@marinoscar/platform-api 0.0.0-stage → 0.1.0-next.11

package/dist/identity/auth/doctor/egress/auth-providers.egress.contributor.js

@@ -0,0 +1,97 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AuthProvidersEgressContributor = exports.GOOGLE_AVATAR_HOSTS = exports.GOOGLE_OAUTH_HOSTS = void 0;
+const common_1 = require("@nestjs/common");
+const index_1 = require("../../../../doctor/index");
+const auth_service_1 = require("../../auth.service");
+const auth_provider_registry_1 = require("../../providers/auth-provider.registry");
+/** Where the browser signs in, and where the API exchanges the code and reads the profile. */
+exports.GOOGLE_OAUTH_HOSTS = ['accounts.google.com', 'oauth2.googleapis.com', 'www.googleapis.com'];
+/** Where a Google profile picture is served from (the browser loads it). */
+exports.GOOGLE_AVATAR_HOSTS = ['lh3.googleusercontent.com'];
+/**
+ * The sign-in providers' outbound dependencies (#773, PP-14.9):
+ *
+ * - `auth.google` and `auth.google.avatars`: Google sign-in, exactly as before.
+ * - `auth.<id>`: one per other registered provider that declared
+ *   `egressHosts` (direction `both`: the browser signs in, the API exchanges
+ *   the code).
+ *
+ * Reads `AuthService.getEnabledProviders()`, the same list the sign-in page
+ * renders (configuration only: whether a provider is configured, never a
+ * secret). A provider is `required` when it is the only enabled one: then
+ * nobody can sign in without reaching it.
+ */
+let AuthProvidersEgressContributor = class AuthProvidersEgressContributor {
+    egress;
+    auth;
+    id = 'auth';
+    constructor(egress, auth) {
+        this.egress = egress;
+        this.auth = auth;
+    }
+    onModuleInit() {
+        this.egress.register(this);
+    }
+    async describe() {
+        const enabled = (await this.auth.getEnabledProviders()).filter((p) => p.enabled);
+        const enabledIds = new Set(enabled.map((p) => p.name));
+        const google = enabledIds.has('google');
+        const onlyProvider = (id) => enabledIds.has(id) && enabled.length === 1;
+        const dependencies = [
+            (0, index_1.egressDependency)({
+                id: 'auth.google',
+                capability: 'Google sign-in',
+                direction: 'both',
+                enabled: google,
+                required: onlyProvider('google'),
+                hosts: [...exports.GOOGLE_OAUTH_HOSTS],
+                degradation: onlyProvider('google')
+                    ? 'Nobody can sign in: Google is the only sign-in provider'
+                    : 'Signing in with Google fails',
+            }),
+            (0, index_1.egressDependency)({
+                id: 'auth.google.avatars',
+                capability: 'Google profile pictures',
+                direction: 'browser',
+                enabled: google,
+                required: false,
+                hosts: [...exports.GOOGLE_AVATAR_HOSTS],
+                degradation: 'Profile pictures from Google do not load; initials are shown instead',
+            }),
+        ];
+        for (const provider of auth_provider_registry_1.authProviderRegistry.list()) {
+            if (provider.id === 'google' || !provider.egressHosts || provider.egressHosts.length === 0)
+                continue;
+            const label = provider.label ?? provider.id;
+            dependencies.push((0, index_1.egressDependency)({
+                id: `auth.${provider.id}`,
+                capability: `${label} sign-in`,
+                direction: 'both',
+                enabled: enabledIds.has(provider.id),
+                required: onlyProvider(provider.id),
+                hosts: [...provider.egressHosts],
+                degradation: onlyProvider(provider.id)
+                    ? `Nobody can sign in: ${label} is the only sign-in provider`
+                    : `Signing in with ${label} fails`,
+            }));
+        }
+        return dependencies;
+    }
+};
+exports.AuthProvidersEgressContributor = AuthProvidersEgressContributor;
+exports.AuthProvidersEgressContributor = AuthProvidersEgressContributor = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [index_1.EgressRegistry,
+        auth_service_1.AuthService])
+], AuthProvidersEgressContributor);
+//# sourceMappingURL=auth-providers.egress.contributor.js.map

package/dist/identity/auth/doctor/egress/auth-providers.egress.contributor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-providers.egress.contributor.js","sourceRoot":"","sources":["../../../../../src/identity/auth/doctor/egress/auth-providers.egress.contributor.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,2CAA0D;AAE1D,oDAKkC;AAElC,qDAAiD;AACjD,mFAA8E;AAE9E,8FAA8F;AACjF,QAAA,kBAAkB,GAAG,CAAC,qBAAqB,EAAE,uBAAuB,EAAE,oBAAoB,CAAU,CAAC;AAElH,4EAA4E;AAC/D,QAAA,mBAAmB,GAAG,CAAC,2BAA2B,CAAU,CAAC;AAE1E;;;;;;;;;;;;GAYG;AAEI,IAAM,8BAA8B,GAApC,MAAM,8BAA8B;IAItB;IACA;IAJV,EAAE,GAAG,MAAM,CAAC;IAErB,YACmB,MAAsB,EACtB,IAAiB;QADjB,WAAM,GAAN,MAAM,CAAgB;QACtB,SAAI,GAAJ,IAAI,CAAa;IACjC,CAAC;IAEJ,YAAY;QACV,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC7B,CAAC;IAED,KAAK,CAAC,QAAQ;QACZ,MAAM,OAAO,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,mBAAmB,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;QACjF,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QACvD,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACxC,MAAM,YAAY,GAAG,CAAC,EAAU,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC;QAEhF,MAAM,YAAY,GAAuB;YACvC,IAAA,wBAAgB,EAAC;gBACf,EAAE,EAAE,aAAa;gBACjB,UAAU,EAAE,gBAAgB;gBAC5B,SAAS,EAAE,MAAM;gBACjB,OAAO,EAAE,MAAM;gBACf,QAAQ,EAAE,YAAY,CAAC,QAAQ,CAAC;gBAChC,KAAK,EAAE,CAAC,GAAG,0BAAkB,CAAC;gBAC9B,WAAW,EAAE,YAAY,CAAC,QAAQ,CAAC;oBACjC,CAAC,CAAC,yDAAyD;oBAC3D,CAAC,CAAC,8BAA8B;aACnC,CAAC;YACF,IAAA,wBAAgB,EAAC;gBACf,EAAE,EAAE,qBAAqB;gBACzB,UAAU,EAAE,yBAAyB;gBACrC,SAAS,EAAE,SAAS;gBACpB,OAAO,EAAE,MAAM;gBACf,QAAQ,EAAE,KAAK;gBACf,KAAK,EAAE,CAAC,GAAG,2BAAmB,CAAC;gBAC/B,WAAW,EAAE,sEAAsE;aACpF,CAAC;SACH,CAAC;QAEF,KAAK,MAAM,QAAQ,IAAI,6CAAoB,CAAC,IAAI,EAAE,EAAE,CAAC;YACnD,IAAI,QAAQ,CAAC,EAAE,KAAK,QAAQ,IAAI,CAAC,QAAQ,CAAC,WAAW,IAAI,QAAQ,CAAC,WAAW,CAAC,MAAM,KAAK,CAAC;gBAAE,SAAS;YACrG,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,IAAI,QAAQ,CAAC,EAAE,CAAC;YAC5C,YAAY,CAAC,IAAI,CACf,IAAA,wBAAgB,EAAC;gBACf,EAAE,EAAE,QAAQ,QAAQ,CAAC,EAAE,EAAE;gBACzB,UAAU,EAAE,GAAG,KAAK,UAAU;gBAC9B,SAAS,EAAE,MAAM;gBACjB,OAAO,EAAE,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACpC,QAAQ,EAAE,YAAY,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACnC,KAAK,EAAE,CAAC,GAAG,QAAQ,CAAC,WAAW,CAAC;gBAChC,WAAW,EAAE,YAAY,CAAC,QAAQ,CAAC,EAAE,CAAC;oBACpC,CAAC,CAAC,uBAAuB,KAAK,+BAA+B;oBAC7D,CAAC,CAAC,mBAAmB,KAAK,QAAQ;aACrC,CAAC,CACH,CAAC;QACJ,CAAC;QAED,OAAO,YAAY,CAAC;IACtB,CAAC;CACF,CAAA;AA7DY,wEAA8B;yCAA9B,8BAA8B;IAD1C,IAAA,mBAAU,GAAE;qCAKgB,sBAAc;QAChB,0BAAW;GALzB,8BAA8B,CA6D1C"}

package/dist/identity/auth/doctor/egress/google-auth.egress.contributor.d.ts

@@ -0,0 +1,2 @@
+export { AuthProvidersEgressContributor as GoogleAuthEgressContributor, GOOGLE_AVATAR_HOSTS, GOOGLE_OAUTH_HOSTS, } from './auth-providers.egress.contributor';
+//# sourceMappingURL=google-auth.egress.contributor.d.ts.map

package/dist/identity/auth/doctor/egress/google-auth.egress.contributor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"google-auth.egress.contributor.d.ts","sourceRoot":"","sources":["../../../../../src/identity/auth/doctor/egress/google-auth.egress.contributor.ts"],"names":[],"mappings":"AAKA,OAAO,EACL,8BAA8B,IAAI,2BAA2B,EAC7D,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,qCAAqC,CAAC"}

package/dist/identity/auth/doctor/egress/google-auth.egress.contributor.js

@@ -0,0 +1,13 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GOOGLE_OAUTH_HOSTS = exports.GOOGLE_AVATAR_HOSTS = exports.GoogleAuthEgressContributor = void 0;
+// The sign-in providers' egress contributor, under the path and class name it
+// had when Google was the only provider. The implementation is generic
+// (`./auth-providers.egress.contributor.ts`): it still emits `auth.google` and
+// `auth.google.avatars` first, then one dependency per other registered
+// provider that declared `egressHosts`.
+var auth_providers_egress_contributor_1 = require("./auth-providers.egress.contributor");
+Object.defineProperty(exports, "GoogleAuthEgressContributor", { enumerable: true, get: function () { return auth_providers_egress_contributor_1.AuthProvidersEgressContributor; } });
+Object.defineProperty(exports, "GOOGLE_AVATAR_HOSTS", { enumerable: true, get: function () { return auth_providers_egress_contributor_1.GOOGLE_AVATAR_HOSTS; } });
+Object.defineProperty(exports, "GOOGLE_OAUTH_HOSTS", { enumerable: true, get: function () { return auth_providers_egress_contributor_1.GOOGLE_OAUTH_HOSTS; } });
+//# sourceMappingURL=google-auth.egress.contributor.js.map

package/dist/identity/auth/doctor/egress/google-auth.egress.contributor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"google-auth.egress.contributor.js","sourceRoot":"","sources":["../../../../../src/identity/auth/doctor/egress/google-auth.egress.contributor.ts"],"names":[],"mappings":";;;AAAA,8EAA8E;AAC9E,uEAAuE;AACvE,+EAA+E;AAC/E,wEAAwE;AACxE,wCAAwC;AACxC,yFAI6C;AAH3C,gJAAA,8BAA8B,OAA+B;AAC7D,wIAAA,mBAAmB,OAAA;AACnB,uIAAA,kBAAkB,OAAA"}

package/dist/identity/auth/doctor/initial-admin.doctor-check.d.ts

@@ -0,0 +1,27 @@
+import { OnModuleInit } from '@nestjs/common';
+import { type ResolvedIdentityModuleOptions } from '../../identity.options';
+import { ConfigService } from '@nestjs/config';
+import { DoctorCheck, DoctorCheckOutcome } from '../../../doctor/index';
+import { DoctorCheckRegistry } from '../../../doctor/index';
+import type { IdentityPrisma } from '../../ports';
+/** Pure: judges the bootstrap variable and the number of active admins. */
+export declare function decideInitialAdmin(input: {
+    initialAdminEmailSet: boolean;
+    activeAdmins: number;
+}): DoctorCheckOutcome;
+/** `auth` / `auth.initial-admin` — somebody can administer this deployment. */
+export declare class InitialAdminDoctorCheck implements DoctorCheck, OnModuleInit {
+    private readonly registry;
+    private readonly config;
+    private readonly prisma;
+    private readonly identityOptions;
+    readonly id = "auth.initial-admin";
+    readonly category = "auth";
+    readonly label = "Administrator access";
+    readonly settingsPath = "/admin/settings/users";
+    readonly dependsOn: string[];
+    constructor(registry: DoctorCheckRegistry, config: ConfigService, prisma: IdentityPrisma, identityOptions?: ResolvedIdentityModuleOptions);
+    onModuleInit(): void;
+    run(): Promise<DoctorCheckOutcome>;
+}
+//# sourceMappingURL=initial-admin.doctor-check.d.ts.map

package/dist/identity/auth/doctor/initial-admin.doctor-check.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"initial-admin.doctor-check.d.ts","sourceRoot":"","sources":["../../../../src/identity/auth/doctor/initial-admin.doctor-check.ts"],"names":[],"mappings":"AAAA,OAAO,EAAsB,YAAY,EAAY,MAAM,gBAAgB,CAAC;AAC5E,OAAO,EAA8C,KAAK,6BAA6B,EAAE,MAAM,wBAAwB,CAAC;AACxH,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAG/C,OAAO,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AACxE,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAE5D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAElD,2EAA2E;AAC3E,wBAAgB,kBAAkB,CAAC,KAAK,EAAE;IAAE,oBAAoB,EAAE,OAAO,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,GAAG,kBAAkB,CA0BrH;AAED,+EAA+E;AAC/E,qBACa,uBAAwB,YAAW,WAAW,EAAE,YAAY;IAQrE,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,MAAM;IACE,OAAO,CAAC,QAAQ,CAAC,MAAM;IAEhD,OAAO,CAAC,QAAQ,CAAC,eAAe;IAXlC,QAAQ,CAAC,EAAE,wBAAwB;IACnC,QAAQ,CAAC,QAAQ,UAAU;IAC3B,QAAQ,CAAC,KAAK,0BAA0B;IACxC,QAAQ,CAAC,YAAY,2BAA2B;IAChD,QAAQ,CAAC,SAAS,WAAqB;gBAGpB,QAAQ,EAAE,mBAAmB,EAC7B,MAAM,EAAE,aAAa,EACI,MAAM,EAAE,cAAc,EAE/C,eAAe,GAAE,6BAAwD;IAG5F,YAAY,IAAI,IAAI;IAId,GAAG,IAAI,OAAO,CAAC,kBAAkB,CAAC;CAWzC"}

package/dist/identity/auth/doctor/initial-admin.doctor-check.js

@@ -0,0 +1,87 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.InitialAdminDoctorCheck = void 0;
+exports.decideInitialAdmin = decideInitialAdmin;
+const common_1 = require("@nestjs/common");
+const identity_options_1 = require("../../identity.options");
+const config_1 = require("@nestjs/config");
+const identity_constants_1 = require("../../identity.constants");
+const index_1 = require("../../../doctor/index");
+const index_2 = require("../../../core/index");
+/** Pure: judges the bootstrap variable and the number of active admins. */
+function decideInitialAdmin(input) {
+    const data = { activeAdmins: input.activeAdmins, initialAdminEmailSet: input.initialAdminEmailSet };
+    if (input.activeAdmins === 0) {
+        return {
+            status: 'fail',
+            detail: 'No active user holds the Admin role',
+            remedy: input.initialAdminEmailSet
+                ? 'Sign in with the INITIAL_ADMIN_EMAIL account; it is granted Admin on sign-in.'
+                : 'Set INITIAL_ADMIN_EMAIL to your email address, restart the API and sign in with that account.',
+            data,
+        };
+    }
+    if (!input.initialAdminEmailSet) {
+        return {
+            status: 'warn',
+            detail: `${input.activeAdmins} active admin(s), but INITIAL_ADMIN_EMAIL is not set`,
+            remedy: 'Set INITIAL_ADMIN_EMAIL so there is always a way back in: that account bypasses the ' +
+                'allowlist and is granted Admin on sign-in.',
+            data,
+        };
+    }
+    return { status: 'pass', detail: `${input.activeAdmins} active admin(s)`, data };
+}
+/** `auth` / `auth.initial-admin` — somebody can administer this deployment. */
+let InitialAdminDoctorCheck = class InitialAdminDoctorCheck {
+    registry;
+    config;
+    prisma;
+    identityOptions;
+    id = 'auth.initial-admin';
+    category = 'auth';
+    label = 'Administrator access';
+    settingsPath = '/admin/settings/users';
+    dependsOn = ['db.connection'];
+    constructor(registry, config, prisma, identityOptions = identity_options_1.DEFAULT_IDENTITY_OPTIONS) {
+        this.registry = registry;
+        this.config = config;
+        this.prisma = prisma;
+        this.identityOptions = identityOptions;
+    }
+    onModuleInit() {
+        this.registry.register(this);
+    }
+    async run() {
+        const email = this.config.get(this.identityOptions.initialAdminEmailEnv);
+        const activeAdmins = await this.prisma.user.count({
+            where: { isActive: true, userRoles: { some: { role: { name: identity_constants_1.ROLES.ADMIN } } } },
+        });
+        return decideInitialAdmin({
+            initialAdminEmailSet: typeof email === 'string' && email.trim() !== '',
+            activeAdmins: Number(activeAdmins ?? 0),
+        });
+    }
+};
+exports.InitialAdminDoctorCheck = InitialAdminDoctorCheck;
+exports.InitialAdminDoctorCheck = InitialAdminDoctorCheck = __decorate([
+    (0, common_1.Injectable)(),
+    __param(2, (0, common_1.Inject)(index_2.PLATFORM_PRISMA)),
+    __param(3, (0, common_1.Optional)()),
+    __param(3, (0, common_1.Inject)(identity_options_1.IDENTITY_OPTIONS)),
+    __metadata("design:paramtypes", [index_1.DoctorCheckRegistry,
+        config_1.ConfigService, Object, Object])
+], InitialAdminDoctorCheck);
+//# sourceMappingURL=initial-admin.doctor-check.js.map

package/dist/identity/auth/doctor/initial-admin.doctor-check.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"initial-admin.doctor-check.js","sourceRoot":"","sources":["../../../../src/identity/auth/doctor/initial-admin.doctor-check.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAWA,gDA0BC;AArCD,2CAA4E;AAC5E,6DAAwH;AACxH,2CAA+C;AAE/C,iEAAiD;AAEjD,iDAA4D;AAC5D,+CAAsD;AAGtD,2EAA2E;AAC3E,SAAgB,kBAAkB,CAAC,KAA8D;IAC/F,MAAM,IAAI,GAAG,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,oBAAoB,EAAE,KAAK,CAAC,oBAAoB,EAAE,CAAC;IAEpG,IAAI,KAAK,CAAC,YAAY,KAAK,CAAC,EAAE,CAAC;QAC7B,OAAO;YACL,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,qCAAqC;YAC7C,MAAM,EAAE,KAAK,CAAC,oBAAoB;gBAChC,CAAC,CAAC,+EAA+E;gBACjF,CAAC,CAAC,+FAA+F;YACnG,IAAI;SACL,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,KAAK,CAAC,oBAAoB,EAAE,CAAC;QAChC,OAAO;YACL,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,GAAG,KAAK,CAAC,YAAY,sDAAsD;YACnF,MAAM,EACJ,sFAAsF;gBACtF,4CAA4C;YAC9C,IAAI;SACL,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC,YAAY,kBAAkB,EAAE,IAAI,EAAE,CAAC;AACnF,CAAC;AAED,+EAA+E;AAExE,IAAM,uBAAuB,GAA7B,MAAM,uBAAuB;IAQf;IACA;IACyB;IAEzB;IAXV,EAAE,GAAG,oBAAoB,CAAC;IAC1B,QAAQ,GAAG,MAAM,CAAC;IAClB,KAAK,GAAG,sBAAsB,CAAC;IAC/B,YAAY,GAAG,uBAAuB,CAAC;IACvC,SAAS,GAAG,CAAC,eAAe,CAAC,CAAC;IAEvC,YACmB,QAA6B,EAC7B,MAAqB,EACI,MAAsB,EAE/C,kBAAiD,2CAAwB;QAJzE,aAAQ,GAAR,QAAQ,CAAqB;QAC7B,WAAM,GAAN,MAAM,CAAe;QACI,WAAM,GAAN,MAAM,CAAgB;QAE/C,oBAAe,GAAf,eAAe,CAA0D;IACzF,CAAC;IAEJ,YAAY;QACV,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC/B,CAAC;IAED,KAAK,CAAC,GAAG;QACP,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAS,IAAI,CAAC,eAAe,CAAC,oBAAoB,CAAC,CAAC;QACjF,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC;YAChD,KAAK,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,0BAAK,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;SAChF,CAAC,CAAC;QAEH,OAAO,kBAAkB,CAAC;YACxB,oBAAoB,EAAE,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE;YACtE,YAAY,EAAE,MAAM,CAAC,YAAY,IAAI,CAAC,CAAC;SACxC,CAAC,CAAC;IACL,CAAC;CACF,CAAA;AA9BY,0DAAuB;kCAAvB,uBAAuB;IADnC,IAAA,mBAAU,GAAE;IAWR,WAAA,IAAA,eAAM,EAAC,uBAAe,CAAC,CAAA;IACvB,WAAA,IAAA,iBAAQ,GAAE,CAAA;IAAE,WAAA,IAAA,eAAM,EAAC,mCAAgB,CAAC,CAAA;qCAHV,2BAAmB;QACrB,sBAAa;GAT7B,uBAAuB,CA8BnC"}

package/dist/identity/auth/doctor/jwt-secret.doctor-check.d.ts

@@ -0,0 +1,27 @@
+import { OnModuleInit } from '@nestjs/common';
+import { ConfigService } from '@nestjs/config';
+import { DoctorCheck, DoctorCheckOutcome } from '../../../doctor/index';
+import { DoctorCheckRegistry } from '../../../doctor/index';
+/**
+ * The placeholder the app's JWT strategy and maintenance module used to fall
+ * back to when JWT_SECRET was unset. Nothing falls back to it any more (a missing
+ * JWT_SECRET is a boot error, #727), but it is published, so a deployment that
+ * set it explicitly is still told to change it.
+ */
+export declare const JWT_FALLBACK_SECRET = "fallback-secret";
+/** Shorter than this is guessable enough to be worth a warning (256 bits of HS256 key). */
+export declare const JWT_MIN_SECRET_LENGTH = 32;
+/** Pure: judges the configured secret. Reports its LENGTH only, never its value. */
+export declare function decideJwtSecret(secret: string | undefined | null): DoctorCheckOutcome;
+/** `auth` / `auth.jwt-secret` — the access-token signing key is real. */
+export declare class JwtSecretDoctorCheck implements DoctorCheck, OnModuleInit {
+    private readonly registry;
+    private readonly config;
+    readonly id = "auth.jwt-secret";
+    readonly category = "auth";
+    readonly label = "JWT signing secret";
+    constructor(registry: DoctorCheckRegistry, config: ConfigService);
+    onModuleInit(): void;
+    run(): Promise<DoctorCheckOutcome>;
+}
+//# sourceMappingURL=jwt-secret.doctor-check.d.ts.map

package/dist/identity/auth/doctor/jwt-secret.doctor-check.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt-secret.doctor-check.d.ts","sourceRoot":"","sources":["../../../../src/identity/auth/doctor/jwt-secret.doctor-check.ts"],"names":[],"mappings":"AAAA,OAAO,EAAc,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC1D,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAE/C,OAAO,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AACxE,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAE5D;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB,oBAAoB,CAAC;AAErD,2FAA2F;AAC3F,eAAO,MAAM,qBAAqB,KAAK,CAAC;AAMxC,oFAAoF;AACpF,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,GAAG,kBAAkB,CA0BrF;AAED,yEAAyE;AACzE,qBACa,oBAAqB,YAAW,WAAW,EAAE,YAAY;IAMlE,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,MAAM;IANzB,QAAQ,CAAC,EAAE,qBAAqB;IAChC,QAAQ,CAAC,QAAQ,UAAU;IAC3B,QAAQ,CAAC,KAAK,wBAAwB;gBAGnB,QAAQ,EAAE,mBAAmB,EAC7B,MAAM,EAAE,aAAa;IAGxC,YAAY,IAAI,IAAI;IAId,GAAG,IAAI,OAAO,CAAC,kBAAkB,CAAC;CAGzC"}

package/dist/identity/auth/doctor/jwt-secret.doctor-check.js

@@ -0,0 +1,78 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.JwtSecretDoctorCheck = exports.JWT_MIN_SECRET_LENGTH = exports.JWT_FALLBACK_SECRET = void 0;
+exports.decideJwtSecret = decideJwtSecret;
+const common_1 = require("@nestjs/common");
+const config_1 = require("@nestjs/config");
+const index_1 = require("../../../doctor/index");
+/**
+ * The placeholder the app's JWT strategy and maintenance module used to fall
+ * back to when JWT_SECRET was unset. Nothing falls back to it any more (a missing
+ * JWT_SECRET is a boot error, #727), but it is published, so a deployment that
+ * set it explicitly is still told to change it.
+ */
+exports.JWT_FALLBACK_SECRET = 'fallback-secret';
+/** Shorter than this is guessable enough to be worth a warning (256 bits of HS256 key). */
+exports.JWT_MIN_SECRET_LENGTH = 32;
+const REMEDY = 'Set JWT_SECRET to a random value of at least 32 characters (e.g. `openssl rand -base64 48`) ' +
+    'and restart the API. Every signed-in user will have to sign in again.';
+/** Pure: judges the configured secret. Reports its LENGTH only, never its value. */
+function decideJwtSecret(secret) {
+    if (!secret) {
+        return {
+            status: 'fail',
+            detail: 'JWT_SECRET is not set',
+            remedy: REMEDY,
+        };
+    }
+    if (secret === exports.JWT_FALLBACK_SECRET) {
+        return {
+            status: 'fail',
+            detail: 'JWT_SECRET is the publicly known placeholder "fallback-secret"',
+            remedy: REMEDY,
+        };
+    }
+    if (secret.length < exports.JWT_MIN_SECRET_LENGTH) {
+        return {
+            status: 'warn',
+            detail: `JWT_SECRET is only ${secret.length} characters long`,
+            remedy: REMEDY,
+            data: { length: secret.length },
+        };
+    }
+    return { status: 'pass', detail: 'JWT_SECRET is set and long enough', data: { length: secret.length } };
+}
+/** `auth` / `auth.jwt-secret` — the access-token signing key is real. */
+let JwtSecretDoctorCheck = class JwtSecretDoctorCheck {
+    registry;
+    config;
+    id = 'auth.jwt-secret';
+    category = 'auth';
+    label = 'JWT signing secret';
+    constructor(registry, config) {
+        this.registry = registry;
+        this.config = config;
+    }
+    onModuleInit() {
+        this.registry.register(this);
+    }
+    async run() {
+        return decideJwtSecret(this.config.get('jwt.secret'));
+    }
+};
+exports.JwtSecretDoctorCheck = JwtSecretDoctorCheck;
+exports.JwtSecretDoctorCheck = JwtSecretDoctorCheck = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [index_1.DoctorCheckRegistry,
+        config_1.ConfigService])
+], JwtSecretDoctorCheck);
+//# sourceMappingURL=jwt-secret.doctor-check.js.map

package/dist/identity/auth/doctor/jwt-secret.doctor-check.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt-secret.doctor-check.js","sourceRoot":"","sources":["../../../../src/identity/auth/doctor/jwt-secret.doctor-check.ts"],"names":[],"mappings":";;;;;;;;;;;;AAsBA,0CA0BC;AAhDD,2CAA0D;AAC1D,2CAA+C;AAG/C,iDAA4D;AAE5D;;;;;GAKG;AACU,QAAA,mBAAmB,GAAG,iBAAiB,CAAC;AAErD,2FAA2F;AAC9E,QAAA,qBAAqB,GAAG,EAAE,CAAC;AAExC,MAAM,MAAM,GACV,8FAA8F;IAC9F,uEAAuE,CAAC;AAE1E,oFAAoF;AACpF,SAAgB,eAAe,CAAC,MAAiC;IAC/D,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO;YACL,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,uBAAuB;YAC/B,MAAM,EAAE,MAAM;SACf,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,KAAK,2BAAmB,EAAE,CAAC;QACnC,OAAO;YACL,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,gEAAgE;YACxE,MAAM,EAAE,MAAM;SACf,CAAC;IACJ,CAAC;IAED,IAAI,MAAM,CAAC,MAAM,GAAG,6BAAqB,EAAE,CAAC;QAC1C,OAAO;YACL,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,sBAAsB,MAAM,CAAC,MAAM,kBAAkB;YAC7D,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE;SAChC,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,mCAAmC,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC;AAC1G,CAAC;AAED,yEAAyE;AAElE,IAAM,oBAAoB,GAA1B,MAAM,oBAAoB;IAMZ;IACA;IANV,EAAE,GAAG,iBAAiB,CAAC;IACvB,QAAQ,GAAG,MAAM,CAAC;IAClB,KAAK,GAAG,oBAAoB,CAAC;IAEtC,YACmB,QAA6B,EAC7B,MAAqB;QADrB,aAAQ,GAAR,QAAQ,CAAqB;QAC7B,WAAM,GAAN,MAAM,CAAe;IACrC,CAAC;IAEJ,YAAY;QACV,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC/B,CAAC;IAED,KAAK,CAAC,GAAG;QACP,OAAO,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAS,YAAY,CAAC,CAAC,CAAC;IAChE,CAAC;CACF,CAAA;AAjBY,oDAAoB;+BAApB,oBAAoB;IADhC,IAAA,mBAAU,GAAE;qCAOkB,2BAAmB;QACrB,sBAAa;GAP7B,oBAAoB,CAiBhC"}

package/dist/identity/auth/doctor/principal-cache.doctor-check.d.ts

@@ -0,0 +1,25 @@
+import { OnModuleInit } from '@nestjs/common';
+import type { IdentityEventBusHealth as EventBusHealth } from '../../ports';
+import { DoctorCheck, DoctorCheckOutcome } from '../../../doctor/index';
+import { DoctorCheckRegistry } from '../../../doctor/index';
+import { PrincipalCache, type PrincipalCacheStats } from '../principal-cache/principal-cache.service';
+/**
+ * Pure: what the principal cache's TTL, its counters and the bus's snapshot
+ * say about how fast a role change or deactivation reaches every replica.
+ *
+ * NEVER `fail`: whatever the bus does, a stale principal lives at most the
+ * TTL, and every replica that made a change drops its own entry at once.
+ */
+export declare function decidePrincipalCache(ttlSeconds: number, stats: PrincipalCacheStats, bus: EventBusHealth): DoctorCheckOutcome;
+/** `auth` / `auth.principal-cache` — the JWT principal cache's TTL and propagation (PP-1.12, #683). */
+export declare class PrincipalCacheDoctorCheck implements DoctorCheck, OnModuleInit {
+    private readonly registry;
+    private readonly cache;
+    readonly id = "auth.principal-cache";
+    readonly category = "auth";
+    readonly label = "JWT principal cache";
+    constructor(registry: DoctorCheckRegistry, cache: PrincipalCache);
+    onModuleInit(): void;
+    run(): Promise<DoctorCheckOutcome>;
+}
+//# sourceMappingURL=principal-cache.doctor-check.d.ts.map

package/dist/identity/auth/doctor/principal-cache.doctor-check.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"principal-cache.doctor-check.d.ts","sourceRoot":"","sources":["../../../../src/identity/auth/doctor/principal-cache.doctor-check.ts"],"names":[],"mappings":"AAAA,OAAO,EAAc,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAE1D,OAAO,KAAK,EAAE,sBAAsB,IAAI,cAAc,EAAE,MAAM,aAAa,CAAC;AAC5E,OAAO,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AACxE,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,EAAE,cAAc,EAAE,KAAK,mBAAmB,EAAE,MAAM,4CAA4C,CAAC;AAEtG;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAClC,UAAU,EAAE,MAAM,EAClB,KAAK,EAAE,mBAAmB,EAC1B,GAAG,EAAE,cAAc,GAClB,kBAAkB,CAuDpB;AAED,uGAAuG;AACvG,qBACa,yBAA0B,YAAW,WAAW,EAAE,YAAY;IAMvE,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,KAAK;IANxB,QAAQ,CAAC,EAAE,0BAA0B;IACrC,QAAQ,CAAC,QAAQ,UAAU;IAC3B,QAAQ,CAAC,KAAK,yBAAyB;gBAGpB,QAAQ,EAAE,mBAAmB,EAC7B,KAAK,EAAE,cAAc;IAGxC,YAAY,IAAI,IAAI;IAKd,GAAG,IAAI,OAAO,CAAC,kBAAkB,CAAC;CAGzC"}

package/dist/identity/auth/doctor/principal-cache.doctor-check.js

@@ -0,0 +1,95 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PrincipalCacheDoctorCheck = void 0;
+exports.decidePrincipalCache = decidePrincipalCache;
+const common_1 = require("@nestjs/common");
+const index_1 = require("../../../doctor/index");
+const principal_cache_service_1 = require("../principal-cache/principal-cache.service");
+/**
+ * Pure: what the principal cache's TTL, its counters and the bus's snapshot
+ * say about how fast a role change or deactivation reaches every replica.
+ *
+ * NEVER `fail`: whatever the bus does, a stale principal lives at most the
+ * TTL, and every replica that made a change drops its own entry at once.
+ */
+function decidePrincipalCache(ttlSeconds, stats, bus) {
+    const data = {
+        ttlSeconds,
+        size: stats.size,
+        hits: stats.hits,
+        misses: stats.misses,
+        invalidations: stats.invalidations,
+        adapter: bus.adapter,
+    };
+    if (ttlSeconds <= 0) {
+        return {
+            status: 'skip',
+            detail: 'The JWT principal cache is off (AUTH_PRINCIPAL_CACHE_TTL_SECONDS=0): every request reads the ' +
+                'user, roles and permissions from the database',
+            data,
+        };
+    }
+    if (bus.adapter === 'in-process') {
+        return {
+            status: 'warn',
+            detail: `Principals are cached for up to ${ttlSeconds}s on an in-process event bus: correct for exactly ` +
+                'one API replica, but with more than one, a role change or deactivation reaches the other ' +
+                `replicas only when their entry expires (up to ${ttlSeconds}s)`,
+            remedy: 'Set EVENT_BUS_ADAPTER=postgres and restart every API replica so invalidations cross replicas, ' +
+                'or set AUTH_PRINCIPAL_CACHE_TTL_SECONDS=0 to turn the cache off.',
+            data,
+        };
+    }
+    if (!bus.connected) {
+        return {
+            status: 'warn',
+            detail: 'The event bus listener is disconnected, so invalidations from other replicas are being missed; ' +
+                `a role change or deactivation made elsewhere takes up to ${ttlSeconds}s to reach this replica`,
+            remedy: 'See the `core.event-bus` check for why the listener is down. Lower ' +
+                'AUTH_PRINCIPAL_CACHE_TTL_SECONDS (0 disables the cache) to tighten the bound meanwhile.',
+            ...(bus.lastError ? { error: bus.lastError } : {}),
+            data,
+        };
+    }
+    return {
+        status: 'pass',
+        detail: `Principals are cached for up to ${ttlSeconds}s and invalidated across replicas on the ` +
+            `${bus.adapter} event bus; changes reach the next request`,
+        data,
+    };
+}
+/** `auth` / `auth.principal-cache` — the JWT principal cache's TTL and propagation (PP-1.12, #683). */
+let PrincipalCacheDoctorCheck = class PrincipalCacheDoctorCheck {
+    registry;
+    cache;
+    id = 'auth.principal-cache';
+    category = 'auth';
+    label = 'JWT principal cache';
+    constructor(registry, cache) {
+        this.registry = registry;
+        this.cache = cache;
+    }
+    onModuleInit() {
+        this.registry.register(this);
+    }
+    // Read-only: two in-memory snapshots (the cache's and its bus's), no I/O, no probe publish.
+    async run() {
+        return decidePrincipalCache(this.cache.ttlMs / 1000, this.cache.stats(), this.cache.busHealth());
+    }
+};
+exports.PrincipalCacheDoctorCheck = PrincipalCacheDoctorCheck;
+exports.PrincipalCacheDoctorCheck = PrincipalCacheDoctorCheck = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [index_1.DoctorCheckRegistry,
+        principal_cache_service_1.PrincipalCache])
+], PrincipalCacheDoctorCheck);
+//# sourceMappingURL=principal-cache.doctor-check.js.map

package/dist/identity/auth/doctor/principal-cache.doctor-check.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"principal-cache.doctor-check.js","sourceRoot":"","sources":["../../../../src/identity/auth/doctor/principal-cache.doctor-check.ts"],"names":[],"mappings":";;;;;;;;;;;;AAcA,oDA2DC;AAzED,2CAA0D;AAI1D,iDAA4D;AAC5D,wFAAsG;AAEtG;;;;;;GAMG;AACH,SAAgB,oBAAoB,CAClC,UAAkB,EAClB,KAA0B,EAC1B,GAAmB;IAEnB,MAAM,IAAI,GAAG;QACX,UAAU;QACV,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,OAAO,EAAE,GAAG,CAAC,OAAO;KACrB,CAAC;IAEF,IAAI,UAAU,IAAI,CAAC,EAAE,CAAC;QACpB,OAAO;YACL,MAAM,EAAE,MAAM;YACd,MAAM,EACJ,+FAA+F;gBAC/F,+CAA+C;YACjD,IAAI;SACL,CAAC;IACJ,CAAC;IAED,IAAI,GAAG,CAAC,OAAO,KAAK,YAAY,EAAE,CAAC;QACjC,OAAO;YACL,MAAM,EAAE,MAAM;YACd,MAAM,EACJ,mCAAmC,UAAU,oDAAoD;gBACjG,2FAA2F;gBAC3F,iDAAiD,UAAU,IAAI;YACjE,MAAM,EACJ,gGAAgG;gBAChG,kEAAkE;YACpE,IAAI;SACL,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC;QACnB,OAAO;YACL,MAAM,EAAE,MAAM;YACd,MAAM,EACJ,iGAAiG;gBACjG,4DAA4D,UAAU,yBAAyB;YACjG,MAAM,EACJ,qEAAqE;gBACrE,yFAAyF;YAC3F,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAClD,IAAI;SACL,CAAC;IACJ,CAAC;IAED,OAAO;QACL,MAAM,EAAE,MAAM;QACd,MAAM,EACJ,mCAAmC,UAAU,2CAA2C;YACxF,GAAG,GAAG,CAAC,OAAO,4CAA4C;QAC5D,IAAI;KACL,CAAC;AACJ,CAAC;AAED,uGAAuG;AAEhG,IAAM,yBAAyB,GAA/B,MAAM,yBAAyB;IAMjB;IACA;IANV,EAAE,GAAG,sBAAsB,CAAC;IAC5B,QAAQ,GAAG,MAAM,CAAC;IAClB,KAAK,GAAG,qBAAqB,CAAC;IAEvC,YACmB,QAA6B,EAC7B,KAAqB;QADrB,aAAQ,GAAR,QAAQ,CAAqB;QAC7B,UAAK,GAAL,KAAK,CAAgB;IACrC,CAAC;IAEJ,YAAY;QACV,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC/B,CAAC;IAED,4FAA4F;IAC5F,KAAK,CAAC,GAAG;QACP,OAAO,oBAAoB,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC;IACnG,CAAC;CACF,CAAA;AAlBY,8DAAyB;oCAAzB,yBAAyB;IADrC,IAAA,mBAAU,GAAE;qCAOkB,2BAAmB;QACtB,wCAAc;GAP7B,yBAAyB,CAkBrC"}

package/dist/identity/auth/dto/auth-provider.dto.d.ts

@@ -0,0 +1,15 @@
+/**
+ * OAuth provider information
+ */
+export declare class AuthProviderDto {
+    name: string;
+    enabled: boolean;
+    mode?: 'custom';
+}
+/**
+ * Response for listing enabled OAuth providers
+ */
+export declare class AuthProvidersResponseDto {
+    providers: AuthProviderDto[];
+}
+//# sourceMappingURL=auth-provider.dto.d.ts.map

package/dist/identity/auth/dto/auth-provider.dto.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-provider.dto.d.ts","sourceRoot":"","sources":["../../../../src/identity/auth/dto/auth-provider.dto.ts"],"names":[],"mappings":"AAEA;;GAEG;AACH,qBAAa,eAAe;IAK1B,IAAI,EAAG,MAAM,CAAC;IAMd,OAAO,EAAG,OAAO,CAAC;IASlB,IAAI,CAAC,EAAE,QAAQ,CAAC;CACjB;AAED;;GAEG;AACH,qBAAa,wBAAwB;IAKnC,SAAS,EAAG,eAAe,EAAE,CAAC;CAC/B"}

package/dist/identity/auth/dto/auth-provider.dto.js

@@ -0,0 +1,60 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AuthProvidersResponseDto = exports.AuthProviderDto = void 0;
+const swagger_1 = require("@nestjs/swagger");
+/**
+ * OAuth provider information
+ */
+class AuthProviderDto {
+    name;
+    enabled;
+    mode;
+}
+exports.AuthProviderDto = AuthProviderDto;
+__decorate([
+    (0, swagger_1.ApiProperty)({
+        example: 'google',
+        description: 'OAuth provider name',
+    }),
+    __metadata("design:type", String)
+], AuthProviderDto.prototype, "name", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({
+        example: true,
+        description: 'Whether the provider is enabled',
+    }),
+    __metadata("design:type", Boolean)
+], AuthProviderDto.prototype, "enabled", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({
+        required: false,
+        enum: ['custom'],
+        example: 'custom',
+        description: 'Present only for a provider that owns its sign-in flow (no `/api/auth/<name>` redirect route): the login page then asks the web provider look to start it. Absent for a redirect provider.',
+    }),
+    __metadata("design:type", String)
+], AuthProviderDto.prototype, "mode", void 0);
+/**
+ * Response for listing enabled OAuth providers
+ */
+class AuthProvidersResponseDto {
+    providers;
+}
+exports.AuthProvidersResponseDto = AuthProvidersResponseDto;
+__decorate([
+    (0, swagger_1.ApiProperty)({
+        type: [AuthProviderDto],
+        description: 'List of OAuth providers',
+    }),
+    __metadata("design:type", Array)
+], AuthProvidersResponseDto.prototype, "providers", void 0);
+//# sourceMappingURL=auth-provider.dto.js.map

package/dist/identity/auth/dto/auth-provider.dto.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-provider.dto.js","sourceRoot":"","sources":["../../../../src/identity/auth/dto/auth-provider.dto.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,6CAA8C;AAE9C;;GAEG;AACH,MAAa,eAAe;IAK1B,IAAI,CAAU;IAMd,OAAO,CAAW;IASlB,IAAI,CAAY;CACjB;AArBD,0CAqBC;AAhBC;IAJC,IAAA,qBAAW,EAAC;QACX,OAAO,EAAE,QAAQ;QACjB,WAAW,EAAE,qBAAqB;KACnC,CAAC;;6CACY;AAMd;IAJC,IAAA,qBAAW,EAAC;QACX,OAAO,EAAE,IAAI;QACb,WAAW,EAAE,iCAAiC;KAC/C,CAAC;;gDACgB;AASlB;IAPC,IAAA,qBAAW,EAAC;QACX,QAAQ,EAAE,KAAK;QACf,IAAI,EAAE,CAAC,QAAQ,CAAC;QAChB,OAAO,EAAE,QAAQ;QACjB,WAAW,EACT,4LAA4L;KAC/L,CAAC;;6CACc;AAGlB;;GAEG;AACH,MAAa,wBAAwB;IAKnC,SAAS,CAAqB;CAC/B;AAND,4DAMC;AADC;IAJC,IAAA,qBAAW,EAAC;QACX,IAAI,EAAE,CAAC,eAAe,CAAC;QACvB,WAAW,EAAE,yBAAyB;KACvC,CAAC;;2DAC4B"}

package/dist/identity/auth/dto/auth-user.dto.d.ts

@@ -0,0 +1,50 @@
+import type { TenancyMode } from '../../../core/index';
+/**
+ * Role information
+ */
+export declare class RoleDto {
+    name: string;
+}
+/**
+ * The organization the session acts in (#724)
+ */
+export declare class ActiveOrgDto {
+    id: string;
+    name: string;
+    slug: string;
+}
+/**
+ * One organization the user is an active member of (#724)
+ */
+export declare class OrgMembershipDto {
+    orgId: string;
+    name: string;
+    slug: string;
+    role: string;
+}
+/**
+ * Current authenticated user information
+ */
+export declare class CurrentUserDto {
+    id: string;
+    email: string;
+    displayName: string | null;
+    profileImageUrl: string | null;
+    providerProfileImageUrl: string | null;
+    hasUploadedProfileImage: boolean;
+    isActive: boolean;
+    roles: RoleDto[];
+    permissions: string[];
+    tenancyMode: TenancyMode;
+    activeOrg: ActiveOrgDto | null;
+    memberships: OrgMembershipDto[];
+    extensions?: Record<string, Record<string, unknown>>;
+}
+/**
+ * JWT token response
+ */
+export declare class TokenResponseDto {
+    accessToken: string;
+    expiresIn: number;
+}
+//# sourceMappingURL=auth-user.dto.d.ts.map