@wildo-ai/saas-backend-lib 1.0.1

package/dist/esm/security/authentications/services/auth-methods/saml-replay-guard.backend.service.d.ts

@@ -0,0 +1,40 @@
+/**
+ * SAML Replay Guard — Redis-Backed Assertion Replay Detection
+ *
+ * Prevents SAML assertion replay attacks (E7, SC-10) by tracking consumed
+ * assertion IDs in Redis with TTL matching the assertion's validity window.
+ *
+ * Key format: `saml:replay:{scopeId}:{sha256(assertionId)}`
+ * - scopeId provides multi-tenant isolation
+ * - SHA-256 hash prevents key injection via crafted assertion IDs (D4)
+ *
+ * Uses atomic SET NX EX (set-if-not-exists with expiry) via Lua script
+ * to guarantee single consumption even under concurrent requests.
+ */
+import 'reflect-metadata';
+import { RedisService } from '../../../../databases/services/redis.service.js';
+import { LoggerService } from '../../../../monitoring/logger/services/logger.service.js';
+export declare class SAMLReplayGuardBackendService {
+    private readonly redis;
+    private readonly logger;
+    private readonly logDebug;
+    constructor(redis: RedisService, logger: LoggerService);
+    /**
+     * Mark an assertion as consumed. Returns `true` if this is the first consumption
+     * (assertion is fresh), `false` if the assertion was already consumed (replay).
+     *
+     * @param assertionId - The SAML assertion's unique ID attribute
+     * @param scopeId - Tenant scope ID for key isolation
+     * @param ttlSeconds - Time-to-live in seconds (should be NotOnOrAfter - now + clockDrift, minimum 300s)
+     */
+    markAssertionConsumed(assertionId: string, scopeId: string, ttlSeconds: number): Promise<boolean>;
+    /**
+     * Check whether an assertion has already been consumed, without marking it.
+     * Uses `buildKey()` + `eval()` to match `markAssertionConsumed()`'s key path
+     * (both apply `createTenantKey()` exactly once via `buildKey()`).
+     */
+    isAssertionConsumed(assertionId: string, scopeId: string): Promise<boolean>;
+    private buildReplayKey;
+    private hashAssertionId;
+}
+//# sourceMappingURL=saml-replay-guard.backend.service.d.ts.map

package/dist/esm/security/authentications/services/auth-methods/saml-replay-guard.backend.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"saml-replay-guard.backend.service.d.ts","sourceRoot":"","sources":["../../../../../../src/security/authentications/services/auth-methods/saml-replay-guard.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,kBAAkB,CAAC;AAI1B,OAAO,EAAE,YAAY,EAAE,MAAM,qDAAqD,CAAC;AACnF,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAQ7F,qBACa,6BAA6B;IAIG,OAAO,CAAC,QAAQ,CAAC,KAAK;IAC5B,OAAO,CAAC,QAAQ,CAAC,MAAM;IAJ5D,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA+D;gBAG5B,KAAK,EAAE,YAAY,EACzB,MAAM,EAAE,aAAa;IAM3E;;;;;;;OAOG;IACU,qBAAqB,CAChC,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,MAAM,EACf,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,OAAO,CAAC;IAgBnB;;;;OAIG;IACU,mBAAmB,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAUxF,OAAO,CAAC,cAAc;IAItB,OAAO,CAAC,eAAe;CAGxB"}

package/dist/esm/security/authentications/services/auth-methods/saml-replay-guard.backend.service.js

@@ -0,0 +1,92 @@
+/**
+ * SAML Replay Guard — Redis-Backed Assertion Replay Detection
+ *
+ * Prevents SAML assertion replay attacks (E7, SC-10) by tracking consumed
+ * assertion IDs in Redis with TTL matching the assertion's validity window.
+ *
+ * Key format: `saml:replay:{scopeId}:{sha256(assertionId)}`
+ * - scopeId provides multi-tenant isolation
+ * - SHA-256 hash prevents key injection via crafted assertion IDs (D4)
+ *
+ * Uses atomic SET NX EX (set-if-not-exists with expiry) via Lua script
+ * to guarantee single consumption even under concurrent requests.
+ */
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+import 'reflect-metadata';
+import { injectable, inject } from 'inversify';
+import * as crypto from 'crypto';
+import { SAAS_SERVICE_TYPES } from '../../../../inject/models/service-types.js';
+import { RedisService } from '../../../../databases/services/redis.service.js';
+import { LoggerService } from '../../../../monitoring/logger/services/logger.service.js';
+import { AUTH_REDIS_KEYS } from '../../../../security/authentications/models/auth-constants.backend.js';
+const SET_NX_EX_SCRIPT = `
+local result = redis.call('SET', KEYS[1], ARGV[1], 'NX', 'EX', ARGV[2])
+if result then return 1 else return 0 end
+`;
+let SAMLReplayGuardBackendService = class SAMLReplayGuardBackendService {
+    redis;
+    logger;
+    logDebug;
+    constructor(redis, logger) {
+        this.redis = redis;
+        this.logger = logger;
+        this.logDebug = this.logger.debugByType('SAMLReplayGuard');
+        this.logger.setDebugTypeLogging('SAMLReplayGuard', false);
+    }
+    /**
+     * Mark an assertion as consumed. Returns `true` if this is the first consumption
+     * (assertion is fresh), `false` if the assertion was already consumed (replay).
+     *
+     * @param assertionId - The SAML assertion's unique ID attribute
+     * @param scopeId - Tenant scope ID for key isolation
+     * @param ttlSeconds - Time-to-live in seconds (should be NotOnOrAfter - now + clockDrift, minimum 300s)
+     */
+    async markAssertionConsumed(assertionId, scopeId, ttlSeconds) {
+        const effectiveTtl = Math.max(ttlSeconds, 300);
+        const key = this.redis.buildKey(this.buildReplayKey(scopeId, assertionId));
+        const result = await this.redis.eval(SET_NX_EX_SCRIPT, [key], ['1', String(effectiveTtl)]);
+        const consumed = result === 1;
+        this.logDebug(consumed ? 'Assertion marked as consumed' : 'Replay detected — assertion already consumed', {
+            scopeId,
+            assertionIdHash: this.hashAssertionId(assertionId),
+            ttlSeconds: effectiveTtl,
+        });
+        return consumed;
+    }
+    /**
+     * Check whether an assertion has already been consumed, without marking it.
+     * Uses `buildKey()` + `eval()` to match `markAssertionConsumed()`'s key path
+     * (both apply `createTenantKey()` exactly once via `buildKey()`).
+     */
+    async isAssertionConsumed(assertionId, scopeId) {
+        const key = this.redis.buildKey(this.buildReplayKey(scopeId, assertionId));
+        const result = await this.redis.eval('return redis.call("EXISTS", KEYS[1])', [key], []);
+        return result === 1;
+    }
+    buildReplayKey(scopeId, assertionId) {
+        return `${AUTH_REDIS_KEYS.SAML_REPLAY}${scopeId}:${this.hashAssertionId(assertionId)}`;
+    }
+    hashAssertionId(assertionId) {
+        return crypto.createHash('sha256').update(assertionId).digest('hex');
+    }
+};
+SAMLReplayGuardBackendService = __decorate([
+    injectable(),
+    __param(0, inject(SAAS_SERVICE_TYPES.RedisService)),
+    __param(1, inject(SAAS_SERVICE_TYPES.Logger)),
+    __metadata("design:paramtypes", [RedisService,
+        LoggerService])
+], SAMLReplayGuardBackendService);
+export { SAMLReplayGuardBackendService };
+//# sourceMappingURL=saml-replay-guard.backend.service.js.map

package/dist/esm/security/authentications/services/auth-methods/saml-replay-guard.backend.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"saml-replay-guard.backend.service.js","sourceRoot":"","sources":["../../../../../../src/security/authentications/services/auth-methods/saml-replay-guard.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;;;;;;;;;;;;;AAEH,OAAO,kBAAkB,CAAC;AAC1B,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAC/C,OAAO,KAAK,MAAM,MAAM,QAAQ,CAAC;AACjC,OAAO,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AACpF,OAAO,EAAE,YAAY,EAAE,MAAM,qDAAqD,CAAC;AACnF,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAC7F,OAAO,EAAE,eAAe,EAAE,MAAM,2EAA2E,CAAC;AAE5G,MAAM,gBAAgB,GAAG;;;CAGxB,CAAC;AAGK,IAAM,6BAA6B,GAAnC,MAAM,6BAA6B;IAIoB;IACN;IAJrC,QAAQ,CAA+D;IAExF,YAC4D,KAAmB,EACzB,MAAqB;QADf,UAAK,GAAL,KAAK,CAAc;QACzB,WAAM,GAAN,MAAM,CAAe;QAEzE,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,iBAAiB,CAAC,CAAC;QAC3D,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,iBAAiB,EAAE,KAAK,CAAC,CAAC;IAC5D,CAAC;IAED;;;;;;;OAOG;IACI,KAAK,CAAC,qBAAqB,CAChC,WAAmB,EACnB,OAAe,EACf,UAAkB;QAElB,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;QAC/C,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,CAAC;QAE3E,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,gBAAgB,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAC3F,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,CAAC;QAE9B,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,8BAA8B,CAAC,CAAC,CAAC,8CAA8C,EAAE;YACxG,OAAO;YACP,eAAe,EAAE,IAAI,CAAC,eAAe,CAAC,WAAW,CAAC;YAClD,UAAU,EAAE,YAAY;SACzB,CAAC,CAAC;QAEH,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED;;;;OAIG;IACI,KAAK,CAAC,mBAAmB,CAAC,WAAmB,EAAE,OAAe;QACnE,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,CAAC;QAC3E,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAClC,sCAAsC,EACtC,CAAC,GAAG,CAAC,EACL,EAAE,CACH,CAAC;QACF,OAAO,MAAM,KAAK,CAAC,CAAC;IACtB,CAAC;IAEO,cAAc,CAAC,OAAe,EAAE,WAAmB;QACzD,OAAO,GAAG,eAAe,CAAC,WAAW,GAAG,OAAO,IAAI,IAAI,CAAC,eAAe,CAAC,WAAW,CAAC,EAAE,CAAC;IACzF,CAAC;IAEO,eAAe,CAAC,WAAmB;QACzC,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACvE,CAAC;CACF,CAAA;AA7DY,6BAA6B;IADzC,UAAU,EAAE;IAKR,WAAA,MAAM,CAAC,kBAAkB,CAAC,YAAY,CAAC,CAAA;IACvC,WAAA,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAA;qCAD+B,YAAY;QACjB,aAAa;GALhE,6BAA6B,CA6DzC"}

package/dist/esm/security/authentications/services/auth-methods/webauthn.backend.service.d.ts

@@ -0,0 +1,82 @@
+import 'reflect-metadata';
+import type { PublicKeyCredentialCreationOptionsJSON, PublicKeyCredentialRequestOptionsJSON, RegistrationResponseJSON, AuthenticationResponseJSON } from '@simplewebauthn/server';
+import { LoggerService } from '../../../../monitoring/logger/services/logger.service.js';
+import { AppConfigurationService } from '../../../../config/services/app-configuration.backend.service.js';
+import { RedisService } from '../../../../databases/services/redis.service.js';
+import { AuthCredentialOpsBackendService } from '../../../../security/authentications/services/utils/auth-credential-ops.backend.service.js';
+import { ErrorBuilderBackendService } from '../../../../errors/services/error-builder.backend.service.js';
+import { ExecutionContext } from '../../../../runtime/models/execution-context.backend.schemas.js';
+import { PasskeyCredentialEntry } from '@wildo-ai/saas-models';
+/**
+ * WebAuthnBackendService
+ *
+ * Encapsulates all WebAuthn/FIDO2 ceremony logic using @simplewebauthn/server.
+ * Handles option generation, response verification, challenge management (Redis),
+ * and credential CRUD on user credential documents.
+ *
+ * This service does NOT:
+ * - Manage sessions (AuthSessionStore)
+ * - Issue tokens (AuthTokenIssuer)
+ * - Audit log (orchestrator/controller responsibility)
+ * - Know about the authentication flow (orchestrator's job)
+ */
+export declare class WebAuthnBackendService {
+    private readonly logger;
+    private readonly appConfigService;
+    private readonly redisService;
+    private readonly credentialOps;
+    private readonly errorBuilder;
+    private readonly logDebug;
+    constructor(logger: LoggerService, appConfigService: AppConfigurationService, redisService: RedisService, credentialOps: AuthCredentialOpsBackendService, errorBuilder: ErrorBuilderBackendService);
+    private get rpId();
+    private get rpName();
+    private get passkeyOps();
+    /**
+     * Derive the expected origin(s) from the app config's runtime endpoints.
+     * Returns all configured publicUrl values as valid origins.
+     */
+    private get expectedOrigins();
+    /**
+     * Generate WebAuthn registration options for a user.
+     * The caller is responsible for ensuring the user is authenticated.
+     */
+    generateRegistrationOptions(ec: ExecutionContext<any>, userId: string, email: string): Promise<PublicKeyCredentialCreationOptionsJSON>;
+    /**
+     * Verify a WebAuthn registration response and store the new credential.
+     * Returns the new credential entry on success.
+     */
+    verifyRegistrationResponse(ec: ExecutionContext<any>, userId: string, response: RegistrationResponseJSON, credentialName?: string): Promise<PasskeyCredentialEntry>;
+    /**
+      * Generate WebAuthn authentication options for a user.
+     * Populates allowCredentials from the user's stored passkeys.
+     */
+    generateAuthenticationOptions(ec: ExecutionContext<any>, userId: string): Promise<PublicKeyCredentialRequestOptionsJSON>;
+    /**
+     * Verify a WebAuthn authentication response.
+     * Updates the credential counter and lastUsedAt on success.
+     */
+    verifyAuthenticationResponse(ec: ExecutionContext<any>, userId: string, response: AuthenticationResponseJSON): Promise<{
+        verified: boolean;
+        credentialId: string;
+    }>;
+    /**
+     * List all passkey credentials for a user (safe fields only — no publicKey/counter).
+     */
+    getCredentials(ec: ExecutionContext<any>, userId: string): Promise<PasskeyCredentialEntry[]>;
+    /**
+     * Remove a passkey credential by its credential ID.
+     */
+    removeCredential(ec: ExecutionContext<any>, userId: string, credentialId: string): Promise<void>;
+    /**
+     * Rename a passkey credential.
+     */
+    renameCredential(ec: ExecutionContext<any>, userId: string, credentialId: string, newName: string): Promise<void>;
+    private _storeChallenge;
+    private _getAndDeleteChallenge;
+    /**
+     * Resolve the credential record for a user.
+     * Returns the credential document (throws if not found).
+     */
+    private _resolveCredentialRecord;
+}
+//# sourceMappingURL=webauthn.backend.service.d.ts.map

package/dist/esm/security/authentications/services/auth-methods/webauthn.backend.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"webauthn.backend.service.d.ts","sourceRoot":"","sources":["../../../../../../src/security/authentications/services/auth-methods/webauthn.backend.service.ts"],"names":[],"mappings":"AAAA,OAAO,kBAAkB,CAAC;AAQ1B,OAAO,KAAK,EACV,sCAAsC,EACtC,qCAAqC,EACrC,wBAAwB,EACxB,0BAA0B,EAC3B,MAAM,wBAAwB,CAAC;AAGhC,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAC7F,OAAO,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AAC/G,OAAO,EAAE,YAAY,EAAE,MAAM,qDAAqD,CAAC;AACnF,OAAO,EAAE,+BAA+B,EAAE,MAAM,gGAAgG,CAAC;AACjJ,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAC9G,OAAO,EAAE,gBAAgB,EAAE,MAAM,qEAAqE,CAAC;AACvG,OAAO,EAEL,sBAAsB,EAGvB,MAAM,uBAAuB,CAAC;AAM/B;;;;;;;;;;;;GAYG;AACH,qBACa,sBAAsB;IAII,OAAO,CAAC,QAAQ,CAAC,MAAM;IACb,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IACrC,OAAO,CAAC,QAAQ,CAAC,YAAY;IACjB,OAAO,CAAC,QAAQ,CAAC,aAAa;IACnC,OAAO,CAAC,QAAQ,CAAC,YAAY;IAP/E,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA+D;gBAGlC,MAAM,EAAE,aAAa,EACX,gBAAgB,EAAE,uBAAuB,EAC7C,YAAY,EAAE,YAAY,EACd,aAAa,EAAE,+BAA+B,EACnD,YAAY,EAAE,0BAA0B;IAQ3G,OAAO,KAAK,IAAI,GAEf;IAED,OAAO,KAAK,MAAM,GAEjB;IAED,OAAO,KAAK,UAAU,GAErB;IAED;;;OAGG;IACH,OAAO,KAAK,eAAe,GAY1B;IAID;;;OAGG;IACG,2BAA2B,CAC/B,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACzB,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,sCAAsC,CAAC;IAuClD;;;OAGG;IACG,0BAA0B,CAC9B,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACzB,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,wBAAwB,EAClC,cAAc,CAAC,EAAE,MAAM,GACtB,OAAO,CAAC,sBAAsB,CAAC;IAoDlC;;;OAGG;IACG,6BAA6B,CACjC,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACzB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,qCAAqC,CAAC;IA2BjD;;;OAGG;IACG,4BAA4B,CAChC,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACzB,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,0BAA0B,GACnC,OAAO,CAAC;QAAE,QAAQ,EAAE,OAAO,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,CAAC;IA8DvD;;OAEG;IACG,cAAc,CAAC,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,EAAE,CAAC;IAKlG;;OAEG;IACG,gBAAgB,CAAC,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAgBtG;;OAEG;IACG,gBAAgB,CAAC,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;YAsBzG,eAAe;YAIf,sBAAsB;IASpC;;;OAGG;YACW,wBAAwB;CAcvC"}

package/dist/esm/security/authentications/services/auth-methods/webauthn.backend.service.js

@@ -0,0 +1,325 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+import 'reflect-metadata';
+import { inject, injectable } from 'inversify';
+import { generateRegistrationOptions, verifyRegistrationResponse, generateAuthenticationOptions, verifyAuthenticationResponse, } from '@simplewebauthn/server';
+import { SAAS_SERVICE_TYPES } from '../../../../inject/models/service-types.js';
+import { LoggerService } from '../../../../monitoring/logger/services/logger.service.js';
+import { AppConfigurationService } from '../../../../config/services/app-configuration.backend.service.js';
+import { RedisService } from '../../../../databases/services/redis.service.js';
+import { AuthCredentialOpsBackendService } from '../../../../security/authentications/services/utils/auth-credential-ops.backend.service.js';
+import { ErrorBuilderBackendService } from '../../../../errors/services/error-builder.backend.service.js';
+import { ErrorType, ErrorCustomMessageReference, } from '@wildo-ai/saas-models';
+const CHALLENGE_TTL_SECONDS = 300; // 5 minutes
+const CHALLENGE_KEY_PREFIX_REG = 'webauthn_challenge:reg:';
+const CHALLENGE_KEY_PREFIX_AUTH = 'webauthn_challenge:auth:';
+/**
+ * WebAuthnBackendService
+ *
+ * Encapsulates all WebAuthn/FIDO2 ceremony logic using @simplewebauthn/server.
+ * Handles option generation, response verification, challenge management (Redis),
+ * and credential CRUD on user credential documents.
+ *
+ * This service does NOT:
+ * - Manage sessions (AuthSessionStore)
+ * - Issue tokens (AuthTokenIssuer)
+ * - Audit log (orchestrator/controller responsibility)
+ * - Know about the authentication flow (orchestrator's job)
+ */
+let WebAuthnBackendService = class WebAuthnBackendService {
+    logger;
+    appConfigService;
+    redisService;
+    credentialOps;
+    errorBuilder;
+    logDebug;
+    constructor(logger, appConfigService, redisService, credentialOps, errorBuilder) {
+        this.logger = logger;
+        this.appConfigService = appConfigService;
+        this.redisService = redisService;
+        this.credentialOps = credentialOps;
+        this.errorBuilder = errorBuilder;
+        this.logDebug = this.logger.debugByType('WebAuthn');
+        this.logger.setDebugTypeLogging('WebAuthn', false);
+    }
+    // ─── Configuration ───────────────────────────────────────────
+    get rpId() {
+        return this.appConfigService.config.auth.passkeyConfig.rpId;
+    }
+    get rpName() {
+        return this.appConfigService.config.auth.passkeyConfig.rpName;
+    }
+    get passkeyOps() {
+        return this.appConfigService.config.auth.passkeyOperational;
+    }
+    /**
+     * Derive the expected origin(s) from the app config's runtime endpoints.
+     * Returns all configured publicUrl values as valid origins.
+     */
+    get expectedOrigins() {
+        const endPoints = this.appConfigService.config.runtime.endPoints;
+        const origins = [];
+        for (const [, urls] of Object.entries(endPoints)) {
+            if (urls?.publicUrl) {
+                origins.push(urls.publicUrl.replace(/\/$/, ''));
+            }
+        }
+        if (origins.length === 0) {
+            origins.push(`https://${this.rpId}`);
+        }
+        return origins;
+    }
+    // ─── Registration ────────────────────────────────────────────
+    /**
+     * Generate WebAuthn registration options for a user.
+     * The caller is responsible for ensuring the user is authenticated.
+     */
+    async generateRegistrationOptions(ec, userId, email) {
+        const { cred } = await this._resolveCredentialRecord(ec, userId);
+        const existingCredentials = cred.passkeyCredentials ?? [];
+        const maxPasskeys = this.appConfigService.config?.auth?.passkeyConfig?.maxPasskeysPerUser ?? 10;
+        if (existingCredentials.length >= maxPasskeys) {
+            throw this.errorBuilder.buildError(ErrorType.VALIDATION, undefined, {
+                context: { reason: `Maximum of ${maxPasskeys} passkeys reached` },
+            });
+        }
+        const ops = this.passkeyOps;
+        const options = await generateRegistrationOptions({
+            rpName: this.rpName,
+            rpID: this.rpId,
+            userName: email,
+            userDisplayName: email,
+            userID: new TextEncoder().encode(userId),
+            // Cast: @simplewebauthn narrows to 'direct'|'enterprise'|'none' but W3C
+            // AttestationConveyancePreference includes 'indirect' — valid at runtime.
+            attestationType: ops.attestation,
+            timeout: ops.timeoutSeconds * 1000,
+            authenticatorSelection: {
+                authenticatorAttachment: ops.authenticatorAttachment === 'any' ? undefined : ops.authenticatorAttachment,
+                residentKey: ops.requireResidentKey ? 'required' : 'preferred',
+                userVerification: ops.userVerification,
+            },
+            excludeCredentials: existingCredentials.map((c) => ({
+                id: c.credentialId,
+                transports: c.transports,
+            })),
+        });
+        await this._storeChallenge(CHALLENGE_KEY_PREFIX_REG + userId, options.challenge);
+        this.logDebug('Registration options generated', { userId, excludeCount: existingCredentials.length });
+        return options;
+    }
+    /**
+     * Verify a WebAuthn registration response and store the new credential.
+     * Returns the new credential entry on success.
+     */
+    async verifyRegistrationResponse(ec, userId, response, credentialName) {
+        const expectedChallenge = await this._getAndDeleteChallenge(CHALLENGE_KEY_PREFIX_REG + userId);
+        if (!expectedChallenge) {
+            throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {
+                customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_USER_CREDENTIALS_INVALID,
+                context: { reason: 'WebAuthn registration challenge expired or not found' },
+            });
+        }
+        const verification = await verifyRegistrationResponse({
+            response,
+            expectedChallenge,
+            expectedOrigin: this.expectedOrigins,
+            expectedRPID: this.rpId,
+            requireUserVerification: this.passkeyOps.userVerification === 'required',
+        });
+        if (!verification.verified || !verification.registrationInfo) {
+            throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {
+                customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_USER_CREDENTIALS_INVALID,
+                context: { reason: 'WebAuthn registration verification failed' },
+            });
+        }
+        const { credential, credentialDeviceType, credentialBackedUp } = verification.registrationInfo;
+        const newCredential = {
+            credentialId: credential.id,
+            publicKey: Buffer.from(credential.publicKey).toString('base64url'),
+            counter: credential.counter,
+            transports: (credential.transports ?? []),
+            credentialDeviceType: credentialDeviceType ?? 'singleDevice',
+            credentialBackedUp: credentialBackedUp ?? false,
+            name: credentialName ?? 'Passkey',
+            aaguid: verification.registrationInfo.aaguid,
+            createdAt: new Date(),
+            lastUsedAt: undefined,
+        };
+        // Append to the credential record
+        const { cred } = await this._resolveCredentialRecord(ec, userId);
+        const existingCredentials = cred.passkeyCredentials ?? [];
+        const updatedCredentials = [...existingCredentials, newCredential];
+        await this.credentialOps.updateById(ec, cred._id, { passkeyCredentials: updatedCredentials });
+        this.logDebug('Passkey registered', { userId, credentialId: newCredential.credentialId });
+        return newCredential;
+    }
+    // ─── Authentication ──────────────────────────────────────────
+    /**
+      * Generate WebAuthn authentication options for a user.
+     * Populates allowCredentials from the user's stored passkeys.
+     */
+    async generateAuthenticationOptions(ec, userId) {
+        const { cred } = await this._resolveCredentialRecord(ec, userId);
+        const existingCredentials = cred.passkeyCredentials ?? [];
+        if (existingCredentials.length === 0) {
+            throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {
+                customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_USER_CREDENTIALS_INVALID,
+                context: { reason: 'No passkey credentials registered for this user' },
+            });
+        }
+        const options = await generateAuthenticationOptions({
+            rpID: this.rpId,
+            userVerification: this.passkeyOps.userVerification,
+            timeout: this.passkeyOps.timeoutSeconds * 1000,
+            allowCredentials: existingCredentials.map((c) => ({
+                id: c.credentialId,
+                transports: c.transports,
+            })),
+        });
+        await this._storeChallenge(CHALLENGE_KEY_PREFIX_AUTH + userId, options.challenge);
+        this.logDebug('Authentication options generated', { userId, credentialCount: existingCredentials.length });
+        return options;
+    }
+    /**
+     * Verify a WebAuthn authentication response.
+     * Updates the credential counter and lastUsedAt on success.
+     */
+    async verifyAuthenticationResponse(ec, userId, response) {
+        const expectedChallenge = await this._getAndDeleteChallenge(CHALLENGE_KEY_PREFIX_AUTH + userId);
+        if (!expectedChallenge) {
+            return { verified: false, credentialId: response.id };
+        }
+        const { cred } = await this._resolveCredentialRecord(ec, userId);
+        const existingCredentials = cred.passkeyCredentials ?? [];
+        const matchedCredential = existingCredentials.find((c) => c.credentialId === response.id);
+        if (!matchedCredential) {
+            this.logger.warn('WebAuthn authentication failed: credential not found', {
+                userId,
+                credentialId: response.id,
+            });
+            return { verified: false, credentialId: response.id };
+        }
+        const verification = await verifyAuthenticationResponse({
+            response,
+            expectedChallenge,
+            expectedOrigin: this.expectedOrigins,
+            expectedRPID: this.rpId,
+            requireUserVerification: this.passkeyOps.userVerification === 'required',
+            credential: {
+                id: matchedCredential.credentialId,
+                publicKey: Buffer.from(matchedCredential.publicKey, 'base64url'),
+                counter: matchedCredential.counter,
+                transports: matchedCredential.transports,
+            },
+        });
+        if (!verification.verified) {
+            return { verified: false, credentialId: response.id };
+        }
+        // Counter verification (clone detection)
+        const newCounter = verification.authenticationInfo.newCounter;
+        if (newCounter > 0 && newCounter <= matchedCredential.counter) {
+            this.logger.warn('WebAuthn counter did not increment — possible credential clone', {
+                userId,
+                credentialId: matchedCredential.credentialId,
+                storedCounter: matchedCredential.counter,
+                receivedCounter: newCounter,
+            });
+        }
+        // Update counter and lastUsedAt
+        const updatedCredentials = existingCredentials.map((c) => c.credentialId === matchedCredential.credentialId
+            ? { ...c, counter: newCounter, lastUsedAt: new Date() }
+            : c);
+        await this.credentialOps.updateById(ec, cred._id, { passkeyCredentials: updatedCredentials });
+        this.logDebug('Passkey authentication verified', { userId, credentialId: matchedCredential.credentialId });
+        return { verified: true, credentialId: matchedCredential.credentialId };
+    }
+    // ─── Credential CRUD ─────────────────────────────────────────
+    /**
+     * List all passkey credentials for a user (safe fields only — no publicKey/counter).
+     */
+    async getCredentials(ec, userId) {
+        const { cred } = await this._resolveCredentialRecord(ec, userId);
+        return cred.passkeyCredentials ?? [];
+    }
+    /**
+     * Remove a passkey credential by its credential ID.
+     */
+    async removeCredential(ec, userId, credentialId) {
+        const { cred } = await this._resolveCredentialRecord(ec, userId);
+        const existingCredentials = cred.passkeyCredentials ?? [];
+        const updatedCredentials = existingCredentials.filter((c) => c.credentialId !== credentialId);
+        if (updatedCredentials.length === existingCredentials.length) {
+            throw this.errorBuilder.buildError(ErrorType.NOT_FOUND, undefined, {
+                context: { reason: 'Passkey credential not found', credentialId },
+            });
+        }
+        await this.credentialOps.updateById(ec, cred._id, { passkeyCredentials: updatedCredentials });
+        this.logDebug('Passkey removed', { userId, credentialId });
+    }
+    /**
+     * Rename a passkey credential.
+     */
+    async renameCredential(ec, userId, credentialId, newName) {
+        const { cred } = await this._resolveCredentialRecord(ec, userId);
+        const existingCredentials = cred.passkeyCredentials ?? [];
+        const found = existingCredentials.find((c) => c.credentialId === credentialId);
+        if (!found) {
+            throw this.errorBuilder.buildError(ErrorType.NOT_FOUND, undefined, {
+                context: { reason: 'Passkey credential not found', credentialId },
+            });
+        }
+        const updatedCredentials = existingCredentials.map((c) => c.credentialId === credentialId ? { ...c, name: newName } : c);
+        await this.credentialOps.updateById(ec, cred._id, { passkeyCredentials: updatedCredentials });
+        this.logDebug('Passkey renamed', { userId, credentialId, newName });
+    }
+    // ─── Challenge Management (Redis) ────────────────────────────
+    async _storeChallenge(key, challenge) {
+        await this.redisService.set(key, challenge, { ttl: CHALLENGE_TTL_SECONDS });
+    }
+    async _getAndDeleteChallenge(key) {
+        const fullKey = this.redisService.buildKey(key);
+        const GETDEL_SCRIPT = `local v = redis.call('GET', KEYS[1]); if v then redis.call('DEL', KEYS[1]); end; return v`;
+        const result = await this.redisService.eval(GETDEL_SCRIPT, [fullKey], []);
+        return result;
+    }
+    // ─── Internal Helpers ────────────────────────────────────────
+    /**
+     * Resolve the credential record for a user.
+     * Returns the credential document (throws if not found).
+     */
+    async _resolveCredentialRecord(ec, userId) {
+        const cred = await this.credentialOps.readByUserId(ec, userId);
+        if (!cred) {
+            throw this.errorBuilder.buildError(ErrorType.NOT_FOUND, undefined, {
+                context: { reason: 'User credentials not found', userId },
+            });
+        }
+        return { cred };
+    }
+};
+WebAuthnBackendService = __decorate([
+    injectable(),
+    __param(0, inject(SAAS_SERVICE_TYPES.Logger)),
+    __param(1, inject(SAAS_SERVICE_TYPES.AppConfigService)),
+    __param(2, inject(SAAS_SERVICE_TYPES.RedisService)),
+    __param(3, inject(SAAS_SERVICE_TYPES.AuthCredentialOpsService)),
+    __param(4, inject(SAAS_SERVICE_TYPES.ErrorBuilderService)),
+    __metadata("design:paramtypes", [LoggerService,
+        AppConfigurationService,
+        RedisService,
+        AuthCredentialOpsBackendService,
+        ErrorBuilderBackendService])
+], WebAuthnBackendService);
+export { WebAuthnBackendService };
+//# sourceMappingURL=webauthn.backend.service.js.map

package/dist/esm/security/authentications/services/auth-methods/webauthn.backend.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"webauthn.backend.service.js","sourceRoot":"","sources":["../../../../../../src/security/authentications/services/auth-methods/webauthn.backend.service.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,OAAO,kBAAkB,CAAC;AAC1B,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAC/C,OAAO,EACL,2BAA2B,EAC3B,0BAA0B,EAC1B,6BAA6B,EAC7B,4BAA4B,GAC7B,MAAM,wBAAwB,CAAC;AAQhC,OAAO,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AACpF,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAC7F,OAAO,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AAC/G,OAAO,EAAE,YAAY,EAAE,MAAM,qDAAqD,CAAC;AACnF,OAAO,EAAE,+BAA+B,EAAE,MAAM,gGAAgG,CAAC;AACjJ,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAE9G,OAAO,EAGL,SAAS,EACT,2BAA2B,GAC5B,MAAM,uBAAuB,CAAC;AAE/B,MAAM,qBAAqB,GAAG,GAAG,CAAC,CAAC,YAAY;AAC/C,MAAM,wBAAwB,GAAG,yBAAyB,CAAC;AAC3D,MAAM,yBAAyB,GAAG,0BAA0B,CAAC;AAE7D;;;;;;;;;;;;GAYG;AAEI,IAAM,sBAAsB,GAA5B,MAAM,sBAAsB;IAIqB;IACU;IACJ;IACY;IACL;IAPlD,QAAQ,CAA+D;IAExF,YACsD,MAAqB,EACX,gBAAyC,EAC7C,YAA0B,EACd,aAA8C,EACnD,YAAwC;QAJrD,WAAM,GAAN,MAAM,CAAe;QACX,qBAAgB,GAAhB,gBAAgB,CAAyB;QAC7C,iBAAY,GAAZ,YAAY,CAAc;QACd,kBAAa,GAAb,aAAa,CAAiC;QACnD,iBAAY,GAAZ,YAAY,CAA4B;QAEzG,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC;QACpD,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IACrD,CAAC;IAED,gEAAgE;IAEhE,IAAY,IAAI;QACd,OAAO,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC;IAC9D,CAAC;IAED,IAAY,MAAM;QAChB,OAAO,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC;IAChE,CAAC;IAED,IAAY,UAAU;QACpB,OAAO,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,IAAI,CAAC,kBAAkB,CAAC;IAC9D,CAAC;IAED;;;OAGG;IACH,IAAY,eAAe;QACzB,MAAM,SAAS,GAAG,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC;QACjE,MAAM,OAAO,GAAa,EAAE,CAAC;QAC7B,KAAK,MAAM,CAAC,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;YACjD,IAAI,IAAI,EAAE,SAAS,EAAE,CAAC;gBACpB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC;YAClD,CAAC;QACH,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,OAAO,CAAC,IAAI,CAAC,WAAW,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QACvC,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,gEAAgE;IAEhE;;;OAGG;IACH,KAAK,CAAC,2BAA2B,CAC/B,EAAyB,EACzB,MAAc,EACd,KAAa;QAEb,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,wBAAwB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QACjE,MAAM,mBAAmB,GAAI,IAAwB,CAAC,kBAAkB,IAAI,EAAE,CAAC;QAE/E,MAAM,WAAW,GAAG,IAAI,CAAC,gBAAgB,CAAC,MAAM,EAAE,IAAI,EAAE,aAAa,EAAE,kBAAkB,IAAI,EAAE,CAAC;QAChG,IAAI,mBAAmB,CAAC,MAAM,IAAI,WAAW,EAAE,CAAC;YAC9C,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,SAAS,EAAE;gBAClE,OAAO,EAAE,EAAE,MAAM,EAAE,cAAc,WAAW,mBAAmB,EAAE;aAClE,CAAC,CAAC;QACL,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,CAAC;QAC5B,MAAM,OAAO,GAAG,MAAM,2BAA2B,CAAC;YAChD,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,QAAQ,EAAE,KAAK;YACf,eAAe,EAAE,KAAK;YACtB,MAAM,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC;YACxC,wEAAwE;YACxE,0EAA0E;YAC1E,eAAe,EAAE,GAAG,CAAC,WAA+C;YACpE,OAAO,EAAE,GAAG,CAAC,cAAc,GAAG,IAAI;YAClC,sBAAsB,EAAE;gBACtB,uBAAuB,EAAE,GAAG,CAAC,uBAAuB,KAAK,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,uBAAuB;gBACxG,WAAW,EAAE,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,WAAW;gBAC9D,gBAAgB,EAAE,GAAG,CAAC,gBAAgB;aACvC;YACD,kBAAkB,EAAE,mBAAmB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBAClD,EAAE,EAAE,CAAC,CAAC,YAAY;gBAClB,UAAU,EAAE,CAAC,CAAC,UAAsC;aACrD,CAAC,CAAC;SACJ,CAAC,CAAC;QAEH,MAAM,IAAI,CAAC,eAAe,CAAC,wBAAwB,GAAG,MAAM,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;QACjF,IAAI,CAAC,QAAQ,CAAC,gCAAgC,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,mBAAmB,CAAC,MAAM,EAAE,CAAC,CAAC;QAEtG,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,0BAA0B,CAC9B,EAAyB,EACzB,MAAc,EACd,QAAkC,EAClC,cAAuB;QAEvB,MAAM,iBAAiB,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,wBAAwB,GAAG,MAAM,CAAC,CAAC;QAC/F,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACvB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;gBACtE,sBAAsB,EAAE,2BAA2B,CAAC,uCAAuC;gBAC3F,OAAO,EAAE,EAAE,MAAM,EAAE,sDAAsD,EAAE;aAC5E,CAAC,CAAC;QACL,CAAC;QAED,MAAM,YAAY,GAAG,MAAM,0BAA0B,CAAC;YACpD,QAAQ;YACR,iBAAiB;YACjB,cAAc,EAAE,IAAI,CAAC,eAAe;YACpC,YAAY,EAAE,IAAI,CAAC,IAAI;YACvB,uBAAuB,EAAE,IAAI,CAAC,UAAU,CAAC,gBAAgB,KAAK,UAAU;SACzE,CAAC,CAAC;QAEH,IAAI,CAAC,YAAY,CAAC,QAAQ,IAAI,CAAC,YAAY,CAAC,gBAAgB,EAAE,CAAC;YAC7D,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;gBACtE,sBAAsB,EAAE,2BAA2B,CAAC,uCAAuC;gBAC3F,OAAO,EAAE,EAAE,MAAM,EAAE,2CAA2C,EAAE;aACjE,CAAC,CAAC;QACL,CAAC;QAED,MAAM,EAAE,UAAU,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,GAAG,YAAY,CAAC,gBAAgB,CAAC;QAE/F,MAAM,aAAa,GAA2B;YAC5C,YAAY,EAAE,UAAU,CAAC,EAAE;YAC3B,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC;YAClE,OAAO,EAAE,UAAU,CAAC,OAAO;YAC3B,UAAU,EAAE,CAAC,UAAU,CAAC,UAAU,IAAI,EAAE,CAAa;YACrD,oBAAoB,EAAE,oBAAoB,IAAI,cAAc;YAC5D,kBAAkB,EAAE,kBAAkB,IAAI,KAAK;YAC/C,IAAI,EAAE,cAAc,IAAI,SAAS;YACjC,MAAM,EAAE,YAAY,CAAC,gBAAgB,CAAC,MAAM;YAC5C,SAAS,EAAE,IAAI,IAAI,EAAE;YACrB,UAAU,EAAE,SAAS;SACtB,CAAC;QAEF,kCAAkC;QAClC,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,wBAAwB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QACjE,MAAM,mBAAmB,GAAI,IAAwB,CAAC,kBAAkB,IAAI,EAAE,CAAC;QAC/E,MAAM,kBAAkB,GAAG,CAAC,GAAG,mBAAmB,EAAE,aAAa,CAAC,CAAC;QAEnE,MAAM,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,kBAAkB,EAAE,kBAAkB,EAA8B,CAAC,CAAC;QAE1H,IAAI,CAAC,QAAQ,CAAC,oBAAoB,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,aAAa,CAAC,YAAY,EAAE,CAAC,CAAC;QAC1F,OAAO,aAAa,CAAC;IACvB,CAAC;IAED,gEAAgE;IAEhE;;;OAGG;IACH,KAAK,CAAC,6BAA6B,CACjC,EAAyB,EACzB,MAAc;QAEd,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,wBAAwB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QACjE,MAAM,mBAAmB,GAAI,IAAwB,CAAC,kBAAkB,IAAI,EAAE,CAAC;QAE/E,IAAI,mBAAmB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACrC,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;gBACtE,sBAAsB,EAAE,2BAA2B,CAAC,uCAAuC;gBAC3F,OAAO,EAAE,EAAE,MAAM,EAAE,iDAAiD,EAAE;aACvE,CAAC,CAAC;QACL,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,6BAA6B,CAAC;YAClD,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,gBAAgB,EAAE,IAAI,CAAC,UAAU,CAAC,gBAAgB;YAClD,OAAO,EAAE,IAAI,CAAC,UAAU,CAAC,cAAc,GAAG,IAAI;YAC9C,gBAAgB,EAAE,mBAAmB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBAChD,EAAE,EAAE,CAAC,CAAC,YAAY;gBAClB,UAAU,EAAE,CAAC,CAAC,UAAsC;aACrD,CAAC,CAAC;SACJ,CAAC,CAAC;QAEH,MAAM,IAAI,CAAC,eAAe,CAAC,yBAAyB,GAAG,MAAM,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;QAClF,IAAI,CAAC,QAAQ,CAAC,kCAAkC,EAAE,EAAE,MAAM,EAAE,eAAe,EAAE,mBAAmB,CAAC,MAAM,EAAE,CAAC,CAAC;QAE3G,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,4BAA4B,CAChC,EAAyB,EACzB,MAAc,EACd,QAAoC;QAEpC,MAAM,iBAAiB,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,yBAAyB,GAAG,MAAM,CAAC,CAAC;QAChG,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACvB,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,YAAY,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC;QACxD,CAAC;QAED,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,wBAAwB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QACjE,MAAM,mBAAmB,GAAI,IAAwB,CAAC,kBAAkB,IAAI,EAAE,CAAC;QAC/E,MAAM,iBAAiB,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,KAAK,QAAQ,CAAC,EAAE,CAAC,CAAC;QAE1F,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACvB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,sDAAsD,EAAE;gBACvE,MAAM;gBACN,YAAY,EAAE,QAAQ,CAAC,EAAE;aAC1B,CAAC,CAAC;YACH,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,YAAY,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC;QACxD,CAAC;QAED,MAAM,YAAY,GAAG,MAAM,4BAA4B,CAAC;YACtD,QAAQ;YACR,iBAAiB;YACjB,cAAc,EAAE,IAAI,CAAC,eAAe;YACpC,YAAY,EAAE,IAAI,CAAC,IAAI;YACvB,uBAAuB,EAAE,IAAI,CAAC,UAAU,CAAC,gBAAgB,KAAK,UAAU;YACxE,UAAU,EAAE;gBACV,EAAE,EAAE,iBAAiB,CAAC,YAAY;gBAClC,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,SAAS,EAAE,WAAW,CAAC;gBAChE,OAAO,EAAE,iBAAiB,CAAC,OAAO;gBAClC,UAAU,EAAE,iBAAiB,CAAC,UAAsC;aACrE;SACF,CAAC,CAAC;QAEH,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,CAAC;YAC3B,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,YAAY,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC;QACxD,CAAC;QAED,yCAAyC;QACzC,MAAM,UAAU,GAAG,YAAY,CAAC,kBAAkB,CAAC,UAAU,CAAC;QAC9D,IAAI,UAAU,GAAG,CAAC,IAAI,UAAU,IAAI,iBAAiB,CAAC,OAAO,EAAE,CAAC;YAC9D,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,gEAAgE,EAAE;gBACjF,MAAM;gBACN,YAAY,EAAE,iBAAiB,CAAC,YAAY;gBAC5C,aAAa,EAAE,iBAAiB,CAAC,OAAO;gBACxC,eAAe,EAAE,UAAU;aAC5B,CAAC,CAAC;QACL,CAAC;QAED,gCAAgC;QAChC,MAAM,kBAAkB,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CACvD,CAAC,CAAC,YAAY,KAAK,iBAAiB,CAAC,YAAY;YAC/C,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,IAAI,IAAI,EAAE,EAAE;YACvD,CAAC,CAAC,CAAC,CACN,CAAC;QAEF,MAAM,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,kBAAkB,EAAE,kBAAkB,EAA8B,CAAC,CAAC;QAE1H,IAAI,CAAC,QAAQ,CAAC,iCAAiC,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,iBAAiB,CAAC,YAAY,EAAE,CAAC,CAAC;QAC3G,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,EAAE,iBAAiB,CAAC,YAAY,EAAE,CAAC;IAC1E,CAAC;IAED,gEAAgE;IAEhE;;OAEG;IACH,KAAK,CAAC,cAAc,CAAC,EAAyB,EAAE,MAAc;QAC5D,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,wBAAwB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QACjE,OAAQ,IAAwB,CAAC,kBAAkB,IAAI,EAAE,CAAC;IAC5D,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,gBAAgB,CAAC,EAAyB,EAAE,MAAc,EAAE,YAAoB;QACpF,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,wBAAwB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QACjE,MAAM,mBAAmB,GAAI,IAAwB,CAAC,kBAAkB,IAAI,EAAE,CAAC;QAC/E,MAAM,kBAAkB,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,KAAK,YAAY,CAAC,CAAC;QAE9F,IAAI,kBAAkB,CAAC,MAAM,KAAK,mBAAmB,CAAC,MAAM,EAAE,CAAC;YAC7D,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,SAAS,EAAE,SAAS,EAAE;gBACjE,OAAO,EAAE,EAAE,MAAM,EAAE,8BAA8B,EAAE,YAAY,EAAE;aAClE,CAAC,CAAC;QACL,CAAC;QAED,MAAM,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,kBAAkB,EAAE,kBAAkB,EAA8B,CAAC,CAAC;QAE1H,IAAI,CAAC,QAAQ,CAAC,iBAAiB,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC;IAC7D,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,gBAAgB,CAAC,EAAyB,EAAE,MAAc,EAAE,YAAoB,EAAE,OAAe;QACrG,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,wBAAwB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QACjE,MAAM,mBAAmB,GAAI,IAAwB,CAAC,kBAAkB,IAAI,EAAE,CAAC;QAC/E,MAAM,KAAK,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,KAAK,YAAY,CAAC,CAAC;QAE/E,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,SAAS,EAAE,SAAS,EAAE;gBACjE,OAAO,EAAE,EAAE,MAAM,EAAE,8BAA8B,EAAE,YAAY,EAAE;aAClE,CAAC,CAAC;QACL,CAAC;QAED,MAAM,kBAAkB,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CACvD,CAAC,CAAC,YAAY,KAAK,YAAY,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAC9D,CAAC;QAEF,MAAM,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,kBAAkB,EAAE,kBAAkB,EAA8B,CAAC,CAAC;QAE1H,IAAI,CAAC,QAAQ,CAAC,iBAAiB,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC,CAAC;IACtE,CAAC;IAED,gEAAgE;IAExD,KAAK,CAAC,eAAe,CAAC,GAAW,EAAE,SAAiB;QAC1D,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,SAAS,EAAE,EAAE,GAAG,EAAE,qBAAqB,EAAE,CAAC,CAAC;IAC9E,CAAC;IAEO,KAAK,CAAC,sBAAsB,CAAC,GAAW;QAC9C,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QAChD,MAAM,aAAa,GAAG,2FAA2F,CAAC;QAClH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;QAC1E,OAAO,MAAuB,CAAC;IACjC,CAAC;IAED,gEAAgE;IAEhE;;;OAGG;IACK,KAAK,CAAC,wBAAwB,CACpC,EAAyB,EACzB,MAAc;QAId,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,YAAY,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QAC/D,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,SAAS,EAAE,SAAS,EAAE;gBACjE,OAAO,EAAE,EAAE,MAAM,EAAE,4BAA4B,EAAE,MAAM,EAAE;aAC1D,CAAC,CAAC;QACL,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,CAAC;IAClB,CAAC;CACF,CAAA;AAvVY,sBAAsB;IADlC,UAAU,EAAE;IAKR,WAAA,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAA;IACjC,WAAA,MAAM,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,CAAA;IAC3C,WAAA,MAAM,CAAC,kBAAkB,CAAC,YAAY,CAAC,CAAA;IACvC,WAAA,MAAM,CAAC,kBAAkB,CAAC,wBAAwB,CAAC,CAAA;IACnD,WAAA,MAAM,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,CAAA;qCAJa,aAAa;QACO,uBAAuB;QAC/B,YAAY;QACC,+BAA+B;QACrC,0BAA0B;GARhG,sBAAsB,CAuVlC"}

package/dist/esm/security/authentications/services/auth-session-store.backend.service.d.ts

@@ -0,0 +1,66 @@
+import 'reflect-metadata';
+import { LoggerService } from '../../../monitoring/logger/services/logger.service.js';
+import { RedisService } from '../../../databases/services/redis.service.js';
+import { ErrorBuilderBackendService } from '../../../errors/services/error-builder.backend.service.js';
+import { AuthenticationSession } from '@wildo-ai/saas-models';
+/**
+ * IAuthSessionStore interface — abstraction over session storage.
+ * Implementations: RedisAuthSessionStore (production), InMemoryAuthSessionStore (testing).
+ */
+export interface IAuthSessionStore {
+    /** Get a session by ID. Returns null if not found or expired. */
+    get(sessionId: string): Promise<AuthenticationSession | null>;
+    /** Store a session with a TTL in seconds. */
+    set(sessionId: string, session: AuthenticationSession, ttlSeconds: number): Promise<void>;
+    /** Delete a session. */
+    delete(sessionId: string): Promise<void>;
+    /** Check if a session exists. */
+    exists(sessionId: string): Promise<boolean>;
+    /** Generate a cryptographically secure session ID. */
+    generateSessionId(): string;
+}
+/**
+ * Redis-backed authentication session store.
+ *
+ * Replaces the in-memory Map<string, AuthenticationSession> from the old AuthenticationBackendService.
+ * Sessions are stored as JSON in Redis with TTL-based expiry — no cleanup interval needed.
+ *
+ * TRAP 1 (from plan): If Redis is down, all authentication fails.
+ * This is intentional — fail-fast prevents a false sense of persistence from a silent in-memory fallback.
+ *
+ * TRAP 10 (from plan): Date serialization — AuthenticationSessionSchema.parse() on read
+ * handles z.coerce.date() conversion from ISO strings back to Date objects.
+ */
+export declare class AuthSessionStoreBackendService implements IAuthSessionStore {
+    private readonly logger;
+    private readonly redisService;
+    private readonly errorBuilder;
+    private readonly logDebug;
+    constructor(logger: LoggerService, redisService: RedisService, errorBuilder: ErrorBuilderBackendService);
+    /**
+     * Generate a cryptographically secure session ID.
+     * Fix for Section 6.5: replaces Date.now()-Math.random() with crypto.randomBytes(32).
+     */
+    generateSessionId(): string;
+    get(sessionId: string): Promise<AuthenticationSession | null>;
+    set(sessionId: string, session: AuthenticationSession, ttlSeconds: number): Promise<void>;
+    delete(sessionId: string): Promise<void>;
+    exists(sessionId: string): Promise<boolean>;
+    /**
+     * M1 fix: Atomic compare-and-swap update using a Lua script.
+     *
+     * Reads the current session, checks the version matches `expectedVersion`,
+     * and only writes the new session if versions match. This prevents TOCTOU
+     * race conditions in concurrent session state updates.
+     *
+     * @returns The updated session on success, or null if the version was stale
+     *          (indicating another writer modified the session concurrently).
+     */
+    atomicUpdate(sessionId: string, updatedSession: AuthenticationSession, expectedVersion: number, ttlSeconds: number): Promise<AuthenticationSession | null>;
+    /**
+     * Build the Redis key for a session.
+     * Uses the global scope (no organizationId) since auth sessions are app-level.
+     */
+    private key;
+}
+//# sourceMappingURL=auth-session-store.backend.service.d.ts.map