@nodefony/security 10.0.0-beta.2 → 10.0.0-beta.4

package/dist/nodefony/service/auditService.js

@@ -1,8 +1,8 @@
 import { defineSecurityConfig } from "../config/defineModuleConfig.js";
 import { getAuditStoreFactory, listAuditStores } from "../src/audit/auditStoreRegistry.js";
-import { AUTO_STORE, EMPTY_INFRA, GcScheduler, Service, durableStoreRemedy, readStoreConnector, readStoreLocation, resolveAutoStore, runNeedsExternalServices } from "nodefony";
+import { AUTO_STORE, EMPTY_INFRA, GcScheduler, Service, durableStoreRemedy, readStoreConnector, readStoreLocation, resolveAutoStore, storeConnectivity } from "nodefony";
 import { randomBytes } from "node:crypto";
-//#region nodefony/service/auditService.ts
+// nodefony/service/auditService.ts
 const serviceName = "auditService";
 const GC_INTERVAL_MS = 36e5;
 /**
@@ -50,7 +50,7 @@ var AuditService = class extends Service {
 		let storeName = config.audit.store;
 		let reason = `store explicitement configuré ("${storeName}")`;
 		if (storeName === AUTO_STORE) {
-			const auto = resolveAutoStore("durable", this.kernel?.infra ?? EMPTY_INFRA, listAuditStores(), "memory", runNeedsExternalServices(this.kernel));
+			const auto = resolveAutoStore("durable", this.kernel?.infra ?? EMPTY_INFRA, listAuditStores(), "memory", storeConnectivity(this.kernel));
 			storeName = auto.store;
 			reason = auto.reason;
 			this.log(`audit.store "auto" → "${storeName}" (${auto.reason})`, "INFO");
@@ -62,7 +62,7 @@ var AuditService = class extends Service {
 			this.log(`${msg} — audit désactivé (journal de sécurité non collecté)`, "CRITIC");
 			return;
 		}
-		if (storeName === "memory" && this.kernel?.environment === "production") this.log("audit.store \"memory\" en PRODUCTION — journal de sécurité volatil et per-pod : perdu au redémarrage, invisible des autres pods, rétention de conformité impossible. " + durableStoreRemedy(runNeedsExternalServices(this.kernel)), "WARNING");
+		if (storeName === "memory" && this.kernel?.environment === "production") this.log("audit.store \"memory\" en PRODUCTION — journal de sécurité volatil et per-pod : perdu au redémarrage, invisible des autres pods, rétention de conformité impossible. " + durableStoreRemedy(storeConnectivity(this.kernel)), "WARNING");
 		this.#enabled = true;
 		this.#idPrefix = randomBytes(4).toString("hex");
 		this.#store = factory({
@@ -142,5 +142,4 @@ var AuditService = class extends Service {
 		return this.#enabled;
 	}
 };
-//#endregion
 export { AuditService as default };

package/dist/nodefony/service/authFlow.js

@@ -1,10 +1,16 @@
+import { securityConfigSchema } from "../config/config.js";
+import { InsecureTransportError } from "../errors/InsecureTransportError.js";
 import { AuthenticationError } from "../errors/AuthenticationError.js";
 import { ThrottledError } from "../errors/ThrottledError.js";
-import { resolveSessionIdentity } from "../src/sessionIdentity.js";
+import { ACCOUNT_ID_KEY, CREDENTIALS_VERSION_KEY, credentialsVersionOf } from "../src/accountBinding.js";
+import { resolveBoundSessionIdentity, resolveSessionIdentity } from "../src/sessionIdentity.js";
 import { recordAudit } from "../src/audit/recordAudit.js";
 import { readAuditContext } from "../src/audit/readAuditContext.js";
-import { RequestContext, Service } from "nodefony";
-//#region nodefony/service/authFlow.ts
+import { amrForFactor } from "../src/sessionAuthentication.js";
+import { LOGIN_PAGE_SKIN_SPECS, MFA_METHOD_TOTP, SESSION_AMR_KEY, SESSION_AUTH_AT_KEY, Service } from "nodefony";
+import { requestUser } from "@nodefony/user";
+// nodefony/service/authFlow.ts
+const MFA_METHODS = Object.freeze([MFA_METHOD_TOTP]);
 const serviceName = "authFlow";
 const INVALID_CREDENTIALS = "Invalid credentials";
 const PENDING_MFA_KEY = "mfa:pending";
@@ -34,8 +40,11 @@ var AuthFlow = class extends Service {
 	#sessions = null;
 	#throttler = null;
 	#throttlerResolved = false;
+	#transport = null;
 	#totp = null;
 	#totpResolved = false;
+	#loginPage = null;
+	#loginPageResolved = false;
 	constructor(module) {
 		super(serviceName, module.container, module.notificationsCenter, module.options);
 		this.module = module;
@@ -51,6 +60,8 @@ var AuthFlow = class extends Service {
 	* @param identifier - identifiant saisi (body JSON, non typé à la frontière).
 	* @param password - mot de passe saisi.
 	* @returns `authenticated` (identité établie) ou `mfa_required` (2ᵉ facteur requis).
+	* @throws InsecureTransportError (403) — mot de passe reçu en clair en
+	*   production (refusé AVANT le throttle et le verifier).
 	* @throws ThrottledError (429 + `Retry-After`) — backoff actif.
 	* @throws AuthenticationError (401, message uniforme) — credential absent ou
 	*   invalide.
@@ -58,6 +69,7 @@ var AuthFlow = class extends Service {
 	async login(context, identifier, password) {
 		const info = readAuditContext(context);
 		const who = typeof identifier === "string" ? identifier : null;
+		this.#assertTransport(context, "login", who, info);
 		if (typeof identifier !== "string" || identifier.length === 0 || typeof password !== "string" || password.length === 0) {
 			recordAudit(this.container, {
 				category: "auth",
@@ -113,12 +125,10 @@ var AuthFlow = class extends Service {
 			});
 			return {
 				status: "mfa_required",
-				methods: ["totp"]
+				methods: MFA_METHODS
 			};
 		}
-		await this.#openSession(context, user.identifier);
-		context.user = user.identifier;
-		RequestContext.set("user", user);
+		await this.#openSession(context, user, "password");
 		recordAudit(this.container, {
 			category: "auth",
 			action: "login.success",
@@ -148,9 +158,7 @@ var AuthFlow = class extends Service {
 	async establishSessionFor(context, identifier, reason = "federated") {
 		if (typeof identifier !== "string" || identifier.length === 0) throw new AuthenticationError(INVALID_CREDENTIALS);
 		const user = await resolveSessionIdentity(this.#resolveUsers(), identifier);
-		await this.#openSession(context, user.identifier);
-		context.user = user.identifier;
-		RequestContext.set("user", user);
+		await this.#openSession(context, user, reason);
 		recordAudit(this.container, {
 			category: "auth",
 			action: "login.success",
@@ -171,6 +179,7 @@ var AuthFlow = class extends Service {
 	* @param context - contexte HTTP (porte la session PENDING).
 	* @param code - code présenté (TOTP ou code de récupération).
 	* @returns la projection publique de l'utilisateur authentifié.
+	* @throws InsecureTransportError (403) — code reçu en clair en production.
 	* @throws ThrottledError (429) — trop de tentatives.
 	* @throws AuthenticationError (401, uniforme) — aucun défi en cours, code absent
 	*   ou invalide (la session N'est PAS ouverte ; le défi reste pour un retry).
@@ -178,6 +187,7 @@ var AuthFlow = class extends Service {
 	async completeMfaLogin(context, code) {
 		const info = readAuditContext(context);
 		const pending = context.session?.get(PENDING_MFA_KEY);
+		this.#assertTransport(context, "login/totp", typeof pending === "string" && pending.length > 0 ? pending : null, info);
 		if (typeof pending !== "string" || pending.length === 0) throw new AuthenticationError(INVALID_CREDENTIALS);
 		const throttler = this.#resolveThrottler();
 		if (throttler !== null) {
@@ -253,23 +263,95 @@ var AuthFlow = class extends Service {
 		return true;
 	}
 	/**
+	* Déconnexion COMPLÈTE : détruit la session locale et rend, si la session
+	* vient d'un fournisseur qui publie un point de déconnexion (Keycloak…),
+	* l'adresse où envoyer le navigateur pour fermer AUSSI sa session à lui —
+	* sans quoi le clic suivant sur « Continuer avec … » reconnecte sans mot de
+	* passe (OpenID Connect RP-Initiated Logout 1.0).
+	*
+	* @returns `destroyed` comme {@link logout} ; `logoutUrl` à suivre, ou `null`.
+	*/
+	async logoutWithProvider(context) {
+		const session = context.session;
+		const logoutUrl = session?.status === "active" ? await this.get("oauth2")?.logoutUrlFor(session) ?? null : null;
+		return {
+			destroyed: await this.logout(context),
+			logoutUrl
+		};
+	}
+	/**
 	* Identité portée par la session courante, re-résolue auprès du provider
 	* (mêmes contrôles que le `SessionAuthenticator` — source unique).
 	*
 	* @returns la projection publique, ou `null` (pas de session, session
-	*   orpheline, compte verrouillé/désactivé) — le handler répond 401.
+	*   orpheline, compte verrouillé/désactivé) — le handler répond `200`
+	*   `{ user: null }`.
 	*/
 	async me(context) {
 		const identifier = context.session?.user;
 		if (typeof identifier !== "string" || identifier.length === 0) return null;
+		const current = requestUser(identifier);
+		if (current !== null) return toSafeUser(current);
 		try {
-			return toSafeUser(await resolveSessionIdentity(this.#resolveUsers(), identifier));
+			return toSafeUser(await resolveBoundSessionIdentity(this.#resolveUsers(), identifier, context.session?.getMetaBag(ACCOUNT_ID_KEY), context.session?.getMetaBag(CREDENTIALS_VERSION_KEY)));
 		} catch (error) {
 			if (error instanceof AuthenticationError) return null;
 			throw error;
 		}
 	}
-	async #openSession(context, identifier) {
+	/**
+	* Décrit la page de connexion par défaut : ce qu'elle propose et comment
+	* elle s'habille, depuis `security.loginPage` et les fournisseurs
+	* opérationnels.
+	*
+	* Lue par le contrôleur de `@nodefony/framework`, qui n'importe pas ce
+	* paquet. Les fournisseurs sont relus à chaque appel : l'un d'eux peut
+	* tomber ou revenir pendant que le serveur tourne.
+	*
+	* @returns la description, ou `null` quand la page par défaut est
+	*   désactivée (`loginPage.enabled: false`) ou la configuration invalide —
+	*   le contrôleur répond alors 404.
+	*/
+	describeLoginPage() {
+		const page = this.#resolveLoginPage();
+		if (page === null || !page.enabled) return null;
+		const offered = this.get("oauth2")?.listDisplayProviders() ?? [];
+		return {
+			path: page.path,
+			title: page.title ?? null,
+			logo: page.logo ?? null,
+			template: page.template ?? null,
+			heading: page.heading ?? null,
+			subtitle: page.subtitle ?? null,
+			stylesheet: page.stylesheet ?? null,
+			providersFirst: page.providersFirst,
+			hero: page.hero === void 0 ? null : page.hero === false ? false : {
+				heading: page.hero.heading,
+				text: page.hero.text ?? null
+			},
+			footer: page.footer,
+			skin: page.skin,
+			layout: page.layout ?? LOGIN_PAGE_SKIN_SPECS[page.skin].layout,
+			previewPicker: page.previewPicker,
+			previewHook: page.previewHook ?? null,
+			password: page.password,
+			passkey: this.get("webauthn")?.isEnabled() ?? false,
+			providers: offered.map(({ name, label, icon }) => ({
+				name,
+				label,
+				icon: icon ?? null
+			}))
+		};
+	}
+	#resolveLoginPage() {
+		if (!this.#loginPageResolved) {
+			this.#loginPageResolved = true;
+			const parsed = securityConfigSchema.safeParse(this.options);
+			this.#loginPage = parsed.success ? parsed.data.loginPage : null;
+		}
+		return this.#loginPage;
+	}
+	async #openSession(context, user, factor) {
 		const session = context.session ?? await this.#resolveSessions().start(context);
 		if (session === null) {
 			this.log("login: session service returned no session", "ERROR");
@@ -287,7 +369,11 @@ var AuthFlow = class extends Service {
 			const ua = provenance.getUserAgent?.();
 			if (ua) session.setMetaBag("ua", ua);
 		} catch {}
-		await session.save(identifier);
+		session.setMetaBag(SESSION_AUTH_AT_KEY, Date.now());
+		session.setMetaBag(SESSION_AMR_KEY, amrForFactor(factor));
+		session.setMetaBag(ACCOUNT_ID_KEY, user.id);
+		session.setMetaBag(CREDENTIALS_VERSION_KEY, credentialsVersionOf(user));
+		await session.save(user.identifier);
 	}
 	#resolveSessions() {
 		if (this.#sessions === null) {
@@ -305,6 +391,23 @@ var AuthFlow = class extends Service {
 		}
 		return this.#users;
 	}
+	#assertTransport(context, door, actor, info) {
+		this.#transport ??= this.get("credentialTransport") ?? null;
+		if (this.#transport === null) return;
+		try {
+			this.#transport.assert(context, door);
+		} catch (error) {
+			if (error instanceof InsecureTransportError) recordAudit(this.container, {
+				category: "auth",
+				action: "login.failure",
+				outcome: "failure",
+				actor,
+				reason: "insecure_transport",
+				...info
+			});
+			throw error;
+		}
+	}
 	#resolveThrottler() {
 		if (!this.#throttlerResolved) {
 			this.#throttler = this.get("loginThrottler") ?? null;
@@ -324,9 +427,8 @@ var AuthFlow = class extends Service {
 function toSafeUser(user) {
 	return {
 		id: user.id,
-		username: user.identifier,
+		identifier: user.identifier,
 		roles: [...user.roles]
 	};
 }
-//#endregion
 export { AuthFlow, AuthFlow as default };

package/dist/nodefony/service/authorization.js

@@ -2,7 +2,7 @@ import { recordAudit } from "../src/audit/recordAudit.js";
 import "../contracts/IAccessVoter.js";
 import { listVoterFactories } from "../src/voter/voterRegistry.js";
 import { Service, logColor } from "nodefony";
-//#region nodefony/service/authorization.ts
+// nodefony/service/authorization.ts
 const serviceName = "authorization";
 /**
 * Service d'autorisation Nodefony (niveau C, P6 J6) — décide d'un accès via un
@@ -90,5 +90,4 @@ function describeSubject(subject) {
 	if (subject === null || subject === void 0) return String(subject);
 	return subject.constructor?.name ?? typeof subject;
 }
-//#endregion
 export { Authorization, Authorization as default };

package/dist/nodefony/service/cors.js

@@ -1,4 +1,4 @@
-//#region nodefony/service/cors.ts
+// nodefony/service/cors.ts
 /**
 * Politique CORS de Nodefony — Same-Origin Policy assouplie côté serveur
 * (Fetch Standard / W3C CORS protocol). Logique PURE et synchrone : décide les
@@ -77,5 +77,4 @@ var Cors = class {
 		return h;
 	}
 };
-//#endregion
 export { Cors, Cors as default };

package/dist/nodefony/service/csrf.js

@@ -1,5 +1,5 @@
 import { CsrfError } from "../errors/CsrfError.js";
-//#region nodefony/service/csrf.ts
+// nodefony/service/csrf.ts
 /**
 * Méthodes HTTP « sûres » (RFC 9110 §9.2.1) — sans effet de bord par contrat,
 * donc hors du vecteur CSRF. Tout le reste (POST/PUT/PATCH/DELETE…) est traité
@@ -93,5 +93,4 @@ var Csrf = class {
 		}
 	}
 };
-//#endregion
 export { Csrf, Csrf as default };

package/dist/nodefony/service/firewall.js

@@ -1,6 +1,11 @@
+import { compileProviderRoleMapping, isPlatformRole } from "../src/oauth/providerRoles.js";
 import { SecuredArea } from "../src/SecuredArea.js";
+import { entryPointLocation } from "../src/entryPoint.js";
 import { LoginThrottler } from "../src/throttle/LoginThrottler.js";
+import { InsecureTransportError } from "../errors/InsecureTransportError.js";
+import { CredentialTransportPolicy, shouldEnforceCredentialTransport } from "../src/transport/CredentialTransportPolicy.js";
 import { RoleHierarchyWalker } from "../src/RoleHierarchyWalker.js";
+import { rolesWithin } from "../src/rolesWithin.js";
 import { mergeCspFragments } from "../src/csp.js";
 import { CsrfTokenManager } from "../src/csrfToken.js";
 import { CsrfError } from "../errors/CsrfError.js";
@@ -17,10 +22,11 @@ import { DEFAULT_SYSTEM_RULES, buildFrameAuthorizer, buildSystemRules } from "..
 import { recordAudit } from "../src/audit/recordAudit.js";
 import { readAuditContext } from "../src/audit/readAuditContext.js";
 import { SECURITY_AUDIT_CHANNEL, createAuditBridge } from "../src/audit/auditBridge.js";
-import { RequestContext, Service, logColor } from "nodefony";
-import { encoderFromConfig } from "@nodefony/user";
+import { findZonesOpenToSignup } from "../src/openToSignup.js";
+import { ROLES_WITHIN, RequestContext, Service, logColor } from "nodefony";
 import { randomBytes } from "node:crypto";
-//#region nodefony/service/firewall.ts
+import { encoderFromConfig } from "@nodefony/user";
+// nodefony/service/firewall.ts
 const serviceName = "firewall";
 /**
 * Réponse partagée de {@link Firewall.publishedProtectedResources} quand il n'y
@@ -87,6 +93,7 @@ var Firewall = class extends Service {
 	#cspFragments = null;
 	#config = null;
 	#configError = null;
+	#longLivedRevalidation = null;
 	constructor(module) {
 		super(serviceName, module.container, module.notificationsCenter, module.options);
 		this.module = module;
@@ -102,6 +109,7 @@ var Firewall = class extends Service {
 		}
 		this.#roleHierarchy = new RoleHierarchyWalker(this.#config.roleHierarchy);
 		this.container?.set("roleHierarchy", this.#roleHierarchy);
+		this.container?.set(ROLES_WITHIN, rolesWithin(() => this.container?.get("users") ?? null, this.#roleHierarchy));
 		this.#provisionSharedServices(this.#config);
 		if (this.#config.csrf.enabled) {
 			this.#csrf = new Csrf(this.#config.csrf, [...this.#config.csrf.trustedOrigins, ...this.#config.cors.origins]);
@@ -122,6 +130,7 @@ var Firewall = class extends Service {
 			this.#areas = list;
 			this.#instantiateAuthenticators(list);
 		}
+		for (const z of findZonesOpenToSignup(this.#config)) this.log(`${z.message} → ${z.action}`, "WARNING");
 		if (!this.#configError) {
 			this.#wireRealtime();
 			this.log(`Firewall ready — ${this.#areas?.length ?? 0} area(s), ${this.#authenticators?.size ?? 0} authenticator(s)`, "DEBUG");
@@ -137,7 +146,7 @@ var Firewall = class extends Service {
 				pattern: area.pattern,
 				host: area.host
 			} : { pattern: area.pattern };
-			realtime.useAuthenticator(matcher, new FirewallRealtimeAuthenticator(() => this.container?.get("tokenStore") ?? null));
+			realtime.useAuthenticator(matcher, new FirewallRealtimeAuthenticator(() => this.container?.get("tokenStore") ?? null, () => this.container?.get("users") ?? null));
 			wired = true;
 		}
 		const configRules = (this.#config?.realtimeChannels ?? []).map((r) => ({
@@ -172,6 +181,10 @@ var Firewall = class extends Service {
 		this.log(wired ? "Realtime data plane locked — WS handshake authenticators (RBAC) + frame authorizer + audit channel wired" : "Realtime data plane locked — frame authorizer (system floor) wired without qualifying zone; system channels closed to anonymous", "DEBUG");
 	}
 	#provisionSharedServices(config) {
+		this.container?.set("credentialTransport", new CredentialTransportPolicy({
+			enforce: shouldEnforceCredentialTransport(this.kernel?.environment, config.allowInsecureCredentials),
+			log: (message) => this.log(message, "WARNING")
+		}));
 		const specs = Object.values(config.encoders);
 		if (specs.length > 0) this.container?.set("passwordEncoder", encoderFromConfig(specs));
 		const rl = config.rateLimit;
@@ -263,17 +276,27 @@ var Firewall = class extends Service {
 	describe() {
 		const config = this.#config;
 		const mounted = this.#authenticators;
-		const zones = (this.#areas ?? []).map((a) => ({
-			name: a.name,
-			pattern: a.pattern.source,
-			security: a.security,
-			stateless: a.stateless,
-			mode: a.mode,
-			authenticators: [...a.authenticators],
-			allowsAnonymous: a.authenticators.includes("anonymous"),
-			host: a.host ?? null,
-			realtime: a.realtime
-		}));
+		const open = new Map((config ? findZonesOpenToSignup(config) : []).map((z) => [z.zone, z]));
+		const zones = (this.#areas ?? []).map((a) => {
+			const notice = open.get(a.name);
+			return {
+				name: a.name,
+				pattern: a.pattern.source,
+				security: a.security,
+				stateless: a.stateless,
+				mode: a.mode,
+				authenticators: [...a.authenticators],
+				allowsAnonymous: a.authenticators.includes("anonymous"),
+				host: a.host ?? null,
+				realtime: a.realtime,
+				roles: a.roles ? [...a.roles] : [],
+				openToSignup: notice !== void 0,
+				openToSignupNotice: notice ? {
+					message: notice.message,
+					action: notice.action
+				} : null
+			};
+		});
 		const available = new Set(listAuthenticatorFactories());
 		const names = new Set(available);
 		if (mounted) for (const n of mounted.keys()) names.add(n);
@@ -340,12 +363,32 @@ var Firewall = class extends Service {
 		const hierarchy = {};
 		for (const [role, inherited] of Object.entries(raw)) hierarchy[role] = [...inherited];
 		const walker = this.roleHierarchy;
+		const roles = Object.keys(hierarchy).map((role) => ({
+			role,
+			inherits: [...walker.reachableRoles([role])].filter((r) => r !== role).sort()
+		}));
+		const providerMappings = [];
+		for (const [provider, p] of Object.entries(this.#config?.oauth2.providers ?? {})) {
+			const mapping = compileProviderRoleMapping(p);
+			if (mapping === null) continue;
+			providerMappings.push({
+				provider,
+				sources: [...mapping.sources],
+				mappings: Object.keys(mapping.table).sort().map((from) => {
+					const to = mapping.table[from] ?? "";
+					return {
+						from,
+						to,
+						platform: isPlatformRole(to)
+					};
+				}),
+				allowPlatformRoles: p.allowPlatformRoles
+			});
+		}
 		return {
 			hierarchy,
-			roles: Object.keys(hierarchy).map((role) => ({
-				role,
-				inherits: [...walker.reachableRoles([role])].filter((r) => r !== role).sort()
-			}))
+			roles,
+			providerMappings
 		};
 	}
 	/**
@@ -424,7 +467,7 @@ var Firewall = class extends Service {
 	}
 	/**
 	* Pipeline complet de la zone : chaîne d'authenticators (selon `mode`) → ALS
-	* → Zero Trust. Rejette (401, challenge RFC 7235 posé) ou résout.
+	* → Zero Trust. Rejette (401, challenge RFC 9110 §11 posé) ou résout.
 	*/
 	async handleSecurity(context) {
 		if (this.#configError) throw new AuthenticationError("Security configuration invalid");
@@ -449,17 +492,22 @@ var Firewall = class extends Service {
 				this.#recordAuth(context, area, "auth.unverifiable", "failure", "verifier_unavailable", null);
 				throw error;
 			}
+			if (error instanceof InsecureTransportError) {
+				this.#recordAuth(context, area, "auth.failure", "failure", "insecure_transport", null);
+				throw error;
+			}
 			this.#setChallenge(context, area);
 			this.#recordAuth(context, area, "auth.failure", "failure", "invalid_credentials", null);
 			throw error;
 		}
 		if (token === null) {
-			this.#setChallenge(context, area);
+			if (!this.#redirectToEntryPoint(context, area)) this.#setChallenge(context, area);
 			this.#recordAuth(context, area, "auth.denied", "denied", "no_credentials", null);
 			throw new AuthenticationError(`Authentication required for area "${area.name}"`);
 		}
 		RequestContext.set("user", token.getUser());
 		RequestContext.set("token", token);
+		if (token.isAuthenticated()) context.userIdentifier = token.getUserIdentifier();
 		if (!token.isAuthenticated() && token.type !== "anonymous") {
 			this.#setChallenge(context, area);
 			this.#recordAuth(context, area, "auth.denied", "denied", "unauthenticated", token.getUserIdentifier());
@@ -520,8 +568,13 @@ var Firewall = class extends Service {
 	*    synchronizer token (`context.csrfToken`) — HttpContext pose ensuite le cookie
 	*    lisible `csrf-token`. Sinon, hot-path GET = retour immédiat (aucun en-tête lu).
 	*  - **Étape 1 (globale)** : sur une mutation, défense Fetch Metadata / Origin
-	*    (rejet cross-site même sur route publique). Skippée si `@CsrfExempt` (webhook,
-	*    auth par signature/clé) ou `bypassFirewall` (callbacks OAuth).
+	*    (rejet cross-site même sur route publique). Skippée SEULEMENT par `@CsrfExempt`
+	*    (webhook, auth par signature/clé). `bypassFirewall` ne l'en dispense PAS : il
+	*    retire l'authentification, pas la provenance — les routes de connexion sont
+	*    en bypass, et c'est précisément là qu'un formulaire tiers ouvrirait chez la
+	*    victime une session sur le compte de l'attaquant (login CSRF, CWE-352). Un
+	*    appel de serveur à serveur (canal arrière OIDC) ne porte ni `Sec-Fetch-Site`
+	*    ni `Origin` : il passe toujours.
 	*  - **Étape 2 (opt-in)** : sur une mutation `@CsrfProtect`, exige EN PLUS le
 	*    synchronizer token (en-tête `x-csrf-token` ≡ cookie + HMAC valide).
 	*
@@ -529,7 +582,6 @@ var Firewall = class extends Service {
 	*/
 	enforceCsrf(context) {
 		if (!this.#csrf) return;
-		if (context.resolver?.bypassFirewall) return;
 		const ctx = context;
 		if (!Csrf.isStateChanging(context.method)) {
 			if (ctx.csrfProtect && this.#csrfTokens && ctx.csrfToken == null) ctx.csrfToken = this.#csrfTokens.issue();
@@ -577,6 +629,18 @@ var Firewall = class extends Service {
 		return isPreflight ? 204 : void 0;
 	}
 	/**
+	* Le revalidateur de l'identité de la requête courante, pour une connexion
+	* longue qui la gardera (flux SSE). Même règle, même store de jetons que les
+	* sockets WebSocket — un transport qui en aurait une autre serait celui
+	* qu'un attaquant prendrait pour survivre à sa révocation.
+	*
+	* @returns `null` pour un anonyme ; sinon la fonction qui re-valide.
+	*/
+	currentRevalidator() {
+		this.#longLivedRevalidation ??= new FirewallRealtimeAuthenticator(() => this.container?.get("tokenStore") ?? null);
+		return this.#longLivedRevalidation.currentRevalidator();
+	}
+	/**
 	* En-têtes de sécurité APPLICATIFS (P6 J5) — CSP, Referrer-Policy, isolation
 	* cross-origin (COOP/COEP/CORP), Origin-Agent-Cluster, Permissions-Policy.
 	* Posés sur toute réponse du pipeline (branché dans `handleHttp`). Complète le
@@ -690,6 +754,34 @@ var Firewall = class extends Service {
 		}
 		return token;
 	}
+	/**
+	* Pose la redirection vers la page de connexion de la zone, quand la requête
+	* refusée est la navigation d'un navigateur. Cold path (refus seulement).
+	*
+	* La réponse est seulement MARQUÉE (`302` + `Location`) : le refus continue
+	* de remonter, et http rend une réponse déjà redirigée telle quelle au lieu
+	* d'un 401. Capability check : un contexte sans `redirect` (WebSocket) garde
+	* son refus.
+	*
+	* @returns `true` si la redirection est posée
+	*/
+	#redirectToEntryPoint(context, area) {
+		if (area.entryPoint === void 0 || !("redirect" in context)) return false;
+		const request = context.request;
+		const header = (name) => {
+			const value = request.headers[name];
+			return typeof value === "string" ? value : void 0;
+		};
+		const location = entryPointLocation(area.entryPoint, {
+			method: request.method,
+			accept: header("accept"),
+			fetchMode: header("sec-fetch-mode"),
+			path: request.url.pathname + request.url.search
+		});
+		if (location === null) return false;
+		context.redirect(location, 302);
+		return true;
+	}
 	#setChallenge(context, area) {
 		const response = context.response;
 		if (typeof response?.setHeader !== "function") return;
@@ -707,5 +799,4 @@ var Firewall = class extends Service {
 		return super.log(pci, severity, msgid, msg);
 	}
 };
-//#endregion
 export { Firewall, Firewall as default };