@ibgib/web-gib 0.0.48 → 0.0.50

package/dist/identity/sso/sso-custodian-service.mjs

@@ -0,0 +1,373 @@
+import { createPublicKey, verify } from 'node:crypto';
+import { hash, HashAlgorithm } from '@ibgib/helper-gib/dist/helpers/utils-helper.mjs';
+import { kdf_recursiveSaltWrap } from '@ibgib/core-gib/dist/keystone/kdf/kdf-helpers.mjs';
+import { POOL_ID_CUSTODIAN_MANAGE, KEYSTONE_VERB_MANAGE, KEYSTONE_VERB_REVOKE } from '@ibgib/core-gib/dist/keystone/keystone-constants.mjs';
+import { createStandardPoolConfig } from '@ibgib/core-gib/dist/keystone/keystone-config-builder.mjs';
+import { generateOpaqueChallengeId } from '@ibgib/core-gib/dist/keystone/keystone-helpers.mjs';
+import { KeystoneStrategyFactory } from '@ibgib/core-gib/dist/keystone/strategy/keystone-strategy-factory.mjs';
+/**
+ * Server-side service for token exchange, JWT validation, and user profile normalization.
+ */
+export class SsoCustodianService {
+    config;
+    lc = `[${SsoCustodianService.name}]`;
+    // In-memory cache for JSON Web Key Sets (JWKS) per provider
+    jwksCache = new Map();
+    jwksTtlMs = 24 * 60 * 60 * 1000; // Cache certs for 24 hours
+    /**
+     * @param config The server's global SSO configuration.
+     *   - Visibility: Private (Contains high-entropy secrets like `ssoServerKdfSecret` and `sessionSecret`).
+     *   - Generator: Server (Bootstrapped from node environment variables on server initialization).
+     */
+    constructor(config) {
+        this.config = config;
+    }
+    /**
+     * Exchanges an authorization code for an OAuth2 token and retrieves normalized user info.
+     *
+     * @param providerId The string identifier of the OAuth provider (e.g. 'google' or 'github').
+     *   - Visibility: Public (Non-sensitive metadata string).
+     *   - Generator: Client (Sent from browser UI selection).
+     *
+     * @param code The temporary authorization code returned by the OAuth provider.
+     *   - Visibility: Private (Confidential short-lived bearer credential. Must be kept private).
+     *   - Generator: Provider (Created by provider's OAuth page and sent to client redirect URI).
+     *
+     * @param redirectUri The redirect URI registered in the provider portal.
+     *   - Visibility: Public (Configuration URL).
+     *   - Generator: Client/Server (Derived from environmental configuration and sent by client).
+     */
+    async getOAuthUserInfo(providerId, code, redirectUri) {
+        const lc = `${this.lc}[${this.getOAuthUserInfo.name}]`;
+        const providerConfig = this.config.providers[providerId];
+        if (!providerConfig) {
+            throw new Error(`Provider '${providerId}' is not configured on this server. (E: c28900abfefd23e89cf23f12)`);
+        }
+        console.log(`${lc} Exchanging code for provider: ${providerId}`);
+        // 1. Exchange authorization code for tokens
+        const tokens = await this.exchangeCodeForTokens(providerConfig, code, redirectUri);
+        // 2. Retrieve and normalize user info
+        if (providerId === 'google') {
+            // Google returns an id_token (JWT) directly containing user info
+            if (!tokens.id_token) {
+                throw new Error(`Google token exchange did not return id_token. (E: e28900abfefd23e89cf45f23)`);
+            }
+            return this.verifyAndNormalizeGoogleToken(tokens.id_token);
+        }
+        else if (providerId === 'github') {
+            // GitHub requires calling the /user API using the access_token
+            if (!tokens.access_token) {
+                throw new Error(`GitHub token exchange did not return access_token. (E: a28900abfefd23e89cf56f34)`);
+            }
+            return this.fetchAndNormalizeGithubUser(providerConfig, tokens.access_token);
+        }
+        throw new Error(`Unsupported provider: ${providerId}. (E: d28900abfefd23e89cf67f45)`);
+    }
+    /**
+     * Directly validates a Google ID Token (JWT) locally and returns normalized user info.
+     * Useful for client-side authentication handshakes.
+     *
+     * @param idToken The raw base64-encoded signed JSON Web Token (JWT) ID token returned by Google.
+     *   - Visibility: Private (Sensitive bearer credential containing signature and claims. Must be kept private).
+     *   - Generator: Provider (Generated and signed cryptographically by Google authentication servers).
+     */
+    async verifyAndNormalizeGoogleToken(idToken) {
+        const lc = `${this.lc}[${this.verifyAndNormalizeGoogleToken.name}]`;
+        const providerConfig = this.config.providers.google;
+        if (!providerConfig) {
+            throw new Error(`Google provider config is missing. (E: g28900abfefd23e89cf78f56)`);
+        }
+        // Verify signature and decode JWT payload
+        const payload = await this.verifyJwt(idToken, providerConfig);
+        // Assert claims
+        const nowSeconds = Math.floor(Date.now() / 1000);
+        if (payload.exp && payload.exp < nowSeconds) {
+            throw new Error(`Token has expired. (E: t28900abfefd23e89cf89f67)`);
+        }
+        if (payload.aud !== providerConfig.clientId) {
+            throw new Error(`Token audience mismatch. Expected ${providerConfig.clientId}, got ${payload.aud}. (E: m28900abfefd23e89cf90f78)`);
+        }
+        if (!payload.sub) {
+            throw new Error(`Google JWT is missing subject claim ('sub'). (E: s28900abfefd23e89cfa1f89)`);
+        }
+        return {
+            providerKey: `google:${payload.sub}`,
+            providerId: 'google',
+            sub: payload.sub,
+            email: payload.email,
+            name: payload.name,
+            picture: payload.picture
+        };
+    }
+    /**
+     * Internal: Exchange authorization code for access token / ID token.
+     *
+     * @param providerConfig Server configuration settings for the specific provider.
+     *   - Visibility: Private (Contains provider client secrets. Must stay server-side).
+     *   - Generator: Server (Configured from node environment variables).
+     *
+     * @param code The temporary authorization code to exchange.
+     *   - Visibility: Private (Short-lived credential. Must be kept private).
+     *   - Generator: Provider (Via OAuth flow).
+     *
+     * @param redirectUri The redirect URI registered for the exchange.
+     *   - Visibility: Public (Configuration URL).
+     *   - Generator: Client/Server (From app configuration).
+     */
+    async exchangeCodeForTokens(providerConfig, code, redirectUri) {
+        const body = new URLSearchParams({
+            client_id: providerConfig.clientId,
+            client_secret: providerConfig.clientSecret,
+            code,
+            redirect_uri: redirectUri,
+            grant_type: 'authorization_code'
+        });
+        const headers = {
+            'Content-Type': 'application/x-www-form-urlencoded'
+        };
+        // GitHub requires an Accept header to return JSON instead of URL-encoded string
+        if (providerConfig.providerId === 'github') {
+            headers['Accept'] = 'application/json';
+        }
+        const res = await fetch(providerConfig.tokenUrl, {
+            method: 'POST',
+            headers,
+            body: body.toString()
+        });
+        if (!res.ok) {
+            const errText = await res.text();
+            throw new Error(`Token exchange failed (HTTP ${res.status}): ${errText}`);
+        }
+        return res.json();
+    }
+    /**
+     * Internal: Fetch GitHub user profile and normalize.
+     *
+     * @param providerConfig Server configuration settings for GitHub.
+     *   - Visibility: Private (Contains GitHub client secret).
+     *   - Generator: Server (From environment config).
+     *
+     * @param accessToken The active OAuth2 access token to authorize the API call.
+     *   - Visibility: Private (Bearer token. Must be kept private).
+     *   - Generator: Provider (GitHub token endpoint).
+     */
+    async fetchAndNormalizeGithubUser(providerConfig, accessToken) {
+        const res = await fetch(providerConfig.userInfoUrl, {
+            headers: {
+                'Authorization': `Bearer ${accessToken}`,
+                'User-Agent': 'space-gib-auth-agent' // GitHub API requires User-Agent
+            }
+        });
+        if (!res.ok) {
+            const errText = await res.text();
+            throw new Error(`Failed to fetch GitHub user info (HTTP ${res.status}): ${errText}`);
+        }
+        const rawUser = await res.json();
+        if (!rawUser.id) {
+            throw new Error(`GitHub user info response missing 'id' field.`);
+        }
+        const sub = String(rawUser.id);
+        return {
+            providerKey: `github:${sub}`,
+            providerId: 'github',
+            sub,
+            email: rawUser.email || undefined,
+            name: rawUser.name || rawUser.login || undefined,
+            picture: rawUser.avatar_url || undefined
+        };
+    }
+    /**
+     * Internal: Decodes and cryptographically verifies a JWT signature using JWKS public keys.
+     *
+     * @param token The raw base64-encoded JWT token to verify.
+     *   - Visibility: Private (Sensitive token. Must be kept private).
+     *   - Generator: Provider (Google / OIDC server).
+     *
+     * @param providerConfig The target provider server settings containing `jwksUrl`.
+     *   - Visibility: Private (Contains secrets).
+     *   - Generator: Server (From environment config).
+     */
+    async verifyJwt(token, providerConfig) {
+        const parts = token.split('.');
+        if (parts.length !== 3) {
+            throw new Error('JWT must have 3 parts separated by dots.');
+        }
+        const [headerB64, payloadB64, signatureB64] = parts;
+        // 1. Decode header and select algorithm/key ID
+        let header;
+        try {
+            header = JSON.parse(Buffer.from(headerB64, 'base64url').toString('utf-8'));
+        }
+        catch {
+            throw new Error('Failed to parse JWT header.');
+        }
+        if (header.alg !== 'RS256') {
+            throw new Error(`Only RS256 algorithm is supported, got: ${header.alg}`);
+        }
+        const kid = header.kid;
+        if (!kid) {
+            throw new Error('JWT header missing key ID (kid).');
+        }
+        // 2. Fetch public keys (JWKS)
+        const keys = await this.getJwksKeys(providerConfig);
+        const jwk = keys.find(key => key.kid === kid);
+        if (!jwk) {
+            throw new Error(`JWK public key matching kid '${kid}' not found.`);
+        }
+        // 3. Create Public Key object using Node native crypto
+        const publicKey = createPublicKey({
+            key: jwk,
+            format: 'jwk'
+        });
+        // 4. Verify signature against header + payload data
+        const signature = Buffer.from(signatureB64, 'base64url');
+        const data = Buffer.from(`${headerB64}.${payloadB64}`);
+        const isValid = verify('sha256', data, publicKey, signature);
+        if (!isValid) {
+            throw new Error('Cryptographic signature verification failed.');
+        }
+        // 5. Decode and return payload
+        try {
+            return JSON.parse(Buffer.from(payloadB64, 'base64url').toString('utf-8'));
+        }
+        catch {
+            throw new Error('Failed to parse JWT payload.');
+        }
+    }
+    /**
+     * Internal: Retrieves JWKS keys from cache or fetches them from the provider's jwksUrl.
+     *
+     * @param providerConfig The provider config containing the target `jwksUrl`.
+     *   - Visibility: Private (Contains client secrets).
+     *   - Generator: Server (From environment config).
+     */
+    async getJwksKeys(providerConfig) {
+        const providerId = providerConfig.providerId;
+        const cached = this.jwksCache.get(providerId);
+        if (cached && cached.expiresAt > Date.now()) {
+            return cached.keys;
+        }
+        if (!providerConfig.jwksUrl) {
+            throw new Error(`Provider '${providerId}' does not define a jwksUrl for JWT signature validation.`);
+        }
+        const res = await fetch(providerConfig.jwksUrl);
+        if (!res.ok) {
+            throw new Error(`Failed to fetch JWKS from ${providerConfig.jwksUrl} (HTTP ${res.status})`);
+        }
+        const body = (await res.json());
+        if (!body.keys || !Array.isArray(body.keys)) {
+            throw new Error(`Invalid JWKS response structure from ${providerConfig.jwksUrl}`);
+        }
+        this.jwksCache.set(providerId, {
+            keys: body.keys,
+            expiresAt: Date.now() + this.jwksTtlMs
+        });
+        return body.keys;
+    }
+    /**
+     * Derives a server-delegate master secret deterministically using the server's private KDF secret,
+     * the providerKey, and the user's public nonce.
+     *
+     * @param providerKey The unique key identifying the provider and user sub ID (e.g. `google:123...`).
+     *   - Visibility: Public (Identifier saved on parent's delegate claim, safe for log/ledger storage).
+     *   - Generator: Provider/Server (Derived by mapping provider user sub ID after authentication).
+     *
+     * @param userNonce The public, high-entropy nonce generated by the client to salt the KDF derivation.
+     *   - Visibility: Public (Salt value stored on parent's delegate claim, safe for ledger storage).
+     *   - Generator: Client (Generated offline on user's device).
+     */
+    async deriveServerDelegateSecret(providerKey, userNonce) {
+        const salt = await hash({
+            s: `${providerKey}:${userNonce}`,
+            algorithm: HashAlgorithm.sha_512
+        });
+        return await kdf_recursiveSaltWrap({
+            masterSecret: this.config.ssoServerKdfSecret,
+            salt,
+            rounds: 1000,
+            algorithm: HashAlgorithm.sha_512
+        });
+    }
+    /**
+     * Creates a public custodian challenge pool (custodian-manage) derived deterministically
+     * from the server's private KDF secret, providerKey, and userNonce.
+     *
+     * @param providerKey The unique key identifying the provider and user sub ID (e.g. `google:123...`).
+     *   - Visibility: Public (Mapped identifier, safe for ledger).
+     *   - Generator: Provider/Server (Derived after successful token exchange).
+     *
+     * @param userNonce The public, high-entropy nonce.
+     *   - Visibility: Public (Derivation salt, safe for ledger).
+     *   - Generator: Client (Generated on user's device).
+     */
+    async createCustodianChallengePool(providerKey, userNonce) {
+        const custodianSecret = await this.deriveServerDelegateSecret(providerKey, userNonce);
+        const poolSalt = await hash({
+            s: `${providerKey}:${userNonce}:salt`,
+            algorithm: HashAlgorithm.sha_256
+        });
+        const poolSaltShort = poolSalt.substring(0, 16);
+        const config = createStandardPoolConfig({
+            id: POOL_ID_CUSTODIAN_MANAGE,
+            salt: poolSaltShort
+        });
+        config.allowedVerbs = [KEYSTONE_VERB_MANAGE, KEYSTONE_VERB_REVOKE];
+        const strategy = KeystoneStrategyFactory.create({ config });
+        const poolSecret = await strategy.derivePoolSecret({ masterSecret: custodianSecret });
+        const challenges = {};
+        const timestamp = Date.now().toString();
+        for (let i = 0; i < config.behavior.size; i++) {
+            const challengeId = await generateOpaqueChallengeId({
+                salt: config.salt,
+                timestamp,
+                index: i
+            });
+            const solution = await strategy.generateSolution({
+                poolSecret,
+                poolId: config.id,
+                challengeId
+            });
+            challenges[challengeId] = await strategy.generateChallenge({ solution });
+        }
+        return {
+            id: POOL_ID_CUSTODIAN_MANAGE,
+            config,
+            challenges,
+            isForeign: true,
+            metadata: {
+                owner: 'custodian',
+                providerKey
+            }
+        };
+    }
+    /**
+     * Maps private server configuration to safe public client configurations.
+     *
+     * @param hostUrl The root URL host address of the server (e.g. `https://space-gib.localhost` or `https://ibgib.space`).
+     *   - Visibility: Public (Non-sensitive hostname configuration).
+     *   - Generator: Server (Extracted from the HTTP request context headers/protocol).
+     */
+    getSsoClientConfigs(hostUrl) {
+        const configs = [];
+        if (this.config.providers.google) {
+            configs.push({
+                providerId: 'google',
+                clientId: this.config.providers.google.clientId,
+                authUrl: 'https://accounts.google.com/o/oauth2/v2/auth',
+                redirectUri: `${hostUrl}/`,
+                scope: 'openid email profile'
+            });
+        }
+        if (this.config.providers.github) {
+            configs.push({
+                providerId: 'github',
+                clientId: this.config.providers.github.clientId,
+                authUrl: 'https://github.com/login/oauth/authorize',
+                redirectUri: `${hostUrl}/`,
+                scope: 'read:user user:email'
+            });
+        }
+        return configs;
+    }
+}
+//# sourceMappingURL=sso-custodian-service.mjs.map

package/dist/identity/sso/sso-custodian-service.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"sso-custodian-service.mjs","sourceRoot":"","sources":["../../../src/identity/sso/sso-custodian-service.mts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,iDAAiD,CAAC;AACtF,OAAO,EAAE,qBAAqB,EAAE,MAAM,mDAAmD,CAAC;AAI1F,OAAO,EAAE,wBAAwB,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,MAAM,sDAAsD,CAAC;AAC5I,OAAO,EAAE,wBAAwB,EAAE,MAAM,2DAA2D,CAAC;AACrG,OAAO,EAAE,yBAAyB,EAAE,MAAM,oDAAoD,CAAC;AAC/F,OAAO,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AAuB/G;;GAEG;AACH,MAAM,OAAO,mBAAmB;IAYR;IAXZ,EAAE,GAAG,IAAI,mBAAmB,CAAC,IAAI,GAAG,CAAC;IAE7C,4DAA4D;IACpD,SAAS,GAA8D,IAAI,GAAG,EAAE,CAAC;IACjF,SAAS,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,2BAA2B;IAEpE;;;;OAIG;IACH,YAAoB,MAAuB;QAAvB,WAAM,GAAN,MAAM,CAAiB;IAAG,CAAC;IAE/C;;;;;;;;;;;;;;OAcG;IACH,KAAK,CAAC,gBAAgB,CAAC,UAAyB,EAAE,IAAY,EAAE,WAAmB;QAC/E,MAAM,EAAE,GAAG,GAAG,IAAI,CAAC,EAAE,IAAI,IAAI,CAAC,gBAAgB,CAAC,IAAI,GAAG,CAAC;QACvD,MAAM,cAAc,GAAG,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;QACzD,IAAI,CAAC,cAAc,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CAAC,aAAa,UAAU,mEAAmE,CAAC,CAAC;QAChH,CAAC;QAED,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,kCAAkC,UAAU,EAAE,CAAC,CAAC;QAEjE,4CAA4C;QAC5C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,cAAc,EAAE,IAAI,EAAE,WAAW,CAAC,CAAC;QAEnF,sCAAsC;QACtC,IAAI,UAAU,KAAK,QAAQ,EAAE,CAAC;YAC1B,iEAAiE;YACjE,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;gBACnB,MAAM,IAAI,KAAK,CAAC,8EAA8E,CAAC,CAAC;YACpG,CAAC;YACD,OAAO,IAAI,CAAC,6BAA6B,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC/D,CAAC;aAAM,IAAI,UAAU,KAAK,QAAQ,EAAE,CAAC;YACjC,+DAA+D;YAC/D,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC;gBACvB,MAAM,IAAI,KAAK,CAAC,kFAAkF,CAAC,CAAC;YACxG,CAAC;YACD,OAAO,IAAI,CAAC,2BAA2B,CAAC,cAAc,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC;QACjF,CAAC;QAED,MAAM,IAAI,KAAK,CAAC,yBAAyB,UAAU,iCAAiC,CAAC,CAAC;IAC1F,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,6BAA6B,CAAC,OAAe;QAC/C,MAAM,EAAE,GAAG,GAAG,IAAI,CAAC,EAAE,IAAI,IAAI,CAAC,6BAA6B,CAAC,IAAI,GAAG,CAAC;QACpE,MAAM,cAAc,GAAG,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC;QACpD,IAAI,CAAC,cAAc,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAC;QACxF,CAAC;QAED,0CAA0C;QAC1C,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;QAE9D,gBAAgB;QAChB,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QACjD,IAAI,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,GAAG,UAAU,EAAE,CAAC;YAC1C,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;QACxE,CAAC;QACD,IAAI,OAAO,CAAC,GAAG,KAAK,cAAc,CAAC,QAAQ,EAAE,CAAC;YAC1C,MAAM,IAAI,KAAK,CAAC,qCAAqC,cAAc,CAAC,QAAQ,SAAS,OAAO,CAAC,GAAG,iCAAiC,CAAC,CAAC;QACvI,CAAC;QAED,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,4EAA4E,CAAC,CAAC;QAClG,CAAC;QAED,OAAO;YACH,WAAW,EAAE,UAAU,OAAO,CAAC,GAAG,EAAE;YACpC,UAAU,EAAE,QAAQ;YACpB,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,OAAO,EAAE,OAAO,CAAC,OAAO;SAC3B,CAAC;IACN,CAAC;IAED;;;;;;;;;;;;;;OAcG;IACK,KAAK,CAAC,qBAAqB,CAC/B,cAAuC,EACvC,IAAY,EACZ,WAAmB;QAEnB,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;YAC7B,SAAS,EAAE,cAAc,CAAC,QAAQ;YAClC,aAAa,EAAE,cAAc,CAAC,YAAY;YAC1C,IAAI;YACJ,YAAY,EAAE,WAAW;YACzB,UAAU,EAAE,oBAAoB;SACnC,CAAC,CAAC;QAEH,MAAM,OAAO,GAA2B;YACpC,cAAc,EAAE,mCAAmC;SACtD,CAAC;QAEF,gFAAgF;QAChF,IAAI,cAAc,CAAC,UAAU,KAAK,QAAQ,EAAE,CAAC;YACzC,OAAO,CAAC,QAAQ,CAAC,GAAG,kBAAkB,CAAC;QAC3C,CAAC;QAED,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,cAAc,CAAC,QAAQ,EAAE;YAC7C,MAAM,EAAE,MAAM;YACd,OAAO;YACP,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE;SACxB,CAAC,CAAC;QAEH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACV,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CAAC,+BAA+B,GAAG,CAAC,MAAM,MAAM,OAAO,EAAE,CAAC,CAAC;QAC9E,CAAC;QAED,OAAO,GAAG,CAAC,IAAI,EAAE,CAAC;IACtB,CAAC;IAED;;;;;;;;;;OAUG;IACK,KAAK,CAAC,2BAA2B,CACrC,cAAuC,EACvC,WAAmB;QAEnB,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,cAAc,CAAC,WAAW,EAAE;YAChD,OAAO,EAAE;gBACL,eAAe,EAAE,UAAU,WAAW,EAAE;gBACxC,YAAY,EAAE,sBAAsB,CAAC,iCAAiC;aACzE;SACJ,CAAC,CAAC;QAEH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACV,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CAAC,0CAA0C,GAAG,CAAC,MAAM,MAAM,OAAO,EAAE,CAAC,CAAC;QACzF,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAEjC,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;YACd,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;QACrE,CAAC;QAED,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAE/B,OAAO;YACH,WAAW,EAAE,UAAU,GAAG,EAAE;YAC5B,UAAU,EAAE,QAAQ;YACpB,GAAG;YACH,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,SAAS;YACjC,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,KAAK,IAAI,SAAS;YAChD,OAAO,EAAE,OAAO,CAAC,UAAU,IAAI,SAAS;SAC3C,CAAC;IACN,CAAC;IAED;;;;;;;;;;OAUG;IACI,KAAK,CAAC,SAAS,CAAC,KAAa,EAAE,cAAuC;QACzE,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;QAChE,CAAC;QAED,MAAM,CAAC,SAAS,EAAE,UAAU,EAAE,YAAY,CAAC,GAAG,KAAK,CAAC;QAEpD,+CAA+C;QAC/C,IAAI,MAAW,CAAC;QAChB,IAAI,CAAC;YACD,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;QAC/E,CAAC;QAAC,MAAM,CAAC;YACL,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;QACnD,CAAC;QAED,IAAI,MAAM,CAAC,GAAG,KAAK,OAAO,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CAAC,2CAA2C,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC;QAC7E,CAAC;QAED,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC;QACvB,IAAI,CAAC,GAAG,EAAE,CAAC;YACP,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;QACxD,CAAC;QAED,8BAA8B;QAC9B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,cAAc,CAAC,CAAC;QACpD,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC;QAC9C,IAAI,CAAC,GAAG,EAAE,CAAC;YACP,MAAM,IAAI,KAAK,CAAC,gCAAgC,GAAG,cAAc,CAAC,CAAC;QACvE,CAAC;QAED,uDAAuD;QACvD,MAAM,SAAS,GAAG,eAAe,CAAC;YAC9B,GAAG,EAAE,GAAU;YACf,MAAM,EAAE,KAAK;SAChB,CAAC,CAAC;QAEH,oDAAoD;QACpD,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC;QACzD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,SAAS,IAAI,UAAU,EAAE,CAAC,CAAC;QAEvD,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;QAC7D,IAAI,CAAC,OAAO,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;QACpE,CAAC;QAED,+BAA+B;QAC/B,IAAI,CAAC;YACD,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;QAC9E,CAAC;QAAC,MAAM,CAAC;YACL,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;QACpD,CAAC;IACL,CAAC;IAED;;;;;;OAMG;IACK,KAAK,CAAC,WAAW,CAAC,cAAuC;QAC7D,MAAM,UAAU,GAAG,cAAc,CAAC,UAAU,CAAC;QAC7C,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAE9C,IAAI,MAAM,IAAI,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YAC1C,OAAO,MAAM,CAAC,IAAI,CAAC;QACvB,CAAC;QAED,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CAAC,aAAa,UAAU,2DAA2D,CAAC,CAAC;QACxG,CAAC;QAED,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC;QAChD,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACV,MAAM,IAAI,KAAK,CAAC,6BAA6B,cAAc,CAAC,OAAO,UAAU,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC;QAChG,CAAC;QAED,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAiB,CAAC;QAChD,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1C,MAAM,IAAI,KAAK,CAAC,wCAAwC,cAAc,CAAC,OAAO,EAAE,CAAC,CAAC;QACtF,CAAC;QAED,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,UAAU,EAAE;YAC3B,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,SAAS;SACzC,CAAC,CAAC;QAEH,OAAO,IAAI,CAAC,IAAI,CAAC;IACrB,CAAC;IAED;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,0BAA0B,CAAC,WAAmB,EAAE,SAAiB;QACnE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC;YACpB,CAAC,EAAE,GAAG,WAAW,IAAI,SAAS,EAAE;YAChC,SAAS,EAAE,aAAa,CAAC,OAAO;SACnC,CAAC,CAAC;QACH,OAAO,MAAM,qBAAqB,CAAC;YAC/B,YAAY,EAAE,IAAI,CAAC,MAAM,CAAC,kBAAkB;YAC5C,IAAI;YACJ,MAAM,EAAE,IAAI;YACZ,SAAS,EAAE,aAAa,CAAC,OAAO;SACnC,CAAC,CAAC;IACP,CAAC;IAED;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,4BAA4B,CAC9B,WAAmB,EACnB,SAAiB;QAEjB,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,0BAA0B,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;QAEtF,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC;YACxB,CAAC,EAAE,GAAG,WAAW,IAAI,SAAS,OAAO;YACrC,SAAS,EAAE,aAAa,CAAC,OAAO;SACnC,CAAC,CAAC;QACH,MAAM,aAAa,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAEhD,MAAM,MAAM,GAAG,wBAAwB,CAAC;YACpC,EAAE,EAAE,wBAAwB;YAC5B,IAAI,EAAE,aAAa;SACtB,CAAC,CAAC;QACH,MAAM,CAAC,YAAY,GAAG,CAAC,oBAAoB,EAAE,oBAAoB,CAAC,CAAC;QAEnE,MAAM,QAAQ,GAAG,uBAAuB,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;QAC5D,MAAM,UAAU,GAAG,MAAM,QAAQ,CAAC,gBAAgB,CAAC,EAAE,YAAY,EAAE,eAAe,EAAE,CAAC,CAAC;QACtF,MAAM,UAAU,GAA0B,EAAE,CAAC;QAC7C,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC;QAExC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC;YAC5C,MAAM,WAAW,GAAG,MAAM,yBAAyB,CAAC;gBAChD,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,SAAS;gBACT,KAAK,EAAE,CAAC;aACX,CAAC,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,gBAAgB,CAAC;gBAC7C,UAAU;gBACV,MAAM,EAAE,MAAM,CAAC,EAAE;gBACjB,WAAW;aACd,CAAC,CAAC;YACH,UAAU,CAAC,WAAW,CAAC,GAAG,MAAM,QAAQ,CAAC,iBAAiB,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC;QAC7E,CAAC;QAED,OAAO;YACH,EAAE,EAAE,wBAAwB;YAC5B,MAAM;YACN,UAAU;YACV,SAAS,EAAE,IAAI;YACf,QAAQ,EAAE;gBACN,KAAK,EAAE,WAAW;gBAClB,WAAW;aACd;SACJ,CAAC;IACN,CAAC;IAED;;;;;;OAMG;IACH,mBAAmB,CAAC,OAAe;QAC/B,MAAM,OAAO,GAA8B,EAAE,CAAC;QAE9C,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC;YAC/B,OAAO,CAAC,IAAI,CAAC;gBACT,UAAU,EAAE,QAAQ;gBACpB,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,QAAQ;gBAC/C,OAAO,EAAE,8CAA8C;gBACvD,WAAW,EAAE,GAAG,OAAO,GAAG;gBAC1B,KAAK,EAAE,sBAAsB;aAChC,CAAC,CAAC;QACP,CAAC;QAED,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC;YAC/B,OAAO,CAAC,IAAI,CAAC;gBACT,UAAU,EAAE,QAAQ;gBACpB,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,QAAQ;gBAC/C,OAAO,EAAE,0CAA0C;gBACnD,WAAW,EAAE,GAAG,OAAO,GAAG;gBAC1B,KAAK,EAAE,sBAAsB;aAChC,CAAC,CAAC;QACP,CAAC;QAED,OAAO,OAAO,CAAC;IACnB,CAAC;CACJ"}

package/dist/identity/sso/sso-custodian-service.respec.d.mts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=sso-custodian-service.respec.d.mts.map

package/dist/identity/sso/sso-custodian-service.respec.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sso-custodian-service.respec.d.mts","sourceRoot":"","sources":["../../../src/identity/sso/sso-custodian-service.respec.mts"],"names":[],"mappings":""}

package/dist/identity/sso/sso-custodian-service.respec.mjs

@@ -0,0 +1,167 @@
+import { generateKeyPairSync, createSign } from 'node:crypto';
+import { respecfully, ifWeMight, iReckon, firstOfAll, lastOfAll } from '@ibgib/helper-gib/dist/respec-gib/respec-gib.mjs';
+import { SsoCustodianService } from './sso-custodian-service.mjs';
+import { POOL_ID_CUSTODIAN_MANAGE } from '@ibgib/core-gib/dist/keystone/keystone-constants.mjs';
+const maam = `[${import.meta.url}]`, sir = maam;
+await respecfully(sir, 'SsoCustodianService', async () => {
+    let mockPrivateKey;
+    let mockPublicKeyJwk;
+    let originalFetch;
+    firstOfAll(sir, async () => {
+        // Generate mock RSA key pair
+        const { privateKey, publicKey } = generateKeyPairSync('rsa', {
+            modulusLength: 2048
+        });
+        mockPrivateKey = privateKey;
+        // Export public key as JWK
+        mockPublicKeyJwk = publicKey.export({ format: 'jwk' });
+        mockPublicKeyJwk.kid = 'mock-kid-123';
+        mockPublicKeyJwk.alg = 'RS256';
+        mockPublicKeyJwk.use = 'sig';
+        // Mock global fetch to return JWKS containing the mock public key
+        originalFetch = globalThis.fetch;
+        globalThis.fetch = async (url, options) => {
+            if (url === 'https://www.googleapis.com/oauth2/v3/certs') {
+                return {
+                    ok: true,
+                    status: 200,
+                    json: async () => ({
+                        keys: [mockPublicKeyJwk]
+                    })
+                };
+            }
+            return {
+                ok: false,
+                status: 404,
+                text: async () => 'Not Found'
+            };
+        };
+    });
+    lastOfAll(sir, async () => {
+        // Restore global fetch
+        if (originalFetch) {
+            globalThis.fetch = originalFetch;
+        }
+    });
+    await ifWeMight(sir, 'verify dynamic RSA RS256 JWT signature successfully', async () => {
+        const config = {
+            ssoServerKdfSecret: 'mock-kdf-secret',
+            sessionSecret: 'mock-session-secret',
+            providers: {
+                google: {
+                    providerId: 'google',
+                    clientId: 'google-client-id-123',
+                    clientSecret: 'google-client-secret-123',
+                    tokenUrl: 'https://oauth2.googleapis.com/token',
+                    userInfoUrl: 'https://openidconnect.googleapis.com/v1/userinfo',
+                    jwksUrl: 'https://www.googleapis.com/oauth2/v3/certs'
+                }
+            }
+        };
+        const service = new SsoCustodianService(config);
+        // 1. Build JWT Header & Payload
+        const header = { alg: 'RS256', kid: 'mock-kid-123', typ: 'JWT' };
+        const payload = {
+            sub: 'user-sub-999',
+            email: 'user@example.com',
+            name: 'John Doe',
+            aud: 'google-client-id-123',
+            iss: 'https://accounts.google.com',
+            exp: Math.floor(Date.now() / 1000) + 3600 // expires in 1 hour
+        };
+        const headerB64 = Buffer.from(JSON.stringify(header)).toString('base64url');
+        const payloadB64 = Buffer.from(JSON.stringify(payload)).toString('base64url');
+        const data = `${headerB64}.${payloadB64}`;
+        // 2. Sign JWT using private key
+        const sign = createSign('RSA-SHA256');
+        sign.update(data);
+        const signatureB64 = sign.sign(mockPrivateKey, 'base64url');
+        const mockJwtToken = `${data}.${signatureB64}`;
+        // 3. Verify signature via service
+        const decodedPayload = await service.verifyJwt(mockJwtToken, config.providers.google);
+        iReckon(sir, decodedPayload.sub).isGonnaBe('user-sub-999');
+        iReckon(sir, decodedPayload.email).isGonnaBe('user@example.com');
+        iReckon(sir, decodedPayload.name).isGonnaBe('John Doe');
+    });
+    await ifWeMight(sir, 'fail validation if JWT has invalid signature', async () => {
+        const config = {
+            ssoServerKdfSecret: 'mock-kdf-secret',
+            sessionSecret: 'mock-session-secret',
+            providers: {
+                google: {
+                    providerId: 'google',
+                    clientId: 'google-client-id-123',
+                    clientSecret: 'google-client-secret-123',
+                    tokenUrl: 'https://oauth2.googleapis.com/token',
+                    userInfoUrl: 'https://openidconnect.googleapis.com/v1/userinfo',
+                    jwksUrl: 'https://www.googleapis.com/oauth2/v3/certs'
+                }
+            }
+        };
+        const service = new SsoCustodianService(config);
+        const header = { alg: 'RS256', kid: 'mock-kid-123', typ: 'JWT' };
+        const payload = {
+            sub: 'user-sub-999',
+            aud: 'google-client-id-123',
+            exp: Math.floor(Date.now() / 1000) + 3600
+        };
+        const headerB64 = Buffer.from(JSON.stringify(header)).toString('base64url');
+        const payloadB64 = Buffer.from(JSON.stringify(payload)).toString('base64url');
+        const data = `${headerB64}.${payloadB64}`;
+        // Create signature using a different/unregistered RSA key
+        const { privateKey: badPrivateKey } = generateKeyPairSync('rsa', { modulusLength: 2048 });
+        const sign = createSign('RSA-SHA256');
+        sign.update(data);
+        const badSignatureB64 = sign.sign(badPrivateKey, 'base64url');
+        const badJwtToken = `${data}.${badSignatureB64}`;
+        let verifyError;
+        try {
+            await service.verifyJwt(badJwtToken, config.providers.google);
+        }
+        catch (error) {
+            verifyError = error;
+        }
+        iReckon(sir, verifyError).not.isGonnaBeUndefined();
+        iReckon(sir, verifyError.message).includes('Cryptographic signature verification failed');
+    });
+    await ifWeMight(sir, 'derive server-delegate secret deterministically', async () => {
+        const config = {
+            ssoServerKdfSecret: 'high-entropy-server-kdf-secret',
+            sessionSecret: 'session-secret-123',
+            providers: {}
+        };
+        const service = new SsoCustodianService(config);
+        const key = 'google:123456789';
+        const nonce1 = 'nonce-abc-123';
+        const nonce2 = 'nonce-def-456';
+        const secret1_a = await service.deriveServerDelegateSecret(key, nonce1);
+        const secret1_b = await service.deriveServerDelegateSecret(key, nonce1);
+        const secret2 = await service.deriveServerDelegateSecret(key, nonce2);
+        // Identical inputs must yield identical outputs
+        iReckon(sir, secret1_a).isGonnaBe(secret1_b);
+        // Different nonces must yield different outputs
+        iReckon(sir, secret1_a).not.isGonnaBe(secret2);
+        // Derived secrets must be string type with high entropy
+        iReckon(sir, typeof secret1_a).isGonnaBe('string');
+        iReckon(sir, secret1_a.length).isGonnaBe(128); // sha512 output in hex/base64 wrap
+    });
+    await ifWeMight(sir, 'create custodian challenge pool successfully', async () => {
+        const config = {
+            ssoServerKdfSecret: 'high-entropy-server-kdf-secret',
+            sessionSecret: 'session-secret-123',
+            providers: {}
+        };
+        const service = new SsoCustodianService(config);
+        const key = 'google:123456789';
+        const nonce = 'nonce-abc-123';
+        const custodianPool = await service.createCustodianChallengePool(key, nonce);
+        iReckon(sir, custodianPool).not.isGonnaBeUndefined();
+        iReckon(sir, custodianPool.id).willEqual(POOL_ID_CUSTODIAN_MANAGE);
+        iReckon(sir, custodianPool.isForeign).isGonnaBeTrue();
+        iReckon(sir, custodianPool.metadata?.providerKey).willEqual(key);
+        // Structural validation of challenges
+        const challengesCount = Object.keys(custodianPool.challenges).length;
+        iReckon(sir, challengesCount).willEqual(custodianPool.config.behavior.size);
+    });
+});
+//# sourceMappingURL=sso-custodian-service.respec.mjs.map

package/dist/identity/sso/sso-custodian-service.respec.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"sso-custodian-service.respec.mjs","sourceRoot":"","sources":["../../../src/identity/sso/sso-custodian-service.respec.mts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAC9D,OAAO,EACH,WAAW,EACX,SAAS,EACT,OAAO,EACP,UAAU,EACV,SAAS,EACZ,MAAM,kDAAkD,CAAC;AAC1D,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAElE,OAAO,EAAE,wBAAwB,EAAE,MAAM,sDAAsD,CAAC;AAEhG,MAAM,IAAI,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,GAAG,EAAE,GAAG,GAAG,IAAI,CAAC;AAEhD,MAAM,WAAW,CAAC,GAAG,EAAE,qBAAqB,EAAE,KAAK,IAAI,EAAE;IACrD,IAAI,cAAmB,CAAC;IACxB,IAAI,gBAAqB,CAAC;IAC1B,IAAI,aAAkB,CAAC;IAEvB,UAAU,CAAC,GAAG,EAAE,KAAK,IAAI,EAAE;QACvB,6BAA6B;QAC7B,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,mBAAmB,CAAC,KAAK,EAAE;YACzD,aAAa,EAAE,IAAI;SACtB,CAAC,CAAC;QACH,cAAc,GAAG,UAAU,CAAC;QAE5B,2BAA2B;QAC3B,gBAAgB,GAAG,SAAS,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QACvD,gBAAgB,CAAC,GAAG,GAAG,cAAc,CAAC;QACtC,gBAAgB,CAAC,GAAG,GAAG,OAAO,CAAC;QAC/B,gBAAgB,CAAC,GAAG,GAAG,KAAK,CAAC;QAE7B,kEAAkE;QAClE,aAAa,GAAI,UAAkB,CAAC,KAAK,CAAC;QACzC,UAAkB,CAAC,KAAK,GAAG,KAAK,EAAE,GAAW,EAAE,OAAa,EAAE,EAAE;YAC7D,IAAI,GAAG,KAAK,4CAA4C,EAAE,CAAC;gBACvD,OAAO;oBACH,EAAE,EAAE,IAAI;oBACR,MAAM,EAAE,GAAG;oBACX,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;wBACf,IAAI,EAAE,CAAC,gBAAgB,CAAC;qBAC3B,CAAC;iBACE,CAAC;YACb,CAAC;YACD,OAAO;gBACH,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,GAAG;gBACX,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC,WAAW;aACzB,CAAC;QACb,CAAC,CAAC;IACN,CAAC,CAAC,CAAC;IAEH,SAAS,CAAC,GAAG,EAAE,KAAK,IAAI,EAAE;QACtB,uBAAuB;QACvB,IAAI,aAAa,EAAE,CAAC;YACf,UAAkB,CAAC,KAAK,GAAG,aAAa,CAAC;QAC9C,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,MAAM,SAAS,CAAC,GAAG,EAAE,qDAAqD,EAAE,KAAK,IAAI,EAAE;QACnF,MAAM,MAAM,GAAoB;YAC5B,kBAAkB,EAAE,iBAAiB;YACrC,aAAa,EAAE,qBAAqB;YACpC,SAAS,EAAE;gBACP,MAAM,EAAE;oBACJ,UAAU,EAAE,QAAQ;oBACpB,QAAQ,EAAE,sBAAsB;oBAChC,YAAY,EAAE,0BAA0B;oBACxC,QAAQ,EAAE,qCAAqC;oBAC/C,WAAW,EAAE,kDAAkD;oBAC/D,OAAO,EAAE,4CAA4C;iBACxD;aACJ;SACJ,CAAC;QAEF,MAAM,OAAO,GAAG,IAAI,mBAAmB,CAAC,MAAM,CAAC,CAAC;QAEhD,gCAAgC;QAChC,MAAM,MAAM,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,cAAc,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;QACjE,MAAM,OAAO,GAAG;YACZ,GAAG,EAAE,cAAc;YACnB,KAAK,EAAE,kBAAkB;YACzB,IAAI,EAAE,UAAU;YAChB,GAAG,EAAE,sBAAsB;YAC3B,GAAG,EAAE,6BAA6B;YAClC,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,oBAAoB;SACjE,CAAC;QAEF,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QAC5E,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QAC9E,MAAM,IAAI,GAAG,GAAG,SAAS,IAAI,UAAU,EAAE,CAAC;QAE1C,gCAAgC;QAChC,MAAM,IAAI,GAAG,UAAU,CAAC,YAAY,CAAC,CAAC;QACtC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAClB,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;QAE5D,MAAM,YAAY,GAAG,GAAG,IAAI,IAAI,YAAY,EAAE,CAAC;QAE/C,kCAAkC;QAClC,MAAM,cAAc,GAAG,MAAM,OAAO,CAAC,SAAS,CAAC,YAAY,EAAE,MAAM,CAAC,SAAS,CAAC,MAAO,CAAC,CAAC;QAEvF,OAAO,CAAC,GAAG,EAAE,cAAc,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC;QAC3D,OAAO,CAAC,GAAG,EAAE,cAAc,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC;QACjE,OAAO,CAAC,GAAG,EAAE,cAAc,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;IAEH,MAAM,SAAS,CAAC,GAAG,EAAE,8CAA8C,EAAE,KAAK,IAAI,EAAE;QAC5E,MAAM,MAAM,GAAoB;YAC5B,kBAAkB,EAAE,iBAAiB;YACrC,aAAa,EAAE,qBAAqB;YACpC,SAAS,EAAE;gBACP,MAAM,EAAE;oBACJ,UAAU,EAAE,QAAQ;oBACpB,QAAQ,EAAE,sBAAsB;oBAChC,YAAY,EAAE,0BAA0B;oBACxC,QAAQ,EAAE,qCAAqC;oBAC/C,WAAW,EAAE,kDAAkD;oBAC/D,OAAO,EAAE,4CAA4C;iBACxD;aACJ;SACJ,CAAC;QAEF,MAAM,OAAO,GAAG,IAAI,mBAAmB,CAAC,MAAM,CAAC,CAAC;QAEhD,MAAM,MAAM,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,cAAc,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;QACjE,MAAM,OAAO,GAAG;YACZ,GAAG,EAAE,cAAc;YACnB,GAAG,EAAE,sBAAsB;YAC3B,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI;SAC5C,CAAC;QAEF,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QAC5E,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QAC9E,MAAM,IAAI,GAAG,GAAG,SAAS,IAAI,UAAU,EAAE,CAAC;QAE1C,0DAA0D;QAC1D,MAAM,EAAE,UAAU,EAAE,aAAa,EAAE,GAAG,mBAAmB,CAAC,KAAK,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1F,MAAM,IAAI,GAAG,UAAU,CAAC,YAAY,CAAC,CAAC;QACtC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAClB,MAAM,eAAe,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC;QAE9D,MAAM,WAAW,GAAG,GAAG,IAAI,IAAI,eAAe,EAAE,CAAC;QAEjD,IAAI,WAAgB,CAAC;QACrB,IAAI,CAAC;YACD,MAAM,OAAO,CAAC,SAAS,CAAC,WAAW,EAAE,MAAM,CAAC,SAAS,CAAC,MAAO,CAAC,CAAC;QACnE,CAAC;QAAC,OAAO,KAAU,EAAE,CAAC;YAClB,WAAW,GAAG,KAAK,CAAC;QACxB,CAAC;QAED,OAAO,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC,GAAG,CAAC,kBAAkB,EAAE,CAAC;QACnD,OAAO,CAAC,GAAG,EAAE,WAAW,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,6CAA6C,CAAC,CAAC;IAC9F,CAAC,CAAC,CAAC;IAEH,MAAM,SAAS,CAAC,GAAG,EAAE,iDAAiD,EAAE,KAAK,IAAI,EAAE;QAC/E,MAAM,MAAM,GAAoB;YAC5B,kBAAkB,EAAE,gCAAgC;YACpD,aAAa,EAAE,oBAAoB;YACnC,SAAS,EAAE,EAAE;SAChB,CAAC;QACF,MAAM,OAAO,GAAG,IAAI,mBAAmB,CAAC,MAAM,CAAC,CAAC;QAEhD,MAAM,GAAG,GAAG,kBAAkB,CAAC;QAC/B,MAAM,MAAM,GAAG,eAAe,CAAC;QAC/B,MAAM,MAAM,GAAG,eAAe,CAAC;QAE/B,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,0BAA0B,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QACxE,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,0BAA0B,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QACxE,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,0BAA0B,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QAEtE,gDAAgD;QAChD,OAAO,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;QAC7C,gDAAgD;QAChD,OAAO,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QAC/C,wDAAwD;QACxD,OAAO,CAAC,GAAG,EAAE,OAAO,SAAS,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QACnD,OAAO,CAAC,GAAG,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,mCAAmC;IACtF,CAAC,CAAC,CAAC;IAEH,MAAM,SAAS,CAAC,GAAG,EAAE,8CAA8C,EAAE,KAAK,IAAI,EAAE;QAC5E,MAAM,MAAM,GAAoB;YAC5B,kBAAkB,EAAE,gCAAgC;YACpD,aAAa,EAAE,oBAAoB;YACnC,SAAS,EAAE,EAAE;SAChB,CAAC;QACF,MAAM,OAAO,GAAG,IAAI,mBAAmB,CAAC,MAAM,CAAC,CAAC;QAEhD,MAAM,GAAG,GAAG,kBAAkB,CAAC;QAC/B,MAAM,KAAK,GAAG,eAAe,CAAC;QAE9B,MAAM,aAAa,GAAG,MAAM,OAAO,CAAC,4BAA4B,CAC5D,GAAG,EACH,KAAK,CACR,CAAC;QAEF,OAAO,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC,GAAG,CAAC,kBAAkB,EAAE,CAAC;QACrD,OAAO,CAAC,GAAG,EAAE,aAAa,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC,wBAAwB,CAAC,CAAC;QACnE,OAAO,CAAC,GAAG,EAAE,aAAa,CAAC,SAAS,CAAC,CAAC,aAAa,EAAE,CAAC;QACtD,OAAO,CAAC,GAAG,EAAE,aAAa,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QAEjE,sCAAsC;QACtC,MAAM,eAAe,GAAG,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC;QACrE,OAAO,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC,SAAS,CAAC,aAAa,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAChF,CAAC,CAAC,CAAC;AACP,CAAC,CAAC,CAAC"}

package/dist/identity/sso/sso-types.d.mts

@@ -0,0 +1,40 @@
+/**
+ * @module identity/sso/sso-types
+ *
+ * Core types and interfaces for extensible SSO (OAuth2) authentication.
+ */
+export type SsoProviderId = 'google' | 'github';
+export interface SsoProviderClientConfig {
+    providerId: SsoProviderId;
+    clientId: string;
+    authUrl: string;
+    redirectUri: string;
+    scope: string;
+}
+export interface SsoProviderServerConfig {
+    providerId: SsoProviderId;
+    clientId: string;
+    clientSecret: string;
+    tokenUrl: string;
+    userInfoUrl: string;
+    jwksUrl?: string;
+}
+export interface SsoServerConfig {
+    /** Server's private KDF secret used to derive server-delegate keystones. */
+    ssoServerKdfSecret: string;
+    /** Server's private session encryption secret. */
+    sessionSecret: string;
+    /** Map of active OAuth2 providers. */
+    providers: Partial<Record<SsoProviderId, SsoProviderServerConfig>>;
+}
+export interface OAuthUserInfo {
+    /** Unique identity key combining provider and sub ID (e.g., `google:107632...`). */
+    providerKey: string;
+    providerId: SsoProviderId;
+    /** Unique user ID within the provider. */
+    sub: string;
+    email?: string;
+    name?: string;
+    picture?: string;
+}
+//# sourceMappingURL=sso-types.d.mts.map

package/dist/identity/sso/sso-types.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sso-types.d.mts","sourceRoot":"","sources":["../../../src/identity/sso/sso-types.mts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,MAAM,MAAM,aAAa,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAEhD,MAAM,WAAW,uBAAuB;IACpC,UAAU,EAAE,aAAa,CAAC;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,uBAAuB;IACpC,UAAU,EAAE,aAAa,CAAC;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,eAAe;IAC5B,4EAA4E;IAC5E,kBAAkB,EAAE,MAAM,CAAC;IAC3B,kDAAkD;IAClD,aAAa,EAAE,MAAM,CAAC;IACtB,sCAAsC;IACtC,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC,aAAa,EAAE,uBAAuB,CAAC,CAAC,CAAC;CACtE;AAED,MAAM,WAAW,aAAa;IAC1B,oFAAoF;IACpF,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,aAAa,CAAC;IAC1B,0CAA0C;IAC1C,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;CACpB"}

package/dist/identity/sso/sso-types.mjs

@@ -0,0 +1,7 @@
+/**
+ * @module identity/sso/sso-types
+ *
+ * Core types and interfaces for extensible SSO (OAuth2) authentication.
+ */
+export {};
+//# sourceMappingURL=sso-types.mjs.map

package/dist/identity/sso/sso-types.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"sso-types.mjs","sourceRoot":"","sources":["../../../src/identity/sso/sso-types.mts"],"names":[],"mappings":"AAAA;;;;GAIG"}