@marinoscar/platform-api 0.1.0-next.3 → 0.1.0-next.5

package/dist/identity/auth/auth.service.js

@@ -0,0 +1,1394 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+var AuthService_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AuthService = exports.ORG_SWITCHED_AUDIT_ACTION = void 0;
+const common_1 = require("@nestjs/common");
+const config_1 = require("@nestjs/config");
+const api_1 = require("@opentelemetry/api");
+const jwt_1 = require("@nestjs/jwt");
+const node_crypto_1 = require("node:crypto");
+const index_1 = require("../../core/index");
+const event_emitter_1 = require("@nestjs/event-emitter");
+const ports_1 = require("../ports");
+const identity_options_1 = require("../identity.options");
+const identity_events_1 = require("../identity.events");
+const auth_provider_registry_1 = require("./providers/auth-provider.registry");
+const external_profile_1 = require("./external-profile");
+const sign_in_policy_1 = require("./sign-in-policy");
+const admin_bootstrap_service_1 = require("./admin-bootstrap.service");
+const allowlist_service_1 = require("../allowlist/allowlist.service");
+const index_2 = require("../../core/index");
+const identity_constants_1 = require("../identity.constants");
+const auth_error_codes_1 = require("./auth-error-codes");
+const principal_factory_1 = require("./principal.factory");
+const credential_binding_1 = require("./credential-binding");
+const principal_cache_service_1 = require("./principal-cache/principal-cache.service");
+const organizations_service_1 = require("../organizations/organizations.service");
+const tenancy_service_1 = require("../organizations/tenancy.service");
+const user_extensions_1 = require("../extensions/user-extensions");
+/**
+ * The audit action `POST /api/auth/switch-org` writes (#724).
+ *
+ * @stability stable
+ */
+exports.ORG_SWITCHED_AUDIT_ACTION = 'auth:org_switched';
+/** How long the default organization's id is memoised for the legacy-token path (#724). */
+const DEFAULT_ORG_MEMO_MS = 60_000;
+/** `/api/auth/me`'s graph: the principal graph plus each membership's org name and slug (#724). */
+const CURRENT_USER_INCLUDE = {
+    ...principal_factory_1.PRINCIPAL_USER_INCLUDE,
+    memberships: {
+        include: {
+            org: { select: { id: true, isDefault: true, name: true, slug: true } },
+            role: principal_factory_1.PRINCIPAL_USER_INCLUDE.memberships.include.role,
+        },
+    },
+    userSettings: {
+        select: { value: true },
+    },
+};
+/** The credential store of an app that bound none: every secret is absent. */
+const NO_AUTH_CREDENTIALS = Object.freeze({ getSecret: async () => null });
+/**
+ * Exported for the reference app's wiring and tests; not a stable extension point (reach identity through IdentityModule and its documented seams).
+ *
+ * @internal
+ */
+let AuthService = AuthService_1 = class AuthService {
+    prisma;
+    jwtService;
+    configService;
+    adminBootstrapService;
+    allowlistService;
+    notifications;
+    principalCache;
+    organizations;
+    tenancy;
+    metrics;
+    userDefaults;
+    profileImages;
+    identityOptions;
+    events;
+    signInPolicy;
+    authCredentials;
+    logger = new common_1.Logger(AuthService_1.name);
+    /**
+     * When this process started. A token issued before #724 carries no `org`
+     * claim; it is honoured (single mode only) until one access-token lifetime
+     * past this instant, so in-flight tokens survive the deploy (#724).
+     */
+    startedAt = Date.now();
+    /** The default organization's id, memoised briefly for the legacy-token path. */
+    defaultOrgMemo = null;
+    constructor(prisma, jwtService, configService, adminBootstrapService, allowlistService, notifications, 
+    // PP-1.12 (#683): JWT principals are read through this short-TTL cache.
+    principalCache, 
+    // PP-6.1 (#721): new users join the default organization.
+    organizations, 
+    // PP-6.2 (#722): TENANCY_MODE decides who joins the default org and who
+    // is refused for having no organization.
+    tenancy, metrics = ports_1.NOOP_IDENTITY_METRICS, userDefaults, profileImages, identityOptions = identity_options_1.DEFAULT_IDENTITY_OPTIONS, events, signInPolicy, authCredentials) {
+        this.prisma = prisma;
+        this.jwtService = jwtService;
+        this.configService = configService;
+        this.adminBootstrapService = adminBootstrapService;
+        this.allowlistService = allowlistService;
+        this.notifications = notifications;
+        this.principalCache = principalCache;
+        this.organizations = organizations;
+        this.tenancy = tenancy;
+        this.metrics = metrics;
+        this.userDefaults = userDefaults;
+        this.profileImages = profileImages;
+        this.identityOptions = identityOptions;
+        this.events = events;
+        this.signInPolicy = signInPolicy;
+        this.authCredentials = authCredentials;
+    }
+    /**
+     * Handles Google OAuth login: maps the Google profile to the neutral shape
+     * and runs the shared sign-in ({@link completeExternalLogin}) with Google's
+     * rules (a verified address links to the existing user holding it).
+     */
+    async handleGoogleLogin(profile) {
+        return this.signInWith((0, external_profile_1.googleProfileToExternal)(profile), { label: 'Google', linkExistingByEmail: true });
+    }
+    /**
+     * Completes a sign-in for ANY registered provider: allowlist, the app's
+     * {@link SignInPolicy}, the user lookup (by `(provider, subject)`), creation
+     * or linking, the disabled and tenancy checks, then the session. Returns the
+     * tokens; the caller (the generic callback route, or a `custom` provider's own
+     * controller through `respondToSignIn`) puts the refresh token in the cookie.
+     *
+     * What it refuses, as `AuthLoginDeniedException` (the redirect carries only
+     * the `reason` code):
+     * - an address the provider does not vouch for (`emailVerified: false`) or no
+     *   address at all: `access_denied`;
+     * - an address outside the allowlist (`INITIAL_ADMIN_EMAIL` bypasses it):
+     *   `not_allowlisted`;
+     * - an address that belongs to a user with no identity at this provider,
+     *   unless the provider declared `linkExistingByEmail`: `access_denied`
+     *   (identities are never merged on an address the provider could have forged);
+     * - a `SignInPolicy` denial: its `reason`;
+     * - a disabled account: `account_disabled`; no organization: `no_organization`.
+     *
+     * @param profile - the provider's neutral profile; `provider` must be registered.
+     * @returns the access token, its lifetime and the refresh token.
+     * @throws Error when `profile.provider` is not a registered provider or the
+     *   profile is malformed (a programming error, not a refusal).
+     *
+     * @stability experimental
+     */
+    async completeExternalLogin(profile) {
+        (0, external_profile_1.assertExternalProfile)(profile);
+        const definition = auth_provider_registry_1.authProviderRegistry.get(profile.provider);
+        if (!definition) {
+            throw new Error(`completeExternalLogin: "${profile.provider}" is not a registered sign-in provider (registerAuthProvider).`);
+        }
+        return this.signInWith((0, external_profile_1.normalizeExternalProfile)(profile), {
+            label: definition.label ?? definition.id,
+            linkExistingByEmail: definition.linkExistingByEmail === true,
+        });
+    }
+    /** The sign-in itself, for a profile and the rules of its provider. */
+    async signInWith(profile, rules) {
+        // `linkExistingByEmail` is the provider's "trusted to vouch for the address"
+        // flag: it gates linking by address AND the INITIAL_ADMIN_EMAIL bootstrap.
+        this.logger.log(`${rules.label} login attempt for email: ${profile.email}`);
+        // The address is the key to the allowlist, the initial-admin bootstrap and
+        // account linking, so it must be one the provider vouches for. Checked
+        // before any lookup, so an unverified address learns nothing.
+        if (profile.email === null || !profile.emailVerified) {
+            this.logger.warn(`Login denied - ${rules.label} did not provide a verified email address`);
+            this.recordLogin('allowlist_rejected', profile.provider);
+            throw new auth_error_codes_1.AuthLoginDeniedException('access_denied', 'The sign-in provider did not verify your email address.');
+        }
+        const verified = { ...profile, email: profile.email };
+        // Check allowlist before any user lookup/creation
+        const email = verified.email.toLowerCase();
+        const isAllowed = await this.allowlistService.isEmailAllowed(email);
+        // INITIAL_ADMIN_EMAIL bypasses the allowlist and bootstraps the first
+        // administrator, so only a provider trusted to vouch for the address may
+        // trigger it (`linkExistingByEmail`: Google). A multi-tenant issuer
+        // (Entra, a shared OIDC issuer) lets a tenant present any address, so for
+        // it the allowlist is the only gate and it is never made an administrator.
+        const isInitialAdmin = rules.linkExistingByEmail && this.isInitialAdminEmail(email);
+        if (!isAllowed && !isInitialAdmin) {
+            this.logger.warn(`Login denied - email not in allowlist: ${email}`);
+            this.recordLogin('allowlist_rejected', profile.provider);
+            throw new auth_error_codes_1.AuthLoginDeniedException('not_allowlisted', 'Your email is not authorized to access this application. Please contact an administrator.');
+        }
+        // Check if identity already exists
+        let identity = await this.prisma.userIdentity.findUnique({
+            where: {
+                provider_providerSubject: {
+                    provider: verified.provider,
+                    providerSubject: verified.subject,
+                },
+            },
+            include: {
+                // System roles and memberships with their org roles (PP-6.3, #723).
+                user: { include: principal_factory_1.PRINCIPAL_USER_INCLUDE },
+            },
+        });
+        let user = identity?.user || null;
+        // Set ONLY on the branch below that actually inserts a user row. This is
+        // the fire-once condition for `user.welcome` (#128) — see the trigger at
+        // the end of this method for why the notification is raised there and not
+        // inside the branch.
+        let userWasCreated = false;
+        // The user an unlinked sign-in would be linked to (identity linking), when
+        // the provider is allowed to link by address.
+        let linkTarget = null;
+        if (!user) {
+            // Check if user exists by email (identity linking case)
+            let existingUser = await this.prisma.user.findUnique({
+                where: { email: verified.email },
+                include: principal_factory_1.PRINCIPAL_USER_INCLUDE,
+            });
+            // `users.email` is a case-sensitive unique and the allowlist lowercases,
+            // so `Alice@corp.com` would otherwise get a second account next to
+            // `alice@corp.com`. For a provider that does not link, look the address up
+            // case-insensitively too and apply the same refusal. Google's lookup is
+            // deliberately left exactly as it was.
+            if (!existingUser && !rules.linkExistingByEmail) {
+                existingUser = await this.prisma.user.findFirst({
+                    where: { email: { equals: verified.email, mode: 'insensitive' } },
+                    include: principal_factory_1.PRINCIPAL_USER_INCLUDE,
+                });
+            }
+            if (existingUser) {
+                // An address already owned by an account that has no identity at this
+                // provider is merged ONLY for a provider that declared its verified
+                // addresses unforgeable (Google). Anything else is refused: merging on
+                // an address a tenant admin or user could have set would let them
+                // sign in as that account.
+                if (!rules.linkExistingByEmail) {
+                    this.logger.warn(`Login denied - ${rules.label} address belongs to an account with no ${rules.label} identity (linking by address is off for this provider)`);
+                    this.recordLogin('allowlist_rejected', profile.provider);
+                    throw new auth_error_codes_1.AuthLoginDeniedException('access_denied', 'This email address belongs to an account that is not linked to this sign-in provider.');
+                }
+                linkTarget = existingUser;
+            }
+        }
+        // The app's sign-in policy: after the allowlist and the address rules,
+        // before the first write, so a denial creates and links nothing.
+        const decision = await this.evaluateSignInPolicy(verified, {
+            existingUserId: (user ?? linkTarget)?.id ?? null,
+            isInitialAdmin,
+        });
+        if (!user) {
+            if (linkTarget) {
+                // Link new identity to existing user
+                this.logger.log(`Linking ${rules.label} identity to existing user: ${linkTarget.email}`);
+                await this.prisma.userIdentity.create({
+                    data: {
+                        userId: linkTarget.id,
+                        provider: verified.provider,
+                        providerSubject: verified.subject,
+                        providerEmail: verified.email,
+                    },
+                });
+                user = linkTarget;
+            }
+            else {
+                // Create new user with identity
+                this.logger.log(`Creating new user: ${verified.email}`);
+                user = await this.createNewUser(verified, isInitialAdmin, decision.roles, rules.linkExistingByEmail);
+                userWasCreated = true;
+                // Mark email as claimed in allowlist
+                await this.allowlistService.markEmailClaimed(email, user.id);
+            }
+        }
+        // Update provider profile information (don't overwrite user overrides)
+        await this.prisma.user.update({
+            where: { id: user.id },
+            data: {
+                providerDisplayName: profile.displayName,
+                providerProfileImageUrl: profile.pictureUrl || null,
+            },
+        });
+        // Principal cache (PP-1.12, #683): the cached row carries these columns.
+        this.principalCache.invalidate({ userId: user.id });
+        // Check if user is disabled
+        if (!user.isActive) {
+            this.logger.warn(`Login attempt by disabled user: ${user.email}`);
+            this.recordLogin('disabled', profile.provider);
+            throw new auth_error_codes_1.AuthLoginDeniedException('account_disabled', 'User account is disabled');
+        }
+        // Invitations (#726): claim every pending, unexpired invitation to this
+        // address BEFORE the tenancy check below, so an invitee's first multi-org
+        // sign-in finds the membership it grants. After the disabled check, so a
+        // deactivated account claims nothing. A claim changes the memberships the
+        // active-org choice reads, so the graph is reloaded.
+        const claimed = await this.organizations.claimPendingInvites(user.id, email);
+        if (claimed > 0) {
+            this.logger.log(`User ${user.id} accepted ${claimed} organization invitation(s) at sign-in`);
+            user =
+                (await this.prisma.user.findUnique({
+                    where: { id: user.id },
+                    include: principal_factory_1.PRINCIPAL_USER_INCLUDE,
+                })) ?? user;
+        }
+        // Tenancy mode (PP-6.2, #722): self-heal the default-org membership, or
+        // refuse a multi-org sign-in that belongs to no organization. After the
+        // disabled check, so a deactivated account is told that first and never
+        // written to.
+        await this.applyTenancyAtSignIn(user.id, {
+            isInitialAdmin,
+            userWasCreated,
+            provider: profile.provider,
+            // A restored membership's org role (PP-6.3, #723): an administrator's
+            // is org_admin, everyone else's the default org role.
+            orgRoleName: user.userRoles.some((ur) => ur.role.name === identity_constants_1.ROLES.ADMIN)
+                ? identity_constants_1.ORG_ADMIN_ROLE
+                : this.identityOptions.defaultOrgRole,
+        });
+        // The active organization (#724): single mode, the default org; multi
+        // mode, the active membership used most recently. Refused when there is
+        // none (a suspended default-org member in single mode; multi mode already
+        // refused zero memberships above).
+        const orgId = await this.chooseSignInOrg(user);
+        if (!orgId) {
+            this.logger.warn(`Login denied - user ${user.id} has no active organization membership to sign in to`);
+            this.recordLogin('no_organization', profile.provider);
+            throw new auth_error_codes_1.AuthLoginDeniedException('no_organization', 'Your account is not a member of any organization. Ask an organization administrator to invite you.');
+        }
+        // Generate JWT tokens, bound to that organization
+        const tokens = await this.generateFullTokens(user, { orgId });
+        await this.organizations.touchMembership(orgId, user.id);
+        this.logger.log(`Login successful for user: ${user.email}`);
+        this.recordLogin('success', profile.provider);
+        // -------------------------------------------------------------------------
+        // Trigger: `user.welcome` (#128, epic #109)
+        // -------------------------------------------------------------------------
+        //
+        // FIRES ONCE PER ACCOUNT, and the guarantee is structural rather than a
+        // check on some "welcomed" column. `userWasCreated` is set on exactly one
+        // branch above: the one reached only when NO identity matched
+        // (provider + subject) AND no user matched by email — i.e. the branch that
+        // runs `INSERT INTO users`. Every subsequent login resolves an identity and
+        // never enters it, and the identity-LINKING case (an existing account
+        // adding a second provider) is a different branch that does not set the
+        // flag, correctly: that user already has an account and was welcomed when
+        // it was made.
+        //
+        // AND ONLY AFTER THE ROW IS COMMITTED. `createNewUser` wraps its inserts in
+        // `prisma.$transaction`, and that promise has resolved — the transaction
+        // has committed — before it returns. So by the time this line runs, the
+        // user, its identity, its default role and its `user_settings` row are all
+        // durable. That matters concretely: the dispatcher reads BOTH `users.email`
+        // (for the address) and `user_settings.value` (for preferences) on its own
+        // connection, outside any transaction of ours. Raising this inside
+        // `createNewUser`'s transaction would have the dispatch race a row it
+        // cannot see, and `loadRecipient` would log "user not found" and deliver
+        // nothing.
+        //
+        // RAISED HERE, AT THE END, RATHER THAN IN THE CREATION BRANCH. Between the
+        // insert and this point the method can still refuse the login — the
+        // `isActive` check, or a failure generating tokens. Welcoming somebody to
+        // an application they were just refused entry to is a worse message than
+        // no message. The flag carries the fire-once condition down to the point
+        // where the login is known to have succeeded.
+        //
+        // CONTAINED: `notify` never rejects and never joins a transaction, so a
+        // mail outage cannot fail the login. It also returns before anything is
+        // rendered or sent, so it adds no latency to the OAuth callback.
+        if (userWasCreated) {
+            const appUrl = this.configService.get('appUrl');
+            const payload = {
+                recipientEmail: user.email,
+                // Optional fields spread in conditionally rather than assigned
+                // `undefined` — same convention as the notification channels.
+                ...(profile.displayName ? { recipientName: profile.displayName } : {}),
+                // System roles plus the default-org role (PP-6.3, #723).
+                roles: principal_factory_1.principalFactory.access(user).roles,
+                ...(appUrl ? { appUrl: appUrl.replace(/\/+$/, '') } : {}),
+            };
+            await this.notifications.userWelcomed(user.id, payload);
+        }
+        // After the session exists and the welcome was raised; ids and the
+        // provider id only (no address, no token, no profile).
+        (0, identity_events_1.emitIdentityEvent)(this.events, this.logger, identity_events_1.IDENTITY_EVENTS.LOGIN_SUCCEEDED, {
+            userId: user.id,
+            provider: profile.provider,
+            isNewUser: userWasCreated,
+        });
+        return tokens;
+    }
+    /**
+     * One `app.auth.logins` observation. Google's calls keep the one-argument
+     * form they always had (the instrument defaults the provider to `google`).
+     */
+    recordLogin(outcome, provider) {
+        if (provider === undefined || provider === 'google')
+            this.metrics.authLogin(outcome);
+        else
+            this.metrics.authLogin(outcome, provider);
+    }
+    /**
+     * Asks the app's {@link SignInPolicy} (when one is bound). A denial, a
+     * malformed answer for a denial, or a throw ends the sign-in; a policy never
+     * sees the user created or linked yet.
+     */
+    async evaluateSignInPolicy(profile, ctx) {
+        if (!this.signInPolicy)
+            return {};
+        let decision;
+        try {
+            decision = await this.signInPolicy.beforeLogin(profile, ctx);
+        }
+        catch (error) {
+            // Fail closed. The message is the policy's own and may name a claim, so
+            // only the exception type is logged.
+            this.logger.error(`Sign-in policy failed for ${profile.provider} (${error instanceof Error ? error.name : typeof error}); refusing the sign-in`);
+            throw new Error('The sign-in policy failed');
+        }
+        if (decision?.allow === true) {
+            return decision.roles?.length ? { roles: decision.roles } : {};
+        }
+        const reason = decision?.allow === false &&
+            (decision.reason === 'not_allowlisted' ||
+                decision.reason === 'account_disabled' ||
+                decision.reason === 'access_denied' ||
+                decision.reason === 'no_organization')
+            ? decision.reason
+            : 'access_denied';
+        this.logger.warn(`Login denied by the sign-in policy (${reason}) for provider ${profile.provider}`);
+        this.recordLogin('allowlist_rejected', profile.provider);
+        throw new auth_error_codes_1.AuthLoginDeniedException(reason, 'Sign-in was refused by the application policy.');
+    }
+    /**
+     * Tenancy at sign-in (PP-6.2, #722), by `TENANCY_MODE`:
+     *
+     * - **single**: every signing-in user is ensured a membership in the default
+     *   organization. A new user already got one inside `createNewUser`'s
+     *   transaction; a returning user who somehow lacks one gets it here, so the
+     *   auto-join is self-healing rather than only applied at creation.
+     * - **multi**: nobody is auto-joined except the `INITIAL_ADMIN_EMAIL`
+     *   account (so the deployment can be administered), and a user with zero
+     *   active memberships is refused with `no_organization`. Pending
+     *   invitations were claimed just before this check (#726).
+     *
+     * The mode goes on the active (HTTP request) span as `tenancy.mode`; the
+     * auth path has no span of its own. Never an org id on a metric label.
+     */
+    async applyTenancyAtSignIn(userId, { isInitialAdmin, userWasCreated, orgRoleName, provider, }) {
+        api_1.trace.getActiveSpan()?.setAttribute('tenancy.mode', this.tenancy.mode());
+        // A user created on this sign-in was joined (or not) by `createNewUser`,
+        // under the same rule, inside its transaction: nothing to heal.
+        if (!userWasCreated && this.tenancy.autoJoinsDefaultOrg(isInitialAdmin)) {
+            const { orgId, created } = await this.organizations.ensureDefaultOrgMembership(userId, orgRoleName);
+            if (created) {
+                // Principal cache (PP-1.12, #683): the restored membership carries an
+                // org role (PP-6.3, #723), so the next request must see it.
+                this.principalCache.invalidate({ userId });
+                this.logger.log(`User ${userId} joined default organization ${orgId} at sign-in (self-heal)`);
+            }
+        }
+        if (this.tenancy.capabilities.requireActiveMembership) {
+            const active = await this.organizations.countActiveMemberships(userId);
+            if (active === 0) {
+                // Audit: the user id only, never the email.
+                this.logger.warn(`Login denied - user ${userId} has no active organization membership (tenancy mode multi)`);
+                this.recordLogin('no_organization', provider);
+                throw new auth_error_codes_1.AuthLoginDeniedException('no_organization', 'Your account is not a member of any organization. Ask an organization administrator to invite you.');
+            }
+        }
+    }
+    /**
+     * Creates a new user with identity and settings. Handles admin bootstrap
+     * if applicable.
+     *
+     * Joins the default organization in the same transaction when the tenancy
+     * mode says so (always in single mode; only the initial admin in multi).
+     *
+     * Roles after the RBAC split (PP-6.3, #723): an ordinary sign-up holds NO
+     * system role and gets `DEFAULT_ORG_ROLE` (viewer) on its membership. The
+     * initial administrator gets the system `admin` role in `user_roles` plus
+     * `ORG_ADMIN_ROLE` on the default-org membership.
+     */
+    async createNewUser(profile, isInitialAdmin, policyRoles, trustedEmail = true) {
+        // Check if this should be the initial admin. Only for a provider trusted to
+        // vouch for the address: otherwise an address presented by another tenant
+        // could become the first administrator.
+        const shouldGrantAdmin = trustedEmail && (await this.adminBootstrapService.shouldGrantAdminRole(profile.email));
+        // Roles the app's sign-in policy mapped for this NEW user (resolved before
+        // anything is written; an unknown or conflicting name fails the sign-in).
+        const mapped = await this.resolvePolicyRoles(policyRoles);
+        // The membership's org role, with its permissions (the returned principal
+        // carries them). Resolved before the transaction: a missing row is a seed
+        // problem and must fail before anything is written. The initial
+        // administrator keeps `org_admin` whatever the policy mapped.
+        const membershipRoleName = shouldGrantAdmin
+            ? identity_constants_1.ORG_ADMIN_ROLE
+            : (mapped.orgRole ?? this.identityOptions.defaultOrgRole);
+        const membershipRole = await this.prisma.role.findUnique({
+            where: { name: membershipRoleName },
+            include: {
+                rolePermissions: {
+                    include: {
+                        permission: true,
+                    },
+                },
+            },
+        });
+        if (!membershipRole) {
+            this.logger.error(`CRITICAL: Role "${membershipRoleName}" not found in database. ` +
+                'Database seeds have not been run. Cannot create new users.');
+            throw new index_2.DatabaseSeedException(`Role "${membershipRoleName}"`, 'npm run prisma:seed');
+        }
+        // The default organization a new user joins (PP-6.1, #721), when the
+        // tenancy mode auto-joins this user (PP-6.2, #722): everyone in single
+        // mode, only the initial admin in multi. Resolved before the transaction
+        // like the default role: a missing row is a seed problem and must fail
+        // before anything is written.
+        const defaultOrg = this.tenancy.autoJoinsDefaultOrg(isInitialAdmin)
+            ? await this.organizations.getDefaultOrg()
+            : null;
+        // Create user with identity, settings and membership in a transaction
+        const user = await this.prisma.$transaction(async (tx) => {
+            // Create user. No system role: an ordinary member holds only the
+            // membership role below.
+            const newUser = await tx.user.create({
+                data: {
+                    email: profile.email,
+                    providerDisplayName: profile.displayName,
+                    providerProfileImageUrl: profile.pictureUrl || null,
+                    isActive: true,
+                    // Create identity
+                    identities: {
+                        create: {
+                            provider: profile.provider,
+                            providerSubject: profile.subject,
+                            providerEmail: profile.email,
+                        },
+                    },
+                    // Create default user settings
+                    userSettings: {
+                        create: {
+                            value: this.userDefaults.userSettings(),
+                        },
+                    },
+                },
+                include: principal_factory_1.PRINCIPAL_USER_INCLUDE,
+            });
+            // Join the default organization with its org role, in the same
+            // transaction as the user.
+            const membership = defaultOrg
+                ? await this.organizations.ensureMembership(tx, defaultOrg.id, newUser.id, membershipRole.id)
+                : null;
+            // Grant the system admin role if applicable
+            if (shouldGrantAdmin) {
+                const adminRole = await tx.role.findUnique({
+                    where: { name: identity_constants_1.ROLES.ADMIN },
+                });
+                if (!adminRole) {
+                    this.logger.error('CRITICAL: Admin role not found in database. Database seeds have not been run.');
+                    throw new index_2.DatabaseSeedException('Role "admin"', 'npm run prisma:seed');
+                }
+                await tx.userRole.upsert({
+                    where: {
+                        userId_roleId: {
+                            userId: newUser.id,
+                            roleId: adminRole.id,
+                        },
+                    },
+                    update: {},
+                    create: {
+                        userId: newUser.id,
+                        roleId: adminRole.id,
+                    },
+                });
+                this.logger.log(`Admin role assigned to user: ${newUser.id}`);
+                // Reload with the principal graph: the system role and the membership.
+                const userWithAdmin = await tx.user.findUnique({
+                    where: { id: newUser.id },
+                    include: principal_factory_1.PRINCIPAL_USER_INCLUDE,
+                });
+                return userWithAdmin;
+            }
+            // System roles the policy mapped (never `admin` implicitly: only a name
+            // the app listed).
+            if (mapped.systemRoles.length > 0) {
+                for (const role of mapped.systemRoles) {
+                    await tx.userRole.upsert({
+                        where: { userId_roleId: { userId: newUser.id, roleId: role.id } },
+                        update: {},
+                        create: { userId: newUser.id, roleId: role.id },
+                    });
+                }
+                const withRoles = await tx.user.findUnique({
+                    where: { id: newUser.id },
+                    include: principal_factory_1.PRINCIPAL_USER_INCLUDE,
+                });
+                return withRoles;
+            }
+            // The principal graph without a second read: the user was created with
+            // no system role, and the membership (if any) was written just above.
+            return {
+                ...newUser,
+                memberships: membership && defaultOrg
+                    ? [
+                        {
+                            ...membership,
+                            org: { id: defaultOrg.id, isDefault: defaultOrg.isDefault },
+                            role: membershipRole,
+                        },
+                    ]
+                    : [],
+            };
+        });
+        // Principal cache (PP-1.12, #683): after the transaction (which may have
+        // upserted the admin role) committed. The user is new, so nothing should
+        // be cached for it — belt and braces.
+        this.principalCache.invalidate({ userId: user.id });
+        if (defaultOrg) {
+            this.logger.log(`User ${user.id} joined default organization ${defaultOrg.id} as ${membershipRoleName}`);
+        }
+        this.logger.log(`User created successfully: ${user.email}`);
+        // #727: after the transaction committed, for app side tables.
+        (0, identity_events_1.emitIdentityEvent)(this.events, this.logger, identity_events_1.IDENTITY_EVENTS.USER_CREATED, {
+            userId: user.id,
+            email: user.email,
+            source: profile.provider,
+            orgId: defaultOrg?.id ?? null,
+        });
+        return user;
+    }
+    /**
+     * Resolves the role names a sign-in policy mapped: at most one `org` role
+     * (the new membership's role) and any number of `system` roles. Fails closed
+     * on an unknown name or a second org role.
+     */
+    async resolvePolicyRoles(names) {
+        const result = { orgRole: null, systemRoles: [] };
+        for (const name of new Set(names ?? [])) {
+            const role = await this.prisma.role.findUnique({ where: { name } });
+            if (!role) {
+                throw new Error(`The sign-in policy named a role that does not exist: "${name}"`);
+            }
+            if (role.scope === 'org') {
+                if (result.orgRole !== null) {
+                    throw new Error('The sign-in policy named more than one organization role; a membership has one');
+                }
+                result.orgRole = role.name;
+            }
+            else {
+                result.systemRoles.push(role);
+            }
+        }
+        return result;
+    }
+    /**
+     * The organization a NEW sign-in (or a credential issued without an
+     * explicit org) acts in (#724):
+     *
+     * - single mode: the default organization, unless the loaded graph shows the
+     *   user's default-org membership suspended;
+     * - multi mode: the active membership with the latest `lastActiveAt` (ties:
+     *   the oldest), read from the graph or, when the graph has none, from the
+     *   database.
+     *
+     * The rule itself is `OrganizationsService.signInOrgId`, shared with the
+     * test login.
+     *
+     * @returns the org id, or `null` when the user has no organization to act in.
+     */
+    async chooseSignInOrg(user) {
+        return this.organizations.signInOrgId(user, this.tenancy.mode());
+    }
+    /** {@link chooseSignInOrg}, or a 401 when there is none. */
+    async requireSignInOrg(user) {
+        const orgId = await this.chooseSignInOrg(user);
+        if (!orgId) {
+            throw new common_1.UnauthorizedException('No active organization membership');
+        }
+        return orgId;
+    }
+    /**
+     * The default organization's id, memoised for {@link DEFAULT_ORG_MEMO_MS};
+     * `null` when it is missing (a seed problem: fail closed).
+     */
+    async defaultOrgIdOrNull() {
+        const now = Date.now();
+        if (this.defaultOrgMemo && now - this.defaultOrgMemo.at < DEFAULT_ORG_MEMO_MS) {
+            return this.defaultOrgMemo.id;
+        }
+        try {
+            const org = await this.organizations.getDefaultOrg();
+            this.defaultOrgMemo = { id: org.id, at: now };
+            return org.id;
+        }
+        catch (error) {
+            this.logger.error(`Default organization lookup failed: ${String(error)}`);
+            return null;
+        }
+    }
+    /**
+     * Generates JWT access token for authenticated user
+     *
+     * `orgId` is the organization the token acts in (#724); when omitted it is
+     * chosen by {@link chooseSignInOrg}.
+     */
+    async generateTokens(user, orgId) {
+        const roles = user.userRoles.map((ur) => ur.role.name);
+        const payload = {
+            sub: user.id,
+            email: user.email,
+            roles,
+            org: orgId ?? (await this.requireSignInOrg(user)),
+        };
+        const accessTtlMinutes = this.configService.get('jwt.accessTtlMinutes', 15);
+        const accessToken = await this.jwtService.signAsync(payload, {
+            expiresIn: `${accessTtlMinutes}m`,
+        });
+        return {
+            accessToken,
+            expiresIn: accessTtlMinutes * 60, // Convert to seconds
+        };
+    }
+    /**
+     * Generate both access and refresh tokens
+     *
+     * `deviceCodeId` is set only by the device-authorization flow's session path
+     * (issue #518): it stamps the access token with a `did` claim and links the
+     * refresh token row to the `device_codes` row, so revoking that device
+     * session reaches both credentials. See `validateJwtPayload` and
+     * `refreshAccessToken` for where the link is enforced.
+     *
+     * `orgId` (#724) is the organization both tokens are bound to: the access
+     * token's `org` claim and the refresh token row's `orgId`. When omitted it
+     * is chosen by {@link chooseSignInOrg}.
+     */
+    async generateFullTokens(user, options) {
+        const orgId = options?.orgId ?? (await this.requireSignInOrg(user));
+        const accessToken = this.generateAccessToken(user, {
+            ttlMinutes: options?.accessTtlMinutes,
+            deviceCodeId: options?.deviceCodeId,
+            orgId,
+        });
+        const refreshToken = await this.createRefreshToken(user.id, {
+            ttlDays: options?.refreshTtlDays,
+            deviceCodeId: options?.deviceCodeId,
+            orgId,
+        });
+        return {
+            accessToken: accessToken.token,
+            expiresIn: accessToken.expiresIn,
+            refreshToken,
+        };
+    }
+    /**
+     * Generate access token only
+     */
+    generateAccessToken(user, options) {
+        const roles = user.userRoles.map((ur) => ur.role.name);
+        const payload = {
+            sub: user.id,
+            email: user.email,
+            roles,
+            org: options.orgId,
+            // Only a device-issued token carries `did`; an interactive login's
+            // payload is `{ sub, email, roles, org }`.
+            ...(options.deviceCodeId ? { did: options.deviceCodeId } : {}),
+        };
+        if (options.ttlSeconds !== undefined) {
+            return {
+                token: this.jwtService.sign(payload, {
+                    expiresIn: `${options.ttlSeconds}s`,
+                }),
+                expiresIn: options.ttlSeconds,
+            };
+        }
+        const accessTtlMinutes = options.ttlMinutes ??
+            this.configService.get('jwt.accessTtlMinutes', 15);
+        return {
+            token: this.jwtService.sign(payload, { expiresIn: `${accessTtlMinutes}m` }),
+            expiresIn: accessTtlMinutes * 60,
+        };
+    }
+    /**
+     * Create a new refresh token
+     *
+     * `expiresAtCap` bounds the row's expiry from above: a refresh token rotated
+     * out of a device-authorization session never outlives that session's
+     * `credentialExpiresAt` (issue #518), however long the default TTL is.
+     */
+    async createRefreshToken(userId, options) {
+        const refreshTtlDays = options.ttlDays ??
+            this.configService.get('jwt.refreshTtlDays', 14);
+        let expiresAt = new Date();
+        expiresAt.setDate(expiresAt.getDate() + refreshTtlDays);
+        if (options.expiresAtCap && options.expiresAtCap < expiresAt) {
+            expiresAt = new Date(options.expiresAtCap.getTime());
+        }
+        // Generate random token
+        const token = (0, node_crypto_1.randomBytes)(32).toString('hex');
+        const tokenHash = this.hashToken(token);
+        // Store hashed token in database
+        await this.prisma.refreshToken.create({
+            data: {
+                userId,
+                tokenHash,
+                expiresAt,
+                orgId: options.orgId,
+                ...(options.deviceCodeId ? { deviceCodeId: options.deviceCodeId } : {}),
+            },
+        });
+        this.logger.debug(`Created refresh token for user: ${userId}`);
+        return token;
+    }
+    /**
+     * Refresh access token using refresh token
+     *
+     * A refresh token minted by the device-authorization flow carries
+     * `deviceCodeId` (issue #518). Its chain stays a DEVICE chain across every
+     * rotation: the new row keeps the link, the new access token keeps the `did`
+     * claim, and neither may outlive the device session's `credentialExpiresAt`,
+     * so rotating cannot launder a device credential into an ordinary 14-day
+     * login. A chain whose device session was revoked refuses to rotate.
+     *
+     * ORG-PRESERVING (#724): the new tokens are bound to the SAME organization
+     * as the presented one (`refresh_tokens.org_id`), and rotation fails (401)
+     * once that membership is no longer active. A row written before #724 has
+     * no org; it is bound to the org {@link chooseSignInOrg} picks.
+     */
+    async refreshAccessToken(refreshToken) {
+        const tokenHash = this.hashToken(refreshToken);
+        // Find valid refresh token. The user is loaded with the principal graph
+        // (memberships included) so the org membership can be checked.
+        const storedToken = await this.prisma.refreshToken.findUnique({
+            where: { tokenHash },
+            include: {
+                user: { include: principal_factory_1.PRINCIPAL_USER_INCLUDE },
+                deviceCode: {
+                    select: {
+                        id: true,
+                        userId: true,
+                        revokedAt: true,
+                        credentialExpiresAt: true,
+                        orgId: true,
+                    },
+                },
+            },
+        });
+        if (!storedToken) {
+            this.metrics.authRefresh('invalid');
+            throw new common_1.UnauthorizedException('Invalid refresh token');
+        }
+        const deviceCode = storedToken.deviceCodeId
+            ? storedToken.deviceCode
+            : null;
+        // Check if revoked
+        if (storedToken.revokedAt) {
+            // A device whose session the user revoked still holds its last refresh
+            // token and will present it; that is the expected aftermath of
+            // `DELETE /api/auth/device/sessions/{id}`, not evidence of theft. Treat
+            // it as reuse and we would sign the user out of every browser too.
+            if (storedToken.deviceCodeId && (!deviceCode || deviceCode.revokedAt)) {
+                this.logger.warn(`Refresh attempted on revoked device session ${storedToken.deviceCodeId} for user: ${storedToken.userId}`);
+                this.metrics.authRefresh('device_revoked');
+                throw new common_1.UnauthorizedException('Refresh token has been revoked');
+            }
+            // Potential token reuse attack - revoke all tokens for user
+            await this.revokeAllUserTokens(storedToken.userId);
+            this.logger.warn(`Refresh token reuse detected for user: ${storedToken.userId}`);
+            this.metrics.authRefresh('reuse_detected');
+            throw new common_1.UnauthorizedException('Refresh token has been revoked');
+        }
+        // Check if expired
+        if (storedToken.expiresAt < new Date()) {
+            this.metrics.authRefresh('expired');
+            throw new common_1.UnauthorizedException('Refresh token has expired');
+        }
+        // Check if user is active
+        if (!storedToken.user.isActive) {
+            this.metrics.authRefresh('user_inactive');
+            throw new common_1.UnauthorizedException('User account is deactivated');
+        }
+        // Device chain: the device session must still be live. A revoked (or
+        // expired, or foreign) session kills the presented token too, so the next
+        // attempt lands in the revoked branch above instead of here again.
+        if (storedToken.deviceCodeId &&
+            !this.isDeviceSessionLive(deviceCode, storedToken.userId)) {
+            await this.prisma.refreshToken.update({
+                where: { id: storedToken.id },
+                data: { revokedAt: new Date() },
+            });
+            this.logger.warn(`Refresh refused: device session ${storedToken.deviceCodeId} is revoked or expired (user: ${storedToken.userId})`);
+            this.metrics.authRefresh('device_revoked');
+            throw new common_1.UnauthorizedException('Refresh token has been revoked');
+        }
+        // Org binding (#724): rotate for the same organization, and only while
+        // that membership is active. A removed or suspended member's chain dies
+        // here, and the presented token with it.
+        const orgId = storedToken.orgId ??
+            deviceCode?.orgId ??
+            (await this.chooseSignInOrg(storedToken.user));
+        if (!orgId || !(0, credential_binding_1.hasActiveMembership)(storedToken.user, orgId)) {
+            await this.prisma.refreshToken.update({
+                where: { id: storedToken.id },
+                data: { revokedAt: new Date() },
+            });
+            this.logger.warn(`Refresh refused: user ${storedToken.userId} is no longer an active member of organization ${orgId ?? '(none)'}`);
+            this.metrics.authRefresh('no_organization');
+            throw new common_1.UnauthorizedException('Organization membership is no longer active');
+        }
+        // Rotate token - revoke old one, create new one
+        await this.prisma.refreshToken.update({
+            where: { id: storedToken.id },
+            data: { revokedAt: new Date() },
+        });
+        // Generate new tokens
+        if (storedToken.deviceCodeId && deviceCode?.credentialExpiresAt) {
+            const credentialExpiresAt = deviceCode.credentialExpiresAt;
+            const configuredDays = Number(this.configService.get('deviceAuth.tokenExpiryDays', 7));
+            const deviceAccessTtlSeconds = (Number.isFinite(configuredDays) && configuredDays > 0
+                ? configuredDays
+                : 7) *
+                24 *
+                60 *
+                60;
+            const remainingSeconds = Math.floor((credentialExpiresAt.getTime() - Date.now()) / 1000);
+            const newRefreshToken = await this.createRefreshToken(storedToken.userId, {
+                deviceCodeId: storedToken.deviceCodeId,
+                expiresAtCap: credentialExpiresAt,
+                orgId,
+            });
+            const accessToken = this.generateAccessToken(storedToken.user, {
+                ttlSeconds: Math.max(1, Math.min(deviceAccessTtlSeconds, remainingSeconds)),
+                deviceCodeId: storedToken.deviceCodeId,
+                orgId,
+            });
+            this.metrics.authRefresh('success');
+            return {
+                accessToken: accessToken.token,
+                expiresIn: accessToken.expiresIn,
+                refreshToken: newRefreshToken,
+            };
+        }
+        const newRefreshToken = await this.createRefreshToken(storedToken.userId, { orgId });
+        const accessToken = this.generateAccessToken(storedToken.user, { orgId });
+        this.metrics.authRefresh('success');
+        return {
+            accessToken: accessToken.token,
+            expiresIn: accessToken.expiresIn,
+            refreshToken: newRefreshToken,
+        };
+    }
+    /**
+     * Logout - revoke refresh token
+     */
+    async logout(userId, refreshToken) {
+        if (refreshToken) {
+            // Revoke specific token
+            const tokenHash = this.hashToken(refreshToken);
+            await this.prisma.refreshToken.updateMany({
+                where: { tokenHash, userId },
+                data: { revokedAt: new Date() },
+            });
+        }
+        else {
+            // Revoke all tokens for user
+            await this.revokeAllUserTokens(userId);
+        }
+        this.logger.log(`User logged out: ${userId}`);
+    }
+    /**
+     * Revoke all refresh tokens for a user
+     */
+    async revokeAllUserTokens(userId) {
+        await this.prisma.refreshToken.updateMany({
+            where: {
+                userId,
+                revokedAt: null,
+            },
+            data: { revokedAt: new Date() },
+        });
+    }
+    /**
+     * Clean up expired tokens (run periodically)
+     */
+    async cleanupExpiredTokens() {
+        const result = await this.prisma.refreshToken.deleteMany({
+            where: {
+                OR: [
+                    { expiresAt: { lt: new Date() } },
+                    { revokedAt: { not: null } },
+                ],
+            },
+        });
+        this.logger.log(`Cleaned up ${result.count} expired/revoked tokens`);
+        return result.count;
+    }
+    /**
+     * Hash token for storage
+     */
+    hashToken(token) {
+        return (0, node_crypto_1.createHash)('sha256').update(token).digest('hex');
+    }
+    /**
+     * Validates JWT payload and returns user with roles and permissions
+     *
+     * A token carrying `did` was issued to a device through the device
+     * authorization flow (issue #518). It is honoured only while that device
+     * session exists, belongs to the token's subject, is not revoked and has not
+     * passed its `credentialExpiresAt` — which is what makes
+     * `DELETE /api/auth/device/sessions/{id}` revoke a 7-day access token
+     * immediately. A token without `did` is validated exactly as before.
+     *
+     * PRINCIPAL CACHE (PP-1.12, #683). The user/role/permission join below is
+     * read through `PrincipalCache` for at most AUTH_PRINCIPAL_CACHE_TTL_SECONDS.
+     * The `did` check above it is NEVER cached: it runs first, on every request.
+     * Every write that changes what a principal resolves to calls
+     * `principalCache.invalidate` after it commits, so a deactivation or role
+     * change still reaches the next request on this replica, and other replicas
+     * within event-bus latency. An inactive user may be cached; the `isActive`
+     * check still rejects it.
+     *
+     * ACTIVE ORG (#724). The `org` claim names the organization the token acts
+     * in; it is honoured only while it is an ACTIVE membership of `sub`, read
+     * from the same (cached) graph, so a removed or suspended member's token
+     * stops working within the cache TTL, and at once after `invalidateUser`. A
+     * `did` token must also match its device session's `orgId`. A token
+     * without `org` is the temporary compatibility path in `legacyTokenOrg`.
+     * The returned user carries the binding (`activeOrgId`, `tokenKind`) as
+     * non-enumerable properties (`credential-binding.ts`).
+     */
+    async validateJwtPayload(payload) {
+        const tokenKind = payload.did !== undefined ? 'device' : 'session';
+        // The active organization (#724). A signed `org` claim is the org; a
+        // token without one predates #724 (see `acceptsLegacyToken`) and is bound
+        // to no org (`null`), so the principal factory's single-mode rule maps it
+        // to the default organization, exactly as before #724.
+        let orgId = null;
+        if (payload.org !== undefined) {
+            if (typeof payload.org !== 'string' || payload.org.length === 0) {
+                return null;
+            }
+            orgId = payload.org;
+        }
+        else if (!this.acceptsLegacyToken(tokenKind)) {
+            return null;
+        }
+        if (payload.did !== undefined) {
+            if (typeof payload.did !== 'string' || payload.did.length === 0) {
+                return null;
+            }
+            const deviceCode = await this.prisma.deviceCode.findUnique({
+                where: { id: payload.did },
+                select: {
+                    id: true,
+                    userId: true,
+                    revokedAt: true,
+                    credentialExpiresAt: true,
+                    // Only an org-bound token is compared with its session's org.
+                    ...(orgId !== null ? { orgId: true } : {}),
+                },
+            });
+            if (!this.isDeviceSessionLive(deviceCode, payload.sub)) {
+                return null;
+            }
+            // A device session is bound to the org it was approved in (#724): its
+            // token may not claim another one.
+            if (orgId !== null && deviceCode?.orgId !== orgId) {
+                return null;
+            }
+        }
+        // Keyed by (user, org, credential kind) since #724.
+        const key = { userId: payload.sub, orgId, tokenKind };
+        let principal = this.principalCache.get(key);
+        if (!principal) {
+            // Captured BEFORE the read: if an invalidation lands while the query is
+            // in flight, `set` refuses to store what may be the pre-change principal.
+            const generation = this.principalCache.generation(payload.sub);
+            // System roles plus memberships with their org roles (PP-6.3, #723):
+            // the shared graph every credential path loads; `PrincipalFactory`
+            // derives the effective permissions from it.
+            const user = await this.prisma.user.findUnique({
+                where: { id: payload.sub },
+                include: principal_factory_1.PRINCIPAL_USER_INCLUDE,
+            });
+            if (!user) {
+                return null;
+            }
+            // The frozen copy when it was stored; the fresh row when the cache is
+            // disabled or the generation moved (exactly the behaviour before #683).
+            principal = this.principalCache.set(key, user, generation) ?? user;
+        }
+        if (!principal.isActive) {
+            return null;
+        }
+        // The claim is signed, but membership is the database's to decide: a
+        // token for an org the user is no longer an ACTIVE member of is refused
+        // (within the cache TTL; at once on this replica after an invalidation).
+        // The legacy path keeps the pre-#724 behaviour and checks nothing here.
+        if (orgId !== null && !(0, credential_binding_1.hasActiveMembership)(principal, orgId)) {
+            return null;
+        }
+        // The org goes on the request span (ADR 0001: `org.id`), never on a
+        // metric label.
+        if (orgId !== null) {
+            api_1.trace.getActiveSpan()?.setAttribute('org.id', orgId);
+        }
+        // A cached entry is already bound to its key; a fresh, uncached read
+        // (cache disabled, or the generation moved) is bound here.
+        return principal.tokenKind === tokenKind
+            ? principal
+            : (0, credential_binding_1.bindCredential)(principal, { activeOrgId: orgId ?? undefined, tokenKind });
+    }
+    /**
+     * TEMPORARY COMPATIBILITY PATH (#724), removed in a later release: whether
+     * an access token issued before the `org` claim existed is still honoured.
+     *
+     * - single mode: yes, for one access-token lifetime after this process
+     *   started (`jwt.accessTtlMinutes`, or the device token lifetime for a
+     *   `did` token), so tokens in flight across the deploy keep working. Such a
+     *   token is bound to no org; the principal factory maps it to the default
+     *   organization's membership, as every token was before #724;
+     * - multi mode, or after the window: no, so the client refreshes (the
+     *   refresh issues an org-bound token).
+     *
+     * Synchronous and I/O-free: it decides before any database read.
+     */
+    acceptsLegacyToken(tokenKind) {
+        if (!this.tenancy.isSingle()) {
+            return false;
+        }
+        const lifetimeSeconds = tokenKind === 'device'
+            ? positiveOr(this.configService.get('deviceAuth.tokenExpiryDays'), 7) * 24 * 60 * 60
+            : positiveOr(this.configService.get('jwt.accessTtlMinutes'), 15) * 60;
+        return Date.now() < this.startedAt + lifetimeSeconds * 1000;
+    }
+    /**
+     * `POST /api/auth/switch-org` (#724): re-issue the session for another
+     * organization the caller is an ACTIVE member of.
+     *
+     * - Only a browser session may switch: a PAT, a device session and a node
+     *   credential are bound to one org at issue and are refused (403).
+     * - The presented refresh token (the HttpOnly cookie) must be a live,
+     *   non-device session token of the caller (else 401). It is revoked and a
+     *   new one bound to `orgId` is issued, exactly like a rotation.
+     * - `orgId` must be an active membership of the caller (else 404, so an
+     *   org id that exists but is not the caller's is indistinguishable from
+     *   one that does not). In single mode only the default organization
+     *   qualifies, so switching to it is a no-op re-issue.
+     * - Writes the `auth:org_switched` audit event and moves the membership's
+     *   `lastActiveAt`, which picks the org of the next sign-in.
+     */
+    async switchOrg(caller, orgId, refreshToken) {
+        if (caller.tokenKind !== undefined && caller.tokenKind !== 'session') {
+            throw new common_1.ForbiddenException('This credential is bound to one organization and cannot switch organization');
+        }
+        if (!refreshToken) {
+            throw new common_1.UnauthorizedException('No refresh token provided');
+        }
+        const storedToken = await this.prisma.refreshToken.findUnique({
+            where: { tokenHash: this.hashToken(refreshToken) },
+            include: { user: { include: principal_factory_1.PRINCIPAL_USER_INCLUDE } },
+        });
+        if (!storedToken ||
+            storedToken.userId !== caller.id ||
+            storedToken.revokedAt !== null ||
+            storedToken.expiresAt < new Date() ||
+            storedToken.deviceCodeId !== null) {
+            throw new common_1.UnauthorizedException('Invalid refresh token');
+        }
+        if (!storedToken.user.isActive) {
+            throw new common_1.UnauthorizedException('User account is deactivated');
+        }
+        const defaultOrgId = this.tenancy.isSingle() ? await this.defaultOrgIdOrNull() : null;
+        if ((this.tenancy.isSingle() && orgId !== defaultOrgId) ||
+            !(0, credential_binding_1.hasActiveMembership)(storedToken.user, orgId)) {
+            throw new common_1.NotFoundException('Organization not found');
+        }
+        // Revoke the presented token conditionally, so two concurrent switches
+        // with the same cookie cannot both mint a session.
+        const revoked = await this.prisma.refreshToken.updateMany({
+            where: { id: storedToken.id, revokedAt: null },
+            data: { revokedAt: new Date() },
+        });
+        if (revoked.count !== 1) {
+            throw new common_1.UnauthorizedException('Invalid refresh token');
+        }
+        const newRefreshToken = await this.createRefreshToken(caller.id, { orgId });
+        const accessToken = this.generateAccessToken(storedToken.user, { orgId });
+        await this.organizations.touchMembership(orgId, caller.id);
+        const fromOrgId = storedToken.orgId ?? caller.activeOrgId ?? null;
+        await this.prisma.auditEvent.create({
+            data: {
+                actorUserId: caller.id,
+                action: exports.ORG_SWITCHED_AUDIT_ACTION,
+                targetType: 'organization',
+                targetId: orgId,
+                meta: { fromOrgId },
+            },
+        });
+        api_1.trace.getActiveSpan()?.setAttribute('org.id', orgId);
+        this.logger.log(`User ${caller.id} switched organization to ${orgId} (from ${fromOrgId ?? '(none)'})`);
+        (0, identity_events_1.emitIdentityEvent)(this.events, this.logger, identity_events_1.IDENTITY_EVENTS.ORG_SWITCHED, { userId: caller.id, orgId });
+        return {
+            accessToken: accessToken.token,
+            expiresIn: accessToken.expiresIn,
+            refreshToken: newRefreshToken,
+        };
+    }
+    /**
+     * Whether a device-authorization session may still back a credential: it
+     * exists, belongs to `userId`, is not revoked, and its collected credential
+     * has not expired. A row with no `credentialExpiresAt` never issued a
+     * session credential through the linked path, so it backs nothing (fail
+     * closed).
+     */
+    isDeviceSessionLive(deviceCode, userId) {
+        return (!!deviceCode &&
+            deviceCode.userId === userId &&
+            deviceCode.revokedAt === null &&
+            deviceCode.credentialExpiresAt !== null &&
+            deviceCode.credentialExpiresAt > new Date());
+    }
+    /**
+     * The context a provider's `isEnabled` and `createStrategy` receive: the app's
+     * configuration and the credential store (every secret absent when the app
+     * bound no `IDENTITY_AUTH_CREDENTIALS`).
+     *
+     * @internal
+     */
+    authProviderContext() {
+        return {
+            config: this.configService,
+            credentials: this.authCredentials ?? NO_AUTH_CREDENTIALS,
+        };
+    }
+    /**
+     * Whether one provider is configured right now. A provider whose `isEnabled`
+     * throws is treated as not enabled (logged by name, never by message: a
+     * credential lookup's error can carry store details).
+     *
+     * @param provider - the registered definition.
+     *
+     * @internal
+     */
+    async isProviderEnabled(provider) {
+        try {
+            return (await provider.isEnabled(this.configService, this.authProviderContext())) === true;
+        }
+        catch (error) {
+            this.logger.warn(`Sign-in provider "${provider.id}" could not be checked and is treated as not enabled (${error instanceof Error ? error.name : typeof error})`);
+            return false;
+        }
+    }
+    /**
+     * Every registered provider with whether it is enabled, in registration order
+     * (the Doctor's and the egress inventory's view).
+     *
+     * @internal
+     */
+    async getProviderStates() {
+        return Promise.all(auth_provider_registry_1.authProviderRegistry.list().map(async (provider) => ({ provider, enabled: await this.isProviderEnabled(provider) })));
+    }
+    /**
+     * Returns list of enabled OAuth providers
+     */
+    async getEnabledProviders() {
+        // The provider registry (#727), in registration order: Google first, then
+        // any provider the app registered. Only configured ones are listed. A
+        // `custom` provider says so (`mode`), so the login page does not navigate
+        // to a route that does not exist; a redirect provider's entry is unchanged.
+        const states = await this.getProviderStates();
+        return states
+            .filter(({ enabled }) => enabled)
+            .map(({ provider }) => ({
+            name: provider.id,
+            enabled: true,
+            ...(provider.mode === 'custom' ? { mode: 'custom' } : {}),
+        }));
+    }
+    /**
+     * Returns current user details with computed display name and image
+     *
+     * `activeOrgId` is the org the request's credential is bound to (#724);
+     * roles, permissions and `activeOrg` are computed for it. Omitted, the
+     * sign-in rule picks the org.
+     */
+    async getCurrentUser(userId, activeOrgId) {
+        const user = await this.prisma.user.findUnique({
+            where: { id: userId },
+            include: CURRENT_USER_INCLUDE,
+        });
+        if (!user) {
+            throw new common_1.UnauthorizedException('User not found');
+        }
+        // Compute display name (override takes precedence)
+        const displayName = user.displayName || user.providerDisplayName || null;
+        // Profile image (#367): resolved from `profile.imageSource`. The unused
+        // `users.profile_image_url` column is deliberately not consulted. The
+        // provider URL and whether an uploaded picture exists are exposed too, so
+        // the settings UI can preview each option whichever one is selected — the
+        // uploaded one through the authenticated GET /user-settings/profile-image,
+        // since the public avatar URL only serves while `upload` is selected.
+        const storedProfile = user.userSettings?.value?.profile;
+        const profileImageUrl = this.profileImages.resolveImageUrl(user, storedProfile);
+        const hasUploadedProfileImage = this.profileImages.hasUploadedImage(storedProfile);
+        // Roles and permissions from `PrincipalFactory` (PP-6.3, #723): system
+        // roles plus the current org's membership role. The shape is unchanged
+        // (`roles: [{ name }]`); a system administrator now lists `admin` and
+        // `org_admin`.
+        const access = principal_factory_1.principalFactory.access(activeOrgId !== undefined ? { ...user, activeOrgId } : user);
+        const roles = access.roles.map((name) => ({ name }));
+        const permissions = access.permissions;
+        // The active organization and every organization the user can switch to
+        // (#724). `memberships` may be absent on a graph a test builds by hand.
+        const memberships = (user.memberships ?? []);
+        const activeMembership = access.membership
+            ? memberships.find((membership) => membership.orgId === access.membership.orgId)
+            : undefined;
+        const extensions = await (0, user_extensions_1.resolveCurrentUserExtensions)(user.id, {
+            orgId: activeMembership?.orgId ?? null,
+        });
+        const current = {
+            id: user.id,
+            email: user.email,
+            displayName,
+            profileImageUrl,
+            providerProfileImageUrl: user.providerProfileImageUrl ?? null,
+            hasUploadedProfileImage,
+            isActive: user.isActive,
+            roles,
+            permissions,
+            // PP-6.2 (#722): so the web can hide organization UI in single mode.
+            tenancyMode: this.tenancy.mode(),
+            // PP-6.4 (#724): the org this session acts in, and the ones it can switch to.
+            activeOrg: activeMembership
+                ? {
+                    id: activeMembership.orgId,
+                    name: activeMembership.org?.name ?? '',
+                    slug: activeMembership.org?.slug ?? '',
+                }
+                : null,
+            memberships: memberships
+                .filter((membership) => membership.status === 'active')
+                .map((membership) => ({
+                orgId: membership.orgId,
+                name: membership.org?.name ?? '',
+                slug: membership.org?.slug ?? '',
+                role: membership.role.name,
+            })),
+        };
+        // PP-14.25: what the app's current-user extensions add, resolved per
+        // request, each isolated (a throwing one is skipped and logged). The key
+        // is absent when nothing contributed, so the payload is unchanged.
+        if (extensions)
+            current.extensions = extensions;
+        return current;
+    }
+    /**
+     * Check if email matches the initial admin email
+     */
+    isInitialAdminEmail(email) {
+        const initialAdminEmail = this.configService.get(this.identityOptions.initialAdminEmailEnv);
+        return initialAdminEmail ? email === initialAdminEmail.toLowerCase() : false;
+    }
+};
+exports.AuthService = AuthService;
+exports.AuthService = AuthService = AuthService_1 = __decorate([
+    (0, common_1.Injectable)(),
+    __param(0, (0, common_1.Inject)(index_1.PLATFORM_PRISMA)),
+    __param(5, (0, common_1.Inject)(ports_1.IDENTITY_NOTIFIER)),
+    __param(9, (0, common_1.Optional)()),
+    __param(9, (0, common_1.Inject)(ports_1.IDENTITY_METRICS)),
+    __param(10, (0, common_1.Inject)(ports_1.USER_DEFAULTS)),
+    __param(11, (0, common_1.Inject)(ports_1.IDENTITY_PROFILE_IMAGES)),
+    __param(12, (0, common_1.Optional)()),
+    __param(12, (0, common_1.Inject)(identity_options_1.IDENTITY_OPTIONS)),
+    __param(13, (0, common_1.Optional)()),
+    __param(14, (0, common_1.Optional)()),
+    __param(14, (0, common_1.Inject)(sign_in_policy_1.IDENTITY_SIGNIN_POLICY)),
+    __param(15, (0, common_1.Optional)()),
+    __param(15, (0, common_1.Inject)(ports_1.IDENTITY_AUTH_CREDENTIALS)),
+    __metadata("design:paramtypes", [Object, jwt_1.JwtService,
+        config_1.ConfigService,
+        admin_bootstrap_service_1.AdminBootstrapService,
+        allowlist_service_1.AllowlistService, Object, principal_cache_service_1.PrincipalCache,
+        organizations_service_1.OrganizationsService,
+        tenancy_service_1.TenancyService, Object, Object, Object, Object, event_emitter_1.EventEmitter2, Object, Object])
+], AuthService);
+/** `value` as a number when it is a positive finite one, else `fallback`. */
+function positiveOr(value, fallback) {
+    const parsed = Number(value);
+    return Number.isFinite(parsed) && parsed > 0 ? parsed : fallback;
+}
+//# sourceMappingURL=auth.service.js.map