@portaidentity/server 1.7.3 → 1.8.0

package/dist/middleware/token-rate-limiter.js

@@ -1,23 +1,26 @@
 /**
  * Token and introspection endpoint rate limiter middleware.
  *
- * Protects the OAuth token endpoint (`POST /:orgSlug/oidc/token`) and
- * token introspection endpoint (`POST /:orgSlug/oidc/token/introspection`)
+ * Protects the OAuth token endpoint (`POST /:orgSlug/token`) and
+ * token introspection endpoint (`POST /:orgSlug/token/introspection`)
  * against abuse: client-credentials flooding, authorization-code
  * brute-forcing, token enumeration, and general endpoint spam.
  *
- * Rate limiting is per-IP + per-client_id composite key.  If `client_id`
- * is not present in the request body (e.g. `client_secret_basic` auth
- * sends credentials in the `Authorization` header), the key falls back
- * to `unknown` — all such requests from the same IP share one counter.
+ * Rate limiting is per-IP + per-client_id composite key. The client
+ * identifier is read from the parsed body or from HTTP Basic credentials;
+ * when neither is present (unauthenticated spam) the key falls back to
+ * `unknown`. Because that identifier is unauthenticated and caller-controlled,
+ * an aggregate per-IP counter runs alongside it, so one address cannot flood
+ * the endpoint by varying the client identifier.
  *
  * Reuses the existing `checkRateLimit()` infrastructure from
  * `src/auth/rate-limiter.ts` which provides Redis INCR+EXPIRE sliding
  * window and graceful degradation on Redis failure.
  *
- * Placement: mount as global middleware **before** the OIDC provider
- * router in `src/server.ts`.  The path regex ensures only matching
- * requests are rate-limited — all other paths pass through untouched.
+ * Placement: mounted on the OIDC router **after** the request body parser so
+ * the client identifier is available, and before the provider callback. The
+ * path regex ensures only the token and introspection endpoints are limited —
+ * every other path passes through untouched.
  *
  * @module middleware/token-rate-limiter
  */
@@ -29,16 +32,52 @@ import { logger } from '../lib/logger.js';
 /**
  * Regex matching the OIDC token endpoint path.
  *
- * Pattern: `/<orgSlug>/oidc/token` where orgSlug starts with a
+ * Pattern: `/<orgSlug>/token` where orgSlug starts with a
  * lowercase alphanumeric character followed by zero or more lowercase
  * alphanumeric or hyphen characters.
  *
- * Matches:  `/acme/oidc/token`, `/my-org/oidc/token`
- * Rejects:  `/api/admin/something`, `/acme/oidc/token/extra`
+ * Matches:  `/acme/token`, `/my-org/token`
+ * Rejects:  `/api/admin/something`, `/acme/token/extra`
  */
-export const TOKEN_PATH_REGEX = /^\/[a-z0-9][a-z0-9-]*\/oidc\/token$/;
+export const TOKEN_PATH_REGEX = /^\/[a-z0-9][a-z0-9-]*\/token$/;
+/** Maximum length of a client identifier accepted for rate-limit bucketing. */
+const MAX_CLIENT_KEY_LENGTH = 255;
 /**
- * Rate limit configuration for the token endpoint.
+ * Extract the presented OAuth client identifier for rate-limit bucketing.
+ *
+ * The identifier is read from the parsed form body (`client_secret_post`) or
+ * from HTTP Basic credentials (`client_secret_basic`). It is a public value
+ * used only to give each client its own counter, so reading it before the
+ * provider authenticates the client is safe. Values longer than
+ * `MAX_CLIENT_KEY_LENGTH` are treated as absent. When neither form is present
+ * the key falls back to `unknown`, so unauthenticated spam from one address
+ * shares a single budget.
+ *
+ * @param ctx - Koa context whose parsed body and Authorization header are read
+ * @returns The presented client identifier, or `unknown` when none is present
+ */
+function presentedClientId(ctx) {
+    const body = ctx.request.body;
+    const bodyClientId = body?.['client_id'];
+    if (typeof bodyClientId === 'string' &&
+        bodyClientId.length > 0 &&
+        bodyClientId.length <= MAX_CLIENT_KEY_LENGTH) {
+        return bodyClientId;
+    }
+    const authorization = ctx.headers.authorization;
+    if (authorization !== undefined &&
+        authorization.length > 6 &&
+        authorization.slice(0, 6).toLowerCase() === 'basic ') {
+        const decoded = Buffer.from(authorization.slice(6), 'base64').toString('utf8');
+        const separator = decoded.indexOf(':');
+        const clientId = separator > 0 ? decoded.slice(0, separator) : '';
+        if (clientId.length > 0 && clientId.length <= MAX_CLIENT_KEY_LENGTH)
+            return clientId;
+    }
+    return 'unknown';
+}
+/**
+ * Rate limit configuration for the token endpoint, per client.
  *
  * 30 requests per 5-minute window — generous enough for legitimate
  * applications (SPAs refreshing tokens, server-side token exchanges)
@@ -48,6 +87,44 @@ export const TOKEN_RATE_LIMIT = {
     max: 30,
     windowSeconds: 300,
 };
+/**
+ * Aggregate token limit for one client address.
+ *
+ * The per-client key comes from an unauthenticated value, so a caller can vary
+ * the client identifier to open a fresh counter for every request. This
+ * aggregate bounds the total token traffic from one address, so the endpoint
+ * cannot be flooded with junk requests, while many legitimate clients behind
+ * one address still receive their own per-client budgets.
+ */
+export const TOKEN_IP_RATE_LIMIT = {
+    max: 300,
+    windowSeconds: 300,
+};
+/**
+ * Emit the OAuth-format 429 response for a limiter denial.
+ *
+ * @param ctx - Koa context to mutate
+ * @param retryAfter - Seconds until the caller may retry
+ * @param description - Client-safe error description
+ */
+function denyRateLimited(ctx, retryAfter, description) {
+    // The limiter runs before the OIDC CORS middleware so it can reject before
+    // any client lookup. Re-emit the request origin here so a browser client can
+    // read the 429 and its Retry-After. A 429 exposes no data, so reflecting the
+    // origin is safe; credentialed access is not granted.
+    const origin = ctx.headers.origin;
+    if (origin !== undefined) {
+        ctx.set('Access-Control-Allow-Origin', origin);
+        ctx.set('Vary', 'Origin');
+    }
+    ctx.status = 429;
+    ctx.set('Retry-After', String(retryAfter));
+    ctx.body = {
+        error: 'rate_limit_exceeded',
+        error_description: description,
+        retry_after: retryAfter,
+    };
+}
 // ---------------------------------------------------------------------------
 // Middleware factory
 // ---------------------------------------------------------------------------
@@ -68,16 +145,15 @@ export function tokenRateLimiter() {
         if (ctx.method !== 'POST' || !TOKEN_PATH_REGEX.test(ctx.path)) {
             return next();
         }
-        // Extract client_id from the parsed request body if available.
-        // The selective bodyParser in server.ts excludes OIDC routes, so
-        // ctx.request.body may be empty when this middleware runs.
-        // Fall back to 'unknown' — all unidentified clients from the same
-        // IP share a single rate limit counter, which is acceptable.
-        const body = ctx.request.body;
-        const clientId = body?.client_id;
-        const clientKey = typeof clientId === 'string' && clientId.length > 0
-            ? clientId
-            : 'unknown';
+        // An unauthenticated client identifier can be varied per request, so an
+        // aggregate per-IP counter bounds total token traffic independently of it.
+        const aggregate = await checkRateLimit(`ratelimit:token:ip:${ctx.ip}`, TOKEN_IP_RATE_LIMIT);
+        if (!aggregate.allowed) {
+            logger.warn({ action: 'token_ip_rate_limit_exceeded', ip: ctx.ip, path: ctx.path }, 'Token endpoint per-IP rate limit exceeded');
+            denyRateLimited(ctx, aggregate.retryAfter, 'Too many token requests. Please try again later.');
+            return;
+        }
+        const clientKey = presentedClientId(ctx);
         // Composite key: per-IP + per-client_id for granular rate limiting
         const key = `ratelimit:token:${ctx.ip}:${clientKey}`;
         const result = await checkRateLimit(key, TOKEN_RATE_LIMIT);
@@ -92,15 +168,7 @@ export function tokenRateLimiter() {
                 clientId: clientKey,
                 path: ctx.path,
             }, 'Token endpoint rate limit exceeded');
-            ctx.status = 429;
-            ctx.set('Retry-After', String(result.retryAfter));
-            // OAuth 2.0 error format — clients that parse token endpoint
-            // errors can handle this structured response.
-            ctx.body = {
-                error: 'rate_limit_exceeded',
-                error_description: 'Too many token requests. Please try again later.',
-                retry_after: result.retryAfter,
-            };
+            denyRateLimited(ctx, result.retryAfter, 'Too many token requests. Please try again later.');
             return;
         }
         return next();
@@ -112,13 +180,13 @@ export function tokenRateLimiter() {
 /**
  * Regex matching the OIDC token introspection endpoint path.
  *
- * Pattern: `/<orgSlug>/oidc/token/introspection` where orgSlug uses
+ * Pattern: `/<orgSlug>/token/introspection` where orgSlug uses
  * the same slug format as TOKEN_PATH_REGEX.
  *
- * Matches:  `/acme/oidc/token/introspection`, `/my-org/oidc/token/introspection`
- * Rejects:  `/acme/oidc/token`, `/api/admin/introspection`
+ * Matches:  `/acme/token/introspection`, `/my-org/token/introspection`
+ * Rejects:  `/acme/token`, `/api/admin/introspection`
  */
-export const INTROSPECTION_PATH_REGEX = /^\/[a-z0-9][a-z0-9-]*\/oidc\/token\/introspection$/;
+export const INTROSPECTION_PATH_REGEX = /^\/[a-z0-9][a-z0-9-]*\/token\/introspection$/;
 /**
  * Rate limit configuration for the introspection endpoint.
  *
@@ -131,6 +199,17 @@ export const INTROSPECTION_RATE_LIMIT = {
     max: 100,
     windowSeconds: 60,
 };
+/**
+ * Aggregate introspection limit for one client address.
+ *
+ * As on the token endpoint, the per-client key comes from an unauthenticated
+ * value and can be varied per request, so this aggregate bounds the total
+ * introspection traffic from one address independently of the client value.
+ */
+export const INTROSPECTION_IP_RATE_LIMIT = {
+    max: 600,
+    windowSeconds: 60,
+};
 /**
  * Create the introspection endpoint rate limiter middleware.
  *
@@ -150,14 +229,15 @@ export function introspectionRateLimiter() {
         if (ctx.method !== 'POST' || !INTROSPECTION_PATH_REGEX.test(ctx.path)) {
             return next();
         }
-        // Extract client_id from the parsed request body if available.
-        // Introspection requests carry client credentials — client_id may
-        // be in the body (client_secret_post) or absent (client_secret_basic).
-        const body = ctx.request.body;
-        const clientId = body?.client_id;
-        const clientKey = typeof clientId === 'string' && clientId.length > 0
-            ? clientId
-            : 'unknown';
+        // An unauthenticated client identifier can be varied per request, so an
+        // aggregate per-IP counter bounds total introspection traffic.
+        const aggregate = await checkRateLimit(`ratelimit:introspect:ip:${ctx.ip}`, INTROSPECTION_IP_RATE_LIMIT);
+        if (!aggregate.allowed) {
+            logger.warn({ action: 'introspection_ip_rate_limit_exceeded', ip: ctx.ip, path: ctx.path }, 'Introspection endpoint per-IP rate limit exceeded');
+            denyRateLimited(ctx, aggregate.retryAfter, 'Too many introspection requests. Please try again later.');
+            return;
+        }
+        const clientKey = presentedClientId(ctx);
         // Composite key: per-IP + per-client_id — separate namespace from
         // the token endpoint to keep counters independent.
         const key = `ratelimit:introspect:${ctx.ip}:${clientKey}`;
@@ -172,15 +252,7 @@ export function introspectionRateLimiter() {
                 clientId: clientKey,
                 path: ctx.path,
             }, 'Introspection endpoint rate limit exceeded');
-            ctx.status = 429;
-            ctx.set('Retry-After', String(result.retryAfter));
-            // OAuth 2.0 error format — resource servers parsing introspection
-            // errors can handle this structured response.
-            ctx.body = {
-                error: 'rate_limit_exceeded',
-                error_description: 'Too many introspection requests. Please try again later.',
-                retry_after: result.retryAfter,
-            };
+            denyRateLimited(ctx, result.retryAfter, 'Too many introspection requests. Please try again later.');
             return;
         }
         return next();

package/dist/middleware/token-rate-limiter.js.map

@@ -1 +1 @@
-{"version":3,"file":"token-rate-limiter.js","sourceRoot":"","sources":["../../src/middleware/token-rate-limiter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAGH,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAEzD,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAE1C,8EAA8E;AAC9E,6DAA6D;AAC7D,8EAA8E;AAE9E;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,qCAAqC,CAAC;AAEtE;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAoB;IAC/C,GAAG,EAAE,EAAE;IACP,aAAa,EAAE,GAAG;CACnB,CAAC;AAEF,8EAA8E;AAC9E,qBAAqB;AACrB,8EAA8E;AAE9E;;;;;;;;;GASG;AACH,MAAM,UAAU,gBAAgB;IAC9B,OAAO,KAAK,UAAU,0BAA0B,CAAC,GAAG,EAAE,IAAI;QACxD,kEAAkE;QAClE,oDAAoD;QACpD,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9D,OAAO,IAAI,EAAE,CAAC;QAChB,CAAC;QAED,+DAA+D;QAC/D,iEAAiE;QACjE,2DAA2D;QAC3D,kEAAkE;QAClE,6DAA6D;QAC7D,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,IAA2C,CAAC;QACrE,MAAM,QAAQ,GAAG,IAAI,EAAE,SAAS,CAAC;QACjC,MAAM,SAAS,GACb,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;YACjD,CAAC,CAAC,QAAQ;YACV,CAAC,CAAC,SAAS,CAAC;QAEhB,mEAAmE;QACnE,MAAM,GAAG,GAAG,mBAAmB,GAAG,CAAC,EAAE,IAAI,SAAS,EAAE,CAAC;QAErD,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC;QAE3D,oEAAoE;QACpE,wDAAwD;QACxD,GAAG,CAAC,GAAG,CAAC,mBAAmB,EAAE,MAAM,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC;QAC3D,GAAG,CAAC,GAAG,CAAC,uBAAuB,EAAE,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;QAE3D,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,MAAM,CAAC,IAAI,CACT;gBACE,MAAM,EAAE,2BAA2B;gBACnC,EAAE,EAAE,GAAG,CAAC,EAAE;gBACV,QAAQ,EAAE,SAAS;gBACnB,IAAI,EAAE,GAAG,CAAC,IAAI;aACf,EACD,oCAAoC,CACrC,CAAC;YAEF,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;YACjB,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC;YAClD,6DAA6D;YAC7D,8CAA8C;YAC9C,GAAG,CAAC,IAAI,GAAG;gBACT,KAAK,EAAE,qBAAqB;gBAC5B,iBAAiB,EACf,kDAAkD;gBACpD,WAAW,EAAE,MAAM,CAAC,UAAU;aAC/B,CAAC;YACF,OAAO;QACT,CAAC;QAED,OAAO,IAAI,EAAE,CAAC;IAChB,CAAC,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,sCAAsC;AACtC,8EAA8E;AAE9E;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,oDAAoD,CAAC;AAE7F;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAoB;IACvD,GAAG,EAAE,GAAG;IACR,aAAa,EAAE,EAAE;CAClB,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,wBAAwB;IACtC,OAAO,KAAK,UAAU,kCAAkC,CAAC,GAAG,EAAE,IAAI;QAChE,sDAAsD;QACtD,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACtE,OAAO,IAAI,EAAE,CAAC;QAChB,CAAC;QAED,+DAA+D;QAC/D,kEAAkE;QAClE,uEAAuE;QACvE,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,IAA2C,CAAC;QACrE,MAAM,QAAQ,GAAG,IAAI,EAAE,SAAS,CAAC;QACjC,MAAM,SAAS,GACb,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;YACjD,CAAC,CAAC,QAAQ;YACV,CAAC,CAAC,SAAS,CAAC;QAEhB,kEAAkE;QAClE,mDAAmD;QACnD,MAAM,GAAG,GAAG,wBAAwB,GAAG,CAAC,EAAE,IAAI,SAAS,EAAE,CAAC;QAE1D,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,GAAG,EAAE,wBAAwB,CAAC,CAAC;QAEnE,kDAAkD;QAClD,GAAG,CAAC,GAAG,CAAC,mBAAmB,EAAE,MAAM,CAAC,wBAAwB,CAAC,GAAG,CAAC,CAAC,CAAC;QACnE,GAAG,CAAC,GAAG,CAAC,uBAAuB,EAAE,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;QAE3D,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,MAAM,CAAC,IAAI,CACT;gBACE,MAAM,EAAE,mCAAmC;gBAC3C,EAAE,EAAE,GAAG,CAAC,EAAE;gBACV,QAAQ,EAAE,SAAS;gBACnB,IAAI,EAAE,GAAG,CAAC,IAAI;aACf,EACD,4CAA4C,CAC7C,CAAC;YAEF,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;YACjB,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC;YAClD,kEAAkE;YAClE,8CAA8C;YAC9C,GAAG,CAAC,IAAI,GAAG;gBACT,KAAK,EAAE,qBAAqB;gBAC5B,iBAAiB,EACf,0DAA0D;gBAC5D,WAAW,EAAE,MAAM,CAAC,UAAU;aAC/B,CAAC;YACF,OAAO;QACT,CAAC;QAED,OAAO,IAAI,EAAE,CAAC;IAChB,CAAC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"token-rate-limiter.js","sourceRoot":"","sources":["../../src/middleware/token-rate-limiter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAGH,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAEzD,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAE1C,8EAA8E;AAC9E,6DAA6D;AAC7D,8EAA8E;AAE9E;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,+BAA+B,CAAC;AAEhE,+EAA+E;AAC/E,MAAM,qBAAqB,GAAG,GAAG,CAAC;AAElC;;;;;;;;;;;;;GAaG;AACH,SAAS,iBAAiB,CAAC,GAAY;IACrC,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,IAA2C,CAAC;IACrE,MAAM,YAAY,GAAG,IAAI,EAAE,CAAC,WAAW,CAAC,CAAC;IACzC,IACE,OAAO,YAAY,KAAK,QAAQ;QAChC,YAAY,CAAC,MAAM,GAAG,CAAC;QACvB,YAAY,CAAC,MAAM,IAAI,qBAAqB,EAC5C,CAAC;QACD,OAAO,YAAY,CAAC;IACtB,CAAC;IACD,MAAM,aAAa,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC;IAChD,IACE,aAAa,KAAK,SAAS;QAC3B,aAAa,CAAC,MAAM,GAAG,CAAC;QACxB,aAAa,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,KAAK,QAAQ,EACpD,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC/E,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACvC,MAAM,QAAQ,GAAG,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAClE,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,QAAQ,CAAC,MAAM,IAAI,qBAAqB;YAAE,OAAO,QAAQ,CAAC;IACvF,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAoB;IAC/C,GAAG,EAAE,EAAE;IACP,aAAa,EAAE,GAAG;CACnB,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAoB;IAClD,GAAG,EAAE,GAAG;IACR,aAAa,EAAE,GAAG;CACnB,CAAC;AAEF;;;;;;GAMG;AACH,SAAS,eAAe,CAAC,GAAY,EAAE,UAAkB,EAAE,WAAmB;IAC5E,2EAA2E;IAC3E,6EAA6E;IAC7E,6EAA6E;IAC7E,sDAAsD;IACtD,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC;IAClC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,GAAG,CAAC,GAAG,CAAC,6BAA6B,EAAE,MAAM,CAAC,CAAC;QAC/C,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAC5B,CAAC;IACD,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;IACjB,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC;IAC3C,GAAG,CAAC,IAAI,GAAG;QACT,KAAK,EAAE,qBAAqB;QAC5B,iBAAiB,EAAE,WAAW;QAC9B,WAAW,EAAE,UAAU;KACxB,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,qBAAqB;AACrB,8EAA8E;AAE9E;;;;;;;;;GASG;AACH,MAAM,UAAU,gBAAgB;IAC9B,OAAO,KAAK,UAAU,0BAA0B,CAAC,GAAG,EAAE,IAAI;QACxD,kEAAkE;QAClE,oDAAoD;QACpD,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9D,OAAO,IAAI,EAAE,CAAC;QAChB,CAAC;QAED,wEAAwE;QACxE,2EAA2E;QAC3E,MAAM,SAAS,GAAG,MAAM,cAAc,CAAC,sBAAsB,GAAG,CAAC,EAAE,EAAE,EAAE,mBAAmB,CAAC,CAAC;QAC5F,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;YACvB,MAAM,CAAC,IAAI,CACT,EAAE,MAAM,EAAE,8BAA8B,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,EACtE,2CAA2C,CAC5C,CAAC;YACF,eAAe,CACb,GAAG,EACH,SAAS,CAAC,UAAU,EACpB,kDAAkD,CACnD,CAAC;YACF,OAAO;QACT,CAAC;QAED,MAAM,SAAS,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;QAEzC,mEAAmE;QACnE,MAAM,GAAG,GAAG,mBAAmB,GAAG,CAAC,EAAE,IAAI,SAAS,EAAE,CAAC;QAErD,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC;QAE3D,oEAAoE;QACpE,wDAAwD;QACxD,GAAG,CAAC,GAAG,CAAC,mBAAmB,EAAE,MAAM,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC;QAC3D,GAAG,CAAC,GAAG,CAAC,uBAAuB,EAAE,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;QAE3D,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,MAAM,CAAC,IAAI,CACT;gBACE,MAAM,EAAE,2BAA2B;gBACnC,EAAE,EAAE,GAAG,CAAC,EAAE;gBACV,QAAQ,EAAE,SAAS;gBACnB,IAAI,EAAE,GAAG,CAAC,IAAI;aACf,EACD,oCAAoC,CACrC,CAAC;YACF,eAAe,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,EAAE,kDAAkD,CAAC,CAAC;YAC5F,OAAO;QACT,CAAC;QAED,OAAO,IAAI,EAAE,CAAC;IAChB,CAAC,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,sCAAsC;AACtC,8EAA8E;AAE9E;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,8CAA8C,CAAC;AAEvF;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAoB;IACvD,GAAG,EAAE,GAAG;IACR,aAAa,EAAE,EAAE;CAClB,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAoB;IAC1D,GAAG,EAAE,GAAG;IACR,aAAa,EAAE,EAAE;CAClB,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,wBAAwB;IACtC,OAAO,KAAK,UAAU,kCAAkC,CAAC,GAAG,EAAE,IAAI;QAChE,sDAAsD;QACtD,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACtE,OAAO,IAAI,EAAE,CAAC;QAChB,CAAC;QAED,wEAAwE;QACxE,+DAA+D;QAC/D,MAAM,SAAS,GAAG,MAAM,cAAc,CACpC,2BAA2B,GAAG,CAAC,EAAE,EAAE,EACnC,2BAA2B,CAC5B,CAAC;QACF,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;YACvB,MAAM,CAAC,IAAI,CACT,EAAE,MAAM,EAAE,sCAAsC,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,EAC9E,mDAAmD,CACpD,CAAC;YACF,eAAe,CACb,GAAG,EACH,SAAS,CAAC,UAAU,EACpB,0DAA0D,CAC3D,CAAC;YACF,OAAO;QACT,CAAC;QAED,MAAM,SAAS,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;QAEzC,kEAAkE;QAClE,mDAAmD;QACnD,MAAM,GAAG,GAAG,wBAAwB,GAAG,CAAC,EAAE,IAAI,SAAS,EAAE,CAAC;QAE1D,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,GAAG,EAAE,wBAAwB,CAAC,CAAC;QAEnE,kDAAkD;QAClD,GAAG,CAAC,GAAG,CAAC,mBAAmB,EAAE,MAAM,CAAC,wBAAwB,CAAC,GAAG,CAAC,CAAC,CAAC;QACnE,GAAG,CAAC,GAAG,CAAC,uBAAuB,EAAE,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;QAE3D,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,MAAM,CAAC,IAAI,CACT;gBACE,MAAM,EAAE,mCAAmC;gBAC3C,EAAE,EAAE,GAAG,CAAC,EAAE;gBACV,QAAQ,EAAE,SAAS;gBACnB,IAAI,EAAE,GAAG,CAAC,IAAI;aACf,EACD,4CAA4C,CAC7C,CAAC;YACF,eAAe,CACb,GAAG,EACH,MAAM,CAAC,UAAU,EACjB,0DAA0D,CAC3D,CAAC;YACF,OAAO;QACT,CAAC;QAED,OAAO,IAAI,EAAE,CAAC;IAChB,CAAC,CAAC;AACJ,CAAC"}

package/dist/oidc/account-finder.d.ts

@@ -11,13 +11,13 @@
  *
  * Claims flow:
  * 1. buildUserClaims(user, scopes) → standard OIDC claims (sub, name, email...)
- * 2. buildRoleClaims(userId) → role slugs array (cache-first)
- * 3. buildPermissionClaims(userId) → permission slugs array (cache-first)
+ * 2. buildRoleClaims(userId, appId) → application-owned role slugs
+ * 3. buildPermissionClaims(userId, appId) → application-owned permission slugs
  * 4. buildCustomClaims(userId, appId, tokenType) → custom per-app claims
  *
- * The applicationId for custom claims is resolved from the OIDC client
- * context. If unavailable (e.g., no client context), custom claims are
- * skipped gracefully.
+ * The applicationId for RBAC and custom claims is resolved from private OIDC
+ * client metadata. If it is unavailable or malformed, authority fails closed:
+ * RBAC arrays are empty and custom claims are skipped while standard claims remain.
  *
  * @see users/service.ts — User lookup for OIDC
  * @see users/claims.ts — Standard OIDC claims builder

package/dist/oidc/account-finder.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"account-finder.d.ts","sourceRoot":"","sources":["../../src/oidc/account-finder.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AASH,0EAA0E;AAC1E,MAAM,WAAW,WAAW;IAC1B,yCAAyC;IACzC,SAAS,EAAE,MAAM,CAAC;IAClB;;;;;OAKG;IACH,MAAM,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CAC1E;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,WAAW,CAC/B,GAAG,EAAE,OAAO,EACZ,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC,CAmDlC"}
+{"version":3,"file":"account-finder.d.ts","sourceRoot":"","sources":["../../src/oidc/account-finder.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAeH,0EAA0E;AAC1E,MAAM,WAAW,WAAW;IAC1B,yCAAyC;IACzC,SAAS,EAAE,MAAM,CAAC;IAClB;;;;;OAKG;IACH,MAAM,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CAC1E;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,WAAW,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC,CAsD7F"}

package/dist/oidc/account-finder.js

@@ -11,24 +11,29 @@
  *
  * Claims flow:
  * 1. buildUserClaims(user, scopes) → standard OIDC claims (sub, name, email...)
- * 2. buildRoleClaims(userId) → role slugs array (cache-first)
- * 3. buildPermissionClaims(userId) → permission slugs array (cache-first)
+ * 2. buildRoleClaims(userId, appId) → application-owned role slugs
+ * 3. buildPermissionClaims(userId, appId) → application-owned permission slugs
  * 4. buildCustomClaims(userId, appId, tokenType) → custom per-app claims
  *
- * The applicationId for custom claims is resolved from the OIDC client
- * context. If unavailable (e.g., no client context), custom claims are
- * skipped gracefully.
+ * The applicationId for RBAC and custom claims is resolved from private OIDC
+ * client metadata. If it is unavailable or malformed, authority fails closed:
+ * RBAC arrays are empty and custom claims are skipped while standard claims remain.
  *
  * @see users/service.ts — User lookup for OIDC
  * @see users/claims.ts — Standard OIDC claims builder
  * @see rbac/user-role-service.ts — RBAC claims builders
  * @see custom-claims/service.ts — Custom claims builder
  */
+import { z } from 'zod';
 import { findUserForOidc } from '../users/service.js';
 import { buildUserClaims } from '../users/claims.js';
 import { buildRoleClaims, buildPermissionClaims } from '../rbac/user-role-service.js';
 import { buildCustomClaims } from '../custom-claims/service.js';
 import { logger } from '../lib/logger.js';
+/** Accepts only database-style UUIDs at the provider metadata trust boundary. */
+const applicationIdSchema = z.string().uuid();
+/** Private provider metadata key carrying the client application's database identity. */
+const INTERNAL_APPLICATION_ID = 'urn:porta:internal_application_id';
 /**
  * Find an OIDC account by subject identifier (user ID).
  *
@@ -61,14 +66,16 @@ export async function findAccount(ctx, sub) {
                 const scopes = scope ? scope.split(' ') : [];
                 // 1. Standard OIDC claims (scope-filtered)
                 const standardClaims = buildUserClaims(user, scopes);
-                // 2. RBAC claims (always included — cache-first resolution)
-                const [roles, permissions] = await Promise.all([
-                    buildRoleClaims(user.id),
-                    buildPermissionClaims(user.id),
-                ]);
-                // 3. Custom claims (per-application, filtered by token type)
-                // Resolve applicationId from the OIDC client context if available
+                // Resolve the application once so every application-owned claim uses the same boundary.
                 const applicationId = resolveApplicationId(ctx);
+                // Missing client context must not fall back to a union of authority from every application.
+                const [roles, permissions] = applicationId
+                    ? await Promise.all([
+                        buildRoleClaims(user.id, applicationId),
+                        buildPermissionClaims(user.id, applicationId),
+                    ])
+                    : [[], []];
+                // 3. Custom claims (per-application, filtered by token type)
                 let customClaims = {};
                 if (applicationId) {
                     // Map OIDC 'use' parameter to our TokenType
@@ -93,23 +100,24 @@ export async function findAccount(ctx, sub) {
 /**
  * Resolve the applicationId from the OIDC context.
  *
- * The OIDC provider passes the Koa context which includes the client
- * object at ctx.oidc.client. The client has an applicationId stored
- * in its metadata. Returns null if the context doesn't have the
- * expected structure (graceful fallback).
+ * The OIDC provider passes the Koa context which includes the client object at
+ * `ctx.oidc.client`. Only a valid UUID from Porta's internal metadata is accepted.
+ * Missing or malformed metadata returns null so authority fails closed.
  *
  * @param ctx - Koa context with OIDC extensions
  * @returns Application UUID or null if not resolvable
  */
 function resolveApplicationId(ctx) {
-    try {
-        // Navigate the OIDC context structure: ctx.oidc.client.applicationId
-        const oidcCtx = ctx;
-        return oidcCtx?.oidc?.client?.applicationId ?? null;
-    }
-    catch {
+    if (typeof ctx !== 'object' || ctx === null)
         return null;
-    }
+    const oidc = Reflect.get(ctx, 'oidc');
+    if (typeof oidc !== 'object' || oidc === null)
+        return null;
+    const client = Reflect.get(oidc, 'client');
+    if (typeof client !== 'object' || client === null)
+        return null;
+    const parsed = applicationIdSchema.safeParse(Reflect.get(client, INTERNAL_APPLICATION_ID));
+    return parsed.success ? parsed.data : null;
 }
 /**
  * Map the OIDC 'use' parameter to our TokenType enum.

package/dist/oidc/account-finder.js.map

@@ -1 +1 @@
-{"version":3,"file":"account-finder.js","sourceRoot":"","sources":["../../src/oidc/account-finder.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EAAE,eAAe,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AACtF,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAChE,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAgB1C;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,GAAY,EACZ,GAAW;IAEX,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,GAAG,CAAC,CAAC;QACxC,IAAI,CAAC,IAAI;YAAE,OAAO,SAAS,CAAC;QAE5B,OAAO;YACL,SAAS,EAAE,IAAI,CAAC,EAAE;YAClB;;;;;;;eAOG;YACH,KAAK,CAAC,MAAM,CAAC,GAAW,EAAE,KAAa;gBACrC,gDAAgD;gBAChD,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBAE7C,2CAA2C;gBAC3C,MAAM,cAAc,GAAG,eAAe,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;gBAErD,4DAA4D;gBAC5D,MAAM,CAAC,KAAK,EAAE,WAAW,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;oBAC7C,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC;oBACxB,qBAAqB,CAAC,IAAI,CAAC,EAAE,CAAC;iBAC/B,CAAC,CAAC;gBAEH,6DAA6D;gBAC7D,kEAAkE;gBAClE,MAAM,aAAa,GAAG,oBAAoB,CAAC,GAAG,CAAC,CAAC;gBAChD,IAAI,YAAY,GAA4B,EAAE,CAAC;gBAC/C,IAAI,aAAa,EAAE,CAAC;oBAClB,4CAA4C;oBAC5C,MAAM,SAAS,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;oBACzC,YAAY,GAAG,MAAM,iBAAiB,CAAC,IAAI,CAAC,EAAE,EAAE,aAAa,EAAE,SAAS,CAAC,CAAC;gBAC5E,CAAC;gBAED,mEAAmE;gBACnE,OAAO;oBACL,GAAG,cAAc;oBACjB,KAAK;oBACL,WAAW;oBACX,GAAG,YAAY;iBAChB,CAAC;YACJ,CAAC;SACF,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,gCAAgC,CAAC,CAAC;QAC/D,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,oBAAoB,CAAC,GAAY;IACxC,IAAI,CAAC;QACH,qEAAqE;QACrE,MAAM,OAAO,GAAG,GAAyD,CAAC;QAC1E,OAAO,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,aAAa,IAAI,IAAI,CAAC;IACtD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,iBAAiB,CAAC,GAAW;IACpC,QAAQ,GAAG,EAAE,CAAC;QACZ,KAAK,UAAU;YACb,OAAO,UAAU,CAAC;QACpB,KAAK,UAAU;YACb,OAAO,UAAU,CAAC;QACpB;YACE,2DAA2D;YAC3D,OAAO,cAAc,CAAC;IAC1B,CAAC;AACH,CAAC"}
+{"version":3,"file":"account-finder.js","sourceRoot":"","sources":["../../src/oidc/account-finder.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EAAE,eAAe,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AACtF,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAChE,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAE1C,iFAAiF;AACjF,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC;AAE9C,yFAAyF;AACzF,MAAM,uBAAuB,GAAG,mCAAmC,CAAC;AAepE;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,GAAY,EAAE,GAAW;IACzD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,GAAG,CAAC,CAAC;QACxC,IAAI,CAAC,IAAI;YAAE,OAAO,SAAS,CAAC;QAE5B,OAAO;YACL,SAAS,EAAE,IAAI,CAAC,EAAE;YAClB;;;;;;;eAOG;YACH,KAAK,CAAC,MAAM,CAAC,GAAW,EAAE,KAAa;gBACrC,gDAAgD;gBAChD,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBAE7C,2CAA2C;gBAC3C,MAAM,cAAc,GAAG,eAAe,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;gBAErD,wFAAwF;gBACxF,MAAM,aAAa,GAAG,oBAAoB,CAAC,GAAG,CAAC,CAAC;gBAEhD,4FAA4F;gBAC5F,MAAM,CAAC,KAAK,EAAE,WAAW,CAAC,GAAG,aAAa;oBACxC,CAAC,CAAC,MAAM,OAAO,CAAC,GAAG,CAAC;wBAChB,eAAe,CAAC,IAAI,CAAC,EAAE,EAAE,aAAa,CAAC;wBACvC,qBAAqB,CAAC,IAAI,CAAC,EAAE,EAAE,aAAa,CAAC;qBAC9C,CAAC;oBACJ,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;gBAEb,6DAA6D;gBAC7D,IAAI,YAAY,GAA4B,EAAE,CAAC;gBAC/C,IAAI,aAAa,EAAE,CAAC;oBAClB,4CAA4C;oBAC5C,MAAM,SAAS,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;oBACzC,YAAY,GAAG,MAAM,iBAAiB,CAAC,IAAI,CAAC,EAAE,EAAE,aAAa,EAAE,SAAS,CAAC,CAAC;gBAC5E,CAAC;gBAED,mEAAmE;gBACnE,OAAO;oBACL,GAAG,cAAc;oBACjB,KAAK;oBACL,WAAW;oBACX,GAAG,YAAY;iBAChB,CAAC;YACJ,CAAC;SACF,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,gCAAgC,CAAC,CAAC;QAC/D,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,oBAAoB,CAAC,GAAY;IACxC,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACzD,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IACtC,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC3D,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAC3C,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAE/D,MAAM,MAAM,GAAG,mBAAmB,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,uBAAuB,CAAC,CAAC,CAAC;IAC3F,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AAC7C,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,iBAAiB,CAAC,GAAW;IACpC,QAAQ,GAAG,EAAE,CAAC;QACZ,KAAK,UAAU;YACb,OAAO,UAAU,CAAC;QACpB,KAAK,UAAU;YACb,OAAO,UAAU,CAAC;QACpB;YACE,2DAA2D;YAC3D,OAAO,cAAc,CAAC;IAC1B,CAAC;AACH,CAAC"}

package/dist/oidc/adapter-factory.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"adapter-factory.d.ts","sourceRoot":"","sources":["../../src/oidc/adapter-factory.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,eAAe,EAAqB,MAAM,uBAAuB,CAAC;AAC3E,OAAO,EAAE,YAAY,EAAsB,MAAM,oBAAoB,CAAC;AAGtE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAE5D;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,YAAY,aAOvB,CAAC;AAEH;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAElD;AAED;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB;eAad,MAAM;QANxB,mDAAmD;kBAClC,eAAe,GAAG,YAAY;QAE/C,wDAAwD;cAC3C,MAAM;QAanB,wCAAwC;mBACvB,MAAM,WAAW,cAAc,aAAa,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;QAInF;;;;;;WAMG;iBACY,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC;QAO3D,kDAAkD;iCACnB,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC;QAI3E,yCAAyC;uBACpB,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC;QAIjE,mCAAmC;oBACjB,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;QAIxC;;;;;;;;;;;;WAYG;oBACe,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;QAgDxC,6CAA6C;iCACd,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;;EAIxD"}
+{"version":3,"file":"adapter-factory.d.ts","sourceRoot":"","sources":["../../src/oidc/adapter-factory.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,eAAe,EAAqB,MAAM,uBAAuB,CAAC;AAC3E,OAAO,EAAE,YAAY,EAAsB,MAAM,oBAAoB,CAAC;AAItE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAwG5D;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,YAAY,aAOvB,CAAC;AAEH;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAElD;AAED;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB;eAad,MAAM;QANxB,mDAAmD;kBAClC,eAAe,GAAG,YAAY;QAE/C,wDAAwD;cAC3C,MAAM;QAanB,wCAAwC;mBACvB,MAAM,WAAW,cAAc,aAAa,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;QAInF;;;;;;WAMG;iBACY,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC;QAQ3D,kDAAkD;iCACnB,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC;QAK3E,yCAAyC;uBACpB,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC;QAKjE,mCAAmC;oBACjB,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;QAIxC;;;;;;;;;;;;WAYG;oBACe,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;QA6CxC,6CAA6C;iCACd,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;;EAIxD"}

package/dist/oidc/adapter-factory.js

@@ -18,7 +18,84 @@
 import { PostgresAdapter, revokeGrantsByIds } from './postgres-adapter.js';
 import { RedisAdapter, cleanupRedisGrants } from './redis-adapter.js';
 import { findForOidc } from '../clients/service.js';
+import { getPool } from '../lib/database.js';
 import { logger } from '../lib/logger.js';
+/** Return true when a value is a plain object suitable for safe field inspection. */
+function isRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+/** Add a non-empty string field to an authority-reference set. */
+function addStringReference(target, value) {
+    if (typeof value === 'string' && value.length > 0)
+        target.add(value);
+}
+/**
+ * Extract every database-backed identifier carried by an OIDC payload.
+ *
+ * Session authorization maps use public client IDs as keys, so they must be
+ * checked in addition to the top-level fields shared by other artifacts.
+ */
+function collectAuthorityReferences(payload) {
+    const references = {
+        clientIds: new Set(),
+        userIds: new Set(),
+        grantIds: new Set(),
+    };
+    addStringReference(references.clientIds, payload.clientId);
+    addStringReference(references.userIds, payload.accountId);
+    addStringReference(references.grantIds, payload.grantId);
+    if (isRecord(payload.authorizations)) {
+        for (const [clientId, authorization] of Object.entries(payload.authorizations)) {
+            addStringReference(references.clientIds, clientId);
+            if (isRecord(authorization)) {
+                addStringReference(references.grantIds, authorization.grantId);
+            }
+        }
+    }
+    return references;
+}
+/**
+ * Verify cached OIDC references against current PostgreSQL authority.
+ *
+ * One set-based query checks all identifiers. Invalid UUID-shaped user IDs
+ * simply fail the text comparison instead of causing a PostgreSQL cast error.
+ * A database failure propagates so callers fail closed rather than accepting
+ * an artifact whose authority could not be established.
+ */
+async function hasLiveAuthority(payload) {
+    const references = collectAuthorityReferences(payload);
+    if (references.clientIds.size === 0 &&
+        references.userIds.size === 0 &&
+        references.grantIds.size === 0) {
+        return true;
+    }
+    const result = await getPool().query(`SELECT
+       NOT EXISTS (
+         SELECT 1
+         FROM unnest($1::text[]) AS requested(client_id)
+         LEFT JOIN clients AS client
+           ON client.client_id = requested.client_id AND client.status = 'active'
+         WHERE client.id IS NULL
+       ) AS "clientsLive",
+       NOT EXISTS (
+         SELECT 1
+         FROM unnest($2::text[]) AS requested(user_id)
+         LEFT JOIN users AS account
+           ON account.id::text = requested.user_id AND account.status = 'active'
+         WHERE account.id IS NULL
+       ) AS "usersLive",
+       NOT EXISTS (
+         SELECT 1
+         FROM unnest($3::text[]) AS requested(grant_id)
+         LEFT JOIN oidc_payloads AS grant_payload
+           ON grant_payload.id = requested.grant_id
+          AND grant_payload.type = 'Grant'
+          AND (grant_payload.expires_at IS NULL OR grant_payload.expires_at > NOW())
+         WHERE grant_payload.id IS NULL
+       ) AS "grantsLive"`, [[...references.clientIds], [...references.userIds], [...references.grantIds]]);
+    const authority = result.rows[0];
+    return Boolean(authority?.clientsLive && authority.usersLive && authority.grantsLive);
+}
 /**
  * Models routed to Redis for performance.
  *
@@ -93,15 +170,18 @@ export function createAdapterFactory() {
             if (this.name === 'Client') {
                 return findForOidc(id);
             }
-            return this.delegate.find(id);
+            const payload = await this.delegate.find(id);
+            return payload && (await hasLiveAuthority(payload)) ? payload : undefined;
         }
         /** Find an artifact by user code (device flow) */
         async findByUserCode(userCode) {
-            return this.delegate.findByUserCode(userCode);
+            const payload = await this.delegate.findByUserCode(userCode);
+            return payload && (await hasLiveAuthority(payload)) ? payload : undefined;
         }
         /** Find an artifact by UID (sessions) */
         async findByUid(uid) {
-            return this.delegate.findByUid(uid);
+            const payload = await this.delegate.findByUid(uid);
+            return payload && (await hasLiveAuthority(payload)) ? payload : undefined;
         }
         /** Mark an artifact as consumed */
         async consume(id) {

package/dist/oidc/adapter-factory.js.map

@@ -1 +1 @@
-{"version":3,"file":"adapter-factory.js","sourceRoot":"","sources":["../../src/oidc/adapter-factory.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC3E,OAAO,EAAE,YAAY,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACtE,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACpD,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAG1C;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC;IAClC,SAAS;IACT,aAAa;IACb,mBAAmB;IACnB,iBAAiB;IACjB,mBAAmB;IACnB,4BAA4B;CAC7B,CAAC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,UAAU,YAAY,CAAC,IAAY;IACvC,OAAO,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AAChC,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,oBAAoB;IAClC;;;;OAIG;IACH,OAAO,MAAM,aAAa;QACxB,mDAAmD;QAC5C,QAAQ,CAAiC;QAEhD,wDAAwD;QACjD,IAAI,CAAS;QAEpB,YAAY,IAAY;YACtB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;YAEjB,2DAA2D;YAC3D,IAAI,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC3B,IAAI,CAAC,QAAQ,GAAG,IAAI,YAAY,CAAC,IAAI,CAAC,CAAC;YACzC,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,QAAQ,GAAG,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC;YAC5C,CAAC;QACH,CAAC;QAED,wCAAwC;QACxC,KAAK,CAAC,MAAM,CAAC,EAAU,EAAE,OAAuB,EAAE,SAAiB;YACjE,OAAO,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;QACtD,CAAC;QAED;;;;;;WAMG;QACH,KAAK,CAAC,IAAI,CAAC,EAAU;YACnB,IAAI,IAAI,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC3B,OAAO,WAAW,CAAC,EAAE,CAAwC,CAAC;YAChE,CAAC;YACD,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAChC,CAAC;QAED,kDAAkD;QAClD,KAAK,CAAC,cAAc,CAAC,QAAgB;YACnC,OAAO,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;QAChD,CAAC;QAED,yCAAyC;QACzC,KAAK,CAAC,SAAS,CAAC,GAAW;YACzB,OAAO,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QACtC,CAAC;QAED,mCAAmC;QACnC,KAAK,CAAC,OAAO,CAAC,EAAU;YACtB,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACnC,CAAC;QAED;;;;;;;;;;;;WAYG;QACH,KAAK,CAAC,OAAO,CAAC,EAAU;YACtB,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;gBAC5B,IAAI,CAAC;oBACH,kEAAkE;oBAClE,mDAAmD;oBACnD,qCAAqC;oBACrC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;oBAC7C,IAAI,OAAO,EAAE,cAAc,EAAE,CAAC;wBAC5B,MAAM,QAAQ,GAAa,EAAE,CAAC;wBAC9B,MAAM,cAAc,GAAG,OAAO,CAAC,cAG9B,CAAC;wBACF,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,EAAE,CAAC;4BACjD,IAAI,IAAI,CAAC,OAAO;gCAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;wBAChD,CAAC;wBAED,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;4BACxB,qEAAqE;4BACrE,sEAAsE;4BACtE,2DAA2D;4BAC3D,MAAM,iBAAiB,CAAC,QAAQ,CAAC,CAAC;4BAElC,oEAAoE;4BACpE,4EAA4E;4BAC5E,MAAM,kBAAkB,CAAC,QAAQ,CAAC,CAAC;4BAEnC,MAAM,CAAC,IAAI,CACT,EAAE,SAAS,EAAE,EAAE,EAAE,QAAQ,EAAE,EAC3B,oDAAoD,CACrD,CAAC;wBACJ,CAAC;oBACH,CAAC;gBACH,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,6DAA6D;oBAC7D,gEAAgE;oBAChE,mCAAmC;oBACnC,MAAM,CAAC,KAAK,CACV,EAAE,GAAG,EAAE,SAAS,EAAE,EAAE,EAAE,EACtB,4EAA4E,CAC7E,CAAC;gBACJ,CAAC;YACH,CAAC;YAED,8DAA8D;YAC9D,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACnC,CAAC;QAED,6CAA6C;QAC7C,KAAK,CAAC,eAAe,CAAC,OAAe;YACnC,OAAO,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;QAChD,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"adapter-factory.js","sourceRoot":"","sources":["../../src/oidc/adapter-factory.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC3E,OAAO,EAAE,YAAY,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACtE,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACpD,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAC7C,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAiB1C,qFAAqF;AACrF,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,kEAAkE;AAClE,SAAS,kBAAkB,CAAC,MAAmB,EAAE,KAAc;IAC7D,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;AACvE,CAAC;AAED;;;;;GAKG;AACH,SAAS,0BAA0B,CAAC,OAAuB;IACzD,MAAM,UAAU,GAAwB;QACtC,SAAS,EAAE,IAAI,GAAG,EAAU;QAC5B,OAAO,EAAE,IAAI,GAAG,EAAU;QAC1B,QAAQ,EAAE,IAAI,GAAG,EAAU;KAC5B,CAAC;IAEF,kBAAkB,CAAC,UAAU,CAAC,SAAS,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC3D,kBAAkB,CAAC,UAAU,CAAC,OAAO,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;IAC1D,kBAAkB,CAAC,UAAU,CAAC,QAAQ,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IAEzD,IAAI,QAAQ,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,CAAC;QACrC,KAAK,MAAM,CAAC,QAAQ,EAAE,aAAa,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,CAAC;YAC/E,kBAAkB,CAAC,UAAU,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;YACnD,IAAI,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;gBAC5B,kBAAkB,CAAC,UAAU,CAAC,QAAQ,EAAE,aAAa,CAAC,OAAO,CAAC,CAAC;YACjE,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,UAAU,CAAC;AACpB,CAAC;AAED;;;;;;;GAOG;AACH,KAAK,UAAU,gBAAgB,CAAC,OAAuB;IACrD,MAAM,UAAU,GAAG,0BAA0B,CAAC,OAAO,CAAC,CAAC;IACvD,IACE,UAAU,CAAC,SAAS,CAAC,IAAI,KAAK,CAAC;QAC/B,UAAU,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC;QAC7B,UAAU,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC,EAC9B,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,OAAO,EAAE,CAAC,KAAK,CAClC;;;;;;;;;;;;;;;;;;;;;;;yBAuBqB,EACrB,CAAC,CAAC,GAAG,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC,GAAG,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,CAC/E,CAAC;IACF,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACjC,OAAO,OAAO,CAAC,SAAS,EAAE,WAAW,IAAI,SAAS,CAAC,SAAS,IAAI,SAAS,CAAC,UAAU,CAAC,CAAC;AACxF,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC;IAClC,SAAS;IACT,aAAa;IACb,mBAAmB;IACnB,iBAAiB;IACjB,mBAAmB;IACnB,4BAA4B;CAC7B,CAAC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,UAAU,YAAY,CAAC,IAAY;IACvC,OAAO,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AAChC,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,oBAAoB;IAClC;;;;OAIG;IACH,OAAO,MAAM,aAAa;QACxB,mDAAmD;QAC5C,QAAQ,CAAiC;QAEhD,wDAAwD;QACjD,IAAI,CAAS;QAEpB,YAAY,IAAY;YACtB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;YAEjB,2DAA2D;YAC3D,IAAI,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC3B,IAAI,CAAC,QAAQ,GAAG,IAAI,YAAY,CAAC,IAAI,CAAC,CAAC;YACzC,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,QAAQ,GAAG,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC;YAC5C,CAAC;QACH,CAAC;QAED,wCAAwC;QACxC,KAAK,CAAC,MAAM,CAAC,EAAU,EAAE,OAAuB,EAAE,SAAiB;YACjE,OAAO,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;QACtD,CAAC;QAED;;;;;;WAMG;QACH,KAAK,CAAC,IAAI,CAAC,EAAU;YACnB,IAAI,IAAI,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC3B,OAAO,WAAW,CAAC,EAAE,CAAwC,CAAC;YAChE,CAAC;YACD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAC7C,OAAO,OAAO,IAAI,CAAC,MAAM,gBAAgB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;QAC5E,CAAC;QAED,kDAAkD;QAClD,KAAK,CAAC,cAAc,CAAC,QAAgB;YACnC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;YAC7D,OAAO,OAAO,IAAI,CAAC,MAAM,gBAAgB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;QAC5E,CAAC;QAED,yCAAyC;QACzC,KAAK,CAAC,SAAS,CAAC,GAAW;YACzB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;YACnD,OAAO,OAAO,IAAI,CAAC,MAAM,gBAAgB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;QAC5E,CAAC;QAED,mCAAmC;QACnC,KAAK,CAAC,OAAO,CAAC,EAAU;YACtB,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACnC,CAAC;QAED;;;;;;;;;;;;WAYG;QACH,KAAK,CAAC,OAAO,CAAC,EAAU;YACtB,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;gBAC5B,IAAI,CAAC;oBACH,kEAAkE;oBAClE,mDAAmD;oBACnD,qCAAqC;oBACrC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;oBAC7C,IAAI,OAAO,EAAE,cAAc,EAAE,CAAC;wBAC5B,MAAM,QAAQ,GAAa,EAAE,CAAC;wBAC9B,MAAM,cAAc,GAAG,OAAO,CAAC,cAAsD,CAAC;wBACtF,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,EAAE,CAAC;4BACjD,IAAI,IAAI,CAAC,OAAO;gCAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;wBAChD,CAAC;wBAED,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;4BACxB,qEAAqE;4BACrE,sEAAsE;4BACtE,2DAA2D;4BAC3D,MAAM,iBAAiB,CAAC,QAAQ,CAAC,CAAC;4BAElC,oEAAoE;4BACpE,4EAA4E;4BAC5E,MAAM,kBAAkB,CAAC,QAAQ,CAAC,CAAC;4BAEnC,MAAM,CAAC,IAAI,CACT,EAAE,SAAS,EAAE,EAAE,EAAE,QAAQ,EAAE,EAC3B,oDAAoD,CACrD,CAAC;wBACJ,CAAC;oBACH,CAAC;gBACH,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,6DAA6D;oBAC7D,gEAAgE;oBAChE,mCAAmC;oBACnC,MAAM,CAAC,KAAK,CACV,EAAE,GAAG,EAAE,SAAS,EAAE,EAAE,EAAE,EACtB,4EAA4E,CAC7E,CAAC;gBACJ,CAAC;YACH,CAAC;YAED,8DAA8D;YAC9D,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACnC,CAAC;QAED,6CAA6C;QAC7C,KAAK,CAAC,eAAe,CAAC,OAAe;YACnC,OAAO,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;QAChD,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/oidc/configuration.d.ts

@@ -17,6 +17,7 @@
  */
 import type { OidcTtlConfig } from '../lib/system-config.js';
 import type { JwkKeyPair } from '../lib/signing-keys.js';
+import { type EffectiveBranding } from '../auth/effective-branding.js';
 import type { Organization } from '../organizations/types.js';
 /** Parameters required to build the provider configuration */
 export interface BuildProviderConfigParams {
@@ -48,13 +49,7 @@ export interface BuildProviderConfigParams {
  *
  * @returns Default branding with Porta's standard blue primary color
  */
-export declare function buildDefaultBranding(): {
-    logoUrl: string | null;
-    faviconUrl: string | null;
-    primaryColor: string;
-    companyName: string;
-    customCss: string | null;
-};
+export declare function buildDefaultBranding(): EffectiveBranding;
 /**
  * Best-effort organization resolution for oidc-provider rendering hooks.
  *
@@ -131,7 +126,7 @@ export declare function renderErrorHook(ctx: any, out: {
  * scopes, and `issueRefreshToken` returns false — so no refresh token is minted.
  * This is exactly the CLI failure ("no refresh_token available" ~1h later).
  *
- * The upgrade is strictly gated (AR-6 / AR-7): only when the request asked for
+ * The upgrade is strictly gated: it applies only when the request asked for
  * `offline_access`, the client allows the `refresh_token` grant, AND the grant
  * does not already include `offline_access`. In every other case the grant is
  * returned unchanged — identical to the provider default — so no other client

package/dist/oidc/configuration.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"configuration.d.ts","sourceRoot":"","sources":["../../src/oidc/configuration.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAC7D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAQzD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAG9D,8DAA8D;AAC9D,MAAM,WAAW,yBAAyB;IACxC,8DAA8D;IAC9D,GAAG,EAAE,aAAa,CAAC;IACnB,iDAAiD;IACjD,IAAI,EAAE;QAAE,IAAI,EAAE,UAAU,EAAE,CAAA;KAAE,CAAC;IAC7B,sEAAsE;IACtE,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,6DAA6D;IAC7D,WAAW,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;KAAE,GAAG,SAAS,CAAC,CAAC;IACjK,yEAAyE;IACzE,cAAc,EAAE,OAAO,CAAC;IACxB,sFAAsF;IACtF,cAAc,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,WAAW,EAAE;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,KAAK,MAAM,CAAC;IACvE,qEAAqE;IACrE,eAAe,CAAC,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,KAAK,OAAO,CAAC;CAC9E;AAMD;;;;;GAKG;AACH,wBAAgB,oBAAoB;IAEhC,OAAO,EAAU,MAAM,GAAG,IAAI;IAC9B,UAAU,EAAU,MAAM,GAAG,IAAI;IACjC,YAAY;IACZ,WAAW;IACX,SAAS,EAAU,MAAM,GAAG,IAAI;EAEnC;AAmBD;;;;;;;;;;;;GAYG;AACH,wBAAsB,yBAAyB,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC,CA8B/F;AAMD;;;;;;;;;;;;;GAaG;AAEH,wBAAsB,gBAAgB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAoD5E;AAED;;;;;;;;;;;GAWG;AAEH,wBAAsB,2BAA2B,CAAC,GAAG,EAAE,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,CAyBzE;AAkDD;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,eAAe,CAEnC,GAAG,EAAE,GAAG,EACR,GAAG,EAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,iBAAiB,CAAC,EAAE,MAAM,CAAA;CAAE,EAClD,MAAM,EAAE,KAAK,GACZ,OAAO,CAAC,IAAI,CAAC,CA0Df;AAMD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAsB,iBAAiB,CAErC,GAAG,EAAE,GAAG,GACP,OAAO,CAAC,OAAO,GAAG,SAAS,CAAC,CA8B9B;AAMD;;;;;;;;;GASG;AACH,wBAAgB,0BAA0B,CAAC,MAAM,EAAE,yBAAyB,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAyKrG"}
+{"version":3,"file":"configuration.d.ts","sourceRoot":"","sources":["../../src/oidc/configuration.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAC7D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAIzD,OAAO,EAGL,KAAK,iBAAiB,EACvB,MAAM,+BAA+B,CAAC;AAKvC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAG9D,8DAA8D;AAC9D,MAAM,WAAW,yBAAyB;IACxC,8DAA8D;IAC9D,GAAG,EAAE,aAAa,CAAC;IACnB,iDAAiD;IACjD,IAAI,EAAE;QAAE,IAAI,EAAE,UAAU,EAAE,CAAA;KAAE,CAAC;IAC7B,sEAAsE;IACtE,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,6DAA6D;IAC7D,WAAW,EAAE,CACX,GAAG,EAAE,OAAO,EACZ,GAAG,EAAE,MAAM,KACR,OAAO,CACR;QACE,SAAS,EAAE,MAAM,CAAC;QAClB,MAAM,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;KAC1E,GACD,SAAS,CACZ,CAAC;IACF,yEAAyE;IACzE,cAAc,EAAE,OAAO,CAAC;IACxB,sFAAsF;IACtF,cAAc,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,WAAW,EAAE;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,KAAK,MAAM,CAAC;IACvE,qEAAqE;IACrE,eAAe,CAAC,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,KAAK,OAAO,CAAC;CAC9E;AAMD;;;;;GAKG;AACH,wBAAgB,oBAAoB,IAAI,iBAAiB,CASxD;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,yBAAyB,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC,CA8B/F;AAMD;;;;;;;;;;;;;GAaG;AAEH,wBAAsB,gBAAgB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAoD5E;AAED;;;;;;;;;;;GAWG;AAEH,wBAAsB,2BAA2B,CAAC,GAAG,EAAE,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,CA0BzE;AAoDD;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,eAAe,CAEnC,GAAG,EAAE,GAAG,EACR,GAAG,EAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,iBAAiB,CAAC,EAAE,MAAM,CAAA;CAAE,EAClD,MAAM,EAAE,KAAK,GACZ,OAAO,CAAC,IAAI,CAAC,CAwDf;AAMD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAsB,iBAAiB,CAErC,GAAG,EAAE,GAAG,GACP,OAAO,CAAC,OAAO,GAAG,SAAS,CAAC,CA6B9B;AAMD;;;;;;;;;GASG;AACH,wBAAgB,0BAA0B,CACxC,MAAM,EAAE,yBAAyB,GAChC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAuMzB"}