@hilbras/keystone 1.6.0 → 2.5.0

package/dist/services/mfa.js

@@ -0,0 +1,157 @@
+import crypto from "node:crypto";
+import { config } from "../config.js";
+import { emit } from "./events/bus.js";
+import { verifyBackupCode, verifyUserTotpCode } from "./totp.js";
+import { err, ok } from "../lib/result.js";
+/** Challenges newer than this are not superseded by a repeat password step. */
+const SUPERSEDE_GRACE_MS = 10_000;
+export function hashMfaChallenge(challenge) {
+    return crypto.createHash("sha256").update(challenge).digest("hex");
+}
+export function isMfaChallengeUsable(challenge, now = new Date()) {
+    if (challenge.status !== "requires_mfa" || challenge.consumedAt)
+        return false;
+    if (challenge.attempts >= challenge.maxAttempts)
+        return false;
+    return challenge.expiresAt > now;
+}
+export class MfaService {
+    challenges;
+    users;
+    constructor(challenges, users) {
+        this.challenges = challenges;
+        this.users = users;
+    }
+    async createChallenge(user, flow, clientId, meta = {}) {
+        // Supersede older challenges so a leaked one cannot outlive a fresh
+        // password step. A short grace period is kept so a client that retries
+        // login moments apart does not cancel the attempt it just started.
+        await this.challenges.invalidateUserChallenges(user.id, new Date(Date.now() - SUPERSEDE_GRACE_MS));
+        const challenge = crypto.randomBytes(32).toString("base64url");
+        const expiresAt = new Date(Date.now() + config.MFA_CHALLENGE_TTL_SECONDS * 1000);
+        await this.challenges.create({
+            challengeHash: hashMfaChallenge(challenge),
+            userId: user.id,
+            flow: normalizeFlow(flow),
+            clientId,
+            ipAddress: meta.ipAddress,
+            userAgent: meta.userAgent,
+            expiresAt,
+            maxAttempts: config.MFA_MAX_ATTEMPTS,
+        });
+        await emit({
+            type: "mfa_challenge_created",
+            payload: {
+                userId: user.id,
+                flow,
+                client_id: clientId,
+                ip: meta.ipAddress,
+                expiresAt: expiresAt.toISOString(),
+            },
+        });
+        return { challenge, expiresAt, flow, clientId };
+    }
+    /**
+     * Verify a second factor for an outstanding challenge and consume it.
+     * No token is issued here: the caller decides what to issue after the state
+     * transition to `mfa_verified` has succeeded.
+     */
+    async verifyChallenge(challengeToken, code, factor, loadUser) {
+        const now = new Date();
+        const challenge = await this.challenges.findByHash(hashMfaChallenge(challengeToken));
+        if (!challenge) {
+            await emit({ type: "mfa_challenge_rejected", payload: { reason: "unknown_challenge" } });
+            return err({ code: "MFA_CHALLENGE_INVALID", message: "The MFA challenge is invalid or has expired.", statusCode: 401 });
+        }
+        if (challenge.expiresAt <= now) {
+            await emit({ type: "mfa_challenge_expired", payload: { userId: challenge.userId, reason: "expired" } });
+            return err({ code: "MFA_CHALLENGE_EXPIRED", message: "The MFA challenge is invalid or has expired.", statusCode: 401 });
+        }
+        if (!isMfaChallengeUsable(challenge, now)) {
+            const reason = challenge.status !== "requires_mfa" ? challenge.status : "attempts_exhausted";
+            await emit({
+                type: challenge.status === "requires_mfa" ? "mfa_challenge_failed" : "mfa_challenge_rejected",
+                payload: { userId: challenge.userId, reason },
+            });
+            return err({
+                code: challenge.status === "consumed" ? "MFA_CHALLENGE_REPLAYED" : "MFA_CHALLENGE_LOCKED",
+                message: "The MFA challenge is invalid or has expired.",
+                statusCode: 401,
+            });
+        }
+        const user = await loadUser(challenge.userId);
+        if (!user || !user.isActive) {
+            await this.challenges.invalidateUserChallenges(challenge.userId, now);
+            await emit({ type: "mfa_challenge_failed", payload: { userId: challenge.userId, reason: "account_unusable" } });
+            return err({ code: "ACCOUNT_UNAVAILABLE", message: "This account cannot sign in.", statusCode: 403 });
+        }
+        // The password step refuses these states; the MFA step must not be the
+        // weaker door, or a challenge opened moments earlier would still work.
+        if (user.accountReviewRequired) {
+            await this.challenges.invalidateUserChallenges(user.id, now);
+            await emit({ type: "mfa_challenge_failed", payload: { userId: user.id, reason: "account_review_required" } });
+            return err({ code: "ACCOUNT_REVIEW_REQUIRED", message: "This account is pending review.", statusCode: 403 });
+        }
+        if (user.lockedUntil && user.lockedUntil > new Date()) {
+            await this.challenges.invalidateUserChallenges(user.id, now);
+            await emit({ type: "mfa_challenge_failed", payload: { userId: user.id, reason: "account_locked" } });
+            return err({ code: "ACCOUNT_LOCKED", message: "Account is temporarily locked due to too many failed attempts. Try again later.", statusCode: 403 });
+        }
+        if (!user.totpEnabled) {
+            // The factor was disabled while the challenge was outstanding.
+            await this.challenges.invalidateUserChallenges(user.id, now);
+            await emit({ type: "mfa_challenge_failed", payload: { userId: user.id, reason: "mfa_disabled" } });
+            return err({ code: "MFA_NOT_REQUIRED", message: "Multi-factor authentication is no longer required.", statusCode: 409 });
+        }
+        const verified = factor === "totp"
+            ? (await verifyUserTotpCode(user, code)).valid
+            : await verifyBackupCode(user.id, code);
+        if (!verified) {
+            const updated = await this.challenges.recordFailedAttempt(challenge.id, now);
+            // Count factor failures toward the account lockout so a stolen password
+            // cannot be brute-forced through the MFA step at its own slower pace.
+            const afterFailure = await this.users.recordFailedLogin(user.id);
+            const failedAttempts = afterFailure?.failedLoginAttempts ?? 0;
+            if (failedAttempts >= config.ACCOUNT_LOCKOUT_THRESHOLD) {
+                await this.users.lockAccount(user.id, new Date(Date.now() + config.ACCOUNT_LOCKOUT_DURATION_SECONDS * 1000));
+                await this.challenges.invalidateUserChallenges(user.id, new Date());
+                await emit({
+                    type: "mfa_challenge_failed",
+                    payload: { userId: user.id, factor, reason: "account_locked", attempts: failedAttempts },
+                });
+                return err({ code: "ACCOUNT_LOCKED", message: "Account locked due to too many failed attempts. Try again later.", statusCode: 403 });
+            }
+            await emit({
+                type: "mfa_challenge_failed",
+                payload: {
+                    userId: user.id,
+                    factor,
+                    attempts: updated?.attempts ?? challenge.attempts + 1,
+                    attemptsRemaining: updated ? Math.max(0, updated.maxAttempts - updated.attempts) : 0,
+                },
+            });
+            return err({ code: "MFA_INVALID_CODE", message: "The verification code is invalid.", statusCode: 401 });
+        }
+        const consumed = await this.challenges.consume(challenge.id, new Date());
+        if (!consumed) {
+            // Lost the race against a concurrent verification of the same challenge.
+            await emit({ type: "mfa_challenge_rejected", payload: { userId: user.id, reason: "already_consumed" } });
+            return err({ code: "MFA_CHALLENGE_REPLAYED", message: "The MFA challenge is invalid or has expired.", statusCode: 401 });
+        }
+        await this.users.resetFailedLogins(user.id);
+        await emit({
+            type: "mfa_verified",
+            payload: { userId: user.id, factor, flow: challenge.flow },
+        });
+        return ok({
+            challengeId: challenge.id,
+            user,
+            flow: normalizeFlow(challenge.flow),
+            clientId: challenge.clientId ?? undefined,
+        });
+    }
+}
+function normalizeFlow(flow) {
+    return flow === "token_login" ? "token_login" : "login";
+}
+//# sourceMappingURL=mfa.js.map

package/dist/services/mfa.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mfa.js","sourceRoot":"","sources":["../../src/services/mfa.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AACtC,OAAO,EAAE,IAAI,EAAE,MAAM,iBAAiB,CAAC;AACvC,OAAO,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAC;AAOjE,OAAO,EAAE,GAAG,EAAE,EAAE,EAAe,MAAM,kBAAkB,CAAC;AAkBxD,+EAA+E;AAC/E,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAclC,MAAM,UAAU,gBAAgB,CAAC,SAAiB;IAChD,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACrE,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,SAA8G,EAC9G,GAAG,GAAG,IAAI,IAAI,EAAE;IAEhB,IAAI,SAAS,CAAC,MAAM,KAAK,cAAc,IAAI,SAAS,CAAC,UAAU;QAAE,OAAO,KAAK,CAAC;IAC9E,IAAI,SAAS,CAAC,QAAQ,IAAI,SAAS,CAAC,WAAW;QAAE,OAAO,KAAK,CAAC;IAC9D,OAAO,SAAS,CAAC,SAAS,GAAG,GAAG,CAAC;AACnC,CAAC;AAED,MAAM,OAAO,UAAU;IAEF,UAAU;IACV,KAAK;IAFxB,YACmB,UAAkC,EAClC,KAAqB;0BADrB,UAAU;qBACV,KAAK;IACrB,CAAC;IAEJ,KAAK,CAAC,eAAe,CACnB,IAAU,EACV,IAAa,EACb,QAA4B,EAC5B,IAAI,GAAqB,EAAE;QAE3B,oEAAoE;QACpE,uEAAuE;QACvE,mEAAmE;QACnE,MAAM,IAAI,CAAC,UAAU,CAAC,wBAAwB,CAC5C,IAAI,CAAC,EAAE,EACP,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,kBAAkB,CAAC,CAC1C,CAAC;QAEF,MAAM,SAAS,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QAC/D,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,yBAAyB,GAAG,IAAI,CAAC,CAAC;QAEjF,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC;YAC3B,aAAa,EAAE,gBAAgB,CAAC,SAAS,CAAC;YAC1C,MAAM,EAAE,IAAI,CAAC,EAAE;YACf,IAAI,EAAE,aAAa,CAAC,IAAI,CAAC;YACzB,QAAQ;YACR,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,SAAS;YACT,WAAW,EAAE,MAAM,CAAC,gBAAgB;SACrC,CAAC,CAAC;QAEH,MAAM,IAAI,CAAC;YACT,IAAI,EAAE,uBAAuB;YAC7B,OAAO,EAAE;gBACP,MAAM,EAAE,IAAI,CAAC,EAAE;gBACf,IAAI;gBACJ,SAAS,EAAE,QAAQ;gBACnB,EAAE,EAAE,IAAI,CAAC,SAAS;gBAClB,SAAS,EAAE,SAAS,CAAC,WAAW,EAAE;aACnC;SACF,CAAC,CAAC;QAEH,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IAClD,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,eAAe,CACnB,cAAsB,EACtB,IAAY,EACZ,MAAiB,EACjB,QAAuD;QAEvD,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,gBAAgB,CAAC,cAAc,CAAC,CAAC,CAAC;QACrF,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,CAAC,EAAE,IAAI,EAAE,wBAAwB,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,mBAAmB,EAAE,EAAE,CAAC,CAAC;YACzF,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,uBAAuB,EAAE,OAAO,EAAE,8CAA8C,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QAC1H,CAAC;QAED,IAAI,SAAS,CAAC,SAAS,IAAI,GAAG,EAAE,CAAC;YAC/B,MAAM,IAAI,CAAC,EAAE,IAAI,EAAE,uBAAuB,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;YACxG,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,uBAAuB,EAAE,OAAO,EAAE,8CAA8C,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QAC1H,CAAC;QAED,IAAI,CAAC,oBAAoB,CAAC,SAAS,EAAE,GAAG,CAAC,EAAE,CAAC;YAC1C,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,KAAK,cAAc,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,oBAAoB,CAAC;YAC7F,MAAM,IAAI,CAAC;gBACT,IAAI,EAAE,SAAS,CAAC,MAAM,KAAK,cAAc,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,wBAAwB;gBAC7F,OAAO,EAAE,EAAE,MAAM,EAAE,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE;aAC9C,CAAC,CAAC;YACH,OAAO,GAAG,CAAC;gBACT,IAAI,EAAE,SAAS,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,sBAAsB;gBACzF,OAAO,EAAE,8CAA8C;gBACvD,UAAU,EAAE,GAAG;aAChB,CAAC,CAAC;QACL,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QAC9C,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC5B,MAAM,IAAI,CAAC,UAAU,CAAC,wBAAwB,CAAC,SAAS,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;YACtE,MAAM,IAAI,CAAC,EAAE,IAAI,EAAE,sBAAsB,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,kBAAkB,EAAE,EAAE,CAAC,CAAC;YAChH,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,qBAAqB,EAAE,OAAO,EAAE,8BAA8B,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QACxG,CAAC;QAED,uEAAuE;QACvE,uEAAuE;QACvE,IAAI,IAAI,CAAC,qBAAqB,EAAE,CAAC;YAC/B,MAAM,IAAI,CAAC,UAAU,CAAC,wBAAwB,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;YAC7D,MAAM,IAAI,CAAC,EAAE,IAAI,EAAE,sBAAsB,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,yBAAyB,EAAE,EAAE,CAAC,CAAC;YAC9G,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,yBAAyB,EAAE,OAAO,EAAE,iCAAiC,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QAC/G,CAAC;QAED,IAAI,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,WAAW,GAAG,IAAI,IAAI,EAAE,EAAE,CAAC;YACtD,MAAM,IAAI,CAAC,UAAU,CAAC,wBAAwB,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;YAC7D,MAAM,IAAI,CAAC,EAAE,IAAI,EAAE,sBAAsB,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,gBAAgB,EAAE,EAAE,CAAC,CAAC;YACrG,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,iFAAiF,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QACtJ,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YACtB,+DAA+D;YAC/D,MAAM,IAAI,CAAC,UAAU,CAAC,wBAAwB,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;YAC7D,MAAM,IAAI,CAAC,EAAE,IAAI,EAAE,sBAAsB,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,cAAc,EAAE,EAAE,CAAC,CAAC;YACnG,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,kBAAkB,EAAE,OAAO,EAAE,oDAAoD,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QAC3H,CAAC;QAED,MAAM,QAAQ,GACZ,MAAM,KAAK,MAAM;YACf,CAAC,CAAC,CAAC,MAAM,kBAAkB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,KAAK;YAC9C,CAAC,CAAC,MAAM,gBAAgB,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;QAE5C,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,mBAAmB,CAAC,SAAS,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;YAE7E,wEAAwE;YACxE,sEAAsE;YACtE,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACjE,MAAM,cAAc,GAAG,YAAY,EAAE,mBAAmB,IAAI,CAAC,CAAC;YAC9D,IAAI,cAAc,IAAI,MAAM,CAAC,yBAAyB,EAAE,CAAC;gBACvD,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW,CAC1B,IAAI,CAAC,EAAE,EACP,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,gCAAgC,GAAG,IAAI,CAAC,CACtE,CAAC;gBACF,MAAM,IAAI,CAAC,UAAU,CAAC,wBAAwB,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC;gBACpE,MAAM,IAAI,CAAC;oBACT,IAAI,EAAE,sBAAsB;oBAC5B,OAAO,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,gBAAgB,EAAE,QAAQ,EAAE,cAAc,EAAE;iBACzF,CAAC,CAAC;gBACH,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,kEAAkE,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;YACvI,CAAC;YAED,MAAM,IAAI,CAAC;gBACT,IAAI,EAAE,sBAAsB;gBAC5B,OAAO,EAAE;oBACP,MAAM,EAAE,IAAI,CAAC,EAAE;oBACf,MAAM;oBACN,QAAQ,EAAE,OAAO,EAAE,QAAQ,IAAI,SAAS,CAAC,QAAQ,GAAG,CAAC;oBACrD,iBAAiB,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,WAAW,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;iBACrF;aACF,CAAC,CAAC;YACH,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,kBAAkB,EAAE,OAAO,EAAE,mCAAmC,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QAC1G,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC;QACzE,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,yEAAyE;YACzE,MAAM,IAAI,CAAC,EAAE,IAAI,EAAE,wBAAwB,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,EAAE,CAAC,CAAC;YACzG,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,wBAAwB,EAAE,OAAO,EAAE,8CAA8C,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QAC3H,CAAC;QAED,MAAM,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAE5C,MAAM,IAAI,CAAC;YACT,IAAI,EAAE,cAAc;YACpB,OAAO,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,EAAE;SAC3D,CAAC,CAAC;QAEH,OAAO,EAAE,CAAC;YACR,WAAW,EAAE,SAAS,CAAC,EAAE;YACzB,IAAI;YACJ,IAAI,EAAE,aAAa,CAAC,SAAS,CAAC,IAAI,CAAC;YACnC,QAAQ,EAAE,SAAS,CAAC,QAAQ,IAAI,SAAS;SAC1C,CAAC,CAAC;IACL,CAAC;CACF;AAED,SAAS,aAAa,CAAC,IAAY;IACjC,OAAO,IAAI,KAAK,aAAa,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC;AAC1D,CAAC"}

package/dist/services/oauth2.d.ts

@@ -1,4 +1,5 @@
-import { oauth2AuthorizationCodes, type User, type Application } from "../db/schema.js";
+import { oauth2AuthorizationCodes, oauth2Consents, type User, type Application } from "../db/schema.js";
+import { type MfaAssertion } from "./tokens.js";
 export interface AuthorizationCodeInput {
     appId: string;
     userId: string;
@@ -7,6 +8,7 @@ export interface AuthorizationCodeInput {
     redirectUri?: string;
     scopes?: string[];
     nonce?: string;
+    mfaFactor?: MfaAssertion;
 }
 export declare function generateAuthorizationCode(): {
     code: string;
@@ -14,44 +16,116 @@ export declare function generateAuthorizationCode(): {
 };
 export declare function storeAuthorizationCode(input: AuthorizationCodeInput): Promise<{
     code: string;
-    id: string;
-    createdAt: Date;
-    userId: string;
-    expiresAt: Date;
     appId: string;
-    scopes: string[];
-    codeHash: string;
     challenge: string | null;
     challengeMethod: string | null;
-    redirectUri: string | null;
+    codeHash: string;
+    createdAt: Date;
+    expiresAt: Date;
+    id: string;
+    mfaFactor: string | null;
     nonce: string | null;
+    redirectUri: string | null;
+    scopes: string[];
     usedAt: Date | null;
+    userId: string;
 }>;
 export declare function consumeAuthorizationCode(code: string, appId: string, redirectUri?: string): Promise<typeof oauth2AuthorizationCodes.$inferSelect | undefined>;
-export declare function verifyPKCE(challenge: string | null | undefined, method: string | null | undefined, verifier: string): boolean;
+/**
+ * Verify a PKCE code verifier against a stored challenge.
+ *
+ * `requireChallenge` exists because the previous shape of this function was the
+ * whole PKCE story at the token endpoint, and it was not a check at all:
+ *
+ * ```ts
+ * if (!challenge) return true;   // no challenge was registered -> accept
+ * ```
+ *
+ * A client that omitted `code_challenge` at `/authorize` and then sent any
+ * string as `code_verifier` at `/token` passed. The endpoint required a
+ * verifier to be *present*, so the requirement looked enforced while proving
+ * nothing. For a public client — an SPA or a mobile app that cannot hold a
+ * secret — PKCE is the only thing standing between an intercepted authorization
+ * code and a stolen account, so "optional" meant "unprotected".
+ *
+ * The two failure modes are now separated deliberately:
+ *  - no challenge and `requireChallenge` false: a confidential client that chose
+ *    not to use PKCE. Permitted, because it authenticates with a secret.
+ *  - a challenge but a mismatched or malformed verifier: always a failure.
+ */
+export declare function verifyPKCE(challenge: string | null | undefined, method: string | null | undefined, verifier: string | null | undefined, options?: {
+    requireChallenge?: boolean;
+}): boolean;
+/**
+ * A client that cannot keep a secret must use PKCE.
+ *
+ * Today every application has a non-null `client_secret_hash`, so this reduces to
+ * "the client has no usable secret" — which is the honest test regardless of how
+ * the column is populated, and stays correct if secretless public clients are
+ * introduced later.
+ */
+export declare function requiresPkce(clientSecretHash: string | null | undefined): boolean;
+/**
+ * Reduce requested scopes to the ones actually granted.
+ *
+ * The effective set is the intersection of what the client is registered to ask
+ * for, what it asked for, and what the user consented to. Previously the
+ * client's `scope` parameter was stored verbatim and the only filter applied was
+ * consent, so a client could put any string it liked into the issued token.
+ *
+ * Rejecting rather than silently dropping is deliberate: a client asking for
+ * something it was never registered for is a misconfiguration or an attempt to
+ * escalate, and quietly handing back a lesser scope set hides both. The error
+ * names the offending scope so the client can be fixed.
+ *
+ * An empty `allowedScopes` means "no restriction registered", which preserves
+ * every existing application. Once an application has an allowlist, it is
+ * enforced.
+ */
+export declare function resolveEffectiveScopes(input: {
+    requested: string[];
+    allowed: string[];
+    consented: string[] | null;
+}): {
+    ok: true;
+    scopes: string[];
+} | {
+    ok: false;
+    error: string;
+    scope: string;
+};
 export declare function hasConsent(userId: string, appId: string, requestedScopes: string[]): Promise<boolean>;
+/**
+ * The user's current consent record, or undefined if they have never consented
+ * or have revoked it.
+ *
+ * Kept separate from `hasConsent` because the scope intersection needs the
+ * granted set itself, not a yes/no answer to it.
+ */
+export declare function findConsent(userId: string, appId: string): Promise<typeof oauth2Consents.$inferSelect | undefined>;
 export declare function grantConsent(userId: string, appId: string, scopes: string[]): Promise<{
-    id: string;
-    userId: string;
     appId: string;
+    grantedAt: Date;
+    id: string;
     revokedAt: Date | null;
     scopes: string[];
-    grantedAt: Date;
+    userId: string;
 }>;
 export declare function revokeConsent(userId: string, appId: string): Promise<void>;
 export declare function listConsentsByAppId(appId: string): Promise<{
     id: string;
-    userId: string;
     appId: string;
-    revokedAt: Date | null;
+    userId: string;
     scopes: string[];
     grantedAt: Date;
+    revokedAt: Date | null;
 }[]>;
 export declare function createTokenResponse(user: User, app: Application, scopes: string[], opts?: {
     ip?: string;
     userAgent?: string;
     deviceFingerprint?: string;
     nonce?: string;
+    mfaFactor?: MfaAssertion;
 }): Promise<Record<string, unknown>>;
 export declare function findApplicationByClientId(clientId: string): Promise<Application | undefined>;
 export declare function verifyClientSecret(clientId: string, secret: string): Promise<Application | undefined>;

package/dist/services/oauth2.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oauth2.d.ts","sourceRoot":"","sources":["../../src/services/oauth2.ts"],"names":[],"mappings":"AAGA,OAAO,EACL,wBAAwB,EAIxB,KAAK,IAAI,EACT,KAAK,WAAW,EACjB,MAAM,iBAAiB,CAAC;AAIzB,MAAM,WAAW,sBAAsB;IACrC,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,wBAAgB,yBAAyB,IAAI;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAI9E;AAED,wBAAsB,sBAAsB,CAAC,KAAK,EAAE,sBAAsB;;;;;;;;;;;;;;GAoBzE;AAED,wBAAsB,wBAAwB,CAC5C,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,EACb,WAAW,CAAC,EAAE,MAAM,GACnB,OAAO,CAAC,OAAO,wBAAwB,CAAC,YAAY,GAAG,SAAS,CAAC,CA4BnE;AAED,wBAAgB,UAAU,CACxB,SAAS,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EACpC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EACjC,QAAQ,EAAE,MAAM,GACf,OAAO,CAKT;AAED,wBAAsB,UAAU,CAC9B,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,EACb,eAAe,EAAE,MAAM,EAAE,GACxB,OAAO,CAAC,OAAO,CAAC,CAkBlB;AAED,wBAAsB,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE;;;;;;;GAoBjF;AAED,wBAAsB,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAKhF;AAED,wBAAsB,mBAAmB,CAAC,KAAK,EAAE,MAAM;;;;;;;KAKtD;AAED,wBAAsB,mBAAmB,CACvC,IAAI,EAAE,IAAI,EACV,GAAG,EAAE,WAAW,EAChB,MAAM,EAAE,MAAM,EAAE,EAChB,IAAI,GAAE;IAAE,EAAE,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAO,oCA6B3F;AAED,wBAAsB,yBAAyB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC,CAOlG;AAED,wBAAsB,kBAAkB,CACtC,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC,CAWlC"}
+{"version":3,"file":"oauth2.d.ts","sourceRoot":"","sources":["../../src/services/oauth2.ts"],"names":[],"mappings":"AAGA,OAAO,EACL,wBAAwB,EACxB,cAAc,EAGd,KAAK,IAAI,EACT,KAAK,WAAW,EACjB,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EAA0D,KAAK,YAAY,EAAE,MAAM,aAAa,CAAC;AAExG,MAAM,WAAW,sBAAsB;IACrC,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,YAAY,CAAC;CAC1B;AAED,wBAAgB,yBAAyB,IAAI;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAI9E;AAED,wBAAsB,sBAAsB,CAAC,KAAK,EAAE,sBAAsB;;;;;;;;;;;;;;;GAqBzE;AAED,wBAAsB,wBAAwB,CAC5C,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,EACb,WAAW,CAAC,EAAE,MAAM,GACnB,OAAO,CAAC,OAAO,wBAAwB,CAAC,YAAY,GAAG,SAAS,CAAC,CAuBnE;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,UAAU,CACxB,SAAS,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EACpC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EACjC,QAAQ,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EACnC,OAAO,GAAE;IAAE,gBAAgB,CAAC,EAAE,OAAO,CAAA;CAAO,GAC3C,OAAO,CAYT;AAUD;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAAC,gBAAgB,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAEjF;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE;IAC5C,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,SAAS,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;CAC5B,GAAG;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,MAAM,EAAE,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAiB/E;AAED,wBAAsB,UAAU,CAC9B,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,EACb,eAAe,EAAE,MAAM,EAAE,GACxB,OAAO,CAAC,OAAO,CAAC,CAkBlB;AAED;;;;;;GAMG;AACH,wBAAsB,WAAW,CAC/B,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,OAAO,cAAc,CAAC,YAAY,GAAG,SAAS,CAAC,CAazD;AAED,wBAAsB,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE;;;;;;;GAoBjF;AAED,wBAAsB,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAKhF;AAED,wBAAsB,mBAAmB,CAAC,KAAK,EAAE,MAAM;;;;;;;KAKtD;AAED,wBAAsB,mBAAmB,CACvC,IAAI,EAAE,IAAI,EACV,GAAG,EAAE,WAAW,EAChB,MAAM,EAAE,MAAM,EAAE,EAChB,IAAI,GAAE;IACJ,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,YAAY,CAAC;CACrB,oCAwCP;AAED,wBAAsB,yBAAyB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC,CAOlG;AAED,wBAAsB,kBAAkB,CACtC,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC,CAWlC"}

package/dist/services/oauth2.js

@@ -1,7 +1,7 @@
 import crypto from "node:crypto";
 import { eq, and, gt, isNull } from "drizzle-orm";
 import { db } from "../db/index.js";
-import { oauth2AuthorizationCodes, oauth2Consents, applications, } from "../db/schema.js";
+import { oauth2AuthorizationCodes, oauth2Consents, applications, orgMemberships, } from "../db/schema.js";
 import { config } from "../config.js";
 import { createTokenSet, createIdToken } from "./tokens.js";
 export function generateAuthorizationCode() {
@@ -23,6 +23,7 @@ export async function storeAuthorizationCode(input) {
         redirectUri: input.redirectUri ?? null,
         scopes: input.scopes ?? [],
         nonce: input.nonce ?? null,
+        mfaFactor: input.mfaFactor ?? null,
         expiresAt,
     })
         .returning();
@@ -31,29 +32,111 @@ export async function storeAuthorizationCode(input) {
 export async function consumeAuthorizationCode(code, appId, redirectUri) {
     const codeHash = crypto.createHash("sha256").update(code).digest("hex");
     const now = new Date();
-    const [record] = await db
-        .select()
-        .from(oauth2AuthorizationCodes)
-        .where(and(eq(oauth2AuthorizationCodes.codeHash, codeHash), eq(oauth2AuthorizationCodes.appId, appId), gt(oauth2AuthorizationCodes.expiresAt, now), isNull(oauth2AuthorizationCodes.usedAt)))
-        .limit(1);
-    if (!record)
-        return undefined;
-    if (redirectUri && record.redirectUri && record.redirectUri !== redirectUri) {
-        return undefined;
+    const conditions = [
+        eq(oauth2AuthorizationCodes.codeHash, codeHash),
+        eq(oauth2AuthorizationCodes.appId, appId),
+        gt(oauth2AuthorizationCodes.expiresAt, now),
+        isNull(oauth2AuthorizationCodes.usedAt),
+    ];
+    // Exact match, no exceptions. `redirect_uri` is required at /authorize, so
+    // there is always a stored value to compare against; tolerating a missing one
+    // here would let a stolen code be redeemed against any redirect URI.
+    if (redirectUri) {
+        conditions.push(eq(oauth2AuthorizationCodes.redirectUri, redirectUri));
     }
-    await db
+    const [record] = await db
         .update(oauth2AuthorizationCodes)
         .set({ usedAt: now })
-        .where(eq(oauth2AuthorizationCodes.id, record.id));
+        .where(and(...conditions))
+        .returning();
     return record;
 }
-export function verifyPKCE(challenge, method, verifier) {
-    if (!challenge)
-        return true;
+/**
+ * Verify a PKCE code verifier against a stored challenge.
+ *
+ * `requireChallenge` exists because the previous shape of this function was the
+ * whole PKCE story at the token endpoint, and it was not a check at all:
+ *
+ * ```ts
+ * if (!challenge) return true;   // no challenge was registered -> accept
+ * ```
+ *
+ * A client that omitted `code_challenge` at `/authorize` and then sent any
+ * string as `code_verifier` at `/token` passed. The endpoint required a
+ * verifier to be *present*, so the requirement looked enforced while proving
+ * nothing. For a public client — an SPA or a mobile app that cannot hold a
+ * secret — PKCE is the only thing standing between an intercepted authorization
+ * code and a stolen account, so "optional" meant "unprotected".
+ *
+ * The two failure modes are now separated deliberately:
+ *  - no challenge and `requireChallenge` false: a confidential client that chose
+ *    not to use PKCE. Permitted, because it authenticates with a secret.
+ *  - a challenge but a mismatched or malformed verifier: always a failure.
+ */
+export function verifyPKCE(challenge, method, verifier, options = {}) {
+    if (!challenge) {
+        // No challenge to verify against. Only acceptable when PKCE was not
+        // required for this client.
+        return !options.requireChallenge;
+    }
+    if (typeof verifier !== "string" || verifier === "")
+        return false;
     if (method?.toLowerCase() !== "s256")
         return false;
     const hash = crypto.createHash("sha256").update(verifier).digest("base64url");
-    return hash === challenge;
+    return timingSafeEqual(hash, challenge);
+}
+/** Constant-time comparison, so a verifier cannot be recovered byte by byte. */
+function timingSafeEqual(a, b) {
+    const bufA = Buffer.from(a, "utf8");
+    const bufB = Buffer.from(b, "utf8");
+    if (bufA.length !== bufB.length)
+        return false;
+    return crypto.timingSafeEqual(bufA, bufB);
+}
+/**
+ * A client that cannot keep a secret must use PKCE.
+ *
+ * Today every application has a non-null `client_secret_hash`, so this reduces to
+ * "the client has no usable secret" — which is the honest test regardless of how
+ * the column is populated, and stays correct if secretless public clients are
+ * introduced later.
+ */
+export function requiresPkce(clientSecretHash) {
+    return !clientSecretHash || clientSecretHash === "";
+}
+/**
+ * Reduce requested scopes to the ones actually granted.
+ *
+ * The effective set is the intersection of what the client is registered to ask
+ * for, what it asked for, and what the user consented to. Previously the
+ * client's `scope` parameter was stored verbatim and the only filter applied was
+ * consent, so a client could put any string it liked into the issued token.
+ *
+ * Rejecting rather than silently dropping is deliberate: a client asking for
+ * something it was never registered for is a misconfiguration or an attempt to
+ * escalate, and quietly handing back a lesser scope set hides both. The error
+ * names the offending scope so the client can be fixed.
+ *
+ * An empty `allowedScopes` means "no restriction registered", which preserves
+ * every existing application. Once an application has an allowlist, it is
+ * enforced.
+ */
+export function resolveEffectiveScopes(input) {
+    const requested = [...new Set(input.requested.filter(Boolean))];
+    const allowed = new Set(input.allowed);
+    const consented = input.consented === null ? null : new Set(input.consented);
+    const effective = [];
+    for (const scope of requested) {
+        if (allowed.size > 0 && !allowed.has(scope)) {
+            return { ok: false, error: "invalid_scope", scope };
+        }
+        if (consented && !consented.has(scope)) {
+            return { ok: false, error: "invalid_scope", scope };
+        }
+        effective.push(scope);
+    }
+    return { ok: true, scopes: effective };
 }
 export async function hasConsent(userId, appId, requestedScopes) {
     if (requestedScopes.length === 0)
@@ -68,6 +151,21 @@ export async function hasConsent(userId, appId, requestedScopes) {
     const granted = new Set(consent.scopes);
     return requestedScopes.every((scope) => granted.has(scope));
 }
+/**
+ * The user's current consent record, or undefined if they have never consented
+ * or have revoked it.
+ *
+ * Kept separate from `hasConsent` because the scope intersection needs the
+ * granted set itself, not a yes/no answer to it.
+ */
+export async function findConsent(userId, appId) {
+    const [consent] = await db
+        .select()
+        .from(oauth2Consents)
+        .where(and(eq(oauth2Consents.appId, appId), eq(oauth2Consents.userId, userId), isNull(oauth2Consents.revokedAt)))
+        .limit(1);
+    return consent;
+}
 export async function grantConsent(userId, appId, scopes) {
     const now = new Date();
     const [record] = await db
@@ -102,10 +200,21 @@ export async function listConsentsByAppId(appId) {
         .where(and(eq(oauth2Consents.appId, appId), isNull(oauth2Consents.revokedAt)));
 }
 export async function createTokenResponse(user, app, scopes, opts = {}) {
+    const [membership] = await db
+        .select({ id: orgMemberships.id })
+        .from(orgMemberships)
+        .where(and(eq(orgMemberships.orgId, app.orgId), eq(orgMemberships.userId, user.id)))
+        .limit(1);
+    if (!membership)
+        throw new Error("OAuth user is not a member of the application organization");
     const tokenOpts = {
         appId: app.id,
         orgId: app.orgId,
         clientId: app.clientId,
+        // The granted set is persisted on the refresh token so it survives rotation
+        // instead of being dropped at the first refresh.
+        ...(scopes.length > 0 ? { scopes } : {}),
+        ...(opts.mfaFactor ? { mfaFactor: opts.mfaFactor } : {}),
     };
     const tokenSet = await createTokenSet(user, opts.ip, opts.userAgent, tokenOpts, opts.deviceFingerprint);
     const response = {

package/dist/services/oauth2.js.map

@@ -1 +1 @@
-{"version":3,"file":"oauth2.js","sourceRoot":"","sources":["../../src/services/oauth2.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,EAAW,MAAM,aAAa,CAAC;AAC3D,OAAO,EAAE,EAAE,EAAE,MAAM,gBAAgB,CAAC;AACpC,OAAO,EACL,wBAAwB,EACxB,cAAc,EACd,YAAY,GAIb,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AACtC,OAAO,EAAE,cAAc,EAAE,aAAa,EAA2B,MAAM,aAAa,CAAC;AAYrF,MAAM,UAAU,yBAAyB;IACvC,MAAM,IAAI,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC1D,MAAM,QAAQ,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACxE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;AAC5B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,KAA6B;IACxE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,yBAAyB,EAAE,CAAC;IACvD,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,sBAAsB,GAAG,IAAI,CAAC,CAAC;IAE9E,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE;SACtB,MAAM,CAAC,wBAAwB,CAAC;SAChC,MAAM,CAAC;QACN,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,QAAQ;QACR,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,IAAI;QAClC,eAAe,EAAE,KAAK,CAAC,eAAe,IAAI,IAAI;QAC9C,WAAW,EAAE,KAAK,CAAC,WAAW,IAAI,IAAI;QACtC,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,EAAE;QAC1B,KAAK,EAAE,KAAK,CAAC,KAAK,IAAI,IAAI;QAC1B,SAAS;KACV,CAAC;SACD,SAAS,EAAE,CAAC;IAEf,OAAO,EAAE,GAAG,MAAM,EAAE,IAAI,EAAE,CAAC;AAC7B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,IAAY,EACZ,KAAa,EACb,WAAoB;IAEpB,MAAM,QAAQ,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACxE,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IAEvB,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE;SACtB,MAAM,EAAE;SACR,IAAI,CAAC,wBAAwB,CAAC;SAC9B,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,wBAAwB,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAC/C,EAAE,CAAC,wBAAwB,CAAC,KAAK,EAAE,KAAK,CAAC,EACzC,EAAE,CAAC,wBAAwB,CAAC,SAAS,EAAE,GAAG,CAAC,EAC3C,MAAM,CAAC,wBAAwB,CAAC,MAAM,CAAC,CACxC,CACF;SACA,KAAK,CAAC,CAAC,CAAC,CAAC;IAEZ,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAC9B,IAAI,WAAW,IAAI,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC,WAAW,KAAK,WAAW,EAAE,CAAC;QAC5E,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,EAAE;SACL,MAAM,CAAC,wBAAwB,CAAC;SAChC,GAAG,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;SACpB,KAAK,CAAC,EAAE,CAAC,wBAAwB,CAAC,EAAE,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;IAErD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,UAAU,CACxB,SAAoC,EACpC,MAAiC,EACjC,QAAgB;IAEhB,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IAC5B,IAAI,MAAM,EAAE,WAAW,EAAE,KAAK,MAAM;QAAE,OAAO,KAAK,CAAC;IACnD,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IAC9E,OAAO,IAAI,KAAK,SAAS,CAAC;AAC5B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,MAAc,EACd,KAAa,EACb,eAAyB;IAEzB,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAE9C,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,EAAE;SACvB,MAAM,EAAE;SACR,IAAI,CAAC,cAAc,CAAC;SACpB,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,cAAc,CAAC,KAAK,EAAE,KAAK,CAAC,EAC/B,EAAE,CAAC,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,EACjC,MAAM,CAAC,cAAc,CAAC,SAAS,CAAC,CACjC,CACF;SACA,KAAK,CAAC,CAAC,CAAC,CAAC;IAEZ,IAAI,CAAC,OAAO;QAAE,OAAO,KAAK,CAAC;IAC3B,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACxC,OAAO,eAAe,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;AAC9D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,MAAc,EAAE,KAAa,EAAE,MAAgB;IAChF,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IACvB,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE;SACtB,MAAM,CAAC,cAAc,CAAC;SACtB,MAAM,CAAC;QACN,KAAK;QACL,MAAM;QACN,MAAM;QACN,SAAS,EAAE,GAAG;KACf,CAAC;SACD,kBAAkB,CAAC;QAClB,MAAM,EAAE,CAAC,cAAc,CAAC,KAAK,EAAE,cAAc,CAAC,MAAM,CAAC;QACrD,GAAG,EAAE;YACH,MAAM;YACN,SAAS,EAAE,GAAG;YACd,SAAS,EAAE,IAAI;SAChB;KACF,CAAC;SACD,SAAS,EAAE,CAAC;IACf,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,MAAc,EAAE,KAAa;IAC/D,MAAM,EAAE;SACL,MAAM,CAAC,cAAc,CAAC;SACtB,GAAG,CAAC,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC;SAC9B,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,cAAc,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;AACpF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,KAAa;IACrD,OAAO,EAAE;SACN,MAAM,EAAE;SACR,IAAI,CAAC,cAAc,CAAC;SACpB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,cAAc,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,MAAM,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;AACnF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,IAAU,EACV,GAAgB,EAChB,MAAgB,EAChB,OAAwF,EAAE;IAE1F,MAAM,SAAS,GAAuB;QACpC,KAAK,EAAE,GAAG,CAAC,EAAE;QACb,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,QAAQ,EAAE,GAAG,CAAC,QAAQ;KACvB,CAAC;IAEF,MAAM,QAAQ,GAAG,MAAM,cAAc,CACnC,IAAI,EACJ,IAAI,CAAC,EAAE,EACP,IAAI,CAAC,SAAS,EACd,SAAS,EACT,IAAI,CAAC,iBAAiB,CACvB,CAAC;IAEF,MAAM,QAAQ,GAA4B;QACxC,YAAY,EAAE,QAAQ,CAAC,WAAW;QAClC,aAAa,EAAE,QAAQ,CAAC,YAAY;QACpC,UAAU,EAAE,QAAQ;QACpB,UAAU,EAAE,MAAM,CAAC,wBAAwB;QAC3C,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;KACxB,CAAC;IAEF,IAAI,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC9B,QAAQ,CAAC,QAAQ,GAAG,MAAM,aAAa,CAAC,IAAI,EAAE,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IACjE,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,QAAgB;IAC9D,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;SACnB,MAAM,EAAE;SACR,IAAI,CAAC,YAAY,CAAC;SAClB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC;SAChF,KAAK,CAAC,CAAC,CAAC,CAAC;IACZ,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,QAAgB,EAChB,MAAc;IAEd,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;SACnB,MAAM,EAAE;SACR,IAAI,CAAC,YAAY,CAAC;SAClB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC;SAChF,KAAK,CAAC,CAAC,CAAC,CAAC;IAEZ,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC;IAC3B,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACtE,IAAI,GAAG,CAAC,gBAAgB,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IACpD,OAAO,GAAG,CAAC;AACb,CAAC"}
+{"version":3,"file":"oauth2.js","sourceRoot":"","sources":["../../src/services/oauth2.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,EAAE,EAAE,EAAE,MAAM,gBAAgB,CAAC;AACpC,OAAO,EACL,wBAAwB,EACxB,cAAc,EACd,YAAY,EACZ,cAAc,GAGf,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AACtC,OAAO,EAAE,cAAc,EAAE,aAAa,EAA8C,MAAM,aAAa,CAAC;AAaxG,MAAM,UAAU,yBAAyB;IACvC,MAAM,IAAI,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC1D,MAAM,QAAQ,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACxE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;AAC5B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,KAA6B;IACxE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,yBAAyB,EAAE,CAAC;IACvD,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,sBAAsB,GAAG,IAAI,CAAC,CAAC;IAE9E,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE;SACtB,MAAM,CAAC,wBAAwB,CAAC;SAChC,MAAM,CAAC;QACN,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,QAAQ;QACR,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,IAAI;QAClC,eAAe,EAAE,KAAK,CAAC,eAAe,IAAI,IAAI;QAC9C,WAAW,EAAE,KAAK,CAAC,WAAW,IAAI,IAAI;QACtC,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,EAAE;QAC1B,KAAK,EAAE,KAAK,CAAC,KAAK,IAAI,IAAI;QAC1B,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,IAAI;QAClC,SAAS;KACV,CAAC;SACD,SAAS,EAAE,CAAC;IAEf,OAAO,EAAE,GAAG,MAAM,EAAE,IAAI,EAAE,CAAC;AAC7B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,IAAY,EACZ,KAAa,EACb,WAAoB;IAEpB,MAAM,QAAQ,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACxE,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IAEvB,MAAM,UAAU,GAAG;QACjB,EAAE,CAAC,wBAAwB,CAAC,QAAQ,EAAE,QAAQ,CAAC;QAC/C,EAAE,CAAC,wBAAwB,CAAC,KAAK,EAAE,KAAK,CAAC;QACzC,EAAE,CAAC,wBAAwB,CAAC,SAAS,EAAE,GAAG,CAAC;QAC3C,MAAM,CAAC,wBAAwB,CAAC,MAAM,CAAC;KACxC,CAAC;IACF,2EAA2E;IAC3E,8EAA8E;IAC9E,qEAAqE;IACrE,IAAI,WAAW,EAAE,CAAC;QAChB,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,wBAAwB,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC,CAAC;IACzE,CAAC;IAED,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE;SACtB,MAAM,CAAC,wBAAwB,CAAC;SAChC,GAAG,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;SACpB,KAAK,CAAC,GAAG,CAAC,GAAG,UAAU,CAAC,CAAC;SACzB,SAAS,EAAE,CAAC;IACf,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,UAAU,UAAU,CACxB,SAAoC,EACpC,MAAiC,EACjC,QAAmC,EACnC,OAAO,GAAmC,EAAE;IAE5C,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,oEAAoE;QACpE,4BAA4B;QAC5B,OAAO,CAAC,OAAO,CAAC,gBAAgB,CAAC;IACnC,CAAC;IAED,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,EAAE;QAAE,OAAO,KAAK,CAAC;IAClE,IAAI,MAAM,EAAE,WAAW,EAAE,KAAK,MAAM;QAAE,OAAO,KAAK,CAAC;IAEnD,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IAC9E,OAAO,eAAe,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;AAC1C,CAAC;AAED,gFAAgF;AAChF,SAAS,eAAe,CAAC,CAAS,EAAE,CAAS;IAC3C,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IACpC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IACpC,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC9C,OAAO,MAAM,CAAC,eAAe,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;AAC5C,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,YAAY,CAAC,gBAA2C;IACtE,OAAO,CAAC,gBAAgB,IAAI,gBAAgB,KAAK,EAAE,CAAC;AACtD,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,sBAAsB,CAAC,KAItC;IACC,MAAM,SAAS,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IAChE,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACvC,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAE7E,MAAM,SAAS,GAAa,EAAE,CAAC;IAC/B,KAAK,MAAM,KAAK,IAAI,SAAS,EAAE,CAAC;QAC9B,IAAI,OAAO,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YAC5C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC;QACtD,CAAC;QACD,IAAI,SAAS,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YACvC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC;QACtD,CAAC;QACD,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACxB,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;AACzC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,MAAc,EACd,KAAa,EACb,eAAyB;IAEzB,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAE9C,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,EAAE;SACvB,MAAM,EAAE;SACR,IAAI,CAAC,cAAc,CAAC;SACpB,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,cAAc,CAAC,KAAK,EAAE,KAAK,CAAC,EAC/B,EAAE,CAAC,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,EACjC,MAAM,CAAC,cAAc,CAAC,SAAS,CAAC,CACjC,CACF;SACA,KAAK,CAAC,CAAC,CAAC,CAAC;IAEZ,IAAI,CAAC,OAAO;QAAE,OAAO,KAAK,CAAC;IAC3B,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACxC,OAAO,eAAe,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;AAC9D,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,MAAc,EACd,KAAa;IAEb,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,EAAE;SACvB,MAAM,EAAE;SACR,IAAI,CAAC,cAAc,CAAC;SACpB,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,cAAc,CAAC,KAAK,EAAE,KAAK,CAAC,EAC/B,EAAE,CAAC,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,EACjC,MAAM,CAAC,cAAc,CAAC,SAAS,CAAC,CACjC,CACF;SACA,KAAK,CAAC,CAAC,CAAC,CAAC;IACZ,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,MAAc,EAAE,KAAa,EAAE,MAAgB;IAChF,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IACvB,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE;SACtB,MAAM,CAAC,cAAc,CAAC;SACtB,MAAM,CAAC;QACN,KAAK;QACL,MAAM;QACN,MAAM;QACN,SAAS,EAAE,GAAG;KACf,CAAC;SACD,kBAAkB,CAAC;QAClB,MAAM,EAAE,CAAC,cAAc,CAAC,KAAK,EAAE,cAAc,CAAC,MAAM,CAAC;QACrD,GAAG,EAAE;YACH,MAAM;YACN,SAAS,EAAE,GAAG;YACd,SAAS,EAAE,IAAI;SAChB;KACF,CAAC;SACD,SAAS,EAAE,CAAC;IACf,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,MAAc,EAAE,KAAa;IAC/D,MAAM,EAAE;SACL,MAAM,CAAC,cAAc,CAAC;SACtB,GAAG,CAAC,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC;SAC9B,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,cAAc,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;AACpF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,KAAa;IACrD,OAAO,EAAE;SACN,MAAM,EAAE;SACR,IAAI,CAAC,cAAc,CAAC;SACpB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,cAAc,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,MAAM,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;AACnF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,IAAU,EACV,GAAgB,EAChB,MAAgB,EAChB,IAAI,GAMA,EAAE;IAEN,MAAM,CAAC,UAAU,CAAC,GAAG,MAAM,EAAE;SAC1B,MAAM,CAAC,EAAE,EAAE,EAAE,cAAc,CAAC,EAAE,EAAE,CAAC;SACjC,IAAI,CAAC,cAAc,CAAC;SACpB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,cAAc,CAAC,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;SACnF,KAAK,CAAC,CAAC,CAAC,CAAC;IACZ,IAAI,CAAC,UAAU;QAAE,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;IAE/F,MAAM,SAAS,GAAuB;QACpC,KAAK,EAAE,GAAG,CAAC,EAAE;QACb,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,4EAA4E;QAC5E,iDAAiD;QACjD,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACzD,CAAC;IAEF,MAAM,QAAQ,GAAG,MAAM,cAAc,CACnC,IAAI,EACJ,IAAI,CAAC,EAAE,EACP,IAAI,CAAC,SAAS,EACd,SAAS,EACT,IAAI,CAAC,iBAAiB,CACvB,CAAC;IAEF,MAAM,QAAQ,GAA4B;QACxC,YAAY,EAAE,QAAQ,CAAC,WAAW;QAClC,aAAa,EAAE,QAAQ,CAAC,YAAY;QACpC,UAAU,EAAE,QAAQ;QACpB,UAAU,EAAE,MAAM,CAAC,wBAAwB;QAC3C,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;KACxB,CAAC;IAEF,IAAI,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC9B,QAAQ,CAAC,QAAQ,GAAG,MAAM,aAAa,CAAC,IAAI,EAAE,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IACjE,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,QAAgB;IAC9D,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;SACnB,MAAM,EAAE;SACR,IAAI,CAAC,YAAY,CAAC;SAClB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC;SAChF,KAAK,CAAC,CAAC,CAAC,CAAC;IACZ,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,QAAgB,EAChB,MAAc;IAEd,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;SACnB,MAAM,EAAE;SACR,IAAI,CAAC,YAAY,CAAC;SAClB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC;SAChF,KAAK,CAAC,CAAC,CAAC,CAAC;IAEZ,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC;IAC3B,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACtE,IAAI,GAAG,CAAC,gBAAgB,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IACpD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/services/oidcSecretFormat.d.ts

@@ -0,0 +1,3 @@
+export declare const LEGACY_OIDC_SECRET_PREFIX = "legacy:";
+export declare function isLegacyOidcSecret(value: string): boolean;
+//# sourceMappingURL=oidcSecretFormat.d.ts.map

package/dist/services/oidcSecretFormat.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oidcSecretFormat.d.ts","sourceRoot":"","sources":["../../src/services/oidcSecretFormat.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,yBAAyB,YAAY,CAAC;AAEnD,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAEzD"}

package/dist/services/oidcSecretFormat.js

@@ -0,0 +1,5 @@
+export const LEGACY_OIDC_SECRET_PREFIX = "legacy:";
+export function isLegacyOidcSecret(value) {
+    return value.startsWith(LEGACY_OIDC_SECRET_PREFIX);
+}
+//# sourceMappingURL=oidcSecretFormat.js.map

package/dist/services/oidcSecretFormat.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oidcSecretFormat.js","sourceRoot":"","sources":["../../src/services/oidcSecretFormat.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,yBAAyB,GAAG,SAAS,CAAC;AAEnD,MAAM,UAAU,kBAAkB,CAAC,KAAa;IAC9C,OAAO,KAAK,CAAC,UAAU,CAAC,yBAAyB,CAAC,CAAC;AACrD,CAAC"}

package/dist/services/organizations.d.ts

@@ -1,38 +1,26 @@
 import { type Organization, type OrgMembership } from "../db/schema.js";
 export type OrgRole = "owner" | "admin" | "member";
 export declare function slugify(name: string): string;
-export declare function createOrganization(input: {
-    name: string;
-    slug?: string;
-    plan?: string;
-}): Promise<Organization>;
 export declare function findOrganizationById(id: string): Promise<Organization | undefined>;
 export declare function findOrganizationBySlug(slug: string): Promise<Organization | undefined>;
 export declare function findOrganizationsByUserId(userId: string): Promise<Organization[]>;
-export declare function addOrgMembership(input: {
-    orgId: string;
-    userId: string;
-    role: OrgRole;
-}): Promise<OrgMembership>;
 export declare function findMembership(orgId: string, userId: string): Promise<OrgMembership | undefined>;
-export declare function updateMembershipRole(orgId: string, userId: string, role: OrgRole): Promise<OrgMembership | undefined>;
-export declare function removeMembership(orgId: string, userId: string): Promise<boolean>;
 export declare function countOwners(orgId: string): Promise<number>;
 export declare function requireOrgRole(userId: string, orgId: string, allowedRoles: OrgRole[]): Promise<OrgMembership>;
 export declare function listOrgMembers(orgId: string): Promise<{
     membership: {
         id: string;
+        orgId: string;
+        userId: string;
+        role: string;
         createdAt: Date;
         updatedAt: Date;
-        role: string;
-        userId: string;
-        orgId: string;
     };
     user: {
         id: string;
-        name: string | null;
         email: string;
         username: string;
+        name: string | null;
         avatarUrl: string | null;
     };
 }[]>;

package/dist/services/organizations.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"organizations.d.ts","sourceRoot":"","sources":["../../src/services/organizations.ts"],"names":[],"mappings":"AAEA,OAAO,EAAwC,KAAK,YAAY,EAAE,KAAK,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAE9G,MAAM,MAAM,OAAO,GAAG,OAAO,GAAG,OAAO,GAAG,QAAQ,CAAC;AAEnD,wBAAgB,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAO5C;AAED,wBAAsB,kBAAkB,CAAC,KAAK,EAAE;IAC9C,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;CACf,GAAG,OAAO,CAAC,YAAY,CAAC,CAaxB;AAED,wBAAsB,oBAAoB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC,CAGxF;AAED,wBAAsB,sBAAsB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC,CAG5F;AAED,wBAAsB,yBAAyB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,CAOvF;AAED,wBAAsB,gBAAgB,CAAC,KAAK,EAAE;IAC5C,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,OAAO,CAAC;CACf,GAAG,OAAO,CAAC,aAAa,CAAC,CAmBzB;AAED,wBAAsB,cAAc,CAClC,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,aAAa,GAAG,SAAS,CAAC,CAOpC;AAED,wBAAsB,oBAAoB,CACxC,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,OAAO,GACZ,OAAO,CAAC,aAAa,GAAG,SAAS,CAAC,CAOpC;AAED,wBAAsB,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAMtF;AAED,wBAAsB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAMhE;AAED,wBAAsB,cAAc,CAClC,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,EACb,YAAY,EAAE,OAAO,EAAE,GACtB,OAAO,CAAC,aAAa,CAAC,CAexB;AAED,wBAAsB,cAAc,CAAC,KAAK,EAAE,MAAM;;;;;;;;;;;;;;;;KAejD"}
+{"version":3,"file":"organizations.d.ts","sourceRoot":"","sources":["../../src/services/organizations.ts"],"names":[],"mappings":"AAEA,OAAO,EAAwC,KAAK,YAAY,EAAE,KAAK,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAE9G,MAAM,MAAM,OAAO,GAAG,OAAO,GAAG,OAAO,GAAG,QAAQ,CAAC;AAEnD,wBAAgB,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAO5C;AAED,wBAAsB,oBAAoB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC,CAGxF;AAED,wBAAsB,sBAAsB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC,CAG5F;AAED,wBAAsB,yBAAyB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,CAOvF;AAED,wBAAsB,cAAc,CAClC,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,aAAa,GAAG,SAAS,CAAC,CAOpC;AAED,wBAAsB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAMhE;AAED,wBAAsB,cAAc,CAClC,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,EACb,YAAY,EAAE,OAAO,EAAE,GACtB,OAAO,CAAC,aAAa,CAAC,CAexB;AAED,wBAAsB,cAAc,CAAC,KAAK,EAAE,MAAM;;;;;;;;;;;;;;;;KAejD"}