@wildo-ai/saas-backend-lib 1.0.1

package/dist/esm/security/authentications/services/auth-methods/oauth2-authentication.backend.service.js

@@ -0,0 +1,1026 @@
+/**
+ * OAuth2AuthenticationBackendService
+ *
+ * Generic OAuth2/OIDC engine parameterized by OAuth2ResolvedConnection.
+ * Handles: authorization URL building, callback processing (code exchange +
+ * profile extraction), and user provisioning/linking.
+ *
+ * This service is provider-agnostic — it operates solely on the resolved
+ * connection config. Adding enterprise SSO (Step 15) means adding a new
+ * resolver; the engine code does not change.
+ *
+ * Key design decisions:
+ * - TRAP 12: Uses `issueTokensForUser(userId, sessionId?)` — NOT `issueTokens(session)`
+ * - TRAP 13: Audit logging is generally caller-driven, EXCEPT for security policy enforcement
+ *   rejections (G3 provider restrictions) which audit directly for defense-in-depth.
+ * - TRAP 9: Does NOT depend on AuthenticationOrchestrator (one-way dependency arrows)
+ * - Critical Note #3: Uses INTERNALLY_INITIATED_REQUEST execution context
+ * - Critical Note #4: Domain-to-org lookup — bound since Step 14
+ *
+ * [Capacitor] [OAuth2] [SAML]
+ * This backend engine is fully Capacitor-compatible — it handles the server-side OAuth2 flow
+ * (authorization URL generation, IdP code exchange, profile extraction, user provisioning).
+ * The Capacitor impact is only on how the frontend opens the authorization URL and receives
+ * the callback — this service is unaffected.
+ * Exception: When Capacitor introduces native Apple/Google SDKs, those flows bypass this
+ * engine entirely. A separate service/method will validate native SDK tokens (Apple identityToken,
+ * Google idToken) and call provisionOrLinkUser() with a NormalizedUserProfile extracted from
+ * the native token. The provisioning and linking logic is reusable.
+ */
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+import 'reflect-metadata';
+import { injectable, inject } from 'inversify';
+import * as crypto from 'crypto';
+import { SAAS_SERVICE_TYPES } from '../../../../inject/models/service-types.js';
+import { LoggerService } from '../../../../monitoring/logger/services/logger.service.js';
+import { AppConfigurationService } from '../../../../config/services/app-configuration.backend.service.js';
+import { ErrorBuilderBackendService } from '../../../../errors/services/error-builder.backend.service.js';
+import { AuthExecutionContextFactoryBackendService } from '../../../../security/authentications/services/auth-execution-context-factory.backend.service.js';
+import { ConsumableTokenBackendService } from '../../../../security/consumable-tokens/services/consumable-token.backend.service.js';
+import { OAuth2ConnectionResolverBackendService } from './oauth2-connection-resolver.backend.service.js';
+import { DomainToOrgLookupBackendService } from '../../../../security/authentications/services/admin-config/domain-to-org-lookup.backend.service.js';
+import { EnterpriseUserProvisioningBackendService } from '../../../../security/authentications/services/admin-config/enterprise-user-provisioning.backend.service.js';
+import { AuditLogsBackendService } from '../../../../compliance/audit-trails/services/audit-logs.backend.service.js';
+import { CoreConsumableTokenTypes, ConsumableToken_ConsumptionMode, CoreResourceType, ErrorType, ErrorCustomMessageReference, CORE_APP_ROLES, UserStatus, RegistrationMode, WildoHeaderKeys, } from '@wildo-ai/saas-models';
+import { DurationUnit } from '@wildo-ai/zod-decorators';
+import { SsoProtocol } from '../../../../security/authentications/models/auth-constants.backend.js';
+const NATIVE_TOKEN_PROVIDER_CONFIG = {
+    apple: {
+        jwksUri: 'https://appleid.apple.com/auth/keys',
+        issuer: 'https://appleid.apple.com',
+    },
+    google: {
+        jwksUri: 'https://www.googleapis.com/oauth2/v3/certs',
+        issuer: ['https://accounts.google.com', 'accounts.google.com'],
+    },
+};
+/**
+ * Provider-agnostic OAuth2 engine.
+ *
+ * Methods:
+ * - buildAuthorizationUrl(connection) — generates the IdP redirect URL with state + PKCE
+ * - handleCallback(callbackParams) — exchanges code, extracts profile
+ * - provisionOrLinkUser(profile, connection) — JIT provisioning or identity link
+ * - exchangeNativeToken(provider, identityToken, nativeClientIds) — verify native SDK token + provision (F2)
+ */
+let OAuth2AuthenticationBackendService = class OAuth2AuthenticationBackendService {
+    logger;
+    appConfigService;
+    errorBuilder;
+    servicesRegistryHandler;
+    authEcFactory;
+    consumableTokenService;
+    resolver;
+    domainToOrgLookup;
+    enterpriseProvisioning;
+    auditLogsService;
+    logDebug;
+    /**
+     * Per-jwksUri cache for `createRemoteJWKSet` functions.
+     * Avoids recreating the function (and losing jose's internal key cache) on each login.
+     * The jose library's `createRemoteJWKSet` handles key rotation internally
+     * (refetch on kid miss), so caching the function instance is safe and long-lived.
+     */
+    _jwksCache = new Map();
+    constructor(logger, appConfigService, errorBuilder, servicesRegistryHandler, authEcFactory, consumableTokenService, resolver, domainToOrgLookup, enterpriseProvisioning, auditLogsService) {
+        this.logger = logger;
+        this.appConfigService = appConfigService;
+        this.errorBuilder = errorBuilder;
+        this.servicesRegistryHandler = servicesRegistryHandler;
+        this.authEcFactory = authEcFactory;
+        this.consumableTokenService = consumableTokenService;
+        this.resolver = resolver;
+        this.domainToOrgLookup = domainToOrgLookup;
+        this.enterpriseProvisioning = enterpriseProvisioning;
+        this.auditLogsService = auditLogsService;
+        this.logDebug = this.logger.debugByType('OAuth2Authentication');
+        this.logger.setDebugTypeLogging('OAuth2Authentication', false);
+    }
+    // ═══════════════════════════════════════════════════════════════
+    // 1. Build Authorization URL
+    // ═══════════════════════════════════════════════════════════════
+    /**
+     * Generate the OAuth2 authorization URL for redirecting to the IdP.
+     * Creates PKCE challenge (if supported) and stores state + context in a consumable token.
+     *
+     * The state token captures all context needed by the callback handler to re-resolve
+     * the same connection configuration (including P3 credential overrides).
+     *
+     * @param options.frontendServiceName - Frontend service identity (stored in state, used to redirect back on callback)
+     * @param options.scopeType - 'organization' or 'application' — stored in the state token so
+     *   resolveFromState() can re-apply the correct scope overrides on callback.
+     *   Falls back to connection.organization.scopeType for enterprise connections.
+     * @param options.scopeId - Org/app ID — stored in the state token alongside scopeType.
+     *   Falls back to connection.organization.scopeId for enterprise connections.
+     */
+    async buildAuthorizationUrl(connection, options) {
+        // Generate PKCE code verifier + challenge
+        let pkceVerifier;
+        let codeChallenge;
+        let codeChallengeMethod;
+        if (connection.pkceMethod) {
+            pkceVerifier = this.generateCodeVerifier();
+            if (connection.pkceMethod === 'S256') {
+                codeChallenge = this.generateS256Challenge(pkceVerifier);
+                codeChallengeMethod = 'S256';
+            }
+            else {
+                codeChallenge = pkceVerifier;
+                codeChallengeMethod = 'plain';
+            }
+        }
+        // Store state + PKCE verifier + connection context in consumable token
+        const stateMetadata = {
+            connectionType: connection.connectionType,
+            providerRef: connection.providerRef,
+            clientId: connection.clientId,
+            responseMode: connection.responseMode,
+            redirectUri: connection.redirectUri,
+            initiatedAt: new Date().toISOString(),
+            pkceVerifier,
+            frontendServiceName: options?.frontendServiceName,
+            scopeType: options?.scopeType || connection.organization?.scopeType,
+            scopeId: options?.scopeId || connection.organization?.scopeId,
+            returnUrl: options?.returnUrl,
+            connectionId: connection.organization?.connectionId,
+        };
+        const stateToken = await this.consumableTokenService.createToken({
+            tokenType: CoreConsumableTokenTypes.OAUTH2_STATE,
+            consumptionMode: ConsumableToken_ConsumptionMode.EPHEMERAL_STATE,
+            expiresIn: { value: 10, unit: DurationUnit.MINUTES },
+            metadata: stateMetadata,
+        });
+        // Build authorization URL
+        const params = new URLSearchParams({
+            client_id: connection.clientId,
+            redirect_uri: connection.redirectUri,
+            scope: connection.scopes.join(' '),
+            state: stateToken.token,
+            response_type: 'code',
+        });
+        if (codeChallenge && codeChallengeMethod) {
+            params.set('code_challenge', codeChallenge);
+            params.set('code_challenge_method', codeChallengeMethod);
+        }
+        // Merge extra auth params
+        if (connection.extraAuthParams) {
+            for (const [key, value] of Object.entries(connection.extraAuthParams)) {
+                params.set(key, value);
+            }
+        }
+        const authorizationUrl = `${connection.authorizationUrl}?${params.toString()}`;
+        this.logDebug('Authorization URL built', {
+            providerRef: connection.providerRef,
+            connectionType: connection.connectionType,
+            pkce: !!pkceVerifier,
+        });
+        return { authorizationUrl, state: stateToken.token };
+    }
+    // ═══════════════════════════════════════════════════════════════
+    // 2. Handle Callback
+    // ═══════════════════════════════════════════════════════════════
+    /**
+     * Process the OAuth2 callback: validate state, exchange code for tokens,
+     * extract user profile.
+     *
+     * The callbackParams are extracted by the route handler from query params (GET)
+     * or body (POST), based on responseMode from the state token.
+     */
+    async handleCallback(callbackParams) {
+        const { code, state, body } = callbackParams;
+        // 1. Validate and consume the state token (single-use, prevents CSRF replay)
+        let consumedToken;
+        try {
+            consumedToken = await this.consumableTokenService.consumeToken(state);
+        }
+        catch {
+            throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {
+                customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_INVALID_TOKEN,
+                context: { message: 'Invalid or expired OAuth2 state token' },
+            });
+        }
+        // Defense-in-depth: verify the consumed token is actually an OAUTH2_STATE token
+        // (prevents a PASSWORD_RESET or other token type from being accepted as state)
+        if (consumedToken.tokenType !== CoreConsumableTokenTypes.OAUTH2_STATE) {
+            throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {
+                customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_INVALID_TOKEN,
+                context: { message: 'Invalid token type for OAuth2 state validation' },
+            });
+        }
+        const stateMetadata = consumedToken.metadata;
+        // 2. Re-resolve connection (ensures fresh credentials)
+        const ec = await this.getInternalExecutionContext();
+        const connection = await this.resolver.resolveFromState(ec, stateMetadata);
+        // 3. Verify clientId matches (detect config drift during auth flow)
+        if (connection.clientId !== stateMetadata.clientId) {
+            throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {
+                customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_INVALID_TOKEN,
+                context: { message: 'Authentication configuration changed during the OAuth2 flow, please try again' },
+            });
+        }
+        // 4. Exchange authorization code for tokens
+        const tokenResponse = await this.exchangeCodeForTokens(code, connection, stateMetadata.pkceVerifier);
+        // 5. Extract user profile based on identitySource
+        const normalizedProfile = await this.extractUserProfile(tokenResponse, connection, body);
+        this.logDebug('Callback handled successfully', {
+            providerRef: connection.providerRef,
+            email: normalizedProfile.email,
+            emailVerified: normalizedProfile.emailVerified,
+        });
+        return { normalizedProfile, connection, stateMetadata };
+    }
+    // ═══════════════════════════════════════════════════════════════
+    // 3. Provision or Link User
+    // ═══════════════════════════════════════════════════════════════
+    /**
+     * JIT provisioning: find existing user or create new one, create identity link.
+     *
+     * 1. Enterprise SSO enforcement check (blocks social login if org requires SSO)
+     * 2. Check for existing identity link (providerRef + providerUserId + connectionType)
+     * 3. Check for existing user by verified email (auto-link)
+     * 4. Enterprise provisioning branch (delegates to EnterpriseUserProvisioningService)
+     * 5. Social provisioning: create user if registration enabled
+     *
+     * All DB operations use INTERNALLY_INITIATED_REQUEST execution context
+     * (the user isn't authenticated yet at callback time).
+     */
+    async provisionOrLinkUser(profile, connection) {
+        const ec = await this.getInternalExecutionContext();
+        // ─── Step 1: Enterprise SSO Enforcement Check ───
+        const emailDomain = profile.email.split('@')[1];
+        if (emailDomain) {
+            const claimingOrg = await this.domainToOrgLookup.findOrgByDomain(ec, emailDomain);
+            if (claimingOrg?.enforcement?.requireSSO && connection.connectionType === 'social') {
+                throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {
+                    customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_INVALID_TOKEN,
+                    context: { message: 'Your organization requires enterprise SSO. Please use your organization\'s sign-in.' },
+                });
+            }
+            // ─── Step 1b: Scope-Level OAuth2 Provider Restrictions (G3) ───
+            if (claimingOrg && connection.connectionType === 'social') {
+                const { allowed, reason } = await this.resolver.isProviderAllowed(ec, claimingOrg.scopeType, claimingOrg.scopeId, connection.providerRef);
+                if (!allowed) {
+                    await this.auditLogsService.logOAuth2ProviderBlocked({
+                        email: profile.email,
+                        providerRef: connection.providerRef,
+                        organizationId: claimingOrg.scopeId,
+                        reason: reason || 'Organization policy',
+                        ipAddress: 'callback',
+                        userAgent: 'callback',
+                    });
+                    throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {
+                        customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_INVALID_TOKEN,
+                        context: {
+                            message: reason || 'This login provider is not allowed for your organization.',
+                        },
+                    });
+                }
+            }
+        }
+        // ─── Step 2: Check for existing identity link ───
+        const existingLink = await this.servicesRegistryHandler.read(CoreResourceType.USER_IDENTITY_LINKS, ec, {
+            providerRef: connection.providerRef,
+            providerUserId: profile.providerUserId,
+            connectionType: connection.connectionType,
+        });
+        if (existingLink) {
+            const linkedUser = await this.servicesRegistryHandler.read(CoreResourceType.USERS, ec, { _id: existingLink.userId });
+            if (linkedUser && linkedUser.status !== UserStatus.ACTIVE) {
+                throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {
+                    customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_ACCOUNT_LOCKED,
+                    context: { userStatus: linkedUser.status },
+                });
+            }
+            await this.servicesRegistryHandler.update(CoreResourceType.USER_IDENTITY_LINKS, ec, existingLink._id, {
+                lastUsedAt: new Date(),
+                providerEmail: profile.email,
+                providerDisplayName: profile.displayName,
+                providerAvatarUrl: profile.avatarUrl,
+                providerRawProfile: profile.rawClaims,
+            });
+            this.logDebug('Existing identity link found, updating lastUsedAt', {
+                userId: existingLink.userId,
+                providerRef: connection.providerRef,
+            });
+            return { userId: existingLink.userId, isNewUser: false };
+        }
+        // ─── Step 3: Check for existing user by verified email (auto-link) ───
+        const userTypes = this.appConfigService.config.userTypes ?? {};
+        const autoLinkByEmail = Object.values(userTypes).some((typeDef) => typeDef?.auth?.autoLinkByEmail !== false);
+        if (autoLinkByEmail) {
+            const existingUser = await this.servicesRegistryHandler.read(CoreResourceType.USERS, ec, { email: profile.email.toLowerCase() });
+            if (existingUser) {
+                if (existingUser.status !== UserStatus.ACTIVE) {
+                    throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {
+                        customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_ACCOUNT_LOCKED,
+                        context: { userStatus: existingUser.status },
+                    });
+                }
+                if (!profile.emailVerified) {
+                    throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {
+                        customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_INVALID_TOKEN,
+                        context: { message: 'Email not verified by the identity provider. Cannot link to existing account.' },
+                    });
+                }
+                // W7.2: Block cross-org SSO when disabled
+                if (connection.connectionType === 'enterprise' && connection.organization) {
+                    await this.enforceCrossOrgSSOAccess(ec, existingUser._id, connection.organization.organizationId);
+                }
+                await this.createIdentityLink(ec, existingUser._id, profile, connection);
+                this.logDebug('Auto-linked by email', {
+                    userId: existingUser._id,
+                    providerRef: connection.providerRef,
+                    email: profile.email,
+                });
+                return { userId: existingUser._id, isNewUser: false };
+            }
+        }
+        // ─── Step 4→15: Enterprise provisioning branch ───
+        if (connection.connectionType === 'enterprise' && connection.organization) {
+            const org = connection.organization;
+            // W7.2: Block cross-org SSO when disabled — check before provisioning
+            const existingUserForCrossOrg = await this.servicesRegistryHandler.read(CoreResourceType.USERS, ec, { email: profile.email.toLowerCase() });
+            if (existingUserForCrossOrg) {
+                await this.enforceCrossOrgSSOAccess(ec, existingUserForCrossOrg._id, org.organizationId);
+            }
+            // Delegate to EnterpriseUserProvisioningService (Step 15, reused by SCIM Step 20)
+            const result = await this.enterpriseProvisioning.createOrgUser(profile, connection, {
+                organizationId: org.organizationId,
+                autoCreateUsers: org.autoCreateUsers,
+                autoVerifyEmail: org.autoVerifyEmail,
+                defaultRole: org.defaultRole,
+                roleMapping: org.roleMapping,
+                groupMapping: org.groupMapping,
+                allowedDomains: org.allowedDomains,
+            });
+            this.logDebug('Enterprise user provisioned/linked', {
+                userId: result.user._id,
+                organizationId: org.organizationId,
+                isNew: result.isNew,
+                roles: result.mappedRoles,
+            });
+            return { userId: result.user._id, isNewUser: result.isNew };
+        }
+        // ─── Step 5: Social provisioning — create new user ───
+        // W6.8: Resolve registration from user-type policies (pre-identification: permissive if ANY type allows)
+        const regAllowed = Object.values(userTypes).some((typeDef) => {
+            const mode = typeDef?.auth?.registration?.mode;
+            return mode === RegistrationMode.OPEN || mode === undefined;
+        });
+        const regDisabled = !regAllowed;
+        const regInvitationOnly = !regDisabled && Object.values(userTypes).every((typeDef) => {
+            const mode = typeDef?.auth?.registration?.mode;
+            return mode === RegistrationMode.INVITATION_ONLY;
+        });
+        if (regDisabled) {
+            throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {
+                customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_USER_NOT_FOUND,
+                context: { message: 'Account not found and registration is disabled. Contact your administrator.' },
+            });
+        }
+        if (regInvitationOnly) {
+            throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {
+                customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_USER_NOT_FOUND,
+                context: { message: 'Registration requires an invitation. Contact your administrator.' },
+            });
+        }
+        const newUser = await this.servicesRegistryHandler.create(CoreResourceType.USERS, ec, {
+            email: profile.email.toLowerCase(),
+            status: UserStatus.ACTIVE,
+            appRoles: [CORE_APP_ROLES.APP_USER],
+        });
+        try {
+            await this.servicesRegistryHandler.create(CoreResourceType.USER_PROFILES, ec, {
+                userId: newUser._id,
+                firstName: profile.firstName,
+                lastName: profile.lastName,
+                displayName: profile.displayName,
+                avatarUrl: profile.avatarUrl,
+                locale: profile.locale,
+            });
+        }
+        catch {
+            this.logDebug('UserProfile creation skipped (repo not available)', { userId: newUser._id });
+        }
+        await this.createIdentityLink(ec, newUser._id, profile, connection);
+        this.logDebug('New user provisioned via OAuth2', {
+            userId: newUser._id,
+            providerRef: connection.providerRef,
+            email: profile.email,
+        });
+        return { userId: newUser._id, isNewUser: true };
+    }
+    /**
+     * W7.2: Enforce crossOrgSSOAccess policy.
+     * When `crossOrgSSOAccess === false`, a user who already has enterprise identity links
+     * from a different organization is blocked from SSO into the current org.
+     * Social/native connections are exempt (enforced by callers only passing enterprise connections).
+     */
+    async enforceCrossOrgSSOAccess(ec, userId, targetOrganizationId) {
+        if (this.appConfigService.config.auth.crossOrgSSOAccess !== false)
+            return;
+        const enterpriseLinks = await this.servicesRegistryHandler.list(CoreResourceType.USER_IDENTITY_LINKS, ec, {
+            userId, connectionType: 'enterprise',
+        }, undefined, { paginated: false }) ?? [];
+        const hasCrossOrgLink = enterpriseLinks.some((link) => link.organizationId && link.organizationId !== targetOrganizationId);
+        if (hasCrossOrgLink) {
+            this.logDebug('Cross-org SSO blocked', { userId, targetOrganizationId });
+            throw this.errorBuilder.buildError(ErrorType.AUTHORIZATION, undefined, {
+                customMessageReference: ErrorCustomMessageReference.CROSS_ORG_SSO_BLOCKED,
+                context: { message: 'Cross-organization SSO access is not allowed.' },
+            });
+        }
+    }
+    // ═══════════════════════════════════════════════════════════════
+    // Private: Token Exchange
+    // ═══════════════════════════════════════════════════════════════
+    /**
+     * Exchange the authorization code for tokens at the IdP's token endpoint.
+     * Server-to-server POST — credentials sent according to tokenEndpointAuthMethod.
+     */
+    async exchangeCodeForTokens(code, connection, pkceVerifier) {
+        const bodyParams = {
+            grant_type: 'authorization_code',
+            code,
+            redirect_uri: connection.redirectUri,
+        };
+        if (pkceVerifier) {
+            bodyParams.code_verifier = pkceVerifier;
+        }
+        // Merge extra token params
+        if (connection.extraTokenParams) {
+            Object.assign(bodyParams, connection.extraTokenParams);
+        }
+        const headers = {
+            [WildoHeaderKeys.CONTENT_TYPE]: 'application/x-www-form-urlencoded',
+            ...(connection.tokenRequestHeaders || {}),
+        };
+        // Send credentials according to tokenEndpointAuthMethod
+        switch (connection.tokenEndpointAuthMethod) {
+            case 'client_secret_post':
+                bodyParams.client_id = connection.clientId;
+                bodyParams.client_secret = connection.clientSecret;
+                break;
+            case 'client_secret_basic':
+                headers[WildoHeaderKeys.AUTHORIZATION] = `Basic ${Buffer.from(`${connection.clientId}:${connection.clientSecret}`).toString('base64')}`;
+                break;
+            case 'none':
+                bodyParams.client_id = connection.clientId;
+                break;
+        }
+        const response = await fetch(connection.tokenUrl, {
+            method: 'POST',
+            headers,
+            body: new URLSearchParams(bodyParams).toString(),
+        });
+        if (!response.ok) {
+            const errorBody = await response.text();
+            this.logger.error('OAuth2 token exchange failed', {
+                providerRef: connection.providerRef,
+                status: response.status,
+                error: errorBody,
+            });
+            throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {
+                customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_INVALID_TOKEN,
+                context: { message: `OAuth2 token exchange failed: ${response.status}` },
+            });
+        }
+        const tokenResponse = await response.json();
+        this.logDebug('Token exchange successful', {
+            providerRef: connection.providerRef,
+            hasAccessToken: !!tokenResponse.access_token,
+            hasIdToken: !!tokenResponse.id_token,
+        });
+        return tokenResponse;
+    }
+    // ═══════════════════════════════════════════════════════════════
+    // Private: Profile Extraction
+    // ═══════════════════════════════════════════════════════════════
+    /**
+     * Extract user identity based on connection.identitySource.
+     *
+     * - 'userinfo': fetch from userInfoUrl (Google, Microsoft, GitHub)
+     * - 'id_token': verify via JWKS then decode from ID token JWT (Apple, enterprise OIDC)
+     * - Apple uses BOTH id_token (email, sub) AND callback_body (name on first auth)
+     *
+     * C3: When jwksUri + issuer are available on the connection, ID tokens are
+     * cryptographically verified against the provider's JWKS before claims extraction.
+     */
+    async extractUserProfile(tokenResponse, connection, callbackBody) {
+        let rawClaims = {};
+        // Primary identity source
+        if (connection.identitySource === 'userinfo' && connection.userInfoUrl) {
+            rawClaims = await this.fetchUserInfo(connection.userInfoUrl, tokenResponse.access_token, connection);
+        }
+        else if (connection.identitySource === 'id_token' && tokenResponse.id_token) {
+            // C3 fix: Verify ID token signature against provider's JWKS when available.
+            // Falls back to unsigned decode only when no JWKS URI is available (should not
+            // happen for well-configured OIDC providers — JWKS is a required discovery field).
+            if (connection.jwksUri && connection.issuer) {
+                try {
+                    rawClaims = await this.verifyIdToken(tokenResponse.id_token, connection.jwksUri, connection.issuer, connection.clientId);
+                }
+                catch (verifyError) {
+                    this.logger.error('ID token JWKS verification failed', {
+                        providerRef: connection.providerRef,
+                        error: verifyError instanceof Error ? verifyError.message : String(verifyError),
+                    });
+                    throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {
+                        customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_INVALID_TOKEN,
+                        context: { message: 'ID token signature verification failed. The token may be forged or expired.' },
+                    });
+                }
+            }
+            else {
+                this.logger.warn('ID token decoded without signature verification — no JWKS URI available', {
+                    providerRef: connection.providerRef,
+                    hasJwksUri: !!connection.jwksUri,
+                    hasIssuer: !!connection.issuer,
+                });
+                rawClaims = this.decodeIdToken(tokenResponse.id_token);
+            }
+        }
+        // Supplement with callback body (Apple first-auth: body.user has name)
+        if (callbackBody?.user) {
+            let userData;
+            if (typeof callbackBody.user === 'string') {
+                try {
+                    userData = JSON.parse(callbackBody.user);
+                }
+                catch {
+                    this.logDebug('Failed to parse Apple callback body.user — skipping name extraction', {
+                        providerRef: connection.providerRef,
+                    });
+                    userData = {};
+                }
+            }
+            else {
+                userData = callbackBody.user;
+            }
+            // Apple's user object: { name: { firstName, lastName }, email }
+            if (userData.name) {
+                const nameObj = userData.name;
+                if (!rawClaims._callbackFirstName && nameObj.firstName) {
+                    rawClaims._callbackFirstName = nameObj.firstName;
+                }
+                if (!rawClaims._callbackLastName && nameObj.lastName) {
+                    rawClaims._callbackLastName = nameObj.lastName;
+                }
+            }
+        }
+        // Provider-specific extension points (data-driven, not per-provider if/else)
+        const extensions = connection.extensions || {};
+        // Extension: emails endpoint (GitHub private email)
+        if (extensions.emailsEndpoint && tokenResponse.access_token) {
+            try {
+                const emailsResponse = await fetch(extensions.emailsEndpoint, {
+                    headers: { Authorization: `Bearer ${tokenResponse.access_token}`, Accept: 'application/json' },
+                });
+                if (emailsResponse.ok) {
+                    const emails = await emailsResponse.json();
+                    const primaryEmail = emails.find((e) => e.primary && e.verified);
+                    if (primaryEmail) {
+                        rawClaims[connection.profileMapping.email] = primaryEmail.email;
+                        rawClaims[connection.profileMapping.emailVerified || 'email_verified'] = true;
+                    }
+                }
+            }
+            catch {
+                this.logDebug('Failed to fetch emails endpoint', { endpoint: extensions.emailsEndpoint });
+            }
+        }
+        // Map raw claims to NormalizedUserProfile
+        const mapping = connection.profileMapping;
+        const providerUserId = String(this.extractClaim(rawClaims, mapping.id) || '');
+        const email = String(this.extractClaim(rawClaims, mapping.email) || '').toLowerCase();
+        const emailVerifiedRaw = this.extractClaim(rawClaims, mapping.emailVerified || 'email_verified');
+        const emailVerified = emailVerifiedRaw === true || emailVerifiedRaw === 'true';
+        // Name extraction: try firstName/lastName fields, fall back to 'name' field splitting
+        let firstName = mapping.firstName ? String(this.extractClaim(rawClaims, mapping.firstName) || '') : '';
+        let lastName = mapping.lastName ? String(this.extractClaim(rawClaims, mapping.lastName) || '') : '';
+        // Callback body supplements (Apple first-auth)
+        if (!firstName && rawClaims._callbackFirstName)
+            firstName = String(rawClaims._callbackFirstName);
+        if (!lastName && rawClaims._callbackLastName)
+            lastName = String(rawClaims._callbackLastName);
+        // Fall back to 'name' field and split
+        if (!firstName && !lastName && mapping.name) {
+            const fullName = String(this.extractClaim(rawClaims, mapping.name) || '');
+            if (fullName) {
+                const parts = fullName.split(' ');
+                firstName = parts[0] || '';
+                lastName = parts.slice(1).join(' ') || '';
+            }
+        }
+        // Display name: constructed name → full name claim → extension fallback → email (last resort)
+        const displayName = [firstName, lastName].filter(Boolean).join(' ')
+            || String(this.extractClaim(rawClaims, mapping.name || 'name') || '')
+            || (extensions.displayNameFallbackField
+                ? String(this.extractClaim(rawClaims, extensions.displayNameFallbackField) || '')
+                : '')
+            || email;
+        // Extension: email fallback (Microsoft uses userPrincipalName)
+        const finalEmail = email
+            || (extensions.emailFallbackField
+                ? String(this.extractClaim(rawClaims, extensions.emailFallbackField) || '').toLowerCase()
+                : '');
+        const rawAvatarUrl = mapping.image ? String(this.extractClaim(rawClaims, mapping.image) || '') : undefined;
+        const avatarUrl = rawAvatarUrl ? this._sanitizeAvatarUrl(rawAvatarUrl) : undefined;
+        // Locale (most OIDC providers include a 'locale' claim)
+        const locale = this.extractClaim(rawClaims, 'locale');
+        // Enterprise claims
+        const roles = mapping.roles ? this.extractArrayClaim(rawClaims, mapping.roles) : undefined;
+        const groups = mapping.groups ? this.extractArrayClaim(rawClaims, mapping.groups) : undefined;
+        const department = mapping.department ? String(this.extractClaim(rawClaims, mapping.department) || '') : undefined;
+        const employeeId = mapping.employeeId ? String(this.extractClaim(rawClaims, mapping.employeeId) || '') : undefined;
+        if (!providerUserId || !finalEmail) {
+            throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {
+                customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_INVALID_TOKEN,
+                context: { message: 'OAuth2 profile extraction failed: missing providerUserId or email' },
+            });
+        }
+        return {
+            providerUserId,
+            email: finalEmail,
+            emailVerified,
+            firstName: firstName || undefined,
+            lastName: lastName || undefined,
+            displayName: displayName || undefined,
+            avatarUrl: avatarUrl || undefined,
+            locale,
+            roles,
+            groups,
+            department: department || undefined,
+            employeeId: employeeId || undefined,
+            rawClaims,
+        };
+    }
+    // ═══════════════════════════════════════════════════════════════
+    // Private: UserInfo Fetch
+    // ═══════════════════════════════════════════════════════════════
+    async fetchUserInfo(userInfoUrl, accessToken, connection) {
+        const headers = {
+            Authorization: `Bearer ${accessToken}`,
+            Accept: 'application/json',
+        };
+        // GitHub requires Accept header (TRAP: without it, returns XML)
+        if (connection.tokenRequestHeaders?.Accept) {
+            headers.Accept = connection.tokenRequestHeaders.Accept;
+        }
+        const response = await fetch(userInfoUrl, { headers });
+        if (!response.ok) {
+            throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {
+                customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_INVALID_TOKEN,
+                context: { message: `Failed to fetch user info: ${response.status}` },
+            });
+        }
+        return await response.json();
+    }
+    // ═══════════════════════════════════════════════════════════════
+    // Private: Identity Link Creation
+    // ═══════════════════════════════════════════════════════════════
+    async createIdentityLink(ec, userId, profile, connection) {
+        await this.servicesRegistryHandler.create(CoreResourceType.USER_IDENTITY_LINKS, ec, {
+            userId,
+            connectionType: connection.connectionType,
+            providerRef: connection.providerRef,
+            providerUserId: profile.providerUserId,
+            providerEmail: profile.email,
+            providerDisplayName: profile.displayName,
+            providerAvatarUrl: profile.avatarUrl,
+            providerRawProfile: profile.rawClaims,
+            organizationId: connection.organization?.organizationId,
+            connectionId: connection.organization?.connectionId,
+            source: SsoProtocol.OIDC,
+        });
+    }
+    // ═══════════════════════════════════════════════════════════════
+    // Private: Execution Context
+    // ═══════════════════════════════════════════════════════════════
+    /**
+     * Pre-auth EC for OAuth2 operations (SSO callbacks, user provisioning).
+     * Caller identity unknown at this point — uses PUBLIC_EXECUTION with APP_PUBLIC.
+     * Primary intent: user lookup/provisioning from IdP callback.
+     */
+    async getInternalExecutionContext() {
+        return this.authEcFactory.createForPreAuthOperation(this.authEcFactory.getUsersReadOperationPath());
+    }
+    // ═══════════════════════════════════════════════════════════════
+    // Private: PKCE Helpers
+    // ═══════════════════════════════════════════════════════════════
+    generateCodeVerifier() {
+        return crypto.randomBytes(32).toString('base64url');
+    }
+    generateS256Challenge(verifier) {
+        return crypto.createHash('sha256').update(verifier).digest('base64url');
+    }
+    // ═══════════════════════════════════════════════════════════════
+    // Private: Claim Extraction Helpers
+    // ═══════════════════════════════════════════════════════════════
+    /**
+     * Extract a claim value from raw claims using dot-notation path support.
+     */
+    extractClaim(claims, path) {
+        if (!path)
+            return undefined;
+        const parts = path.split('.');
+        let current = claims;
+        for (const part of parts) {
+            if (current === null || current === undefined || typeof current !== 'object')
+                return undefined;
+            current = current[part];
+        }
+        return current;
+    }
+    /**
+     * Extract an array claim (roles, groups), handling both string and array values.
+     */
+    extractArrayClaim(claims, path) {
+        const value = this.extractClaim(claims, path);
+        if (!value)
+            return undefined;
+        if (Array.isArray(value))
+            return value.map(String);
+        if (typeof value === 'string')
+            return value.split(',').map((s) => s.trim());
+        return undefined;
+    }
+    /**
+     * Decode a JWT ID token without signature verification.
+     * Used as fallback for providers that don't expose a JWKS endpoint.
+     * Prefer verifyIdToken() for providers with JWKS.
+     */
+    decodeIdToken(idToken) {
+        try {
+            const parts = idToken.split('.');
+            if (parts.length !== 3)
+                throw new Error('Invalid JWT format');
+            const payload = Buffer.from(parts[1], 'base64url').toString('utf-8');
+            return JSON.parse(payload);
+        }
+        catch {
+            this.logger.warn('Failed to decode ID token');
+            return {};
+        }
+    }
+    /**
+     * Verify a JWT ID token against the provider's JWKS endpoint.
+     * Uses the `jose` library for cryptographic signature verification + claims validation.
+     *
+     * C3 fix: Replaces unsigned jwt.decode() with full JWKS verification.
+     * Verifies: signature (via JWKS), issuer, audience, expiration, and issued-at claims.
+     *
+     * The JWKS function is cached per jwksUri on the service instance to avoid losing
+     * jose's internal key cache between login attempts. The library handles key rotation
+     * internally (refetch on kid miss).
+     */
+    async verifyIdToken(idToken, jwksUri, issuer, audience) {
+        const { jwtVerify, createRemoteJWKSet } = await import('jose');
+        let JWKS = this._jwksCache.get(jwksUri);
+        if (!JWKS) {
+            JWKS = createRemoteJWKSet(new URL(jwksUri));
+            this._jwksCache.set(jwksUri, JWKS);
+        }
+        const { payload } = await jwtVerify(idToken, JWKS, {
+            issuer,
+            audience,
+            maxTokenAge: '5 minutes',
+        });
+        return payload;
+    }
+    /**
+     * Exchange a native SDK identity token (Apple/Google) for a provisioned user.
+     * Verifies the token against the IdP's JWKS, extracts the user profile,
+     * and provisions/links the user via the same path as OAuth2 callback.
+     *
+     * When `nonce` is provided, verifies it against the token's `nonce` claim for replay protection.
+     * Apple: token contains SHA-256(nonce); Google: token contains nonce verbatim.
+     */
+    async exchangeNativeToken(provider, identityToken, nativeClientIds, nonce) {
+        const providerConfig = NATIVE_TOKEN_PROVIDER_CONFIG[provider];
+        if (!providerConfig) {
+            throw this.errorBuilder.buildError(ErrorType.VALIDATION, undefined, {
+                customMessageReference: ErrorCustomMessageReference.VALIDATION,
+                context: { message: `Unsupported native token provider: ${provider}` },
+            });
+        }
+        const claims = await this.verifyIdToken(identityToken, providerConfig.jwksUri, providerConfig.issuer, nativeClientIds);
+        if (nonce) {
+            this._verifyNonce(provider, nonce, claims);
+        }
+        const normalizedProfile = this._extractNativeTokenProfile(provider, claims);
+        const connection = {
+            source: SsoProtocol.OIDC,
+            providerRef: provider,
+            displayName: provider === 'apple' ? 'Apple' : 'Google',
+            connectionType: 'social',
+        };
+        const provisionResult = await this.provisionOrLinkUser(normalizedProfile, connection);
+        return { provisionResult, normalizedProfile };
+    }
+    /**
+     * Verify the nonce claim in a native SDK identity token.
+     * Apple embeds SHA-256(nonce) in the token; Google embeds the nonce verbatim.
+     */
+    _verifyNonce(provider, expectedNonce, claims) {
+        const tokenNonce = claims.nonce;
+        if (!tokenNonce) {
+            throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {
+                customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_INVALID_TOKEN,
+                context: { message: 'Nonce was provided but identity token does not contain a nonce claim' },
+            });
+        }
+        let matches;
+        if (provider === 'apple') {
+            const expectedHash = crypto.createHash('sha256').update(expectedNonce).digest('hex');
+            matches = expectedHash === tokenNonce;
+        }
+        else {
+            matches = expectedNonce === tokenNonce;
+        }
+        if (!matches) {
+            throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {
+                customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_INVALID_TOKEN,
+                context: { message: 'Nonce mismatch — possible token replay' },
+            });
+        }
+    }
+    _extractNativeTokenProfile(provider, claims) {
+        const sub = claims.sub;
+        const email = claims.email?.toLowerCase();
+        if (!sub || !email) {
+            throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {
+                customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_INVALID_TOKEN,
+                context: { message: 'Identity token missing required claims (sub, email)' },
+            });
+        }
+        const emailVerifiedRaw = claims.email_verified;
+        let emailVerified;
+        if (provider === 'apple') {
+            emailVerified = emailVerifiedRaw === true || emailVerifiedRaw === 'true' || emailVerifiedRaw === undefined;
+        }
+        else {
+            emailVerified = emailVerifiedRaw === true || emailVerifiedRaw === 'true';
+        }
+        return {
+            providerUserId: sub,
+            email,
+            emailVerified,
+            firstName: claims.given_name,
+            lastName: claims.family_name,
+            displayName: claims.name,
+            avatarUrl: this._sanitizeAvatarUrl(claims.picture || ''),
+            rawClaims: claims,
+        };
+    }
+    /**
+     * L5 fix: Sanitize avatar URL from IdP profile.
+     * Validates URL scheme (HTTPS/HTTP only) and rejects private/loopback IPs
+     * to prevent javascript: XSS, data: URI injection, and SSRF via internal network URLs.
+     *
+     * Returns undefined for invalid URLs (fail-safe — missing avatar is harmless).
+     */
+    _sanitizeAvatarUrl(url) {
+        if (!url)
+            return undefined;
+        try {
+            const parsed = new URL(url);
+            // Only allow http: and https: schemes — reject javascript:, data:, etc.
+            if (parsed.protocol !== 'https:' && parsed.protocol !== 'http:') {
+                return undefined;
+            }
+            // Normalize hostname: strip IPv6 brackets and resolve IPv4-mapped IPv6
+            // (e.g., `[::ffff:127.0.0.1]` → `127.0.0.1`, `[::ffff:10.0.0.1]` → `10.0.0.1`)
+            let hostname = parsed.hostname.toLowerCase();
+            if (hostname.startsWith('[') && hostname.endsWith(']')) {
+                hostname = hostname.slice(1, -1);
+            }
+            const ipv4MappedMatch = hostname.match(/^::ffff:(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})$/);
+            if (ipv4MappedMatch) {
+                hostname = ipv4MappedMatch[1];
+            }
+            if (this._isPrivateOrReservedHost(hostname)) {
+                return undefined;
+            }
+            return parsed.toString();
+        }
+        catch {
+            return undefined;
+        }
+    }
+    /**
+     * Check if a hostname is private, loopback, link-local, or otherwise reserved.
+     * Covers IPv4, IPv6 loopback, IPv4-mapped IPv6 (after normalization), and special TLDs.
+     */
+    _isPrivateOrReservedHost(hostname) {
+        // Normalize decimal/octal/hex IP representations to dotted-decimal.
+        // e.g., http://2130706433 (decimal for 127.0.0.1), http://0x7f000001 (hex),
+        // http://017700000001 (octal). These bypass naive string prefix checks.
+        const normalizedHostname = this._normalizeNumericIp(hostname);
+        // Loopback
+        if (normalizedHostname === 'localhost' || normalizedHostname === '127.0.0.1' || normalizedHostname === '0.0.0.0' || normalizedHostname === '::1') {
+            return true;
+        }
+        // IPv6 loopback/unspecified variants
+        if (normalizedHostname === '::' || normalizedHostname === '0:0:0:0:0:0:0:1' || normalizedHostname === '0:0:0:0:0:0:0:0') {
+            return true;
+        }
+        // IPv4-mapped IPv6 prefix (catch any remaining after normalization)
+        if (normalizedHostname.startsWith('::ffff:')) {
+            return true;
+        }
+        // RFC 1918 private ranges
+        if (normalizedHostname.startsWith('10.') || normalizedHostname.startsWith('192.168.')) {
+            return true;
+        }
+        // 172.16.0.0/12 — 172.16.x through 172.31.x
+        if (normalizedHostname.startsWith('172.')) {
+            const second = parseInt(normalizedHostname.split('.')[1], 10);
+            if (second >= 16 && second <= 31)
+                return true;
+        }
+        // Link-local (169.254.0.0/16)
+        if (normalizedHostname.startsWith('169.254.')) {
+            return true;
+        }
+        // CGNAT (100.64.0.0/10) — shared address space, not publicly routable
+        if (normalizedHostname.startsWith('100.')) {
+            const second = parseInt(normalizedHostname.split('.')[1], 10);
+            if (second >= 64 && second <= 127)
+                return true;
+        }
+        // Special-use TLDs
+        if (normalizedHostname.endsWith('.local') ||
+            normalizedHostname.endsWith('.internal') ||
+            normalizedHostname.endsWith('.localhost') ||
+            normalizedHostname.endsWith('.invalid') ||
+            normalizedHostname.endsWith('.test') ||
+            normalizedHostname.endsWith('.onion')) {
+            return true;
+        }
+        return false;
+    }
+    /**
+     * Normalize numeric IP representations (decimal, hex, octal) to dotted-decimal IPv4.
+     * Prevents SSRF bypass via alternative IP notations like http://2130706433 (= 127.0.0.1).
+     * Returns the input unchanged if it's not a numeric IP.
+     */
+    _normalizeNumericIp(hostname) {
+        // Pure decimal integer (e.g., 2130706433 for 127.0.0.1)
+        if (/^\d+$/.test(hostname)) {
+            const num = parseInt(hostname, 10);
+            if (num >= 0 && num <= 0xFFFFFFFF) {
+                return `${(num >>> 24) & 0xFF}.${(num >>> 16) & 0xFF}.${(num >>> 8) & 0xFF}.${num & 0xFF}`;
+            }
+        }
+        // Hex notation (e.g., 0x7f000001)
+        if (/^0x[0-9a-fA-F]+$/.test(hostname)) {
+            const num = parseInt(hostname, 16);
+            if (num >= 0 && num <= 0xFFFFFFFF) {
+                return `${(num >>> 24) & 0xFF}.${(num >>> 16) & 0xFF}.${(num >>> 8) & 0xFF}.${num & 0xFF}`;
+            }
+        }
+        // Octal notation (e.g., 017700000001) — leading zero
+        if (/^0[0-7]+$/.test(hostname)) {
+            const num = parseInt(hostname, 8);
+            if (num >= 0 && num <= 0xFFFFFFFF) {
+                return `${(num >>> 24) & 0xFF}.${(num >>> 16) & 0xFF}.${(num >>> 8) & 0xFF}.${num & 0xFF}`;
+            }
+        }
+        return hostname;
+    }
+};
+OAuth2AuthenticationBackendService = __decorate([
+    injectable(),
+    __param(0, inject(SAAS_SERVICE_TYPES.Logger)),
+    __param(1, inject(SAAS_SERVICE_TYPES.AppConfigService)),
+    __param(2, inject(SAAS_SERVICE_TYPES.ErrorBuilderService)),
+    __param(3, inject(SAAS_SERVICE_TYPES.ServicesRegistryHandlerService)),
+    __param(4, inject(SAAS_SERVICE_TYPES.AuthExecutionContextFactory)),
+    __param(5, inject(SAAS_SERVICE_TYPES.ConsumableTokenService)),
+    __param(6, inject(SAAS_SERVICE_TYPES.OAuth2ConnectionResolverService)),
+    __param(7, inject(SAAS_SERVICE_TYPES.DomainToOrgLookupService)),
+    __param(8, inject(SAAS_SERVICE_TYPES.EnterpriseUserProvisioningService)),
+    __param(9, inject(SAAS_SERVICE_TYPES.AuditLogsService)),
+    __metadata("design:paramtypes", [LoggerService,
+        AppConfigurationService,
+        ErrorBuilderBackendService, Function, AuthExecutionContextFactoryBackendService,
+        ConsumableTokenBackendService,
+        OAuth2ConnectionResolverBackendService,
+        DomainToOrgLookupBackendService,
+        EnterpriseUserProvisioningBackendService,
+        AuditLogsBackendService])
+], OAuth2AuthenticationBackendService);
+export { OAuth2AuthenticationBackendService };
+//# sourceMappingURL=oauth2-authentication.backend.service.js.map