@portaidentity/server 1.7.3 → 1.9.0

package/dist/oidc/configuration.js

@@ -16,8 +16,9 @@
  * - Cookie signing with rotation support
  */
 import { config } from '../config/index.js';
-import { HTML_CSP } from '../middleware/security-headers.js';
+import { buildHtmlCsp, HTML_CSP } from '../middleware/security-headers.js';
 import { renderPage } from '../auth/template-engine.js';
+import { DEFAULT_BRANDING_PRIMARY_COLOR, resolveEffectiveBranding, } from '../auth/effective-branding.js';
 import { resolveLocale, getTranslationFunction } from '../auth/i18n.js';
 import { logger } from '../lib/logger.js';
 import { getUserById } from '../users/service.js';
@@ -36,25 +37,10 @@ export function buildDefaultBranding() {
     return {
         logoUrl: null,
         faviconUrl: null,
-        primaryColor: '#3B82F6',
+        primaryColor: DEFAULT_BRANDING_PRIMARY_COLOR,
         companyName: '',
         customCss: null,
-    };
-}
-/**
- * Build branding context from a resolved organization.
- * Maps Organization entity fields to the TemplateContext branding shape.
- *
- * @param org - The resolved organization
- * @returns Branding object for TemplateContext
- */
-function buildBrandingFromOrg(org) {
-    return {
-        logoUrl: org.brandingLogoUrl,
-        faviconUrl: org.brandingFaviconUrl,
-        primaryColor: org.brandingPrimaryColor ?? '#3B82F6',
-        companyName: org.brandingCompanyName ?? org.name,
-        customCss: org.brandingCustomCss,
+        imageSources: [],
     };
 }
 /**
@@ -123,7 +109,7 @@ export async function logoutSourceHook(ctx, form) {
     try {
         // Resolve org for branding (best-effort, defaults on failure)
         const org = await resolveOrgForProviderHook(ctx);
-        const branding = org ? buildBrandingFromOrg(org) : buildDefaultBranding();
+        const branding = org ? await resolveEffectiveBranding(org) : buildDefaultBranding();
         // Resolve locale and translation function
         const locale = await resolveLocale(undefined, undefined, org?.defaultLocale ?? '');
         const t = getTranslationFunction(locale, org?.slug);
@@ -153,7 +139,7 @@ export async function logoutSourceHook(ctx, form) {
             returnUrl: returnUrl ?? null,
         });
         ctx.type = 'text/html';
-        ctx.set('Content-Security-Policy', HTML_CSP);
+        ctx.set('Content-Security-Policy', buildHtmlCsp(branding.imageSources));
         ctx.body = html;
     }
     catch (err) {
@@ -193,14 +179,15 @@ export async function postLogoutSuccessSourceHook(ctx) {
             orgSlug: '',
         });
         ctx.type = 'text/html';
-        ctx.set('Content-Security-Policy', HTML_CSP);
+        ctx.set('Content-Security-Policy', buildHtmlCsp(branding.imageSources));
         ctx.body = html;
     }
     catch (err) {
         logger.error({ err }, 'Failed to render custom post-logout page');
         ctx.type = 'text/html';
         ctx.set('Content-Security-Policy', HTML_CSP);
-        ctx.body = '<!DOCTYPE html><html><body><h1>Signed out</h1><p>You have been signed out successfully.</p></body></html>';
+        ctx.body =
+            '<!DOCTYPE html><html><body><h1>Signed out</h1><p>You have been signed out successfully.</p></body></html>';
     }
 }
 /**
@@ -232,7 +219,7 @@ function isSessionNotFoundError(out, error) {
  *
  * Resolves the session cookie name from the provider (defaulting to
  * `_session`) and delegates to the shared, signing-free `clearSessionCookies`
- * helper so the middleware and this hook use one tested code path (PF-002).
+ * helper so the middleware and this hook use one tested code path.
  *
  * @param ctx - oidc-provider's enhanced Koa context
  */
@@ -240,7 +227,9 @@ function clearProviderSessionCookies(
 // eslint-disable-next-line @typescript-eslint/no-explicit-any
 ctx) {
     const cookieNameFn = ctx?.oidc?.provider?.cookieName;
-    const sessionCookieName = typeof cookieNameFn === 'function' ? cookieNameFn.call(ctx.oidc.provider, 'session') : '_session';
+    const sessionCookieName = typeof cookieNameFn === 'function'
+        ? cookieNameFn.call(ctx.oidc.provider, 'session')
+        : '_session';
     clearSessionCookies(ctx, sessionCookieName);
 }
 /**
@@ -265,12 +254,12 @@ ctx, out, _error) {
     try {
         // Resolve org from client context for branding (best-effort)
         const org = await resolveOrgForProviderHook(ctx);
-        const branding = org ? buildBrandingFromOrg(org) : buildDefaultBranding();
+        const branding = org ? await resolveEffectiveBranding(org) : buildDefaultBranding();
         // Resolve locale and translation function
         const locale = await resolveLocale(undefined, undefined, org?.defaultLocale ?? '');
         const t = getTranslationFunction(locale, org?.slug);
         // ---------------------------------------------------------------------
-        // Graceful SessionNotFound recovery (Bug #1, AR-4).
+        // Gracefully recover when the provider cannot resolve its session.
         //
         // node-oidc-provider throws `SessionNotFound` during authorize/resume when
         // the interaction's recorded session uid no longer matches the live session
@@ -290,9 +279,7 @@ ctx, out, _error) {
         if (isSessionNotFound) {
             clearProviderSessionCookies(ctx);
         }
-        const errorMessage = isSessionNotFound
-            ? t('errors.session_expired')
-            : t('errors.generic');
+        const errorMessage = isSessionNotFound ? t('errors.session_expired') : t('errors.generic');
         // SECURITY: Never expose raw error_description to the user — it may
         // contain internal details. Use generic i18n message instead.
         // OIDC error codes (e.g., 'invalid_client') are safe standard strings.
@@ -306,7 +293,7 @@ ctx, out, _error) {
             errorCode: out.error,
         });
         ctx.type = 'text/html';
-        ctx.set('Content-Security-Policy', HTML_CSP);
+        ctx.set('Content-Security-Policy', buildHtmlCsp(branding.imageSources));
         ctx.body = html;
     }
     catch (err) {
@@ -333,7 +320,7 @@ ctx, out, _error) {
  * scopes, and `issueRefreshToken` returns false — so no refresh token is minted.
  * This is exactly the CLI failure ("no refresh_token available" ~1h later).
  *
- * The upgrade is strictly gated (AR-6 / AR-7): only when the request asked for
+ * The upgrade is strictly gated: it applies only when the request asked for
  * `offline_access`, the client allows the `refresh_token` grant, AND the grant
  * does not already include `offline_access`. In every other case the grant is
  * returned unchanged — identical to the provider default — so no other client
@@ -345,15 +332,14 @@ ctx, out, _error) {
 export async function loadExistingGrant(
 // eslint-disable-next-line @typescript-eslint/no-explicit-any
 ctx) {
-    const grantId = ctx.oidc.result?.consent?.grantId ||
-        ctx.oidc.session.grantIdFor(ctx.oidc.client.clientId);
+    const grantId = ctx.oidc.result?.consent?.grantId || ctx.oidc.session.grantIdFor(ctx.oidc.client.clientId);
     if (!grantId)
         return undefined;
     const grant = await ctx.oidc.provider.Grant.find(grantId);
     if (!grant)
         return undefined;
-    // AR-6/AR-7: upgrade an existing grant to include offline_access when the
-    // request asked for it, the client allows refresh_token, and it's missing.
+    // Upgrade an existing grant only when the request asked for offline_access,
+    // the client allows refresh_token, and the scope is missing.
     const requestedScopes = String(ctx.oidc.params?.scope ?? '')
         .split(' ')
         .filter(Boolean);
@@ -432,10 +418,10 @@ export function buildProviderConfiguration(params) {
             AccessToken: 'opaque',
             ClientCredentials: 'opaque',
         },
-        // PKCE — required for all authorization code flows, S256 only.
-        // This is a security best practice that prevents authorization code interception.
+        // Public authorization-code clients always require PKCE. Confidential clients use their
+        // persisted setting, while S256 remains the only accepted challenge method.
         pkce: {
-            required: () => true,
+            required: (_ctx, client) => client['urn:porta:client_type'] === 'public' || client['urn:porta:require_pkce'] === true,
             methods: ['S256'],
         },
         // Token TTLs from system_config table
@@ -454,10 +440,11 @@ export function buildProviderConfiguration(params) {
         // This explicit function ensures refresh tokens are issued whenever the client
         // lists 'refresh_token' in its grant_types AND the auth request included offline_access.
         issueRefreshToken: async (_ctx, client, code) => {
-            return client.grantTypeAllowed('refresh_token') && (code.scopes.has('offline_access') ||
-                // Fallback: also issue for confidential web clients (web + auth method != none)
-                (client.applicationType === 'web' &&
-                    client.tokenEndpointAuthMethod !== 'none'));
+            return (client.grantTypeAllowed('refresh_token') &&
+                (code.scopes.has('offline_access') ||
+                    // Fallback: also issue for confidential web clients (web + auth method != none)
+                    (client.applicationType === 'web' &&
+                        client.tokenEndpointAuthMethod !== 'none')));
         },
         // Enable refresh token rotation — each refresh generates a new token
         rotateRefreshToken: true,
@@ -472,14 +459,29 @@ export function buildProviderConfiguration(params) {
             openid: [
                 'sub',
                 // RBAC claims — always included
-                'roles', 'permissions',
+                'roles',
+                'permissions',
                 // Custom ERP claims — always included
-                'department', 'employee_id', 'cost_center', 'job_title',
+                'department',
+                'employee_id',
+                'cost_center',
+                'job_title',
             ],
             profile: [
-                'name', 'given_name', 'family_name', 'middle_name', 'nickname',
-                'preferred_username', 'profile', 'picture', 'website',
-                'gender', 'birthdate', 'zoneinfo', 'locale', 'updated_at',
+                'name',
+                'given_name',
+                'family_name',
+                'middle_name',
+                'nickname',
+                'preferred_username',
+                'profile',
+                'picture',
+                'website',
+                'gender',
+                'birthdate',
+                'zoneinfo',
+                'locale',
+                'updated_at',
             ],
             email: ['email', 'email_verified'],
             address: ['address'],
@@ -489,7 +491,7 @@ export function buildProviderConfiguration(params) {
         responseTypes: ['code'],
         grantTypes: ['authorization_code', 'client_credentials', 'refresh_token'],
         // Interaction URL — where users are redirected for login/consent.
-        // Placeholder for RD-03; real login UI implemented in RD-07.
+        // The host application owns the concrete login and consent interaction UI.
         interactions: {
             url: interactionUrl,
         },
@@ -502,8 +504,18 @@ export function buildProviderConfiguration(params) {
         // This is the same check used by the HSTS header in security-headers.ts.
         cookies: {
             keys: cookieKeys,
-            long: { signed: true, httpOnly: true, sameSite: 'lax', secure: config.issuerBaseUrl.startsWith('https://') },
-            short: { signed: true, httpOnly: true, sameSite: 'lax', secure: config.issuerBaseUrl.startsWith('https://') },
+            long: {
+                signed: true,
+                httpOnly: true,
+                sameSite: 'lax',
+                secure: config.issuerBaseUrl.startsWith('https://'),
+            },
+            short: {
+                signed: true,
+                httpOnly: true,
+                sameSite: 'lax',
+                secure: config.issuerBaseUrl.startsWith('https://'),
+            },
         },
         // CORS handler — checks client's allowed_origins
         clientBasedCORS,
@@ -519,11 +531,16 @@ export function buildProviderConfiguration(params) {
                 'client_name',
                 'urn:porta:allowed_origins',
                 'urn:porta:client_type',
+                'urn:porta:require_pkce',
+                'urn:porta:internal_application_id',
                 // Per-client login method override. Raw value from findForOidc():
                 //   null       → inherit organization.defaultLoginMethods
                 //   string[]   → explicit override (subset of ['password','magic_link'])
                 // Resolved to effective methods inside the interaction route handlers.
                 'urn:porta:login_methods',
+                // Whether the client must ask the end user for consent. Read by the
+                // consent gate in showConsent().
+                'requireConsent',
             ],
         },
     };

package/dist/oidc/configuration.js.map

@@ -1 +1 @@
-{"version":3,"file":"configuration.js","sourceRoot":"","sources":["../../src/oidc/configuration.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAIH,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EAAE,QAAQ,EAAE,MAAM,mCAAmC,CAAC;AAC7D,OAAO,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAC;AACxD,OAAO,EAAE,aAAa,EAAE,sBAAsB,EAAE,MAAM,iBAAiB,CAAC;AACxE,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC1C,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAElE,OAAO,EAAE,mBAAmB,EAAE,MAAM,qCAAqC,CAAC;AAoB1E,8EAA8E;AAC9E,yBAAyB;AACzB,8EAA8E;AAE9E;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB;IAClC,OAAO;QACL,OAAO,EAAE,IAAqB;QAC9B,UAAU,EAAE,IAAqB;QACjC,YAAY,EAAE,SAAS;QACvB,WAAW,EAAE,EAAE;QACf,SAAS,EAAE,IAAqB;KACjC,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,SAAS,oBAAoB,CAAC,GAAiB;IAC7C,OAAO;QACL,OAAO,EAAE,GAAG,CAAC,eAAe;QAC5B,UAAU,EAAE,GAAG,CAAC,kBAAkB;QAClC,YAAY,EAAE,GAAG,CAAC,oBAAoB,IAAI,SAAS;QACnD,WAAW,EAAE,GAAG,CAAC,mBAAmB,IAAI,GAAG,CAAC,IAAI;QAChD,SAAS,EAAE,GAAG,CAAC,iBAAiB;KACjC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,GAAY;IAC1D,IAAI,CAAC;QACH,sDAAsD;QACtD,sEAAsE;QACtE,yCAAyC;QACzC,8DAA8D;QAC9D,MAAM,OAAO,GAAG,GAAU,CAAC;QAE3B,2DAA2D;QAC3D,MAAM,SAAS,GAAG,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,SAA+B,CAAC;QAC1E,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,SAAS,CAAC,CAAC;YAC1C,IAAI,IAAI,EAAE,CAAC;gBACT,MAAM,GAAG,GAAG,MAAM,mBAAmB,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;gBAC3D,IAAI,GAAG;oBAAE,OAAO,GAAG,CAAC;YACtB,CAAC;QACH,CAAC;QAED,4DAA4D;QAC5D,MAAM,KAAK,GAAG,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,cAAoC,CAAC;QAC1E,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,GAAG,GAAG,MAAM,mBAAmB,CAAC,KAAK,CAAC,CAAC;YAC7C,IAAI,GAAG;gBAAE,OAAO,GAAG,CAAC;QACtB,CAAC;QAED,OAAO,SAAS,CAAC;IACnB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,EAAE,mDAAmD,CAAC,CAAC;QAC1E,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,2BAA2B;AAC3B,8EAA8E;AAE9E;;;;;;;;;;;;;GAaG;AACH,8DAA8D;AAC9D,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,GAAQ,EAAE,IAAY;IAC3D,IAAI,CAAC;QACH,8DAA8D;QAC9D,MAAM,GAAG,GAAG,MAAM,yBAAyB,CAAC,GAAG,CAAC,CAAC;QACjD,MAAM,QAAQ,GAAG,GAAG,CAAC,CAAC,CAAC,oBAAoB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,oBAAoB,EAAE,CAAC;QAE1E,0CAA0C;QAC1C,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,SAAS,EAAE,SAAS,EAAE,GAAG,EAAE,aAAa,IAAI,EAAE,CAAC,CAAC;QACnF,MAAM,CAAC,GAAG,sBAAsB,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;QAEpD,uEAAuE;QACvE,uEAAuE;QACvE,iEAAiE;QACjE,EAAE;QACF,sEAAsE;QACtE,wEAAwE;QACxE,uEAAuE;QACvE,yEAAyE;QACzE,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAC7B,SAAS,EACT,6FAA6F,CAAC,CAAC,gBAAgB,CAAC,kBAAkB,CACnI,CAAC;QAEF,0EAA0E;QAC1E,mFAAmF;QACnF,qFAAqF;QACrF,MAAM,UAAU,GAAG,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,WAAiC,CAAC;QACnF,MAAM,SAAS,GAAG,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,wBAA8C,CAAC;QAEnF,2DAA2D;QAC3D,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,QAAQ,EAAE;YACtC,QAAQ;YACR,MAAM;YACN,CAAC;YACD,SAAS,EAAE,EAAE,EAAE,mDAAmD;YAClE,OAAO,EAAE,GAAG,EAAE,IAAI,IAAI,EAAE;YACxB,UAAU,EAAE,UAAU;YACtB,UAAU,EAAE,UAAU,IAAI,IAAI;YAC9B,SAAS,EAAE,SAAS,IAAI,IAAI;SAC7B,CAAC,CAAC;QAEH,GAAG,CAAC,IAAI,GAAG,WAAW,CAAC;QACvB,GAAG,CAAC,GAAG,CAAC,yBAAyB,EAAE,QAAQ,CAAC,CAAC;QAC7C,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC;IAClB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,0DAA0D;QAC1D,iEAAiE;QACjE,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,qCAAqC,CAAC,CAAC;QAC7D,GAAG,CAAC,IAAI,GAAG,WAAW,CAAC;QACvB,GAAG,CAAC,GAAG,CAAC,yBAAyB,EAAE,QAAQ,CAAC,CAAC;QAC7C,GAAG,CAAC,IAAI,GAAG,8BAA8B,IAAI,yLAAyL,CAAC;IACzO,CAAC;AACH,CAAC;AAED;;;;;;;;;;;GAWG;AACH,8DAA8D;AAC9D,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,GAAQ;IACxD,IAAI,CAAC;QACH,0DAA0D;QAC1D,wDAAwD;QACxD,MAAM,QAAQ,GAAG,oBAAoB,EAAE,CAAC;QACxC,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,SAAS,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;QAC7D,MAAM,CAAC,GAAG,sBAAsB,CAAC,MAAM,CAAC,CAAC;QAEzC,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,gBAAgB,EAAE;YAC9C,QAAQ;YACR,MAAM;YACN,CAAC;YACD,SAAS,EAAE,EAAE;YACb,OAAO,EAAE,EAAE;SACZ,CAAC,CAAC;QAEH,GAAG,CAAC,IAAI,GAAG,WAAW,CAAC;QACvB,GAAG,CAAC,GAAG,CAAC,yBAAyB,EAAE,QAAQ,CAAC,CAAC;QAC7C,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC;IAClB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,0CAA0C,CAAC,CAAC;QAClE,GAAG,CAAC,IAAI,GAAG,WAAW,CAAC;QACvB,GAAG,CAAC,GAAG,CAAC,yBAAyB,EAAE,QAAQ,CAAC,CAAC;QAC7C,GAAG,CAAC,IAAI,GAAG,2GAA2G,CAAC;IACzH,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,SAAS,sBAAsB,CAC7B,GAAkD,EAClD,KAAwB;IAExB,IAAI,KAAK,EAAE,IAAI,KAAK,iBAAiB;QAAE,OAAO,IAAI,CAAC;IAEnD,IAAI,GAAG,CAAC,KAAK,KAAK,iBAAiB;QAAE,OAAO,KAAK,CAAC;IAClD,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,iBAAiB,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IACzD,OAAO,CACL,IAAI,CAAC,QAAQ,CAAC,+BAA+B,CAAC;QAC9C,IAAI,CAAC,QAAQ,CAAC,6CAA6C,CAAC;QAC5D,IAAI,CAAC,QAAQ,CAAC,mCAAmC,CAAC;QAClD,IAAI,CAAC,QAAQ,CAAC,sDAAsD,CAAC,CACtE,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,2BAA2B;AAClC,8DAA8D;AAC9D,GAAQ;IAER,MAAM,YAAY,GAAG,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,CAAC;IACrD,MAAM,iBAAiB,GACrB,OAAO,YAAY,KAAK,UAAU,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC;IACpG,mBAAmB,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC;AAC9C,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe;AACnC,8DAA8D;AAC9D,GAAQ,EACR,GAAkD,EAClD,MAAa;IAEb,IAAI,CAAC;QACH,6DAA6D;QAC7D,MAAM,GAAG,GAAG,MAAM,yBAAyB,CAAC,GAAG,CAAC,CAAC;QACjD,MAAM,QAAQ,GAAG,GAAG,CAAC,CAAC,CAAC,oBAAoB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,oBAAoB,EAAE,CAAC;QAE1E,0CAA0C;QAC1C,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,SAAS,EAAE,SAAS,EAAE,GAAG,EAAE,aAAa,IAAI,EAAE,CAAC,CAAC;QACnF,MAAM,CAAC,GAAG,sBAAsB,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;QAEpD,wEAAwE;QACxE,oDAAoD;QACpD,EAAE;QACF,2EAA2E;QAC3E,4EAA4E;QAC5E,sEAAsE;QACtE,2EAA2E;QAC3E,0DAA0D;QAC1D,EAAE;QACF,+EAA+E;QAC/E,4EAA4E;QAC5E,2EAA2E;QAC3E,EAAE;QACF,6EAA6E;QAC7E,yEAAyE;QACzE,8CAA8C;QAC9C,wEAAwE;QACxE,MAAM,iBAAiB,GAAG,sBAAsB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QAC9D,IAAI,iBAAiB,EAAE,CAAC;YACtB,2BAA2B,CAAC,GAAG,CAAC,CAAC;QACnC,CAAC;QAED,MAAM,YAAY,GAAG,iBAAiB;YACpC,CAAC,CAAC,CAAC,CAAC,wBAAwB,CAAC;YAC7B,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC;QAExB,oEAAoE;QACpE,8DAA8D;QAC9D,uEAAuE;QACvE,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,OAAO,EAAE;YACrC,QAAQ;YACR,MAAM;YACN,CAAC;YACD,SAAS,EAAE,EAAE;YACb,OAAO,EAAE,GAAG,EAAE,IAAI,IAAI,EAAE;YACxB,YAAY;YACZ,SAAS,EAAE,GAAG,CAAC,KAAK;SACrB,CAAC,CAAC;QAEH,GAAG,CAAC,IAAI,GAAG,WAAW,CAAC;QACvB,GAAG,CAAC,GAAG,CAAC,yBAAyB,EAAE,QAAQ,CAAC,CAAC;QAC7C,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC;IAClB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,oCAAoC,CAAC,CAAC;QAC5D,GAAG,CAAC,IAAI,GAAG,WAAW,CAAC;QACvB,GAAG,CAAC,GAAG,CAAC,yBAAyB,EAAE,QAAQ,CAAC,CAAC;QAC7C,GAAG,CAAC,IAAI,GAAG,kFAAkF,CAAC;IAChG,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,yBAAyB;AACzB,8EAA8E;AAE9E;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB;AACrC,8DAA8D;AAC9D,GAAQ;IAER,MAAM,OAAO,GACX,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO;QACjC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAExD,IAAI,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC;IAE/B,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC1D,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAE7B,0EAA0E;IAC1E,2EAA2E;IAC3E,MAAM,eAAe,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,IAAI,EAAE,CAAC;SACzD,KAAK,CAAC,GAAG,CAAC;SACV,MAAM,CAAC,OAAO,CAAC,CAAC;IACnB,MAAM,YAAY,GAAG,eAAe,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC;IAChE,MAAM,mBAAmB,GACvB,OAAO,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,gBAAgB,KAAK,UAAU;QACvD,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,eAAe,CAAC,CAAC;IACpD,MAAM,eAAe,GAAG,MAAM,CAAC,KAAK,CAAC,YAAY,EAAE,IAAI,EAAE,CAAC;SACvD,KAAK,CAAC,GAAG,CAAC;SACV,MAAM,CAAC,OAAO,CAAC;SACf,QAAQ,CAAC,gBAAgB,CAAC,CAAC;IAE9B,IAAI,YAAY,IAAI,mBAAmB,IAAI,CAAC,eAAe,EAAE,CAAC;QAC5D,KAAK,CAAC,YAAY,CAAC,gBAAgB,CAAC,CAAC;QACrC,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC;IACrB,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,8EAA8E;AAC9E,iCAAiC;AACjC,8EAA8E;AAE9E;;;;;;;;;GASG;AACH,MAAM,UAAU,0BAA0B,CAAC,MAAiC;IAC1E,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,UAAU,EAAE,WAAW,EAAE,cAAc,EAAE,cAAc,EAAE,eAAe,EAAE,GAAG,MAAM,CAAC;IAEvG,OAAO;QACL,8CAA8C;QAC9C,OAAO,EAAE,cAAc;QAEvB,mEAAmE;QACnE,WAAW;QAEX,8DAA8D;QAC9D,2EAA2E;QAC3E,iBAAiB;QAEjB,gBAAgB;QAChB,QAAQ,EAAE;YACR,gEAAgE;YAChE,eAAe,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE;YACnC,wCAAwC;YACxC,aAAa,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE;YAChC,qCAAqC;YACrC,UAAU,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE;YAC7B,wCAAwC;YACxC,kBAAkB,EAAE;gBAClB,OAAO,EAAE,IAAI;gBACb,gFAAgF;gBAChF,2EAA2E;gBAC3E,oFAAoF;gBACpF,gFAAgF;gBAChF,8EAA8E;gBAC9E,eAAe,EAAE,KAAK,EAAE,IAAa,EAAE,OAAgB,EAAE,KAAc,EAAE,EAAE,CACzE,KAAK,IAAI,SAAS;gBACpB,qBAAqB,EAAE,GAAG,EAAE,CAAC,CAAC;oBAC5B,KAAK,EAAE,sBAAsB;oBAC7B,QAAQ,EAAE,mBAAmB;oBAC7B,iBAAiB,EAAE,QAAQ;oBAC3B,cAAc,EAAE,GAAG,CAAC,WAAW;iBAChC,CAAC;gBACF,kBAAkB,EAAE,GAAG,EAAE,CAAC,IAAI;aAC/B;YACD,kDAAkD;YAClD,iBAAiB,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE;YACpC,sEAAsE;YACtE,iBAAiB,EAAE;gBACjB,OAAO,EAAE,IAAI;gBACb,YAAY,EAAE,gBAAgB;gBAC9B,uBAAuB,EAAE,2BAA2B;aACrD;SACF;QAED,gEAAgE;QAChE,OAAO,EAAE;YACP,WAAW,EAAE,QAAQ;YACrB,iBAAiB,EAAE,QAAQ;SAC5B;QAED,+DAA+D;QAC/D,kFAAkF;QAClF,IAAI,EAAE;YACJ,QAAQ,EAAE,GAAG,EAAE,CAAC,IAAI;YACpB,OAAO,EAAE,CAAC,MAAM,CAAC;SAClB;QAED,sCAAsC;QACtC,GAAG,EAAE;YACH,WAAW,EAAE,GAAG,CAAC,WAAW;YAC5B,iBAAiB,EAAE,GAAG,CAAC,iBAAiB;YACxC,OAAO,EAAE,GAAG,CAAC,OAAO;YACpB,YAAY,EAAE,GAAG,CAAC,YAAY;YAC9B,WAAW,EAAE,GAAG,CAAC,WAAW;YAC5B,OAAO,EAAE,GAAG,CAAC,OAAO;YACpB,KAAK,EAAE,GAAG,CAAC,KAAK;SACjB;QAED,sDAAsD;QACtD,0FAA0F;QAC1F,gFAAgF;QAChF,+EAA+E;QAC/E,yFAAyF;QACzF,iBAAiB,EAAE,KAAK,EACtB,IAAa,EACb,MAAuD,EACvD,IAA6B,EAC7B,EAAE;YACF,OAAO,MAAM,CAAC,gBAAgB,CAAC,eAAe,CAAC,IAAI,CACjD,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,gBAAgB,CAAC;gBACjC,gFAAgF;gBAChF,CAAE,MAAkC,CAAC,eAAe,KAAK,KAAK;oBAC5D,MAAkC,CAAC,uBAAuB,KAAK,MAAM,CAAC,CACzE,CAAC;QACJ,CAAC;QAED,qEAAqE;QACrE,kBAAkB,EAAE,IAAI;QAExB,uBAAuB;QACvB,MAAM,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,gBAAgB,CAAC;QAE5E,iCAAiC;QACjC,mDAAmD;QACnD,mEAAmE;QACnE,yEAAyE;QACzE,gFAAgF;QAChF,MAAM,EAAE;YACN,MAAM,EAAE;gBACN,KAAK;gBACL,gCAAgC;gBAChC,OAAO,EAAE,aAAa;gBACtB,sCAAsC;gBACtC,YAAY,EAAE,aAAa,EAAE,aAAa,EAAE,WAAW;aACxD;YACD,OAAO,EAAE;gBACP,MAAM,EAAE,YAAY,EAAE,aAAa,EAAE,aAAa,EAAE,UAAU;gBAC9D,oBAAoB,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS;gBACrD,QAAQ,EAAE,WAAW,EAAE,UAAU,EAAE,QAAQ,EAAE,YAAY;aAC1D;YACD,KAAK,EAAE,CAAC,OAAO,EAAE,gBAAgB,CAAC;YAClC,OAAO,EAAE,CAAC,SAAS,CAAC;YACpB,KAAK,EAAE,CAAC,cAAc,EAAE,uBAAuB,CAAC;SACjD;QAED,2CAA2C;QAC3C,aAAa,EAAE,CAAC,MAAM,CAAC;QACvB,UAAU,EAAE,CAAC,oBAAoB,EAAE,oBAAoB,EAAE,eAAe,CAAC;QAEzE,kEAAkE;QAClE,6DAA6D;QAC7D,YAAY,EAAE;YACZ,GAAG,EAAE,cAAc;SACpB;QAED,6BAA6B;QAC7B,IAAI;QAEJ,0DAA0D;QAC1D,+DAA+D;QAC/D,gEAAgE;QAChE,oEAAoE;QACpE,yEAAyE;QACzE,OAAO,EAAE;YACP,IAAI,EAAE,UAAU;YAChB,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAc,EAAE,MAAM,EAAE,MAAM,CAAC,aAAa,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE;YACrH,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAc,EAAE,MAAM,EAAE,MAAM,CAAC,aAAa,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE;SACvH;QAED,iDAAiD;QACjD,eAAe;QAEf,sEAAsE;QACtE,4EAA4E;QAC5E,WAAW,EAAE,eAAe;QAE5B,mEAAmE;QACnE,8DAA8D;QAC9D,kEAAkE;QAClE,mBAAmB,EAAE;YACnB,UAAU,EAAE;gBACV,gBAAgB;gBAChB,aAAa;gBACb,2BAA2B;gBAC3B,uBAAuB;gBACvB,kEAAkE;gBAClE,0DAA0D;gBAC1D,yEAAyE;gBACzE,uEAAuE;gBACvE,yBAAyB;aAC1B;SACF;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"configuration.js","sourceRoot":"","sources":["../../src/oidc/configuration.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAIH,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,mCAAmC,CAAC;AAC3E,OAAO,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAC;AACxD,OAAO,EACL,8BAA8B,EAC9B,wBAAwB,GAEzB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,aAAa,EAAE,sBAAsB,EAAE,MAAM,iBAAiB,CAAC;AACxE,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC1C,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAElE,OAAO,EAAE,mBAAmB,EAAE,MAAM,qCAAqC,CAAC;AA6B1E,8EAA8E;AAC9E,yBAAyB;AACzB,8EAA8E;AAE9E;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB;IAClC,OAAO;QACL,OAAO,EAAE,IAAI;QACb,UAAU,EAAE,IAAI;QAChB,YAAY,EAAE,8BAA8B;QAC5C,WAAW,EAAE,EAAE;QACf,SAAS,EAAE,IAAI;QACf,YAAY,EAAE,EAAE;KACjB,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,GAAY;IAC1D,IAAI,CAAC;QACH,sDAAsD;QACtD,sEAAsE;QACtE,yCAAyC;QACzC,8DAA8D;QAC9D,MAAM,OAAO,GAAG,GAAU,CAAC;QAE3B,2DAA2D;QAC3D,MAAM,SAAS,GAAG,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,SAA+B,CAAC;QAC1E,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,SAAS,CAAC,CAAC;YAC1C,IAAI,IAAI,EAAE,CAAC;gBACT,MAAM,GAAG,GAAG,MAAM,mBAAmB,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;gBAC3D,IAAI,GAAG;oBAAE,OAAO,GAAG,CAAC;YACtB,CAAC;QACH,CAAC;QAED,4DAA4D;QAC5D,MAAM,KAAK,GAAG,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,cAAoC,CAAC;QAC1E,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,GAAG,GAAG,MAAM,mBAAmB,CAAC,KAAK,CAAC,CAAC;YAC7C,IAAI,GAAG;gBAAE,OAAO,GAAG,CAAC;QACtB,CAAC;QAED,OAAO,SAAS,CAAC;IACnB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,EAAE,mDAAmD,CAAC,CAAC;QAC1E,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,2BAA2B;AAC3B,8EAA8E;AAE9E;;;;;;;;;;;;;GAaG;AACH,8DAA8D;AAC9D,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,GAAQ,EAAE,IAAY;IAC3D,IAAI,CAAC;QACH,8DAA8D;QAC9D,MAAM,GAAG,GAAG,MAAM,yBAAyB,CAAC,GAAG,CAAC,CAAC;QACjD,MAAM,QAAQ,GAAG,GAAG,CAAC,CAAC,CAAC,MAAM,wBAAwB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,oBAAoB,EAAE,CAAC;QAEpF,0CAA0C;QAC1C,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,SAAS,EAAE,SAAS,EAAE,GAAG,EAAE,aAAa,IAAI,EAAE,CAAC,CAAC;QACnF,MAAM,CAAC,GAAG,sBAAsB,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;QAEpD,uEAAuE;QACvE,uEAAuE;QACvE,iEAAiE;QACjE,EAAE;QACF,sEAAsE;QACtE,wEAAwE;QACxE,uEAAuE;QACvE,yEAAyE;QACzE,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAC7B,SAAS,EACT,6FAA6F,CAAC,CAAC,gBAAgB,CAAC,kBAAkB,CACnI,CAAC;QAEF,0EAA0E;QAC1E,mFAAmF;QACnF,qFAAqF;QACrF,MAAM,UAAU,GAAG,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,WAAiC,CAAC;QACnF,MAAM,SAAS,GAAG,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,wBAA8C,CAAC;QAEnF,2DAA2D;QAC3D,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,QAAQ,EAAE;YACtC,QAAQ;YACR,MAAM;YACN,CAAC;YACD,SAAS,EAAE,EAAE,EAAE,mDAAmD;YAClE,OAAO,EAAE,GAAG,EAAE,IAAI,IAAI,EAAE;YACxB,UAAU,EAAE,UAAU;YACtB,UAAU,EAAE,UAAU,IAAI,IAAI;YAC9B,SAAS,EAAE,SAAS,IAAI,IAAI;SAC7B,CAAC,CAAC;QAEH,GAAG,CAAC,IAAI,GAAG,WAAW,CAAC;QACvB,GAAG,CAAC,GAAG,CAAC,yBAAyB,EAAE,YAAY,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC;QACxE,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC;IAClB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,0DAA0D;QAC1D,iEAAiE;QACjE,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,qCAAqC,CAAC,CAAC;QAC7D,GAAG,CAAC,IAAI,GAAG,WAAW,CAAC;QACvB,GAAG,CAAC,GAAG,CAAC,yBAAyB,EAAE,QAAQ,CAAC,CAAC;QAC7C,GAAG,CAAC,IAAI,GAAG,8BAA8B,IAAI,yLAAyL,CAAC;IACzO,CAAC;AACH,CAAC;AAED;;;;;;;;;;;GAWG;AACH,8DAA8D;AAC9D,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,GAAQ;IACxD,IAAI,CAAC;QACH,0DAA0D;QAC1D,wDAAwD;QACxD,MAAM,QAAQ,GAAG,oBAAoB,EAAE,CAAC;QACxC,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,SAAS,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;QAC7D,MAAM,CAAC,GAAG,sBAAsB,CAAC,MAAM,CAAC,CAAC;QAEzC,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,gBAAgB,EAAE;YAC9C,QAAQ;YACR,MAAM;YACN,CAAC;YACD,SAAS,EAAE,EAAE;YACb,OAAO,EAAE,EAAE;SACZ,CAAC,CAAC;QAEH,GAAG,CAAC,IAAI,GAAG,WAAW,CAAC;QACvB,GAAG,CAAC,GAAG,CAAC,yBAAyB,EAAE,YAAY,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC;QACxE,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC;IAClB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,0CAA0C,CAAC,CAAC;QAClE,GAAG,CAAC,IAAI,GAAG,WAAW,CAAC;QACvB,GAAG,CAAC,GAAG,CAAC,yBAAyB,EAAE,QAAQ,CAAC,CAAC;QAC7C,GAAG,CAAC,IAAI;YACN,2GAA2G,CAAC;IAChH,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,SAAS,sBAAsB,CAC7B,GAAkD,EAClD,KAAwB;IAExB,IAAI,KAAK,EAAE,IAAI,KAAK,iBAAiB;QAAE,OAAO,IAAI,CAAC;IAEnD,IAAI,GAAG,CAAC,KAAK,KAAK,iBAAiB;QAAE,OAAO,KAAK,CAAC;IAClD,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,iBAAiB,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IACzD,OAAO,CACL,IAAI,CAAC,QAAQ,CAAC,+BAA+B,CAAC;QAC9C,IAAI,CAAC,QAAQ,CAAC,6CAA6C,CAAC;QAC5D,IAAI,CAAC,QAAQ,CAAC,mCAAmC,CAAC;QAClD,IAAI,CAAC,QAAQ,CAAC,sDAAsD,CAAC,CACtE,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,2BAA2B;AAClC,8DAA8D;AAC9D,GAAQ;IAER,MAAM,YAAY,GAAG,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,CAAC;IACrD,MAAM,iBAAiB,GACrB,OAAO,YAAY,KAAK,UAAU;QAChC,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAC;QACjD,CAAC,CAAC,UAAU,CAAC;IACjB,mBAAmB,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC;AAC9C,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe;AACnC,8DAA8D;AAC9D,GAAQ,EACR,GAAkD,EAClD,MAAa;IAEb,IAAI,CAAC;QACH,6DAA6D;QAC7D,MAAM,GAAG,GAAG,MAAM,yBAAyB,CAAC,GAAG,CAAC,CAAC;QACjD,MAAM,QAAQ,GAAG,GAAG,CAAC,CAAC,CAAC,MAAM,wBAAwB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,oBAAoB,EAAE,CAAC;QAEpF,0CAA0C;QAC1C,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,SAAS,EAAE,SAAS,EAAE,GAAG,EAAE,aAAa,IAAI,EAAE,CAAC,CAAC;QACnF,MAAM,CAAC,GAAG,sBAAsB,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;QAEpD,wEAAwE;QACxE,mEAAmE;QACnE,EAAE;QACF,2EAA2E;QAC3E,4EAA4E;QAC5E,sEAAsE;QACtE,2EAA2E;QAC3E,0DAA0D;QAC1D,EAAE;QACF,+EAA+E;QAC/E,4EAA4E;QAC5E,2EAA2E;QAC3E,EAAE;QACF,6EAA6E;QAC7E,yEAAyE;QACzE,8CAA8C;QAC9C,wEAAwE;QACxE,MAAM,iBAAiB,GAAG,sBAAsB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QAC9D,IAAI,iBAAiB,EAAE,CAAC;YACtB,2BAA2B,CAAC,GAAG,CAAC,CAAC;QACnC,CAAC;QAED,MAAM,YAAY,GAAG,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC;QAE3F,oEAAoE;QACpE,8DAA8D;QAC9D,uEAAuE;QACvE,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,OAAO,EAAE;YACrC,QAAQ;YACR,MAAM;YACN,CAAC;YACD,SAAS,EAAE,EAAE;YACb,OAAO,EAAE,GAAG,EAAE,IAAI,IAAI,EAAE;YACxB,YAAY;YACZ,SAAS,EAAE,GAAG,CAAC,KAAK;SACrB,CAAC,CAAC;QAEH,GAAG,CAAC,IAAI,GAAG,WAAW,CAAC;QACvB,GAAG,CAAC,GAAG,CAAC,yBAAyB,EAAE,YAAY,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC;QACxE,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC;IAClB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,oCAAoC,CAAC,CAAC;QAC5D,GAAG,CAAC,IAAI,GAAG,WAAW,CAAC;QACvB,GAAG,CAAC,GAAG,CAAC,yBAAyB,EAAE,QAAQ,CAAC,CAAC;QAC7C,GAAG,CAAC,IAAI,GAAG,kFAAkF,CAAC;IAChG,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,yBAAyB;AACzB,8EAA8E;AAE9E;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB;AACrC,8DAA8D;AAC9D,GAAQ;IAER,MAAM,OAAO,GACX,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,IAAI,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAE7F,IAAI,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC;IAE/B,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC1D,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAE7B,4EAA4E;IAC5E,6DAA6D;IAC7D,MAAM,eAAe,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,IAAI,EAAE,CAAC;SACzD,KAAK,CAAC,GAAG,CAAC;SACV,MAAM,CAAC,OAAO,CAAC,CAAC;IACnB,MAAM,YAAY,GAAG,eAAe,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC;IAChE,MAAM,mBAAmB,GACvB,OAAO,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,gBAAgB,KAAK,UAAU;QACvD,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,eAAe,CAAC,CAAC;IACpD,MAAM,eAAe,GAAG,MAAM,CAAC,KAAK,CAAC,YAAY,EAAE,IAAI,EAAE,CAAC;SACvD,KAAK,CAAC,GAAG,CAAC;SACV,MAAM,CAAC,OAAO,CAAC;SACf,QAAQ,CAAC,gBAAgB,CAAC,CAAC;IAE9B,IAAI,YAAY,IAAI,mBAAmB,IAAI,CAAC,eAAe,EAAE,CAAC;QAC5D,KAAK,CAAC,YAAY,CAAC,gBAAgB,CAAC,CAAC;QACrC,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC;IACrB,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,8EAA8E;AAC9E,iCAAiC;AACjC,8EAA8E;AAE9E;;;;;;;;;GASG;AACH,MAAM,UAAU,0BAA0B,CACxC,MAAiC;IAEjC,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,UAAU,EAAE,WAAW,EAAE,cAAc,EAAE,cAAc,EAAE,eAAe,EAAE,GAC3F,MAAM,CAAC;IAET,OAAO;QACL,8CAA8C;QAC9C,OAAO,EAAE,cAAc;QAEvB,mEAAmE;QACnE,WAAW;QAEX,8DAA8D;QAC9D,2EAA2E;QAC3E,iBAAiB;QAEjB,gBAAgB;QAChB,QAAQ,EAAE;YACR,gEAAgE;YAChE,eAAe,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE;YACnC,wCAAwC;YACxC,aAAa,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE;YAChC,qCAAqC;YACrC,UAAU,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE;YAC7B,wCAAwC;YACxC,kBAAkB,EAAE;gBAClB,OAAO,EAAE,IAAI;gBACb,gFAAgF;gBAChF,2EAA2E;gBAC3E,oFAAoF;gBACpF,gFAAgF;gBAChF,8EAA8E;gBAC9E,eAAe,EAAE,KAAK,EAAE,IAAa,EAAE,OAAgB,EAAE,KAAc,EAAE,EAAE,CACzE,KAAK,IAAI,SAAS;gBACpB,qBAAqB,EAAE,GAAG,EAAE,CAAC,CAAC;oBAC5B,KAAK,EAAE,sBAAsB;oBAC7B,QAAQ,EAAE,mBAAmB;oBAC7B,iBAAiB,EAAE,QAAQ;oBAC3B,cAAc,EAAE,GAAG,CAAC,WAAW;iBAChC,CAAC;gBACF,kBAAkB,EAAE,GAAG,EAAE,CAAC,IAAI;aAC/B;YACD,kDAAkD;YAClD,iBAAiB,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE;YACpC,sEAAsE;YACtE,iBAAiB,EAAE;gBACjB,OAAO,EAAE,IAAI;gBACb,YAAY,EAAE,gBAAgB;gBAC9B,uBAAuB,EAAE,2BAA2B;aACrD;SACF;QAED,gEAAgE;QAChE,OAAO,EAAE;YACP,WAAW,EAAE,QAAQ;YACrB,iBAAiB,EAAE,QAAQ;SAC5B;QAED,wFAAwF;QACxF,4EAA4E;QAC5E,IAAI,EAAE;YACJ,QAAQ,EAAE,CAAC,IAAa,EAAE,MAA+B,EAAE,EAAE,CAC3D,MAAM,CAAC,uBAAuB,CAAC,KAAK,QAAQ,IAAI,MAAM,CAAC,wBAAwB,CAAC,KAAK,IAAI;YAC3F,OAAO,EAAE,CAAC,MAAM,CAAC;SAClB;QAED,sCAAsC;QACtC,GAAG,EAAE;YACH,WAAW,EAAE,GAAG,CAAC,WAAW;YAC5B,iBAAiB,EAAE,GAAG,CAAC,iBAAiB;YACxC,OAAO,EAAE,GAAG,CAAC,OAAO;YACpB,YAAY,EAAE,GAAG,CAAC,YAAY;YAC9B,WAAW,EAAE,GAAG,CAAC,WAAW;YAC5B,OAAO,EAAE,GAAG,CAAC,OAAO;YACpB,KAAK,EAAE,GAAG,CAAC,KAAK;SACjB;QAED,sDAAsD;QACtD,0FAA0F;QAC1F,gFAAgF;QAChF,+EAA+E;QAC/E,yFAAyF;QACzF,iBAAiB,EAAE,KAAK,EACtB,IAAa,EACb,MAAuD,EACvD,IAA6B,EAC7B,EAAE;YACF,OAAO,CACL,MAAM,CAAC,gBAAgB,CAAC,eAAe,CAAC;gBACxC,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,gBAAgB,CAAC;oBAChC,gFAAgF;oBAChF,CAAE,MAAkC,CAAC,eAAe,KAAK,KAAK;wBAC3D,MAAkC,CAAC,uBAAuB,KAAK,MAAM,CAAC,CAAC,CAC7E,CAAC;QACJ,CAAC;QAED,qEAAqE;QACrE,kBAAkB,EAAE,IAAI;QAExB,uBAAuB;QACvB,MAAM,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,gBAAgB,CAAC;QAE5E,iCAAiC;QACjC,mDAAmD;QACnD,mEAAmE;QACnE,yEAAyE;QACzE,gFAAgF;QAChF,MAAM,EAAE;YACN,MAAM,EAAE;gBACN,KAAK;gBACL,gCAAgC;gBAChC,OAAO;gBACP,aAAa;gBACb,sCAAsC;gBACtC,YAAY;gBACZ,aAAa;gBACb,aAAa;gBACb,WAAW;aACZ;YACD,OAAO,EAAE;gBACP,MAAM;gBACN,YAAY;gBACZ,aAAa;gBACb,aAAa;gBACb,UAAU;gBACV,oBAAoB;gBACpB,SAAS;gBACT,SAAS;gBACT,SAAS;gBACT,QAAQ;gBACR,WAAW;gBACX,UAAU;gBACV,QAAQ;gBACR,YAAY;aACb;YACD,KAAK,EAAE,CAAC,OAAO,EAAE,gBAAgB,CAAC;YAClC,OAAO,EAAE,CAAC,SAAS,CAAC;YACpB,KAAK,EAAE,CAAC,cAAc,EAAE,uBAAuB,CAAC;SACjD;QAED,2CAA2C;QAC3C,aAAa,EAAE,CAAC,MAAM,CAAC;QACvB,UAAU,EAAE,CAAC,oBAAoB,EAAE,oBAAoB,EAAE,eAAe,CAAC;QAEzE,kEAAkE;QAClE,2EAA2E;QAC3E,YAAY,EAAE;YACZ,GAAG,EAAE,cAAc;SACpB;QAED,6BAA6B;QAC7B,IAAI;QAEJ,0DAA0D;QAC1D,+DAA+D;QAC/D,gEAAgE;QAChE,oEAAoE;QACpE,yEAAyE;QACzE,OAAO,EAAE;YACP,IAAI,EAAE,UAAU;YAChB,IAAI,EAAE;gBACJ,MAAM,EAAE,IAAI;gBACZ,QAAQ,EAAE,IAAI;gBACd,QAAQ,EAAE,KAAc;gBACxB,MAAM,EAAE,MAAM,CAAC,aAAa,CAAC,UAAU,CAAC,UAAU,CAAC;aACpD;YACD,KAAK,EAAE;gBACL,MAAM,EAAE,IAAI;gBACZ,QAAQ,EAAE,IAAI;gBACd,QAAQ,EAAE,KAAc;gBACxB,MAAM,EAAE,MAAM,CAAC,aAAa,CAAC,UAAU,CAAC,UAAU,CAAC;aACpD;SACF;QAED,iDAAiD;QACjD,eAAe;QAEf,sEAAsE;QACtE,4EAA4E;QAC5E,WAAW,EAAE,eAAe;QAE5B,mEAAmE;QACnE,8DAA8D;QAC9D,kEAAkE;QAClE,mBAAmB,EAAE;YACnB,UAAU,EAAE;gBACV,gBAAgB;gBAChB,aAAa;gBACb,2BAA2B;gBAC3B,uBAAuB;gBACvB,wBAAwB;gBACxB,mCAAmC;gBACnC,kEAAkE;gBAClE,0DAA0D;gBAC1D,yEAAyE;gBACzE,uEAAuE;gBACvE,yBAAyB;gBACzB,oEAAoE;gBACpE,iCAAiC;gBACjC,gBAAgB;aACjB;SACF;KACF,CAAC;AACJ,CAAC"}

package/dist/oidc/provider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"provider.d.ts","sourceRoot":"","sources":["../../src/oidc/provider.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,QAAQ,MAAM,eAAe,CAAC;AAErC,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAG7D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAOzD;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,kBAAkB,CAAC,MAAM,EAAE;IAC/C,IAAI,EAAE;QAAE,IAAI,EAAE,UAAU,EAAE,CAAA;KAAE,CAAC;IAC7B,GAAG,EAAE,aAAa,CAAC;CACpB,GAAG,OAAO,CAAC,QAAQ,CAAC,CA0CpB"}
+{"version":3,"file":"provider.d.ts","sourceRoot":"","sources":["../../src/oidc/provider.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,QAAQ,MAAM,eAAe,CAAC;AAErC,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAG7D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAOzD;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,kBAAkB,CAAC,MAAM,EAAE;IAC/C,IAAI,EAAE;QAAE,IAAI,EAAE,UAAU,EAAE,CAAA;KAAE,CAAC;IAC7B,GAAG,EAAE,aAAa,CAAC;CACpB,GAAG,OAAO,CAAC,QAAQ,CAAC,CAiDpB"}

package/dist/oidc/provider.js

@@ -63,6 +63,13 @@ export async function createOidcProvider(params) {
     // in the Koa router (server.ts strips the /:orgSlug prefix).
     const provider = new Provider(config.issuerBaseUrl, configuration);
     registerProtocolSecurityObservers(provider);
+    provider.on('server_error', (context) => {
+        // oidc-provider owns its internal error response. When a Redis command fails during that
+        // request, expose only the correct availability status and retain its generic response body.
+        if (getRedis().status !== 'ready') {
+            context.status = 503;
+        }
+    });
     // Enable proxy mode — required for path-based multi-tenancy so the
     // provider trusts forwarded headers and handles URL rewriting correctly.
     provider.proxy = true;

package/dist/oidc/provider.js.map

@@ -1 +1 @@
-{"version":3,"file":"provider.js","sourceRoot":"","sources":["../../src/oidc/provider.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,QAAQ,MAAM,eAAe,CAAC;AACrC,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAE5C,OAAO,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAC3C,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAE1C,OAAO,EAAE,0BAA0B,EAAE,MAAM,oBAAoB,CAAC;AAChE,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,EAAE,QAAQ,EAAE,MAAM,4BAA4B,CAAC;AACtD,OAAO,EAAE,iCAAiC,EAAE,MAAM,iCAAiC,CAAC;AAEpF;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,MAGxC;IACC,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC;IAE7B,kEAAkE;IAClE,MAAM,aAAa,GAAG,0BAA0B,CAAC;QAC/C,GAAG;QACH,IAAI;QACJ,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,WAAW;QACX,cAAc,EAAE,oBAAoB,EAAE;QACtC,eAAe,EAAE,QAAQ;QACzB,2BAA2B;QAC3B,oEAAoE;QACpE,0EAA0E;QAC1E,cAAc,EAAE,CAAC,GAAG,EAAE,WAAW,EAAE,EAAE;YAKnC,MAAM,GAAG,GACN,GAA8B,CAAC,GAAG,IAAK,GAA8B,CAAC,OAAO,EAAE,GAAG,CAAC;YACtF,MAAM,GAAG,GAAG,GAAG,EAAE,kBAAkB,CAAC;YACpC,IAAI,GAAG,EAAE,EAAE,IAAI,WAAW,EAAE,GAAG,EAAE,CAAC;gBAChC,QAAQ,EAAE;qBACP,GAAG,CAAC,mBAAmB,WAAW,CAAC,GAAG,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC;qBAC7D,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,EAAE,iCAAiC,CAAC,CAAC,CAAC;YACtF,CAAC;YACD,OAAO,gBAAgB,WAAW,CAAC,GAAG,EAAE,CAAC;QAC3C,CAAC;KACF,CAAC,CAAC;IAEH,wCAAwC;IACxC,sEAAsE;IACtE,6DAA6D;IAC7D,MAAM,QAAQ,GAAG,IAAI,QAAQ,CAAC,MAAM,CAAC,aAAa,EAAE,aAAa,CAAC,CAAC;IACnE,iCAAiC,CAAC,QAAQ,CAAC,CAAC;IAE5C,mEAAmE;IACnE,yEAAyE;IACzE,QAAQ,CAAC,KAAK,GAAG,IAAI,CAAC;IAEtB,OAAO,QAAQ,CAAC;AAClB,CAAC"}
+{"version":3,"file":"provider.js","sourceRoot":"","sources":["../../src/oidc/provider.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,QAAQ,MAAM,eAAe,CAAC;AACrC,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAE5C,OAAO,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAC3C,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAE1C,OAAO,EAAE,0BAA0B,EAAE,MAAM,oBAAoB,CAAC;AAChE,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,EAAE,QAAQ,EAAE,MAAM,4BAA4B,CAAC;AACtD,OAAO,EAAE,iCAAiC,EAAE,MAAM,iCAAiC,CAAC;AAEpF;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,MAGxC;IACC,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC;IAE7B,kEAAkE;IAClE,MAAM,aAAa,GAAG,0BAA0B,CAAC;QAC/C,GAAG;QACH,IAAI;QACJ,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,WAAW;QACX,cAAc,EAAE,oBAAoB,EAAE;QACtC,eAAe,EAAE,QAAQ;QACzB,2BAA2B;QAC3B,oEAAoE;QACpE,0EAA0E;QAC1E,cAAc,EAAE,CAAC,GAAG,EAAE,WAAW,EAAE,EAAE;YAKnC,MAAM,GAAG,GACN,GAA8B,CAAC,GAAG,IAAK,GAA8B,CAAC,OAAO,EAAE,GAAG,CAAC;YACtF,MAAM,GAAG,GAAG,GAAG,EAAE,kBAAkB,CAAC;YACpC,IAAI,GAAG,EAAE,EAAE,IAAI,WAAW,EAAE,GAAG,EAAE,CAAC;gBAChC,QAAQ,EAAE;qBACP,GAAG,CAAC,mBAAmB,WAAW,CAAC,GAAG,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC;qBAC7D,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,EAAE,iCAAiC,CAAC,CAAC,CAAC;YACtF,CAAC;YACD,OAAO,gBAAgB,WAAW,CAAC,GAAG,EAAE,CAAC;QAC3C,CAAC;KACF,CAAC,CAAC;IAEH,wCAAwC;IACxC,sEAAsE;IACtE,6DAA6D;IAC7D,MAAM,QAAQ,GAAG,IAAI,QAAQ,CAAC,MAAM,CAAC,aAAa,EAAE,aAAa,CAAC,CAAC;IACnE,iCAAiC,CAAC,QAAQ,CAAC,CAAC;IAC5C,QAAQ,CAAC,EAAE,CAAC,cAAc,EAAE,CAAC,OAAO,EAAE,EAAE;QACtC,yFAAyF;QACzF,6FAA6F;QAC7F,IAAI,QAAQ,EAAE,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;YAClC,OAAO,CAAC,MAAM,GAAG,GAAG,CAAC;QACvB,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,mEAAmE;IACnE,yEAAyE;IACzE,QAAQ,CAAC,KAAK,GAAG,IAAI,CAAC;IAEtB,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/oidc/redis-adapter.d.ts

@@ -91,9 +91,8 @@ export declare class RedisAdapter {
     /**
      * Mark an artifact as consumed.
      *
-     * Reads the current payload, adds a `consumed` timestamp (epoch seconds),
-     * and writes it back with the remaining TTL preserved. This is used for
-     * authorization code replay detection.
+     * Atomically adds a `consumed` timestamp while preserving the existing TTL. A missing or already
+     * consumed artifact is rejected so concurrent authorization-code requests cannot both succeed.
      *
      * @param id - Artifact ID to mark as consumed
      */

package/dist/oidc/redis-adapter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"redis-adapter.d.ts","sourceRoot":"","sources":["../../src/oidc/redis-adapter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAKH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAE5D;;;;;;GAMG;AACH,qBAAa,YAAY;IACvB,+EAA+E;IAC/E,SAAS,CAAC,IAAI,EAAE,MAAM,CAAC;IAEvB,YAAY,IAAI,EAAE,MAAM,EAEvB;IAED;;;;OAIG;IACH,SAAS,CAAC,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CAEhC;IAED;;;;OAIG;IACH,SAAS,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAEpC;IAED;;;;OAIG;IACH,SAAS,CAAC,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAE9C;IAED;;;;OAIG;IACH,SAAS,CAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAE1C;IAED;;;;;;;;;;OAUG;IACG,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CA6DlF;IAED;;;;;;;OAOG;IACG,IAAI,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAY1D;IAED;;;;;;;;OAQG;IACG,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAO1E;IAED;;;;;;;;OAQG;IACG,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAOhE;IAED;;;;;;;;OAQG;IACG,OAAO,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAsBvC;IAED;;;;;;;OAOG;IACG,OAAO,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CA6BvC;IAED;;;;;;;;;OASG;IACG,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAmBpD;CACF;AAoBD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CA+B1E"}
+{"version":3,"file":"redis-adapter.d.ts","sourceRoot":"","sources":["../../src/oidc/redis-adapter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAMH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAwB5D;;;;;;GAMG;AACH,qBAAa,YAAY;IACvB,+EAA+E;IAC/E,SAAS,CAAC,IAAI,EAAE,MAAM,CAAC;IAEvB,YAAY,IAAI,EAAE,MAAM,EAEvB;IAED;;;;OAIG;IACH,SAAS,CAAC,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CAEhC;IAED;;;;OAIG;IACH,SAAS,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAEpC;IAED;;;;OAIG;IACH,SAAS,CAAC,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAE9C;IAED;;;;OAIG;IACH,SAAS,CAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAE1C;IAED;;;;;;;;;;OAUG;IACG,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CA6DlF;IAED;;;;;;;OAOG;IACG,IAAI,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAmB1D;IAED;;;;;;;;OAQG;IACG,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAO1E;IAED;;;;;;;;OAQG;IACG,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAOhE;IAED;;;;;;;OAOG;IACG,OAAO,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAUvC;IAED;;;;;;;OAOG;IACG,OAAO,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CA0BvC;IAED;;;;;;;;;OASG;IACG,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAmBpD;CACF;AAoBD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAkC1E"}

package/dist/oidc/redis-adapter.js

@@ -11,9 +11,31 @@
  *   oidc:{type}:user_code:{uc}      — User code index → primary ID (device flow)
  *   oidc:{type}:grant:{grantId}     — Grant set of primary IDs (for revocation)
  */
+import { errors } from 'oidc-provider';
 import { getRedis } from '../lib/redis.js';
 import { logger } from '../lib/logger.js';
-import { upsertSession, revokeSession } from '../lib/session-tracking.js';
+import { getSession, upsertSession, revokeSession } from '../lib/session-tracking.js';
+/**
+ * Atomically marks one Redis-backed OIDC artifact as consumed without changing its expiry.
+ *
+ * A separate read and write permits concurrent requests to consume the same single-use artifact.
+ * Redis executes this script as one operation, so only the first request can add `consumed`.
+ */
+const CONSUME_UNCONSUMED_ARTIFACT = `
+local payloadJson = redis.call('GET', KEYS[1])
+if not payloadJson then
+  return 0
+end
+
+local payload = cjson.decode(payloadJson)
+if payload.consumed ~= nil then
+  return 0
+end
+
+payload.consumed = tonumber(ARGV[1])
+redis.call('SET', KEYS[1], cjson.encode(payload), 'KEEPTTL')
+return 1
+`;
 /**
  * Redis adapter implementing the node-oidc-provider storage interface.
  *
@@ -73,6 +95,19 @@ export class RedisAdapter {
     async upsert(id, payload, expiresIn) {
         const redis = getRedis();
         const mainKey = this.key(id);
+        // PostgreSQL is the revocation authority for Session payloads. Persist it
+        // before preparing or executing Redis writes so a tracking failure cannot
+        // publish a Session that administrative deletion is unable to revoke.
+        if (this.name === 'Session') {
+            const expiresAt = new Date(Date.now() + expiresIn * 1000);
+            await upsertSession({
+                sessionId: id,
+                userId: typeof payload.accountId === 'string' ? payload.accountId : undefined,
+                organizationId: typeof payload.orgId === 'string' ? payload.orgId : undefined,
+                grantId: typeof payload.grantId === 'string' ? payload.grantId : undefined,
+                expiresAt,
+            });
+        }
         // Use pipeline for atomic multi-key operations
         const pipeline = redis.pipeline();
         // Store the full payload with TTL
@@ -110,22 +145,9 @@ export class RedisAdapter {
                 pipeline.expire(grantSetKey, expiresIn);
             }
         }
-        await pipeline.exec();
-        // Fire-and-forget: mirror session data to PostgreSQL for admin listing.
-        // Only Session model needs tracking — other models (Interaction, AuthorizationCode, etc.)
-        // are short-lived artifacts that don't need admin visibility.
-        if (this.name === 'Session') {
-            const expiresAt = new Date(Date.now() + expiresIn * 1000);
-            upsertSession({
-                sessionId: id,
-                userId: payload.accountId,
-                organizationId: payload.orgId,
-                grantId: payload.grantId,
-                expiresAt,
-            }).catch(() => {
-                // Intentionally swallowed — tracking must never break the OIDC flow.
-                // upsertSession already logs warnings internally.
-            });
+        const results = await pipeline.exec();
+        if (results === null || results.some(([error]) => error !== null)) {
+            throw new Error('Redis pipeline execution failed');
         }
     }
     /**
@@ -141,6 +163,12 @@ export class RedisAdapter {
         const data = await redis.get(this.key(id));
         if (!data)
             return undefined;
+        if (this.name === 'Session') {
+            const tracking = await getSession(id);
+            if (!tracking || tracking.revokedAt !== null || tracking.expiresAt.getTime() <= Date.now()) {
+                return undefined;
+            }
+        }
         try {
             return JSON.parse(data);
         }
@@ -184,34 +212,17 @@ export class RedisAdapter {
     /**
      * Mark an artifact as consumed.
      *
-     * Reads the current payload, adds a `consumed` timestamp (epoch seconds),
-     * and writes it back with the remaining TTL preserved. This is used for
-     * authorization code replay detection.
+     * Atomically adds a `consumed` timestamp while preserving the existing TTL. A missing or already
+     * consumed artifact is rejected so concurrent authorization-code requests cannot both succeed.
      *
      * @param id - Artifact ID to mark as consumed
      */
     async consume(id) {
         const redis = getRedis();
         const mainKey = this.key(id);
-        const data = await redis.get(mainKey);
-        if (!data)
-            return;
-        try {
-            const payload = JSON.parse(data);
-            payload.consumed = Math.floor(Date.now() / 1000);
-            // Preserve the remaining TTL when updating the payload
-            const ttl = await redis.ttl(mainKey);
-            if (ttl > 0) {
-                await redis.set(mainKey, JSON.stringify(payload), 'EX', ttl);
-            }
-            else {
-                // No TTL set (or key is expiring imminently) — just update
-                await redis.set(mainKey, JSON.stringify(payload));
-            }
-        }
-        catch (error) {
-            logger.warn({ key: mainKey, error }, 'Failed to consume OIDC artifact in Redis');
-        }
+        const consumed = await redis.eval(CONSUME_UNCONSUMED_ARTIFACT, 1, mainKey, Math.floor(Date.now() / 1000));
+        if (consumed !== 1)
+            throw new errors.InvalidGrant();
     }
     /**
      * Delete an artifact and its associated index keys.
@@ -240,15 +251,12 @@ export class RedisAdapter {
                 // If JSON parse fails, just delete the main key
             }
         }
-        await redis.del(...keysToDelete);
-        // Fire-and-forget: mark session as revoked in PostgreSQL tracking table.
-        // Only Session model needs tracking — other model destroys don't need admin visibility.
+        // Session revocation is the durable authority boundary. Complete it before
+        // deleting Redis so a concurrent publication cannot restore a live session.
         if (this.name === 'Session') {
-            revokeSession(id).catch(() => {
-                // Intentionally swallowed — tracking must never break the OIDC flow.
-                // revokeSession already logs warnings internally.
-            });
+            await revokeSession(id);
         }
+        await redis.del(...keysToDelete);
     }
     /**
      * Revoke all artifacts associated with a grant.

package/dist/oidc/redis-adapter.js.map

@@ -1 +1 @@
-{"version":3,"file":"redis-adapter.js","sourceRoot":"","sources":["../../src/oidc/redis-adapter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAC3C,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAG1E;;;;;;GAMG;AACH,MAAM,OAAO,YAAY;IACvB,+EAA+E;IACrE,IAAI,CAAS;IAEvB,YAAY,IAAY;QACtB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;IAED;;;;OAIG;IACO,GAAG,CAAC,EAAU;QACtB,OAAO,QAAQ,IAAI,CAAC,IAAI,IAAI,EAAE,EAAE,CAAC;IACnC,CAAC;IAED;;;;OAIG;IACO,MAAM,CAAC,GAAW;QAC1B,OAAO,QAAQ,IAAI,CAAC,IAAI,QAAQ,GAAG,EAAE,CAAC;IACxC,CAAC;IAED;;;;OAIG;IACO,WAAW,CAAC,QAAgB;QACpC,OAAO,QAAQ,IAAI,CAAC,IAAI,cAAc,QAAQ,EAAE,CAAC;IACnD,CAAC;IAED;;;;OAIG;IACO,QAAQ,CAAC,OAAe;QAChC,OAAO,QAAQ,IAAI,CAAC,IAAI,UAAU,OAAO,EAAE,CAAC;IAC9C,CAAC;IAED;;;;;;;;;;OAUG;IACH,KAAK,CAAC,MAAM,CAAC,EAAU,EAAE,OAAuB,EAAE,SAAiB;QACjE,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC;QACzB,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAE7B,+CAA+C;QAC/C,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,EAAE,CAAC;QAElC,kCAAkC;QAClC,IAAI,SAAS,EAAE,CAAC;YACd,QAAQ,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;QAClE,CAAC;aAAM,CAAC;YACN,QAAQ,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;QACjD,CAAC;QAED,0EAA0E;QAC1E,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;YAChB,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YACxC,IAAI,SAAS,EAAE,CAAC;gBACd,QAAQ,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;YAC5C,CAAC;iBAAM,CAAC;gBACN,QAAQ,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YAC3B,CAAC;QACH,CAAC;QAED,iFAAiF;QACjF,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;YACrB,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;YACjD,IAAI,SAAS,EAAE,CAAC;gBACd,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;YAC3C,CAAC;iBAAM,CAAC;gBACN,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YAC1B,CAAC;QACH,CAAC;QAED,4EAA4E;QAC5E,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;YACpB,MAAM,WAAW,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YACnD,QAAQ,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;YAC/B,IAAI,SAAS,EAAE,CAAC;gBACd,QAAQ,CAAC,MAAM,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;YAC1C,CAAC;QACH,CAAC;QAED,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QAEtB,wEAAwE;QACxE,0FAA0F;QAC1F,8DAA8D;QAC9D,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC5B,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,GAAG,IAAI,CAAC,CAAC;YAC1D,aAAa,CAAC;gBACZ,SAAS,EAAE,EAAE;gBACb,MAAM,EAAE,OAAO,CAAC,SAA+B;gBAC/C,cAAc,EAAE,OAAO,CAAC,KAA2B;gBACnD,OAAO,EAAE,OAAO,CAAC,OAA6B;gBAC9C,SAAS;aACV,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE;gBACZ,qEAAqE;gBACrE,kDAAkD;YACpD,CAAC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,IAAI,CAAC,EAAU;QACnB,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;QAE3C,IAAI,CAAC,IAAI;YAAE,OAAO,SAAS,CAAC;QAE5B,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAmB,CAAC;QAC5C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,oCAAoC,CAAC,CAAC;YAChF,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,cAAc,CAAC,QAAgB;QACnC,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC;QACzB,MAAM,EAAE,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC;QAEvD,IAAI,CAAC,EAAE;YAAE,OAAO,SAAS,CAAC;QAE1B,OAAO,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACvB,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,SAAS,CAAC,GAAW;QACzB,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC;QACzB,MAAM,EAAE,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QAE7C,IAAI,CAAC,EAAE;YAAE,OAAO,SAAS,CAAC;QAE1B,OAAO,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACvB,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,OAAO,CAAC,EAAU;QACtB,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC;QACzB,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAE7B,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACtC,IAAI,CAAC,IAAI;YAAE,OAAO;QAElB,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAmB,CAAC;YACnD,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;YAEjD,uDAAuD;YACvD,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YACrC,IAAI,GAAG,GAAG,CAAC,EAAE,CAAC;gBACZ,MAAM,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;YAC/D,CAAC;iBAAM,CAAC;gBACN,2DAA2D;gBAC3D,MAAM,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;YACpD,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,0CAA0C,CAAC,CAAC;QACnF,CAAC;IACH,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,OAAO,CAAC,EAAU;QACtB,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC;QACzB,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAE7B,6CAA6C;QAC7C,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACtC,MAAM,YAAY,GAAG,CAAC,OAAO,CAAC,CAAC;QAE/B,IAAI,IAAI,EAAE,CAAC;YACT,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAmB,CAAC;gBACnD,oCAAoC;gBACpC,IAAI,OAAO,CAAC,GAAG;oBAAE,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;gBAC7D,IAAI,OAAO,CAAC,QAAQ;oBAAE,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;YAC9E,CAAC;YAAC,MAAM,CAAC;gBACP,gDAAgD;YAClD,CAAC;QACH,CAAC;QAED,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,YAAY,CAAC,CAAC;QAEjC,yEAAyE;QACzE,wFAAwF;QACxF,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC5B,aAAa,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE;gBAC3B,qEAAqE;gBACrE,kDAAkD;YACpD,CAAC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,eAAe,CAAC,OAAe;QACnC,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC;QACzB,MAAM,WAAW,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QAE3C,qCAAqC;QACrC,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QAElD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,mEAAmE;YACnE,MAAM,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;YAC7B,OAAO;QACT,CAAC;QAED,2DAA2D;QAC3D,MAAM,cAAc,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;QAC7D,MAAM,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;QAElC,8BAA8B;QAC9B,MAAM,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IAC/B,CAAC;CACF;AAED,8EAA8E;AAC9E,sDAAsD;AACtD,8EAA8E;AAE9E;;;;GAIG;AACH,MAAM,iBAAiB,GAAG;IACxB,SAAS;IACT,aAAa;IACb,mBAAmB;IACnB,iBAAiB;IACjB,mBAAmB;IACnB,4BAA4B;CAC7B,CAAC;AAEF;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,QAAkB;IACzD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAElC,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC;QACzB,MAAM,YAAY,GAAa,EAAE,CAAC;QAElC,oEAAoE;QACpE,qDAAqD;QACrD,KAAK,MAAM,KAAK,IAAI,iBAAiB,EAAE,CAAC;YACtC,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;gBAC/B,MAAM,QAAQ,GAAG,QAAQ,KAAK,UAAU,OAAO,EAAE,CAAC;gBAClD,yCAAyC;gBACzC,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;gBAC/C,8CAA8C;gBAC9C,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;gBAC5B,+CAA+C;gBAC/C,KAAK,MAAM,QAAQ,IAAI,OAAO,EAAE,CAAC;oBAC/B,YAAY,CAAC,IAAI,CAAC,QAAQ,KAAK,IAAI,QAAQ,EAAE,CAAC,CAAC;gBACjD,CAAC;YACH,CAAC;QACH,CAAC;QAED,qDAAqD;QACrD,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC5B,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,YAAY,CAAC,CAAC;QACnC,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,+DAA+D;QAC/D,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,EAAE,gEAAgE,CAAC,CAAC;IACnG,CAAC;AACH,CAAC"}
+{"version":3,"file":"redis-adapter.js","sourceRoot":"","sources":["../../src/oidc/redis-adapter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AACvC,OAAO,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAC3C,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC1C,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAGtF;;;;;GAKG;AACH,MAAM,2BAA2B,GAAG;;;;;;;;;;;;;;CAcnC,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,OAAO,YAAY;IACvB,+EAA+E;IACrE,IAAI,CAAS;IAEvB,YAAY,IAAY;QACtB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;IAED;;;;OAIG;IACO,GAAG,CAAC,EAAU;QACtB,OAAO,QAAQ,IAAI,CAAC,IAAI,IAAI,EAAE,EAAE,CAAC;IACnC,CAAC;IAED;;;;OAIG;IACO,MAAM,CAAC,GAAW;QAC1B,OAAO,QAAQ,IAAI,CAAC,IAAI,QAAQ,GAAG,EAAE,CAAC;IACxC,CAAC;IAED;;;;OAIG;IACO,WAAW,CAAC,QAAgB;QACpC,OAAO,QAAQ,IAAI,CAAC,IAAI,cAAc,QAAQ,EAAE,CAAC;IACnD,CAAC;IAED;;;;OAIG;IACO,QAAQ,CAAC,OAAe;QAChC,OAAO,QAAQ,IAAI,CAAC,IAAI,UAAU,OAAO,EAAE,CAAC;IAC9C,CAAC;IAED;;;;;;;;;;OAUG;IACH,KAAK,CAAC,MAAM,CAAC,EAAU,EAAE,OAAuB,EAAE,SAAiB;QACjE,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC;QACzB,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAE7B,0EAA0E;QAC1E,0EAA0E;QAC1E,sEAAsE;QACtE,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC5B,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,GAAG,IAAI,CAAC,CAAC;YAC1D,MAAM,aAAa,CAAC;gBAClB,SAAS,EAAE,EAAE;gBACb,MAAM,EAAE,OAAO,OAAO,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;gBAC7E,cAAc,EAAE,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;gBAC7E,OAAO,EAAE,OAAO,OAAO,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS;gBAC1E,SAAS;aACV,CAAC,CAAC;QACL,CAAC;QAED,+CAA+C;QAC/C,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,EAAE,CAAC;QAElC,kCAAkC;QAClC,IAAI,SAAS,EAAE,CAAC;YACd,QAAQ,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;QAClE,CAAC;aAAM,CAAC;YACN,QAAQ,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;QACjD,CAAC;QAED,0EAA0E;QAC1E,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;YAChB,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YACxC,IAAI,SAAS,EAAE,CAAC;gBACd,QAAQ,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;YAC5C,CAAC;iBAAM,CAAC;gBACN,QAAQ,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YAC3B,CAAC;QACH,CAAC;QAED,iFAAiF;QACjF,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;YACrB,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;YACjD,IAAI,SAAS,EAAE,CAAC;gBACd,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;YAC3C,CAAC;iBAAM,CAAC;gBACN,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YAC1B,CAAC;QACH,CAAC;QAED,4EAA4E;QAC5E,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;YACpB,MAAM,WAAW,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YACnD,QAAQ,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;YAC/B,IAAI,SAAS,EAAE,CAAC;gBACd,QAAQ,CAAC,MAAM,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;YAC1C,CAAC;QACH,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QACtC,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,KAAK,IAAI,CAAC,EAAE,CAAC;YAClE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;QACrD,CAAC;IACH,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,IAAI,CAAC,EAAU;QACnB,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;QAE3C,IAAI,CAAC,IAAI;YAAE,OAAO,SAAS,CAAC;QAE5B,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC5B,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,EAAE,CAAC,CAAC;YACtC,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,SAAS,KAAK,IAAI,IAAI,QAAQ,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;gBAC3F,OAAO,SAAS,CAAC;YACnB,CAAC;QACH,CAAC;QAED,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAmB,CAAC;QAC5C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,oCAAoC,CAAC,CAAC;YAChF,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,cAAc,CAAC,QAAgB;QACnC,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC;QACzB,MAAM,EAAE,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC;QAEvD,IAAI,CAAC,EAAE;YAAE,OAAO,SAAS,CAAC;QAE1B,OAAO,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACvB,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,SAAS,CAAC,GAAW;QACzB,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC;QACzB,MAAM,EAAE,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QAE7C,IAAI,CAAC,EAAE;YAAE,OAAO,SAAS,CAAC;QAE1B,OAAO,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACvB,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,OAAO,CAAC,EAAU;QACtB,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC;QACzB,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC7B,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,IAAI,CAC/B,2BAA2B,EAC3B,CAAC,EACD,OAAO,EACP,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAC9B,CAAC;QACF,IAAI,QAAQ,KAAK,CAAC;YAAE,MAAM,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;IACtD,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,OAAO,CAAC,EAAU;QACtB,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC;QACzB,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAE7B,6CAA6C;QAC7C,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACtC,MAAM,YAAY,GAAG,CAAC,OAAO,CAAC,CAAC;QAE/B,IAAI,IAAI,EAAE,CAAC;YACT,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAmB,CAAC;gBACnD,oCAAoC;gBACpC,IAAI,OAAO,CAAC,GAAG;oBAAE,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;gBAC7D,IAAI,OAAO,CAAC,QAAQ;oBAAE,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;YAC9E,CAAC;YAAC,MAAM,CAAC;gBACP,gDAAgD;YAClD,CAAC;QACH,CAAC;QAED,2EAA2E;QAC3E,4EAA4E;QAC5E,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC5B,MAAM,aAAa,CAAC,EAAE,CAAC,CAAC;QAC1B,CAAC;QAED,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,YAAY,CAAC,CAAC;IACnC,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,eAAe,CAAC,OAAe;QACnC,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC;QACzB,MAAM,WAAW,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QAE3C,qCAAqC;QACrC,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QAElD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,mEAAmE;YACnE,MAAM,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;YAC7B,OAAO;QACT,CAAC;QAED,2DAA2D;QAC3D,MAAM,cAAc,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;QAC7D,MAAM,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;QAElC,8BAA8B;QAC9B,MAAM,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IAC/B,CAAC;CACF;AAED,8EAA8E;AAC9E,sDAAsD;AACtD,8EAA8E;AAE9E;;;;GAIG;AACH,MAAM,iBAAiB,GAAG;IACxB,SAAS;IACT,aAAa;IACb,mBAAmB;IACnB,iBAAiB;IACjB,mBAAmB;IACnB,4BAA4B;CAC7B,CAAC;AAEF;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,QAAkB;IACzD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAElC,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC;QACzB,MAAM,YAAY,GAAa,EAAE,CAAC;QAElC,oEAAoE;QACpE,qDAAqD;QACrD,KAAK,MAAM,KAAK,IAAI,iBAAiB,EAAE,CAAC;YACtC,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;gBAC/B,MAAM,QAAQ,GAAG,QAAQ,KAAK,UAAU,OAAO,EAAE,CAAC;gBAClD,yCAAyC;gBACzC,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;gBAC/C,8CAA8C;gBAC9C,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;gBAC5B,+CAA+C;gBAC/C,KAAK,MAAM,QAAQ,IAAI,OAAO,EAAE,CAAC;oBAC/B,YAAY,CAAC,IAAI,CAAC,QAAQ,KAAK,IAAI,QAAQ,EAAE,CAAC,CAAC;gBACjD,CAAC;YACH,CAAC;QACH,CAAC;QAED,qDAAqD;QACrD,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC5B,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,YAAY,CAAC,CAAC;QACnC,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,+DAA+D;QAC/D,MAAM,CAAC,IAAI,CACT,EAAE,GAAG,EAAE,QAAQ,EAAE,EACjB,gEAAgE,CACjE,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/organizations/branding-url.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Validate and normalize an externally hosted branding image URL.
+ *
+ * Production accepts credential-free HTTPS URLs. Development and test
+ * environments additionally accept HTTP on exact loopback hosts so local
+ * identity flows can load local assets without weakening deployed systems.
+ */
+/**
+ * Return the normalized branding URL or reject values that are unsafe to render.
+ *
+ * @param value - User-supplied absolute image URL.
+ * @returns The URL with surrounding whitespace removed.
+ * @throws OrganizationValidationError when the URL is malformed, contains credentials, or uses a
+ * disallowed protocol or host.
+ */
+export declare function validateBrandingImageUrl(value: string): string;
+//# sourceMappingURL=branding-url.d.ts.map

package/dist/organizations/branding-url.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"branding-url.d.ts","sourceRoot":"","sources":["../../src/organizations/branding-url.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAOH;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAqB9D"}

package/dist/organizations/branding-url.js

@@ -0,0 +1,38 @@
+/**
+ * Validate and normalize an externally hosted branding image URL.
+ *
+ * Production accepts credential-free HTTPS URLs. Development and test
+ * environments additionally accept HTTP on exact loopback hosts so local
+ * identity flows can load local assets without weakening deployed systems.
+ */
+import { config } from '../config/index.js';
+import { OrganizationValidationError } from './errors.js';
+const LOOPBACK_HOSTS = new Set(['localhost', '127.0.0.1', '[::1]']);
+/**
+ * Return the normalized branding URL or reject values that are unsafe to render.
+ *
+ * @param value - User-supplied absolute image URL.
+ * @returns The URL with surrounding whitespace removed.
+ * @throws OrganizationValidationError when the URL is malformed, contains credentials, or uses a
+ * disallowed protocol or host.
+ */
+export function validateBrandingImageUrl(value) {
+    const normalized = value.trim();
+    let url;
+    try {
+        url = new URL(normalized);
+    }
+    catch {
+        throw new OrganizationValidationError('Branding image URL is invalid');
+    }
+    if (url.username !== '' || url.password !== '') {
+        throw new OrganizationValidationError('Branding image URL is invalid');
+    }
+    if (url.protocol === 'https:')
+        return normalized;
+    const localHttpAllowed = config.nodeEnv !== 'production' && url.protocol === 'http:' && LOOPBACK_HOSTS.has(url.hostname);
+    if (localHttpAllowed)
+        return normalized;
+    throw new OrganizationValidationError('Branding image URL is invalid');
+}
+//# sourceMappingURL=branding-url.js.map

package/dist/organizations/branding-url.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"branding-url.js","sourceRoot":"","sources":["../../src/organizations/branding-url.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EAAE,2BAA2B,EAAE,MAAM,aAAa,CAAC;AAE1D,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC;AAEpE;;;;;;;GAOG;AACH,MAAM,UAAU,wBAAwB,CAAC,KAAa;IACpD,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAChC,IAAI,GAAQ,CAAC;IAEb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,2BAA2B,CAAC,+BAA+B,CAAC,CAAC;IACzE,CAAC;IAED,IAAI,GAAG,CAAC,QAAQ,KAAK,EAAE,IAAI,GAAG,CAAC,QAAQ,KAAK,EAAE,EAAE,CAAC;QAC/C,MAAM,IAAI,2BAA2B,CAAC,+BAA+B,CAAC,CAAC;IACzE,CAAC;IAED,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ;QAAE,OAAO,UAAU,CAAC;IAEjD,MAAM,gBAAgB,GACpB,MAAM,CAAC,OAAO,KAAK,YAAY,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAClG,IAAI,gBAAgB;QAAE,OAAO,UAAU,CAAC;IAExC,MAAM,IAAI,2BAA2B,CAAC,+BAA+B,CAAC,CAAC;AACzE,CAAC"}