@hilbras/keystone 1.6.0 → 2.5.0

package/dist/services/connectors/google.js

@@ -1,3 +1,4 @@
+import { fetchSsoEndpoint } from "../ssoEndpointPolicy.js";
 import { OidcConnector, normalizePayload } from "./oidc.js";
 /**
  * Google-specific OIDC connector.
@@ -18,8 +19,14 @@ export class GoogleConnector extends OidcConnector {
         };
         return super.getAuthorizeUrl(opts);
     }
-    async exchangeCode(code, redirectUri) {
-        const identity = await super.exchangeCode(code, redirectUri);
+    /**
+     * `opts` must be forwarded. Overriding this method without it silently
+     * discarded the OIDC nonce, so nonce validation added in 2.4.0 applied to every
+     * OIDC provider except this one -- which is the default, and therefore the
+     * most likely to be in use.
+     */
+    async exchangeCode(code, redirectUri, opts = {}) {
+        const identity = await super.exchangeCode(code, redirectUri, opts);
         // Google usually returns picture, email_verified, etc. in the id_token.
         // If something is missing, enrich from the userinfo endpoint.
         if (!identity.name || !identity.picture || identity.emailVerified === undefined) {
@@ -39,6 +46,18 @@ export class GoogleConnector extends OidcConnector {
         }
         return identity;
     }
+    /**
+     * The userinfo endpoint to enrich from.
+     *
+     * Discovery supplies it for Google, but a hand-configured provider may not
+     * have one. Returning undefined rather than passing `undefined!` into the
+     * fetcher means the caller can skip enrichment, instead of surfacing a
+     * misleading "must be a valid URL" for a URL that was never configured.
+     */
+    resolveUserinfoEndpoint() {
+        const configured = this.config.userinfoEndpoint ?? this.userinfoEndpoint;
+        return typeof configured === "string" && configured.trim() !== "" ? configured : undefined;
+    }
     async fetchUserinfo(code, redirectUri) {
         // Re-exchange the code for an access token. In practice the parent
         // exchange already did this, but we do not retain the access token.
@@ -50,7 +69,7 @@ export class GoogleConnector extends OidcConnector {
             code,
             redirect_uri: redirectUri,
         });
-        const tokenRes = await fetch(this.config.tokenEndpoint, {
+        const tokenRes = await fetchSsoEndpoint(this.config.tokenEndpoint, "tokenEndpoint", {
             method: "POST",
             headers: { "Content-Type": "application/x-www-form-urlencoded" },
             body: params.toString(),
@@ -62,7 +81,11 @@ export class GoogleConnector extends OidcConnector {
         if (!tokenData.access_token) {
             throw new Error("Google did not return an access_token for userinfo");
         }
-        const userinfoRes = await fetch(this.config.userinfoEndpoint, {
+        const userinfoEndpoint = this.resolveUserinfoEndpoint();
+        if (!userinfoEndpoint) {
+            throw new Error("No userinfo endpoint is configured for this provider");
+        }
+        const userinfoRes = await fetchSsoEndpoint(userinfoEndpoint, "userinfoEndpoint", {
             headers: { Authorization: `Bearer ${tokenData.access_token}` },
         });
         if (!userinfoRes.ok) {

package/dist/services/connectors/google.js.map

@@ -1 +1 @@
-{"version":3,"file":"google.js","sourceRoot":"","sources":["../../../src/services/connectors/google.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAG5D;;;;;;;GAOG;AACH,MAAM,OAAO,eAAgB,SAAQ,aAAa;IAChD,eAAe,CAAC,IAAyB;QACvC,iEAAiE;QACjE,qEAAqE;QACrE,IAAI,CAAC,WAAW,GAAG;YACjB,GAAG,IAAI,CAAC,WAAW;YACnB,MAAM,EAAE,gBAAgB;YACxB,WAAW,EAAE,QAAQ;SACtB,CAAC;QACF,OAAO,KAAK,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;IACrC,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,IAAY,EAAE,WAAmB;QAClD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;QAE7D,wEAAwE;QACxE,8DAA8D;QAC9D,IAAI,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,IAAI,QAAQ,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;YAChF,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;gBAC7D,OAAO;oBACL,GAAG,QAAQ;oBACX,IAAI,EAAE,QAAQ,CAAC,IAAI,IAAI,QAAQ,CAAC,IAAI;oBACpC,OAAO,EAAE,QAAQ,CAAC,OAAO,IAAI,QAAQ,CAAC,OAAO;oBAC7C,aAAa,EAAE,QAAQ,CAAC,aAAa,IAAI,QAAQ,CAAC,aAAa;iBAChE,CAAC;YACJ,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,4EAA4E;gBAC5E,IAAI,CAAC,QAAQ,CAAC,mCAAmC,EAAE,GAAG,CAAC,CAAC;YAC1D,CAAC;QACH,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;IAEO,KAAK,CAAC,aAAa,CAAC,IAAY,EAAE,WAAmB;QAC3D,mEAAmE;QACnE,oEAAoE;QACpE,qEAAqE;QACrE,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;YACjC,UAAU,EAAE,oBAAoB;YAChC,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;YAC/B,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,YAAY;YACvC,IAAI;YACJ,YAAY,EAAE,WAAW;SAC1B,CAAC,CAAC;QAEH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,aAAc,EAAE;YACvD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;YAChE,IAAI,EAAE,MAAM,CAAC,QAAQ,EAAE;SACxB,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,6CAA6C,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;QAClF,CAAC;QAED,MAAM,SAAS,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAA8B,CAAC;QACvE,IAAI,CAAC,SAAS,CAAC,YAAY,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;QACxE,CAAC;QAED,MAAM,WAAW,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,gBAAiB,EAAE;YAC7D,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,SAAS,CAAC,YAAY,EAAE,EAAE;SAC/D,CAAC,CAAC;QAEH,IAAI,CAAC,WAAW,CAAC,EAAE,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CAAC,mCAAmC,WAAW,CAAC,MAAM,EAAE,CAAC,CAAC;QAC3E,CAAC;QAED,MAAM,OAAO,GAAG,CAAC,MAAM,WAAW,CAAC,IAAI,EAAE,CAA4B,CAAC;QACtE,OAAO,gBAAgB,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;IACjE,CAAC;IAEO,QAAQ,CAAC,OAAe,EAAE,GAAY;QAC5C,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;YACpC,sCAAsC;YACtC,OAAO,CAAC,KAAK,CAAC,qBAAqB,OAAO,GAAG,EAAE,GAAG,CAAC,CAAC;QACtD,CAAC;IACH,CAAC;CACF"}
+{"version":3,"file":"google.js","sourceRoot":"","sources":["../../../src/services/connectors/google.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAG5D;;;;;;;GAOG;AACH,MAAM,OAAO,eAAgB,SAAQ,aAAa;IAChD,eAAe,CAAC,IAAyB;QACvC,iEAAiE;QACjE,qEAAqE;QACrE,IAAI,CAAC,WAAW,GAAG;YACjB,GAAG,IAAI,CAAC,WAAW;YACnB,MAAM,EAAE,gBAAgB;YACxB,WAAW,EAAE,QAAQ;SACtB,CAAC;QACF,OAAO,KAAK,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;IACrC,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,YAAY,CAChB,IAAY,EACZ,WAAmB,EACnB,IAAI,GAAuB,EAAE;QAE7B,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC,CAAC;QAEnE,wEAAwE;QACxE,8DAA8D;QAC9D,IAAI,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,IAAI,QAAQ,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;YAChF,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;gBAC7D,OAAO;oBACL,GAAG,QAAQ;oBACX,IAAI,EAAE,QAAQ,CAAC,IAAI,IAAI,QAAQ,CAAC,IAAI;oBACpC,OAAO,EAAE,QAAQ,CAAC,OAAO,IAAI,QAAQ,CAAC,OAAO;oBAC7C,aAAa,EAAE,QAAQ,CAAC,aAAa,IAAI,QAAQ,CAAC,aAAa;iBAChE,CAAC;YACJ,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,4EAA4E;gBAC5E,IAAI,CAAC,QAAQ,CAAC,mCAAmC,EAAE,GAAG,CAAC,CAAC;YAC1D,CAAC;QACH,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED;;;;;;;OAOG;IACK,uBAAuB;QAC7B,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,gBAAgB,IAAK,IAAsC,CAAC,gBAAgB,CAAC;QAC5G,OAAO,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;IAC7F,CAAC;IAEO,KAAK,CAAC,aAAa,CAAC,IAAY,EAAE,WAAmB;QAC3D,mEAAmE;QACnE,oEAAoE;QACpE,qEAAqE;QACrE,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;YACjC,UAAU,EAAE,oBAAoB;YAChC,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;YAC/B,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,YAAY;YACvC,IAAI;YACJ,YAAY,EAAE,WAAW;SAC1B,CAAC,CAAC;QAEH,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,aAAc,EAAE,eAAe,EAAE;YACnF,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;YAChE,IAAI,EAAE,MAAM,CAAC,QAAQ,EAAE;SACxB,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,6CAA6C,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;QAClF,CAAC;QAED,MAAM,SAAS,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAA8B,CAAC;QACvE,IAAI,CAAC,SAAS,CAAC,YAAY,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;QACxE,CAAC;QAED,MAAM,gBAAgB,GAAG,IAAI,CAAC,uBAAuB,EAAE,CAAC;QACxD,IAAI,CAAC,gBAAgB,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;QAC1E,CAAC;QAED,MAAM,WAAW,GAAG,MAAM,gBAAgB,CAAC,gBAAgB,EAAE,kBAAkB,EAAE;YAC/E,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,SAAS,CAAC,YAAY,EAAE,EAAE;SAC/D,CAAC,CAAC;QAEH,IAAI,CAAC,WAAW,CAAC,EAAE,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CAAC,mCAAmC,WAAW,CAAC,MAAM,EAAE,CAAC,CAAC;QAC3E,CAAC;QAED,MAAM,OAAO,GAAG,CAAC,MAAM,WAAW,CAAC,IAAI,EAAE,CAA4B,CAAC;QACtE,OAAO,gBAAgB,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;IACjE,CAAC;IAEO,QAAQ,CAAC,OAAe,EAAE,GAAY;QAC5C,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;YACpC,sCAAsC;YACtC,OAAO,CAAC,KAAK,CAAC,qBAAqB,OAAO,GAAG,EAAE,GAAG,CAAC,CAAC;QACtD,CAAC;IACH,CAAC;CACF"}

package/dist/services/connectors/oidc.d.ts

@@ -6,8 +6,20 @@ export declare class OidcConnector implements IdentityConnector {
     protected config: ConnectorConfig;
     constructor(id: string, name: string, type: string, config: ConnectorConfig);
     getAuthorizeUrl(opts: AuthorizeUrlOptions): string;
-    exchangeCode(code: string, redirectUri: string): Promise<ExternalIdentity>;
-    verifyToken(token: string): Promise<ExternalIdentity>;
+    exchangeCode(code: string, redirectUri: string, opts?: {
+        nonce?: string;
+    }): Promise<ExternalIdentity>;
+    /**
+     * Verify an ID token from the provider.
+     *
+     * The `nonce` is the part that was missing. `state` already protects the
+     * callback against CSRF, but it says nothing about the *token*: without a
+     * nonce, an ID token minted for a different login — another session, another
+     * user, or one injected through a code obtained elsewhere — verifies
+     * correctly, because issuer, audience, and signature are all still valid. The
+     * nonce is what proves the token belongs to the request we started.
+     */
+    verifyToken(token: string, expectedNonce?: string): Promise<ExternalIdentity>;
     private discovery;
 }
 export declare function normalizePayload(payload: Record<string, unknown>, mapping?: Record<string, string>): ExternalIdentity;

package/dist/services/connectors/oidc.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oidc.d.ts","sourceRoot":"","sources":["../../../src/services/connectors/oidc.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAG5G,qBAAa,aAAc,YAAW,iBAAiB;IACrD,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,MAAM,EAAE,eAAe,CAAC;gBAEtB,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,eAAe;IAO3E,eAAe,CAAC,IAAI,EAAE,mBAAmB,GAAG,MAAM;IAoB5C,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC;IA2B1E,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC;YAa7C,SAAS;CAYxB;AAED,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAChC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC/B,gBAAgB,CAgBlB"}
+{"version":3,"file":"oidc.d.ts","sourceRoot":"","sources":["../../../src/services/connectors/oidc.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAI5G,qBAAa,aAAc,YAAW,iBAAiB;IACrD,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,MAAM,EAAE,eAAe,CAAC;IAElC,YAAY,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,eAAe,EAK1E;IAED,eAAe,CAAC,IAAI,EAAE,mBAAmB,GAAG,MAAM,CAqBjD;IAEK,YAAY,CAChB,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,MAAM,EACnB,IAAI,GAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAA;KAAO,GAC5B,OAAO,CAAC,gBAAgB,CAAC,CAyB3B;IAED;;;;;;;;;OASG;IACG,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,aAAa,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC,CA4BlF;YAEa,SAAS;CAexB;AAED,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAChC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC/B,gBAAgB,CAgBlB"}

package/dist/services/connectors/oidc.js

@@ -1,5 +1,6 @@
 import { createRemoteJWKSet, jwtVerify } from "jose";
 import { cache } from "../cache.js";
+import { assertSafeSsoEndpoint, customFetch, fetchSsoEndpoint, safeJwksFetch } from "../ssoEndpointPolicy.js";
 export class OidcConnector {
     id;
     name;
@@ -20,6 +21,9 @@ export class OidcConnector {
             scope: scopes.join(" "),
             state: opts.state,
         });
+        if (opts.nonce) {
+            params.set("nonce", opts.nonce);
+        }
         if (this.config.idpHint) {
             params.set("idp_hint", this.config.idpHint);
         }
@@ -30,7 +34,7 @@ export class OidcConnector {
         }
         return `${this.config.authorizationEndpoint}?${params.toString()}`;
     }
-    async exchangeCode(code, redirectUri) {
+    async exchangeCode(code, redirectUri, opts = {}) {
         const params = new URLSearchParams({
             grant_type: "authorization_code",
             client_id: this.config.clientId,
@@ -38,7 +42,7 @@ export class OidcConnector {
             code,
             redirect_uri: redirectUri,
         });
-        const res = await fetch(this.config.tokenEndpoint, {
+        const res = await fetchSsoEndpoint(this.config.tokenEndpoint, "tokenEndpoint", {
             method: "POST",
             headers: { "Content-Type": "application/x-www-form-urlencoded" },
             body: params.toString(),
@@ -51,18 +55,43 @@ export class OidcConnector {
         if (!data.id_token) {
             throw new Error("OIDC provider did not return an id_token");
         }
-        return this.verifyToken(data.id_token);
+        return this.verifyToken(data.id_token, opts.nonce);
     }
-    async verifyToken(token) {
+    /**
+     * Verify an ID token from the provider.
+     *
+     * The `nonce` is the part that was missing. `state` already protects the
+     * callback against CSRF, but it says nothing about the *token*: without a
+     * nonce, an ID token minted for a different login — another session, another
+     * user, or one injected through a code obtained elsewhere — verifies
+     * correctly, because issuer, audience, and signature are all still valid. The
+     * nonce is what proves the token belongs to the request we started.
+     */
+    async verifyToken(token, expectedNonce) {
         const jwksUrl = this.config.jwksUri || (await this.discovery())?.jwks_uri;
         if (!jwksUrl) {
             throw new Error("OIDC connector missing jwks_uri");
         }
-        const JWKS = createRemoteJWKSet(new URL(jwksUrl));
+        const JWKS = createRemoteJWKSet(await assertSafeSsoEndpoint(jwksUrl, "jwksUri"), {
+            [customFetch]: safeJwksFetch,
+        });
         const { payload } = await jwtVerify(token, JWKS, {
             issuer: this.config.issuer,
             audience: this.config.clientId,
+            // Pin the algorithm instead of accepting whatever the key material
+            // happens to allow, which leaves room for algorithm-confusion attempts.
+            algorithms: ["RS256", "ES256", "PS256"],
+            // Required rather than merely validated when present: a token with no
+            // expiry would otherwise be accepted forever.
+            requiredClaims: ["exp", "iat", "iss", "aud", "sub"],
+            clockTolerance: 5,
         });
+        if (expectedNonce) {
+            const presented = typeof payload.nonce === "string" ? payload.nonce : undefined;
+            if (presented !== expectedNonce) {
+                throw new Error("OIDC id_token nonce does not match the authorization request");
+            }
+        }
         return normalizePayload(payload, this.config.attributeMapping);
     }
     async discovery() {
@@ -72,7 +101,7 @@ export class OidcConnector {
         const cached = await cache.get(key);
         if (cached)
             return cached;
-        const res = await fetch(`${this.config.issuer.replace(/\/$/, "")}/.well-known/openid-configuration`);
+        const res = await fetchSsoEndpoint(`${this.config.issuer.replace(/\/$/, "")}/.well-known/openid-configuration`, "issuer");
         if (!res.ok)
             throw new Error(`OIDC discovery failed: ${res.status}`);
         const data = (await res.json());

package/dist/services/connectors/oidc.js.map

@@ -1 +1 @@
-{"version":3,"file":"oidc.js","sourceRoot":"","sources":["../../../src/services/connectors/oidc.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AAErD,OAAO,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AAEpC,MAAM,OAAO,aAAa;IACxB,EAAE,CAAS;IACX,IAAI,CAAS;IACb,IAAI,CAAS;IACH,MAAM,CAAkB;IAElC,YAAY,EAAU,EAAE,IAAY,EAAE,IAAY,EAAE,MAAuB;QACzE,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC;QACb,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;IAED,eAAe,CAAC,IAAyB;QACvC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;QACnF,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;YACjC,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;YAC/B,YAAY,EAAE,IAAI,CAAC,WAAW;YAC9B,aAAa,EAAE,MAAM;YACrB,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;YACvB,KAAK,EAAE,IAAI,CAAC,KAAK;SAClB,CAAC,CAAC;QACH,IAAI,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACxB,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAC9C,CAAC;QACD,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACrB,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;gBACtD,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YACnB,CAAC;QACH,CAAC;QACD,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,qBAAqB,IAAI,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC;IACrE,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,IAAY,EAAE,WAAmB;QAClD,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;YACjC,UAAU,EAAE,oBAAoB;YAChC,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;YAC/B,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,YAAY;YACvC,IAAI;YACJ,YAAY,EAAE,WAAW;SAC1B,CAAC,CAAC;QAEH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,aAAc,EAAE;YAClD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;YAChE,IAAI,EAAE,MAAM,CAAC,QAAQ,EAAE;SACxB,CAAC,CAAC;QAEH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CAAC,+BAA+B,GAAG,CAAC,MAAM,IAAI,IAAI,EAAE,CAAC,CAAC;QACvE,CAAC;QAED,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAgD,CAAC;QAC/E,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACnB,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;QAC9D,CAAC;QACD,OAAO,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACzC,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,KAAa;QAC7B,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,IAAK,CAAC,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC,EAAE,QAAmB,CAAC;QACtF,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;QACrD,CAAC;QACD,MAAM,IAAI,GAAG,kBAAkB,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;QAClD,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE;YAC/C,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM;YAC1B,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;SAC/B,CAAC,CAAC;QACH,OAAO,gBAAgB,CAAC,OAAkC,EAAE,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;IAC5F,CAAC;IAEO,KAAK,CAAC,SAAS;QACrB,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;QACxF,MAAM,GAAG,GAAG,kBAAkB,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;QACnD,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,GAAG,CAA0B,GAAG,CAAC,CAAC;QAC7D,IAAI,MAAM;YAAE,OAAO,MAAM,CAAC;QAE1B,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,mCAAmC,CAAC,CAAC;QACrG,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;QACrE,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA4B,CAAC;QAC3D,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;QACjC,OAAO,IAAI,CAAC;IACd,CAAC;CACF;AAED,MAAM,UAAU,gBAAgB,CAC9B,OAAgC,EAChC,OAAgC;IAEhC,MAAM,CAAC,GAAG,OAAO,IAAI,EAAE,CAAC;IACxB,MAAM,GAAG,GAAG,CAAC,GAAW,EAAW,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC;IAC7D,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;IACzC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACvE,CAAC;IACD,OAAO;QACL,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QAC7B,KAAK;QACL,aAAa,EAAE,GAAG,CAAC,gBAAgB,CAAC,KAAK,IAAI;QAC7C,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS;QACnD,OAAO,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS;QAC5D,QAAQ,EAAE,GAAG,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS;QACnF,GAAG,EAAE,OAAO;KACb,CAAC;AACJ,CAAC"}
+{"version":3,"file":"oidc.js","sourceRoot":"","sources":["../../../src/services/connectors/oidc.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AAErD,OAAO,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AACpC,OAAO,EAAE,qBAAqB,EAAE,WAAW,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAE9G,MAAM,OAAO,aAAa;IACxB,EAAE,CAAS;IACX,IAAI,CAAS;IACb,IAAI,CAAS;IACH,MAAM,CAAkB;IAElC,YAAY,EAAU,EAAE,IAAY,EAAE,IAAY,EAAE,MAAuB;QACzE,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC;QACb,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;IAED,eAAe,CAAC,IAAyB;QACvC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;QACnF,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;YACjC,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;YAC/B,YAAY,EAAE,IAAI,CAAC,WAAW;YAC9B,aAAa,EAAE,MAAM;YACrB,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;YACvB,KAAK,EAAE,IAAI,CAAC,KAAK;SAClB,CAAC,CAAC;QACH,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QAClC,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACxB,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAC9C,CAAC;QACD,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACrB,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;gBACtD,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YACnB,CAAC;QACH,CAAC;QACD,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,qBAAqB,IAAI,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC;IACrE,CAAC;IAED,KAAK,CAAC,YAAY,CAChB,IAAY,EACZ,WAAmB,EACnB,IAAI,GAAuB,EAAE;QAE7B,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;YACjC,UAAU,EAAE,oBAAoB;YAChC,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;YAC/B,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,YAAY;YACvC,IAAI;YACJ,YAAY,EAAE,WAAW;SAC1B,CAAC,CAAC;QAEH,MAAM,GAAG,GAAG,MAAM,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,aAAc,EAAE,eAAe,EAAE;YAC9E,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;YAChE,IAAI,EAAE,MAAM,CAAC,QAAQ,EAAE;SACxB,CAAC,CAAC;QAEH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CAAC,+BAA+B,GAAG,CAAC,MAAM,IAAI,IAAI,EAAE,CAAC,CAAC;QACvE,CAAC;QAED,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAgD,CAAC;QAC/E,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACnB,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;QAC9D,CAAC;QACD,OAAO,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IACrD,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,WAAW,CAAC,KAAa,EAAE,aAAsB;QACrD,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,IAAK,CAAC,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC,EAAE,QAAmB,CAAC;QACtF,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;QACrD,CAAC;QACD,MAAM,IAAI,GAAG,kBAAkB,CAAC,MAAM,qBAAqB,CAAC,OAAO,EAAE,SAAS,CAAC,EAAE;YAC/E,CAAC,WAAW,CAAC,EAAE,aAAa;SAC7B,CAAC,CAAC;QACH,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE;YAC/C,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM;YAC1B,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;YAC9B,mEAAmE;YACnE,wEAAwE;YACxE,UAAU,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC;YACvC,sEAAsE;YACtE,8CAA8C;YAC9C,cAAc,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC;YACnD,cAAc,EAAE,CAAC;SAClB,CAAC,CAAC;QAEH,IAAI,aAAa,EAAE,CAAC;YAClB,MAAM,SAAS,GAAG,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;YAChF,IAAI,SAAS,KAAK,aAAa,EAAE,CAAC;gBAChC,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAC;YAClF,CAAC;QACH,CAAC;QAED,OAAO,gBAAgB,CAAC,OAAkC,EAAE,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;IAC5F,CAAC;IAEO,KAAK,CAAC,SAAS;QACrB,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;QACxF,MAAM,GAAG,GAAG,kBAAkB,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;QACnD,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,GAAG,CAA0B,GAAG,CAAC,CAAC;QAC7D,IAAI,MAAM;YAAE,OAAO,MAAM,CAAC;QAE1B,MAAM,GAAG,GAAG,MAAM,gBAAgB,CAChC,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,mCAAmC,EAC3E,QAAQ,CACT,CAAC;QACF,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;QACrE,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA4B,CAAC;QAC3D,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;QACjC,OAAO,IAAI,CAAC;IACd,CAAC;CACF;AAED,MAAM,UAAU,gBAAgB,CAC9B,OAAgC,EAChC,OAAgC;IAEhC,MAAM,CAAC,GAAG,OAAO,IAAI,EAAE,CAAC;IACxB,MAAM,GAAG,GAAG,CAAC,GAAW,EAAW,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC;IAC7D,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;IACzC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACvE,CAAC;IACD,OAAO;QACL,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QAC7B,KAAK;QACL,aAAa,EAAE,GAAG,CAAC,gBAAgB,CAAC,KAAK,IAAI;QAC7C,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS;QACnD,OAAO,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS;QAC5D,QAAQ,EAAE,GAAG,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS;QACnF,GAAG,EAAE,OAAO;KACb,CAAC;AACJ,CAAC"}

package/dist/services/connectors/types.d.ts

@@ -12,13 +12,25 @@ export interface AuthorizeUrlOptions {
     redirectUri: string;
     scopes?: string[];
     extraParams?: Record<string, string>;
+    /**
+     * Binds the ID token to this authorization request. The connector sends it to
+     * the provider and the returned ID token must carry the same value.
+     */
+    nonce?: string;
 }
 export interface IdentityConnector {
     id: string;
     name: string;
     type: string;
     getAuthorizeUrl(opts: AuthorizeUrlOptions): string | Promise<string>;
-    exchangeCode(code: string, redirectUri: string): Promise<ExternalIdentity>;
+    /**
+     * `nonce` is the value sent in the authorization request. When supplied, the
+     * returned ID token must carry it, which is what binds the token to this
+     * login attempt rather than to any other.
+     */
+    exchangeCode(code: string, redirectUri: string, opts?: {
+        nonce?: string;
+    }): Promise<ExternalIdentity>;
     verifyToken?(token: string): Promise<ExternalIdentity>;
 }
 export interface ConnectorConfig {

package/dist/services/connectors/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/services/connectors/types.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,gBAAgB;IAC/B,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC/B;AAED,MAAM,WAAW,mBAAmB;IAClC,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACtC;AAED,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,eAAe,CAAC,IAAI,EAAE,mBAAmB,GAAG,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACrE,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAC3E,WAAW,CAAC,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;CACxD;AAED,MAAM,WAAW,eAAe;IAC9B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,gBAAgB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC3C"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/services/connectors/types.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,gBAAgB;IAC/B,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC/B;AAED,MAAM,WAAW,mBAAmB;IAClC,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACrC;;;OAGG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,eAAe,CAAC,IAAI,EAAE,mBAAmB,GAAG,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACrE;;;;OAIG;IACH,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;IACtG,WAAW,CAAC,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;CACxD;AAED,MAAM,WAAW,eAAe;IAC9B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,gBAAgB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC3C"}

package/dist/services/connectors/zitadel.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"zitadel.d.ts","sourceRoot":"","sources":["../../../src/services/connectors/zitadel.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAG5G,qBAAa,gBAAiB,YAAW,iBAAiB;IACxD,EAAE,SAAa;IACf,IAAI,SAAa;IACjB,IAAI,SAAa;IACjB,OAAO,CAAC,GAAG,CAAkB;IAC7B,OAAO,CAAC,aAAa,CAAuB;gBAEhC,GAAG,EAAE,eAAe;IAIhC,eAAe,CAAC,IAAI,EAAE,mBAAmB,GAAG,MAAM;IAe5C,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAwB1E,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC;YAa7C,UAAU;CAQzB"}
+{"version":3,"file":"zitadel.d.ts","sourceRoot":"","sources":["../../../src/services/connectors/zitadel.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAI5G,qBAAa,gBAAiB,YAAW,iBAAiB;IACxD,EAAE,SAAa;IACf,IAAI,SAAa;IACjB,IAAI,SAAa;IACjB,OAAO,CAAC,GAAG,CAAkB;IAC7B,OAAO,CAAC,aAAa,CAAuB;IAE5C,YAAY,GAAG,EAAE,eAAe,EAE/B;IAED,eAAe,CAAC,IAAI,EAAE,mBAAmB,GAAG,MAAM,CAajD;IAEK,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAsB/E;IAEK,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAW1D;YAEa,UAAU;CAQzB"}

package/dist/services/connectors/zitadel.js

@@ -1,6 +1,7 @@
 import { createRemoteJWKSet, jwtVerify } from "jose";
 import { config, zitadelBaseUrl } from "../../config.js";
 import { normalizePayload } from "./oidc.js";
+import { customFetch, fetchSsoEndpoint, safeJwksFetch } from "../ssoEndpointPolicy.js";
 export class ZitadelConnector {
     id = "zitadel";
     name = "Zitadel";
@@ -32,7 +33,7 @@ export class ZitadelConnector {
             code,
             redirect_uri: redirectUri,
         });
-        const res = await fetch(`${zitadelBaseUrl()}/oauth/v2/token`, {
+        const res = await fetchSsoEndpoint(`${zitadelBaseUrl()}/oauth/v2/token`, "tokenEndpoint", {
             method: "POST",
             headers: { "Content-Type": "application/x-www-form-urlencoded" },
             body: params.toString(),
@@ -46,7 +47,7 @@ export class ZitadelConnector {
     }
     async verifyToken(token) {
         const jwksUrl = await this.getJwksUrl();
-        const JWKS = createRemoteJWKSet(new URL(jwksUrl));
+        const JWKS = createRemoteJWKSet(new URL(jwksUrl), { [customFetch]: safeJwksFetch });
         const issuer = config.ZITADEL_DOMAIN.startsWith("http")
             ? config.ZITADEL_DOMAIN
             : `https://${config.ZITADEL_DOMAIN}`;
@@ -59,7 +60,7 @@ export class ZitadelConnector {
     async getJwksUrl() {
         if (this.cachedJwksUrl)
             return this.cachedJwksUrl;
-        const res = await fetch(`${zitadelBaseUrl()}/.well-known/openid-configuration`);
+        const res = await fetchSsoEndpoint(`${zitadelBaseUrl()}/.well-known/openid-configuration`, "issuer");
         if (!res.ok)
             throw new Error(`Zitadel discovery failed: ${res.status}`);
         const discovery = (await res.json());

package/dist/services/connectors/zitadel.js.map

@@ -1 +1 @@
-{"version":3,"file":"zitadel.js","sourceRoot":"","sources":["../../../src/services/connectors/zitadel.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AACrD,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAEzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAE7C,MAAM,OAAO,gBAAgB;IAC3B,EAAE,GAAG,SAAS,CAAC;IACf,IAAI,GAAG,SAAS,CAAC;IACjB,IAAI,GAAG,SAAS,CAAC;IACT,GAAG,CAAkB;IACrB,aAAa,GAAkB,IAAI,CAAC;IAE5C,YAAY,GAAoB;QAC9B,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;IACjB,CAAC;IAED,eAAe,CAAC,IAAyB;QACvC,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC;QACrC,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;YACjC,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,QAAQ;YAC5B,YAAY,EAAE,WAAW;YACzB,aAAa,EAAE,MAAM;YACrB,KAAK,EAAE,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;YAChE,KAAK,EAAE,IAAI,CAAC,KAAK;SAClB,CAAC,CAAC;QACH,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;YACrB,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC3C,CAAC;QACD,OAAO,GAAG,cAAc,EAAE,uBAAuB,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC;IACvE,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,IAAY,EAAE,WAAmB;QAClD,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;YACjC,UAAU,EAAE,oBAAoB;YAChC,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,QAAQ;YAC5B,aAAa,EAAE,IAAI,CAAC,GAAG,CAAC,YAAY;YACpC,IAAI;YACJ,YAAY,EAAE,WAAW;SAC1B,CAAC,CAAC;QAEH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,cAAc,EAAE,iBAAiB,EAAE;YAC5D,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;YAChE,IAAI,EAAE,MAAM,CAAC,QAAQ,EAAE;SACxB,CAAC,CAAC;QAEH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CAAC,kCAAkC,GAAG,CAAC,MAAM,IAAI,IAAI,EAAE,CAAC,CAAC;QAC1E,CAAC;QAED,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAyB,CAAC;QACxD,OAAO,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACzC,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,KAAa;QAC7B,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;QACxC,MAAM,IAAI,GAAG,kBAAkB,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;QAClD,MAAM,MAAM,GAAG,MAAM,CAAC,cAAe,CAAC,UAAU,CAAC,MAAM,CAAC;YACtD,CAAC,CAAC,MAAM,CAAC,cAAe;YACxB,CAAC,CAAC,WAAW,MAAM,CAAC,cAAe,EAAE,CAAC;QACxC,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE;YAC/C,MAAM;YACN,QAAQ,EAAE,IAAI,CAAC,GAAG,CAAC,QAAQ;SAC5B,CAAC,CAAC;QACH,OAAO,gBAAgB,CAAC,OAAkC,EAAE,IAAI,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;IACzF,CAAC;IAEO,KAAK,CAAC,UAAU;QACtB,IAAI,IAAI,CAAC,aAAa;YAAE,OAAO,IAAI,CAAC,aAAa,CAAC;QAClD,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,cAAc,EAAE,mCAAmC,CAAC,CAAC;QAChF,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;QACxE,MAAM,SAAS,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA4B,CAAC;QAChE,IAAI,CAAC,aAAa,GAAI,SAAS,CAAC,QAAmB,IAAI,GAAG,cAAc,EAAE,gBAAgB,CAAC;QAC3F,OAAO,IAAI,CAAC,aAAa,CAAC;IAC5B,CAAC;CACF"}
+{"version":3,"file":"zitadel.js","sourceRoot":"","sources":["../../../src/services/connectors/zitadel.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AACrD,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAEzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAEvF,MAAM,OAAO,gBAAgB;IAC3B,EAAE,GAAG,SAAS,CAAC;IACf,IAAI,GAAG,SAAS,CAAC;IACjB,IAAI,GAAG,SAAS,CAAC;IACT,GAAG,CAAkB;IACrB,aAAa,GAAkB,IAAI,CAAC;IAE5C,YAAY,GAAoB;QAC9B,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;IACjB,CAAC;IAED,eAAe,CAAC,IAAyB;QACvC,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC;QACrC,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;YACjC,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,QAAQ;YAC5B,YAAY,EAAE,WAAW;YACzB,aAAa,EAAE,MAAM;YACrB,KAAK,EAAE,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;YAChE,KAAK,EAAE,IAAI,CAAC,KAAK;SAClB,CAAC,CAAC;QACH,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;YACrB,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC3C,CAAC;QACD,OAAO,GAAG,cAAc,EAAE,uBAAuB,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC;IACvE,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,IAAY,EAAE,WAAmB;QAClD,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;YACjC,UAAU,EAAE,oBAAoB;YAChC,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,QAAQ;YAC5B,aAAa,EAAE,IAAI,CAAC,GAAG,CAAC,YAAY;YACpC,IAAI;YACJ,YAAY,EAAE,WAAW;SAC1B,CAAC,CAAC;QAEH,MAAM,GAAG,GAAG,MAAM,gBAAgB,CAAC,GAAG,cAAc,EAAE,iBAAiB,EAAE,eAAe,EAAE;YACxF,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;YAChE,IAAI,EAAE,MAAM,CAAC,QAAQ,EAAE;SACxB,CAAC,CAAC;QAEH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CAAC,kCAAkC,GAAG,CAAC,MAAM,IAAI,IAAI,EAAE,CAAC,CAAC;QAC1E,CAAC;QAED,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAyB,CAAC;QACxD,OAAO,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACzC,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,KAAa;QAC7B,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;QACxC,MAAM,IAAI,GAAG,kBAAkB,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC;QACpF,MAAM,MAAM,GAAG,MAAM,CAAC,cAAe,CAAC,UAAU,CAAC,MAAM,CAAC;YACtD,CAAC,CAAC,MAAM,CAAC,cAAe;YACxB,CAAC,CAAC,WAAW,MAAM,CAAC,cAAe,EAAE,CAAC;QACxC,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE;YAC/C,MAAM;YACN,QAAQ,EAAE,IAAI,CAAC,GAAG,CAAC,QAAQ;SAC5B,CAAC,CAAC;QACH,OAAO,gBAAgB,CAAC,OAAkC,EAAE,IAAI,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;IACzF,CAAC;IAEO,KAAK,CAAC,UAAU;QACtB,IAAI,IAAI,CAAC,aAAa;YAAE,OAAO,IAAI,CAAC,aAAa,CAAC;QAClD,MAAM,GAAG,GAAG,MAAM,gBAAgB,CAAC,GAAG,cAAc,EAAE,mCAAmC,EAAE,QAAQ,CAAC,CAAC;QACrG,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;QACxE,MAAM,SAAS,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA4B,CAAC;QAChE,IAAI,CAAC,aAAa,GAAI,SAAS,CAAC,QAAmB,IAAI,GAAG,cAAc,EAAE,gBAAgB,CAAC;QAC3F,OAAO,IAAI,CAAC,aAAa,CAAC;IAC5B,CAAC;CACF"}

package/dist/services/domain/authentication.d.ts

@@ -1,12 +1,13 @@
 import { type User } from "../../db/schema.js";
 import { type TokenSet } from "../tokens.js";
-import type { UserRepository, ApplicationRepository } from "../../repositories/types.js";
+import type { UserRepository, ApplicationRepository, OrganizationRepository, MfaFlow } from "../../repositories/types.js";
+import type { IssuedMfaChallenge, MfaFactor, MfaService } from "../mfa.js";
 import { type Result } from "../../lib/result.js";
 export interface AuthContext {
     app?: {
         id: string;
         clientId: string;
-        orgId: string;
+        orgId?: string;
     };
     org?: {
         id: string;
@@ -24,19 +25,57 @@ export interface LoginInput {
     email: string;
     password: string;
     clientId?: string;
+    /** Which login surface started the flow; recorded on the challenge. */
+    flow?: MfaFlow;
+    ipAddress?: string;
+    userAgent?: string;
 }
 export interface TokenResponse {
     user: User;
     tokens: TokenSet;
     context: AuthContext;
 }
+/**
+ * Result of the password step. Tokens are only ever present once the user is
+ * fully authenticated; an MFA-enabled user is returned in `requires_mfa` with
+ * an opaque challenge and no tokens.
+ */
+export type LoginResult = {
+    status: "authenticated";
+    user: User;
+    tokens: TokenSet;
+    context: AuthContext;
+} | {
+    status: "requires_mfa";
+    user: User;
+    challenge: IssuedMfaChallenge;
+    context: AuthContext;
+};
+export interface MfaCompletion {
+    user: User;
+    tokens: TokenSet;
+    context: AuthContext;
+    flow: MfaFlow;
+    factor: MfaFactor;
+    /** Client the challenge was created for; the session cookie is scoped to it. */
+    clientId?: string;
+}
 export declare class AuthenticationDomainService {
     private readonly users;
     private readonly applications;
-    constructor(users: UserRepository, applications: ApplicationRepository);
+    private readonly organizations;
+    private readonly mfa;
+    constructor(users: UserRepository, applications: ApplicationRepository, organizations: OrganizationRepository, mfa: MfaService);
     private loadAppContext;
     register(input: RegisterInput): Promise<Result<TokenResponse>>;
-    login(input: LoginInput): Promise<Result<TokenResponse>>;
+    login(input: LoginInput): Promise<Result<LoginResult>>;
+    private issueTokens;
+    /**
+     * Second step of the login state machine: verify a factor against an
+     * outstanding challenge and only then issue tokens. Replaying the same
+     * challenge returns `MFA_CHALLENGE_REPLAYED` and issues nothing.
+     */
+    completeMfa(challengeToken: string, code: string, factor: MfaFactor, ipAddress?: string, userAgent?: string): Promise<Result<MfaCompletion>>;
     refresh(refreshToken: string, clientId?: string): Promise<Result<{
         tokens: TokenSet;
         userId?: string;

package/dist/services/domain/authentication.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"authentication.d.ts","sourceRoot":"","sources":["../../../src/services/domain/authentication.ts"],"names":[],"mappings":"AAIA,OAAO,EAA8B,KAAK,IAAI,EAAE,MAAM,oBAAoB,CAAC;AAE3E,OAAO,EAA0D,KAAK,QAAQ,EAAE,MAAM,cAAc,CAAC;AAIrG,OAAO,KAAK,EAAE,cAAc,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AACzF,OAAO,EAAW,KAAK,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAG3D,MAAM,WAAW,WAAW;IAC1B,GAAG,CAAC,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IACtD,GAAG,CAAC,EAAE;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC;CACtB;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,IAAI,CAAC;IACX,MAAM,EAAE,QAAQ,CAAC;IACjB,OAAO,EAAE,WAAW,CAAC;CACtB;AAED,qBAAa,2BAA2B;IAEpC,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,YAAY;gBADZ,KAAK,EAAE,cAAc,EACrB,YAAY,EAAE,qBAAqB;YAGxC,cAAc;IAUtB,QAAQ,CAAC,KAAK,EAAE,aAAa,GAAG,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;IA8E9D,KAAK,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;IA6DxD,OAAO,CAAC,YAAY,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAAE,MAAM,EAAE,QAAQ,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAWxG,MAAM,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAOpD,wBAAwB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,IAAI,CAAA;KAAE,GAAG,IAAI,CAAC,CAAC;IAkB9F,sBAAsB,CAAC,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;CA+CxF"}
+{"version":3,"file":"authentication.d.ts","sourceRoot":"","sources":["../../../src/services/domain/authentication.ts"],"names":[],"mappings":"AAIA,OAAO,EAA8B,KAAK,IAAI,EAAE,MAAM,oBAAoB,CAAC;AAI3E,OAAO,EAA6E,KAAK,QAAQ,EAAE,MAAM,cAAc,CAAC;AAIxH,OAAO,KAAK,EAAE,cAAc,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,OAAO,EAAE,MAAM,6BAA6B,CAAC;AAC1H,OAAO,KAAK,EAAE,kBAAkB,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAC3E,OAAO,EAAW,KAAK,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAG3D,MAAM,WAAW,WAAW;IAC1B,GAAG,CAAC,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACvD,GAAG,CAAC,EAAE;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC;CACtB;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,uEAAuE;IACvE,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,IAAI,CAAC;IACX,MAAM,EAAE,QAAQ,CAAC;IACjB,OAAO,EAAE,WAAW,CAAC;CACtB;AAED;;;;GAIG;AACH,MAAM,MAAM,WAAW,GACnB;IAAE,MAAM,EAAE,eAAe,CAAC;IAAC,IAAI,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,QAAQ,CAAC;IAAC,OAAO,EAAE,WAAW,CAAA;CAAE,GAC/E;IAAE,MAAM,EAAE,cAAc,CAAC;IAAC,IAAI,EAAE,IAAI,CAAC;IAAC,SAAS,EAAE,kBAAkB,CAAC;IAAC,OAAO,EAAE,WAAW,CAAA;CAAE,CAAC;AAEhG,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,IAAI,CAAC;IACX,MAAM,EAAE,QAAQ,CAAC;IACjB,OAAO,EAAE,WAAW,CAAC;IACrB,IAAI,EAAE,OAAO,CAAC;IACd,MAAM,EAAE,SAAS,CAAC;IAClB,gFAAgF;IAChF,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,qBAAa,2BAA2B;IAEpC,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,YAAY;IAC7B,OAAO,CAAC,QAAQ,CAAC,aAAa;IAC9B,OAAO,CAAC,QAAQ,CAAC,GAAG;IAJtB,YACmB,KAAK,EAAE,cAAc,EACrB,YAAY,EAAE,qBAAqB,EACnC,aAAa,EAAE,sBAAsB,EACrC,GAAG,EAAE,UAAU,EAC9B;YAEU,cAAc;IAYtB,QAAQ,CAAC,KAAK,EAAE,aAAa,GAAG,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CA4EnE;IAEK,KAAK,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CA4E3D;YAEa,WAAW;IAoBzB;;;;OAIG;IACG,WAAW,CACf,cAAc,EAAE,MAAM,EACtB,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,SAAS,EACjB,SAAS,CAAC,EAAE,MAAM,EAClB,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAgChC;IAEK,OAAO,CAAC,YAAY,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAAE,MAAM,EAAE,QAAQ,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC,CAS7G;IAEK,MAAM,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAKzD;IAEK,wBAAwB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,IAAI,CAAA;KAAE,GAAG,IAAI,CAAC,CAAC,CAgBnG;IAEK,sBAAsB,CAAC,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAuDtF;CACF"}