@hilbras/keystone 1.5.0 → 1.9.0

package/dist/routes/federation.js.map

@@ -1 +1 @@
-{"version":3,"file":"federation.js","sourceRoot":"","sources":["../../src/routes/federation.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AACtC,OAAO,EAAE,sBAAsB,EAAE,uBAAuB,EAAE,MAAM,oCAAoC,CAAC;AACrG,OAAO,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AACzC,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAC5E,OAAO,EAAE,yBAAyB,EAAE,MAAM,6BAA6B,CAAC;AAExE,OAAO,EAAE,uBAAuB,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AACpF,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAE/C,SAAS,UAAU,CAAC,KAAa;IAC/B,OAAO,sBAAsB,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAClD,CAAC;AAED,SAAS,WAAW;IAClB,OAAO,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AACtD,CAAC;AAED,SAAS,SAAS;IAChB,OAAO,MAAM,CAAC,mBAAmB,IAAI,oBAAoB,MAAM,CAAC,IAAI,EAAE,CAAC;AACzE,CAAC;AAED,SAAS,mBAAmB,CAAC,QAAgB;IAC3C,OAAO,GAAG,SAAS,EAAE,eAAe,QAAQ,WAAW,CAAC;AAC1D,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAmB,EAAE,KAAa,EAAE,QAAiB;IAC/E,KAAK,CAAC,SAAS,CAAC,WAAW,EAAE,KAAK,EAAE;QAClC,IAAI,EAAE,GAAG;QACT,QAAQ,EAAE,IAAI;QACd,MAAM,EAAE,MAAM,CAAC,aAAa;QAC5B,QAAQ,EAAE,KAAc;QACxB,MAAM,EAAE,MAAM,CAAC,aAAa,IAAI,SAAS;QACzC,MAAM,EAAE,GAAG;KACZ,CAAC,CAAC;IACH,IAAI,QAAQ,EAAE,CAAC;QACb,KAAK,CAAC,SAAS,CAAC,eAAe,EAAE,QAAQ,EAAE;YACzC,IAAI,EAAE,GAAG;YACT,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,MAAM,CAAC,aAAa;YAC5B,QAAQ,EAAE,KAAc;YACxB,MAAM,EAAE,MAAM,CAAC,aAAa,IAAI,SAAS;YACzC,MAAM,EAAE,GAAG;SACZ,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,SAAS,sBAAsB,CAAC,KAAmB;IACjD,MAAM,IAAI,GAAG;QACX,IAAI,EAAE,GAAG;QACT,QAAQ,EAAE,IAAI;QACd,MAAM,EAAE,MAAM,CAAC,aAAa;QAC5B,QAAQ,EAAE,KAAc;QACxB,MAAM,EAAE,MAAM,CAAC,aAAa,IAAI,SAAS;KAC1C,CAAC;IACF,KAAK,CAAC,WAAW,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;IACrC,KAAK,CAAC,WAAW,CAAC,eAAe,EAAE,IAAI,CAAC,CAAC;AAC3C,CAAC;AAED,SAAS,iBAAiB,CAAC,QAAiB,EAAE,GAAiB;IAC7D,IAAI,GAAG,EAAE,YAAY,EAAE,MAAM;QAAE,OAAO,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IAC1D,OAAO,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,uBAAuB,CAAC;AAC/D,CAAC;AAED,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IAClC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;IAC7B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE;CACrC,CAAC,CAAC;AAEH,MAAM,CAAC,OAAO,CAAC,KAAK,UAAU,gBAAgB,CAAC,GAAoB;IACjE,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC;IAErB,GAAG,CAAC,GAAG,CAAC,kBAAkB,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QACnD,MAAM,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC,MAA8B,CAAC;QAC5D,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC1B,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iCAAiC,EAAE,CAAC,CAAC;QAC9E,CAAC;QACD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAsD,CAAC;QAC7E,MAAM,KAAK,GAAG,WAAW,EAAE,CAAC;QAC5B,kBAAkB,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;QAElD,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,QAAQ,CAAC,yBAAyB,CAAC,QAAQ,EAAE,KAAK,EAAE,mBAAmB,CAAC,QAAQ,CAAC,CAAC,CAAC;YAC5G,IAAI,CAAC,MAAM,CAAC,OAAO;gBAAE,OAAO,eAAe,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;YAC3D,OAAO,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACzC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,yBAAyB,CAAC,CAAC;YACtD,sBAAsB,CAAC,KAAK,CAAC,CAAC;YAC9B,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,GAAG,uBAAuB,CAAC,GAAG,CAAC,CAAC;YAC1D,OAAO,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7C,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,qBAAqB,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QACtD,MAAM,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC,MAA8B,CAAC;QAC5D,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC1B,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iCAAiC,EAAE,CAAC,CAAC;QAC9E,CAAC;QAED,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC,KAA0C,CAAC;QAC3E,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC;QAC9C,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC;QAE/C,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,IAAI,KAAK,KAAK,WAAW,EAAE,CAAC;YAC7C,sBAAsB,CAAC,KAAK,CAAC,CAAC;YAC9B,OAAO,KAAK,CAAC,QAAQ,CAAC,GAAG,iBAAiB,CAAC,QAAQ,CAAC,UAAU,kBAAkB,CAAC,0BAA0B,CAAC,EAAE,CAAC,CAAC;QAClH,CAAC;QACD,sBAAsB,CAAC,KAAK,CAAC,CAAC;QAE9B,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,QAAQ,CAAC,uBAAuB,CAAC,QAAQ,EAAE,IAAI,EAAE,mBAAmB,CAAC,QAAQ,CAAC,CAAC,CAAC;YACzG,IAAI,CAAC,MAAM,CAAC,OAAO;gBAAE,OAAO,eAAe,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;YAC3D,MAAM,GAAG,GAAG,QAAQ,CAAC,CAAC,CAAC,MAAM,yBAAyB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YAC7E,iBAAiB,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC;YACzG,OAAO,KAAK,CAAC,QAAQ,CAAC,iBAAiB,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC;QAC1D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,4BAA4B,CAAC,CAAC;YACzD,mBAAmB,CAAC,KAAK,CAAC,CAAC;YAC3B,MAAM,GAAG,GAAG,uBAAuB,CAAC,GAAG,EAAE,iBAAiB,CAAC,QAAQ,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;YACjF,OAAO,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QAC7B,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,YAAY,EAAE,KAAK,IAAI,EAAE;QAC/B,OAAO;YACL,SAAS,EAAE,uBAAuB,EAAE;SACrC,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CACN,OAAO,EACP,EAAE,UAAU,EAAE,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,EAClC,KAAK,EAAE,OAAuB,EAAE,KAAK,EAAE,EAAE;QACvC,MAAM,IAAI,GAAG,kBAAkB,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACpD,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,QAAQ,CAAC,gBAAgB,CAChD,OAAO,CAAC,IAAK,CAAC,EAAE,EAChB,IAAI,CAAC,UAAU,EACf,IAAI,CAAC,YAAY,EACjB,IAAI,CAAC,WAAW,EAChB,IAAI,CAAC,KAAK,CACX,CAAC;QACF,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,OAAO,eAAe,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAC3D,MAAM,OAAO,CAAC,KAAK,CAAC,4BAA4B,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,IAAK,CAAC,EAAE,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC;QAC9I,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;IACnD,CAAC,CACF,CAAC;IAEF,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,EAAE,UAAU,EAAE,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,EAAE,KAAK,EAAE,OAAuB,EAAE,EAAE;QAC3F,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,SAAS,CAAC,kBAAkB,CAAC,YAAY,CAAC,OAAO,CAAC,IAAK,CAAC,EAAE,CAAC,CAAC;QACnF,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;IAC9B,CAAC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"federation.js","sourceRoot":"","sources":["../../src/routes/federation.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AACtC,OAAO,EAAE,sBAAsB,EAAE,uBAAuB,EAAE,MAAM,oCAAoC,CAAC;AACrG,OAAO,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AACzC,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAC5E,OAAO,EAAE,yBAAyB,EAAE,MAAM,6BAA6B,CAAC;AAExE,OAAO,EAAE,uBAAuB,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AACpF,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAE/C,SAAS,UAAU,CAAC,KAAa;IAC/B,OAAO,sBAAsB,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAClD,CAAC;AAED,SAAS,WAAW;IAClB,OAAO,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AACtD,CAAC;AAED,SAAS,SAAS;IAChB,OAAO,MAAM,CAAC,mBAAmB,IAAI,oBAAoB,MAAM,CAAC,IAAI,EAAE,CAAC;AACzE,CAAC;AAED,SAAS,mBAAmB,CAAC,QAAgB;IAC3C,OAAO,GAAG,SAAS,EAAE,eAAe,QAAQ,WAAW,CAAC;AAC1D,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAmB,EAAE,KAAa,EAAE,QAAiB;IAC/E,KAAK,CAAC,SAAS,CAAC,WAAW,EAAE,KAAK,EAAE;QAClC,IAAI,EAAE,GAAG;QACT,QAAQ,EAAE,IAAI;QACd,MAAM,EAAE,MAAM,CAAC,aAAa;QAC5B,QAAQ,EAAE,KAAc;QACxB,MAAM,EAAE,MAAM,CAAC,aAAa,IAAI,SAAS;QACzC,MAAM,EAAE,GAAG;KACZ,CAAC,CAAC;IACH,IAAI,QAAQ,EAAE,CAAC;QACb,KAAK,CAAC,SAAS,CAAC,eAAe,EAAE,QAAQ,EAAE;YACzC,IAAI,EAAE,GAAG;YACT,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,MAAM,CAAC,aAAa;YAC5B,QAAQ,EAAE,KAAc;YACxB,MAAM,EAAE,MAAM,CAAC,aAAa,IAAI,SAAS;YACzC,MAAM,EAAE,GAAG;SACZ,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,SAAS,sBAAsB,CAAC,KAAmB;IACjD,MAAM,IAAI,GAAG;QACX,IAAI,EAAE,GAAG;QACT,QAAQ,EAAE,IAAI;QACd,MAAM,EAAE,MAAM,CAAC,aAAa;QAC5B,QAAQ,EAAE,KAAc;QACxB,MAAM,EAAE,MAAM,CAAC,aAAa,IAAI,SAAS;KAC1C,CAAC;IACF,KAAK,CAAC,WAAW,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;IACrC,KAAK,CAAC,WAAW,CAAC,eAAe,EAAE,IAAI,CAAC,CAAC;AAC3C,CAAC;AAED,SAAS,iBAAiB,CAAC,QAAiB,EAAE,GAAiB;IAC7D,IAAI,GAAG,EAAE,YAAY,EAAE,MAAM;QAAE,OAAO,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IAC1D,OAAO,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,uBAAuB,CAAC;AAC/D,CAAC;AAED,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IAClC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;IAC7B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE;CACrC,CAAC,CAAC;AAEH,MAAM,CAAC,OAAO,CAAC,KAAK,UAAU,gBAAgB,CAAC,GAAoB;IACjE,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC;IAErB,GAAG,CAAC,GAAG,CAAC,kBAAkB,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QACnD,MAAM,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC,MAA8B,CAAC;QAC5D,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC1B,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iCAAiC,EAAE,CAAC,CAAC;QAC9E,CAAC;QACD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAsD,CAAC;QAC7E,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;YACpB,MAAM,WAAW,GAAG,MAAM,yBAAyB,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;YACrE,IAAI,CAAC,WAAW;gBAAE,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,qBAAqB,EAAE,CAAC,CAAC;QACpF,CAAC;QACD,MAAM,KAAK,GAAG,WAAW,EAAE,CAAC;QAC5B,kBAAkB,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;QAElD,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,QAAQ,CAAC,yBAAyB,CAAC,QAAQ,EAAE,KAAK,EAAE,mBAAmB,CAAC,QAAQ,CAAC,CAAC,CAAC;YAC5G,IAAI,CAAC,MAAM,CAAC,OAAO;gBAAE,OAAO,eAAe,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;YAC3D,OAAO,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACzC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,yBAAyB,CAAC,CAAC;YACtD,sBAAsB,CAAC,KAAK,CAAC,CAAC;YAC9B,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,GAAG,uBAAuB,CAAC,GAAG,CAAC,CAAC;YAC1D,OAAO,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7C,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,qBAAqB,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QACtD,MAAM,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC,MAA8B,CAAC;QAC5D,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC1B,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iCAAiC,EAAE,CAAC,CAAC;QAC9E,CAAC;QAED,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC,KAA0C,CAAC;QAC3E,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC;QAC9C,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC;QAE/C,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,IAAI,KAAK,KAAK,WAAW,EAAE,CAAC;YAC7C,sBAAsB,CAAC,KAAK,CAAC,CAAC;YAC9B,OAAO,KAAK,CAAC,QAAQ,CAAC,GAAG,iBAAiB,CAAC,QAAQ,CAAC,UAAU,kBAAkB,CAAC,0BAA0B,CAAC,EAAE,CAAC,CAAC;QAClH,CAAC;QACD,sBAAsB,CAAC,KAAK,CAAC,CAAC;QAE9B,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,QAAQ,CAAC,CAAC,CAAC,MAAM,yBAAyB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YAC7E,IAAI,QAAQ,IAAI,CAAC,GAAG,EAAE,CAAC;gBACrB,OAAO,KAAK,CAAC,QAAQ,CAAC,GAAG,iBAAiB,CAAC,QAAQ,CAAC,UAAU,kBAAkB,CAAC,qBAAqB,CAAC,EAAE,CAAC,CAAC;YAC7G,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,QAAQ,CAAC,uBAAuB,CACvD,QAAQ,EACR,IAAI,EACJ,mBAAmB,CAAC,QAAQ,CAAC,EAC7B,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,SAAS,CAC3E,CAAC;YACF,IAAI,CAAC,MAAM,CAAC,OAAO;gBAAE,OAAO,eAAe,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;YAC3D,OAAO,CAAC,KAAK,CAAC,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAChD,IAAI,GAAG,EAAE,CAAC;gBACR,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,GAAG,CAAC;gBACxB,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,sBAAsB,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YAChG,CAAC;YACD,MAAM,OAAO,CAAC,KAAK,CAAC,kBAAkB,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC;YAC5G,iBAAiB,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC;YACzG,OAAO,KAAK,CAAC,QAAQ,CAAC,iBAAiB,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC;QAC1D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,4BAA4B,CAAC,CAAC;YACzD,mBAAmB,CAAC,KAAK,CAAC,CAAC;YAC3B,MAAM,GAAG,GAAG,uBAAuB,CAAC,GAAG,EAAE,iBAAiB,CAAC,QAAQ,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;YACjF,OAAO,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QAC7B,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,YAAY,EAAE,KAAK,IAAI,EAAE;QAC/B,OAAO;YACL,SAAS,EAAE,uBAAuB,EAAE;SACrC,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CACN,OAAO,EACP,EAAE,UAAU,EAAE,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,EAClC,KAAK,EAAE,OAAuB,EAAE,KAAK,EAAE,EAAE;QACvC,MAAM,IAAI,GAAG,kBAAkB,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACpD,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,QAAQ,CAAC,gBAAgB,CAChD,OAAO,CAAC,IAAK,CAAC,EAAE,EAChB,OAAO,CAAC,IAAK,CAAC,EAAE,EAChB,IAAI,CAAC,UAAU,EACf,IAAI,CAAC,YAAY,EACjB,IAAI,CAAC,WAAW,EAChB,IAAI,CAAC,KAAK,CACX,CAAC;QACF,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,OAAO,eAAe,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAC3D,MAAM,OAAO,CAAC,KAAK,CAAC,4BAA4B,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,IAAK,CAAC,EAAE,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC;QAC9I,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;IACnD,CAAC,CACF,CAAC;IAEF,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,EAAE,UAAU,EAAE,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,EAAE,KAAK,EAAE,OAAuB,EAAE,EAAE;QAC3F,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,SAAS,CAAC,kBAAkB,CAAC,YAAY,CAAC,OAAO,CAAC,IAAK,CAAC,EAAE,CAAC,CAAC;QACnF,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;IAC9B,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/routes/magicLinks.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"magicLinks.d.ts","sourceRoot":"","sources":["../../src/routes/magicLinks.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAkB,MAAM,SAAS,CAAC;AA+B/D,wBAA8B,eAAe,CAAC,GAAG,EAAE,eAAe,iBA0EjE"}
+{"version":3,"file":"magicLinks.d.ts","sourceRoot":"","sources":["../../src/routes/magicLinks.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAkB,MAAM,SAAS,CAAC;AA+B/D,wBAA8B,eAAe,CAAC,GAAG,EAAE,eAAe,iBAuFjE"}

package/dist/routes/magicLinks.js

@@ -5,7 +5,7 @@ import { createTokenSet } from "../services/tokens.js";
 import { fingerprintFromRequest, recordDevice } from "../services/devices.js";
 import { setSessionCookies } from "../plugins/auth.js";
 import { emailProvider } from "../services/email.js";
-import { toPublicUser } from "../types.js";
+import { toSelfUser } from "../types.js";
 import { config } from "../config.js";
 import { rateLimit } from "../plugins/rateLimit.js";
 const SendSchema = z.object({
@@ -32,7 +32,7 @@ export default async function magicLinkRoutes(app) {
     }, async (request, reply) => {
         const body = SendSchema.parse(request.body);
         const user = await findUserByEmail(body.email);
-        if (!user) {
+        if (!user || !user.isActive) {
             return reply.status(200).send({ success: true });
         }
         const { token, tokenHash } = generateMagicLink();
@@ -62,8 +62,20 @@ export default async function magicLinkRoutes(app) {
         if (!user) {
             return reply.status(400).send({ error: "Invalid or expired token" });
         }
+        if (!user.isActive) {
+            return reply.status(403).send({ error: "Account is deactivated" });
+        }
         const fingerprint = fingerprintFromRequest(request);
         await recordDevice(user.id, fingerprint, request.ip, request.headers["user-agent"]);
+        if (user.totpEnabled) {
+            // A magic link proves mailbox control, which is weaker than the second
+            // factor the user explicitly enrolled. Refuse rather than downgrade.
+            await request.audit("mfa_bypass_blocked", { userId: user.id, flow: "magic_link" });
+            return reply.status(403).send({
+                error: "Multi-factor authentication is required for this account. Sign in with your password and verification code.",
+                code: "MFA_REQUIRED",
+            });
+        }
         const tokens = await createTokenSet(user, request.ip, request.headers["user-agent"], {}, fingerprint);
         setSessionCookies(reply, tokens.accessToken, tokens.refreshToken);
         await request.audit("magic_link_verified", { userId: user.id });
@@ -73,7 +85,7 @@ export default async function magicLinkRoutes(app) {
             return reply.redirect(postLoginRedirect());
         }
         return {
-            user: toPublicUser(user),
+            user: toSelfUser(user),
             accessToken: tokens.accessToken,
             refreshToken: tokens.refreshToken,
         };

package/dist/routes/magicLinks.js.map

@@ -1 +1 @@
-{"version":3,"file":"magicLinks.js","sourceRoot":"","sources":["../../src/routes/magicLinks.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,EACL,iBAAiB,EACjB,cAAc,EACd,gBAAgB,EAChB,kBAAkB,GACnB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,sBAAsB,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAC9E,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AACtC,OAAO,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AAEpD,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE;CAC1B,CAAC,CAAC;AAEH,SAAS,YAAY,CAAC,KAAa;IACjC,kEAAkE;IAClE,mEAAmE;IACnE,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,uBAAuB,CAAC;IACnE,OAAO,GAAG,IAAI,gBAAgB,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC;AAC5D,CAAC;AAED,SAAS,iBAAiB;IACxB,OAAO,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,uBAAuB,CAAC;AAC/D,CAAC;AAED,MAAM,CAAC,OAAO,CAAC,KAAK,UAAU,eAAe,CAAC,GAAoB;IAChE,GAAG,CAAC,IAAI,CAAC,kBAAkB,EAAE;QAC3B,UAAU,EAAE;YACV,SAAS,CAAC;gBACR,SAAS,EAAE,YAAY;gBACvB,WAAW,EAAE,CAAC;gBACd,aAAa,EAAE,GAAG;aACnB,CAAC;SACH;KACF,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QAC1B,MAAM,IAAI,GAAG,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC5C,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC/C,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QACnD,CAAC;QAED,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,iBAAiB,EAAE,CAAC;QACjD,MAAM,cAAc,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,kBAAkB,EAAE,CAAC,CAAC;QAE/D,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;YAChC,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,sBAAsB,GAAG,EAAE,CAAC,CAAC;YAClE,MAAM,aAAa,CAAC,IAAI,CAAC;gBACvB,EAAE,EAAE,IAAI,CAAC,KAAK;gBACd,OAAO,EAAE,mBAAmB;gBAC5B,IAAI,EAAE,iCAAiC,GAAG,4BAA4B,UAAU,qCAAqC;gBACrH,IAAI,EAAE,qBAAqB,GAAG,qDAAqD,UAAU,yCAAyC;aACvI,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,iCAAiC,CAAC,CAAC;QAChE,CAAC;QAED,MAAM,OAAO,CAAC,KAAK,CAAC,iBAAiB,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;QAE5D,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,oBAAoB,EAAE,KAAK,EAAE,OAAuB,EAAE,KAAK,EAAE,EAAE;QACrE,MAAM,KAAK,GAAG,OAAO,CAAC,KAA8C,CAAC;QACrE,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;YACjB,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,CAAC;QAC5D,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACjD,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,0BAA0B,EAAE,CAAC,CAAC;QACvE,CAAC;QAED,MAAM,WAAW,GAAG,sBAAsB,CAAC,OAAO,CAAC,CAAC;QACpD,MAAM,YAAY,CAAC,IAAI,CAAC,EAAE,EAAE,WAAW,EAAE,OAAO,CAAC,EAAE,EAAE,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC;QAEpF,MAAM,MAAM,GAAG,MAAM,cAAc,CACjC,IAAI,EACJ,OAAO,CAAC,EAAE,EACV,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,EAC7B,EAAE,EACF,WAAW,CACZ,CAAC;QACF,iBAAiB,CAAC,KAAK,EAAE,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC;QAElE,MAAM,OAAO,CAAC,KAAK,CAAC,qBAAqB,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;QAEhE,wEAAwE;QACxE,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC;QAC5C,IAAI,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;YACjC,OAAO,KAAK,CAAC,QAAQ,CAAC,iBAAiB,EAAE,CAAC,CAAC;QAC7C,CAAC;QAED,OAAO;YACL,IAAI,EAAE,YAAY,CAAC,IAAI,CAAC;YACxB,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,YAAY,EAAE,MAAM,CAAC,YAAY;SAClC,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"magicLinks.js","sourceRoot":"","sources":["../../src/routes/magicLinks.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,EACL,iBAAiB,EACjB,cAAc,EACd,gBAAgB,EAChB,kBAAkB,GACnB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,sBAAsB,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAC9E,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AACtC,OAAO,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AAEpD,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE;CAC1B,CAAC,CAAC;AAEH,SAAS,YAAY,CAAC,KAAa;IACjC,kEAAkE;IAClE,mEAAmE;IACnE,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,uBAAuB,CAAC;IACnE,OAAO,GAAG,IAAI,gBAAgB,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC;AAC5D,CAAC;AAED,SAAS,iBAAiB;IACxB,OAAO,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,uBAAuB,CAAC;AAC/D,CAAC;AAED,MAAM,CAAC,OAAO,CAAC,KAAK,UAAU,eAAe,CAAC,GAAoB;IAChE,GAAG,CAAC,IAAI,CAAC,kBAAkB,EAAE;QAC3B,UAAU,EAAE;YACV,SAAS,CAAC;gBACR,SAAS,EAAE,YAAY;gBACvB,WAAW,EAAE,CAAC;gBACd,aAAa,EAAE,GAAG;aACnB,CAAC;SACH;KACF,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QAC1B,MAAM,IAAI,GAAG,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC5C,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC/C,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC5B,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QACnD,CAAC;QAED,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,iBAAiB,EAAE,CAAC;QACjD,MAAM,cAAc,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,kBAAkB,EAAE,CAAC,CAAC;QAE/D,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;YAChC,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,sBAAsB,GAAG,EAAE,CAAC,CAAC;YAClE,MAAM,aAAa,CAAC,IAAI,CAAC;gBACvB,EAAE,EAAE,IAAI,CAAC,KAAK;gBACd,OAAO,EAAE,mBAAmB;gBAC5B,IAAI,EAAE,iCAAiC,GAAG,4BAA4B,UAAU,qCAAqC;gBACrH,IAAI,EAAE,qBAAqB,GAAG,qDAAqD,UAAU,yCAAyC;aACvI,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,iCAAiC,CAAC,CAAC;QAChE,CAAC;QAED,MAAM,OAAO,CAAC,KAAK,CAAC,iBAAiB,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;QAE5D,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,oBAAoB,EAAE,KAAK,EAAE,OAAuB,EAAE,KAAK,EAAE,EAAE;QACrE,MAAM,KAAK,GAAG,OAAO,CAAC,KAA8C,CAAC;QACrE,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;YACjB,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,CAAC;QAC5D,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACjD,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,0BAA0B,EAAE,CAAC,CAAC;QACvE,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACnB,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,wBAAwB,EAAE,CAAC,CAAC;QACrE,CAAC;QAED,MAAM,WAAW,GAAG,sBAAsB,CAAC,OAAO,CAAC,CAAC;QACpD,MAAM,YAAY,CAAC,IAAI,CAAC,EAAE,EAAE,WAAW,EAAE,OAAO,CAAC,EAAE,EAAE,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC;QAEpF,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACrB,uEAAuE;YACvE,qEAAqE;YACrE,MAAM,OAAO,CAAC,KAAK,CAAC,oBAAoB,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC;YACnF,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBAC5B,KAAK,EAAE,6GAA6G;gBACpH,IAAI,EAAE,cAAc;aACrB,CAAC,CAAC;QACL,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,cAAc,CACjC,IAAI,EACJ,OAAO,CAAC,EAAE,EACV,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,EAC7B,EAAE,EACF,WAAW,CACZ,CAAC;QACF,iBAAiB,CAAC,KAAK,EAAE,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC;QAElE,MAAM,OAAO,CAAC,KAAK,CAAC,qBAAqB,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;QAEhE,wEAAwE;QACxE,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC;QAC5C,IAAI,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;YACjC,OAAO,KAAK,CAAC,QAAQ,CAAC,iBAAiB,EAAE,CAAC,CAAC;QAC7C,CAAC;QAED,OAAO;YACL,IAAI,EAAE,UAAU,CAAC,IAAI,CAAC;YACtB,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,YAAY,EAAE,MAAM,CAAC,YAAY;SAClC,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/routes/oauth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oauth.d.ts","sourceRoot":"","sources":["../../src/routes/oauth.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAgC,MAAM,SAAS,CAAC;AAoF7E,wBAA8B,WAAW,CAAC,GAAG,EAAE,eAAe,iBA0E7D"}
+{"version":3,"file":"oauth.d.ts","sourceRoot":"","sources":["../../src/routes/oauth.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAgC,MAAM,SAAS,CAAC;AAkF7E,wBAA8B,WAAW,CAAC,GAAG,EAAE,eAAe,iBA8F7D"}

package/dist/routes/oauth.js

@@ -1,12 +1,11 @@
 import crypto from "node:crypto";
 import { config } from "../config.js";
 import { buildConnector, listSupportedProviders } from "../services/connectors/registry.js";
-import { upsertOAuthUser } from "../services/users.js";
+import { findIdentityProviderByType, upsertOAuthUser } from "../services/users.js";
 import { createTokenSet } from "../services/tokens.js";
 import { setSessionCookies, clearSessionCookies } from "../plugins/auth.js";
 import { findApplicationByClientId } from "../services/applications.js";
 import { buildOAuthErrorRedirect, buildOAuthErrorResponse } from "../lib/errors.js";
-const REDIRECT_TARGET = process.env.AUTH_SUCCESS_REDIRECT || "/chat";
 const OAuthStartSchema = {
     querystring: {
         type: "object",
@@ -77,6 +76,9 @@ export default async function oauthRoutes(app) {
             return reply.status(400).send({ error: "Unsupported provider" });
         }
         const query = request.query;
+        if (query.client_id && !(await findApplicationByClientId(query.client_id))) {
+            return reply.status(400).send({ error: "Unknown application" });
+        }
         const state = randomState();
         setOAuthState(reply, state);
         setOAuthClientId(reply, query.client_id);
@@ -113,8 +115,24 @@ export default async function oauthRoutes(app) {
         try {
             const connector = buildConnector(provider);
             const identity = await connector.exchangeCode(code, callbackRedirectUri(provider));
-            const user = await upsertOAuthUser(identity, provider);
+            const providerRecord = await findIdentityProviderByType(provider);
+            const user = await upsertOAuthUser(identity, provider, providerRecord?.id);
+            request.state.auditUserId = user.id;
             const app = clientId ? await findApplicationByClientId(clientId) : undefined;
+            if (clientId && !app) {
+                throw new Error("unknown_application");
+            }
+            const membership = app
+                ? await request.server.container.organizationRepository.findMembership(app.orgId, user.id)
+                : undefined;
+            if (app && !membership) {
+                throw new Error("not_member");
+            }
+            if (app && membership) {
+                request.state.app = app;
+                request.state.membership = membership;
+                request.state.org = await request.server.container.organizationRepository.findById(app.orgId);
+            }
             const tokens = await createTokenSet(user, request.ip, request.headers["user-agent"], {
                 appId: app?.id,
                 orgId: app?.orgId,
@@ -124,6 +142,7 @@ export default async function oauthRoutes(app) {
             await request.audit("oauth_callback", {
                 provider,
                 externalSub: identity.sub,
+                userId: user.id,
                 appId: app?.id,
                 orgId: app?.orgId,
             });

package/dist/routes/oauth.js.map

@@ -1 +1 @@
-{"version":3,"file":"oauth.js","sourceRoot":"","sources":["../../src/routes/oauth.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AAEjC,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AACtC,OAAO,EAAE,cAAc,EAAE,sBAAsB,EAAE,MAAM,oCAAoC,CAAC;AAC5F,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAC5E,OAAO,EAAE,yBAAyB,EAAE,MAAM,6BAA6B,CAAC;AAExE,OAAO,EAAE,uBAAuB,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AAEpF,MAAM,eAAe,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,IAAI,OAAO,CAAC;AAErE,MAAM,gBAAgB,GAAG;IACvB,WAAW,EAAE;QACX,IAAI,EAAE,QAAQ;QACd,UAAU,EAAE;YACV,SAAS,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;SAC9B;KACF;CACF,CAAC;AAEF,SAAS,UAAU,CAAC,KAAa;IAC/B,OAAO,sBAAsB,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAClD,CAAC;AAED,SAAS,WAAW;IAClB,OAAO,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AACtD,CAAC;AAED,SAAS,aAAa,CAAC,KAAmB,EAAE,KAAa;IACvD,KAAK,CAAC,SAAS,CAAC,aAAa,EAAE,KAAK,EAAE;QACpC,IAAI,EAAE,GAAG;QACT,QAAQ,EAAE,IAAI;QACd,MAAM,EAAE,MAAM,CAAC,aAAa;QAC5B,QAAQ,EAAE,KAAc;QACxB,MAAM,EAAE,MAAM,CAAC,aAAa,IAAI,SAAS;QACzC,MAAM,EAAE,GAAG;KACZ,CAAC,CAAC;AACL,CAAC;AAED,SAAS,eAAe,CAAC,KAAmB;IAC1C,KAAK,CAAC,WAAW,CAAC,aAAa,EAAE;QAC/B,IAAI,EAAE,GAAG;QACT,QAAQ,EAAE,IAAI;QACd,MAAM,EAAE,MAAM,CAAC,aAAa;QAC5B,QAAQ,EAAE,KAAc;QACxB,MAAM,EAAE,MAAM,CAAC,aAAa,IAAI,SAAS;KAC1C,CAAC,CAAC;AACL,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAmB,EAAE,QAAiB;IAC9D,IAAI,CAAC,QAAQ;QAAE,OAAO;IACtB,KAAK,CAAC,SAAS,CAAC,iBAAiB,EAAE,QAAQ,EAAE;QAC3C,IAAI,EAAE,GAAG;QACT,QAAQ,EAAE,IAAI;QACd,MAAM,EAAE,MAAM,CAAC,aAAa;QAC5B,QAAQ,EAAE,KAAc;QACxB,MAAM,EAAE,MAAM,CAAC,aAAa,IAAI,SAAS;QACzC,MAAM,EAAE,GAAG;KACZ,CAAC,CAAC;AACL,CAAC;AAED,SAAS,gBAAgB,CAAC,OAAuB;IAC/C,OAAO,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC;AACzC,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAmB;IAC7C,KAAK,CAAC,WAAW,CAAC,iBAAiB,EAAE;QACnC,IAAI,EAAE,GAAG;QACT,QAAQ,EAAE,IAAI;QACd,MAAM,EAAE,MAAM,CAAC,aAAa;QAC5B,QAAQ,EAAE,KAAc;QACxB,MAAM,EAAE,MAAM,CAAC,aAAa,IAAI,SAAS;KAC1C,CAAC,CAAC;AACL,CAAC;AAED,SAAS,SAAS;IAChB,OAAO,MAAM,CAAC,mBAAmB,IAAI,oBAAoB,MAAM,CAAC,IAAI,EAAE,CAAC;AACzE,CAAC;AAED,SAAS,mBAAmB,CAAC,QAAgB;IAC3C,OAAO,GAAG,SAAS,EAAE,kBAAkB,QAAQ,EAAE,CAAC;AACpD,CAAC;AAED,MAAM,CAAC,OAAO,CAAC,KAAK,UAAU,WAAW,CAAC,GAAoB;IAC5D,GAAG,CAAC,GAAG,CAAC,kBAAkB,EAAE,EAAE,MAAM,EAAE,gBAAgB,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QACjF,MAAM,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC,MAA8B,CAAC;QAC5D,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC1B,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,sBAAsB,EAAE,CAAC,CAAC;QACnE,CAAC;QAED,MAAM,KAAK,GAAG,OAAO,CAAC,KAA+B,CAAC;QACtD,MAAM,KAAK,GAAG,WAAW,EAAE,CAAC;QAC5B,aAAa,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAC5B,gBAAgB,CAAC,KAAK,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;QAEzC,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC;YAC3C,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,eAAe,CAAC;gBAC1C,KAAK;gBACL,WAAW,EAAE,mBAAmB,CAAC,QAAQ,CAAC;gBAC1C,MAAM,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC;aACvC,CAAC,CAAC;YACH,OAAO,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QAC7B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,oBAAoB,CAAC,CAAC;YACjD,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,GAAG,uBAAuB,CAAC,GAAG,CAAC,CAAC;YAC1D,OAAO,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7C,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,qBAAqB,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QACtD,MAAM,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC,MAA8B,CAAC;QAC5D,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC1B,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,sBAAsB,EAAE,CAAC,CAAC;QACnE,CAAC;QAED,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC,KAA0C,CAAC;QAC3E,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC;QAChD,MAAM,QAAQ,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;QAE3C,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,IAAI,KAAK,KAAK,WAAW,EAAE,CAAC;YAC7C,eAAe,CAAC,KAAK,CAAC,CAAC;YACvB,kBAAkB,CAAC,KAAK,CAAC,CAAC;YAC1B,OAAO,KAAK,CAAC,QAAQ,CAAC,GAAG,iBAAiB,CAAC,QAAQ,CAAC,UAAU,kBAAkB,CAAC,qBAAqB,CAAC,EAAE,CAAC,CAAC;QAC7G,CAAC;QACD,eAAe,CAAC,KAAK,CAAC,CAAC;QACvB,kBAAkB,CAAC,KAAK,CAAC,CAAC;QAE1B,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC;YAC3C,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,YAAY,CAAC,IAAI,EAAE,mBAAmB,CAAC,QAAQ,CAAC,CAAC,CAAC;YAEnF,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;YAEvD,MAAM,GAAG,GAAG,QAAQ,CAAC,CAAC,CAAC,MAAM,yBAAyB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YAC7E,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,EAAE,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE;gBACnF,KAAK,EAAE,GAAG,EAAE,EAAE;gBACd,KAAK,EAAE,GAAG,EAAE,KAAK;gBACjB,QAAQ,EAAE,GAAG,EAAE,QAAQ;aACxB,CAAC,CAAC;YACH,iBAAiB,CAAC,KAAK,EAAE,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,YAAY,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC;YAEjF,MAAM,OAAO,CAAC,KAAK,CAAC,gBAAgB,EAAE;gBACpC,QAAQ;gBACR,WAAW,EAAE,QAAQ,CAAC,GAAG;gBACzB,KAAK,EAAE,GAAG,EAAE,EAAE;gBACd,KAAK,EAAE,GAAG,EAAE,KAAK;aAClB,CAAC,CAAC;YAEH,OAAO,KAAK,CAAC,QAAQ,CAAC,iBAAiB,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC;QAC1D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,uBAAuB,CAAC,CAAC;YACpD,mBAAmB,CAAC,KAAK,CAAC,CAAC;YAC3B,MAAM,GAAG,GAAG,uBAAuB,CAAC,GAAG,EAAE,iBAAiB,CAAC,QAAQ,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;YACjF,OAAO,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QAC7B,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,iBAAiB,CAAC,QAAiB,EAAE,GAAiB;IAC7D,IAAI,GAAG,EAAE,YAAY,EAAE,MAAM,EAAE,CAAC;QAC9B,OAAO,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IAC7B,CAAC;IACD,OAAO,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,uBAAuB,CAAC;AAC/D,CAAC"}
+{"version":3,"file":"oauth.js","sourceRoot":"","sources":["../../src/routes/oauth.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AAEjC,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AACtC,OAAO,EAAE,cAAc,EAAE,sBAAsB,EAAE,MAAM,oCAAoC,CAAC;AAC5F,OAAO,EAAE,0BAA0B,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACnF,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAC5E,OAAO,EAAE,yBAAyB,EAAE,MAAM,6BAA6B,CAAC;AAExE,OAAO,EAAE,uBAAuB,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AAEpF,MAAM,gBAAgB,GAAG;IACvB,WAAW,EAAE;QACX,IAAI,EAAE,QAAQ;QACd,UAAU,EAAE;YACV,SAAS,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;SAC9B;KACF;CACF,CAAC;AAEF,SAAS,UAAU,CAAC,KAAa;IAC/B,OAAO,sBAAsB,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAClD,CAAC;AAED,SAAS,WAAW;IAClB,OAAO,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AACtD,CAAC;AAED,SAAS,aAAa,CAAC,KAAmB,EAAE,KAAa;IACvD,KAAK,CAAC,SAAS,CAAC,aAAa,EAAE,KAAK,EAAE;QACpC,IAAI,EAAE,GAAG;QACT,QAAQ,EAAE,IAAI;QACd,MAAM,EAAE,MAAM,CAAC,aAAa;QAC5B,QAAQ,EAAE,KAAc;QACxB,MAAM,EAAE,MAAM,CAAC,aAAa,IAAI,SAAS;QACzC,MAAM,EAAE,GAAG;KACZ,CAAC,CAAC;AACL,CAAC;AAED,SAAS,eAAe,CAAC,KAAmB;IAC1C,KAAK,CAAC,WAAW,CAAC,aAAa,EAAE;QAC/B,IAAI,EAAE,GAAG;QACT,QAAQ,EAAE,IAAI;QACd,MAAM,EAAE,MAAM,CAAC,aAAa;QAC5B,QAAQ,EAAE,KAAc;QACxB,MAAM,EAAE,MAAM,CAAC,aAAa,IAAI,SAAS;KAC1C,CAAC,CAAC;AACL,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAmB,EAAE,QAAiB;IAC9D,IAAI,CAAC,QAAQ;QAAE,OAAO;IACtB,KAAK,CAAC,SAAS,CAAC,iBAAiB,EAAE,QAAQ,EAAE;QAC3C,IAAI,EAAE,GAAG;QACT,QAAQ,EAAE,IAAI;QACd,MAAM,EAAE,MAAM,CAAC,aAAa;QAC5B,QAAQ,EAAE,KAAc;QACxB,MAAM,EAAE,MAAM,CAAC,aAAa,IAAI,SAAS;QACzC,MAAM,EAAE,GAAG;KACZ,CAAC,CAAC;AACL,CAAC;AAED,SAAS,gBAAgB,CAAC,OAAuB;IAC/C,OAAO,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC;AACzC,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAmB;IAC7C,KAAK,CAAC,WAAW,CAAC,iBAAiB,EAAE;QACnC,IAAI,EAAE,GAAG;QACT,QAAQ,EAAE,IAAI;QACd,MAAM,EAAE,MAAM,CAAC,aAAa;QAC5B,QAAQ,EAAE,KAAc;QACxB,MAAM,EAAE,MAAM,CAAC,aAAa,IAAI,SAAS;KAC1C,CAAC,CAAC;AACL,CAAC;AAED,SAAS,SAAS;IAChB,OAAO,MAAM,CAAC,mBAAmB,IAAI,oBAAoB,MAAM,CAAC,IAAI,EAAE,CAAC;AACzE,CAAC;AAED,SAAS,mBAAmB,CAAC,QAAgB;IAC3C,OAAO,GAAG,SAAS,EAAE,kBAAkB,QAAQ,EAAE,CAAC;AACpD,CAAC;AAED,MAAM,CAAC,OAAO,CAAC,KAAK,UAAU,WAAW,CAAC,GAAoB;IAC5D,GAAG,CAAC,GAAG,CAAC,kBAAkB,EAAE,EAAE,MAAM,EAAE,gBAAgB,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QACjF,MAAM,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC,MAA8B,CAAC;QAC5D,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC1B,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,sBAAsB,EAAE,CAAC,CAAC;QACnE,CAAC;QAED,MAAM,KAAK,GAAG,OAAO,CAAC,KAA+B,CAAC;QACtD,IAAI,KAAK,CAAC,SAAS,IAAI,CAAC,CAAC,MAAM,yBAAyB,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;YAC3E,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,qBAAqB,EAAE,CAAC,CAAC;QAClE,CAAC;QACD,MAAM,KAAK,GAAG,WAAW,EAAE,CAAC;QAC5B,aAAa,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAC5B,gBAAgB,CAAC,KAAK,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;QAEzC,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC;YAC3C,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,eAAe,CAAC;gBAC1C,KAAK;gBACL,WAAW,EAAE,mBAAmB,CAAC,QAAQ,CAAC;gBAC1C,MAAM,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC;aACvC,CAAC,CAAC;YACH,OAAO,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QAC7B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,oBAAoB,CAAC,CAAC;YACjD,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,GAAG,uBAAuB,CAAC,GAAG,CAAC,CAAC;YAC1D,OAAO,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7C,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,qBAAqB,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QACtD,MAAM,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC,MAA8B,CAAC;QAC5D,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC1B,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,sBAAsB,EAAE,CAAC,CAAC;QACnE,CAAC;QAED,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC,KAA0C,CAAC;QAC3E,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC;QAChD,MAAM,QAAQ,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;QAE3C,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,IAAI,KAAK,KAAK,WAAW,EAAE,CAAC;YAC7C,eAAe,CAAC,KAAK,CAAC,CAAC;YACvB,kBAAkB,CAAC,KAAK,CAAC,CAAC;YAC1B,OAAO,KAAK,CAAC,QAAQ,CAAC,GAAG,iBAAiB,CAAC,QAAQ,CAAC,UAAU,kBAAkB,CAAC,qBAAqB,CAAC,EAAE,CAAC,CAAC;QAC7G,CAAC;QACD,eAAe,CAAC,KAAK,CAAC,CAAC;QACvB,kBAAkB,CAAC,KAAK,CAAC,CAAC;QAE1B,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC;YAC3C,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,YAAY,CAAC,IAAI,EAAE,mBAAmB,CAAC,QAAQ,CAAC,CAAC,CAAC;YAEnF,MAAM,cAAc,GAAG,MAAM,0BAA0B,CAAC,QAAQ,CAAC,CAAC;YAClE,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,QAAQ,EAAE,QAAQ,EAAE,cAAc,EAAE,EAAE,CAAC,CAAC;YAC3E,OAAO,CAAC,KAAK,CAAC,WAAW,GAAG,IAAI,CAAC,EAAE,CAAC;YAEpC,MAAM,GAAG,GAAG,QAAQ,CAAC,CAAC,CAAC,MAAM,yBAAyB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YAC7E,IAAI,QAAQ,IAAI,CAAC,GAAG,EAAE,CAAC;gBACrB,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;YACzC,CAAC;YACD,MAAM,UAAU,GAAG,GAAG;gBACpB,CAAC,CAAC,MAAM,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,sBAAsB,CAAC,cAAc,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,EAAE,CAAC;gBAC1F,CAAC,CAAC,SAAS,CAAC;YACd,IAAI,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC;gBACvB,MAAM,IAAI,KAAK,CAAC,YAAY,CAAC,CAAC;YAChC,CAAC;YACD,IAAI,GAAG,IAAI,UAAU,EAAE,CAAC;gBACtB,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,GAAG,CAAC;gBACxB,OAAO,CAAC,KAAK,CAAC,UAAU,GAAG,UAAU,CAAC;gBACtC,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,sBAAsB,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YAChG,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,EAAE,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE;gBACnF,KAAK,EAAE,GAAG,EAAE,EAAE;gBACd,KAAK,EAAE,GAAG,EAAE,KAAK;gBACjB,QAAQ,EAAE,GAAG,EAAE,QAAQ;aACxB,CAAC,CAAC;YACH,iBAAiB,CAAC,KAAK,EAAE,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,YAAY,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC;YAEjF,MAAM,OAAO,CAAC,KAAK,CAAC,gBAAgB,EAAE;gBACpC,QAAQ;gBACR,WAAW,EAAE,QAAQ,CAAC,GAAG;gBACzB,MAAM,EAAE,IAAI,CAAC,EAAE;gBACf,KAAK,EAAE,GAAG,EAAE,EAAE;gBACd,KAAK,EAAE,GAAG,EAAE,KAAK;aAClB,CAAC,CAAC;YAEH,OAAO,KAAK,CAAC,QAAQ,CAAC,iBAAiB,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC;QAC1D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,uBAAuB,CAAC,CAAC;YACpD,mBAAmB,CAAC,KAAK,CAAC,CAAC;YAC3B,MAAM,GAAG,GAAG,uBAAuB,CAAC,GAAG,EAAE,iBAAiB,CAAC,QAAQ,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;YACjF,OAAO,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QAC7B,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,iBAAiB,CAAC,QAAiB,EAAE,GAAiB;IAC7D,IAAI,GAAG,EAAE,YAAY,EAAE,MAAM,EAAE,CAAC;QAC9B,OAAO,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IAC7B,CAAC;IACD,OAAO,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,uBAAuB,CAAC;AAC/D,CAAC"}

package/dist/routes/oauth2.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oauth2.d.ts","sourceRoot":"","sources":["../../src/routes/oauth2.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAgC,MAAM,SAAS,CAAC;AAiE7E,wBAA8B,YAAY,CAAC,GAAG,EAAE,eAAe,iBAyN9D"}
+{"version":3,"file":"oauth2.d.ts","sourceRoot":"","sources":["../../src/routes/oauth2.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAgC,MAAM,SAAS,CAAC;AAkF7E,wBAA8B,YAAY,CAAC,GAAG,EAAE,eAAe,iBAgU9D"}

package/dist/routes/oauth2.js

@@ -2,7 +2,7 @@ import { z } from "zod";
 import { config } from "../config.js";
 import { storeAuthorizationCode, consumeAuthorizationCode, verifyPKCE, hasConsent, grantConsent, revokeConsent, createTokenResponse, findApplicationByClientId, verifyClientSecret, } from "../services/oauth2.js";
 import { findUserById } from "../services/users.js";
-import { revokeRefreshToken, createApplicationAccessToken, rotateRefreshToken } from "../services/tokens.js";
+import { revokeRefreshToken, createApplicationAccessToken, rotateRefreshToken, MfaRequiredError, } from "../services/tokens.js";
 import { fingerprintFromRequest } from "../services/devices.js";
 import { rateLimit } from "../plugins/rateLimit.js";
 const AuthorizeQuerySchema = z.object({
@@ -30,6 +30,15 @@ const ConsentBodySchema = z.object({
     scopes: z.array(z.string()).default([]),
     grant: z.boolean(),
 });
+const MFA_ASSERTIONS = new Set(["totp", "backup_code", "webauthn", "session"]);
+/**
+ * The MFA factor is copied out of a verified token into a column guarded by a
+ * CHECK constraint, so it must be validated at runtime rather than cast.
+ * An unrecognised value is treated as "no factor recorded", which fails closed.
+ */
+function asMfaAssertion(value) {
+    return value && MFA_ASSERTIONS.has(value) ? value : undefined;
+}
 function extractClientCredentials(request, body) {
     const authHeader = request.headers.authorization;
     if (authHeader?.toLowerCase().startsWith("basic ")) {
@@ -56,11 +65,25 @@ export default async function oauth2Routes(app) {
         if (!application) {
             return reply.status(400).send({ error: "invalid_client", error_description: "Unknown client" });
         }
+        const membership = await app.container.organizationRepository.findMembership(application.orgId, request.user.id);
+        if (!membership) {
+            await request.audit("unauthorized_access", {
+                action: "oauth_application_tenant_membership",
+                appId: application.id,
+                orgId: application.orgId,
+            });
+            return reply.status(403).send({
+                error: "not_member",
+                error_description: "You are not a member of the application organization",
+            });
+        }
         if (!application.redirectUris.includes(query.redirect_uri)) {
             return reply
                 .status(400)
                 .send({ error: "invalid_redirect_uri", error_description: "Redirect URI not registered" });
         }
+        request.state.membership = membership;
+        request.state.org = await app.container.organizationRepository.findById(application.orgId);
         const scopes = query.scope ? query.scope.split(" ").filter(Boolean) : [];
         const consent = await hasConsent(request.user.id, application.id, scopes);
         if (!consent) {
@@ -69,6 +92,9 @@ export default async function oauth2Routes(app) {
                 error_description: "User consent required",
             });
         }
+        // The authorization code inherits the second factor of the session that
+        // approved it, so the token exchange cannot launder an unverified login.
+        const sessionMfaFactor = asMfaAssertion(request.authClaims?.mfa_factor);
         const stored = await storeAuthorizationCode({
             appId: application.id,
             userId: request.user.id,
@@ -77,6 +103,7 @@ export default async function oauth2Routes(app) {
             redirectUri: query.redirect_uri,
             scopes,
             nonce: query.nonce,
+            ...(sessionMfaFactor ? { mfaFactor: sessionMfaFactor } : {}),
         });
         const url = new URL(query.redirect_uri);
         url.searchParams.set("code", stored.code);
@@ -119,31 +146,86 @@ export default async function oauth2Routes(app) {
                 return reply.status(400).send({ error: "invalid_grant", error_description: "PKCE verification failed" });
             }
             const user = await findUserById(record.userId);
-            if (!user) {
+            if (!user?.isActive) {
+                return reply.status(400).send({ error: "invalid_grant" });
+            }
+            const membership = await app.container.organizationRepository.findMembership(application.orgId, user.id);
+            if (!membership) {
+                await request.audit("unauthorized_access", {
+                    action: "oauth_application_tenant_membership",
+                    appId: application.id,
+                    orgId: application.orgId,
+                });
                 return reply.status(400).send({ error: "invalid_grant" });
             }
+            request.state.auditUserId = user.id;
+            request.state.membership = membership;
+            request.state.org = await app.container.organizationRepository.findById(application.orgId);
             await request.audit("oauth2_token", {
                 appId: application.id,
                 clientId: application.clientId,
                 grantType: "authorization_code",
             });
+            const storedMfaFactor = asMfaAssertion(record.mfaFactor);
             const fingerprint = fingerprintFromRequest(request);
-            return createTokenResponse(user, application, record.scopes, {
-                ip: request.ip,
-                userAgent: request.headers["user-agent"],
-                deviceFingerprint: fingerprint,
-                nonce: record.nonce ?? undefined,
-            });
+            try {
+                return await createTokenResponse(user, application, record.scopes, {
+                    ip: request.ip,
+                    userAgent: request.headers["user-agent"],
+                    deviceFingerprint: fingerprint,
+                    nonce: record.nonce ?? undefined,
+                    ...(storedMfaFactor ? { mfaFactor: storedMfaFactor } : {}),
+                });
+            }
+            catch (err) {
+                if (err instanceof MfaRequiredError) {
+                    return reply.status(400).send({
+                        error: "mfa_required",
+                        error_description: "The approving session did not complete multi-factor authentication. Sign in again with your verification code.",
+                    });
+                }
+                throw err;
+            }
         }
         if (body.grant_type === "refresh_token") {
-            if (!body.refresh_token) {
+            if (!body.refresh_token || !body.client_id || !body.client_secret) {
+                await request.audit("oauth2_refresh_failed", {
+                    clientId: body.client_id,
+                    reason: "invalid_request",
+                });
                 return reply.status(400).send({ error: "invalid_request" });
             }
+            const application = await verifyClientSecret(body.client_id, body.client_secret);
+            if (!application) {
+                await request.audit("oauth2_refresh_failed", {
+                    clientId: body.client_id,
+                    reason: "invalid_client",
+                });
+                return reply.status(401).send({ error: "invalid_client" });
+            }
             // Lazy import to avoid circular dependency.
-            const tokens = await rotateRefreshToken(body.refresh_token, request.ip, request.headers["user-agent"]);
+            const tokens = await rotateRefreshToken(body.refresh_token, request.ip, request.headers["user-agent"], body.client_id, application.id);
             if (!tokens) {
+                request.state.app = application;
+                request.state.org = await app.container.organizationRepository.findById(application.orgId);
+                await request.audit("oauth2_refresh_failed", {
+                    appId: application.id,
+                    orgId: application.orgId,
+                    clientId: application.clientId,
+                    reason: "invalid_grant",
+                });
                 return reply.status(400).send({ error: "invalid_grant" });
             }
+            request.state.auditUserId = tokens.userId;
+            request.state.app = application;
+            request.state.org = await app.container.organizationRepository.findById(application.orgId);
+            request.state.membership = await app.container.organizationRepository.findMembership(application.orgId, tokens.userId);
+            await request.audit("oauth2_refresh", {
+                appId: application.id,
+                orgId: application.orgId,
+                clientId: application.clientId,
+                grantType: "refresh_token",
+            });
             return {
                 access_token: tokens.accessToken,
                 refresh_token: tokens.refreshToken,
@@ -190,7 +272,7 @@ export default async function oauth2Routes(app) {
             picture: user.avatarUrl,
         };
     });
-    app.post("/revoke", async (request, reply) => {
+    app.post("/revoke", async (request) => {
         const body = z.object({ token: z.string() }).parse(request.body);
         await revokeRefreshToken(body.token);
         await request.audit("oauth2_revoke", {});
@@ -202,6 +284,17 @@ export default async function oauth2Routes(app) {
         if (!application) {
             return reply.status(400).send({ error: "invalid_client" });
         }
+        const membership = await app.container.organizationRepository.findMembership(application.orgId, request.user.id);
+        if (!membership) {
+            await request.audit("unauthorized_access", {
+                action: "oauth_application_tenant_membership",
+                appId: application.id,
+                orgId: application.orgId,
+            });
+            return reply.status(403).send({ error: "not_member" });
+        }
+        request.state.membership = membership;
+        request.state.org = await app.container.organizationRepository.findById(application.orgId);
         if (body.grant) {
             await grantConsent(request.user.id, application.id, body.scopes);
         }

package/dist/routes/oauth2.js.map

@@ -1 +1 @@
-{"version":3,"file":"oauth2.js","sourceRoot":"","sources":["../../src/routes/oauth2.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AACtC,OAAO,EACL,sBAAsB,EACtB,wBAAwB,EACxB,UAAU,EACV,UAAU,EACV,YAAY,EACZ,aAAa,EACb,mBAAmB,EACnB,yBAAyB,EACzB,kBAAkB,GACnB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACpD,OAAO,EAAE,kBAAkB,EAAE,4BAA4B,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAC7G,OAAO,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAC;AAChE,OAAO,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AAEpD,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IAC9B,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;IAChC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IAC3C,qBAAqB,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;IACxC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC7B,CAAC,CAAC;AAEH,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/B,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,oBAAoB,EAAE,eAAe,EAAE,oBAAoB,CAAC,CAAC;IACjF,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3B,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IACzC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IACrD,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC7B,CAAC,CAAC;AAEH,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACjC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACvC,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE;CACnB,CAAC,CAAC;AAOH,SAAS,wBAAwB,CAAC,OAAuB,EAAE,IAAuB;IAChF,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC;IACjD,IAAI,UAAU,EAAE,WAAW,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QACnD,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YAC5E,MAAM,CAAC,QAAQ,EAAE,YAAY,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACpD,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC;QACpC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,OAAO,CAAC,KAAK,UAAU,YAAY,CAAC,GAAoB;IAC7D,GAAG,CAAC,GAAG,CACL,YAAY,EACZ;QACE,UAAU,EAAE;YACV,GAAG,CAAC,YAAY;YAChB,SAAS,CAAC,EAAE,SAAS,EAAE,kBAAkB,EAAE,WAAW,EAAE,EAAE,EAAE,aAAa,EAAE,EAAE,EAAE,CAAC;SACjF;KACF,EACD,KAAK,EAAE,OAAuB,EAAE,KAAmB,EAAE,EAAE;QACrD,MAAM,KAAK,GAAG,oBAAoB,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAExD,MAAM,WAAW,GAAG,MAAM,yBAAyB,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QACrE,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,CAAC,CAAC;QAClG,CAAC;QAED,IAAI,CAAC,WAAW,CAAC,YAAY,CAAC,QAAQ,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC;YAC3D,OAAO,KAAK;iBACT,MAAM,CAAC,GAAG,CAAC;iBACX,IAAI,CAAC,EAAE,KAAK,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,6BAA6B,EAAE,CAAC,CAAC;QAC/F,CAAC;QAED,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAEzE,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,IAAK,CAAC,EAAE,EAAE,WAAW,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QAC3E,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBAC5B,KAAK,EAAE,kBAAkB;gBACzB,iBAAiB,EAAE,uBAAuB;aAC3C,CAAC,CAAC;QACL,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,sBAAsB,CAAC;YAC1C,KAAK,EAAE,WAAW,CAAC,EAAE;YACrB,MAAM,EAAE,OAAO,CAAC,IAAK,CAAC,EAAE;YACxB,SAAS,EAAE,KAAK,CAAC,cAAc;YAC/B,eAAe,EAAE,KAAK,CAAC,qBAAqB;YAC5C,WAAW,EAAE,KAAK,CAAC,YAAY;YAC/B,MAAM;YACN,KAAK,EAAE,KAAK,CAAC,KAAK;SACnB,CAAC,CAAC;QAEH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QACxC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;QAC1C,IAAI,KAAK,CAAC,KAAK;YAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;QAE5D,MAAM,OAAO,CAAC,KAAK,CAAC,kBAAkB,EAAE;YACtC,KAAK,EAAE,WAAW,CAAC,EAAE;YACrB,QAAQ,EAAE,WAAW,CAAC,QAAQ;SAC/B,CAAC,CAAC;QAEH,OAAO,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;IACxC,CAAC,CACF,CAAC;IAEF,GAAG,CAAC,IAAI,CACN,QAAQ,EACR;QACE,UAAU,EAAE,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,cAAc,EAAE,WAAW,EAAE,EAAE,EAAE,aAAa,EAAE,EAAE,EAAE,CAAC,CAAC;KAC3F,EACD,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QACvB,MAAM,UAAU,GAAG,eAAe,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACvD,MAAM,WAAW,GAAG,wBAAwB,CAAC,OAAO,EAAE;YACpD,QAAQ,EAAE,UAAU,CAAC,SAAS;YAC9B,YAAY,EAAE,UAAU,CAAC,aAAa;SACvC,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,EAAE,GAAG,UAAU,EAAE,SAAS,EAAE,WAAW,CAAC,QAAQ,EAAE,aAAa,EAAE,WAAW,CAAC,YAAY,EAAE,CAAC;QAEzG,IAAI,IAAI,CAAC,UAAU,KAAK,oBAAoB,EAAE,CAAC;YAC7C,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;gBACxD,OAAO,KAAK;qBACT,MAAM,CAAC,GAAG,CAAC;qBACX,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,gDAAgD,EAAE,CAAC,CAAC;YAC7G,CAAC;YAED,MAAM,WAAW,GAAG,MAAM,yBAAyB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACpE,IAAI,CAAC,WAAW,EAAE,CAAC;gBACjB,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;YAC7D,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,wBAAwB,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,EAAE,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;YAC5F,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,CAAC;YAC5D,CAAC;YAED,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,CAAC;YACpC,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,wBAAwB,EAAE,CAAC,CAAC;YAC3G,CAAC;YAED,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,eAAe,EAAE,QAAQ,CAAC,EAAE,CAAC;gBACpE,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,iBAAiB,EAAE,0BAA0B,EAAE,CAAC,CAAC;YAC3G,CAAC;YAED,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAC/C,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,CAAC;YAC5D,CAAC;YAED,MAAM,OAAO,CAAC,KAAK,CAAC,cAAc,EAAE;gBAClC,KAAK,EAAE,WAAW,CAAC,EAAE;gBACrB,QAAQ,EAAE,WAAW,CAAC,QAAQ;gBAC9B,SAAS,EAAE,oBAAoB;aAChC,CAAC,CAAC;YAEH,MAAM,WAAW,GAAG,sBAAsB,CAAC,OAAO,CAAC,CAAC;YACpD,OAAO,mBAAmB,CAAC,IAAI,EAAE,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE;gBAC3D,EAAE,EAAE,OAAO,CAAC,EAAE;gBACd,SAAS,EAAE,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC;gBACxC,iBAAiB,EAAE,WAAW;gBAC9B,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,SAAS;aACjC,CAAC,CAAC;QACL,CAAC;QAED,IAAI,IAAI,CAAC,UAAU,KAAK,eAAe,EAAE,CAAC;YACxC,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;gBACxB,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CAAC;YAC9D,CAAC;YAED,4CAA4C;YAC5C,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,IAAI,CAAC,aAAa,EAAE,OAAO,CAAC,EAAE,EAAE,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC;YACvG,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,CAAC;YAC5D,CAAC;YAED,OAAO;gBACL,YAAY,EAAE,MAAM,CAAC,WAAW;gBAChC,aAAa,EAAE,MAAM,CAAC,YAAY;gBAClC,UAAU,EAAE,QAAQ;gBACpB,UAAU,EAAE,MAAM,CAAC,wBAAwB;aAC5C,CAAC;QACJ,CAAC;QAED,IAAI,IAAI,CAAC,UAAU,KAAK,oBAAoB,EAAE,CAAC;YAC7C,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;gBAC3C,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,6BAA6B,EAAE,CAAC,CAAC;YAChH,CAAC;YAED,MAAM,WAAW,GAAG,MAAM,kBAAkB,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC;YACjF,IAAI,CAAC,WAAW,EAAE,CAAC;gBACjB,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;YAC7D,CAAC;YAED,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACvE,MAAM,WAAW,GAAG,MAAM,4BAA4B,CAAC;gBACrD,KAAK,EAAE,WAAW,CAAC,EAAE;gBACrB,KAAK,EAAE,WAAW,CAAC,KAAK;gBACxB,QAAQ,EAAE,WAAW,CAAC,QAAQ;gBAC9B,MAAM;aACP,CAAC,CAAC;YAEH,MAAM,OAAO,CAAC,KAAK,CAAC,2BAA2B,EAAE;gBAC/C,KAAK,EAAE,WAAW,CAAC,EAAE;gBACrB,QAAQ,EAAE,WAAW,CAAC,QAAQ;aAC/B,CAAC,CAAC;YAEH,OAAO;gBACL,YAAY,EAAE,WAAW;gBACzB,UAAU,EAAE,QAAQ;gBACpB,UAAU,EAAE,MAAM,CAAC,wBAAwB;gBAC3C,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;aACxB,CAAC;QACJ,CAAC;QAED,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,wBAAwB,EAAE,CAAC,CAAC;IACrE,CAAC,CACF,CAAC;IAEF,GAAG,CAAC,GAAG,CACL,WAAW,EACX,EAAE,UAAU,EAAE,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,EAClC,KAAK,EAAE,OAAuB,EAAE,EAAE;QAChC,MAAM,IAAI,GAAG,OAAO,CAAC,IAAK,CAAC;QAC3B,OAAO;YACL,GAAG,EAAE,IAAI,CAAC,EAAE;YACZ,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,cAAc,EAAE,IAAI,CAAC,aAAa;YAClC,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,OAAO,EAAE,IAAI,CAAC,SAAS;SACxB,CAAC;IACJ,CAAC,CACF,CAAC;IAEF,GAAG,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QAC3C,MAAM,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACjE,MAAM,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrC,MAAM,OAAO,CAAC,KAAK,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC;QACzC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CACN,UAAU,EACV,EAAE,UAAU,EAAE,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,EAClC,KAAK,EAAE,OAAuB,EAAE,KAAmB,EAAE,EAAE;QACrD,MAAM,IAAI,GAAG,iBAAiB,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACnD,MAAM,WAAW,GAAG,MAAM,yBAAyB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACpE,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;QAC7D,CAAC;QAED,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACf,MAAM,YAAY,CAAC,OAAO,CAAC,IAAK,CAAC,EAAE,EAAE,WAAW,CAAC,EAAE,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QACpE,CAAC;aAAM,CAAC;YACN,MAAM,aAAa,CAAC,OAAO,CAAC,IAAK,CAAC,EAAE,EAAE,WAAW,CAAC,EAAE,CAAC,CAAC;QACxD,CAAC;QAED,MAAM,OAAO,CAAC,KAAK,CAAC,gBAAgB,EAAE;YACpC,KAAK,EAAE,WAAW,CAAC,EAAE;YACrB,OAAO,EAAE,IAAI,CAAC,KAAK;YACnB,MAAM,EAAE,IAAI,CAAC,MAAM;SACpB,CAAC,CAAC;QAEH,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC,CACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"oauth2.js","sourceRoot":"","sources":["../../src/routes/oauth2.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AACtC,OAAO,EACL,sBAAsB,EACtB,wBAAwB,EACxB,UAAU,EACV,UAAU,EACV,YAAY,EACZ,aAAa,EACb,mBAAmB,EACnB,yBAAyB,EACzB,kBAAkB,GACnB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACpD,OAAO,EACL,kBAAkB,EAClB,4BAA4B,EAC5B,kBAAkB,EAClB,gBAAgB,GAEjB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAC;AAChE,OAAO,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AAEpD,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IAC9B,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;IAChC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IAC3C,qBAAqB,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;IACxC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC7B,CAAC,CAAC;AAEH,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/B,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,oBAAoB,EAAE,eAAe,EAAE,oBAAoB,CAAC,CAAC;IACjF,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3B,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IACzC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IACrD,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC7B,CAAC,CAAC;AAEH,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACjC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACvC,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE;CACnB,CAAC,CAAC;AAOH,MAAM,cAAc,GAAG,IAAI,GAAG,CAAS,CAAC,MAAM,EAAE,aAAa,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC,CAAC;AAEvF;;;;GAIG;AACH,SAAS,cAAc,CAAC,KAAgC;IACtD,OAAO,KAAK,IAAI,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAE,KAAsB,CAAC,CAAC,CAAC,SAAS,CAAC;AAClF,CAAC;AAED,SAAS,wBAAwB,CAAC,OAAuB,EAAE,IAAuB;IAChF,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC;IACjD,IAAI,UAAU,EAAE,WAAW,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QACnD,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YAC5E,MAAM,CAAC,QAAQ,EAAE,YAAY,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACpD,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC;QACpC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,OAAO,CAAC,KAAK,UAAU,YAAY,CAAC,GAAoB;IAC7D,GAAG,CAAC,GAAG,CACL,YAAY,EACZ;QACE,UAAU,EAAE;YACV,GAAG,CAAC,YAAY;YAChB,SAAS,CAAC,EAAE,SAAS,EAAE,kBAAkB,EAAE,WAAW,EAAE,EAAE,EAAE,aAAa,EAAE,EAAE,EAAE,CAAC;SACjF;KACF,EACD,KAAK,EAAE,OAAuB,EAAE,KAAmB,EAAE,EAAE;QACrD,MAAM,KAAK,GAAG,oBAAoB,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAExD,MAAM,WAAW,GAAG,MAAM,yBAAyB,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QACrE,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,CAAC,CAAC;QAClG,CAAC;QAED,MAAM,UAAU,GAAG,MAAM,GAAG,CAAC,SAAS,CAAC,sBAAsB,CAAC,cAAc,CAC1E,WAAW,CAAC,KAAK,EACjB,OAAO,CAAC,IAAK,CAAC,EAAE,CACjB,CAAC;QACF,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,OAAO,CAAC,KAAK,CAAC,qBAAqB,EAAE;gBACzC,MAAM,EAAE,qCAAqC;gBAC7C,KAAK,EAAE,WAAW,CAAC,EAAE;gBACrB,KAAK,EAAE,WAAW,CAAC,KAAK;aACzB,CAAC,CAAC;YACH,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBAC5B,KAAK,EAAE,YAAY;gBACnB,iBAAiB,EAAE,sDAAsD;aAC1E,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,WAAW,CAAC,YAAY,CAAC,QAAQ,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC;YAC3D,OAAO,KAAK;iBACT,MAAM,CAAC,GAAG,CAAC;iBACX,IAAI,CAAC,EAAE,KAAK,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,6BAA6B,EAAE,CAAC,CAAC;QAC/F,CAAC;QAED,OAAO,CAAC,KAAK,CAAC,UAAU,GAAG,UAAU,CAAC;QACtC,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,MAAM,GAAG,CAAC,SAAS,CAAC,sBAAsB,CAAC,QAAQ,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;QAC3F,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAEzE,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,IAAK,CAAC,EAAE,EAAE,WAAW,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QAC3E,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBAC5B,KAAK,EAAE,kBAAkB;gBACzB,iBAAiB,EAAE,uBAAuB;aAC3C,CAAC,CAAC;QACL,CAAC;QAED,wEAAwE;QACxE,yEAAyE;QACzE,MAAM,gBAAgB,GAAG,cAAc,CAAC,OAAO,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;QAExE,MAAM,MAAM,GAAG,MAAM,sBAAsB,CAAC;YAC1C,KAAK,EAAE,WAAW,CAAC,EAAE;YACrB,MAAM,EAAE,OAAO,CAAC,IAAK,CAAC,EAAE;YACxB,SAAS,EAAE,KAAK,CAAC,cAAc;YAC/B,eAAe,EAAE,KAAK,CAAC,qBAAqB;YAC5C,WAAW,EAAE,KAAK,CAAC,YAAY;YAC/B,MAAM;YACN,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC7D,CAAC,CAAC;QAEH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QACxC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;QAC1C,IAAI,KAAK,CAAC,KAAK;YAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;QAE5D,MAAM,OAAO,CAAC,KAAK,CAAC,kBAAkB,EAAE;YACtC,KAAK,EAAE,WAAW,CAAC,EAAE;YACrB,QAAQ,EAAE,WAAW,CAAC,QAAQ;SAC/B,CAAC,CAAC;QAEH,OAAO,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;IACxC,CAAC,CACF,CAAC;IAEF,GAAG,CAAC,IAAI,CACN,QAAQ,EACR;QACE,UAAU,EAAE,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,cAAc,EAAE,WAAW,EAAE,EAAE,EAAE,aAAa,EAAE,EAAE,EAAE,CAAC,CAAC;KAC3F,EACD,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QACvB,MAAM,UAAU,GAAG,eAAe,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACvD,MAAM,WAAW,GAAG,wBAAwB,CAAC,OAAO,EAAE;YACpD,QAAQ,EAAE,UAAU,CAAC,SAAS;YAC9B,YAAY,EAAE,UAAU,CAAC,aAAa;SACvC,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,EAAE,GAAG,UAAU,EAAE,SAAS,EAAE,WAAW,CAAC,QAAQ,EAAE,aAAa,EAAE,WAAW,CAAC,YAAY,EAAE,CAAC;QAEzG,IAAI,IAAI,CAAC,UAAU,KAAK,oBAAoB,EAAE,CAAC;YAC7C,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;gBACxD,OAAO,KAAK;qBACT,MAAM,CAAC,GAAG,CAAC;qBACX,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,gDAAgD,EAAE,CAAC,CAAC;YAC7G,CAAC;YAED,MAAM,WAAW,GAAG,MAAM,yBAAyB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACpE,IAAI,CAAC,WAAW,EAAE,CAAC;gBACjB,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;YAC7D,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,wBAAwB,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,EAAE,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;YAC5F,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,CAAC;YAC5D,CAAC;YAED,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,CAAC;YACpC,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,wBAAwB,EAAE,CAAC,CAAC;YAC3G,CAAC;YAED,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,eAAe,EAAE,QAAQ,CAAC,EAAE,CAAC;gBACpE,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,iBAAiB,EAAE,0BAA0B,EAAE,CAAC,CAAC;YAC3G,CAAC;YAED,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAC/C,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,CAAC;gBACpB,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,CAAC;YAC5D,CAAC;YAED,MAAM,UAAU,GAAG,MAAM,GAAG,CAAC,SAAS,CAAC,sBAAsB,CAAC,cAAc,CAC1E,WAAW,CAAC,KAAK,EACjB,IAAI,CAAC,EAAE,CACR,CAAC;YACF,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,MAAM,OAAO,CAAC,KAAK,CAAC,qBAAqB,EAAE;oBACzC,MAAM,EAAE,qCAAqC;oBAC7C,KAAK,EAAE,WAAW,CAAC,EAAE;oBACrB,KAAK,EAAE,WAAW,CAAC,KAAK;iBACzB,CAAC,CAAC;gBACH,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,CAAC;YAC5D,CAAC;YAED,OAAO,CAAC,KAAK,CAAC,WAAW,GAAG,IAAI,CAAC,EAAE,CAAC;YACpC,OAAO,CAAC,KAAK,CAAC,UAAU,GAAG,UAAU,CAAC;YACtC,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,MAAM,GAAG,CAAC,SAAS,CAAC,sBAAsB,CAAC,QAAQ,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;YAC3F,MAAM,OAAO,CAAC,KAAK,CAAC,cAAc,EAAE;gBAClC,KAAK,EAAE,WAAW,CAAC,EAAE;gBACrB,QAAQ,EAAE,WAAW,CAAC,QAAQ;gBAC9B,SAAS,EAAE,oBAAoB;aAChC,CAAC,CAAC;YAEH,MAAM,eAAe,GAAG,cAAc,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YACzD,MAAM,WAAW,GAAG,sBAAsB,CAAC,OAAO,CAAC,CAAC;YACpD,IAAI,CAAC;gBACH,OAAO,MAAM,mBAAmB,CAAC,IAAI,EAAE,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE;oBACjE,EAAE,EAAE,OAAO,CAAC,EAAE;oBACd,SAAS,EAAE,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC;oBACxC,iBAAiB,EAAE,WAAW;oBAC9B,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,SAAS;oBAChC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAC3D,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,GAAG,YAAY,gBAAgB,EAAE,CAAC;oBACpC,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;wBAC5B,KAAK,EAAE,cAAc;wBACrB,iBAAiB,EACf,gHAAgH;qBACnH,CAAC,CAAC;gBACL,CAAC;gBACD,MAAM,GAAG,CAAC;YACZ,CAAC;QACH,CAAC;QAED,IAAI,IAAI,CAAC,UAAU,KAAK,eAAe,EAAE,CAAC;YACxC,IAAI,CAAC,IAAI,CAAC,aAAa,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;gBAClE,MAAM,OAAO,CAAC,KAAK,CAAC,uBAAuB,EAAE;oBAC3C,QAAQ,EAAE,IAAI,CAAC,SAAS;oBACxB,MAAM,EAAE,iBAAiB;iBAC1B,CAAC,CAAC;gBACH,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CAAC;YAC9D,CAAC;YACD,MAAM,WAAW,GAAG,MAAM,kBAAkB,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC;YACjF,IAAI,CAAC,WAAW,EAAE,CAAC;gBACjB,MAAM,OAAO,CAAC,KAAK,CAAC,uBAAuB,EAAE;oBAC3C,QAAQ,EAAE,IAAI,CAAC,SAAS;oBACxB,MAAM,EAAE,gBAAgB;iBACzB,CAAC,CAAC;gBACH,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;YAC7D,CAAC;YAED,4CAA4C;YAC5C,MAAM,MAAM,GAAG,MAAM,kBAAkB,CACrC,IAAI,CAAC,aAAa,EAClB,OAAO,CAAC,EAAE,EACV,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,EAC7B,IAAI,CAAC,SAAS,EACd,WAAW,CAAC,EAAE,CACf,CAAC;YACF,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,WAAW,CAAC;gBAChC,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,MAAM,GAAG,CAAC,SAAS,CAAC,sBAAsB,CAAC,QAAQ,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;gBAC3F,MAAM,OAAO,CAAC,KAAK,CAAC,uBAAuB,EAAE;oBAC3C,KAAK,EAAE,WAAW,CAAC,EAAE;oBACrB,KAAK,EAAE,WAAW,CAAC,KAAK;oBACxB,QAAQ,EAAE,WAAW,CAAC,QAAQ;oBAC9B,MAAM,EAAE,eAAe;iBACxB,CAAC,CAAC;gBACH,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,CAAC;YAC5D,CAAC;YAED,OAAO,CAAC,KAAK,CAAC,WAAW,GAAG,MAAM,CAAC,MAAM,CAAC;YAC1C,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,WAAW,CAAC;YAChC,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,MAAM,GAAG,CAAC,SAAS,CAAC,sBAAsB,CAAC,QAAQ,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;YAC3F,OAAO,CAAC,KAAK,CAAC,UAAU,GAAG,MAAM,GAAG,CAAC,SAAS,CAAC,sBAAsB,CAAC,cAAc,CAAC,WAAW,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;YACvH,MAAM,OAAO,CAAC,KAAK,CAAC,gBAAgB,EAAE;gBACpC,KAAK,EAAE,WAAW,CAAC,EAAE;gBACrB,KAAK,EAAE,WAAW,CAAC,KAAK;gBACxB,QAAQ,EAAE,WAAW,CAAC,QAAQ;gBAC9B,SAAS,EAAE,eAAe;aAC3B,CAAC,CAAC;YACH,OAAO;gBACL,YAAY,EAAE,MAAM,CAAC,WAAW;gBAChC,aAAa,EAAE,MAAM,CAAC,YAAY;gBAClC,UAAU,EAAE,QAAQ;gBACpB,UAAU,EAAE,MAAM,CAAC,wBAAwB;aAC5C,CAAC;QACJ,CAAC;QAED,IAAI,IAAI,CAAC,UAAU,KAAK,oBAAoB,EAAE,CAAC;YAC7C,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;gBAC3C,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,6BAA6B,EAAE,CAAC,CAAC;YAChH,CAAC;YAED,MAAM,WAAW,GAAG,MAAM,kBAAkB,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC;YACjF,IAAI,CAAC,WAAW,EAAE,CAAC;gBACjB,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;YAC7D,CAAC;YAED,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACvE,MAAM,WAAW,GAAG,MAAM,4BAA4B,CAAC;gBACrD,KAAK,EAAE,WAAW,CAAC,EAAE;gBACrB,KAAK,EAAE,WAAW,CAAC,KAAK;gBACxB,QAAQ,EAAE,WAAW,CAAC,QAAQ;gBAC9B,MAAM;aACP,CAAC,CAAC;YAEH,MAAM,OAAO,CAAC,KAAK,CAAC,2BAA2B,EAAE;gBAC/C,KAAK,EAAE,WAAW,CAAC,EAAE;gBACrB,QAAQ,EAAE,WAAW,CAAC,QAAQ;aAC/B,CAAC,CAAC;YAEH,OAAO;gBACL,YAAY,EAAE,WAAW;gBACzB,UAAU,EAAE,QAAQ;gBACpB,UAAU,EAAE,MAAM,CAAC,wBAAwB;gBAC3C,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;aACxB,CAAC;QACJ,CAAC;QAED,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,wBAAwB,EAAE,CAAC,CAAC;IACrE,CAAC,CACF,CAAC;IAEF,GAAG,CAAC,GAAG,CACL,WAAW,EACX,EAAE,UAAU,EAAE,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,EAClC,KAAK,EAAE,OAAuB,EAAE,EAAE;QAChC,MAAM,IAAI,GAAG,OAAO,CAAC,IAAK,CAAC;QAC3B,OAAO;YACL,GAAG,EAAE,IAAI,CAAC,EAAE;YACZ,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,cAAc,EAAE,IAAI,CAAC,aAAa;YAClC,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,OAAO,EAAE,IAAI,CAAC,SAAS;SACxB,CAAC;IACJ,CAAC,CACF,CAAC;IAEF,GAAG,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QACpC,MAAM,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACjE,MAAM,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrC,MAAM,OAAO,CAAC,KAAK,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC;QACzC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CACN,UAAU,EACV,EAAE,UAAU,EAAE,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,EAClC,KAAK,EAAE,OAAuB,EAAE,KAAmB,EAAE,EAAE;QACrD,MAAM,IAAI,GAAG,iBAAiB,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACnD,MAAM,WAAW,GAAG,MAAM,yBAAyB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACpE,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;QAC7D,CAAC;QAED,MAAM,UAAU,GAAG,MAAM,GAAG,CAAC,SAAS,CAAC,sBAAsB,CAAC,cAAc,CAC1E,WAAW,CAAC,KAAK,EACjB,OAAO,CAAC,IAAK,CAAC,EAAE,CACjB,CAAC;QACF,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,OAAO,CAAC,KAAK,CAAC,qBAAqB,EAAE;gBACzC,MAAM,EAAE,qCAAqC;gBAC7C,KAAK,EAAE,WAAW,CAAC,EAAE;gBACrB,KAAK,EAAE,WAAW,CAAC,KAAK;aACzB,CAAC,CAAC;YACH,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,CAAC;QACzD,CAAC;QAED,OAAO,CAAC,KAAK,CAAC,UAAU,GAAG,UAAU,CAAC;QACtC,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,MAAM,GAAG,CAAC,SAAS,CAAC,sBAAsB,CAAC,QAAQ,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;QAC3F,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACf,MAAM,YAAY,CAAC,OAAO,CAAC,IAAK,CAAC,EAAE,EAAE,WAAW,CAAC,EAAE,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QACpE,CAAC;aAAM,CAAC;YACN,MAAM,aAAa,CAAC,OAAO,CAAC,IAAK,CAAC,EAAE,EAAE,WAAW,CAAC,EAAE,CAAC,CAAC;QACxD,CAAC;QAED,MAAM,OAAO,CAAC,KAAK,CAAC,gBAAgB,EAAE;YACpC,KAAK,EAAE,WAAW,CAAC,EAAE;YACrB,OAAO,EAAE,IAAI,CAAC,KAAK;YACnB,MAAM,EAAE,IAAI,CAAC,MAAM;SACpB,CAAC,CAAC;QAEH,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC,CACF,CAAC;AACJ,CAAC"}

package/dist/routes/oidcEnterprise.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oidcEnterprise.d.ts","sourceRoot":"","sources":["../../src/routes/oidcEnterprise.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAgC,MAAM,SAAS,CAAC;AAgC7E,wBAA8B,oBAAoB,CAAC,GAAG,EAAE,eAAe,iBAoItE"}
+{"version":3,"file":"oidcEnterprise.d.ts","sourceRoot":"","sources":["../../src/routes/oidcEnterprise.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,eAAe,EAAgC,MAAM,SAAS,CAAC;AAmC7E,wBAA8B,oBAAoB,CAAC,GAAG,EAAE,eAAe,iBA8KtE"}

package/dist/routes/oidcEnterprise.js

@@ -1,10 +1,15 @@
 import crypto from "node:crypto";
+import { config } from "../config.js";
+import { createRemoteJWKSet, jwtVerify } from "jose";
 import { provisionEnterpriseUser, defaultRoleForOrg } from "../services/enterpriseSso.js";
 import { createTokenSet } from "../services/tokens.js";
 import { setSessionCookies, clearSessionCookies } from "../plugins/auth.js";
 import { fingerprintFromRequest, recordDevice } from "../services/devices.js";
-import { toPublicUser } from "../types.js";
+import { toSelfUser } from "../types.js";
+import { assertSafeSsoEndpoint, customFetch, fetchSsoEndpoint, safeJwksFetch } from "../services/ssoEndpointPolicy.js";
 import { buildOAuthErrorResponse } from "../lib/errors.js";
+import { decryptSecret } from "../services/secrets/index.js";
+import { isLegacyOidcSecret, LEGACY_OIDC_SECRET_PREFIX } from "../services/oidcSecretFormat.js";
 const OIDC_STATE_COOKIE = "keystone_oidc_enterprise_state";
 function publicUrl() {
     return process.env.AUTH_API_PUBLIC_URL || "http://localhost:4001";
@@ -13,7 +18,7 @@ function setStateCookie(reply, state) {
     reply.setCookie(OIDC_STATE_COOKIE, state, {
         path: "/",
         httpOnly: true,
-        secure: process.env.COOKIE_SECURE === "true",
+        secure: config.COOKIE_SECURE,
         sameSite: "lax",
         maxAge: 600,
     });
@@ -27,13 +32,16 @@ function clearStateCookie(reply) {
 export default async function oidcEnterpriseRoutes(app) {
     app.get("/sso/oidc/:connectionId", async (request, reply) => {
         const { connectionId } = request.params;
-        const connection = await app.container.oidcConnectionRepository.findActiveById(connectionId);
+        const orgId = request.query.orgId;
+        if (!orgId)
+            return reply.status(400).send({ error: "orgId is required" });
+        const connection = await app.container.oidcConnectionRepository.findActiveByIdAndOrgId(connectionId, orgId);
         if (!connection) {
             return reply.status(404).send({ error: "OIDC connection not found" });
         }
         const state = crypto.randomBytes(24).toString("base64url");
-        setStateCookie(reply, `${state}:${connectionId}`);
-        const redirectUri = `${publicUrl()}/sso/oidc/${connectionId}/callback`;
+        setStateCookie(reply, `${state}:${connectionId}:${orgId}`);
+        const redirectUri = `${publicUrl()}/sso/oidc/${connectionId}/callback?orgId=${encodeURIComponent(orgId)}`;
         const url = new URL(connection.authorizationEndpoint);
         url.searchParams.set("client_id", connection.clientId);
         url.searchParams.set("response_type", "code");
@@ -45,30 +53,50 @@ export default async function oidcEnterpriseRoutes(app) {
     app.get("/sso/oidc/:connectionId/callback", async (request, reply) => {
         const { connectionId } = request.params;
         const query = request.query;
+        const cookieState = getStateCookie(request);
+        if (!query.state || !query.orgId || !cookieState) {
+            clearStateCookie(reply);
+            return reply.status(400).send({ error: "Invalid OIDC state" });
+        }
+        const [cookieStateValue, cookieConnectionId, cookieOrgId] = cookieState.split(":");
+        if (cookieStateValue !== query.state || cookieConnectionId !== connectionId || cookieOrgId !== query.orgId) {
+            clearStateCookie(reply);
+            return reply.status(400).send({ error: "Invalid OIDC state" });
+        }
+        clearStateCookie(reply);
         if (query.error) {
-            clearSessionCookies(reply);
             const idpError = new Error(`Identity provider error: ${query.error}${query.error_description ? ` - ${query.error_description}` : ""}`);
             const { statusCode, body } = buildOAuthErrorResponse(idpError);
             return reply.status(statusCode).send(body);
         }
-        const cookieState = getStateCookie(request);
-        clearStateCookie(reply);
-        if (!query.code || !query.state || !cookieState || !cookieState.startsWith(`${query.state}:`)) {
+        if (!query.code) {
             return reply.status(400).send({ error: "Invalid OIDC state" });
         }
-        const connection = await app.container.oidcConnectionRepository.findActiveById(connectionId);
+        const connection = await app.container.oidcConnectionRepository.findActiveByIdAndOrgId(connectionId, query.orgId);
         if (!connection) {
             return reply.status(400).send({ error: "OIDC connection not found" });
         }
-        const redirectUri = `${publicUrl()}/sso/oidc/${connectionId}/callback`;
+        const redirectUri = `${publicUrl()}/sso/oidc/${connectionId}/callback?orgId=${encodeURIComponent(query.orgId)}`;
         try {
-            const tokenRes = await fetch(connection.tokenEndpoint, {
+            let clientSecret;
+            if (isLegacyOidcSecret(connection.clientSecret)) {
+                clientSecret = connection.clientSecret.slice(LEGACY_OIDC_SECRET_PREFIX.length);
+                await app.container.oidcConnectionRepository.updateClientSecret(connection.id, clientSecret);
+            }
+            else {
+                clientSecret = await decryptSecret(connection.clientSecret);
+            }
+            const userinfoEndpoint = await assertSafeSsoEndpoint(connection.userinfoEndpoint ||
+                (connection.scopes.includes("openid")
+                    ? `${connection.issuer}/oauth/v2/userinfo`
+                    : `${connection.issuer}/userinfo`), "userinfoEndpoint");
+            const tokenRes = await fetchSsoEndpoint(connection.tokenEndpoint, "tokenEndpoint", {
                 method: "POST",
                 headers: { "Content-Type": "application/x-www-form-urlencoded" },
                 body: new URLSearchParams({
                     grant_type: "authorization_code",
                     client_id: connection.clientId,
-                    client_secret: connection.clientSecret,
+                    client_secret: clientSecret,
                     code: query.code,
                     redirect_uri: redirectUri,
                 }).toString(),
@@ -78,25 +106,43 @@ export default async function oidcEnterpriseRoutes(app) {
                 throw new Error(`Token exchange failed: ${tokenRes.status} ${text}`);
             }
             const tokenData = (await tokenRes.json());
-            const userinfoRes = await fetch(connection.userinfoEndpoint ||
-                connection.scopes.includes("openid")
-                ? `${connection.issuer}/oauth/v2/userinfo`
-                : `${connection.issuer}/userinfo`, {
+            if (!tokenData.id_token || !connection.jwksUri) {
+                throw new Error("OIDC provider did not return a verifiable ID token");
+            }
+            const jwks = createRemoteJWKSet(await assertSafeSsoEndpoint(connection.jwksUri, "jwksUri"), {
+                [customFetch]: safeJwksFetch,
+            });
+            const verifiedIdToken = await jwtVerify(tokenData.id_token, jwks, {
+                issuer: connection.issuer,
+                audience: connection.clientId,
+            });
+            const userinfoRes = await fetchSsoEndpoint(userinfoEndpoint.toString(), "userinfoEndpoint", {
                 headers: { Authorization: `Bearer ${tokenData.access_token}` },
             });
             if (!userinfoRes.ok) {
                 throw new Error(`Userinfo request failed: ${userinfoRes.status}`);
             }
             const userinfo = (await userinfoRes.json());
-            if (!userinfo.email) {
-                throw new Error("OIDC provider did not return an email");
+            if (!userinfo.sub || !userinfo.email) {
+                throw new Error("OIDC provider did not return a verified subject and email");
+            }
+            if (userinfo.email_verified !== true || verifiedIdToken.payload.email_verified !== true) {
+                throw new Error("OIDC provider did not verify the email address");
+            }
+            if (verifiedIdToken.payload.sub !== userinfo.sub ||
+                (typeof verifiedIdToken.payload.email === "string" && verifiedIdToken.payload.email.toLowerCase() !== userinfo.email.toLowerCase())) {
+                throw new Error("OIDC ID token and userinfo subject did not match");
             }
             const org = await app.container.organizationRepository.findById(connection.orgId);
             const user = await provisionEnterpriseUser(connection.orgId, {
                 email: userinfo.email,
                 name: userinfo.name,
                 username: userinfo.preferred_username,
-            }, org ? defaultRoleForOrg(org) : "member");
+                externalId: userinfo.sub,
+            }, { id: connection.id, type: "oidc" }, org ? defaultRoleForOrg(org) : "member");
+            request.user = user;
+            if (org)
+                request.state.org = org;
             const fingerprint = fingerprintFromRequest(request);
             await recordDevice(user.id, fingerprint, request.ip, request.headers["user-agent"]);
             const tokens = await createTokenSet(user, request.ip, request.headers["user-agent"], { orgId: connection.orgId }, fingerprint);
@@ -106,7 +152,7 @@ export default async function oidcEnterpriseRoutes(app) {
                 connectionId: connection.id,
                 userId: user.id,
             });
-            return { user: toPublicUser(user) };
+            return { user: toSelfUser(user) };
         }
         catch (err) {
             request.log.error({ err }, "OIDC enterprise callback failed");