@taico/taico 0.0.5 → 0.2.0

package/dist/authorization-server/dto/authorization-request.dto.js

@@ -92,12 +92,12 @@ __decorate([
     __metadata("design:type", String)
 ], AuthorizationRequestDto.prototype, "state", void 0);
 __decorate([
-    (0, swagger_1.ApiProperty)({
+    (0, swagger_1.ApiPropertyOptional)({
         description: 'Resource server URL that the client wants to access',
         example: 'http://localhost:4001/',
     }),
+    (0, class_validator_1.IsOptional)(),
     (0, class_validator_1.IsString)(),
-    (0, class_validator_1.IsNotEmpty)(),
     (0, class_validator_1.IsUrl)({ require_tld: false, require_protocol: true }),
     __metadata("design:type", String)
 ], AuthorizationRequestDto.prototype, "resource", void 0);

package/dist/authorization-server/dto/authorization-request.dto.js.map

@@ -1 +1 @@
-{"version":3,"file":"authorization-request.dto.js","sourceRoot":"","sources":["../../../src/authorization-server/dto/authorization-request.dto.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,qDAQyB;AACzB,6CAAmE;AACnE,oCAAwC;AAMxC,MAAa,uBAAuB;IAQlC,aAAa,CAAgB;IAQ7B,KAAK,CAAU;IAQf,SAAS,CAAU;IAUnB,cAAc,CAAU;IASxB,qBAAqB,CAAU;IAS/B,YAAY,CAAU;IAQtB,KAAK,CAAU;IASf,QAAQ,CAAU;CACnB;AAtED,0DAsEC;AA9DC;IAPC,IAAA,qBAAW,EAAC;QACX,WAAW,EACT,sEAAsE;QACxE,OAAO,EAAE,MAAM;QACf,IAAI,EAAE,oBAAY;KACnB,CAAC;IACD,IAAA,wBAAM,EAAC,oBAAY,CAAC;;8DACQ;AAQ7B;IANC,IAAA,6BAAmB,EAAC;QACnB,WAAW,EAAE,gDAAgD;QAC7D,OAAO,EAAE,wBAAwB;KAClC,CAAC;IACD,IAAA,4BAAU,GAAE;IACZ,IAAA,0BAAQ,GAAE;;sDACI;AAQf;IANC,IAAA,qBAAW,EAAC;QACX,WAAW,EAAE,8CAA8C;QAC3D,OAAO,EAAE,kCAAkC;KAC5C,CAAC;IACD,IAAA,0BAAQ,GAAE;IACV,IAAA,4BAAU,GAAE;;0DACM;AAUnB;IARC,IAAA,qBAAW,EAAC;QACX,WAAW,EAAE,oDAAoD;QACjE,OAAO,EAAE,6CAA6C;KACvD,CAAC;IACD,IAAA,0BAAQ,GAAE;IACV,IAAA,4BAAU,GAAE;IACZ,IAAA,wBAAM,EAAC,EAAE,EAAE,GAAG,CAAC;IACf,IAAA,yBAAO,EAAC,kBAAkB,CAAC;;+DACJ;AASxB;IAPC,IAAA,qBAAW,EAAC;QACX,WAAW,EAAE,+CAA+C;QAC5D,OAAO,EAAE,MAAM;KAChB,CAAC;IACD,IAAA,0BAAQ,GAAE;IACV,IAAA,4BAAU,GAAE;IACZ,IAAA,yBAAO,EAAC,QAAQ,CAAC;;sEACa;AAS/B;IAPC,IAAA,qBAAW,EAAC;QACX,WAAW,EAAE,4DAA4D;QACzE,OAAO,EAAE,4CAA4C;KACtD,CAAC;IACD,IAAA,0BAAQ,GAAE;IACV,IAAA,4BAAU,GAAE;IACZ,IAAA,uBAAK,EAAC,EAAE,WAAW,EAAE,KAAK,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAAC;;6DAChC;AAQtB;IANC,IAAA,qBAAW,EAAC;QACX,WAAW,EAAE,wCAAwC;QACrD,OAAO,EAAE,kEAAkE;KAC5E,CAAC;IACD,IAAA,0BAAQ,GAAE;IACV,IAAA,4BAAU,GAAE;;sDACE;AASf;IAPC,IAAA,qBAAW,EAAC;QACX,WAAW,EAAE,qDAAqD;QAClE,OAAO,EAAE,wBAAwB;KAClC,CAAC;IACD,IAAA,0BAAQ,GAAE;IACV,IAAA,4BAAU,GAAE;IACZ,IAAA,uBAAK,EAAC,EAAE,WAAW,EAAE,KAAK,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAAC;;yDACpC"}
+{"version":3,"file":"authorization-request.dto.js","sourceRoot":"","sources":["../../../src/authorization-server/dto/authorization-request.dto.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,qDAQyB;AACzB,6CAAmE;AACnE,oCAAwC;AAMxC,MAAa,uBAAuB;IAQlC,aAAa,CAAgB;IAQ7B,KAAK,CAAU;IAQf,SAAS,CAAU;IAUnB,cAAc,CAAU;IASxB,qBAAqB,CAAU;IAS/B,YAAY,CAAU;IAQtB,KAAK,CAAU;IASf,QAAQ,CAAU;CACnB;AAtED,0DAsEC;AA9DC;IAPC,IAAA,qBAAW,EAAC;QACX,WAAW,EACT,sEAAsE;QACxE,OAAO,EAAE,MAAM;QACf,IAAI,EAAE,oBAAY;KACnB,CAAC;IACD,IAAA,wBAAM,EAAC,oBAAY,CAAC;;8DACQ;AAQ7B;IANC,IAAA,6BAAmB,EAAC;QACnB,WAAW,EAAE,gDAAgD;QAC7D,OAAO,EAAE,wBAAwB;KAClC,CAAC;IACD,IAAA,4BAAU,GAAE;IACZ,IAAA,0BAAQ,GAAE;;sDACI;AAQf;IANC,IAAA,qBAAW,EAAC;QACX,WAAW,EAAE,8CAA8C;QAC3D,OAAO,EAAE,kCAAkC;KAC5C,CAAC;IACD,IAAA,0BAAQ,GAAE;IACV,IAAA,4BAAU,GAAE;;0DACM;AAUnB;IARC,IAAA,qBAAW,EAAC;QACX,WAAW,EAAE,oDAAoD;QACjE,OAAO,EAAE,6CAA6C;KACvD,CAAC;IACD,IAAA,0BAAQ,GAAE;IACV,IAAA,4BAAU,GAAE;IACZ,IAAA,wBAAM,EAAC,EAAE,EAAE,GAAG,CAAC;IACf,IAAA,yBAAO,EAAC,kBAAkB,CAAC;;+DACJ;AASxB;IAPC,IAAA,qBAAW,EAAC;QACX,WAAW,EAAE,+CAA+C;QAC5D,OAAO,EAAE,MAAM;KAChB,CAAC;IACD,IAAA,0BAAQ,GAAE;IACV,IAAA,4BAAU,GAAE;IACZ,IAAA,yBAAO,EAAC,QAAQ,CAAC;;sEACa;AAS/B;IAPC,IAAA,qBAAW,EAAC;QACX,WAAW,EAAE,4DAA4D;QACzE,OAAO,EAAE,4CAA4C;KACtD,CAAC;IACD,IAAA,0BAAQ,GAAE;IACV,IAAA,4BAAU,GAAE;IACZ,IAAA,uBAAK,EAAC,EAAE,WAAW,EAAE,KAAK,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAAC;;6DAChC;AAQtB;IANC,IAAA,qBAAW,EAAC;QACX,WAAW,EAAE,wCAAwC;QACrD,OAAO,EAAE,kEAAkE;KAC5E,CAAC;IACD,IAAA,0BAAQ,GAAE;IACV,IAAA,4BAAU,GAAE;;sDACE;AASf;IAPC,IAAA,6BAAmB,EAAC;QACnB,WAAW,EAAE,qDAAqD;QAClE,OAAO,EAAE,wBAAwB;KAClC,CAAC;IACD,IAAA,4BAAU,GAAE;IACZ,IAAA,0BAAQ,GAAE;IACV,IAAA,uBAAK,EAAC,EAAE,WAAW,EAAE,KAAK,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAAC;;yDACpC"}

package/dist/authorization-server/dto/authorization-request.dto.spec.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/authorization-server/dto/authorization-request.dto.spec.js

@@ -0,0 +1,30 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const class_validator_1 = require("class-validator");
+const authorization_request_dto_1 = require("./authorization-request.dto");
+const enums_1 = require("../enums");
+describe('AuthorizationRequestDto', () => {
+    const createValidDto = () => {
+        const dto = new authorization_request_dto_1.AuthorizationRequestDto();
+        dto.response_type = enums_1.ResponseType.CODE;
+        dto.client_id = 'client-id';
+        dto.code_challenge = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_1';
+        dto.code_challenge_method = 'S256';
+        dto.redirect_uri = 'http://127.0.0.1:53299/callback';
+        dto.state = 'state-value';
+        dto.scope = 'tasks:read';
+        return dto;
+    };
+    it('allows authorization requests without resource', async () => {
+        const dto = createValidDto();
+        const errors = await (0, class_validator_1.validate)(dto);
+        expect(errors).toHaveLength(0);
+    });
+    it('still validates resource format when resource is provided', async () => {
+        const dto = createValidDto();
+        dto.resource = 'not-a-url';
+        const errors = await (0, class_validator_1.validate)(dto);
+        expect(errors.some((error) => error.property === 'resource')).toBe(true);
+    });
+});
+//# sourceMappingURL=authorization-request.dto.spec.js.map

package/dist/authorization-server/dto/authorization-request.dto.spec.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorization-request.dto.spec.js","sourceRoot":"","sources":["../../../src/authorization-server/dto/authorization-request.dto.spec.ts"],"names":[],"mappings":";;AAAA,qDAA2C;AAC3C,2EAAsE;AACtE,oCAAwC;AAExC,QAAQ,CAAC,yBAAyB,EAAE,GAAG,EAAE;IACvC,MAAM,cAAc,GAAG,GAA4B,EAAE;QACnD,MAAM,GAAG,GAAG,IAAI,mDAAuB,EAAE,CAAC;QAC1C,GAAG,CAAC,aAAa,GAAG,oBAAY,CAAC,IAAI,CAAC;QACtC,GAAG,CAAC,SAAS,GAAG,WAAW,CAAC;QAC5B,GAAG,CAAC,cAAc,GAAG,mEAAmE,CAAC;QACzF,GAAG,CAAC,qBAAqB,GAAG,MAAM,CAAC;QACnC,GAAG,CAAC,YAAY,GAAG,iCAAiC,CAAC;QACrD,GAAG,CAAC,KAAK,GAAG,aAAa,CAAC;QAC1B,GAAG,CAAC,KAAK,GAAG,YAAY,CAAC;QACzB,OAAO,GAAG,CAAC;IACb,CAAC,CAAC;IAEF,EAAE,CAAC,gDAAgD,EAAE,KAAK,IAAI,EAAE;QAC9D,MAAM,GAAG,GAAG,cAAc,EAAE,CAAC;QAE7B,MAAM,MAAM,GAAG,MAAM,IAAA,0BAAQ,EAAC,GAAG,CAAC,CAAC;QAEnC,MAAM,CAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IACjC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2DAA2D,EAAE,KAAK,IAAI,EAAE;QACzE,MAAM,GAAG,GAAG,cAAc,EAAE,CAAC;QAC7B,GAAG,CAAC,QAAQ,GAAG,WAAW,CAAC;QAE3B,MAAM,MAAM,GAAG,MAAM,IAAA,0BAAQ,EAAC,GAAG,CAAC,CAAC;QAEnC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,KAAK,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC3E,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/authorization-server/dto/onboarding-request.dto.d.ts

@@ -0,0 +1,6 @@
+export declare class OnboardingRequestDto {
+    email: string;
+    displayName: string;
+    slug: string;
+    password: string;
+}

package/dist/authorization-server/dto/onboarding-request.dto.js

@@ -0,0 +1,57 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OnboardingRequestDto = void 0;
+const swagger_1 = require("@nestjs/swagger");
+const class_validator_1 = require("class-validator");
+class OnboardingRequestDto {
+    email;
+    displayName;
+    slug;
+    password;
+}
+exports.OnboardingRequestDto = OnboardingRequestDto;
+__decorate([
+    (0, swagger_1.ApiProperty)({
+        description: 'Email address for the first admin user',
+        example: 'admin@example.com',
+    }),
+    (0, class_validator_1.IsEmail)(),
+    __metadata("design:type", String)
+], OnboardingRequestDto.prototype, "email", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({
+        description: 'Display name for the first admin user',
+        example: 'Admin User',
+    }),
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.IsNotEmpty)(),
+    __metadata("design:type", String)
+], OnboardingRequestDto.prototype, "displayName", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({
+        description: 'Slug/username for the first admin user',
+        example: 'admin',
+    }),
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.IsNotEmpty)(),
+    __metadata("design:type", String)
+], OnboardingRequestDto.prototype, "slug", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({
+        description: 'Password for the first admin user (minimum 8 characters)',
+        example: 'securepassword123',
+    }),
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.MinLength)(8),
+    __metadata("design:type", String)
+], OnboardingRequestDto.prototype, "password", void 0);
+//# sourceMappingURL=onboarding-request.dto.js.map

package/dist/authorization-server/dto/onboarding-request.dto.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"onboarding-request.dto.js","sourceRoot":"","sources":["../../../src/authorization-server/dto/onboarding-request.dto.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,6CAA8C;AAC9C,qDAA2E;AAE3E,MAAa,oBAAoB;IAM/B,KAAK,CAAU;IAQf,WAAW,CAAU;IAQrB,IAAI,CAAU;IAQd,QAAQ,CAAU;CACnB;AA/BD,oDA+BC;AAzBC;IALC,IAAA,qBAAW,EAAC;QACX,WAAW,EAAE,wCAAwC;QACrD,OAAO,EAAE,mBAAmB;KAC7B,CAAC;IACD,IAAA,yBAAO,GAAE;;mDACK;AAQf;IANC,IAAA,qBAAW,EAAC;QACX,WAAW,EAAE,uCAAuC;QACpD,OAAO,EAAE,YAAY;KACtB,CAAC;IACD,IAAA,0BAAQ,GAAE;IACV,IAAA,4BAAU,GAAE;;yDACQ;AAQrB;IANC,IAAA,qBAAW,EAAC;QACX,WAAW,EAAE,wCAAwC;QACrD,OAAO,EAAE,OAAO;KACjB,CAAC;IACD,IAAA,0BAAQ,GAAE;IACV,IAAA,4BAAU,GAAE;;kDACC;AAQd;IANC,IAAA,qBAAW,EAAC;QACX,WAAW,EAAE,0DAA0D;QACvE,OAAO,EAAE,mBAAmB;KAC7B,CAAC;IACD,IAAA,0BAAQ,GAAE;IACV,IAAA,2BAAS,EAAC,CAAC,CAAC;;sDACK"}

package/dist/authorization-server/dto/onboarding-status-response.dto.d.ts

@@ -0,0 +1,3 @@
+export declare class OnboardingStatusResponseDto {
+    needsOnboarding: boolean;
+}

package/dist/authorization-server/dto/onboarding-status-response.dto.js

@@ -0,0 +1,25 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OnboardingStatusResponseDto = void 0;
+const swagger_1 = require("@nestjs/swagger");
+class OnboardingStatusResponseDto {
+    needsOnboarding;
+}
+exports.OnboardingStatusResponseDto = OnboardingStatusResponseDto;
+__decorate([
+    (0, swagger_1.ApiProperty)({
+        description: 'Whether the system needs to be onboarded (no admin users exist)',
+        example: true,
+    }),
+    __metadata("design:type", Boolean)
+], OnboardingStatusResponseDto.prototype, "needsOnboarding", void 0);
+//# sourceMappingURL=onboarding-status-response.dto.js.map

package/dist/authorization-server/dto/onboarding-status-response.dto.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"onboarding-status-response.dto.js","sourceRoot":"","sources":["../../../src/authorization-server/dto/onboarding-status-response.dto.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,6CAA8C;AAE9C,MAAa,2BAA2B;IAKtC,eAAe,CAAW;CAC3B;AAND,kEAMC;AADC;IAJC,IAAA,qBAAW,EAAC;QACX,WAAW,EAAE,iEAAiE;QAC9E,OAAO,EAAE,IAAI;KACd,CAAC;;oEACwB"}

package/dist/authorization-server/dto/register-client.dto.js

@@ -87,8 +87,8 @@ __decorate([
 __decorate([
     (0, swagger_1.ApiPropertyOptional)({
         description: 'Requested scopes for the client',
-        example: ['data:read', 'data:write'],
-        type: [String],
+        example: 'data:read data:write',
+        type: String,
     }),
     (0, class_validator_1.IsString)(),
     (0, class_validator_1.IsOptional)(),

package/dist/authorization-server/dto/register-client.dto.js.map

@@ -1 +1 @@
-{"version":3,"file":"register-client.dto.js","sourceRoot":"","sources":["../../../src/authorization-server/dto/register-client.dto.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,qDAUyB;AACzB,6CAAmE;AACnE,oCAA4E;AAmB5E,MAAa,iBAAiB;IAU5B,aAAa,CAAY;IASzB,0BAA0B,CAA2B;IAYrD,WAAW,CAAe;IAY1B,cAAc,CAAkB;IAQhC,WAAW,CAAU;IAarB,KAAK,CAAU;IAUf,QAAQ,CAAY;IAQpB,OAAO,CAAU;IAQjB,UAAU,CAAU;IAQpB,QAAQ,CAAU;IASlB,UAAU,CAAU;IASpB,QAAQ,CAAU;IAUlB,IAAI,CAAU;IASd,WAAW,CAAU;IAQrB,gBAAgB,CAAU;CAC3B;AAhJD,8CAgJC;AAtIC;IATC,IAAA,qBAAW,EAAC;QACX,WAAW,EACT,kGAAkG;QACpG,OAAO,EAAE,CAAC,gCAAgC,EAAE,8BAA8B,CAAC;QAC3E,IAAI,EAAE,CAAC,MAAM,CAAC;KACf,CAAC;IACD,IAAA,yBAAO,GAAE;IACT,IAAA,+BAAa,GAAE;IACf,IAAA,uBAAK,EAAC,EAAE,WAAW,EAAE,KAAK,EAAE,gBAAgB,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;;wDAC7C;AASzB;IAPC,IAAA,qBAAW,EAAC;QACX,WAAW,EACT,uEAAuE;QACzE,OAAO,EAAE,+BAAuB,CAAC,IAAI;QACrC,IAAI,EAAE,+BAAuB;KAC9B,CAAC;IACD,IAAA,wBAAM,EAAC,+BAAuB,CAAC;;qEACqB;AAYrD;IAVC,IAAA,qBAAW,EAAC;QACX,WAAW,EACT,0GAA0G;QAC5G,OAAO,EAAE,CAAC,oBAAoB,EAAE,eAAe,CAAC;QAChD,IAAI,EAAE,iBAAS;QACf,OAAO,EAAE,IAAI;KACd,CAAC;IACD,IAAA,yBAAO,GAAE;IACT,IAAA,+BAAa,GAAE;IACf,IAAA,wBAAM,EAAC,iBAAS,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;;sDACR;AAY1B;IAVC,IAAA,qBAAW,EAAC;QACX,WAAW,EACT,qGAAqG;QACvG,OAAO,EAAE,CAAC,oBAAY,CAAC,IAAI,CAAC;QAC5B,IAAI,EAAE,oBAAY;QAClB,OAAO,EAAE,IAAI;KACd,CAAC;IACD,IAAA,yBAAO,GAAE;IACT,IAAA,+BAAa,GAAE;IACf,IAAA,wBAAM,EAAC,oBAAY,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;;yDACL;AAQhC;IANC,IAAA,qBAAW,EAAC;QACX,WAAW,EAAE,mCAAmC;QAChD,OAAO,EAAE,iBAAiB;KAC3B,CAAC;IACD,IAAA,0BAAQ,GAAE;IACV,IAAA,4BAAU,GAAE;;sDACQ;AAarB;IAPC,IAAA,6BAAmB,EAAC;QACnB,WAAW,EAAE,iCAAiC;QAC9C,OAAO,EAAE,CAAC,WAAW,EAAE,YAAY,CAAC;QACpC,IAAI,EAAE,CAAC,MAAM,CAAC;KACf,CAAC;IACD,IAAA,0BAAQ,GAAE;IACV,IAAA,4BAAU,GAAE;;gDACE;AAUf;IARC,IAAA,6BAAmB,EAAC;QACnB,WAAW,EAAE,4CAA4C;QACzD,OAAO,EAAE,CAAC,mBAAmB,CAAC;QAC9B,IAAI,EAAE,CAAC,MAAM,CAAC;KACf,CAAC;IACD,IAAA,yBAAO,GAAE;IACT,IAAA,0BAAQ,EAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IACxB,IAAA,4BAAU,GAAE;;mDACO;AAQpB;IANC,IAAA,6BAAmB,EAAC;QACnB,WAAW,EAAE,kDAAkD;QAC/D,OAAO,EAAE,yBAAyB;KACnC,CAAC;IACD,IAAA,uBAAK,GAAE;IACP,IAAA,4BAAU,GAAE;;kDACI;AAQjB;IANC,IAAA,6BAAmB,EAAC;QACnB,WAAW,EAAE,oCAAoC;QACjD,OAAO,EAAE,qBAAqB;KAC/B,CAAC;IACD,IAAA,uBAAK,GAAE;IACP,IAAA,4BAAU,GAAE;;qDACO;AAQpB;IANC,IAAA,6BAAmB,EAAC;QACnB,WAAW,EAAE,uDAAuD;QACpE,OAAO,EAAE,8BAA8B;KACxC,CAAC;IACD,IAAA,uBAAK,GAAE;IACP,IAAA,4BAAU,GAAE;;mDACK;AASlB;IAPC,IAAA,6BAAmB,EAAC;QACnB,WAAW,EACT,8FAA8F;QAChG,OAAO,EAAE,6BAA6B;KACvC,CAAC;IACD,IAAA,uBAAK,GAAE;IACP,IAAA,4BAAU,GAAE;;qDACO;AASpB;IAPC,IAAA,6BAAmB,EAAC;QACnB,WAAW,EACT,6FAA6F;QAC/F,OAAO,EAAE,2CAA2C;KACrD,CAAC;IACD,IAAA,uBAAK,GAAE;IACP,IAAA,4BAAU,GAAE;;mDACK;AAUlB;IARC,IAAA,6BAAmB,EAAC;QACnB,WAAW,EACT,4GAA4G;QAC9G,OAAO,EACL,yEAAyE;KAC5E,CAAC;IACD,IAAA,0BAAQ,GAAE;IACV,IAAA,4BAAU,GAAE;;+CACC;AASd;IAPC,IAAA,6BAAmB,EAAC;QACnB,WAAW,EACT,iFAAiF;QACnF,OAAO,EAAE,iBAAiB;KAC3B,CAAC;IACD,IAAA,0BAAQ,GAAE;IACV,IAAA,4BAAU,GAAE;;sDACQ;AAQrB;IANC,IAAA,6BAAmB,EAAC;QACnB,WAAW,EAAE,mDAAmD;QAChE,OAAO,EAAE,OAAO;KACjB,CAAC;IACD,IAAA,0BAAQ,GAAE;IACV,IAAA,4BAAU,GAAE;;2DACa"}
+{"version":3,"file":"register-client.dto.js","sourceRoot":"","sources":["../../../src/authorization-server/dto/register-client.dto.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,qDAUyB;AACzB,6CAAmE;AACnE,oCAA4E;AAmB5E,MAAa,iBAAiB;IAU5B,aAAa,CAAY;IASzB,0BAA0B,CAA2B;IAYrD,WAAW,CAAe;IAY1B,cAAc,CAAkB;IAQhC,WAAW,CAAU;IAarB,KAAK,CAAU;IAUf,QAAQ,CAAY;IAQpB,OAAO,CAAU;IAQjB,UAAU,CAAU;IAQpB,QAAQ,CAAU;IASlB,UAAU,CAAU;IASpB,QAAQ,CAAU;IAUlB,IAAI,CAAU;IASd,WAAW,CAAU;IAQrB,gBAAgB,CAAU;CAC3B;AAhJD,8CAgJC;AAtIC;IATC,IAAA,qBAAW,EAAC;QACX,WAAW,EACT,kGAAkG;QACpG,OAAO,EAAE,CAAC,gCAAgC,EAAE,8BAA8B,CAAC;QAC3E,IAAI,EAAE,CAAC,MAAM,CAAC;KACf,CAAC;IACD,IAAA,yBAAO,GAAE;IACT,IAAA,+BAAa,GAAE;IACf,IAAA,uBAAK,EAAC,EAAE,WAAW,EAAE,KAAK,EAAE,gBAAgB,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;;wDAC7C;AASzB;IAPC,IAAA,qBAAW,EAAC;QACX,WAAW,EACT,uEAAuE;QACzE,OAAO,EAAE,+BAAuB,CAAC,IAAI;QACrC,IAAI,EAAE,+BAAuB;KAC9B,CAAC;IACD,IAAA,wBAAM,EAAC,+BAAuB,CAAC;;qEACqB;AAYrD;IAVC,IAAA,qBAAW,EAAC;QACX,WAAW,EACT,0GAA0G;QAC5G,OAAO,EAAE,CAAC,oBAAoB,EAAE,eAAe,CAAC;QAChD,IAAI,EAAE,iBAAS;QACf,OAAO,EAAE,IAAI;KACd,CAAC;IACD,IAAA,yBAAO,GAAE;IACT,IAAA,+BAAa,GAAE;IACf,IAAA,wBAAM,EAAC,iBAAS,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;;sDACR;AAY1B;IAVC,IAAA,qBAAW,EAAC;QACX,WAAW,EACT,qGAAqG;QACvG,OAAO,EAAE,CAAC,oBAAY,CAAC,IAAI,CAAC;QAC5B,IAAI,EAAE,oBAAY;QAClB,OAAO,EAAE,IAAI;KACd,CAAC;IACD,IAAA,yBAAO,GAAE;IACT,IAAA,+BAAa,GAAE;IACf,IAAA,wBAAM,EAAC,oBAAY,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;;yDACL;AAQhC;IANC,IAAA,qBAAW,EAAC;QACX,WAAW,EAAE,mCAAmC;QAChD,OAAO,EAAE,iBAAiB;KAC3B,CAAC;IACD,IAAA,0BAAQ,GAAE;IACV,IAAA,4BAAU,GAAE;;sDACQ;AAarB;IAPC,IAAA,6BAAmB,EAAC;QACnB,WAAW,EAAE,iCAAiC;QAC9C,OAAO,EAAE,sBAAsB;QAC/B,IAAI,EAAE,MAAM;KACb,CAAC;IACD,IAAA,0BAAQ,GAAE;IACV,IAAA,4BAAU,GAAE;;gDACE;AAUf;IARC,IAAA,6BAAmB,EAAC;QACnB,WAAW,EAAE,4CAA4C;QACzD,OAAO,EAAE,CAAC,mBAAmB,CAAC;QAC9B,IAAI,EAAE,CAAC,MAAM,CAAC;KACf,CAAC;IACD,IAAA,yBAAO,GAAE;IACT,IAAA,0BAAQ,EAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IACxB,IAAA,4BAAU,GAAE;;mDACO;AAQpB;IANC,IAAA,6BAAmB,EAAC;QACnB,WAAW,EAAE,kDAAkD;QAC/D,OAAO,EAAE,yBAAyB;KACnC,CAAC;IACD,IAAA,uBAAK,GAAE;IACP,IAAA,4BAAU,GAAE;;kDACI;AAQjB;IANC,IAAA,6BAAmB,EAAC;QACnB,WAAW,EAAE,oCAAoC;QACjD,OAAO,EAAE,qBAAqB;KAC/B,CAAC;IACD,IAAA,uBAAK,GAAE;IACP,IAAA,4BAAU,GAAE;;qDACO;AAQpB;IANC,IAAA,6BAAmB,EAAC;QACnB,WAAW,EAAE,uDAAuD;QACpE,OAAO,EAAE,8BAA8B;KACxC,CAAC;IACD,IAAA,uBAAK,GAAE;IACP,IAAA,4BAAU,GAAE;;mDACK;AASlB;IAPC,IAAA,6BAAmB,EAAC;QACnB,WAAW,EACT,8FAA8F;QAChG,OAAO,EAAE,6BAA6B;KACvC,CAAC;IACD,IAAA,uBAAK,GAAE;IACP,IAAA,4BAAU,GAAE;;qDACO;AASpB;IAPC,IAAA,6BAAmB,EAAC;QACnB,WAAW,EACT,6FAA6F;QAC/F,OAAO,EAAE,2CAA2C;KACrD,CAAC;IACD,IAAA,uBAAK,GAAE;IACP,IAAA,4BAAU,GAAE;;mDACK;AAUlB;IARC,IAAA,6BAAmB,EAAC;QACnB,WAAW,EACT,4GAA4G;QAC9G,OAAO,EACL,yEAAyE;KAC5E,CAAC;IACD,IAAA,0BAAQ,GAAE;IACV,IAAA,4BAAU,GAAE;;+CACC;AASd;IAPC,IAAA,6BAAmB,EAAC;QACnB,WAAW,EACT,iFAAiF;QACnF,OAAO,EAAE,iBAAiB;KAC3B,CAAC;IACD,IAAA,0BAAQ,GAAE;IACV,IAAA,4BAAU,GAAE;;sDACQ;AAQrB;IANC,IAAA,6BAAmB,EAAC;QACnB,WAAW,EAAE,mDAAmD;QAChE,OAAO,EAAE,OAAO;KACjB,CAAC;IACD,IAAA,0BAAQ,GAAE;IACV,IAAA,4BAAU,GAAE;;2DACa"}

package/dist/authorization-server/dto/user-response.dto.d.ts

@@ -4,4 +4,5 @@ export declare class UserResponseDto {
     displayName: string;
     role: 'admin' | 'standard';
     actorId: string;
+    hasSeenWalkthrough: boolean;
 }

package/dist/authorization-server/dto/user-response.dto.js

@@ -17,6 +17,7 @@ class UserResponseDto {
     displayName;
     role;
     actorId;
+    hasSeenWalkthrough;
 }
 exports.UserResponseDto = UserResponseDto;
 __decorate([
@@ -55,4 +56,11 @@ __decorate([
     }),
     __metadata("design:type", String)
 ], UserResponseDto.prototype, "actorId", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({
+        description: 'Whether the user has seen the walkthrough',
+        example: false,
+    }),
+    __metadata("design:type", Boolean)
+], UserResponseDto.prototype, "hasSeenWalkthrough", void 0);
 //# sourceMappingURL=user-response.dto.js.map

package/dist/authorization-server/dto/user-response.dto.js.map

@@ -1 +1 @@
-{"version":3,"file":"user-response.dto.js","sourceRoot":"","sources":["../../../src/authorization-server/dto/user-response.dto.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,6CAA8C;AAE9C,MAAa,eAAe;IAK1B,EAAE,CAAU;IAMZ,KAAK,CAAU;IAMf,WAAW,CAAU;IAOrB,IAAI,CAAwB;IAM5B,OAAO,CAAU;CAClB;AA/BD,0CA+BC;AA1BC;IAJC,IAAA,qBAAW,EAAC;QACX,WAAW,EAAE,SAAS;QACtB,OAAO,EAAE,sCAAsC;KAChD,CAAC;;2CACU;AAMZ;IAJC,IAAA,qBAAW,EAAC;QACX,WAAW,EAAE,oBAAoB;QACjC,OAAO,EAAE,kBAAkB;KAC5B,CAAC;;8CACa;AAMf;IAJC,IAAA,qBAAW,EAAC;QACX,WAAW,EAAE,mBAAmB;QAChC,OAAO,EAAE,UAAU;KACpB,CAAC;;oDACmB;AAOrB;IALC,IAAA,qBAAW,EAAC;QACX,WAAW,EAAE,WAAW;QACxB,IAAI,EAAE,CAAC,OAAO,EAAE,UAAU,CAAC;QAC3B,OAAO,EAAE,UAAU;KACpB,CAAC;;6CAC0B;AAM5B;IAJC,IAAA,qBAAW,EAAC;QACX,WAAW,EAAE,oCAAoC;QACjD,OAAO,EAAE,sCAAsC;KAChD,CAAC;;gDACe"}
+{"version":3,"file":"user-response.dto.js","sourceRoot":"","sources":["../../../src/authorization-server/dto/user-response.dto.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,6CAA8C;AAE9C,MAAa,eAAe;IAK1B,EAAE,CAAU;IAMZ,KAAK,CAAU;IAMf,WAAW,CAAU;IAOrB,IAAI,CAAwB;IAM5B,OAAO,CAAU;IAMjB,kBAAkB,CAAW;CAC9B;AArCD,0CAqCC;AAhCC;IAJC,IAAA,qBAAW,EAAC;QACX,WAAW,EAAE,SAAS;QACtB,OAAO,EAAE,sCAAsC;KAChD,CAAC;;2CACU;AAMZ;IAJC,IAAA,qBAAW,EAAC;QACX,WAAW,EAAE,oBAAoB;QACjC,OAAO,EAAE,kBAAkB;KAC5B,CAAC;;8CACa;AAMf;IAJC,IAAA,qBAAW,EAAC;QACX,WAAW,EAAE,mBAAmB;QAChC,OAAO,EAAE,UAAU;KACpB,CAAC;;oDACmB;AAOrB;IALC,IAAA,qBAAW,EAAC;QACX,WAAW,EAAE,WAAW;QACxB,IAAI,EAAE,CAAC,OAAO,EAAE,UAAU,CAAC;QAC3B,OAAO,EAAE,UAAU;KACpB,CAAC;;6CAC0B;AAM5B;IAJC,IAAA,qBAAW,EAAC;QACX,WAAW,EAAE,oCAAoC;QACjD,OAAO,EAAE,sCAAsC;KAChD,CAAC;;gDACe;AAMjB;IAJC,IAAA,qBAAW,EAAC;QACX,WAAW,EAAE,2CAA2C;QACxD,OAAO,EAAE,KAAK;KACf,CAAC;;2DAC2B"}

package/dist/authorization-server/issued-access-token.service.d.ts

@@ -26,14 +26,27 @@ export interface IssueTokenResult {
     entity: IssuedAccessTokenEntity;
     token: string;
 }
+export interface IssueSystemTokenResult {
+    jti: string;
+    expiresAt: Date;
+    token: string;
+}
+export interface IssueSystemTokenInput {
+    subjectActor: ActorInfo;
+    issuedByActor: ActorInfo;
+    scopes: string[];
+    expirationSeconds?: number;
+}
 export declare class IssuedAccessTokenService {
     private readonly tokenRepository;
     private readonly tokenSignerService;
     private readonly logger;
     constructor(tokenRepository: Repository<IssuedAccessTokenEntity>, tokenSignerService: TokenSignerService);
     issueToken(input: IssueTokenInput): Promise<IssueTokenResult>;
+    issueSystemToken(input: IssueSystemTokenInput): Promise<IssueSystemTokenResult>;
     issueTokenFromPersistedActors(input: IssueTokenFromPersistedActorsInput): Promise<IssueTokenResult>;
     private toActorInfo;
+    private signIssuedToken;
     listTokensForSubject(subjectActorId: string): Promise<IssuedAccessTokenEntity[]>;
     getTokenById(tokenId: string): Promise<IssuedAccessTokenEntity | null>;
     revokeTokenById(tokenId: string): Promise<IssuedAccessTokenEntity | null>;

package/dist/authorization-server/issued-access-token.service.js

@@ -32,47 +32,41 @@ let IssuedAccessTokenService = IssuedAccessTokenService_1 = class IssuedAccessTo
     async issueToken(input) {
         const config = (0, env_config_1.getConfig)();
         const expirationDays = input.expirationDays ?? 30;
-        const jti = (0, crypto_1.randomBytes)(16).toString('hex');
-        const now = Math.floor(Date.now() / 1000);
-        const expiresAt = new Date();
-        expiresAt.setDate(expiresAt.getDate() + expirationDays);
-        const expSeconds = now + expirationDays * 24 * 60 * 60;
-        const claims = {
-            iss: config.issuerUrl,
-            sub: input.subjectActor.id,
-            actor_id: input.subjectActor.id,
-            actor_slug: input.subjectActor.slug,
-            actor_type: input.subjectActor.type,
-            displayName: input.subjectActor.displayName,
-            aud: config.issuerUrl,
-            exp: expSeconds,
-            iat: now,
-            jti,
-            client_id: 'issued-token',
-            scope: input.scopes,
-            resource: config.issuerUrl,
-            version: '1.0.0',
-            issued_by: input.issuedByActor.id,
-        };
-        const token = await this.tokenSignerService.signToken(claims);
+        const issuedToken = await this.signIssuedToken({
+            subjectActor: input.subjectActor,
+            issuedByActor: input.issuedByActor,
+            scopes: input.scopes,
+            expirationSeconds: expirationDays * 24 * 60 * 60,
+        });
         const entity = this.tokenRepository.create({
             subjectActorId: input.subjectActor.id,
             issuedByActorId: input.issuedByActor.id,
-            jti,
+            jti: issuedToken.jti,
             name: input.name,
             scopes: input.scopes,
-            expiresAt,
+            expiresAt: issuedToken.expiresAt,
             revokedAt: null,
             lastUsedAt: null,
         });
         const savedEntity = await this.tokenRepository.save(entity);
         this.logger.log(`Issued access token "${input.name}" for actor ${input.subjectActor.slug} ` +
-            `(expires: ${expiresAt.toISOString()})`);
+            `(expires: ${issuedToken.expiresAt.toISOString()})`);
         return {
             entity: savedEntity,
-            token,
+            token: issuedToken.token,
         };
     }
+    async issueSystemToken(input) {
+        const issuedToken = await this.signIssuedToken({
+            subjectActor: input.subjectActor,
+            issuedByActor: input.issuedByActor,
+            scopes: input.scopes,
+            expirationSeconds: input.expirationSeconds,
+        });
+        this.logger.debug(`Issued ephemeral system token for actor ${input.subjectActor.slug} ` +
+            `(jti: ${issuedToken.jti}, expires: ${issuedToken.expiresAt.toISOString()})`);
+        return issuedToken;
+    }
     async issueTokenFromPersistedActors(input) {
         return this.issueToken({
             subjectActor: this.toActorInfo(input.subjectActor),
@@ -90,6 +84,38 @@ let IssuedAccessTokenService = IssuedAccessTokenService_1 = class IssuedAccessTo
             displayName: actor.displayName,
         };
     }
+    async signIssuedToken(input) {
+        const config = (0, env_config_1.getConfig)();
+        const lifetimeSeconds = input.expirationSeconds ?? config.mcpAccessTokenDurationSeconds;
+        const safeLifetimeSeconds = Math.max(1, Math.floor(lifetimeSeconds));
+        const jti = (0, crypto_1.randomBytes)(16).toString('hex');
+        const nowSeconds = Math.floor(Date.now() / 1000);
+        const expSeconds = nowSeconds + safeLifetimeSeconds;
+        const expiresAt = new Date(expSeconds * 1000);
+        const claims = {
+            iss: config.issuerUrl,
+            sub: input.subjectActor.id,
+            actor_id: input.subjectActor.id,
+            actor_slug: input.subjectActor.slug,
+            actor_type: input.subjectActor.type,
+            displayName: input.subjectActor.displayName,
+            aud: config.issuerUrl,
+            exp: expSeconds,
+            iat: nowSeconds,
+            jti,
+            client_id: 'issued-token',
+            scope: input.scopes,
+            resource: config.issuerUrl,
+            version: '1.0.0',
+            issued_by: input.issuedByActor.id,
+        };
+        const token = await this.tokenSignerService.signToken(claims);
+        return {
+            token,
+            jti,
+            expiresAt,
+        };
+    }
     async listTokensForSubject(subjectActorId) {
         return this.tokenRepository.find({
             where: { subjectActorId },

package/dist/authorization-server/issued-access-token.service.js.map

@@ -1 +1 @@
-{"version":3,"file":"issued-access-token.service.js","sourceRoot":"","sources":["../../src/authorization-server/issued-access-token.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,2CAAoD;AACpD,6CAAmD;AACnD,qCAAqC;AACrC,mCAAqC;AACrC,sFAAgF;AAChF,8EAAyE;AAGzE,qDAAiD;AA8D1C,IAAM,wBAAwB,gCAA9B,MAAM,wBAAwB;IAKhB;IACA;IALF,MAAM,GAAG,IAAI,eAAM,CAAC,0BAAwB,CAAC,IAAI,CAAC,CAAC;IAEpE,YAEmB,eAAoD,EACpD,kBAAsC;QADtC,oBAAe,GAAf,eAAe,CAAqC;QACpD,uBAAkB,GAAlB,kBAAkB,CAAoB;IACtD,CAAC;IAQJ,KAAK,CAAC,UAAU,CAAC,KAAsB;QACrC,MAAM,MAAM,GAAG,IAAA,sBAAS,GAAE,CAAC;QAC3B,MAAM,cAAc,GAAG,KAAK,CAAC,cAAc,IAAI,EAAE,CAAC;QAGlD,MAAM,GAAG,GAAG,IAAA,oBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAG5C,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAC1C,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC;QAC7B,SAAS,CAAC,OAAO,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,cAAc,CAAC,CAAC;QACxD,MAAM,UAAU,GAAG,GAAG,GAAG,cAAc,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;QAGvD,MAAM,MAAM,GAAsB;YAChC,GAAG,EAAE,MAAM,CAAC,SAAS;YACrB,GAAG,EAAE,KAAK,CAAC,YAAY,CAAC,EAAE;YAC1B,QAAQ,EAAE,KAAK,CAAC,YAAY,CAAC,EAAE;YAC/B,UAAU,EAAE,KAAK,CAAC,YAAY,CAAC,IAAI;YACnC,UAAU,EAAE,KAAK,CAAC,YAAY,CAAC,IAAI;YACnC,WAAW,EAAE,KAAK,CAAC,YAAY,CAAC,WAAW;YAC3C,GAAG,EAAE,MAAM,CAAC,SAAS;YACrB,GAAG,EAAE,UAAU;YACf,GAAG,EAAE,GAAG;YACR,GAAG;YACH,SAAS,EAAE,cAAc;YACzB,KAAK,EAAE,KAAK,CAAC,MAAM;YACnB,QAAQ,EAAE,MAAM,CAAC,SAAS;YAC1B,OAAO,EAAE,OAAO;YAEhB,SAAS,EAAE,KAAK,CAAC,aAAa,CAAC,EAAE;SAClC,CAAC;QAGF,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QAG9D,MAAM,MAAM,GAAG,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC;YACzC,cAAc,EAAE,KAAK,CAAC,YAAY,CAAC,EAAE;YACrC,eAAe,EAAE,KAAK,CAAC,aAAa,CAAC,EAAE;YACvC,GAAG;YACH,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,SAAS;YACT,SAAS,EAAE,IAAI;YACf,UAAU,EAAE,IAAI;SACjB,CAAC,CAAC;QAEH,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAE5D,IAAI,CAAC,MAAM,CAAC,GAAG,CACb,wBAAwB,KAAK,CAAC,IAAI,eAAe,KAAK,CAAC,YAAY,CAAC,IAAI,GAAG;YACzE,aAAa,SAAS,CAAC,WAAW,EAAE,GAAG,CAC1C,CAAC;QAEF,OAAO;YACL,MAAM,EAAE,WAAW;YACnB,KAAK;SACN,CAAC;IACJ,CAAC;IAMD,KAAK,CAAC,6BAA6B,CACjC,KAAyC;QAEzC,OAAO,IAAI,CAAC,UAAU,CAAC;YACrB,YAAY,EAAE,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,YAAY,CAAC;YAClD,aAAa,EAAE,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,aAAa,CAAC;YACpD,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,cAAc,EAAE,KAAK,CAAC,cAAc;SACrC,CAAC,CAAC;IACL,CAAC;IAEO,WAAW,CAAC,KAAkB;QACpC,OAAO;YACL,EAAE,EAAE,KAAK,CAAC,EAAE;YACZ,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,WAAW,EAAE,KAAK,CAAC,WAAW;SAC/B,CAAC;IACJ,CAAC;IAKD,KAAK,CAAC,oBAAoB,CACxB,cAAsB;QAEtB,OAAO,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC;YAC/B,KAAK,EAAE,EAAE,cAAc,EAAE;YACzB,SAAS,EAAE,CAAC,cAAc,EAAE,eAAe,CAAC;YAC5C,KAAK,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE;SAC7B,CAAC,CAAC;IACL,CAAC;IAKD,KAAK,CAAC,YAAY,CAAC,OAAe;QAChC,OAAO,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC;YAClC,KAAK,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE;YACtB,SAAS,EAAE,CAAC,cAAc,EAAE,eAAe,CAAC;SAC7C,CAAC,CAAC;IACL,CAAC;IAKD,KAAK,CAAC,eAAe,CACnB,OAAe;QAEf,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC;YAC/C,KAAK,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE;YACtB,SAAS,EAAE,CAAC,cAAc,EAAE,eAAe,CAAC;SAC7C,CAAC,CAAC;QAEH,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;YAEpB,OAAO,KAAK,CAAC;QACf,CAAC;QAED,KAAK,CAAC,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC;QAC7B,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAE1D,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,kBAAkB,KAAK,CAAC,IAAI,UAAU,OAAO,GAAG,CAAC,CAAC;QAElE,OAAO,UAAU,CAAC;IACpB,CAAC;IAKD,KAAK,CAAC,gBAAgB,CAAC,GAAW;QAChC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC;YAC/C,KAAK,EAAE,EAAE,GAAG,EAAE;YACd,SAAS,EAAE,CAAC,cAAc,EAAE,eAAe,CAAC;SAC7C,CAAC,CAAC;QAEH,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;YACpB,OAAO,KAAK,CAAC;QACf,CAAC;QAED,KAAK,CAAC,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC;QAC7B,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAE1D,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,yBAAyB,GAAG,GAAG,CAAC,CAAC;QAEjD,OAAO,UAAU,CAAC;IACpB,CAAC;IAKD,KAAK,CAAC,cAAc,CAAC,GAAW;QAC9B,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC;YAC/C,KAAK,EAAE,EAAE,GAAG,EAAE;SACf,CAAC,CAAC;QAEH,IAAI,CAAC,KAAK,EAAE,CAAC;YAEX,OAAO,KAAK,CAAC;QACf,CAAC;QAED,OAAO,KAAK,CAAC,SAAS,KAAK,IAAI,CAAC;IAClC,CAAC;IAKD,KAAK,CAAC,cAAc,CAAC,GAAW;QAC9B,MAAM,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE,UAAU,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC,CAAC;IACzE,CAAC;CACF,CAAA;AAvMY,4DAAwB;mCAAxB,wBAAwB;IADpC,IAAA,mBAAU,GAAE;IAKR,WAAA,IAAA,0BAAgB,EAAC,oDAAuB,CAAC,CAAA;qCACR,oBAAU;QACP,yCAAkB;GAN9C,wBAAwB,CAuMpC"}
+{"version":3,"file":"issued-access-token.service.js","sourceRoot":"","sources":["../../src/authorization-server/issued-access-token.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,2CAAoD;AACpD,6CAAmD;AACnD,qCAAqC;AACrC,mCAAqC;AACrC,sFAAgF;AAChF,8EAAyE;AAGzE,qDAAiD;AAwF1C,IAAM,wBAAwB,gCAA9B,MAAM,wBAAwB;IAKhB;IACA;IALF,MAAM,GAAG,IAAI,eAAM,CAAC,0BAAwB,CAAC,IAAI,CAAC,CAAC;IAEpE,YAEmB,eAAoD,EACpD,kBAAsC;QADtC,oBAAe,GAAf,eAAe,CAAqC;QACpD,uBAAkB,GAAlB,kBAAkB,CAAoB;IACtD,CAAC;IAQJ,KAAK,CAAC,UAAU,CAAC,KAAsB;QACrC,MAAM,MAAM,GAAG,IAAA,sBAAS,GAAE,CAAC;QAC3B,MAAM,cAAc,GAAG,KAAK,CAAC,cAAc,IAAI,EAAE,CAAC;QAClD,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC;YAC7C,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,aAAa,EAAE,KAAK,CAAC,aAAa;YAClC,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,iBAAiB,EAAE,cAAc,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE;SACjD,CAAC,CAAC;QAGH,MAAM,MAAM,GAAG,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC;YACzC,cAAc,EAAE,KAAK,CAAC,YAAY,CAAC,EAAE;YACrC,eAAe,EAAE,KAAK,CAAC,aAAa,CAAC,EAAE;YACvC,GAAG,EAAE,WAAW,CAAC,GAAG;YACpB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,SAAS,EAAE,WAAW,CAAC,SAAS;YAChC,SAAS,EAAE,IAAI;YACf,UAAU,EAAE,IAAI;SACjB,CAAC,CAAC;QAEH,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAE5D,IAAI,CAAC,MAAM,CAAC,GAAG,CACb,wBAAwB,KAAK,CAAC,IAAI,eAAe,KAAK,CAAC,YAAY,CAAC,IAAI,GAAG;YACzE,aAAa,WAAW,CAAC,SAAS,CAAC,WAAW,EAAE,GAAG,CACtD,CAAC;QAEF,OAAO;YACL,MAAM,EAAE,WAAW;YACnB,KAAK,EAAE,WAAW,CAAC,KAAK;SACzB,CAAC;IACJ,CAAC;IAKD,KAAK,CAAC,gBAAgB,CACpB,KAA4B;QAE5B,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC;YAC7C,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,aAAa,EAAE,KAAK,CAAC,aAAa;YAClC,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;SAC3C,CAAC,CAAC;QAEH,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,2CAA2C,KAAK,CAAC,YAAY,CAAC,IAAI,GAAG;YACnE,SAAS,WAAW,CAAC,GAAG,cAAc,WAAW,CAAC,SAAS,CAAC,WAAW,EAAE,GAAG,CAC/E,CAAC;QAEF,OAAO,WAAW,CAAC;IACrB,CAAC;IAMD,KAAK,CAAC,6BAA6B,CACjC,KAAyC;QAEzC,OAAO,IAAI,CAAC,UAAU,CAAC;YACrB,YAAY,EAAE,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,YAAY,CAAC;YAClD,aAAa,EAAE,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,aAAa,CAAC;YACpD,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,cAAc,EAAE,KAAK,CAAC,cAAc;SACrC,CAAC,CAAC;IACL,CAAC;IAEO,WAAW,CAAC,KAAkB;QACpC,OAAO;YACL,EAAE,EAAE,KAAK,CAAC,EAAE;YACZ,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,WAAW,EAAE,KAAK,CAAC,WAAW;SAC/B,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,eAAe,CAAC,KAK7B;QACC,MAAM,MAAM,GAAG,IAAA,sBAAS,GAAE,CAAC;QAC3B,MAAM,eAAe,GACnB,KAAK,CAAC,iBAAiB,IAAI,MAAM,CAAC,6BAA6B,CAAC;QAClE,MAAM,mBAAmB,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC;QAErE,MAAM,GAAG,GAAG,IAAA,oBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC5C,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QACjD,MAAM,UAAU,GAAG,UAAU,GAAG,mBAAmB,CAAC;QACpD,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC;QAE9C,MAAM,MAAM,GAAsB;YAChC,GAAG,EAAE,MAAM,CAAC,SAAS;YACrB,GAAG,EAAE,KAAK,CAAC,YAAY,CAAC,EAAE;YAC1B,QAAQ,EAAE,KAAK,CAAC,YAAY,CAAC,EAAE;YAC/B,UAAU,EAAE,KAAK,CAAC,YAAY,CAAC,IAAI;YACnC,UAAU,EAAE,KAAK,CAAC,YAAY,CAAC,IAAI;YACnC,WAAW,EAAE,KAAK,CAAC,YAAY,CAAC,WAAW;YAC3C,GAAG,EAAE,MAAM,CAAC,SAAS;YACrB,GAAG,EAAE,UAAU;YACf,GAAG,EAAE,UAAU;YACf,GAAG;YACH,SAAS,EAAE,cAAc;YACzB,KAAK,EAAE,KAAK,CAAC,MAAM;YACnB,QAAQ,EAAE,MAAM,CAAC,SAAS;YAC1B,OAAO,EAAE,OAAO;YAChB,SAAS,EAAE,KAAK,CAAC,aAAa,CAAC,EAAE;SAClC,CAAC;QAEF,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QAE9D,OAAO;YACL,KAAK;YACL,GAAG;YACH,SAAS;SACV,CAAC;IACJ,CAAC;IAKD,KAAK,CAAC,oBAAoB,CACxB,cAAsB;QAEtB,OAAO,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC;YAC/B,KAAK,EAAE,EAAE,cAAc,EAAE;YACzB,SAAS,EAAE,CAAC,cAAc,EAAE,eAAe,CAAC;YAC5C,KAAK,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE;SAC7B,CAAC,CAAC;IACL,CAAC;IAKD,KAAK,CAAC,YAAY,CAAC,OAAe;QAChC,OAAO,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC;YAClC,KAAK,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE;YACtB,SAAS,EAAE,CAAC,cAAc,EAAE,eAAe,CAAC;SAC7C,CAAC,CAAC;IACL,CAAC;IAKD,KAAK,CAAC,eAAe,CACnB,OAAe;QAEf,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC;YAC/C,KAAK,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE;YACtB,SAAS,EAAE,CAAC,cAAc,EAAE,eAAe,CAAC;SAC7C,CAAC,CAAC;QAEH,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;YAEpB,OAAO,KAAK,CAAC;QACf,CAAC;QAED,KAAK,CAAC,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC;QAC7B,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAE1D,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,kBAAkB,KAAK,CAAC,IAAI,UAAU,OAAO,GAAG,CAAC,CAAC;QAElE,OAAO,UAAU,CAAC;IACpB,CAAC;IAKD,KAAK,CAAC,gBAAgB,CAAC,GAAW;QAChC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC;YAC/C,KAAK,EAAE,EAAE,GAAG,EAAE;YACd,SAAS,EAAE,CAAC,cAAc,EAAE,eAAe,CAAC;SAC7C,CAAC,CAAC;QAEH,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;YACpB,OAAO,KAAK,CAAC;QACf,CAAC;QAED,KAAK,CAAC,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC;QAC7B,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAE1D,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,yBAAyB,GAAG,GAAG,CAAC,CAAC;QAEjD,OAAO,UAAU,CAAC;IACpB,CAAC;IAKD,KAAK,CAAC,cAAc,CAAC,GAAW;QAC9B,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC;YAC/C,KAAK,EAAE,EAAE,GAAG,EAAE;SACf,CAAC,CAAC;QAEH,IAAI,CAAC,KAAK,EAAE,CAAC;YAEX,OAAO,KAAK,CAAC;QACf,CAAC;QAED,OAAO,KAAK,CAAC,SAAS,KAAK,IAAI,CAAC;IAClC,CAAC;IAKD,KAAK,CAAC,cAAc,CAAC,GAAW;QAC9B,MAAM,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE,UAAU,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC,CAAC;IACzE,CAAC;CACF,CAAA;AA7OY,4DAAwB;mCAAxB,wBAAwB;IADpC,IAAA,mBAAU,GAAE;IAKR,WAAA,IAAA,0BAAgB,EAAC,oDAAuB,CAAC,CAAA;qCACR,oBAAU;QACP,yCAAkB;GAN9C,wBAAwB,CA6OpC"}

package/dist/authorization-server/web-auth.controller.d.ts

@@ -4,6 +4,8 @@ import { LoginRequestDto } from './dto/login-request.dto';
 import { LoginResponseDto } from './dto/login-response.dto';
 import { UserResponseDto } from './dto/user-response.dto';
 import { ChangePasswordRequestDto } from './dto/change-password-request.dto';
+import { OnboardingStatusResponseDto } from './dto/onboarding-status-response.dto';
+import { OnboardingRequestDto } from './dto/onboarding-request.dto';
 import { TokenVerifierService } from '../auth/crypto/token-verifier.service';
 import { WebAuthService } from './web-auth.service';
 import { ActorService } from 'src/identity-provider/actor.service';
@@ -23,4 +25,9 @@ export declare class WebAuthController {
     changePassword(request: Request, changePasswordDto: ChangePasswordRequestDto): Promise<{
         ok: boolean;
     }>;
+    getOnboardingStatus(): Promise<OnboardingStatusResponseDto>;
+    onboard(onboardingDto: OnboardingRequestDto, response: Response): Promise<LoginResponseDto>;
+    markWalkthroughSeen(request: Request): Promise<{
+        ok: boolean;
+    }>;
 }

package/dist/authorization-server/web-auth.controller.js

@@ -21,11 +21,15 @@ const login_request_dto_1 = require("./dto/login-request.dto");
 const login_response_dto_1 = require("./dto/login-response.dto");
 const user_response_dto_1 = require("./dto/user-response.dto");
 const change_password_request_dto_1 = require("./dto/change-password-request.dto");
+const onboarding_status_response_dto_1 = require("./dto/onboarding-status-response.dto");
+const onboarding_request_dto_1 = require("./dto/onboarding-request.dto");
 const env_config_1 = require("../config/env.config");
 const cookie_keys_constant_1 = require("../auth/core/constants/cookie-keys.constant");
 const token_verifier_service_1 = require("../auth/crypto/token-verifier.service");
 const web_auth_service_1 = require("./web-auth.service");
 const actor_service_1 = require("../identity-provider/actor.service");
+const enums_1 = require("../identity-provider/enums");
+const identity_provider_errors_1 = require("../identity-provider/errors/identity-provider.errors");
 let WebAuthController = WebAuthController_1 = class WebAuthController {
     webAuthService;
     tokenVerifierService;
@@ -64,6 +68,7 @@ let WebAuthController = WebAuthController_1 = class WebAuthController {
                 displayName: actor.displayName,
                 role: user.role,
                 actorId: user.actorId,
+                hasSeenWalkthrough: user.hasSeenWalkthrough,
             },
             expiresIn: expiresInSeconds,
         };
@@ -100,6 +105,7 @@ let WebAuthController = WebAuthController_1 = class WebAuthController {
                 displayName: actor.displayName,
                 role: user.role,
                 actorId: user.actorId,
+                hasSeenWalkthrough: user.hasSeenWalkthrough,
             },
             expiresIn,
         };
@@ -137,6 +143,7 @@ let WebAuthController = WebAuthController_1 = class WebAuthController {
             displayName: actor.displayName,
             role: actor.user.role,
             actorId: actor.user.actorId,
+            hasSeenWalkthrough: actor.user.hasSeenWalkthrough,
         };
     }
     async changePassword(request, changePasswordDto) {
@@ -157,6 +164,73 @@ let WebAuthController = WebAuthController_1 = class WebAuthController {
         this.logger.log(`Password changed for user: ${actor.user.email}`);
         return { ok: true };
     }
+    async getOnboardingStatus() {
+        const hasAdmins = await this.identityProviderService.hasAdminUsers();
+        return { needsOnboarding: !hasAdmins };
+    }
+    async onboard(onboardingDto, response) {
+        const user = await this.identityProviderService.createFirstAdminUserIfNeeded({
+            email: onboardingDto.email,
+            slug: onboardingDto.slug,
+            displayName: onboardingDto.displayName,
+            password: onboardingDto.password,
+        });
+        if (!user) {
+            throw new identity_provider_errors_1.OnboardingNotAllowedError();
+        }
+        const actor = await this.actorService.getActorById(user.actorId);
+        if (!actor) {
+            this.logger.error('Actor not found after user creation');
+            throw new common_1.InternalServerErrorException('Failed to retrieve actor');
+        }
+        const { accessToken, refreshToken, expiresInSeconds } = await this.webAuthService.login(onboardingDto.email, onboardingDto.password);
+        const config = (0, env_config_1.getConfig)();
+        const isProduction = config.nodeEnv === 'production';
+        const cookieOptions = {
+            httpOnly: true,
+            secure: isProduction,
+            sameSite: 'lax',
+            path: '/',
+        };
+        response.cookie(cookie_keys_constant_1.COOKIE_KEYS.ACCESS_TOKEN, accessToken, {
+            ...cookieOptions,
+            maxAge: expiresInSeconds * 1000,
+        });
+        response.cookie(cookie_keys_constant_1.COOKIE_KEYS.REFRESH_TOKEN, refreshToken, {
+            ...cookieOptions,
+            maxAge: 24 * 60 * 60 * 1000,
+        });
+        this.logger.log(`First admin user created: ${onboardingDto.email}`);
+        return {
+            user: {
+                id: actor.id,
+                email: user.email,
+                displayName: actor.displayName,
+                role: enums_1.UserRole.ADMIN,
+                actorId: user.actorId,
+                hasSeenWalkthrough: user.hasSeenWalkthrough,
+            },
+            expiresIn: expiresInSeconds,
+        };
+    }
+    async markWalkthroughSeen(request) {
+        const accessToken = request.cookies?.[cookie_keys_constant_1.COOKIE_KEYS.ACCESS_TOKEN];
+        if (!accessToken) {
+            throw new common_1.UnauthorizedException('Not authenticated');
+        }
+        const payload = await this.tokenVerifierService.verifyAndDecode(accessToken);
+        const actor = await this.actorService.getActorById(payload.actor_id, true);
+        if (!actor) {
+            throw new common_1.UnauthorizedException('Actor not found');
+        }
+        if (!actor.user) {
+            this.logger.error('Actor returned no user. This should not happen');
+            throw new common_1.InternalServerErrorException('Failed to retrieve actor');
+        }
+        await this.identityProviderService.markWalkthroughSeen(actor.user.id);
+        this.logger.log(`Walkthrough marked as seen for user: ${actor.user.email}`);
+        return { ok: true };
+    }
 };
 exports.WebAuthController = WebAuthController;
 __decorate([
@@ -260,6 +334,61 @@ __decorate([
     __metadata("design:paramtypes", [Object, change_password_request_dto_1.ChangePasswordRequestDto]),
     __metadata("design:returntype", Promise)
 ], WebAuthController.prototype, "changePassword", null);
+__decorate([
+    (0, common_1.Get)('onboarding-status'),
+    (0, swagger_1.ApiOperation)({ summary: 'Check if system needs onboarding' }),
+    (0, swagger_1.ApiResponse)({
+        status: 200,
+        description: 'Onboarding status',
+        type: onboarding_status_response_dto_1.OnboardingStatusResponseDto,
+    }),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", []),
+    __metadata("design:returntype", Promise)
+], WebAuthController.prototype, "getOnboardingStatus", null);
+__decorate([
+    (0, common_1.Post)('onboard'),
+    (0, common_1.HttpCode)(common_1.HttpStatus.OK),
+    (0, swagger_1.ApiOperation)({ summary: 'Create first admin user (only works if no admins exist)' }),
+    (0, swagger_1.ApiBody)({ type: onboarding_request_dto_1.OnboardingRequestDto }),
+    (0, swagger_1.ApiResponse)({
+        status: 200,
+        description: 'First admin user created and logged in',
+        type: login_response_dto_1.LoginResponseDto,
+    }),
+    (0, swagger_1.ApiResponse)({
+        status: 409,
+        description: 'Admin users already exist, onboarding not allowed',
+    }),
+    __param(0, (0, common_1.Body)()),
+    __param(1, (0, common_1.Res)({ passthrough: true })),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [onboarding_request_dto_1.OnboardingRequestDto, Object]),
+    __metadata("design:returntype", Promise)
+], WebAuthController.prototype, "onboard", null);
+__decorate([
+    (0, common_1.Post)('mark-walkthrough-seen'),
+    (0, common_1.HttpCode)(common_1.HttpStatus.OK),
+    (0, swagger_1.ApiOperation)({ summary: 'Mark walkthrough as seen for authenticated user' }),
+    (0, swagger_1.ApiResponse)({
+        status: 200,
+        description: 'Walkthrough marked as seen',
+        schema: {
+            type: 'object',
+            properties: {
+                ok: { type: 'boolean', example: true },
+            },
+        },
+    }),
+    (0, swagger_1.ApiResponse)({
+        status: 401,
+        description: 'Not authenticated',
+    }),
+    __param(0, (0, common_1.Req)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], WebAuthController.prototype, "markWalkthroughSeen", null);
 exports.WebAuthController = WebAuthController = WebAuthController_1 = __decorate([
     (0, swagger_1.ApiTags)('Web Authentication'),
     (0, common_1.Controller)('auth'),