@ibgib/web-gib 0.0.56 → 0.0.58

package/src/api/ibgib-api-bridge.mts

@@ -6,6 +6,7 @@
 
 import { extractErrorMsg } from "@ibgib/helper-gib/dist/helpers/utils-helper.mjs";
 import { IbGib_V1 } from "@ibgib/ts-gib/dist/V1/types.mjs";
+import { FlatIbGibGraph } from "@ibgib/core-gib/dist/common/other/graph-types.mjs";
 
 const logalot = false;
 
@@ -27,7 +28,7 @@ export class IbGibApiBridge {
     /**
      * Posts a single genesis keystone ibgib to the server to create a new domain.
      */
-    public async postGenesisKeystone(keystoneIbGib: IbGib_V1): Promise<{ success: boolean; message?: string; addr?: string }> {
+    public async postGenesisKeystone(keystoneIbGib: IbGib_V1): Promise<{ success: boolean; pending?: boolean; statusCode?: number; message?: string; addr?: string }> {
         const lc = `${this.lc}[${this.postGenesisKeystone.name}]`;
         try {
             if (logalot) { console.log(`${lc} starting... (I: eecd082fc4a4381c8857928e8b090826)`); }
@@ -46,11 +47,11 @@ export class IbGibApiBridge {
             if (!response.ok) {
                 const errorMsg = data.message || data.error || 'Unknown error';
                 console.error(`${lc} server rejected genesis keystone: ${errorMsg}`);
-                return { success: false, message: errorMsg, addr: data.addr };
+                return { success: false, message: errorMsg, addr: data.addr, statusCode: response.status };
             }
 
-            if (logalot) { console.log(`${lc} genesis keystone posted successfully.`); }
-            return { success: true, addr: data.addr };
+            if (logalot) { console.log(`${lc} genesis keystone posted successfully. pending: ${data.pending}`); }
+            return { success: true, pending: !!data.pending, statusCode: response.status, addr: data.addr, message: data.message };
 
         } catch (error) {
             const errorMsg = extractErrorMsg(error);
@@ -270,6 +271,289 @@ export class IbGibApiBridge {
             return { success: false, message: errorMsg };
         }
     }
+
+    /**
+     * Posts a request to generate a 6-digit verification code, save it to pending staging, and dispatch an email.
+     */
+    public async postVerificationCode({
+        email,
+        primaryTjpAddr
+    }: {
+        email: string;
+        primaryTjpAddr?: string;
+    }): Promise<{ success: boolean; message?: string }> {
+        const lc = `${this.lc}[${this.postVerificationCode.name}]`;
+        try {
+            const url = '/api/email/verification-code';
+            const response = await fetch(url, {
+                method: 'POST',
+                headers: {
+                    'Content-Type': 'application/json',
+                },
+                body: JSON.stringify({ email, primaryTjpAddr }),
+            });
+
+            const data = await this.parseResponseJson(response, url);
+
+            if (!response.ok) {
+                const errorMsg = data.message || data.error || 'Verification code request failed';
+                console.error(`${lc} server verification code post failed: ${errorMsg}`);
+                return { success: false, message: errorMsg };
+            }
+
+            return { success: true, message: data.message };
+        } catch (error) {
+            const errorMsg = extractErrorMsg(error);
+            console.error(`${lc} post verification code error: ${errorMsg}`);
+            return { success: false, message: errorMsg };
+        }
+    }
+
+    /**
+     * Alias for postVerificationCode (deprecated name).
+     *
+     * @deprecated Use postVerificationCode instead.
+     */
+    public async postMagicLink(opts: {
+        email: string;
+        primaryTjpAddr: string;
+    }): Promise<{ success: boolean; message?: string }> {
+        return this.postVerificationCode(opts);
+    }
+
+    /**
+     * Posts a 6-digit verification code to activate an identity and verify email.
+     */
+    public async postVerifyCode({
+        email,
+        primaryTjpAddr,
+        code
+    }: {
+        email: string;
+        primaryTjpAddr: string;
+        code: string;
+    }): Promise<{ success: boolean; message?: string }> {
+        const lc = `${this.lc}[${this.postVerifyCode.name}]`;
+        try {
+            const url = '/api/email/verify-code';
+            const response = await fetch(url, {
+                method: 'POST',
+                headers: {
+                    'Content-Type': 'application/json',
+                },
+                body: JSON.stringify({ email, primaryTjpAddr, code }),
+            });
+
+            const data = await this.parseResponseJson(response, url);
+
+            if (!response.ok) {
+                const errorMsg = data.message || data.error || 'Code verification failed';
+                console.error(`${lc} server verify-code failed: ${errorMsg}`);
+                return { success: false, message: errorMsg };
+            }
+
+            if (logalot) { console.log(`${lc} verification code accepted.`); }
+            return { success: true, message: data.message };
+
+        } catch (error) {
+            const errorMsg = extractErrorMsg(error);
+            console.error(`${lc} fetch error: ${errorMsg}`);
+            return { success: false, message: errorMsg };
+        }
+    }
+
+    /**
+     * Posts a custodian genesis request (`POST /api/identity/custodian/genesis`)
+     * to obtain the primary identity keystone (or primaryTjpAddr) and a fresh, single-turn
+     * `CustodianRequirements` payload for delegate registration.
+     */
+    public async postCustodianGenesis({
+        email,
+        code,
+        username
+    }: {
+        email: string;
+        code?: string;
+        username?: string;
+    }): Promise<{
+        success: boolean;
+        isNewIdentity?: boolean;
+        primaryTjpAddr?: string;
+        primaryKeystone?: IbGib_V1;
+        primaryGraph?: FlatIbGibGraph;
+        custodianReqs?: any;
+        message?: string;
+    }> {
+        const lc = `${this.lc}[${this.postCustodianGenesis.name}]`;
+        try {
+            const url = '/api/identity/custodian/genesis';
+            const response = await fetch(url, {
+                method: 'POST',
+                headers: {
+                    'Content-Type': 'application/json',
+                },
+                body: JSON.stringify({ email, code, username }),
+            });
+
+            const data = await this.parseResponseJson(response, url);
+
+            if (!response.ok) {
+                const errorMsg = data.message || data.error || 'Custodian genesis failed';
+                console.error(`${lc} custodian genesis failed: ${errorMsg}`);
+                return { success: false, message: errorMsg };
+            }
+
+            return {
+                success: true,
+                isNewIdentity: !!data.isNewIdentity,
+                primaryTjpAddr: data.primaryTjpAddr,
+                primaryKeystone: data.primaryKeystone,
+                primaryGraph: data.primaryGraph,
+                custodianReqs: data.custodianReqs,
+                message: data.message
+            };
+        } catch (error) {
+            const errorMsg = extractErrorMsg(error);
+            console.error(`${lc} post custodian genesis error: ${errorMsg}`);
+            return { success: false, message: errorMsg };
+        }
+    }
+
+    /**
+     * Posts a client delegate keystone containing single-turn `custodianReqs`
+     * to register it with the server custodian node (`POST /api/identity/custodian/register-delegate`).
+     */
+    public async postCustodianRegisterDelegate({
+        delegateKeystone
+    }: {
+        delegateKeystone: IbGib_V1;
+    }): Promise<{
+        success: boolean;
+        primaryTjpAddr?: string;
+        evolvedPrimaryKeystone?: IbGib_V1;
+        primaryGraph?: FlatIbGibGraph;
+        message?: string;
+    }> {
+        const lc = `${this.lc}[${this.postCustodianRegisterDelegate.name}]`;
+        try {
+            const url = '/api/identity/custodian/register-delegate';
+            const response = await fetch(url, {
+                method: 'POST',
+                headers: {
+                    'Content-Type': 'application/json',
+                },
+                body: JSON.stringify({ delegateKeystone }),
+            });
+
+            const data = await this.parseResponseJson(response, url);
+
+            if (!response.ok) {
+                const errorMsg = data.message || data.error || 'Custodian delegate registration failed';
+                console.error(`${lc} custodian delegate registration failed: ${errorMsg}`);
+                return { success: false, message: errorMsg };
+            }
+
+            return {
+                success: true,
+                primaryTjpAddr: data.primaryTjpAddr,
+                evolvedPrimaryKeystone: data.evolvedPrimaryKeystone,
+                primaryGraph: data.primaryGraph,
+                message: data.message
+            };
+        } catch (error) {
+            const errorMsg = extractErrorMsg(error);
+            console.error(`${lc} post custodian register delegate error: ${errorMsg}`);
+            return { success: false, message: errorMsg };
+        }
+    }
+
+    /**
+     * Retrieves safe public SSO client configuration (`GET /api/identity/sso/config`).
+     */
+    public async getSsoConfig(): Promise<{
+        success: boolean;
+        providers?: Record<string, { providerId: string; clientId: string; authUrl: string }>;
+        message?: string;
+    }> {
+        const lc = `${this.lc}[${this.getSsoConfig.name}]`;
+        try {
+            const url = '/api/identity/sso/config';
+            const response = await fetch(url, { method: 'GET' });
+            const data = await this.parseResponseJson(response, url);
+
+            if (!response.ok) {
+                const errorMsg = data.message || data.error || 'Failed to fetch SSO config';
+                return { success: false, message: errorMsg };
+            }
+
+            return {
+                success: true,
+                providers: data.providers
+            };
+        } catch (error) {
+            const errorMsg = extractErrorMsg(error);
+            console.error(`${lc} fetch SSO config error: ${errorMsg}`);
+            return { success: false, message: errorMsg };
+        }
+    }
+
+    /**
+     * Posts an OAuth authorization code (`POST /api/identity/sso/login`)
+     * to complete SSO token exchange and obtain custodian requirements.
+     */
+    public async postSsoLogin({
+        code,
+        providerId,
+        redirectUri
+    }: {
+        code: string;
+        providerId: string;
+        redirectUri: string;
+    }): Promise<{
+        success: boolean;
+        isNewIdentity?: boolean;
+        primaryTjpAddr?: string;
+        primaryKeystone?: IbGib_V1;
+        primaryGraph?: FlatIbGibGraph;
+        custodianReqs?: any;
+        userInfo?: any;
+        message?: string;
+    }> {
+        const lc = `${this.lc}[${this.postSsoLogin.name}]`;
+        try {
+            const url = '/api/identity/sso/login';
+            const response = await fetch(url, {
+                method: 'POST',
+                headers: {
+                    'Content-Type': 'application/json',
+                },
+                body: JSON.stringify({ code, providerId, redirectUri }),
+            });
+
+            const data = await this.parseResponseJson(response, url);
+
+            if (!response.ok) {
+                const errorMsg = data.message || data.error || 'SSO login code exchange failed';
+                console.error(`${lc} SSO login code exchange failed: ${errorMsg}`);
+                return { success: false, message: errorMsg };
+            }
+
+            return {
+                success: true,
+                isNewIdentity: !!data.isNewIdentity,
+                primaryTjpAddr: data.primaryTjpAddr,
+                primaryKeystone: data.primaryKeystone,
+                primaryGraph: data.primaryGraph,
+                custodianReqs: data.custodianReqs,
+                userInfo: data.userInfo,
+                message: data.message
+            };
+        } catch (error) {
+            const errorMsg = extractErrorMsg(error);
+            console.error(`${lc} post SSO login error: ${errorMsg}`);
+            return { success: false, message: errorMsg };
+        }
+    }
 }
 
 let _apiBridge: IbGibApiBridge | undefined;

package/src/identity/custodian-delegate-helper.mts

@@ -0,0 +1,61 @@
+/**
+ * @module identity/custodian-delegate-helper
+ *
+ * Client-side helper functions for deriving and storing local cryptographic delegate secrets
+ * for full-custodian / passwordless identities.
+ */
+
+import { getUUID, hash, HashAlgorithm, extractErrorMsg } from "@ibgib/helper-gib/dist/helpers/utils-helper.mjs";
+
+const LOCAL_STORAGE_PREFIX = 'ibgib_custodian_delegate_secret_';
+
+/**
+ * Retrieves or generates a high-entropy local delegate secret for a passwordless custodian identity.
+ * Stored locally in `localStorage` keyed by `primaryTjpAddr`.
+ *
+ * @param primaryTjpAddr The primary identity keystone TJP address (`ib^gib`).
+ */
+export async function deriveLocalCustodianDelegateSecret({
+    primaryTjpAddr,
+}: {
+    primaryTjpAddr: string;
+}): Promise<string> {
+    const lc = `[${deriveLocalCustodianDelegateSecret.name}]`;
+    try {
+        if (!primaryTjpAddr) {
+            throw new Error('primaryTjpAddr is required to derive local custodian delegate secret (E: a1b2c3d4e5f67890123456789a000101)');
+        }
+
+        const key = `${LOCAL_STORAGE_PREFIX}${primaryTjpAddr}`;
+        const existingSecret = localStorage.getItem(key);
+        if (existingSecret) {
+            return existingSecret;
+        }
+
+        // Generate high-entropy 512-bit SHA hash secret from fresh UUIDs
+        const rawEntropy = `${await getUUID()}-${await getUUID()}-${await getUUID()}-${Date.now()}`;
+        const newSecret = await hash({
+            s: rawEntropy,
+            algorithm: HashAlgorithm.sha_512
+        });
+
+        localStorage.setItem(key, newSecret);
+        return newSecret;
+    } catch (error) {
+        console.error(`${lc} ${extractErrorMsg(error)}`);
+        throw error;
+    }
+}
+
+/**
+ * Removes the stored local delegate secret for a custodian identity.
+ */
+export function clearLocalCustodianDelegateSecret({
+    primaryTjpAddr,
+}: {
+    primaryTjpAddr: string;
+}): void {
+    if (!primaryTjpAddr) { return; }
+    const key = `${LOCAL_STORAGE_PREFIX}${primaryTjpAddr}`;
+    localStorage.removeItem(key);
+}

package/src/identity/sso/{sso-custodian-service.mts → sso-custodian-service.mts.bak}

@@ -1,20 +1,17 @@
 import { createPublicKey, verify } from 'node:crypto';
+
 import { hash, HashAlgorithm, extractErrorMsg } from '@ibgib/helper-gib/dist/helpers/utils-helper.mjs';
 import { kdf_recursiveSaltWrap } from '@ibgib/core-gib/dist/keystone/kdf/kdf-helpers.mjs';
 import { KeystoneService_V1 } from '@ibgib/core-gib/dist/keystone/keystone-service-v1.mjs';
-import { KeystoneProfileBuilder } from '@ibgib/core-gib/dist/keystone/policy/keystone-profile-builder.mjs';
-import { KeystoneIbGib_V1, KeystoneChallengePool, KeystonePoolConfig } from '@ibgib/core-gib/dist/keystone/keystone-types.mjs';
-import { POOL_ID_CUSTODIAN_MANAGE, KEYSTONE_VERB_MANAGE, KEYSTONE_VERB_REVOKE, POOL_ID_MANAGE, KEYSTONE_POOL_ID_REGEXP } from '@ibgib/core-gib/dist/keystone/keystone-constants.mjs';
-import { createStandardPoolConfig } from '@ibgib/core-gib/dist/keystone/keystone-config-builder.mjs';
+import { KeystoneChallengePool, KeystonePoolConfig } from '@ibgib/core-gib/dist/keystone/keystone-types.mjs';
+import { KEYSTONE_VERB_MANAGE, KEYSTONE_VERB_REVOKE, POOL_ID_MANAGE, KEYSTONE_POOL_ID_REGEXP } from '@ibgib/core-gib/dist/keystone/keystone-constants.mjs';
 import { generateOpaqueChallengeId } from '@ibgib/core-gib/dist/keystone/keystone-helpers.mjs';
 import { KeystoneStrategyFactory } from '@ibgib/core-gib/dist/keystone/strategy/keystone-strategy-factory.mjs';
 import { MetaspaceService } from '@ibgib/core-gib/dist/witness/space/metaspace/metaspace-types.mjs';
 import { IbGibSpaceAny } from '@ibgib/core-gib/dist/witness/space/space-base-v1.mjs';
-import { 
-    SsoServerConfig, 
-    SsoProviderId, 
-    OAuthUserInfo, 
-    SsoProviderServerConfig,
+
+import {
+    SsoServerConfig, SsoProviderId, OAuthUserInfo, SsoProviderServerConfig,
     SsoProviderClientConfig
 } from './sso-types.mjs';
 
@@ -37,7 +34,7 @@ interface JwksResponse {
  */
 export class SsoCustodianService {
     private lc = `[${SsoCustodianService.name}]`;
-    
+
     // In-memory cache for JSON Web Key Sets (JWKS) per provider
     private jwksCache: Map<SsoProviderId, { keys: JwkKey[]; expiresAt: number }> = new Map();
     private jwksTtlMs = 24 * 60 * 60 * 1000; // Cache certs for 24 hours
@@ -47,19 +44,19 @@ export class SsoCustodianService {
      *   - Visibility: Private (Contains high-entropy secrets like `ssoServerKdfSecret` and `sessionSecret`).
      *   - Generator: Server (Bootstrapped from node environment variables on server initialization).
      */
-    constructor(private config: SsoServerConfig) {}
+    constructor(private config: SsoServerConfig) { }
 
     /**
      * Exchanges an authorization code for an OAuth2 token and retrieves normalized user info.
-     * 
+     *
      * @param providerId The string identifier of the OAuth provider (e.g. 'google' or 'github').
      *   - Visibility: Public (Non-sensitive metadata string).
      *   - Generator: Client (Sent from browser UI selection).
-     * 
+     *
      * @param code The temporary authorization code returned by the OAuth provider.
      *   - Visibility: Private (Confidential short-lived bearer credential. Must be kept private).
      *   - Generator: Provider (Created by provider's OAuth page and sent to client redirect URI).
-     * 
+     *
      * @param redirectUri The redirect URI registered in the provider portal.
      *   - Visibility: Public (Configuration URL).
      *   - Generator: Client/Server (Derived from environmental configuration and sent by client).
@@ -97,7 +94,7 @@ export class SsoCustodianService {
     /**
      * Directly validates a Google ID Token (JWT) locally and returns normalized user info.
      * Useful for client-side authentication handshakes.
-     * 
+     *
      * @param idToken The raw base64-encoded signed JSON Web Token (JWT) ID token returned by Google.
      *   - Visibility: Private (Sensitive bearer credential containing signature and claims. Must be kept private).
      *   - Generator: Provider (Generated and signed cryptographically by Google authentication servers).
@@ -125,6 +122,10 @@ export class SsoCustodianService {
             throw new Error(`Google JWT is missing subject claim ('sub'). (E: s28900abfefd23e89cfa1f89)`);
         }
 
+        if (payload.email && payload.email_verified !== true && (payload.email_verified as any) !== 'true') {
+            throw new Error(`Google email is not verified: ${payload.email}. (E: v28900abfefd23e89cfb2f90)`);
+        }
+
         return {
             providerKey: `google:${payload.sub}`,
             providerId: 'google',
@@ -137,22 +138,22 @@ export class SsoCustodianService {
 
     /**
      * Internal: Exchange authorization code for access token / ID token.
-     * 
+     *
      * @param providerConfig Server configuration settings for the specific provider.
      *   - Visibility: Private (Contains provider client secrets. Must stay server-side).
      *   - Generator: Server (Configured from node environment variables).
-     * 
+     *
      * @param code The temporary authorization code to exchange.
      *   - Visibility: Private (Short-lived credential. Must be kept private).
      *   - Generator: Provider (Via OAuth flow).
-     * 
+     *
      * @param redirectUri The redirect URI registered for the exchange.
      *   - Visibility: Public (Configuration URL).
      *   - Generator: Client/Server (From app configuration).
      */
     private async exchangeCodeForTokens(
-        providerConfig: SsoProviderServerConfig, 
-        code: string, 
+        providerConfig: SsoProviderServerConfig,
+        code: string,
         redirectUri: string
     ): Promise<any> {
         const body = new URLSearchParams({
@@ -188,17 +189,17 @@ export class SsoCustodianService {
 
     /**
      * Internal: Fetch GitHub user profile and normalize.
-     * 
+     *
      * @param providerConfig Server configuration settings for GitHub.
      *   - Visibility: Private (Contains GitHub client secret).
      *   - Generator: Server (From environment config).
-     * 
+     *
      * @param accessToken The active OAuth2 access token to authorize the API call.
      *   - Visibility: Private (Bearer token. Must be kept private).
      *   - Generator: Provider (GitHub token endpoint).
      */
     private async fetchAndNormalizeGithubUser(
-        providerConfig: SsoProviderServerConfig, 
+        providerConfig: SsoProviderServerConfig,
         accessToken: string
     ): Promise<OAuthUserInfo> {
         const res = await fetch(providerConfig.userInfoUrl, {
@@ -214,18 +215,44 @@ export class SsoCustodianService {
         }
 
         const rawUser = await res.json();
-        
+
         if (!rawUser.id) {
             throw new Error(`GitHub user info response missing 'id' field.`);
         }
 
         const sub = String(rawUser.id);
+        let email = rawUser.email || undefined;
+
+        // If email is missing or private, fetch /user/emails to extract primary verified email
+        if (!email) {
+            try {
+                const emailsRes = await fetch('https://api.github.com/user/emails', {
+                    headers: {
+                        'Authorization': `Bearer ${accessToken}`,
+                        'User-Agent': 'space-gib-auth-agent'
+                    }
+                });
+                if (emailsRes.ok) {
+                    const emailsList: any[] = await emailsRes.json();
+                    const primaryVerified = emailsList.find((e: any) => e.verified && e.primary) || emailsList.find((e: any) => e.verified);
+                    if (primaryVerified?.email) {
+                        email = primaryVerified.email;
+                    }
+                }
+            } catch (err) {
+                console.warn(`[${this.fetchAndNormalizeGithubUser.name}] Could not fetch GitHub /user/emails fallback: ${extractErrorMsg(err)}`);
+            }
+        }
+
+        if (!email) {
+            throw new Error(`Your GitHub account does not have a verified primary email address. Please verify your primary email on GitHub and try again. (E: e28900abfefd23e89cfc3f01)`);
+        }
 
         return {
             providerKey: `github:${sub}`,
             providerId: 'github',
             sub,
-            email: rawUser.email || undefined,
+            email,
             name: rawUser.name || rawUser.login || undefined,
             picture: rawUser.avatar_url || undefined
         };
@@ -233,11 +260,11 @@ export class SsoCustodianService {
 
     /**
      * Internal: Decodes and cryptographically verifies a JWT signature using JWKS public keys.
-     * 
+     *
      * @param token The raw base64-encoded JWT token to verify.
      *   - Visibility: Private (Sensitive token. Must be kept private).
      *   - Generator: Provider (Google / OIDC server).
-     * 
+     *
      * @param providerConfig The target provider server settings containing `jwksUrl`.
      *   - Visibility: Private (Contains secrets).
      *   - Generator: Server (From environment config).
@@ -299,7 +326,7 @@ export class SsoCustodianService {
 
     /**
      * Internal: Retrieves JWKS keys from cache or fetches them from the provider's jwksUrl.
-     * 
+     *
      * @param providerConfig The provider config containing the target `jwksUrl`.
      *   - Visibility: Private (Contains client secrets).
      *   - Generator: Server (From environment config).
@@ -307,7 +334,7 @@ export class SsoCustodianService {
     private async getJwksKeys(providerConfig: SsoProviderServerConfig): Promise<JwkKey[]> {
         const providerId = providerConfig.providerId;
         const cached = this.jwksCache.get(providerId);
-        
+
         if (cached && cached.expiresAt > Date.now()) {
             return cached.keys;
         }
@@ -337,11 +364,11 @@ export class SsoCustodianService {
     /**
      * Derives a server-delegate master secret deterministically using the server's private KDF secret,
      * the providerKey, and the user's public nonce.
-     * 
+     *
      * @param providerKey The unique key identifying the provider and user sub ID (e.g. `google:123...`).
      *   - Visibility: Public (Identifier saved on parent's delegate claim, safe for log/ledger storage).
      *   - Generator: Provider/Server (Derived by mapping provider user sub ID after authentication).
-     * 
+     *
      * @param userNonce The public, high-entropy nonce generated by the client to salt the KDF derivation.
      *   - Visibility: Public (Salt value stored on parent's delegate claim, safe for ledger storage).
      *   - Generator: Client (Generated offline on user's device).
@@ -362,11 +389,11 @@ export class SsoCustodianService {
     /**
      * Creates a public custodian challenge pool (custodian-manage) derived deterministically
      * from the server's private KDF secret, providerKey, and userNonce.
-     * 
+     *
      * @param providerKey The unique key identifying the provider and user sub ID (e.g. `google:123...`).
      *   - Visibility: Public (Mapped identifier, safe for ledger).
      *   - Generator: Provider/Server (Derived after successful token exchange).
-     * 
+     *
      * @param userNonce The public, high-entropy nonce.
      *   - Visibility: Public (Derivation salt, safe for ledger).
      *   - Generator: Client (Generated on user's device).
@@ -412,7 +439,7 @@ export class SsoCustodianService {
 
         // 4. Derive delegate secrets
         const custodianSecret = await this.deriveServerDelegateSecret(providerKey, userNonce);
-        
+
         const poolSalt = await hash({
             s: `${providerKey}:${userNonce}:salt`,
             algorithm: HashAlgorithm.sha_256
@@ -460,14 +487,14 @@ export class SsoCustodianService {
 
     /**
      * Maps private server configuration to safe public client configurations.
-     * 
+     *
      * @param hostUrl The root URL host address of the server (e.g. `https://space-gib.localhost` or `https://ibgib.space`).
      *   - Visibility: Public (Non-sensitive hostname configuration).
      *   - Generator: Server (Extracted from the HTTP request context headers/protocol).
      */
     getSsoClientConfigs(hostUrl: string): SsoProviderClientConfig[] {
         const configs: SsoProviderClientConfig[] = [];
-        
+
         if (this.config.providers.google) {
             configs.push({
                 providerId: 'google',
@@ -477,7 +504,7 @@ export class SsoCustodianService {
                 scope: 'openid email profile'
             });
         }
-        
+
         if (this.config.providers.github) {
             configs.push({
                 providerId: 'github',
@@ -487,7 +514,7 @@ export class SsoCustodianService {
                 scope: 'read:user user:email'
             });
         }
-        
+
         return configs;
     }