@contember/engine-tenant-api 2.2.0-alpha.2 → 2.2.0-alpha.5

package/dist/development/src/model/service/idp/IdpSessionRevalidator.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"IdpSessionRevalidator.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/service/idp/IdpSessionRevalidator.ts"],"sourcesContent":["import { DatabaseContext } from '../../utils/index.js'\nimport { ApiKeyRequestInfo } from '../../commands/index.js'\nimport { ApiKeyRow } from '../../queries/apiKey/ApiKeyQuery.js'\nimport { IdpSessionByApiKeyQuery, IdpSessionRow } from '../../queries/idp/IdpSessionByApiKeyQuery.js'\nimport { IDPHandlerRegistry } from './IDPHandlerRegistry.js'\nimport { ClaimIdpRevalidationCommand } from '../../commands/idp/ClaimIdpRevalidationCommand.js'\nimport { UpdateIdpSessionCommand } from '../../commands/idp/UpdateIdpSessionCommand.js'\nimport { DisableApiKeyCommand } from '../../commands/index.js'\nimport { CreateAuthLogEntryCommand } from '../../commands/authLog/CreateAuthLogEntryCommand.js'\nimport { REVALIDATION_DEFAULT_FALLBACK_INTERVAL, REVALIDATION_DEFAULT_MIN_INTERVAL, REVALIDATION_DEFAULT_SOFT_THRESHOLD } from './IDPRevalidation.js'\nimport { IdentityProviderHandler, RevalidationResult } from './IdentityProviderHandler.js'\n\nexport type RevalidationOutcome = 'valid' | 'revoked'\n\ntype ResolvedRevalidationConfig = {\n\tenabled: boolean\n\tsoftThreshold: number\n\tminInterval: string\n\tfallbackInterval: string\n\tmode: 'auto' | 'blocking'\n}\n\n/**\n * Decision for the current request: whether to attempt a revalidation, and if so whether it\n * must block the request. `claimInterval` is the single-flight floor for the atomic claim.\n */\ntype Decision = null | { blocking: boolean; claimInterval: string }\n\n/**\n * Re-validates IdP-backed sessions against their identity provider on the verify hot path\n * (A24). Invoked from `ApiKeyManager.verifyAndProlong`. Operates entirely through the supplied\n * database contexts and the command bus, so it does not depend on `ApiKeyManager` (no DI cycle).\n *\n * The cadence is driven by the **access-token lifetime**, not a fixed interval:\n *   - while the token is fresh (before `softRefreshThreshold` of its lifetime) → skip, free;\n *   - past the threshold but not yet expired → a proactive **background (SWR)** refresh, so the\n *     request keeps zero added latency and the token is renewed before it dies;\n *   - once the token has actually expired → a **blocking** refresh (we can't serve a dead token).\n * `mode: 'blocking'` forces every revalidation synchronous (zero revocation lag). When the IdP\n * returns no token expiry, falls back to a plain `fallbackInterval` background throttle.\n */\nexport class IdpSessionRevalidator {\n\tconstructor(\n\t\tprivate readonly idpRegistry: IDPHandlerRegistry,\n\t) {\n\t}\n\n\tasync revalidate(\n\t\tdbContext: DatabaseContext,\n\t\treadDbContext: DatabaseContext,\n\t\tapiKeyRow: ApiKeyRow,\n\t\trequestInfo?: ApiKeyRequestInfo,\n\t): Promise<RevalidationOutcome> {\n\t\tconst row = await readDbContext.queryHandler.fetch(new IdpSessionByApiKeyQuery(apiKeyRow.id, readDbContext.providers))\n\t\tif (!row) {\n\t\t\t// not a federated session (password / IdP without revalidation) — fast no-op\n\t\t\treturn 'valid'\n\t\t}\n\n\t\tconst config = this.resolveConfig(row.providerConfiguration)\n\t\tif (!config.enabled) {\n\t\t\treturn 'valid'\n\t\t}\n\n\t\t// A disabled IdP no longer vouches for its sessions.\n\t\tif (row.providerDisabledAt) {\n\t\t\tawait this.revoke(dbContext, apiKeyRow, row, 'idp_disabled', requestInfo)\n\t\t\treturn 'revoked'\n\t\t}\n\n\t\tconst handler = this.idpRegistry.getHandlerOrNull(row.providerType)\n\t\tif (!handler?.revalidate) {\n\t\t\t// provider can't actively re-validate (e.g. SAML) — rely on expiry / SLO\n\t\t\treturn 'valid'\n\t\t}\n\n\t\tconst decision = this.decide(row, config, dbContext.providers.now())\n\t\tif (!decision) {\n\t\t\t// token still fresh — vouched for, no IdP call\n\t\t\treturn 'valid'\n\t\t}\n\n\t\t// Atomic claim = single-flight. Loser (within the floor window, or lost the race) serves stale.\n\t\tlet claimed: boolean\n\t\ttry {\n\t\t\tclaimed = await dbContext.commandBus.execute(new ClaimIdpRevalidationCommand(row.id, decision.claimInterval))\n\t\t} catch {\n\t\t\t// invalid interval string or transient DB error — fail open, retry next request\n\t\t\treturn 'valid'\n\t\t}\n\t\tif (!claimed) {\n\t\t\treturn 'valid'\n\t\t}\n\n\t\tif (decision.blocking) {\n\t\t\treturn await this.runRevalidation(dbContext, handler, row, apiKeyRow, requestInfo)\n\t\t}\n\n\t\t// SWR: serve this request from the (still valid) token, refresh after the response.\n\t\t// The work runs detached (after the response is sent), so any rejection — a transient\n\t\t// DB error in the revoke / persist writes, a corrupt-config throw — must be swallowed\n\t\t// here; otherwise it becomes an unhandledRejection and can take the worker down. The\n\t\t// session is simply kept and re-tried on a later request (the claim floor throttles).\n\t\tsetImmediate(() => {\n\t\t\tthis.runRevalidation(dbContext, handler, row, apiKeyRow, requestInfo).catch(() => {})\n\t\t})\n\t\treturn 'valid'\n\t}\n\n\t/**\n\t * Decide whether (and how) to revalidate, purely from timestamps — no interval parsing in\n\t * JS (the claim handles intervals in SQL). Returns null to skip.\n\t */\n\tprivate decide(row: IdpSessionRow, config: ResolvedRevalidationConfig, now: Date): Decision {\n\t\tconst expiresAt = row.session.expiresAt\n\t\tconst obtainedAt = row.tokenObtainedAt\n\n\t\t// No lifetime info from the IdP → plain background throttle on fallbackInterval.\n\t\tif (!expiresAt || !obtainedAt) {\n\t\t\treturn { blocking: config.mode === 'blocking', claimInterval: config.fallbackInterval }\n\t\t}\n\n\t\tconst lifetimeMs = expiresAt.getTime() - obtainedAt.getTime()\n\t\tconst softAtMs = obtainedAt.getTime() + lifetimeMs * config.softThreshold\n\t\tconst nowMs = now.getTime()\n\n\t\tif (nowMs < softAtMs) {\n\t\t\treturn null // still within the trusted window\n\t\t}\n\n\t\tconst expired = nowMs >= expiresAt.getTime()\n\t\treturn { blocking: config.mode === 'blocking' || expired, claimInterval: config.minInterval }\n\t}\n\n\tprivate async runRevalidation(\n\t\tdbContext: DatabaseContext,\n\t\thandler: IdentityProviderHandler<{}>,\n\t\trow: IdpSessionRow,\n\t\tapiKeyRow: ApiKeyRow,\n\t\trequestInfo?: ApiKeyRequestInfo,\n\t): Promise<RevalidationOutcome> {\n\t\tlet config: {}\n\t\ttry {\n\t\t\tconfig = handler.validateConfiguration(row.providerConfiguration)\n\t\t} catch {\n\t\t\t// corrupt stored config — must NOT revoke; keep the session and retry later. Audit\n\t\t\t// it so the operator can tell \"vouched for\" apart from \"silently broken\" (without an\n\t\t\t// entry, a config typo disables re-validation invisibly for the life of every session).\n\t\t\tawait this.logRevalidationFailed(dbContext, apiKeyRow, row, 'config_invalid', requestInfo)\n\t\t\treturn 'valid'\n\t\t}\n\n\t\tlet result: RevalidationResult\n\t\ttry {\n\t\t\tresult = await handler.revalidate!(config, row.session)\n\t\t} catch {\n\t\t\t// transient failure (network / IdP down) — must NOT revoke; keep the session and retry\n\t\t\t// on a later request (the claim floor prevents hammering the IdP). Audited (throttled\n\t\t\t// to one entry per claim window) so a prolonged IdP outage is visible rather than a\n\t\t\t// silent fail-open.\n\t\t\tawait this.logRevalidationFailed(dbContext, apiKeyRow, row, 'revalidation_error', requestInfo)\n\t\t\treturn 'valid'\n\t\t}\n\n\t\tif (result.status === 'revoked') {\n\t\t\tawait this.revoke(dbContext, apiKeyRow, row, result.reason, requestInfo)\n\t\t\treturn 'revoked'\n\t\t}\n\n\t\t// Still valid — persist the rotated token (resets the lifetime reference) / refreshed\n\t\t// expiry. A rotation is a real, low-frequency event (token-lifetime cadence), so we\n\t\t// audit it as `idp_session_revalidated`; the no-op userinfo/introspection probes\n\t\t// (no rotated session) are intentionally NOT logged to keep the audit log usable.\n\t\t//\n\t\t// The IdP has already vouched for the session, so these post-success writes are pure\n\t\t// best-effort bookkeeping (they only reset the SWR cadence reference). A transient DB\n\t\t// error or an `encrypt()` throw here must NOT fail the request — otherwise a blocking\n\t\t// revalidation fails closed on a successful refresh, contradicting \"fail open\" (the SWR\n\t\t// path already swallows this). Keep the existing row; the claim floor throttles a retry.\n\t\tif (result.idpSession) {\n\t\t\ttry {\n\t\t\t\tawait dbContext.commandBus.execute(new UpdateIdpSessionCommand(row.id, result.idpSession))\n\t\t\t\tawait this.logRevalidated(dbContext, apiKeyRow, row, requestInfo)\n\t\t\t} catch {\n\t\t\t\t// fall through — session stays valid, persist retried on a later request\n\t\t\t}\n\t\t}\n\t\treturn 'valid'\n\t}\n\n\tprivate async logRevalidated(dbContext: DatabaseContext, apiKeyRow: ApiKeyRow, row: IdpSessionRow, requestInfo?: ApiKeyRequestInfo): Promise<void> {\n\t\tawait dbContext.commandBus.execute(\n\t\t\tnew CreateAuthLogEntryCommand({\n\t\t\t\ttype: 'idp_session_revalidated',\n\t\t\t\tinvokedById: apiKeyRow.identity_id,\n\t\t\t\tpersonId: apiKeyRow.person_id ?? undefined,\n\t\t\t\tidentityProviderId: row.identityProviderId,\n\t\t\t\tpersonTokenId: apiKeyRow.id,\n\t\t\t\tsuccess: true,\n\t\t\t\tipAddress: requestInfo?.ip,\n\t\t\t\tuserAgent: requestInfo?.userAgent,\n\t\t\t}),\n\t\t)\n\t}\n\n\t/**\n\t * Audit a fail-open: the IdP couldn't be consulted (transient outage) or the stored config is\n\t * corrupt, so we kept the session rather than revoking it. Naturally throttled to one entry\n\t * per claim window (we only reach here after a successful claim, which bumps\n\t * `last_validated_at`). The write is best-effort and self-contained — a failure to audit must\n\t * never propagate and fail a blocking verify request (the whole point of failing open).\n\t */\n\tprivate async logRevalidationFailed(\n\t\tdbContext: DatabaseContext,\n\t\tapiKeyRow: ApiKeyRow,\n\t\trow: IdpSessionRow,\n\t\terrorCode: 'config_invalid' | 'revalidation_error',\n\t\trequestInfo?: ApiKeyRequestInfo,\n\t): Promise<void> {\n\t\ttry {\n\t\t\tawait dbContext.commandBus.execute(\n\t\t\t\tnew CreateAuthLogEntryCommand({\n\t\t\t\t\ttype: 'idp_session_revalidation_failed',\n\t\t\t\t\tinvokedById: apiKeyRow.identity_id,\n\t\t\t\t\tpersonId: apiKeyRow.person_id ?? undefined,\n\t\t\t\t\tidentityProviderId: row.identityProviderId,\n\t\t\t\t\tpersonTokenId: apiKeyRow.id,\n\t\t\t\t\t// not a security failure (the session is kept) — a fail-open marker the operator\n\t\t\t\t\t// can alert on. `success: true` keeps it out of the failed-login funnels.\n\t\t\t\t\tsuccess: true,\n\t\t\t\t\terrorCode,\n\t\t\t\t\tipAddress: requestInfo?.ip,\n\t\t\t\t\tuserAgent: requestInfo?.userAgent,\n\t\t\t\t}),\n\t\t\t)\n\t\t} catch {\n\t\t\t// best-effort observability — never fail the request because the audit write failed\n\t\t}\n\t}\n\n\tprivate async revoke(\n\t\tdbContext: DatabaseContext,\n\t\tapiKeyRow: ApiKeyRow,\n\t\trow: IdpSessionRow,\n\t\treason: string,\n\t\trequestInfo?: ApiKeyRequestInfo,\n\t): Promise<void> {\n\t\tawait dbContext.commandBus.execute(new DisableApiKeyCommand(apiKeyRow.id))\n\t\tawait dbContext.commandBus.execute(\n\t\t\tnew CreateAuthLogEntryCommand({\n\t\t\t\ttype: 'idp_session_revoked',\n\t\t\t\tinvokedById: apiKeyRow.identity_id,\n\t\t\t\tpersonId: apiKeyRow.person_id ?? undefined,\n\t\t\t\tidentityProviderId: row.identityProviderId,\n\t\t\t\tpersonTokenId: apiKeyRow.id,\n\t\t\t\tsuccess: false,\n\t\t\t\terrorCode: reason,\n\t\t\t\tipAddress: requestInfo?.ip,\n\t\t\t\tuserAgent: requestInfo?.userAgent,\n\t\t\t\t// the action payload belongs in `event_data` (where every other audit event puts\n\t\t\t\t// it and where the admin UI / AuthLogQueryResolver reads it); `metadata` is for\n\t\t\t\t// transport context (forwarder IP/UA).\n\t\t\t\teventData: { reason },\n\t\t\t}),\n\t\t)\n\t}\n\n\tprivate resolveConfig(configuration: Record<string, unknown>): ResolvedRevalidationConfig {\n\t\tconst raw = (configuration.revalidation ?? {}) as Record<string, unknown>\n\t\tconst threshold = typeof raw.softRefreshThreshold === 'number' && raw.softRefreshThreshold > 0 && raw.softRefreshThreshold <= 1\n\t\t\t? raw.softRefreshThreshold\n\t\t\t: REVALIDATION_DEFAULT_SOFT_THRESHOLD\n\t\treturn {\n\t\t\tenabled: raw.enabled === true,\n\t\t\tsoftThreshold: threshold,\n\t\t\tminInterval: typeof raw.minInterval === 'string' ? raw.minInterval : REVALIDATION_DEFAULT_MIN_INTERVAL,\n\t\t\tfallbackInterval: typeof raw.fallbackInterval === 'string' ? raw.fallbackInterval : REVALIDATION_DEFAULT_FALLBACK_INTERVAL,\n\t\t\tmode: raw.mode === 'blocking' ? 'blocking' : 'auto',\n\t\t}\n\t}\n}\n"],"names":["IdpSessionByApiKeyQuery","ClaimIdpRevalidationCommand","UpdateIdpSessionCommand","CreateAuthLogEntryCommand","DisableApiKeyCommand","REVALIDATION_DEFAULT_SOFT_THRESHOLD","REVALIDATION_DEFAULT_MIN_INTERVAL","REVALIDATION_DEFAULT_FALLBACK_INTERVAL"],"mappings":";;;;;;;;;;;AAyCO,MAAM,sBAAsB;AAAA,EAClC,YACkB,aAChB;AADgB,SAAA,cAAA;AAAA,EAElB;AAAA,EAEA,MAAM,WACL,WACA,eACA,WACA,aAC+B;AAC/B,UAAM,MAAM,MAAM,cAAc,aAAa,MAAM,IAAIA,wBAAAA,wBAAwB,UAAU,IAAI,cAAc,SAAS,CAAC;AACrH,QAAI,CAAC,KAAK;AAET,aAAO;AAAA,IACR;AAEA,UAAM,SAAS,KAAK,cAAc,IAAI,qBAAqB;AAC3D,QAAI,CAAC,OAAO,SAAS;AACpB,aAAO;AAAA,IACR;AAGA,QAAI,IAAI,oBAAoB;AAC3B,YAAM,KAAK,OAAO,WAAW,WAAW,KAAK,gBAAgB,WAAW;AACxE,aAAO;AAAA,IACR;AAEA,UAAM,UAAU,KAAK,YAAY,iBAAiB,IAAI,YAAY;AAClE,QAAI,CAAC,SAAS,YAAY;AAEzB,aAAO;AAAA,IACR;AAEA,UAAM,WAAW,KAAK,OAAO,KAAK,QAAQ,UAAU,UAAU,KAAK;AACnE,QAAI,CAAC,UAAU;AAEd,aAAO;AAAA,IACR;AAGA,QAAI;AACJ,QAAI;AACH,gBAAU,MAAM,UAAU,WAAW,QAAQ,IAAIC,wDAA4B,IAAI,IAAI,SAAS,aAAa,CAAC;AAAA,IAC7G,QAAQ;AAEP,aAAO;AAAA,IACR;AACA,QAAI,CAAC,SAAS;AACb,aAAO;AAAA,IACR;AAEA,QAAI,SAAS,UAAU;AACtB,aAAO,MAAM,KAAK,gBAAgB,WAAW,SAAS,KAAK,WAAW,WAAW;AAAA,IAClF;AAOA,iBAAa,MAAM;AAClB,WAAK,gBAAgB,WAAW,SAAS,KAAK,WAAW,WAAW,EAAE,MAAM,MAAM;AAAA,MAAC,CAAC;AAAA,IACrF,CAAC;AACD,WAAO;AAAA,EACR;AAAA;AAAA;AAAA;AAAA;AAAA,EAMQ,OAAO,KAAoB,QAAoC,KAAqB;AAC3F,UAAM,YAAY,IAAI,QAAQ;AAC9B,UAAM,aAAa,IAAI;AAGvB,QAAI,CAAC,aAAa,CAAC,YAAY;AAC9B,aAAO,EAAE,UAAU,OAAO,SAAS,YAAY,eAAe,OAAO,iBAAA;AAAA,IACtE;AAEA,UAAM,aAAa,UAAU,QAAA,IAAY,WAAW,QAAA;AACpD,UAAM,WAAW,WAAW,QAAA,IAAY,aAAa,OAAO;AAC5D,UAAM,QAAQ,IAAI,QAAA;AAElB,QAAI,QAAQ,UAAU;AACrB,aAAO;AAAA,IACR;AAEA,UAAM,UAAU,SAAS,UAAU,QAAA;AACnC,WAAO,EAAE,UAAU,OAAO,SAAS,cAAc,SAAS,eAAe,OAAO,YAAA;AAAA,EACjF;AAAA,EAEA,MAAc,gBACb,WACA,SACA,KACA,WACA,aAC+B;AAC/B,QAAI;AACJ,QAAI;AACH,eAAS,QAAQ,sBAAsB,IAAI,qBAAqB;AAAA,IACjE,QAAQ;AAIP,YAAM,KAAK,sBAAsB,WAAW,WAAW,KAAK,kBAAkB,WAAW;AACzF,aAAO;AAAA,IACR;AAEA,QAAI;AACJ,QAAI;AACH,eAAS,MAAM,QAAQ,WAAY,QAAQ,IAAI,OAAO;AAAA,IACvD,QAAQ;AAKP,YAAM,KAAK,sBAAsB,WAAW,WAAW,KAAK,sBAAsB,WAAW;AAC7F,aAAO;AAAA,IACR;AAEA,QAAI,OAAO,WAAW,WAAW;AAChC,YAAM,KAAK,OAAO,WAAW,WAAW,KAAK,OAAO,QAAQ,WAAW;AACvE,aAAO;AAAA,IACR;AAYA,QAAI,OAAO,YAAY;AACtB,UAAI;AACH,cAAM,UAAU,WAAW,QAAQ,IAAIC,wBAAAA,wBAAwB,IAAI,IAAI,OAAO,UAAU,CAAC;AACzF,cAAM,KAAK,eAAe,WAAW,WAAW,KAAK,WAAW;AAAA,MACjE,QAAQ;AAAA,MAER;AAAA,IACD;AACA,WAAO;AAAA,EACR;AAAA,EAEA,MAAc,eAAe,WAA4B,WAAsB,KAAoB,aAAgD;AAClJ,UAAM,UAAU,WAAW;AAAA,MAC1B,IAAIC,oDAA0B;AAAA,QAC7B,MAAM;AAAA,QACN,aAAa,UAAU;AAAA,QACvB,UAAU,UAAU,aAAa;AAAA,QACjC,oBAAoB,IAAI;AAAA,QACxB,eAAe,UAAU;AAAA,QACzB,SAAS;AAAA,QACT,WAAW,aAAa;AAAA,QACxB,WAAW,aAAa;AAAA,MAAA,CACxB;AAAA,IAAA;AAAA,EAEH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAc,sBACb,WACA,WACA,KACA,WACA,aACgB;AAChB,QAAI;AACH,YAAM,UAAU,WAAW;AAAA,QAC1B,IAAIA,oDAA0B;AAAA,UAC7B,MAAM;AAAA,UACN,aAAa,UAAU;AAAA,UACvB,UAAU,UAAU,aAAa;AAAA,UACjC,oBAAoB,IAAI;AAAA,UACxB,eAAe,UAAU;AAAA;AAAA;AAAA,UAGzB,SAAS;AAAA,UACT;AAAA,UACA,WAAW,aAAa;AAAA,UACxB,WAAW,aAAa;AAAA,QAAA,CACxB;AAAA,MAAA;AAAA,IAEH,QAAQ;AAAA,IAER;AAAA,EACD;AAAA,EAEA,MAAc,OACb,WACA,WACA,KACA,QACA,aACgB;AAChB,UAAM,UAAU,WAAW,QAAQ,IAAIC,qBAAAA,qBAAqB,UAAU,EAAE,CAAC;AACzE,UAAM,UAAU,WAAW;AAAA,MAC1B,IAAID,oDAA0B;AAAA,QAC7B,MAAM;AAAA,QACN,aAAa,UAAU;AAAA,QACvB,UAAU,UAAU,aAAa;AAAA,QACjC,oBAAoB,IAAI;AAAA,QACxB,eAAe,UAAU;AAAA,QACzB,SAAS;AAAA,QACT,WAAW;AAAA,QACX,WAAW,aAAa;AAAA,QACxB,WAAW,aAAa;AAAA;AAAA;AAAA;AAAA,QAIxB,WAAW,EAAE,OAAA;AAAA,MAAO,CACpB;AAAA,IAAA;AAAA,EAEH;AAAA,EAEQ,cAAc,eAAoE;AACzF,UAAM,MAAO,cAAc,gBAAgB,CAAA;AAC3C,UAAM,YAAY,OAAO,IAAI,yBAAyB,YAAY,IAAI,uBAAuB,KAAK,IAAI,wBAAwB,IAC3H,IAAI,uBACJE,gBAAAA;AACH,WAAO;AAAA,MACN,SAAS,IAAI,YAAY;AAAA,MACzB,eAAe;AAAA,MACf,aAAa,OAAO,IAAI,gBAAgB,WAAW,IAAI,cAAcC,gBAAAA;AAAAA,MACrE,kBAAkB,OAAO,IAAI,qBAAqB,WAAW,IAAI,mBAAmBC,gBAAAA;AAAAA,MACpF,MAAM,IAAI,SAAS,aAAa,aAAa;AAAA,IAAA;AAAA,EAE/C;AACD;;"}
+{"version":3,"file":"IdpSessionRevalidator.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/service/idp/IdpSessionRevalidator.ts"],"sourcesContent":["import { DatabaseContext } from '../../utils/index.js'\nimport { ApiKeyRequestInfo } from '../../commands/index.js'\nimport { ApiKeyRow } from '../../queries/apiKey/ApiKeyQuery.js'\nimport { IdpSessionByApiKeyQuery, IdpSessionRow } from '../../queries/idp/IdpSessionByApiKeyQuery.js'\nimport { IDPHandlerRegistry } from './IDPHandlerRegistry.js'\nimport { ClaimIdpRevalidationCommand } from '../../commands/idp/ClaimIdpRevalidationCommand.js'\nimport { UpdateIdpSessionCommand } from '../../commands/idp/UpdateIdpSessionCommand.js'\nimport { DisableApiKeyCommand } from '../../commands/index.js'\nimport { CreateAuthLogEntryCommand } from '../../commands/authLog/CreateAuthLogEntryCommand.js'\nimport { REVALIDATION_DEFAULT_FALLBACK_INTERVAL, REVALIDATION_DEFAULT_MIN_INTERVAL, REVALIDATION_DEFAULT_SOFT_THRESHOLD } from './IDPRevalidation.js'\nimport { IdentityProviderHandler, RevalidationResult } from './IdentityProviderHandler.js'\nimport { IDPClaimSyncService } from './IDPClaimSyncService.js'\nimport { parseClaimMapping } from './ClaimMapping.js'\nimport { JSONValue } from '@contember/schema'\n\nexport type RevalidationOutcome = 'valid' | 'revoked'\n\ntype ResolvedRevalidationConfig = {\n\tenabled: boolean\n\tsoftThreshold: number\n\tminInterval: string\n\tfallbackInterval: string\n\tmode: 'auto' | 'blocking'\n}\n\n/**\n * Decision for the current request: whether to attempt a revalidation, and if so whether it\n * must block the request. `claimInterval` is the single-flight floor for the atomic claim.\n */\ntype Decision = null | { blocking: boolean; claimInterval: string }\n\n/**\n * Re-validates IdP-backed sessions against their identity provider on the verify hot path\n * (A24). Invoked from `ApiKeyManager.verifyAndProlong`. Operates entirely through the supplied\n * database contexts and the command bus, so it does not depend on `ApiKeyManager` (no DI cycle).\n *\n * The cadence is driven by the **access-token lifetime**, not a fixed interval:\n *   - while the token is fresh (before `softRefreshThreshold` of its lifetime) → skip, free;\n *   - past the threshold but not yet expired → a proactive **background (SWR)** refresh, so the\n *     request keeps zero added latency and the token is renewed before it dies;\n *   - once the token has actually expired → a **blocking** refresh (we can't serve a dead token).\n * `mode: 'blocking'` forces every revalidation synchronous (zero revocation lag). When the IdP\n * returns no token expiry, falls back to a plain `fallbackInterval` background throttle.\n */\nexport class IdpSessionRevalidator {\n\tconstructor(\n\t\tprivate readonly idpRegistry: IDPHandlerRegistry,\n\t\tprivate readonly claimSyncService: IDPClaimSyncService,\n\t) {\n\t}\n\n\tasync revalidate(\n\t\tdbContext: DatabaseContext,\n\t\treadDbContext: DatabaseContext,\n\t\tapiKeyRow: ApiKeyRow,\n\t\trequestInfo?: ApiKeyRequestInfo,\n\t): Promise<RevalidationOutcome> {\n\t\tconst row = await readDbContext.queryHandler.fetch(new IdpSessionByApiKeyQuery(apiKeyRow.id, readDbContext.providers))\n\t\tif (!row) {\n\t\t\t// not a federated session (password / IdP without revalidation) — fast no-op\n\t\t\treturn 'valid'\n\t\t}\n\n\t\tconst config = this.resolveConfig(row.providerConfiguration)\n\t\tif (!config.enabled) {\n\t\t\treturn 'valid'\n\t\t}\n\n\t\t// A disabled IdP no longer vouches for its sessions.\n\t\tif (row.providerDisabledAt) {\n\t\t\tawait this.revoke(dbContext, apiKeyRow, row, 'idp_disabled', requestInfo)\n\t\t\treturn 'revoked'\n\t\t}\n\n\t\tconst handler = this.idpRegistry.getHandlerOrNull(row.providerType)\n\t\tif (!handler?.revalidate) {\n\t\t\t// provider can't actively re-validate (e.g. SAML) — rely on expiry / SLO\n\t\t\treturn 'valid'\n\t\t}\n\n\t\tconst decision = this.decide(row, config, dbContext.providers.now())\n\t\tif (!decision) {\n\t\t\t// token still fresh — vouched for, no IdP call\n\t\t\treturn 'valid'\n\t\t}\n\n\t\t// Atomic claim = single-flight. Loser (within the floor window, or lost the race) serves stale.\n\t\tlet claimed: boolean\n\t\ttry {\n\t\t\tclaimed = await dbContext.commandBus.execute(new ClaimIdpRevalidationCommand(row.id, decision.claimInterval))\n\t\t} catch {\n\t\t\t// invalid interval string or transient DB error — fail open, retry next request\n\t\t\treturn 'valid'\n\t\t}\n\t\tif (!claimed) {\n\t\t\treturn 'valid'\n\t\t}\n\n\t\tif (decision.blocking) {\n\t\t\treturn await this.runRevalidation(dbContext, handler, row, apiKeyRow, requestInfo)\n\t\t}\n\n\t\t// SWR: serve this request from the (still valid) token, refresh after the response.\n\t\t// The work runs detached (after the response is sent), so any rejection — a transient\n\t\t// DB error in the revoke / persist writes, a corrupt-config throw — must be swallowed\n\t\t// here; otherwise it becomes an unhandledRejection and can take the worker down. The\n\t\t// session is simply kept and re-tried on a later request (the claim floor throttles).\n\t\tsetImmediate(() => {\n\t\t\tthis.runRevalidation(dbContext, handler, row, apiKeyRow, requestInfo).catch(() => {})\n\t\t})\n\t\treturn 'valid'\n\t}\n\n\t/**\n\t * Decide whether (and how) to revalidate, purely from timestamps — no interval parsing in\n\t * JS (the claim handles intervals in SQL). Returns null to skip.\n\t */\n\tprivate decide(row: IdpSessionRow, config: ResolvedRevalidationConfig, now: Date): Decision {\n\t\tconst expiresAt = row.session.expiresAt\n\t\tconst obtainedAt = row.tokenObtainedAt\n\n\t\t// No lifetime info from the IdP → plain background throttle on fallbackInterval.\n\t\tif (!expiresAt || !obtainedAt) {\n\t\t\treturn { blocking: config.mode === 'blocking', claimInterval: config.fallbackInterval }\n\t\t}\n\n\t\tconst lifetimeMs = expiresAt.getTime() - obtainedAt.getTime()\n\t\tconst softAtMs = obtainedAt.getTime() + lifetimeMs * config.softThreshold\n\t\tconst nowMs = now.getTime()\n\n\t\tif (nowMs < softAtMs) {\n\t\t\treturn null // still within the trusted window\n\t\t}\n\n\t\tconst expired = nowMs >= expiresAt.getTime()\n\t\treturn { blocking: config.mode === 'blocking' || expired, claimInterval: config.minInterval }\n\t}\n\n\tprivate async runRevalidation(\n\t\tdbContext: DatabaseContext,\n\t\thandler: IdentityProviderHandler<{}>,\n\t\trow: IdpSessionRow,\n\t\tapiKeyRow: ApiKeyRow,\n\t\trequestInfo?: ApiKeyRequestInfo,\n\t): Promise<RevalidationOutcome> {\n\t\tlet config: {}\n\t\ttry {\n\t\t\tconfig = handler.validateConfiguration(row.providerConfiguration)\n\t\t} catch {\n\t\t\t// corrupt stored config — must NOT revoke; keep the session and retry later. Audit\n\t\t\t// it so the operator can tell \"vouched for\" apart from \"silently broken\" (without an\n\t\t\t// entry, a config typo disables re-validation invisibly for the life of every session).\n\t\t\tawait this.logRevalidationFailed(dbContext, apiKeyRow, row, 'config_invalid', requestInfo)\n\t\t\treturn 'valid'\n\t\t}\n\n\t\tlet result: RevalidationResult\n\t\ttry {\n\t\t\tresult = await handler.revalidate!(config, row.session)\n\t\t} catch {\n\t\t\t// transient failure (network / IdP down) — must NOT revoke; keep the session and retry\n\t\t\t// on a later request (the claim floor prevents hammering the IdP). Audited (throttled\n\t\t\t// to one entry per claim window) so a prolonged IdP outage is visible rather than a\n\t\t\t// silent fail-open.\n\t\t\tawait this.logRevalidationFailed(dbContext, apiKeyRow, row, 'revalidation_error', requestInfo)\n\t\t\treturn 'valid'\n\t\t}\n\n\t\tif (result.status === 'revoked') {\n\t\t\tawait this.revoke(dbContext, apiKeyRow, row, result.reason, requestInfo)\n\t\t\treturn 'revoked'\n\t\t}\n\n\t\t// Still valid — persist the rotated token (resets the lifetime reference) / refreshed\n\t\t// expiry. A rotation is a real, low-frequency event (token-lifetime cadence), so we\n\t\t// audit it as `idp_session_revalidated`; the no-op userinfo/introspection probes\n\t\t// (no rotated session) are intentionally NOT logged to keep the audit log usable.\n\t\t//\n\t\t// The IdP has already vouched for the session, so these post-success writes are pure\n\t\t// best-effort bookkeeping (they only reset the SWR cadence reference). A transient DB\n\t\t// error or an `encrypt()` throw here must NOT fail the request — otherwise a blocking\n\t\t// revalidation fails closed on a successful refresh, contradicting \"fail open\" (the SWR\n\t\t// path already swallows this). Keep the existing row; the claim floor throttles a retry.\n\t\tif (result.idpSession) {\n\t\t\ttry {\n\t\t\t\tawait dbContext.commandBus.execute(new UpdateIdpSessionCommand(row.id, result.idpSession))\n\t\t\t\tawait this.logRevalidated(dbContext, apiKeyRow, row, requestInfo)\n\t\t\t} catch {\n\t\t\t\t// fall through — session stays valid, persist retried on a later request\n\t\t\t}\n\t\t}\n\n\t\t// A09 — re-apply the IdP's claim mapping when the refresh returned fresh claims, so an `always`\n\t\t// mapping keeps an established session's project memberships in sync with the IdP's current claims\n\t\t// without requiring a full re-login. `sticky` mappings self-skip (the sync passes isNewPerson=false).\n\t\t// `claimsComplete` tells the sync whether the refresh rebuilt sign-in's full claim surface, so it can\n\t\t// reconcile (incl. `unmatched: \"remove\"`) exactly like sign-in. Strictly fail-open — see `syncClaims`.\n\t\tif (result.claims) {\n\t\t\tawait this.syncClaims(dbContext, row, apiKeyRow, result.claims, result.claimsComplete === true, requestInfo)\n\t\t}\n\t\treturn 'valid'\n\t}\n\n\t/**\n\t * Re-apply the claim mapping on a successful refresh. Runs in its own transaction (atomic apply of\n\t * the membership changes) and never throws: the IdP has already vouched for the session, so a\n\t * malformed mapping or a transient apply error must not revoke or fail it. A real membership change\n\t * is audited as `idp_role_mapped`; a failure is audited as `idp_role_mapping_failed` (fail-open\n\t * marker), mirroring the sign-in path. `claimsComplete` carries whether the refresh rebuilt sign-in's\n\t * full claim surface (so removal reconciliation is safe) — see `allowRemoval` below.\n\t */\n\tprivate async syncClaims(\n\t\tdbContext: DatabaseContext,\n\t\trow: IdpSessionRow,\n\t\tapiKeyRow: ApiKeyRow,\n\t\tclaims: Record<string, unknown>,\n\t\tclaimsComplete: boolean,\n\t\trequestInfo?: ApiKeyRequestInfo,\n\t): Promise<void> {\n\t\ttry {\n\t\t\tconst mapping = parseClaimMapping(row.providerConfiguration)\n\t\t\tif (!mapping) {\n\t\t\t\treturn\n\t\t\t}\n\t\t\t// Atomic apply in its own transaction (the verify path has no surrounding one). `always`-only:\n\t\t\t// the sync passes isNewPerson=false, so a `sticky` mapping self-skips and returns a null audit.\n\t\t\t// Refresh mirrors sign-in as closely as the claim surface allows: when the provider returned its\n\t\t\t// COMPLETE surface (`claimsComplete` — `method: \"refresh\"` rebuilding sign-in's id-token + userinfo\n\t\t\t// merge), `unmatched: \"remove\"` reconciliation runs here too. A partial surface (a userinfo-only\n\t\t\t// probe, or a refresh whose userinfo fetch failed) passes `allowRemoval: false`, so refresh stays\n\t\t\t// additive-only and a membership the IdP still asserts is never stripped off an incomplete surface.\n\t\t\tconst { audit, droppedUnsafeRules } = await dbContext.transaction(db =>\n\t\t\t\tthis.claimSyncService.sync(db, mapping, claims, { id: apiKeyRow.identity_id }, false, { allowRemoval: claimsComplete })\n\t\t\t)\n\t\t\tif (audit) {\n\t\t\t\tawait this.logRoleMapping(dbContext, apiKeyRow, row, 'idp_role_mapped', audit, requestInfo)\n\t\t\t}\n\t\t\t// The apply-time safety backstop dropped a configured rule — emit the fail-open marker so a broken\n\t\t\t// mapping is visible on the refresh path too, mirroring sign-in (the marker carries no claim values).\n\t\t\tif (droppedUnsafeRules) {\n\t\t\t\tawait this.logRoleMapping(dbContext, apiKeyRow, row, 'idp_role_mapping_failed', undefined, requestInfo)\n\t\t\t}\n\t\t} catch {\n\t\t\t// Strictly fail-open: a malformed mapping or a transient apply error must never revoke or\n\t\t\t// fail an already-vouched-for session. The transaction rolls back any partial apply.\n\t\t\tawait this.logRoleMapping(dbContext, apiKeyRow, row, 'idp_role_mapping_failed', undefined, requestInfo)\n\t\t}\n\t}\n\n\tprivate async logRoleMapping(\n\t\tdbContext: DatabaseContext,\n\t\tapiKeyRow: ApiKeyRow,\n\t\trow: IdpSessionRow,\n\t\ttype: 'idp_role_mapped' | 'idp_role_mapping_failed',\n\t\teventData: JSONValue | undefined,\n\t\trequestInfo?: ApiKeyRequestInfo,\n\t): Promise<void> {\n\t\ttry {\n\t\t\tawait dbContext.commandBus.execute(\n\t\t\t\tnew CreateAuthLogEntryCommand({\n\t\t\t\t\ttype,\n\t\t\t\t\tinvokedById: apiKeyRow.identity_id,\n\t\t\t\t\tpersonId: apiKeyRow.person_id ?? undefined,\n\t\t\t\t\t// The membership change affects this session's own person — record it as the target too,\n\t\t\t\t\t// so an admin querying membership changes by target_person_id sees IdP-driven grants/revokes\n\t\t\t\t\t// (consistent with the project_membership_* audit events).\n\t\t\t\t\ttargetPersonId: apiKeyRow.person_id ?? undefined,\n\t\t\t\t\tidentityProviderId: row.identityProviderId,\n\t\t\t\t\tpersonTokenId: apiKeyRow.id,\n\t\t\t\t\tsuccess: true,\n\t\t\t\t\teventData,\n\t\t\t\t\tipAddress: requestInfo?.ip,\n\t\t\t\t\tuserAgent: requestInfo?.userAgent,\n\t\t\t\t}),\n\t\t\t)\n\t\t} catch {\n\t\t\t// best-effort audit — never fail the request because the audit write failed\n\t\t}\n\t}\n\n\tprivate async logRevalidated(dbContext: DatabaseContext, apiKeyRow: ApiKeyRow, row: IdpSessionRow, requestInfo?: ApiKeyRequestInfo): Promise<void> {\n\t\tawait dbContext.commandBus.execute(\n\t\t\tnew CreateAuthLogEntryCommand({\n\t\t\t\ttype: 'idp_session_revalidated',\n\t\t\t\tinvokedById: apiKeyRow.identity_id,\n\t\t\t\tpersonId: apiKeyRow.person_id ?? undefined,\n\t\t\t\tidentityProviderId: row.identityProviderId,\n\t\t\t\tpersonTokenId: apiKeyRow.id,\n\t\t\t\tsuccess: true,\n\t\t\t\tipAddress: requestInfo?.ip,\n\t\t\t\tuserAgent: requestInfo?.userAgent,\n\t\t\t}),\n\t\t)\n\t}\n\n\t/**\n\t * Audit a fail-open: the IdP couldn't be consulted (transient outage) or the stored config is\n\t * corrupt, so we kept the session rather than revoking it. Naturally throttled to one entry\n\t * per claim window (we only reach here after a successful claim, which bumps\n\t * `last_validated_at`). The write is best-effort and self-contained — a failure to audit must\n\t * never propagate and fail a blocking verify request (the whole point of failing open).\n\t */\n\tprivate async logRevalidationFailed(\n\t\tdbContext: DatabaseContext,\n\t\tapiKeyRow: ApiKeyRow,\n\t\trow: IdpSessionRow,\n\t\terrorCode: 'config_invalid' | 'revalidation_error',\n\t\trequestInfo?: ApiKeyRequestInfo,\n\t): Promise<void> {\n\t\ttry {\n\t\t\tawait dbContext.commandBus.execute(\n\t\t\t\tnew CreateAuthLogEntryCommand({\n\t\t\t\t\ttype: 'idp_session_revalidation_failed',\n\t\t\t\t\tinvokedById: apiKeyRow.identity_id,\n\t\t\t\t\tpersonId: apiKeyRow.person_id ?? undefined,\n\t\t\t\t\tidentityProviderId: row.identityProviderId,\n\t\t\t\t\tpersonTokenId: apiKeyRow.id,\n\t\t\t\t\t// not a security failure (the session is kept) — a fail-open marker the operator\n\t\t\t\t\t// can alert on. `success: true` keeps it out of the failed-login funnels.\n\t\t\t\t\tsuccess: true,\n\t\t\t\t\terrorCode,\n\t\t\t\t\tipAddress: requestInfo?.ip,\n\t\t\t\t\tuserAgent: requestInfo?.userAgent,\n\t\t\t\t}),\n\t\t\t)\n\t\t} catch {\n\t\t\t// best-effort observability — never fail the request because the audit write failed\n\t\t}\n\t}\n\n\tprivate async revoke(\n\t\tdbContext: DatabaseContext,\n\t\tapiKeyRow: ApiKeyRow,\n\t\trow: IdpSessionRow,\n\t\treason: string,\n\t\trequestInfo?: ApiKeyRequestInfo,\n\t): Promise<void> {\n\t\tawait dbContext.commandBus.execute(new DisableApiKeyCommand(apiKeyRow.id))\n\t\tawait dbContext.commandBus.execute(\n\t\t\tnew CreateAuthLogEntryCommand({\n\t\t\t\ttype: 'idp_session_revoked',\n\t\t\t\tinvokedById: apiKeyRow.identity_id,\n\t\t\t\tpersonId: apiKeyRow.person_id ?? undefined,\n\t\t\t\tidentityProviderId: row.identityProviderId,\n\t\t\t\tpersonTokenId: apiKeyRow.id,\n\t\t\t\tsuccess: false,\n\t\t\t\terrorCode: reason,\n\t\t\t\tipAddress: requestInfo?.ip,\n\t\t\t\tuserAgent: requestInfo?.userAgent,\n\t\t\t\t// the action payload belongs in `event_data` (where every other audit event puts\n\t\t\t\t// it and where the admin UI / AuthLogQueryResolver reads it); `metadata` is for\n\t\t\t\t// transport context (forwarder IP/UA).\n\t\t\t\teventData: { reason },\n\t\t\t}),\n\t\t)\n\t}\n\n\tprivate resolveConfig(configuration: Record<string, unknown>): ResolvedRevalidationConfig {\n\t\tconst raw = (configuration.revalidation ?? {}) as Record<string, unknown>\n\t\tconst threshold = typeof raw.softRefreshThreshold === 'number' && raw.softRefreshThreshold > 0 && raw.softRefreshThreshold <= 1\n\t\t\t? raw.softRefreshThreshold\n\t\t\t: REVALIDATION_DEFAULT_SOFT_THRESHOLD\n\t\treturn {\n\t\t\tenabled: raw.enabled === true,\n\t\t\tsoftThreshold: threshold,\n\t\t\tminInterval: typeof raw.minInterval === 'string' ? raw.minInterval : REVALIDATION_DEFAULT_MIN_INTERVAL,\n\t\t\tfallbackInterval: typeof raw.fallbackInterval === 'string' ? raw.fallbackInterval : REVALIDATION_DEFAULT_FALLBACK_INTERVAL,\n\t\t\tmode: raw.mode === 'blocking' ? 'blocking' : 'auto',\n\t\t}\n\t}\n}\n"],"names":["IdpSessionByApiKeyQuery","ClaimIdpRevalidationCommand","UpdateIdpSessionCommand","parseClaimMapping","CreateAuthLogEntryCommand","DisableApiKeyCommand","REVALIDATION_DEFAULT_SOFT_THRESHOLD","REVALIDATION_DEFAULT_MIN_INTERVAL","REVALIDATION_DEFAULT_FALLBACK_INTERVAL"],"mappings":";;;;;;;;;;;;AA4CO,MAAM,sBAAsB;AAAA,EAClC,YACkB,aACA,kBAChB;AAFgB,SAAA,cAAA;AACA,SAAA,mBAAA;AAAA,EAElB;AAAA,EAEA,MAAM,WACL,WACA,eACA,WACA,aAC+B;AAC/B,UAAM,MAAM,MAAM,cAAc,aAAa,MAAM,IAAIA,wBAAAA,wBAAwB,UAAU,IAAI,cAAc,SAAS,CAAC;AACrH,QAAI,CAAC,KAAK;AAET,aAAO;AAAA,IACR;AAEA,UAAM,SAAS,KAAK,cAAc,IAAI,qBAAqB;AAC3D,QAAI,CAAC,OAAO,SAAS;AACpB,aAAO;AAAA,IACR;AAGA,QAAI,IAAI,oBAAoB;AAC3B,YAAM,KAAK,OAAO,WAAW,WAAW,KAAK,gBAAgB,WAAW;AACxE,aAAO;AAAA,IACR;AAEA,UAAM,UAAU,KAAK,YAAY,iBAAiB,IAAI,YAAY;AAClE,QAAI,CAAC,SAAS,YAAY;AAEzB,aAAO;AAAA,IACR;AAEA,UAAM,WAAW,KAAK,OAAO,KAAK,QAAQ,UAAU,UAAU,KAAK;AACnE,QAAI,CAAC,UAAU;AAEd,aAAO;AAAA,IACR;AAGA,QAAI;AACJ,QAAI;AACH,gBAAU,MAAM,UAAU,WAAW,QAAQ,IAAIC,wDAA4B,IAAI,IAAI,SAAS,aAAa,CAAC;AAAA,IAC7G,QAAQ;AAEP,aAAO;AAAA,IACR;AACA,QAAI,CAAC,SAAS;AACb,aAAO;AAAA,IACR;AAEA,QAAI,SAAS,UAAU;AACtB,aAAO,MAAM,KAAK,gBAAgB,WAAW,SAAS,KAAK,WAAW,WAAW;AAAA,IAClF;AAOA,iBAAa,MAAM;AAClB,WAAK,gBAAgB,WAAW,SAAS,KAAK,WAAW,WAAW,EAAE,MAAM,MAAM;AAAA,MAAC,CAAC;AAAA,IACrF,CAAC;AACD,WAAO;AAAA,EACR;AAAA;AAAA;AAAA;AAAA;AAAA,EAMQ,OAAO,KAAoB,QAAoC,KAAqB;AAC3F,UAAM,YAAY,IAAI,QAAQ;AAC9B,UAAM,aAAa,IAAI;AAGvB,QAAI,CAAC,aAAa,CAAC,YAAY;AAC9B,aAAO,EAAE,UAAU,OAAO,SAAS,YAAY,eAAe,OAAO,iBAAA;AAAA,IACtE;AAEA,UAAM,aAAa,UAAU,QAAA,IAAY,WAAW,QAAA;AACpD,UAAM,WAAW,WAAW,QAAA,IAAY,aAAa,OAAO;AAC5D,UAAM,QAAQ,IAAI,QAAA;AAElB,QAAI,QAAQ,UAAU;AACrB,aAAO;AAAA,IACR;AAEA,UAAM,UAAU,SAAS,UAAU,QAAA;AACnC,WAAO,EAAE,UAAU,OAAO,SAAS,cAAc,SAAS,eAAe,OAAO,YAAA;AAAA,EACjF;AAAA,EAEA,MAAc,gBACb,WACA,SACA,KACA,WACA,aAC+B;AAC/B,QAAI;AACJ,QAAI;AACH,eAAS,QAAQ,sBAAsB,IAAI,qBAAqB;AAAA,IACjE,QAAQ;AAIP,YAAM,KAAK,sBAAsB,WAAW,WAAW,KAAK,kBAAkB,WAAW;AACzF,aAAO;AAAA,IACR;AAEA,QAAI;AACJ,QAAI;AACH,eAAS,MAAM,QAAQ,WAAY,QAAQ,IAAI,OAAO;AAAA,IACvD,QAAQ;AAKP,YAAM,KAAK,sBAAsB,WAAW,WAAW,KAAK,sBAAsB,WAAW;AAC7F,aAAO;AAAA,IACR;AAEA,QAAI,OAAO,WAAW,WAAW;AAChC,YAAM,KAAK,OAAO,WAAW,WAAW,KAAK,OAAO,QAAQ,WAAW;AACvE,aAAO;AAAA,IACR;AAYA,QAAI,OAAO,YAAY;AACtB,UAAI;AACH,cAAM,UAAU,WAAW,QAAQ,IAAIC,wBAAAA,wBAAwB,IAAI,IAAI,OAAO,UAAU,CAAC;AACzF,cAAM,KAAK,eAAe,WAAW,WAAW,KAAK,WAAW;AAAA,MACjE,QAAQ;AAAA,MAER;AAAA,IACD;AAOA,QAAI,OAAO,QAAQ;AAClB,YAAM,KAAK,WAAW,WAAW,KAAK,WAAW,OAAO,QAAQ,OAAO,mBAAmB,MAAM,WAAW;AAAA,IAC5G;AACA,WAAO;AAAA,EACR;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,MAAc,WACb,WACA,KACA,WACA,QACA,gBACA,aACgB;AAChB,QAAI;AACH,YAAM,UAAUC,aAAAA,kBAAkB,IAAI,qBAAqB;AAC3D,UAAI,CAAC,SAAS;AACb;AAAA,MACD;AAQA,YAAM,EAAE,OAAO,uBAAuB,MAAM,UAAU;AAAA,QAAY,QACjE,KAAK,iBAAiB,KAAK,IAAI,SAAS,QAAQ,EAAE,IAAI,UAAU,eAAe,OAAO,EAAE,cAAc,gBAAgB;AAAA,MAAA;AAEvH,UAAI,OAAO;AACV,cAAM,KAAK,eAAe,WAAW,WAAW,KAAK,mBAAmB,OAAO,WAAW;AAAA,MAC3F;AAGA,UAAI,oBAAoB;AACvB,cAAM,KAAK,eAAe,WAAW,WAAW,KAAK,2BAA2B,QAAW,WAAW;AAAA,MACvG;AAAA,IACD,QAAQ;AAGP,YAAM,KAAK,eAAe,WAAW,WAAW,KAAK,2BAA2B,QAAW,WAAW;AAAA,IACvG;AAAA,EACD;AAAA,EAEA,MAAc,eACb,WACA,WACA,KACA,MACA,WACA,aACgB;AAChB,QAAI;AACH,YAAM,UAAU,WAAW;AAAA,QAC1B,IAAIC,oDAA0B;AAAA,UAC7B;AAAA,UACA,aAAa,UAAU;AAAA,UACvB,UAAU,UAAU,aAAa;AAAA;AAAA;AAAA;AAAA,UAIjC,gBAAgB,UAAU,aAAa;AAAA,UACvC,oBAAoB,IAAI;AAAA,UACxB,eAAe,UAAU;AAAA,UACzB,SAAS;AAAA,UACT;AAAA,UACA,WAAW,aAAa;AAAA,UACxB,WAAW,aAAa;AAAA,QAAA,CACxB;AAAA,MAAA;AAAA,IAEH,QAAQ;AAAA,IAER;AAAA,EACD;AAAA,EAEA,MAAc,eAAe,WAA4B,WAAsB,KAAoB,aAAgD;AAClJ,UAAM,UAAU,WAAW;AAAA,MAC1B,IAAIA,oDAA0B;AAAA,QAC7B,MAAM;AAAA,QACN,aAAa,UAAU;AAAA,QACvB,UAAU,UAAU,aAAa;AAAA,QACjC,oBAAoB,IAAI;AAAA,QACxB,eAAe,UAAU;AAAA,QACzB,SAAS;AAAA,QACT,WAAW,aAAa;AAAA,QACxB,WAAW,aAAa;AAAA,MAAA,CACxB;AAAA,IAAA;AAAA,EAEH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAc,sBACb,WACA,WACA,KACA,WACA,aACgB;AAChB,QAAI;AACH,YAAM,UAAU,WAAW;AAAA,QAC1B,IAAIA,oDAA0B;AAAA,UAC7B,MAAM;AAAA,UACN,aAAa,UAAU;AAAA,UACvB,UAAU,UAAU,aAAa;AAAA,UACjC,oBAAoB,IAAI;AAAA,UACxB,eAAe,UAAU;AAAA;AAAA;AAAA,UAGzB,SAAS;AAAA,UACT;AAAA,UACA,WAAW,aAAa;AAAA,UACxB,WAAW,aAAa;AAAA,QAAA,CACxB;AAAA,MAAA;AAAA,IAEH,QAAQ;AAAA,IAER;AAAA,EACD;AAAA,EAEA,MAAc,OACb,WACA,WACA,KACA,QACA,aACgB;AAChB,UAAM,UAAU,WAAW,QAAQ,IAAIC,qBAAAA,qBAAqB,UAAU,EAAE,CAAC;AACzE,UAAM,UAAU,WAAW;AAAA,MAC1B,IAAID,oDAA0B;AAAA,QAC7B,MAAM;AAAA,QACN,aAAa,UAAU;AAAA,QACvB,UAAU,UAAU,aAAa;AAAA,QACjC,oBAAoB,IAAI;AAAA,QACxB,eAAe,UAAU;AAAA,QACzB,SAAS;AAAA,QACT,WAAW;AAAA,QACX,WAAW,aAAa;AAAA,QACxB,WAAW,aAAa;AAAA;AAAA;AAAA;AAAA,QAIxB,WAAW,EAAE,OAAA;AAAA,MAAO,CACpB;AAAA,IAAA;AAAA,EAEH;AAAA,EAEQ,cAAc,eAAoE;AACzF,UAAM,MAAO,cAAc,gBAAgB,CAAA;AAC3C,UAAM,YAAY,OAAO,IAAI,yBAAyB,YAAY,IAAI,uBAAuB,KAAK,IAAI,wBAAwB,IAC3H,IAAI,uBACJE,gBAAAA;AACH,WAAO;AAAA,MACN,SAAS,IAAI,YAAY;AAAA,MACzB,eAAe;AAAA,MACf,aAAa,OAAO,IAAI,gBAAgB,WAAW,IAAI,cAAcC,gBAAAA;AAAAA,MACrE,kBAAkB,OAAO,IAAI,qBAAqB,WAAW,IAAI,mBAAmBC,gBAAAA;AAAAA,MACpF,MAAM,IAAI,SAAS,aAAa,aAAa;AAAA,IAAA;AAAA,EAE/C;AACD;;"}

package/dist/development/src/model/service/idp/IdpSessionRevalidator.js

@@ -7,9 +7,11 @@ import "node:crypto";
 import { DisableApiKeyCommand } from "../../commands/apiKey/DisableApiKeyCommand.js";
 import { CreateAuthLogEntryCommand } from "../../commands/authLog/CreateAuthLogEntryCommand.js";
 import { REVALIDATION_DEFAULT_SOFT_THRESHOLD, REVALIDATION_DEFAULT_FALLBACK_INTERVAL, REVALIDATION_DEFAULT_MIN_INTERVAL } from "./IDPRevalidation.js";
+import { parseClaimMapping } from "./ClaimMapping.js";
 class IdpSessionRevalidator {
-  constructor(idpRegistry) {
+  constructor(idpRegistry, claimSyncService) {
     this.idpRegistry = idpRegistry;
+    this.claimSyncService = claimSyncService;
   }
   async revalidate(dbContext, readDbContext, apiKeyRow, requestInfo) {
     const row = await readDbContext.queryHandler.fetch(new IdpSessionByApiKeyQuery(apiKeyRow.id, readDbContext.providers));
@@ -95,8 +97,60 @@ class IdpSessionRevalidator {
       } catch {
       }
     }
+    if (result.claims) {
+      await this.syncClaims(dbContext, row, apiKeyRow, result.claims, result.claimsComplete === true, requestInfo);
+    }
     return "valid";
   }
+  /**
+   * Re-apply the claim mapping on a successful refresh. Runs in its own transaction (atomic apply of
+   * the membership changes) and never throws: the IdP has already vouched for the session, so a
+   * malformed mapping or a transient apply error must not revoke or fail it. A real membership change
+   * is audited as `idp_role_mapped`; a failure is audited as `idp_role_mapping_failed` (fail-open
+   * marker), mirroring the sign-in path. `claimsComplete` carries whether the refresh rebuilt sign-in's
+   * full claim surface (so removal reconciliation is safe) — see `allowRemoval` below.
+   */
+  async syncClaims(dbContext, row, apiKeyRow, claims, claimsComplete, requestInfo) {
+    try {
+      const mapping = parseClaimMapping(row.providerConfiguration);
+      if (!mapping) {
+        return;
+      }
+      const { audit, droppedUnsafeRules } = await dbContext.transaction(
+        (db) => this.claimSyncService.sync(db, mapping, claims, { id: apiKeyRow.identity_id }, false, { allowRemoval: claimsComplete })
+      );
+      if (audit) {
+        await this.logRoleMapping(dbContext, apiKeyRow, row, "idp_role_mapped", audit, requestInfo);
+      }
+      if (droppedUnsafeRules) {
+        await this.logRoleMapping(dbContext, apiKeyRow, row, "idp_role_mapping_failed", void 0, requestInfo);
+      }
+    } catch {
+      await this.logRoleMapping(dbContext, apiKeyRow, row, "idp_role_mapping_failed", void 0, requestInfo);
+    }
+  }
+  async logRoleMapping(dbContext, apiKeyRow, row, type, eventData, requestInfo) {
+    try {
+      await dbContext.commandBus.execute(
+        new CreateAuthLogEntryCommand({
+          type,
+          invokedById: apiKeyRow.identity_id,
+          personId: apiKeyRow.person_id ?? void 0,
+          // The membership change affects this session's own person — record it as the target too,
+          // so an admin querying membership changes by target_person_id sees IdP-driven grants/revokes
+          // (consistent with the project_membership_* audit events).
+          targetPersonId: apiKeyRow.person_id ?? void 0,
+          identityProviderId: row.identityProviderId,
+          personTokenId: apiKeyRow.id,
+          success: true,
+          eventData,
+          ipAddress: requestInfo?.ip,
+          userAgent: requestInfo?.userAgent
+        })
+      );
+    } catch {
+    }
+  }
   async logRevalidated(dbContext, apiKeyRow, row, requestInfo) {
     await dbContext.commandBus.execute(
       new CreateAuthLogEntryCommand({

package/dist/development/src/model/service/idp/IdpSessionRevalidator.js.map

@@ -1 +1 @@
-{"version":3,"file":"IdpSessionRevalidator.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/service/idp/IdpSessionRevalidator.ts"],"sourcesContent":["import { DatabaseContext } from '../../utils/index.js'\nimport { ApiKeyRequestInfo } from '../../commands/index.js'\nimport { ApiKeyRow } from '../../queries/apiKey/ApiKeyQuery.js'\nimport { IdpSessionByApiKeyQuery, IdpSessionRow } from '../../queries/idp/IdpSessionByApiKeyQuery.js'\nimport { IDPHandlerRegistry } from './IDPHandlerRegistry.js'\nimport { ClaimIdpRevalidationCommand } from '../../commands/idp/ClaimIdpRevalidationCommand.js'\nimport { UpdateIdpSessionCommand } from '../../commands/idp/UpdateIdpSessionCommand.js'\nimport { DisableApiKeyCommand } from '../../commands/index.js'\nimport { CreateAuthLogEntryCommand } from '../../commands/authLog/CreateAuthLogEntryCommand.js'\nimport { REVALIDATION_DEFAULT_FALLBACK_INTERVAL, REVALIDATION_DEFAULT_MIN_INTERVAL, REVALIDATION_DEFAULT_SOFT_THRESHOLD } from './IDPRevalidation.js'\nimport { IdentityProviderHandler, RevalidationResult } from './IdentityProviderHandler.js'\n\nexport type RevalidationOutcome = 'valid' | 'revoked'\n\ntype ResolvedRevalidationConfig = {\n\tenabled: boolean\n\tsoftThreshold: number\n\tminInterval: string\n\tfallbackInterval: string\n\tmode: 'auto' | 'blocking'\n}\n\n/**\n * Decision for the current request: whether to attempt a revalidation, and if so whether it\n * must block the request. `claimInterval` is the single-flight floor for the atomic claim.\n */\ntype Decision = null | { blocking: boolean; claimInterval: string }\n\n/**\n * Re-validates IdP-backed sessions against their identity provider on the verify hot path\n * (A24). Invoked from `ApiKeyManager.verifyAndProlong`. Operates entirely through the supplied\n * database contexts and the command bus, so it does not depend on `ApiKeyManager` (no DI cycle).\n *\n * The cadence is driven by the **access-token lifetime**, not a fixed interval:\n *   - while the token is fresh (before `softRefreshThreshold` of its lifetime) → skip, free;\n *   - past the threshold but not yet expired → a proactive **background (SWR)** refresh, so the\n *     request keeps zero added latency and the token is renewed before it dies;\n *   - once the token has actually expired → a **blocking** refresh (we can't serve a dead token).\n * `mode: 'blocking'` forces every revalidation synchronous (zero revocation lag). When the IdP\n * returns no token expiry, falls back to a plain `fallbackInterval` background throttle.\n */\nexport class IdpSessionRevalidator {\n\tconstructor(\n\t\tprivate readonly idpRegistry: IDPHandlerRegistry,\n\t) {\n\t}\n\n\tasync revalidate(\n\t\tdbContext: DatabaseContext,\n\t\treadDbContext: DatabaseContext,\n\t\tapiKeyRow: ApiKeyRow,\n\t\trequestInfo?: ApiKeyRequestInfo,\n\t): Promise<RevalidationOutcome> {\n\t\tconst row = await readDbContext.queryHandler.fetch(new IdpSessionByApiKeyQuery(apiKeyRow.id, readDbContext.providers))\n\t\tif (!row) {\n\t\t\t// not a federated session (password / IdP without revalidation) — fast no-op\n\t\t\treturn 'valid'\n\t\t}\n\n\t\tconst config = this.resolveConfig(row.providerConfiguration)\n\t\tif (!config.enabled) {\n\t\t\treturn 'valid'\n\t\t}\n\n\t\t// A disabled IdP no longer vouches for its sessions.\n\t\tif (row.providerDisabledAt) {\n\t\t\tawait this.revoke(dbContext, apiKeyRow, row, 'idp_disabled', requestInfo)\n\t\t\treturn 'revoked'\n\t\t}\n\n\t\tconst handler = this.idpRegistry.getHandlerOrNull(row.providerType)\n\t\tif (!handler?.revalidate) {\n\t\t\t// provider can't actively re-validate (e.g. SAML) — rely on expiry / SLO\n\t\t\treturn 'valid'\n\t\t}\n\n\t\tconst decision = this.decide(row, config, dbContext.providers.now())\n\t\tif (!decision) {\n\t\t\t// token still fresh — vouched for, no IdP call\n\t\t\treturn 'valid'\n\t\t}\n\n\t\t// Atomic claim = single-flight. Loser (within the floor window, or lost the race) serves stale.\n\t\tlet claimed: boolean\n\t\ttry {\n\t\t\tclaimed = await dbContext.commandBus.execute(new ClaimIdpRevalidationCommand(row.id, decision.claimInterval))\n\t\t} catch {\n\t\t\t// invalid interval string or transient DB error — fail open, retry next request\n\t\t\treturn 'valid'\n\t\t}\n\t\tif (!claimed) {\n\t\t\treturn 'valid'\n\t\t}\n\n\t\tif (decision.blocking) {\n\t\t\treturn await this.runRevalidation(dbContext, handler, row, apiKeyRow, requestInfo)\n\t\t}\n\n\t\t// SWR: serve this request from the (still valid) token, refresh after the response.\n\t\t// The work runs detached (after the response is sent), so any rejection — a transient\n\t\t// DB error in the revoke / persist writes, a corrupt-config throw — must be swallowed\n\t\t// here; otherwise it becomes an unhandledRejection and can take the worker down. The\n\t\t// session is simply kept and re-tried on a later request (the claim floor throttles).\n\t\tsetImmediate(() => {\n\t\t\tthis.runRevalidation(dbContext, handler, row, apiKeyRow, requestInfo).catch(() => {})\n\t\t})\n\t\treturn 'valid'\n\t}\n\n\t/**\n\t * Decide whether (and how) to revalidate, purely from timestamps — no interval parsing in\n\t * JS (the claim handles intervals in SQL). Returns null to skip.\n\t */\n\tprivate decide(row: IdpSessionRow, config: ResolvedRevalidationConfig, now: Date): Decision {\n\t\tconst expiresAt = row.session.expiresAt\n\t\tconst obtainedAt = row.tokenObtainedAt\n\n\t\t// No lifetime info from the IdP → plain background throttle on fallbackInterval.\n\t\tif (!expiresAt || !obtainedAt) {\n\t\t\treturn { blocking: config.mode === 'blocking', claimInterval: config.fallbackInterval }\n\t\t}\n\n\t\tconst lifetimeMs = expiresAt.getTime() - obtainedAt.getTime()\n\t\tconst softAtMs = obtainedAt.getTime() + lifetimeMs * config.softThreshold\n\t\tconst nowMs = now.getTime()\n\n\t\tif (nowMs < softAtMs) {\n\t\t\treturn null // still within the trusted window\n\t\t}\n\n\t\tconst expired = nowMs >= expiresAt.getTime()\n\t\treturn { blocking: config.mode === 'blocking' || expired, claimInterval: config.minInterval }\n\t}\n\n\tprivate async runRevalidation(\n\t\tdbContext: DatabaseContext,\n\t\thandler: IdentityProviderHandler<{}>,\n\t\trow: IdpSessionRow,\n\t\tapiKeyRow: ApiKeyRow,\n\t\trequestInfo?: ApiKeyRequestInfo,\n\t): Promise<RevalidationOutcome> {\n\t\tlet config: {}\n\t\ttry {\n\t\t\tconfig = handler.validateConfiguration(row.providerConfiguration)\n\t\t} catch {\n\t\t\t// corrupt stored config — must NOT revoke; keep the session and retry later. Audit\n\t\t\t// it so the operator can tell \"vouched for\" apart from \"silently broken\" (without an\n\t\t\t// entry, a config typo disables re-validation invisibly for the life of every session).\n\t\t\tawait this.logRevalidationFailed(dbContext, apiKeyRow, row, 'config_invalid', requestInfo)\n\t\t\treturn 'valid'\n\t\t}\n\n\t\tlet result: RevalidationResult\n\t\ttry {\n\t\t\tresult = await handler.revalidate!(config, row.session)\n\t\t} catch {\n\t\t\t// transient failure (network / IdP down) — must NOT revoke; keep the session and retry\n\t\t\t// on a later request (the claim floor prevents hammering the IdP). Audited (throttled\n\t\t\t// to one entry per claim window) so a prolonged IdP outage is visible rather than a\n\t\t\t// silent fail-open.\n\t\t\tawait this.logRevalidationFailed(dbContext, apiKeyRow, row, 'revalidation_error', requestInfo)\n\t\t\treturn 'valid'\n\t\t}\n\n\t\tif (result.status === 'revoked') {\n\t\t\tawait this.revoke(dbContext, apiKeyRow, row, result.reason, requestInfo)\n\t\t\treturn 'revoked'\n\t\t}\n\n\t\t// Still valid — persist the rotated token (resets the lifetime reference) / refreshed\n\t\t// expiry. A rotation is a real, low-frequency event (token-lifetime cadence), so we\n\t\t// audit it as `idp_session_revalidated`; the no-op userinfo/introspection probes\n\t\t// (no rotated session) are intentionally NOT logged to keep the audit log usable.\n\t\t//\n\t\t// The IdP has already vouched for the session, so these post-success writes are pure\n\t\t// best-effort bookkeeping (they only reset the SWR cadence reference). A transient DB\n\t\t// error or an `encrypt()` throw here must NOT fail the request — otherwise a blocking\n\t\t// revalidation fails closed on a successful refresh, contradicting \"fail open\" (the SWR\n\t\t// path already swallows this). Keep the existing row; the claim floor throttles a retry.\n\t\tif (result.idpSession) {\n\t\t\ttry {\n\t\t\t\tawait dbContext.commandBus.execute(new UpdateIdpSessionCommand(row.id, result.idpSession))\n\t\t\t\tawait this.logRevalidated(dbContext, apiKeyRow, row, requestInfo)\n\t\t\t} catch {\n\t\t\t\t// fall through — session stays valid, persist retried on a later request\n\t\t\t}\n\t\t}\n\t\treturn 'valid'\n\t}\n\n\tprivate async logRevalidated(dbContext: DatabaseContext, apiKeyRow: ApiKeyRow, row: IdpSessionRow, requestInfo?: ApiKeyRequestInfo): Promise<void> {\n\t\tawait dbContext.commandBus.execute(\n\t\t\tnew CreateAuthLogEntryCommand({\n\t\t\t\ttype: 'idp_session_revalidated',\n\t\t\t\tinvokedById: apiKeyRow.identity_id,\n\t\t\t\tpersonId: apiKeyRow.person_id ?? undefined,\n\t\t\t\tidentityProviderId: row.identityProviderId,\n\t\t\t\tpersonTokenId: apiKeyRow.id,\n\t\t\t\tsuccess: true,\n\t\t\t\tipAddress: requestInfo?.ip,\n\t\t\t\tuserAgent: requestInfo?.userAgent,\n\t\t\t}),\n\t\t)\n\t}\n\n\t/**\n\t * Audit a fail-open: the IdP couldn't be consulted (transient outage) or the stored config is\n\t * corrupt, so we kept the session rather than revoking it. Naturally throttled to one entry\n\t * per claim window (we only reach here after a successful claim, which bumps\n\t * `last_validated_at`). The write is best-effort and self-contained — a failure to audit must\n\t * never propagate and fail a blocking verify request (the whole point of failing open).\n\t */\n\tprivate async logRevalidationFailed(\n\t\tdbContext: DatabaseContext,\n\t\tapiKeyRow: ApiKeyRow,\n\t\trow: IdpSessionRow,\n\t\terrorCode: 'config_invalid' | 'revalidation_error',\n\t\trequestInfo?: ApiKeyRequestInfo,\n\t): Promise<void> {\n\t\ttry {\n\t\t\tawait dbContext.commandBus.execute(\n\t\t\t\tnew CreateAuthLogEntryCommand({\n\t\t\t\t\ttype: 'idp_session_revalidation_failed',\n\t\t\t\t\tinvokedById: apiKeyRow.identity_id,\n\t\t\t\t\tpersonId: apiKeyRow.person_id ?? undefined,\n\t\t\t\t\tidentityProviderId: row.identityProviderId,\n\t\t\t\t\tpersonTokenId: apiKeyRow.id,\n\t\t\t\t\t// not a security failure (the session is kept) — a fail-open marker the operator\n\t\t\t\t\t// can alert on. `success: true` keeps it out of the failed-login funnels.\n\t\t\t\t\tsuccess: true,\n\t\t\t\t\terrorCode,\n\t\t\t\t\tipAddress: requestInfo?.ip,\n\t\t\t\t\tuserAgent: requestInfo?.userAgent,\n\t\t\t\t}),\n\t\t\t)\n\t\t} catch {\n\t\t\t// best-effort observability — never fail the request because the audit write failed\n\t\t}\n\t}\n\n\tprivate async revoke(\n\t\tdbContext: DatabaseContext,\n\t\tapiKeyRow: ApiKeyRow,\n\t\trow: IdpSessionRow,\n\t\treason: string,\n\t\trequestInfo?: ApiKeyRequestInfo,\n\t): Promise<void> {\n\t\tawait dbContext.commandBus.execute(new DisableApiKeyCommand(apiKeyRow.id))\n\t\tawait dbContext.commandBus.execute(\n\t\t\tnew CreateAuthLogEntryCommand({\n\t\t\t\ttype: 'idp_session_revoked',\n\t\t\t\tinvokedById: apiKeyRow.identity_id,\n\t\t\t\tpersonId: apiKeyRow.person_id ?? undefined,\n\t\t\t\tidentityProviderId: row.identityProviderId,\n\t\t\t\tpersonTokenId: apiKeyRow.id,\n\t\t\t\tsuccess: false,\n\t\t\t\terrorCode: reason,\n\t\t\t\tipAddress: requestInfo?.ip,\n\t\t\t\tuserAgent: requestInfo?.userAgent,\n\t\t\t\t// the action payload belongs in `event_data` (where every other audit event puts\n\t\t\t\t// it and where the admin UI / AuthLogQueryResolver reads it); `metadata` is for\n\t\t\t\t// transport context (forwarder IP/UA).\n\t\t\t\teventData: { reason },\n\t\t\t}),\n\t\t)\n\t}\n\n\tprivate resolveConfig(configuration: Record<string, unknown>): ResolvedRevalidationConfig {\n\t\tconst raw = (configuration.revalidation ?? {}) as Record<string, unknown>\n\t\tconst threshold = typeof raw.softRefreshThreshold === 'number' && raw.softRefreshThreshold > 0 && raw.softRefreshThreshold <= 1\n\t\t\t? raw.softRefreshThreshold\n\t\t\t: REVALIDATION_DEFAULT_SOFT_THRESHOLD\n\t\treturn {\n\t\t\tenabled: raw.enabled === true,\n\t\t\tsoftThreshold: threshold,\n\t\t\tminInterval: typeof raw.minInterval === 'string' ? raw.minInterval : REVALIDATION_DEFAULT_MIN_INTERVAL,\n\t\t\tfallbackInterval: typeof raw.fallbackInterval === 'string' ? raw.fallbackInterval : REVALIDATION_DEFAULT_FALLBACK_INTERVAL,\n\t\t\tmode: raw.mode === 'blocking' ? 'blocking' : 'auto',\n\t\t}\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;AAyCO,MAAM,sBAAsB;AAAA,EAClC,YACkB,aAChB;AADgB,SAAA,cAAA;AAAA,EAElB;AAAA,EAEA,MAAM,WACL,WACA,eACA,WACA,aAC+B;AAC/B,UAAM,MAAM,MAAM,cAAc,aAAa,MAAM,IAAI,wBAAwB,UAAU,IAAI,cAAc,SAAS,CAAC;AACrH,QAAI,CAAC,KAAK;AAET,aAAO;AAAA,IACR;AAEA,UAAM,SAAS,KAAK,cAAc,IAAI,qBAAqB;AAC3D,QAAI,CAAC,OAAO,SAAS;AACpB,aAAO;AAAA,IACR;AAGA,QAAI,IAAI,oBAAoB;AAC3B,YAAM,KAAK,OAAO,WAAW,WAAW,KAAK,gBAAgB,WAAW;AACxE,aAAO;AAAA,IACR;AAEA,UAAM,UAAU,KAAK,YAAY,iBAAiB,IAAI,YAAY;AAClE,QAAI,CAAC,SAAS,YAAY;AAEzB,aAAO;AAAA,IACR;AAEA,UAAM,WAAW,KAAK,OAAO,KAAK,QAAQ,UAAU,UAAU,KAAK;AACnE,QAAI,CAAC,UAAU;AAEd,aAAO;AAAA,IACR;AAGA,QAAI;AACJ,QAAI;AACH,gBAAU,MAAM,UAAU,WAAW,QAAQ,IAAI,4BAA4B,IAAI,IAAI,SAAS,aAAa,CAAC;AAAA,IAC7G,QAAQ;AAEP,aAAO;AAAA,IACR;AACA,QAAI,CAAC,SAAS;AACb,aAAO;AAAA,IACR;AAEA,QAAI,SAAS,UAAU;AACtB,aAAO,MAAM,KAAK,gBAAgB,WAAW,SAAS,KAAK,WAAW,WAAW;AAAA,IAClF;AAOA,iBAAa,MAAM;AAClB,WAAK,gBAAgB,WAAW,SAAS,KAAK,WAAW,WAAW,EAAE,MAAM,MAAM;AAAA,MAAC,CAAC;AAAA,IACrF,CAAC;AACD,WAAO;AAAA,EACR;AAAA;AAAA;AAAA;AAAA;AAAA,EAMQ,OAAO,KAAoB,QAAoC,KAAqB;AAC3F,UAAM,YAAY,IAAI,QAAQ;AAC9B,UAAM,aAAa,IAAI;AAGvB,QAAI,CAAC,aAAa,CAAC,YAAY;AAC9B,aAAO,EAAE,UAAU,OAAO,SAAS,YAAY,eAAe,OAAO,iBAAA;AAAA,IACtE;AAEA,UAAM,aAAa,UAAU,QAAA,IAAY,WAAW,QAAA;AACpD,UAAM,WAAW,WAAW,QAAA,IAAY,aAAa,OAAO;AAC5D,UAAM,QAAQ,IAAI,QAAA;AAElB,QAAI,QAAQ,UAAU;AACrB,aAAO;AAAA,IACR;AAEA,UAAM,UAAU,SAAS,UAAU,QAAA;AACnC,WAAO,EAAE,UAAU,OAAO,SAAS,cAAc,SAAS,eAAe,OAAO,YAAA;AAAA,EACjF;AAAA,EAEA,MAAc,gBACb,WACA,SACA,KACA,WACA,aAC+B;AAC/B,QAAI;AACJ,QAAI;AACH,eAAS,QAAQ,sBAAsB,IAAI,qBAAqB;AAAA,IACjE,QAAQ;AAIP,YAAM,KAAK,sBAAsB,WAAW,WAAW,KAAK,kBAAkB,WAAW;AACzF,aAAO;AAAA,IACR;AAEA,QAAI;AACJ,QAAI;AACH,eAAS,MAAM,QAAQ,WAAY,QAAQ,IAAI,OAAO;AAAA,IACvD,QAAQ;AAKP,YAAM,KAAK,sBAAsB,WAAW,WAAW,KAAK,sBAAsB,WAAW;AAC7F,aAAO;AAAA,IACR;AAEA,QAAI,OAAO,WAAW,WAAW;AAChC,YAAM,KAAK,OAAO,WAAW,WAAW,KAAK,OAAO,QAAQ,WAAW;AACvE,aAAO;AAAA,IACR;AAYA,QAAI,OAAO,YAAY;AACtB,UAAI;AACH,cAAM,UAAU,WAAW,QAAQ,IAAI,wBAAwB,IAAI,IAAI,OAAO,UAAU,CAAC;AACzF,cAAM,KAAK,eAAe,WAAW,WAAW,KAAK,WAAW;AAAA,MACjE,QAAQ;AAAA,MAER;AAAA,IACD;AACA,WAAO;AAAA,EACR;AAAA,EAEA,MAAc,eAAe,WAA4B,WAAsB,KAAoB,aAAgD;AAClJ,UAAM,UAAU,WAAW;AAAA,MAC1B,IAAI,0BAA0B;AAAA,QAC7B,MAAM;AAAA,QACN,aAAa,UAAU;AAAA,QACvB,UAAU,UAAU,aAAa;AAAA,QACjC,oBAAoB,IAAI;AAAA,QACxB,eAAe,UAAU;AAAA,QACzB,SAAS;AAAA,QACT,WAAW,aAAa;AAAA,QACxB,WAAW,aAAa;AAAA,MAAA,CACxB;AAAA,IAAA;AAAA,EAEH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAc,sBACb,WACA,WACA,KACA,WACA,aACgB;AAChB,QAAI;AACH,YAAM,UAAU,WAAW;AAAA,QAC1B,IAAI,0BAA0B;AAAA,UAC7B,MAAM;AAAA,UACN,aAAa,UAAU;AAAA,UACvB,UAAU,UAAU,aAAa;AAAA,UACjC,oBAAoB,IAAI;AAAA,UACxB,eAAe,UAAU;AAAA;AAAA;AAAA,UAGzB,SAAS;AAAA,UACT;AAAA,UACA,WAAW,aAAa;AAAA,UACxB,WAAW,aAAa;AAAA,QAAA,CACxB;AAAA,MAAA;AAAA,IAEH,QAAQ;AAAA,IAER;AAAA,EACD;AAAA,EAEA,MAAc,OACb,WACA,WACA,KACA,QACA,aACgB;AAChB,UAAM,UAAU,WAAW,QAAQ,IAAI,qBAAqB,UAAU,EAAE,CAAC;AACzE,UAAM,UAAU,WAAW;AAAA,MAC1B,IAAI,0BAA0B;AAAA,QAC7B,MAAM;AAAA,QACN,aAAa,UAAU;AAAA,QACvB,UAAU,UAAU,aAAa;AAAA,QACjC,oBAAoB,IAAI;AAAA,QACxB,eAAe,UAAU;AAAA,QACzB,SAAS;AAAA,QACT,WAAW;AAAA,QACX,WAAW,aAAa;AAAA,QACxB,WAAW,aAAa;AAAA;AAAA;AAAA;AAAA,QAIxB,WAAW,EAAE,OAAA;AAAA,MAAO,CACpB;AAAA,IAAA;AAAA,EAEH;AAAA,EAEQ,cAAc,eAAoE;AACzF,UAAM,MAAO,cAAc,gBAAgB,CAAA;AAC3C,UAAM,YAAY,OAAO,IAAI,yBAAyB,YAAY,IAAI,uBAAuB,KAAK,IAAI,wBAAwB,IAC3H,IAAI,uBACJ;AACH,WAAO;AAAA,MACN,SAAS,IAAI,YAAY;AAAA,MACzB,eAAe;AAAA,MACf,aAAa,OAAO,IAAI,gBAAgB,WAAW,IAAI,cAAc;AAAA,MACrE,kBAAkB,OAAO,IAAI,qBAAqB,WAAW,IAAI,mBAAmB;AAAA,MACpF,MAAM,IAAI,SAAS,aAAa,aAAa;AAAA,IAAA;AAAA,EAE/C;AACD;"}
+{"version":3,"file":"IdpSessionRevalidator.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/service/idp/IdpSessionRevalidator.ts"],"sourcesContent":["import { DatabaseContext } from '../../utils/index.js'\nimport { ApiKeyRequestInfo } from '../../commands/index.js'\nimport { ApiKeyRow } from '../../queries/apiKey/ApiKeyQuery.js'\nimport { IdpSessionByApiKeyQuery, IdpSessionRow } from '../../queries/idp/IdpSessionByApiKeyQuery.js'\nimport { IDPHandlerRegistry } from './IDPHandlerRegistry.js'\nimport { ClaimIdpRevalidationCommand } from '../../commands/idp/ClaimIdpRevalidationCommand.js'\nimport { UpdateIdpSessionCommand } from '../../commands/idp/UpdateIdpSessionCommand.js'\nimport { DisableApiKeyCommand } from '../../commands/index.js'\nimport { CreateAuthLogEntryCommand } from '../../commands/authLog/CreateAuthLogEntryCommand.js'\nimport { REVALIDATION_DEFAULT_FALLBACK_INTERVAL, REVALIDATION_DEFAULT_MIN_INTERVAL, REVALIDATION_DEFAULT_SOFT_THRESHOLD } from './IDPRevalidation.js'\nimport { IdentityProviderHandler, RevalidationResult } from './IdentityProviderHandler.js'\nimport { IDPClaimSyncService } from './IDPClaimSyncService.js'\nimport { parseClaimMapping } from './ClaimMapping.js'\nimport { JSONValue } from '@contember/schema'\n\nexport type RevalidationOutcome = 'valid' | 'revoked'\n\ntype ResolvedRevalidationConfig = {\n\tenabled: boolean\n\tsoftThreshold: number\n\tminInterval: string\n\tfallbackInterval: string\n\tmode: 'auto' | 'blocking'\n}\n\n/**\n * Decision for the current request: whether to attempt a revalidation, and if so whether it\n * must block the request. `claimInterval` is the single-flight floor for the atomic claim.\n */\ntype Decision = null | { blocking: boolean; claimInterval: string }\n\n/**\n * Re-validates IdP-backed sessions against their identity provider on the verify hot path\n * (A24). Invoked from `ApiKeyManager.verifyAndProlong`. Operates entirely through the supplied\n * database contexts and the command bus, so it does not depend on `ApiKeyManager` (no DI cycle).\n *\n * The cadence is driven by the **access-token lifetime**, not a fixed interval:\n *   - while the token is fresh (before `softRefreshThreshold` of its lifetime) → skip, free;\n *   - past the threshold but not yet expired → a proactive **background (SWR)** refresh, so the\n *     request keeps zero added latency and the token is renewed before it dies;\n *   - once the token has actually expired → a **blocking** refresh (we can't serve a dead token).\n * `mode: 'blocking'` forces every revalidation synchronous (zero revocation lag). When the IdP\n * returns no token expiry, falls back to a plain `fallbackInterval` background throttle.\n */\nexport class IdpSessionRevalidator {\n\tconstructor(\n\t\tprivate readonly idpRegistry: IDPHandlerRegistry,\n\t\tprivate readonly claimSyncService: IDPClaimSyncService,\n\t) {\n\t}\n\n\tasync revalidate(\n\t\tdbContext: DatabaseContext,\n\t\treadDbContext: DatabaseContext,\n\t\tapiKeyRow: ApiKeyRow,\n\t\trequestInfo?: ApiKeyRequestInfo,\n\t): Promise<RevalidationOutcome> {\n\t\tconst row = await readDbContext.queryHandler.fetch(new IdpSessionByApiKeyQuery(apiKeyRow.id, readDbContext.providers))\n\t\tif (!row) {\n\t\t\t// not a federated session (password / IdP without revalidation) — fast no-op\n\t\t\treturn 'valid'\n\t\t}\n\n\t\tconst config = this.resolveConfig(row.providerConfiguration)\n\t\tif (!config.enabled) {\n\t\t\treturn 'valid'\n\t\t}\n\n\t\t// A disabled IdP no longer vouches for its sessions.\n\t\tif (row.providerDisabledAt) {\n\t\t\tawait this.revoke(dbContext, apiKeyRow, row, 'idp_disabled', requestInfo)\n\t\t\treturn 'revoked'\n\t\t}\n\n\t\tconst handler = this.idpRegistry.getHandlerOrNull(row.providerType)\n\t\tif (!handler?.revalidate) {\n\t\t\t// provider can't actively re-validate (e.g. SAML) — rely on expiry / SLO\n\t\t\treturn 'valid'\n\t\t}\n\n\t\tconst decision = this.decide(row, config, dbContext.providers.now())\n\t\tif (!decision) {\n\t\t\t// token still fresh — vouched for, no IdP call\n\t\t\treturn 'valid'\n\t\t}\n\n\t\t// Atomic claim = single-flight. Loser (within the floor window, or lost the race) serves stale.\n\t\tlet claimed: boolean\n\t\ttry {\n\t\t\tclaimed = await dbContext.commandBus.execute(new ClaimIdpRevalidationCommand(row.id, decision.claimInterval))\n\t\t} catch {\n\t\t\t// invalid interval string or transient DB error — fail open, retry next request\n\t\t\treturn 'valid'\n\t\t}\n\t\tif (!claimed) {\n\t\t\treturn 'valid'\n\t\t}\n\n\t\tif (decision.blocking) {\n\t\t\treturn await this.runRevalidation(dbContext, handler, row, apiKeyRow, requestInfo)\n\t\t}\n\n\t\t// SWR: serve this request from the (still valid) token, refresh after the response.\n\t\t// The work runs detached (after the response is sent), so any rejection — a transient\n\t\t// DB error in the revoke / persist writes, a corrupt-config throw — must be swallowed\n\t\t// here; otherwise it becomes an unhandledRejection and can take the worker down. The\n\t\t// session is simply kept and re-tried on a later request (the claim floor throttles).\n\t\tsetImmediate(() => {\n\t\t\tthis.runRevalidation(dbContext, handler, row, apiKeyRow, requestInfo).catch(() => {})\n\t\t})\n\t\treturn 'valid'\n\t}\n\n\t/**\n\t * Decide whether (and how) to revalidate, purely from timestamps — no interval parsing in\n\t * JS (the claim handles intervals in SQL). Returns null to skip.\n\t */\n\tprivate decide(row: IdpSessionRow, config: ResolvedRevalidationConfig, now: Date): Decision {\n\t\tconst expiresAt = row.session.expiresAt\n\t\tconst obtainedAt = row.tokenObtainedAt\n\n\t\t// No lifetime info from the IdP → plain background throttle on fallbackInterval.\n\t\tif (!expiresAt || !obtainedAt) {\n\t\t\treturn { blocking: config.mode === 'blocking', claimInterval: config.fallbackInterval }\n\t\t}\n\n\t\tconst lifetimeMs = expiresAt.getTime() - obtainedAt.getTime()\n\t\tconst softAtMs = obtainedAt.getTime() + lifetimeMs * config.softThreshold\n\t\tconst nowMs = now.getTime()\n\n\t\tif (nowMs < softAtMs) {\n\t\t\treturn null // still within the trusted window\n\t\t}\n\n\t\tconst expired = nowMs >= expiresAt.getTime()\n\t\treturn { blocking: config.mode === 'blocking' || expired, claimInterval: config.minInterval }\n\t}\n\n\tprivate async runRevalidation(\n\t\tdbContext: DatabaseContext,\n\t\thandler: IdentityProviderHandler<{}>,\n\t\trow: IdpSessionRow,\n\t\tapiKeyRow: ApiKeyRow,\n\t\trequestInfo?: ApiKeyRequestInfo,\n\t): Promise<RevalidationOutcome> {\n\t\tlet config: {}\n\t\ttry {\n\t\t\tconfig = handler.validateConfiguration(row.providerConfiguration)\n\t\t} catch {\n\t\t\t// corrupt stored config — must NOT revoke; keep the session and retry later. Audit\n\t\t\t// it so the operator can tell \"vouched for\" apart from \"silently broken\" (without an\n\t\t\t// entry, a config typo disables re-validation invisibly for the life of every session).\n\t\t\tawait this.logRevalidationFailed(dbContext, apiKeyRow, row, 'config_invalid', requestInfo)\n\t\t\treturn 'valid'\n\t\t}\n\n\t\tlet result: RevalidationResult\n\t\ttry {\n\t\t\tresult = await handler.revalidate!(config, row.session)\n\t\t} catch {\n\t\t\t// transient failure (network / IdP down) — must NOT revoke; keep the session and retry\n\t\t\t// on a later request (the claim floor prevents hammering the IdP). Audited (throttled\n\t\t\t// to one entry per claim window) so a prolonged IdP outage is visible rather than a\n\t\t\t// silent fail-open.\n\t\t\tawait this.logRevalidationFailed(dbContext, apiKeyRow, row, 'revalidation_error', requestInfo)\n\t\t\treturn 'valid'\n\t\t}\n\n\t\tif (result.status === 'revoked') {\n\t\t\tawait this.revoke(dbContext, apiKeyRow, row, result.reason, requestInfo)\n\t\t\treturn 'revoked'\n\t\t}\n\n\t\t// Still valid — persist the rotated token (resets the lifetime reference) / refreshed\n\t\t// expiry. A rotation is a real, low-frequency event (token-lifetime cadence), so we\n\t\t// audit it as `idp_session_revalidated`; the no-op userinfo/introspection probes\n\t\t// (no rotated session) are intentionally NOT logged to keep the audit log usable.\n\t\t//\n\t\t// The IdP has already vouched for the session, so these post-success writes are pure\n\t\t// best-effort bookkeeping (they only reset the SWR cadence reference). A transient DB\n\t\t// error or an `encrypt()` throw here must NOT fail the request — otherwise a blocking\n\t\t// revalidation fails closed on a successful refresh, contradicting \"fail open\" (the SWR\n\t\t// path already swallows this). Keep the existing row; the claim floor throttles a retry.\n\t\tif (result.idpSession) {\n\t\t\ttry {\n\t\t\t\tawait dbContext.commandBus.execute(new UpdateIdpSessionCommand(row.id, result.idpSession))\n\t\t\t\tawait this.logRevalidated(dbContext, apiKeyRow, row, requestInfo)\n\t\t\t} catch {\n\t\t\t\t// fall through — session stays valid, persist retried on a later request\n\t\t\t}\n\t\t}\n\n\t\t// A09 — re-apply the IdP's claim mapping when the refresh returned fresh claims, so an `always`\n\t\t// mapping keeps an established session's project memberships in sync with the IdP's current claims\n\t\t// without requiring a full re-login. `sticky` mappings self-skip (the sync passes isNewPerson=false).\n\t\t// `claimsComplete` tells the sync whether the refresh rebuilt sign-in's full claim surface, so it can\n\t\t// reconcile (incl. `unmatched: \"remove\"`) exactly like sign-in. Strictly fail-open — see `syncClaims`.\n\t\tif (result.claims) {\n\t\t\tawait this.syncClaims(dbContext, row, apiKeyRow, result.claims, result.claimsComplete === true, requestInfo)\n\t\t}\n\t\treturn 'valid'\n\t}\n\n\t/**\n\t * Re-apply the claim mapping on a successful refresh. Runs in its own transaction (atomic apply of\n\t * the membership changes) and never throws: the IdP has already vouched for the session, so a\n\t * malformed mapping or a transient apply error must not revoke or fail it. A real membership change\n\t * is audited as `idp_role_mapped`; a failure is audited as `idp_role_mapping_failed` (fail-open\n\t * marker), mirroring the sign-in path. `claimsComplete` carries whether the refresh rebuilt sign-in's\n\t * full claim surface (so removal reconciliation is safe) — see `allowRemoval` below.\n\t */\n\tprivate async syncClaims(\n\t\tdbContext: DatabaseContext,\n\t\trow: IdpSessionRow,\n\t\tapiKeyRow: ApiKeyRow,\n\t\tclaims: Record<string, unknown>,\n\t\tclaimsComplete: boolean,\n\t\trequestInfo?: ApiKeyRequestInfo,\n\t): Promise<void> {\n\t\ttry {\n\t\t\tconst mapping = parseClaimMapping(row.providerConfiguration)\n\t\t\tif (!mapping) {\n\t\t\t\treturn\n\t\t\t}\n\t\t\t// Atomic apply in its own transaction (the verify path has no surrounding one). `always`-only:\n\t\t\t// the sync passes isNewPerson=false, so a `sticky` mapping self-skips and returns a null audit.\n\t\t\t// Refresh mirrors sign-in as closely as the claim surface allows: when the provider returned its\n\t\t\t// COMPLETE surface (`claimsComplete` — `method: \"refresh\"` rebuilding sign-in's id-token + userinfo\n\t\t\t// merge), `unmatched: \"remove\"` reconciliation runs here too. A partial surface (a userinfo-only\n\t\t\t// probe, or a refresh whose userinfo fetch failed) passes `allowRemoval: false`, so refresh stays\n\t\t\t// additive-only and a membership the IdP still asserts is never stripped off an incomplete surface.\n\t\t\tconst { audit, droppedUnsafeRules } = await dbContext.transaction(db =>\n\t\t\t\tthis.claimSyncService.sync(db, mapping, claims, { id: apiKeyRow.identity_id }, false, { allowRemoval: claimsComplete })\n\t\t\t)\n\t\t\tif (audit) {\n\t\t\t\tawait this.logRoleMapping(dbContext, apiKeyRow, row, 'idp_role_mapped', audit, requestInfo)\n\t\t\t}\n\t\t\t// The apply-time safety backstop dropped a configured rule — emit the fail-open marker so a broken\n\t\t\t// mapping is visible on the refresh path too, mirroring sign-in (the marker carries no claim values).\n\t\t\tif (droppedUnsafeRules) {\n\t\t\t\tawait this.logRoleMapping(dbContext, apiKeyRow, row, 'idp_role_mapping_failed', undefined, requestInfo)\n\t\t\t}\n\t\t} catch {\n\t\t\t// Strictly fail-open: a malformed mapping or a transient apply error must never revoke or\n\t\t\t// fail an already-vouched-for session. The transaction rolls back any partial apply.\n\t\t\tawait this.logRoleMapping(dbContext, apiKeyRow, row, 'idp_role_mapping_failed', undefined, requestInfo)\n\t\t}\n\t}\n\n\tprivate async logRoleMapping(\n\t\tdbContext: DatabaseContext,\n\t\tapiKeyRow: ApiKeyRow,\n\t\trow: IdpSessionRow,\n\t\ttype: 'idp_role_mapped' | 'idp_role_mapping_failed',\n\t\teventData: JSONValue | undefined,\n\t\trequestInfo?: ApiKeyRequestInfo,\n\t): Promise<void> {\n\t\ttry {\n\t\t\tawait dbContext.commandBus.execute(\n\t\t\t\tnew CreateAuthLogEntryCommand({\n\t\t\t\t\ttype,\n\t\t\t\t\tinvokedById: apiKeyRow.identity_id,\n\t\t\t\t\tpersonId: apiKeyRow.person_id ?? undefined,\n\t\t\t\t\t// The membership change affects this session's own person — record it as the target too,\n\t\t\t\t\t// so an admin querying membership changes by target_person_id sees IdP-driven grants/revokes\n\t\t\t\t\t// (consistent with the project_membership_* audit events).\n\t\t\t\t\ttargetPersonId: apiKeyRow.person_id ?? undefined,\n\t\t\t\t\tidentityProviderId: row.identityProviderId,\n\t\t\t\t\tpersonTokenId: apiKeyRow.id,\n\t\t\t\t\tsuccess: true,\n\t\t\t\t\teventData,\n\t\t\t\t\tipAddress: requestInfo?.ip,\n\t\t\t\t\tuserAgent: requestInfo?.userAgent,\n\t\t\t\t}),\n\t\t\t)\n\t\t} catch {\n\t\t\t// best-effort audit — never fail the request because the audit write failed\n\t\t}\n\t}\n\n\tprivate async logRevalidated(dbContext: DatabaseContext, apiKeyRow: ApiKeyRow, row: IdpSessionRow, requestInfo?: ApiKeyRequestInfo): Promise<void> {\n\t\tawait dbContext.commandBus.execute(\n\t\t\tnew CreateAuthLogEntryCommand({\n\t\t\t\ttype: 'idp_session_revalidated',\n\t\t\t\tinvokedById: apiKeyRow.identity_id,\n\t\t\t\tpersonId: apiKeyRow.person_id ?? undefined,\n\t\t\t\tidentityProviderId: row.identityProviderId,\n\t\t\t\tpersonTokenId: apiKeyRow.id,\n\t\t\t\tsuccess: true,\n\t\t\t\tipAddress: requestInfo?.ip,\n\t\t\t\tuserAgent: requestInfo?.userAgent,\n\t\t\t}),\n\t\t)\n\t}\n\n\t/**\n\t * Audit a fail-open: the IdP couldn't be consulted (transient outage) or the stored config is\n\t * corrupt, so we kept the session rather than revoking it. Naturally throttled to one entry\n\t * per claim window (we only reach here after a successful claim, which bumps\n\t * `last_validated_at`). The write is best-effort and self-contained — a failure to audit must\n\t * never propagate and fail a blocking verify request (the whole point of failing open).\n\t */\n\tprivate async logRevalidationFailed(\n\t\tdbContext: DatabaseContext,\n\t\tapiKeyRow: ApiKeyRow,\n\t\trow: IdpSessionRow,\n\t\terrorCode: 'config_invalid' | 'revalidation_error',\n\t\trequestInfo?: ApiKeyRequestInfo,\n\t): Promise<void> {\n\t\ttry {\n\t\t\tawait dbContext.commandBus.execute(\n\t\t\t\tnew CreateAuthLogEntryCommand({\n\t\t\t\t\ttype: 'idp_session_revalidation_failed',\n\t\t\t\t\tinvokedById: apiKeyRow.identity_id,\n\t\t\t\t\tpersonId: apiKeyRow.person_id ?? undefined,\n\t\t\t\t\tidentityProviderId: row.identityProviderId,\n\t\t\t\t\tpersonTokenId: apiKeyRow.id,\n\t\t\t\t\t// not a security failure (the session is kept) — a fail-open marker the operator\n\t\t\t\t\t// can alert on. `success: true` keeps it out of the failed-login funnels.\n\t\t\t\t\tsuccess: true,\n\t\t\t\t\terrorCode,\n\t\t\t\t\tipAddress: requestInfo?.ip,\n\t\t\t\t\tuserAgent: requestInfo?.userAgent,\n\t\t\t\t}),\n\t\t\t)\n\t\t} catch {\n\t\t\t// best-effort observability — never fail the request because the audit write failed\n\t\t}\n\t}\n\n\tprivate async revoke(\n\t\tdbContext: DatabaseContext,\n\t\tapiKeyRow: ApiKeyRow,\n\t\trow: IdpSessionRow,\n\t\treason: string,\n\t\trequestInfo?: ApiKeyRequestInfo,\n\t): Promise<void> {\n\t\tawait dbContext.commandBus.execute(new DisableApiKeyCommand(apiKeyRow.id))\n\t\tawait dbContext.commandBus.execute(\n\t\t\tnew CreateAuthLogEntryCommand({\n\t\t\t\ttype: 'idp_session_revoked',\n\t\t\t\tinvokedById: apiKeyRow.identity_id,\n\t\t\t\tpersonId: apiKeyRow.person_id ?? undefined,\n\t\t\t\tidentityProviderId: row.identityProviderId,\n\t\t\t\tpersonTokenId: apiKeyRow.id,\n\t\t\t\tsuccess: false,\n\t\t\t\terrorCode: reason,\n\t\t\t\tipAddress: requestInfo?.ip,\n\t\t\t\tuserAgent: requestInfo?.userAgent,\n\t\t\t\t// the action payload belongs in `event_data` (where every other audit event puts\n\t\t\t\t// it and where the admin UI / AuthLogQueryResolver reads it); `metadata` is for\n\t\t\t\t// transport context (forwarder IP/UA).\n\t\t\t\teventData: { reason },\n\t\t\t}),\n\t\t)\n\t}\n\n\tprivate resolveConfig(configuration: Record<string, unknown>): ResolvedRevalidationConfig {\n\t\tconst raw = (configuration.revalidation ?? {}) as Record<string, unknown>\n\t\tconst threshold = typeof raw.softRefreshThreshold === 'number' && raw.softRefreshThreshold > 0 && raw.softRefreshThreshold <= 1\n\t\t\t? raw.softRefreshThreshold\n\t\t\t: REVALIDATION_DEFAULT_SOFT_THRESHOLD\n\t\treturn {\n\t\t\tenabled: raw.enabled === true,\n\t\t\tsoftThreshold: threshold,\n\t\t\tminInterval: typeof raw.minInterval === 'string' ? raw.minInterval : REVALIDATION_DEFAULT_MIN_INTERVAL,\n\t\t\tfallbackInterval: typeof raw.fallbackInterval === 'string' ? raw.fallbackInterval : REVALIDATION_DEFAULT_FALLBACK_INTERVAL,\n\t\t\tmode: raw.mode === 'blocking' ? 'blocking' : 'auto',\n\t\t}\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;AA4CO,MAAM,sBAAsB;AAAA,EAClC,YACkB,aACA,kBAChB;AAFgB,SAAA,cAAA;AACA,SAAA,mBAAA;AAAA,EAElB;AAAA,EAEA,MAAM,WACL,WACA,eACA,WACA,aAC+B;AAC/B,UAAM,MAAM,MAAM,cAAc,aAAa,MAAM,IAAI,wBAAwB,UAAU,IAAI,cAAc,SAAS,CAAC;AACrH,QAAI,CAAC,KAAK;AAET,aAAO;AAAA,IACR;AAEA,UAAM,SAAS,KAAK,cAAc,IAAI,qBAAqB;AAC3D,QAAI,CAAC,OAAO,SAAS;AACpB,aAAO;AAAA,IACR;AAGA,QAAI,IAAI,oBAAoB;AAC3B,YAAM,KAAK,OAAO,WAAW,WAAW,KAAK,gBAAgB,WAAW;AACxE,aAAO;AAAA,IACR;AAEA,UAAM,UAAU,KAAK,YAAY,iBAAiB,IAAI,YAAY;AAClE,QAAI,CAAC,SAAS,YAAY;AAEzB,aAAO;AAAA,IACR;AAEA,UAAM,WAAW,KAAK,OAAO,KAAK,QAAQ,UAAU,UAAU,KAAK;AACnE,QAAI,CAAC,UAAU;AAEd,aAAO;AAAA,IACR;AAGA,QAAI;AACJ,QAAI;AACH,gBAAU,MAAM,UAAU,WAAW,QAAQ,IAAI,4BAA4B,IAAI,IAAI,SAAS,aAAa,CAAC;AAAA,IAC7G,QAAQ;AAEP,aAAO;AAAA,IACR;AACA,QAAI,CAAC,SAAS;AACb,aAAO;AAAA,IACR;AAEA,QAAI,SAAS,UAAU;AACtB,aAAO,MAAM,KAAK,gBAAgB,WAAW,SAAS,KAAK,WAAW,WAAW;AAAA,IAClF;AAOA,iBAAa,MAAM;AAClB,WAAK,gBAAgB,WAAW,SAAS,KAAK,WAAW,WAAW,EAAE,MAAM,MAAM;AAAA,MAAC,CAAC;AAAA,IACrF,CAAC;AACD,WAAO;AAAA,EACR;AAAA;AAAA;AAAA;AAAA;AAAA,EAMQ,OAAO,KAAoB,QAAoC,KAAqB;AAC3F,UAAM,YAAY,IAAI,QAAQ;AAC9B,UAAM,aAAa,IAAI;AAGvB,QAAI,CAAC,aAAa,CAAC,YAAY;AAC9B,aAAO,EAAE,UAAU,OAAO,SAAS,YAAY,eAAe,OAAO,iBAAA;AAAA,IACtE;AAEA,UAAM,aAAa,UAAU,QAAA,IAAY,WAAW,QAAA;AACpD,UAAM,WAAW,WAAW,QAAA,IAAY,aAAa,OAAO;AAC5D,UAAM,QAAQ,IAAI,QAAA;AAElB,QAAI,QAAQ,UAAU;AACrB,aAAO;AAAA,IACR;AAEA,UAAM,UAAU,SAAS,UAAU,QAAA;AACnC,WAAO,EAAE,UAAU,OAAO,SAAS,cAAc,SAAS,eAAe,OAAO,YAAA;AAAA,EACjF;AAAA,EAEA,MAAc,gBACb,WACA,SACA,KACA,WACA,aAC+B;AAC/B,QAAI;AACJ,QAAI;AACH,eAAS,QAAQ,sBAAsB,IAAI,qBAAqB;AAAA,IACjE,QAAQ;AAIP,YAAM,KAAK,sBAAsB,WAAW,WAAW,KAAK,kBAAkB,WAAW;AACzF,aAAO;AAAA,IACR;AAEA,QAAI;AACJ,QAAI;AACH,eAAS,MAAM,QAAQ,WAAY,QAAQ,IAAI,OAAO;AAAA,IACvD,QAAQ;AAKP,YAAM,KAAK,sBAAsB,WAAW,WAAW,KAAK,sBAAsB,WAAW;AAC7F,aAAO;AAAA,IACR;AAEA,QAAI,OAAO,WAAW,WAAW;AAChC,YAAM,KAAK,OAAO,WAAW,WAAW,KAAK,OAAO,QAAQ,WAAW;AACvE,aAAO;AAAA,IACR;AAYA,QAAI,OAAO,YAAY;AACtB,UAAI;AACH,cAAM,UAAU,WAAW,QAAQ,IAAI,wBAAwB,IAAI,IAAI,OAAO,UAAU,CAAC;AACzF,cAAM,KAAK,eAAe,WAAW,WAAW,KAAK,WAAW;AAAA,MACjE,QAAQ;AAAA,MAER;AAAA,IACD;AAOA,QAAI,OAAO,QAAQ;AAClB,YAAM,KAAK,WAAW,WAAW,KAAK,WAAW,OAAO,QAAQ,OAAO,mBAAmB,MAAM,WAAW;AAAA,IAC5G;AACA,WAAO;AAAA,EACR;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,MAAc,WACb,WACA,KACA,WACA,QACA,gBACA,aACgB;AAChB,QAAI;AACH,YAAM,UAAU,kBAAkB,IAAI,qBAAqB;AAC3D,UAAI,CAAC,SAAS;AACb;AAAA,MACD;AAQA,YAAM,EAAE,OAAO,uBAAuB,MAAM,UAAU;AAAA,QAAY,QACjE,KAAK,iBAAiB,KAAK,IAAI,SAAS,QAAQ,EAAE,IAAI,UAAU,eAAe,OAAO,EAAE,cAAc,gBAAgB;AAAA,MAAA;AAEvH,UAAI,OAAO;AACV,cAAM,KAAK,eAAe,WAAW,WAAW,KAAK,mBAAmB,OAAO,WAAW;AAAA,MAC3F;AAGA,UAAI,oBAAoB;AACvB,cAAM,KAAK,eAAe,WAAW,WAAW,KAAK,2BAA2B,QAAW,WAAW;AAAA,MACvG;AAAA,IACD,QAAQ;AAGP,YAAM,KAAK,eAAe,WAAW,WAAW,KAAK,2BAA2B,QAAW,WAAW;AAAA,IACvG;AAAA,EACD;AAAA,EAEA,MAAc,eACb,WACA,WACA,KACA,MACA,WACA,aACgB;AAChB,QAAI;AACH,YAAM,UAAU,WAAW;AAAA,QAC1B,IAAI,0BAA0B;AAAA,UAC7B;AAAA,UACA,aAAa,UAAU;AAAA,UACvB,UAAU,UAAU,aAAa;AAAA;AAAA;AAAA;AAAA,UAIjC,gBAAgB,UAAU,aAAa;AAAA,UACvC,oBAAoB,IAAI;AAAA,UACxB,eAAe,UAAU;AAAA,UACzB,SAAS;AAAA,UACT;AAAA,UACA,WAAW,aAAa;AAAA,UACxB,WAAW,aAAa;AAAA,QAAA,CACxB;AAAA,MAAA;AAAA,IAEH,QAAQ;AAAA,IAER;AAAA,EACD;AAAA,EAEA,MAAc,eAAe,WAA4B,WAAsB,KAAoB,aAAgD;AAClJ,UAAM,UAAU,WAAW;AAAA,MAC1B,IAAI,0BAA0B;AAAA,QAC7B,MAAM;AAAA,QACN,aAAa,UAAU;AAAA,QACvB,UAAU,UAAU,aAAa;AAAA,QACjC,oBAAoB,IAAI;AAAA,QACxB,eAAe,UAAU;AAAA,QACzB,SAAS;AAAA,QACT,WAAW,aAAa;AAAA,QACxB,WAAW,aAAa;AAAA,MAAA,CACxB;AAAA,IAAA;AAAA,EAEH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAc,sBACb,WACA,WACA,KACA,WACA,aACgB;AAChB,QAAI;AACH,YAAM,UAAU,WAAW;AAAA,QAC1B,IAAI,0BAA0B;AAAA,UAC7B,MAAM;AAAA,UACN,aAAa,UAAU;AAAA,UACvB,UAAU,UAAU,aAAa;AAAA,UACjC,oBAAoB,IAAI;AAAA,UACxB,eAAe,UAAU;AAAA;AAAA;AAAA,UAGzB,SAAS;AAAA,UACT;AAAA,UACA,WAAW,aAAa;AAAA,UACxB,WAAW,aAAa;AAAA,QAAA,CACxB;AAAA,MAAA;AAAA,IAEH,QAAQ;AAAA,IAER;AAAA,EACD;AAAA,EAEA,MAAc,OACb,WACA,WACA,KACA,QACA,aACgB;AAChB,UAAM,UAAU,WAAW,QAAQ,IAAI,qBAAqB,UAAU,EAAE,CAAC;AACzE,UAAM,UAAU,WAAW;AAAA,MAC1B,IAAI,0BAA0B;AAAA,QAC7B,MAAM;AAAA,QACN,aAAa,UAAU;AAAA,QACvB,UAAU,UAAU,aAAa;AAAA,QACjC,oBAAoB,IAAI;AAAA,QACxB,eAAe,UAAU;AAAA,QACzB,SAAS;AAAA,QACT,WAAW;AAAA,QACX,WAAW,aAAa;AAAA,QACxB,WAAW,aAAa;AAAA;AAAA;AAAA;AAAA,QAIxB,WAAW,EAAE,OAAA;AAAA,MAAO,CACpB;AAAA,IAAA;AAAA,EAEH;AAAA,EAEQ,cAAc,eAAoE;AACzF,UAAM,MAAO,cAAc,gBAAgB,CAAA;AAC3C,UAAM,YAAY,OAAO,IAAI,yBAAyB,YAAY,IAAI,uBAAuB,KAAK,IAAI,wBAAwB,IAC3H,IAAI,uBACJ;AACH,WAAO;AAAA,MACN,SAAS,IAAI,YAAY;AAAA,MACzB,eAAe;AAAA,MACf,aAAa,OAAO,IAAI,gBAAgB,WAAW,IAAI,cAAc;AAAA,MACrE,kBAAkB,OAAO,IAAI,qBAAqB,WAAW,IAAI,mBAAmB;AAAA,MACpF,MAAM,IAAI,SAAS,aAAa,aAAa;AAAA,IAAA;AAAA,EAE/C;AACD;"}

package/dist/development/src/model/service/idp/providers/OIDCHelpers.cjs

@@ -33,9 +33,56 @@ const initOIDCAuth = async (client, { redirectUrl, scope, responseMode }) => {
   };
 };
 const getClaim = (source, path) => path.split(".").reduce(
-  (acc, key) => acc != null && typeof acc === "object" ? acc[key] : void 0,
+  (acc, key) => acc != null && typeof acc === "object" && Object.prototype.hasOwnProperty.call(acc, key) ? acc[key] : void 0,
   source
 );
+const liftNestedClaims = (source, attributesKey) => {
+  if (!attributesKey) {
+    return source;
+  }
+  const nested = Object.prototype.hasOwnProperty.call(source, attributesKey) ? source[attributesKey] : void 0;
+  if (nested !== null && typeof nested === "object" && !Array.isArray(nested)) {
+    return { ...nested, ...source };
+  }
+  return source;
+};
+const normalizeClaims = (rawSource, claimMapping, subFallback) => {
+  const source = liftNestedClaims(rawSource, claimMapping?.attributesKey);
+  const rawEmailVerified = source.email_verified;
+  const emailVerified = rawEmailVerified === true || rawEmailVerified === "true";
+  const mappedSubject = getClaim(source, claimMapping?.externalIdentifier ?? "sub");
+  let externalIdentifier;
+  if (mappedSubject === void 0 || mappedSubject === null) {
+    externalIdentifier = subFallback ?? "";
+  } else if (typeof mappedSubject === "string" || typeof mappedSubject === "number") {
+    externalIdentifier = String(mappedSubject);
+  } else {
+    throw new IDPValidationError.IDPValidationError(`The mapped externalIdentifier claim is not a scalar value`);
+  }
+  if (externalIdentifier === "") {
+    throw new IDPValidationError.IDPValidationError(`The mapped externalIdentifier claim resolved to an empty value`);
+  }
+  const email = getClaim(source, claimMapping?.email ?? "email");
+  const name = resolveName(source, claimMapping);
+  return {
+    ...source,
+    externalIdentifier,
+    email: typeof email === "string" ? email : void 0,
+    name,
+    emailVerified
+  };
+};
+const resolveName = (source, claimMapping) => {
+  const mapped = getClaim(source, claimMapping?.name ?? "name");
+  if (typeof mapped === "string" && mapped.trim() !== "") {
+    return mapped;
+  }
+  if (claimMapping?.name !== void 0) {
+    return void 0;
+  }
+  const parts = [getClaim(source, "given_name"), getClaim(source, "family_name")].filter((part) => typeof part === "string" && part.trim() !== "").map((part) => part.trim());
+  return parts.length > 0 ? parts.join(" ") : void 0;
+};
 const handleOIDCResponse = async (client, { sessionData, redirectUrl, ...otherData }, { fetchUserInfo, returnOIDCResult, captureSession, claimMapping } = {}) => {
   const params = "parameters" in otherData ? otherData.parameters : client.callbackParams(otherData.url);
   if (params.state && !sessionData?.state) {
@@ -48,37 +95,10 @@ const handleOIDCResponse = async (client, { sessionData, redirectUrl, ...otherDa
     const userInfo = result.access_token && fetchUserInfo ? await client.userinfo(result) : {};
     const oidcResult = returnOIDCResult ? result : {};
     const idpSession = captureSession ? tokenSetToSessionState(result, typeof claims.sid === "string" ? claims.sid : void 0) : void 0;
-    let source = { ...claimsWithoutHashes, ...userInfo };
-    const attributesKey = claimMapping?.attributesKey;
-    if (attributesKey) {
-      const nested = source[attributesKey];
-      if (nested && typeof nested === "object" && !Array.isArray(nested)) {
-        source = { ...nested, ...source };
-      }
-    }
-    const rawEmailVerified = source.email_verified;
-    const emailVerified = rawEmailVerified === true || rawEmailVerified === "true";
-    const mappedSubject = getClaim(source, claimMapping?.externalIdentifier ?? "sub");
-    let externalIdentifier;
-    if (mappedSubject === void 0 || mappedSubject === null) {
-      externalIdentifier = claims.sub;
-    } else if (typeof mappedSubject === "string" || typeof mappedSubject === "number") {
-      externalIdentifier = String(mappedSubject);
-    } else {
-      throw new IDPValidationError.IDPValidationError(`The mapped externalIdentifier claim is not a scalar value`);
-    }
-    if (externalIdentifier === "") {
-      throw new IDPValidationError.IDPValidationError(`The mapped externalIdentifier claim resolved to an empty value`);
-    }
-    const email = getClaim(source, claimMapping?.email ?? "email");
-    const name = getClaim(source, claimMapping?.name ?? "name");
+    const normalized = normalizeClaims({ ...claimsWithoutHashes, ...userInfo }, claimMapping, claims.sub);
     return {
       ...oidcResult,
-      ...source,
-      externalIdentifier,
-      email: typeof email === "string" ? email : void 0,
-      name: typeof name === "string" ? name : void 0,
-      emailVerified,
+      ...normalized,
       ...idpSession ? { idpSession } : {}
     };
   } catch (e) {
@@ -96,7 +116,8 @@ const handleOIDCResponse = async (client, { sessionData, redirectUrl, ...otherDa
   }
 };
 const REVOKED_OIDC_ERRORS = /* @__PURE__ */ new Set(["invalid_grant", "invalid_token", "expired_token"]);
-const revalidateOIDC = async (client, method, session) => {
+const revalidateOIDC = async (client, method, session, options = {}) => {
+  const { claimMapping, fetchUserInfo } = options;
   const tokens = session.tokens ?? {};
   const refreshToken = typeof tokens.refresh_token === "string" ? tokens.refresh_token : void 0;
   const accessToken = typeof tokens.access_token === "string" ? tokens.access_token : void 0;
@@ -107,14 +128,22 @@ const revalidateOIDC = async (client, method, session) => {
       }
       const tokenSet = await client.refresh(refreshToken);
       let claims;
+      let claimsComplete = false;
       try {
-        claims = tokenSet.id_token ? tokenSet.claims() : void 0;
+        if (tokenSet.id_token) {
+          const idClaims = tokenSet.claims();
+          const userInfo = tokenSet.access_token && fetchUserInfo ? await client.userinfo(tokenSet) : {};
+          claims = normalizeClaims({ ...idClaims, ...userInfo }, claimMapping, typeof idClaims.sub === "string" ? idClaims.sub : void 0);
+          claimsComplete = true;
+        }
       } catch {
         claims = void 0;
+        claimsComplete = false;
       }
       return {
         status: "valid",
         claims,
+        claimsComplete,
         // carry the stored tokens forward: a non-rotating IdP omits the refresh token here
         idpSession: tokenSetToSessionState(tokenSet, session.sessionId, tokens)
       };
@@ -124,7 +153,13 @@ const revalidateOIDC = async (client, method, session) => {
         return { status: "revoked", reason: "no_access_token" };
       }
       const userInfo = await client.userinfo(accessToken);
-      return { status: "valid", claims: userInfo };
+      let claims;
+      try {
+        claims = normalizeClaims(userInfo, claimMapping, typeof userInfo.sub === "string" ? userInfo.sub : void 0);
+      } catch {
+        claims = void 0;
+      }
+      return { status: "valid", claims, claimsComplete: false };
     }
     const token = accessToken ?? refreshToken;
     if (!token) {
@@ -215,6 +250,7 @@ const validateOIDCLogoutToken = async (client, issuer, logoutToken) => {
 exports.buildOIDCLogoutUrl = buildOIDCLogoutUrl;
 exports.handleOIDCResponse = handleOIDCResponse;
 exports.initOIDCAuth = initOIDCAuth;
+exports.liftNestedClaims = liftNestedClaims;
 exports.revalidateOIDC = revalidateOIDC;
 exports.tokenSetToSessionState = tokenSetToSessionState;
 exports.validateOIDCLogoutToken = validateOIDCLogoutToken;

package/dist/development/src/model/service/idp/providers/OIDCHelpers.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"OIDCHelpers.cjs","sources":["../../../../../../../../packages/engine-tenant-api/src/model/service/idp/providers/OIDCHelpers.ts"],"sourcesContent":["import { Client, custom, errors, generators, Issuer, TokenSet } from 'openid-client'\nimport { createRemoteJWKSet, jwtVerify } from 'jose'\nimport { OIDCClaimMapping, OIDCResponseData } from './OIDCTypes.js'\nimport { IDPValidationError } from '../IDPValidationError.js'\nimport { IDPResponseError } from '../IDPResponseError.js'\nimport {\n\tIDPResponse,\n\tIDPSessionState,\n\tInitIDPAuthResult,\n\tLogoutTokenClaims,\n\tLogoutUrlRequest,\n\tRevalidationResult,\n} from '../IdentityProviderHandler.js'\n\n/**\n * Build the persisted session state from an OIDC token set. Stores the tokens needed for\n * later re-validation (refresh/access) and SLO (id_token); the whole `tokens` blob is\n * encrypted at rest by the command layer.\n *\n * `prevTokens` carries the previously stored tokens forward: a refresh-grant response MAY omit\n * the refresh token (RFC 6749 §6 — IdPs that don't rotate just don't re-send it), in which case\n * the client must keep using the old one. Without this fallback a non-rotating IdP would persist\n * a session with no refresh token and be revoked (`no_refresh_token`) on the very next tick.\n */\nexport const tokenSetToSessionState = (tokenSet: TokenSet, sessionId?: string, prevTokens?: Record<string, unknown>): IDPSessionState => {\n\tconst refreshToken = tokenSet.refresh_token ?? (typeof prevTokens?.refresh_token === 'string' ? prevTokens.refresh_token : undefined)\n\tconst idToken = tokenSet.id_token ?? (typeof prevTokens?.id_token === 'string' ? prevTokens.id_token : undefined)\n\treturn {\n\t\tsessionId,\n\t\ttokens: {\n\t\t\t...(refreshToken ? { refresh_token: refreshToken } : {}),\n\t\t\t...(tokenSet.access_token ? { access_token: tokenSet.access_token } : {}),\n\t\t\t...(idToken ? { id_token: idToken } : {}),\n\t\t},\n\t\texpiresAt: tokenSet.expires_at ? new Date(tokenSet.expires_at * 1000) : undefined,\n\t}\n}\n\nexport const initOIDCAuth = async (\n\tclient: Client,\n\t{ redirectUrl, scope, responseMode }: { redirectUrl: string; scope?: string; responseMode?: string },\n): Promise<InitIDPAuthResult> => {\n\tconst nonce = generators.nonce()\n\tconst state = generators.state()\n\tconst url = client.authorizationUrl({\n\t\tredirect_uri: redirectUrl,\n\t\tresponse_mode: responseMode,\n\t\tscope: scope ?? 'openid email',\n\t\tnonce,\n\t\tstate,\n\t})\n\n\treturn {\n\t\tauthUrl: url,\n\t\tsessionData: { nonce, state },\n\t}\n}\n\nexport type HandleOIDCResponseOptions = {\n\tfetchUserInfo?: boolean\n\treturnOIDCResult?: boolean\n\tcaptureSession?: boolean\n\tclaimMapping?: OIDCClaimMapping\n}\n\n/** Read a claim by name, supporting dot-paths into nested objects (`a.b.c`). */\nconst getClaim = (source: Record<string, unknown>, path: string): unknown =>\n\tpath.split('.').reduce<unknown>(\n\t\t(acc, key) => (acc != null && typeof acc === 'object' ? (acc as Record<string, unknown>)[key] : undefined),\n\t\tsource,\n\t)\n\nexport const handleOIDCResponse = async (\n\tclient: Client,\n\t{ sessionData, redirectUrl, ...otherData }: OIDCResponseData,\n\t{ fetchUserInfo, returnOIDCResult, captureSession, claimMapping }: HandleOIDCResponseOptions = {},\n): Promise<IDPResponse> => {\n\tconst params = 'parameters' in otherData ? otherData.parameters : client.callbackParams(otherData.url)\n\tif (params.state && !sessionData?.state) {\n\t\tthrow new IDPValidationError(`state is present in parameters, but missing in session data`)\n\t}\n\ttry {\n\t\tconst result = await client.callback(redirectUrl, params, sessionData)\n\t\tconst claims = result.claims()\n\t\tconst { at_hash, c_hash, nonce, ...claimsWithoutHashes } = claims\n\t\tconst userInfo = result.access_token && fetchUserInfo ? await client.userinfo(result) : {}\n\t\tconst oidcResult = returnOIDCResult ? result : {}\n\t\tconst idpSession = captureSession ? tokenSetToSessionState(result, typeof claims.sid === 'string' ? claims.sid : undefined) : undefined\n\n\t\t// Merge ID-token claims with userInfo (userInfo wins, per spec). Then optionally lift a\n\t\t// nested attributes object to the top level so providers that nest their claims (notably\n\t\t// Apereo CAS userinfo, which returns them under `attributes`) map without a code change.\n\t\t// The nested attributes are UNSIGNED, so they must not override a claim already present in\n\t\t// the (signature-verified) ID-token / userInfo merge — spread them UNDER `source`, not over\n\t\t// it, so a signed `sub` / `email_verified` keeps precedence over an attributes-level value.\n\t\tlet source: Record<string, unknown> = { ...claimsWithoutHashes, ...userInfo }\n\t\tconst attributesKey = claimMapping?.attributesKey\n\t\tif (attributesKey) {\n\t\t\tconst nested = source[attributesKey]\n\t\t\tif (nested && typeof nested === 'object' && !Array.isArray(nested)) {\n\t\t\t\tsource = { ...(nested as Record<string, unknown>), ...source }\n\t\t\t}\n\t\t}\n\n\t\t// The OIDC `email_verified` claim is a boolean per spec, but some providers send the\n\t\t// string \"true\". userInfo (and any unwrapped attributes) take precedence over the ID token.\n\t\tconst rawEmailVerified = source.email_verified\n\t\tconst emailVerified = rawEmailVerified === true || rawEmailVerified === 'true'\n\n\t\t// `externalIdentifier` is the federation key persisted in `person_identity_provider` and\n\t\t// matched on the next sign-in, so it must be a stable scalar. A `claimMapping` that pointed\n\t\t// it at an object/array would otherwise be coerced by `String(...)` to `'[object Object]'` /\n\t\t// a comma-join — collapsing every user of the provider onto one key (account takeover). Fail\n\t\t// closed instead. The default `sub` path is safe (openid-client guarantees `sub` is a string).\n\t\tconst mappedSubject = getClaim(source, claimMapping?.externalIdentifier ?? 'sub')\n\t\tlet externalIdentifier: string\n\t\tif (mappedSubject === undefined || mappedSubject === null) {\n\t\t\texternalIdentifier = claims.sub\n\t\t} else if (typeof mappedSubject === 'string' || typeof mappedSubject === 'number') {\n\t\t\texternalIdentifier = String(mappedSubject)\n\t\t} else {\n\t\t\tthrow new IDPValidationError(`The mapped externalIdentifier claim is not a scalar value`)\n\t\t}\n\t\tif (externalIdentifier === '') {\n\t\t\tthrow new IDPValidationError(`The mapped externalIdentifier claim resolved to an empty value`)\n\t\t}\n\n\t\t// `email` / `name` are typed `string | undefined` on IDPResponse and feed the by-e-mail\n\t\t// account lookup (which crashes on a non-string). `...source` already placed the raw claim\n\t\t// of whatever type, so OVERWRITE (don't conditionally add) with the mapped value when it is\n\t\t// a string, otherwise `undefined` — a non-string claim must not leak through `...source`.\n\t\tconst email = getClaim(source, claimMapping?.email ?? 'email')\n\t\tconst name = getClaim(source, claimMapping?.name ?? 'name')\n\n\t\treturn {\n\t\t\t...oidcResult,\n\t\t\t...source,\n\t\t\texternalIdentifier,\n\t\t\temail: typeof email === 'string' ? email : undefined,\n\t\t\tname: typeof name === 'string' ? name : undefined,\n\t\t\temailVerified,\n\t\t\t...(idpSession ? { idpSession } : {}),\n\t\t}\n\t} catch (e: any) {\n\t\tif (e instanceof errors.RPError) {\n\t\t\tthrow new IDPValidationError(e.message)\n\t\t}\n\t\tif (e instanceof errors.OPError) {\n\t\t\tconst body = e.response?.body as any\n\t\t\tif (typeof body === 'object' && typeof body?.error === 'object' && typeof body.error?.message === 'string') {\n\t\t\t\tthrow new IDPResponseError(body.error.message)\n\t\t\t}\n\t\t\tthrow new IDPResponseError(e.message)\n\t\t}\n\t\tthrow e\n\t}\n}\n\n/** OIDC errors that definitively mean \"this session is no longer valid at the IdP\". */\nconst REVOKED_OIDC_ERRORS = new Set(['invalid_grant', 'invalid_token', 'expired_token'])\n\n/**\n * Re-validate a stored OIDC session against the IdP. Returns `revoked` only for definitive\n * IdP responses (invalid/expired grant or inactive introspection). Transient failures\n * (network, IdP down) re-throw so the caller can fail-open and keep the session — IdP\n * downtime must not log everyone out.\n */\nexport const revalidateOIDC = async (\n\tclient: Client,\n\tmethod: 'refresh' | 'userinfo' | 'introspection',\n\tsession: IDPSessionState,\n): Promise<RevalidationResult> => {\n\tconst tokens = session.tokens ?? {}\n\tconst refreshToken = typeof tokens.refresh_token === 'string' ? tokens.refresh_token : undefined\n\tconst accessToken = typeof tokens.access_token === 'string' ? tokens.access_token : undefined\n\ttry {\n\t\tif (method === 'refresh') {\n\t\t\tif (!refreshToken) {\n\t\t\t\treturn { status: 'revoked', reason: 'no_refresh_token' }\n\t\t\t}\n\t\t\tconst tokenSet = await client.refresh(refreshToken)\n\t\t\tlet claims: Record<string, unknown> | undefined\n\t\t\ttry {\n\t\t\t\tclaims = tokenSet.id_token ? tokenSet.claims() : undefined\n\t\t\t} catch {\n\t\t\t\tclaims = undefined\n\t\t\t}\n\t\t\treturn {\n\t\t\t\tstatus: 'valid',\n\t\t\t\tclaims,\n\t\t\t\t// carry the stored tokens forward: a non-rotating IdP omits the refresh token here\n\t\t\t\tidpSession: tokenSetToSessionState(tokenSet, session.sessionId, tokens),\n\t\t\t}\n\t\t}\n\t\tif (method === 'userinfo') {\n\t\t\tif (!accessToken) {\n\t\t\t\treturn { status: 'revoked', reason: 'no_access_token' }\n\t\t\t}\n\t\t\tconst userInfo = await client.userinfo(accessToken)\n\t\t\treturn { status: 'valid', claims: userInfo }\n\t\t}\n\t\t// introspection\n\t\tconst token = accessToken ?? refreshToken\n\t\tif (!token) {\n\t\t\treturn { status: 'revoked', reason: 'no_token' }\n\t\t}\n\t\tconst result = await client.introspect(token, accessToken ? 'access_token' : 'refresh_token')\n\t\tif (!result.active) {\n\t\t\treturn { status: 'revoked', reason: 'inactive' }\n\t\t}\n\t\treturn { status: 'valid' }\n\t} catch (e: any) {\n\t\tif (e instanceof errors.OPError) {\n\t\t\tif (typeof e.error === 'string' && REVOKED_OIDC_ERRORS.has(e.error)) {\n\t\t\t\treturn { status: 'revoked', reason: e.error }\n\t\t\t}\n\t\t\t// The userinfo endpoint signals a rejected access token with a bare HTTP 401 — per\n\t\t\t// RFC 6750 the `WWW-Authenticate` error code is optional, so openid-client may not\n\t\t\t// surface a parseable `error` here. A 401 is still definitive: the token is no\n\t\t\t// longer accepted → revoked. (Introspection is NOT treated this way: it returns 200\n\t\t\t// `{active:false}` for revoked tokens, so a 401/400 there means client-auth/config\n\t\t\t// failure — transient, must not log users out.)\n\t\t\tif (method === 'userinfo' && e.response?.statusCode === 401) {\n\t\t\t\treturn { status: 'revoked', reason: 'userinfo_unauthorized' }\n\t\t\t}\n\t\t}\n\t\t// transient (network / IdP unavailable) — propagate, do not revoke\n\t\tthrow e\n\t}\n}\n\n/**\n * Build an RP-initiated (front-channel) logout URL (OIDC RP-Initiated Logout 1.0). Returns null\n * when the IdP advertises no `end_session_endpoint` — the caller then degrades to a local-only\n * logout (legacy-IdP graceful fallback). The `id_token_hint` lets the IdP identify and confirm the\n * session to terminate; `post_logout_redirect_uri` is where the IdP returns the browser afterwards.\n */\nexport const buildOIDCLogoutUrl = (client: Client, { idToken, postLogoutRedirectUri }: LogoutUrlRequest): string | null => {\n\tif (!client.issuer.metadata.end_session_endpoint) {\n\t\treturn null\n\t}\n\treturn client.endSessionUrl({\n\t\t...(idToken ? { id_token_hint: idToken } : {}),\n\t\t...(postLogoutRedirectUri ? { post_logout_redirect_uri: postLogoutRedirectUri } : {}),\n\t})\n}\n\n/**\n * The OIDC Back-Channel Logout 1.0 event member that MUST be present in a logout token's `events`\n * claim. Its presence (and the absence of a `nonce`) is what distinguishes a logout token from an\n * ID token — both are signed by the same IdP, so without this check an ID token could be replayed\n * to forcibly log a user out.\n */\nconst BACKCHANNEL_LOGOUT_EVENT = 'http://schemas.openid.net/event/backchannel-logout'\n\n/**\n * Max accepted age of a back-channel logout token, derived from its `iat`. OIDC Back-Channel Logout\n * tokens are single-use and short-lived; bounding the age (together with requiring `exp`) limits the\n * window in which a captured token could be replayed to force a logout.\n */\nconst LOGOUT_TOKEN_MAX_AGE_SECONDS = 120\nconst LOGOUT_TOKEN_CLOCK_TOLERANCE_SECONDS = 5\n\n/**\n * Remote JWKS sets keyed by `jwks_uri`. `createRemoteJWKSet` returns a function with its own internal\n * key cache + fetch cooldown, so it MUST be reused across requests — re-creating it per call (as the\n * unauthenticated back-channel endpoint would otherwise do) defeats the cache and turns every request\n * into a potential outbound JWKS fetch. Keyed by URL, so two providers sharing an IdP share the set.\n */\nconst remoteJwksCache = new Map<string, ReturnType<typeof createRemoteJWKSet>>()\n\nconst getRemoteJwks = (jwksUri: string): ReturnType<typeof createRemoteJWKSet> => {\n\tlet jwks = remoteJwksCache.get(jwksUri)\n\tif (!jwks) {\n\t\tjwks = createRemoteJWKSet(new URL(jwksUri))\n\t\tremoteJwksCache.set(jwksUri, jwks)\n\t}\n\treturn jwks\n}\n\n/**\n * Validate an OIDC back-channel logout token (OIDC Back-Channel Logout 1.0 §2.4–2.6) and extract\n * the targeted `sid` / `sub`. The token is a JWT signed by the IdP; we verify the signature against\n * the issuer's JWKS and enforce the issuer + audience (client_id) the same way ID tokens are\n * verified, pinning the signing algorithm to the provider's configured one, then assert the\n * back-channel-specific claims:\n *   - `iat` is present and recent and `exp` is present (§2.4 requires both) — bounds the replay window;\n *   - `events` contains the back-channel-logout member (it really is a logout token);\n *   - it carries a `sid` and/or `sub` (otherwise there is nothing to act on);\n *   - it does NOT carry a `nonce` (a `nonce` means it is an ID token being replayed).\n * Throws {@link IDPValidationError} on any failure so the caller can answer 400.\n */\nexport const validateOIDCLogoutToken = async (client: Client, issuer: Issuer<Client>, logoutToken: string): Promise<LogoutTokenClaims> => {\n\tconst jwksUri = issuer.metadata.jwks_uri\n\tif (!jwksUri) {\n\t\tthrow new IDPValidationError('IdP has no jwks_uri; cannot verify logout token')\n\t}\n\tconst clientId = client.metadata.client_id\n\tif (typeof clientId !== 'string' || clientId === '') {\n\t\t// The `aud` check is a core anti-token-substitution defence on this unauthenticated endpoint.\n\t\t// jose treats `audience: undefined` as \"skip the aud check entirely\", so a missing client_id\n\t\t// must fail closed (reject the token) rather than fall through and accept any audience.\n\t\tthrow new IDPValidationError('cannot verify logout token audience: client_id is missing')\n\t}\n\tconst expectedAlg = typeof client.metadata.id_token_signed_response_alg === 'string'\n\t\t? client.metadata.id_token_signed_response_alg\n\t\t: 'RS256'\n\tconst jwks = getRemoteJwks(jwksUri)\n\tlet payload: Record<string, unknown>\n\ttry {\n\t\tconst verified = await jwtVerify(logoutToken, jwks, {\n\t\t\tissuer: issuer.metadata.issuer,\n\t\t\taudience: clientId,\n\t\t\t// pin to the provider's configured signing alg so a JWKS containing a symmetric/none key\n\t\t\t// can never be selected (defence-in-depth on top of jose's own key-type check).\n\t\t\talgorithms: [expectedAlg],\n\t\t\t// §2.4: `iat` and `exp` are REQUIRED. `maxTokenAge` makes `iat` required + bounds freshness;\n\t\t\t// `requiredClaims` makes `exp` required (jose only checks `exp` when present).\n\t\t\tmaxTokenAge: LOGOUT_TOKEN_MAX_AGE_SECONDS,\n\t\t\trequiredClaims: ['exp'],\n\t\t\tclockTolerance: LOGOUT_TOKEN_CLOCK_TOLERANCE_SECONDS,\n\t\t})\n\t\tpayload = verified.payload as Record<string, unknown>\n\t} catch (e: any) {\n\t\tthrow new IDPValidationError(`Invalid logout token: ${e?.message ?? 'verification failed'}`)\n\t}\n\n\t// A logout token MUST NOT contain a nonce; its presence means an ID token is being replayed.\n\tif ('nonce' in payload) {\n\t\tthrow new IDPValidationError('Logout token must not contain a nonce')\n\t}\n\n\tconst events = payload.events\n\tconst hasLogoutEvent = typeof events === 'object' && events !== null && BACKCHANNEL_LOGOUT_EVENT in (events as Record<string, unknown>)\n\tif (!hasLogoutEvent) {\n\t\tthrow new IDPValidationError('Logout token is missing the back-channel-logout event')\n\t}\n\n\tconst sid = typeof payload.sid === 'string' ? payload.sid : undefined\n\tconst sub = typeof payload.sub === 'string' ? payload.sub : undefined\n\tif (!sid && !sub) {\n\t\tthrow new IDPValidationError('Logout token must contain a sid or sub claim')\n\t}\n\n\treturn { sid, sub }\n}\n"],"names":["generators","IDPValidationError","errors","IDPResponseError","createRemoteJWKSet","jwtVerify"],"mappings":";;;;;;AAwBO,MAAM,yBAAyB,CAAC,UAAoB,WAAoB,eAA0D;AACxI,QAAM,eAAe,SAAS,kBAAkB,OAAO,YAAY,kBAAkB,WAAW,WAAW,gBAAgB;AAC3H,QAAM,UAAU,SAAS,aAAa,OAAO,YAAY,aAAa,WAAW,WAAW,WAAW;AACvG,SAAO;AAAA,IACN;AAAA,IACA,QAAQ;AAAA,MACP,GAAI,eAAe,EAAE,eAAe,aAAA,IAAiB,CAAA;AAAA,MACrD,GAAI,SAAS,eAAe,EAAE,cAAc,SAAS,aAAA,IAAiB,CAAA;AAAA,MACtE,GAAI,UAAU,EAAE,UAAU,YAAY,CAAA;AAAA,IAAC;AAAA,IAExC,WAAW,SAAS,aAAa,IAAI,KAAK,SAAS,aAAa,GAAI,IAAI;AAAA,EAAA;AAE1E;AAEO,MAAM,eAAe,OAC3B,QACA,EAAE,aAAa,OAAO,mBACU;AAChC,QAAM,QAAQA,aAAAA,WAAW,MAAA;AACzB,QAAM,QAAQA,aAAAA,WAAW,MAAA;AACzB,QAAM,MAAM,OAAO,iBAAiB;AAAA,IACnC,cAAc;AAAA,IACd,eAAe;AAAA,IACf,OAAO,SAAS;AAAA,IAChB;AAAA,IACA;AAAA,EAAA,CACA;AAED,SAAO;AAAA,IACN,SAAS;AAAA,IACT,aAAa,EAAE,OAAO,MAAA;AAAA,EAAM;AAE9B;AAUA,MAAM,WAAW,CAAC,QAAiC,SAClD,KAAK,MAAM,GAAG,EAAE;AAAA,EACf,CAAC,KAAK,QAAS,OAAO,QAAQ,OAAO,QAAQ,WAAY,IAAgC,GAAG,IAAI;AAAA,EAChG;AACD;AAEM,MAAM,qBAAqB,OACjC,QACA,EAAE,aAAa,aAAa,GAAG,aAC/B,EAAE,eAAe,kBAAkB,gBAAgB,aAAA,IAA4C,CAAA,MACrE;AAC1B,QAAM,SAAS,gBAAgB,YAAY,UAAU,aAAa,OAAO,eAAe,UAAU,GAAG;AACrG,MAAI,OAAO,SAAS,CAAC,aAAa,OAAO;AACxC,UAAM,IAAIC,mBAAAA,mBAAmB,6DAA6D;AAAA,EAC3F;AACA,MAAI;AACH,UAAM,SAAS,MAAM,OAAO,SAAS,aAAa,QAAQ,WAAW;AACrE,UAAM,SAAS,OAAO,OAAA;AACtB,UAAM,EAAE,SAAS,QAAQ,OAAO,GAAG,wBAAwB;AAC3D,UAAM,WAAW,OAAO,gBAAgB,gBAAgB,MAAM,OAAO,SAAS,MAAM,IAAI,CAAA;AACxF,UAAM,aAAa,mBAAmB,SAAS,CAAA;AAC/C,UAAM,aAAa,iBAAiB,uBAAuB,QAAQ,OAAO,OAAO,QAAQ,WAAW,OAAO,MAAM,MAAS,IAAI;AAQ9H,QAAI,SAAkC,EAAE,GAAG,qBAAqB,GAAG,SAAA;AACnE,UAAM,gBAAgB,cAAc;AACpC,QAAI,eAAe;AAClB,YAAM,SAAS,OAAO,aAAa;AACnC,UAAI,UAAU,OAAO,WAAW,YAAY,CAAC,MAAM,QAAQ,MAAM,GAAG;AACnE,iBAAS,EAAE,GAAI,QAAoC,GAAG,OAAA;AAAA,MACvD;AAAA,IACD;AAIA,UAAM,mBAAmB,OAAO;AAChC,UAAM,gBAAgB,qBAAqB,QAAQ,qBAAqB;AAOxE,UAAM,gBAAgB,SAAS,QAAQ,cAAc,sBAAsB,KAAK;AAChF,QAAI;AACJ,QAAI,kBAAkB,UAAa,kBAAkB,MAAM;AAC1D,2BAAqB,OAAO;AAAA,IAC7B,WAAW,OAAO,kBAAkB,YAAY,OAAO,kBAAkB,UAAU;AAClF,2BAAqB,OAAO,aAAa;AAAA,IAC1C,OAAO;AACN,YAAM,IAAIA,mBAAAA,mBAAmB,2DAA2D;AAAA,IACzF;AACA,QAAI,uBAAuB,IAAI;AAC9B,YAAM,IAAIA,mBAAAA,mBAAmB,gEAAgE;AAAA,IAC9F;AAMA,UAAM,QAAQ,SAAS,QAAQ,cAAc,SAAS,OAAO;AAC7D,UAAM,OAAO,SAAS,QAAQ,cAAc,QAAQ,MAAM;AAE1D,WAAO;AAAA,MACN,GAAG;AAAA,MACH,GAAG;AAAA,MACH;AAAA,MACA,OAAO,OAAO,UAAU,WAAW,QAAQ;AAAA,MAC3C,MAAM,OAAO,SAAS,WAAW,OAAO;AAAA,MACxC;AAAA,MACA,GAAI,aAAa,EAAE,eAAe,CAAA;AAAA,IAAC;AAAA,EAErC,SAAS,GAAQ;AAChB,QAAI,aAAaC,aAAAA,OAAO,SAAS;AAChC,YAAM,IAAID,mBAAAA,mBAAmB,EAAE,OAAO;AAAA,IACvC;AACA,QAAI,aAAaC,aAAAA,OAAO,SAAS;AAChC,YAAM,OAAO,EAAE,UAAU;AACzB,UAAI,OAAO,SAAS,YAAY,OAAO,MAAM,UAAU,YAAY,OAAO,KAAK,OAAO,YAAY,UAAU;AAC3G,cAAM,IAAIC,iBAAAA,iBAAiB,KAAK,MAAM,OAAO;AAAA,MAC9C;AACA,YAAM,IAAIA,iBAAAA,iBAAiB,EAAE,OAAO;AAAA,IACrC;AACA,UAAM;AAAA,EACP;AACD;AAGA,MAAM,sBAAsB,oBAAI,IAAI,CAAC,iBAAiB,iBAAiB,eAAe,CAAC;AAQhF,MAAM,iBAAiB,OAC7B,QACA,QACA,YACiC;AACjC,QAAM,SAAS,QAAQ,UAAU,CAAA;AACjC,QAAM,eAAe,OAAO,OAAO,kBAAkB,WAAW,OAAO,gBAAgB;AACvF,QAAM,cAAc,OAAO,OAAO,iBAAiB,WAAW,OAAO,eAAe;AACpF,MAAI;AACH,QAAI,WAAW,WAAW;AACzB,UAAI,CAAC,cAAc;AAClB,eAAO,EAAE,QAAQ,WAAW,QAAQ,mBAAA;AAAA,MACrC;AACA,YAAM,WAAW,MAAM,OAAO,QAAQ,YAAY;AAClD,UAAI;AACJ,UAAI;AACH,iBAAS,SAAS,WAAW,SAAS,OAAA,IAAW;AAAA,MAClD,QAAQ;AACP,iBAAS;AAAA,MACV;AACA,aAAO;AAAA,QACN,QAAQ;AAAA,QACR;AAAA;AAAA,QAEA,YAAY,uBAAuB,UAAU,QAAQ,WAAW,MAAM;AAAA,MAAA;AAAA,IAExE;AACA,QAAI,WAAW,YAAY;AAC1B,UAAI,CAAC,aAAa;AACjB,eAAO,EAAE,QAAQ,WAAW,QAAQ,kBAAA;AAAA,MACrC;AACA,YAAM,WAAW,MAAM,OAAO,SAAS,WAAW;AAClD,aAAO,EAAE,QAAQ,SAAS,QAAQ,SAAA;AAAA,IACnC;AAEA,UAAM,QAAQ,eAAe;AAC7B,QAAI,CAAC,OAAO;AACX,aAAO,EAAE,QAAQ,WAAW,QAAQ,WAAA;AAAA,IACrC;AACA,UAAM,SAAS,MAAM,OAAO,WAAW,OAAO,cAAc,iBAAiB,eAAe;AAC5F,QAAI,CAAC,OAAO,QAAQ;AACnB,aAAO,EAAE,QAAQ,WAAW,QAAQ,WAAA;AAAA,IACrC;AACA,WAAO,EAAE,QAAQ,QAAA;AAAA,EAClB,SAAS,GAAQ;AAChB,QAAI,aAAaD,aAAAA,OAAO,SAAS;AAChC,UAAI,OAAO,EAAE,UAAU,YAAY,oBAAoB,IAAI,EAAE,KAAK,GAAG;AACpE,eAAO,EAAE,QAAQ,WAAW,QAAQ,EAAE,MAAA;AAAA,MACvC;AAOA,UAAI,WAAW,cAAc,EAAE,UAAU,eAAe,KAAK;AAC5D,eAAO,EAAE,QAAQ,WAAW,QAAQ,wBAAA;AAAA,MACrC;AAAA,IACD;AAEA,UAAM;AAAA,EACP;AACD;AAQO,MAAM,qBAAqB,CAAC,QAAgB,EAAE,SAAS,4BAA6D;AAC1H,MAAI,CAAC,OAAO,OAAO,SAAS,sBAAsB;AACjD,WAAO;AAAA,EACR;AACA,SAAO,OAAO,cAAc;AAAA,IAC3B,GAAI,UAAU,EAAE,eAAe,QAAA,IAAY,CAAA;AAAA,IAC3C,GAAI,wBAAwB,EAAE,0BAA0B,0BAA0B,CAAA;AAAA,EAAC,CACnF;AACF;AAQA,MAAM,2BAA2B;AAOjC,MAAM,+BAA+B;AACrC,MAAM,uCAAuC;AAQ7C,MAAM,sCAAsB,IAAA;AAE5B,MAAM,gBAAgB,CAAC,YAA2D;AACjF,MAAI,OAAO,gBAAgB,IAAI,OAAO;AACtC,MAAI,CAAC,MAAM;AACV,WAAOE,KAAAA,mBAAmB,IAAI,IAAI,OAAO,CAAC;AAC1C,oBAAgB,IAAI,SAAS,IAAI;AAAA,EAClC;AACA,SAAO;AACR;AAcO,MAAM,0BAA0B,OAAO,QAAgB,QAAwB,gBAAoD;AACzI,QAAM,UAAU,OAAO,SAAS;AAChC,MAAI,CAAC,SAAS;AACb,UAAM,IAAIH,mBAAAA,mBAAmB,iDAAiD;AAAA,EAC/E;AACA,QAAM,WAAW,OAAO,SAAS;AACjC,MAAI,OAAO,aAAa,YAAY,aAAa,IAAI;AAIpD,UAAM,IAAIA,mBAAAA,mBAAmB,2DAA2D;AAAA,EACzF;AACA,QAAM,cAAc,OAAO,OAAO,SAAS,iCAAiC,WACzE,OAAO,SAAS,+BAChB;AACH,QAAM,OAAO,cAAc,OAAO;AAClC,MAAI;AACJ,MAAI;AACH,UAAM,WAAW,MAAMI,eAAU,aAAa,MAAM;AAAA,MACnD,QAAQ,OAAO,SAAS;AAAA,MACxB,UAAU;AAAA;AAAA;AAAA,MAGV,YAAY,CAAC,WAAW;AAAA;AAAA;AAAA,MAGxB,aAAa;AAAA,MACb,gBAAgB,CAAC,KAAK;AAAA,MACtB,gBAAgB;AAAA,IAAA,CAChB;AACD,cAAU,SAAS;AAAA,EACpB,SAAS,GAAQ;AAChB,UAAM,IAAIJ,mBAAAA,mBAAmB,yBAAyB,GAAG,WAAW,qBAAqB,EAAE;AAAA,EAC5F;AAGA,MAAI,WAAW,SAAS;AACvB,UAAM,IAAIA,mBAAAA,mBAAmB,uCAAuC;AAAA,EACrE;AAEA,QAAM,SAAS,QAAQ;AACvB,QAAM,iBAAiB,OAAO,WAAW,YAAY,WAAW,QAAQ,4BAA6B;AACrG,MAAI,CAAC,gBAAgB;AACpB,UAAM,IAAIA,mBAAAA,mBAAmB,uDAAuD;AAAA,EACrF;AAEA,QAAM,MAAM,OAAO,QAAQ,QAAQ,WAAW,QAAQ,MAAM;AAC5D,QAAM,MAAM,OAAO,QAAQ,QAAQ,WAAW,QAAQ,MAAM;AAC5D,MAAI,CAAC,OAAO,CAAC,KAAK;AACjB,UAAM,IAAIA,mBAAAA,mBAAmB,8CAA8C;AAAA,EAC5E;AAEA,SAAO,EAAE,KAAK,IAAA;AACf;;;;;;;"}
+{"version":3,"file":"OIDCHelpers.cjs","sources":["../../../../../../../../packages/engine-tenant-api/src/model/service/idp/providers/OIDCHelpers.ts"],"sourcesContent":["import { Client, custom, errors, generators, Issuer, TokenSet } from 'openid-client'\nimport { createRemoteJWKSet, jwtVerify } from 'jose'\nimport { OIDCClaimMapping, OIDCResponseData } from './OIDCTypes.js'\nimport { IDPValidationError } from '../IDPValidationError.js'\nimport { IDPResponseError } from '../IDPResponseError.js'\nimport {\n\tIDPResponse,\n\tIDPSessionState,\n\tInitIDPAuthResult,\n\tLogoutTokenClaims,\n\tLogoutUrlRequest,\n\tRevalidationResult,\n} from '../IdentityProviderHandler.js'\n\n/**\n * Build the persisted session state from an OIDC token set. Stores the tokens needed for\n * later re-validation (refresh/access) and SLO (id_token); the whole `tokens` blob is\n * encrypted at rest by the command layer.\n *\n * `prevTokens` carries the previously stored tokens forward: a refresh-grant response MAY omit\n * the refresh token (RFC 6749 §6 — IdPs that don't rotate just don't re-send it), in which case\n * the client must keep using the old one. Without this fallback a non-rotating IdP would persist\n * a session with no refresh token and be revoked (`no_refresh_token`) on the very next tick.\n */\nexport const tokenSetToSessionState = (tokenSet: TokenSet, sessionId?: string, prevTokens?: Record<string, unknown>): IDPSessionState => {\n\tconst refreshToken = tokenSet.refresh_token ?? (typeof prevTokens?.refresh_token === 'string' ? prevTokens.refresh_token : undefined)\n\tconst idToken = tokenSet.id_token ?? (typeof prevTokens?.id_token === 'string' ? prevTokens.id_token : undefined)\n\treturn {\n\t\tsessionId,\n\t\ttokens: {\n\t\t\t...(refreshToken ? { refresh_token: refreshToken } : {}),\n\t\t\t...(tokenSet.access_token ? { access_token: tokenSet.access_token } : {}),\n\t\t\t...(idToken ? { id_token: idToken } : {}),\n\t\t},\n\t\texpiresAt: tokenSet.expires_at ? new Date(tokenSet.expires_at * 1000) : undefined,\n\t}\n}\n\nexport const initOIDCAuth = async (\n\tclient: Client,\n\t{ redirectUrl, scope, responseMode }: { redirectUrl: string; scope?: string; responseMode?: string },\n): Promise<InitIDPAuthResult> => {\n\tconst nonce = generators.nonce()\n\tconst state = generators.state()\n\tconst url = client.authorizationUrl({\n\t\tredirect_uri: redirectUrl,\n\t\tresponse_mode: responseMode,\n\t\tscope: scope ?? 'openid email',\n\t\tnonce,\n\t\tstate,\n\t})\n\n\treturn {\n\t\tauthUrl: url,\n\t\tsessionData: { nonce, state },\n\t}\n}\n\nexport type HandleOIDCResponseOptions = {\n\tfetchUserInfo?: boolean\n\treturnOIDCResult?: boolean\n\tcaptureSession?: boolean\n\tclaimMapping?: OIDCClaimMapping\n}\n\n/**\n * Read a claim by name, supporting dot-paths into nested objects (`a.b.c`). Own-property only at every\n * segment (mirrors `ClaimMappingEvaluator.resolvePath`): a configured path must never descend into an\n * inherited member, so a `__proto__` / `constructor` segment cannot surface an `Object.prototype` value\n * as the externalIdentifier / email / name.\n */\nconst getClaim = (source: Record<string, unknown>, path: string): unknown =>\n\tpath.split('.').reduce<unknown>(\n\t\t(\n\t\t\tacc,\n\t\t\tkey,\n\t\t) => (acc != null && typeof acc === 'object' && Object.prototype.hasOwnProperty.call(acc, key) ? (acc as Record<string, unknown>)[key] : undefined),\n\t\tsource,\n\t)\n\n/**\n * Lift a configured nested attributes object (`attributesKey`, notably Apereo CAS's `attributes`) to the\n * top level so providers that nest their claims map without a code change. The nested attributes are\n * UNSIGNED, so they are spread UNDER `source` — a signed top-level claim keeps precedence over an\n * attributes-level value. Shared by the sign-in response handler ({@link handleOIDCResponse}) and the\n * session-refresh path ({@link revalidateOIDC}) so BOTH see the same claim surface; without this, an\n * `attributesKey` provider's A09 claim mapping would resolve at sign-in but silently not on refresh.\n */\nexport const liftNestedClaims = (source: Record<string, unknown>, attributesKey: string | undefined): Record<string, unknown> => {\n\tif (!attributesKey) {\n\t\treturn source\n\t}\n\tconst nested = Object.prototype.hasOwnProperty.call(source, attributesKey) ? source[attributesKey] : undefined\n\tif (nested !== null && typeof nested === 'object' && !Array.isArray(nested)) {\n\t\treturn { ...nested, ...source }\n\t}\n\treturn source\n}\n\ntype NormalizedClaims = Record<string, unknown> & {\n\texternalIdentifier: string\n\temail: string | undefined\n\tname: string | undefined\n\temailVerified: boolean\n}\n\n/**\n * Build the normalized claim surface shared by sign-in ({@link handleOIDCResponse}) and session refresh\n * ({@link revalidateOIDC}): lift any configured nested attributes object to the top level, then layer the\n * mapped identity fields (`externalIdentifier` / `email` / `name` / `emailVerified`) over the raw claims.\n * BOTH paths run this SAME normalization so an A09 claim-mapping rule resolves identically whether it\n * targets a raw provider claim or one of the normalized identity fields — without it the two surfaces\n * diverged (refresh saw the raw claim, sign-in the mapped value).\n *\n * `subFallback` is the signature-verified ID-token `sub`, used when a custom `externalIdentifier` mapping\n * resolves to nothing: at sign-in it is guaranteed present; on refresh it is the refreshed id-token's `sub`\n * (or, for the userinfo method, the userinfo `sub`). Throws (account-takeover guard) when the mapped\n * subject is a non-scalar or resolves empty — the refresh caller catches this and skips the sync.\n */\nconst normalizeClaims = (\n\trawSource: Record<string, unknown>,\n\tclaimMapping: OIDCClaimMapping | undefined,\n\tsubFallback: string | undefined,\n): NormalizedClaims => {\n\tconst source = liftNestedClaims(rawSource, claimMapping?.attributesKey)\n\n\t// The OIDC `email_verified` claim is a boolean per spec, but some providers send the\n\t// string \"true\". userInfo (and any unwrapped attributes) take precedence over the ID token.\n\tconst rawEmailVerified = source.email_verified\n\tconst emailVerified = rawEmailVerified === true || rawEmailVerified === 'true'\n\n\t// `externalIdentifier` is the federation key persisted in `person_identity_provider` and\n\t// matched on the next sign-in, so it must be a stable scalar. A `claimMapping` that pointed\n\t// it at an object/array would otherwise be coerced by `String(...)` to `'[object Object]'` /\n\t// a comma-join — collapsing every user of the provider onto one key (account takeover). Fail\n\t// closed instead. The default `sub` path is safe (openid-client guarantees `sub` is a string).\n\tconst mappedSubject = getClaim(source, claimMapping?.externalIdentifier ?? 'sub')\n\tlet externalIdentifier: string\n\tif (mappedSubject === undefined || mappedSubject === null) {\n\t\texternalIdentifier = subFallback ?? ''\n\t} else if (typeof mappedSubject === 'string' || typeof mappedSubject === 'number') {\n\t\texternalIdentifier = String(mappedSubject)\n\t} else {\n\t\tthrow new IDPValidationError(`The mapped externalIdentifier claim is not a scalar value`)\n\t}\n\tif (externalIdentifier === '') {\n\t\tthrow new IDPValidationError(`The mapped externalIdentifier claim resolved to an empty value`)\n\t}\n\n\t// `email` / `name` are typed `string | undefined` on IDPResponse and feed the by-e-mail\n\t// account lookup (which crashes on a non-string). `...source` already placed the raw claim\n\t// of whatever type, so OVERWRITE (don't conditionally add) with the mapped value when it is\n\t// a string, otherwise `undefined` — a non-string claim must not leak through `...source`.\n\tconst email = getClaim(source, claimMapping?.email ?? 'email')\n\tconst name = resolveName(source, claimMapping)\n\n\treturn {\n\t\t...source,\n\t\texternalIdentifier,\n\t\temail: typeof email === 'string' ? email : undefined,\n\t\tname,\n\t\temailVerified,\n\t}\n}\n\n/**\n * Resolve the display name, falling back to `given_name` + `family_name` when there is no usable\n * `name` claim.\n *\n * `name` is optional in OIDC core and plenty of providers omit it while sending the parts — Apereo\n * CAS and Entra ID do, and so does Keycloak under its default mappers. Without the fallback,\n * `CreatePersonCommand` lands on its own last-resort default and a federated person ends up named\n * after the local part of their e-mail (`jan.novak`) despite the IdP having reported \"Jan Novák\".\n * A single-path `claimMapping.name` cannot express this: the value has to be composed from two\n * claims, not selected from one.\n *\n * An explicitly configured `claimMapping.name` is honoured as-is, fallback included — mapping a\n * claim is a statement about where the name lives, and quietly substituting a different source\n * would defeat it. A blank claim counts as absent: an empty string is not a display name, and\n * treating it as one would keep the fallback (and `CreatePersonCommand`'s) from ever running.\n */\nconst resolveName = (source: Record<string, unknown>, claimMapping: OIDCClaimMapping | undefined): string | undefined => {\n\tconst mapped = getClaim(source, claimMapping?.name ?? 'name')\n\tif (typeof mapped === 'string' && mapped.trim() !== '') {\n\t\treturn mapped\n\t}\n\tif (claimMapping?.name !== undefined) {\n\t\treturn undefined\n\t}\n\tconst parts = [getClaim(source, 'given_name'), getClaim(source, 'family_name')]\n\t\t.filter((part): part is string => typeof part === 'string' && part.trim() !== '')\n\t\t.map(part => part.trim())\n\treturn parts.length > 0 ? parts.join(' ') : undefined\n}\n\nexport const handleOIDCResponse = async (\n\tclient: Client,\n\t{ sessionData, redirectUrl, ...otherData }: OIDCResponseData,\n\t{ fetchUserInfo, returnOIDCResult, captureSession, claimMapping }: HandleOIDCResponseOptions = {},\n): Promise<IDPResponse> => {\n\tconst params = 'parameters' in otherData ? otherData.parameters : client.callbackParams(otherData.url)\n\tif (params.state && !sessionData?.state) {\n\t\tthrow new IDPValidationError(`state is present in parameters, but missing in session data`)\n\t}\n\ttry {\n\t\tconst result = await client.callback(redirectUrl, params, sessionData)\n\t\tconst claims = result.claims()\n\t\tconst { at_hash, c_hash, nonce, ...claimsWithoutHashes } = claims\n\t\tconst userInfo = result.access_token && fetchUserInfo ? await client.userinfo(result) : {}\n\t\tconst oidcResult = returnOIDCResult ? result : {}\n\t\tconst idpSession = captureSession ? tokenSetToSessionState(result, typeof claims.sid === 'string' ? claims.sid : undefined) : undefined\n\n\t\t// Merge ID-token claims with userInfo (userInfo wins, per spec), then normalize the surface (lift\n\t\t// nested attributes + map the identity fields). The refresh path runs the SAME normalization, so a\n\t\t// claim mapping resolves identically at sign-in and on refresh. The default `sub` fallback is safe —\n\t\t// openid-client guarantees `sub` is a string.\n\t\tconst normalized = normalizeClaims({ ...claimsWithoutHashes, ...userInfo }, claimMapping, claims.sub)\n\n\t\treturn {\n\t\t\t...oidcResult,\n\t\t\t...normalized,\n\t\t\t...(idpSession ? { idpSession } : {}),\n\t\t}\n\t} catch (e: any) {\n\t\tif (e instanceof errors.RPError) {\n\t\t\tthrow new IDPValidationError(e.message)\n\t\t}\n\t\tif (e instanceof errors.OPError) {\n\t\t\tconst body = e.response?.body as any\n\t\t\tif (typeof body === 'object' && typeof body?.error === 'object' && typeof body.error?.message === 'string') {\n\t\t\t\tthrow new IDPResponseError(body.error.message)\n\t\t\t}\n\t\t\tthrow new IDPResponseError(e.message)\n\t\t}\n\t\tthrow e\n\t}\n}\n\n/** OIDC errors that definitively mean \"this session is no longer valid at the IdP\". */\nconst REVOKED_OIDC_ERRORS = new Set(['invalid_grant', 'invalid_token', 'expired_token'])\n\n/**\n * Re-validate a stored OIDC session against the IdP. Returns `revoked` only for definitive\n * IdP responses (invalid/expired grant or inactive introspection). Transient failures\n * (network, IdP down) re-throw so the caller can fail-open and keep the session — IdP\n * downtime must not log everyone out.\n */\nexport const revalidateOIDC = async (\n\tclient: Client,\n\tmethod: 'refresh' | 'userinfo' | 'introspection',\n\tsession: IDPSessionState,\n\toptions: { claimMapping?: OIDCClaimMapping; fetchUserInfo?: boolean } = {},\n): Promise<RevalidationResult> => {\n\tconst { claimMapping, fetchUserInfo } = options\n\tconst tokens = session.tokens ?? {}\n\tconst refreshToken = typeof tokens.refresh_token === 'string' ? tokens.refresh_token : undefined\n\tconst accessToken = typeof tokens.access_token === 'string' ? tokens.access_token : undefined\n\ttry {\n\t\tif (method === 'refresh') {\n\t\t\tif (!refreshToken) {\n\t\t\t\treturn { status: 'revoked', reason: 'no_refresh_token' }\n\t\t\t}\n\t\t\tconst tokenSet = await client.refresh(refreshToken)\n\t\t\tlet claims: Record<string, unknown> | undefined\n\t\t\tlet claimsComplete = false\n\t\t\ttry {\n\t\t\t\t// Reconstruct the SAME claim surface sign-in builds (handleOIDCResponse): the refreshed id-token\n\t\t\t\t// claims merged with userInfo when `fetchUserInfo` is set — exactly as at sign-in — then the shared\n\t\t\t\t// normalization (lift nested attributes + map identity fields). An `always` mapping therefore\n\t\t\t\t// reconciles against an identical surface on refresh, so `claimsComplete` lets the caller enable\n\t\t\t\t// `unmatched: \"remove\"` reconciliation here too (see IdpSessionRevalidator).\n\t\t\t\tif (tokenSet.id_token) {\n\t\t\t\t\tconst idClaims = tokenSet.claims()\n\t\t\t\t\tconst userInfo = tokenSet.access_token && fetchUserInfo ? await client.userinfo(tokenSet) : {}\n\t\t\t\t\tclaims = normalizeClaims({ ...idClaims, ...userInfo }, claimMapping, typeof idClaims.sub === 'string' ? idClaims.sub : undefined)\n\t\t\t\t\tclaimsComplete = true\n\t\t\t\t}\n\t\t\t} catch {\n\t\t\t\t// Building the surface failed (userinfo unreachable, a non-scalar `externalIdentifier`, …). The IdP\n\t\t\t\t// already vouched for the session via the successful refresh, so KEEP it — just skip the claim sync\n\t\t\t\t// this tick (no claims → no grant, no removal) and retry on a later refresh. Leaving claimsComplete\n\t\t\t\t// false also guarantees a half-built surface can never drive a removal.\n\t\t\t\tclaims = undefined\n\t\t\t\tclaimsComplete = false\n\t\t\t}\n\t\t\treturn {\n\t\t\t\tstatus: 'valid',\n\t\t\t\tclaims,\n\t\t\t\tclaimsComplete,\n\t\t\t\t// carry the stored tokens forward: a non-rotating IdP omits the refresh token here\n\t\t\t\tidpSession: tokenSetToSessionState(tokenSet, session.sessionId, tokens),\n\t\t\t}\n\t\t}\n\t\tif (method === 'userinfo') {\n\t\t\tif (!accessToken) {\n\t\t\t\treturn { status: 'revoked', reason: 'no_access_token' }\n\t\t\t}\n\t\t\tconst userInfo = await client.userinfo(accessToken)\n\t\t\tlet claims: Record<string, unknown> | undefined\n\t\t\ttry {\n\t\t\t\tclaims = normalizeClaims(userInfo, claimMapping, typeof userInfo.sub === 'string' ? userInfo.sub : undefined)\n\t\t\t} catch {\n\t\t\t\tclaims = undefined\n\t\t\t}\n\t\t\t// A userinfo probe carries no id-token claims, so its surface is NARROWER than sign-in's (id-token +\n\t\t\t// userinfo): a rule keyed on an id-token-only claim would miss here. Keep refresh-time sync additive-only\n\t\t\t// (`claimsComplete: false`) so `unmatched: \"remove\"` never strips a membership off this partial surface.\n\t\t\treturn { status: 'valid', claims, claimsComplete: false }\n\t\t}\n\t\t// introspection\n\t\tconst token = accessToken ?? refreshToken\n\t\tif (!token) {\n\t\t\treturn { status: 'revoked', reason: 'no_token' }\n\t\t}\n\t\tconst result = await client.introspect(token, accessToken ? 'access_token' : 'refresh_token')\n\t\tif (!result.active) {\n\t\t\treturn { status: 'revoked', reason: 'inactive' }\n\t\t}\n\t\treturn { status: 'valid' }\n\t} catch (e: any) {\n\t\tif (e instanceof errors.OPError) {\n\t\t\tif (typeof e.error === 'string' && REVOKED_OIDC_ERRORS.has(e.error)) {\n\t\t\t\treturn { status: 'revoked', reason: e.error }\n\t\t\t}\n\t\t\t// The userinfo endpoint signals a rejected access token with a bare HTTP 401 — per\n\t\t\t// RFC 6750 the `WWW-Authenticate` error code is optional, so openid-client may not\n\t\t\t// surface a parseable `error` here. A 401 is still definitive: the token is no\n\t\t\t// longer accepted → revoked. (Introspection is NOT treated this way: it returns 200\n\t\t\t// `{active:false}` for revoked tokens, so a 401/400 there means client-auth/config\n\t\t\t// failure — transient, must not log users out.)\n\t\t\tif (method === 'userinfo' && e.response?.statusCode === 401) {\n\t\t\t\treturn { status: 'revoked', reason: 'userinfo_unauthorized' }\n\t\t\t}\n\t\t}\n\t\t// transient (network / IdP unavailable) — propagate, do not revoke\n\t\tthrow e\n\t}\n}\n\n/**\n * Build an RP-initiated (front-channel) logout URL (OIDC RP-Initiated Logout 1.0). Returns null\n * when the IdP advertises no `end_session_endpoint` — the caller then degrades to a local-only\n * logout (legacy-IdP graceful fallback). The `id_token_hint` lets the IdP identify and confirm the\n * session to terminate; `post_logout_redirect_uri` is where the IdP returns the browser afterwards.\n */\nexport const buildOIDCLogoutUrl = (client: Client, { idToken, postLogoutRedirectUri }: LogoutUrlRequest): string | null => {\n\tif (!client.issuer.metadata.end_session_endpoint) {\n\t\treturn null\n\t}\n\treturn client.endSessionUrl({\n\t\t...(idToken ? { id_token_hint: idToken } : {}),\n\t\t...(postLogoutRedirectUri ? { post_logout_redirect_uri: postLogoutRedirectUri } : {}),\n\t})\n}\n\n/**\n * The OIDC Back-Channel Logout 1.0 event member that MUST be present in a logout token's `events`\n * claim. Its presence (and the absence of a `nonce`) is what distinguishes a logout token from an\n * ID token — both are signed by the same IdP, so without this check an ID token could be replayed\n * to forcibly log a user out.\n */\nconst BACKCHANNEL_LOGOUT_EVENT = 'http://schemas.openid.net/event/backchannel-logout'\n\n/**\n * Max accepted age of a back-channel logout token, derived from its `iat`. OIDC Back-Channel Logout\n * tokens are single-use and short-lived; bounding the age (together with requiring `exp`) limits the\n * window in which a captured token could be replayed to force a logout.\n */\nconst LOGOUT_TOKEN_MAX_AGE_SECONDS = 120\nconst LOGOUT_TOKEN_CLOCK_TOLERANCE_SECONDS = 5\n\n/**\n * Remote JWKS sets keyed by `jwks_uri`. `createRemoteJWKSet` returns a function with its own internal\n * key cache + fetch cooldown, so it MUST be reused across requests — re-creating it per call (as the\n * unauthenticated back-channel endpoint would otherwise do) defeats the cache and turns every request\n * into a potential outbound JWKS fetch. Keyed by URL, so two providers sharing an IdP share the set.\n */\nconst remoteJwksCache = new Map<string, ReturnType<typeof createRemoteJWKSet>>()\n\nconst getRemoteJwks = (jwksUri: string): ReturnType<typeof createRemoteJWKSet> => {\n\tlet jwks = remoteJwksCache.get(jwksUri)\n\tif (!jwks) {\n\t\tjwks = createRemoteJWKSet(new URL(jwksUri))\n\t\tremoteJwksCache.set(jwksUri, jwks)\n\t}\n\treturn jwks\n}\n\n/**\n * Validate an OIDC back-channel logout token (OIDC Back-Channel Logout 1.0 §2.4–2.6) and extract\n * the targeted `sid` / `sub`. The token is a JWT signed by the IdP; we verify the signature against\n * the issuer's JWKS and enforce the issuer + audience (client_id) the same way ID tokens are\n * verified, pinning the signing algorithm to the provider's configured one, then assert the\n * back-channel-specific claims:\n *   - `iat` is present and recent and `exp` is present (§2.4 requires both) — bounds the replay window;\n *   - `events` contains the back-channel-logout member (it really is a logout token);\n *   - it carries a `sid` and/or `sub` (otherwise there is nothing to act on);\n *   - it does NOT carry a `nonce` (a `nonce` means it is an ID token being replayed).\n * Throws {@link IDPValidationError} on any failure so the caller can answer 400.\n */\nexport const validateOIDCLogoutToken = async (client: Client, issuer: Issuer<Client>, logoutToken: string): Promise<LogoutTokenClaims> => {\n\tconst jwksUri = issuer.metadata.jwks_uri\n\tif (!jwksUri) {\n\t\tthrow new IDPValidationError('IdP has no jwks_uri; cannot verify logout token')\n\t}\n\tconst clientId = client.metadata.client_id\n\tif (typeof clientId !== 'string' || clientId === '') {\n\t\t// The `aud` check is a core anti-token-substitution defence on this unauthenticated endpoint.\n\t\t// jose treats `audience: undefined` as \"skip the aud check entirely\", so a missing client_id\n\t\t// must fail closed (reject the token) rather than fall through and accept any audience.\n\t\tthrow new IDPValidationError('cannot verify logout token audience: client_id is missing')\n\t}\n\tconst expectedAlg = typeof client.metadata.id_token_signed_response_alg === 'string'\n\t\t? client.metadata.id_token_signed_response_alg\n\t\t: 'RS256'\n\tconst jwks = getRemoteJwks(jwksUri)\n\tlet payload: Record<string, unknown>\n\ttry {\n\t\tconst verified = await jwtVerify(logoutToken, jwks, {\n\t\t\tissuer: issuer.metadata.issuer,\n\t\t\taudience: clientId,\n\t\t\t// pin to the provider's configured signing alg so a JWKS containing a symmetric/none key\n\t\t\t// can never be selected (defence-in-depth on top of jose's own key-type check).\n\t\t\talgorithms: [expectedAlg],\n\t\t\t// §2.4: `iat` and `exp` are REQUIRED. `maxTokenAge` makes `iat` required + bounds freshness;\n\t\t\t// `requiredClaims` makes `exp` required (jose only checks `exp` when present).\n\t\t\tmaxTokenAge: LOGOUT_TOKEN_MAX_AGE_SECONDS,\n\t\t\trequiredClaims: ['exp'],\n\t\t\tclockTolerance: LOGOUT_TOKEN_CLOCK_TOLERANCE_SECONDS,\n\t\t})\n\t\tpayload = verified.payload as Record<string, unknown>\n\t} catch (e: any) {\n\t\tthrow new IDPValidationError(`Invalid logout token: ${e?.message ?? 'verification failed'}`)\n\t}\n\n\t// A logout token MUST NOT contain a nonce; its presence means an ID token is being replayed.\n\tif ('nonce' in payload) {\n\t\tthrow new IDPValidationError('Logout token must not contain a nonce')\n\t}\n\n\tconst events = payload.events\n\tconst hasLogoutEvent = typeof events === 'object' && events !== null && BACKCHANNEL_LOGOUT_EVENT in (events as Record<string, unknown>)\n\tif (!hasLogoutEvent) {\n\t\tthrow new IDPValidationError('Logout token is missing the back-channel-logout event')\n\t}\n\n\tconst sid = typeof payload.sid === 'string' ? payload.sid : undefined\n\tconst sub = typeof payload.sub === 'string' ? payload.sub : undefined\n\tif (!sid && !sub) {\n\t\tthrow new IDPValidationError('Logout token must contain a sid or sub claim')\n\t}\n\n\treturn { sid, sub }\n}\n"],"names":["generators","IDPValidationError","errors","IDPResponseError","createRemoteJWKSet","jwtVerify"],"mappings":";;;;;;AAwBO,MAAM,yBAAyB,CAAC,UAAoB,WAAoB,eAA0D;AACxI,QAAM,eAAe,SAAS,kBAAkB,OAAO,YAAY,kBAAkB,WAAW,WAAW,gBAAgB;AAC3H,QAAM,UAAU,SAAS,aAAa,OAAO,YAAY,aAAa,WAAW,WAAW,WAAW;AACvG,SAAO;AAAA,IACN;AAAA,IACA,QAAQ;AAAA,MACP,GAAI,eAAe,EAAE,eAAe,aAAA,IAAiB,CAAA;AAAA,MACrD,GAAI,SAAS,eAAe,EAAE,cAAc,SAAS,aAAA,IAAiB,CAAA;AAAA,MACtE,GAAI,UAAU,EAAE,UAAU,YAAY,CAAA;AAAA,IAAC;AAAA,IAExC,WAAW,SAAS,aAAa,IAAI,KAAK,SAAS,aAAa,GAAI,IAAI;AAAA,EAAA;AAE1E;AAEO,MAAM,eAAe,OAC3B,QACA,EAAE,aAAa,OAAO,mBACU;AAChC,QAAM,QAAQA,aAAAA,WAAW,MAAA;AACzB,QAAM,QAAQA,aAAAA,WAAW,MAAA;AACzB,QAAM,MAAM,OAAO,iBAAiB;AAAA,IACnC,cAAc;AAAA,IACd,eAAe;AAAA,IACf,OAAO,SAAS;AAAA,IAChB;AAAA,IACA;AAAA,EAAA,CACA;AAED,SAAO;AAAA,IACN,SAAS;AAAA,IACT,aAAa,EAAE,OAAO,MAAA;AAAA,EAAM;AAE9B;AAeA,MAAM,WAAW,CAAC,QAAiC,SAClD,KAAK,MAAM,GAAG,EAAE;AAAA,EACf,CACC,KACA,QACK,OAAO,QAAQ,OAAO,QAAQ,YAAY,OAAO,UAAU,eAAe,KAAK,KAAK,GAAG,IAAK,IAAgC,GAAG,IAAI;AAAA,EACzI;AACD;AAUM,MAAM,mBAAmB,CAAC,QAAiC,kBAA+D;AAChI,MAAI,CAAC,eAAe;AACnB,WAAO;AAAA,EACR;AACA,QAAM,SAAS,OAAO,UAAU,eAAe,KAAK,QAAQ,aAAa,IAAI,OAAO,aAAa,IAAI;AACrG,MAAI,WAAW,QAAQ,OAAO,WAAW,YAAY,CAAC,MAAM,QAAQ,MAAM,GAAG;AAC5E,WAAO,EAAE,GAAG,QAAQ,GAAG,OAAA;AAAA,EACxB;AACA,SAAO;AACR;AAsBA,MAAM,kBAAkB,CACvB,WACA,cACA,gBACsB;AACtB,QAAM,SAAS,iBAAiB,WAAW,cAAc,aAAa;AAItE,QAAM,mBAAmB,OAAO;AAChC,QAAM,gBAAgB,qBAAqB,QAAQ,qBAAqB;AAOxE,QAAM,gBAAgB,SAAS,QAAQ,cAAc,sBAAsB,KAAK;AAChF,MAAI;AACJ,MAAI,kBAAkB,UAAa,kBAAkB,MAAM;AAC1D,yBAAqB,eAAe;AAAA,EACrC,WAAW,OAAO,kBAAkB,YAAY,OAAO,kBAAkB,UAAU;AAClF,yBAAqB,OAAO,aAAa;AAAA,EAC1C,OAAO;AACN,UAAM,IAAIC,mBAAAA,mBAAmB,2DAA2D;AAAA,EACzF;AACA,MAAI,uBAAuB,IAAI;AAC9B,UAAM,IAAIA,mBAAAA,mBAAmB,gEAAgE;AAAA,EAC9F;AAMA,QAAM,QAAQ,SAAS,QAAQ,cAAc,SAAS,OAAO;AAC7D,QAAM,OAAO,YAAY,QAAQ,YAAY;AAE7C,SAAO;AAAA,IACN,GAAG;AAAA,IACH;AAAA,IACA,OAAO,OAAO,UAAU,WAAW,QAAQ;AAAA,IAC3C;AAAA,IACA;AAAA,EAAA;AAEF;AAkBA,MAAM,cAAc,CAAC,QAAiC,iBAAmE;AACxH,QAAM,SAAS,SAAS,QAAQ,cAAc,QAAQ,MAAM;AAC5D,MAAI,OAAO,WAAW,YAAY,OAAO,KAAA,MAAW,IAAI;AACvD,WAAO;AAAA,EACR;AACA,MAAI,cAAc,SAAS,QAAW;AACrC,WAAO;AAAA,EACR;AACA,QAAM,QAAQ,CAAC,SAAS,QAAQ,YAAY,GAAG,SAAS,QAAQ,aAAa,CAAC,EAC5E,OAAO,CAAC,SAAyB,OAAO,SAAS,YAAY,KAAK,WAAW,EAAE,EAC/E,IAAI,CAAA,SAAQ,KAAK,KAAA,CAAM;AACzB,SAAO,MAAM,SAAS,IAAI,MAAM,KAAK,GAAG,IAAI;AAC7C;AAEO,MAAM,qBAAqB,OACjC,QACA,EAAE,aAAa,aAAa,GAAG,aAC/B,EAAE,eAAe,kBAAkB,gBAAgB,aAAA,IAA4C,CAAA,MACrE;AAC1B,QAAM,SAAS,gBAAgB,YAAY,UAAU,aAAa,OAAO,eAAe,UAAU,GAAG;AACrG,MAAI,OAAO,SAAS,CAAC,aAAa,OAAO;AACxC,UAAM,IAAIA,mBAAAA,mBAAmB,6DAA6D;AAAA,EAC3F;AACA,MAAI;AACH,UAAM,SAAS,MAAM,OAAO,SAAS,aAAa,QAAQ,WAAW;AACrE,UAAM,SAAS,OAAO,OAAA;AACtB,UAAM,EAAE,SAAS,QAAQ,OAAO,GAAG,wBAAwB;AAC3D,UAAM,WAAW,OAAO,gBAAgB,gBAAgB,MAAM,OAAO,SAAS,MAAM,IAAI,CAAA;AACxF,UAAM,aAAa,mBAAmB,SAAS,CAAA;AAC/C,UAAM,aAAa,iBAAiB,uBAAuB,QAAQ,OAAO,OAAO,QAAQ,WAAW,OAAO,MAAM,MAAS,IAAI;AAM9H,UAAM,aAAa,gBAAgB,EAAE,GAAG,qBAAqB,GAAG,YAAY,cAAc,OAAO,GAAG;AAEpG,WAAO;AAAA,MACN,GAAG;AAAA,MACH,GAAG;AAAA,MACH,GAAI,aAAa,EAAE,eAAe,CAAA;AAAA,IAAC;AAAA,EAErC,SAAS,GAAQ;AAChB,QAAI,aAAaC,aAAAA,OAAO,SAAS;AAChC,YAAM,IAAID,mBAAAA,mBAAmB,EAAE,OAAO;AAAA,IACvC;AACA,QAAI,aAAaC,aAAAA,OAAO,SAAS;AAChC,YAAM,OAAO,EAAE,UAAU;AACzB,UAAI,OAAO,SAAS,YAAY,OAAO,MAAM,UAAU,YAAY,OAAO,KAAK,OAAO,YAAY,UAAU;AAC3G,cAAM,IAAIC,iBAAAA,iBAAiB,KAAK,MAAM,OAAO;AAAA,MAC9C;AACA,YAAM,IAAIA,iBAAAA,iBAAiB,EAAE,OAAO;AAAA,IACrC;AACA,UAAM;AAAA,EACP;AACD;AAGA,MAAM,sBAAsB,oBAAI,IAAI,CAAC,iBAAiB,iBAAiB,eAAe,CAAC;AAQhF,MAAM,iBAAiB,OAC7B,QACA,QACA,SACA,UAAwE,CAAA,MACvC;AACjC,QAAM,EAAE,cAAc,cAAA,IAAkB;AACxC,QAAM,SAAS,QAAQ,UAAU,CAAA;AACjC,QAAM,eAAe,OAAO,OAAO,kBAAkB,WAAW,OAAO,gBAAgB;AACvF,QAAM,cAAc,OAAO,OAAO,iBAAiB,WAAW,OAAO,eAAe;AACpF,MAAI;AACH,QAAI,WAAW,WAAW;AACzB,UAAI,CAAC,cAAc;AAClB,eAAO,EAAE,QAAQ,WAAW,QAAQ,mBAAA;AAAA,MACrC;AACA,YAAM,WAAW,MAAM,OAAO,QAAQ,YAAY;AAClD,UAAI;AACJ,UAAI,iBAAiB;AACrB,UAAI;AAMH,YAAI,SAAS,UAAU;AACtB,gBAAM,WAAW,SAAS,OAAA;AAC1B,gBAAM,WAAW,SAAS,gBAAgB,gBAAgB,MAAM,OAAO,SAAS,QAAQ,IAAI,CAAA;AAC5F,mBAAS,gBAAgB,EAAE,GAAG,UAAU,GAAG,SAAA,GAAY,cAAc,OAAO,SAAS,QAAQ,WAAW,SAAS,MAAM,MAAS;AAChI,2BAAiB;AAAA,QAClB;AAAA,MACD,QAAQ;AAKP,iBAAS;AACT,yBAAiB;AAAA,MAClB;AACA,aAAO;AAAA,QACN,QAAQ;AAAA,QACR;AAAA,QACA;AAAA;AAAA,QAEA,YAAY,uBAAuB,UAAU,QAAQ,WAAW,MAAM;AAAA,MAAA;AAAA,IAExE;AACA,QAAI,WAAW,YAAY;AAC1B,UAAI,CAAC,aAAa;AACjB,eAAO,EAAE,QAAQ,WAAW,QAAQ,kBAAA;AAAA,MACrC;AACA,YAAM,WAAW,MAAM,OAAO,SAAS,WAAW;AAClD,UAAI;AACJ,UAAI;AACH,iBAAS,gBAAgB,UAAU,cAAc,OAAO,SAAS,QAAQ,WAAW,SAAS,MAAM,MAAS;AAAA,MAC7G,QAAQ;AACP,iBAAS;AAAA,MACV;AAIA,aAAO,EAAE,QAAQ,SAAS,QAAQ,gBAAgB,MAAA;AAAA,IACnD;AAEA,UAAM,QAAQ,eAAe;AAC7B,QAAI,CAAC,OAAO;AACX,aAAO,EAAE,QAAQ,WAAW,QAAQ,WAAA;AAAA,IACrC;AACA,UAAM,SAAS,MAAM,OAAO,WAAW,OAAO,cAAc,iBAAiB,eAAe;AAC5F,QAAI,CAAC,OAAO,QAAQ;AACnB,aAAO,EAAE,QAAQ,WAAW,QAAQ,WAAA;AAAA,IACrC;AACA,WAAO,EAAE,QAAQ,QAAA;AAAA,EAClB,SAAS,GAAQ;AAChB,QAAI,aAAaD,aAAAA,OAAO,SAAS;AAChC,UAAI,OAAO,EAAE,UAAU,YAAY,oBAAoB,IAAI,EAAE,KAAK,GAAG;AACpE,eAAO,EAAE,QAAQ,WAAW,QAAQ,EAAE,MAAA;AAAA,MACvC;AAOA,UAAI,WAAW,cAAc,EAAE,UAAU,eAAe,KAAK;AAC5D,eAAO,EAAE,QAAQ,WAAW,QAAQ,wBAAA;AAAA,MACrC;AAAA,IACD;AAEA,UAAM;AAAA,EACP;AACD;AAQO,MAAM,qBAAqB,CAAC,QAAgB,EAAE,SAAS,4BAA6D;AAC1H,MAAI,CAAC,OAAO,OAAO,SAAS,sBAAsB;AACjD,WAAO;AAAA,EACR;AACA,SAAO,OAAO,cAAc;AAAA,IAC3B,GAAI,UAAU,EAAE,eAAe,QAAA,IAAY,CAAA;AAAA,IAC3C,GAAI,wBAAwB,EAAE,0BAA0B,0BAA0B,CAAA;AAAA,EAAC,CACnF;AACF;AAQA,MAAM,2BAA2B;AAOjC,MAAM,+BAA+B;AACrC,MAAM,uCAAuC;AAQ7C,MAAM,sCAAsB,IAAA;AAE5B,MAAM,gBAAgB,CAAC,YAA2D;AACjF,MAAI,OAAO,gBAAgB,IAAI,OAAO;AACtC,MAAI,CAAC,MAAM;AACV,WAAOE,KAAAA,mBAAmB,IAAI,IAAI,OAAO,CAAC;AAC1C,oBAAgB,IAAI,SAAS,IAAI;AAAA,EAClC;AACA,SAAO;AACR;AAcO,MAAM,0BAA0B,OAAO,QAAgB,QAAwB,gBAAoD;AACzI,QAAM,UAAU,OAAO,SAAS;AAChC,MAAI,CAAC,SAAS;AACb,UAAM,IAAIH,mBAAAA,mBAAmB,iDAAiD;AAAA,EAC/E;AACA,QAAM,WAAW,OAAO,SAAS;AACjC,MAAI,OAAO,aAAa,YAAY,aAAa,IAAI;AAIpD,UAAM,IAAIA,mBAAAA,mBAAmB,2DAA2D;AAAA,EACzF;AACA,QAAM,cAAc,OAAO,OAAO,SAAS,iCAAiC,WACzE,OAAO,SAAS,+BAChB;AACH,QAAM,OAAO,cAAc,OAAO;AAClC,MAAI;AACJ,MAAI;AACH,UAAM,WAAW,MAAMI,eAAU,aAAa,MAAM;AAAA,MACnD,QAAQ,OAAO,SAAS;AAAA,MACxB,UAAU;AAAA;AAAA;AAAA,MAGV,YAAY,CAAC,WAAW;AAAA;AAAA;AAAA,MAGxB,aAAa;AAAA,MACb,gBAAgB,CAAC,KAAK;AAAA,MACtB,gBAAgB;AAAA,IAAA,CAChB;AACD,cAAU,SAAS;AAAA,EACpB,SAAS,GAAQ;AAChB,UAAM,IAAIJ,mBAAAA,mBAAmB,yBAAyB,GAAG,WAAW,qBAAqB,EAAE;AAAA,EAC5F;AAGA,MAAI,WAAW,SAAS;AACvB,UAAM,IAAIA,mBAAAA,mBAAmB,uCAAuC;AAAA,EACrE;AAEA,QAAM,SAAS,QAAQ;AACvB,QAAM,iBAAiB,OAAO,WAAW,YAAY,WAAW,QAAQ,4BAA6B;AACrG,MAAI,CAAC,gBAAgB;AACpB,UAAM,IAAIA,mBAAAA,mBAAmB,uDAAuD;AAAA,EACrF;AAEA,QAAM,MAAM,OAAO,QAAQ,QAAQ,WAAW,QAAQ,MAAM;AAC5D,QAAM,MAAM,OAAO,QAAQ,QAAQ,WAAW,QAAQ,MAAM;AAC5D,MAAI,CAAC,OAAO,CAAC,KAAK;AACjB,UAAM,IAAIA,mBAAAA,mBAAmB,8CAA8C;AAAA,EAC5E;AAEA,SAAO,EAAE,KAAK,IAAA;AACf;;;;;;;;"}