@hed-hog/core 0.0.373 → 0.0.375

package/dist/integration-profile/integration-profile.secrets.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"integration-profile.secrets.d.ts","sourceRoot":"","sources":["../../src/integration-profile/integration-profile.secrets.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,uBAAuB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAiC5D,CAAC;AAEF,+DAA+D;AAC/D,wBAAgB,sBAAsB,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,EAAE,CAErE"}
+{"version":3,"file":"integration-profile.secrets.d.ts","sourceRoot":"","sources":["../../src/integration-profile/integration-profile.secrets.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,uBAAuB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAqC5D,CAAC;AAEF,+DAA+D;AAC/D,wBAAgB,sBAAsB,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,EAAE,CAErE"}

package/dist/integration-profile/integration-profile.secrets.js

@@ -37,6 +37,10 @@ exports.INTEGRATION_SECRET_KEYS = {
     'microsoft-oauth': ['client_secret'],
     'facebook-oauth': ['client_secret'],
     'microsoft-entra-id-oauth': ['client_secret'],
+    // Apple has no static client_secret — the private_key signs a short-lived JWT
+    // client_secret at request time (see AppleProvider), so private_key is the secret.
+    'apple-oauth': ['private_key'],
+    'linkedin-oauth': ['client_secret'],
     // Pagamento
     stripe: ['secret_key', 'webhook_secret'],
     mercado_pago: ['access_token', 'webhook_secret'],

package/dist/integration-profile/integration-profile.secrets.js.map

@@ -1 +1 @@
-{"version":3,"file":"integration-profile.secrets.js","sourceRoot":"","sources":["../../src/integration-profile/integration-profile.secrets.ts"],"names":[],"mappings":";;;AAgDA,wDAEC;AAlDD;;;;;;;;;;;GAWG;AACU,QAAA,uBAAuB,GAA6B;IAC/D,QAAQ;IACR,IAAI,EAAE,CAAC,UAAU,CAAC;IAClB,KAAK,EAAE,CAAC,eAAe,EAAE,eAAe,CAAC;IACzC,GAAG,EAAE,CAAC,mBAAmB,CAAC;IAC1B,aAAa;IACb,eAAe,EAAE,CAAC,OAAO,CAAC;IAC1B,mBAAmB,EAAE,CAAC,cAAc,CAAC;IACrC,UAAU;IACV,EAAE,EAAE,CAAC,mBAAmB,CAAC;IACzB,GAAG,EAAE,CAAC,eAAe,CAAC;IACtB,YAAY,EAAE,CAAC,KAAK,CAAC;IACrB,eAAe,EAAE,CAAC,mBAAmB,CAAC;IACtC,KAAK;IACL,MAAM,EAAE,CAAC,SAAS,CAAC;IACnB,MAAM,EAAE,CAAC,SAAS,CAAC;IACnB,MAAM,EAAE,CAAC,SAAS,CAAC;IACnB,QAAQ;IACR,cAAc,EAAE,CAAC,eAAe,CAAC;IACjC,cAAc,EAAE,CAAC,eAAe,CAAC;IACjC,iBAAiB,EAAE,CAAC,eAAe,CAAC;IACpC,gBAAgB,EAAE,CAAC,eAAe,CAAC;IACnC,0BAA0B,EAAE,CAAC,eAAe,CAAC;IAC7C,YAAY;IACZ,MAAM,EAAE,CAAC,YAAY,EAAE,gBAAgB,CAAC;IACxC,YAAY,EAAE,CAAC,cAAc,EAAE,gBAAgB,CAAC;IAChD,UAAU;IACV,SAAS,EAAE,CAAC,YAAY,CAAC;IACzB,sBAAsB,EAAE,CAAC,YAAY,CAAC;IACtC,MAAM,EAAE,CAAC,UAAU,CAAC;IACpB,+BAA+B;IAC/B,YAAY,EAAE,CAAC,WAAW,CAAC;IAC3B,UAAU,EAAE,CAAC,OAAO,EAAE,SAAS,CAAC;CACjC,CAAC;AAEF,+DAA+D;AAC/D,SAAgB,sBAAsB,CAAC,YAAoB;;IACzD,OAAO,MAAA,+BAAuB,CAAC,YAAY,CAAC,WAAW,EAAE,CAAC,mCAAI,EAAE,CAAC;AACnE,CAAC"}
+{"version":3,"file":"integration-profile.secrets.js","sourceRoot":"","sources":["../../src/integration-profile/integration-profile.secrets.ts"],"names":[],"mappings":";;;AAoDA,wDAEC;AAtDD;;;;;;;;;;;GAWG;AACU,QAAA,uBAAuB,GAA6B;IAC/D,QAAQ;IACR,IAAI,EAAE,CAAC,UAAU,CAAC;IAClB,KAAK,EAAE,CAAC,eAAe,EAAE,eAAe,CAAC;IACzC,GAAG,EAAE,CAAC,mBAAmB,CAAC;IAC1B,aAAa;IACb,eAAe,EAAE,CAAC,OAAO,CAAC;IAC1B,mBAAmB,EAAE,CAAC,cAAc,CAAC;IACrC,UAAU;IACV,EAAE,EAAE,CAAC,mBAAmB,CAAC;IACzB,GAAG,EAAE,CAAC,eAAe,CAAC;IACtB,YAAY,EAAE,CAAC,KAAK,CAAC;IACrB,eAAe,EAAE,CAAC,mBAAmB,CAAC;IACtC,KAAK;IACL,MAAM,EAAE,CAAC,SAAS,CAAC;IACnB,MAAM,EAAE,CAAC,SAAS,CAAC;IACnB,MAAM,EAAE,CAAC,SAAS,CAAC;IACnB,QAAQ;IACR,cAAc,EAAE,CAAC,eAAe,CAAC;IACjC,cAAc,EAAE,CAAC,eAAe,CAAC;IACjC,iBAAiB,EAAE,CAAC,eAAe,CAAC;IACpC,gBAAgB,EAAE,CAAC,eAAe,CAAC;IACnC,0BAA0B,EAAE,CAAC,eAAe,CAAC;IAC7C,8EAA8E;IAC9E,mFAAmF;IACnF,aAAa,EAAE,CAAC,aAAa,CAAC;IAC9B,gBAAgB,EAAE,CAAC,eAAe,CAAC;IACnC,YAAY;IACZ,MAAM,EAAE,CAAC,YAAY,EAAE,gBAAgB,CAAC;IACxC,YAAY,EAAE,CAAC,cAAc,EAAE,gBAAgB,CAAC;IAChD,UAAU;IACV,SAAS,EAAE,CAAC,YAAY,CAAC;IACzB,sBAAsB,EAAE,CAAC,YAAY,CAAC;IACtC,MAAM,EAAE,CAAC,UAAU,CAAC;IACpB,+BAA+B;IAC/B,YAAY,EAAE,CAAC,WAAW,CAAC;IAC3B,UAAU,EAAE,CAAC,OAAO,EAAE,SAAS,CAAC;CACjC,CAAC;AAEF,+DAA+D;AAC/D,SAAgB,sBAAsB,CAAC,YAAoB;;IACzD,OAAO,MAAA,+BAAuB,CAAC,YAAY,CAAC,WAAW,EAAE,CAAC,mCAAI,EAAE,CAAC;AACnE,CAAC"}

package/dist/integration-profile/integration-profile.utils.d.ts

@@ -21,6 +21,12 @@ export declare function buildOAuthConfigFromIntegration(_providerSlug: string, c
     clientId: string;
     clientSecret: string;
     tenantId?: string;
+    /** Apple Developer Team ID (Sign in with Apple). */
+    teamId?: string;
+    /** Key ID of the .p8 private key registered for Sign in with Apple. */
+    keyId?: string;
+    /** EC private key (PEM, .p8 contents) used to sign Apple's client_secret JWT. */
+    privateKey?: string;
 };
 export type DigitalOceanConfig = {
     apiToken: string;

package/dist/integration-profile/integration-profile.utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"integration-profile.utils.d.ts","sourceRoot":"","sources":["../../src/integration-profile/integration-profile.utils.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,MAAM,gCAAgC,CAAC;AAI9D,wBAAgB,8BAA8B,CAC5C,YAAY,EAAE,MAAM,EACpB,MAAM,EAAE,OAAO,GACd,GAAG,CAmCL;AAED,wBAAgB,cAAc,CAAC,MAAM,EAAE,OAAO,GAAG,MAAM,CAKtD;AAED,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAMrE;AAID;;;;;;;;GAQG;AACH,wBAAgB,iCAAiC,CAC/C,YAAY,EAAE,MAAM,EACpB,MAAM,EAAE,OAAO,GACd,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAqCxB;AAED,sDAAsD;AACtD,wBAAgB,0BAA0B,CAAC,YAAY,EAAE,MAAM,GAAG,YAAY,CAU7E;AAED,kFAAkF;AAClF,wBAAgB,uBAAuB,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAMpE;AAMD,2EAA2E;AAC3E,wBAAgB,+BAA+B,CAC7C,aAAa,EAAE,MAAM,EACrB,MAAM,EAAE,OAAO,GACd;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,CAO/D;AAID,MAAM,MAAM,kBAAkB,GAAG;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,eAAe,EAAE,MAAM,CAAC;IACxB,iBAAiB,EAAE,MAAM,CAAC;CAC3B,CAAC;AAEF,2FAA2F;AAC3F,wBAAgB,sCAAsC,CACpD,YAAY,EAAE,MAAM,EACpB,MAAM,EAAE,OAAO,GACd,kBAAkB,CAcpB;AAED,MAAM,MAAM,gBAAgB,GAAG;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,6FAA6F;AAC7F,wBAAgB,oCAAoC,CAClD,YAAY,EAAE,MAAM,EACpB,MAAM,EAAE,OAAO,GACd,gBAAgB,CAalB;AAID,sGAAsG;AACtG,wBAAgB,4BAA4B,CAC1C,YAAY,EAAE,MAAM,EACpB,MAAM,EAAE,OAAO,GACd;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAA;CAAE,CAc3C"}
+{"version":3,"file":"integration-profile.utils.d.ts","sourceRoot":"","sources":["../../src/integration-profile/integration-profile.utils.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,MAAM,gCAAgC,CAAC;AAI9D,wBAAgB,8BAA8B,CAC5C,YAAY,EAAE,MAAM,EACpB,MAAM,EAAE,OAAO,GACd,GAAG,CAmCL;AAED,wBAAgB,cAAc,CAAC,MAAM,EAAE,OAAO,GAAG,MAAM,CAKtD;AAED,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAMrE;AAID;;;;;;;;GAQG;AACH,wBAAgB,iCAAiC,CAC/C,YAAY,EAAE,MAAM,EACpB,MAAM,EAAE,OAAO,GACd,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAqCxB;AAED,sDAAsD;AACtD,wBAAgB,0BAA0B,CAAC,YAAY,EAAE,MAAM,GAAG,YAAY,CAU7E;AAED,kFAAkF;AAClF,wBAAgB,uBAAuB,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAMpE;AAMD,2EAA2E;AAC3E,wBAAgB,+BAA+B,CAC7C,aAAa,EAAE,MAAM,EACrB,MAAM,EAAE,OAAO,GACd;IACD,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,oDAAoD;IACpD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,uEAAuE;IACvE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,iFAAiF;IACjF,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,CAUA;AAID,MAAM,MAAM,kBAAkB,GAAG;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,eAAe,EAAE,MAAM,CAAC;IACxB,iBAAiB,EAAE,MAAM,CAAC;CAC3B,CAAC;AAEF,2FAA2F;AAC3F,wBAAgB,sCAAsC,CACpD,YAAY,EAAE,MAAM,EACpB,MAAM,EAAE,OAAO,GACd,kBAAkB,CAcpB;AAED,MAAM,MAAM,gBAAgB,GAAG;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,6FAA6F;AAC7F,wBAAgB,oCAAoC,CAClD,YAAY,EAAE,MAAM,EACpB,MAAM,EAAE,OAAO,GACd,gBAAgB,CAalB;AAID,sGAAsG;AACtG,wBAAgB,4BAA4B,CAC1C,YAAY,EAAE,MAAM,EACpB,MAAM,EAAE,OAAO,GACd;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAA;CAAE,CAc3C"}

package/dist/integration-profile/integration-profile.utils.js

@@ -138,7 +138,7 @@ function resolveFileProviderSlug(providerSlug) {
 function buildOAuthConfigFromIntegration(_providerSlug, config) {
     var _a, _b, _c;
     const cfg = (_a = config) !== null && _a !== void 0 ? _a : {};
-    return Object.assign({ clientId: String((_b = cfg.client_id) !== null && _b !== void 0 ? _b : ''), clientSecret: String((_c = cfg.client_secret) !== null && _c !== void 0 ? _c : '') }, (cfg.tenant_id ? { tenantId: String(cfg.tenant_id) } : {}));
+    return Object.assign(Object.assign(Object.assign(Object.assign({ clientId: String((_b = cfg.client_id) !== null && _b !== void 0 ? _b : ''), clientSecret: String((_c = cfg.client_secret) !== null && _c !== void 0 ? _c : '') }, (cfg.tenant_id ? { tenantId: String(cfg.tenant_id) } : {})), (cfg.team_id ? { teamId: String(cfg.team_id) } : {})), (cfg.key_id ? { keyId: String(cfg.key_id) } : {})), (cfg.private_key ? { privateKey: String(cfg.private_key) } : {}));
 }
 /** Maps an integration_profile config JSON to the DigitalOcean API credentials/targets. */
 function buildDigitalOceanConfigFromIntegration(providerSlug, config) {

package/dist/integration-profile/integration-profile.utils.js.map

@@ -1 +1 @@
-{"version":3,"file":"integration-profile.utils.js","sourceRoot":"","sources":["../../src/integration-profile/integration-profile.utils.ts"],"names":[],"mappings":";;AAKA,wEAsCC;AAED,wCAKC;AAED,8CAMC;AAaD,8EAwCC;AAGD,gEAUC;AAGD,0DAMC;AAOD,0EAUC;AAaD,wFAiBC;AAUD,oFAgBC;AAKD,oEAiBC;AApOD,2CAAqD;AACrD,kEAA8D;AAI9D,SAAgB,8BAA8B,CAC5C,YAAoB,EACpB,MAAe;;IAEf,MAAM,GAAG,GAAG,MAAC,MAAc,mCAAI,EAAE,CAAC;IAElC,QAAQ,YAAY,CAAC,WAAW,EAAE,EAAE,CAAC;QACnC,KAAK,MAAM;YACT,OAAO;gBACL,MAAM,EAAE,IAAI;gBACZ,IAAI,EAAE,MAAe;gBACrB,IAAI,EAAE,MAAM,CAAC,MAAA,GAAG,CAAC,IAAI,mCAAI,EAAE,CAAC;gBAC5B,IAAI,EAAE,MAAM,CAAC,MAAA,GAAG,CAAC,IAAI,mCAAI,GAAG,CAAC;gBAC7B,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC;gBAC3B,QAAQ,EAAE,MAAM,CAAC,MAAA,GAAG,CAAC,QAAQ,mCAAI,EAAE,CAAC;gBACpC,QAAQ,EAAE,MAAM,CAAC,MAAA,GAAG,CAAC,QAAQ,mCAAI,EAAE,CAAC;aACrC,CAAC;QACJ,KAAK,OAAO;YACV,OAAO;gBACL,MAAM,EAAE,IAAI;gBACZ,IAAI,EAAE,OAAgB;gBACtB,QAAQ,EAAE,MAAM,CAAC,MAAA,GAAG,CAAC,SAAS,mCAAI,EAAE,CAAC;gBACrC,YAAY,EAAE,MAAM,CAAC,MAAA,GAAG,CAAC,aAAa,mCAAI,EAAE,CAAC;gBAC7C,YAAY,EAAE,MAAM,CAAC,MAAA,GAAG,CAAC,aAAa,mCAAI,EAAE,CAAC;gBAC7C,IAAI,EAAE,MAAM,CAAC,MAAA,GAAG,CAAC,UAAU,mCAAI,EAAE,CAAC;aACnC,CAAC;QACJ,KAAK,KAAK;YACR,OAAO;gBACL,MAAM,EAAE,IAAI;gBACZ,IAAI,EAAE,KAAc;gBACpB,MAAM,EAAE,MAAM,CAAC,MAAA,GAAG,CAAC,MAAM,mCAAI,EAAE,CAAC;gBAChC,WAAW,EAAE,MAAM,CAAC,MAAA,GAAG,CAAC,aAAa,mCAAI,EAAE,CAAC;gBAC5C,eAAe,EAAE,MAAM,CAAC,MAAA,GAAG,CAAC,iBAAiB,mCAAI,EAAE,CAAC;gBACpD,IAAI,EAAE,MAAM,CAAC,MAAA,GAAG,CAAC,UAAU,mCAAI,EAAE,CAAC;aACnC,CAAC;QACJ;YACE,MAAM,IAAI,4BAAmB,CAAC,8BAA8B,YAAY,EAAE,CAAC,CAAC;IAChF,CAAC;AACH,CAAC;AAED,SAAgB,cAAc,CAAC,MAAe;;IAC5C,MAAM,GAAG,GAAG,MAAC,MAAc,mCAAI,EAAE,CAAC;IAClC,MAAM,SAAS,GAAG,MAAM,CAAC,MAAA,GAAG,CAAC,UAAU,mCAAI,EAAE,CAAC,CAAC;IAC/C,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAA,GAAG,CAAC,SAAS,mCAAI,EAAE,CAAC,CAAC;IAC7C,OAAO,QAAQ,CAAC,CAAC,CAAC,GAAG,QAAQ,KAAK,SAAS,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;AAC7D,CAAC;AAED,SAAgB,iBAAiB,CAAC,MAAe;;IAC/C,MAAM,GAAG,GAAG,MAAC,MAAc,mCAAI,EAAE,CAAC;IAClC,MAAM,YAAY,GAAG,MAAM,CAAC,MAAA,GAAG,CAAC,cAAc,mCAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC7D,IAAI,CAAC,YAAY;QAAE,OAAO,SAAS,CAAC;IACpC,MAAM,WAAW,GAAG,MAAM,CAAC,MAAA,GAAG,CAAC,aAAa,mCAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC3D,OAAO,WAAW,CAAC,CAAC,CAAC,GAAG,WAAW,KAAK,YAAY,GAAG,CAAC,CAAC,CAAC,YAAY,CAAC;AACzE,CAAC;AAED,iFAAiF;AAEjF;;;;;;;;GAQG;AACH,SAAgB,iCAAiC,CAC/C,YAAoB,EACpB,MAAe;;IAEf,MAAM,GAAG,GAAG,MAAC,MAAc,mCAAI,EAAE,CAAC;IAElC,QAAQ,YAAY,CAAC,WAAW,EAAE,EAAE,CAAC;QACnC,KAAK,OAAO;YACV,OAAO;gBACL,oBAAoB,EAAE,MAAM,CAAC,MAAA,GAAG,CAAC,SAAS,mCAAI,SAAS,CAAC;aACzD,CAAC;QACJ,KAAK,IAAI;YACP,OAAO;gBACL,gBAAgB,EAAE,MAAM,CAAC,MAAA,GAAG,CAAC,aAAa,mCAAI,EAAE,CAAC;gBACjD,mBAAmB,EAAE,MAAM,CAAC,MAAA,GAAG,CAAC,iBAAiB,mCAAI,EAAE,CAAC;gBACxD,mBAAmB,EAAE,MAAM,CAAC,MAAA,GAAG,CAAC,MAAM,mCAAI,WAAW,CAAC;gBACtD,mBAAmB,EAAE,MAAM,CAAC,MAAA,GAAG,CAAC,MAAM,mCAAI,EAAE,CAAC;aAC9C,CAAC;QACJ,KAAK,KAAK;YACR,OAAO;gBACL,qBAAqB,EAAE,MAAM,CAAC,MAAA,GAAG,CAAC,aAAa,mCAAI,EAAE,CAAC;gBACtD,oBAAoB,EAAE,MAAM,CAAC,MAAA,GAAG,CAAC,MAAM,mCAAI,EAAE,CAAC;aAC/C,CAAC;QACJ,KAAK,YAAY;YACf,OAAO;gBACL,qBAAqB,EAAE,MAAM,CAAC,MAAA,GAAG,CAAC,OAAO,mCAAI,EAAE,CAAC;gBAChD,iBAAiB,EAAE,MAAM,CAAC,MAAA,GAAG,CAAC,GAAG,mCAAI,EAAE,CAAC;gBACxC,uBAAuB,EAAE,MAAM,CAAC,MAAA,GAAG,CAAC,SAAS,mCAAI,EAAE,CAAC;aACrD,CAAC;QACJ,KAAK,eAAe;YAClB,OAAO;gBACL,oBAAoB,EAAE,MAAM,CAAC,MAAA,GAAG,CAAC,aAAa,mCAAI,EAAE,CAAC;gBACrD,uBAAuB,EAAE,MAAM,CAAC,MAAA,GAAG,CAAC,iBAAiB,mCAAI,EAAE,CAAC;gBAC5D,uBAAuB,EAAE,MAAM,CAAC,MAAA,GAAG,CAAC,MAAM,mCAAI,EAAE,CAAC;gBACjD,uBAAuB,EAAE,MAAM,CAAC,MAAA,GAAG,CAAC,MAAM,mCAAI,EAAE,CAAC;gBACjD,oBAAoB,EAAE,MAAM,CAAC,MAAA,GAAG,CAAC,QAAQ,mCAAI,EAAE,CAAC;aACjD,CAAC;QACJ;YACE,MAAM,IAAI,4BAAmB,CAAC,iCAAiC,YAAY,EAAE,CAAC,CAAC;IACnF,CAAC;AACH,CAAC;AAED,sDAAsD;AACtD,SAAgB,0BAA0B,CAAC,YAAoB;IAC7D,QAAQ,YAAY,CAAC,WAAW,EAAE,EAAE,CAAC;QACnC,KAAK,OAAO,CAAC,CAAC,OAAO,4BAAY,CAAC,KAAK,CAAC;QACxC,KAAK,IAAI,CAAC,CAAC,OAAO,4BAAY,CAAC,EAAE,CAAC;QAClC,KAAK,KAAK,CAAC,CAAC,OAAO,4BAAY,CAAC,GAAG,CAAC;QACpC,KAAK,YAAY,CAAC,CAAC,OAAO,4BAAY,CAAC,KAAK,CAAC;QAC7C,KAAK,eAAe,CAAC,CAAC,OAAO,4BAAY,CAAC,MAAM,CAAC;QACjD;YACE,MAAM,IAAI,4BAAmB,CAAC,iCAAiC,YAAY,EAAE,CAAC,CAAC;IACnF,CAAC;AACH,CAAC;AAED,kFAAkF;AAClF,SAAgB,uBAAuB,CAAC,YAAoB;IAC1D,QAAQ,YAAY,CAAC,WAAW,EAAE,EAAE,CAAC;QACnC,KAAK,YAAY,CAAC,CAAC,OAAO,KAAK,CAAC;QAChC,KAAK,eAAe,CAAC,CAAC,OAAO,QAAQ,CAAC;QACtC,OAAO,CAAC,CAAC,OAAO,YAAY,CAAC,WAAW,EAAE,CAAC;IAC7C,CAAC;AACH,CAAC;AAED,iFAAiF;AAEjF,iFAAiF;AAEjF,2EAA2E;AAC3E,SAAgB,+BAA+B,CAC7C,aAAqB,EACrB,MAAe;;IAEf,MAAM,GAAG,GAAG,MAAC,MAAc,mCAAI,EAAE,CAAC;IAClC,uBACE,QAAQ,EAAE,MAAM,CAAC,MAAA,GAAG,CAAC,SAAS,mCAAI,EAAE,CAAC,EACrC,YAAY,EAAE,MAAM,CAAC,MAAA,GAAG,CAAC,aAAa,mCAAI,EAAE,CAAC,IAC1C,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAC7D;AACJ,CAAC;AAYD,2FAA2F;AAC3F,SAAgB,sCAAsC,CACpD,YAAoB,EACpB,MAAe;;IAEf,IAAI,YAAY,CAAC,WAAW,EAAE,KAAK,cAAc,EAAE,CAAC;QAClD,MAAM,IAAI,4BAAmB,CAC3B,wCAAwC,YAAY,EAAE,CACvD,CAAC;IACJ,CAAC;IACD,MAAM,GAAG,GAAG,MAAC,MAAc,mCAAI,EAAE,CAAC;IAClC,OAAO;QACL,QAAQ,EAAE,MAAM,CAAC,MAAA,GAAG,CAAC,SAAS,mCAAI,EAAE,CAAC;QACrC,SAAS,EAAE,MAAM,CAAC,MAAA,GAAG,CAAC,UAAU,mCAAI,EAAE,CAAC;QACvC,MAAM,EAAE,MAAM,CAAC,MAAA,GAAG,CAAC,MAAM,mCAAI,EAAE,CAAC;QAChC,eAAe,EAAE,MAAM,CAAC,MAAA,GAAG,CAAC,kBAAkB,mCAAI,EAAE,CAAC;QACrD,iBAAiB,EAAE,MAAM,CAAC,MAAA,GAAG,CAAC,oBAAoB,mCAAI,EAAE,CAAC;KAC1D,CAAC;AACJ,CAAC;AASD,6FAA6F;AAC7F,SAAgB,oCAAoC,CAClD,YAAoB,EACpB,MAAe;;IAEf,IAAI,YAAY,CAAC,WAAW,EAAE,KAAK,YAAY,EAAE,CAAC;QAChD,MAAM,IAAI,4BAAmB,CAC3B,wCAAwC,YAAY,EAAE,CACvD,CAAC;IACJ,CAAC;IACD,MAAM,GAAG,GAAG,MAAC,MAAc,mCAAI,EAAE,CAAC;IAClC,OAAO;QACL,SAAS,EAAE,MAAM,CAAC,MAAA,GAAG,CAAC,UAAU,mCAAI,EAAE,CAAC;QACvC,KAAK,EAAE,MAAM,CAAC,MAAA,GAAG,CAAC,KAAK,mCAAI,EAAE,CAAC;QAC9B,MAAM,EAAE,MAAM,CAAC,MAAA,GAAG,CAAC,OAAO,mCAAI,EAAE,CAAC;QACjC,SAAS,EAAE,MAAM,CAAC,MAAA,GAAG,CAAC,SAAS,mCAAI,OAAO,CAAC;KAC5C,CAAC;AACJ,CAAC;AAED,iFAAiF;AAEjF,sGAAsG;AACtG,SAAgB,4BAA4B,CAC1C,YAAoB,EACpB,MAAe;;IAEf,MAAM,GAAG,GAAG,MAAC,MAAc,mCAAI,EAAE,CAAC;IAClC,QAAQ,YAAY,CAAC,WAAW,EAAE,EAAE,CAAC;QACnC,KAAK,QAAQ;YACX,uBACE,MAAM,EAAE,MAAM,CAAC,MAAA,GAAG,CAAC,OAAO,mCAAI,EAAE,CAAC,IAC9B,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EACvE;QACJ,KAAK,QAAQ,CAAC;QACd,KAAK,QAAQ;YACX,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAA,GAAG,CAAC,OAAO,mCAAI,EAAE,CAAC,EAAE,CAAC;QAC/C;YACE,MAAM,IAAI,4BAAmB,CAAC,4BAA4B,YAAY,EAAE,CAAC,CAAC;IAC9E,CAAC;AACH,CAAC"}
+{"version":3,"file":"integration-profile.utils.js","sourceRoot":"","sources":["../../src/integration-profile/integration-profile.utils.ts"],"names":[],"mappings":";;AAKA,wEAsCC;AAED,wCAKC;AAED,8CAMC;AAaD,8EAwCC;AAGD,gEAUC;AAGD,0DAMC;AAOD,0EAuBC;AAaD,wFAiBC;AAUD,oFAgBC;AAKD,oEAiBC;AAjPD,2CAAqD;AACrD,kEAA8D;AAI9D,SAAgB,8BAA8B,CAC5C,YAAoB,EACpB,MAAe;;IAEf,MAAM,GAAG,GAAG,MAAC,MAAc,mCAAI,EAAE,CAAC;IAElC,QAAQ,YAAY,CAAC,WAAW,EAAE,EAAE,CAAC;QACnC,KAAK,MAAM;YACT,OAAO;gBACL,MAAM,EAAE,IAAI;gBACZ,IAAI,EAAE,MAAe;gBACrB,IAAI,EAAE,MAAM,CAAC,MAAA,GAAG,CAAC,IAAI,mCAAI,EAAE,CAAC;gBAC5B,IAAI,EAAE,MAAM,CAAC,MAAA,GAAG,CAAC,IAAI,mCAAI,GAAG,CAAC;gBAC7B,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC;gBAC3B,QAAQ,EAAE,MAAM,CAAC,MAAA,GAAG,CAAC,QAAQ,mCAAI,EAAE,CAAC;gBACpC,QAAQ,EAAE,MAAM,CAAC,MAAA,GAAG,CAAC,QAAQ,mCAAI,EAAE,CAAC;aACrC,CAAC;QACJ,KAAK,OAAO;YACV,OAAO;gBACL,MAAM,EAAE,IAAI;gBACZ,IAAI,EAAE,OAAgB;gBACtB,QAAQ,EAAE,MAAM,CAAC,MAAA,GAAG,CAAC,SAAS,mCAAI,EAAE,CAAC;gBACrC,YAAY,EAAE,MAAM,CAAC,MAAA,GAAG,CAAC,aAAa,mCAAI,EAAE,CAAC;gBAC7C,YAAY,EAAE,MAAM,CAAC,MAAA,GAAG,CAAC,aAAa,mCAAI,EAAE,CAAC;gBAC7C,IAAI,EAAE,MAAM,CAAC,MAAA,GAAG,CAAC,UAAU,mCAAI,EAAE,CAAC;aACnC,CAAC;QACJ,KAAK,KAAK;YACR,OAAO;gBACL,MAAM,EAAE,IAAI;gBACZ,IAAI,EAAE,KAAc;gBACpB,MAAM,EAAE,MAAM,CAAC,MAAA,GAAG,CAAC,MAAM,mCAAI,EAAE,CAAC;gBAChC,WAAW,EAAE,MAAM,CAAC,MAAA,GAAG,CAAC,aAAa,mCAAI,EAAE,CAAC;gBAC5C,eAAe,EAAE,MAAM,CAAC,MAAA,GAAG,CAAC,iBAAiB,mCAAI,EAAE,CAAC;gBACpD,IAAI,EAAE,MAAM,CAAC,MAAA,GAAG,CAAC,UAAU,mCAAI,EAAE,CAAC;aACnC,CAAC;QACJ;YACE,MAAM,IAAI,4BAAmB,CAAC,8BAA8B,YAAY,EAAE,CAAC,CAAC;IAChF,CAAC;AACH,CAAC;AAED,SAAgB,cAAc,CAAC,MAAe;;IAC5C,MAAM,GAAG,GAAG,MAAC,MAAc,mCAAI,EAAE,CAAC;IAClC,MAAM,SAAS,GAAG,MAAM,CAAC,MAAA,GAAG,CAAC,UAAU,mCAAI,EAAE,CAAC,CAAC;IAC/C,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAA,GAAG,CAAC,SAAS,mCAAI,EAAE,CAAC,CAAC;IAC7C,OAAO,QAAQ,CAAC,CAAC,CAAC,GAAG,QAAQ,KAAK,SAAS,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;AAC7D,CAAC;AAED,SAAgB,iBAAiB,CAAC,MAAe;;IAC/C,MAAM,GAAG,GAAG,MAAC,MAAc,mCAAI,EAAE,CAAC;IAClC,MAAM,YAAY,GAAG,MAAM,CAAC,MAAA,GAAG,CAAC,cAAc,mCAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC7D,IAAI,CAAC,YAAY;QAAE,OAAO,SAAS,CAAC;IACpC,MAAM,WAAW,GAAG,MAAM,CAAC,MAAA,GAAG,CAAC,aAAa,mCAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC3D,OAAO,WAAW,CAAC,CAAC,CAAC,GAAG,WAAW,KAAK,YAAY,GAAG,CAAC,CAAC,CAAC,YAAY,CAAC;AACzE,CAAC;AAED,iFAAiF;AAEjF;;;;;;;;GAQG;AACH,SAAgB,iCAAiC,CAC/C,YAAoB,EACpB,MAAe;;IAEf,MAAM,GAAG,GAAG,MAAC,MAAc,mCAAI,EAAE,CAAC;IAElC,QAAQ,YAAY,CAAC,WAAW,EAAE,EAAE,CAAC;QACnC,KAAK,OAAO;YACV,OAAO;gBACL,oBAAoB,EAAE,MAAM,CAAC,MAAA,GAAG,CAAC,SAAS,mCAAI,SAAS,CAAC;aACzD,CAAC;QACJ,KAAK,IAAI;YACP,OAAO;gBACL,gBAAgB,EAAE,MAAM,CAAC,MAAA,GAAG,CAAC,aAAa,mCAAI,EAAE,CAAC;gBACjD,mBAAmB,EAAE,MAAM,CAAC,MAAA,GAAG,CAAC,iBAAiB,mCAAI,EAAE,CAAC;gBACxD,mBAAmB,EAAE,MAAM,CAAC,MAAA,GAAG,CAAC,MAAM,mCAAI,WAAW,CAAC;gBACtD,mBAAmB,EAAE,MAAM,CAAC,MAAA,GAAG,CAAC,MAAM,mCAAI,EAAE,CAAC;aAC9C,CAAC;QACJ,KAAK,KAAK;YACR,OAAO;gBACL,qBAAqB,EAAE,MAAM,CAAC,MAAA,GAAG,CAAC,aAAa,mCAAI,EAAE,CAAC;gBACtD,oBAAoB,EAAE,MAAM,CAAC,MAAA,GAAG,CAAC,MAAM,mCAAI,EAAE,CAAC;aAC/C,CAAC;QACJ,KAAK,YAAY;YACf,OAAO;gBACL,qBAAqB,EAAE,MAAM,CAAC,MAAA,GAAG,CAAC,OAAO,mCAAI,EAAE,CAAC;gBAChD,iBAAiB,EAAE,MAAM,CAAC,MAAA,GAAG,CAAC,GAAG,mCAAI,EAAE,CAAC;gBACxC,uBAAuB,EAAE,MAAM,CAAC,MAAA,GAAG,CAAC,SAAS,mCAAI,EAAE,CAAC;aACrD,CAAC;QACJ,KAAK,eAAe;YAClB,OAAO;gBACL,oBAAoB,EAAE,MAAM,CAAC,MAAA,GAAG,CAAC,aAAa,mCAAI,EAAE,CAAC;gBACrD,uBAAuB,EAAE,MAAM,CAAC,MAAA,GAAG,CAAC,iBAAiB,mCAAI,EAAE,CAAC;gBAC5D,uBAAuB,EAAE,MAAM,CAAC,MAAA,GAAG,CAAC,MAAM,mCAAI,EAAE,CAAC;gBACjD,uBAAuB,EAAE,MAAM,CAAC,MAAA,GAAG,CAAC,MAAM,mCAAI,EAAE,CAAC;gBACjD,oBAAoB,EAAE,MAAM,CAAC,MAAA,GAAG,CAAC,QAAQ,mCAAI,EAAE,CAAC;aACjD,CAAC;QACJ;YACE,MAAM,IAAI,4BAAmB,CAAC,iCAAiC,YAAY,EAAE,CAAC,CAAC;IACnF,CAAC;AACH,CAAC;AAED,sDAAsD;AACtD,SAAgB,0BAA0B,CAAC,YAAoB;IAC7D,QAAQ,YAAY,CAAC,WAAW,EAAE,EAAE,CAAC;QACnC,KAAK,OAAO,CAAC,CAAC,OAAO,4BAAY,CAAC,KAAK,CAAC;QACxC,KAAK,IAAI,CAAC,CAAC,OAAO,4BAAY,CAAC,EAAE,CAAC;QAClC,KAAK,KAAK,CAAC,CAAC,OAAO,4BAAY,CAAC,GAAG,CAAC;QACpC,KAAK,YAAY,CAAC,CAAC,OAAO,4BAAY,CAAC,KAAK,CAAC;QAC7C,KAAK,eAAe,CAAC,CAAC,OAAO,4BAAY,CAAC,MAAM,CAAC;QACjD;YACE,MAAM,IAAI,4BAAmB,CAAC,iCAAiC,YAAY,EAAE,CAAC,CAAC;IACnF,CAAC;AACH,CAAC;AAED,kFAAkF;AAClF,SAAgB,uBAAuB,CAAC,YAAoB;IAC1D,QAAQ,YAAY,CAAC,WAAW,EAAE,EAAE,CAAC;QACnC,KAAK,YAAY,CAAC,CAAC,OAAO,KAAK,CAAC;QAChC,KAAK,eAAe,CAAC,CAAC,OAAO,QAAQ,CAAC;QACtC,OAAO,CAAC,CAAC,OAAO,YAAY,CAAC,WAAW,EAAE,CAAC;IAC7C,CAAC;AACH,CAAC;AAED,iFAAiF;AAEjF,iFAAiF;AAEjF,2EAA2E;AAC3E,SAAgB,+BAA+B,CAC7C,aAAqB,EACrB,MAAe;;IAYf,MAAM,GAAG,GAAG,MAAC,MAAc,mCAAI,EAAE,CAAC;IAClC,iEACE,QAAQ,EAAE,MAAM,CAAC,MAAA,GAAG,CAAC,SAAS,mCAAI,EAAE,CAAC,EACrC,YAAY,EAAE,MAAM,CAAC,MAAA,GAAG,CAAC,aAAa,mCAAI,EAAE,CAAC,IAC1C,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,GAC1D,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,GACpD,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,GACjD,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EACnE;AACJ,CAAC;AAYD,2FAA2F;AAC3F,SAAgB,sCAAsC,CACpD,YAAoB,EACpB,MAAe;;IAEf,IAAI,YAAY,CAAC,WAAW,EAAE,KAAK,cAAc,EAAE,CAAC;QAClD,MAAM,IAAI,4BAAmB,CAC3B,wCAAwC,YAAY,EAAE,CACvD,CAAC;IACJ,CAAC;IACD,MAAM,GAAG,GAAG,MAAC,MAAc,mCAAI,EAAE,CAAC;IAClC,OAAO;QACL,QAAQ,EAAE,MAAM,CAAC,MAAA,GAAG,CAAC,SAAS,mCAAI,EAAE,CAAC;QACrC,SAAS,EAAE,MAAM,CAAC,MAAA,GAAG,CAAC,UAAU,mCAAI,EAAE,CAAC;QACvC,MAAM,EAAE,MAAM,CAAC,MAAA,GAAG,CAAC,MAAM,mCAAI,EAAE,CAAC;QAChC,eAAe,EAAE,MAAM,CAAC,MAAA,GAAG,CAAC,kBAAkB,mCAAI,EAAE,CAAC;QACrD,iBAAiB,EAAE,MAAM,CAAC,MAAA,GAAG,CAAC,oBAAoB,mCAAI,EAAE,CAAC;KAC1D,CAAC;AACJ,CAAC;AASD,6FAA6F;AAC7F,SAAgB,oCAAoC,CAClD,YAAoB,EACpB,MAAe;;IAEf,IAAI,YAAY,CAAC,WAAW,EAAE,KAAK,YAAY,EAAE,CAAC;QAChD,MAAM,IAAI,4BAAmB,CAC3B,wCAAwC,YAAY,EAAE,CACvD,CAAC;IACJ,CAAC;IACD,MAAM,GAAG,GAAG,MAAC,MAAc,mCAAI,EAAE,CAAC;IAClC,OAAO;QACL,SAAS,EAAE,MAAM,CAAC,MAAA,GAAG,CAAC,UAAU,mCAAI,EAAE,CAAC;QACvC,KAAK,EAAE,MAAM,CAAC,MAAA,GAAG,CAAC,KAAK,mCAAI,EAAE,CAAC;QAC9B,MAAM,EAAE,MAAM,CAAC,MAAA,GAAG,CAAC,OAAO,mCAAI,EAAE,CAAC;QACjC,SAAS,EAAE,MAAM,CAAC,MAAA,GAAG,CAAC,SAAS,mCAAI,OAAO,CAAC;KAC5C,CAAC;AACJ,CAAC;AAED,iFAAiF;AAEjF,sGAAsG;AACtG,SAAgB,4BAA4B,CAC1C,YAAoB,EACpB,MAAe;;IAEf,MAAM,GAAG,GAAG,MAAC,MAAc,mCAAI,EAAE,CAAC;IAClC,QAAQ,YAAY,CAAC,WAAW,EAAE,EAAE,CAAC;QACnC,KAAK,QAAQ;YACX,uBACE,MAAM,EAAE,MAAM,CAAC,MAAA,GAAG,CAAC,OAAO,mCAAI,EAAE,CAAC,IAC9B,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EACvE;QACJ,KAAK,QAAQ,CAAC;QACd,KAAK,QAAQ;YACX,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAA,GAAG,CAAC,OAAO,mCAAI,EAAE,CAAC,EAAE,CAAC;QAC/C;YACE,MAAM,IAAI,4BAAmB,CAAC,4BAA4B,YAAY,EAAE,CAAC,CAAC;IAC9E,CAAC;AACH,CAAC"}

package/dist/oauth/oauth.controller.d.ts

@@ -7,12 +7,20 @@ export declare class OAuthController {
     constructor(service: OAuthService, settingService: SettingService);
     private logOAuthRequest;
     githubCallback(code: string, state: string, res: any): Promise<any>;
-    login(origin: string, referer: string, host: string, provider: string, res: any): Promise<any>;
+    /**
+     * Apple mandates `response_mode=form_post` whenever `scope` is requested, so it
+     * POSTs `code`/`state` to the single registered "Return URL" instead of a GET
+     * redirect. This bounces it back to a GET, mirroring the GitHub callback above,
+     * so the rest of the pipeline (hub forwarding, code exchange) stays identical
+     * across every provider.
+     */
+    appleCallback(code: string, state: string, res: any): Promise<any>;
+    login(origin: string, referer: string, host: string, provider: string, redirectApp: string, res: any): Promise<any>;
     mobileAuthUrl(provider: string, redirectUri: string): Promise<{
         authUrl: string;
     }>;
-    register(provider: string, res: any): Promise<any>;
-    connect(provider: string, res: any): Promise<any>;
+    register(provider: string, redirectApp: string, res: any): Promise<any>;
+    connect(provider: string, redirectApp: string, res: any): Promise<any>;
     callbackLogin(locale: string, ipAddress: string, userAgent: string, origin: string, referer: string, host: string, forwardedHost: string, provider: string, code: string, state: string, redirectUri: string, res: any): Promise<{
         accessToken: string;
     }>;

package/dist/oauth/oauth.controller.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oauth.controller.d.ts","sourceRoot":"","sources":["../../src/oauth/oauth.controller.ts"],"names":[],"mappings":"AAgBA,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAC5D,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAE/C,qBACa,eAAe;IAGd,OAAO,CAAC,QAAQ,CAAC,OAAO;IAAgB,OAAO,CAAC,QAAQ,CAAC,cAAc;IAFnF,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAoC;gBAE9B,OAAO,EAAE,YAAY,EAAmB,cAAc,EAAE,cAAc;IAEnG,OAAO,CAAC,eAAe;IAkCjB,cAAc,CACH,IAAI,EAAE,MAAM,EACX,KAAK,EAAE,MAAM,EACtB,GAAG,KAAA;IAUN,KAAK,CACU,MAAM,EAAE,MAAM,EACb,OAAO,EAAE,MAAM,EAClB,IAAI,EAAE,MAAM,EACV,QAAQ,EAAE,MAAM,EAC5B,GAAG,KAAA;IAcN,aAAa,CACE,QAAQ,EAAE,MAAM,EACb,WAAW,EAAE,MAAM;;;IAarC,QAAQ,CAAoB,QAAQ,EAAE,MAAM,EAAS,GAAG,KAAA;IAWxD,OAAO,CAAoB,QAAQ,EAAE,MAAM,EAAS,GAAG,KAAA;IAWvD,aAAa,CACP,MAAM,EAAE,MAAM,EAClB,SAAS,EAAE,MAAM,EACA,SAAS,EAAE,MAAM,EACrB,MAAM,EAAE,MAAM,EACb,OAAO,EAAE,MAAM,EAClB,IAAI,EAAE,MAAM,EACA,aAAa,EAAE,MAAM,EAC/B,QAAQ,EAAE,MAAM,EACpB,IAAI,EAAE,MAAM,EACX,KAAK,EAAE,MAAM,EACP,WAAW,EAAE,MAAM,EACb,GAAG,KAAA;;;IA6B3B,gBAAgB,CACV,MAAM,EAAE,MAAM,EAClB,SAAS,EAAE,MAAM,EACA,SAAS,EAAE,MAAM,EACrB,QAAQ,EAAE,MAAM,EACpB,IAAI,EAAE,MAAM,EACC,GAAG,KAAA;;;IAO3B,eAAe,CACT,MAAM,EAAE,MAAM,EAClB,SAAS,EAAE,MAAM,EACA,SAAS,EAAE,MAAM,EAChC,EAAE,EAAE,EAAE;;KAAA,EACK,QAAQ,EAAE,MAAM,EACpB,IAAI,EAAE,MAAM,EACC,GAAG,KAAA;;;IAO3B,UAAU,CACJ,MAAM,EAAE,MAAM,EAClB,SAAS,EAAE,MAAM,EACA,SAAS,EAAE,MAAM,EACrB,QAAQ,EAAE,MAAM,EACpB,KAAK,EAAE,MAAM,EACA,GAAG,KAAA;;;CAIlC"}
+{"version":3,"file":"oauth.controller.d.ts","sourceRoot":"","sources":["../../src/oauth/oauth.controller.ts"],"names":[],"mappings":"AAiBA,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAC5D,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAE/C,qBACa,eAAe;IAGd,OAAO,CAAC,QAAQ,CAAC,OAAO;IAAgB,OAAO,CAAC,QAAQ,CAAC,cAAc;IAFnF,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAoC;gBAE9B,OAAO,EAAE,YAAY,EAAmB,cAAc,EAAE,cAAc;IAEnG,OAAO,CAAC,eAAe;IAkCjB,cAAc,CACH,IAAI,EAAE,MAAM,EACX,KAAK,EAAE,MAAM,EACtB,GAAG,KAAA;IAaZ;;;;;;OAMG;IAGG,aAAa,CACH,IAAI,EAAE,MAAM,EACX,KAAK,EAAE,MAAM,EACrB,GAAG,KAAA;IAaN,KAAK,CACU,MAAM,EAAE,MAAM,EACb,OAAO,EAAE,MAAM,EAClB,IAAI,EAAE,MAAM,EACV,QAAQ,EAAE,MAAM,EACb,WAAW,EAAE,MAAM,EAClC,GAAG,KAAA;IAeN,aAAa,CACE,QAAQ,EAAE,MAAM,EACb,WAAW,EAAE,MAAM;;;IAarC,QAAQ,CACO,QAAQ,EAAE,MAAM,EACb,WAAW,EAAE,MAAM,EAClC,GAAG,KAAA;IAaN,OAAO,CACQ,QAAQ,EAAE,MAAM,EACb,WAAW,EAAE,MAAM,EAClC,GAAG,KAAA;IAaN,aAAa,CACP,MAAM,EAAE,MAAM,EAClB,SAAS,EAAE,MAAM,EACA,SAAS,EAAE,MAAM,EACrB,MAAM,EAAE,MAAM,EACb,OAAO,EAAE,MAAM,EAClB,IAAI,EAAE,MAAM,EACA,aAAa,EAAE,MAAM,EAC/B,QAAQ,EAAE,MAAM,EACpB,IAAI,EAAE,MAAM,EACX,KAAK,EAAE,MAAM,EACP,WAAW,EAAE,MAAM,EACb,GAAG,KAAA;;;IA+B3B,gBAAgB,CACV,MAAM,EAAE,MAAM,EAClB,SAAS,EAAE,MAAM,EACA,SAAS,EAAE,MAAM,EACrB,QAAQ,EAAE,MAAM,EACpB,IAAI,EAAE,MAAM,EACC,GAAG,KAAA;;;IAO3B,eAAe,CACT,MAAM,EAAE,MAAM,EAClB,SAAS,EAAE,MAAM,EACA,SAAS,EAAE,MAAM,EAChC,EAAE,EAAE,EAAE;;KAAA,EACK,QAAQ,EAAE,MAAM,EACpB,IAAI,EAAE,MAAM,EACC,GAAG,KAAA;;;IAO3B,UAAU,CACJ,MAAM,EAAE,MAAM,EAClB,SAAS,EAAE,MAAM,EACA,SAAS,EAAE,MAAM,EACrB,QAAQ,EAAE,MAAM,EACpB,KAAK,EAAE,MAAM,EACA,GAAG,KAAA;;;CAIlC"}

package/dist/oauth/oauth.controller.js

@@ -35,26 +35,49 @@ let OAuthController = OAuthController_1 = class OAuthController {
         this.logger.log(`OAuth ${action}: provider=${provider} locale=${locale !== null && locale !== void 0 ? locale : 'n/a'} origin=${origin !== null && origin !== void 0 ? origin : 'n/a'} referer=${referer !== null && referer !== void 0 ? referer : 'n/a'} host=${host !== null && host !== void 0 ? host : 'n/a'} ip=${ipAddress !== null && ipAddress !== void 0 ? ipAddress : 'n/a'} hasCode=${code ? 'yes' : 'no'} codeLength=${(_a = code === null || code === void 0 ? void 0 : code.length) !== null && _a !== void 0 ? _a : 0} userAgent="${summarizedUserAgent}"`);
     }
     async githubCallback(code, state, res) {
-        const type = state || 'login';
+        var _a;
+        const forward = await this.service.resolveWebForward(state);
+        const type = (_a = forward === null || forward === void 0 ? void 0 : forward.flow) !== null && _a !== void 0 ? _a : (state || 'login');
+        const { url: frontendURL = '' } = await this.settingService.getSettingValues(['url']);
+        const base = (forward === null || forward === void 0 ? void 0 : forward.origin) || frontendURL;
+        // Preserve the signed state on web-hub flows so the initiating app's callback
+        // can pass it back for origin binding at the code exchange.
+        const stateParam = forward ? `&state=${encodeURIComponent(state)}` : '';
+        const redirectURL = `${base}/callback/github/${type}?code=${encodeURIComponent(code)}${stateParam}`;
+        return res.redirect(redirectURL);
+    }
+    /**
+     * Apple mandates `response_mode=form_post` whenever `scope` is requested, so it
+     * POSTs `code`/`state` to the single registered "Return URL" instead of a GET
+     * redirect. This bounces it back to a GET, mirroring the GitHub callback above,
+     * so the rest of the pipeline (hub forwarding, code exchange) stays identical
+     * across every provider.
+     */
+    async appleCallback(code, state, res) {
+        var _a;
+        const forward = await this.service.resolveWebForward(state);
+        const type = (_a = forward === null || forward === void 0 ? void 0 : forward.flow) !== null && _a !== void 0 ? _a : (state || 'login');
         const { url: frontendURL = '' } = await this.settingService.getSettingValues(['url']);
-        const redirectURL = `${frontendURL}/callback/github/${type}?code=${encodeURIComponent(code)}`;
+        const base = (forward === null || forward === void 0 ? void 0 : forward.origin) || frontendURL;
+        const stateParam = forward ? `&state=${encodeURIComponent(state)}` : '';
+        const redirectURL = `${base}/callback/apple/${type}?code=${encodeURIComponent(code)}${stateParam}`;
         return res.redirect(redirectURL);
     }
-    async login(origin, referer, host, provider, res) {
+    async login(origin, referer, host, provider, redirectApp, res) {
         this.logOAuthRequest('login-init', provider, { origin, referer, host });
-        const url = await this.service.getAuthUrl(provider, `/callback/${provider}/login`);
+        const url = await this.service.getWebAuthUrl(provider, 'login', redirectApp);
         return res.redirect(url);
     }
     async mobileAuthUrl(provider, redirectUri) {
         const authUrl = await this.service.getMobileAuthUrl(provider, redirectUri);
         return { authUrl };
     }
-    async register(provider, res) {
-        const url = await this.service.getAuthUrl(provider, `/callback/${provider}/register`);
+    async register(provider, redirectApp, res) {
+        const url = await this.service.getWebAuthUrl(provider, 'register', redirectApp);
         return res.redirect(url);
     }
-    async connect(provider, res) {
-        const url = await this.service.getAuthUrl(provider, `/callback/${provider}/connect`);
+    async connect(provider, redirectApp, res) {
+        const url = await this.service.getWebAuthUrl(provider, 'connect', redirectApp);
         return res.redirect(url);
     }
     async callbackLogin(locale, ipAddress, userAgent, origin, referer, host, forwardedHost, provider, code, state, redirectUri, res) {
@@ -78,6 +101,8 @@ let OAuthController = OAuthController_1 = class OAuthController {
             type: 'login',
             redirectUri,
             includeRefreshTokenInBody: Boolean(redirectUri),
+            requestOrigin: origin,
+            requestReferer: referer,
         });
     }
     async callbackRegister(locale, ipAddress, userAgent, provider, code, res) {
@@ -101,6 +126,16 @@ __decorate([
     __metadata("design:paramtypes", [String, String, Object]),
     __metadata("design:returntype", Promise)
 ], OAuthController.prototype, "githubCallback", null);
+__decorate([
+    (0, api_1.Public)(),
+    (0, common_1.Post)('apple/callback'),
+    __param(0, (0, common_1.Body)('code')),
+    __param(1, (0, common_1.Body)('state')),
+    __param(2, (0, common_1.Res)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [String, String, Object]),
+    __metadata("design:returntype", Promise)
+], OAuthController.prototype, "appleCallback", null);
 __decorate([
     (0, api_1.Public)(),
     (0, common_1.Get)(':provider/login'),
@@ -108,9 +143,10 @@ __decorate([
     __param(1, (0, common_1.Headers)('referer')),
     __param(2, (0, common_1.Headers)('host')),
     __param(3, (0, common_1.Param)('provider')),
-    __param(4, (0, common_1.Res)()),
+    __param(4, (0, common_1.Query)('redirectApp')),
+    __param(5, (0, common_1.Res)()),
     __metadata("design:type", Function),
-    __metadata("design:paramtypes", [String, String, String, String, Object]),
+    __metadata("design:paramtypes", [String, String, String, String, String, Object]),
     __metadata("design:returntype", Promise)
 ], OAuthController.prototype, "login", null);
 __decorate([
@@ -126,18 +162,20 @@ __decorate([
     (0, api_1.Public)(),
     (0, common_1.Get)(':provider/register'),
     __param(0, (0, common_1.Param)('provider')),
-    __param(1, (0, common_1.Res)()),
+    __param(1, (0, common_1.Query)('redirectApp')),
+    __param(2, (0, common_1.Res)()),
     __metadata("design:type", Function),
-    __metadata("design:paramtypes", [String, Object]),
+    __metadata("design:paramtypes", [String, String, Object]),
     __metadata("design:returntype", Promise)
 ], OAuthController.prototype, "register", null);
 __decorate([
     (0, api_1.Public)(),
     (0, common_1.Get)(':provider/connect'),
     __param(0, (0, common_1.Param)('provider')),
-    __param(1, (0, common_1.Res)()),
+    __param(1, (0, common_1.Query)('redirectApp')),
+    __param(2, (0, common_1.Res)()),
     __metadata("design:type", Function),
-    __metadata("design:paramtypes", [String, Object]),
+    __metadata("design:paramtypes", [String, String, Object]),
     __metadata("design:returntype", Promise)
 ], OAuthController.prototype, "connect", null);
 __decorate([

package/dist/oauth/oauth.controller.js.map

@@ -1 +1 @@
-{"version":3,"file":"oauth.controller.js","sourceRoot":"","sources":["../../src/oauth/oauth.controller.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AACA,sCAA4C;AAC5C,oDAA6C;AAE7C,2CAWwB;AACxB,gEAA4D;AAC5D,mDAA+C;AAGxC,IAAM,eAAe,uBAArB,MAAM,eAAe;IAG1B,YAA6B,OAAqB,EAAmB,cAA8B;QAAtE,YAAO,GAAP,OAAO,CAAc;QAAmB,mBAAc,GAAd,cAAc,CAAgB;QAFlF,WAAM,GAAG,IAAI,eAAM,CAAC,iBAAe,CAAC,IAAI,CAAC,CAAC;IAE2C,CAAC;IAE/F,eAAe,CACrB,MAAc,EACd,QAAgB,EAChB,EACE,MAAM,EACN,MAAM,EACN,OAAO,EACP,IAAI,EACJ,SAAS,EACT,SAAS,EACT,IAAI,GASL;;QAED,MAAM,mBAAmB,GAAG,SAAS;YACnC,CAAC,CAAC,SAAS,CAAC,MAAM,GAAG,GAAG;gBACtB,CAAC,CAAC,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,KAAK;gBACjC,CAAC,CAAC,SAAS;YACb,CAAC,CAAC,KAAK,CAAC;QAEV,IAAI,CAAC,MAAM,CAAC,GAAG,CACb,SAAS,MAAM,cAAc,QAAQ,WAAW,MAAM,aAAN,MAAM,cAAN,MAAM,GAAI,KAAK,WAAW,MAAM,aAAN,MAAM,cAAN,MAAM,GAAI,KAAK,YAAY,OAAO,aAAP,OAAO,cAAP,OAAO,GAAI,KAAK,SAAS,IAAI,aAAJ,IAAI,cAAJ,IAAI,GAAI,KAAK,OAAO,SAAS,aAAT,SAAS,cAAT,SAAS,GAAI,KAAK,YAAY,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,eAAe,MAAA,IAAI,aAAJ,IAAI,uBAAJ,IAAI,CAAE,MAAM,mCAAI,CAAC,eAAe,mBAAmB,GAAG,CACzQ,CAAC;IACJ,CAAC;IAIK,AAAN,KAAK,CAAC,cAAc,CACH,IAAY,EACX,KAAa,EACtB,GAAG;QAEV,MAAM,IAAI,GAAG,KAAK,IAAI,OAAO,CAAC;QAC9B,MAAM,EAAE,GAAG,EAAE,WAAW,GAAG,EAAE,EAAE,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,gBAAgB,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;QACtF,MAAM,WAAW,GAAG,GAAG,WAAW,oBAAoB,IAAI,SAAS,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9F,OAAO,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACnC,CAAC;IAIK,AAAN,KAAK,CAAC,KAAK,CACU,MAAc,EACb,OAAe,EAClB,IAAY,EACV,QAAgB,EAC5B,GAAG;QAEV,IAAI,CAAC,eAAe,CAAC,YAAY,EAAE,QAAQ,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QAExE,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,UAAU,CACvC,QAAiD,EACjD,aAAa,QAAQ,QAAQ,CAC9B,CAAC;QACF,OAAO,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAKK,AAAN,KAAK,CAAC,aAAa,CACE,QAAgB,EACb,WAAmB;QAEzC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,gBAAgB,CACjD,QAAiD,EACjD,WAAW,CACZ,CAAC;QAEF,OAAO,EAAE,OAAO,EAAE,CAAC;IACrB,CAAC;IAKK,AAAN,KAAK,CAAC,QAAQ,CAAoB,QAAgB,EAAS,GAAG;QAC5D,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,UAAU,CACvC,QAAiD,EACjD,aAAa,QAAQ,WAAW,CACjC,CAAC;QACF,OAAO,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAKK,AAAN,KAAK,CAAC,OAAO,CAAoB,QAAgB,EAAS,GAAG;QAC3D,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,UAAU,CACvC,QAAiD,EACjD,aAAa,QAAQ,UAAU,CAChC,CAAC;QACF,OAAO,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAKK,AAAN,KAAK,CAAC,aAAa,CACP,MAAc,EAClB,SAAiB,EACA,SAAiB,EACrB,MAAc,EACb,OAAe,EAClB,IAAY,EACA,aAAqB,EAC/B,QAAgB,EACpB,IAAY,EACX,KAAa,EACP,WAAmB,EACb,GAAG;QAE/B,IAAI,CAAC,eAAe,CAAC,gBAAgB,EAAE,QAAQ,EAAE;YAC/C,MAAM;YACN,MAAM;YACN,OAAO;YACP,IAAI,EAAE,aAAa,IAAI,IAAI;YAC3B,SAAS;YACT,SAAS;YACT,IAAI;SACL,CAAC,CAAC;QAEH,OAAO,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC;YACjC,GAAG;YACH,MAAM;YACN,SAAS;YACT,SAAS;YACT,QAAQ,EAAE,QAAiD;YAC3D,IAAI;YACJ,KAAK;YACL,IAAI,EAAE,OAAO;YACb,WAAW;YACX,yBAAyB,EAAE,OAAO,CAAC,WAAW,CAAC;SAChD,CAAC,CAAC;IACL,CAAC;IAKK,AAAN,KAAK,CAAC,gBAAgB,CACV,MAAc,EAClB,SAAiB,EACA,SAAiB,EACrB,QAAgB,EACpB,IAAY,EACC,GAAG;QAE/B,OAAO,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAiD,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;IACjK,CAAC;IAIK,AAAN,KAAK,CAAC,eAAe,CACT,MAAc,EAClB,SAAiB,EACA,SAAiB,EAChC,EAAE,EAAE,EAAE,EACK,QAAgB,EACpB,IAAY,EACC,GAAG;QAE/B,OAAO,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAiD,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC;IAC5K,CAAC;IAIK,AAAN,KAAK,CAAC,UAAU,CACJ,MAAc,EAClB,SAAiB,EACA,SAAiB,EACrB,QAAgB,EACpB,KAAa,EACA,GAAG;QAE/B,OAAO,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAiD,EAAE,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC;IACpK,CAAC;CACF,CAAA;AA1LY,0CAAe;AAuCpB;IAFL,IAAA,YAAM,GAAE;IACR,IAAA,YAAG,EAAC,iBAAiB,CAAC;IAEpB,WAAA,IAAA,cAAK,EAAC,MAAM,CAAC,CAAA;IACb,WAAA,IAAA,cAAK,EAAC,OAAO,CAAC,CAAA;IACd,WAAA,IAAA,YAAG,GAAE,CAAA;;;;qDAMP;AAIK;IAFL,IAAA,YAAM,GAAE;IACR,IAAA,YAAG,EAAC,iBAAiB,CAAC;IAEpB,WAAA,IAAA,gBAAO,EAAC,QAAQ,CAAC,CAAA;IACjB,WAAA,IAAA,gBAAO,EAAC,SAAS,CAAC,CAAA;IAClB,WAAA,IAAA,gBAAO,EAAC,MAAM,CAAC,CAAA;IACf,WAAA,IAAA,cAAK,EAAC,UAAU,CAAC,CAAA;IACjB,WAAA,IAAA,YAAG,GAAE,CAAA;;;;4CASP;AAKK;IAFL,IAAA,YAAM,GAAE;IACR,IAAA,YAAG,EAAC,2BAA2B,CAAC;IAE9B,WAAA,IAAA,cAAK,EAAC,UAAU,CAAC,CAAA;IACjB,WAAA,IAAA,cAAK,EAAC,aAAa,CAAC,CAAA;;;;oDAQtB;AAKK;IAFL,IAAA,YAAM,GAAE;IACR,IAAA,YAAG,EAAC,oBAAoB,CAAC;IACV,WAAA,IAAA,cAAK,EAAC,UAAU,CAAC,CAAA;IAAoB,WAAA,IAAA,YAAG,GAAE,CAAA;;;;+CAMzD;AAKK;IAFL,IAAA,YAAM,GAAE;IACR,IAAA,YAAG,EAAC,mBAAmB,CAAC;IACV,WAAA,IAAA,cAAK,EAAC,UAAU,CAAC,CAAA;IAAoB,WAAA,IAAA,YAAG,GAAE,CAAA;;;;8CAMxD;AAKK;IAFL,IAAA,YAAM,GAAE;IACR,IAAA,YAAG,EAAC,0BAA0B,CAAC;IAE7B,WAAA,IAAA,mBAAM,GAAE,CAAA;IACR,WAAA,IAAA,WAAE,GAAE,CAAA;IACJ,WAAA,IAAA,gBAAO,EAAC,YAAY,CAAC,CAAA;IACrB,WAAA,IAAA,gBAAO,EAAC,QAAQ,CAAC,CAAA;IACjB,WAAA,IAAA,gBAAO,EAAC,SAAS,CAAC,CAAA;IAClB,WAAA,IAAA,gBAAO,EAAC,MAAM,CAAC,CAAA;IACf,WAAA,IAAA,gBAAO,EAAC,kBAAkB,CAAC,CAAA;IAC3B,WAAA,IAAA,cAAK,EAAC,UAAU,CAAC,CAAA;IACjB,WAAA,IAAA,cAAK,EAAC,MAAM,CAAC,CAAA;IACb,WAAA,IAAA,cAAK,EAAC,OAAO,CAAC,CAAA;IACd,YAAA,IAAA,cAAK,EAAC,aAAa,CAAC,CAAA;IACpB,YAAA,IAAA,YAAG,EAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAA;;;;oDAwB5B;AAKK;IAFL,IAAA,YAAM,GAAE;IACR,IAAA,YAAG,EAAC,6BAA6B,CAAC;IAEhC,WAAA,IAAA,mBAAM,GAAE,CAAA;IACR,WAAA,IAAA,WAAE,GAAE,CAAA;IACJ,WAAA,IAAA,gBAAO,EAAC,YAAY,CAAC,CAAA;IACrB,WAAA,IAAA,cAAK,EAAC,UAAU,CAAC,CAAA;IACjB,WAAA,IAAA,cAAK,EAAC,MAAM,CAAC,CAAA;IACb,WAAA,IAAA,YAAG,EAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAA;;;;uDAG5B;AAIK;IADL,IAAA,YAAG,EAAC,4BAA4B,CAAC;IAE/B,WAAA,IAAA,mBAAM,GAAE,CAAA;IACR,WAAA,IAAA,WAAE,GAAE,CAAA;IACJ,WAAA,IAAA,gBAAO,EAAC,YAAY,CAAC,CAAA;IACrB,WAAA,IAAA,UAAI,GAAE,CAAA;IACN,WAAA,IAAA,cAAK,EAAC,UAAU,CAAC,CAAA;IACjB,WAAA,IAAA,cAAK,EAAC,MAAM,CAAC,CAAA;IACb,WAAA,IAAA,YAAG,EAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAA;;;;sDAG5B;AAIK;IADL,IAAA,eAAM,EAAC,WAAW,CAAC;IAEjB,WAAA,IAAA,mBAAM,GAAE,CAAA;IACR,WAAA,IAAA,WAAE,GAAE,CAAA;IACJ,WAAA,IAAA,gBAAO,EAAC,YAAY,CAAC,CAAA;IACrB,WAAA,IAAA,cAAK,EAAC,UAAU,CAAC,CAAA;IACjB,WAAA,IAAA,aAAI,EAAC,OAAO,CAAC,CAAA;IACb,WAAA,IAAA,YAAG,EAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAA;;;;iDAG5B;0BAzLU,eAAe;IAD3B,IAAA,mBAAU,EAAC,OAAO,CAAC;qCAIoB,4BAAY,EAAmC,gCAAc;GAHxF,eAAe,CA0L3B"}
+{"version":3,"file":"oauth.controller.js","sourceRoot":"","sources":["../../src/oauth/oauth.controller.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AACA,sCAA4C;AAC5C,oDAA6C;AAE7C,2CAYwB;AACxB,gEAA4D;AAC5D,mDAA+C;AAGxC,IAAM,eAAe,uBAArB,MAAM,eAAe;IAG1B,YAA6B,OAAqB,EAAmB,cAA8B;QAAtE,YAAO,GAAP,OAAO,CAAc;QAAmB,mBAAc,GAAd,cAAc,CAAgB;QAFlF,WAAM,GAAG,IAAI,eAAM,CAAC,iBAAe,CAAC,IAAI,CAAC,CAAC;IAE2C,CAAC;IAE/F,eAAe,CACrB,MAAc,EACd,QAAgB,EAChB,EACE,MAAM,EACN,MAAM,EACN,OAAO,EACP,IAAI,EACJ,SAAS,EACT,SAAS,EACT,IAAI,GASL;;QAED,MAAM,mBAAmB,GAAG,SAAS;YACnC,CAAC,CAAC,SAAS,CAAC,MAAM,GAAG,GAAG;gBACtB,CAAC,CAAC,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,KAAK;gBACjC,CAAC,CAAC,SAAS;YACb,CAAC,CAAC,KAAK,CAAC;QAEV,IAAI,CAAC,MAAM,CAAC,GAAG,CACb,SAAS,MAAM,cAAc,QAAQ,WAAW,MAAM,aAAN,MAAM,cAAN,MAAM,GAAI,KAAK,WAAW,MAAM,aAAN,MAAM,cAAN,MAAM,GAAI,KAAK,YAAY,OAAO,aAAP,OAAO,cAAP,OAAO,GAAI,KAAK,SAAS,IAAI,aAAJ,IAAI,cAAJ,IAAI,GAAI,KAAK,OAAO,SAAS,aAAT,SAAS,cAAT,SAAS,GAAI,KAAK,YAAY,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,eAAe,MAAA,IAAI,aAAJ,IAAI,uBAAJ,IAAI,CAAE,MAAM,mCAAI,CAAC,eAAe,mBAAmB,GAAG,CACzQ,CAAC;IACJ,CAAC;IAIK,AAAN,KAAK,CAAC,cAAc,CACH,IAAY,EACX,KAAa,EACtB,GAAG;;QAEV,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC;QAC5D,MAAM,IAAI,GAAG,MAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,IAAI,mCAAI,CAAC,KAAK,IAAI,OAAO,CAAC,CAAC;QACjD,MAAM,EAAE,GAAG,EAAE,WAAW,GAAG,EAAE,EAAE,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,gBAAgB,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;QACtF,MAAM,IAAI,GAAG,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,MAAM,KAAI,WAAW,CAAC;QAC5C,8EAA8E;QAC9E,4DAA4D;QAC5D,MAAM,UAAU,GAAG,OAAO,CAAC,CAAC,CAAC,UAAU,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxE,MAAM,WAAW,GAAG,GAAG,IAAI,oBAAoB,IAAI,SAAS,kBAAkB,CAAC,IAAI,CAAC,GAAG,UAAU,EAAE,CAAC;QACpG,OAAO,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACnC,CAAC;IAED;;;;;;OAMG;IAGG,AAAN,KAAK,CAAC,aAAa,CACH,IAAY,EACX,KAAa,EACrB,GAAG;;QAEV,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC;QAC5D,MAAM,IAAI,GAAG,MAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,IAAI,mCAAI,CAAC,KAAK,IAAI,OAAO,CAAC,CAAC;QACjD,MAAM,EAAE,GAAG,EAAE,WAAW,GAAG,EAAE,EAAE,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,gBAAgB,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;QACtF,MAAM,IAAI,GAAG,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,MAAM,KAAI,WAAW,CAAC;QAC5C,MAAM,UAAU,GAAG,OAAO,CAAC,CAAC,CAAC,UAAU,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxE,MAAM,WAAW,GAAG,GAAG,IAAI,mBAAmB,IAAI,SAAS,kBAAkB,CAAC,IAAI,CAAC,GAAG,UAAU,EAAE,CAAC;QACnG,OAAO,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACnC,CAAC;IAIK,AAAN,KAAK,CAAC,KAAK,CACU,MAAc,EACb,OAAe,EAClB,IAAY,EACV,QAAgB,EACb,WAAmB,EAClC,GAAG;QAEV,IAAI,CAAC,eAAe,CAAC,YAAY,EAAE,QAAQ,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QAExE,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,aAAa,CAC1C,QAAiD,EACjD,OAAO,EACP,WAAW,CACZ,CAAC;QACF,OAAO,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAKK,AAAN,KAAK,CAAC,aAAa,CACE,QAAgB,EACb,WAAmB;QAEzC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,gBAAgB,CACjD,QAAiD,EACjD,WAAW,CACZ,CAAC;QAEF,OAAO,EAAE,OAAO,EAAE,CAAC;IACrB,CAAC;IAKK,AAAN,KAAK,CAAC,QAAQ,CACO,QAAgB,EACb,WAAmB,EAClC,GAAG;QAEV,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,aAAa,CAC1C,QAAiD,EACjD,UAAU,EACV,WAAW,CACZ,CAAC;QACF,OAAO,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAKK,AAAN,KAAK,CAAC,OAAO,CACQ,QAAgB,EACb,WAAmB,EAClC,GAAG;QAEV,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,aAAa,CAC1C,QAAiD,EACjD,SAAS,EACT,WAAW,CACZ,CAAC;QACF,OAAO,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAKK,AAAN,KAAK,CAAC,aAAa,CACP,MAAc,EAClB,SAAiB,EACA,SAAiB,EACrB,MAAc,EACb,OAAe,EAClB,IAAY,EACA,aAAqB,EAC/B,QAAgB,EACpB,IAAY,EACX,KAAa,EACP,WAAmB,EACb,GAAG;QAE/B,IAAI,CAAC,eAAe,CAAC,gBAAgB,EAAE,QAAQ,EAAE;YAC/C,MAAM;YACN,MAAM;YACN,OAAO;YACP,IAAI,EAAE,aAAa,IAAI,IAAI;YAC3B,SAAS;YACT,SAAS;YACT,IAAI;SACL,CAAC,CAAC;QAEH,OAAO,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC;YACjC,GAAG;YACH,MAAM;YACN,SAAS;YACT,SAAS;YACT,QAAQ,EAAE,QAAiD;YAC3D,IAAI;YACJ,KAAK;YACL,IAAI,EAAE,OAAO;YACb,WAAW;YACX,yBAAyB,EAAE,OAAO,CAAC,WAAW,CAAC;YAC/C,aAAa,EAAE,MAAM;YACrB,cAAc,EAAE,OAAO;SACxB,CAAC,CAAC;IACL,CAAC;IAKK,AAAN,KAAK,CAAC,gBAAgB,CACV,MAAc,EAClB,SAAiB,EACA,SAAiB,EACrB,QAAgB,EACpB,IAAY,EACC,GAAG;QAE/B,OAAO,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAiD,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;IACjK,CAAC;IAIK,AAAN,KAAK,CAAC,eAAe,CACT,MAAc,EAClB,SAAiB,EACA,SAAiB,EAChC,EAAE,EAAE,EAAE,EACK,QAAgB,EACpB,IAAY,EACC,GAAG;QAE/B,OAAO,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAiD,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC;IAC5K,CAAC;IAIK,AAAN,KAAK,CAAC,UAAU,CACJ,MAAc,EAClB,SAAiB,EACA,SAAiB,EACrB,QAAgB,EACpB,KAAa,EACA,GAAG;QAE/B,OAAO,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAiD,EAAE,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC;IACpK,CAAC;CACF,CAAA;AApOY,0CAAe;AAuCpB;IAFL,IAAA,YAAM,GAAE;IACR,IAAA,YAAG,EAAC,iBAAiB,CAAC;IAEpB,WAAA,IAAA,cAAK,EAAC,MAAM,CAAC,CAAA;IACb,WAAA,IAAA,cAAK,EAAC,OAAO,CAAC,CAAA;IACd,WAAA,IAAA,YAAG,GAAE,CAAA;;;;qDAWP;AAWK;IAFL,IAAA,YAAM,GAAE;IACR,IAAA,aAAI,EAAC,gBAAgB,CAAC;IAEpB,WAAA,IAAA,aAAI,EAAC,MAAM,CAAC,CAAA;IACZ,WAAA,IAAA,aAAI,EAAC,OAAO,CAAC,CAAA;IACb,WAAA,IAAA,YAAG,GAAE,CAAA;;;;oDASP;AAIK;IAFL,IAAA,YAAM,GAAE;IACR,IAAA,YAAG,EAAC,iBAAiB,CAAC;IAEpB,WAAA,IAAA,gBAAO,EAAC,QAAQ,CAAC,CAAA;IACjB,WAAA,IAAA,gBAAO,EAAC,SAAS,CAAC,CAAA;IAClB,WAAA,IAAA,gBAAO,EAAC,MAAM,CAAC,CAAA;IACf,WAAA,IAAA,cAAK,EAAC,UAAU,CAAC,CAAA;IACjB,WAAA,IAAA,cAAK,EAAC,aAAa,CAAC,CAAA;IACpB,WAAA,IAAA,YAAG,GAAE,CAAA;;;;4CAUP;AAKK;IAFL,IAAA,YAAM,GAAE;IACR,IAAA,YAAG,EAAC,2BAA2B,CAAC;IAE9B,WAAA,IAAA,cAAK,EAAC,UAAU,CAAC,CAAA;IACjB,WAAA,IAAA,cAAK,EAAC,aAAa,CAAC,CAAA;;;;oDAQtB;AAKK;IAFL,IAAA,YAAM,GAAE;IACR,IAAA,YAAG,EAAC,oBAAoB,CAAC;IAEvB,WAAA,IAAA,cAAK,EAAC,UAAU,CAAC,CAAA;IACjB,WAAA,IAAA,cAAK,EAAC,aAAa,CAAC,CAAA;IACpB,WAAA,IAAA,YAAG,GAAE,CAAA;;;;+CAQP;AAKK;IAFL,IAAA,YAAM,GAAE;IACR,IAAA,YAAG,EAAC,mBAAmB,CAAC;IAEtB,WAAA,IAAA,cAAK,EAAC,UAAU,CAAC,CAAA;IACjB,WAAA,IAAA,cAAK,EAAC,aAAa,CAAC,CAAA;IACpB,WAAA,IAAA,YAAG,GAAE,CAAA;;;;8CAQP;AAKK;IAFL,IAAA,YAAM,GAAE;IACR,IAAA,YAAG,EAAC,0BAA0B,CAAC;IAE7B,WAAA,IAAA,mBAAM,GAAE,CAAA;IACR,WAAA,IAAA,WAAE,GAAE,CAAA;IACJ,WAAA,IAAA,gBAAO,EAAC,YAAY,CAAC,CAAA;IACrB,WAAA,IAAA,gBAAO,EAAC,QAAQ,CAAC,CAAA;IACjB,WAAA,IAAA,gBAAO,EAAC,SAAS,CAAC,CAAA;IAClB,WAAA,IAAA,gBAAO,EAAC,MAAM,CAAC,CAAA;IACf,WAAA,IAAA,gBAAO,EAAC,kBAAkB,CAAC,CAAA;IAC3B,WAAA,IAAA,cAAK,EAAC,UAAU,CAAC,CAAA;IACjB,WAAA,IAAA,cAAK,EAAC,MAAM,CAAC,CAAA;IACb,WAAA,IAAA,cAAK,EAAC,OAAO,CAAC,CAAA;IACd,YAAA,IAAA,cAAK,EAAC,aAAa,CAAC,CAAA;IACpB,YAAA,IAAA,YAAG,EAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAA;;;;oDA0B5B;AAKK;IAFL,IAAA,YAAM,GAAE;IACR,IAAA,YAAG,EAAC,6BAA6B,CAAC;IAEhC,WAAA,IAAA,mBAAM,GAAE,CAAA;IACR,WAAA,IAAA,WAAE,GAAE,CAAA;IACJ,WAAA,IAAA,gBAAO,EAAC,YAAY,CAAC,CAAA;IACrB,WAAA,IAAA,cAAK,EAAC,UAAU,CAAC,CAAA;IACjB,WAAA,IAAA,cAAK,EAAC,MAAM,CAAC,CAAA;IACb,WAAA,IAAA,YAAG,EAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAA;;;;uDAG5B;AAIK;IADL,IAAA,YAAG,EAAC,4BAA4B,CAAC;IAE/B,WAAA,IAAA,mBAAM,GAAE,CAAA;IACR,WAAA,IAAA,WAAE,GAAE,CAAA;IACJ,WAAA,IAAA,gBAAO,EAAC,YAAY,CAAC,CAAA;IACrB,WAAA,IAAA,UAAI,GAAE,CAAA;IACN,WAAA,IAAA,cAAK,EAAC,UAAU,CAAC,CAAA;IACjB,WAAA,IAAA,cAAK,EAAC,MAAM,CAAC,CAAA;IACb,WAAA,IAAA,YAAG,EAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAA;;;;sDAG5B;AAIK;IADL,IAAA,eAAM,EAAC,WAAW,CAAC;IAEjB,WAAA,IAAA,mBAAM,GAAE,CAAA;IACR,WAAA,IAAA,WAAE,GAAE,CAAA;IACJ,WAAA,IAAA,gBAAO,EAAC,YAAY,CAAC,CAAA;IACrB,WAAA,IAAA,cAAK,EAAC,UAAU,CAAC,CAAA;IACjB,WAAA,IAAA,aAAI,EAAC,OAAO,CAAC,CAAA;IACb,WAAA,IAAA,YAAG,EAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAA;;;;iDAG5B;0BAnOU,eAAe;IAD3B,IAAA,mBAAU,EAAC,OAAO,CAAC;qCAIoB,4BAAY,EAAmC,gCAAc;GAHxF,eAAe,CAoO3B"}

package/dist/oauth/oauth.module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oauth.module.d.ts","sourceRoot":"","sources":["../../src/oauth/oauth.module.ts"],"names":[],"mappings":"AAoBA,qBAyBa,WAAW;CAAG"}
+{"version":3,"file":"oauth.module.d.ts","sourceRoot":"","sources":["../../src/oauth/oauth.module.ts"],"names":[],"mappings":"AAsBA,qBA2Ba,WAAW;CAAG"}

package/dist/oauth/oauth.module.js

@@ -21,9 +21,11 @@ const user_module_1 = require("../user/user.module");
 const oauth_callback_coordinator_service_1 = require("./oauth-callback-coordinator.service");
 const oauth_controller_1 = require("./oauth.controller");
 const oauth_service_1 = require("./oauth.service");
+const apple_provider_1 = require("./providers/apple.provider");
 const facebook_provider_1 = require("./providers/facebook.provider");
 const github_provider_1 = require("./providers/github.provider");
 const google_provider_1 = require("./providers/google.provider");
+const linkedin_provider_1 = require("./providers/linkedin.provider");
 const microsoft_entra_id_provider_1 = require("./providers/microsoft-entra-id.provider");
 const microsoft_provider_1 = require("./providers/microsoft.provider");
 let OAuthModule = class OAuthModule {
@@ -52,6 +54,8 @@ exports.OAuthModule = OAuthModule = __decorate([
             github_provider_1.GithubProvider,
             microsoft_provider_1.MicrosoftProvider,
             microsoft_entra_id_provider_1.MicrosoftEntraIdProvider,
+            apple_provider_1.AppleProvider,
+            linkedin_provider_1.LinkedinProvider,
         ],
         exports: [oauth_service_1.OAuthService],
     })

package/dist/oauth/oauth.module.js.map

@@ -1 +1 @@
-{"version":3,"file":"oauth.module.js","sourceRoot":"","sources":["../../src/oauth/oauth.module.ts"],"names":[],"mappings":";;;;;;;;;AAAA,gDAAiE;AACjE,oDAAmD;AACnD,yCAA2C;AAC3C,2CAAoD;AACpD,2CAA8C;AAC9C,qDAAiD;AACjD,qDAAiD;AACjD,qDAAiD;AACjD,iEAA6D;AAC7D,wDAAoD;AACpD,qDAAiD;AACjD,6FAAuF;AACvF,yDAAqD;AACrD,mDAA+C;AAC/C,qEAAiE;AACjE,iEAA6D;AAC7D,iEAA6D;AAC7D,yFAAmF;AACnF,uEAAmE;AA2B5D,IAAM,WAAW,GAAjB,MAAM,WAAW;CAAG,CAAA;AAAd,kCAAW;sBAAX,WAAW;IAzBvB,IAAA,eAAM,EAAC;QACN,OAAO,EAAE;YACP,IAAA,mBAAU,EAAC,GAAG,EAAE,CAAC,kBAAU,CAAC;YAC5B,IAAA,mBAAU,EAAC,GAAG,EAAE,CAAC,yBAAY,CAAC;YAC9B,IAAA,mBAAU,EAAC,GAAG,EAAE,CAAC,qBAAc,CAAC;YAChC,IAAA,mBAAU,EAAC,GAAG,EAAE,CAAC,qBAAY,CAAC;YAC9B,IAAA,mBAAU,EAAC,GAAG,EAAE,CAAC,wBAAU,CAAC;YAC5B,IAAA,mBAAU,EAAC,GAAG,EAAE,CAAC,wBAAU,CAAC;YAC5B,IAAA,mBAAU,EAAC,GAAG,EAAE,CAAC,gCAAc,CAAC;YAChC,IAAA,mBAAU,EAAC,GAAG,EAAE,CAAC,0BAAW,CAAC;YAC7B,IAAA,mBAAU,EAAC,GAAG,EAAE,CAAC,wBAAU,CAAC;YAC5B,IAAA,mBAAU,EAAC,GAAG,EAAE,CAAC,wBAAU,CAAC;SAC7B;QACD,WAAW,EAAE,CAAC,kCAAe,CAAC;QAC9B,SAAS,EAAE;YACT,oEAA+B;YAC/B,4BAAY;YACZ,gCAAc;YACd,oCAAgB;YAChB,gCAAc;YACd,sCAAiB;YACjB,sDAAwB;SACzB;QACD,OAAO,EAAE,CAAC,4BAAY,CAAC;KACxB,CAAC;GACW,WAAW,CAAG"}
+{"version":3,"file":"oauth.module.js","sourceRoot":"","sources":["../../src/oauth/oauth.module.ts"],"names":[],"mappings":";;;;;;;;;AAAA,gDAAiE;AACjE,oDAAmD;AACnD,yCAA2C;AAC3C,2CAAoD;AACpD,2CAA8C;AAC9C,qDAAiD;AACjD,qDAAiD;AACjD,qDAAiD;AACjD,iEAA6D;AAC7D,wDAAoD;AACpD,qDAAiD;AACjD,6FAAuF;AACvF,yDAAqD;AACrD,mDAA+C;AAC/C,+DAA2D;AAC3D,qEAAiE;AACjE,iEAA6D;AAC7D,iEAA6D;AAC7D,qEAAiE;AACjE,yFAAmF;AACnF,uEAAmE;AA6B5D,IAAM,WAAW,GAAjB,MAAM,WAAW;CAAG,CAAA;AAAd,kCAAW;sBAAX,WAAW;IA3BvB,IAAA,eAAM,EAAC;QACN,OAAO,EAAE;YACP,IAAA,mBAAU,EAAC,GAAG,EAAE,CAAC,kBAAU,CAAC;YAC5B,IAAA,mBAAU,EAAC,GAAG,EAAE,CAAC,yBAAY,CAAC;YAC9B,IAAA,mBAAU,EAAC,GAAG,EAAE,CAAC,qBAAc,CAAC;YAChC,IAAA,mBAAU,EAAC,GAAG,EAAE,CAAC,qBAAY,CAAC;YAC9B,IAAA,mBAAU,EAAC,GAAG,EAAE,CAAC,wBAAU,CAAC;YAC5B,IAAA,mBAAU,EAAC,GAAG,EAAE,CAAC,wBAAU,CAAC;YAC5B,IAAA,mBAAU,EAAC,GAAG,EAAE,CAAC,gCAAc,CAAC;YAChC,IAAA,mBAAU,EAAC,GAAG,EAAE,CAAC,0BAAW,CAAC;YAC7B,IAAA,mBAAU,EAAC,GAAG,EAAE,CAAC,wBAAU,CAAC;YAC5B,IAAA,mBAAU,EAAC,GAAG,EAAE,CAAC,wBAAU,CAAC;SAC7B;QACD,WAAW,EAAE,CAAC,kCAAe,CAAC;QAC9B,SAAS,EAAE;YACT,oEAA+B;YAC/B,4BAAY;YACZ,gCAAc;YACd,oCAAgB;YAChB,gCAAc;YACd,sCAAiB;YACjB,sDAAwB;YACxB,8BAAa;YACb,oCAAgB;SACjB;QACD,OAAO,EAAE,CAAC,4BAAY,CAAC;KACxB,CAAC;GACW,WAAW,CAAG"}

package/dist/oauth/oauth.service.d.ts

@@ -7,9 +7,11 @@ import { SettingService } from '../setting/setting.service';
 import { TokenService } from '../token/token.service';
 import { UserService } from '../user/user.service';
 import { OAuthCallbackCoordinatorService } from './oauth-callback-coordinator.service';
+import { AppleProvider } from './providers/apple.provider';
 import { FacebookProvider } from './providers/facebook.provider';
 import { GithubProvider } from './providers/github.provider';
 import { GoogleProvider } from './providers/google.provider';
+import { LinkedinProvider } from './providers/linkedin.provider';
 import { MicrosoftEntraIdProvider } from './providers/microsoft-entra-id.provider';
 import { MicrosoftProvider } from './providers/microsoft.provider';
 type HandleCallbackProps = {
@@ -25,6 +27,10 @@ type HandleCallbackProps = {
     redirectUri?: string;
     state?: string;
     includeRefreshTokenInBody?: boolean;
+    /** Origin header of the request that hit the callback (used to bind web hub flows). */
+    requestOrigin?: string;
+    /** Referer header, used as a fallback when the Origin header is absent. */
+    requestReferer?: string;
 };
 export declare class OAuthService {
     private readonly callbackCoordinator;
@@ -39,10 +45,40 @@ export declare class OAuthService {
     private readonly logger;
     private providers;
     private readonly mobileOAuthStateTtlMs;
-    constructor(google: GoogleProvider, facebook: FacebookProvider, microsoft: MicrosoftProvider, github: GithubProvider, microsoftEntraId: MicrosoftEntraIdProvider, callbackCoordinator: OAuthCallbackCoordinatorService, auth: AuthService, file: FileService, mail: MailService, security: SecurityService, prisma: PrismaService, token: TokenService, setting: SettingService, user: UserService);
+    /** Sentinel app in the web state meaning "the OAuth hub handles this locally". */
+    private static readonly WEB_STATE_SELF_APP;
+    constructor(google: GoogleProvider, facebook: FacebookProvider, microsoft: MicrosoftProvider, github: GithubProvider, microsoftEntraId: MicrosoftEntraIdProvider, apple: AppleProvider, linkedin: LinkedinProvider, callbackCoordinator: OAuthCallbackCoordinatorService, auth: AuthService, file: FileService, mail: MailService, security: SecurityService, prisma: PrismaService, token: TokenService, setting: SettingService, user: UserService);
     getAuthUrl(provider: user_account_provider_52222e2ecb_enum, callbackPath: string): Promise<string>;
     getMobileAuthUrl(provider: user_account_provider_52222e2ecb_enum, redirectUri: string): Promise<string>;
-    handleCallback({ res, locale, ipAddress, userAgent, provider, code, type, userId, email, redirectUri, state, includeRefreshTokenInBody, }: HandleCallbackProps): Promise<{
+    /**
+     * Builds a provider auth URL for a browser (web) flow that may be initiated by an
+     * app other than the OAuth hub (the app configured in the `url` setting).
+     *
+     * When `redirectApp` resolves to a known origin (via the `app-urls` setting), a
+     * signed `state` (`hhweb.<app>.<flow>.<sig>`) is attached so the hub can forward
+     * the callback back to the initiating app and the backend can bind the code
+     * exchange to that origin. Without a resolvable `redirectApp`, the URL is returned
+     * unchanged — identical to the legacy hub-only behavior.
+     */
+    getWebAuthUrl(provider: user_account_provider_52222e2ecb_enum, flow: 'login' | 'register' | 'connect', redirectApp?: string): Promise<string>;
+    /**
+     * Resolves how the GitHub backend bounce should forward the browser. GitHub only
+     * supports a single registered callback URL (the API), so the provider always
+     * lands on the backend; this maps the signed web state to the initiating app's
+     * origin. Returns null for legacy hub-only flows (state carries just the flow).
+     */
+    resolveWebForward(state?: string): Promise<{
+        origin: string | null;
+        flow: 'login' | 'register' | 'connect';
+    } | null>;
+    private sanitizeAppKey;
+    private buildWebState;
+    /** Parses and verifies a signed web-hub state. Returns null when invalid. */
+    private parseWebState;
+    /** Resolves an app key to its configured base origin via the `app-urls` setting. */
+    private resolveAppOrigin;
+    private normalizeOrigin;
+    handleCallback({ res, locale, ipAddress, userAgent, provider, code, type, userId, email, redirectUri, state, includeRefreshTokenInBody, requestOrigin, requestReferer, }: HandleCallbackProps): Promise<{
         accessToken: string;
     }>;
     private getProvider;

package/dist/oauth/oauth.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oauth.service.d.ts","sourceRoot":"","sources":["../../src/oauth/oauth.service.ts"],"names":[],"mappings":"AACA,OAAO,EAAU,aAAa,EAAE,qCAAqC,EAAE,MAAM,qBAAqB,CAAC;AAWnG,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AAC/D,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAC5D,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAEtD,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAEnD,OAAO,EAAE,+BAA+B,EAAE,MAAM,sCAAsC,CAAC;AAMvF,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AACjE,OAAO,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAC7D,OAAO,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAC7D,OAAO,EAAE,wBAAwB,EAAE,MAAM,yCAAyC,CAAC;AACnF,OAAO,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AAEnE,KAAK,mBAAmB,GAAG;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,GAAG,EAAE,QAAQ,CAAC;IACd,QAAQ,EAAE,qCAAqC,CAAC;IAChD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,OAAO,GAAG,UAAU,GAAG,SAAS,GAAG,YAAY,CAAC;IACtD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,yBAAyB,CAAC,EAAE,OAAO,CAAC;CACrC,CAAC;AAEF,qBACa,YAAY;IAWrB,OAAO,CAAC,QAAQ,CAAC,mBAAmB;IAEpC,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAExB,OAAO,CAAC,QAAQ,CAAC,IAAI;IApBvB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAiC;IACxD,OAAO,CAAC,SAAS,CAAyC;IAC1D,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAkB;gBAGtD,MAAM,EAAE,cAAc,EACtB,QAAQ,EAAE,gBAAgB,EAC1B,SAAS,EAAE,iBAAiB,EAC5B,MAAM,EAAE,cAAc,EACtB,gBAAgB,EAAE,wBAAwB,EACzB,mBAAmB,EAAE,+BAA+B,EAEpD,IAAI,EAAE,WAAW,EACjB,IAAI,EAAE,WAAW,EACjB,IAAI,EAAE,WAAW,EACjB,QAAQ,EAAE,eAAe,EACzB,MAAM,EAAE,aAAa,EACrB,KAAK,EAAE,YAAY,EACnB,OAAO,EAAE,cAAc,EAEvB,IAAI,EAAE,WAAW;IAS9B,UAAU,CAAC,QAAQ,EAAE,qCAAqC,EAAE,YAAY,EAAE,MAAM;IAQhF,gBAAgB,CACpB,QAAQ,EAAE,qCAAqC,EAC/C,WAAW,EAAE,MAAM;IAqBf,cAAc,CAAC,EACnB,GAAG,EACH,MAAM,EACN,SAAS,EACT,SAAS,EACT,QAAQ,EACR,IAAI,EACJ,IAAI,EACJ,MAAM,EACN,KAAK,EACL,WAAW,EACX,KAAK,EACL,yBAAyB,GAC1B,EAAE,mBAAmB;;;IAuGtB,OAAO,CAAC,WAAW;IAOnB,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,oBAAoB,CAO1C;IAEF,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,sBAAsB,CAO5C;IAEI,iBAAiB,CAAC,QAAQ,EAAE,qCAAqC,GAAG,OAAO,CAAC,OAAO,CAAC;YAO5E,iBAAiB;IAQ/B,OAAO,CAAC,gBAAgB;IAQxB,OAAO,CAAC,kBAAkB;YAUZ,gBAAgB;YAiChB,kBAAkB;YA+ClB,uBAAuB;YAgCvB,gBAAgB;IAyB9B,OAAO,CAAC,kBAAkB;IAY1B,OAAO,CAAC,oBAAoB;IAQ5B,OAAO,CAAC,gBAAgB;YAkEV,WAAW;YAsDX,cAAc;YA0Fd,aAAa;YAoEb,gBAAgB;YAuBhB,6BAA6B;CA+B5C"}
+{"version":3,"file":"oauth.service.d.ts","sourceRoot":"","sources":["../../src/oauth/oauth.service.ts"],"names":[],"mappings":"AACA,OAAO,EAAU,aAAa,EAAE,qCAAqC,EAAE,MAAM,qBAAqB,CAAC;AAWnG,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AAC/D,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAC5D,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAEtD,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAEnD,OAAO,EAAE,+BAA+B,EAAE,MAAM,sCAAsC,CAAC;AAMvF,OAAO,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAC3D,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AACjE,OAAO,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAC7D,OAAO,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAC7D,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AACjE,OAAO,EAAE,wBAAwB,EAAE,MAAM,yCAAyC,CAAC;AACnF,OAAO,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AAEnE,KAAK,mBAAmB,GAAG;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,GAAG,EAAE,QAAQ,CAAC;IACd,QAAQ,EAAE,qCAAqC,CAAC;IAChD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,OAAO,GAAG,UAAU,GAAG,SAAS,GAAG,YAAY,CAAC;IACtD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,yBAAyB,CAAC,EAAE,OAAO,CAAC;IACpC,uFAAuF;IACvF,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,2EAA2E;IAC3E,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB,CAAC;AAEF,qBACa,YAAY;IAerB,OAAO,CAAC,QAAQ,CAAC,mBAAmB;IAEpC,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAExB,OAAO,CAAC,QAAQ,CAAC,IAAI;IAxBvB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAiC;IACxD,OAAO,CAAC,SAAS,CAAyC;IAC1D,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAkB;IACxD,kFAAkF;IAClF,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAU;gBAGlD,MAAM,EAAE,cAAc,EACtB,QAAQ,EAAE,gBAAgB,EAC1B,SAAS,EAAE,iBAAiB,EAC5B,MAAM,EAAE,cAAc,EACtB,gBAAgB,EAAE,wBAAwB,EAC1C,KAAK,EAAE,aAAa,EACpB,QAAQ,EAAE,gBAAgB,EACT,mBAAmB,EAAE,+BAA+B,EAEpD,IAAI,EAAE,WAAW,EACjB,IAAI,EAAE,WAAW,EACjB,IAAI,EAAE,WAAW,EACjB,QAAQ,EAAE,eAAe,EACzB,MAAM,EAAE,aAAa,EACrB,KAAK,EAAE,YAAY,EACnB,OAAO,EAAE,cAAc,EAEvB,IAAI,EAAE,WAAW;IAW9B,UAAU,CAAC,QAAQ,EAAE,qCAAqC,EAAE,YAAY,EAAE,MAAM;IAQhF,gBAAgB,CACpB,QAAQ,EAAE,qCAAqC,EAC/C,WAAW,EAAE,MAAM;IAuBrB;;;;;;;;;OASG;IACG,aAAa,CACjB,QAAQ,EAAE,qCAAqC,EAC/C,IAAI,EAAE,OAAO,GAAG,UAAU,GAAG,SAAS,EACtC,WAAW,CAAC,EAAE,MAAM;IAiBtB;;;;;OAKG;IACG,iBAAiB,CACrB,KAAK,CAAC,EAAE,MAAM,GACb,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,IAAI,EAAE,OAAO,GAAG,UAAU,GAAG,SAAS,CAAA;KAAE,GAAG,IAAI,CAAC;IAQpF,OAAO,CAAC,cAAc;IAKtB,OAAO,CAAC,aAAa;IAKrB,6EAA6E;IAC7E,OAAO,CAAC,aAAa;IA4BrB,oFAAoF;YACtE,gBAAgB;IAW9B,OAAO,CAAC,eAAe;IAWjB,cAAc,CAAC,EACnB,GAAG,EACH,MAAM,EACN,SAAS,EACT,SAAS,EACT,QAAQ,EACR,IAAI,EACJ,IAAI,EACJ,MAAM,EACN,KAAK,EACL,WAAW,EACX,KAAK,EACL,yBAAyB,EACzB,aAAa,EACb,cAAc,GACf,EAAE,mBAAmB;;;IAkItB,OAAO,CAAC,WAAW;IAOnB,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,oBAAoB,CAS1C;IAEF,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,sBAAsB,CAS5C;IAEI,iBAAiB,CAAC,QAAQ,EAAE,qCAAqC,GAAG,OAAO,CAAC,OAAO,CAAC;YAO5E,iBAAiB;IAQ/B,OAAO,CAAC,gBAAgB;IAQxB,OAAO,CAAC,kBAAkB;YAUZ,gBAAgB;YAiChB,kBAAkB;YA+ClB,uBAAuB;YAgCvB,gBAAgB;IAyB9B,OAAO,CAAC,kBAAkB;IAY1B,OAAO,CAAC,oBAAoB;IAQ5B,OAAO,CAAC,gBAAgB;YAkEV,WAAW;YAsDX,cAAc;YA0Fd,aAAa;YAoEb,gBAAgB;YAuBhB,6BAA6B;CA+B5C"}

package/dist/oauth/oauth.service.js

@@ -27,13 +27,15 @@ const user_constants_1 = require("../user/constants/user.constants");
 const user_service_1 = require("../user/user.service");
 const oauth_callback_coordinator_service_1 = require("./oauth-callback-coordinator.service");
 const oauth_errors_1 = require("./oauth.errors");
+const apple_provider_1 = require("./providers/apple.provider");
 const facebook_provider_1 = require("./providers/facebook.provider");
 const github_provider_1 = require("./providers/github.provider");
 const google_provider_1 = require("./providers/google.provider");
+const linkedin_provider_1 = require("./providers/linkedin.provider");
 const microsoft_entra_id_provider_1 = require("./providers/microsoft-entra-id.provider");
 const microsoft_provider_1 = require("./providers/microsoft.provider");
 let OAuthService = OAuthService_1 = class OAuthService {
-    constructor(google, facebook, microsoft, github, microsoftEntraId, callbackCoordinator, auth, file, mail, security, prisma, token, setting, user) {
+    constructor(google, facebook, microsoft, github, microsoftEntraId, apple, linkedin, callbackCoordinator, auth, file, mail, security, prisma, token, setting, user) {
         this.callbackCoordinator = callbackCoordinator;
         this.auth = auth;
         this.file = file;
@@ -51,6 +53,8 @@ let OAuthService = OAuthService_1 = class OAuthService {
         this.providers.set(microsoft.getProviderType(), microsoft);
         this.providers.set(github.getProviderType(), github);
         this.providers.set(microsoftEntraId.getProviderType(), microsoftEntraId);
+        this.providers.set(apple.getProviderType(), apple);
+        this.providers.set(linkedin.getProviderType(), linkedin);
     }
     async getAuthUrl(provider, callbackPath) {
         const enabled = await this.isProviderEnabled(provider);
@@ -64,7 +68,9 @@ let OAuthService = OAuthService_1 = class OAuthService {
         if (!/^[a-z][a-z\d+.-]*:/i.test(sanitizedRedirectUri)) {
             throw new common_1.BadRequestException('Invalid mobile redirect URI.');
         }
-        const callbackPath = `/callback/${String(provider)}/login`;
+        // Flow-less callback to match the single registered redirect URI and the
+        // flow-less token exchange in each provider's getProfile.
+        const callbackPath = `/callback/${String(provider)}`;
         const authUrl = await this.getAuthUrl(provider, callbackPath);
         const flow = 'login';
         const { token, signature } = await this.issueMobileState(provider, sanitizedRedirectUri, flow);
@@ -72,8 +78,96 @@ let OAuthService = OAuthService_1 = class OAuthService {
         url.searchParams.set('state', `hhmob.${token}.${signature}.${flow}`);
         return url.toString();
     }
-    async handleCallback({ res, locale, ipAddress, userAgent, provider, code, type, userId, email, redirectUri, state, includeRefreshTokenInBody, }) {
+    /**
+     * Builds a provider auth URL for a browser (web) flow that may be initiated by an
+     * app other than the OAuth hub (the app configured in the `url` setting).
+     *
+     * When `redirectApp` resolves to a known origin (via the `app-urls` setting), a
+     * signed `state` (`hhweb.<app>.<flow>.<sig>`) is attached so the hub can forward
+     * the callback back to the initiating app and the backend can bind the code
+     * exchange to that origin. Without a resolvable `redirectApp`, the URL is returned
+     * unchanged — identical to the legacy hub-only behavior.
+     */
+    async getWebAuthUrl(provider, flow, redirectApp) {
         var _a;
+        // Single, flow-less callback per provider: the flow (and the initiating app)
+        // travel in the signed state, so only ONE redirect URI needs to be registered
+        // per provider in its OAuth console.
+        const callbackPath = `/callback/${String(provider)}`;
+        const authUrl = await this.getAuthUrl(provider, callbackPath);
+        // Always carry the flow. `self` means "the hub handles it locally"; a resolvable
+        // app key means the hub forwards the callback back to that app (origin-bound).
+        const app = (_a = this.sanitizeAppKey(redirectApp)) !== null && _a !== void 0 ? _a : OAuthService_1.WEB_STATE_SELF_APP;
+        const url = new URL(authUrl);
+        url.searchParams.set('state', this.buildWebState(app, flow));
+        return url.toString();
+    }
+    /**
+     * Resolves how the GitHub backend bounce should forward the browser. GitHub only
+     * supports a single registered callback URL (the API), so the provider always
+     * lands on the backend; this maps the signed web state to the initiating app's
+     * origin. Returns null for legacy hub-only flows (state carries just the flow).
+     */
+    async resolveWebForward(state) {
+        const web = this.parseWebState(state);
+        if (!web) {
+            return null;
+        }
+        return { origin: await this.resolveAppOrigin(web.app), flow: web.flow };
+    }
+    sanitizeAppKey(app) {
+        const value = String(app !== null && app !== void 0 ? app : '').trim().toLowerCase();
+        return /^[a-z0-9][a-z0-9_-]{0,63}$/.test(value) ? value : null;
+    }
+    buildWebState(app, flow) {
+        const signature = this.security.signHmacSha256(`oauth-web-state:${app}:${flow}`);
+        return `hhweb.${app}.${flow}.${signature}`;
+    }
+    /** Parses and verifies a signed web-hub state. Returns null when invalid. */
+    parseWebState(state) {
+        if (!state || !state.startsWith('hhweb.')) {
+            return null;
+        }
+        const parts = state.split('.');
+        if (parts.length !== 4) {
+            return null;
+        }
+        const [, app, flow, signature] = parts;
+        if (!app || !flow || !signature) {
+            return null;
+        }
+        if (flow !== 'login' && flow !== 'register' && flow !== 'connect') {
+            return null;
+        }
+        if (!this.security.verifyHmacSha256(`oauth-web-state:${app}:${flow}`, signature)) {
+            return null;
+        }
+        return { app, flow };
+    }
+    /** Resolves an app key to its configured base origin via the `app-urls` setting. */
+    async resolveAppOrigin(app) {
+        const settings = await this.setting.getSettingValues(['app-urls']);
+        const appUrls = Array.isArray(settings['app-urls']) ? settings['app-urls'] : [];
+        const entry = appUrls.find((item) => { var _a; return ((_a = item.split('=')[0]) === null || _a === void 0 ? void 0 : _a.trim()) === app; });
+        if (!entry) {
+            return null;
+        }
+        const value = entry.slice(entry.indexOf('=') + 1).trim();
+        return value || null;
+    }
+    normalizeOrigin(value) {
+        if (!value) {
+            return null;
+        }
+        try {
+            return new URL(value).origin.toLowerCase();
+        }
+        catch (_a) {
+            return null;
+        }
+    }
+    async handleCallback({ res, locale, ipAddress, userAgent, provider, code, type, userId, email, redirectUri, state, includeRefreshTokenInBody, requestOrigin, requestReferer, }) {
+        var _a, _b;
         try {
             this.logger.log(`OAuth callback received: provider=${provider} type=${type} locale=${locale} ip=${ipAddress || 'n/a'} hasCode=${code ? 'yes' : 'no'} codeLength=${(_a = code === null || code === void 0 ? void 0 : code.length) !== null && _a !== void 0 ? _a : 0} userAgent="${this.summarizeUserAgent(userAgent)}"`);
             if (type === 'disconnect') {
@@ -82,6 +176,21 @@ let OAuthService = OAuthService_1 = class OAuthService {
             if (!code) {
                 throw new common_1.BadRequestException((0, api_locale_1.getLocaleText)('oauth.callback.codeRequired', locale, 'Authorization code is required to complete OAuth authentication.'));
             }
+            // Web hub flow: an app other than the OAuth hub started the flow and the hub
+            // forwarded the code here. Bind the code exchange to the initiating app's
+            // origin so a leaked/forwarded code cannot be redeemed from another origin.
+            const webState = this.parseWebState(state);
+            if (webState && (type === 'login' || type === 'register')) {
+                const expectedOrigin = this.normalizeOrigin(await this.resolveAppOrigin(webState.app));
+                // Only bind cross-app forwards (the app resolves to a configured origin).
+                // The hub's own flow (app "self") resolves to nothing and runs locally.
+                if (expectedOrigin) {
+                    const boundOrigin = (_b = this.normalizeOrigin(requestOrigin)) !== null && _b !== void 0 ? _b : this.normalizeOrigin(requestReferer);
+                    if (!boundOrigin || expectedOrigin !== boundOrigin) {
+                        throw new common_1.BadRequestException((0, api_locale_1.getLocaleText)('oauth.callback.invalidState', locale, 'OAuth callback origin is invalid. Start the sign-in flow again.'));
+                    }
+                }
+            }
             if (redirectUri &&
                 !(await this.consumeMobileState(state, provider, redirectUri))) {
                 throw new common_1.BadRequestException((0, api_locale_1.getLocaleText)('oauth.callback.invalidState', locale, 'OAuth callback state is invalid or expired. Start the sign-in flow again.'));
@@ -505,6 +614,8 @@ let OAuthService = OAuthService_1 = class OAuthService {
     }
 };
 exports.OAuthService = OAuthService;
+/** Sentinel app in the web state meaning "the OAuth hub handles this locally". */
+OAuthService.WEB_STATE_SELF_APP = 'self';
 OAuthService.PROVIDER_SCOPE_SLUGS = {
     google: 'oauth-google-scopes',
     facebook: 'oauth-facebook-scopes',
@@ -512,6 +623,8 @@ OAuthService.PROVIDER_SCOPE_SLUGS = {
     microsoft: 'oauth-microsoft-scopes',
     'microsoft-entra-id': 'oauth-microsoft-entra-id-scopes',
     microsoft_entra_id: 'oauth-microsoft-entra-id-scopes',
+    apple: 'oauth-apple-scopes',
+    linkedin: 'oauth-linkedin-scopes',
 };
 OAuthService.PROVIDER_ENABLED_SLUGS = {
     google: 'oauth-google-enabled',
@@ -520,16 +633,20 @@ OAuthService.PROVIDER_ENABLED_SLUGS = {
     microsoft: 'oauth-microsoft-enabled',
     'microsoft-entra-id': 'oauth-microsoft-entra-id-enabled',
     microsoft_entra_id: 'oauth-microsoft-entra-id-enabled',
+    apple: 'oauth-apple-enabled',
+    linkedin: 'oauth-linkedin-enabled',
 };
 exports.OAuthService = OAuthService = OAuthService_1 = __decorate([
     (0, common_1.Injectable)(),
-    __param(6, (0, common_1.Inject)((0, common_1.forwardRef)(() => auth_service_1.AuthService))),
-    __param(13, (0, common_1.Inject)((0, common_1.forwardRef)(() => user_service_1.UserService))),
+    __param(8, (0, common_1.Inject)((0, common_1.forwardRef)(() => auth_service_1.AuthService))),
+    __param(15, (0, common_1.Inject)((0, common_1.forwardRef)(() => user_service_1.UserService))),
     __metadata("design:paramtypes", [google_provider_1.GoogleProvider,
         facebook_provider_1.FacebookProvider,
         microsoft_provider_1.MicrosoftProvider,
         github_provider_1.GithubProvider,
         microsoft_entra_id_provider_1.MicrosoftEntraIdProvider,
+        apple_provider_1.AppleProvider,
+        linkedin_provider_1.LinkedinProvider,
         oauth_callback_coordinator_service_1.OAuthCallbackCoordinatorService,
         auth_service_1.AuthService,
         file_service_1.FileService,