@memberjunction/server 6.1.0-edge.2 → 6.1.0-edge.4

package/dist/auth/AuthProviderEngine.js

@@ -0,0 +1,245 @@
+/**
+ * @fileoverview Metadata-driven authentication provider catalog.
+ *
+ * Loads `MJ: Authentication Providers` rows and registers each one with the runtime
+ * `AuthProviderFactory`, resolving the concrete driver through `ClassFactory` by `DriverClass`.
+ * This is the auth subsystem's equivalent of the File Storage `ServerDriverKey` pattern:
+ * adding a provider is a subclass plus a row, never an edit to core code.
+ *
+ * @module @memberjunction/server/auth
+ */
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+import { BaseEngine, LogError, LogStatusEx, RegisterForStartup } from '@memberjunction/core';
+import { AuthProviderFactory } from '@memberjunction/auth-providers';
+import { CredentialEngine } from '@memberjunction/credentials';
+/**
+ * Subsystem label used when this engine asks CredentialEngine to decrypt secret material,
+ * so credential-access auditing attributes the read to authentication.
+ */
+const CREDENTIAL_SUBSYSTEM = 'Authentication';
+/**
+ * Loads the authentication-provider catalog from metadata and registers it with the
+ * {@link AuthProviderFactory}.
+ *
+ * **Not `deferred`**: no authenticated request may be served before the catalog is registered,
+ * or tokens from a metadata-defined provider would be rejected during the startup window.
+ *
+ * **Severity is `warn`, not `fatal`**, and that is deliberate. This engine is one of two possible
+ * sources of providers — `initializeAuthProviders` also registers whatever `mj.config.cjs`
+ * declares. Making a catalog load failure fatal would turn a transient metadata problem into a
+ * total authentication outage for deployments that never adopted the table. The failure is
+ * logged loudly and the config-declared providers still stand.
+ */
+let AuthProviderEngine = class AuthProviderEngine extends BaseEngine {
+    constructor() {
+        super(...arguments);
+        this._providers = [];
+    }
+    static get Instance() {
+        return super.getInstance();
+    }
+    /**
+     * Loads Active providers only. Inactive rows are excluded at the query rather than filtered
+     * later, so a disabled provider is never even instantiated.
+     */
+    async Config(forceRefresh, contextUser, provider) {
+        const configs = [
+            {
+                PropertyName: '_providers',
+                EntityName: 'MJ: Authentication Providers',
+                Filter: `Status='Active'`,
+                OrderBy: 'Sequence ASC, Name ASC',
+                CacheLocal: true
+            }
+        ];
+        await this.Load(configs, provider, forceRefresh, contextUser);
+    }
+    /** Active providers from metadata, ordered for presentation. */
+    get Providers() {
+        return this.GetConfigData('_providers');
+    }
+    /**
+     * Startup hook: load the catalog, then register every row with the factory.
+     */
+    async HandleStartup(contextUser, provider) {
+        await this.Config(false, contextUser, provider);
+        await this.RegisterAll(contextUser);
+    }
+    /**
+     * Instantiates and registers every catalog row with the {@link AuthProviderFactory}.
+     *
+     * One bad row must not cost the deployment its other providers, so each registration is
+     * isolated: a failure is logged with the offending provider's name and the loop continues.
+     *
+     * @returns the number of providers successfully registered.
+     */
+    async RegisterAll(contextUser) {
+        const factory = AuthProviderFactory.Instance;
+        let registered = 0;
+        for (const row of this.Providers) {
+            try {
+                const config = await this.buildProviderConfig(row, contextUser);
+                factory.register(AuthProviderFactory.createProvider(config));
+                registered++;
+            }
+            catch (error) {
+                const message = error instanceof Error ? error.message : String(error);
+                LogError(`[Auth] Could not register metadata provider '${row.Name}' (DriverClass '${row.DriverClass}'): ${message}`);
+            }
+        }
+        if (registered > 0) {
+            LogStatusEx({ message: `[Auth] Registered ${registered} provider(s) from metadata.`, verboseOnly: true });
+        }
+        return registered;
+    }
+    /**
+     * Projects a catalog row onto the runtime {@link AuthProviderConfig} the driver expects.
+     *
+     * `AdditionalConfiguration` is spread FIRST so that the modelled columns win over anything a
+     * driver-specific blob happens to repeat — the columns are the reviewable, described surface,
+     * and a JSON blob must not be able to silently redefine the issuer a token is validated against.
+     */
+    async buildProviderConfig(row, contextUser) {
+        const additional = this.parseJsonColumn(row.AdditionalConfiguration, row.Name, 'AdditionalConfiguration');
+        const secrets = await this.resolveCredential(row, contextUser);
+        const config = {
+            ...additional,
+            ...secrets,
+            name: row.Name,
+            type: row.DriverClass
+        };
+        if (row.ClientID)
+            config.clientId = row.ClientID;
+        if (row.Domain)
+            config.domain = row.Domain;
+        if (row.Issuer)
+            config.issuer = row.Issuer;
+        if (row.Audience)
+            config.audience = row.Audience;
+        if (row.JWKSUri)
+            config.jwksUri = row.JWKSUri;
+        if (row.Scopes)
+            config.scopes = this.parseScopes(row.Scopes);
+        return config;
+    }
+    /**
+     * Splits the delimited `Scopes` column into the parsed list both projections publish.
+     *
+     * This is the single home of the delimiter convention: `buildProviderConfig` and
+     * `GetPublicCatalog` must agree on it, or the server would validate tokens against one scope
+     * set while telling the browser to request another.
+     */
+    parseScopes(raw) {
+        return raw ? raw.split(/[\s,]+/).filter((s) => s.length > 0) : [];
+    }
+    /**
+     * Decrypts the row's linked credential, when it has one.
+     *
+     * Almost every provider validates tokens against a public JWKS and needs no secret at all, so
+     * this is the uncommon path — present for confidential-client flows, management APIs, and SCIM.
+     */
+    async resolveCredential(row, contextUser) {
+        if (!row.CredentialID || !row.Credential) {
+            return {};
+        }
+        await CredentialEngine.Instance.Config(false, contextUser);
+        const resolved = await CredentialEngine.Instance.getCredential(row.Credential, {
+            contextUser,
+            subsystem: CREDENTIAL_SUBSYSTEM
+        });
+        return resolved.values;
+    }
+    /**
+     * Parses a JSON configuration column, treating malformed content as absent.
+     *
+     * Throwing here would take down an otherwise-valid provider over a stray character in an
+     * optional extras blob, so the row is registered without the extras and the problem is logged.
+     */
+    parseJsonColumn(raw, providerName, columnName) {
+        if (!raw?.trim()) {
+            return {};
+        }
+        try {
+            const parsed = JSON.parse(raw);
+            if (parsed && typeof parsed === 'object' && !Array.isArray(parsed)) {
+                return parsed;
+            }
+            LogError(`[Auth] ${columnName} on provider '${providerName}' is not a JSON object; ignoring it.`);
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : String(error);
+            LogError(`[Auth] ${columnName} on provider '${providerName}' is not valid JSON (${message}); ignoring it.`);
+        }
+        return {};
+    }
+    /**
+     * Projects the catalog to the PUBLIC shape served by the unauthenticated catalog endpoint.
+     *
+     * The projection is an explicit allow-list rather than a redaction of the full row: a column
+     * added to this entity later is invisible to anonymous callers until someone deliberately adds
+     * it here. `AdditionalConfiguration` and `CredentialID` are structurally absent, never merely
+     * omitted at serialization time.
+     */
+    GetPublicCatalog() {
+        return this.Providers.filter((row) => row.ClientVisible).map((row) => {
+            const info = {
+                name: row.Name,
+                driverClass: row.DriverClass,
+                displayName: row.DisplayName ?? row.Name,
+                sequence: row.Sequence,
+                isDefault: row.IsDefault
+            };
+            if (row.Icon)
+                info.icon = row.Icon;
+            if (row.ClientID)
+                info.clientId = row.ClientID;
+            if (row.Issuer)
+                info.issuer = row.Issuer;
+            if (row.Domain)
+                info.domain = row.Domain;
+            // Published pre-parsed so the browser never re-derives the delimiter convention —
+            // the drivers hand this straight to SDK config typed string[].
+            const scopes = this.parseScopes(row.Scopes);
+            if (scopes.length > 0)
+                info.scopes = scopes;
+            const clientConfig = this.parseJsonColumn(row.ClientConfiguration, row.Name, 'ClientConfiguration');
+            if (Object.keys(clientConfig).length > 0) {
+                info.clientConfiguration = this.toPublicClientConfig(clientConfig, row.Name);
+            }
+            return info;
+        });
+    }
+    /**
+     * Flattens a parsed `ClientConfiguration` blob to the primitive key/value shape the browser
+     * contract declares. Nested objects and arrays are dropped with a warning rather than passed
+     * through, so a structured blob (the shape a credential would take) cannot ride along to an
+     * anonymous caller.
+     */
+    toPublicClientConfig(parsed, providerName) {
+        const result = {};
+        for (const [key, value] of Object.entries(parsed)) {
+            if (value === null || ['string', 'number', 'boolean'].includes(typeof value)) {
+                result[key] = value;
+            }
+            else {
+                LogError(`[Auth] ClientConfiguration key '${key}' on provider '${providerName}' is not a primitive value; it was NOT published to the public catalog.`);
+            }
+        }
+        return result;
+    }
+};
+AuthProviderEngine = __decorate([
+    RegisterForStartup({
+        priority: 20,
+        severity: 'warn',
+        deferred: false,
+        description: 'Loads the metadata authentication-provider catalog and registers it with AuthProviderFactory'
+    })
+], AuthProviderEngine);
+export { AuthProviderEngine };
+//# sourceMappingURL=AuthProviderEngine.js.map

package/dist/auth/AuthProviderEngine.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthProviderEngine.js","sourceRoot":"","sources":["../../src/auth/AuthProviderEngine.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;;;;;;;AAEH,OAAO,EACL,UAAU,EAEV,QAAQ,EACR,WAAW,EACX,kBAAkB,EAKnB,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AACrE,OAAO,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAE/D;;;GAGG;AACH,MAAM,oBAAoB,GAAG,gBAAgB,CAAC;AAE9C;;;;;;;;;;;;GAYG;AAOI,IAAM,kBAAkB,GAAxB,MAAM,kBAAmB,SAAQ,UAA8B;IAA/D;;QACG,eAAU,GAAqC,EAAE,CAAC;IAwM5D,CAAC;IAtMQ,MAAM,KAAK,QAAQ;QACxB,OAAO,KAAK,CAAC,WAAW,EAAsB,CAAC;IACjD,CAAC;IAED;;;OAGG;IACI,KAAK,CAAC,MAAM,CAAC,YAAsB,EAAE,WAAsB,EAAE,QAA4B;QAC9F,MAAM,OAAO,GAAwC;YACnD;gBACE,YAAY,EAAE,YAAY;gBAC1B,UAAU,EAAE,8BAA8B;gBAC1C,MAAM,EAAE,iBAAiB;gBACzB,OAAO,EAAE,wBAAwB;gBACjC,UAAU,EAAE,IAAI;aACjB;SACF,CAAC;QACF,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,WAAW,CAAC,CAAC;IAChE,CAAC;IAED,gEAAgE;IAChE,IAAW,SAAS;QAClB,OAAO,IAAI,CAAC,aAAa,CAAiC,YAAY,CAAC,CAAC;IAC1E,CAAC;IAED;;OAEG;IACI,KAAK,CAAC,aAAa,CAAC,WAAsB,EAAE,QAA4B;QAC7E,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;QAChD,MAAM,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC;IACtC,CAAC;IAED;;;;;;;OAOG;IACI,KAAK,CAAC,WAAW,CAAC,WAAsB;QAC7C,MAAM,OAAO,GAAG,mBAAmB,CAAC,QAAQ,CAAC;QAC7C,IAAI,UAAU,GAAG,CAAC,CAAC;QAEnB,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACjC,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;gBAChE,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC;gBAC7D,UAAU,EAAE,CAAC;YACf,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBACvE,QAAQ,CAAC,gDAAgD,GAAG,CAAC,IAAI,mBAAmB,GAAG,CAAC,WAAW,OAAO,OAAO,EAAE,CAAC,CAAC;YACvH,CAAC;QACH,CAAC;QAED,IAAI,UAAU,GAAG,CAAC,EAAE,CAAC;YACnB,WAAW,CAAC,EAAE,OAAO,EAAE,qBAAqB,UAAU,6BAA6B,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;QAC5G,CAAC;QACD,OAAO,UAAU,CAAC;IACpB,CAAC;IAED;;;;;;OAMG;IACK,KAAK,CAAC,mBAAmB,CAAC,GAAmC,EAAE,WAAsB;QAC3F,MAAM,UAAU,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,uBAAuB,EAAE,GAAG,CAAC,IAAI,EAAE,yBAAyB,CAAC,CAAC;QAC1G,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;QAE/D,MAAM,MAAM,GAAuB;YACjC,GAAG,UAAU;YACb,GAAG,OAAO;YACV,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,IAAI,EAAE,GAAG,CAAC,WAAW;SACtB,CAAC;QAEF,IAAI,GAAG,CAAC,QAAQ;YAAE,MAAM,CAAC,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC;QACjD,IAAI,GAAG,CAAC,MAAM;YAAE,MAAM,CAAC,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC;QAC3C,IAAI,GAAG,CAAC,MAAM;YAAE,MAAM,CAAC,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC;QAC3C,IAAI,GAAG,CAAC,QAAQ;YAAE,MAAM,CAAC,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC;QACjD,IAAI,GAAG,CAAC,OAAO;YAAE,MAAM,CAAC,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC;QAC9C,IAAI,GAAG,CAAC,MAAM;YAAE,MAAM,CAAC,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAE7D,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;;;;OAMG;IACK,WAAW,CAAC,GAAkB;QACpC,OAAO,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACpE,CAAC;IAED;;;;;OAKG;IACK,KAAK,CAAC,iBAAiB,CAAC,GAAmC,EAAE,WAAsB;QACzF,IAAI,CAAC,GAAG,CAAC,YAAY,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC;YACzC,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,MAAM,gBAAgB,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;QAC3D,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,QAAQ,CAAC,aAAa,CAAC,GAAG,CAAC,UAAU,EAAE;YAC7E,WAAW;YACX,SAAS,EAAE,oBAAoB;SAChC,CAAC,CAAC;QACH,OAAO,QAAQ,CAAC,MAAM,CAAC;IACzB,CAAC;IAED;;;;;OAKG;IACK,eAAe,CAAC,GAAkB,EAAE,YAAoB,EAAE,UAAkB;QAClF,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC;YACjB,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,IAAI,CAAC;YACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACxC,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;gBACnE,OAAO,MAAiC,CAAC;YAC3C,CAAC;YACD,QAAQ,CAAC,UAAU,UAAU,iBAAiB,YAAY,sCAAsC,CAAC,CAAC;QACpG,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACvE,QAAQ,CAAC,UAAU,UAAU,iBAAiB,YAAY,wBAAwB,OAAO,iBAAiB,CAAC,CAAC;QAC9G,CAAC;QACD,OAAO,EAAE,CAAC;IACZ,CAAC;IAED;;;;;;;OAOG;IACI,gBAAgB;QACrB,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;YACnE,MAAM,IAAI,GAA2B;gBACnC,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,WAAW,EAAE,GAAG,CAAC,WAAW;gBAC5B,WAAW,EAAE,GAAG,CAAC,WAAW,IAAI,GAAG,CAAC,IAAI;gBACxC,QAAQ,EAAE,GAAG,CAAC,QAAQ;gBACtB,SAAS,EAAE,GAAG,CAAC,SAAS;aACzB,CAAC;YAEF,IAAI,GAAG,CAAC,IAAI;gBAAE,IAAI,CAAC,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC;YACnC,IAAI,GAAG,CAAC,QAAQ;gBAAE,IAAI,CAAC,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC;YAC/C,IAAI,GAAG,CAAC,MAAM;gBAAE,IAAI,CAAC,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC;YACzC,IAAI,GAAG,CAAC,MAAM;gBAAE,IAAI,CAAC,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC;YAEzC,kFAAkF;YAClF,+DAA+D;YAC/D,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YAC5C,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;gBAAE,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;YAE5C,MAAM,YAAY,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,mBAAmB,EAAE,GAAG,CAAC,IAAI,EAAE,qBAAqB,CAAC,CAAC;YACpG,IAAI,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACzC,IAAI,CAAC,mBAAmB,GAAG,IAAI,CAAC,oBAAoB,CAAC,YAAY,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;YAC/E,CAAC;YAED,OAAO,IAAI,CAAC;QACd,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACK,oBAAoB,CAAC,MAA+B,EAAE,YAAoB;QAChF,MAAM,MAAM,GAAqD,EAAE,CAAC;QACpE,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YAClD,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,QAAQ,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,OAAO,KAAK,CAAC,EAAE,CAAC;gBAC7E,MAAM,CAAC,GAAG,CAAC,GAAG,KAAyC,CAAC;YAC1D,CAAC;iBAAM,CAAC;gBACN,QAAQ,CAAC,mCAAmC,GAAG,kBAAkB,YAAY,yEAAyE,CAAC,CAAC;YAC1J,CAAC;QACH,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;CACF,CAAA;AAzMY,kBAAkB;IAN9B,kBAAkB,CAAC;QAClB,QAAQ,EAAE,EAAE;QACZ,QAAQ,EAAE,MAAM;QAChB,QAAQ,EAAE,KAAK;QACf,WAAW,EAAE,8FAA8F;KAC5G,CAAC;GACW,kBAAkB,CAyM9B"}

package/dist/auth/index.d.ts

@@ -2,7 +2,11 @@ import { JwtHeader, SigningKeyCallback, JwtPayload } from 'jsonwebtoken';
 import sql from 'mssql';
 import { UserInfo } from '@memberjunction/core';
 export * from './APIKeyScopeAuth.js';
+export * from './scopeLimitedPrincipal.js';
 export * from './actingContextResolver.js';
+export * from './AuthProviderEngine.js';
+export * from './AuthProviderCatalogRouter.js';
+export { initializeAuthProviders, initializeAuthProvidersFromMetadata, refreshAuthProviders, validateAuthProvidersRegistered } from './initializeProviders.js';
 /**
  * Gets validation options for a specific issuer.
  * When multiple providers share the same issuer (e.g. two Auth0 apps on
@@ -57,5 +61,13 @@ export declare const extractUserInfoFromPayload: (payload: JwtPayload) => {
     preferredUsername?: string;
 };
 export declare const getSystemUser: (dataSource?: sql.ConnectionPool, attemptCacheUpdateIfNeeded?: boolean) => Promise<UserInfo>;
+/**
+ * Resolves a verified identity to an MJ `UserInfo`, optionally auto-provisioning a new user.
+ *
+ * @param requestDomain the hostname parsed from the request's `Origin` header. **Not used for any
+ *        authorization decision** — it is spoofable on non-browser requests, and new-user domain
+ *        authorization runs against the verified JWT's email domain instead. Retained for audit
+ *        logging and for the recursive retry call.
+ */
 export declare const verifyUserRecord: (email?: string, firstName?: string, lastName?: string, requestDomain?: string, dataSource?: sql.ConnectionPool, attemptCacheUpdateIfNeeded?: boolean) => Promise<UserInfo | undefined>;
 //# sourceMappingURL=index.d.ts.map

package/dist/auth/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,kBAAkB,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAGzE,OAAO,GAAG,MAAM,OAAO,CAAC;AACxB,OAAO,EAA4C,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAO1F,cAAc,sBAAsB,CAAC;AACrC,cAAc,4BAA4B,CAAC;AAsC3C;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,GAAI,QAAQ,MAAM,KAAG;IAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG,SAexG,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,iBAAiB,EAAE,MAAM,CAAC,MAAM,EAAE;IAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAW7F,CAAC;AAEH,qBAAa,WAAW;IACtB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED;;GAEG;AACH,eAAO,MAAM,cAAc,GAAI,QAAQ,MAAM,MAAM,QAAQ,SAAS,EAAE,IAAI,kBAAkB,SAmB3F,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,0BAA0B,GAAI,SAAS,UAAU,KAAG;IAC/D,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAiC5B,CAAC;AAEF,eAAO,MAAM,aAAa,GAAU,aAAa,GAAG,CAAC,cAAc,EAAE,6BAA4B,OAAc,KAAG,OAAO,CAAC,QAAQ,CAYjI,CAAC;AAEF,eAAO,MAAM,gBAAgB,GAC3B,QAAQ,MAAM,EACd,YAAY,MAAM,EAClB,WAAW,MAAM,EACjB,gBAAgB,MAAM,EACtB,aAAa,GAAG,CAAC,cAAc,EAC/B,6BAA4B,OAAc,KACzC,OAAO,CAAC,QAAQ,GAAG,SAAS,CAyE9B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,kBAAkB,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAGzE,OAAO,GAAG,MAAM,OAAO,CAAC;AACxB,OAAO,EAA4C,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAO1F,cAAc,sBAAsB,CAAC;AACrC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,4BAA4B,CAAC;AAC3C,cAAc,yBAAyB,CAAC;AACxC,cAAc,gCAAgC,CAAC;AAC/C,OAAO,EAAE,uBAAuB,EAAE,mCAAmC,EAAE,oBAAoB,EAAE,+BAA+B,EAAE,MAAM,0BAA0B,CAAC;AAsC/J;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,GAAI,QAAQ,MAAM,KAAG;IAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG,SAexG,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,iBAAiB,EAAE,MAAM,CAAC,MAAM,EAAE;IAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAW7F,CAAC;AAEH,qBAAa,WAAW;IACtB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED;;GAEG;AACH,eAAO,MAAM,cAAc,GAAI,QAAQ,MAAM,MAAM,QAAQ,SAAS,EAAE,IAAI,kBAAkB,SAmB3F,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,0BAA0B,GAAI,SAAS,UAAU,KAAG;IAC/D,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAiC5B,CAAC;AAEF,eAAO,MAAM,aAAa,GAAU,aAAa,GAAG,CAAC,cAAc,EAAE,6BAA4B,OAAc,KAAG,OAAO,CAAC,QAAQ,CAYjI,CAAC;AA8BF;;;;;;;GAOG;AACH,eAAO,MAAM,gBAAgB,GAC3B,QAAQ,MAAM,EACd,YAAY,MAAM,EAClB,WAAW,MAAM,EACjB,gBAAgB,MAAM,EACtB,aAAa,GAAG,CAAC,cAAc,EAC/B,6BAA4B,OAAc,KACzC,OAAO,CAAC,QAAQ,GAAG,SAAS,CA8E9B,CAAC"}

package/dist/auth/index.js

@@ -6,7 +6,11 @@ import { MJGlobal } from '@memberjunction/global';
 import { AuthProviderFactory } from '@memberjunction/auth-providers';
 import { initializeAuthProviders } from './initializeProviders.js';
 export * from './APIKeyScopeAuth.js';
+export * from './scopeLimitedPrincipal.js';
 export * from './actingContextResolver.js';
+export * from './AuthProviderEngine.js';
+export * from './AuthProviderCatalogRouter.js';
+export { initializeAuthProviders, initializeAuthProvidersFromMetadata, refreshAuthProviders, validateAuthProvidersRegistered } from './initializeProviders.js';
 // This is a hard-coded forever constant due to internal migrations
 class MissingAuthError extends Error {
     constructor() {
@@ -136,6 +140,40 @@ export const getSystemUser = async (dataSource, attemptCacheUpdateIfNeeded = tru
     }
     return systemUser;
 };
+/**
+ * Extracts the lowercased domain portion of an email address.
+ *
+ * @returns the domain, or an empty string when the value is not an email address (e.g. an IdP that
+ *          issues a bare username). Callers MUST treat an empty result as "cannot be authorized"
+ *          rather than as a wildcard.
+ */
+const extractEmailDomain = (email) => {
+    const parts = email.split('@');
+    // Reject anything that isn't exactly local@domain — a value with 0 or 2+ '@' is not an address we
+    // can make a trust decision about.
+    if (parts.length !== 2)
+        return '';
+    return parts[1].toLowerCase().trim();
+};
+/**
+ * Tests a domain against `userHandling.newUserAuthorizedDomains`, honoring `*` wildcards.
+ *
+ * Note that a pattern is matched in full, so `*.example.com` matches `mail.example.com` but NOT
+ * `example.com` — list both if you need both.
+ */
+const isDomainAuthorized = (domain) => configInfo.userHandling.newUserAuthorizedDomains.some((pattern) => {
+    // Convert wildcard domain patterns to regular expressions
+    const regex = new RegExp('^' + pattern.toLowerCase().trim().replace(/\./g, '\\.').replace(/\*/g, '.*') + '$');
+    return regex.test(domain);
+});
+/**
+ * Resolves a verified identity to an MJ `UserInfo`, optionally auto-provisioning a new user.
+ *
+ * @param requestDomain the hostname parsed from the request's `Origin` header. **Not used for any
+ *        authorization decision** — it is spoofable on non-browser requests, and new-user domain
+ *        authorization runs against the verified JWT's email domain instead. Retained for audit
+ *        logging and for the recursive retry call.
+ */
 export const verifyUserRecord = async (email, firstName, lastName, requestDomain, dataSource, attemptCacheUpdateIfNeeded = true) => {
     if (!email)
         return undefined;
@@ -150,20 +188,20 @@ export const verifyUserRecord = async (email, firstName, lastName, requestDomain
             return u.Email.toLowerCase().trim() === email.toLowerCase().trim();
     });
     if (!user) {
-        if (configInfo.userHandling.autoCreateNewUsers &&
-            firstName &&
-            lastName &&
-            (requestDomain || configInfo.userHandling.newUserLimitedToAuthorizedDomains === false)) {
-            // check to see if the domain that we have a request coming in from matches one of the domains in the autoCreateNewUsersDomains setting
+        // NOTE: `requestDomain` (parsed from the spoofable `Origin` header) is deliberately NOT part of
+        // this condition. It was previously required here, which meant a non-browser client sending no
+        // Origin could never auto-provision while an attacker simply forged one — it gated entry without
+        // authorizing anything. Authorization happens below, against the verified identity's email domain.
+        if (configInfo.userHandling.autoCreateNewUsers && firstName && lastName) {
+            // SECURITY: authorize against the EMAIL DOMAIN of the cryptographically-verified identity,
+            // NOT the request `Origin` header. Origin is trivially spoofable on non-browser / bearer-token
+            // requests, so gating on it let a holder of any valid IdP token auto-provision an account under
+            // an authorized domain by sending a forged Origin. The email comes from the verified JWT.
+            const emailDomain = extractEmailDomain(email);
             let passesDomainCheck = configInfo.userHandling.newUserLimitedToAuthorizedDomains ===
                 false; /*in this first condition, we are set up to NOT care about domain */
-            if (!passesDomainCheck && requestDomain) {
-                /*in this second condition, we check the domain against authorized domains*/
-                passesDomainCheck = configInfo.userHandling.newUserAuthorizedDomains.some((pattern) => {
-                    // Convert wildcard domain patterns to regular expressions
-                    const regex = new RegExp('^' + pattern.toLowerCase().trim().replace(/\./g, '\\.').replace(/\*/g, '.*') + '$');
-                    return regex.test(requestDomain?.toLowerCase().trim());
-                });
+            if (!passesDomainCheck) {
+                passesDomainCheck = emailDomain.length > 0 && isDomainAuthorized(emailDomain);
             }
             if (passesDomainCheck) {
                 // we have a domain from the request that matches one of the domains provided by the configuration, so we will create a new user
@@ -185,8 +223,14 @@ export const verifyUserRecord = async (email, firstName, lastName, requestDomain
                     console.warn(`   >>> New user ${email} created successfully!`);
                 }
             }
+            else if (emailDomain.length === 0) {
+                // The verified identity carries no email domain at all — typically an IdP that issues a bare
+                // `preferred_username` with no `email` claim. There is nothing to match against, so the gate
+                // denies rather than falling back to anything spoofable.
+                console.warn(`User ${email} not found in cache and will NOT be auto-created: the verified identity has no email domain (no '@'), so it cannot be matched against newUserAuthorizedDomains. This usually means the identity provider issues a username rather than an email address — configure it to emit an 'email' claim, or set newUserLimitedToAuthorizedDomains to false to disable domain checking.`);
+            }
             else {
-                console.warn(`User ${email} not found in cache. Request domain '${requestDomain}' does not match any of the domains in the newUserAuthorizedDomains setting. To ignore domain, make sure you set the newUserLimitedToAuthorizedDomains setting to false. In this case we are NOT creating a new user.`);
+                console.warn(`User ${email} not found in cache. Email domain '${emailDomain}' does not match any of the domains in the newUserAuthorizedDomains setting. NOTE: this check is against the EMAIL DOMAIN of the verified identity, NOT the browser Origin — if newUserAuthorizedDomains lists frontend hostnames (e.g. 'app.example.com'), replace them with email domains (e.g. 'example.com'). To ignore domain, make sure you set the newUserLimitedToAuthorizedDomains setting to false. In this case we are NOT creating a new user.`);
             }
         }
         if (!user && configInfo.userHandling.updateCacheWhenNotFound && dataSource && attemptCacheUpdateIfNeeded) {

package/dist/auth/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAE,SAAS,EAAE,MAAM,2CAA2C,CAAC;AAEtE,OAAO,EAAwB,QAAQ,EAAY,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAC1F,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAC5C,OAAO,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AAElD,OAAO,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AACrE,OAAO,EAAE,uBAAuB,EAAE,MAAM,0BAA0B,CAAC;AAEnE,cAAc,sBAAsB,CAAC;AACrC,cAAc,4BAA4B,CAAC;AAE3C,mEAAmE;AAEnE,MAAM,gBAAiB,SAAQ,KAAK;IAClC;QACE,KAAK,CAAC,sGAAsG,CAAC,CAAC;QAC9G,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;IACjC,CAAC;CACF;AAED,MAAM,gBAAgB,GAAG,KAAK,IAAI,EAAE;IAClC,MAAM,SAAS,GAAW,IAAI,CAAC,GAAG,EAAE,CAAC;IACrC,2FAA2F;IAC3F,uFAAuF;IACvF,gEAAgE;IAChE,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAA2C,CAAC,CAAC,wFAAwF;IAC/J,MAAM,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC3C,MAAM,OAAO,GAAW,IAAI,CAAC,GAAG,EAAE,CAAC;IACnC,MAAM,OAAO,GAAW,OAAO,GAAG,SAAS,CAAC;IAE5C,yGAAyG;IACzG,0EAA0E;IAC1E,MAAM,KAAK,GAAG,UAAU,CAAC,YAAY,CAAC,4BAA4B;QAChE,CAAC,CAAC,UAAU,CAAC,YAAY,CAAC,4BAA4B,GAAG,KAAK;YAC5D,CAAC,CAAC,UAAU,CAAC,YAAY,CAAC,4BAA4B;YACtD,CAAC,CAAC,KAAK;QACT,CAAC,CAAC,CAAC,CAAC;IACN,IAAI,OAAO,GAAG,KAAK;QAAE,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,KAAK,GAAG,OAAO,CAAC,CAAC,CAAC;IAE1F,MAAM,SAAS,GAAW,IAAI,CAAC,GAAG,EAAE,CAAC;IACrC,MAAM,YAAY,GAAW,SAAS,GAAG,SAAS,CAAC;IAEnD,OAAO,CAAC,GAAG,CACT,2BAA2B,OAAO,6BAA6B,YAAY,yBAAyB,KAAK,sEAAsE,CAChL,CAAC;AACJ,CAAC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,MAAc,EAAgE,EAAE;IACnH,MAAM,OAAO,GAAG,mBAAmB,CAAC,QAAQ,CAAC;IAC7C,MAAM,SAAS,GAAG,OAAO,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;IAEjD,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,mEAAmE;IACnE,MAAM,SAAS,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;IAE/D,OAAO;QACL,QAAQ,EAAE,SAAS,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS;QAC3D,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,OAAO,CAAE,mCAAmC;KACnE,CAAC;AACJ,CAAC,CAAC;AAEF;;;GAGG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAqE,IAAI,KAAK,CAAC,EAAE,EAAE;IAC/G,GAAG,EAAE,CAAC,MAAM,EAAE,IAAY,EAAE,EAAE;QAC5B,OAAO,oBAAoB,CAAC,IAAI,CAAC,CAAC;IACpC,CAAC;IACD,GAAG,EAAE,CAAC,MAAM,EAAE,IAAY,EAAE,EAAE;QAC5B,OAAO,oBAAoB,CAAC,IAAI,CAAC,KAAK,SAAS,CAAC;IAClD,CAAC;IACD,OAAO,EAAE,GAAG,EAAE;QACZ,MAAM,OAAO,GAAG,mBAAmB,CAAC,QAAQ,CAAC;QAC7C,OAAO,OAAO,CAAC,eAAe,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IACtD,CAAC;CACF,CAAC,CAAC;AAEH,MAAM,OAAO,WAAW;CAoBvB;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,MAAc,EAAE,EAAE,CAAC,CAAC,MAAiB,EAAE,EAAsB,EAAE,EAAE;IAC9F,MAAM,OAAO,GAAG,mBAAmB,CAAC,QAAQ,CAAC;IAE7C,2CAA2C;IAC3C,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC;QAC5B,uBAAuB,EAAE,CAAC;IAC5B,CAAC;IAED,MAAM,QAAQ,GAAG,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;IAE7C,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,wCAAwC;QACxC,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC;YAC5B,MAAM,IAAI,gBAAgB,EAAE,CAAC;QAC/B,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,gDAAgD,MAAM,EAAE,CAAC,CAAC;IAC5E,CAAC;IAED,QAAQ,CAAC,aAAa,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACrC,CAAC,CAAC;AAEF;;GAEG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,OAAmB,EAM5D,EAAE;IACF,MAAM,OAAO,GAAG,mBAAmB,CAAC,QAAQ,CAAC;IAC7C,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC;IAE3B,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,iCAAiC;QACjC,MAAM,iBAAiB,GAAG,OAAO,CAAC,kBAAwC,CAAC;QAC3E,OAAO;YACL,KAAK,EAAE,OAAO,CAAC,KAA2B,IAAI,iBAAiB;YAC/D,SAAS,EAAE,OAAO,CAAC,UAAgC;YACnD,QAAQ,EAAE,OAAO,CAAC,WAAiC;YACnD,QAAQ,EAAE,OAAO,CAAC,IAA0B;YAC5C,iBAAiB;SAClB,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;IAE7C,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,iCAAiC;QACjC,MAAM,QAAQ,GAAG,OAAO,CAAC,IAA0B,CAAC;QACpD,MAAM,iBAAiB,GAAG,OAAO,CAAC,kBAAwC,CAAC;QAC3E,OAAO;YACL,KAAK,EAAE,OAAO,CAAC,KAA2B,IAAI,iBAAiB;YAC/D,SAAS,EAAE,OAAO,CAAC,UAAgC,IAAI,QAAQ,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YAC9E,QAAQ,EAAE,OAAO,CAAC,WAAiC,IAAI,QAAQ,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,QAAQ,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YACzG,QAAQ;YACR,iBAAiB;SAClB,CAAC;IACJ,CAAC;IAED,OAAO,QAAQ,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;AAC3C,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,aAAa,GAAG,KAAK,EAAE,UAA+B,EAAE,6BAAsC,IAAI,EAAqB,EAAE;IACpI,MAAM,UAAU,GAAG,SAAS,CAAC,QAAQ,CAAC,aAAa,EAAE,CAAC;IACtD,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,IAAI,UAAU,IAAI,0BAA0B,EAAE,CAAC;YAC7C,OAAO,CAAC,IAAI,CAAC,+EAA+E,CAAC,CAAC;YAE9F,MAAM,gBAAgB,EAAE,CAAC;YACzB,OAAO,aAAa,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC,CAAC,mEAAmE;QAC9G,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,mBAAmB,SAAS,CAAC,QAAQ,CAAC,cAAc,yBAAyB,CAAC,CAAC;IACjG,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,gBAAgB,GAAG,KAAK,EACnC,KAAc,EACd,SAAkB,EAClB,QAAiB,EACjB,aAAsB,EACtB,UAA+B,EAC/B,6BAAsC,IAAI,EACX,EAAE;IACjC,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAE7B,IAAI,IAAI,GAAG,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE;QAC7C,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;YACtC,6FAA6F;YAC7F,4GAA4G;YAC5G,OAAO,CAAC,KAAK,CAAC,+BAA+B,CAAC,CAAC,EAAE,uBAAuB,CAAC,CAAC;YAC1E,OAAO,KAAK,CAAC;QACf,CAAC;;YAAM,OAAO,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,KAAK,KAAK,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,CAAC;IAC5E,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,IACE,UAAU,CAAC,YAAY,CAAC,kBAAkB;YAC1C,SAAS;YACT,QAAQ;YACR,CAAC,aAAa,IAAI,UAAU,CAAC,YAAY,CAAC,iCAAiC,KAAK,KAAK,CAAC,EACtF,CAAC;YACD,uIAAuI;YACvI,IAAI,iBAAiB,GACnB,UAAU,CAAC,YAAY,CAAC,iCAAiC;gBACzD,KAAK,CAAC,CAAC,oEAAoE;YAC7E,IAAI,CAAC,iBAAiB,IAAI,aAAa,EAAE,CAAC;gBACxC,4EAA4E;gBAC5E,iBAAiB,GAAG,UAAU,CAAC,YAAY,CAAC,wBAAwB,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE;oBACpF,0DAA0D;oBAC1D,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,GAAG,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,GAAG,CAAC,CAAC;oBAC9G,OAAO,KAAK,CAAC,IAAI,CAAC,aAAa,EAAE,WAAW,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC;gBACzD,CAAC,CAAC,CAAC;YACL,CAAC;YAED,IAAI,iBAAiB,EAAE,CAAC;gBACtB,gIAAgI;gBAChI,OAAO,CAAC,IAAI,CAAC,QAAQ,KAAK,yDAAyD,CAAC,CAAC;gBACrF,MAAM,cAAc,GAAgB,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC,cAAc,CAAc,WAAW,CAAC,CAAC,CAAC,wEAAwE;gBACrL,MAAM,OAAO,GAAwB,MAAM,cAAc,CAAC,aAAa,CAAC,SAAS,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;gBACpG,IAAI,OAAO,EAAE,CAAC;oBACZ,6LAA6L;oBAC7L,+DAA+D;oBAC/D,MAAM,EAAE,GAAa,IAAI,QAAQ,EAAE,CAAC,CAAC,2HAA2H;oBAEhK,MAAM,QAAQ,GAAyF,OAAO,CAAC,MAAM,EAAE,CAAC;oBAExH,QAAQ,CAAC,SAAS,GAAG,UAAU,CAAC,YAAY,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;wBACrE,MAAM,QAAQ,GAAyB,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;wBAC7E,MAAM,MAAM,GAAW,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;wBAEnD,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;oBAC7D,CAAC,CAAC,CAAC;oBAEH,IAAI,GAAG,IAAI,QAAQ,CAAC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,gFAAgF;oBAClI,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;oBACpC,OAAO,CAAC,IAAI,CAAC,mBAAmB,KAAK,wBAAwB,CAAC,CAAC;gBACjE,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,IAAI,CACV,QAAQ,KAAK,wCAAwC,aAAa,uNAAuN,CAC1R,CAAC;YACJ,CAAC;QACH,CAAC;QAED,IAAI,CAAC,IAAI,IAAI,UAAU,CAAC,YAAY,CAAC,uBAAuB,IAAI,UAAU,IAAI,0BAA0B,EAAE,CAAC;YACzG,yLAAyL;YACzL,OAAO,CAAC,IAAI,CAAC,QAAQ,KAAK,oEAAoE,CAAC,CAAC;YAEhG,MAAM,gBAAgB,EAAE,CAAC;YAEzB,OAAO,gBAAgB,CAAC,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,aAAa,EAAE,UAAU,EAAE,KAAK,CAAC,CAAC,CAAC,mEAAmE;QAC5J,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC,CAAC;AAEF,sCAAsC;AACtC,uBAAuB,EAAE,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAE,SAAS,EAAE,MAAM,2CAA2C,CAAC;AAEtE,OAAO,EAAwB,QAAQ,EAAY,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAC1F,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAC5C,OAAO,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AAElD,OAAO,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AACrE,OAAO,EAAE,uBAAuB,EAAE,MAAM,0BAA0B,CAAC;AAEnE,cAAc,sBAAsB,CAAC;AACrC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,4BAA4B,CAAC;AAC3C,cAAc,yBAAyB,CAAC;AACxC,cAAc,gCAAgC,CAAC;AAC/C,OAAO,EAAE,uBAAuB,EAAE,mCAAmC,EAAE,oBAAoB,EAAE,+BAA+B,EAAE,MAAM,0BAA0B,CAAC;AAE/J,mEAAmE;AAEnE,MAAM,gBAAiB,SAAQ,KAAK;IAClC;QACE,KAAK,CAAC,sGAAsG,CAAC,CAAC;QAC9G,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;IACjC,CAAC;CACF;AAED,MAAM,gBAAgB,GAAG,KAAK,IAAI,EAAE;IAClC,MAAM,SAAS,GAAW,IAAI,CAAC,GAAG,EAAE,CAAC;IACrC,2FAA2F;IAC3F,uFAAuF;IACvF,gEAAgE;IAChE,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAA2C,CAAC,CAAC,wFAAwF;IAC/J,MAAM,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC3C,MAAM,OAAO,GAAW,IAAI,CAAC,GAAG,EAAE,CAAC;IACnC,MAAM,OAAO,GAAW,OAAO,GAAG,SAAS,CAAC;IAE5C,yGAAyG;IACzG,0EAA0E;IAC1E,MAAM,KAAK,GAAG,UAAU,CAAC,YAAY,CAAC,4BAA4B;QAChE,CAAC,CAAC,UAAU,CAAC,YAAY,CAAC,4BAA4B,GAAG,KAAK;YAC5D,CAAC,CAAC,UAAU,CAAC,YAAY,CAAC,4BAA4B;YACtD,CAAC,CAAC,KAAK;QACT,CAAC,CAAC,CAAC,CAAC;IACN,IAAI,OAAO,GAAG,KAAK;QAAE,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,KAAK,GAAG,OAAO,CAAC,CAAC,CAAC;IAE1F,MAAM,SAAS,GAAW,IAAI,CAAC,GAAG,EAAE,CAAC;IACrC,MAAM,YAAY,GAAW,SAAS,GAAG,SAAS,CAAC;IAEnD,OAAO,CAAC,GAAG,CACT,2BAA2B,OAAO,6BAA6B,YAAY,yBAAyB,KAAK,sEAAsE,CAChL,CAAC;AACJ,CAAC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,MAAc,EAAgE,EAAE;IACnH,MAAM,OAAO,GAAG,mBAAmB,CAAC,QAAQ,CAAC;IAC7C,MAAM,SAAS,GAAG,OAAO,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;IAEjD,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,mEAAmE;IACnE,MAAM,SAAS,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;IAE/D,OAAO;QACL,QAAQ,EAAE,SAAS,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS;QAC3D,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,OAAO,CAAE,mCAAmC;KACnE,CAAC;AACJ,CAAC,CAAC;AAEF;;;GAGG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAqE,IAAI,KAAK,CAAC,EAAE,EAAE;IAC/G,GAAG,EAAE,CAAC,MAAM,EAAE,IAAY,EAAE,EAAE;QAC5B,OAAO,oBAAoB,CAAC,IAAI,CAAC,CAAC;IACpC,CAAC;IACD,GAAG,EAAE,CAAC,MAAM,EAAE,IAAY,EAAE,EAAE;QAC5B,OAAO,oBAAoB,CAAC,IAAI,CAAC,KAAK,SAAS,CAAC;IAClD,CAAC;IACD,OAAO,EAAE,GAAG,EAAE;QACZ,MAAM,OAAO,GAAG,mBAAmB,CAAC,QAAQ,CAAC;QAC7C,OAAO,OAAO,CAAC,eAAe,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IACtD,CAAC;CACF,CAAC,CAAC;AAEH,MAAM,OAAO,WAAW;CAoBvB;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,MAAc,EAAE,EAAE,CAAC,CAAC,MAAiB,EAAE,EAAsB,EAAE,EAAE;IAC9F,MAAM,OAAO,GAAG,mBAAmB,CAAC,QAAQ,CAAC;IAE7C,2CAA2C;IAC3C,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC;QAC5B,uBAAuB,EAAE,CAAC;IAC5B,CAAC;IAED,MAAM,QAAQ,GAAG,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;IAE7C,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,wCAAwC;QACxC,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC;YAC5B,MAAM,IAAI,gBAAgB,EAAE,CAAC;QAC/B,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,gDAAgD,MAAM,EAAE,CAAC,CAAC;IAC5E,CAAC;IAED,QAAQ,CAAC,aAAa,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACrC,CAAC,CAAC;AAEF;;GAEG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,OAAmB,EAM5D,EAAE;IACF,MAAM,OAAO,GAAG,mBAAmB,CAAC,QAAQ,CAAC;IAC7C,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC;IAE3B,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,iCAAiC;QACjC,MAAM,iBAAiB,GAAG,OAAO,CAAC,kBAAwC,CAAC;QAC3E,OAAO;YACL,KAAK,EAAE,OAAO,CAAC,KAA2B,IAAI,iBAAiB;YAC/D,SAAS,EAAE,OAAO,CAAC,UAAgC;YACnD,QAAQ,EAAE,OAAO,CAAC,WAAiC;YACnD,QAAQ,EAAE,OAAO,CAAC,IAA0B;YAC5C,iBAAiB;SAClB,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;IAE7C,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,iCAAiC;QACjC,MAAM,QAAQ,GAAG,OAAO,CAAC,IAA0B,CAAC;QACpD,MAAM,iBAAiB,GAAG,OAAO,CAAC,kBAAwC,CAAC;QAC3E,OAAO;YACL,KAAK,EAAE,OAAO,CAAC,KAA2B,IAAI,iBAAiB;YAC/D,SAAS,EAAE,OAAO,CAAC,UAAgC,IAAI,QAAQ,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YAC9E,QAAQ,EAAE,OAAO,CAAC,WAAiC,IAAI,QAAQ,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,QAAQ,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YACzG,QAAQ;YACR,iBAAiB;SAClB,CAAC;IACJ,CAAC;IAED,OAAO,QAAQ,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;AAC3C,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,aAAa,GAAG,KAAK,EAAE,UAA+B,EAAE,6BAAsC,IAAI,EAAqB,EAAE;IACpI,MAAM,UAAU,GAAG,SAAS,CAAC,QAAQ,CAAC,aAAa,EAAE,CAAC;IACtD,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,IAAI,UAAU,IAAI,0BAA0B,EAAE,CAAC;YAC7C,OAAO,CAAC,IAAI,CAAC,+EAA+E,CAAC,CAAC;YAE9F,MAAM,gBAAgB,EAAE,CAAC;YACzB,OAAO,aAAa,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC,CAAC,mEAAmE;QAC9G,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,mBAAmB,SAAS,CAAC,QAAQ,CAAC,cAAc,yBAAyB,CAAC,CAAC;IACjG,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,kBAAkB,GAAG,CAAC,KAAa,EAAU,EAAE;IACnD,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,kGAAkG;IAClG,mCAAmC;IACnC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAClC,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,CAAC;AACvC,CAAC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,kBAAkB,GAAG,CAAC,MAAc,EAAW,EAAE,CACrD,UAAU,CAAC,YAAY,CAAC,wBAAwB,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE;IAChE,0DAA0D;IAC1D,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,GAAG,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,GAAG,CAAC,CAAC;IAC9G,OAAO,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AAC5B,CAAC,CAAC,CAAC;AAEL;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,KAAK,EACnC,KAAc,EACd,SAAkB,EAClB,QAAiB,EACjB,aAAsB,EACtB,UAA+B,EAC/B,6BAAsC,IAAI,EACX,EAAE;IACjC,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAE7B,IAAI,IAAI,GAAG,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE;QAC7C,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;YACtC,6FAA6F;YAC7F,4GAA4G;YAC5G,OAAO,CAAC,KAAK,CAAC,+BAA+B,CAAC,CAAC,EAAE,uBAAuB,CAAC,CAAC;YAC1E,OAAO,KAAK,CAAC;QACf,CAAC;;YAAM,OAAO,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,KAAK,KAAK,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,CAAC;IAC5E,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,gGAAgG;QAChG,+FAA+F;QAC/F,iGAAiG;QACjG,mGAAmG;QACnG,IAAI,UAAU,CAAC,YAAY,CAAC,kBAAkB,IAAI,SAAS,IAAI,QAAQ,EAAE,CAAC;YACxE,2FAA2F;YAC3F,+FAA+F;YAC/F,gGAAgG;YAChG,0FAA0F;YAC1F,MAAM,WAAW,GAAW,kBAAkB,CAAC,KAAK,CAAC,CAAC;YACtD,IAAI,iBAAiB,GACnB,UAAU,CAAC,YAAY,CAAC,iCAAiC;gBACzD,KAAK,CAAC,CAAC,oEAAoE;YAC7E,IAAI,CAAC,iBAAiB,EAAE,CAAC;gBACvB,iBAAiB,GAAG,WAAW,CAAC,MAAM,GAAG,CAAC,IAAI,kBAAkB,CAAC,WAAW,CAAC,CAAC;YAChF,CAAC;YAED,IAAI,iBAAiB,EAAE,CAAC;gBACtB,gIAAgI;gBAChI,OAAO,CAAC,IAAI,CAAC,QAAQ,KAAK,yDAAyD,CAAC,CAAC;gBACrF,MAAM,cAAc,GAAgB,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC,cAAc,CAAc,WAAW,CAAC,CAAC,CAAC,wEAAwE;gBACrL,MAAM,OAAO,GAAwB,MAAM,cAAc,CAAC,aAAa,CAAC,SAAS,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;gBACpG,IAAI,OAAO,EAAE,CAAC;oBACZ,6LAA6L;oBAC7L,+DAA+D;oBAC/D,MAAM,EAAE,GAAa,IAAI,QAAQ,EAAE,CAAC,CAAC,2HAA2H;oBAEhK,MAAM,QAAQ,GAAyF,OAAO,CAAC,MAAM,EAAE,CAAC;oBAExH,QAAQ,CAAC,SAAS,GAAG,UAAU,CAAC,YAAY,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;wBACrE,MAAM,QAAQ,GAAyB,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;wBAC7E,MAAM,MAAM,GAAW,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;wBAEnD,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;oBAC7D,CAAC,CAAC,CAAC;oBAEH,IAAI,GAAG,IAAI,QAAQ,CAAC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,gFAAgF;oBAClI,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;oBACpC,OAAO,CAAC,IAAI,CAAC,mBAAmB,KAAK,wBAAwB,CAAC,CAAC;gBACjE,CAAC;YACH,CAAC;iBAAM,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACpC,6FAA6F;gBAC7F,6FAA6F;gBAC7F,yDAAyD;gBACzD,OAAO,CAAC,IAAI,CACV,QAAQ,KAAK,gXAAgX,CAC9X,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,IAAI,CACV,QAAQ,KAAK,sCAAsC,WAAW,4bAA4b,CAC3f,CAAC;YACJ,CAAC;QACH,CAAC;QAED,IAAI,CAAC,IAAI,IAAI,UAAU,CAAC,YAAY,CAAC,uBAAuB,IAAI,UAAU,IAAI,0BAA0B,EAAE,CAAC;YACzG,yLAAyL;YACzL,OAAO,CAAC,IAAI,CAAC,QAAQ,KAAK,oEAAoE,CAAC,CAAC;YAEhG,MAAM,gBAAgB,EAAE,CAAC;YAEzB,OAAO,gBAAgB,CAAC,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,aAAa,EAAE,UAAU,EAAE,KAAK,CAAC,CAAC,CAAC,mEAAmE;QAC5J,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC,CAAC;AAEF,sCAAsC;AACtC,uBAAuB,EAAE,CAAC"}

package/dist/auth/initializeProviders.d.ts

@@ -1,5 +1,68 @@
+import { UserInfo, type IMetadataProvider } from '@memberjunction/core';
 /**
- * Initialize authentication providers from configuration
+ * Initialize authentication providers from configuration.
+ *
+ * Registers everything declared in `mj.config.cjs`'s `authProviders` array. This remains the
+ * baseline path and runs on every boot: it needs no database, so it is what lets the server
+ * authenticate even when metadata is unreachable.
+ *
+ * Providers defined in the `MJ: Authentication Providers` catalog are layered on top by
+ * {@link initializeAuthProvidersFromMetadata}, which runs later in startup once a database
+ * connection and a system user exist.
  */
 export declare function initializeAuthProviders(): void;
+/**
+ * Layers the metadata provider catalog on top of the config-declared providers.
+ *
+ * Called after the data provider and system user are available. Metadata rows are registered in
+ * addition to — not instead of — the config-declared ones: a deployment mid-migration may
+ * legitimately have both, and a name collision resolves to the metadata row because it registers
+ * last and `AuthProviderFactory.register` keys by provider name.
+ *
+ * Never throws. An unreachable or empty catalog leaves the config-declared providers exactly as
+ * they were, which is what makes adopting this feature a no-op for existing deployments and keeps
+ * a metadata problem from turning into a lockout.
+ *
+ * @returns the number of providers registered from metadata.
+ */
+export declare function initializeAuthProvidersFromMetadata(contextUser?: UserInfo, provider?: IMetadataProvider): Promise<number>;
+/**
+ * Rebuilds the provider registry from scratch: config-declared providers first, then the
+ * metadata catalog layered on top — the same two-source order as startup.
+ *
+ * This is THE entry point for reacting to a catalog edit at runtime (an admin page's Save
+ * button, a future invalidation hook). A full rebuild is required because the factory caches
+ * issuer→provider resolutions, so an edited row would otherwise keep serving its old
+ * configuration until the process restarted. It lives here rather than on `AuthProviderEngine`
+ * because a bare `factory.clear()` + metadata re-registration would silently drop everything
+ * the config path registered — magic-link included — and no caller should have to know to put
+ * those back. `initializeAuthProviders()` clears the factory itself, so no separate clear step
+ * exists for a caller to forget.
+ *
+ * **Failure policy: abort-before-mutate.** Everything that can throw — the catalog reload and
+ * the permission probe on its result — runs BEFORE the factory is touched, so a failed refresh
+ * leaves the registry serving the previous (stale but complete) provider set and surfaces the
+ * error to the caller. This is deliberately the opposite of `initializeAuthProvidersFromMetadata`,
+ * which swallows metadata failures: at boot there is no previous registry to preserve and a
+ * metadata problem must not become a lockout, while at refresh time there is one and the caller
+ * (an admin UI) wants the error. That difference in failure policy is why this function does not
+ * simply delegate to its sibling.
+ *
+ * Known limitation, acceptable for an admin-triggered operation: metadata providers are absent
+ * from the registry for the duration of `RegisterAll`'s per-row config builds (config-declared
+ * providers are restored synchronously). A request bearing a metadata-declared IdP's token in
+ * that window is rejected. If a caller ever needs an atomic swap, build the configs first and
+ * register them in one synchronous pass.
+ *
+ * @returns the number of providers registered from metadata after the refresh.
+ */
+export declare function refreshAuthProviders(contextUser?: UserInfo, provider?: IMetadataProvider): Promise<number>;
+/**
+ * Reports whether any provider is registered, from either source, and logs a diagnostic when none
+ * is.
+ *
+ * Split out from {@link initializeAuthProviders} because "no providers" is only genuinely wrong
+ * once BOTH sources have had their turn.
+ */
+export declare function validateAuthProvidersRegistered(): boolean;
 //# sourceMappingURL=initializeProviders.d.ts.map

package/dist/auth/initializeProviders.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"initializeProviders.d.ts","sourceRoot":"","sources":["../../src/auth/initializeProviders.ts"],"names":[],"mappings":"AAIA;;GAEG;AACH,wBAAgB,uBAAuB,IAAI,IAAI,CAyB9C"}
+{"version":3,"file":"initializeProviders.d.ts","sourceRoot":"","sources":["../../src/auth/initializeProviders.ts"],"names":[],"mappings":"AACA,OAAO,EAAwD,QAAQ,EAAE,KAAK,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAI9H;;;;;;;;;;GAUG;AACH,wBAAgB,uBAAuB,IAAI,IAAI,CA4C9C;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,mCAAmC,CAAC,WAAW,CAAC,EAAE,QAAQ,EAAE,QAAQ,CAAC,EAAE,iBAAiB,GAAG,OAAO,CAAC,MAAM,CAAC,CAa/H;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,wBAAsB,oBAAoB,CAAC,WAAW,CAAC,EAAE,QAAQ,EAAE,QAAQ,CAAC,EAAE,iBAAiB,GAAG,OAAO,CAAC,MAAM,CAAC,CAchH;AAED;;;;;;GAMG;AACH,wBAAgB,+BAA+B,IAAI,OAAO,CASzD"}