@nodefony/framework 10.0.0-beta.2 → 10.0.0-beta.3

package/dist/_virtual/{_@oxc-project_runtime@0.152.0 → _@oxc-project_runtime@0.153.0}/helpers/esm/decorate.js

@@ -1,4 +1,4 @@
-//#region \0@oxc-project+runtime@0.152.0/helpers/esm/decorate.js
+//#region \0@oxc-project+runtime@0.153.0/helpers/esm/decorate.js
 function __decorate(decorators, target, key, desc) {
 	var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
 	if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);

package/dist/_virtual/{_@oxc-project_runtime@0.152.0 → _@oxc-project_runtime@0.153.0}/helpers/esm/decorateMetadata.js

@@ -1,4 +1,4 @@
-//#region \0@oxc-project+runtime@0.152.0/helpers/esm/decorateMetadata.js
+//#region \0@oxc-project+runtime@0.153.0/helpers/esm/decorateMetadata.js
 function __decorateMetadata(k, v) {
 	if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 }

package/dist/index.js

@@ -5,16 +5,17 @@ import { RedisIdempotencyStore } from "./nodefony/src/RedisIdempotencyStore.js";
 import { scheduleIdempotencyGc } from "./nodefony/src/idempotencyGc.js";
 import Route from "./nodefony/src/Route.js";
 import Controller from "./nodefony/src/Controller.js";
-import { All, Anonymous, Body, BypassFirewall, Cookie, Csp, CsrfExempt, CsrfProtect, CurrentUser, Delete, Domain, Get, Head, Header, Headers, HttpCode, Idempotent, IsGranted, Options, Param, Patch, Post, Put, Query, Redirect, Req, RequireScope, Res, Scope, Session, UploadedFile, UploadedFiles, UseSession, controller, controllers, route, routeExpectsBodyStream } from "./nodefony/decorators/routerDecorators.js";
+import { All, Anonymous, Body, BypassFirewall, Cookie, Csp, CsrfExempt, CsrfProtect, CurrentUser, Delete, Domain, Get, Head, Header, Headers, HttpCode, Idempotent, IsGranted, Options, Param, Patch, Post, Put, Query, Redirect, Req, RequireAuthentication, RequireScope, Res, Scope, Session, UploadedFile, UploadedFiles, UseSession, buildContextParamArgs, controller, controllers, getParamArgsMeta, route, routeExpectsBodyStream } from "./nodefony/decorators/routerDecorators.js";
 import Resolver from "./nodefony/src/Resolver.js";
-import __decorateMetadata from "./_virtual/_@oxc-project_runtime@0.152.0/helpers/esm/decorateMetadata.js";
-import __decorate from "./_virtual/_@oxc-project_runtime@0.152.0/helpers/esm/decorate.js";
+import __decorateMetadata from "./_virtual/_@oxc-project_runtime@0.153.0/helpers/esm/decorateMetadata.js";
+import __decorate from "./_virtual/_@oxc-project_runtime@0.153.0/helpers/esm/decorate.js";
 import router_default from "./nodefony/service/router.js";
 import ResourceController from "./nodefony/src/ResourceController.js";
 import AdminApiController from "./nodefony/controller/AdminApiController.js";
 import AdminBroker_default from "./nodefony/service/AdminBroker.js";
 import IdempotencyStore_default from "./nodefony/service/IdempotencyStore.js";
 import SessionAuthController, { mountSessionAuthRoutes } from "./nodefony/controller/SessionAuthController.js";
+import LoginPageController, { mountLoginPage } from "./nodefony/controller/LoginPageController.js";
 import TokenAuthController, { mountTokenAuthRoutes } from "./nodefony/controller/TokenAuthController.js";
 import IssuerMetadataController, { mountIssuerMetadataRoutes } from "./nodefony/controller/IssuerMetadataController.js";
 import ProtectedResourceMetadataController, { collectProtectedResources, mountProtectedResourceRoutes, protectedResourceRoutePaths } from "./nodefony/controller/ProtectedResourceMetadataController.js";
@@ -176,7 +177,10 @@ let Framework = class Framework extends Module {
 			}
 			broker.mountAll();
 		}
-		if (this.kernel?.container?.get("authFlow")) mountSessionAuthRoutes(this);
+		if (this.kernel?.container?.get("authFlow")) {
+			mountSessionAuthRoutes(this);
+			mountLoginPage(this);
+		}
 		if (this.kernel?.container?.get("tokenService")) {
 			mountTokenAuthRoutes(this);
 			const issuer = this.kernel.container.get("tokenService")?.publishedIssuer();
@@ -209,4 +213,4 @@ const graphql = {
 };
 var framework_default = Framework;
 //#endregion
-export { AdminApiController, AdminBroker_default as AdminBroker, All, Anonymous, ApiKeyController, BenchController, Body, BypassFirewall, Controller, Cookie, Csp, CsrfExempt, CsrfProtect, CurrentUser, Delete, Domain, Eta, Get, Head, Header, Headers, HttpCode, Idempotent, IsGranted, IssuerMetadataController, IdempotencyStore_default as MemoryIdempotencyStore, OAuth2Controller, Options, Param, Patch, Post, ProtectedResourceMetadataController, Put, Query, Redirect, Req, RequireScope, Res, Resolver, ResourceController, Route, router_default as Router, Scope, Session, SessionAuthController, TokenAuthController, TotpController, UploadedFile, UploadedFiles, UseSession, WebAuthnController, buildPlaygroundSnapshot, collectProtectedResources, controller, controllers, createFrameworkAdminApi, createKernelAdminApi, createSyslogAdminApi, framework_default as default, defineFrameworkConfig, frameworkConfigJsonSchema, frameworkConfigSchema, getIdempotencyStoreFactory, graphql, listIdempotencyStores, mountApiKeyRoutes, mountBenchRoutes, mountIssuerMetadataRoutes, mountOAuth2Routes, mountProtectedResourceRoutes, mountSessionAuthRoutes, mountTokenAuthRoutes, mountTotpRoutes, mountWebAuthnRoutes, protectedResourceRoutePaths, registerIdempotencyStore, route, routeExpectsBodyStream };
+export { AdminApiController, AdminBroker_default as AdminBroker, All, Anonymous, ApiKeyController, BenchController, Body, BypassFirewall, Controller, Cookie, Csp, CsrfExempt, CsrfProtect, CurrentUser, Delete, Domain, Eta, Get, Head, Header, Headers, HttpCode, Idempotent, IsGranted, IssuerMetadataController, LoginPageController, IdempotencyStore_default as MemoryIdempotencyStore, OAuth2Controller, Options, Param, Patch, Post, ProtectedResourceMetadataController, Put, Query, Redirect, Req, RequireAuthentication, RequireScope, Res, Resolver, ResourceController, Route, router_default as Router, Scope, Session, SessionAuthController, TokenAuthController, TotpController, UploadedFile, UploadedFiles, UseSession, WebAuthnController, buildContextParamArgs, buildPlaygroundSnapshot, collectProtectedResources, controller, controllers, createFrameworkAdminApi, createKernelAdminApi, createSyslogAdminApi, framework_default as default, defineFrameworkConfig, frameworkConfigJsonSchema, frameworkConfigSchema, getIdempotencyStoreFactory, getParamArgsMeta, graphql, listIdempotencyStores, mountApiKeyRoutes, mountBenchRoutes, mountIssuerMetadataRoutes, mountLoginPage, mountOAuth2Routes, mountProtectedResourceRoutes, mountSessionAuthRoutes, mountTokenAuthRoutes, mountTotpRoutes, mountWebAuthnRoutes, protectedResourceRoutePaths, registerIdempotencyStore, route, routeExpectsBodyStream };

package/dist/nodefony/controller/AdminApiController.js

@@ -1,6 +1,6 @@
 import Controller from "../src/Controller.js";
 import { computeFingerprint, evaluateIdempotency, resolveIdempotencyKey, resolveIdentity } from "../src/idempotency.js";
-import { RequestContext, RpcError, executeAdminEndpoint } from "nodefony";
+import { JsonRpcServerError, RequestContext, RpcError, executeAdminEndpoint } from "nodefony";
 //#region nodefony/controller/AdminApiController.ts
 /**
 * Controller pont unique du data plane admin (Studio).
@@ -46,7 +46,7 @@ var AdminApiController = class AdminApiController extends Controller {
 		if (this.context?.type.startsWith("websocket")) {
 			if (status >= 400) {
 				const message = body?.error ?? "admin error";
-				throw new RpcError(message, -32e3, {
+				throw new RpcError(message, JsonRpcServerError.DEFAULT, {
 					status,
 					body
 				});
@@ -84,7 +84,10 @@ var AdminApiController = class AdminApiController extends Controller {
 			request: this.buildRequest(args),
 			requiredRole: adminRoute.role,
 			gate: (request) => this.idempotencyGate(adminRoute, request),
-			onServerError: (error) => this.log(error, "ERROR")
+			onServerError: (error) => this.log(error, "ERROR"),
+			assertCredentialTransport: () => {
+				this.get("credentialTransport")?.assert(this.context ?? {}, `admin ${name}`);
+			}
 		});
 	}
 	/**
@@ -104,7 +107,7 @@ var AdminApiController = class AdminApiController extends Controller {
 		const store = this.get("idempotencyStore");
 		const verdict = await evaluateIdempotency({
 			store,
-			identity: resolveIdentity(request.user),
+			identity: resolveIdentity(),
 			clientKey: request.idempotencyKey,
 			fingerprint: computeFingerprint([
 				adminRoute.name,

package/dist/nodefony/controller/ApiKeyController.js

@@ -1,5 +1,5 @@
-import Controller from "../src/Controller.js";
 import router_default from "../service/router.js";
+import SecurityApiController from "../src/SecurityApiController.js";
 import { collectDeclaredApiScopes } from "../src/scopeCatalog.js";
 //#region nodefony/controller/ApiKeyController.ts
 let mounted = false;
@@ -24,7 +24,7 @@ let mounted = false;
 * Erreurs mappées par DUCK-TYPING sur `code` (400/409/503) — framework ne peut pas
 * importer les classes d'erreur de security.
 */
-var ApiKeyController = class extends Controller {
+var ApiKeyController = class extends SecurityApiController {
 	constructor(context) {
 		super("ApiKeyController", context);
 	}
@@ -89,7 +89,7 @@ var ApiKeyController = class extends Controller {
 		const flow = this.#flow();
 		if (!flow) return null;
 		const me = await flow.me(this.context);
-		return me && typeof me.username === "string" ? me.username : null;
+		return me && typeof me.identifier === "string" ? me.identifier : null;
 	}
 	#renderApiKeyError(e) {
 		const code = e.code;

package/dist/nodefony/controller/LoginPageController.js

@@ -0,0 +1,124 @@
+import { isDevelopment } from "../src/singletonGuard.js";
+import Controller from "../src/Controller.js";
+import { Csp } from "../decorators/routerDecorators.js";
+import __decorateMetadata from "../../_virtual/_@oxc-project_runtime@0.153.0/helpers/esm/decorateMetadata.js";
+import __decorate from "../../_virtual/_@oxc-project_runtime@0.153.0/helpers/esm/decorate.js";
+import router_default from "../service/router.js";
+import { LOGIN_PAGE_ASSET_FILES, LOGIN_PAGE_TEMPLATE, buildLoginPageView, keepSuccess } from "../src/loginPage.js";
+import path from "node:path";
+import { LOGIN_PAGE_ASSETS_BASE, LOGIN_PAGE_SKINS, loginPageSkinFile } from "nodefony";
+import { createHash } from "node:crypto";
+import { readFile } from "node:fs/promises";
+import { fileURLToPath } from "node:url";
+import { Eta } from "eta";
+//#region nodefony/controller/LoginPageController.ts
+const NO_STORE = { "cache-control": "no-store" };
+let mounted = false;
+let engine = null;
+let defaultTemplate = null;
+let appTemplate = null;
+/** Dossier des fichiers de la page (`dist/login/` du paquet `nodefony`). */
+function assetsDir() {
+	return path.dirname(fileURLToPath(import.meta.resolve("nodefony/login.js")));
+}
+function eta() {
+	return engine ??= new Eta({
+		autoEscape: true,
+		useWith: false
+	});
+}
+function templateFor(page) {
+	if (page.template === null) return Promise.resolve(defaultTemplate ??= eta().compile(LOGIN_PAGE_TEMPLATE));
+	if (appTemplate?.file !== page.template) {
+		const file = page.template;
+		appTemplate = {
+			file,
+			template: keepSuccess(() => readFile(file, "utf8").then((source) => eta().compile(source)))
+		};
+	}
+	return appTemplate.template();
+}
+const version = keepSuccess(async () => {
+	const dir = assetsDir();
+	const hash = createHash("sha256");
+	const skins = LOGIN_PAGE_SKINS.map(loginPageSkinFile).filter((file) => file !== null);
+	for (const file of [
+		LOGIN_PAGE_ASSET_FILES.script,
+		LOGIN_PAGE_ASSET_FILES.style,
+		...skins
+	]) hash.update(await readFile(path.join(dir, file)));
+	return hash.digest("hex").slice(0, 12);
+});
+/**
+* Page de connexion par défaut (ADR-0015) : gabarit F03 rendu côté serveur,
+* feuille `nodefony/login.css`, script `nodefony/login.js`. Aucun front, aucun
+* build côté application.
+*
+* Joignable sans session ; jamais mise en cache (`no-store`) ni affichable
+* dans un cadre (`frame-ancestors 'none'`).
+*/
+var LoginPageController = class extends Controller {
+	constructor(context) {
+		super("LoginPageController", context);
+	}
+	/**
+	* Rend la page de connexion.
+	*
+	* @returns la page HTML, ou 404 quand security ne la décrit plus
+	*/
+	async page() {
+		const page = this.get("authFlow")?.describeLoginPage?.() ?? null;
+		if (page === null) return this.renderJson({ error: "Not Found" }, 404, NO_STORE);
+		const query = this.queryGet;
+		const view = buildLoginPageView(page, {
+			from: query?.from,
+			reason: query?.reason,
+			theme: query?.theme,
+			skin: query?.skin,
+			layout: query?.layout,
+			preview: isDevelopment(this.kernel?.environment),
+			nonce: this.context?.cspNonce ?? "",
+			projectName: this.kernel?.projectName ?? "Nodefony",
+			assetsVersion: await version()
+		});
+		const template = await templateFor(page);
+		return this.render(template.call(eta(), view), "utf8", 200, {
+			...NO_STORE,
+			"content-type": "text/html; charset=utf-8"
+		});
+	}
+};
+__decorate([
+	Csp({ "frame-ancestors": ["'none'"] }),
+	__decorateMetadata("design:type", Function),
+	__decorateMetadata("design:paramtypes", []),
+	__decorateMetadata("design:returntype", Promise)
+], LoginPageController.prototype, "page", null);
+/**
+* Monte la page de connexion par défaut quand security la décrit : la route
+* sur `loginPage.path`, et ses fichiers sous `LOGIN_PAGE_ASSETS_BASE`.
+*
+* La page est le chemin vers la session : elle échappe au pare-feu, comme les
+* routes de connexion — sinon une application qui protège `^/` exigerait
+* d'être connecté pour se connecter.
+*
+* @param frameworkModule - module framework, qui porte les contrôleurs
+*/
+function mountLoginPage(frameworkModule) {
+	if (mounted) return;
+	const page = frameworkModule.get("authFlow")?.describeLoginPage?.() ?? null;
+	if (page === null) return;
+	if (!page.password && !page.passkey && page.providers.length === 0) frameworkModule.log(`${page.path} : aucun moyen de connexion — loginPage.password à false, passkeys coupées, aucun fournisseur opérationnel`, "WARNING");
+	router_default.createRoute("security.login.page", {
+		path: page.path,
+		constructor: LoginPageController,
+		classMethod: "page",
+		requirements: { methods: ["GET", "HEAD"] },
+		bypassFirewall: true
+	});
+	frameworkModule.get("server-static")?.addMount(LOGIN_PAGE_ASSETS_BASE, assetsDir());
+	if (!Object.prototype.hasOwnProperty.call(LoginPageController.prototype, "module")) router_default.setController(LoginPageController, frameworkModule);
+	mounted = true;
+}
+//#endregion
+export { LoginPageController as default, mountLoginPage };

package/dist/nodefony/controller/OAuth2Controller.js

@@ -1,20 +1,80 @@
-import Controller from "../src/Controller.js";
 import router_default from "../service/router.js";
+import SecurityApiController from "../src/SecurityApiController.js";
+import { OAUTH2_API_BASE, OAUTH2_FAILED_REASON, safeRedirectPath } from "nodefony";
 //#region nodefony/controller/OAuth2Controller.ts
 const STATE_KEY = "oauth2:state";
 const VERIFIER_KEY = "oauth2:verifier";
 const PROVIDER_KEY = "oauth2:provider";
+const FROM_KEY = "oauth2:from";
+const BACK_KEY = "oauth2:back";
 let mounted = false;
 /**
+* Codes d'erreur qu'un serveur d'autorisation peut renvoyer au callback, et
+* SEULS codes que l'écran d'arrivée reçoit : OAuth 2.0 (RFC 6749 §4.1.2.1) et
+* OpenID Connect Core (§3.1.2.6). Une liste fermée — jamais la chaîne reçue
+* telle quelle : le paramètre `error` vient de l'URL, donc de n'importe qui.
+*/
+const AUTHORIZATION_ERRORS = /* @__PURE__ */ new Set([
+	"invalid_request",
+	"unauthorized_client",
+	"access_denied",
+	"unsupported_response_type",
+	"invalid_scope",
+	"server_error",
+	"temporarily_unavailable",
+	"interaction_required",
+	"login_required",
+	"account_selection_required",
+	"consent_required"
+]);
+/**
+* Thème que la page appelante a rendu (`?theme=`), à transmettre à l'écran du
+* fournisseur. Liste FERMÉE : la chaîne vient de l'URL, toute autre valeur est
+* ignorée sans un mot — rien d'arbitraire n'atteint la requête d'autorisation.
+*
+* @param value - paramètre `theme` de la requête, ou `null`
+* @returns l'option à passer à `createAuthorization`, vide hors liste
+*/
+function providerThemeOption(value) {
+	return value === "light" || value === "dark" ? { theme: value } : {};
+}
+const PROBE_ORIGIN = "http://redirect.invalid";
+/**
+* Compose l'adresse de l'écran d'échec : la raison de l'échec, et la page où
+* aller une fois connecté, pour que l'écran la garde à la tentative suivante.
+*
+* `reason` vaut le code rendu par le fournisseur s'il appartient à la liste
+* normalisée (`access_denied` = l'utilisateur a choisi de revenir), sinon
+* {@link OAUTH2_FAILED_REASON} — jamais la chaîne reçue, qui vient de l'URL.
+* Une `reason` ou un `from` déjà présents sont REMPLACÉS (l'écran qui a lancé
+* le flux peut porter ceux d'une tentative précédente) ; le reste de la
+* requête et le fragment sont conservés, et une adresse relative reste relative.
+*
+* @param failure - l'écran d'échec : `back` revalidé, ou `failureRedirect`
+* @param error - le paramètre `error` reçu au callback, ou `null`
+* @param from - la page où aller une fois connecté (revalidée), ou `null`
+* @returns l'adresse de redirection
+*/
+function oauth2FailureTarget(failure, error, from) {
+	const reason = error !== null && AUTHORIZATION_ERRORS.has(error) ? error : OAUTH2_FAILED_REASON;
+	const absolute = /^[a-z][a-z0-9+.-]*:/i.test(failure);
+	const url = new URL(failure, PROBE_ORIGIN);
+	url.searchParams.set("reason", reason);
+	if (from === null) url.searchParams.delete("from");
+	else url.searchParams.set("from", from);
+	return absolute ? url.href : `${url.pathname}${url.search}${url.hash}`;
+}
+/**
 * Endpoints HTTP du **social login OAuth 2.0** (P6 J9) — adaptateurs MINCES
 * au-dessus du service `oauth2` (`@nodefony/security`) :
 *
-*  - `GET /nodefony/security/api/oauth2/{provider}/authorize` — démarre le flux :
-*    pose `state`+`code_verifier` en session (anonyme), redirige (302) vers le
-*    fournisseur.
+*  - `GET /nodefony/security/api/oauth2/{provider}/authorize?from=&back=` —
+*    démarre le flux : pose `state`+`code_verifier` en session (anonyme), avec
+*    les retours revalidés en chemins locaux, redirige (302) vers le fournisseur.
 *  - `GET /nodefony/security/api/oauth2/{provider}/callback` — valide le `state`
 *    (anti-CSRF), échange le `code`, provisionne le Shadow User et OUVRE la
-*    session BFF (302 vers `successRedirect`).
+*    session BFF (302 vers `from`, sinon `successRedirect`). Un échec mène à
+*    `back`, sinon à `failureRedirect`, avec `reason` et `from`.
 *
 * Montés UNIQUEMENT si le service `oauth2` existe (social login activé) — 404
 * sinon, zéro surface.
@@ -25,7 +85,7 @@ let mounted = false;
 * La session anonyme ne porte que `state`/`verifier` ; `establishSessionFor`
 * régénère l'ID (anti-fixation) à la promotion.
 */
-var OAuth2Controller = class extends Controller {
+var OAuth2Controller = class extends SecurityApiController {
 	constructor(context) {
 		super("OAuth2Controller", context);
 	}
@@ -55,7 +115,7 @@ var OAuth2Controller = class extends Controller {
 		if (!svc.listProviders().includes(provider)) return this.renderJson({ error: "Unknown provider" }, 404);
 		let auth;
 		try {
-			auth = await svc.createAuthorization(provider);
+			auth = await svc.createAuthorization(provider, providerThemeOption(this.#queryString("theme")));
 		} catch (error) {
 			this.log(`oauth2 authorize "${provider}" : ${error.message}`, "ERROR");
 			return this.renderJson({ error: "OAuth provider unavailable" }, 503);
@@ -65,6 +125,8 @@ var OAuth2Controller = class extends Controller {
 		session.set(STATE_KEY, auth.state);
 		session.set(VERIFIER_KEY, auth.codeVerifier);
 		session.set(PROVIDER_KEY, provider);
+		session.set(FROM_KEY, this.#localPath("from"));
+		session.set(BACK_KEY, this.#localPath("back"));
 		await session.save();
 		this.redirect(auth.url, 302);
 	}
@@ -78,28 +140,73 @@ var OAuth2Controller = class extends Controller {
 		const expectedState = session?.get(STATE_KEY);
 		const storedVerifier = session?.get(VERIFIER_KEY);
 		const expectedProvider = session?.get(PROVIDER_KEY);
+		const from = safeRedirectPath(session?.get(FROM_KEY), "") || null;
+		const back = safeRedirectPath(session?.get(BACK_KEY), "") || null;
 		session?.set(STATE_KEY, null);
 		session?.set(VERIFIER_KEY, null);
 		session?.set(PROVIDER_KEY, null);
+		session?.set(FROM_KEY, null);
+		session?.set(BACK_KEY, null);
 		await session?.save();
+		const failedAt = back ?? failure;
 		const code = this.#queryString("code");
 		const returnedState = this.#queryString("state");
 		const returnedIss = this.#queryString("iss");
-		if (code === null || returnedState === null || typeof expectedState !== "string" || returnedState !== expectedState || expectedProvider !== provider) {
-			this.redirect(failure, 302);
+		const stateIsValid = returnedState !== null && typeof expectedState === "string" && returnedState === expectedState && expectedProvider === provider;
+		if (code === null || !stateIsValid) {
+			const returnedError = code === null && stateIsValid ? this.#queryString("error") : null;
+			if (returnedError !== null) {
+				const logged = AUTHORIZATION_ERRORS.has(returnedError) ? returnedError : "code non normalisé";
+				this.log(`oauth2 callback "${provider}" : le fournisseur a répondu « ${logged} »`, "INFO");
+			}
+			this.redirect(oauth2FailureTarget(failedAt, returnedError, from), 302);
 			return;
 		}
 		try {
-			const { identifier } = await svc.exchangeAndProvision(provider, code, typeof storedVerifier === "string" ? storedVerifier : null, returnedIss);
+			const { identifier, logoutHint } = await svc.exchangeAndProvision(provider, code, typeof storedVerifier === "string" ? storedVerifier : null, returnedIss);
 			await flow.establishSessionFor(this.context, identifier, "oauth");
-			this.redirect(success, 302);
+			const opened = this.context.session;
+			if (opened && logoutHint !== void 0 && svc.rememberLogout) svc.rememberLogout(opened, logoutHint);
+			this.redirect(from ?? success, 302);
 			return;
 		} catch (error) {
 			this.log(`oauth2 callback "${provider}" : ${error.message.slice(0, 200)}`, "WARNING");
-			this.redirect(failure, 302);
+			this.redirect(oauth2FailureTarget(failedAt, null, from), 302);
 			return;
 		}
 	}
+	/**
+	* Canal arrière : le fournisseur demande de fermer les sessions qu'il
+	* désigne (OpenID Connect Back-Channel Logout 1.0 §2.5-2.8).
+	*
+	* Appelé serveur à serveur — ni cookie, ni session, ni jeton CSRF : la
+	* SIGNATURE du `logout_token` est la seule authentification. Réponses de la
+	* norme (§2.8) : 200 si la déconnexion a eu lieu (ou n'avait plus lieu
+	* d'être), 400 sinon — jeton refusé (`invalid_request`) comme déconnexion
+	* impossible (la cause part au journal, jamais au fournisseur). Toujours
+	* `Cache-Control: no-store`.
+	*/
+	async backchannelLogout(provider) {
+		const noStore = { "cache-control": "no-store" };
+		const svc = this.#service();
+		if (!svc || !svc.listProviders().includes(provider)) return this.renderJson({ error: "Unknown provider" }, 404, noStore);
+		if (!svc.backchannelLogout) return this.renderJson({ error: "Not implemented" }, 501, noStore);
+		const token = this.queryPost?.logout_token;
+		if (typeof token !== "string" || token.length === 0) return this.renderJson({ error: "invalid_request" }, 400, noStore);
+		let outcome;
+		try {
+			({outcome} = await svc.backchannelLogout(provider, token));
+		} catch (error) {
+			this.log(`oauth2 back-channel logout "${provider}" : ${error.message.slice(0, 200)}`, "ERROR");
+			return this.renderJson({ error: "invalid_request" }, 400, noStore);
+		}
+		if (outcome === "unsupported") return this.renderJson({ error: "Not implemented" }, 501, noStore);
+		if (outcome === "refused") {
+			this.log(`oauth2 back-channel logout "${provider}" : jeton de déconnexion refusé`, "WARNING");
+			return this.renderJson({ error: "invalid_request" }, 400, noStore);
+		}
+		return this.renderResponse("", "utf8", 200, noStore);
+	}
 	#service() {
 		const svc = this.get("oauth2");
 		return svc?.isEnabled() ? svc : null;
@@ -107,6 +214,10 @@ var OAuth2Controller = class extends Controller {
 	#flow() {
 		return this.get("authFlow") ?? null;
 	}
+	/** Paramètre de query string revalidé en chemin local, ou `null`. */
+	#localPath(key) {
+		return safeRedirectPath(this.#queryString(key), "") || null;
+	}
 	/** Lit un paramètre de query string (GET), ou `null`. */
 	#queryString(key) {
 		const v = this.queryGet?.[key];
@@ -119,7 +230,7 @@ var OAuth2Controller = class extends Controller {
 */
 function mountOAuth2Routes(frameworkModule) {
 	if (mounted) return;
-	const base = "/nodefony/security/api/oauth2";
+	const base = OAUTH2_API_BASE;
 	const routes = [
 		[
 			"security.oauth2.providers",
@@ -138,6 +249,12 @@ function mountOAuth2Routes(frameworkModule) {
 			`${base}/{provider}/callback`,
 			"GET",
 			"callback"
+		],
+		[
+			"security.oauth2.backchannelLogout",
+			`${base}/{provider}/backchannel-logout`,
+			"POST",
+			"backchannelLogout"
 		]
 	];
 	for (const [name, path, method, classMethod] of routes) router_default.createRoute(name, {
@@ -151,4 +268,4 @@ function mountOAuth2Routes(frameworkModule) {
 	mounted = true;
 }
 //#endregion
-export { OAuth2Controller as default, mountOAuth2Routes };
+export { OAuth2Controller as default, mountOAuth2Routes, oauth2FailureTarget, providerThemeOption };

package/dist/nodefony/controller/SessionAuthController.js

@@ -1,5 +1,6 @@
-import Controller from "../src/Controller.js";
 import router_default from "../service/router.js";
+import SecurityApiController from "../src/SecurityApiController.js";
+import { AUTH_API_BASE } from "nodefony";
 //#region nodefony/controller/SessionAuthController.ts
 let mounted = false;
 /**
@@ -8,7 +9,8 @@ let mounted = false;
 *
 *  - `POST /nodefony/security/api/auth/login`  — body JSON `{username, password}`
 *  - `POST /nodefony/security/api/auth/logout` — idempotent
-*  - `GET  /nodefony/security/api/auth/me`     — identité de la session courante
+*  - `GET  /nodefony/security/api/auth/me`     — identité de la session courante :
+*    TOUJOURS `200`, `{ user }` ou `{ user: null }` sans session
 *
 * Montés par le module framework UNIQUEMENT si le service `authFlow` existe
 * (module security chargé) — sans lui, les routes n'existent pas (404, zéro
@@ -19,14 +21,20 @@ let mounted = false;
 * `Retry-After` (RFC 6585) posé par le throttler NIST ; tout le reste remonte
 * au pipeline d'erreurs standard (500, détail loggé jamais fuité).
 *
-* @remarks Dérogation RFC 7235 §3.1 DÉLIBÉRÉE : les 401 de `login`/`me` ne
+* `me` est une SONDE d'état, pas une ressource protégée : « pas de session »
+* est un état normal du navigateur, pas une faute — d'où `200` + `{ user:
+* null }`, comme les bibliothèques qui livrent aussi le client de connexion
+* (Auth.js, better-auth). Le `401` y écrivait une erreur réseau dans la console
+* de chaque visiteur anonyme, sans rien protéger : la réponse ne révèle rien.
+*
+* @remarks Dérogation RFC 9110 §15.5.2 DÉLIBÉRÉE : les 401 de `login` ne
 * portent PAS de `WWW-Authenticate` — aucun scheme HTTP ne décrit un cookie de
 * session, et un challenge `Basic` mensonger déclencherait le popup natif du
 * navigateur (l'anti-pattern que le BFF élimine). Les zones du firewall, elles,
 * restent strictement conformes (challenge du premier authenticator qui en
 * déclare un).
 */
-var SessionAuthController = class extends Controller {
+var SessionAuthController = class extends SecurityApiController {
 	constructor(context) {
 		super("SessionAuthController", context);
 	}
@@ -62,19 +70,35 @@ var SessionAuthController = class extends Controller {
 			return this.#renderAuthError(e);
 		}
 	}
-	/** Détruit la session (storage + cookie). Toujours 200 (idempotent). */
+	/**
+	* Détruit la session (storage + cookie). Toujours 200 (idempotent). Quand la
+	* session venait d'un fournisseur qui publie un point de déconnexion, la
+	* réponse porte `logoutUrl` : le client y envoie le navigateur pour fermer
+	* aussi la session du fournisseur.
+	*/
 	async logout() {
 		const flow = this.#flow();
 		if (!flow) return this.renderJson({ error: "Authentication unavailable" }, 503);
-		await flow.logout(this.context);
+		const context = this.context;
+		if (flow.logoutWithProvider) {
+			const { logoutUrl } = await flow.logoutWithProvider(context);
+			return this.renderJson(logoutUrl ? {
+				ok: true,
+				logoutUrl
+			} : { ok: true });
+		}
+		await flow.logout(context);
 		return this.renderJson({ ok: true });
 	}
-	/** Identité de la session courante, re-résolue (rôles frais), ou 401. */
+	/**
+	* Identité de la session courante, re-résolue (rôles frais). Toujours `200` :
+	* `{ user: null }` quand il n'y a pas de session (ou qu'elle ne mène plus à
+	* un compte actif) — l'absence de session est un état, pas une erreur.
+	*/
 	async me() {
 		const flow = this.#flow();
 		if (!flow) return this.renderJson({ error: "Authentication unavailable" }, 503);
 		const user = await flow.me(this.context);
-		if (user === null) return this.renderJson({ error: "Unauthorized" }, 401);
 		return this.renderJson({ user });
 	}
 	#flow() {
@@ -87,6 +111,10 @@ var SessionAuthController = class extends Controller {
 			return this.renderJson({ error: "Too many attempts" }, 429, { "retry-after": String(typeof retry === "number" ? retry : 1) });
 		}
 		if (code === 401) return this.renderJson({ error: "Invalid credentials" }, 401);
+		if (code === 403) {
+			const message = e instanceof Error ? e.message : "Forbidden";
+			return this.renderJson({ error: message }, 403);
+		}
 		throw e;
 	}
 };
@@ -100,7 +128,7 @@ var SessionAuthController = class extends Controller {
 */
 function mountSessionAuthRoutes(frameworkModule) {
 	if (mounted) return;
-	const base = "/nodefony/security/api/auth";
+	const base = AUTH_API_BASE;
 	const routes = [
 		[
 			"security.auth.login",

package/dist/nodefony/controller/TokenAuthController.js

@@ -1,5 +1,5 @@
-import Controller from "../src/Controller.js";
 import router_default from "../service/router.js";
+import SecurityApiController from "../src/SecurityApiController.js";
 //#region nodefony/controller/TokenAuthController.ts
 let mounted = false;
 /** Normalise le paramètre `scope` (string OAuth « a b c » ou tableau) → string[]. */
@@ -24,11 +24,11 @@ function parseScope(scope) {
 * framework ne peut pas importer les classes d'erreur de security ; un 429
 * reporte le `Retry-After` (RFC 6585) du throttler NIST.
 *
-* @remarks Dérogation RFC 7235 §3.1 (comme `SessionAuthController`) : ces 401 ne
+* @remarks Dérogation RFC 9110 §15.5.2 (comme `SessionAuthController`) : ces 401 ne
 * portent pas de `WWW-Authenticate` — l'endpoint d'émission n'est pas une
 * ressource protégée par Bearer, il DÉLIVRE le Bearer.
 */
-var TokenAuthController = class extends Controller {
+var TokenAuthController = class extends SecurityApiController {
 	constructor(context) {
 		super("TokenAuthController", context);
 	}
@@ -38,7 +38,7 @@ var TokenAuthController = class extends Controller {
 		if (!svc || !svc.isEnabled()) return this.renderJson({ error: "Token issuance unavailable" }, 503);
 		const body = this.queryPost ?? {};
 		try {
-			const tokens = await svc.issueForCredentials(body.username, body.password, parseScope(body.scope), body.resource);
+			const tokens = await svc.issueForCredentials(body.username, body.password, parseScope(body.scope), body.resource, this.context);
 			return await this.renderJson(tokens);
 		} catch (e) {
 			return this.#renderAuthError(e);
@@ -73,6 +73,13 @@ var TokenAuthController = class extends Controller {
 			return this.renderJson({ error: "Too many attempts" }, 429, { "retry-after": String(typeof retry === "number" ? retry : 1) });
 		}
 		if (code === 401) return this.renderJson({ error: "invalid_grant" }, 401);
+		if (code === 403) {
+			const description = e instanceof Error ? e.message : "Forbidden";
+			return this.renderJson({
+				error: "invalid_request",
+				error_description: description
+			}, 403);
+		}
 		throw e;
 	}
 };

package/dist/nodefony/controller/TotpController.js

@@ -1,5 +1,5 @@
-import Controller from "../src/Controller.js";
 import router_default from "../service/router.js";
+import SecurityApiController from "../src/SecurityApiController.js";
 //#region nodefony/controller/TotpController.ts
 let mounted = false;
 /**
@@ -20,7 +20,7 @@ let mounted = false;
 * `totp` existe (security chargé) — sans security, 404 et zéro surface ; 2FA
 * désactivé, les routes répondent 503.
 */
-var TotpController = class extends Controller {
+var TotpController = class extends SecurityApiController {
 	constructor(context) {
 		super("TotpController", context);
 	}
@@ -43,7 +43,7 @@ var TotpController = class extends Controller {
 		if (typeof code !== "string" || code.length === 0) return this.renderJson({ error: "Invalid code" }, 400);
 		let activation;
 		try {
-			activation = await svc.confirmEnrollment(subject, code);
+			activation = await svc.confirmEnrollment(subject, code, this.context);
 		} catch {
 			return this.renderJson({ error: "Invalid or expired code" }, 400);
 		}
@@ -55,7 +55,7 @@ var TotpController = class extends Controller {
 		if (!svc) return this.renderJson({ error: "2FA unavailable" }, 503);
 		const subject = await this.#currentSubject();
 		if (subject === null) return this.renderJson({ error: "Unauthorized" }, 401);
-		await svc.disable(subject);
+		await svc.disable(subject, this.context);
 		return this.renderJson({ ok: true });
 	}
 	/** État 2FA du porteur courant (alimente la console « ma sécurité »). */
@@ -78,7 +78,7 @@ var TotpController = class extends Controller {
 		const flow = this.#flow();
 		if (!flow) return null;
 		const me = await flow.me(this.context);
-		return me && typeof me.username === "string" ? me.username : null;
+		return me && typeof me.identifier === "string" ? me.identifier : null;
 	}
 };
 /**