@portaidentity/server 1.12.0 → 1.13.0

package/CHANGELOG.md

@@ -5,6 +5,19 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [1.13.0] - 2026-10-24
+
+## Added
+- Add tenant-scoped user invitations, including a tenant invite route for service clients and tenant users.
+
+## Changed
+- Keep the server dependency pin aligned with the audited lockfile.
+- Keep the exact version pins aligned across the root and server workspace.
+
+## Fixed
+- Upgrade nodemailer to the patched 10.1.4 release to resolve remaining moderate production audit advisories.
+- Upgrade zod to the patched 4.6.6 release to resolve high-severity production audit advisory.
+
 ## [1.12.0] - 2026-10-23
 
 Fixed:

package/dist/config/schema.d.ts

@@ -26,7 +26,7 @@ export declare const configSchema: z.ZodObject<{
         warn: "warn";
     }>>;
     trustProxy: z.ZodPipe<z.ZodDefault<z.ZodUnion<readonly [z.ZodBoolean, z.ZodString]>>, z.ZodTransform<boolean, string | boolean>>;
-    trustProxyHops: z.ZodPreprocess<z.ZodDefault<z.ZodCoercedNumber<unknown>>>;
+    trustProxyHops: z.ZodPreprocess<z.ZodDefault<z.ZodCoercedNumber<unknown>>, unknown>;
     twoFactorEncryptionKey: z.ZodOptional<z.ZodString>;
     signingKeyEncryptionKey: z.ZodString;
     adminCorsOrigins: z.ZodDefault<z.ZodArray<z.ZodString>>;

package/dist/middleware/tenant-invite-auth.d.ts

@@ -0,0 +1,81 @@
+/**
+ * Tenant-scoped invitation authentication.
+ *
+ * The tenant invitation route accepts two caller types:
+ *
+ *   - A confidential client using the OAuth `client_credentials` grant. The
+ *     token must carry the `org:user:invite` scope, the client must be active
+ *     and confidential, and the client must belong to the route organization.
+ *   - A tenant user's access token. The user must be active, belong to the
+ *     route organization, and hold the `org:user:invite` permission in the
+ *     token client's application.
+ *
+ * Control-plane clients and the super-admin organization are rejected. This
+ * route is deliberately separate from `/api/admin/*`; a Porta administrator
+ * uses the existing admin invitation route instead.
+ *
+ * @module middleware/tenant-invite-auth
+ */
+import type { Middleware } from 'koa';
+import { TENANT_INVITE_PERMISSION, TENANT_INVITE_SCOPE } from '../oidc/scopes.js';
+export { TENANT_INVITE_PERMISSION, TENANT_INVITE_SCOPE };
+/** Minimal provider boundary needed to resolve both supported token types. */
+export interface TenantInviteTokenProvider {
+    /** Opaque user access-token model. */
+    readonly AccessToken: {
+        /** Resolve one user access token. */
+        find(token: string): Promise<{
+            readonly accountId?: string;
+            readonly clientId?: string;
+            readonly scopes: ReadonlySet<string>;
+        } | undefined>;
+    };
+    /** Opaque client-credentials token model. */
+    readonly ClientCredentials: {
+        /** Resolve one service access token. */
+        find(token: string): Promise<{
+            readonly clientId?: string;
+            readonly scopes: ReadonlySet<string>;
+        } | undefined>;
+    };
+}
+/** Authenticated tenant invitation actor. */
+export type TenantInviteActor = {
+    /** Tenant service client. */
+    readonly kind: 'service';
+    /** Client identifier used for audit and rate limiting. */
+    readonly clientId: string;
+    /** Application that owns the invite's roles and claims. */
+    readonly applicationId: string;
+    /** Route organization. */
+    readonly organizationId: string;
+    /** Safe display name used in the invitation email. */
+    readonly displayName: string;
+} | {
+    /** Tenant user. */
+    readonly kind: 'user';
+    /** User identifier used for audit and rate limiting. */
+    readonly userId: string;
+    /** Application that owns the invite's roles and claims. */
+    readonly applicationId: string;
+    /** Route organization. */
+    readonly organizationId: string;
+    /** Safe display name used in the invitation email. */
+    readonly displayName: string;
+    /** Live permissions used to enforce the delegation ceiling. */
+    readonly permissions: ReadonlySet<string>;
+};
+declare module 'koa' {
+    interface DefaultState {
+        /** Set by requireTenantInviteAuth after a successful caller check. */
+        tenantInviteActor?: TenantInviteActor;
+    }
+}
+/**
+ * Create middleware that authenticates a tenant invitation caller.
+ *
+ * @param provider - OIDC provider token models, or undefined to fail closed
+ * @returns Koa middleware that sets `ctx.state.tenantInviteActor`
+ */
+export declare function requireTenantInviteAuth(provider?: TenantInviteTokenProvider): Middleware;
+//# sourceMappingURL=tenant-invite-auth.d.ts.map

package/dist/middleware/tenant-invite-auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tenant-invite-auth.d.ts","sourceRoot":"","sources":["../../src/middleware/tenant-invite-auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,KAAK,CAAC;AAItC,OAAO,EAAE,wBAAwB,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAUlF,OAAO,EAAE,wBAAwB,EAAE,mBAAmB,EAAE,CAAC;AAEzD,8EAA8E;AAC9E,MAAM,WAAW,yBAAyB;IACxC,sCAAsC;IACtC,QAAQ,CAAC,WAAW,EAAE;QACpB,qCAAqC;QACrC,IAAI,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CACxB;YACE,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;YAC5B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;YAC3B,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;SACtC,GACD,SAAS,CACZ,CAAC;KACH,CAAC;IACF,6CAA6C;IAC7C,QAAQ,CAAC,iBAAiB,EAAE;QAC1B,wCAAwC;QACxC,IAAI,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CACxB;YACE,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;YAC3B,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;SACtC,GACD,SAAS,CACZ,CAAC;KACH,CAAC;CACH;AAED,6CAA6C;AAC7C,MAAM,MAAM,iBAAiB,GACzB;IACE,6BAA6B;IAC7B,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IACzB,0DAA0D;IAC1D,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,2DAA2D;IAC3D,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,0BAA0B;IAC1B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,sDAAsD;IACtD,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B,GACD;IACE,mBAAmB;IACnB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,wDAAwD;IACxD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,2DAA2D;IAC3D,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,0BAA0B;IAC1B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,sDAAsD;IACtD,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,+DAA+D;IAC/D,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;CAC3C,CAAC;AAMN,OAAO,QAAQ,KAAK,CAAC;IACnB,UAAU,YAAY;QACpB,sEAAsE;QACtE,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;KACvC;CACF;AA4LD;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,QAAQ,CAAC,EAAE,yBAAyB,GAAG,UAAU,CAuGxF"}

package/dist/middleware/tenant-invite-auth.js

@@ -0,0 +1,280 @@
+/**
+ * Tenant-scoped invitation authentication.
+ *
+ * The tenant invitation route accepts two caller types:
+ *
+ *   - A confidential client using the OAuth `client_credentials` grant. The
+ *     token must carry the `org:user:invite` scope, the client must be active
+ *     and confidential, and the client must belong to the route organization.
+ *   - A tenant user's access token. The user must be active, belong to the
+ *     route organization, and hold the `org:user:invite` permission in the
+ *     token client's application.
+ *
+ * Control-plane clients and the super-admin organization are rejected. This
+ * route is deliberately separate from `/api/admin/*`; a Porta administrator
+ * uses the existing admin invitation route instead.
+ *
+ * @module middleware/tenant-invite-auth
+ */
+import { getApplicationBySlug } from '../applications/service.js';
+import { getClientByClientId } from '../clients/service.js';
+import { logger } from '../lib/logger.js';
+import { TENANT_INVITE_PERMISSION, TENANT_INVITE_SCOPE } from '../oidc/scopes.js';
+import { findSuperAdminOrganization } from '../organizations/repository.js';
+import { buildPermissionClaims } from '../rbac/user-role-service.js';
+import { recordSecurityDecision, recordSecurityReference } from '../security/decision-context.js';
+import { findUserForOidc } from '../users/service.js';
+// ---------------------------------------------------------------------------
+// Public constants and contracts
+// ---------------------------------------------------------------------------
+export { TENANT_INVITE_PERMISSION, TENANT_INVITE_SCOPE };
+// ---------------------------------------------------------------------------
+// Internal helpers
+// ---------------------------------------------------------------------------
+/** Return the authenticated permission set when the scope is granted. */
+function hasInviteScope(scopes) {
+    return scopes?.has(TENANT_INVITE_SCOPE) === true;
+}
+/** Build a safe display name from optional profile fields. */
+function displayName(givenName, familyName, fallback) {
+    const name = [givenName, familyName].filter((part) => Boolean(part)).join(' ');
+    return name.length > 0 ? name : fallback;
+}
+/** Resolve the canonical control-plane application or fail closed. */
+async function loadAdminApplicationId() {
+    const application = await getApplicationBySlug('porta-admin');
+    return application?.id ?? null;
+}
+/** Resolve the control-plane organization or fail closed. */
+async function loadSuperAdminOrganizationId() {
+    const organization = await findSuperAdminOrganization();
+    return organization?.id ?? null;
+}
+/**
+ * Reject the super-admin organization and the canonical admin application.
+ *
+ * @returns A fixed denial status when the route is not a tenant surface.
+ */
+async function isTenantBoundary(organizationId, applicationId) {
+    const [adminApplicationId, superAdminOrganizationId] = await Promise.all([
+        loadAdminApplicationId(),
+        loadSuperAdminOrganizationId(),
+    ]);
+    if (!adminApplicationId || !superAdminOrganizationId)
+        return false;
+    return applicationId !== adminApplicationId && organizationId !== superAdminOrganizationId;
+}
+/**
+ * Authorize a client-credentials token.
+ *
+ * @returns The service actor, or undefined after writing a denial response.
+ */
+async function authorizeService(ctx, organizationId, token) {
+    if (!token.clientId || !hasInviteScope(token.scopes)) {
+        recordSecurityDecision(ctx, {
+            decisionPoint: 'permission',
+            reasonCode: 'permission-required',
+            outcome: 'deny',
+        });
+        ctx.status = 403;
+        ctx.body = { error: 'Forbidden', message: 'The requested operation is not permitted' };
+        return undefined;
+    }
+    const client = await getClientByClientId(token.clientId);
+    if (!client ||
+        client.status !== 'active' ||
+        client.clientType !== 'confidential' ||
+        client.organizationId !== organizationId ||
+        !client.scope.split(' ').includes(TENANT_INVITE_SCOPE)) {
+        recordSecurityDecision(ctx, {
+            decisionPoint: 'membership',
+            reasonCode: 'membership-required',
+            outcome: 'deny',
+        });
+        ctx.status = 403;
+        ctx.body = { error: 'Forbidden', message: 'The requested operation is not permitted' };
+        return undefined;
+    }
+    if (!(await isTenantBoundary(organizationId, client.applicationId))) {
+        recordSecurityDecision(ctx, {
+            decisionPoint: 'membership',
+            reasonCode: 'membership-required',
+            outcome: 'deny',
+        });
+        ctx.status = 403;
+        ctx.body = { error: 'Forbidden', message: 'The requested operation is not permitted' };
+        return undefined;
+    }
+    return {
+        kind: 'service',
+        clientId: client.clientId,
+        applicationId: client.applicationId,
+        organizationId,
+        displayName: client.clientName,
+    };
+}
+/**
+ * Authorize a user access token.
+ *
+ * @returns The user actor, or undefined after writing a denial response.
+ */
+async function authorizeUser(ctx, organizationId, token) {
+    if (!token.accountId || !token.clientId) {
+        recordSecurityDecision(ctx, {
+            decisionPoint: 'authentication',
+            reasonCode: 'authentication-required',
+            outcome: 'deny',
+        });
+        ctx.status = 401;
+        ctx.body = { error: 'Invalid token', message: 'Token validation failed' };
+        return undefined;
+    }
+    const client = await getClientByClientId(token.clientId);
+    if (!client || client.status !== 'active' || client.organizationId !== organizationId) {
+        recordSecurityDecision(ctx, {
+            decisionPoint: 'membership',
+            reasonCode: 'membership-required',
+            outcome: 'deny',
+        });
+        ctx.status = 403;
+        ctx.body = { error: 'Forbidden', message: 'The requested operation is not permitted' };
+        return undefined;
+    }
+    if (!(await isTenantBoundary(organizationId, client.applicationId))) {
+        recordSecurityDecision(ctx, {
+            decisionPoint: 'membership',
+            reasonCode: 'membership-required',
+            outcome: 'deny',
+        });
+        ctx.status = 403;
+        ctx.body = { error: 'Forbidden', message: 'The requested operation is not permitted' };
+        return undefined;
+    }
+    const user = await findUserForOidc(token.accountId);
+    if (!user || user.organizationId !== organizationId) {
+        recordSecurityDecision(ctx, {
+            decisionPoint: 'membership',
+            reasonCode: 'membership-required',
+            outcome: 'deny',
+        });
+        ctx.status = 403;
+        ctx.body = { error: 'Forbidden', message: 'The requested operation is not permitted' };
+        return undefined;
+    }
+    const permissions = await buildPermissionClaims(user.id, client.applicationId);
+    if (!permissions.includes(TENANT_INVITE_PERMISSION)) {
+        recordSecurityDecision(ctx, {
+            decisionPoint: 'permission',
+            reasonCode: 'permission-required',
+            outcome: 'deny',
+        });
+        ctx.status = 403;
+        ctx.body = { error: 'Forbidden', message: 'The requested operation is not permitted' };
+        return undefined;
+    }
+    return {
+        kind: 'user',
+        userId: user.id,
+        applicationId: client.applicationId,
+        organizationId,
+        displayName: displayName(user.givenName, user.familyName, user.email),
+        permissions: new Set(permissions),
+    };
+}
+// ---------------------------------------------------------------------------
+// Middleware factory
+// ---------------------------------------------------------------------------
+/**
+ * Create middleware that authenticates a tenant invitation caller.
+ *
+ * @param provider - OIDC provider token models, or undefined to fail closed
+ * @returns Koa middleware that sets `ctx.state.tenantInviteActor`
+ */
+export function requireTenantInviteAuth(provider) {
+    return async function tenantInviteAuthMiddleware(ctx, next) {
+        if (!provider) {
+            logger.error('Tenant invite auth: OIDC provider not initialized');
+            recordSecurityDecision(ctx, {
+                decisionPoint: 'handler',
+                reasonCode: 'handler-failed',
+                outcome: 'error',
+            });
+            ctx.status = 500;
+            ctx.body = { error: 'Server configuration error' };
+            return;
+        }
+        const organizationId = ctx.params.orgId;
+        if (typeof organizationId !== 'string' || organizationId.length === 0) {
+            recordSecurityDecision(ctx, {
+                decisionPoint: 'resource',
+                reasonCode: 'resource-not-found',
+                outcome: 'deny',
+            });
+            ctx.status = 404;
+            ctx.body = { error: 'Organization not found' };
+            return;
+        }
+        const authHeader = ctx.get('Authorization');
+        if (!authHeader.startsWith('Bearer ')) {
+            recordSecurityDecision(ctx, {
+                decisionPoint: 'authentication',
+                reasonCode: 'authentication-required',
+                outcome: 'deny',
+            });
+            ctx.status = 401;
+            ctx.body = {
+                error: 'Authentication required',
+                message: 'Missing or invalid Authorization header',
+            };
+            return;
+        }
+        const token = authHeader.slice(7);
+        if (token.length === 0) {
+            ctx.status = 401;
+            ctx.body = { error: 'Invalid token', message: 'Token validation failed' };
+            return;
+        }
+        let serviceToken;
+        try {
+            serviceToken = await provider.ClientCredentials.find(token);
+        }
+        catch {
+            logger.debug({ event: 'tenant-invite-service-token-unavailable' }, 'Tenant invite service token lookup failed');
+        }
+        if (serviceToken) {
+            const actor = await authorizeService(ctx, organizationId, serviceToken);
+            if (!actor)
+                return;
+            recordSecurityReference(ctx, 'actor', actor.clientId);
+            recordSecurityReference(ctx, 'tenant', organizationId);
+            ctx.state.tenantInviteActor = actor;
+            await next();
+            return;
+        }
+        let userToken;
+        try {
+            userToken = await provider.AccessToken.find(token);
+        }
+        catch {
+            logger.debug({ event: 'tenant-invite-user-token-unavailable' }, 'Tenant invite user token lookup failed');
+        }
+        if (userToken) {
+            const actor = await authorizeUser(ctx, organizationId, userToken);
+            if (!actor)
+                return;
+            recordSecurityReference(ctx, 'actor', actor.userId);
+            recordSecurityReference(ctx, 'tenant', organizationId);
+            ctx.state.tenantInviteActor = actor;
+            await next();
+            return;
+        }
+        recordSecurityDecision(ctx, {
+            decisionPoint: 'authentication',
+            reasonCode: 'authentication-required',
+            outcome: 'deny',
+        });
+        ctx.status = 401;
+        ctx.body = { error: 'Invalid token', message: 'Token validation failed' };
+    };
+}
+//# sourceMappingURL=tenant-invite-auth.js.map

package/dist/middleware/tenant-invite-auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tenant-invite-auth.js","sourceRoot":"","sources":["../../src/middleware/tenant-invite-auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAGH,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAClE,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC1C,OAAO,EAAE,wBAAwB,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAClF,OAAO,EAAE,0BAA0B,EAAE,MAAM,gCAAgC,CAAC;AAC5E,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,EAAE,sBAAsB,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAClG,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAEtD,8EAA8E;AAC9E,iCAAiC;AACjC,8EAA8E;AAE9E,OAAO,EAAE,wBAAwB,EAAE,mBAAmB,EAAE,CAAC;AAqEzD,8EAA8E;AAC9E,mBAAmB;AACnB,8EAA8E;AAE9E,yEAAyE;AACzE,SAAS,cAAc,CAAC,MAAuC;IAC7D,OAAO,MAAM,EAAE,GAAG,CAAC,mBAAmB,CAAC,KAAK,IAAI,CAAC;AACnD,CAAC;AAED,8DAA8D;AAC9D,SAAS,WAAW,CAClB,SAAoC,EACpC,UAAqC,EACrC,QAAgB;IAEhB,MAAM,IAAI,GAAG,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAkB,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC/F,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC;AAC3C,CAAC;AAED,sEAAsE;AACtE,KAAK,UAAU,sBAAsB;IACnC,MAAM,WAAW,GAAG,MAAM,oBAAoB,CAAC,aAAa,CAAC,CAAC;IAC9D,OAAO,WAAW,EAAE,EAAE,IAAI,IAAI,CAAC;AACjC,CAAC;AAED,6DAA6D;AAC7D,KAAK,UAAU,4BAA4B;IACzC,MAAM,YAAY,GAAG,MAAM,0BAA0B,EAAE,CAAC;IACxD,OAAO,YAAY,EAAE,EAAE,IAAI,IAAI,CAAC;AAClC,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,gBAAgB,CAAC,cAAsB,EAAE,aAAqB;IAC3E,MAAM,CAAC,kBAAkB,EAAE,wBAAwB,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACvE,sBAAsB,EAAE;QACxB,4BAA4B,EAAE;KAC/B,CAAC,CAAC;IACH,IAAI,CAAC,kBAAkB,IAAI,CAAC,wBAAwB;QAAE,OAAO,KAAK,CAAC;IACnE,OAAO,aAAa,KAAK,kBAAkB,IAAI,cAAc,KAAK,wBAAwB,CAAC;AAC7F,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,gBAAgB,CAC7B,GAA8B,EAC9B,cAAsB,EACtB,KAA2E;IAE3E,IAAI,CAAC,KAAK,CAAC,QAAQ,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;QACrD,sBAAsB,CAAC,GAAG,EAAE;YAC1B,aAAa,EAAE,YAAY;YAC3B,UAAU,EAAE,qBAAqB;YACjC,OAAO,EAAE,MAAM;SAChB,CAAC,CAAC;QACH,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;QACjB,GAAG,CAAC,IAAI,GAAG,EAAE,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,0CAA0C,EAAE,CAAC;QACvF,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACzD,IACE,CAAC,MAAM;QACP,MAAM,CAAC,MAAM,KAAK,QAAQ;QAC1B,MAAM,CAAC,UAAU,KAAK,cAAc;QACpC,MAAM,CAAC,cAAc,KAAK,cAAc;QACxC,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,mBAAmB,CAAC,EACtD,CAAC;QACD,sBAAsB,CAAC,GAAG,EAAE;YAC1B,aAAa,EAAE,YAAY;YAC3B,UAAU,EAAE,qBAAqB;YACjC,OAAO,EAAE,MAAM;SAChB,CAAC,CAAC;QACH,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;QACjB,GAAG,CAAC,IAAI,GAAG,EAAE,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,0CAA0C,EAAE,CAAC;QACvF,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,IAAI,CAAC,CAAC,MAAM,gBAAgB,CAAC,cAAc,EAAE,MAAM,CAAC,aAAa,CAAC,CAAC,EAAE,CAAC;QACpE,sBAAsB,CAAC,GAAG,EAAE;YAC1B,aAAa,EAAE,YAAY;YAC3B,UAAU,EAAE,qBAAqB;YACjC,OAAO,EAAE,MAAM;SAChB,CAAC,CAAC;QACH,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;QACjB,GAAG,CAAC,IAAI,GAAG,EAAE,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,0CAA0C,EAAE,CAAC;QACvF,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,OAAO;QACL,IAAI,EAAE,SAAS;QACf,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,aAAa,EAAE,MAAM,CAAC,aAAa;QACnC,cAAc;QACd,WAAW,EAAE,MAAM,CAAC,UAAU;KAC/B,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,aAAa,CAC1B,GAA8B,EAC9B,cAAsB,EACtB,KAAkE;IAElE,IAAI,CAAC,KAAK,CAAC,SAAS,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC;QACxC,sBAAsB,CAAC,GAAG,EAAE;YAC1B,aAAa,EAAE,gBAAgB;YAC/B,UAAU,EAAE,yBAAyB;YACrC,OAAO,EAAE,MAAM;SAChB,CAAC,CAAC;QACH,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;QACjB,GAAG,CAAC,IAAI,GAAG,EAAE,KAAK,EAAE,eAAe,EAAE,OAAO,EAAE,yBAAyB,EAAE,CAAC;QAC1E,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACzD,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,cAAc,KAAK,cAAc,EAAE,CAAC;QACtF,sBAAsB,CAAC,GAAG,EAAE;YAC1B,aAAa,EAAE,YAAY;YAC3B,UAAU,EAAE,qBAAqB;YACjC,OAAO,EAAE,MAAM;SAChB,CAAC,CAAC;QACH,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;QACjB,GAAG,CAAC,IAAI,GAAG,EAAE,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,0CAA0C,EAAE,CAAC;QACvF,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,IAAI,CAAC,CAAC,MAAM,gBAAgB,CAAC,cAAc,EAAE,MAAM,CAAC,aAAa,CAAC,CAAC,EAAE,CAAC;QACpE,sBAAsB,CAAC,GAAG,EAAE;YAC1B,aAAa,EAAE,YAAY;YAC3B,UAAU,EAAE,qBAAqB;YACjC,OAAO,EAAE,MAAM;SAChB,CAAC,CAAC;QACH,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;QACjB,GAAG,CAAC,IAAI,GAAG,EAAE,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,0CAA0C,EAAE,CAAC;QACvF,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IACpD,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,cAAc,KAAK,cAAc,EAAE,CAAC;QACpD,sBAAsB,CAAC,GAAG,EAAE;YAC1B,aAAa,EAAE,YAAY;YAC3B,UAAU,EAAE,qBAAqB;YACjC,OAAO,EAAE,MAAM;SAChB,CAAC,CAAC;QACH,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;QACjB,GAAG,CAAC,IAAI,GAAG,EAAE,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,0CAA0C,EAAE,CAAC;QACvF,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,WAAW,GAAG,MAAM,qBAAqB,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,CAAC,aAAa,CAAC,CAAC;IAC/E,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,wBAAwB,CAAC,EAAE,CAAC;QACpD,sBAAsB,CAAC,GAAG,EAAE;YAC1B,aAAa,EAAE,YAAY;YAC3B,UAAU,EAAE,qBAAqB;YACjC,OAAO,EAAE,MAAM;SAChB,CAAC,CAAC;QACH,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;QACjB,GAAG,CAAC,IAAI,GAAG,EAAE,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,0CAA0C,EAAE,CAAC;QACvF,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,OAAO;QACL,IAAI,EAAE,MAAM;QACZ,MAAM,EAAE,IAAI,CAAC,EAAE;QACf,aAAa,EAAE,MAAM,CAAC,aAAa;QACnC,cAAc;QACd,WAAW,EAAE,WAAW,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC;QACrE,WAAW,EAAE,IAAI,GAAG,CAAC,WAAW,CAAC;KAClC,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,qBAAqB;AACrB,8EAA8E;AAE9E;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CAAC,QAAoC;IAC1E,OAAO,KAAK,UAAU,0BAA0B,CAAC,GAAG,EAAE,IAAI;QACxD,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,CAAC,KAAK,CAAC,mDAAmD,CAAC,CAAC;YAClE,sBAAsB,CAAC,GAAG,EAAE;gBAC1B,aAAa,EAAE,SAAS;gBACxB,UAAU,EAAE,gBAAgB;gBAC5B,OAAO,EAAE,OAAO;aACjB,CAAC,CAAC;YACH,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;YACjB,GAAG,CAAC,IAAI,GAAG,EAAE,KAAK,EAAE,4BAA4B,EAAE,CAAC;YACnD,OAAO;QACT,CAAC;QAED,MAAM,cAAc,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC;QACxC,IAAI,OAAO,cAAc,KAAK,QAAQ,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtE,sBAAsB,CAAC,GAAG,EAAE;gBAC1B,aAAa,EAAE,UAAU;gBACzB,UAAU,EAAE,oBAAoB;gBAChC,OAAO,EAAE,MAAM;aAChB,CAAC,CAAC;YACH,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;YACjB,GAAG,CAAC,IAAI,GAAG,EAAE,KAAK,EAAE,wBAAwB,EAAE,CAAC;YAC/C,OAAO;QACT,CAAC;QAED,MAAM,UAAU,GAAG,GAAG,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;QAC5C,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YACtC,sBAAsB,CAAC,GAAG,EAAE;gBAC1B,aAAa,EAAE,gBAAgB;gBAC/B,UAAU,EAAE,yBAAyB;gBACrC,OAAO,EAAE,MAAM;aAChB,CAAC,CAAC;YACH,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;YACjB,GAAG,CAAC,IAAI,GAAG;gBACT,KAAK,EAAE,yBAAyB;gBAChC,OAAO,EAAE,yCAAyC;aACnD,CAAC;YACF,OAAO;QACT,CAAC;QAED,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAClC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;YACjB,GAAG,CAAC,IAAI,GAAG,EAAE,KAAK,EAAE,eAAe,EAAE,OAAO,EAAE,yBAAyB,EAAE,CAAC;YAC1E,OAAO;QACT,CAAC;QAED,IAAI,YAC8E,CAAC;QACnF,IAAI,CAAC;YACH,YAAY,GAAG,MAAM,QAAQ,CAAC,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC9D,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,CAAC,KAAK,CACV,EAAE,KAAK,EAAE,yCAAyC,EAAE,EACpD,2CAA2C,CAC5C,CAAC;QACJ,CAAC;QAED,IAAI,YAAY,EAAE,CAAC;YACjB,MAAM,KAAK,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,cAAc,EAAE,YAAY,CAAC,CAAC;YACxE,IAAI,CAAC,KAAK;gBAAE,OAAO;YACnB,uBAAuB,CAAC,GAAG,EAAE,OAAO,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;YACtD,uBAAuB,CAAC,GAAG,EAAE,QAAQ,EAAE,cAAc,CAAC,CAAC;YACvD,GAAG,CAAC,KAAK,CAAC,iBAAiB,GAAG,KAAK,CAAC;YACpC,MAAM,IAAI,EAAE,CAAC;YACb,OAAO;QACT,CAAC;QAED,IAAI,SAMS,CAAC;QACd,IAAI,CAAC;YACH,SAAS,GAAG,MAAM,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrD,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,CAAC,KAAK,CACV,EAAE,KAAK,EAAE,sCAAsC,EAAE,EACjD,wCAAwC,CACzC,CAAC;QACJ,CAAC;QAED,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE,cAAc,EAAE,SAAS,CAAC,CAAC;YAClE,IAAI,CAAC,KAAK;gBAAE,OAAO;YACnB,uBAAuB,CAAC,GAAG,EAAE,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;YACpD,uBAAuB,CAAC,GAAG,EAAE,QAAQ,EAAE,cAAc,CAAC,CAAC;YACvD,GAAG,CAAC,KAAK,CAAC,iBAAiB,GAAG,KAAK,CAAC;YACpC,MAAM,IAAI,EAAE,CAAC;YACb,OAAO;QACT,CAAC;QAED,sBAAsB,CAAC,GAAG,EAAE;YAC1B,aAAa,EAAE,gBAAgB;YAC/B,UAAU,EAAE,yBAAyB;YACrC,OAAO,EAAE,MAAM;SAChB,CAAC,CAAC;QACH,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;QACjB,GAAG,CAAC,IAAI,GAAG,EAAE,KAAK,EAAE,eAAe,EAAE,OAAO,EAAE,yBAAyB,EAAE,CAAC;IAC5E,CAAC,CAAC;AACJ,CAAC"}

package/dist/middleware/tenant-invite-rate-limiter.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Tenant invitation rate limiter.
+ *
+ * Sits after tenant invitation authentication so the counter can be keyed by
+ * the authenticated user or service client instead of a shared IP address.
+ * The limit is intentionally small because invitations send email and create
+ * durable invitation records.
+ *
+ * @module middleware/tenant-invite-rate-limiter
+ */
+import type { Middleware } from 'koa';
+import type { RateLimitConfig } from '../auth/rate-limiter.js';
+/** Invitation limit per actor and organization. */
+export declare const TENANT_INVITE_RATE_LIMIT: RateLimitConfig;
+/**
+ * Create the tenant invitation rate limiter.
+ *
+ * @returns Koa middleware that limits authenticated invitation requests
+ */
+export declare function tenantInviteRateLimiter(): Middleware;
+//# sourceMappingURL=tenant-invite-rate-limiter.d.ts.map

package/dist/middleware/tenant-invite-rate-limiter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tenant-invite-rate-limiter.d.ts","sourceRoot":"","sources":["../../src/middleware/tenant-invite-rate-limiter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,KAAK,CAAC;AAEtC,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAG/D,mDAAmD;AACnD,eAAO,MAAM,wBAAwB,EAAE,eAGtC,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,uBAAuB,IAAI,UAAU,CAkCpD"}

package/dist/middleware/tenant-invite-rate-limiter.js

@@ -0,0 +1,51 @@
+/**
+ * Tenant invitation rate limiter.
+ *
+ * Sits after tenant invitation authentication so the counter can be keyed by
+ * the authenticated user or service client instead of a shared IP address.
+ * The limit is intentionally small because invitations send email and create
+ * durable invitation records.
+ *
+ * @module middleware/tenant-invite-rate-limiter
+ */
+import { checkRateLimit } from '../auth/rate-limiter.js';
+import { logger } from '../lib/logger.js';
+/** Invitation limit per actor and organization. */
+export const TENANT_INVITE_RATE_LIMIT = {
+    max: 30,
+    windowSeconds: 3600,
+};
+/**
+ * Create the tenant invitation rate limiter.
+ *
+ * @returns Koa middleware that limits authenticated invitation requests
+ */
+export function tenantInviteRateLimiter() {
+    return async function tenantInviteRateLimiterMiddleware(ctx, next) {
+        const actor = ctx.state.tenantInviteActor;
+        if (!actor)
+            return next();
+        const key = actor.kind === 'user'
+            ? `ratelimit:tenant-invite:user:${actor.organizationId}:${actor.userId}`
+            : `ratelimit:tenant-invite:client:${actor.organizationId}:${actor.clientId}`;
+        const result = await checkRateLimit(key, TENANT_INVITE_RATE_LIMIT);
+        ctx.set('X-RateLimit-Limit', String(TENANT_INVITE_RATE_LIMIT.max));
+        ctx.set('X-RateLimit-Remaining', String(result.remaining));
+        if (!result.allowed) {
+            logger.warn({
+                action: 'tenant_invite_rate_limit_exceeded',
+                actorKind: actor.kind,
+            }, 'Tenant invitation rate limit exceeded');
+            ctx.status = 429;
+            ctx.set('Retry-After', String(result.retryAfter));
+            ctx.body = {
+                error: 'Too Many Requests',
+                message: 'Invitation rate limit exceeded. Please try again later.',
+                retry_after: result.retryAfter,
+            };
+            return;
+        }
+        return next();
+    };
+}
+//# sourceMappingURL=tenant-invite-rate-limiter.js.map

package/dist/middleware/tenant-invite-rate-limiter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tenant-invite-rate-limiter.js","sourceRoot":"","sources":["../../src/middleware/tenant-invite-rate-limiter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAGH,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAEzD,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAE1C,mDAAmD;AACnD,MAAM,CAAC,MAAM,wBAAwB,GAAoB;IACvD,GAAG,EAAE,EAAE;IACP,aAAa,EAAE,IAAI;CACpB,CAAC;AAEF;;;;GAIG;AACH,MAAM,UAAU,uBAAuB;IACrC,OAAO,KAAK,UAAU,iCAAiC,CAAC,GAAG,EAAE,IAAI;QAC/D,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,iBAAiB,CAAC;QAC1C,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,EAAE,CAAC;QAE1B,MAAM,GAAG,GACP,KAAK,CAAC,IAAI,KAAK,MAAM;YACnB,CAAC,CAAC,gCAAgC,KAAK,CAAC,cAAc,IAAI,KAAK,CAAC,MAAM,EAAE;YACxE,CAAC,CAAC,kCAAkC,KAAK,CAAC,cAAc,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;QAEjF,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,GAAG,EAAE,wBAAwB,CAAC,CAAC;QACnE,GAAG,CAAC,GAAG,CAAC,mBAAmB,EAAE,MAAM,CAAC,wBAAwB,CAAC,GAAG,CAAC,CAAC,CAAC;QACnE,GAAG,CAAC,GAAG,CAAC,uBAAuB,EAAE,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;QAE3D,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,MAAM,CAAC,IAAI,CACT;gBACE,MAAM,EAAE,mCAAmC;gBAC3C,SAAS,EAAE,KAAK,CAAC,IAAI;aACtB,EACD,uCAAuC,CACxC,CAAC;YACF,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;YACjB,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC;YAClD,GAAG,CAAC,IAAI,GAAG;gBACT,KAAK,EAAE,mBAAmB;gBAC1B,OAAO,EAAE,yDAAyD;gBAClE,WAAW,EAAE,MAAM,CAAC,UAAU;aAC/B,CAAC;YACF,OAAO;QACT,CAAC;QAED,OAAO,IAAI,EAAE,CAAC;IAChB,CAAC,CAAC;AACJ,CAAC"}

package/dist/oidc/configuration.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"configuration.d.ts","sourceRoot":"","sources":["../../src/oidc/configuration.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAC7D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAIzD,OAAO,EAGL,KAAK,iBAAiB,EACvB,MAAM,+BAA+B,CAAC;AAKvC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAG9D,8DAA8D;AAC9D,MAAM,WAAW,yBAAyB;IACxC,8DAA8D;IAC9D,GAAG,EAAE,aAAa,CAAC;IACnB,iDAAiD;IACjD,IAAI,EAAE;QAAE,IAAI,EAAE,UAAU,EAAE,CAAA;KAAE,CAAC;IAC7B,sEAAsE;IACtE,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,6DAA6D;IAC7D,WAAW,EAAE,CACX,GAAG,EAAE,OAAO,EACZ,GAAG,EAAE,MAAM,KACR,OAAO,CACR;QACE,SAAS,EAAE,MAAM,CAAC;QAClB,MAAM,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;KAC1E,GACD,SAAS,CACZ,CAAC;IACF,yEAAyE;IACzE,cAAc,EAAE,OAAO,CAAC;IACxB,sFAAsF;IACtF,cAAc,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,WAAW,EAAE;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,KAAK,MAAM,CAAC;IACvE,qEAAqE;IACrE,eAAe,CAAC,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,KAAK,OAAO,CAAC;CAC9E;AAMD;;;;;GAKG;AACH,wBAAgB,oBAAoB,IAAI,iBAAiB,CASxD;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,yBAAyB,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC,CA8B/F;AAMD;;;;;;;;;;;;;GAaG;AAEH,wBAAsB,gBAAgB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAoD5E;AAED;;;;;;;;;;;GAWG;AAEH,wBAAsB,2BAA2B,CAAC,GAAG,EAAE,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,CA0BzE;AAoDD;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,eAAe,CAEnC,GAAG,EAAE,GAAG,EACR,GAAG,EAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,iBAAiB,CAAC,EAAE,MAAM,CAAA;CAAE,EAClD,MAAM,EAAE,KAAK,GACZ,OAAO,CAAC,IAAI,CAAC,CAwDf;AAMD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAsB,iBAAiB,CAErC,GAAG,EAAE,GAAG,GACP,OAAO,CAAC,OAAO,GAAG,SAAS,CAAC,CA6B9B;AAMD;;;;;;;;;GASG;AACH,wBAAgB,0BAA0B,CACxC,MAAM,EAAE,yBAAyB,GAChC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CA0MzB"}
+{"version":3,"file":"configuration.d.ts","sourceRoot":"","sources":["../../src/oidc/configuration.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAC7D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAIzD,OAAO,EAGL,KAAK,iBAAiB,EACvB,MAAM,+BAA+B,CAAC;AAKvC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAI9D,8DAA8D;AAC9D,MAAM,WAAW,yBAAyB;IACxC,8DAA8D;IAC9D,GAAG,EAAE,aAAa,CAAC;IACnB,iDAAiD;IACjD,IAAI,EAAE;QAAE,IAAI,EAAE,UAAU,EAAE,CAAA;KAAE,CAAC;IAC7B,sEAAsE;IACtE,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,6DAA6D;IAC7D,WAAW,EAAE,CACX,GAAG,EAAE,OAAO,EACZ,GAAG,EAAE,MAAM,KACR,OAAO,CACR;QACE,SAAS,EAAE,MAAM,CAAC;QAClB,MAAM,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;KAC1E,GACD,SAAS,CACZ,CAAC;IACF,yEAAyE;IACzE,cAAc,EAAE,OAAO,CAAC;IACxB,sFAAsF;IACtF,cAAc,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,WAAW,EAAE;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,KAAK,MAAM,CAAC;IACvE,qEAAqE;IACrE,eAAe,CAAC,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,KAAK,OAAO,CAAC;CAC9E;AAMD;;;;;GAKG;AACH,wBAAgB,oBAAoB,IAAI,iBAAiB,CASxD;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,yBAAyB,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC,CA8B/F;AAMD;;;;;;;;;;;;;GAaG;AAEH,wBAAsB,gBAAgB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAoD5E;AAED;;;;;;;;;;;GAWG;AAEH,wBAAsB,2BAA2B,CAAC,GAAG,EAAE,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,CA0BzE;AAoDD;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,eAAe,CAEnC,GAAG,EAAE,GAAG,EACR,GAAG,EAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,iBAAiB,CAAC,EAAE,MAAM,CAAA;CAAE,EAClD,MAAM,EAAE,KAAK,GACZ,OAAO,CAAC,IAAI,CAAC,CAwDf;AAMD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAsB,iBAAiB,CAErC,GAAG,EAAE,GAAG,GACP,OAAO,CAAC,OAAO,GAAG,SAAS,CAAC,CA6B9B;AAMD;;;;;;;;;GASG;AACH,wBAAgB,0BAA0B,CACxC,MAAM,EAAE,yBAAyB,GAChC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAoNzB"}

package/dist/oidc/configuration.js

@@ -24,6 +24,7 @@ import { logger } from '../lib/logger.js';
 import { getUserById } from '../users/service.js';
 import { getOrganizationById } from '../organizations/service.js';
 import { clearSessionCookies } from '../middleware/prompt-login-reset.js';
+import { TENANT_INVITE_SCOPE } from './scopes.js';
 // ---------------------------------------------------------------------------
 // Rendering hook helpers
 // ---------------------------------------------------------------------------
@@ -448,8 +449,18 @@ export function buildProviderConfiguration(params) {
         },
         // Enable refresh token rotation — each refresh generates a new token
         rotateRefreshToken: true,
-        // Standard OIDC scopes
-        scopes: ['openid', 'profile', 'email', 'address', 'phone', 'offline_access'],
+        // Standard OIDC scopes plus the tenant application scope used by the
+        // tenant-scoped BFF invitation API. Supported scopes must be registered
+        // here before a client may carry them in its metadata.
+        scopes: [
+            'openid',
+            'profile',
+            'email',
+            'address',
+            'phone',
+            'offline_access',
+            TENANT_INVITE_SCOPE,
+        ],
         // OIDC claims mapping per scope.
         // Standard claims follow OpenID Connect Core §5.4.
         // Custom claims (roles, permissions, ERP attributes) are mapped to

package/dist/oidc/configuration.js.map

@@ -1 +1 @@
-{"version":3,"file":"configuration.js","sourceRoot":"","sources":["../../src/oidc/configuration.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAIH,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,mCAAmC,CAAC;AAC3E,OAAO,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAC;AACxD,OAAO,EACL,8BAA8B,EAC9B,wBAAwB,GAEzB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,aAAa,EAAE,sBAAsB,EAAE,MAAM,iBAAiB,CAAC;AACxE,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC1C,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAElE,OAAO,EAAE,mBAAmB,EAAE,MAAM,qCAAqC,CAAC;AA6B1E,8EAA8E;AAC9E,yBAAyB;AACzB,8EAA8E;AAE9E;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB;IAClC,OAAO;QACL,OAAO,EAAE,IAAI;QACb,UAAU,EAAE,IAAI;QAChB,YAAY,EAAE,8BAA8B;QAC5C,WAAW,EAAE,EAAE;QACf,SAAS,EAAE,IAAI;QACf,YAAY,EAAE,EAAE;KACjB,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,GAAY;IAC1D,IAAI,CAAC;QACH,sDAAsD;QACtD,sEAAsE;QACtE,yCAAyC;QACzC,8DAA8D;QAC9D,MAAM,OAAO,GAAG,GAAU,CAAC;QAE3B,2DAA2D;QAC3D,MAAM,SAAS,GAAG,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,SAA+B,CAAC;QAC1E,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,SAAS,CAAC,CAAC;YAC1C,IAAI,IAAI,EAAE,CAAC;gBACT,MAAM,GAAG,GAAG,MAAM,mBAAmB,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;gBAC3D,IAAI,GAAG;oBAAE,OAAO,GAAG,CAAC;YACtB,CAAC;QACH,CAAC;QAED,4DAA4D;QAC5D,MAAM,KAAK,GAAG,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,cAAoC,CAAC;QAC1E,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,GAAG,GAAG,MAAM,mBAAmB,CAAC,KAAK,CAAC,CAAC;YAC7C,IAAI,GAAG;gBAAE,OAAO,GAAG,CAAC;QACtB,CAAC;QAED,OAAO,SAAS,CAAC;IACnB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,EAAE,mDAAmD,CAAC,CAAC;QAC1E,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,2BAA2B;AAC3B,8EAA8E;AAE9E;;;;;;;;;;;;;GAaG;AACH,8DAA8D;AAC9D,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,GAAQ,EAAE,IAAY;IAC3D,IAAI,CAAC;QACH,8DAA8D;QAC9D,MAAM,GAAG,GAAG,MAAM,yBAAyB,CAAC,GAAG,CAAC,CAAC;QACjD,MAAM,QAAQ,GAAG,GAAG,CAAC,CAAC,CAAC,MAAM,wBAAwB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,oBAAoB,EAAE,CAAC;QAEpF,0CAA0C;QAC1C,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,SAAS,EAAE,SAAS,EAAE,GAAG,EAAE,aAAa,IAAI,EAAE,CAAC,CAAC;QACnF,MAAM,CAAC,GAAG,sBAAsB,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;QAEpD,uEAAuE;QACvE,uEAAuE;QACvE,iEAAiE;QACjE,EAAE;QACF,sEAAsE;QACtE,wEAAwE;QACxE,uEAAuE;QACvE,yEAAyE;QACzE,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAC7B,SAAS,EACT,6FAA6F,CAAC,CAAC,gBAAgB,CAAC,kBAAkB,CACnI,CAAC;QAEF,0EAA0E;QAC1E,mFAAmF;QACnF,qFAAqF;QACrF,MAAM,UAAU,GAAG,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,WAAiC,CAAC;QACnF,MAAM,SAAS,GAAG,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,wBAA8C,CAAC;QAEnF,2DAA2D;QAC3D,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,QAAQ,EAAE;YACtC,QAAQ;YACR,MAAM;YACN,CAAC;YACD,SAAS,EAAE,EAAE,EAAE,mDAAmD;YAClE,OAAO,EAAE,GAAG,EAAE,IAAI,IAAI,EAAE;YACxB,UAAU,EAAE,UAAU;YACtB,UAAU,EAAE,UAAU,IAAI,IAAI;YAC9B,SAAS,EAAE,SAAS,IAAI,IAAI;SAC7B,CAAC,CAAC;QAEH,GAAG,CAAC,IAAI,GAAG,WAAW,CAAC;QACvB,GAAG,CAAC,GAAG,CAAC,yBAAyB,EAAE,YAAY,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC;QACxE,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC;IAClB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,0DAA0D;QAC1D,iEAAiE;QACjE,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,qCAAqC,CAAC,CAAC;QAC7D,GAAG,CAAC,IAAI,GAAG,WAAW,CAAC;QACvB,GAAG,CAAC,GAAG,CAAC,yBAAyB,EAAE,QAAQ,CAAC,CAAC;QAC7C,GAAG,CAAC,IAAI,GAAG,8BAA8B,IAAI,yLAAyL,CAAC;IACzO,CAAC;AACH,CAAC;AAED;;;;;;;;;;;GAWG;AACH,8DAA8D;AAC9D,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,GAAQ;IACxD,IAAI,CAAC;QACH,0DAA0D;QAC1D,wDAAwD;QACxD,MAAM,QAAQ,GAAG,oBAAoB,EAAE,CAAC;QACxC,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,SAAS,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;QAC7D,MAAM,CAAC,GAAG,sBAAsB,CAAC,MAAM,CAAC,CAAC;QAEzC,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,gBAAgB,EAAE;YAC9C,QAAQ;YACR,MAAM;YACN,CAAC;YACD,SAAS,EAAE,EAAE;YACb,OAAO,EAAE,EAAE;SACZ,CAAC,CAAC;QAEH,GAAG,CAAC,IAAI,GAAG,WAAW,CAAC;QACvB,GAAG,CAAC,GAAG,CAAC,yBAAyB,EAAE,YAAY,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC;QACxE,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC;IAClB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,0CAA0C,CAAC,CAAC;QAClE,GAAG,CAAC,IAAI,GAAG,WAAW,CAAC;QACvB,GAAG,CAAC,GAAG,CAAC,yBAAyB,EAAE,QAAQ,CAAC,CAAC;QAC7C,GAAG,CAAC,IAAI;YACN,2GAA2G,CAAC;IAChH,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,SAAS,sBAAsB,CAC7B,GAAkD,EAClD,KAAwB;IAExB,IAAI,KAAK,EAAE,IAAI,KAAK,iBAAiB;QAAE,OAAO,IAAI,CAAC;IAEnD,IAAI,GAAG,CAAC,KAAK,KAAK,iBAAiB;QAAE,OAAO,KAAK,CAAC;IAClD,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,iBAAiB,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IACzD,OAAO,CACL,IAAI,CAAC,QAAQ,CAAC,+BAA+B,CAAC;QAC9C,IAAI,CAAC,QAAQ,CAAC,6CAA6C,CAAC;QAC5D,IAAI,CAAC,QAAQ,CAAC,mCAAmC,CAAC;QAClD,IAAI,CAAC,QAAQ,CAAC,sDAAsD,CAAC,CACtE,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,2BAA2B;AAClC,8DAA8D;AAC9D,GAAQ;IAER,MAAM,YAAY,GAAG,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,CAAC;IACrD,MAAM,iBAAiB,GACrB,OAAO,YAAY,KAAK,UAAU;QAChC,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAC;QACjD,CAAC,CAAC,UAAU,CAAC;IACjB,mBAAmB,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC;AAC9C,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe;AACnC,8DAA8D;AAC9D,GAAQ,EACR,GAAkD,EAClD,MAAa;IAEb,IAAI,CAAC;QACH,6DAA6D;QAC7D,MAAM,GAAG,GAAG,MAAM,yBAAyB,CAAC,GAAG,CAAC,CAAC;QACjD,MAAM,QAAQ,GAAG,GAAG,CAAC,CAAC,CAAC,MAAM,wBAAwB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,oBAAoB,EAAE,CAAC;QAEpF,0CAA0C;QAC1C,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,SAAS,EAAE,SAAS,EAAE,GAAG,EAAE,aAAa,IAAI,EAAE,CAAC,CAAC;QACnF,MAAM,CAAC,GAAG,sBAAsB,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;QAEpD,wEAAwE;QACxE,mEAAmE;QACnE,EAAE;QACF,2EAA2E;QAC3E,4EAA4E;QAC5E,sEAAsE;QACtE,2EAA2E;QAC3E,0DAA0D;QAC1D,EAAE;QACF,+EAA+E;QAC/E,4EAA4E;QAC5E,2EAA2E;QAC3E,EAAE;QACF,6EAA6E;QAC7E,yEAAyE;QACzE,8CAA8C;QAC9C,wEAAwE;QACxE,MAAM,iBAAiB,GAAG,sBAAsB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QAC9D,IAAI,iBAAiB,EAAE,CAAC;YACtB,2BAA2B,CAAC,GAAG,CAAC,CAAC;QACnC,CAAC;QAED,MAAM,YAAY,GAAG,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC;QAE3F,oEAAoE;QACpE,8DAA8D;QAC9D,uEAAuE;QACvE,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,OAAO,EAAE;YACrC,QAAQ;YACR,MAAM;YACN,CAAC;YACD,SAAS,EAAE,EAAE;YACb,OAAO,EAAE,GAAG,EAAE,IAAI,IAAI,EAAE;YACxB,YAAY;YACZ,SAAS,EAAE,GAAG,CAAC,KAAK;SACrB,CAAC,CAAC;QAEH,GAAG,CAAC,IAAI,GAAG,WAAW,CAAC;QACvB,GAAG,CAAC,GAAG,CAAC,yBAAyB,EAAE,YAAY,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC;QACxE,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC;IAClB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,oCAAoC,CAAC,CAAC;QAC5D,GAAG,CAAC,IAAI,GAAG,WAAW,CAAC;QACvB,GAAG,CAAC,GAAG,CAAC,yBAAyB,EAAE,QAAQ,CAAC,CAAC;QAC7C,GAAG,CAAC,IAAI,GAAG,kFAAkF,CAAC;IAChG,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,yBAAyB;AACzB,8EAA8E;AAE9E;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB;AACrC,8DAA8D;AAC9D,GAAQ;IAER,MAAM,OAAO,GACX,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,IAAI,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAE7F,IAAI,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC;IAE/B,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC1D,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAE7B,4EAA4E;IAC5E,6DAA6D;IAC7D,MAAM,eAAe,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,IAAI,EAAE,CAAC;SACzD,KAAK,CAAC,GAAG,CAAC;SACV,MAAM,CAAC,OAAO,CAAC,CAAC;IACnB,MAAM,YAAY,GAAG,eAAe,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC;IAChE,MAAM,mBAAmB,GACvB,OAAO,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,gBAAgB,KAAK,UAAU;QACvD,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,eAAe,CAAC,CAAC;IACpD,MAAM,eAAe,GAAG,MAAM,CAAC,KAAK,CAAC,YAAY,EAAE,IAAI,EAAE,CAAC;SACvD,KAAK,CAAC,GAAG,CAAC;SACV,MAAM,CAAC,OAAO,CAAC;SACf,QAAQ,CAAC,gBAAgB,CAAC,CAAC;IAE9B,IAAI,YAAY,IAAI,mBAAmB,IAAI,CAAC,eAAe,EAAE,CAAC;QAC5D,KAAK,CAAC,YAAY,CAAC,gBAAgB,CAAC,CAAC;QACrC,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC;IACrB,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,8EAA8E;AAC9E,iCAAiC;AACjC,8EAA8E;AAE9E;;;;;;;;;GASG;AACH,MAAM,UAAU,0BAA0B,CACxC,MAAiC;IAEjC,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,UAAU,EAAE,WAAW,EAAE,cAAc,EAAE,cAAc,EAAE,eAAe,EAAE,GAC3F,MAAM,CAAC;IAET,OAAO;QACL,8CAA8C;QAC9C,OAAO,EAAE,cAAc;QAEvB,mEAAmE;QACnE,WAAW;QAEX,8DAA8D;QAC9D,2EAA2E;QAC3E,iBAAiB;QAEjB,gBAAgB;QAChB,QAAQ,EAAE;YACR,gEAAgE;YAChE,eAAe,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE;YACnC,wCAAwC;YACxC,aAAa,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE;YAChC,qCAAqC;YACrC,UAAU,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE;YAC7B,wCAAwC;YACxC,kBAAkB,EAAE;gBAClB,OAAO,EAAE,IAAI;gBACb,gFAAgF;gBAChF,2EAA2E;gBAC3E,oFAAoF;gBACpF,gFAAgF;gBAChF,8EAA8E;gBAC9E,eAAe,EAAE,KAAK,EAAE,IAAa,EAAE,OAAgB,EAAE,KAAc,EAAE,EAAE,CACzE,KAAK,IAAI,SAAS;gBACpB,qBAAqB,EAAE,GAAG,EAAE,CAAC,CAAC;oBAC5B,KAAK,EAAE,sBAAsB;oBAC7B,QAAQ,EAAE,mBAAmB;oBAC7B,iBAAiB,EAAE,QAAQ;oBAC3B,cAAc,EAAE,GAAG,CAAC,WAAW;iBAChC,CAAC;gBACF,kBAAkB,EAAE,GAAG,EAAE,CAAC,IAAI;aAC/B;YACD,kDAAkD;YAClD,iBAAiB,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE;YACpC,sEAAsE;YACtE,iBAAiB,EAAE;gBACjB,OAAO,EAAE,IAAI;gBACb,YAAY,EAAE,gBAAgB;gBAC9B,uBAAuB,EAAE,2BAA2B;aACrD;SACF;QAED,gEAAgE;QAChE,OAAO,EAAE;YACP,WAAW,EAAE,QAAQ;YACrB,iBAAiB,EAAE,QAAQ;SAC5B;QAED,wFAAwF;QACxF,4EAA4E;QAC5E,IAAI,EAAE;YACJ,QAAQ,EAAE,CAAC,IAAa,EAAE,MAA+B,EAAE,EAAE,CAC3D,MAAM,CAAC,uBAAuB,CAAC,KAAK,QAAQ,IAAI,MAAM,CAAC,wBAAwB,CAAC,KAAK,IAAI;YAC3F,OAAO,EAAE,CAAC,MAAM,CAAC;SAClB;QAED,sCAAsC;QACtC,GAAG,EAAE;YACH,WAAW,EAAE,GAAG,CAAC,WAAW;YAC5B,iBAAiB,EAAE,GAAG,CAAC,iBAAiB;YACxC,OAAO,EAAE,GAAG,CAAC,OAAO;YACpB,YAAY,EAAE,GAAG,CAAC,YAAY;YAC9B,WAAW,EAAE,GAAG,CAAC,WAAW;YAC5B,OAAO,EAAE,GAAG,CAAC,OAAO;YACpB,KAAK,EAAE,GAAG,CAAC,KAAK;SACjB;QAED,sDAAsD;QACtD,0FAA0F;QAC1F,gFAAgF;QAChF,+EAA+E;QAC/E,yFAAyF;QACzF,iBAAiB,EAAE,KAAK,EACtB,IAAa,EACb,MAAuD,EACvD,IAA6B,EAC7B,EAAE;YACF,OAAO,CACL,MAAM,CAAC,gBAAgB,CAAC,eAAe,CAAC;gBACxC,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,gBAAgB,CAAC;oBAChC,gFAAgF;oBAChF,CAAE,MAAkC,CAAC,eAAe,KAAK,KAAK;wBAC3D,MAAkC,CAAC,uBAAuB,KAAK,MAAM,CAAC,CAAC,CAC7E,CAAC;QACJ,CAAC;QAED,qEAAqE;QACrE,kBAAkB,EAAE,IAAI;QAExB,uBAAuB;QACvB,MAAM,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,gBAAgB,CAAC;QAE5E,iCAAiC;QACjC,mDAAmD;QACnD,mEAAmE;QACnE,yEAAyE;QACzE,gFAAgF;QAChF,MAAM,EAAE;YACN,MAAM,EAAE;gBACN,KAAK;gBACL,gCAAgC;gBAChC,OAAO;gBACP,aAAa;gBACb,sCAAsC;gBACtC,YAAY;gBACZ,aAAa;gBACb,aAAa;gBACb,WAAW;aACZ;YACD,OAAO,EAAE;gBACP,MAAM;gBACN,YAAY;gBACZ,aAAa;gBACb,aAAa;gBACb,UAAU;gBACV,oBAAoB;gBACpB,SAAS;gBACT,SAAS;gBACT,SAAS;gBACT,QAAQ;gBACR,WAAW;gBACX,UAAU;gBACV,QAAQ;gBACR,YAAY;aACb;YACD,KAAK,EAAE,CAAC,OAAO,EAAE,gBAAgB,CAAC;YAClC,OAAO,EAAE,CAAC,SAAS,CAAC;YACpB,KAAK,EAAE,CAAC,cAAc,EAAE,uBAAuB,CAAC;SACjD;QAED,2CAA2C;QAC3C,aAAa,EAAE,CAAC,MAAM,CAAC;QACvB,UAAU,EAAE,CAAC,oBAAoB,EAAE,oBAAoB,EAAE,eAAe,CAAC;QAEzE,kEAAkE;QAClE,2EAA2E;QAC3E,YAAY,EAAE;YACZ,GAAG,EAAE,cAAc;SACpB;QAED,6BAA6B;QAC7B,IAAI;QAEJ,0DAA0D;QAC1D,+DAA+D;QAC/D,gEAAgE;QAChE,oEAAoE;QACpE,yEAAyE;QACzE,OAAO,EAAE;YACP,IAAI,EAAE,UAAU;YAChB,IAAI,EAAE;gBACJ,MAAM,EAAE,IAAI;gBACZ,QAAQ,EAAE,IAAI;gBACd,QAAQ,EAAE,KAAc;gBACxB,MAAM,EAAE,MAAM,CAAC,aAAa,CAAC,UAAU,CAAC,UAAU,CAAC;aACpD;YACD,KAAK,EAAE;gBACL,MAAM,EAAE,IAAI;gBACZ,QAAQ,EAAE,IAAI;gBACd,QAAQ,EAAE,KAAc;gBACxB,MAAM,EAAE,MAAM,CAAC,aAAa,CAAC,UAAU,CAAC,UAAU,CAAC;aACpD;SACF;QAED,iDAAiD;QACjD,eAAe;QAEf,sEAAsE;QACtE,4EAA4E;QAC5E,WAAW,EAAE,eAAe;QAE5B,mEAAmE;QACnE,8DAA8D;QAC9D,kEAAkE;QAClE,mBAAmB,EAAE;YACnB,UAAU,EAAE;gBACV,gBAAgB;gBAChB,aAAa;gBACb,2BAA2B;gBAC3B,uBAAuB;gBACvB,wBAAwB;gBACxB,mCAAmC;gBACnC,kEAAkE;gBAClE,0DAA0D;gBAC1D,yEAAyE;gBACzE,uEAAuE;gBACvE,yBAAyB;gBACzB,oEAAoE;gBACpE,iCAAiC;gBACjC,gBAAgB;aACjB;SACF;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"configuration.js","sourceRoot":"","sources":["../../src/oidc/configuration.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAIH,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,mCAAmC,CAAC;AAC3E,OAAO,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAC;AACxD,OAAO,EACL,8BAA8B,EAC9B,wBAAwB,GAEzB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,aAAa,EAAE,sBAAsB,EAAE,MAAM,iBAAiB,CAAC;AACxE,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC1C,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAElE,OAAO,EAAE,mBAAmB,EAAE,MAAM,qCAAqC,CAAC;AAC1E,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AA6BlD,8EAA8E;AAC9E,yBAAyB;AACzB,8EAA8E;AAE9E;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB;IAClC,OAAO;QACL,OAAO,EAAE,IAAI;QACb,UAAU,EAAE,IAAI;QAChB,YAAY,EAAE,8BAA8B;QAC5C,WAAW,EAAE,EAAE;QACf,SAAS,EAAE,IAAI;QACf,YAAY,EAAE,EAAE;KACjB,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,GAAY;IAC1D,IAAI,CAAC;QACH,sDAAsD;QACtD,sEAAsE;QACtE,yCAAyC;QACzC,8DAA8D;QAC9D,MAAM,OAAO,GAAG,GAAU,CAAC;QAE3B,2DAA2D;QAC3D,MAAM,SAAS,GAAG,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,SAA+B,CAAC;QAC1E,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,SAAS,CAAC,CAAC;YAC1C,IAAI,IAAI,EAAE,CAAC;gBACT,MAAM,GAAG,GAAG,MAAM,mBAAmB,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;gBAC3D,IAAI,GAAG;oBAAE,OAAO,GAAG,CAAC;YACtB,CAAC;QACH,CAAC;QAED,4DAA4D;QAC5D,MAAM,KAAK,GAAG,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,cAAoC,CAAC;QAC1E,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,GAAG,GAAG,MAAM,mBAAmB,CAAC,KAAK,CAAC,CAAC;YAC7C,IAAI,GAAG;gBAAE,OAAO,GAAG,CAAC;QACtB,CAAC;QAED,OAAO,SAAS,CAAC;IACnB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,EAAE,mDAAmD,CAAC,CAAC;QAC1E,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,2BAA2B;AAC3B,8EAA8E;AAE9E;;;;;;;;;;;;;GAaG;AACH,8DAA8D;AAC9D,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,GAAQ,EAAE,IAAY;IAC3D,IAAI,CAAC;QACH,8DAA8D;QAC9D,MAAM,GAAG,GAAG,MAAM,yBAAyB,CAAC,GAAG,CAAC,CAAC;QACjD,MAAM,QAAQ,GAAG,GAAG,CAAC,CAAC,CAAC,MAAM,wBAAwB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,oBAAoB,EAAE,CAAC;QAEpF,0CAA0C;QAC1C,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,SAAS,EAAE,SAAS,EAAE,GAAG,EAAE,aAAa,IAAI,EAAE,CAAC,CAAC;QACnF,MAAM,CAAC,GAAG,sBAAsB,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;QAEpD,uEAAuE;QACvE,uEAAuE;QACvE,iEAAiE;QACjE,EAAE;QACF,sEAAsE;QACtE,wEAAwE;QACxE,uEAAuE;QACvE,yEAAyE;QACzE,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAC7B,SAAS,EACT,6FAA6F,CAAC,CAAC,gBAAgB,CAAC,kBAAkB,CACnI,CAAC;QAEF,0EAA0E;QAC1E,mFAAmF;QACnF,qFAAqF;QACrF,MAAM,UAAU,GAAG,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,WAAiC,CAAC;QACnF,MAAM,SAAS,GAAG,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,wBAA8C,CAAC;QAEnF,2DAA2D;QAC3D,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,QAAQ,EAAE;YACtC,QAAQ;YACR,MAAM;YACN,CAAC;YACD,SAAS,EAAE,EAAE,EAAE,mDAAmD;YAClE,OAAO,EAAE,GAAG,EAAE,IAAI,IAAI,EAAE;YACxB,UAAU,EAAE,UAAU;YACtB,UAAU,EAAE,UAAU,IAAI,IAAI;YAC9B,SAAS,EAAE,SAAS,IAAI,IAAI;SAC7B,CAAC,CAAC;QAEH,GAAG,CAAC,IAAI,GAAG,WAAW,CAAC;QACvB,GAAG,CAAC,GAAG,CAAC,yBAAyB,EAAE,YAAY,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC;QACxE,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC;IAClB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,0DAA0D;QAC1D,iEAAiE;QACjE,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,qCAAqC,CAAC,CAAC;QAC7D,GAAG,CAAC,IAAI,GAAG,WAAW,CAAC;QACvB,GAAG,CAAC,GAAG,CAAC,yBAAyB,EAAE,QAAQ,CAAC,CAAC;QAC7C,GAAG,CAAC,IAAI,GAAG,8BAA8B,IAAI,yLAAyL,CAAC;IACzO,CAAC;AACH,CAAC;AAED;;;;;;;;;;;GAWG;AACH,8DAA8D;AAC9D,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,GAAQ;IACxD,IAAI,CAAC;QACH,0DAA0D;QAC1D,wDAAwD;QACxD,MAAM,QAAQ,GAAG,oBAAoB,EAAE,CAAC;QACxC,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,SAAS,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;QAC7D,MAAM,CAAC,GAAG,sBAAsB,CAAC,MAAM,CAAC,CAAC;QAEzC,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,gBAAgB,EAAE;YAC9C,QAAQ;YACR,MAAM;YACN,CAAC;YACD,SAAS,EAAE,EAAE;YACb,OAAO,EAAE,EAAE;SACZ,CAAC,CAAC;QAEH,GAAG,CAAC,IAAI,GAAG,WAAW,CAAC;QACvB,GAAG,CAAC,GAAG,CAAC,yBAAyB,EAAE,YAAY,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC;QACxE,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC;IAClB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,0CAA0C,CAAC,CAAC;QAClE,GAAG,CAAC,IAAI,GAAG,WAAW,CAAC;QACvB,GAAG,CAAC,GAAG,CAAC,yBAAyB,EAAE,QAAQ,CAAC,CAAC;QAC7C,GAAG,CAAC,IAAI;YACN,2GAA2G,CAAC;IAChH,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,SAAS,sBAAsB,CAC7B,GAAkD,EAClD,KAAwB;IAExB,IAAI,KAAK,EAAE,IAAI,KAAK,iBAAiB;QAAE,OAAO,IAAI,CAAC;IAEnD,IAAI,GAAG,CAAC,KAAK,KAAK,iBAAiB;QAAE,OAAO,KAAK,CAAC;IAClD,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,iBAAiB,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IACzD,OAAO,CACL,IAAI,CAAC,QAAQ,CAAC,+BAA+B,CAAC;QAC9C,IAAI,CAAC,QAAQ,CAAC,6CAA6C,CAAC;QAC5D,IAAI,CAAC,QAAQ,CAAC,mCAAmC,CAAC;QAClD,IAAI,CAAC,QAAQ,CAAC,sDAAsD,CAAC,CACtE,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,2BAA2B;AAClC,8DAA8D;AAC9D,GAAQ;IAER,MAAM,YAAY,GAAG,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,CAAC;IACrD,MAAM,iBAAiB,GACrB,OAAO,YAAY,KAAK,UAAU;QAChC,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAC;QACjD,CAAC,CAAC,UAAU,CAAC;IACjB,mBAAmB,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC;AAC9C,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe;AACnC,8DAA8D;AAC9D,GAAQ,EACR,GAAkD,EAClD,MAAa;IAEb,IAAI,CAAC;QACH,6DAA6D;QAC7D,MAAM,GAAG,GAAG,MAAM,yBAAyB,CAAC,GAAG,CAAC,CAAC;QACjD,MAAM,QAAQ,GAAG,GAAG,CAAC,CAAC,CAAC,MAAM,wBAAwB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,oBAAoB,EAAE,CAAC;QAEpF,0CAA0C;QAC1C,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,SAAS,EAAE,SAAS,EAAE,GAAG,EAAE,aAAa,IAAI,EAAE,CAAC,CAAC;QACnF,MAAM,CAAC,GAAG,sBAAsB,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;QAEpD,wEAAwE;QACxE,mEAAmE;QACnE,EAAE;QACF,2EAA2E;QAC3E,4EAA4E;QAC5E,sEAAsE;QACtE,2EAA2E;QAC3E,0DAA0D;QAC1D,EAAE;QACF,+EAA+E;QAC/E,4EAA4E;QAC5E,2EAA2E;QAC3E,EAAE;QACF,6EAA6E;QAC7E,yEAAyE;QACzE,8CAA8C;QAC9C,wEAAwE;QACxE,MAAM,iBAAiB,GAAG,sBAAsB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QAC9D,IAAI,iBAAiB,EAAE,CAAC;YACtB,2BAA2B,CAAC,GAAG,CAAC,CAAC;QACnC,CAAC;QAED,MAAM,YAAY,GAAG,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC;QAE3F,oEAAoE;QACpE,8DAA8D;QAC9D,uEAAuE;QACvE,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,OAAO,EAAE;YACrC,QAAQ;YACR,MAAM;YACN,CAAC;YACD,SAAS,EAAE,EAAE;YACb,OAAO,EAAE,GAAG,EAAE,IAAI,IAAI,EAAE;YACxB,YAAY;YACZ,SAAS,EAAE,GAAG,CAAC,KAAK;SACrB,CAAC,CAAC;QAEH,GAAG,CAAC,IAAI,GAAG,WAAW,CAAC;QACvB,GAAG,CAAC,GAAG,CAAC,yBAAyB,EAAE,YAAY,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC;QACxE,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC;IAClB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,oCAAoC,CAAC,CAAC;QAC5D,GAAG,CAAC,IAAI,GAAG,WAAW,CAAC;QACvB,GAAG,CAAC,GAAG,CAAC,yBAAyB,EAAE,QAAQ,CAAC,CAAC;QAC7C,GAAG,CAAC,IAAI,GAAG,kFAAkF,CAAC;IAChG,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,yBAAyB;AACzB,8EAA8E;AAE9E;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB;AACrC,8DAA8D;AAC9D,GAAQ;IAER,MAAM,OAAO,GACX,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,IAAI,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAE7F,IAAI,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC;IAE/B,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC1D,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAE7B,4EAA4E;IAC5E,6DAA6D;IAC7D,MAAM,eAAe,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,IAAI,EAAE,CAAC;SACzD,KAAK,CAAC,GAAG,CAAC;SACV,MAAM,CAAC,OAAO,CAAC,CAAC;IACnB,MAAM,YAAY,GAAG,eAAe,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC;IAChE,MAAM,mBAAmB,GACvB,OAAO,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,gBAAgB,KAAK,UAAU;QACvD,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,eAAe,CAAC,CAAC;IACpD,MAAM,eAAe,GAAG,MAAM,CAAC,KAAK,CAAC,YAAY,EAAE,IAAI,EAAE,CAAC;SACvD,KAAK,CAAC,GAAG,CAAC;SACV,MAAM,CAAC,OAAO,CAAC;SACf,QAAQ,CAAC,gBAAgB,CAAC,CAAC;IAE9B,IAAI,YAAY,IAAI,mBAAmB,IAAI,CAAC,eAAe,EAAE,CAAC;QAC5D,KAAK,CAAC,YAAY,CAAC,gBAAgB,CAAC,CAAC;QACrC,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC;IACrB,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,8EAA8E;AAC9E,iCAAiC;AACjC,8EAA8E;AAE9E;;;;;;;;;GASG;AACH,MAAM,UAAU,0BAA0B,CACxC,MAAiC;IAEjC,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,UAAU,EAAE,WAAW,EAAE,cAAc,EAAE,cAAc,EAAE,eAAe,EAAE,GAC3F,MAAM,CAAC;IAET,OAAO;QACL,8CAA8C;QAC9C,OAAO,EAAE,cAAc;QAEvB,mEAAmE;QACnE,WAAW;QAEX,8DAA8D;QAC9D,2EAA2E;QAC3E,iBAAiB;QAEjB,gBAAgB;QAChB,QAAQ,EAAE;YACR,gEAAgE;YAChE,eAAe,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE;YACnC,wCAAwC;YACxC,aAAa,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE;YAChC,qCAAqC;YACrC,UAAU,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE;YAC7B,wCAAwC;YACxC,kBAAkB,EAAE;gBAClB,OAAO,EAAE,IAAI;gBACb,gFAAgF;gBAChF,2EAA2E;gBAC3E,oFAAoF;gBACpF,gFAAgF;gBAChF,8EAA8E;gBAC9E,eAAe,EAAE,KAAK,EAAE,IAAa,EAAE,OAAgB,EAAE,KAAc,EAAE,EAAE,CACzE,KAAK,IAAI,SAAS;gBACpB,qBAAqB,EAAE,GAAG,EAAE,CAAC,CAAC;oBAC5B,KAAK,EAAE,sBAAsB;oBAC7B,QAAQ,EAAE,mBAAmB;oBAC7B,iBAAiB,EAAE,QAAQ;oBAC3B,cAAc,EAAE,GAAG,CAAC,WAAW;iBAChC,CAAC;gBACF,kBAAkB,EAAE,GAAG,EAAE,CAAC,IAAI;aAC/B;YACD,kDAAkD;YAClD,iBAAiB,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE;YACpC,sEAAsE;YACtE,iBAAiB,EAAE;gBACjB,OAAO,EAAE,IAAI;gBACb,YAAY,EAAE,gBAAgB;gBAC9B,uBAAuB,EAAE,2BAA2B;aACrD;SACF;QAED,gEAAgE;QAChE,OAAO,EAAE;YACP,WAAW,EAAE,QAAQ;YACrB,iBAAiB,EAAE,QAAQ;SAC5B;QAED,wFAAwF;QACxF,4EAA4E;QAC5E,IAAI,EAAE;YACJ,QAAQ,EAAE,CAAC,IAAa,EAAE,MAA+B,EAAE,EAAE,CAC3D,MAAM,CAAC,uBAAuB,CAAC,KAAK,QAAQ,IAAI,MAAM,CAAC,wBAAwB,CAAC,KAAK,IAAI;YAC3F,OAAO,EAAE,CAAC,MAAM,CAAC;SAClB;QAED,sCAAsC;QACtC,GAAG,EAAE;YACH,WAAW,EAAE,GAAG,CAAC,WAAW;YAC5B,iBAAiB,EAAE,GAAG,CAAC,iBAAiB;YACxC,OAAO,EAAE,GAAG,CAAC,OAAO;YACpB,YAAY,EAAE,GAAG,CAAC,YAAY;YAC9B,WAAW,EAAE,GAAG,CAAC,WAAW;YAC5B,OAAO,EAAE,GAAG,CAAC,OAAO;YACpB,KAAK,EAAE,GAAG,CAAC,KAAK;SACjB;QAED,sDAAsD;QACtD,0FAA0F;QAC1F,gFAAgF;QAChF,+EAA+E;QAC/E,yFAAyF;QACzF,iBAAiB,EAAE,KAAK,EACtB,IAAa,EACb,MAAuD,EACvD,IAA6B,EAC7B,EAAE;YACF,OAAO,CACL,MAAM,CAAC,gBAAgB,CAAC,eAAe,CAAC;gBACxC,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,gBAAgB,CAAC;oBAChC,gFAAgF;oBAChF,CAAE,MAAkC,CAAC,eAAe,KAAK,KAAK;wBAC3D,MAAkC,CAAC,uBAAuB,KAAK,MAAM,CAAC,CAAC,CAC7E,CAAC;QACJ,CAAC;QAED,qEAAqE;QACrE,kBAAkB,EAAE,IAAI;QAExB,qEAAqE;QACrE,wEAAwE;QACxE,uDAAuD;QACvD,MAAM,EAAE;YACN,QAAQ;YACR,SAAS;YACT,OAAO;YACP,SAAS;YACT,OAAO;YACP,gBAAgB;YAChB,mBAAmB;SACpB;QAED,iCAAiC;QACjC,mDAAmD;QACnD,mEAAmE;QACnE,yEAAyE;QACzE,gFAAgF;QAChF,MAAM,EAAE;YACN,MAAM,EAAE;gBACN,KAAK;gBACL,gCAAgC;gBAChC,OAAO;gBACP,aAAa;gBACb,sCAAsC;gBACtC,YAAY;gBACZ,aAAa;gBACb,aAAa;gBACb,WAAW;aACZ;YACD,OAAO,EAAE;gBACP,MAAM;gBACN,YAAY;gBACZ,aAAa;gBACb,aAAa;gBACb,UAAU;gBACV,oBAAoB;gBACpB,SAAS;gBACT,SAAS;gBACT,SAAS;gBACT,QAAQ;gBACR,WAAW;gBACX,UAAU;gBACV,QAAQ;gBACR,YAAY;aACb;YACD,KAAK,EAAE,CAAC,OAAO,EAAE,gBAAgB,CAAC;YAClC,OAAO,EAAE,CAAC,SAAS,CAAC;YACpB,KAAK,EAAE,CAAC,cAAc,EAAE,uBAAuB,CAAC;SACjD;QAED,2CAA2C;QAC3C,aAAa,EAAE,CAAC,MAAM,CAAC;QACvB,UAAU,EAAE,CAAC,oBAAoB,EAAE,oBAAoB,EAAE,eAAe,CAAC;QAEzE,kEAAkE;QAClE,2EAA2E;QAC3E,YAAY,EAAE;YACZ,GAAG,EAAE,cAAc;SACpB;QAED,6BAA6B;QAC7B,IAAI;QAEJ,0DAA0D;QAC1D,+DAA+D;QAC/D,gEAAgE;QAChE,oEAAoE;QACpE,yEAAyE;QACzE,OAAO,EAAE;YACP,IAAI,EAAE,UAAU;YAChB,IAAI,EAAE;gBACJ,MAAM,EAAE,IAAI;gBACZ,QAAQ,EAAE,IAAI;gBACd,QAAQ,EAAE,KAAc;gBACxB,MAAM,EAAE,MAAM,CAAC,aAAa,CAAC,UAAU,CAAC,UAAU,CAAC;aACpD;YACD,KAAK,EAAE;gBACL,MAAM,EAAE,IAAI;gBACZ,QAAQ,EAAE,IAAI;gBACd,QAAQ,EAAE,KAAc;gBACxB,MAAM,EAAE,MAAM,CAAC,aAAa,CAAC,UAAU,CAAC,UAAU,CAAC;aACpD;SACF;QAED,iDAAiD;QACjD,eAAe;QAEf,sEAAsE;QACtE,4EAA4E;QAC5E,WAAW,EAAE,eAAe;QAE5B,mEAAmE;QACnE,8DAA8D;QAC9D,kEAAkE;QAClE,mBAAmB,EAAE;YACnB,UAAU,EAAE;gBACV,gBAAgB;gBAChB,aAAa;gBACb,2BAA2B;gBAC3B,uBAAuB;gBACvB,wBAAwB;gBACxB,mCAAmC;gBACnC,kEAAkE;gBAClE,0DAA0D;gBAC1D,yEAAyE;gBACzE,uEAAuE;gBACvE,yBAAyB;gBACzB,oEAAoE;gBACpE,iCAAiC;gBACjC,gBAAgB;aACjB;SACF;KACF,CAAC;AACJ,CAAC"}

package/dist/oidc/scopes.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Tenant-scoped OAuth scope names.
+ *
+ * These values are shared by the OIDC provider configuration and the tenant
+ * invitation middleware. A scope must be registered as supported before an
+ * OIDC client can carry it in its metadata; otherwise the provider rejects the
+ * client at the token endpoint.
+ *
+ * @module oidc/scopes
+ */
+/** Scope that authorizes a tenant service client to invite users. */
+export declare const TENANT_INVITE_SCOPE = "org:user:invite";
+/** Permission that authorizes a tenant user to invite users. */
+export declare const TENANT_INVITE_PERMISSION = "org:user:invite";
+//# sourceMappingURL=scopes.d.ts.map

package/dist/oidc/scopes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scopes.d.ts","sourceRoot":"","sources":["../../src/oidc/scopes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,qEAAqE;AACrE,eAAO,MAAM,mBAAmB,oBAAoB,CAAC;AAErD,gEAAgE;AAChE,eAAO,MAAM,wBAAwB,oBAAsB,CAAC"}

package/dist/oidc/scopes.js

@@ -0,0 +1,15 @@
+/**
+ * Tenant-scoped OAuth scope names.
+ *
+ * These values are shared by the OIDC provider configuration and the tenant
+ * invitation middleware. A scope must be registered as supported before an
+ * OIDC client can carry it in its metadata; otherwise the provider rejects the
+ * client at the token endpoint.
+ *
+ * @module oidc/scopes
+ */
+/** Scope that authorizes a tenant service client to invite users. */
+export const TENANT_INVITE_SCOPE = 'org:user:invite';
+/** Permission that authorizes a tenant user to invite users. */
+export const TENANT_INVITE_PERMISSION = TENANT_INVITE_SCOPE;
+//# sourceMappingURL=scopes.js.map

package/dist/oidc/scopes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scopes.js","sourceRoot":"","sources":["../../src/oidc/scopes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,qEAAqE;AACrE,MAAM,CAAC,MAAM,mBAAmB,GAAG,iBAAiB,CAAC;AAErD,gEAAgE;AAChE,MAAM,CAAC,MAAM,wBAAwB,GAAG,mBAAmB,CAAC"}