@ibgib/web-gib 0.0.50 → 0.0.51

package/dist/AUTO-GENERATED-version.d.mts

@@ -10,5 +10,5 @@
 /**
  * this is the version of this package, auto-updated in the build process
  */
-export declare const AUTO_GENERATED_VERSION = "0.0.50";
+export declare const AUTO_GENERATED_VERSION = "0.0.51";
 //# sourceMappingURL=AUTO-GENERATED-version.d.mts.map

package/dist/AUTO-GENERATED-version.mjs

@@ -10,5 +10,5 @@
 /**
  * this is the version of this package, auto-updated in the build process
  */
-export const AUTO_GENERATED_VERSION = '0.0.50';
+export const AUTO_GENERATED_VERSION = '0.0.51';
 //# sourceMappingURL=AUTO-GENERATED-version.mjs.map

package/dist/identity/sso/sso-custodian-service.d.mts

@@ -1,4 +1,6 @@
 import { KeystoneChallengePool } from '@ibgib/core-gib/dist/keystone/keystone-types.mjs';
+import { MetaspaceService } from '@ibgib/core-gib/dist/witness/space/metaspace/metaspace-types.mjs';
+import { IbGibSpaceAny } from '@ibgib/core-gib/dist/witness/space/space-base-v1.mjs';
 import { SsoServerConfig, SsoProviderId, OAuthUserInfo, SsoProviderServerConfig, SsoProviderClientConfig } from './sso-types.mjs';
 /**
  * Server-side service for token exchange, JWT validation, and user profile normalization.
@@ -112,7 +114,14 @@ export declare class SsoCustodianService {
      *   - Visibility: Public (Derivation salt, safe for ledger).
      *   - Generator: Client (Generated on user's device).
      */
-    createCustodianChallengePool(providerKey: string, userNonce: string): Promise<KeystoneChallengePool>;
+    createCustodianChallengePool({ providerId, providerKey, userNonce, keystoneAddr, metaspace, space, }: {
+        providerId: string;
+        providerKey: string;
+        userNonce: string;
+        keystoneAddr: string;
+        metaspace: MetaspaceService;
+        space: IbGibSpaceAny;
+    }): Promise<KeystoneChallengePool>;
     /**
      * Maps private server configuration to safe public client configurations.
      *
@@ -121,5 +130,10 @@ export declare class SsoCustodianService {
      *   - Generator: Server (Extracted from the HTTP request context headers/protocol).
      */
     getSsoClientConfigs(hostUrl: string): SsoProviderClientConfig[];
+    /**
+     * Revokes an active OAuth access or refresh token with the provider.
+     * Keeps token revocation logic DRY and centralized.
+     */
+    revokeToken(providerId: SsoProviderId, token: string): Promise<void>;
 }
 //# sourceMappingURL=sso-custodian-service.d.mts.map

package/dist/identity/sso/sso-custodian-service.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"sso-custodian-service.d.mts","sourceRoot":"","sources":["../../../src/identity/sso/sso-custodian-service.mts"],"names":[],"mappings":"AAKA,OAAO,EAAoB,qBAAqB,EAAE,MAAM,kDAAkD,CAAC;AAK3G,OAAO,EACH,eAAe,EACf,aAAa,EACb,aAAa,EACb,uBAAuB,EACvB,uBAAuB,EAC1B,MAAM,iBAAiB,CAAC;AAgBzB;;GAEG;AACH,qBAAa,mBAAmB;IAYhB,OAAO,CAAC,MAAM;IAX1B,OAAO,CAAC,EAAE,CAAmC;IAG7C,OAAO,CAAC,SAAS,CAAwE;IACzF,OAAO,CAAC,SAAS,CAAuB;IAExC;;;;OAIG;gBACiB,MAAM,EAAE,eAAe;IAE3C;;;;;;;;;;;;;;OAcG;IACG,gBAAgB,CAAC,UAAU,EAAE,aAAa,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC;IA8B5G;;;;;;;OAOG;IACG,6BAA6B,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC;IAiC5E;;;;;;;;;;;;;;OAcG;YACW,qBAAqB;IAoCnC;;;;;;;;;;OAUG;YACW,2BAA2B;IAkCzC;;;;;;;;;;OAUG;IACU,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,uBAAuB,GAAG,OAAO,CAAC,GAAG,CAAC;IAuD5F;;;;;;OAMG;YACW,WAAW;IA8BzB;;;;;;;;;;;OAWG;IACG,0BAA0B,CAAC,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAazF;;;;;;;;;;;OAWG;IACG,4BAA4B,CAC9B,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,GAClB,OAAO,CAAC,qBAAqB,CAAC;IA8CjC;;;;;;OAMG;IACH,mBAAmB,CAAC,OAAO,EAAE,MAAM,GAAG,uBAAuB,EAAE;CAyBlE"}
+{"version":3,"file":"sso-custodian-service.d.mts","sourceRoot":"","sources":["../../../src/identity/sso/sso-custodian-service.mts"],"names":[],"mappings":"AAKA,OAAO,EAAoB,qBAAqB,EAAsB,MAAM,kDAAkD,CAAC;AAK/H,OAAO,EAAE,gBAAgB,EAAE,MAAM,kEAAkE,CAAC;AACpG,OAAO,EAAE,aAAa,EAAE,MAAM,sDAAsD,CAAC;AACrF,OAAO,EACH,eAAe,EACf,aAAa,EACb,aAAa,EACb,uBAAuB,EACvB,uBAAuB,EAC1B,MAAM,iBAAiB,CAAC;AAgBzB;;GAEG;AACH,qBAAa,mBAAmB;IAYhB,OAAO,CAAC,MAAM;IAX1B,OAAO,CAAC,EAAE,CAAmC;IAG7C,OAAO,CAAC,SAAS,CAAwE;IACzF,OAAO,CAAC,SAAS,CAAuB;IAExC;;;;OAIG;gBACiB,MAAM,EAAE,eAAe;IAE3C;;;;;;;;;;;;;;OAcG;IACG,gBAAgB,CAAC,UAAU,EAAE,aAAa,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC;IA8B5G;;;;;;;OAOG;IACG,6BAA6B,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC;IAiC5E;;;;;;;;;;;;;;OAcG;YACW,qBAAqB;IAoCnC;;;;;;;;;;OAUG;YACW,2BAA2B;IAkCzC;;;;;;;;;;OAUG;IACU,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,uBAAuB,GAAG,OAAO,CAAC,GAAG,CAAC;IAuD5F;;;;;;OAMG;YACW,WAAW;IA8BzB;;;;;;;;;;;OAWG;IACG,0BAA0B,CAAC,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAazF;;;;;;;;;;;OAWG;IACG,4BAA4B,CAAC,EAC/B,UAAU,EACV,WAAW,EACX,SAAS,EACT,YAAY,EACZ,SAAS,EACT,KAAK,GACR,EAAE;QACC,UAAU,EAAE,MAAM,CAAC;QACnB,WAAW,EAAE,MAAM,CAAC;QACpB,SAAS,EAAE,MAAM,CAAC;QAClB,YAAY,EAAE,MAAM,CAAC;QACrB,SAAS,EAAE,gBAAgB,CAAC;QAC5B,KAAK,EAAE,aAAa,CAAC;KACxB,GAAG,OAAO,CAAC,qBAAqB,CAAC;IAyElC;;;;;;OAMG;IACH,mBAAmB,CAAC,OAAO,EAAE,MAAM,GAAG,uBAAuB,EAAE;IA0B/D;;;OAGG;IACG,WAAW,CAAC,UAAU,EAAE,aAAa,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAyC7E"}

package/dist/identity/sso/sso-custodian-service.mjs

@@ -1,8 +1,8 @@
 import { createPublicKey, verify } from 'node:crypto';
-import { hash, HashAlgorithm } from '@ibgib/helper-gib/dist/helpers/utils-helper.mjs';
+import { hash, HashAlgorithm, extractErrorMsg } from '@ibgib/helper-gib/dist/helpers/utils-helper.mjs';
 import { kdf_recursiveSaltWrap } from '@ibgib/core-gib/dist/keystone/kdf/kdf-helpers.mjs';
-import { POOL_ID_CUSTODIAN_MANAGE, KEYSTONE_VERB_MANAGE, KEYSTONE_VERB_REVOKE } from '@ibgib/core-gib/dist/keystone/keystone-constants.mjs';
-import { createStandardPoolConfig } from '@ibgib/core-gib/dist/keystone/keystone-config-builder.mjs';
+import { KeystoneService_V1 } from '@ibgib/core-gib/dist/keystone/keystone-service-v1.mjs';
+import { KEYSTONE_VERB_MANAGE, KEYSTONE_VERB_REVOKE, POOL_ID_MANAGE, KEYSTONE_POOL_ID_REGEXP } from '@ibgib/core-gib/dist/keystone/keystone-constants.mjs';
 import { generateOpaqueChallengeId } from '@ibgib/core-gib/dist/keystone/keystone-helpers.mjs';
 import { KeystoneStrategyFactory } from '@ibgib/core-gib/dist/keystone/strategy/keystone-strategy-factory.mjs';
 /**
@@ -300,18 +300,41 @@ export class SsoCustodianService {
      *   - Visibility: Public (Derivation salt, safe for ledger).
      *   - Generator: Client (Generated on user's device).
      */
-    async createCustodianChallengePool(providerKey, userNonce) {
+    async createCustodianChallengePool({ providerId, providerKey, userNonce, keystoneAddr, metaspace, space, }) {
+        // 1. Fetch target keystone
+        const keystoneService = new KeystoneService_V1();
+        const targetKeystone = await keystoneService.getLatestKeystone({
+            addr: keystoneAddr,
+            metaspace,
+            space
+        });
+        if (!targetKeystone) {
+            throw new Error(`Keystone not found for address: ${keystoneAddr} (E: 8a9c2b1d3e5f6a7b8c9d0e1f2a3b4c5d)`);
+        }
+        // 2. Locate native manage pool
+        const userManagePool = targetKeystone.data?.challengePools.find(p => p.id === POOL_ID_MANAGE);
+        if (!userManagePool) {
+            throw new Error(`Keystone manage pool not found. Custodian manage pool must match the user manage pool's security config. (E: 7c4e5f6a7b8c9d0e1f2a3b4c5e6f7a8b)`);
+        }
+        // 3. Dynamic poolId based on providerId with regex validation
+        if (!providerId || !KEYSTONE_POOL_ID_REGEXP.test(providerId)) {
+            throw new Error(`Invalid providerId: "${providerId}". Must match ${KEYSTONE_POOL_ID_REGEXP} (E: 3a2c4e5f6a7b8c9d0e1f2a3b4c5e6f)`);
+        }
+        const poolId = `custodian-manage-${providerId}`;
+        // 4. Derive delegate secrets
         const custodianSecret = await this.deriveServerDelegateSecret(providerKey, userNonce);
         const poolSalt = await hash({
             s: `${providerKey}:${userNonce}:salt`,
             algorithm: HashAlgorithm.sha_256
         });
         const poolSaltShort = poolSalt.substring(0, 16);
-        const config = createStandardPoolConfig({
-            id: POOL_ID_CUSTODIAN_MANAGE,
-            salt: poolSaltShort
-        });
-        config.allowedVerbs = [KEYSTONE_VERB_MANAGE, KEYSTONE_VERB_REVOKE];
+        // 5. Clone user's manage pool config, updating only ID, salt, and allowedVerbs
+        const config = {
+            ...userManagePool.config,
+            id: poolId,
+            salt: poolSaltShort,
+            allowedVerbs: [KEYSTONE_VERB_MANAGE, KEYSTONE_VERB_REVOKE]
+        };
         const strategy = KeystoneStrategyFactory.create({ config });
         const poolSecret = await strategy.derivePoolSecret({ masterSecret: custodianSecret });
         const challenges = {};
@@ -330,7 +353,7 @@ export class SsoCustodianService {
             challenges[challengeId] = await strategy.generateChallenge({ solution });
         }
         return {
-            id: POOL_ID_CUSTODIAN_MANAGE,
+            id: poolId,
             config,
             challenges,
             isForeign: true,
@@ -369,5 +392,52 @@ export class SsoCustodianService {
         }
         return configs;
     }
+    /**
+     * Revokes an active OAuth access or refresh token with the provider.
+     * Keeps token revocation logic DRY and centralized.
+     */
+    async revokeToken(providerId, token) {
+        const lc = `${this.lc}[${this.revokeToken.name}]`;
+        const providerConfig = this.config.providers[providerId];
+        if (!providerConfig) {
+            throw new Error(`SSO provider "${providerId}" config is missing. (E: r28900abfefd23e89cf78f57)`);
+        }
+        try {
+            if (providerId === 'google') {
+                const res = await fetch(`https://oauth2.googleapis.com/revoke?token=${encodeURIComponent(token)}`, {
+                    method: 'POST',
+                    headers: {
+                        'Content-Type': 'application/x-www-form-urlencoded'
+                    }
+                });
+                if (!res.ok) {
+                    const text = await res.text();
+                    console.warn(`${lc} Google token revocation returned status ${res.status}: ${text}`);
+                }
+            }
+            else if (providerId === 'github') {
+                const auth = Buffer.from(`${providerConfig.clientId}:${providerConfig.clientSecret}`).toString('base64');
+                const res = await fetch(`https://api.github.com/applications/${providerConfig.clientId}/grant`, {
+                    method: 'DELETE',
+                    headers: {
+                        'Authorization': `Basic ${auth}`,
+                        'Accept': 'application/vnd.github.v3+json',
+                        'User-Agent': 'space-gib-server'
+                    },
+                    body: JSON.stringify({ access_token: token })
+                });
+                if (!res.ok && res.status !== 404) {
+                    const text = await res.text();
+                    console.warn(`${lc} GitHub token revocation returned status ${res.status}: ${text}`);
+                }
+            }
+            else {
+                throw new Error(`Unsupported provider: ${providerId} (E: e28900abfefd23e89cf78f58)`);
+            }
+        }
+        catch (error) {
+            console.error(`${lc} Token revocation failed for provider ${providerId}: ${extractErrorMsg(error)}`);
+        }
+    }
 }
 //# sourceMappingURL=sso-custodian-service.mjs.map

package/dist/identity/sso/sso-custodian-service.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"sso-custodian-service.mjs","sourceRoot":"","sources":["../../../src/identity/sso/sso-custodian-service.mts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,iDAAiD,CAAC;AACtF,OAAO,EAAE,qBAAqB,EAAE,MAAM,mDAAmD,CAAC;AAI1F,OAAO,EAAE,wBAAwB,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,MAAM,sDAAsD,CAAC;AAC5I,OAAO,EAAE,wBAAwB,EAAE,MAAM,2DAA2D,CAAC;AACrG,OAAO,EAAE,yBAAyB,EAAE,MAAM,oDAAoD,CAAC;AAC/F,OAAO,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AAuB/G;;GAEG;AACH,MAAM,OAAO,mBAAmB;IAYR;IAXZ,EAAE,GAAG,IAAI,mBAAmB,CAAC,IAAI,GAAG,CAAC;IAE7C,4DAA4D;IACpD,SAAS,GAA8D,IAAI,GAAG,EAAE,CAAC;IACjF,SAAS,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,2BAA2B;IAEpE;;;;OAIG;IACH,YAAoB,MAAuB;QAAvB,WAAM,GAAN,MAAM,CAAiB;IAAG,CAAC;IAE/C;;;;;;;;;;;;;;OAcG;IACH,KAAK,CAAC,gBAAgB,CAAC,UAAyB,EAAE,IAAY,EAAE,WAAmB;QAC/E,MAAM,EAAE,GAAG,GAAG,IAAI,CAAC,EAAE,IAAI,IAAI,CAAC,gBAAgB,CAAC,IAAI,GAAG,CAAC;QACvD,MAAM,cAAc,GAAG,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;QACzD,IAAI,CAAC,cAAc,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CAAC,aAAa,UAAU,mEAAmE,CAAC,CAAC;QAChH,CAAC;QAED,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,kCAAkC,UAAU,EAAE,CAAC,CAAC;QAEjE,4CAA4C;QAC5C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,cAAc,EAAE,IAAI,EAAE,WAAW,CAAC,CAAC;QAEnF,sCAAsC;QACtC,IAAI,UAAU,KAAK,QAAQ,EAAE,CAAC;YAC1B,iEAAiE;YACjE,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;gBACnB,MAAM,IAAI,KAAK,CAAC,8EAA8E,CAAC,CAAC;YACpG,CAAC;YACD,OAAO,IAAI,CAAC,6BAA6B,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC/D,CAAC;aAAM,IAAI,UAAU,KAAK,QAAQ,EAAE,CAAC;YACjC,+DAA+D;YAC/D,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC;gBACvB,MAAM,IAAI,KAAK,CAAC,kFAAkF,CAAC,CAAC;YACxG,CAAC;YACD,OAAO,IAAI,CAAC,2BAA2B,CAAC,cAAc,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC;QACjF,CAAC;QAED,MAAM,IAAI,KAAK,CAAC,yBAAyB,UAAU,iCAAiC,CAAC,CAAC;IAC1F,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,6BAA6B,CAAC,OAAe;QAC/C,MAAM,EAAE,GAAG,GAAG,IAAI,CAAC,EAAE,IAAI,IAAI,CAAC,6BAA6B,CAAC,IAAI,GAAG,CAAC;QACpE,MAAM,cAAc,GAAG,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC;QACpD,IAAI,CAAC,cAAc,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAC;QACxF,CAAC;QAED,0CAA0C;QAC1C,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;QAE9D,gBAAgB;QAChB,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QACjD,IAAI,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,GAAG,UAAU,EAAE,CAAC;YAC1C,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;QACxE,CAAC;QACD,IAAI,OAAO,CAAC,GAAG,KAAK,cAAc,CAAC,QAAQ,EAAE,CAAC;YAC1C,MAAM,IAAI,KAAK,CAAC,qCAAqC,cAAc,CAAC,QAAQ,SAAS,OAAO,CAAC,GAAG,iCAAiC,CAAC,CAAC;QACvI,CAAC;QAED,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,4EAA4E,CAAC,CAAC;QAClG,CAAC;QAED,OAAO;YACH,WAAW,EAAE,UAAU,OAAO,CAAC,GAAG,EAAE;YACpC,UAAU,EAAE,QAAQ;YACpB,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,OAAO,EAAE,OAAO,CAAC,OAAO;SAC3B,CAAC;IACN,CAAC;IAED;;;;;;;;;;;;;;OAcG;IACK,KAAK,CAAC,qBAAqB,CAC/B,cAAuC,EACvC,IAAY,EACZ,WAAmB;QAEnB,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;YAC7B,SAAS,EAAE,cAAc,CAAC,QAAQ;YAClC,aAAa,EAAE,cAAc,CAAC,YAAY;YAC1C,IAAI;YACJ,YAAY,EAAE,WAAW;YACzB,UAAU,EAAE,oBAAoB;SACnC,CAAC,CAAC;QAEH,MAAM,OAAO,GAA2B;YACpC,cAAc,EAAE,mCAAmC;SACtD,CAAC;QAEF,gFAAgF;QAChF,IAAI,cAAc,CAAC,UAAU,KAAK,QAAQ,EAAE,CAAC;YACzC,OAAO,CAAC,QAAQ,CAAC,GAAG,kBAAkB,CAAC;QAC3C,CAAC;QAED,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,cAAc,CAAC,QAAQ,EAAE;YAC7C,MAAM,EAAE,MAAM;YACd,OAAO;YACP,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE;SACxB,CAAC,CAAC;QAEH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACV,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CAAC,+BAA+B,GAAG,CAAC,MAAM,MAAM,OAAO,EAAE,CAAC,CAAC;QAC9E,CAAC;QAED,OAAO,GAAG,CAAC,IAAI,EAAE,CAAC;IACtB,CAAC;IAED;;;;;;;;;;OAUG;IACK,KAAK,CAAC,2BAA2B,CACrC,cAAuC,EACvC,WAAmB;QAEnB,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,cAAc,CAAC,WAAW,EAAE;YAChD,OAAO,EAAE;gBACL,eAAe,EAAE,UAAU,WAAW,EAAE;gBACxC,YAAY,EAAE,sBAAsB,CAAC,iCAAiC;aACzE;SACJ,CAAC,CAAC;QAEH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACV,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CAAC,0CAA0C,GAAG,CAAC,MAAM,MAAM,OAAO,EAAE,CAAC,CAAC;QACzF,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAEjC,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;YACd,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;QACrE,CAAC;QAED,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAE/B,OAAO;YACH,WAAW,EAAE,UAAU,GAAG,EAAE;YAC5B,UAAU,EAAE,QAAQ;YACpB,GAAG;YACH,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,SAAS;YACjC,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,KAAK,IAAI,SAAS;YAChD,OAAO,EAAE,OAAO,CAAC,UAAU,IAAI,SAAS;SAC3C,CAAC;IACN,CAAC;IAED;;;;;;;;;;OAUG;IACI,KAAK,CAAC,SAAS,CAAC,KAAa,EAAE,cAAuC;QACzE,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;QAChE,CAAC;QAED,MAAM,CAAC,SAAS,EAAE,UAAU,EAAE,YAAY,CAAC,GAAG,KAAK,CAAC;QAEpD,+CAA+C;QAC/C,IAAI,MAAW,CAAC;QAChB,IAAI,CAAC;YACD,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;QAC/E,CAAC;QAAC,MAAM,CAAC;YACL,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;QACnD,CAAC;QAED,IAAI,MAAM,CAAC,GAAG,KAAK,OAAO,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CAAC,2CAA2C,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC;QAC7E,CAAC;QAED,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC;QACvB,IAAI,CAAC,GAAG,EAAE,CAAC;YACP,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;QACxD,CAAC;QAED,8BAA8B;QAC9B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,cAAc,CAAC,CAAC;QACpD,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC;QAC9C,IAAI,CAAC,GAAG,EAAE,CAAC;YACP,MAAM,IAAI,KAAK,CAAC,gCAAgC,GAAG,cAAc,CAAC,CAAC;QACvE,CAAC;QAED,uDAAuD;QACvD,MAAM,SAAS,GAAG,eAAe,CAAC;YAC9B,GAAG,EAAE,GAAU;YACf,MAAM,EAAE,KAAK;SAChB,CAAC,CAAC;QAEH,oDAAoD;QACpD,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC;QACzD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,SAAS,IAAI,UAAU,EAAE,CAAC,CAAC;QAEvD,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;QAC7D,IAAI,CAAC,OAAO,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;QACpE,CAAC;QAED,+BAA+B;QAC/B,IAAI,CAAC;YACD,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;QAC9E,CAAC;QAAC,MAAM,CAAC;YACL,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;QACpD,CAAC;IACL,CAAC;IAED;;;;;;OAMG;IACK,KAAK,CAAC,WAAW,CAAC,cAAuC;QAC7D,MAAM,UAAU,GAAG,cAAc,CAAC,UAAU,CAAC;QAC7C,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAE9C,IAAI,MAAM,IAAI,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YAC1C,OAAO,MAAM,CAAC,IAAI,CAAC;QACvB,CAAC;QAED,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CAAC,aAAa,UAAU,2DAA2D,CAAC,CAAC;QACxG,CAAC;QAED,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC;QAChD,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACV,MAAM,IAAI,KAAK,CAAC,6BAA6B,cAAc,CAAC,OAAO,UAAU,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC;QAChG,CAAC;QAED,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAiB,CAAC;QAChD,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1C,MAAM,IAAI,KAAK,CAAC,wCAAwC,cAAc,CAAC,OAAO,EAAE,CAAC,CAAC;QACtF,CAAC;QAED,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,UAAU,EAAE;YAC3B,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,SAAS;SACzC,CAAC,CAAC;QAEH,OAAO,IAAI,CAAC,IAAI,CAAC;IACrB,CAAC;IAED;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,0BAA0B,CAAC,WAAmB,EAAE,SAAiB;QACnE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC;YACpB,CAAC,EAAE,GAAG,WAAW,IAAI,SAAS,EAAE;YAChC,SAAS,EAAE,aAAa,CAAC,OAAO;SACnC,CAAC,CAAC;QACH,OAAO,MAAM,qBAAqB,CAAC;YAC/B,YAAY,EAAE,IAAI,CAAC,MAAM,CAAC,kBAAkB;YAC5C,IAAI;YACJ,MAAM,EAAE,IAAI;YACZ,SAAS,EAAE,aAAa,CAAC,OAAO;SACnC,CAAC,CAAC;IACP,CAAC;IAED;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,4BAA4B,CAC9B,WAAmB,EACnB,SAAiB;QAEjB,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,0BAA0B,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;QAEtF,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC;YACxB,CAAC,EAAE,GAAG,WAAW,IAAI,SAAS,OAAO;YACrC,SAAS,EAAE,aAAa,CAAC,OAAO;SACnC,CAAC,CAAC;QACH,MAAM,aAAa,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAEhD,MAAM,MAAM,GAAG,wBAAwB,CAAC;YACpC,EAAE,EAAE,wBAAwB;YAC5B,IAAI,EAAE,aAAa;SACtB,CAAC,CAAC;QACH,MAAM,CAAC,YAAY,GAAG,CAAC,oBAAoB,EAAE,oBAAoB,CAAC,CAAC;QAEnE,MAAM,QAAQ,GAAG,uBAAuB,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;QAC5D,MAAM,UAAU,GAAG,MAAM,QAAQ,CAAC,gBAAgB,CAAC,EAAE,YAAY,EAAE,eAAe,EAAE,CAAC,CAAC;QACtF,MAAM,UAAU,GAA0B,EAAE,CAAC;QAC7C,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC;QAExC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC;YAC5C,MAAM,WAAW,GAAG,MAAM,yBAAyB,CAAC;gBAChD,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,SAAS;gBACT,KAAK,EAAE,CAAC;aACX,CAAC,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,gBAAgB,CAAC;gBAC7C,UAAU;gBACV,MAAM,EAAE,MAAM,CAAC,EAAE;gBACjB,WAAW;aACd,CAAC,CAAC;YACH,UAAU,CAAC,WAAW,CAAC,GAAG,MAAM,QAAQ,CAAC,iBAAiB,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC;QAC7E,CAAC;QAED,OAAO;YACH,EAAE,EAAE,wBAAwB;YAC5B,MAAM;YACN,UAAU;YACV,SAAS,EAAE,IAAI;YACf,QAAQ,EAAE;gBACN,KAAK,EAAE,WAAW;gBAClB,WAAW;aACd;SACJ,CAAC;IACN,CAAC;IAED;;;;;;OAMG;IACH,mBAAmB,CAAC,OAAe;QAC/B,MAAM,OAAO,GAA8B,EAAE,CAAC;QAE9C,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC;YAC/B,OAAO,CAAC,IAAI,CAAC;gBACT,UAAU,EAAE,QAAQ;gBACpB,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,QAAQ;gBAC/C,OAAO,EAAE,8CAA8C;gBACvD,WAAW,EAAE,GAAG,OAAO,GAAG;gBAC1B,KAAK,EAAE,sBAAsB;aAChC,CAAC,CAAC;QACP,CAAC;QAED,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC;YAC/B,OAAO,CAAC,IAAI,CAAC;gBACT,UAAU,EAAE,QAAQ;gBACpB,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,QAAQ;gBAC/C,OAAO,EAAE,0CAA0C;gBACnD,WAAW,EAAE,GAAG,OAAO,GAAG;gBAC1B,KAAK,EAAE,sBAAsB;aAChC,CAAC,CAAC;QACP,CAAC;QAED,OAAO,OAAO,CAAC;IACnB,CAAC;CACJ"}
+{"version":3,"file":"sso-custodian-service.mjs","sourceRoot":"","sources":["../../../src/identity/sso/sso-custodian-service.mts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,iDAAiD,CAAC;AACvG,OAAO,EAAE,qBAAqB,EAAE,MAAM,mDAAmD,CAAC;AAC1F,OAAO,EAAE,kBAAkB,EAAE,MAAM,uDAAuD,CAAC;AAG3F,OAAO,EAA4B,oBAAoB,EAAE,oBAAoB,EAAE,cAAc,EAAE,uBAAuB,EAAE,MAAM,sDAAsD,CAAC;AAErL,OAAO,EAAE,yBAAyB,EAAE,MAAM,oDAAoD,CAAC;AAC/F,OAAO,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AAyB/G;;GAEG;AACH,MAAM,OAAO,mBAAmB;IAYR;IAXZ,EAAE,GAAG,IAAI,mBAAmB,CAAC,IAAI,GAAG,CAAC;IAE7C,4DAA4D;IACpD,SAAS,GAA8D,IAAI,GAAG,EAAE,CAAC;IACjF,SAAS,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,2BAA2B;IAEpE;;;;OAIG;IACH,YAAoB,MAAuB;QAAvB,WAAM,GAAN,MAAM,CAAiB;IAAG,CAAC;IAE/C;;;;;;;;;;;;;;OAcG;IACH,KAAK,CAAC,gBAAgB,CAAC,UAAyB,EAAE,IAAY,EAAE,WAAmB;QAC/E,MAAM,EAAE,GAAG,GAAG,IAAI,CAAC,EAAE,IAAI,IAAI,CAAC,gBAAgB,CAAC,IAAI,GAAG,CAAC;QACvD,MAAM,cAAc,GAAG,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;QACzD,IAAI,CAAC,cAAc,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CAAC,aAAa,UAAU,mEAAmE,CAAC,CAAC;QAChH,CAAC;QAED,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,kCAAkC,UAAU,EAAE,CAAC,CAAC;QAEjE,4CAA4C;QAC5C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,cAAc,EAAE,IAAI,EAAE,WAAW,CAAC,CAAC;QAEnF,sCAAsC;QACtC,IAAI,UAAU,KAAK,QAAQ,EAAE,CAAC;YAC1B,iEAAiE;YACjE,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;gBACnB,MAAM,IAAI,KAAK,CAAC,8EAA8E,CAAC,CAAC;YACpG,CAAC;YACD,OAAO,IAAI,CAAC,6BAA6B,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC/D,CAAC;aAAM,IAAI,UAAU,KAAK,QAAQ,EAAE,CAAC;YACjC,+DAA+D;YAC/D,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC;gBACvB,MAAM,IAAI,KAAK,CAAC,kFAAkF,CAAC,CAAC;YACxG,CAAC;YACD,OAAO,IAAI,CAAC,2BAA2B,CAAC,cAAc,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC;QACjF,CAAC;QAED,MAAM,IAAI,KAAK,CAAC,yBAAyB,UAAU,iCAAiC,CAAC,CAAC;IAC1F,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,6BAA6B,CAAC,OAAe;QAC/C,MAAM,EAAE,GAAG,GAAG,IAAI,CAAC,EAAE,IAAI,IAAI,CAAC,6BAA6B,CAAC,IAAI,GAAG,CAAC;QACpE,MAAM,cAAc,GAAG,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC;QACpD,IAAI,CAAC,cAAc,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAC;QACxF,CAAC;QAED,0CAA0C;QAC1C,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;QAE9D,gBAAgB;QAChB,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QACjD,IAAI,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,GAAG,UAAU,EAAE,CAAC;YAC1C,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;QACxE,CAAC;QACD,IAAI,OAAO,CAAC,GAAG,KAAK,cAAc,CAAC,QAAQ,EAAE,CAAC;YAC1C,MAAM,IAAI,KAAK,CAAC,qCAAqC,cAAc,CAAC,QAAQ,SAAS,OAAO,CAAC,GAAG,iCAAiC,CAAC,CAAC;QACvI,CAAC;QAED,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,4EAA4E,CAAC,CAAC;QAClG,CAAC;QAED,OAAO;YACH,WAAW,EAAE,UAAU,OAAO,CAAC,GAAG,EAAE;YACpC,UAAU,EAAE,QAAQ;YACpB,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,OAAO,EAAE,OAAO,CAAC,OAAO;SAC3B,CAAC;IACN,CAAC;IAED;;;;;;;;;;;;;;OAcG;IACK,KAAK,CAAC,qBAAqB,CAC/B,cAAuC,EACvC,IAAY,EACZ,WAAmB;QAEnB,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;YAC7B,SAAS,EAAE,cAAc,CAAC,QAAQ;YAClC,aAAa,EAAE,cAAc,CAAC,YAAY;YAC1C,IAAI;YACJ,YAAY,EAAE,WAAW;YACzB,UAAU,EAAE,oBAAoB;SACnC,CAAC,CAAC;QAEH,MAAM,OAAO,GAA2B;YACpC,cAAc,EAAE,mCAAmC;SACtD,CAAC;QAEF,gFAAgF;QAChF,IAAI,cAAc,CAAC,UAAU,KAAK,QAAQ,EAAE,CAAC;YACzC,OAAO,CAAC,QAAQ,CAAC,GAAG,kBAAkB,CAAC;QAC3C,CAAC;QAED,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,cAAc,CAAC,QAAQ,EAAE;YAC7C,MAAM,EAAE,MAAM;YACd,OAAO;YACP,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE;SACxB,CAAC,CAAC;QAEH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACV,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CAAC,+BAA+B,GAAG,CAAC,MAAM,MAAM,OAAO,EAAE,CAAC,CAAC;QAC9E,CAAC;QAED,OAAO,GAAG,CAAC,IAAI,EAAE,CAAC;IACtB,CAAC;IAED;;;;;;;;;;OAUG;IACK,KAAK,CAAC,2BAA2B,CACrC,cAAuC,EACvC,WAAmB;QAEnB,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,cAAc,CAAC,WAAW,EAAE;YAChD,OAAO,EAAE;gBACL,eAAe,EAAE,UAAU,WAAW,EAAE;gBACxC,YAAY,EAAE,sBAAsB,CAAC,iCAAiC;aACzE;SACJ,CAAC,CAAC;QAEH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACV,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CAAC,0CAA0C,GAAG,CAAC,MAAM,MAAM,OAAO,EAAE,CAAC,CAAC;QACzF,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAEjC,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;YACd,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;QACrE,CAAC;QAED,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAE/B,OAAO;YACH,WAAW,EAAE,UAAU,GAAG,EAAE;YAC5B,UAAU,EAAE,QAAQ;YACpB,GAAG;YACH,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,SAAS;YACjC,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,KAAK,IAAI,SAAS;YAChD,OAAO,EAAE,OAAO,CAAC,UAAU,IAAI,SAAS;SAC3C,CAAC;IACN,CAAC;IAED;;;;;;;;;;OAUG;IACI,KAAK,CAAC,SAAS,CAAC,KAAa,EAAE,cAAuC;QACzE,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;QAChE,CAAC;QAED,MAAM,CAAC,SAAS,EAAE,UAAU,EAAE,YAAY,CAAC,GAAG,KAAK,CAAC;QAEpD,+CAA+C;QAC/C,IAAI,MAAW,CAAC;QAChB,IAAI,CAAC;YACD,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;QAC/E,CAAC;QAAC,MAAM,CAAC;YACL,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;QACnD,CAAC;QAED,IAAI,MAAM,CAAC,GAAG,KAAK,OAAO,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CAAC,2CAA2C,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC;QAC7E,CAAC;QAED,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC;QACvB,IAAI,CAAC,GAAG,EAAE,CAAC;YACP,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;QACxD,CAAC;QAED,8BAA8B;QAC9B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,cAAc,CAAC,CAAC;QACpD,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC;QAC9C,IAAI,CAAC,GAAG,EAAE,CAAC;YACP,MAAM,IAAI,KAAK,CAAC,gCAAgC,GAAG,cAAc,CAAC,CAAC;QACvE,CAAC;QAED,uDAAuD;QACvD,MAAM,SAAS,GAAG,eAAe,CAAC;YAC9B,GAAG,EAAE,GAAU;YACf,MAAM,EAAE,KAAK;SAChB,CAAC,CAAC;QAEH,oDAAoD;QACpD,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC;QACzD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,SAAS,IAAI,UAAU,EAAE,CAAC,CAAC;QAEvD,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;QAC7D,IAAI,CAAC,OAAO,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;QACpE,CAAC;QAED,+BAA+B;QAC/B,IAAI,CAAC;YACD,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;QAC9E,CAAC;QAAC,MAAM,CAAC;YACL,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;QACpD,CAAC;IACL,CAAC;IAED;;;;;;OAMG;IACK,KAAK,CAAC,WAAW,CAAC,cAAuC;QAC7D,MAAM,UAAU,GAAG,cAAc,CAAC,UAAU,CAAC;QAC7C,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAE9C,IAAI,MAAM,IAAI,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YAC1C,OAAO,MAAM,CAAC,IAAI,CAAC;QACvB,CAAC;QAED,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CAAC,aAAa,UAAU,2DAA2D,CAAC,CAAC;QACxG,CAAC;QAED,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC;QAChD,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACV,MAAM,IAAI,KAAK,CAAC,6BAA6B,cAAc,CAAC,OAAO,UAAU,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC;QAChG,CAAC;QAED,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAiB,CAAC;QAChD,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1C,MAAM,IAAI,KAAK,CAAC,wCAAwC,cAAc,CAAC,OAAO,EAAE,CAAC,CAAC;QACtF,CAAC;QAED,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,UAAU,EAAE;YAC3B,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,SAAS;SACzC,CAAC,CAAC;QAEH,OAAO,IAAI,CAAC,IAAI,CAAC;IACrB,CAAC;IAED;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,0BAA0B,CAAC,WAAmB,EAAE,SAAiB;QACnE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC;YACpB,CAAC,EAAE,GAAG,WAAW,IAAI,SAAS,EAAE;YAChC,SAAS,EAAE,aAAa,CAAC,OAAO;SACnC,CAAC,CAAC;QACH,OAAO,MAAM,qBAAqB,CAAC;YAC/B,YAAY,EAAE,IAAI,CAAC,MAAM,CAAC,kBAAkB;YAC5C,IAAI;YACJ,MAAM,EAAE,IAAI;YACZ,SAAS,EAAE,aAAa,CAAC,OAAO;SACnC,CAAC,CAAC;IACP,CAAC;IAED;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,4BAA4B,CAAC,EAC/B,UAAU,EACV,WAAW,EACX,SAAS,EACT,YAAY,EACZ,SAAS,EACT,KAAK,GAQR;QACG,2BAA2B;QAC3B,MAAM,eAAe,GAAG,IAAI,kBAAkB,EAAE,CAAC;QACjD,MAAM,cAAc,GAAG,MAAM,eAAe,CAAC,iBAAiB,CAAC;YAC3D,IAAI,EAAE,YAAY;YAClB,SAAS;YACT,KAAK;SACR,CAAC,CAAC;QAEH,IAAI,CAAC,cAAc,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CAAC,mCAAmC,YAAY,wCAAwC,CAAC,CAAC;QAC7G,CAAC;QAED,+BAA+B;QAC/B,MAAM,cAAc,GAAG,cAAc,CAAC,IAAI,EAAE,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,cAAc,CAAC,CAAC;QAC9F,IAAI,CAAC,cAAc,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CAAC,gJAAgJ,CAAC,CAAC;QACtK,CAAC;QAED,8DAA8D;QAC9D,IAAI,CAAC,UAAU,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;YAC3D,MAAM,IAAI,KAAK,CAAC,wBAAwB,UAAU,iBAAiB,uBAAuB,sCAAsC,CAAC,CAAC;QACtI,CAAC;QACD,MAAM,MAAM,GAAG,oBAAoB,UAAU,EAAE,CAAC;QAEhD,6BAA6B;QAC7B,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,0BAA0B,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;QAEtF,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC;YACxB,CAAC,EAAE,GAAG,WAAW,IAAI,SAAS,OAAO;YACrC,SAAS,EAAE,aAAa,CAAC,OAAO;SACnC,CAAC,CAAC;QACH,MAAM,aAAa,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAEhD,+EAA+E;QAC/E,MAAM,MAAM,GAAuB;YAC/B,GAAG,cAAc,CAAC,MAAM;YACxB,EAAE,EAAE,MAAM;YACV,IAAI,EAAE,aAAa;YACnB,YAAY,EAAE,CAAC,oBAAoB,EAAE,oBAAoB,CAAC;SAC7D,CAAC;QAEF,MAAM,QAAQ,GAAG,uBAAuB,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;QAC5D,MAAM,UAAU,GAAG,MAAM,QAAQ,CAAC,gBAAgB,CAAC,EAAE,YAAY,EAAE,eAAe,EAAE,CAAC,CAAC;QACtF,MAAM,UAAU,GAA0B,EAAE,CAAC;QAC7C,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC;QAExC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC;YAC5C,MAAM,WAAW,GAAG,MAAM,yBAAyB,CAAC;gBAChD,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,SAAS;gBACT,KAAK,EAAE,CAAC;aACX,CAAC,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,gBAAgB,CAAC;gBAC7C,UAAU;gBACV,MAAM,EAAE,MAAM,CAAC,EAAE;gBACjB,WAAW;aACd,CAAC,CAAC;YACH,UAAU,CAAC,WAAW,CAAC,GAAG,MAAM,QAAQ,CAAC,iBAAiB,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC;QAC7E,CAAC;QAED,OAAO;YACH,EAAE,EAAE,MAAM;YACV,MAAM;YACN,UAAU;YACV,SAAS,EAAE,IAAI;YACf,QAAQ,EAAE;gBACN,KAAK,EAAE,WAAW;gBAClB,WAAW;aACd;SACJ,CAAC;IACN,CAAC;IAED;;;;;;OAMG;IACH,mBAAmB,CAAC,OAAe;QAC/B,MAAM,OAAO,GAA8B,EAAE,CAAC;QAE9C,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC;YAC/B,OAAO,CAAC,IAAI,CAAC;gBACT,UAAU,EAAE,QAAQ;gBACpB,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,QAAQ;gBAC/C,OAAO,EAAE,8CAA8C;gBACvD,WAAW,EAAE,GAAG,OAAO,GAAG;gBAC1B,KAAK,EAAE,sBAAsB;aAChC,CAAC,CAAC;QACP,CAAC;QAED,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC;YAC/B,OAAO,CAAC,IAAI,CAAC;gBACT,UAAU,EAAE,QAAQ;gBACpB,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,QAAQ;gBAC/C,OAAO,EAAE,0CAA0C;gBACnD,WAAW,EAAE,GAAG,OAAO,GAAG;gBAC1B,KAAK,EAAE,sBAAsB;aAChC,CAAC,CAAC;QACP,CAAC;QAED,OAAO,OAAO,CAAC;IACnB,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,WAAW,CAAC,UAAyB,EAAE,KAAa;QACtD,MAAM,EAAE,GAAG,GAAG,IAAI,CAAC,EAAE,IAAI,IAAI,CAAC,WAAW,CAAC,IAAI,GAAG,CAAC;QAClD,MAAM,cAAc,GAAG,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;QACzD,IAAI,CAAC,cAAc,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CAAC,iBAAiB,UAAU,oDAAoD,CAAC,CAAC;QACrG,CAAC;QAED,IAAI,CAAC;YACD,IAAI,UAAU,KAAK,QAAQ,EAAE,CAAC;gBAC1B,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,8CAA8C,kBAAkB,CAAC,KAAK,CAAC,EAAE,EAAE;oBAC/F,MAAM,EAAE,MAAM;oBACd,OAAO,EAAE;wBACL,cAAc,EAAE,mCAAmC;qBACtD;iBACJ,CAAC,CAAC;gBACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;oBACV,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;oBAC9B,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,4CAA4C,GAAG,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC,CAAC;gBACzF,CAAC;YACL,CAAC;iBAAM,IAAI,UAAU,KAAK,QAAQ,EAAE,CAAC;gBACjC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,cAAc,CAAC,QAAQ,IAAI,cAAc,CAAC,YAAY,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;gBACzG,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,uCAAuC,cAAc,CAAC,QAAQ,QAAQ,EAAE;oBAC5F,MAAM,EAAE,QAAQ;oBAChB,OAAO,EAAE;wBACL,eAAe,EAAE,SAAS,IAAI,EAAE;wBAChC,QAAQ,EAAE,gCAAgC;wBAC1C,YAAY,EAAE,kBAAkB;qBACnC;oBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC;iBAChD,CAAC,CAAC;gBACH,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;oBAChC,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;oBAC9B,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,4CAA4C,GAAG,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC,CAAC;gBACzF,CAAC;YACL,CAAC;iBAAM,CAAC;gBACJ,MAAM,IAAI,KAAK,CAAC,yBAAyB,UAAU,gCAAgC,CAAC,CAAC;YACzF,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,yCAAyC,UAAU,KAAK,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACzG,CAAC;IACL,CAAC;CACJ"}

package/dist/identity/sso/sso-custodian-service.respec.mjs

@@ -1,7 +1,8 @@
 import { generateKeyPairSync, createSign } from 'node:crypto';
 import { respecfully, ifWeMight, iReckon, firstOfAll, lastOfAll } from '@ibgib/helper-gib/dist/respec-gib/respec-gib.mjs';
 import { SsoCustodianService } from './sso-custodian-service.mjs';
-import { POOL_ID_CUSTODIAN_MANAGE } from '@ibgib/core-gib/dist/keystone/keystone-constants.mjs';
+import { POOL_ID_MANAGE } from '@ibgib/core-gib/dist/keystone/keystone-constants.mjs';
+import { createStandardPoolConfig } from '@ibgib/core-gib/dist/keystone/keystone-config-builder.mjs';
 const maam = `[${import.meta.url}]`, sir = maam;
 await respecfully(sir, 'SsoCustodianService', async () => {
     let mockPrivateKey;
@@ -154,14 +155,100 @@ await respecfully(sir, 'SsoCustodianService', async () => {
         const service = new SsoCustodianService(config);
         const key = 'google:123456789';
         const nonce = 'nonce-abc-123';
-        const custodianPool = await service.createCustodianChallengePool(key, nonce);
+        // 1. Create a mock target keystone containing a 'manage' pool
+        const userManageConfig = createStandardPoolConfig({
+            id: POOL_ID_MANAGE,
+            salt: 'user-manage-salt'
+        });
+        userManageConfig.behavior.size = 12; // custom size for verification
+        const mockTargetKeystone = {
+            ib: 'keystone^some-tjp-addr',
+            gib: 'some-gib-value',
+            data: {
+                challengePools: [
+                    {
+                        id: 'manage',
+                        config: userManageConfig,
+                        challenges: { 'chal1': 'val1' }
+                    }
+                ],
+                n: 0
+            }
+        };
+        // 2. Mock metaspace and space calls
+        const mockSpace = {};
+        const mockMetaspace = {
+            getLatestAddr: async () => 'latest-keystone-addr',
+            get: async () => ({
+                success: true,
+                ibGibs: [mockTargetKeystone]
+            })
+        };
+        const custodianPool = await service.createCustodianChallengePool({
+            providerId: 'google',
+            providerKey: key,
+            userNonce: nonce,
+            keystoneAddr: 'some-tjp-addr',
+            metaspace: mockMetaspace,
+            space: mockSpace
+        });
         iReckon(sir, custodianPool).not.isGonnaBeUndefined();
-        iReckon(sir, custodianPool.id).willEqual(POOL_ID_CUSTODIAN_MANAGE);
+        iReckon(sir, custodianPool.id).willEqual('custodian-manage-google');
         iReckon(sir, custodianPool.isForeign).isGonnaBeTrue();
         iReckon(sir, custodianPool.metadata?.providerKey).willEqual(key);
+        // Replicated behavior size from parent manage pool config
+        iReckon(sir, custodianPool.config.behavior.size).willEqual(userManageConfig.behavior.size);
         // Structural validation of challenges
         const challengesCount = Object.keys(custodianPool.challenges).length;
         iReckon(sir, challengesCount).willEqual(custodianPool.config.behavior.size);
     });
+    await ifWeMight(sir, 'revoke tokens successfully, making the correct http fetch calls', async () => {
+        const config = {
+            ssoServerKdfSecret: 'high-entropy-server-kdf-secret',
+            sessionSecret: 'session-secret-123',
+            providers: {
+                google: {
+                    providerId: 'google',
+                    clientId: 'google-client-id-abc',
+                    clientSecret: 'google-client-secret-abc',
+                    tokenUrl: 'https://oauth2.googleapis.com/token',
+                    userInfoUrl: 'https://openidconnect.googleapis.com/v1/userinfo'
+                },
+                github: {
+                    providerId: 'github',
+                    clientId: 'github-client-id-xyz',
+                    clientSecret: 'github-client-secret-xyz',
+                    tokenUrl: 'https://github.com/login/oauth/access_token',
+                    userInfoUrl: 'https://api.github.com/user'
+                }
+            }
+        };
+        const service = new SsoCustodianService(config);
+        const originalFetch = globalThis.fetch;
+        let fetchCalls = [];
+        globalThis.fetch = (async (url, options) => {
+            fetchCalls.push({ url, options });
+            return {
+                ok: true,
+                status: 200,
+                text: async () => 'ok'
+            };
+        });
+        try {
+            // Revoke Google token
+            await service.revokeToken('google', 'google-test-token-123');
+            iReckon(sir, fetchCalls.length).willEqual(1);
+            iReckon(sir, fetchCalls[0].url).includes('google-test-token-123');
+            // Revoke GitHub token
+            await service.revokeToken('github', 'github-test-token-456');
+            iReckon(sir, fetchCalls.length).willEqual(2);
+            iReckon(sir, fetchCalls[1].url).includes('/applications/github-client-id-xyz/grant');
+            iReckon(sir, fetchCalls[1].options.method).willEqual('DELETE');
+            iReckon(sir, fetchCalls[1].options.headers['Authorization']).includes('Basic');
+        }
+        finally {
+            globalThis.fetch = originalFetch;
+        }
+    });
 });
 //# sourceMappingURL=sso-custodian-service.respec.mjs.map

package/dist/identity/sso/sso-custodian-service.respec.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"sso-custodian-service.respec.mjs","sourceRoot":"","sources":["../../../src/identity/sso/sso-custodian-service.respec.mts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAC9D,OAAO,EACH,WAAW,EACX,SAAS,EACT,OAAO,EACP,UAAU,EACV,SAAS,EACZ,MAAM,kDAAkD,CAAC;AAC1D,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAElE,OAAO,EAAE,wBAAwB,EAAE,MAAM,sDAAsD,CAAC;AAEhG,MAAM,IAAI,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,GAAG,EAAE,GAAG,GAAG,IAAI,CAAC;AAEhD,MAAM,WAAW,CAAC,GAAG,EAAE,qBAAqB,EAAE,KAAK,IAAI,EAAE;IACrD,IAAI,cAAmB,CAAC;IACxB,IAAI,gBAAqB,CAAC;IAC1B,IAAI,aAAkB,CAAC;IAEvB,UAAU,CAAC,GAAG,EAAE,KAAK,IAAI,EAAE;QACvB,6BAA6B;QAC7B,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,mBAAmB,CAAC,KAAK,EAAE;YACzD,aAAa,EAAE,IAAI;SACtB,CAAC,CAAC;QACH,cAAc,GAAG,UAAU,CAAC;QAE5B,2BAA2B;QAC3B,gBAAgB,GAAG,SAAS,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QACvD,gBAAgB,CAAC,GAAG,GAAG,cAAc,CAAC;QACtC,gBAAgB,CAAC,GAAG,GAAG,OAAO,CAAC;QAC/B,gBAAgB,CAAC,GAAG,GAAG,KAAK,CAAC;QAE7B,kEAAkE;QAClE,aAAa,GAAI,UAAkB,CAAC,KAAK,CAAC;QACzC,UAAkB,CAAC,KAAK,GAAG,KAAK,EAAE,GAAW,EAAE,OAAa,EAAE,EAAE;YAC7D,IAAI,GAAG,KAAK,4CAA4C,EAAE,CAAC;gBACvD,OAAO;oBACH,EAAE,EAAE,IAAI;oBACR,MAAM,EAAE,GAAG;oBACX,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;wBACf,IAAI,EAAE,CAAC,gBAAgB,CAAC;qBAC3B,CAAC;iBACE,CAAC;YACb,CAAC;YACD,OAAO;gBACH,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,GAAG;gBACX,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC,WAAW;aACzB,CAAC;QACb,CAAC,CAAC;IACN,CAAC,CAAC,CAAC;IAEH,SAAS,CAAC,GAAG,EAAE,KAAK,IAAI,EAAE;QACtB,uBAAuB;QACvB,IAAI,aAAa,EAAE,CAAC;YACf,UAAkB,CAAC,KAAK,GAAG,aAAa,CAAC;QAC9C,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,MAAM,SAAS,CAAC,GAAG,EAAE,qDAAqD,EAAE,KAAK,IAAI,EAAE;QACnF,MAAM,MAAM,GAAoB;YAC5B,kBAAkB,EAAE,iBAAiB;YACrC,aAAa,EAAE,qBAAqB;YACpC,SAAS,EAAE;gBACP,MAAM,EAAE;oBACJ,UAAU,EAAE,QAAQ;oBACpB,QAAQ,EAAE,sBAAsB;oBAChC,YAAY,EAAE,0BAA0B;oBACxC,QAAQ,EAAE,qCAAqC;oBAC/C,WAAW,EAAE,kDAAkD;oBAC/D,OAAO,EAAE,4CAA4C;iBACxD;aACJ;SACJ,CAAC;QAEF,MAAM,OAAO,GAAG,IAAI,mBAAmB,CAAC,MAAM,CAAC,CAAC;QAEhD,gCAAgC;QAChC,MAAM,MAAM,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,cAAc,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;QACjE,MAAM,OAAO,GAAG;YACZ,GAAG,EAAE,cAAc;YACnB,KAAK,EAAE,kBAAkB;YACzB,IAAI,EAAE,UAAU;YAChB,GAAG,EAAE,sBAAsB;YAC3B,GAAG,EAAE,6BAA6B;YAClC,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,oBAAoB;SACjE,CAAC;QAEF,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QAC5E,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QAC9E,MAAM,IAAI,GAAG,GAAG,SAAS,IAAI,UAAU,EAAE,CAAC;QAE1C,gCAAgC;QAChC,MAAM,IAAI,GAAG,UAAU,CAAC,YAAY,CAAC,CAAC;QACtC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAClB,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;QAE5D,MAAM,YAAY,GAAG,GAAG,IAAI,IAAI,YAAY,EAAE,CAAC;QAE/C,kCAAkC;QAClC,MAAM,cAAc,GAAG,MAAM,OAAO,CAAC,SAAS,CAAC,YAAY,EAAE,MAAM,CAAC,SAAS,CAAC,MAAO,CAAC,CAAC;QAEvF,OAAO,CAAC,GAAG,EAAE,cAAc,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC;QAC3D,OAAO,CAAC,GAAG,EAAE,cAAc,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC;QACjE,OAAO,CAAC,GAAG,EAAE,cAAc,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;IAEH,MAAM,SAAS,CAAC,GAAG,EAAE,8CAA8C,EAAE,KAAK,IAAI,EAAE;QAC5E,MAAM,MAAM,GAAoB;YAC5B,kBAAkB,EAAE,iBAAiB;YACrC,aAAa,EAAE,qBAAqB;YACpC,SAAS,EAAE;gBACP,MAAM,EAAE;oBACJ,UAAU,EAAE,QAAQ;oBACpB,QAAQ,EAAE,sBAAsB;oBAChC,YAAY,EAAE,0BAA0B;oBACxC,QAAQ,EAAE,qCAAqC;oBAC/C,WAAW,EAAE,kDAAkD;oBAC/D,OAAO,EAAE,4CAA4C;iBACxD;aACJ;SACJ,CAAC;QAEF,MAAM,OAAO,GAAG,IAAI,mBAAmB,CAAC,MAAM,CAAC,CAAC;QAEhD,MAAM,MAAM,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,cAAc,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;QACjE,MAAM,OAAO,GAAG;YACZ,GAAG,EAAE,cAAc;YACnB,GAAG,EAAE,sBAAsB;YAC3B,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI;SAC5C,CAAC;QAEF,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QAC5E,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QAC9E,MAAM,IAAI,GAAG,GAAG,SAAS,IAAI,UAAU,EAAE,CAAC;QAE1C,0DAA0D;QAC1D,MAAM,EAAE,UAAU,EAAE,aAAa,EAAE,GAAG,mBAAmB,CAAC,KAAK,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1F,MAAM,IAAI,GAAG,UAAU,CAAC,YAAY,CAAC,CAAC;QACtC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAClB,MAAM,eAAe,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC;QAE9D,MAAM,WAAW,GAAG,GAAG,IAAI,IAAI,eAAe,EAAE,CAAC;QAEjD,IAAI,WAAgB,CAAC;QACrB,IAAI,CAAC;YACD,MAAM,OAAO,CAAC,SAAS,CAAC,WAAW,EAAE,MAAM,CAAC,SAAS,CAAC,MAAO,CAAC,CAAC;QACnE,CAAC;QAAC,OAAO,KAAU,EAAE,CAAC;YAClB,WAAW,GAAG,KAAK,CAAC;QACxB,CAAC;QAED,OAAO,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC,GAAG,CAAC,kBAAkB,EAAE,CAAC;QACnD,OAAO,CAAC,GAAG,EAAE,WAAW,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,6CAA6C,CAAC,CAAC;IAC9F,CAAC,CAAC,CAAC;IAEH,MAAM,SAAS,CAAC,GAAG,EAAE,iDAAiD,EAAE,KAAK,IAAI,EAAE;QAC/E,MAAM,MAAM,GAAoB;YAC5B,kBAAkB,EAAE,gCAAgC;YACpD,aAAa,EAAE,oBAAoB;YACnC,SAAS,EAAE,EAAE;SAChB,CAAC;QACF,MAAM,OAAO,GAAG,IAAI,mBAAmB,CAAC,MAAM,CAAC,CAAC;QAEhD,MAAM,GAAG,GAAG,kBAAkB,CAAC;QAC/B,MAAM,MAAM,GAAG,eAAe,CAAC;QAC/B,MAAM,MAAM,GAAG,eAAe,CAAC;QAE/B,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,0BAA0B,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QACxE,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,0BAA0B,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QACxE,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,0BAA0B,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QAEtE,gDAAgD;QAChD,OAAO,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;QAC7C,gDAAgD;QAChD,OAAO,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QAC/C,wDAAwD;QACxD,OAAO,CAAC,GAAG,EAAE,OAAO,SAAS,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QACnD,OAAO,CAAC,GAAG,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,mCAAmC;IACtF,CAAC,CAAC,CAAC;IAEH,MAAM,SAAS,CAAC,GAAG,EAAE,8CAA8C,EAAE,KAAK,IAAI,EAAE;QAC5E,MAAM,MAAM,GAAoB;YAC5B,kBAAkB,EAAE,gCAAgC;YACpD,aAAa,EAAE,oBAAoB;YACnC,SAAS,EAAE,EAAE;SAChB,CAAC;QACF,MAAM,OAAO,GAAG,IAAI,mBAAmB,CAAC,MAAM,CAAC,CAAC;QAEhD,MAAM,GAAG,GAAG,kBAAkB,CAAC;QAC/B,MAAM,KAAK,GAAG,eAAe,CAAC;QAE9B,MAAM,aAAa,GAAG,MAAM,OAAO,CAAC,4BAA4B,CAC5D,GAAG,EACH,KAAK,CACR,CAAC;QAEF,OAAO,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC,GAAG,CAAC,kBAAkB,EAAE,CAAC;QACrD,OAAO,CAAC,GAAG,EAAE,aAAa,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC,wBAAwB,CAAC,CAAC;QACnE,OAAO,CAAC,GAAG,EAAE,aAAa,CAAC,SAAS,CAAC,CAAC,aAAa,EAAE,CAAC;QACtD,OAAO,CAAC,GAAG,EAAE,aAAa,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QAEjE,sCAAsC;QACtC,MAAM,eAAe,GAAG,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC;QACrE,OAAO,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC,SAAS,CAAC,aAAa,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAChF,CAAC,CAAC,CAAC;AACP,CAAC,CAAC,CAAC"}
+{"version":3,"file":"sso-custodian-service.respec.mjs","sourceRoot":"","sources":["../../../src/identity/sso/sso-custodian-service.respec.mts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAC9D,OAAO,EACH,WAAW,EACX,SAAS,EACT,OAAO,EACP,UAAU,EACV,SAAS,EACZ,MAAM,kDAAkD,CAAC;AAC1D,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAElE,OAAO,EAA4B,cAAc,EAAE,MAAM,sDAAsD,CAAC;AAChH,OAAO,EAAE,wBAAwB,EAAE,MAAM,2DAA2D,CAAC;AAErG,MAAM,IAAI,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,GAAG,EAAE,GAAG,GAAG,IAAI,CAAC;AAEhD,MAAM,WAAW,CAAC,GAAG,EAAE,qBAAqB,EAAE,KAAK,IAAI,EAAE;IACrD,IAAI,cAAmB,CAAC;IACxB,IAAI,gBAAqB,CAAC;IAC1B,IAAI,aAAkB,CAAC;IAEvB,UAAU,CAAC,GAAG,EAAE,KAAK,IAAI,EAAE;QACvB,6BAA6B;QAC7B,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,mBAAmB,CAAC,KAAK,EAAE;YACzD,aAAa,EAAE,IAAI;SACtB,CAAC,CAAC;QACH,cAAc,GAAG,UAAU,CAAC;QAE5B,2BAA2B;QAC3B,gBAAgB,GAAG,SAAS,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QACvD,gBAAgB,CAAC,GAAG,GAAG,cAAc,CAAC;QACtC,gBAAgB,CAAC,GAAG,GAAG,OAAO,CAAC;QAC/B,gBAAgB,CAAC,GAAG,GAAG,KAAK,CAAC;QAE7B,kEAAkE;QAClE,aAAa,GAAI,UAAkB,CAAC,KAAK,CAAC;QACzC,UAAkB,CAAC,KAAK,GAAG,KAAK,EAAE,GAAW,EAAE,OAAa,EAAE,EAAE;YAC7D,IAAI,GAAG,KAAK,4CAA4C,EAAE,CAAC;gBACvD,OAAO;oBACH,EAAE,EAAE,IAAI;oBACR,MAAM,EAAE,GAAG;oBACX,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;wBACf,IAAI,EAAE,CAAC,gBAAgB,CAAC;qBAC3B,CAAC;iBACE,CAAC;YACb,CAAC;YACD,OAAO;gBACH,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,GAAG;gBACX,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC,WAAW;aACzB,CAAC;QACb,CAAC,CAAC;IACN,CAAC,CAAC,CAAC;IAEH,SAAS,CAAC,GAAG,EAAE,KAAK,IAAI,EAAE;QACtB,uBAAuB;QACvB,IAAI,aAAa,EAAE,CAAC;YACf,UAAkB,CAAC,KAAK,GAAG,aAAa,CAAC;QAC9C,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,MAAM,SAAS,CAAC,GAAG,EAAE,qDAAqD,EAAE,KAAK,IAAI,EAAE;QACnF,MAAM,MAAM,GAAoB;YAC5B,kBAAkB,EAAE,iBAAiB;YACrC,aAAa,EAAE,qBAAqB;YACpC,SAAS,EAAE;gBACP,MAAM,EAAE;oBACJ,UAAU,EAAE,QAAQ;oBACpB,QAAQ,EAAE,sBAAsB;oBAChC,YAAY,EAAE,0BAA0B;oBACxC,QAAQ,EAAE,qCAAqC;oBAC/C,WAAW,EAAE,kDAAkD;oBAC/D,OAAO,EAAE,4CAA4C;iBACxD;aACJ;SACJ,CAAC;QAEF,MAAM,OAAO,GAAG,IAAI,mBAAmB,CAAC,MAAM,CAAC,CAAC;QAEhD,gCAAgC;QAChC,MAAM,MAAM,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,cAAc,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;QACjE,MAAM,OAAO,GAAG;YACZ,GAAG,EAAE,cAAc;YACnB,KAAK,EAAE,kBAAkB;YACzB,IAAI,EAAE,UAAU;YAChB,GAAG,EAAE,sBAAsB;YAC3B,GAAG,EAAE,6BAA6B;YAClC,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,oBAAoB;SACjE,CAAC;QAEF,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QAC5E,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QAC9E,MAAM,IAAI,GAAG,GAAG,SAAS,IAAI,UAAU,EAAE,CAAC;QAE1C,gCAAgC;QAChC,MAAM,IAAI,GAAG,UAAU,CAAC,YAAY,CAAC,CAAC;QACtC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAClB,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;QAE5D,MAAM,YAAY,GAAG,GAAG,IAAI,IAAI,YAAY,EAAE,CAAC;QAE/C,kCAAkC;QAClC,MAAM,cAAc,GAAG,MAAM,OAAO,CAAC,SAAS,CAAC,YAAY,EAAE,MAAM,CAAC,SAAS,CAAC,MAAO,CAAC,CAAC;QAEvF,OAAO,CAAC,GAAG,EAAE,cAAc,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC;QAC3D,OAAO,CAAC,GAAG,EAAE,cAAc,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC;QACjE,OAAO,CAAC,GAAG,EAAE,cAAc,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;IAEH,MAAM,SAAS,CAAC,GAAG,EAAE,8CAA8C,EAAE,KAAK,IAAI,EAAE;QAC5E,MAAM,MAAM,GAAoB;YAC5B,kBAAkB,EAAE,iBAAiB;YACrC,aAAa,EAAE,qBAAqB;YACpC,SAAS,EAAE;gBACP,MAAM,EAAE;oBACJ,UAAU,EAAE,QAAQ;oBACpB,QAAQ,EAAE,sBAAsB;oBAChC,YAAY,EAAE,0BAA0B;oBACxC,QAAQ,EAAE,qCAAqC;oBAC/C,WAAW,EAAE,kDAAkD;oBAC/D,OAAO,EAAE,4CAA4C;iBACxD;aACJ;SACJ,CAAC;QAEF,MAAM,OAAO,GAAG,IAAI,mBAAmB,CAAC,MAAM,CAAC,CAAC;QAEhD,MAAM,MAAM,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,cAAc,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;QACjE,MAAM,OAAO,GAAG;YACZ,GAAG,EAAE,cAAc;YACnB,GAAG,EAAE,sBAAsB;YAC3B,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI;SAC5C,CAAC;QAEF,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QAC5E,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QAC9E,MAAM,IAAI,GAAG,GAAG,SAAS,IAAI,UAAU,EAAE,CAAC;QAE1C,0DAA0D;QAC1D,MAAM,EAAE,UAAU,EAAE,aAAa,EAAE,GAAG,mBAAmB,CAAC,KAAK,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1F,MAAM,IAAI,GAAG,UAAU,CAAC,YAAY,CAAC,CAAC;QACtC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAClB,MAAM,eAAe,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC;QAE9D,MAAM,WAAW,GAAG,GAAG,IAAI,IAAI,eAAe,EAAE,CAAC;QAEjD,IAAI,WAAgB,CAAC;QACrB,IAAI,CAAC;YACD,MAAM,OAAO,CAAC,SAAS,CAAC,WAAW,EAAE,MAAM,CAAC,SAAS,CAAC,MAAO,CAAC,CAAC;QACnE,CAAC;QAAC,OAAO,KAAU,EAAE,CAAC;YAClB,WAAW,GAAG,KAAK,CAAC;QACxB,CAAC;QAED,OAAO,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC,GAAG,CAAC,kBAAkB,EAAE,CAAC;QACnD,OAAO,CAAC,GAAG,EAAE,WAAW,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,6CAA6C,CAAC,CAAC;IAC9F,CAAC,CAAC,CAAC;IAEH,MAAM,SAAS,CAAC,GAAG,EAAE,iDAAiD,EAAE,KAAK,IAAI,EAAE;QAC/E,MAAM,MAAM,GAAoB;YAC5B,kBAAkB,EAAE,gCAAgC;YACpD,aAAa,EAAE,oBAAoB;YACnC,SAAS,EAAE,EAAE;SAChB,CAAC;QACF,MAAM,OAAO,GAAG,IAAI,mBAAmB,CAAC,MAAM,CAAC,CAAC;QAEhD,MAAM,GAAG,GAAG,kBAAkB,CAAC;QAC/B,MAAM,MAAM,GAAG,eAAe,CAAC;QAC/B,MAAM,MAAM,GAAG,eAAe,CAAC;QAE/B,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,0BAA0B,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QACxE,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,0BAA0B,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QACxE,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,0BAA0B,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QAEtE,gDAAgD;QAChD,OAAO,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;QAC7C,gDAAgD;QAChD,OAAO,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QAC/C,wDAAwD;QACxD,OAAO,CAAC,GAAG,EAAE,OAAO,SAAS,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QACnD,OAAO,CAAC,GAAG,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,mCAAmC;IACtF,CAAC,CAAC,CAAC;IAEH,MAAM,SAAS,CAAC,GAAG,EAAE,8CAA8C,EAAE,KAAK,IAAI,EAAE;QAC5E,MAAM,MAAM,GAAoB;YAC5B,kBAAkB,EAAE,gCAAgC;YACpD,aAAa,EAAE,oBAAoB;YACnC,SAAS,EAAE,EAAE;SAChB,CAAC;QACF,MAAM,OAAO,GAAG,IAAI,mBAAmB,CAAC,MAAM,CAAC,CAAC;QAEhD,MAAM,GAAG,GAAG,kBAAkB,CAAC;QAC/B,MAAM,KAAK,GAAG,eAAe,CAAC;QAE9B,8DAA8D;QAC9D,MAAM,gBAAgB,GAAG,wBAAwB,CAAC;YAC9C,EAAE,EAAE,cAAc;YAClB,IAAI,EAAE,kBAAkB;SAC3B,CAAC,CAAC;QACH,gBAAgB,CAAC,QAAQ,CAAC,IAAI,GAAG,EAAE,CAAC,CAAC,+BAA+B;QACpE,MAAM,kBAAkB,GAAG;YACvB,EAAE,EAAE,wBAAwB;YAC5B,GAAG,EAAE,gBAAgB;YACrB,IAAI,EAAE;gBACF,cAAc,EAAE;oBACZ;wBACI,EAAE,EAAE,QAAQ;wBACZ,MAAM,EAAE,gBAAgB;wBACxB,UAAU,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE;qBAClC;iBACJ;gBACD,CAAC,EAAE,CAAC;aACP;SACJ,CAAC;QAEF,oCAAoC;QACpC,MAAM,SAAS,GAAG,EAAE,CAAC;QACrB,MAAM,aAAa,GAAG;YAClB,aAAa,EAAE,KAAK,IAAI,EAAE,CAAC,sBAAsB;YACjD,GAAG,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;gBACd,OAAO,EAAE,IAAI;gBACb,MAAM,EAAE,CAAC,kBAAkB,CAAC;aAC/B,CAAC;SACL,CAAC;QAEF,MAAM,aAAa,GAAG,MAAM,OAAO,CAAC,4BAA4B,CAAC;YAC7D,UAAU,EAAE,QAAQ;YACpB,WAAW,EAAE,GAAG;YAChB,SAAS,EAAE,KAAK;YAChB,YAAY,EAAE,eAAe;YAC7B,SAAS,EAAE,aAAoB;YAC/B,KAAK,EAAE,SAAgB;SAC1B,CAAC,CAAC;QAEH,OAAO,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC,GAAG,CAAC,kBAAkB,EAAE,CAAC;QACrD,OAAO,CAAC,GAAG,EAAE,aAAa,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC,yBAAyB,CAAC,CAAC;QACpE,OAAO,CAAC,GAAG,EAAE,aAAa,CAAC,SAAS,CAAC,CAAC,aAAa,EAAE,CAAC;QACtD,OAAO,CAAC,GAAG,EAAE,aAAa,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QAEjE,0DAA0D;QAC1D,OAAO,CAAC,GAAG,EAAE,aAAa,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,gBAAgB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAE3F,sCAAsC;QACtC,MAAM,eAAe,GAAG,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC;QACrE,OAAO,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC,SAAS,CAAC,aAAa,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAChF,CAAC,CAAC,CAAC;IAEH,MAAM,SAAS,CAAC,GAAG,EAAE,iEAAiE,EAAE,KAAK,IAAI,EAAE;QAC/F,MAAM,MAAM,GAAoB;YAC5B,kBAAkB,EAAE,gCAAgC;YACpD,aAAa,EAAE,oBAAoB;YACnC,SAAS,EAAE;gBACP,MAAM,EAAE;oBACJ,UAAU,EAAE,QAAQ;oBACpB,QAAQ,EAAE,sBAAsB;oBAChC,YAAY,EAAE,0BAA0B;oBACxC,QAAQ,EAAE,qCAAqC;oBAC/C,WAAW,EAAE,kDAAkD;iBAClE;gBACD,MAAM,EAAE;oBACJ,UAAU,EAAE,QAAQ;oBACpB,QAAQ,EAAE,sBAAsB;oBAChC,YAAY,EAAE,0BAA0B;oBACxC,QAAQ,EAAE,6CAA6C;oBACvD,WAAW,EAAE,6BAA6B;iBAC7C;aACJ;SACJ,CAAC;QACF,MAAM,OAAO,GAAG,IAAI,mBAAmB,CAAC,MAAM,CAAC,CAAC;QAEhD,MAAM,aAAa,GAAG,UAAU,CAAC,KAAK,CAAC;QACvC,IAAI,UAAU,GAAoC,EAAE,CAAC;QACrD,UAAU,CAAC,KAAK,GAAG,CAAC,KAAK,EAAE,GAAQ,EAAE,OAAY,EAAE,EAAE;YACjD,UAAU,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC;YAClC,OAAO;gBACH,EAAE,EAAE,IAAI;gBACR,MAAM,EAAE,GAAG;gBACX,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC,IAAI;aAClB,CAAC;QACb,CAAC,CAAQ,CAAC;QAEV,IAAI,CAAC;YACD,sBAAsB;YACtB,MAAM,OAAO,CAAC,WAAW,CAAC,QAAQ,EAAE,uBAAuB,CAAC,CAAC;YAC7D,OAAO,CAAC,GAAG,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;YAC7C,OAAO,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,uBAAuB,CAAC,CAAC;YAElE,sBAAsB;YACtB,MAAM,OAAO,CAAC,WAAW,CAAC,QAAQ,EAAE,uBAAuB,CAAC,CAAC;YAC7D,OAAO,CAAC,GAAG,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;YAC7C,OAAO,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,0CAA0C,CAAC,CAAC;YACrF,OAAO,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;YAC/D,OAAO,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QACnF,CAAC;gBAAS,CAAC;YACP,UAAU,CAAC,KAAK,GAAG,aAAa,CAAC;QACrC,CAAC;IACL,CAAC,CAAC,CAAC;AACP,CAAC,CAAC,CAAC"}

package/dist/identity/sso/sso-helpers.d.mts

@@ -0,0 +1,10 @@
+import { KeystoneIbGib_V1 } from '@ibgib/core-gib/dist/keystone/keystone-types.mjs';
+/**
+ * Checks if a keystone contains a custodian challenge pool for the given provider.
+ * Client-safe & server-safe with zero dependencies.
+ */
+export declare function isSsoProviderLinked({ keystone, providerId }: {
+    keystone: KeystoneIbGib_V1 | null | undefined;
+    providerId: string;
+}): boolean;
+//# sourceMappingURL=sso-helpers.d.mts.map

package/dist/identity/sso/sso-helpers.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sso-helpers.d.mts","sourceRoot":"","sources":["../../../src/identity/sso/sso-helpers.mts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,kDAAkD,CAAC;AAEpF;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,EAChC,QAAQ,EACR,UAAU,EACb,EAAE;IACC,QAAQ,EAAE,gBAAgB,GAAG,IAAI,GAAG,SAAS,CAAC;IAC9C,UAAU,EAAE,MAAM,CAAC;CACtB,GAAG,OAAO,CAIV"}

package/dist/identity/sso/sso-helpers.mjs

@@ -0,0 +1,11 @@
+/**
+ * Checks if a keystone contains a custodian challenge pool for the given provider.
+ * Client-safe & server-safe with zero dependencies.
+ */
+export function isSsoProviderLinked({ keystone, providerId }) {
+    if (!keystone?.data?.challengePools)
+        return false;
+    const targetPoolId = `custodian-manage-${providerId}`;
+    return keystone.data.challengePools.some(p => p.id === targetPoolId);
+}
+//# sourceMappingURL=sso-helpers.mjs.map

package/dist/identity/sso/sso-helpers.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"sso-helpers.mjs","sourceRoot":"","sources":["../../../src/identity/sso/sso-helpers.mts"],"names":[],"mappings":"AAEA;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAC,EAChC,QAAQ,EACR,UAAU,EAIb;IACG,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,cAAc;QAAE,OAAO,KAAK,CAAC;IAClD,MAAM,YAAY,GAAG,oBAAoB,UAAU,EAAE,CAAC;IACtD,OAAO,QAAQ,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,YAAY,CAAC,CAAC;AACzE,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ibgib/web-gib",
-  "version": "0.0.50",
+  "version": "0.0.51",
   "description": "Framework for creating agentic ibGib web apps. Contains plumbing for ibgib components, agentic framework (currently only Gemini implemented), web-based IndexedDB storage substrate, and more.",
   "funding": {
     "type": "individual",
@@ -29,7 +29,7 @@
   "license": "ISC",
   "dependencies": {
     "@google/genai": "^1.33.0",
-    "@ibgib/core-gib": "^0.1.64",
+    "@ibgib/core-gib": "^0.1.65",
     "@ibgib/encrypt-gib": "^0.2.37",
     "@ibgib/helper-gib": "^0.0.36",
     "@ibgib/ts-gib": "^0.5.33"

package/src/AUTO-GENERATED-version.mts

@@ -11,4 +11,4 @@
 /**
  * this is the version of this package, auto-updated in the build process
  */
-export const AUTO_GENERATED_VERSION = '0.0.50';
+export const AUTO_GENERATED_VERSION = '0.0.51';

package/src/identity/sso/sso-custodian-service.mts

@@ -1,13 +1,15 @@
 import { createPublicKey, verify } from 'node:crypto';
-import { hash, HashAlgorithm } from '@ibgib/helper-gib/dist/helpers/utils-helper.mjs';
+import { hash, HashAlgorithm, extractErrorMsg } from '@ibgib/helper-gib/dist/helpers/utils-helper.mjs';
 import { kdf_recursiveSaltWrap } from '@ibgib/core-gib/dist/keystone/kdf/kdf-helpers.mjs';
 import { KeystoneService_V1 } from '@ibgib/core-gib/dist/keystone/keystone-service-v1.mjs';
 import { KeystoneProfileBuilder } from '@ibgib/core-gib/dist/keystone/policy/keystone-profile-builder.mjs';
-import { KeystoneIbGib_V1, KeystoneChallengePool } from '@ibgib/core-gib/dist/keystone/keystone-types.mjs';
-import { POOL_ID_CUSTODIAN_MANAGE, KEYSTONE_VERB_MANAGE, KEYSTONE_VERB_REVOKE } from '@ibgib/core-gib/dist/keystone/keystone-constants.mjs';
+import { KeystoneIbGib_V1, KeystoneChallengePool, KeystonePoolConfig } from '@ibgib/core-gib/dist/keystone/keystone-types.mjs';
+import { POOL_ID_CUSTODIAN_MANAGE, KEYSTONE_VERB_MANAGE, KEYSTONE_VERB_REVOKE, POOL_ID_MANAGE, KEYSTONE_POOL_ID_REGEXP } from '@ibgib/core-gib/dist/keystone/keystone-constants.mjs';
 import { createStandardPoolConfig } from '@ibgib/core-gib/dist/keystone/keystone-config-builder.mjs';
 import { generateOpaqueChallengeId } from '@ibgib/core-gib/dist/keystone/keystone-helpers.mjs';
 import { KeystoneStrategyFactory } from '@ibgib/core-gib/dist/keystone/strategy/keystone-strategy-factory.mjs';
+import { MetaspaceService } from '@ibgib/core-gib/dist/witness/space/metaspace/metaspace-types.mjs';
+import { IbGibSpaceAny } from '@ibgib/core-gib/dist/witness/space/space-base-v1.mjs';
 import { 
     SsoServerConfig, 
     SsoProviderId, 
@@ -369,10 +371,46 @@ export class SsoCustodianService {
      *   - Visibility: Public (Derivation salt, safe for ledger).
      *   - Generator: Client (Generated on user's device).
      */
-    async createCustodianChallengePool(
-        providerKey: string,
-        userNonce: string,
-    ): Promise<KeystoneChallengePool> {
+    async createCustodianChallengePool({
+        providerId,
+        providerKey,
+        userNonce,
+        keystoneAddr,
+        metaspace,
+        space,
+    }: {
+        providerId: string;
+        providerKey: string;
+        userNonce: string;
+        keystoneAddr: string;
+        metaspace: MetaspaceService;
+        space: IbGibSpaceAny;
+    }): Promise<KeystoneChallengePool> {
+        // 1. Fetch target keystone
+        const keystoneService = new KeystoneService_V1();
+        const targetKeystone = await keystoneService.getLatestKeystone({
+            addr: keystoneAddr,
+            metaspace,
+            space
+        });
+
+        if (!targetKeystone) {
+            throw new Error(`Keystone not found for address: ${keystoneAddr} (E: 8a9c2b1d3e5f6a7b8c9d0e1f2a3b4c5d)`);
+        }
+
+        // 2. Locate native manage pool
+        const userManagePool = targetKeystone.data?.challengePools.find(p => p.id === POOL_ID_MANAGE);
+        if (!userManagePool) {
+            throw new Error(`Keystone manage pool not found. Custodian manage pool must match the user manage pool's security config. (E: 7c4e5f6a7b8c9d0e1f2a3b4c5e6f7a8b)`);
+        }
+
+        // 3. Dynamic poolId based on providerId with regex validation
+        if (!providerId || !KEYSTONE_POOL_ID_REGEXP.test(providerId)) {
+            throw new Error(`Invalid providerId: "${providerId}". Must match ${KEYSTONE_POOL_ID_REGEXP} (E: 3a2c4e5f6a7b8c9d0e1f2a3b4c5e6f)`);
+        }
+        const poolId = `custodian-manage-${providerId}`;
+
+        // 4. Derive delegate secrets
         const custodianSecret = await this.deriveServerDelegateSecret(providerKey, userNonce);
         
         const poolSalt = await hash({
@@ -381,11 +419,13 @@ export class SsoCustodianService {
         });
         const poolSaltShort = poolSalt.substring(0, 16);
 
-        const config = createStandardPoolConfig({
-            id: POOL_ID_CUSTODIAN_MANAGE,
-            salt: poolSaltShort
-        });
-        config.allowedVerbs = [KEYSTONE_VERB_MANAGE, KEYSTONE_VERB_REVOKE];
+        // 5. Clone user's manage pool config, updating only ID, salt, and allowedVerbs
+        const config: KeystonePoolConfig = {
+            ...userManagePool.config,
+            id: poolId,
+            salt: poolSaltShort,
+            allowedVerbs: [KEYSTONE_VERB_MANAGE, KEYSTONE_VERB_REVOKE]
+        };
 
         const strategy = KeystoneStrategyFactory.create({ config });
         const poolSecret = await strategy.derivePoolSecret({ masterSecret: custodianSecret });
@@ -407,7 +447,7 @@ export class SsoCustodianService {
         }
 
         return {
-            id: POOL_ID_CUSTODIAN_MANAGE,
+            id: poolId,
             config,
             challenges,
             isForeign: true,
@@ -450,4 +490,50 @@ export class SsoCustodianService {
         
         return configs;
     }
+
+    /**
+     * Revokes an active OAuth access or refresh token with the provider.
+     * Keeps token revocation logic DRY and centralized.
+     */
+    async revokeToken(providerId: SsoProviderId, token: string): Promise<void> {
+        const lc = `${this.lc}[${this.revokeToken.name}]`;
+        const providerConfig = this.config.providers[providerId];
+        if (!providerConfig) {
+            throw new Error(`SSO provider "${providerId}" config is missing. (E: r28900abfefd23e89cf78f57)`);
+        }
+
+        try {
+            if (providerId === 'google') {
+                const res = await fetch(`https://oauth2.googleapis.com/revoke?token=${encodeURIComponent(token)}`, {
+                    method: 'POST',
+                    headers: {
+                        'Content-Type': 'application/x-www-form-urlencoded'
+                    }
+                });
+                if (!res.ok) {
+                    const text = await res.text();
+                    console.warn(`${lc} Google token revocation returned status ${res.status}: ${text}`);
+                }
+            } else if (providerId === 'github') {
+                const auth = Buffer.from(`${providerConfig.clientId}:${providerConfig.clientSecret}`).toString('base64');
+                const res = await fetch(`https://api.github.com/applications/${providerConfig.clientId}/grant`, {
+                    method: 'DELETE',
+                    headers: {
+                        'Authorization': `Basic ${auth}`,
+                        'Accept': 'application/vnd.github.v3+json',
+                        'User-Agent': 'space-gib-server'
+                    },
+                    body: JSON.stringify({ access_token: token })
+                });
+                if (!res.ok && res.status !== 404) {
+                    const text = await res.text();
+                    console.warn(`${lc} GitHub token revocation returned status ${res.status}: ${text}`);
+                }
+            } else {
+                throw new Error(`Unsupported provider: ${providerId} (E: e28900abfefd23e89cf78f58)`);
+            }
+        } catch (error) {
+            console.error(`${lc} Token revocation failed for provider ${providerId}: ${extractErrorMsg(error)}`);
+        }
+    }
 }

package/src/identity/sso/sso-custodian-service.respec.mts

@@ -8,7 +8,8 @@ import {
 } from '@ibgib/helper-gib/dist/respec-gib/respec-gib.mjs';
 import { SsoCustodianService } from './sso-custodian-service.mjs';
 import { SsoServerConfig } from './sso-types.mjs';
-import { POOL_ID_CUSTODIAN_MANAGE } from '@ibgib/core-gib/dist/keystone/keystone-constants.mjs';
+import { POOL_ID_CUSTODIAN_MANAGE, POOL_ID_MANAGE } from '@ibgib/core-gib/dist/keystone/keystone-constants.mjs';
+import { createStandardPoolConfig } from '@ibgib/core-gib/dist/keystone/keystone-config-builder.mjs';
 
 const maam = `[${import.meta.url}]`, sir = maam;
 
@@ -189,18 +190,108 @@ await respecfully(sir, 'SsoCustodianService', async () => {
         const key = 'google:123456789';
         const nonce = 'nonce-abc-123';
 
-        const custodianPool = await service.createCustodianChallengePool(
-            key,
-            nonce
-        );
+        // 1. Create a mock target keystone containing a 'manage' pool
+        const userManageConfig = createStandardPoolConfig({
+            id: POOL_ID_MANAGE,
+            salt: 'user-manage-salt'
+        });
+        userManageConfig.behavior.size = 12; // custom size for verification
+        const mockTargetKeystone = {
+            ib: 'keystone^some-tjp-addr',
+            gib: 'some-gib-value',
+            data: {
+                challengePools: [
+                    {
+                        id: 'manage',
+                        config: userManageConfig,
+                        challenges: { 'chal1': 'val1' }
+                    }
+                ],
+                n: 0
+            }
+        };
+
+        // 2. Mock metaspace and space calls
+        const mockSpace = {};
+        const mockMetaspace = {
+            getLatestAddr: async () => 'latest-keystone-addr',
+            get: async () => ({
+                success: true,
+                ibGibs: [mockTargetKeystone]
+            })
+        };
+
+        const custodianPool = await service.createCustodianChallengePool({
+            providerId: 'google',
+            providerKey: key,
+            userNonce: nonce,
+            keystoneAddr: 'some-tjp-addr',
+            metaspace: mockMetaspace as any,
+            space: mockSpace as any
+        });
 
         iReckon(sir, custodianPool).not.isGonnaBeUndefined();
-        iReckon(sir, custodianPool.id).willEqual(POOL_ID_CUSTODIAN_MANAGE);
+        iReckon(sir, custodianPool.id).willEqual('custodian-manage-google');
         iReckon(sir, custodianPool.isForeign).isGonnaBeTrue();
         iReckon(sir, custodianPool.metadata?.providerKey).willEqual(key);
         
+        // Replicated behavior size from parent manage pool config
+        iReckon(sir, custodianPool.config.behavior.size).willEqual(userManageConfig.behavior.size);
+        
         // Structural validation of challenges
         const challengesCount = Object.keys(custodianPool.challenges).length;
         iReckon(sir, challengesCount).willEqual(custodianPool.config.behavior.size);
     });
+
+    await ifWeMight(sir, 'revoke tokens successfully, making the correct http fetch calls', async () => {
+        const config: SsoServerConfig = {
+            ssoServerKdfSecret: 'high-entropy-server-kdf-secret',
+            sessionSecret: 'session-secret-123',
+            providers: {
+                google: {
+                    providerId: 'google',
+                    clientId: 'google-client-id-abc',
+                    clientSecret: 'google-client-secret-abc',
+                    tokenUrl: 'https://oauth2.googleapis.com/token',
+                    userInfoUrl: 'https://openidconnect.googleapis.com/v1/userinfo'
+                },
+                github: {
+                    providerId: 'github',
+                    clientId: 'github-client-id-xyz',
+                    clientSecret: 'github-client-secret-xyz',
+                    tokenUrl: 'https://github.com/login/oauth/access_token',
+                    userInfoUrl: 'https://api.github.com/user'
+                }
+            }
+        };
+        const service = new SsoCustodianService(config);
+
+        const originalFetch = globalThis.fetch;
+        let fetchCalls: { url: string, options: any }[] = [];
+        globalThis.fetch = (async (url: any, options: any) => {
+            fetchCalls.push({ url, options });
+            return {
+                ok: true,
+                status: 200,
+                text: async () => 'ok'
+            } as any;
+        }) as any;
+
+        try {
+            // Revoke Google token
+            await service.revokeToken('google', 'google-test-token-123');
+            iReckon(sir, fetchCalls.length).willEqual(1);
+            iReckon(sir, fetchCalls[0].url).includes('google-test-token-123');
+
+            // Revoke GitHub token
+            await service.revokeToken('github', 'github-test-token-456');
+            iReckon(sir, fetchCalls.length).willEqual(2);
+            iReckon(sir, fetchCalls[1].url).includes('/applications/github-client-id-xyz/grant');
+            iReckon(sir, fetchCalls[1].options.method).willEqual('DELETE');
+            iReckon(sir, fetchCalls[1].options.headers['Authorization']).includes('Basic');
+        } finally {
+            globalThis.fetch = originalFetch;
+        }
+    });
 });
+

package/src/identity/sso/sso-helpers.mts

@@ -0,0 +1,17 @@
+import { KeystoneIbGib_V1 } from '@ibgib/core-gib/dist/keystone/keystone-types.mjs';
+
+/**
+ * Checks if a keystone contains a custodian challenge pool for the given provider.
+ * Client-safe & server-safe with zero dependencies.
+ */
+export function isSsoProviderLinked({
+    keystone,
+    providerId
+}: {
+    keystone: KeystoneIbGib_V1 | null | undefined;
+    providerId: string;
+}): boolean {
+    if (!keystone?.data?.challengePools) return false;
+    const targetPoolId = `custodian-manage-${providerId}`;
+    return keystone.data.challengePools.some(p => p.id === targetPoolId);
+}