,oBAAS,OAAO;AAAA,IACf,aAAaA,oBAAS;AAAA,EAAA,CACtB;AAAA,EACDA,oBAAS,QAAQ;AAAA,IAChB,cAAcA,oBAAS;AAAA,EAAA,CACvB;AACF,CAAC;;;;;;;;"}

package/dist/development/src/model/service/idp/providers/OIDCTypes.js

@@ -1,4 +1,30 @@
 import * as Typesafe from "@contember/typesafe";
+import { IDPRevalidationConfig } from "../IDPRevalidation.js";
+const OIDCRevalidationConfig = Typesafe.intersection(
+  IDPRevalidationConfig,
+  Typesafe.partial({
+    /** How to probe the IdP. `refresh` needs `offline_access`; default `refresh`. */
+    method: Typesafe.enumeration("refresh", "userinfo", "introspection")
+  })
+);
+const OIDCClaimMapping = Typesafe.partial({
+  /**
+   * Claim used as the stable external identifier (the IdP subject). Default `sub`.
+   * Must resolve to a scalar (string/number) — a non-scalar claim is rejected at sign-in.
+   * Mapping this to a claim that only appears in userInfo / `attributes` takes the federation
+   * key off the signature-verified ID-token subject; prefer a signed claim where possible.
+   */
+  externalIdentifier: Typesafe.string,
+  /** Claim used as the e-mail address. Default `email`. */
+  email: Typesafe.string,
+  /** Claim used as the display name. Default `name`. */
+  name: Typesafe.string,
+  /**
+   * Key of a nested object whose properties are lifted to the top level before mapping.
+   * Some providers (notably Apereo CAS userinfo) nest the actual claims under `attributes`.
+   */
+  attributesKey: Typesafe.string
+});
 const OIDCConfigurationOptions = Typesafe.partial({
   responseType: Typesafe.enumeration("code", "code id_token", "code id_token token", "code token", "id_token", "id_token token", "none"),
   claims: Typesafe.string,
@@ -6,9 +32,31 @@ const OIDCConfigurationOptions = Typesafe.partial({
   scope: Typesafe.string,
   additionalAuthorizedParties: Typesafe.array(Typesafe.string),
   idTokenSignedResponseAlg: Typesafe.string,
+  /**
+   * How the client authenticates to the token endpoint. `openid-client` defaults to
+   * `client_secret_basic`; set `client_secret_post` for providers (e.g. some Apereo CAS
+   * registrations) that only accept the secret in the request body.
+   */
+  tokenEndpointAuthMethod: Typesafe.enumeration(
+    "client_secret_basic",
+    "client_secret_post",
+    "client_secret_jwt",
+    "private_key_jwt",
+    "tls_client_auth",
+    "self_signed_tls_client_auth",
+    "none"
+  ),
   fetchUserInfo: Typesafe.boolean,
   returnOIDCResult: Typesafe.boolean,
-  timeout: Typesafe.number
+  timeout: Typesafe.number,
+  revalidation: OIDCRevalidationConfig,
+  claimMapping: OIDCClaimMapping,
+  /**
+   * Where the IdP should send the browser back after an RP-initiated (front-channel) logout
+   * (A10). Used as `post_logout_redirect_uri` in the end-session URL; must be registered at the
+   * IdP. When unset, the IdP applies its own default post-logout behavior.
+   */
+  postLogoutRedirectUri: Typesafe.string
 });
 const BaseOIDCConfiguration = Typesafe.intersection(
   Typesafe.object({
@@ -51,9 +99,11 @@ const OIDCInitData = Typesafe.noExtraProps(Typesafe.intersection(
 ));
 export {
   BaseOIDCConfiguration,
+  OIDCClaimMapping,
   OIDCConfiguration,
   OIDCConfigurationOptions,
   OIDCInitData,
-  OIDCResponseData
+  OIDCResponseData,
+  OIDCRevalidationConfig
 };
 //# sourceMappingURL=OIDCTypes.js.map

package/dist/development/src/model/service/idp/providers/OIDCTypes.js.map

@@ -1 +1 @@
-{"version":3,"file":"OIDCTypes.js","sources":["../../../../../../../../packages/engine-tenant-api/src/model/service/idp/providers/OIDCTypes.ts"],"sourcesContent":["import * as Typesafe from '@contember/typesafe'\nimport { ResponseType } from 'openid-client'\n\nexport interface OIDCSessionData {\n\tnonce: string\n\tstate: string\n}\n\nexport const OIDCConfigurationOptions = Typesafe.partial({\n\tresponseType: Typesafe.enumeration<ResponseType>('code', 'code id_token', 'code id_token token', 'code token', 'id_token', 'id_token token', 'none'),\n\tclaims: Typesafe.string, // deprecated, use scope instead\n\tscope: Typesafe.string,\n\tadditionalAuthorizedParties: Typesafe.array(Typesafe.string),\n\tidTokenSignedResponseAlg: Typesafe.string,\n\tfetchUserInfo: Typesafe.boolean,\n\treturnOIDCResult: Typesafe.boolean,\n\ttimeout: Typesafe.number,\n})\nexport const BaseOIDCConfiguration = Typesafe.intersection(\n\tTypesafe.object({\n\t\turl: Typesafe.string,\n\t\tclientId: Typesafe.string,\n\t\tclientSecret: Typesafe.string,\n\t}),\n\tOIDCConfigurationOptions,\n)\n\nexport const OIDCConfiguration = Typesafe.intersection(\n\tBaseOIDCConfiguration,\n\tTypesafe.object({\n\t\turl: Typesafe.string,\n\t}),\n)\n\nexport type OIDCConfiguration = ReturnType<typeof OIDCConfiguration>\n\nexport const OIDCResponseData = Typesafe.intersection(\n\tTypesafe.union(\n\t\tTypesafe.object({\n\t\t\turl: Typesafe.string,\n\t\t}),\n\t\tTypesafe.object({\n\t\t\tparameters: Typesafe.record(Typesafe.string, Typesafe.string),\n\t\t}),\n\t),\n\tTypesafe.partial({\n\t\tredirectUrl: Typesafe.string,\n\t\tsessionData: Typesafe.partial({\n\t\t\tnonce: Typesafe.string,\n\t\t\tstate: Typesafe.string,\n\t\t}),\n\t}),\n)\n\nexport type OIDCResponseData = ReturnType<typeof OIDCResponseData>\n\nexport const OIDCInitData = Typesafe.noExtraProps(Typesafe.intersection(\n\tTypesafe.object({\n\t\tredirectUrl: Typesafe.string,\n\t}),\n\tTypesafe.partial({\n\t\tresponseMode: Typesafe.string,\n\t}),\n))\n\nexport type OIDCInitData = ReturnType<typeof OIDCInitData>\n"],"names":[],"mappings":";AAQO,MAAM,2BAA2B,SAAS,QAAQ;AAAA,EACxD,cAAc,SAAS,YAA0B,QAAQ,iBAAiB,uBAAuB,cAAc,YAAY,kBAAkB,MAAM;AAAA,EACnJ,QAAQ,SAAS;AAAA;AAAA,EACjB,OAAO,SAAS;AAAA,EAChB,6BAA6B,SAAS,MAAM,SAAS,MAAM;AAAA,EAC3D,0BAA0B,SAAS;AAAA,EACnC,eAAe,SAAS;AAAA,EACxB,kBAAkB,SAAS;AAAA,EAC3B,SAAS,SAAS;AACnB,CAAC;AACM,MAAM,wBAAwB,SAAS;AAAA,EAC7C,SAAS,OAAO;AAAA,IACf,KAAK,SAAS;AAAA,IACd,UAAU,SAAS;AAAA,IACnB,cAAc,SAAS;AAAA,EAAA,CACvB;AAAA,EACD;AACD;AAEO,MAAM,oBAAoB,SAAS;AAAA,EACzC;AAAA,EACA,SAAS,OAAO;AAAA,IACf,KAAK,SAAS;AAAA,EAAA,CACd;AACF;AAIO,MAAM,mBAAmB,SAAS;AAAA,EACxC,SAAS;AAAA,IACR,SAAS,OAAO;AAAA,MACf,KAAK,SAAS;AAAA,IAAA,CACd;AAAA,IACD,SAAS,OAAO;AAAA,MACf,YAAY,SAAS,OAAO,SAAS,QAAQ,SAAS,MAAM;AAAA,IAAA,CAC5D;AAAA,EAAA;AAAA,EAEF,SAAS,QAAQ;AAAA,IAChB,aAAa,SAAS;AAAA,IACtB,aAAa,SAAS,QAAQ;AAAA,MAC7B,OAAO,SAAS;AAAA,MAChB,OAAO,SAAS;AAAA,IAAA,CAChB;AAAA,EAAA,CACD;AACF;AAIO,MAAM,eAAe,SAAS,aAAa,SAAS;AAAA,EAC1D,SAAS,OAAO;AAAA,IACf,aAAa,SAAS;AAAA,EAAA,CACtB;AAAA,EACD,SAAS,QAAQ;AAAA,IAChB,cAAc,SAAS;AAAA,EAAA,CACvB;AACF,CAAC;"}
+{"version":3,"file":"OIDCTypes.js","sources":["../../../../../../../../packages/engine-tenant-api/src/model/service/idp/providers/OIDCTypes.ts"],"sourcesContent":["import * as Typesafe from '@contember/typesafe'\nimport { ClientAuthMethod, ResponseType } from 'openid-client'\nimport { IDPRevalidationConfig } from '../IDPRevalidation.js'\n\nexport interface OIDCSessionData {\n\tnonce: string\n\tstate: string\n}\n\n/** OIDC re-validation config: the generic settings plus the OIDC-specific probe method. */\nexport const OIDCRevalidationConfig = Typesafe.intersection(\n\tIDPRevalidationConfig,\n\tTypesafe.partial({\n\t\t/** How to probe the IdP. `refresh` needs `offline_access`; default `refresh`. */\n\t\tmethod: Typesafe.enumeration('refresh', 'userinfo', 'introspection'),\n\t}),\n)\n\nexport type OIDCRevalidationConfig = ReturnType<typeof OIDCRevalidationConfig>\n\n/**\n * Maps provider claims onto the normalized {@link IDPResponse} fields. Each value is a claim\n * name, dot-path supported (e.g. `address.region`). Lets a provider whose claims don't follow\n * the OIDC defaults still be consumed without a per-provider code change.\n */\nexport const OIDCClaimMapping = Typesafe.partial({\n\t/**\n\t * Claim used as the stable external identifier (the IdP subject). Default `sub`.\n\t * Must resolve to a scalar (string/number) — a non-scalar claim is rejected at sign-in.\n\t * Mapping this to a claim that only appears in userInfo / `attributes` takes the federation\n\t * key off the signature-verified ID-token subject; prefer a signed claim where possible.\n\t */\n\texternalIdentifier: Typesafe.string,\n\t/** Claim used as the e-mail address. Default `email`. */\n\temail: Typesafe.string,\n\t/** Claim used as the display name. Default `name`. */\n\tname: Typesafe.string,\n\t/**\n\t * Key of a nested object whose properties are lifted to the top level before mapping.\n\t * Some providers (notably Apereo CAS userinfo) nest the actual claims under `attributes`.\n\t */\n\tattributesKey: Typesafe.string,\n})\n\nexport type OIDCClaimMapping = ReturnType<typeof OIDCClaimMapping>\n\nexport const OIDCConfigurationOptions = Typesafe.partial({\n\tresponseType: Typesafe.enumeration<ResponseType>('code', 'code id_token', 'code id_token token', 'code token', 'id_token', 'id_token token', 'none'),\n\tclaims: Typesafe.string, // deprecated, use scope instead\n\tscope: Typesafe.string,\n\tadditionalAuthorizedParties: Typesafe.array(Typesafe.string),\n\tidTokenSignedResponseAlg: Typesafe.string,\n\t/**\n\t * How the client authenticates to the token endpoint. `openid-client` defaults to\n\t * `client_secret_basic`; set `client_secret_post` for providers (e.g. some Apereo CAS\n\t * registrations) that only accept the secret in the request body.\n\t */\n\ttokenEndpointAuthMethod: Typesafe.enumeration<ClientAuthMethod>(\n\t\t'client_secret_basic',\n\t\t'client_secret_post',\n\t\t'client_secret_jwt',\n\t\t'private_key_jwt',\n\t\t'tls_client_auth',\n\t\t'self_signed_tls_client_auth',\n\t\t'none',\n\t),\n\tfetchUserInfo: Typesafe.boolean,\n\treturnOIDCResult: Typesafe.boolean,\n\ttimeout: Typesafe.number,\n\trevalidation: OIDCRevalidationConfig,\n\tclaimMapping: OIDCClaimMapping,\n\t/**\n\t * Where the IdP should send the browser back after an RP-initiated (front-channel) logout\n\t * (A10). Used as `post_logout_redirect_uri` in the end-session URL; must be registered at the\n\t * IdP. When unset, the IdP applies its own default post-logout behavior.\n\t */\n\tpostLogoutRedirectUri: Typesafe.string,\n})\nexport const BaseOIDCConfiguration = Typesafe.intersection(\n\tTypesafe.object({\n\t\turl: Typesafe.string,\n\t\tclientId: Typesafe.string,\n\t\tclientSecret: Typesafe.string,\n\t}),\n\tOIDCConfigurationOptions,\n)\n\nexport const OIDCConfiguration = Typesafe.intersection(\n\tBaseOIDCConfiguration,\n\tTypesafe.object({\n\t\turl: Typesafe.string,\n\t}),\n)\n\nexport type OIDCConfiguration = ReturnType<typeof OIDCConfiguration>\n\nexport const OIDCResponseData = Typesafe.intersection(\n\tTypesafe.union(\n\t\tTypesafe.object({\n\t\t\turl: Typesafe.string,\n\t\t}),\n\t\tTypesafe.object({\n\t\t\tparameters: Typesafe.record(Typesafe.string, Typesafe.string),\n\t\t}),\n\t),\n\tTypesafe.partial({\n\t\tredirectUrl: Typesafe.string,\n\t\tsessionData: Typesafe.partial({\n\t\t\tnonce: Typesafe.string,\n\t\t\tstate: Typesafe.string,\n\t\t}),\n\t}),\n)\n\nexport type OIDCResponseData = ReturnType<typeof OIDCResponseData>\n\nexport const OIDCInitData = Typesafe.noExtraProps(Typesafe.intersection(\n\tTypesafe.object({\n\t\tredirectUrl: Typesafe.string,\n\t}),\n\tTypesafe.partial({\n\t\tresponseMode: Typesafe.string,\n\t}),\n))\n\nexport type OIDCInitData = ReturnType<typeof OIDCInitData>\n"],"names":[],"mappings":";;AAUO,MAAM,yBAAyB,SAAS;AAAA,EAC9C;AAAA,EACA,SAAS,QAAQ;AAAA;AAAA,IAEhB,QAAQ,SAAS,YAAY,WAAW,YAAY,eAAe;AAAA,EAAA,CACnE;AACF;AASO,MAAM,mBAAmB,SAAS,QAAQ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOhD,oBAAoB,SAAS;AAAA;AAAA,EAE7B,OAAO,SAAS;AAAA;AAAA,EAEhB,MAAM,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA,EAKf,eAAe,SAAS;AACzB,CAAC;AAIM,MAAM,2BAA2B,SAAS,QAAQ;AAAA,EACxD,cAAc,SAAS,YAA0B,QAAQ,iBAAiB,uBAAuB,cAAc,YAAY,kBAAkB,MAAM;AAAA,EACnJ,QAAQ,SAAS;AAAA;AAAA,EACjB,OAAO,SAAS;AAAA,EAChB,6BAA6B,SAAS,MAAM,SAAS,MAAM;AAAA,EAC3D,0BAA0B,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMnC,yBAAyB,SAAS;AAAA,IACjC;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EAAA;AAAA,EAED,eAAe,SAAS;AAAA,EACxB,kBAAkB,SAAS;AAAA,EAC3B,SAAS,SAAS;AAAA,EAClB,cAAc;AAAA,EACd,cAAc;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMd,uBAAuB,SAAS;AACjC,CAAC;AACM,MAAM,wBAAwB,SAAS;AAAA,EAC7C,SAAS,OAAO;AAAA,IACf,KAAK,SAAS;AAAA,IACd,UAAU,SAAS;AAAA,IACnB,cAAc,SAAS;AAAA,EAAA,CACvB;AAAA,EACD;AACD;AAEO,MAAM,oBAAoB,SAAS;AAAA,EACzC;AAAA,EACA,SAAS,OAAO;AAAA,IACf,KAAK,SAAS;AAAA,EAAA,CACd;AACF;AAIO,MAAM,mBAAmB,SAAS;AAAA,EACxC,SAAS;AAAA,IACR,SAAS,OAAO;AAAA,MACf,KAAK,SAAS;AAAA,IAAA,CACd;AAAA,IACD,SAAS,OAAO;AAAA,MACf,YAAY,SAAS,OAAO,SAAS,QAAQ,SAAS,MAAM;AAAA,IAAA,CAC5D;AAAA,EAAA;AAAA,EAEF,SAAS,QAAQ;AAAA,IAChB,aAAa,SAAS;AAAA,IACtB,aAAa,SAAS,QAAQ;AAAA,MAC7B,OAAO,SAAS;AAAA,MAChB,OAAO,SAAS;AAAA,IAAA,CAChB;AAAA,EAAA,CACD;AACF;AAIO,MAAM,eAAe,SAAS,aAAa,SAAS;AAAA,EAC1D,SAAS,OAAO;AAAA,IACf,aAAa,SAAS;AAAA,EAAA,CACtB;AAAA,EACD,SAAS,QAAQ;AAAA,IAChB,cAAc,SAAS;AAAA,EAAA,CACvB;AACF,CAAC;"}

package/dist/development/src/model/service/membershipUtils.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"membershipUtils.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/service/membershipUtils.ts"],"sourcesContent":["import { MembershipInput, MembershipUpdateInput, VariableUpdateInput } from '../commands'\nimport { Acl } from '@contember/schema'\n\nexport const createSetMembershipVariables = (memberships: readonly Acl.Membership[]): MembershipInput[] => {\n\treturn memberships.map(it => ({\n\t\trole: it.role,\n\t\tvariables: it.variables.map(it => ({ name: it.name, set: it.values })),\n\t}))\n}\nexport const createAppendMembershipVariables = (memberships: readonly Acl.Membership[]): MembershipInput[] => {\n\treturn memberships.map(it => ({\n\t\trole: it.role,\n\t\tvariables: it.variables.map(it => ({ name: it.name, append: it.values, remove: [] })),\n\t}))\n}\n\nexport const createMembershipModification = (\n\toldMemberships: readonly Acl.Membership[],\n\tnewMemberships: readonly Acl.Membership[],\n): MembershipUpdateInput[] => {\n\tconst input: MembershipUpdateInput[] = []\n\tfor (const membership of newMemberships) {\n\t\tconst old = oldMemberships.find(it => it.role === membership.role)\n\t\tif (!old) {\n\t\t\tinput.push({\n\t\t\t\trole: membership.role,\n\t\t\t\toperation: 'create',\n\t\t\t\tvariables: createMembershipVariablePatch([], membership.variables),\n\t\t\t})\n\t\t} else {\n\t\t\tinput.push({\n\t\t\t\trole: membership.role,\n\t\t\t\toperation: 'update',\n\t\t\t\tvariables: createMembershipVariablePatch(old.variables, membership.variables),\n\t\t\t})\n\t\t}\n\t}\n\tfor (const old of oldMemberships) {\n\t\tconst newMembership = newMemberships.find(it => it.role === old.role)\n\t\tif (!newMembership) {\n\t\t\tinput.push({\n\t\t\t\trole: old.role,\n\t\t\t\toperation: 'remove',\n\t\t\t\tvariables: createMembershipVariablePatch(old.variables, []), // for acl check\n\t\t\t})\n\t\t}\n\t}\n\n\treturn input\n}\n\nconst createMembershipVariablePatch = (\n\toldVariables: readonly Acl.MembershipVariable[],\n\tnewVariables: readonly Acl.MembershipVariable[],\n): VariableUpdateInput[] => {\n\tconst update: VariableUpdateInput[] = []\n\tconst varANames = newVariables.map(it => it.name)\n\tfor (const varA of newVariables) {\n\t\tconst varB = oldVariables.find(it => it.name === varA.name)\n\t\tif (!varB) {\n\t\t\tupdate.push({\n\t\t\t\tname: varA.name,\n\t\t\t\tset: varA.values,\n\t\t\t})\n\t\t} else {\n\t\t\tupdate.push({\n\t\t\t\tname: varA.name,\n\t\t\t\tappend: varA.values.filter(valA => !varB.values.includes(valA)),\n\t\t\t\tremove: varB.values.filter(valB => !varA.values.includes(valB)),\n\t\t\t})\n\t\t}\n\t}\n\tupdate.push(\n\t\t...oldVariables\n\t\t\t.filter(varB => !varANames.includes(varB.name))\n\t\t\t.map(it => ({\n\t\t\t\tname: it.name,\n\t\t\t\tset: [],\n\t\t\t})),\n\t)\n\treturn update\n}\n"],"names":["it"],"mappings":";;AAGO,MAAM,+BAA+B,CAAC,gBAA8D;AAC1G,SAAO,YAAY,IAAI,CAAA,QAAO;AAAA,IAC7B,MAAM,GAAG;AAAA,IACT,WAAW,GAAG,UAAU,IAAI,CAAAA,SAAO,EAAE,MAAMA,IAAG,MAAM,KAAKA,IAAG,SAAS;AAAA,EAAA,EACpE;AACH;AACO,MAAM,kCAAkC,CAAC,gBAA8D;AAC7G,SAAO,YAAY,IAAI,CAAA,QAAO;AAAA,IAC7B,MAAM,GAAG;AAAA,IACT,WAAW,GAAG,UAAU,IAAI,CAAAA,SAAO,EAAE,MAAMA,IAAG,MAAM,QAAQA,IAAG,QAAQ,QAAQ,CAAA,IAAK;AAAA,EAAA,EACnF;AACH;AAEO,MAAM,+BAA+B,CAC3C,gBACA,mBAC6B;AAC7B,QAAM,QAAiC,CAAA;AACvC,aAAW,cAAc,gBAAgB;AACxC,UAAM,MAAM,eAAe,KAAK,QAAM,GAAG,SAAS,WAAW,IAAI;AACjE,QAAI,CAAC,KAAK;AACT,YAAM,KAAK;AAAA,QACV,MAAM,WAAW;AAAA,QACjB,WAAW;AAAA,QACX,WAAW,8BAA8B,IAAI,WAAW,SAAS;AAAA,MAAA,CACjE;AAAA,IACF,OAAO;AACN,YAAM,KAAK;AAAA,QACV,MAAM,WAAW;AAAA,QACjB,WAAW;AAAA,QACX,WAAW,8BAA8B,IAAI,WAAW,WAAW,SAAS;AAAA,MAAA,CAC5E;AAAA,IACF;AAAA,EACD;AACA,aAAW,OAAO,gBAAgB;AACjC,UAAM,gBAAgB,eAAe,KAAK,QAAM,GAAG,SAAS,IAAI,IAAI;AACpE,QAAI,CAAC,eAAe;AACnB,YAAM,KAAK;AAAA,QACV,MAAM,IAAI;AAAA,QACV,WAAW;AAAA,QACX,WAAW,8BAA8B,IAAI,WAAW,CAAA,CAAE;AAAA;AAAA,MAAA,CAC1D;AAAA,IACF;AAAA,EACD;AAEA,SAAO;AACR;AAEA,MAAM,gCAAgC,CACrC,cACA,iBAC2B;AAC3B,QAAM,SAAgC,CAAA;AACtC,QAAM,YAAY,aAAa,IAAI,CAAA,OAAM,GAAG,IAAI;AAChD,aAAW,QAAQ,cAAc;AAChC,UAAM,OAAO,aAAa,KAAK,QAAM,GAAG,SAAS,KAAK,IAAI;AAC1D,QAAI,CAAC,MAAM;AACV,aAAO,KAAK;AAAA,QACX,MAAM,KAAK;AAAA,QACX,KAAK,KAAK;AAAA,MAAA,CACV;AAAA,IACF,OAAO;AACN,aAAO,KAAK;AAAA,QACX,MAAM,KAAK;AAAA,QACX,QAAQ,KAAK,OAAO,OAAO,CAAA,SAAQ,CAAC,KAAK,OAAO,SAAS,IAAI,CAAC;AAAA,QAC9D,QAAQ,KAAK,OAAO,OAAO,CAAA,SAAQ,CAAC,KAAK,OAAO,SAAS,IAAI,CAAC;AAAA,MAAA,CAC9D;AAAA,IACF;AAAA,EACD;AACA,SAAO;AAAA,IACN,GAAG,aACD,OAAO,CAAA,SAAQ,CAAC,UAAU,SAAS,KAAK,IAAI,CAAC,EAC7C,IAAI,CAAA,QAAO;AAAA,MACX,MAAM,GAAG;AAAA,MACT,KAAK,CAAA;AAAA,IAAC,EACL;AAAA,EAAA;AAEJ,SAAO;AACR;;;;"}
+{"version":3,"file":"membershipUtils.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/service/membershipUtils.ts"],"sourcesContent":["import { MembershipInput, MembershipUpdateInput, VariableUpdateInput } from '../commands/index.js'\nimport { Acl } from '@contember/schema'\n\nexport const createSetMembershipVariables = (memberships: readonly Acl.Membership[]): MembershipInput[] => {\n\treturn memberships.map(it => ({\n\t\trole: it.role,\n\t\tvariables: it.variables.map(it => ({ name: it.name, set: it.values })),\n\t}))\n}\nexport const createAppendMembershipVariables = (memberships: readonly Acl.Membership[]): MembershipInput[] => {\n\treturn memberships.map(it => ({\n\t\trole: it.role,\n\t\tvariables: it.variables.map(it => ({ name: it.name, append: it.values, remove: [] })),\n\t}))\n}\n\nexport const createMembershipModification = (\n\toldMemberships: readonly Acl.Membership[],\n\tnewMemberships: readonly Acl.Membership[],\n): MembershipUpdateInput[] => {\n\tconst input: MembershipUpdateInput[] = []\n\tfor (const membership of newMemberships) {\n\t\tconst old = oldMemberships.find(it => it.role === membership.role)\n\t\tif (!old) {\n\t\t\tinput.push({\n\t\t\t\trole: membership.role,\n\t\t\t\toperation: 'create',\n\t\t\t\tvariables: createMembershipVariablePatch([], membership.variables),\n\t\t\t})\n\t\t} else {\n\t\t\tinput.push({\n\t\t\t\trole: membership.role,\n\t\t\t\toperation: 'update',\n\t\t\t\tvariables: createMembershipVariablePatch(old.variables, membership.variables),\n\t\t\t})\n\t\t}\n\t}\n\tfor (const old of oldMemberships) {\n\t\tconst newMembership = newMemberships.find(it => it.role === old.role)\n\t\tif (!newMembership) {\n\t\t\tinput.push({\n\t\t\t\trole: old.role,\n\t\t\t\toperation: 'remove',\n\t\t\t\tvariables: createMembershipVariablePatch(old.variables, []), // for acl check\n\t\t\t})\n\t\t}\n\t}\n\n\treturn input\n}\n\nconst createMembershipVariablePatch = (\n\toldVariables: readonly Acl.MembershipVariable[],\n\tnewVariables: readonly Acl.MembershipVariable[],\n): VariableUpdateInput[] => {\n\tconst update: VariableUpdateInput[] = []\n\tconst varANames = newVariables.map(it => it.name)\n\tfor (const varA of newVariables) {\n\t\tconst varB = oldVariables.find(it => it.name === varA.name)\n\t\tif (!varB) {\n\t\t\tupdate.push({\n\t\t\t\tname: varA.name,\n\t\t\t\tset: varA.values,\n\t\t\t})\n\t\t} else {\n\t\t\tupdate.push({\n\t\t\t\tname: varA.name,\n\t\t\t\tappend: varA.values.filter(valA => !varB.values.includes(valA)),\n\t\t\t\tremove: varB.values.filter(valB => !varA.values.includes(valB)),\n\t\t\t})\n\t\t}\n\t}\n\tupdate.push(\n\t\t...oldVariables\n\t\t\t.filter(varB => !varANames.includes(varB.name))\n\t\t\t.map(it => ({\n\t\t\t\tname: it.name,\n\t\t\t\tset: [],\n\t\t\t})),\n\t)\n\treturn update\n}\n"],"names":["it"],"mappings":";;AAGO,MAAM,+BAA+B,CAAC,gBAA8D;AAC1G,SAAO,YAAY,IAAI,CAAA,QAAO;AAAA,IAC7B,MAAM,GAAG;AAAA,IACT,WAAW,GAAG,UAAU,IAAI,CAAAA,SAAO,EAAE,MAAMA,IAAG,MAAM,KAAKA,IAAG,SAAS;AAAA,EAAA,EACpE;AACH;AACO,MAAM,kCAAkC,CAAC,gBAA8D;AAC7G,SAAO,YAAY,IAAI,CAAA,QAAO;AAAA,IAC7B,MAAM,GAAG;AAAA,IACT,WAAW,GAAG,UAAU,IAAI,CAAAA,SAAO,EAAE,MAAMA,IAAG,MAAM,QAAQA,IAAG,QAAQ,QAAQ,CAAA,IAAK;AAAA,EAAA,EACnF;AACH;AAEO,MAAM,+BAA+B,CAC3C,gBACA,mBAC6B;AAC7B,QAAM,QAAiC,CAAA;AACvC,aAAW,cAAc,gBAAgB;AACxC,UAAM,MAAM,eAAe,KAAK,QAAM,GAAG,SAAS,WAAW,IAAI;AACjE,QAAI,CAAC,KAAK;AACT,YAAM,KAAK;AAAA,QACV,MAAM,WAAW;AAAA,QACjB,WAAW;AAAA,QACX,WAAW,8BAA8B,IAAI,WAAW,SAAS;AAAA,MAAA,CACjE;AAAA,IACF,OAAO;AACN,YAAM,KAAK;AAAA,QACV,MAAM,WAAW;AAAA,QACjB,WAAW;AAAA,QACX,WAAW,8BAA8B,IAAI,WAAW,WAAW,SAAS;AAAA,MAAA,CAC5E;AAAA,IACF;AAAA,EACD;AACA,aAAW,OAAO,gBAAgB;AACjC,UAAM,gBAAgB,eAAe,KAAK,QAAM,GAAG,SAAS,IAAI,IAAI;AACpE,QAAI,CAAC,eAAe;AACnB,YAAM,KAAK;AAAA,QACV,MAAM,IAAI;AAAA,QACV,WAAW;AAAA,QACX,WAAW,8BAA8B,IAAI,WAAW,CAAA,CAAE;AAAA;AAAA,MAAA,CAC1D;AAAA,IACF;AAAA,EACD;AAEA,SAAO;AACR;AAEA,MAAM,gCAAgC,CACrC,cACA,iBAC2B;AAC3B,QAAM,SAAgC,CAAA;AACtC,QAAM,YAAY,aAAa,IAAI,CAAA,OAAM,GAAG,IAAI;AAChD,aAAW,QAAQ,cAAc;AAChC,UAAM,OAAO,aAAa,KAAK,QAAM,GAAG,SAAS,KAAK,IAAI;AAC1D,QAAI,CAAC,MAAM;AACV,aAAO,KAAK;AAAA,QACX,MAAM,KAAK;AAAA,QACX,KAAK,KAAK;AAAA,MAAA,CACV;AAAA,IACF,OAAO;AACN,aAAO,KAAK;AAAA,QACX,MAAM,KAAK;AAAA,QACX,QAAQ,KAAK,OAAO,OAAO,CAAA,SAAQ,CAAC,KAAK,OAAO,SAAS,IAAI,CAAC;AAAA,QAC9D,QAAQ,KAAK,OAAO,OAAO,CAAA,SAAQ,CAAC,KAAK,OAAO,SAAS,IAAI,CAAC;AAAA,MAAA,CAC9D;AAAA,IACF;AAAA,EACD;AACA,SAAO;AAAA,IACN,GAAG,aACD,OAAO,CAAA,SAAQ,CAAC,UAAU,SAAS,KAAK,IAAI,CAAC,EAC7C,IAAI,CAAA,QAAO;AAAA,MACX,MAAM,GAAG;AAAA,MACT,KAAK,CAAA;AAAA,IAAC,EACL;AAAA,EAAA;AAEJ,SAAO;AACR;;;;"}

package/dist/development/src/model/service/membershipUtils.js.map

@@ -1 +1 @@
-{"version":3,"file":"membershipUtils.js","sources":["../../../../../../packages/engine-tenant-api/src/model/service/membershipUtils.ts"],"sourcesContent":["import { MembershipInput, MembershipUpdateInput, VariableUpdateInput } from '../commands'\nimport { Acl } from '@contember/schema'\n\nexport const createSetMembershipVariables = (memberships: readonly Acl.Membership[]): MembershipInput[] => {\n\treturn memberships.map(it => ({\n\t\trole: it.role,\n\t\tvariables: it.variables.map(it => ({ name: it.name, set: it.values })),\n\t}))\n}\nexport const createAppendMembershipVariables = (memberships: readonly Acl.Membership[]): MembershipInput[] => {\n\treturn memberships.map(it => ({\n\t\trole: it.role,\n\t\tvariables: it.variables.map(it => ({ name: it.name, append: it.values, remove: [] })),\n\t}))\n}\n\nexport const createMembershipModification = (\n\toldMemberships: readonly Acl.Membership[],\n\tnewMemberships: readonly Acl.Membership[],\n): MembershipUpdateInput[] => {\n\tconst input: MembershipUpdateInput[] = []\n\tfor (const membership of newMemberships) {\n\t\tconst old = oldMemberships.find(it => it.role === membership.role)\n\t\tif (!old) {\n\t\t\tinput.push({\n\t\t\t\trole: membership.role,\n\t\t\t\toperation: 'create',\n\t\t\t\tvariables: createMembershipVariablePatch([], membership.variables),\n\t\t\t})\n\t\t} else {\n\t\t\tinput.push({\n\t\t\t\trole: membership.role,\n\t\t\t\toperation: 'update',\n\t\t\t\tvariables: createMembershipVariablePatch(old.variables, membership.variables),\n\t\t\t})\n\t\t}\n\t}\n\tfor (const old of oldMemberships) {\n\t\tconst newMembership = newMemberships.find(it => it.role === old.role)\n\t\tif (!newMembership) {\n\t\t\tinput.push({\n\t\t\t\trole: old.role,\n\t\t\t\toperation: 'remove',\n\t\t\t\tvariables: createMembershipVariablePatch(old.variables, []), // for acl check\n\t\t\t})\n\t\t}\n\t}\n\n\treturn input\n}\n\nconst createMembershipVariablePatch = (\n\toldVariables: readonly Acl.MembershipVariable[],\n\tnewVariables: readonly Acl.MembershipVariable[],\n): VariableUpdateInput[] => {\n\tconst update: VariableUpdateInput[] = []\n\tconst varANames = newVariables.map(it => it.name)\n\tfor (const varA of newVariables) {\n\t\tconst varB = oldVariables.find(it => it.name === varA.name)\n\t\tif (!varB) {\n\t\t\tupdate.push({\n\t\t\t\tname: varA.name,\n\t\t\t\tset: varA.values,\n\t\t\t})\n\t\t} else {\n\t\t\tupdate.push({\n\t\t\t\tname: varA.name,\n\t\t\t\tappend: varA.values.filter(valA => !varB.values.includes(valA)),\n\t\t\t\tremove: varB.values.filter(valB => !varA.values.includes(valB)),\n\t\t\t})\n\t\t}\n\t}\n\tupdate.push(\n\t\t...oldVariables\n\t\t\t.filter(varB => !varANames.includes(varB.name))\n\t\t\t.map(it => ({\n\t\t\t\tname: it.name,\n\t\t\t\tset: [],\n\t\t\t})),\n\t)\n\treturn update\n}\n"],"names":["it"],"mappings":"AAGO,MAAM,+BAA+B,CAAC,gBAA8D;AAC1G,SAAO,YAAY,IAAI,CAAA,QAAO;AAAA,IAC7B,MAAM,GAAG;AAAA,IACT,WAAW,GAAG,UAAU,IAAI,CAAAA,SAAO,EAAE,MAAMA,IAAG,MAAM,KAAKA,IAAG,SAAS;AAAA,EAAA,EACpE;AACH;AACO,MAAM,kCAAkC,CAAC,gBAA8D;AAC7G,SAAO,YAAY,IAAI,CAAA,QAAO;AAAA,IAC7B,MAAM,GAAG;AAAA,IACT,WAAW,GAAG,UAAU,IAAI,CAAAA,SAAO,EAAE,MAAMA,IAAG,MAAM,QAAQA,IAAG,QAAQ,QAAQ,CAAA,IAAK;AAAA,EAAA,EACnF;AACH;AAEO,MAAM,+BAA+B,CAC3C,gBACA,mBAC6B;AAC7B,QAAM,QAAiC,CAAA;AACvC,aAAW,cAAc,gBAAgB;AACxC,UAAM,MAAM,eAAe,KAAK,QAAM,GAAG,SAAS,WAAW,IAAI;AACjE,QAAI,CAAC,KAAK;AACT,YAAM,KAAK;AAAA,QACV,MAAM,WAAW;AAAA,QACjB,WAAW;AAAA,QACX,WAAW,8BAA8B,IAAI,WAAW,SAAS;AAAA,MAAA,CACjE;AAAA,IACF,OAAO;AACN,YAAM,KAAK;AAAA,QACV,MAAM,WAAW;AAAA,QACjB,WAAW;AAAA,QACX,WAAW,8BAA8B,IAAI,WAAW,WAAW,SAAS;AAAA,MAAA,CAC5E;AAAA,IACF;AAAA,EACD;AACA,aAAW,OAAO,gBAAgB;AACjC,UAAM,gBAAgB,eAAe,KAAK,QAAM,GAAG,SAAS,IAAI,IAAI;AACpE,QAAI,CAAC,eAAe;AACnB,YAAM,KAAK;AAAA,QACV,MAAM,IAAI;AAAA,QACV,WAAW;AAAA,QACX,WAAW,8BAA8B,IAAI,WAAW,CAAA,CAAE;AAAA;AAAA,MAAA,CAC1D;AAAA,IACF;AAAA,EACD;AAEA,SAAO;AACR;AAEA,MAAM,gCAAgC,CACrC,cACA,iBAC2B;AAC3B,QAAM,SAAgC,CAAA;AACtC,QAAM,YAAY,aAAa,IAAI,CAAA,OAAM,GAAG,IAAI;AAChD,aAAW,QAAQ,cAAc;AAChC,UAAM,OAAO,aAAa,KAAK,QAAM,GAAG,SAAS,KAAK,IAAI;AAC1D,QAAI,CAAC,MAAM;AACV,aAAO,KAAK;AAAA,QACX,MAAM,KAAK;AAAA,QACX,KAAK,KAAK;AAAA,MAAA,CACV;AAAA,IACF,OAAO;AACN,aAAO,KAAK;AAAA,QACX,MAAM,KAAK;AAAA,QACX,QAAQ,KAAK,OAAO,OAAO,CAAA,SAAQ,CAAC,KAAK,OAAO,SAAS,IAAI,CAAC;AAAA,QAC9D,QAAQ,KAAK,OAAO,OAAO,CAAA,SAAQ,CAAC,KAAK,OAAO,SAAS,IAAI,CAAC;AAAA,MAAA,CAC9D;AAAA,IACF;AAAA,EACD;AACA,SAAO;AAAA,IACN,GAAG,aACD,OAAO,CAAA,SAAQ,CAAC,UAAU,SAAS,KAAK,IAAI,CAAC,EAC7C,IAAI,CAAA,QAAO;AAAA,MACX,MAAM,GAAG;AAAA,MACT,KAAK,CAAA;AAAA,IAAC,EACL;AAAA,EAAA;AAEJ,SAAO;AACR;"}
+{"version":3,"file":"membershipUtils.js","sources":["../../../../../../packages/engine-tenant-api/src/model/service/membershipUtils.ts"],"sourcesContent":["import { MembershipInput, MembershipUpdateInput, VariableUpdateInput } from '../commands/index.js'\nimport { Acl } from '@contember/schema'\n\nexport const createSetMembershipVariables = (memberships: readonly Acl.Membership[]): MembershipInput[] => {\n\treturn memberships.map(it => ({\n\t\trole: it.role,\n\t\tvariables: it.variables.map(it => ({ name: it.name, set: it.values })),\n\t}))\n}\nexport const createAppendMembershipVariables = (memberships: readonly Acl.Membership[]): MembershipInput[] => {\n\treturn memberships.map(it => ({\n\t\trole: it.role,\n\t\tvariables: it.variables.map(it => ({ name: it.name, append: it.values, remove: [] })),\n\t}))\n}\n\nexport const createMembershipModification = (\n\toldMemberships: readonly Acl.Membership[],\n\tnewMemberships: readonly Acl.Membership[],\n): MembershipUpdateInput[] => {\n\tconst input: MembershipUpdateInput[] = []\n\tfor (const membership of newMemberships) {\n\t\tconst old = oldMemberships.find(it => it.role === membership.role)\n\t\tif (!old) {\n\t\t\tinput.push({\n\t\t\t\trole: membership.role,\n\t\t\t\toperation: 'create',\n\t\t\t\tvariables: createMembershipVariablePatch([], membership.variables),\n\t\t\t})\n\t\t} else {\n\t\t\tinput.push({\n\t\t\t\trole: membership.role,\n\t\t\t\toperation: 'update',\n\t\t\t\tvariables: createMembershipVariablePatch(old.variables, membership.variables),\n\t\t\t})\n\t\t}\n\t}\n\tfor (const old of oldMemberships) {\n\t\tconst newMembership = newMemberships.find(it => it.role === old.role)\n\t\tif (!newMembership) {\n\t\t\tinput.push({\n\t\t\t\trole: old.role,\n\t\t\t\toperation: 'remove',\n\t\t\t\tvariables: createMembershipVariablePatch(old.variables, []), // for acl check\n\t\t\t})\n\t\t}\n\t}\n\n\treturn input\n}\n\nconst createMembershipVariablePatch = (\n\toldVariables: readonly Acl.MembershipVariable[],\n\tnewVariables: readonly Acl.MembershipVariable[],\n): VariableUpdateInput[] => {\n\tconst update: VariableUpdateInput[] = []\n\tconst varANames = newVariables.map(it => it.name)\n\tfor (const varA of newVariables) {\n\t\tconst varB = oldVariables.find(it => it.name === varA.name)\n\t\tif (!varB) {\n\t\t\tupdate.push({\n\t\t\t\tname: varA.name,\n\t\t\t\tset: varA.values,\n\t\t\t})\n\t\t} else {\n\t\t\tupdate.push({\n\t\t\t\tname: varA.name,\n\t\t\t\tappend: varA.values.filter(valA => !varB.values.includes(valA)),\n\t\t\t\tremove: varB.values.filter(valB => !varA.values.includes(valB)),\n\t\t\t})\n\t\t}\n\t}\n\tupdate.push(\n\t\t...oldVariables\n\t\t\t.filter(varB => !varANames.includes(varB.name))\n\t\t\t.map(it => ({\n\t\t\t\tname: it.name,\n\t\t\t\tset: [],\n\t\t\t})),\n\t)\n\treturn update\n}\n"],"names":["it"],"mappings":"AAGO,MAAM,+BAA+B,CAAC,gBAA8D;AAC1G,SAAO,YAAY,IAAI,CAAA,QAAO;AAAA,IAC7B,MAAM,GAAG;AAAA,IACT,WAAW,GAAG,UAAU,IAAI,CAAAA,SAAO,EAAE,MAAMA,IAAG,MAAM,KAAKA,IAAG,SAAS;AAAA,EAAA,EACpE;AACH;AACO,MAAM,kCAAkC,CAAC,gBAA8D;AAC7G,SAAO,YAAY,IAAI,CAAA,QAAO;AAAA,IAC7B,MAAM,GAAG;AAAA,IACT,WAAW,GAAG,UAAU,IAAI,CAAAA,SAAO,EAAE,MAAMA,IAAG,MAAM,QAAQA,IAAG,QAAQ,QAAQ,CAAA,IAAK;AAAA,EAAA,EACnF;AACH;AAEO,MAAM,+BAA+B,CAC3C,gBACA,mBAC6B;AAC7B,QAAM,QAAiC,CAAA;AACvC,aAAW,cAAc,gBAAgB;AACxC,UAAM,MAAM,eAAe,KAAK,QAAM,GAAG,SAAS,WAAW,IAAI;AACjE,QAAI,CAAC,KAAK;AACT,YAAM,KAAK;AAAA,QACV,MAAM,WAAW;AAAA,QACjB,WAAW;AAAA,QACX,WAAW,8BAA8B,IAAI,WAAW,SAAS;AAAA,MAAA,CACjE;AAAA,IACF,OAAO;AACN,YAAM,KAAK;AAAA,QACV,MAAM,WAAW;AAAA,QACjB,WAAW;AAAA,QACX,WAAW,8BAA8B,IAAI,WAAW,WAAW,SAAS;AAAA,MAAA,CAC5E;AAAA,IACF;AAAA,EACD;AACA,aAAW,OAAO,gBAAgB;AACjC,UAAM,gBAAgB,eAAe,KAAK,QAAM,GAAG,SAAS,IAAI,IAAI;AACpE,QAAI,CAAC,eAAe;AACnB,YAAM,KAAK;AAAA,QACV,MAAM,IAAI;AAAA,QACV,WAAW;AAAA,QACX,WAAW,8BAA8B,IAAI,WAAW,CAAA,CAAE;AAAA;AAAA,MAAA,CAC1D;AAAA,IACF;AAAA,EACD;AAEA,SAAO;AACR;AAEA,MAAM,gCAAgC,CACrC,cACA,iBAC2B;AAC3B,QAAM,SAAgC,CAAA;AACtC,QAAM,YAAY,aAAa,IAAI,CAAA,OAAM,GAAG,IAAI;AAChD,aAAW,QAAQ,cAAc;AAChC,UAAM,OAAO,aAAa,KAAK,QAAM,GAAG,SAAS,KAAK,IAAI;AAC1D,QAAI,CAAC,MAAM;AACV,aAAO,KAAK;AAAA,QACX,MAAM,KAAK;AAAA,QACX,KAAK,KAAK;AAAA,MAAA,CACV;AAAA,IACF,OAAO;AACN,aAAO,KAAK;AAAA,QACX,MAAM,KAAK;AAAA,QACX,QAAQ,KAAK,OAAO,OAAO,CAAA,SAAQ,CAAC,KAAK,OAAO,SAAS,IAAI,CAAC;AAAA,QAC9D,QAAQ,KAAK,OAAO,OAAO,CAAA,SAAQ,CAAC,KAAK,OAAO,SAAS,IAAI,CAAC;AAAA,MAAA,CAC9D;AAAA,IACF;AAAA,EACD;AACA,SAAO;AAAA,IACN,GAAG,aACD,OAAO,CAAA,SAAQ,CAAC,UAAU,SAAS,KAAK,IAAI,CAAC,EAC7C,IAAI,CAAA,QAAO;AAAA,MACX,MAAM,GAAG;AAAA,MACT,KAAK,CAAA;AAAA,IAAC,EACL;AAAA,EAAA;AAEJ,SAAO;AACR;"}

package/dist/development/src/model/type/RateLimit.cjs

@@ -0,0 +1,7 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const RateLimitScopes = {
+  emailOtpPerPerson: "email_otp_per_person"
+};
+exports.RateLimitScopes = RateLimitScopes;
+//# sourceMappingURL=RateLimit.cjs.map

package/dist/development/src/model/type/RateLimit.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"RateLimit.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/type/RateLimit.ts"],"sourcesContent":["export const RateLimitScopes = {\n\tsignUpPerIp: 'sign_up_per_ip',\n\tloginPerIp: 'login_per_ip',\n\tpasswordResetPerIp: 'password_reset_per_ip',\n\tpasswordlessInitPerIp: 'passwordless_init_per_ip',\n\temailOtpPerPerson: 'email_otp_per_person',\n\temailVerificationPerIp: 'email_verification_per_ip',\n} as const\n\nexport type RateLimitScope = typeof RateLimitScopes[keyof typeof RateLimitScopes]\n"],"names":[],"mappings":";;AAAO,MAAM,kBAAkB;AAAA,EAK9B,mBAAmB;AAEpB;;"}

package/dist/development/src/model/type/RateLimit.js

@@ -0,0 +1,7 @@
+const RateLimitScopes = {
+  emailOtpPerPerson: "email_otp_per_person"
+};
+export {
+  RateLimitScopes
+};
+//# sourceMappingURL=RateLimit.js.map

package/dist/development/src/model/type/RateLimit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"RateLimit.js","sources":["../../../../../../packages/engine-tenant-api/src/model/type/RateLimit.ts"],"sourcesContent":["export const RateLimitScopes = {\n\tsignUpPerIp: 'sign_up_per_ip',\n\tloginPerIp: 'login_per_ip',\n\tpasswordResetPerIp: 'password_reset_per_ip',\n\tpasswordlessInitPerIp: 'passwordless_init_per_ip',\n\temailOtpPerPerson: 'email_otp_per_person',\n\temailVerificationPerIp: 'email_verification_per_ip',\n} as const\n\nexport type RateLimitScope = typeof RateLimitScopes[keyof typeof RateLimitScopes]\n"],"names":[],"mappings":"AAAO,MAAM,kBAAkB;AAAA,EAK9B,mBAAmB;AAEpB;"}

package/dist/development/src/model/utils/DatabaseContext.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"DatabaseContext.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/utils/DatabaseContext.ts"],"sourcesContent":["import { Client, Connection } from '@contember/database'\nimport { Providers } from '../providers'\nimport { CommandBus } from '../commands'\nimport { BatchLoaderArgs, initBatchLoader, ItemLoader } from '../../utils/batchQuery'\n\nexport class DatabaseContext<Conn extends Connection.ConnectionLike = Connection.ConnectionLike> {\n\tprivate loaders = new Map<BatchLoaderArgs<any, any, any>, ItemLoader<any, any>>()\n\n\tconstructor(\n\t\tpublic readonly client: Client<Conn>,\n\t\tpublic readonly providers: Providers,\n\t) {\n\t}\n\n\tpublic get commandBus() {\n\t\treturn new CommandBus(this.client, this.providers)\n\t}\n\n\tpublic get queryHandler() {\n\t\treturn this.client.createQueryHandler()\n\t}\n\n\tpublic async transaction<T>(cb: (dbContext: DatabaseContext<Connection.TransactionLike>) => Promise<T>): Promise<T> {\n\t\treturn await this.client.transaction(async db => {\n\t\t\tawait db.query(Connection.REPEATABLE_READ)\n\t\t\treturn await cb(new DatabaseContext(db, this.providers))\n\t\t})\n\t}\n\n\tpublic async scope<T>(cb: (dbContext: DatabaseContext<Connection.AcquiredConnectionLike>) => Promise<T>): Promise<T> {\n\t\treturn await this.client.scope(async db => {\n\t\t\treturn await cb(new DatabaseContext(db, this.providers))\n\t\t})\n\t}\n\n\tpublic batchLoad<Arg, Result, Item>(loaderArgs: BatchLoaderArgs<Arg, Result, Item>, arg: Arg): Promise<Item> {\n\t\tconst existing = this.loaders.get(loaderArgs)\n\t\tif (existing) {\n\t\t\treturn existing(arg)\n\t\t}\n\t\tconst newLoader = initBatchLoader(loaderArgs, this)\n\t\tthis.loaders.set(loaderArgs, newLoader)\n\t\treturn newLoader(arg)\n\t}\n}\n"],"names":["CommandBus","Connection","initBatchLoader"],"mappings":";;;;;;;;;;AAKO,MAAM,gBAAoF;AAAA,EAGhG,YACiB,QACA,WACf;AAFe,SAAA,SAAA;AACA,SAAA,YAAA;AAJjB,kBAAA,MAAQ,+BAAc,IAAA,CAA0D;AAAA,EAMhF;AAAA,EAEA,IAAW,aAAa;AACvB,WAAO,IAAIA,WAAAA,WAAW,KAAK,QAAQ,KAAK,SAAS;AAAA,EAClD;AAAA,EAEA,IAAW,eAAe;AACzB,WAAO,KAAK,OAAO,mBAAA;AAAA,EACpB;AAAA,EAEA,MAAa,YAAe,IAAwF;AACnH,WAAO,MAAM,KAAK,OAAO,YAAY,OAAM,OAAM;AAChD,YAAM,GAAG,MAAMC,SAAAA,WAAW,eAAe;AACzC,aAAO,MAAM,GAAG,IAAI,gBAAgB,IAAI,KAAK,SAAS,CAAC;AAAA,IACxD,CAAC;AAAA,EACF;AAAA,EAEA,MAAa,MAAS,IAA+F;AACpH,WAAO,MAAM,KAAK,OAAO,MAAM,OAAM,OAAM;AAC1C,aAAO,MAAM,GAAG,IAAI,gBAAgB,IAAI,KAAK,SAAS,CAAC;AAAA,IACxD,CAAC;AAAA,EACF;AAAA,EAEO,UAA6B,YAAgD,KAAyB;AAC5G,UAAM,WAAW,KAAK,QAAQ,IAAI,UAAU;AAC5C,QAAI,UAAU;AACb,aAAO,SAAS,GAAG;AAAA,IACpB;AACA,UAAM,YAAYC,WAAAA,gBAAgB,YAAY,IAAI;AAClD,SAAK,QAAQ,IAAI,YAAY,SAAS;AACtC,WAAO,UAAU,GAAG;AAAA,EACrB;AACD;;"}
+{"version":3,"file":"DatabaseContext.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/utils/DatabaseContext.ts"],"sourcesContent":["import { Client, Connection } from '@contember/database'\nimport { Providers } from '../providers.js'\nimport { CommandBus } from '../commands/index.js'\nimport { BatchLoaderArgs, initBatchLoader, ItemLoader } from '../../utils/batchQuery.js'\n\nexport class DatabaseContext<Conn extends Connection.ConnectionLike = Connection.ConnectionLike> {\n\tprivate loaders = new Map<BatchLoaderArgs<any, any, any>, ItemLoader<any, any>>()\n\n\tconstructor(\n\t\tpublic readonly client: Client<Conn>,\n\t\tpublic readonly providers: Providers,\n\t) {\n\t}\n\n\tpublic get commandBus() {\n\t\treturn new CommandBus(this.client, this.providers)\n\t}\n\n\tpublic get queryHandler() {\n\t\treturn this.client.createQueryHandler()\n\t}\n\n\tpublic async transaction<T>(cb: (dbContext: DatabaseContext<Connection.TransactionLike>) => Promise<T>): Promise<T> {\n\t\treturn await this.client.transaction(async db => {\n\t\t\tawait db.query(Connection.REPEATABLE_READ)\n\t\t\treturn await cb(new DatabaseContext(db, this.providers))\n\t\t})\n\t}\n\n\tpublic async scope<T>(cb: (dbContext: DatabaseContext<Connection.AcquiredConnectionLike>) => Promise<T>): Promise<T> {\n\t\treturn await this.client.scope(async db => {\n\t\t\treturn await cb(new DatabaseContext(db, this.providers))\n\t\t})\n\t}\n\n\tpublic batchLoad<Arg, Result, Item>(loaderArgs: BatchLoaderArgs<Arg, Result, Item>, arg: Arg): Promise<Item> {\n\t\tconst existing = this.loaders.get(loaderArgs)\n\t\tif (existing) {\n\t\t\treturn existing(arg)\n\t\t}\n\t\tconst newLoader = initBatchLoader(loaderArgs, this)\n\t\tthis.loaders.set(loaderArgs, newLoader)\n\t\treturn newLoader(arg)\n\t}\n}\n"],"names":["CommandBus","Connection","initBatchLoader"],"mappings":";;;;;;;;;;AAKO,MAAM,gBAAoF;AAAA,EAGhG,YACiB,QACA,WACf;AAFe,SAAA,SAAA;AACA,SAAA,YAAA;AAJjB,kBAAA,MAAQ,+BAAc,IAAA,CAA0D;AAAA,EAMhF;AAAA,EAEA,IAAW,aAAa;AACvB,WAAO,IAAIA,WAAAA,WAAW,KAAK,QAAQ,KAAK,SAAS;AAAA,EAClD;AAAA,EAEA,IAAW,eAAe;AACzB,WAAO,KAAK,OAAO,mBAAA;AAAA,EACpB;AAAA,EAEA,MAAa,YAAe,IAAwF;AACnH,WAAO,MAAM,KAAK,OAAO,YAAY,OAAM,OAAM;AAChD,YAAM,GAAG,MAAMC,SAAAA,WAAW,eAAe;AACzC,aAAO,MAAM,GAAG,IAAI,gBAAgB,IAAI,KAAK,SAAS,CAAC;AAAA,IACxD,CAAC;AAAA,EACF;AAAA,EAEA,MAAa,MAAS,IAA+F;AACpH,WAAO,MAAM,KAAK,OAAO,MAAM,OAAM,OAAM;AAC1C,aAAO,MAAM,GAAG,IAAI,gBAAgB,IAAI,KAAK,SAAS,CAAC;AAAA,IACxD,CAAC;AAAA,EACF;AAAA,EAEO,UAA6B,YAAgD,KAAyB;AAC5G,UAAM,WAAW,KAAK,QAAQ,IAAI,UAAU;AAC5C,QAAI,UAAU;AACb,aAAO,SAAS,GAAG;AAAA,IACpB;AACA,UAAM,YAAYC,WAAAA,gBAAgB,YAAY,IAAI;AAClD,SAAK,QAAQ,IAAI,YAAY,SAAS;AACtC,WAAO,UAAU,GAAG;AAAA,EACrB;AACD;;"}

package/dist/development/src/model/utils/DatabaseContext.js.map

@@ -1 +1 @@
-{"version":3,"file":"DatabaseContext.js","sources":["../../../../../../packages/engine-tenant-api/src/model/utils/DatabaseContext.ts"],"sourcesContent":["import { Client, Connection } from '@contember/database'\nimport { Providers } from '../providers'\nimport { CommandBus } from '../commands'\nimport { BatchLoaderArgs, initBatchLoader, ItemLoader } from '../../utils/batchQuery'\n\nexport class DatabaseContext<Conn extends Connection.ConnectionLike = Connection.ConnectionLike> {\n\tprivate loaders = new Map<BatchLoaderArgs<any, any, any>, ItemLoader<any, any>>()\n\n\tconstructor(\n\t\tpublic readonly client: Client<Conn>,\n\t\tpublic readonly providers: Providers,\n\t) {\n\t}\n\n\tpublic get commandBus() {\n\t\treturn new CommandBus(this.client, this.providers)\n\t}\n\n\tpublic get queryHandler() {\n\t\treturn this.client.createQueryHandler()\n\t}\n\n\tpublic async transaction<T>(cb: (dbContext: DatabaseContext<Connection.TransactionLike>) => Promise<T>): Promise<T> {\n\t\treturn await this.client.transaction(async db => {\n\t\t\tawait db.query(Connection.REPEATABLE_READ)\n\t\t\treturn await cb(new DatabaseContext(db, this.providers))\n\t\t})\n\t}\n\n\tpublic async scope<T>(cb: (dbContext: DatabaseContext<Connection.AcquiredConnectionLike>) => Promise<T>): Promise<T> {\n\t\treturn await this.client.scope(async db => {\n\t\t\treturn await cb(new DatabaseContext(db, this.providers))\n\t\t})\n\t}\n\n\tpublic batchLoad<Arg, Result, Item>(loaderArgs: BatchLoaderArgs<Arg, Result, Item>, arg: Arg): Promise<Item> {\n\t\tconst existing = this.loaders.get(loaderArgs)\n\t\tif (existing) {\n\t\t\treturn existing(arg)\n\t\t}\n\t\tconst newLoader = initBatchLoader(loaderArgs, this)\n\t\tthis.loaders.set(loaderArgs, newLoader)\n\t\treturn newLoader(arg)\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;AAKO,MAAM,gBAAoF;AAAA,EAGhG,YACiB,QACA,WACf;AAFe,SAAA,SAAA;AACA,SAAA,YAAA;AAJjB,kBAAA,MAAQ,+BAAc,IAAA,CAA0D;AAAA,EAMhF;AAAA,EAEA,IAAW,aAAa;AACvB,WAAO,IAAI,WAAW,KAAK,QAAQ,KAAK,SAAS;AAAA,EAClD;AAAA,EAEA,IAAW,eAAe;AACzB,WAAO,KAAK,OAAO,mBAAA;AAAA,EACpB;AAAA,EAEA,MAAa,YAAe,IAAwF;AACnH,WAAO,MAAM,KAAK,OAAO,YAAY,OAAM,OAAM;AAChD,YAAM,GAAG,MAAM,WAAW,eAAe;AACzC,aAAO,MAAM,GAAG,IAAI,gBAAgB,IAAI,KAAK,SAAS,CAAC;AAAA,IACxD,CAAC;AAAA,EACF;AAAA,EAEA,MAAa,MAAS,IAA+F;AACpH,WAAO,MAAM,KAAK,OAAO,MAAM,OAAM,OAAM;AAC1C,aAAO,MAAM,GAAG,IAAI,gBAAgB,IAAI,KAAK,SAAS,CAAC;AAAA,IACxD,CAAC;AAAA,EACF;AAAA,EAEO,UAA6B,YAAgD,KAAyB;AAC5G,UAAM,WAAW,KAAK,QAAQ,IAAI,UAAU;AAC5C,QAAI,UAAU;AACb,aAAO,SAAS,GAAG;AAAA,IACpB;AACA,UAAM,YAAY,gBAAgB,YAAY,IAAI;AAClD,SAAK,QAAQ,IAAI,YAAY,SAAS;AACtC,WAAO,UAAU,GAAG;AAAA,EACrB;AACD;"}
+{"version":3,"file":"DatabaseContext.js","sources":["../../../../../../packages/engine-tenant-api/src/model/utils/DatabaseContext.ts"],"sourcesContent":["import { Client, Connection } from '@contember/database'\nimport { Providers } from '../providers.js'\nimport { CommandBus } from '../commands/index.js'\nimport { BatchLoaderArgs, initBatchLoader, ItemLoader } from '../../utils/batchQuery.js'\n\nexport class DatabaseContext<Conn extends Connection.ConnectionLike = Connection.ConnectionLike> {\n\tprivate loaders = new Map<BatchLoaderArgs<any, any, any>, ItemLoader<any, any>>()\n\n\tconstructor(\n\t\tpublic readonly client: Client<Conn>,\n\t\tpublic readonly providers: Providers,\n\t) {\n\t}\n\n\tpublic get commandBus() {\n\t\treturn new CommandBus(this.client, this.providers)\n\t}\n\n\tpublic get queryHandler() {\n\t\treturn this.client.createQueryHandler()\n\t}\n\n\tpublic async transaction<T>(cb: (dbContext: DatabaseContext<Connection.TransactionLike>) => Promise<T>): Promise<T> {\n\t\treturn await this.client.transaction(async db => {\n\t\t\tawait db.query(Connection.REPEATABLE_READ)\n\t\t\treturn await cb(new DatabaseContext(db, this.providers))\n\t\t})\n\t}\n\n\tpublic async scope<T>(cb: (dbContext: DatabaseContext<Connection.AcquiredConnectionLike>) => Promise<T>): Promise<T> {\n\t\treturn await this.client.scope(async db => {\n\t\t\treturn await cb(new DatabaseContext(db, this.providers))\n\t\t})\n\t}\n\n\tpublic batchLoad<Arg, Result, Item>(loaderArgs: BatchLoaderArgs<Arg, Result, Item>, arg: Arg): Promise<Item> {\n\t\tconst existing = this.loaders.get(loaderArgs)\n\t\tif (existing) {\n\t\t\treturn existing(arg)\n\t\t}\n\t\tconst newLoader = initBatchLoader(loaderArgs, this)\n\t\tthis.loaders.set(loaderArgs, newLoader)\n\t\treturn newLoader(arg)\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;AAKO,MAAM,gBAAoF;AAAA,EAGhG,YACiB,QACA,WACf;AAFe,SAAA,SAAA;AACA,SAAA,YAAA;AAJjB,kBAAA,MAAQ,+BAAc,IAAA,CAA0D;AAAA,EAMhF;AAAA,EAEA,IAAW,aAAa;AACvB,WAAO,IAAI,WAAW,KAAK,QAAQ,KAAK,SAAS;AAAA,EAClD;AAAA,EAEA,IAAW,eAAe;AACzB,WAAO,KAAK,OAAO,mBAAA;AAAA,EACpB;AAAA,EAEA,MAAa,YAAe,IAAwF;AACnH,WAAO,MAAM,KAAK,OAAO,YAAY,OAAM,OAAM;AAChD,YAAM,GAAG,MAAM,WAAW,eAAe;AACzC,aAAO,MAAM,GAAG,IAAI,gBAAgB,IAAI,KAAK,SAAS,CAAC;AAAA,IACxD,CAAC;AAAA,EACF;AAAA,EAEA,MAAa,MAAS,IAA+F;AACpH,WAAO,MAAM,KAAK,OAAO,MAAM,OAAM,OAAM;AAC1C,aAAO,MAAM,GAAG,IAAI,gBAAgB,IAAI,KAAK,SAAS,CAAC;AAAA,IACxD,CAAC;AAAA,EACF;AAAA,EAEO,UAA6B,YAAgD,KAAyB;AAC5G,UAAM,WAAW,KAAK,QAAQ,IAAI,UAAU;AAC5C,QAAI,UAAU;AACb,aAAO,SAAS,GAAG;AAAA,IACpB;AACA,UAAM,YAAY,gBAAgB,YAAY,IAAI;AAClD,SAAK,QAAQ,IAAI,YAAY,SAAS;AACtC,WAAO,UAAU,GAAG;AAAA,EACrB;AACD;"}

package/dist/development/src/model/utils/interval.cjs

@@ -1,8 +1,15 @@
 "use strict";
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const intervalToPostgres = (interval) => {
+  if (typeof interval.toPostgres === "function") {
+    return interval.toPostgres();
+  }
+  return `${intervalToSeconds(interval)} seconds`;
+};
 const intervalToSeconds = (interval) => {
   const { months, years, days, hours, minutes, seconds, milliseconds } = interval;
   return (years || 0) * 365 * 24 * 60 * 60 + (months || 0) * 30 * 24 * 60 * 60 + (days || 0) * 24 * 60 * 60 + (hours || 0) * 60 * 60 + (minutes || 0) * 60 + (seconds || 0) + (milliseconds || 0) / 1e3;
 };
+exports.intervalToPostgres = intervalToPostgres;
 exports.intervalToSeconds = intervalToSeconds;
 //# sourceMappingURL=interval.cjs.map

package/dist/development/src/model/utils/interval.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"interval.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/utils/interval.ts"],"sourcesContent":["import { IPostgresInterval } from 'postgres-interval'\n\nexport const intervalToSeconds = (interval: IPostgresInterval): number => {\n\tconst { months, years, days, hours, minutes, seconds, milliseconds } = interval\n\treturn (\n\t\t(years || 0) * 365 * 24 * 60 * 60\n\t\t+ (months || 0) * 30 * 24 * 60 * 60\n\t\t+ (days || 0) * 24 * 60 * 60\n\t\t+ (hours || 0) * 60 * 60\n\t\t+ (minutes || 0) * 60\n\t\t+ (seconds || 0)\n\t\t+ (milliseconds || 0) / 1000\n\t)\n}\n"],"names":[],"mappings":";;AAEO,MAAM,oBAAoB,CAAC,aAAwC;AACzE,QAAM,EAAE,QAAQ,OAAO,MAAM,OAAO,SAAS,SAAS,iBAAiB;AACvE,UACE,SAAS,KAAK,MAAM,KAAK,KAAK,MAC5B,UAAU,KAAK,KAAK,KAAK,KAAK,MAC9B,QAAQ,KAAK,KAAK,KAAK,MACvB,SAAS,KAAK,KAAK,MACnB,WAAW,KAAK,MAChB,WAAW,MACX,gBAAgB,KAAK;AAE1B;;"}
+{"version":3,"file":"interval.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/utils/interval.ts"],"sourcesContent":["import { IPostgresInterval } from 'postgres-interval'\n\n/**\n * Serializes an interval into a Postgres-acceptable string literal for use as a\n * query parameter (e.g. writing into an INTERVAL column). `postgres-interval`\n * instances expose `toPostgres()`; we fall back to a seconds literal otherwise.\n */\nexport const intervalToPostgres = (interval: IPostgresInterval): string => {\n\tif (typeof interval.toPostgres === 'function') {\n\t\treturn interval.toPostgres()\n\t}\n\treturn `${intervalToSeconds(interval)} seconds`\n}\n\nexport const intervalToSeconds = (interval: IPostgresInterval): number => {\n\tconst { months, years, days, hours, minutes, seconds, milliseconds } = interval\n\treturn (\n\t\t(years || 0) * 365 * 24 * 60 * 60\n\t\t+ (months || 0) * 30 * 24 * 60 * 60\n\t\t+ (days || 0) * 24 * 60 * 60\n\t\t+ (hours || 0) * 60 * 60\n\t\t+ (minutes || 0) * 60\n\t\t+ (seconds || 0)\n\t\t+ (milliseconds || 0) / 1000\n\t)\n}\n"],"names":[],"mappings":";;AAOO,MAAM,qBAAqB,CAAC,aAAwC;AAC1E,MAAI,OAAO,SAAS,eAAe,YAAY;AAC9C,WAAO,SAAS,WAAA;AAAA,EACjB;AACA,SAAO,GAAG,kBAAkB,QAAQ,CAAC;AACtC;AAEO,MAAM,oBAAoB,CAAC,aAAwC;AACzE,QAAM,EAAE,QAAQ,OAAO,MAAM,OAAO,SAAS,SAAS,iBAAiB;AACvE,UACE,SAAS,KAAK,MAAM,KAAK,KAAK,MAC5B,UAAU,KAAK,KAAK,KAAK,KAAK,MAC9B,QAAQ,KAAK,KAAK,KAAK,MACvB,SAAS,KAAK,KAAK,MACnB,WAAW,KAAK,MAChB,WAAW,MACX,gBAAgB,KAAK;AAE1B;;;"}