@hilbras/keystone 1.5.0 → 1.9.0

package/dist/services/connectors/oidc.js

@@ -1,5 +1,6 @@
 import { createRemoteJWKSet, jwtVerify } from "jose";
 import { cache } from "../cache.js";
+import { assertSafeSsoEndpoint, customFetch, fetchSsoEndpoint, safeJwksFetch } from "../ssoEndpointPolicy.js";
 export class OidcConnector {
     id;
     name;
@@ -38,7 +39,7 @@ export class OidcConnector {
             code,
             redirect_uri: redirectUri,
         });
-        const res = await fetch(this.config.tokenEndpoint, {
+        const res = await fetchSsoEndpoint(this.config.tokenEndpoint, "tokenEndpoint", {
             method: "POST",
             headers: { "Content-Type": "application/x-www-form-urlencoded" },
             body: params.toString(),
@@ -58,7 +59,9 @@ export class OidcConnector {
         if (!jwksUrl) {
             throw new Error("OIDC connector missing jwks_uri");
         }
-        const JWKS = createRemoteJWKSet(new URL(jwksUrl));
+        const JWKS = createRemoteJWKSet(await assertSafeSsoEndpoint(jwksUrl, "jwksUri"), {
+            [customFetch]: safeJwksFetch,
+        });
         const { payload } = await jwtVerify(token, JWKS, {
             issuer: this.config.issuer,
             audience: this.config.clientId,
@@ -72,7 +75,7 @@ export class OidcConnector {
         const cached = await cache.get(key);
         if (cached)
             return cached;
-        const res = await fetch(`${this.config.issuer.replace(/\/$/, "")}/.well-known/openid-configuration`);
+        const res = await fetchSsoEndpoint(`${this.config.issuer.replace(/\/$/, "")}/.well-known/openid-configuration`, "issuer");
         if (!res.ok)
             throw new Error(`OIDC discovery failed: ${res.status}`);
         const data = (await res.json());

package/dist/services/connectors/oidc.js.map

@@ -1 +1 @@
-{"version":3,"file":"oidc.js","sourceRoot":"","sources":["../../../src/services/connectors/oidc.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AAErD,OAAO,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AAEpC,MAAM,OAAO,aAAa;IACxB,EAAE,CAAS;IACX,IAAI,CAAS;IACb,IAAI,CAAS;IACH,MAAM,CAAkB;IAElC,YAAY,EAAU,EAAE,IAAY,EAAE,IAAY,EAAE,MAAuB;QACzE,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC;QACb,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;IAED,eAAe,CAAC,IAAyB;QACvC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;QACnF,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;YACjC,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;YAC/B,YAAY,EAAE,IAAI,CAAC,WAAW;YAC9B,aAAa,EAAE,MAAM;YACrB,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;YACvB,KAAK,EAAE,IAAI,CAAC,KAAK;SAClB,CAAC,CAAC;QACH,IAAI,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACxB,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAC9C,CAAC;QACD,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACrB,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;gBACtD,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YACnB,CAAC;QACH,CAAC;QACD,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,qBAAqB,IAAI,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC;IACrE,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,IAAY,EAAE,WAAmB;QAClD,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;YACjC,UAAU,EAAE,oBAAoB;YAChC,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;YAC/B,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,YAAY;YACvC,IAAI;YACJ,YAAY,EAAE,WAAW;SAC1B,CAAC,CAAC;QAEH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,aAAc,EAAE;YAClD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;YAChE,IAAI,EAAE,MAAM,CAAC,QAAQ,EAAE;SACxB,CAAC,CAAC;QAEH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CAAC,+BAA+B,GAAG,CAAC,MAAM,IAAI,IAAI,EAAE,CAAC,CAAC;QACvE,CAAC;QAED,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAgD,CAAC;QAC/E,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACnB,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;QAC9D,CAAC;QACD,OAAO,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACzC,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,KAAa;QAC7B,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,IAAK,CAAC,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC,EAAE,QAAmB,CAAC;QACtF,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;QACrD,CAAC;QACD,MAAM,IAAI,GAAG,kBAAkB,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;QAClD,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE;YAC/C,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM;YAC1B,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;SAC/B,CAAC,CAAC;QACH,OAAO,gBAAgB,CAAC,OAAkC,EAAE,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;IAC5F,CAAC;IAEO,KAAK,CAAC,SAAS;QACrB,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;QACxF,MAAM,GAAG,GAAG,kBAAkB,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;QACnD,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,GAAG,CAA0B,GAAG,CAAC,CAAC;QAC7D,IAAI,MAAM;YAAE,OAAO,MAAM,CAAC;QAE1B,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,mCAAmC,CAAC,CAAC;QACrG,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;QACrE,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA4B,CAAC;QAC3D,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;QACjC,OAAO,IAAI,CAAC;IACd,CAAC;CACF;AAED,MAAM,UAAU,gBAAgB,CAC9B,OAAgC,EAChC,OAAgC;IAEhC,MAAM,CAAC,GAAG,OAAO,IAAI,EAAE,CAAC;IACxB,MAAM,GAAG,GAAG,CAAC,GAAW,EAAW,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC;IAC7D,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;IACzC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACvE,CAAC;IACD,OAAO;QACL,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QAC7B,KAAK;QACL,aAAa,EAAE,GAAG,CAAC,gBAAgB,CAAC,KAAK,IAAI;QAC7C,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS;QACnD,OAAO,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS;QAC5D,QAAQ,EAAE,GAAG,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS;QACnF,GAAG,EAAE,OAAO;KACb,CAAC;AACJ,CAAC"}
+{"version":3,"file":"oidc.js","sourceRoot":"","sources":["../../../src/services/connectors/oidc.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AAErD,OAAO,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AACpC,OAAO,EAAE,qBAAqB,EAAE,WAAW,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAE9G,MAAM,OAAO,aAAa;IACxB,EAAE,CAAS;IACX,IAAI,CAAS;IACb,IAAI,CAAS;IACH,MAAM,CAAkB;IAElC,YAAY,EAAU,EAAE,IAAY,EAAE,IAAY,EAAE,MAAuB;QACzE,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC;QACb,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;IAED,eAAe,CAAC,IAAyB;QACvC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;QACnF,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;YACjC,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;YAC/B,YAAY,EAAE,IAAI,CAAC,WAAW;YAC9B,aAAa,EAAE,MAAM;YACrB,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;YACvB,KAAK,EAAE,IAAI,CAAC,KAAK;SAClB,CAAC,CAAC;QACH,IAAI,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACxB,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAC9C,CAAC;QACD,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACrB,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;gBACtD,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YACnB,CAAC;QACH,CAAC;QACD,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,qBAAqB,IAAI,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC;IACrE,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,IAAY,EAAE,WAAmB;QAClD,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;YACjC,UAAU,EAAE,oBAAoB;YAChC,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;YAC/B,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,YAAY;YACvC,IAAI;YACJ,YAAY,EAAE,WAAW;SAC1B,CAAC,CAAC;QAEH,MAAM,GAAG,GAAG,MAAM,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,aAAc,EAAE,eAAe,EAAE;YAC9E,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;YAChE,IAAI,EAAE,MAAM,CAAC,QAAQ,EAAE;SACxB,CAAC,CAAC;QAEH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CAAC,+BAA+B,GAAG,CAAC,MAAM,IAAI,IAAI,EAAE,CAAC,CAAC;QACvE,CAAC;QAED,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAgD,CAAC;QAC/E,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACnB,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;QAC9D,CAAC;QACD,OAAO,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACzC,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,KAAa;QAC7B,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,IAAK,CAAC,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC,EAAE,QAAmB,CAAC;QACtF,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;QACrD,CAAC;QACD,MAAM,IAAI,GAAG,kBAAkB,CAAC,MAAM,qBAAqB,CAAC,OAAO,EAAE,SAAS,CAAC,EAAE;YAC/E,CAAC,WAAW,CAAC,EAAE,aAAa;SAC7B,CAAC,CAAC;QACH,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE;YAC/C,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM;YAC1B,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;SAC/B,CAAC,CAAC;QACH,OAAO,gBAAgB,CAAC,OAAkC,EAAE,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;IAC5F,CAAC;IAEO,KAAK,CAAC,SAAS;QACrB,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;QACxF,MAAM,GAAG,GAAG,kBAAkB,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;QACnD,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,GAAG,CAA0B,GAAG,CAAC,CAAC;QAC7D,IAAI,MAAM;YAAE,OAAO,MAAM,CAAC;QAE1B,MAAM,GAAG,GAAG,MAAM,gBAAgB,CAChC,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,mCAAmC,EAC3E,QAAQ,CACT,CAAC;QACF,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;QACrE,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA4B,CAAC;QAC3D,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;QACjC,OAAO,IAAI,CAAC;IACd,CAAC;CACF;AAED,MAAM,UAAU,gBAAgB,CAC9B,OAAgC,EAChC,OAAgC;IAEhC,MAAM,CAAC,GAAG,OAAO,IAAI,EAAE,CAAC;IACxB,MAAM,GAAG,GAAG,CAAC,GAAW,EAAW,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC;IAC7D,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;IACzC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACvE,CAAC;IACD,OAAO;QACL,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QAC7B,KAAK;QACL,aAAa,EAAE,GAAG,CAAC,gBAAgB,CAAC,KAAK,IAAI;QAC7C,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS;QACnD,OAAO,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS;QAC5D,QAAQ,EAAE,GAAG,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS;QACnF,GAAG,EAAE,OAAO;KACb,CAAC;AACJ,CAAC"}

package/dist/services/connectors/zitadel.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"zitadel.d.ts","sourceRoot":"","sources":["../../../src/services/connectors/zitadel.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAG5G,qBAAa,gBAAiB,YAAW,iBAAiB;IACxD,EAAE,SAAa;IACf,IAAI,SAAa;IACjB,IAAI,SAAa;IACjB,OAAO,CAAC,GAAG,CAAkB;IAC7B,OAAO,CAAC,aAAa,CAAuB;gBAEhC,GAAG,EAAE,eAAe;IAIhC,eAAe,CAAC,IAAI,EAAE,mBAAmB,GAAG,MAAM;IAe5C,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAwB1E,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC;YAa7C,UAAU;CAQzB"}
+{"version":3,"file":"zitadel.d.ts","sourceRoot":"","sources":["../../../src/services/connectors/zitadel.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAI5G,qBAAa,gBAAiB,YAAW,iBAAiB;IACxD,EAAE,SAAa;IACf,IAAI,SAAa;IACjB,IAAI,SAAa;IACjB,OAAO,CAAC,GAAG,CAAkB;IAC7B,OAAO,CAAC,aAAa,CAAuB;IAE5C,YAAY,GAAG,EAAE,eAAe,EAE/B;IAED,eAAe,CAAC,IAAI,EAAE,mBAAmB,GAAG,MAAM,CAajD;IAEK,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAsB/E;IAEK,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAW1D;YAEa,UAAU;CAQzB"}

package/dist/services/connectors/zitadel.js

@@ -1,6 +1,7 @@
 import { createRemoteJWKSet, jwtVerify } from "jose";
 import { config, zitadelBaseUrl } from "../../config.js";
 import { normalizePayload } from "./oidc.js";
+import { customFetch, fetchSsoEndpoint, safeJwksFetch } from "../ssoEndpointPolicy.js";
 export class ZitadelConnector {
     id = "zitadel";
     name = "Zitadel";
@@ -32,7 +33,7 @@ export class ZitadelConnector {
             code,
             redirect_uri: redirectUri,
         });
-        const res = await fetch(`${zitadelBaseUrl()}/oauth/v2/token`, {
+        const res = await fetchSsoEndpoint(`${zitadelBaseUrl()}/oauth/v2/token`, "tokenEndpoint", {
             method: "POST",
             headers: { "Content-Type": "application/x-www-form-urlencoded" },
             body: params.toString(),
@@ -46,7 +47,7 @@ export class ZitadelConnector {
     }
     async verifyToken(token) {
         const jwksUrl = await this.getJwksUrl();
-        const JWKS = createRemoteJWKSet(new URL(jwksUrl));
+        const JWKS = createRemoteJWKSet(new URL(jwksUrl), { [customFetch]: safeJwksFetch });
         const issuer = config.ZITADEL_DOMAIN.startsWith("http")
             ? config.ZITADEL_DOMAIN
             : `https://${config.ZITADEL_DOMAIN}`;
@@ -59,7 +60,7 @@ export class ZitadelConnector {
     async getJwksUrl() {
         if (this.cachedJwksUrl)
             return this.cachedJwksUrl;
-        const res = await fetch(`${zitadelBaseUrl()}/.well-known/openid-configuration`);
+        const res = await fetchSsoEndpoint(`${zitadelBaseUrl()}/.well-known/openid-configuration`, "issuer");
         if (!res.ok)
             throw new Error(`Zitadel discovery failed: ${res.status}`);
         const discovery = (await res.json());

package/dist/services/connectors/zitadel.js.map

@@ -1 +1 @@
-{"version":3,"file":"zitadel.js","sourceRoot":"","sources":["../../../src/services/connectors/zitadel.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AACrD,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAEzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAE7C,MAAM,OAAO,gBAAgB;IAC3B,EAAE,GAAG,SAAS,CAAC;IACf,IAAI,GAAG,SAAS,CAAC;IACjB,IAAI,GAAG,SAAS,CAAC;IACT,GAAG,CAAkB;IACrB,aAAa,GAAkB,IAAI,CAAC;IAE5C,YAAY,GAAoB;QAC9B,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;IACjB,CAAC;IAED,eAAe,CAAC,IAAyB;QACvC,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC;QACrC,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;YACjC,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,QAAQ;YAC5B,YAAY,EAAE,WAAW;YACzB,aAAa,EAAE,MAAM;YACrB,KAAK,EAAE,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;YAChE,KAAK,EAAE,IAAI,CAAC,KAAK;SAClB,CAAC,CAAC;QACH,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;YACrB,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC3C,CAAC;QACD,OAAO,GAAG,cAAc,EAAE,uBAAuB,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC;IACvE,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,IAAY,EAAE,WAAmB;QAClD,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;YACjC,UAAU,EAAE,oBAAoB;YAChC,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,QAAQ;YAC5B,aAAa,EAAE,IAAI,CAAC,GAAG,CAAC,YAAY;YACpC,IAAI;YACJ,YAAY,EAAE,WAAW;SAC1B,CAAC,CAAC;QAEH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,cAAc,EAAE,iBAAiB,EAAE;YAC5D,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;YAChE,IAAI,EAAE,MAAM,CAAC,QAAQ,EAAE;SACxB,CAAC,CAAC;QAEH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CAAC,kCAAkC,GAAG,CAAC,MAAM,IAAI,IAAI,EAAE,CAAC,CAAC;QAC1E,CAAC;QAED,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAyB,CAAC;QACxD,OAAO,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACzC,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,KAAa;QAC7B,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;QACxC,MAAM,IAAI,GAAG,kBAAkB,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;QAClD,MAAM,MAAM,GAAG,MAAM,CAAC,cAAe,CAAC,UAAU,CAAC,MAAM,CAAC;YACtD,CAAC,CAAC,MAAM,CAAC,cAAe;YACxB,CAAC,CAAC,WAAW,MAAM,CAAC,cAAe,EAAE,CAAC;QACxC,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE;YAC/C,MAAM;YACN,QAAQ,EAAE,IAAI,CAAC,GAAG,CAAC,QAAQ;SAC5B,CAAC,CAAC;QACH,OAAO,gBAAgB,CAAC,OAAkC,EAAE,IAAI,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;IACzF,CAAC;IAEO,KAAK,CAAC,UAAU;QACtB,IAAI,IAAI,CAAC,aAAa;YAAE,OAAO,IAAI,CAAC,aAAa,CAAC;QAClD,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,cAAc,EAAE,mCAAmC,CAAC,CAAC;QAChF,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;QACxE,MAAM,SAAS,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA4B,CAAC;QAChE,IAAI,CAAC,aAAa,GAAI,SAAS,CAAC,QAAmB,IAAI,GAAG,cAAc,EAAE,gBAAgB,CAAC;QAC3F,OAAO,IAAI,CAAC,aAAa,CAAC;IAC5B,CAAC;CACF"}
+{"version":3,"file":"zitadel.js","sourceRoot":"","sources":["../../../src/services/connectors/zitadel.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AACrD,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAEzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAEvF,MAAM,OAAO,gBAAgB;IAC3B,EAAE,GAAG,SAAS,CAAC;IACf,IAAI,GAAG,SAAS,CAAC;IACjB,IAAI,GAAG,SAAS,CAAC;IACT,GAAG,CAAkB;IACrB,aAAa,GAAkB,IAAI,CAAC;IAE5C,YAAY,GAAoB;QAC9B,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;IACjB,CAAC;IAED,eAAe,CAAC,IAAyB;QACvC,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC;QACrC,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;YACjC,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,QAAQ;YAC5B,YAAY,EAAE,WAAW;YACzB,aAAa,EAAE,MAAM;YACrB,KAAK,EAAE,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;YAChE,KAAK,EAAE,IAAI,CAAC,KAAK;SAClB,CAAC,CAAC;QACH,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;YACrB,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC3C,CAAC;QACD,OAAO,GAAG,cAAc,EAAE,uBAAuB,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC;IACvE,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,IAAY,EAAE,WAAmB;QAClD,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;YACjC,UAAU,EAAE,oBAAoB;YAChC,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,QAAQ;YAC5B,aAAa,EAAE,IAAI,CAAC,GAAG,CAAC,YAAY;YACpC,IAAI;YACJ,YAAY,EAAE,WAAW;SAC1B,CAAC,CAAC;QAEH,MAAM,GAAG,GAAG,MAAM,gBAAgB,CAAC,GAAG,cAAc,EAAE,iBAAiB,EAAE,eAAe,EAAE;YACxF,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;YAChE,IAAI,EAAE,MAAM,CAAC,QAAQ,EAAE;SACxB,CAAC,CAAC;QAEH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CAAC,kCAAkC,GAAG,CAAC,MAAM,IAAI,IAAI,EAAE,CAAC,CAAC;QAC1E,CAAC;QAED,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAyB,CAAC;QACxD,OAAO,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACzC,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,KAAa;QAC7B,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;QACxC,MAAM,IAAI,GAAG,kBAAkB,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC;QACpF,MAAM,MAAM,GAAG,MAAM,CAAC,cAAe,CAAC,UAAU,CAAC,MAAM,CAAC;YACtD,CAAC,CAAC,MAAM,CAAC,cAAe;YACxB,CAAC,CAAC,WAAW,MAAM,CAAC,cAAe,EAAE,CAAC;QACxC,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE;YAC/C,MAAM;YACN,QAAQ,EAAE,IAAI,CAAC,GAAG,CAAC,QAAQ;SAC5B,CAAC,CAAC;QACH,OAAO,gBAAgB,CAAC,OAAkC,EAAE,IAAI,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;IACzF,CAAC;IAEO,KAAK,CAAC,UAAU;QACtB,IAAI,IAAI,CAAC,aAAa;YAAE,OAAO,IAAI,CAAC,aAAa,CAAC;QAClD,MAAM,GAAG,GAAG,MAAM,gBAAgB,CAAC,GAAG,cAAc,EAAE,mCAAmC,EAAE,QAAQ,CAAC,CAAC;QACrG,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;QACxE,MAAM,SAAS,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA4B,CAAC;QAChE,IAAI,CAAC,aAAa,GAAI,SAAS,CAAC,QAAmB,IAAI,GAAG,cAAc,EAAE,gBAAgB,CAAC;QAC3F,OAAO,IAAI,CAAC,aAAa,CAAC;IAC5B,CAAC;CACF"}

package/dist/services/domain/authentication.d.ts

@@ -1,12 +1,13 @@
 import { type User } from "../../db/schema.js";
 import { type TokenSet } from "../tokens.js";
-import type { UserRepository, ApplicationRepository } from "../../repositories/types.js";
+import type { UserRepository, ApplicationRepository, OrganizationRepository, MfaFlow } from "../../repositories/types.js";
+import type { IssuedMfaChallenge, MfaFactor, MfaService } from "../mfa.js";
 import { type Result } from "../../lib/result.js";
 export interface AuthContext {
     app?: {
         id: string;
         clientId: string;
-        orgId: string;
+        orgId?: string;
     };
     org?: {
         id: string;
@@ -24,19 +25,57 @@ export interface LoginInput {
     email: string;
     password: string;
     clientId?: string;
+    /** Which login surface started the flow; recorded on the challenge. */
+    flow?: MfaFlow;
+    ipAddress?: string;
+    userAgent?: string;
 }
 export interface TokenResponse {
     user: User;
     tokens: TokenSet;
     context: AuthContext;
 }
+/**
+ * Result of the password step. Tokens are only ever present once the user is
+ * fully authenticated; an MFA-enabled user is returned in `requires_mfa` with
+ * an opaque challenge and no tokens.
+ */
+export type LoginResult = {
+    status: "authenticated";
+    user: User;
+    tokens: TokenSet;
+    context: AuthContext;
+} | {
+    status: "requires_mfa";
+    user: User;
+    challenge: IssuedMfaChallenge;
+    context: AuthContext;
+};
+export interface MfaCompletion {
+    user: User;
+    tokens: TokenSet;
+    context: AuthContext;
+    flow: MfaFlow;
+    factor: MfaFactor;
+    /** Client the challenge was created for; the session cookie is scoped to it. */
+    clientId?: string;
+}
 export declare class AuthenticationDomainService {
     private readonly users;
     private readonly applications;
-    constructor(users: UserRepository, applications: ApplicationRepository);
+    private readonly organizations;
+    private readonly mfa;
+    constructor(users: UserRepository, applications: ApplicationRepository, organizations: OrganizationRepository, mfa: MfaService);
     private loadAppContext;
     register(input: RegisterInput): Promise<Result<TokenResponse>>;
-    login(input: LoginInput): Promise<Result<TokenResponse>>;
+    login(input: LoginInput): Promise<Result<LoginResult>>;
+    private issueTokens;
+    /**
+     * Second step of the login state machine: verify a factor against an
+     * outstanding challenge and only then issue tokens. Replaying the same
+     * challenge returns `MFA_CHALLENGE_REPLAYED` and issues nothing.
+     */
+    completeMfa(challengeToken: string, code: string, factor: MfaFactor, ipAddress?: string, userAgent?: string): Promise<Result<MfaCompletion>>;
     refresh(refreshToken: string, clientId?: string): Promise<Result<{
         tokens: TokenSet;
         userId?: string;

package/dist/services/domain/authentication.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"authentication.d.ts","sourceRoot":"","sources":["../../../src/services/domain/authentication.ts"],"names":[],"mappings":"AAIA,OAAO,EAA8B,KAAK,IAAI,EAAE,MAAM,oBAAoB,CAAC;AAE3E,OAAO,EAA0D,KAAK,QAAQ,EAAE,MAAM,cAAc,CAAC;AAIrG,OAAO,KAAK,EAAE,cAAc,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AACzF,OAAO,EAAW,KAAK,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAG3D,MAAM,WAAW,WAAW;IAC1B,GAAG,CAAC,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IACtD,GAAG,CAAC,EAAE;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC;CACtB;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,IAAI,CAAC;IACX,MAAM,EAAE,QAAQ,CAAC;IACjB,OAAO,EAAE,WAAW,CAAC;CACtB;AAED,qBAAa,2BAA2B;IAEpC,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,YAAY;gBADZ,KAAK,EAAE,cAAc,EACrB,YAAY,EAAE,qBAAqB;YAGxC,cAAc;IAUtB,QAAQ,CAAC,KAAK,EAAE,aAAa,GAAG,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;IA8E9D,KAAK,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;IA6DxD,OAAO,CAAC,YAAY,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAAE,MAAM,EAAE,QAAQ,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAWxG,MAAM,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAOpD,wBAAwB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,IAAI,CAAA;KAAE,GAAG,IAAI,CAAC,CAAC;IAkB9F,sBAAsB,CAAC,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;CA+CxF"}
+{"version":3,"file":"authentication.d.ts","sourceRoot":"","sources":["../../../src/services/domain/authentication.ts"],"names":[],"mappings":"AAIA,OAAO,EAA8B,KAAK,IAAI,EAAE,MAAM,oBAAoB,CAAC;AAE3E,OAAO,EAA6E,KAAK,QAAQ,EAAE,MAAM,cAAc,CAAC;AAIxH,OAAO,KAAK,EAAE,cAAc,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,OAAO,EAAE,MAAM,6BAA6B,CAAC;AAC1H,OAAO,KAAK,EAAE,kBAAkB,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAC3E,OAAO,EAAW,KAAK,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAG3D,MAAM,WAAW,WAAW;IAC1B,GAAG,CAAC,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACvD,GAAG,CAAC,EAAE;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC;CACtB;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,uEAAuE;IACvE,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,IAAI,CAAC;IACX,MAAM,EAAE,QAAQ,CAAC;IACjB,OAAO,EAAE,WAAW,CAAC;CACtB;AAED;;;;GAIG;AACH,MAAM,MAAM,WAAW,GACnB;IAAE,MAAM,EAAE,eAAe,CAAC;IAAC,IAAI,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,QAAQ,CAAC;IAAC,OAAO,EAAE,WAAW,CAAA;CAAE,GAC/E;IAAE,MAAM,EAAE,cAAc,CAAC;IAAC,IAAI,EAAE,IAAI,CAAC;IAAC,SAAS,EAAE,kBAAkB,CAAC;IAAC,OAAO,EAAE,WAAW,CAAA;CAAE,CAAC;AAEhG,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,IAAI,CAAC;IACX,MAAM,EAAE,QAAQ,CAAC;IACjB,OAAO,EAAE,WAAW,CAAC;IACrB,IAAI,EAAE,OAAO,CAAC;IACd,MAAM,EAAE,SAAS,CAAC;IAClB,gFAAgF;IAChF,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,qBAAa,2BAA2B;IAEpC,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,YAAY;IAC7B,OAAO,CAAC,QAAQ,CAAC,aAAa;IAC9B,OAAO,CAAC,QAAQ,CAAC,GAAG;IAJtB,YACmB,KAAK,EAAE,cAAc,EACrB,YAAY,EAAE,qBAAqB,EACnC,aAAa,EAAE,sBAAsB,EACrC,GAAG,EAAE,UAAU,EAC9B;YAEU,cAAc;IAYtB,QAAQ,CAAC,KAAK,EAAE,aAAa,GAAG,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CA4EnE;IAEK,KAAK,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CA4E3D;YAEa,WAAW;IAoBzB;;;;OAIG;IACG,WAAW,CACf,cAAc,EAAE,MAAM,EACtB,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,SAAS,EACjB,SAAS,CAAC,EAAE,MAAM,EAClB,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAgChC;IAEK,OAAO,CAAC,YAAY,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAAE,MAAM,EAAE,QAAQ,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC,CAS7G;IAEK,MAAM,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAKzD;IAEK,wBAAwB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,IAAI,CAAA;KAAE,GAAG,IAAI,CAAC,CAAC,CAgBnG;IAEK,sBAAsB,CAAC,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CA8CtF;CACF"}

package/dist/services/domain/authentication.js

@@ -13,19 +13,24 @@ import { hashPassword, verifyPassword } from "../secrets/index.js";
 export class AuthenticationDomainService {
     users;
     applications;
-    constructor(users, applications) {
+    organizations;
+    mfa;
+    constructor(users, applications, organizations, mfa) {
         this.users = users;
         this.applications = applications;
+        this.organizations = organizations;
+        this.mfa = mfa;
     }
-    async loadAppContext(clientId) {
+    async loadAppContext(userId, clientId) {
         if (!clientId)
             return {};
         const app = await this.applications.findByClientId(clientId);
         if (!app)
             return {};
+        const membership = await this.organizations.findMembership(app.orgId, userId);
         return {
-            app: { id: app.id, clientId: app.clientId, orgId: app.orgId },
-            org: { id: app.orgId },
+            app: { id: app.id, clientId: app.clientId, ...(membership ? { orgId: app.orgId } : {}) },
+            ...(membership ? { org: { id: app.orgId } } : {}),
         };
     }
     async register(input) {
@@ -76,11 +81,11 @@ export class AuthenticationDomainService {
                 // emailVerification module may not be available in all configurations
             }
         }
-        const context = await this.loadAppContext(input.clientId);
+        const context = await this.loadAppContext(user.id, input.clientId);
         const tokens = await createTokenSet(user, undefined, undefined, {
-            appId: context.app?.id,
+            appId: context.org ? context.app?.id : undefined,
             orgId: context.org?.id,
-            clientId: context.app?.clientId,
+            clientId: context.org ? context.app?.clientId : undefined,
         });
         await emit({
             type: "user_registered",
@@ -91,7 +96,7 @@ export class AuthenticationDomainService {
                 username: user.username,
                 email: user.email,
                 client_id: input.clientId,
-                appId: context.app?.id,
+                appId: context.org ? context.app?.id : undefined,
                 orgId: context.org?.id,
             },
         });
@@ -110,6 +115,14 @@ export class AuthenticationDomainService {
             }
             return err({ code: "INVALID_CREDENTIALS", message: "Invalid email or password.", statusCode: 401 });
         }
+        if (!user.isActive) {
+            await emit({ type: "user_login_failed", payload: { reason: "account_deactivated", userId: user.id } });
+            return err({ code: "ACCOUNT_DEACTIVATED", message: "This account is deactivated", statusCode: 403 });
+        }
+        if (user.accountReviewRequired) {
+            await emit({ type: "user_login_failed", payload: { reason: "account_review_required", userId: user.id } });
+            return err({ code: "ACCOUNT_REVIEW_REQUIRED", message: "This account is pending review.", statusCode: 403 });
+        }
         if (user.lockedUntil && user.lockedUntil > new Date()) {
             await emit({ type: "user_login_failed", payload: { reason: "account_locked", userId: user.id } });
             return err({ code: "ACCOUNT_LOCKED", message: "Account is temporarily locked due to too many failed attempts. Try again later.", statusCode: 403 });
@@ -136,27 +149,76 @@ export class AuthenticationDomainService {
             return err({ code: "INVALID_CREDENTIALS", message: "Invalid email or password.", statusCode: 401 });
         }
         await this.users.resetFailedLogins(user.id);
+        const context = await this.loadAppContext(user.id, input.clientId);
+        if (user.totpEnabled) {
+            // requires_mfa: no access token, no refresh token, no session row, and no
+            // `user_login` event. The only thing handed back is an opaque challenge.
+            const challenge = await this.mfa.createChallenge(user, input.flow ?? "login", input.clientId, {
+                ipAddress: input.ipAddress,
+                userAgent: input.userAgent,
+            });
+            return ok({ status: "requires_mfa", user, challenge, context });
+        }
         await this.users.updateLastSeen(user.id);
-        const context = await this.loadAppContext(input.clientId);
-        const tokens = await createTokenSet(user, undefined, undefined, {
-            appId: context.app?.id,
+        const tokens = await this.issueTokens(user, context, input.ipAddress, input.userAgent);
+        await emit({
+            type: "user_login",
+            payload: { provider: user.provider, userId: user.id, appId: context.org ? context.app?.id : undefined, orgId: context.org?.id },
+        });
+        return ok({ status: "authenticated", user, tokens, context });
+    }
+    async issueTokens(user, context, ipAddress, userAgent, mfaFactor) {
+        return createTokenSet(user, ipAddress, userAgent, {
+            appId: context.org ? context.app?.id : undefined,
             orgId: context.org?.id,
-            clientId: context.app?.clientId,
+            clientId: context.org ? context.app?.clientId : undefined,
+            ...(mfaFactor ? { mfaFactor } : {}),
         });
+    }
+    /**
+     * Second step of the login state machine: verify a factor against an
+     * outstanding challenge and only then issue tokens. Replaying the same
+     * challenge returns `MFA_CHALLENGE_REPLAYED` and issues nothing.
+     */
+    async completeMfa(challengeToken, code, factor, ipAddress, userAgent) {
+        const result = await this.mfa.verifyChallenge(challengeToken, code, factor, (id) => this.users.findById(id));
+        if (!result.success)
+            return result;
+        const { user, flow, clientId } = result.data;
+        const context = await this.loadAppContext(user.id, clientId);
+        let tokens;
+        try {
+            tokens = await this.issueTokens(user, context, ipAddress, userAgent, factor);
+        }
+        catch {
+            await emit({ type: "mfa_bypass_blocked", payload: { userId: user.id, flow } });
+            return err({
+                code: "MFA_REQUIRED",
+                message: "Multi-factor authentication could not be completed.",
+                statusCode: 401,
+            });
+        }
+        await this.users.updateLastSeen(user.id);
         await emit({
             type: "user_login",
-            payload: { provider: user.provider, userId: user.id, appId: context.app?.id, orgId: context.org?.id },
+            payload: {
+                provider: user.provider,
+                userId: user.id,
+                mfa: factor,
+                appId: context.org ? context.app?.id : undefined,
+                orgId: context.org?.id,
+            },
         });
-        return ok({ user, tokens, context });
+        return ok({ user, tokens, context, flow, factor, clientId });
     }
     async refresh(refreshToken, clientId) {
-        const tokens = await rotateRefreshToken(refreshToken, undefined, undefined);
+        const tokens = await rotateRefreshToken(refreshToken, undefined, undefined, clientId);
         if (!tokens) {
             await emit({ type: "token_refresh_failed", payload: { reason: "invalid_refresh_token" } });
             return err({ code: "INVALID_REFRESH_TOKEN", message: "Invalid or expired session.", statusCode: 401 });
         }
-        await emit({ type: "token_refresh", payload: {} });
-        return ok({ tokens, userId: undefined });
+        await emit({ type: "token_refresh", payload: { userId: tokens.userId } });
+        return ok({ tokens, userId: tokens.userId });
     }
     async logout(refreshToken) {
         if (refreshToken) {
@@ -166,7 +228,7 @@ export class AuthenticationDomainService {
     }
     async createPasswordResetToken(email) {
         const user = await this.users.findByEmail(email);
-        if (!user)
+        if (!user || !user.isActive)
             return ok(null);
         const token = crypto.randomBytes(48).toString("base64url");
         const tokenHash = crypto.createHash("sha256").update(token).digest("hex");
@@ -191,8 +253,8 @@ export class AuthenticationDomainService {
             return err({ code: "INVALID_TOKEN", message: "Invalid or expired reset token.", statusCode: 400 });
         }
         const user = await this.users.findById(record.userId);
-        if (!user) {
-            return err({ code: "USER_NOT_FOUND", message: "User not found.", statusCode: 400 });
+        if (!user?.isActive) {
+            return err({ code: "ACCOUNT_DEACTIVATED", message: "This account is deactivated.", statusCode: 403 });
         }
         if (config.HIBP_CHECK_ENABLED) {
             const breached = await isPasswordBreached(newPassword);

package/dist/services/domain/authentication.js.map

@@ -1 +1 @@
-{"version":3,"file":"authentication.js","sourceRoot":"","sources":["../../../src/services/domain/authentication.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,EAAE,MAAM,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAC9D,OAAO,EAAE,EAAE,EAAE,MAAM,mBAAmB,CAAC;AACvC,OAAO,EAAE,KAAK,EAAE,mBAAmB,EAAa,MAAM,oBAAoB,CAAC;AAC3E,OAAO,EAAE,eAAe,EAAE,cAAc,IAAI,qBAAqB,EAAE,MAAM,eAAe,CAAC;AACzF,OAAO,EAAE,cAAc,EAAE,kBAAkB,EAAE,kBAAkB,EAAiB,MAAM,cAAc,CAAC;AACrG,OAAO,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAChD,OAAO,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AACjF,OAAO,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAExC,OAAO,EAAE,EAAE,EAAE,GAAG,EAAe,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AA4BnE,MAAM,OAAO,2BAA2B;IAEnB;IACA;IAFnB,YACmB,KAAqB,EACrB,YAAmC;QADnC,UAAK,GAAL,KAAK,CAAgB;QACrB,iBAAY,GAAZ,YAAY,CAAuB;IACnD,CAAC;IAEI,KAAK,CAAC,cAAc,CAAC,QAAiB;QAC5C,IAAI,CAAC,QAAQ;YAAE,OAAO,EAAE,CAAC;QACzB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;QAC7D,IAAI,CAAC,GAAG;YAAE,OAAO,EAAE,CAAC;QACpB,OAAO;YACL,GAAG,EAAE,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE;YAC7D,GAAG,EAAE,EAAE,EAAE,EAAE,GAAG,CAAC,KAAK,EAAE;SACvB,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,KAAoB;QACjC,IAAI,MAAM,CAAC,kBAAkB,EAAE,CAAC;YAC9B,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;YAC1D,IAAI,QAAQ,EAAE,CAAC;gBACb,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,8CAA8C,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;YACtH,CAAC;QACH,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC3D,IAAI,QAAQ,EAAE,CAAC;YACb,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,4CAA4C,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QAC/G,CAAC;QAED,MAAM,YAAY,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACxD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,oBAAoB,CACpD,KAAK,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,eAAe,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CACvG,CAAC;QAEF,IAAI,aAAiC,CAAC;QACtC,IAAI,mBAAmB,EAAE,EAAE,CAAC;YAC1B,IAAI,CAAC;gBACH,aAAa,GAAG,MAAM,eAAe,CAAC;oBACpC,QAAQ,EAAE,KAAK,CAAC,QAAQ;oBACxB,KAAK,EAAE,KAAK,CAAC,KAAK;oBAClB,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,QAAQ;oBAClC,QAAQ,EAAE,KAAK,CAAC,QAAQ;iBACzB,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,CAAC,IAAI,CAAC,wDAAwD,EAAE,GAAG,CAAC,CAAC;YAC9E,CAAC;QACH,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC;YACnC,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,QAAQ;YACR,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,QAAQ;YAClC,YAAY;YACZ,QAAQ,EAAE,UAAU;YACpB,aAAa,EAAE,CAAC,MAAM,CAAC,2BAA2B;YAClD,aAAa;YACb,QAAQ,EAAE,KAAK,CAAC,QAAQ;SACzB,CAAC,CAAC;QAEH,IAAI,MAAM,CAAC,2BAA2B,EAAE,CAAC;YACvC,IAAI,CAAC;gBACH,MAAM,EAAE,qBAAqB,EAAE,GAAG,MAAM,MAAM,CAAC,yBAAyB,CAAC,CAAC;gBAC1E,qBAAqB,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;oBACjD,OAAO,CAAC,KAAK,CAAC,2CAA2C,EAAE,GAAG,CAAC,CAAC;gBAClE,CAAC,CAAC,CAAC;YACL,CAAC;YAAC,MAAM,CAAC;gBACP,sEAAsE;YACxE,CAAC;QACH,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAC1D,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE;YAC9D,KAAK,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE;YACtB,KAAK,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE;YACtB,QAAQ,EAAE,OAAO,CAAC,GAAG,EAAE,QAAQ;SAChC,CAAC,CAAC;QAEH,MAAM,IAAI,CAAC;YACT,IAAI,EAAE,iBAAiB;YACvB,OAAO,EAAE;gBACP,QAAQ,EAAE,UAAU;gBACpB,aAAa;gBACb,MAAM,EAAE,IAAI,CAAC,EAAE;gBACf,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,SAAS,EAAE,KAAK,CAAC,QAAQ;gBACzB,KAAK,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE;gBACtB,KAAK,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE;aACvB;SACF,CAAC,CAAC;QAEH,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;IACvC,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,KAAiB;QAC3B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAEvD,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,IAAI,mBAAmB,EAAE,EAAE,CAAC;gBAC1B,MAAM,qBAAqB,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YAC3E,CAAC;YACD,MAAM,iBAAiB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YACrC,MAAM,IAAI,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,cAAc,EAAE,EAAE,CAAC,CAAC;YAC/E,IAAI,MAAM,oBAAoB,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC5C,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,mDAAmD,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;YAC3H,CAAC;YACD,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,qBAAqB,EAAE,OAAO,EAAE,4BAA4B,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QACtG,CAAC;QAED,IAAI,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,WAAW,GAAG,IAAI,IAAI,EAAE,EAAE,CAAC;YACtD,MAAM,IAAI,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;YAClG,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,iFAAiF,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QACtJ,CAAC;QAED,IAAI,KAAK,GAAG,KAAK,CAAC;QAClB,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACtB,KAAK,GAAG,MAAM,cAAc,CAAC,KAAK,CAAC,QAAQ,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;QAClE,CAAC;aAAM,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS,IAAI,mBAAmB,EAAE,EAAE,CAAC;YAChE,KAAK,GAAG,MAAM,qBAAqB,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;QACnE,CAAC;QAED,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAC5D,MAAM,IAAI,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;YAEpG,MAAM,QAAQ,GAAG,OAAO,EAAE,mBAAmB,IAAI,CAAC,CAAC;YACnD,IAAI,QAAQ,IAAI,MAAM,CAAC,yBAAyB,EAAE,CAAC;gBACjD,MAAM,WAAW,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,gCAAgC,GAAG,IAAI,CAAC,CAAC;gBAC1F,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,EAAE,WAAW,CAAC,CAAC;gBACnD,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,kEAAkE,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;YACvI,CAAC;YAED,IAAI,MAAM,oBAAoB,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;gBACxC,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,mDAAmD,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;YAC3H,CAAC;YACD,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,qBAAqB,EAAE,OAAO,EAAE,4BAA4B,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QACtG,CAAC;QAED,MAAM,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC5C,MAAM,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACzC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAC1D,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE;YAC9D,KAAK,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE;YACtB,KAAK,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE;YACtB,QAAQ,EAAE,OAAO,CAAC,GAAG,EAAE,QAAQ;SAChC,CAAC,CAAC;QAEH,MAAM,IAAI,CAAC;YACT,IAAI,EAAE,YAAY;YAClB,OAAO,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE,EAAE;SACtG,CAAC,CAAC;QAEH,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;IACvC,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,YAAoB,EAAE,QAAiB;QACnD,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,YAAY,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;QAC5E,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,CAAC,EAAE,IAAI,EAAE,sBAAsB,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,uBAAuB,EAAE,EAAE,CAAC,CAAC;YAC3F,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,uBAAuB,EAAE,OAAO,EAAE,6BAA6B,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QACzG,CAAC;QAED,MAAM,IAAI,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC;QACnD,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;IAC3C,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,YAAqB;QAChC,IAAI,YAAY,EAAE,CAAC;YACjB,MAAM,kBAAkB,CAAC,YAAY,CAAC,CAAC;QACzC,CAAC;QACD,OAAO,EAAE,CAAC,SAAS,CAAC,CAAC;IACvB,CAAC;IAED,KAAK,CAAC,wBAAwB,CAAC,KAAa;QAC1C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;QACjD,IAAI,CAAC,IAAI;YAAE,OAAO,EAAE,CAAC,IAAI,CAAC,CAAC;QAE3B,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QAC3D,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC1E,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,SAAS;QAElE,MAAM,EAAE,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC,MAAM,CAAC;YAC1C,MAAM,EAAE,IAAI,CAAC,EAAE;YACf,SAAS;YACT,SAAS;SACV,CAAC,CAAC;QAEH,MAAM,IAAI,CAAC,EAAE,IAAI,EAAE,0BAA0B,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QAC/E,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAC7B,CAAC;IAED,KAAK,CAAC,sBAAsB,CAAC,KAAa,EAAE,WAAmB;QAC7D,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC1E,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;QAEvB,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE;aACtB,MAAM,EAAE;aACR,IAAI,CAAC,mBAAmB,CAAC;aACzB,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,mBAAmB,CAAC,SAAS,EAAE,SAAS,CAAC,EAC5C,EAAE,CAAC,mBAAmB,CAAC,SAAS,EAAE,GAAG,CAAC,EACtC,MAAM,CAAC,mBAAmB,CAAC,MAAM,CAAC,CACnC,CACF;aACA,KAAK,CAAC,CAAC,CAAC,CAAC;QAEZ,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,iCAAiC,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QACrG,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACtD,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,iBAAiB,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QACtF,CAAC;QAED,IAAI,MAAM,CAAC,kBAAkB,EAAE,CAAC;YAC9B,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CAAC,WAAW,CAAC,CAAC;YACvD,IAAI,QAAQ,EAAE,CAAC;gBACb,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,8CAA8C,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;YACtH,CAAC;QACH,CAAC;QAED,MAAM,YAAY,GAAG,MAAM,YAAY,CAAC,WAAW,CAAC,CAAC;QACrD,MAAM,EAAE,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;YAChC,MAAM,EAAE;iBACL,MAAM,CAAC,mBAAmB,CAAC;iBAC3B,GAAG,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;iBACpB,KAAK,CAAC,EAAE,CAAC,mBAAmB,CAAC,EAAE,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;YAChD,MAAM,EAAE;iBACL,MAAM,CAAC,KAAK,CAAC;iBACb,GAAG,CAAC,EAAE,YAAY,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC;iBACrC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;QAClC,CAAC,CAAC,CAAC;QAEH,MAAM,IAAI,CAAC,EAAE,IAAI,EAAE,0BAA0B,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QAC/E,OAAO,EAAE,CAAC,IAAI,CAAC,CAAC;IAClB,CAAC;CACF"}
+{"version":3,"file":"authentication.js","sourceRoot":"","sources":["../../../src/services/domain/authentication.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,EAAE,MAAM,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAC9D,OAAO,EAAE,EAAE,EAAE,MAAM,mBAAmB,CAAC;AACvC,OAAO,EAAE,KAAK,EAAE,mBAAmB,EAAa,MAAM,oBAAoB,CAAC;AAC3E,OAAO,EAAE,eAAe,EAAE,cAAc,IAAI,qBAAqB,EAAE,MAAM,eAAe,CAAC;AACzF,OAAO,EAAE,cAAc,EAAE,kBAAkB,EAAE,kBAAkB,EAAoC,MAAM,cAAc,CAAC;AACxH,OAAO,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAChD,OAAO,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AACjF,OAAO,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAGxC,OAAO,EAAE,EAAE,EAAE,GAAG,EAAe,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAmDnE,MAAM,OAAO,2BAA2B;IAEnB,KAAK;IACL,YAAY;IACZ,aAAa;IACb,GAAG;IAJtB,YACmB,KAAqB,EACrB,YAAmC,EACnC,aAAqC,EACrC,GAAe;qBAHf,KAAK;4BACL,YAAY;6BACZ,aAAa;mBACb,GAAG;IACnB,CAAC;IAEI,KAAK,CAAC,cAAc,CAAC,MAAc,EAAE,QAAiB;QAC5D,IAAI,CAAC,QAAQ;YAAE,OAAO,EAAE,CAAC;QACzB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;QAC7D,IAAI,CAAC,GAAG;YAAE,OAAO,EAAE,CAAC;QAEpB,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,cAAc,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAC9E,OAAO;YACL,GAAG,EAAE,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;YACxF,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,GAAG,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAClD,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,KAAoB;QACjC,IAAI,MAAM,CAAC,kBAAkB,EAAE,CAAC;YAC9B,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;YAC1D,IAAI,QAAQ,EAAE,CAAC;gBACb,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,8CAA8C,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;YACtH,CAAC;QACH,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC3D,IAAI,QAAQ,EAAE,CAAC;YACb,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,4CAA4C,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QAC/G,CAAC;QAED,MAAM,YAAY,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACxD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,oBAAoB,CACpD,KAAK,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,eAAe,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CACvG,CAAC;QAEF,IAAI,aAAiC,CAAC;QACtC,IAAI,mBAAmB,EAAE,EAAE,CAAC;YAC1B,IAAI,CAAC;gBACH,aAAa,GAAG,MAAM,eAAe,CAAC;oBACpC,QAAQ,EAAE,KAAK,CAAC,QAAQ;oBACxB,KAAK,EAAE,KAAK,CAAC,KAAK;oBAClB,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,QAAQ;oBAClC,QAAQ,EAAE,KAAK,CAAC,QAAQ;iBACzB,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,CAAC,IAAI,CAAC,wDAAwD,EAAE,GAAG,CAAC,CAAC;YAC9E,CAAC;QACH,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC;YACnC,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,QAAQ;YACR,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,QAAQ;YAClC,YAAY;YACZ,QAAQ,EAAE,UAAU;YACpB,aAAa,EAAE,CAAC,MAAM,CAAC,2BAA2B;YAClD,aAAa;YACb,QAAQ,EAAE,KAAK,CAAC,QAAQ;SACzB,CAAC,CAAC;QAEH,IAAI,MAAM,CAAC,2BAA2B,EAAE,CAAC;YACvC,IAAI,CAAC;gBACH,MAAM,EAAE,qBAAqB,EAAE,GAAG,MAAM,MAAM,CAAC,yBAAyB,CAAC,CAAC;gBAC1E,qBAAqB,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;oBACjD,OAAO,CAAC,KAAK,CAAC,2CAA2C,EAAE,GAAG,CAAC,CAAC;gBAClE,CAAC,CAAC,CAAC;YACL,CAAC;YAAC,MAAM,CAAC;gBACP,sEAAsE;YACxE,CAAC;QACH,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;QACnE,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE;YAC9D,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS;YAChD,KAAK,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE;YACtB,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC,SAAS;SAC1D,CAAC,CAAC;QAEH,MAAM,IAAI,CAAC;YACT,IAAI,EAAE,iBAAiB;YACvB,OAAO,EAAE;gBACP,QAAQ,EAAE,UAAU;gBACpB,aAAa;gBACb,MAAM,EAAE,IAAI,CAAC,EAAE;gBACf,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,SAAS,EAAE,KAAK,CAAC,QAAQ;gBACzB,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS;gBAChD,KAAK,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE;aACvB;SACF,CAAC,CAAC;QAEH,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;IACvC,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,KAAiB;QAC3B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAEvD,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,IAAI,mBAAmB,EAAE,EAAE,CAAC;gBAC1B,MAAM,qBAAqB,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YAC3E,CAAC;YACD,MAAM,iBAAiB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YACrC,MAAM,IAAI,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,cAAc,EAAE,EAAE,CAAC,CAAC;YAC/E,IAAI,MAAM,oBAAoB,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC5C,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,mDAAmD,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;YAC3H,CAAC;YACD,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,qBAAqB,EAAE,OAAO,EAAE,4BAA4B,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QACtG,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACnB,MAAM,IAAI,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,qBAAqB,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;YACvG,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,qBAAqB,EAAE,OAAO,EAAE,6BAA6B,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QACvG,CAAC;QAED,IAAI,IAAI,CAAC,qBAAqB,EAAE,CAAC;YAC/B,MAAM,IAAI,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,yBAAyB,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;YAC3G,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,yBAAyB,EAAE,OAAO,EAAE,iCAAiC,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QAC/G,CAAC;QAED,IAAI,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,WAAW,GAAG,IAAI,IAAI,EAAE,EAAE,CAAC;YACtD,MAAM,IAAI,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;YAClG,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,iFAAiF,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QACtJ,CAAC;QAED,IAAI,KAAK,GAAG,KAAK,CAAC;QAClB,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACtB,KAAK,GAAG,MAAM,cAAc,CAAC,KAAK,CAAC,QAAQ,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;QAClE,CAAC;aAAM,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS,IAAI,mBAAmB,EAAE,EAAE,CAAC;YAChE,KAAK,GAAG,MAAM,qBAAqB,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;QACnE,CAAC;QAED,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAC5D,MAAM,IAAI,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;YAEpG,MAAM,QAAQ,GAAG,OAAO,EAAE,mBAAmB,IAAI,CAAC,CAAC;YACnD,IAAI,QAAQ,IAAI,MAAM,CAAC,yBAAyB,EAAE,CAAC;gBACjD,MAAM,WAAW,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,gCAAgC,GAAG,IAAI,CAAC,CAAC;gBAC1F,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,EAAE,WAAW,CAAC,CAAC;gBACnD,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,kEAAkE,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;YACvI,CAAC;YAED,IAAI,MAAM,oBAAoB,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;gBACxC,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,mDAAmD,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;YAC3H,CAAC;YACD,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,qBAAqB,EAAE,OAAO,EAAE,4BAA4B,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QACtG,CAAC;QAED,MAAM,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC5C,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;QAEnE,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACrB,0EAA0E;YAC1E,yEAAyE;YACzE,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,OAAO,EAAE,KAAK,CAAC,QAAQ,EAAE;gBAC5F,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,SAAS,EAAE,KAAK,CAAC,SAAS;aAC3B,CAAC,CAAC;YACH,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,cAAc,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC;QAClE,CAAC;QAED,MAAM,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACzC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;QAEvF,MAAM,IAAI,CAAC;YACT,IAAI,EAAE,YAAY;YAClB,OAAO,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,EAAE,KAAK,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE,EAAE;SAChI,CAAC,CAAC;QAEH,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,eAAe,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;IAChE,CAAC;IAEO,KAAK,CAAC,WAAW,CACvB,IAAU,EACV,OAAoB,EACpB,SAAkB,EAClB,SAAkB,EAClB,SAAwB;QAExB,OAAO,cAAc,CACnB,IAAI,EACJ,SAAS,EACT,SAAS,EACT;YACE,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS;YAChD,KAAK,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE;YACtB,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC,SAAS;YACzD,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACpC,CACF,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,WAAW,CACf,cAAsB,EACtB,IAAY,EACZ,MAAiB,EACjB,SAAkB,EAClB,SAAkB;QAElB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,eAAe,CAAC,cAAc,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;QAC7G,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,OAAO,MAAM,CAAC;QAEnC,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC;QAC7C,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;QAE7D,IAAI,MAAgB,CAAC;QACrB,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;QAC/E,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,CAAC,EAAE,IAAI,EAAE,oBAAoB,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;YAC/E,OAAO,GAAG,CAAC;gBACT,IAAI,EAAE,cAAc;gBACpB,OAAO,EAAE,qDAAqD;gBAC9D,UAAU,EAAE,GAAG;aAChB,CAAC,CAAC;QACL,CAAC;QAED,MAAM,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACzC,MAAM,IAAI,CAAC;YACT,IAAI,EAAE,YAAY;YAClB,OAAO,EAAE;gBACP,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,MAAM,EAAE,IAAI,CAAC,EAAE;gBACf,GAAG,EAAE,MAAM;gBACX,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS;gBAChD,KAAK,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE;aACvB;SACF,CAAC,CAAC;QAEH,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC/D,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,YAAoB,EAAE,QAAiB;QACnD,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,YAAY,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC;QACtF,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,CAAC,EAAE,IAAI,EAAE,sBAAsB,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,uBAAuB,EAAE,EAAE,CAAC,CAAC;YAC3F,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,uBAAuB,EAAE,OAAO,EAAE,6BAA6B,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QACzG,CAAC;QAED,MAAM,IAAI,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAC1E,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;IAC/C,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,YAAqB;QAChC,IAAI,YAAY,EAAE,CAAC;YACjB,MAAM,kBAAkB,CAAC,YAAY,CAAC,CAAC;QACzC,CAAC;QACD,OAAO,EAAE,CAAC,SAAS,CAAC,CAAC;IACvB,CAAC;IAED,KAAK,CAAC,wBAAwB,CAAC,KAAa;QAC1C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;QACjD,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ;YAAE,OAAO,EAAE,CAAC,IAAI,CAAC,CAAC;QAE7C,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QAC3D,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC1E,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,SAAS;QAElE,MAAM,EAAE,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC,MAAM,CAAC;YAC1C,MAAM,EAAE,IAAI,CAAC,EAAE;YACf,SAAS;YACT,SAAS;SACV,CAAC,CAAC;QAEH,MAAM,IAAI,CAAC,EAAE,IAAI,EAAE,0BAA0B,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QAC/E,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAC7B,CAAC;IAED,KAAK,CAAC,sBAAsB,CAAC,KAAa,EAAE,WAAmB;QAC7D,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC1E,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;QAEvB,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE;aACtB,MAAM,EAAE;aACR,IAAI,CAAC,mBAAmB,CAAC;aACzB,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,mBAAmB,CAAC,SAAS,EAAE,SAAS,CAAC,EAC5C,EAAE,CAAC,mBAAmB,CAAC,SAAS,EAAE,GAAG,CAAC,EACtC,MAAM,CAAC,mBAAmB,CAAC,MAAM,CAAC,CACnC,CACF;aACA,KAAK,CAAC,CAAC,CAAC,CAAC;QAEZ,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,iCAAiC,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QACrG,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACtD,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,CAAC;YACpB,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,qBAAqB,EAAE,OAAO,EAAE,8BAA8B,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QACxG,CAAC;QAED,IAAI,MAAM,CAAC,kBAAkB,EAAE,CAAC;YAC9B,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CAAC,WAAW,CAAC,CAAC;YACvD,IAAI,QAAQ,EAAE,CAAC;gBACb,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,8CAA8C,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;YACtH,CAAC;QACH,CAAC;QAED,MAAM,YAAY,GAAG,MAAM,YAAY,CAAC,WAAW,CAAC,CAAC;QACrD,MAAM,EAAE,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;YAChC,MAAM,EAAE;iBACL,MAAM,CAAC,mBAAmB,CAAC;iBAC3B,GAAG,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;iBACpB,KAAK,CAAC,EAAE,CAAC,mBAAmB,CAAC,EAAE,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;YAChD,MAAM,EAAE;iBACL,MAAM,CAAC,KAAK,CAAC;iBACb,GAAG,CAAC,EAAE,YAAY,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC;iBACrC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;QAClC,CAAC,CAAC,CAAC;QAEH,MAAM,IAAI,CAAC,EAAE,IAAI,EAAE,0BAA0B,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QAC/E,OAAO,EAAE,CAAC,IAAI,CAAC,CAAC;IAClB,CAAC;CACF"}

package/dist/services/domain/authorization.d.ts

@@ -6,7 +6,16 @@ export interface PermissionInput {
     action: string;
 }
 export { type PermissionInput as PermissionRequirement };
+export type PlatformRole = "owner" | "user";
 export type OrgRole = "owner" | "admin" | "member";
+export declare function isPlatformRole(role: string): role is PlatformRole;
+export declare function isOrganizationRole(role: string): role is OrgRole;
+/**
+ * Organization admins may manage members and other admins, but only an
+ * organization owner may grant or modify the owner role.
+ */
+export declare function canManageOrganizationRole(actorRole: OrgRole, targetRole: OrgRole, nextRole: OrgRole): boolean;
+export declare function canManagePlatformRole(actorRole: string, nextRole: PlatformRole): boolean;
 export declare class AuthorizationDomainService {
     private readonly organizations;
     private readonly permissions;
@@ -14,6 +23,8 @@ export declare class AuthorizationDomainService {
     requirePermission(role: string, resource: string, action: string): Promise<Result<void>>;
     hasPermission(role: string, resource: string, action: string): Promise<boolean>;
     hasAnyPermission(role: string, required: PermissionInput[]): Promise<boolean>;
+    requireOrganizationPermission(userId: string, orgId: string, allowedRoles: OrgRole[], resource: string, action: string): Promise<Result<OrgMembership>>;
+    hasOrganizationPermission(userId: string, orgId: string, resource: string, action: string): Promise<boolean>;
     requireOrgRole(userId: string, orgId: string, allowedRoles: OrgRole[]): Promise<Result<OrgMembership>>;
     isOrgMember(userId: string, orgId: string): Promise<OrgMembership | undefined>;
 }

package/dist/services/domain/authorization.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"authorization.d.ts","sourceRoot":"","sources":["../../../src/services/domain/authorization.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,KAAK,EAAE,sBAAsB,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AAChG,OAAO,EAAW,KAAK,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAE3D,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,OAAO,EAAE,KAAK,eAAe,IAAI,qBAAqB,EAAE,CAAC;AACzD,MAAM,MAAM,OAAO,GAAG,OAAO,GAAG,OAAO,GAAG,QAAQ,CAAC;AAEnD,qBAAa,0BAA0B;IAEnC,OAAO,CAAC,QAAQ,CAAC,aAAa;IAC9B,OAAO,CAAC,QAAQ,CAAC,WAAW;gBADX,aAAa,EAAE,sBAAsB,EACrC,WAAW,EAAE,oBAAoB;IAG9C,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAQxF,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAI/E,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,eAAe,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC;IAI7E,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;IAWtG,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,SAAS,CAAC;CAGrF"}
+{"version":3,"file":"authorization.d.ts","sourceRoot":"","sources":["../../../src/services/domain/authorization.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,KAAK,EAAE,sBAAsB,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AAChG,OAAO,EAAW,KAAK,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAE3D,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,OAAO,EAAE,KAAK,eAAe,IAAI,qBAAqB,EAAE,CAAC;AACzD,MAAM,MAAM,YAAY,GAAG,OAAO,GAAG,MAAM,CAAC;AAC5C,MAAM,MAAM,OAAO,GAAG,OAAO,GAAG,OAAO,GAAG,QAAQ,CAAC;AAEnD,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,IAAI,YAAY,CAEjE;AAED,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,IAAI,OAAO,CAEhE;AAED;;;GAGG;AACH,wBAAgB,yBAAyB,CACvC,SAAS,EAAE,OAAO,EAClB,UAAU,EAAE,OAAO,EACnB,QAAQ,EAAE,OAAO,GAChB,OAAO,CAIT;AAED,wBAAgB,qBAAqB,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,YAAY,GAAG,OAAO,CAExF;AAED,qBAAa,0BAA0B;IAEnC,OAAO,CAAC,QAAQ,CAAC,aAAa;IAC9B,OAAO,CAAC,QAAQ,CAAC,WAAW;IAF9B,YACmB,aAAa,EAAE,sBAAsB,EACrC,WAAW,EAAE,oBAAoB,EAChD;IAEE,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAM7F;IAEK,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAEpF;IAEK,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,eAAe,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAElF;IAEK,6BAA6B,CACjC,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,EACb,YAAY,EAAE,OAAO,EAAE,EACvB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAMhC;IAEK,yBAAyB,CAC7B,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,OAAO,CAAC,CAIlB;IAEK,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAS3G;IAEK,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,SAAS,CAAC,CAEnF;CACF"}

package/dist/services/domain/authorization.js

@@ -1,4 +1,24 @@
 import { ok, err } from "../../lib/result.js";
+export function isPlatformRole(role) {
+    return role === "owner" || role === "user";
+}
+export function isOrganizationRole(role) {
+    return role === "owner" || role === "admin" || role === "member";
+}
+/**
+ * Organization admins may manage members and other admins, but only an
+ * organization owner may grant or modify the owner role.
+ */
+export function canManageOrganizationRole(actorRole, targetRole, nextRole) {
+    if (actorRole === "owner")
+        return true;
+    if (actorRole !== "admin")
+        return false;
+    return targetRole !== "owner" && nextRole !== "owner";
+}
+export function canManagePlatformRole(actorRole, nextRole) {
+    return actorRole === "owner" && isPlatformRole(nextRole);
+}
 export class AuthorizationDomainService {
     organizations;
     permissions;
@@ -19,12 +39,27 @@ export class AuthorizationDomainService {
     async hasAnyPermission(role, required) {
         return this.permissions.hasAnyPermission(role, required);
     }
+    async requireOrganizationPermission(userId, orgId, allowedRoles, resource, action) {
+        const roleResult = await this.requireOrgRole(userId, orgId, allowedRoles);
+        if (!roleResult.success)
+            return roleResult;
+        const permissionResult = await this.requirePermission(roleResult.data.role, resource, action);
+        if (!permissionResult.success)
+            return permissionResult;
+        return roleResult;
+    }
+    async hasOrganizationPermission(userId, orgId, resource, action) {
+        const membership = await this.requireOrgRole(userId, orgId, ["owner", "admin", "member"]);
+        if (!membership.success)
+            return false;
+        return this.permissions.hasPermission(membership.data.role, resource, action);
+    }
     async requireOrgRole(userId, orgId, allowedRoles) {
         const membership = await this.organizations.findMembership(orgId, userId);
         if (!membership) {
             return err({ code: "NOT_MEMBER", message: "Not a member of this organization", statusCode: 403 });
         }
-        if (!allowedRoles.includes(membership.role)) {
+        if (!isOrganizationRole(membership.role) || !allowedRoles.includes(membership.role)) {
             return err({ code: "INSUFFICIENT_ROLE", message: "Insufficient organization permissions", statusCode: 403 });
         }
         return ok(membership);

package/dist/services/domain/authorization.js.map

@@ -1 +1 @@
-{"version":3,"file":"authorization.js","sourceRoot":"","sources":["../../../src/services/domain/authorization.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,EAAE,EAAE,GAAG,EAAe,MAAM,qBAAqB,CAAC;AAU3D,MAAM,OAAO,0BAA0B;IAElB;IACA;IAFnB,YACmB,aAAqC,EACrC,WAAiC;QADjC,kBAAa,GAAb,aAAa,CAAwB;QACrC,gBAAW,GAAX,WAAW,CAAsB;IACjD,CAAC;IAEJ,KAAK,CAAC,iBAAiB,CAAC,IAAY,EAAE,QAAgB,EAAE,MAAc;QACpE,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,aAAa,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;QAC7E,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,sBAAsB,QAAQ,IAAI,MAAM,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QAC1G,CAAC;QACD,OAAO,EAAE,CAAC,SAAS,CAAC,CAAC;IACvB,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,IAAY,EAAE,QAAgB,EAAE,MAAc;QAChE,OAAO,IAAI,CAAC,WAAW,CAAC,aAAa,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;IAChE,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,IAAY,EAAE,QAA2B;QAC9D,OAAO,IAAI,CAAC,WAAW,CAAC,gBAAgB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAC3D,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,MAAc,EAAE,KAAa,EAAE,YAAuB;QACzE,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,cAAc,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAC1E,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,mCAAmC,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QACpG,CAAC;QACD,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAe,CAAC,EAAE,CAAC;YACvD,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,uCAAuC,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QAC/G,CAAC;QACD,OAAO,EAAE,CAAC,UAAU,CAAC,CAAC;IACxB,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,MAAc,EAAE,KAAa;QAC7C,OAAO,IAAI,CAAC,aAAa,CAAC,cAAc,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAC1D,CAAC;CACF"}
+{"version":3,"file":"authorization.js","sourceRoot":"","sources":["../../../src/services/domain/authorization.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,EAAE,EAAE,GAAG,EAAe,MAAM,qBAAqB,CAAC;AAW3D,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,OAAO,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,MAAM,CAAC;AAC7C,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,IAAY;IAC7C,OAAO,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,QAAQ,CAAC;AACnE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,yBAAyB,CACvC,SAAkB,EAClB,UAAmB,EACnB,QAAiB;IAEjB,IAAI,SAAS,KAAK,OAAO;QAAE,OAAO,IAAI,CAAC;IACvC,IAAI,SAAS,KAAK,OAAO;QAAE,OAAO,KAAK,CAAC;IACxC,OAAO,UAAU,KAAK,OAAO,IAAI,QAAQ,KAAK,OAAO,CAAC;AACxD,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,SAAiB,EAAE,QAAsB;IAC7E,OAAO,SAAS,KAAK,OAAO,IAAI,cAAc,CAAC,QAAQ,CAAC,CAAC;AAC3D,CAAC;AAED,MAAM,OAAO,0BAA0B;IAElB,aAAa;IACb,WAAW;IAF9B,YACmB,aAAqC,EACrC,WAAiC;6BADjC,aAAa;2BACb,WAAW;IAC3B,CAAC;IAEJ,KAAK,CAAC,iBAAiB,CAAC,IAAY,EAAE,QAAgB,EAAE,MAAc;QACpE,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,aAAa,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;QAC7E,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,sBAAsB,QAAQ,IAAI,MAAM,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QAC1G,CAAC;QACD,OAAO,EAAE,CAAC,SAAS,CAAC,CAAC;IACvB,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,IAAY,EAAE,QAAgB,EAAE,MAAc;QAChE,OAAO,IAAI,CAAC,WAAW,CAAC,aAAa,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;IAChE,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,IAAY,EAAE,QAA2B;QAC9D,OAAO,IAAI,CAAC,WAAW,CAAC,gBAAgB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAC3D,CAAC;IAED,KAAK,CAAC,6BAA6B,CACjC,MAAc,EACd,KAAa,EACb,YAAuB,EACvB,QAAgB,EAChB,MAAc;QAEd,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,MAAM,EAAE,KAAK,EAAE,YAAY,CAAC,CAAC;QAC1E,IAAI,CAAC,UAAU,CAAC,OAAO;YAAE,OAAO,UAAU,CAAC;QAC3C,MAAM,gBAAgB,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;QAC9F,IAAI,CAAC,gBAAgB,CAAC,OAAO;YAAE,OAAO,gBAAgB,CAAC;QACvD,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,KAAK,CAAC,yBAAyB,CAC7B,MAAc,EACd,KAAa,EACb,QAAgB,EAChB,MAAc;QAEd,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;QAC1F,IAAI,CAAC,UAAU,CAAC,OAAO;YAAE,OAAO,KAAK,CAAC;QACtC,OAAO,IAAI,CAAC,WAAW,CAAC,aAAa,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;IAChF,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,MAAc,EAAE,KAAa,EAAE,YAAuB;QACzE,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,cAAc,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAC1E,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,mCAAmC,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QACpG,CAAC;QACD,IAAI,CAAC,kBAAkB,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACpF,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,uCAAuC,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QAC/G,CAAC;QACD,OAAO,EAAE,CAAC,UAAU,CAAC,CAAC;IACxB,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,MAAc,EAAE,KAAa;QAC7C,OAAO,IAAI,CAAC,aAAa,CAAC,cAAc,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAC1D,CAAC;CACF"}

package/dist/services/domain/identity.d.ts

@@ -1,11 +1,16 @@
 import type { User } from "../../db/schema.js";
-import type { UserRepository, IdentityRepository } from "../../repositories/types.js";
+import { type UserRepository, type IdentityRepository } from "../../repositories/types.js";
 import type { TokenSet } from "../tokens.js";
+import { type MfaAssertion } from "../tokens.js";
+import { type FederationApplicationContext } from "../federation.js";
 import { type Result } from "../../lib/result.js";
+import { type PlatformRole } from "./authorization.js";
+import type { EventContext } from "../events/types.js";
 export declare class IdentityDomainService {
     private readonly users;
     private readonly identities;
     constructor(users: UserRepository, identities: IdentityRepository);
+    private auditDenied;
     findUser(id: string): Promise<Result<User>>;
     findUserByEmail(email: string): Promise<Result<User>>;
     upsertInvitedUser(input: {
@@ -13,27 +18,34 @@ export declare class IdentityDomainService {
         name?: string;
         username?: string;
     }): Promise<Result<User>>;
-    updateUserProfile(userId: string, updates: Partial<{
+    updateUserProfile(actorId: string, userId: string, updates: Partial<{
         name: string;
         username: string;
-        role: string;
         emailVerified: boolean;
-    }>): Promise<Result<User>>;
-    deactivate(userId: string): Promise<Result<void>>;
-    listOrganizationUsers(orgId: string): Promise<User[]>;
+    }>, context?: EventContext): Promise<Result<User>>;
+    updatePlatformRole(actorId: string, targetUserId: string, role: PlatformRole, context?: EventContext): Promise<Result<User>>;
+    deactivate(actorId: string, targetUserId: string, context?: EventContext): Promise<Result<void>>;
+    reviewAccount(actorId: string, targetUserId: string, active: boolean, context?: EventContext): Promise<Result<User>>;
     touchLastSeen(userId: string): Promise<void>;
-    linkUserIdentity(userId: string, providerId: string, providerType: string, externalSub: string, email?: string): Promise<Result<void>>;
+    linkUserIdentity(actorId: string, userId: string, providerId: string, providerType: string, externalSub: string, email?: string): Promise<Result<void>>;
     getFederationAuthorizeUrl(provider: string, state: string, redirectUri: string): Promise<Result<{
         url: string;
     }>>;
-    completeFederationLogin(provider: string, code: string, redirectUri: string): Promise<Result<{
+    completeFederationLogin(provider: string, code: string, redirectUri: string, application?: FederationApplicationContext): Promise<Result<{
         user: User;
         tokens: {
             accessToken: string;
             refreshToken: string;
         };
     }>>;
-    issueLocalTokenSet(user: User, opts?: {
+    /**
+     * Issue a local token set on behalf of an already-verified factor.
+     *
+     * `mfaFactor` is required rather than optional: without it the token
+     * chokepoint rejects MFA-enabled users, and an omitted argument silently
+     * reintroduces the bypass this parameter exists to prevent.
+     */
+    issueLocalTokenSet(user: User, mfaFactor: MfaAssertion, opts?: {
         appId?: string;
         orgId?: string;
         clientId?: string;

package/dist/services/domain/identity.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"identity.d.ts","sourceRoot":"","sources":["../../../src/services/domain/identity.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,KAAK,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AACtF,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAI7C,OAAO,EAAW,KAAK,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAE3D,qBAAa,qBAAqB;IAE9B,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,UAAU;gBADV,KAAK,EAAE,cAAc,EACrB,UAAU,EAAE,kBAAkB;IAG3C,QAAQ,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAM3C,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAMrD,iBAAiB,CAAC,KAAK,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAmBpG,iBAAiB,CACrB,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,OAAO,CAAA;KAAE,CAAC,GACzF,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAMlB,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAKjD,qBAAqB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;IAIrD,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAI5C,gBAAgB,CACpB,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,MAAM,EAClB,YAAY,EAAE,MAAM,EACpB,WAAW,EAAE,MAAM,EACnB,KAAK,CAAC,EAAE,MAAM,GACb,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAKlB,yBAAyB,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAKjH,uBAAuB,CAC3B,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,MAAM,CAAC;QAAE,IAAI,EAAE,IAAI,CAAC;QAAC,MAAM,EAAE;YAAE,WAAW,EAAE,MAAM,CAAC;YAAC,YAAY,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE,CAAC,CAAC;IASnF,kBAAkB,CACtB,IAAI,EAAE,IAAI,EACV,IAAI,CAAC,EAAE;QACL,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,iBAAiB,CAAC,EAAE,MAAM,CAAC;KAC5B,GACA,OAAO,CAAC,QAAQ,CAAC;CAGrB"}
+{"version":3,"file":"identity.d.ts","sourceRoot":"","sources":["../../../src/services/domain/identity.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAA2B,KAAK,cAAc,EAAE,KAAK,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AACpH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EAAkB,KAAK,YAAY,EAAE,MAAM,cAAc,CAAC;AAEjE,OAAO,EAA4H,KAAK,4BAA4B,EAAE,MAAM,kBAAkB,CAAC;AAC/L,OAAO,EAAW,KAAK,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAyC,KAAK,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAC9F,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAEvD,qBAAa,qBAAqB;IAE9B,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,UAAU;IAF7B,YACmB,KAAK,EAAE,cAAc,EACrB,UAAU,EAAE,kBAAkB,EAC7C;YAEU,WAAW;IAanB,QAAQ,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAIhD;IAEK,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAI1D;IAEK,iBAAiB,CAAC,KAAK,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAiBzG;IAEK,iBAAiB,CACrB,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,OAAO,CAAA;KAAE,CAAC,EAC5E,OAAO,CAAC,EAAE,YAAY,GACrB,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAqBvB;IAEK,kBAAkB,CACtB,OAAO,EAAE,MAAM,EACf,YAAY,EAAE,MAAM,EACpB,IAAI,EAAE,YAAY,EAClB,OAAO,CAAC,EAAE,YAAY,GACrB,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CA4CvB;IAEK,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAkCrG;IAEK,aAAa,CACjB,OAAO,EAAE,MAAM,EACf,YAAY,EAAE,MAAM,EACpB,MAAM,EAAE,OAAO,EACf,OAAO,CAAC,EAAE,YAAY,GACrB,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAmDvB;IAEK,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAEjD;IAEK,gBAAgB,CACpB,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,MAAM,EAClB,YAAY,EAAE,MAAM,EACpB,WAAW,EAAE,MAAM,EACnB,KAAK,CAAC,EAAE,MAAM,GACb,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CASvB;IAEK,yBAAyB,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC,CAGtH;IAEK,uBAAuB,CAC3B,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,MAAM,EACnB,WAAW,CAAC,EAAE,4BAA4B,GACzC,OAAO,CAAC,MAAM,CAAC;QAAE,IAAI,EAAE,IAAI,CAAC;QAAC,MAAM,EAAE;YAAE,WAAW,EAAE,MAAM,CAAC;YAAC,YAAY,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE,CAAC,CAAC,CAOxF;IAED;;;;;;OAMG;IACG,kBAAkB,CACtB,IAAI,EAAE,IAAI,EACV,SAAS,EAAE,YAAY,EACvB,IAAI,CAAC,EAAE;QACL,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,iBAAiB,CAAC,EAAE,MAAM,CAAC;KAC5B,GACA,OAAO,CAAC,QAAQ,CAAC,CAQnB;CACF"}