@contember/engine-tenant-api 2.1.0-rc.3 → 2.2.0-alpha.10

package/dist/types/model/service/idp/IDPClaimSyncService.d.ts

@@ -0,0 +1,113 @@
+import { DatabaseContext } from '../../utils/index.js';
+import { ClaimMapping } from './ClaimMapping.js';
+import { MappedMembership } from './ClaimMappingEvaluator.js';
+import { ProjectSchemaResolver } from '../../type/index.js';
+export type ClaimMappingSnapshot = {
+    readonly memberships: readonly MappedMembership[];
+};
+export type ClaimMappingAudit = {
+    readonly before: ClaimMappingSnapshot;
+    readonly after: ClaimMappingSnapshot;
+    readonly syncPolicy: NonNullable<ClaimMapping['syncPolicy']>;
+    readonly unmatched: NonNullable<ClaimMapping['unmatched']>;
+};
+export type ClaimMappingSyncResult = {
+    /** Membership before/after delta — present only when the apply actually changed grants. */
+    readonly audit: ClaimMappingAudit | null;
+    /** True when the apply-time safety backstop dropped one or more configured rules (a fail-open marker for the caller's audit). */
+    readonly droppedUnsafeRules: boolean;
+};
+/**
+ * Applies an IdP's `claimMapping` (A09) after a person has been resolved: evaluates the declarative
+ * rules against the IdP claims and grants the resulting project memberships, honouring the per-IdP
+ * `syncPolicy` (`always` vs `sticky`) and `unmatched` (`keep` vs `remove`) settings. The mapping
+ * grants project memberships only — never global/tenant roles (see {@link ClaimMapping}).
+ *
+ * Runs at sign-in (inside the sign-in transaction) and, for `always` mappings, again on each OIDC
+ * session refresh (see `IdpSessionRevalidator`). Returns a {@link ClaimMappingSyncResult}: an
+ * `{ before, after }` audit delta (`null` when nothing changed) plus `droppedUnsafeRules` (true when the
+ * apply-time safety backstop dropped a configured rule). The caller emits the `idp_role_mapped` audit
+ * from the delta and the `idp_role_mapping_failed` fail-open marker from `droppedUnsafeRules` — audit
+ * lives at the caller layer, never here.
+ *
+ * The caller parses the mapping (via {@link parseClaimMapping}) and decides the fail-open policy: a
+ * malformed config is caught by the caller before this runs, while a DB error raised here propagates
+ * so the surrounding transaction rolls back the partial apply (no half-applied grants).
+ */
+export declare class IDPClaimSyncService {
+    private readonly projectSchemaResolver;
+    constructor(projectSchemaResolver: ProjectSchemaResolver);
+    sync(db: DatabaseContext, mapping: ClaimMapping, claims: Record<string, unknown>, identity: {
+        id: string;
+    }, isNewPerson: boolean, options?: {
+        allowRemoval?: boolean;
+    }): Promise<ClaimMappingSyncResult>;
+    /**
+     * Partition rules into those safe to apply and those dropped by the apply-time safety backstop. A rule
+     * is dropped when its granted membership produces ANY validation error against the project's CURRENT ACL
+     * schema (fail-closed) — condition-injection above all, but also an unknown role/variable, a malformed
+     * condition value, or a forbidden predefined variable. A validation throw is treated as unsafe (we cannot
+     * prove the grant safe). Schemas (and, when needed, project existence) are resolved at most once per
+     * project. The dropped set is returned so the caller can emit a fail-open audit marker.
+     *
+     * When `getSchema` returns no ACL it does NOT mean "the project does not exist": it returns undefined both
+     * for a project that has no row yet AND for one whose row exists but whose container / content schema is
+     * momentarily unresolvable (mid-provisioning, transient). The two need OPPOSITE handling, so we
+     * disambiguate via the tenant `project` table:
+     *   - no project row → the grant is genuinely inert (`applyMemberships` resolves the same slug and skips
+     *     it, so nothing is written). KEEP the rule for when the project is created later.
+     *   - project row EXISTS but the ACL is unresolvable → `applyMemberships` WOULD still write the membership
+     *     (it resolves the slug from the tenant `project` table, independent of the content schema), so an
+     *     UNVALIDATED grant — including a claim-derived value targeting a `condition` ACL variable — could
+     *     land. Fail closed: DROP the rule (it re-applies on a later sign-in once the schema resolves). This
+     *     matches the direct add-member path, which refuses a membership whose project schema can't be resolved.
+     *
+     * Returns the per-project ACL map it built (`aclByProject`) so the runtime backstop
+     * ({@link dropUnsafeEvaluatedMemberships}) can re-use it without re-resolving any schema.
+     */
+    private dropUnsafeRules;
+    /**
+     * RUNTIME companion to {@link dropUnsafeRules} (A09 apply-time backstop, part 2). `dropUnsafeRules`
+     * validates each rule's static CONFIG shape and — like config-time validation — TOLERATES a missing
+     * membership variable (`VARIABLE_EMPTY`): an A09 grant may legitimately set only some of a role's
+     * variables. For an ordinary role that tolerance is safe: a variable that resolves to no value just
+     * narrows CONTENT access (the membership resolver maps it to `{ never: true }` — strictly LESS access,
+     * never more), and a role's tenant permissions are matched against that role's OWN tenant rule (a
+     * missing variable there denies, never escalates).
+     *
+     * The ONE role that breaks the assumption is the project `admin` role: {@link ProjectScope} grants the
+     * PROJECT_ADMIN tenant role (project secrets, member management, IdP config, deploy, …) to ANY identity
+     * holding an `admin` membership in the project — keyed on the role NAME alone, independent of the
+     * membership's variables. So when a claim-derived variable meant to SCOPE an `admin` grant resolves
+     * empty, `applyMemberships` drops the empty variable before the write and persists a BARE `admin`
+     * membership — i.e. UNSCOPED project-admin, even though the operator intended a scoped grant, and a
+     * membership the direct add-member path ({@link MembershipResolver}, via `MembershipValidator`) would
+     * REJECT as `VARIABLE_EMPTY`. (`admin` is the only role-name-based grant in the whole authorization
+     * layer; every other privilege is gated by ACL variables/predicates, so it cannot be widened this way.)
+     *
+     * So, fail-closed, we re-validate every evaluated `admin` grant EXACTLY as it would be written (empty
+     * variables filtered out, as `applyMemberships` does) against the live ACL and DROP it if the resolver
+     * reports any error — i.e. if a required (non-fallback) `admin` variable would be absent. Under `keep`
+     * the bare grant is then never written; under `remove` it is absent from the granted set, so
+     * reconciliation revokes any pre-existing one. Non-`admin` grants are left untouched (their partial
+     * grants stay valid). The drop folds into `droppedUnsafeRules`, so the caller still emits the
+     * `idp_role_mapping_failed` fail-open marker.
+     */
+    private dropUnsafeEvaluatedMemberships;
+    private applyMemberships;
+    /**
+     * Snapshot the identity's mapping-relevant memberships for the audit delta: its memberships (with
+     * variable values) for exactly the (project, role) pairs in the mapping's vocabulary. Bounding is by
+     * (project, role) — a membership whose ROLE no rule names is excluded entirely — which keeps the audit
+     * consistent with the (also vocabulary-bounded) reconciliation. NOTE the bound is per-(project, role),
+     * NOT per-variable-name: for an in-vocabulary membership ALL its variables are snapshotted, including any
+     * variable managed OUTSIDE the mapping on that same role (e.g. an admin-set `condition` filter), and a
+     * `passthrough` variable's value IS the verbatim external claim value. So the idp_role_mapped event_data
+     * can disclose claim-derived / admin-managed variable values for a mapped role to system:viewAuthLog
+     * readers — by design (the recorded value is the ACL grant being audited). Variable values are included
+     * so a sign-in that only changes a claim-derived membership variable — itself a row-level ACL grant — is
+     * still detected as a change and audited.
+     */
+    private snapshot;
+}
+//# sourceMappingURL=IDPClaimSyncService.d.ts.map

package/dist/types/model/service/idp/IDPClaimSyncService.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"IDPClaimSyncService.d.ts","sourceRoot":"","sources":["../../../../../src/model/service/idp/IDPClaimSyncService.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAA;AACtD,OAAO,EAAE,YAAY,EAA4D,MAAM,mBAAmB,CAAA;AAC1G,OAAO,EAAwB,gBAAgB,EAAE,MAAM,4BAA4B,CAAA;AAEnF,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAA;AAM3D,MAAM,MAAM,oBAAoB,GAAG;IAClC,QAAQ,CAAC,WAAW,EAAE,SAAS,gBAAgB,EAAE,CAAA;CACjD,CAAA;AAED,MAAM,MAAM,iBAAiB,GAAG;IAC/B,QAAQ,CAAC,MAAM,EAAE,oBAAoB,CAAA;IACrC,QAAQ,CAAC,KAAK,EAAE,oBAAoB,CAAA;IACpC,QAAQ,CAAC,UAAU,EAAE,WAAW,CAAC,YAAY,CAAC,YAAY,CAAC,CAAC,CAAA;IAC5D,QAAQ,CAAC,SAAS,EAAE,WAAW,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC,CAAA;CAC1D,CAAA;AAED,MAAM,MAAM,sBAAsB,GAAG;IACpC,2FAA2F;IAC3F,QAAQ,CAAC,KAAK,EAAE,iBAAiB,GAAG,IAAI,CAAA;IACxC,iIAAiI;IACjI,QAAQ,CAAC,kBAAkB,EAAE,OAAO,CAAA;CACpC,CAAA;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,qBAAa,mBAAmB;IAE9B,OAAO,CAAC,QAAQ,CAAC,qBAAqB;IADvC,YACkB,qBAAqB,EAAE,qBAAqB,EAE7D;IAEK,IAAI,CACT,EAAE,EAAE,eAAe,EACnB,OAAO,EAAE,YAAY,EACrB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,QAAQ,EAAE;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,EACxB,WAAW,EAAE,OAAO,EACpB,OAAO,GAAE;QAAE,YAAY,CAAC,EAAE,OAAO,CAAA;KAAO,GACtC,OAAO,CAAC,sBAAsB,CAAC,CAiEjC;IAED;;;;;;;;;;;;;;;;;;;;;;OAsBG;YACW,eAAe;IAgD7B;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IACH,OAAO,CAAC,8BAA8B;YAyCxB,gBAAgB;IAkF9B;;;;;;;;;;;;OAYG;YACW,QAAQ;CAuBtB"}

package/dist/types/model/service/idp/IDPHandlerRegistry.d.ts

@@ -1,4 +1,4 @@
-import { IdentityProviderHandler } from './IdentityProviderHandler';
+import { IdentityProviderHandler } from './IdentityProviderHandler.js';
 export declare class IDPHandlerRegistry {
     private providers;
     registerHandler(type: string, provider: IdentityProviderHandler<any>): void;

package/dist/types/model/service/idp/IDPHandlerRegistry.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"IDPHandlerRegistry.d.ts","sourceRoot":"","sources":["../../../../../src/model/service/idp/IDPHandlerRegistry.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAA;AAGnE,qBAAa,kBAAkB;IAC9B,OAAO,CAAC,SAAS,CAAmD;IAE7D,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,uBAAuB,CAAC,GAAG,CAAC,GAAG,IAAI;IAI3E,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,uBAAuB,CAAC,EAAE,CAAC,GAAG,IAAI;IAIlE,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,uBAAuB,CAAC,EAAE,CAAC;CAO5D"}
+{"version":3,"file":"IDPHandlerRegistry.d.ts","sourceRoot":"","sources":["../../../../../src/model/service/idp/IDPHandlerRegistry.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAA;AAGtE,qBAAa,kBAAkB;IAC9B,OAAO,CAAC,SAAS,CAAmD;IAE7D,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,uBAAuB,CAAC,GAAG,CAAC,GAAG,IAAI,CAEjF;IAEM,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,uBAAuB,CAAC,EAAE,CAAC,GAAG,IAAI,CAExE;IAEM,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,uBAAuB,CAAC,EAAE,CAAC,CAM3D;CACD"}

package/dist/types/model/service/idp/IDPManager.d.ts

@@ -1,13 +1,15 @@
-import { Response } from '../../utils/Response';
-import { AddIdpErrorCode, DisableIdpErrorCode, EnableIdpErrorCode, UpdateIdpErrorCode } from '../../../schema';
-import { DatabaseContext } from '../../utils';
-import { IdentityProviderData } from '../../type';
-import { IDPHandlerRegistry } from './IDPHandlerRegistry';
-import { UpdateIdpData } from '../../commands/idp/UpdateIdpCommand';
-import { IdentityProviderDto } from '../../queries/idp/types';
+import { Response } from '../../utils/Response.js';
+import { AddIdpErrorCode, DisableIdpErrorCode, EnableIdpErrorCode, UpdateIdpErrorCode } from '../../../schema/index.js';
+import { DatabaseContext } from '../../utils/index.js';
+import { IdentityProviderData } from '../../type/index.js';
+import { IDPHandlerRegistry } from './IDPHandlerRegistry.js';
+import { ProjectSchemaResolver } from '../../type/index.js';
+import { UpdateIdpData } from '../../commands/idp/UpdateIdpCommand.js';
+import { IdentityProviderDto } from '../../queries/idp/types.js';
 export declare class IDPManager {
     private readonly idpRegistry;
-    constructor(idpRegistry: IDPHandlerRegistry);
+    private readonly projectSchemaResolver;
+    constructor(idpRegistry: IDPHandlerRegistry, projectSchemaResolver: ProjectSchemaResolver);
     addIDP(db: DatabaseContext, idp: IdentityProviderData): Promise<RegisterIDPResponse>;
     disableIDP(db: DatabaseContext, slug: string): Promise<DisableIDPResponse>;
     enableIDP(db: DatabaseContext, slug: string): Promise<EnableIDPResponse>;
@@ -24,12 +26,22 @@ export declare class IDPManager {
      * The parsed result carries exactly the keys the provider understood, so the difference against
      * the submitted object is the set of ignored keys. All of them are reported at once (rather than
      * the first, as `Typesafe.noExtraProps` would) so a configuration with several typos takes one
-     * round trip to fix.
+     * round trip to fix, matching {@link findRemovedRuleKeys}.
      *
-     * Write time only: reading a stored configuration is deliberately left untouched, so a row written
-     * before this check keeps authenticating instead of locking its users out.
+     * Only the top level is checked: nested shapes that need strictness validate themselves
+     * (`claimMapping` via {@link parseClaimMapping}). Reading a stored configuration is deliberately
+     * left untouched — this runs at write time only, so a row written before this check keeps
+     * authenticating instead of locking its users out.
      */
     private assertNoUnknownConfigurationKeys;
+    /**
+     * Validate the optional A09 `claimMapping` embedded in an IdP `configuration`: reject a removed
+     * `grantRoles` (global-role mapping was dropped — see {@link parseClaimMapping}), reject a
+     * malformed shape, and validate each granted membership's role against the target project's ACL
+     * schema (mirroring the direct add-member path). Throws {@link InvalidIDPConfigurationError},
+     * surfaced as `INVALID_CONFIGURATION`.
+     */
+    private assertValidClaimMapping;
     listIDP(db: DatabaseContext): Promise<IdentityProviderDto[]>;
 }
 export type RegisterIDPResponse = Response<null, AddIdpErrorCode>;

package/dist/types/model/service/idp/IDPManager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"IDPManager.d.ts","sourceRoot":"","sources":["../../../../../src/model/service/idp/IDPManager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAA6B,MAAM,sBAAsB,CAAA;AAC1E,OAAO,EAAE,eAAe,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAA;AAC9G,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AAC7C,OAAO,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAA;AAGjD,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAA;AAKzD,OAAO,EAAoB,aAAa,EAAE,MAAM,qCAAqC,CAAA;AACrF,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAA;AAE7D,qBAAa,UAAU;IAErB,OAAO,CAAC,QAAQ,CAAC,WAAW;gBAAX,WAAW,EAAE,kBAAkB;IAIpC,MAAM,CAAC,EAAE,EAAE,eAAe,EAAE,GAAG,EAAE,oBAAoB,GAAG,OAAO,CAAC,mBAAmB,CAAC;IAwBpF,UAAU,CAAC,EAAE,EAAE,eAAe,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAa1E,SAAS,CAAC,EAAE,EAAE,eAAe,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC;IAaxE,SAAS,CAAC,EAAE,EAAE,eAAe,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,EAAE,kBAAkB,EAAE,OAAO,GAAG,OAAO,CAAC,iBAAiB,CAAC;IAmDvI;;;;;;;;;;;;;;;;OAgBG;IACH,OAAO,CAAC,gCAAgC;IAW3B,OAAO,CAAC,EAAE,EAAE,eAAe,GAAG,OAAO,CAAC,mBAAmB,EAAE,CAAC;CAWzE;AAED,MAAM,MAAM,mBAAmB,GAAG,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAC,CAAA;AACjE,MAAM,MAAM,kBAAkB,GAAG,QAAQ,CAAC,IAAI,EAAE,mBAAmB,CAAC,CAAA;AACpE,MAAM,MAAM,iBAAiB,GAAG,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC,CAAA;AAClE,MAAM,MAAM,iBAAiB,GAAG,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC,CAAA"}
+{"version":3,"file":"IDPManager.d.ts","sourceRoot":"","sources":["../../../../../src/model/service/idp/IDPManager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAA6B,MAAM,yBAAyB,CAAA;AAC7E,OAAO,EAAE,eAAe,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAA;AACvH,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAA;AACtD,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAA;AAG1D,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAA;AAK5D,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAA;AAG3D,OAAO,EAAoB,aAAa,EAAE,MAAM,wCAAwC,CAAA;AACxF,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAA;AAEhE,qBAAa,UAAU;IAErB,OAAO,CAAC,QAAQ,CAAC,WAAW;IAC5B,OAAO,CAAC,QAAQ,CAAC,qBAAqB;IAFvC,YACkB,WAAW,EAAE,kBAAkB,EAC/B,qBAAqB,EAAE,qBAAqB,EAE7D;IAEY,MAAM,CAAC,EAAE,EAAE,eAAe,EAAE,GAAG,EAAE,oBAAoB,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAuBhG;IAEY,UAAU,CAAC,EAAE,EAAE,eAAe,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAWtF;IAEY,SAAS,CAAC,EAAE,EAAE,eAAe,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAWpF;IAEY,SAAS,CAAC,EAAE,EAAE,eAAe,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,EAAE,kBAAkB,EAAE,OAAO,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAkCtI;IAED;;;;;;;;;;;;;;;;;;OAkBG;IACH,OAAO,CAAC,gCAAgC;IAWxC;;;;;;OAMG;YACW,uBAAuB;IA8CxB,OAAO,CAAC,EAAE,EAAE,eAAe,GAAG,OAAO,CAAC,mBAAmB,EAAE,CAAC,CAUxE;CACD;AAkCD,MAAM,MAAM,mBAAmB,GAAG,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAC,CAAA;AACjE,MAAM,MAAM,kBAAkB,GAAG,QAAQ,CAAC,IAAI,EAAE,mBAAmB,CAAC,CAAA;AACpE,MAAM,MAAM,iBAAiB,GAAG,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC,CAAA;AAClE,MAAM,MAAM,iBAAiB,GAAG,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC,CAAA"}

package/dist/types/model/service/idp/IDPRevalidation.d.ts

@@ -0,0 +1,54 @@
+import * as Typesafe from '@contember/typesafe';
+/**
+ * Provider-agnostic re-validation settings, stored on an IdP's `configuration.revalidation`.
+ * Read both by the provider (to decide whether to capture session state at sign-in) and by
+ * the generic verify hook (`ApiKeyManager.verifyAndProlong`) to drive re-validation.
+ *
+ * The cadence is driven by the **access-token lifetime**, not a fixed interval: while the
+ * token is fresh the session is vouched-for and nothing happens; past `softRefreshThreshold`
+ * of its lifetime a proactive background (SWR) refresh kicks in; once the token has actually
+ * expired the refresh becomes blocking. See {@link IdpSessionRevalidator}.
+ *
+ * All fields optional; absent / `enabled: false` reproduces the pre-A24 behaviour exactly.
+ */
+export declare const IDPRevalidationConfig: {
+    (input: unknown, path?: PropertyKey[]): {
+        readonly enabled?: boolean | undefined;
+        readonly softRefreshThreshold?: number | undefined;
+        readonly minInterval?: string | undefined;
+        readonly fallbackInterval?: string | undefined;
+        readonly mode?: "auto" | "blocking" | undefined;
+        readonly onFailure?: "revoke" | undefined;
+    };
+    inner: {
+        enabled: Typesafe.Type<boolean>;
+        /**
+         * Fraction (0–1) of the access-token lifetime after which a proactive background (SWR)
+         * refresh starts — e.g. 0.5 = refresh once the token is half-expired. Default 0.5.
+         */
+        softRefreshThreshold: Typesafe.Type<number>;
+        /**
+         * Single-flight floor as a Postgres interval string: the minimum gap between revalidation
+         * attempts, so a burst of requests past the threshold triggers only one refresh.
+         * Default "10 seconds".
+         */
+        minInterval: Typesafe.Type<string>;
+        /**
+         * Throttle used when the IdP returns no token expiry (so the lifetime-based cadence can't
+         * apply), as a Postgres interval string. Default "5 minutes".
+         */
+        fallbackInterval: Typesafe.Type<string>;
+        /**
+         * `auto` (default): SWR/background before expiry, blocking once expired. `blocking`: always
+         * synchronous (zero revocation lag, at the cost of latency on the revalidation tick).
+         */
+        mode: Typesafe.Type<"auto" | "blocking">;
+        /** What to do when the IdP reports the session as gone. Currently only `revoke`. */
+        onFailure: Typesafe.Type<"revoke">;
+    };
+};
+export type IDPRevalidationConfig = ReturnType<typeof IDPRevalidationConfig>;
+export declare const REVALIDATION_DEFAULT_SOFT_THRESHOLD = 0.5;
+export declare const REVALIDATION_DEFAULT_MIN_INTERVAL = "10 seconds";
+export declare const REVALIDATION_DEFAULT_FALLBACK_INTERVAL = "5 minutes";
+//# sourceMappingURL=IDPRevalidation.d.ts.map

package/dist/types/model/service/idp/IDPRevalidation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"IDPRevalidation.d.ts","sourceRoot":"","sources":["../../../../../src/model/service/idp/IDPRevalidation.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,QAAQ,MAAM,qBAAqB,CAAA;AAE/C;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,qBAAqB;;;;;;;;;;;QAEjC;;;WAGG;;QAEH;;;;WAIG;;QAEH;;;WAGG;;QAEH;;;WAGG;;QAEH,oFAAoF;;;CAEnF,CAAA;AAEF,MAAM,MAAM,qBAAqB,GAAG,UAAU,CAAC,OAAO,qBAAqB,CAAC,CAAA;AAE5E,eAAO,MAAM,mCAAmC,MAAM,CAAA;AACtD,eAAO,MAAM,iCAAiC,eAAe,CAAA;AAC7D,eAAO,MAAM,sCAAsC,cAAc,CAAA"}

package/dist/types/model/service/idp/IdentityProviderHandler.d.ts

@@ -2,15 +2,88 @@ export interface InitIDPAuthResult {
     authUrl: string;
     sessionData: unknown;
 }
+/**
+ * Provider-specific federated-session state persisted alongside a Contember session
+ * (see the `idp_session` table) so the session can be re-validated against the IdP
+ * after the initial sign-in. Opaque to the core — only the owning provider's
+ * `revalidate` interprets `tokens`. Token material is encrypted at rest.
+ */
+export type IDPSessionState = {
+    /** OIDC `sid` claim / SAML `SessionIndex`, when the IdP provides one. */
+    sessionId?: string;
+    /** Provider-specific token payload (e.g. OIDC refresh/id token). Encrypted at rest. */
+    tokens?: Record<string, unknown>;
+    /** IdP-asserted absolute expiry of the federated session, if known. */
+    expiresAt?: Date;
+};
 export type IDPResponse = {
     externalIdentifier: string;
     email?: string;
     name?: string;
+    /** Whether the provider asserts the e-mail address is verified (OIDC `email_verified`). */
+    emailVerified?: boolean;
+    /**
+     * Federated-session state to persist for continuous re-validation. Present only when
+     * the provider supports it and revalidation is enabled on the IdP configuration;
+     * otherwise undefined and the session behaves like a plain password session.
+     */
+    idpSession?: IDPSessionState;
 } & Record<string, unknown>;
+/** Input for building an RP-initiated (front-channel) logout redirect URL. */
+export type LogoutUrlRequest = {
+    /** The ID token issued at sign-in, used as `id_token_hint`. */
+    idToken?: string;
+    /** Where the IdP should redirect the browser after it has logged the user out. */
+    postLogoutRedirectUri?: string;
+};
+/** Claims extracted from a validated OIDC back-channel logout token (the subset we act on). */
+export type LogoutTokenClaims = {
+    /** The IdP session id (`sid`) the logout applies to, when the token targets a single session. */
+    sid?: string;
+    /** The subject (`sub`) the logout applies to, when the token targets all the subject's sessions. */
+    sub?: string;
+};
+/** Outcome of a federated-session re-validation against the IdP. */
+export type RevalidationResult = {
+    status: 'valid';
+    /** Fresh claims, if the revalidation method returned any (e.g. userinfo). */
+    claims?: Record<string, unknown>;
+    /**
+     * Whether `claims` represent the IdP's COMPLETE claim surface — the same one sign-in sees — so a
+     * claim-mapping reconciliation may safely remove memberships under `unmatched: "remove"`. A partial
+     * surface (a userinfo-only probe, or a refresh whose userinfo fetch failed) leaves this false, and the
+     * caller keeps refresh-time sync additive-only to avoid stripping a grant the IdP still asserts.
+     */
+    claimsComplete?: boolean;
+    /** Updated session state to persist (e.g. a rotated refresh token). */
+    idpSession?: IDPSessionState;
+} | {
+    status: 'revoked';
+    reason: string;
+};
 export interface IdentityProviderHandler<Configuration extends {}> {
     initAuth: (configuration: Configuration, data: unknown) => Promise<InitIDPAuthResult>;
     processResponse: (configuration: Configuration, responseData: unknown) => Promise<IDPResponse>;
     validateConfiguration: (config: unknown) => Configuration;
     getPublicConfiguration?: (config: Configuration) => Partial<Configuration>;
+    /**
+     * Re-validate a previously established federated session against the IdP.
+     * Present only on providers that support continuous re-validation (OIDC); absent on
+     * providers that cannot (Apple, Facebook, SAML — which rely on a short max lifetime + SLO).
+     */
+    revalidate?: (configuration: Configuration, session: IDPSessionState) => Promise<RevalidationResult>;
+    /**
+     * Build an RP-initiated (front-channel) logout redirect URL for this session (A10).
+     * Returns null when the IdP advertises no `end_session_endpoint` — the caller then falls
+     * back to a local-only logout. Present only on providers that support Single Logout (OIDC).
+     */
+    buildLogoutUrl?: (configuration: Configuration, request: LogoutUrlRequest) => Promise<string | null>;
+    /**
+     * Validate an IdP-signed back-channel logout token (A10) and extract the targeted
+     * `sid` / `sub`. Throws when the token is invalid (bad signature, wrong issuer/audience,
+     * missing the back-channel `events` claim, etc.). Present only on providers that support
+     * OIDC back-channel logout.
+     */
+    validateLogoutToken?: (configuration: Configuration, logoutToken: string) => Promise<LogoutTokenClaims>;
 }
 //# sourceMappingURL=IdentityProviderHandler.d.ts.map

package/dist/types/model/service/idp/IdentityProviderHandler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"IdentityProviderHandler.d.ts","sourceRoot":"","sources":["../../../../../src/model/service/idp/IdentityProviderHandler.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,iBAAiB;IACjC,OAAO,EAAE,MAAM,CAAA;IACf,WAAW,EAAE,OAAO,CAAA;CACpB;AAED,MAAM,MAAM,WAAW,GAAG;IACzB,kBAAkB,EAAE,MAAM,CAAA;IAC1B,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,IAAI,CAAC,EAAE,MAAM,CAAA;CACb,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;AAE3B,MAAM,WAAW,uBAAuB,CAAC,aAAa,SAAS,EAAE;IAChE,QAAQ,EAAE,CAAC,aAAa,EAAE,aAAa,EAAE,IAAI,EAAE,OAAO,KAAK,OAAO,CAAC,iBAAiB,CAAC,CAAA;IAErF,eAAe,EAAE,CAAC,aAAa,EAAE,aAAa,EAAE,YAAY,EAAE,OAAO,KAAK,OAAO,CAAC,WAAW,CAAC,CAAA;IAE9F,qBAAqB,EAAE,CAAC,MAAM,EAAE,OAAO,KAAK,aAAa,CAAA;IAEzD,sBAAsB,CAAC,EAAE,CAAC,MAAM,EAAE,aAAa,KAAK,OAAO,CAAC,aAAa,CAAC,CAAA;CAC1E"}
+{"version":3,"file":"IdentityProviderHandler.d.ts","sourceRoot":"","sources":["../../../../../src/model/service/idp/IdentityProviderHandler.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,iBAAiB;IACjC,OAAO,EAAE,MAAM,CAAA;IACf,WAAW,EAAE,OAAO,CAAA;CACpB;AAED;;;;;GAKG;AACH,MAAM,MAAM,eAAe,GAAG;IAC7B,yEAAyE;IACzE,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,uFAAuF;IACvF,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAChC,uEAAuE;IACvE,SAAS,CAAC,EAAE,IAAI,CAAA;CAChB,CAAA;AAED,MAAM,MAAM,WAAW,GAAG;IACzB,kBAAkB,EAAE,MAAM,CAAA;IAC1B,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,2FAA2F;IAC3F,aAAa,CAAC,EAAE,OAAO,CAAA;IACvB;;;;OAIG;IACH,UAAU,CAAC,EAAE,eAAe,CAAA;CAC5B,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;AAE3B,8EAA8E;AAC9E,MAAM,MAAM,gBAAgB,GAAG;IAC9B,+DAA+D;IAC/D,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,kFAAkF;IAClF,qBAAqB,CAAC,EAAE,MAAM,CAAA;CAC9B,CAAA;AAED,+FAA+F;AAC/F,MAAM,MAAM,iBAAiB,GAAG;IAC/B,iGAAiG;IACjG,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,oGAAoG;IACpG,GAAG,CAAC,EAAE,MAAM,CAAA;CACZ,CAAA;AAED,oEAAoE;AACpE,MAAM,MAAM,kBAAkB,GAC3B;IACD,MAAM,EAAE,OAAO,CAAA;IACf,6EAA6E;IAC7E,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAChC;;;;;OAKG;IACH,cAAc,CAAC,EAAE,OAAO,CAAA;IACxB,uEAAuE;IACvE,UAAU,CAAC,EAAE,eAAe,CAAA;CAC5B,GACC;IACD,MAAM,EAAE,SAAS,CAAA;IACjB,MAAM,EAAE,MAAM,CAAA;CACd,CAAA;AAEF,MAAM,WAAW,uBAAuB,CAAC,aAAa,SAAS,EAAE;IAChE,QAAQ,EAAE,CAAC,aAAa,EAAE,aAAa,EAAE,IAAI,EAAE,OAAO,KAAK,OAAO,CAAC,iBAAiB,CAAC,CAAA;IAErF,eAAe,EAAE,CAAC,aAAa,EAAE,aAAa,EAAE,YAAY,EAAE,OAAO,KAAK,OAAO,CAAC,WAAW,CAAC,CAAA;IAE9F,qBAAqB,EAAE,CAAC,MAAM,EAAE,OAAO,KAAK,aAAa,CAAA;IAEzD,sBAAsB,CAAC,EAAE,CAAC,MAAM,EAAE,aAAa,KAAK,OAAO,CAAC,aAAa,CAAC,CAAA;IAE1E;;;;OAIG;IACH,UAAU,CAAC,EAAE,CAAC,aAAa,EAAE,aAAa,EAAE,OAAO,EAAE,eAAe,KAAK,OAAO,CAAC,kBAAkB,CAAC,CAAA;IAEpG;;;;OAIG;IACH,cAAc,CAAC,EAAE,CAAC,aAAa,EAAE,aAAa,EAAE,OAAO,EAAE,gBAAgB,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAA;IAEpG;;;;;OAKG;IACH,mBAAmB,CAAC,EAAE,CAAC,aAAa,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,KAAK,OAAO,CAAC,iBAAiB,CAAC,CAAA;CACvG"}

package/dist/types/model/service/idp/IdpSessionRevalidator.d.ts

@@ -0,0 +1,55 @@
+import { DatabaseContext } from '../../utils/index.js';
+import { ApiKeyRequestInfo } from '../../commands/index.js';
+import { ApiKeyRow } from '../../queries/apiKey/ApiKeyQuery.js';
+import { IDPHandlerRegistry } from './IDPHandlerRegistry.js';
+import { IDPClaimSyncService } from './IDPClaimSyncService.js';
+import { Logger } from '@contember/logger';
+export type RevalidationOutcome = 'valid' | 'revoked';
+/**
+ * Re-validates IdP-backed sessions against their identity provider on the verify hot path
+ * (A24). Invoked from `ApiKeyManager.verifyAndProlong`. Operates entirely through the supplied
+ * database contexts and the command bus, so it does not depend on `ApiKeyManager` (no DI cycle).
+ *
+ * The cadence is driven by the **access-token lifetime**, not a fixed interval:
+ *   - while the token is fresh (before `softRefreshThreshold` of its lifetime) → skip, free;
+ *   - past the threshold but not yet expired → a proactive **background (SWR)** refresh, so the
+ *     request keeps zero added latency and the token is renewed before it dies;
+ *   - once the token has actually expired → a **blocking** refresh (we can't serve a dead token).
+ * `mode: 'blocking'` forces every revalidation synchronous (zero revocation lag). When the IdP
+ * returns no token expiry, falls back to a plain `fallbackInterval` background throttle.
+ */
+export declare class IdpSessionRevalidator {
+    private readonly idpRegistry;
+    private readonly claimSyncService;
+    private readonly logger;
+    constructor(idpRegistry: IDPHandlerRegistry, claimSyncService: IDPClaimSyncService, logger: Logger);
+    revalidate(dbContext: DatabaseContext, readDbContext: DatabaseContext, apiKeyRow: ApiKeyRow, requestInfo?: ApiKeyRequestInfo): Promise<RevalidationOutcome>;
+    /**
+     * Decide whether (and how) to revalidate, purely from timestamps — no interval parsing in
+     * JS (the claim handles intervals in SQL). Returns null to skip.
+     */
+    private decide;
+    private runRevalidation;
+    /**
+     * Re-apply the claim mapping on a successful refresh. Runs in its own transaction (atomic apply of
+     * the membership changes) and never throws: the IdP has already vouched for the session, so a
+     * malformed mapping or a transient apply error must not revoke or fail it. A real membership change
+     * is audited as `idp_role_mapped`; a failure is audited as `idp_role_mapping_failed` (fail-open
+     * marker), mirroring the sign-in path. `claimsComplete` carries whether the refresh rebuilt sign-in's
+     * full claim surface (so removal reconciliation is safe) — see `allowRemoval` below.
+     */
+    private syncClaims;
+    private logRoleMapping;
+    private logRevalidated;
+    /**
+     * Audit a fail-open: the IdP couldn't be consulted (transient outage) or the stored config is
+     * corrupt, so we kept the session rather than revoking it. Naturally throttled to one entry
+     * per claim window (we only reach here after a successful claim, which bumps
+     * `last_validated_at`). The write is best-effort and self-contained — a failure to audit must
+     * never propagate and fail a blocking verify request (the whole point of failing open).
+     */
+    private logRevalidationFailed;
+    private revoke;
+    private resolveConfig;
+}
+//# sourceMappingURL=IdpSessionRevalidator.d.ts.map

package/dist/types/model/service/idp/IdpSessionRevalidator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"IdpSessionRevalidator.d.ts","sourceRoot":"","sources":["../../../../../src/model/service/idp/IdpSessionRevalidator.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAA;AACtD,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAA;AAC3D,OAAO,EAAE,SAAS,EAAE,MAAM,qCAAqC,CAAA;AAE/D,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAA;AAO5D,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAA;AAC9D,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAA;AAI1C,MAAM,MAAM,mBAAmB,GAAG,OAAO,GAAG,SAAS,CAAA;AAgBrD;;;;;;;;;;;;GAYG;AACH,qBAAa,qBAAqB;IAEhC,OAAO,CAAC,QAAQ,CAAC,WAAW;IAC5B,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IACjC,OAAO,CAAC,QAAQ,CAAC,MAAM;IAHxB,YACkB,WAAW,EAAE,kBAAkB,EAC/B,gBAAgB,EAAE,mBAAmB,EACrC,MAAM,EAAE,MAAM,EAE/B;IAEK,UAAU,CACf,SAAS,EAAE,eAAe,EAC1B,aAAa,EAAE,eAAe,EAC9B,SAAS,EAAE,SAAS,EACpB,WAAW,CAAC,EAAE,iBAAiB,GAC7B,OAAO,CAAC,mBAAmB,CAAC,CA0D9B;IAED;;;OAGG;IACH,OAAO,CAAC,MAAM;YAqBA,eAAe;IAoE7B;;;;;;;OAOG;YACW,UAAU;YAuCV,cAAc;YA+Bd,cAAc;IAe5B;;;;;;OAMG;YACW,qBAAqB;YA6BrB,MAAM;IAgCpB,OAAO,CAAC,aAAa;CAarB"}

package/dist/types/model/service/idp/PersonIdentityProviderManager.d.ts

@@ -0,0 +1,24 @@
+import { Response } from '../../utils/Response.js';
+import { DisconnectIdpErrorCode } from '../../../schema/index.js';
+import { DatabaseContext } from '../../utils/index.js';
+import { PersonIdentityProviderRow, PersonRow } from '../../queries/index.js';
+/**
+ * Manages the external IdP connections of the *currently authenticated* person.
+ *
+ * Lock-out policy: a person may always disconnect a provider as long as it does
+ * not remove their last remaining sign-in method. A connection is refused only
+ * when, after removal, the person would have no password, no passwordless
+ * sign-in enabled and no other *usable* IdP connection left — which would lock
+ * them out of their account entirely. Whether passwordless counts is decided by
+ * the same tenant policy the sign-in flow applies, and connections to disabled
+ * providers are not counted as a usable fallback (they cannot sign in).
+ */
+export declare class PersonIdentityProviderManager {
+    listPersonIdentityProviders(db: DatabaseContext, personId: string): Promise<PersonIdentityProviderRow[]>;
+    disconnectIdentityProvider(db: DatabaseContext, person: PersonRow, connectionId: string): Promise<DisconnectIDPResponse>;
+}
+export interface DisconnectIDPResult {
+    readonly slug: string;
+}
+export type DisconnectIDPResponse = Response<DisconnectIDPResult, DisconnectIdpErrorCode>;
+//# sourceMappingURL=PersonIdentityProviderManager.d.ts.map

package/dist/types/model/service/idp/PersonIdentityProviderManager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"PersonIdentityProviderManager.d.ts","sourceRoot":"","sources":["../../../../../src/model/service/idp/PersonIdentityProviderManager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAA6B,MAAM,yBAAyB,CAAA;AAC7E,OAAO,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAA;AACjE,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAA;AACtD,OAAO,EAAsB,yBAAyB,EAAgC,SAAS,EAAE,MAAM,wBAAwB,CAAA;AAI/H;;;;;;;;;;GAUG;AACH,qBAAa,6BAA6B;IAC5B,2BAA2B,CAAC,EAAE,EAAE,eAAe,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,yBAAyB,EAAE,CAAC,CAEpH;IAEY,0BAA0B,CAAC,EAAE,EAAE,eAAe,EAAE,MAAM,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,CAAC,CA+BpI;CACD;AAED,MAAM,WAAW,mBAAmB;IACnC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CACrB;AAED,MAAM,MAAM,qBAAqB,GAAG,QAAQ,CAAC,mBAAmB,EAAE,sBAAsB,CAAC,CAAA"}

package/dist/types/model/service/idp/index.d.ts

@@ -1,11 +1,19 @@
-export * from './IdentityProviderHandler';
-export * from './IdentityProviderNotFoundError';
-export * from './IDPHandlerRegistry';
-export * from './IDPManager';
-export * from './IDPResponseError';
-export * from './IDPValidationError';
-export * from './InvalidIDPConfigurationError';
-export * from './providers/AppleProvider';
-export * from './providers/OIDCProvider';
-export * from './providers/FacebookProvider';
+export * from './IdentityProviderHandler.js';
+export * from './IdentityProviderNotFoundError.js';
+export * from './IDPHandlerRegistry.js';
+export * from './IdpSessionRevalidator.js';
+export * from './BackchannelLogoutManager.js';
+export * from './IDPRevalidation.js';
+export * from './IDPManager.js';
+export * from './PersonIdentityProviderManager.js';
+export * from './ClaimMapping.js';
+export * from './ClaimMappingEvaluator.js';
+export * from './ClaimMappingValidation.js';
+export * from './IDPClaimSyncService.js';
+export * from './IDPResponseError.js';
+export * from './IDPValidationError.js';
+export * from './InvalidIDPConfigurationError.js';
+export * from './providers/AppleProvider.js';
+export * from './providers/OIDCProvider.js';
+export * from './providers/FacebookProvider.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/types/model/service/idp/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/model/service/idp/index.ts"],"names":[],"mappings":"AAAA,cAAc,2BAA2B,CAAA;AACzC,cAAc,iCAAiC,CAAA;AAC/C,cAAc,sBAAsB,CAAA;AACpC,cAAc,cAAc,CAAA;AAC5B,cAAc,oBAAoB,CAAA;AAClC,cAAc,sBAAsB,CAAA;AACpC,cAAc,gCAAgC,CAAA;AAC9C,cAAc,2BAA2B,CAAA;AACzC,cAAc,0BAA0B,CAAA;AACxC,cAAc,8BAA8B,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/model/service/idp/index.ts"],"names":[],"mappings":"AAAA,cAAc,8BAA8B,CAAA;AAC5C,cAAc,oCAAoC,CAAA;AAClD,cAAc,yBAAyB,CAAA;AACvC,cAAc,4BAA4B,CAAA;AAC1C,cAAc,+BAA+B,CAAA;AAC7C,cAAc,sBAAsB,CAAA;AACpC,cAAc,iBAAiB,CAAA;AAC/B,cAAc,oCAAoC,CAAA;AAClD,cAAc,mBAAmB,CAAA;AACjC,cAAc,4BAA4B,CAAA;AAC1C,cAAc,6BAA6B,CAAA;AAC3C,cAAc,0BAA0B,CAAA;AACxC,cAAc,uBAAuB,CAAA;AACrC,cAAc,yBAAyB,CAAA;AACvC,cAAc,mCAAmC,CAAA;AACjD,cAAc,8BAA8B,CAAA;AAC5C,cAAc,6BAA6B,CAAA;AAC3C,cAAc,iCAAiC,CAAA"}

package/dist/types/model/service/idp/providers/AppleProvider.d.ts

@@ -1,5 +1,5 @@
 import * as Typesafe from '@contember/typesafe';
-import { IdentityProviderHandler, IDPResponse, InitIDPAuthResult } from '../IdentityProviderHandler';
+import { IdentityProviderHandler, IDPResponse, InitIDPAuthResult } from '../IdentityProviderHandler.js';
 export declare const AppleConfiguration: Typesafe.Type<{
     readonly keyId: string;
     readonly teamId: string;
@@ -11,9 +11,27 @@ export declare const AppleConfiguration: Typesafe.Type<{
     readonly scope?: string | undefined;
     readonly additionalAuthorizedParties?: readonly string[] | undefined;
     readonly idTokenSignedResponseAlg?: string | undefined;
+    readonly tokenEndpointAuthMethod?: import("openid-client").ClientAuthMethod | undefined;
     readonly fetchUserInfo?: boolean | undefined;
     readonly returnOIDCResult?: boolean | undefined;
     readonly timeout?: number | undefined;
+    readonly revalidation?: ({
+        readonly enabled?: boolean | undefined;
+        readonly softRefreshThreshold?: number | undefined;
+        readonly minInterval?: string | undefined;
+        readonly fallbackInterval?: string | undefined;
+        readonly mode?: "auto" | "blocking" | undefined;
+        readonly onFailure?: "revoke" | undefined;
+    } & {
+        readonly method?: "introspection" | "refresh" | "userinfo" | undefined;
+    }) | undefined;
+    readonly claimMapping?: {
+        readonly externalIdentifier?: string | undefined;
+        readonly email?: string | undefined;
+        readonly name?: string | undefined;
+        readonly attributesKey?: string | undefined;
+    } | undefined;
+    readonly postLogoutRedirectUri?: string | undefined;
 }>;
 type AppleConfiguration = ReturnType<typeof AppleConfiguration>;
 export declare class AppleProvider implements IdentityProviderHandler<AppleConfiguration> {
@@ -29,9 +47,27 @@ export declare class AppleProvider implements IdentityProviderHandler<AppleConfi
         readonly scope?: string | undefined;
         readonly additionalAuthorizedParties?: readonly string[] | undefined;
         readonly idTokenSignedResponseAlg?: string | undefined;
+        readonly tokenEndpointAuthMethod?: import("openid-client").ClientAuthMethod | undefined;
         readonly fetchUserInfo?: boolean | undefined;
         readonly returnOIDCResult?: boolean | undefined;
         readonly timeout?: number | undefined;
+        readonly revalidation?: ({
+            readonly enabled?: boolean | undefined;
+            readonly softRefreshThreshold?: number | undefined;
+            readonly minInterval?: string | undefined;
+            readonly fallbackInterval?: string | undefined;
+            readonly mode?: "auto" | "blocking" | undefined;
+            readonly onFailure?: "revoke" | undefined;
+        } & {
+            readonly method?: "introspection" | "refresh" | "userinfo" | undefined;
+        }) | undefined;
+        readonly claimMapping?: {
+            readonly externalIdentifier?: string | undefined;
+            readonly email?: string | undefined;
+            readonly name?: string | undefined;
+            readonly attributesKey?: string | undefined;
+        } | undefined;
+        readonly postLogoutRedirectUri?: string | undefined;
     };
     initAuth(configuration: AppleConfiguration, data: unknown): Promise<InitIDPAuthResult>;
     processResponse(configuration: AppleConfiguration, data: unknown): Promise<IDPResponse>;

package/dist/types/model/service/idp/providers/AppleProvider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"AppleProvider.d.ts","sourceRoot":"","sources":["../../../../../../src/model/service/idp/providers/AppleProvider.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,QAAQ,MAAM,qBAAqB,CAAA;AAC/C,OAAO,EAAE,uBAAuB,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAA;AASpG,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;EAQ9B,CAAA;AAED,KAAK,kBAAkB,GAAG,UAAU,CAAC,OAAO,kBAAkB,CAAC,CAAA;AAI/D,qBAAa,aAAc,YAAW,uBAAuB,CAAC,kBAAkB,CAAC;IAChF,OAAO,CAAC,MAAM,CAA4B;IAE1C,qBAAqB;;;;;;;;;;;;;;MAAkE;IAE1E,QAAQ,CAAC,aAAa,EAAE,kBAAkB,EAAE,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC,iBAAiB,CAAC;IAStF,eAAe,CAAC,aAAa,EAAE,kBAAkB,EAAE,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC,WAAW,CAAC;IAMpG,sBAAsB,CAAC,EAAE,UAAU,EAAE,GAAG,MAAM,EAAE,EAAE,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,CAAC;YAIpF,gBAAgB;CAyB9B"}
+{"version":3,"file":"AppleProvider.d.ts","sourceRoot":"","sources":["../../../../../../src/model/service/idp/providers/AppleProvider.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,QAAQ,MAAM,qBAAqB,CAAA;AAC/C,OAAO,EAAE,uBAAuB,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAA;AASvG,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAQ9B,CAAA;AAED,KAAK,kBAAkB,GAAG,UAAU,CAAC,OAAO,kBAAkB,CAAC,CAAA;AAI/D,qBAAa,aAAc,YAAW,uBAAuB,CAAC,kBAAkB,CAAC;IAChF,OAAO,CAAC,MAAM,CAA4B;IAE1C,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;MAAkE;IAE1E,QAAQ,CAAC,aAAa,EAAE,kBAAkB,EAAE,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAOlG;IAEY,eAAe,CAAC,aAAa,EAAE,kBAAkB,EAAE,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC,WAAW,CAAC,CAInG;IAED,sBAAsB,CAAC,EAAE,UAAU,EAAE,GAAG,MAAM,EAAE,EAAE,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAEjG;YAEa,gBAAgB;CAyB9B"}

package/dist/types/model/service/idp/providers/FacebookProvider.d.ts

@@ -1,5 +1,5 @@
 import * as Typesafe from '@contember/typesafe';
-import { IdentityProviderHandler, IDPResponse, InitIDPAuthResult } from '../IdentityProviderHandler';
+import { IdentityProviderHandler, IDPResponse, InitIDPAuthResult } from '../IdentityProviderHandler.js';
 declare const FacebookConfiguration: Typesafe.Type<{
     readonly url: string;
     readonly clientId: string;
@@ -10,9 +10,27 @@ declare const FacebookConfiguration: Typesafe.Type<{
     readonly scope?: string | undefined;
     readonly additionalAuthorizedParties?: readonly string[] | undefined;
     readonly idTokenSignedResponseAlg?: string | undefined;
+    readonly tokenEndpointAuthMethod?: import("openid-client").ClientAuthMethod | undefined;
     readonly fetchUserInfo?: boolean | undefined;
     readonly returnOIDCResult?: boolean | undefined;
     readonly timeout?: number | undefined;
+    readonly revalidation?: ({
+        readonly enabled?: boolean | undefined;
+        readonly softRefreshThreshold?: number | undefined;
+        readonly minInterval?: string | undefined;
+        readonly fallbackInterval?: string | undefined;
+        readonly mode?: "auto" | "blocking" | undefined;
+        readonly onFailure?: "revoke" | undefined;
+    } & {
+        readonly method?: "introspection" | "refresh" | "userinfo" | undefined;
+    }) | undefined;
+    readonly claimMapping?: {
+        readonly externalIdentifier?: string | undefined;
+        readonly email?: string | undefined;
+        readonly name?: string | undefined;
+        readonly attributesKey?: string | undefined;
+    } | undefined;
+    readonly postLogoutRedirectUri?: string | undefined;
 }>;
 type FacebookConfiguration = ReturnType<typeof FacebookConfiguration>;
 export declare class FacebookProvider implements IdentityProviderHandler<FacebookConfiguration> {
@@ -27,9 +45,27 @@ export declare class FacebookProvider implements IdentityProviderHandler<Faceboo
         readonly scope?: string | undefined;
         readonly additionalAuthorizedParties?: readonly string[] | undefined;
         readonly idTokenSignedResponseAlg?: string | undefined;
+        readonly tokenEndpointAuthMethod?: import("openid-client").ClientAuthMethod | undefined;
         readonly fetchUserInfo?: boolean | undefined;
         readonly returnOIDCResult?: boolean | undefined;
         readonly timeout?: number | undefined;
+        readonly revalidation?: ({
+            readonly enabled?: boolean | undefined;
+            readonly softRefreshThreshold?: number | undefined;
+            readonly minInterval?: string | undefined;
+            readonly fallbackInterval?: string | undefined;
+            readonly mode?: "auto" | "blocking" | undefined;
+            readonly onFailure?: "revoke" | undefined;
+        } & {
+            readonly method?: "introspection" | "refresh" | "userinfo" | undefined;
+        }) | undefined;
+        readonly claimMapping?: {
+            readonly externalIdentifier?: string | undefined;
+            readonly email?: string | undefined;
+            readonly name?: string | undefined;
+            readonly attributesKey?: string | undefined;
+        } | undefined;
+        readonly postLogoutRedirectUri?: string | undefined;
     };
     initAuth(configuration: FacebookConfiguration, data: unknown): Promise<InitIDPAuthResult>;
     processResponse(configuration: FacebookConfiguration, data: unknown): Promise<IDPResponse>;

package/dist/types/model/service/idp/providers/FacebookProvider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"FacebookProvider.d.ts","sourceRoot":"","sources":["../../../../../../src/model/service/idp/providers/FacebookProvider.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,QAAQ,MAAM,qBAAqB,CAAA;AAE/C,OAAO,EAAE,uBAAuB,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAA;AASpG,QAAA,MAAM,qBAAqB;;;;;;;;;;;;;EAAwB,CAAA;AACnD,KAAK,qBAAqB,GAAG,UAAU,CAAC,OAAO,qBAAqB,CAAC,CAAA;AAkBrE,qBAAa,gBAAiB,YAAW,uBAAuB,CAAC,qBAAqB,CAAC;IAGtF,OAAO,CAAC,cAAc,CAsCpB;IAEF,qBAAqB;;;;;;;;;;;;;MAAqE;IAE7E,QAAQ,CAAC,aAAa,EAAE,qBAAqB,EAAE,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC,iBAAiB,CAAC;IASzF,eAAe,CAAC,aAAa,EAAE,qBAAqB,EAAE,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC,WAAW,CAAC;IA8BvG,sBAAsB,CAAC,EAAE,YAAY,EAAE,GAAG,MAAM,EAAE,EAAE,qBAAqB,GAAG,OAAO,CAAC,qBAAqB,CAAC;YAI5F,gBAAgB;CAa9B"}
+{"version":3,"file":"FacebookProvider.d.ts","sourceRoot":"","sources":["../../../../../../src/model/service/idp/providers/FacebookProvider.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,QAAQ,MAAM,qBAAqB,CAAA;AAE/C,OAAO,EAAE,uBAAuB,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAA;AASvG,QAAA,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAAwB,CAAA;AACnD,KAAK,qBAAqB,GAAG,UAAU,CAAC,OAAO,qBAAqB,CAAC,CAAA;AAkBrE,qBAAa,gBAAiB,YAAW,uBAAuB,CAAC,qBAAqB,CAAC;IAGtF,OAAO,CAAC,cAAc,CAsCpB;IAEF,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;MAAqE;IAE7E,QAAQ,CAAC,aAAa,EAAE,qBAAqB,EAAE,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAOrG;IAEY,eAAe,CAAC,aAAa,EAAE,qBAAqB,EAAE,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC,WAAW,CAAC,CA4BtG;IAED,sBAAsB,CAAC,EAAE,YAAY,EAAE,GAAG,MAAM,EAAE,EAAE,qBAAqB,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAEzG;YAEa,gBAAgB;CAa9B"}