@wildo-ai/saas-backend-lib 1.1.0 → 1.1.2

package/dist/esm/security/authentications/models/jwt.backend.schemas.d.ts

@@ -1,5 +1,8 @@
 import jwt from 'jsonwebtoken';
 import { z } from 'zod';
+import { JwtPrivateKeys, JwtPublicKeys } from '@wildo-ai/saas-models';
+/** Re-exported so the 41 existing consumers keep one import site; the vocabularies live in `saas-models`. */
+export { JwtPrivateKeys, JwtPublicKeys };
 /**
  * Application JWT Private Keys
  *
@@ -8,29 +11,6 @@ import { z } from 'zod';
  * - Private key: wildo_application_secrets.security.jwt.privateKey[key]
  * - Public key: wildo_application_config.jwt.publicKey[key]
  */
-export declare enum JwtPrivateKeys {
-    /** Application signing requests to platform services */
-    APPLICATION_PLATFORM_REQUEST = "APPLICATION_PLATFORM_REQUEST",
-    /** Application signing requests to worker runtimes */
-    APPLICATION_WORKER_REQUEST = "APPLICATION_WORKER_REQUEST",
-    /** Application signing webhooks */
-    APPLICATION_WEBHOOK = "APPLICATION_WEBHOOK",
-    /** Application signing auth tokens */
-    APPLICATION_AUTH_TOKEN = "APPLICATION_AUTH_TOKEN"
-}
-/**
- * Platform Service JWT Public Keys
- *
- * Used to verify JWTs from platform services.
- * Public keys are stored in apps-manager env config.
- * Env var pattern: PLATFORM_<SERVICE_NAME>_PUBLIC_KEY
- */
-export declare enum JwtPublicKeys {
-    /** Platform service: apps-manager - central platform orchestrator */
-    PLATFORM_APPS_MANAGER = "PLATFORM_APPS_MANAGER",
-    /** Platform service: crontabs-batches-manager - handles scheduled jobs */
-    PLATFORM_CRONTABS_BATCHES_MANAGER = "PLATFORM_CRONTABS_BATCHES_MANAGER"
-}
 export declare const VerifiableJwtKeysSchema: z.ZodEnum<{
     [x: string]: string;
 }>;

package/dist/esm/security/authentications/models/jwt.backend.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"jwt.backend.schemas.d.ts","sourceRoot":"","sources":["../../../../../../src/security/authentications/models/jwt.backend.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,GAAG,MAAM,cAAc,CAAC;AAC/B,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB;;;;;;;GAOG;AACH,oBAAY,cAAc;IACtB,wDAAwD;IACxD,4BAA4B,iCAAiC;IAC7D,sDAAsD;IACtD,0BAA0B,+BAA+B;IACzD,mCAAmC;IACnC,mBAAmB,wBAAwB;IAC3C,sCAAsC;IACtC,sBAAsB,2BAA2B;CACpD;AAED;;;;;;GAMG;AACH,oBAAY,aAAa;IACrB,qEAAqE;IACrE,qBAAqB,0BAA0B;IAE/C,0EAA0E;IAC1E,iCAAiC,sCAAsC;CAC1E;AAED,eAAO,MAAM,uBAAuB;;EAAwG,CAAC;AAC7I,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE,eAAO,MAAM,qBAAqB,EAAE,GAAG,CAAC,WAGvC,CAAA;AAED,eAAO,MAAM,uBAAuB,EAAE,GAAG,CAAC,aAGzC,CAAA;AAED,eAAO,MAAM,wBAAwB,EAAE,MAAM,CAAC,cAAc,EAAE,GAAG,CAAC,WAAW,CAmC5E,CAAA;AAED,eAAO,MAAM,gBAAgB,EAAE,MAAM,CAAC,iBAAiB,EAAE,GAAG,CAAC,aAAa,CAkCzE,CAAA"}
+{"version":3,"file":"jwt.backend.schemas.d.ts","sourceRoot":"","sources":["../../../../../../src/security/authentications/models/jwt.backend.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,GAAG,MAAM,cAAc,CAAC;AAC/B,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAA0B,cAAc,EAAE,aAAa,EAAiC,MAAM,uBAAuB,CAAC;AAE7H,6GAA6G;AAC7G,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,CAAC;AAGzC;;;;;;;GAOG;AAGH,eAAO,MAAM,uBAAuB;;EAAwG,CAAC;AAC7I,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE,eAAO,MAAM,qBAAqB,EAAE,GAAG,CAAC,WAGvC,CAAA;AAED,eAAO,MAAM,uBAAuB,EAAE,GAAG,CAAC,aAGzC,CAAA;AAED,eAAO,MAAM,wBAAwB,EAAE,MAAM,CAAC,cAAc,EAAE,GAAG,CAAC,WAAW,CAgC5E,CAAA;AAED,eAAO,MAAM,gBAAgB,EAAE,MAAM,CAAC,iBAAiB,EAAE,GAAG,CAAC,aAAa,CAkCzE,CAAA"}

package/dist/esm/security/authentications/models/jwt.backend.schemas.js

@@ -1,4 +1,7 @@
 import { z } from 'zod';
+import { APPLICATION_JWT_ISSUER, JwtPrivateKeys, JwtPublicKeys, M2M_WEBHOOK_DELIVERY_CONTRACT } from '@wildo-ai/saas-models';
+/** Re-exported so the 41 existing consumers keep one import site; the vocabularies live in `saas-models`. */
+export { JwtPrivateKeys, JwtPublicKeys };
 /**
  * Application JWT Private Keys
  *
@@ -7,31 +10,6 @@ import { z } from 'zod';
  * - Private key: wildo_application_secrets.security.jwt.privateKey[key]
  * - Public key: wildo_application_config.jwt.publicKey[key]
  */
-export var JwtPrivateKeys;
-(function (JwtPrivateKeys) {
-    /** Application signing requests to platform services */
-    JwtPrivateKeys["APPLICATION_PLATFORM_REQUEST"] = "APPLICATION_PLATFORM_REQUEST";
-    /** Application signing requests to worker runtimes */
-    JwtPrivateKeys["APPLICATION_WORKER_REQUEST"] = "APPLICATION_WORKER_REQUEST";
-    /** Application signing webhooks */
-    JwtPrivateKeys["APPLICATION_WEBHOOK"] = "APPLICATION_WEBHOOK";
-    /** Application signing auth tokens */
-    JwtPrivateKeys["APPLICATION_AUTH_TOKEN"] = "APPLICATION_AUTH_TOKEN";
-})(JwtPrivateKeys || (JwtPrivateKeys = {}));
-/**
- * Platform Service JWT Public Keys
- *
- * Used to verify JWTs from platform services.
- * Public keys are stored in apps-manager env config.
- * Env var pattern: PLATFORM_<SERVICE_NAME>_PUBLIC_KEY
- */
-export var JwtPublicKeys;
-(function (JwtPublicKeys) {
-    /** Platform service: apps-manager - central platform orchestrator */
-    JwtPublicKeys["PLATFORM_APPS_MANAGER"] = "PLATFORM_APPS_MANAGER";
-    /** Platform service: crontabs-batches-manager - handles scheduled jobs */
-    JwtPublicKeys["PLATFORM_CRONTABS_BATCHES_MANAGER"] = "PLATFORM_CRONTABS_BATCHES_MANAGER";
-})(JwtPublicKeys || (JwtPublicKeys = {}));
 export const VerifiableJwtKeysSchema = z.enum([...Object.values(JwtPrivateKeys), ...Object.values(JwtPublicKeys)]);
 export const JwtDefaultSignOptions = {
     algorithm: 'ES256',
@@ -45,35 +23,32 @@ export const JwtPrivateKeySignOptions = {
     [JwtPrivateKeys.APPLICATION_PLATFORM_REQUEST]: {
         ...JwtDefaultSignOptions,
         keyid: JwtPrivateKeys.APPLICATION_PLATFORM_REQUEST,
-        issuer: 'wildo-application',
+        issuer: APPLICATION_JWT_ISSUER,
         audience: 'PLATFORM_SERVICE',
     },
     [JwtPrivateKeys.APPLICATION_WORKER_REQUEST]: {
         ...JwtDefaultSignOptions,
         keyid: JwtPrivateKeys.APPLICATION_WORKER_REQUEST,
-        issuer: 'wildo-application',
+        issuer: APPLICATION_JWT_ISSUER,
         audience: 'APPLICATION_WORKER',
     },
     [JwtPrivateKeys.APPLICATION_WEBHOOK]: {
         ...JwtDefaultSignOptions,
+        // Enum-name `keyid` is the internal default; `JwtBackendService.sign` overrides it with the
+        // RFC 7638 thumbprint of the signing key, which is what receivers and the JWKS see.
         keyid: JwtPrivateKeys.APPLICATION_WEBHOOK,
-        issuer: 'wildo-application',
-        audience: 'WEBHOOK',
-        // Override the 24h global default. The webhook signature only
-        // needs to outlive the delivery + retry window: the worker's
-        // backoff cap is 1m → 5m → 30m → 2h, so the JWT must live at
-        // least past the longest scheduled retry. 6 hours gives a
-        // generous buffer (consumer-side queue lag, clock skew) while
-        // shrinking the replay window an attacker has if they capture a
-        // signature in transit. A 24h window is unnecessary for an
-        // unauthenticated POST whose only consumer is the webhook
-        // recipient.
-        expiresIn: '6h',
+        // Issuer, audience and lifetime are a PUBLISHED receiver contract, so they come from
+        // `M2M_WEBHOOK_DELIVERY_CONTRACT` in saas-models — the same object the customer
+        // documentation projects. The lifetime overrides the 24h default: it only needs to outlive
+        // the delivery + retry window (backoff cap 1m → 5m → 30m → 2h).
+        issuer: M2M_WEBHOOK_DELIVERY_CONTRACT.signature.issuer,
+        audience: M2M_WEBHOOK_DELIVERY_CONTRACT.signature.audience,
+        expiresIn: M2M_WEBHOOK_DELIVERY_CONTRACT.signature.expiresIn,
     },
     [JwtPrivateKeys.APPLICATION_AUTH_TOKEN]: {
         ...JwtDefaultSignOptions,
         keyid: JwtPrivateKeys.APPLICATION_AUTH_TOKEN,
-        issuer: 'wildo-application',
+        issuer: APPLICATION_JWT_ISSUER,
         audience: 'AUTH_TOKEN',
     },
 };
@@ -81,22 +56,22 @@ export const JwtVerifyOptions = {
     // Application keys - used to verify tokens from Wildo applications
     [JwtPrivateKeys.APPLICATION_PLATFORM_REQUEST]: {
         ...JwtDefaultVerifyOptions,
-        issuer: 'wildo-application',
+        issuer: APPLICATION_JWT_ISSUER,
         audience: 'PLATFORM_SERVICE',
     },
     [JwtPrivateKeys.APPLICATION_WORKER_REQUEST]: {
         ...JwtDefaultVerifyOptions,
-        issuer: 'wildo-application',
+        issuer: APPLICATION_JWT_ISSUER,
         audience: 'APPLICATION_WORKER',
     },
     [JwtPrivateKeys.APPLICATION_WEBHOOK]: {
         ...JwtDefaultVerifyOptions,
-        issuer: 'wildo-application',
-        audience: 'WEBHOOK',
+        issuer: M2M_WEBHOOK_DELIVERY_CONTRACT.signature.issuer,
+        audience: M2M_WEBHOOK_DELIVERY_CONTRACT.signature.audience,
     },
     [JwtPrivateKeys.APPLICATION_AUTH_TOKEN]: {
         ...JwtDefaultVerifyOptions,
-        issuer: 'wildo-application',
+        issuer: APPLICATION_JWT_ISSUER,
         audience: 'AUTH_TOKEN',
     },
     // Platform service keys - used to verify tokens from platform services

package/dist/esm/security/authentications/models/jwt.backend.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"jwt.backend.schemas.js","sourceRoot":"","sources":["../../../../../../src/security/authentications/models/jwt.backend.schemas.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB;;;;;;;GAOG;AACH,MAAM,CAAN,IAAY,cASX;AATD,WAAY,cAAc;IACtB,wDAAwD;IACxD,+EAA6D,CAAA;IAC7D,sDAAsD;IACtD,2EAAyD,CAAA;IACzD,mCAAmC;IACnC,6DAA2C,CAAA;IAC3C,sCAAsC;IACtC,mEAAiD,CAAA;AACrD,CAAC,EATW,cAAc,KAAd,cAAc,QASzB;AAED;;;;;;GAMG;AACH,MAAM,CAAN,IAAY,aAMX;AAND,WAAY,aAAa;IACrB,qEAAqE;IACrE,gEAA+C,CAAA;IAE/C,0EAA0E;IAC1E,wFAAuE,CAAA;AAC3E,CAAC,EANW,aAAa,KAAb,aAAa,QAMxB;AAED,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAE,GAAG,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,CAA0B,CAAC,CAAC;AAG7I,MAAM,CAAC,MAAM,qBAAqB,GAAoB;IAClD,SAAS,EAAE,OAAO;IAClB,SAAS,EAAE,KAAK;CACnB,CAAA;AAED,MAAM,CAAC,MAAM,uBAAuB,GAAsB;IACtD,UAAU,EAAE,CAAC,OAAO,CAAC;IACrB,cAAc,EAAE,EAAE;CACrB,CAAA;AAED,MAAM,CAAC,MAAM,wBAAwB,GAA4C;IAC7E,CAAC,cAAc,CAAC,4BAA4B,CAAC,EAAE;QAC3C,GAAG,qBAAqB;QACxB,KAAK,EAAE,cAAc,CAAC,4BAA4B;QAClD,MAAM,EAAE,mBAAmB;QAC3B,QAAQ,EAAE,kBAAkB;KAC/B;IACD,CAAC,cAAc,CAAC,0BAA0B,CAAC,EAAE;QACzC,GAAG,qBAAqB;QACxB,KAAK,EAAE,cAAc,CAAC,0BAA0B;QAChD,MAAM,EAAE,mBAAmB;QAC3B,QAAQ,EAAE,oBAAoB;KACjC;IACD,CAAC,cAAc,CAAC,mBAAmB,CAAC,EAAE;QAClC,GAAG,qBAAqB;QACxB,KAAK,EAAE,cAAc,CAAC,mBAAmB;QACzC,MAAM,EAAE,mBAAmB;QAC3B,QAAQ,EAAE,SAAS;QACnB,8DAA8D;QAC9D,6DAA6D;QAC7D,6DAA6D;QAC7D,0DAA0D;QAC1D,8DAA8D;QAC9D,gEAAgE;QAChE,2DAA2D;QAC3D,0DAA0D;QAC1D,aAAa;QACb,SAAS,EAAE,IAAI;KAClB;IACD,CAAC,cAAc,CAAC,sBAAsB,CAAC,EAAE;QACrC,GAAG,qBAAqB;QACxB,KAAK,EAAE,cAAc,CAAC,sBAAsB;QAC5C,MAAM,EAAE,mBAAmB;QAC3B,QAAQ,EAAE,YAAY;KACzB;CACJ,CAAA;AAED,MAAM,CAAC,MAAM,gBAAgB,GAAiD;IAC1E,mEAAmE;IACnE,CAAC,cAAc,CAAC,4BAA4B,CAAC,EAAE;QAC3C,GAAG,uBAAuB;QAC1B,MAAM,EAAE,mBAAmB;QAC3B,QAAQ,EAAE,kBAAkB;KAC/B;IACD,CAAC,cAAc,CAAC,0BAA0B,CAAC,EAAE;QACzC,GAAG,uBAAuB;QAC1B,MAAM,EAAE,mBAAmB;QAC3B,QAAQ,EAAE,oBAAoB;KACjC;IACD,CAAC,cAAc,CAAC,mBAAmB,CAAC,EAAE;QAClC,GAAG,uBAAuB;QAC1B,MAAM,EAAE,mBAAmB;QAC3B,QAAQ,EAAE,SAAS;KACtB;IACD,CAAC,cAAc,CAAC,sBAAsB,CAAC,EAAE;QACrC,GAAG,uBAAuB;QAC1B,MAAM,EAAE,mBAAmB;QAC3B,QAAQ,EAAE,YAAY;KACzB;IACD,uEAAuE;IACvE,CAAC,aAAa,CAAC,qBAAqB,CAAC,EAAE;QACnC,GAAG,uBAAuB;QAC1B,MAAM,EAAE,uBAAuB;QAC/B,QAAQ,EAAE,kBAAkB;KAC/B;IAED,CAAC,aAAa,CAAC,iCAAiC,CAAC,EAAE;QAC/C,GAAG,uBAAuB;QAC1B,MAAM,EAAE,mCAAmC;QAC3C,QAAQ,EAAE,eAAe;KAC5B;CACJ,CAAA","sourcesContent":["import jwt from 'jsonwebtoken';\nimport { z } from 'zod';\n\n\n/**\n * Application JWT Private Keys\n * \n * Used by Wildo Applications (not platform services) to sign JWTs.\n * Each application has its own key pair stored in MongoDB:\n * - Private key: wildo_application_secrets.security.jwt.privateKey[key]\n * - Public key: wildo_application_config.jwt.publicKey[key]\n */\nexport enum JwtPrivateKeys {\n    /** Application signing requests to platform services */\n    APPLICATION_PLATFORM_REQUEST = 'APPLICATION_PLATFORM_REQUEST',\n    /** Application signing requests to worker runtimes */\n    APPLICATION_WORKER_REQUEST = 'APPLICATION_WORKER_REQUEST',\n    /** Application signing webhooks */\n    APPLICATION_WEBHOOK = 'APPLICATION_WEBHOOK',\n    /** Application signing auth tokens */\n    APPLICATION_AUTH_TOKEN = 'APPLICATION_AUTH_TOKEN',\n}\n\n/**\n * Platform Service JWT Public Keys\n * \n * Used to verify JWTs from platform services.\n * Public keys are stored in apps-manager env config.\n * Env var pattern: PLATFORM_<SERVICE_NAME>_PUBLIC_KEY\n */\nexport enum JwtPublicKeys {\n    /** Platform service: apps-manager - central platform orchestrator */\n    PLATFORM_APPS_MANAGER = 'PLATFORM_APPS_MANAGER',\n\n    /** Platform service: crontabs-batches-manager - handles scheduled jobs */\n    PLATFORM_CRONTABS_BATCHES_MANAGER = 'PLATFORM_CRONTABS_BATCHES_MANAGER',\n}\n\nexport const VerifiableJwtKeysSchema = z.enum([ ...Object.values(JwtPrivateKeys), ...Object.values(JwtPublicKeys)] as [string, ...string[]]);\nexport type VerifiableJwtKeys = z.infer<typeof VerifiableJwtKeysSchema>;\n\nexport const JwtDefaultSignOptions: jwt.SignOptions = {\n    algorithm: 'ES256',\n    expiresIn: '24h',\n}\n\nexport const JwtDefaultVerifyOptions: jwt.VerifyOptions = {\n    algorithms: ['ES256'],\n    clockTolerance: 30,\n}\n\nexport const JwtPrivateKeySignOptions: Record<JwtPrivateKeys, jwt.SignOptions> = {\n    [JwtPrivateKeys.APPLICATION_PLATFORM_REQUEST]: {\n        ...JwtDefaultSignOptions,\n        keyid: JwtPrivateKeys.APPLICATION_PLATFORM_REQUEST,\n        issuer: 'wildo-application',\n        audience: 'PLATFORM_SERVICE',\n    },\n    [JwtPrivateKeys.APPLICATION_WORKER_REQUEST]: {\n        ...JwtDefaultSignOptions,\n        keyid: JwtPrivateKeys.APPLICATION_WORKER_REQUEST,\n        issuer: 'wildo-application',\n        audience: 'APPLICATION_WORKER',\n    },\n    [JwtPrivateKeys.APPLICATION_WEBHOOK]: {\n        ...JwtDefaultSignOptions,\n        keyid: JwtPrivateKeys.APPLICATION_WEBHOOK,\n        issuer: 'wildo-application',\n        audience: 'WEBHOOK',\n        // Override the 24h global default. The webhook signature only\n        // needs to outlive the delivery + retry window: the worker's\n        // backoff cap is 1m → 5m → 30m → 2h, so the JWT must live at\n        // least past the longest scheduled retry. 6 hours gives a\n        // generous buffer (consumer-side queue lag, clock skew) while\n        // shrinking the replay window an attacker has if they capture a\n        // signature in transit. A 24h window is unnecessary for an\n        // unauthenticated POST whose only consumer is the webhook\n        // recipient.\n        expiresIn: '6h',\n    },\n    [JwtPrivateKeys.APPLICATION_AUTH_TOKEN]: {\n        ...JwtDefaultSignOptions,\n        keyid: JwtPrivateKeys.APPLICATION_AUTH_TOKEN,\n        issuer: 'wildo-application',\n        audience: 'AUTH_TOKEN',\n    },\n}\n\nexport const JwtVerifyOptions: Record<VerifiableJwtKeys, jwt.VerifyOptions> = {\n    // Application keys - used to verify tokens from Wildo applications\n    [JwtPrivateKeys.APPLICATION_PLATFORM_REQUEST]: {\n        ...JwtDefaultVerifyOptions,\n        issuer: 'wildo-application',\n        audience: 'PLATFORM_SERVICE',\n    },\n    [JwtPrivateKeys.APPLICATION_WORKER_REQUEST]: {\n        ...JwtDefaultVerifyOptions,\n        issuer: 'wildo-application',\n        audience: 'APPLICATION_WORKER',\n    },\n    [JwtPrivateKeys.APPLICATION_WEBHOOK]: {\n        ...JwtDefaultVerifyOptions,\n        issuer: 'wildo-application',\n        audience: 'WEBHOOK',\n    },\n    [JwtPrivateKeys.APPLICATION_AUTH_TOKEN]: {\n        ...JwtDefaultVerifyOptions,\n        issuer: 'wildo-application',\n        audience: 'AUTH_TOKEN',\n    },\n    // Platform service keys - used to verify tokens from platform services\n    [JwtPublicKeys.PLATFORM_APPS_MANAGER]: {\n        ...JwtDefaultVerifyOptions,\n        issuer: 'platform_apps_manager',\n        audience: 'PLATFORM_SERVICE',\n    },\n\n    [JwtPublicKeys.PLATFORM_CRONTABS_BATCHES_MANAGER]: {\n        ...JwtDefaultVerifyOptions,\n        issuer: 'platform_crontabs_batches_manager',\n        audience: 'SCHEDULED_JOB',\n    },\n}\n"]}
+{"version":3,"file":"jwt.backend.schemas.js","sourceRoot":"","sources":["../../../../../../src/security/authentications/models/jwt.backend.schemas.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,sBAAsB,EAAE,cAAc,EAAE,aAAa,EAAE,6BAA6B,EAAE,MAAM,uBAAuB,CAAC;AAE7H,6GAA6G;AAC7G,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,CAAC;AAGzC;;;;;;;GAOG;AAGH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAE,GAAG,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,CAA0B,CAAC,CAAC;AAG7I,MAAM,CAAC,MAAM,qBAAqB,GAAoB;IAClD,SAAS,EAAE,OAAO;IAClB,SAAS,EAAE,KAAK;CACnB,CAAA;AAED,MAAM,CAAC,MAAM,uBAAuB,GAAsB;IACtD,UAAU,EAAE,CAAC,OAAO,CAAC;IACrB,cAAc,EAAE,EAAE;CACrB,CAAA;AAED,MAAM,CAAC,MAAM,wBAAwB,GAA4C;IAC7E,CAAC,cAAc,CAAC,4BAA4B,CAAC,EAAE;QAC3C,GAAG,qBAAqB;QACxB,KAAK,EAAE,cAAc,CAAC,4BAA4B;QAClD,MAAM,EAAE,sBAAsB;QAC9B,QAAQ,EAAE,kBAAkB;KAC/B;IACD,CAAC,cAAc,CAAC,0BAA0B,CAAC,EAAE;QACzC,GAAG,qBAAqB;QACxB,KAAK,EAAE,cAAc,CAAC,0BAA0B;QAChD,MAAM,EAAE,sBAAsB;QAC9B,QAAQ,EAAE,oBAAoB;KACjC;IACD,CAAC,cAAc,CAAC,mBAAmB,CAAC,EAAE;QAClC,GAAG,qBAAqB;QACxB,4FAA4F;QAC5F,oFAAoF;QACpF,KAAK,EAAE,cAAc,CAAC,mBAAmB;QACzC,qFAAqF;QACrF,gFAAgF;QAChF,2FAA2F;QAC3F,gEAAgE;QAChE,MAAM,EAAE,6BAA6B,CAAC,SAAS,CAAC,MAAM;QACtD,QAAQ,EAAE,6BAA6B,CAAC,SAAS,CAAC,QAAQ;QAC1D,SAAS,EAAE,6BAA6B,CAAC,SAAS,CAAC,SAAS;KAC/D;IACD,CAAC,cAAc,CAAC,sBAAsB,CAAC,EAAE;QACrC,GAAG,qBAAqB;QACxB,KAAK,EAAE,cAAc,CAAC,sBAAsB;QAC5C,MAAM,EAAE,sBAAsB;QAC9B,QAAQ,EAAE,YAAY;KACzB;CACJ,CAAA;AAED,MAAM,CAAC,MAAM,gBAAgB,GAAiD;IAC1E,mEAAmE;IACnE,CAAC,cAAc,CAAC,4BAA4B,CAAC,EAAE;QAC3C,GAAG,uBAAuB;QAC1B,MAAM,EAAE,sBAAsB;QAC9B,QAAQ,EAAE,kBAAkB;KAC/B;IACD,CAAC,cAAc,CAAC,0BAA0B,CAAC,EAAE;QACzC,GAAG,uBAAuB;QAC1B,MAAM,EAAE,sBAAsB;QAC9B,QAAQ,EAAE,oBAAoB;KACjC;IACD,CAAC,cAAc,CAAC,mBAAmB,CAAC,EAAE;QAClC,GAAG,uBAAuB;QAC1B,MAAM,EAAE,6BAA6B,CAAC,SAAS,CAAC,MAAM;QACtD,QAAQ,EAAE,6BAA6B,CAAC,SAAS,CAAC,QAAQ;KAC7D;IACD,CAAC,cAAc,CAAC,sBAAsB,CAAC,EAAE;QACrC,GAAG,uBAAuB;QAC1B,MAAM,EAAE,sBAAsB;QAC9B,QAAQ,EAAE,YAAY;KACzB;IACD,uEAAuE;IACvE,CAAC,aAAa,CAAC,qBAAqB,CAAC,EAAE;QACnC,GAAG,uBAAuB;QAC1B,MAAM,EAAE,uBAAuB;QAC/B,QAAQ,EAAE,kBAAkB;KAC/B;IAED,CAAC,aAAa,CAAC,iCAAiC,CAAC,EAAE;QAC/C,GAAG,uBAAuB;QAC1B,MAAM,EAAE,mCAAmC;QAC3C,QAAQ,EAAE,eAAe;KAC5B;CACJ,CAAA","sourcesContent":["import jwt from 'jsonwebtoken';\nimport { z } from 'zod';\nimport { APPLICATION_JWT_ISSUER, JwtPrivateKeys, JwtPublicKeys, M2M_WEBHOOK_DELIVERY_CONTRACT } from '@wildo-ai/saas-models';\n\n/** Re-exported so the 41 existing consumers keep one import site; the vocabularies live in `saas-models`. */\nexport { JwtPrivateKeys, JwtPublicKeys };\n\n\n/**\n * Application JWT Private Keys\n * \n * Used by Wildo Applications (not platform services) to sign JWTs.\n * Each application has its own key pair stored in MongoDB:\n * - Private key: wildo_application_secrets.security.jwt.privateKey[key]\n * - Public key: wildo_application_config.jwt.publicKey[key]\n */\n\n\nexport const VerifiableJwtKeysSchema = z.enum([ ...Object.values(JwtPrivateKeys), ...Object.values(JwtPublicKeys)] as [string, ...string[]]);\nexport type VerifiableJwtKeys = z.infer<typeof VerifiableJwtKeysSchema>;\n\nexport const JwtDefaultSignOptions: jwt.SignOptions = {\n    algorithm: 'ES256',\n    expiresIn: '24h',\n}\n\nexport const JwtDefaultVerifyOptions: jwt.VerifyOptions = {\n    algorithms: ['ES256'],\n    clockTolerance: 30,\n}\n\nexport const JwtPrivateKeySignOptions: Record<JwtPrivateKeys, jwt.SignOptions> = {\n    [JwtPrivateKeys.APPLICATION_PLATFORM_REQUEST]: {\n        ...JwtDefaultSignOptions,\n        keyid: JwtPrivateKeys.APPLICATION_PLATFORM_REQUEST,\n        issuer: APPLICATION_JWT_ISSUER,\n        audience: 'PLATFORM_SERVICE',\n    },\n    [JwtPrivateKeys.APPLICATION_WORKER_REQUEST]: {\n        ...JwtDefaultSignOptions,\n        keyid: JwtPrivateKeys.APPLICATION_WORKER_REQUEST,\n        issuer: APPLICATION_JWT_ISSUER,\n        audience: 'APPLICATION_WORKER',\n    },\n    [JwtPrivateKeys.APPLICATION_WEBHOOK]: {\n        ...JwtDefaultSignOptions,\n        // Enum-name `keyid` is the internal default; `JwtBackendService.sign` overrides it with the\n        // RFC 7638 thumbprint of the signing key, which is what receivers and the JWKS see.\n        keyid: JwtPrivateKeys.APPLICATION_WEBHOOK,\n        // Issuer, audience and lifetime are a PUBLISHED receiver contract, so they come from\n        // `M2M_WEBHOOK_DELIVERY_CONTRACT` in saas-models — the same object the customer\n        // documentation projects. The lifetime overrides the 24h default: it only needs to outlive\n        // the delivery + retry window (backoff cap 1m → 5m → 30m → 2h).\n        issuer: M2M_WEBHOOK_DELIVERY_CONTRACT.signature.issuer,\n        audience: M2M_WEBHOOK_DELIVERY_CONTRACT.signature.audience,\n        expiresIn: M2M_WEBHOOK_DELIVERY_CONTRACT.signature.expiresIn,\n    },\n    [JwtPrivateKeys.APPLICATION_AUTH_TOKEN]: {\n        ...JwtDefaultSignOptions,\n        keyid: JwtPrivateKeys.APPLICATION_AUTH_TOKEN,\n        issuer: APPLICATION_JWT_ISSUER,\n        audience: 'AUTH_TOKEN',\n    },\n}\n\nexport const JwtVerifyOptions: Record<VerifiableJwtKeys, jwt.VerifyOptions> = {\n    // Application keys - used to verify tokens from Wildo applications\n    [JwtPrivateKeys.APPLICATION_PLATFORM_REQUEST]: {\n        ...JwtDefaultVerifyOptions,\n        issuer: APPLICATION_JWT_ISSUER,\n        audience: 'PLATFORM_SERVICE',\n    },\n    [JwtPrivateKeys.APPLICATION_WORKER_REQUEST]: {\n        ...JwtDefaultVerifyOptions,\n        issuer: APPLICATION_JWT_ISSUER,\n        audience: 'APPLICATION_WORKER',\n    },\n    [JwtPrivateKeys.APPLICATION_WEBHOOK]: {\n        ...JwtDefaultVerifyOptions,\n        issuer: M2M_WEBHOOK_DELIVERY_CONTRACT.signature.issuer,\n        audience: M2M_WEBHOOK_DELIVERY_CONTRACT.signature.audience,\n    },\n    [JwtPrivateKeys.APPLICATION_AUTH_TOKEN]: {\n        ...JwtDefaultVerifyOptions,\n        issuer: APPLICATION_JWT_ISSUER,\n        audience: 'AUTH_TOKEN',\n    },\n    // Platform service keys - used to verify tokens from platform services\n    [JwtPublicKeys.PLATFORM_APPS_MANAGER]: {\n        ...JwtDefaultVerifyOptions,\n        issuer: 'platform_apps_manager',\n        audience: 'PLATFORM_SERVICE',\n    },\n\n    [JwtPublicKeys.PLATFORM_CRONTABS_BATCHES_MANAGER]: {\n        ...JwtDefaultVerifyOptions,\n        issuer: 'platform_crontabs_batches_manager',\n        audience: 'SCHEDULED_JOB',\n    },\n}\n"]}

package/dist/esm/security/authentications/services/auth-methods/auth-method-management.backend.service.d.ts

@@ -86,7 +86,15 @@ export declare class AuthMethodManagementBackendService {
      * observed during login would still be valid moments later, and step-up would authorize a
      * destructive operation on a credential the caller never freshly proved.
      *
-     * `PASSKEY` remains explicitly refused rather than silently unsupported.
+     * `PASSKEY` is SUPPORTED, through a dedicated two-legged ceremony rather than the one call
+     * password and TOTP take: `POST /auth/reauth/passkey/options` then `POST /auth/reauth` with the
+     * assertion, because WebAuthn is challenge-response. It is a re-proof rather than a possession
+     * check — the branch below verifies under `PasskeyAuthenticationCeremony.STEP_UP`, which reads a
+     * SEPARATE challenge (so an assertion minted for a login cannot be redeemed here) and demands
+     * user verification even where the app policy is `preferred`.
+     *
+     * Any other `AuthMethod` is refused explicitly by the trailing `else`, rather than silently
+     * unsupported.
      *
      * assurance-control: WILDO.IDENTITY.STEP_UP_AUTHENTICATION — re-proof of identity before a
      * high-impact action, over any factor the principal actually holds.

package/dist/esm/security/authentications/services/auth-methods/auth-method-management.backend.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-method-management.backend.service.d.ts","sourceRoot":"","sources":["../../../../../../../src/security/authentications/services/auth-methods/auth-method-management.backend.service.ts"],"names":[],"mappings":"AAAA,OAAO,kBAAkB,CAAC;AAG1B,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAC9G,OAAO,KAAK,EAAE,qCAAqC,EAAE,MAAM,6FAA6F,CAAC;AACzJ,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,iFAAiF,CAAC;AAClI,OAAO,EAAE,oCAAoC,EAAE,MAAM,+FAA+F,CAAC;AACrJ,OAAO,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AAC/G,OAAO,EAAE,uBAAuB,EAAE,MAAM,gFAAgF,CAAC;AACzH,OAAO,EAAE,6BAA6B,EAAE,MAAM,yFAAyF,CAAC;AACxI,OAAO,EAAE,6BAA6B,EAAE,MAAM,wFAAwF,CAAC;AACvI,OAAO,EAAE,4BAA4B,EAAE,MAAM,6FAA6F,CAAC;AAC3I,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAC7F,OAAO,EAKL,UAAU,EAGV,sBAAsB,EACtB,iBAAiB,EAClB,MAAM,uBAAuB,CAAC;AAM/B,OAAO,EAAE,qBAAqB,EAAE,MAAM,4FAA4F,CAAC;AACnI,OAAO,EAAiC,sBAAsB,EAAE,MAAM,4FAA4F,CAAC;AAEnK,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qEAAqE,CAAC;AAE5G,UAAU,mBAAmB;IAC3B,GAAG,EAAE,MAAM,CAAC;IACZ,cAAc,EAAE,iBAAiB,CAAC;IAClC,MAAM,EAAE,sBAAsB,CAAC;IAC/B,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,IAAI,CAAC;IACf,UAAU,EAAE,IAAI,CAAC;CAClB;AAED,qBACa,kCAAkC;IAIR,OAAO,CAAC,QAAQ,CAAC,MAAM;IACV,OAAO,CAAC,QAAQ,CAAC,YAAY;IAClB,OAAO,CAAC,QAAQ,CAAC,uBAAuB;IAChD,OAAO,CAAC,QAAQ,CAAC,kBAAkB;IACzC,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IACjC,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IAC3B,OAAO,CAAC,QAAQ,CAAC,sBAAsB;IAC9C,OAAO,CAAC,QAAQ,CAAC,WAAW;IACtB,OAAO,CAAC,QAAQ,CAAC,UAAU;IAM7B,OAAO,CAAC,QAAQ,CAAC,mBAAmB;IAIzC,OAAO,CAAC,QAAQ,CAAC,cAAc;IAE9B,OAAO,CAAC,QAAQ,CAAC,eAAe;IAvB9E,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA+D;gBAGlC,MAAM,EAAE,aAAa,EACR,YAAY,EAAE,0BAA0B,EAC7B,uBAAuB,EAAE,qCAAqC,EACtE,kBAAkB,EAAE,oCAAoC,EAC9D,gBAAgB,EAAE,uBAAuB,EACzC,gBAAgB,EAAE,uBAAuB,EACnC,sBAAsB,EAAE,6BAA6B,EAC5D,WAAW,EAAE,6BAA6B,EACpC,UAAU,EAAE,4BAA4B,EAM1C,mBAAmB,EAAE,0BAA0B,EAIpD,cAAc,EAAE,qBAAqB,EAEpC,eAAe,EAAE,sBAAsB;IAUtG,OAAO,CAAC,SAAS;IAKjB;;;OAGG;YACW,sBAAsB;IAYvB,+BAA+B,CAAC,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAezF,cAAc,CACzB,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACzB,MAAM,EAAE,MAAM,EACd,eAAe,EAAE,MAAM,EACvB,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,IAAI,CAAC;IA6CH,WAAW,CACtB,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACzB,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,IAAI,CAAC;IAsCH,WAAW,CACtB,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACzB,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,MAAM,GAAG,SAAS,EAC/B,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,IAAI,CAAC;IA4EH,YAAY,CACvB,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACzB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC;QAAE,OAAO,EAAE,KAAK,CAAC;YAAE,MAAM,EAAE,UAAU,CAAC;YAAC,QAAQ,EAAE,OAAO,CAAC;YAAC,UAAU,CAAC,EAAE,IAAI,CAAC;YAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;SAAE,CAAC,CAAA;KAAE,CAAC;IAmHlH,gBAAgB,CAC3B,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACzB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC;QAAE,KAAK,EAAE,mBAAmB,EAAE,CAAA;KAAE,CAAC;IA8B/B,kBAAkB,CAC7B,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACzB,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,IAAI,CAAC;IAmDhB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA+BG;IACU,cAAc,CACzB,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACzB,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,UAAU,EAClB,QAAQ,CAAC,EAAE,MAAM,EACjB,eAAe,CAAC,EAAE,OAAO,EACzB,SAAS,CAAC,EAAE,MAAM,EAClB,SAAS,CAAC,EAAE,MAAM;IAClB;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC;QAAE,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC;IAsGtB,gBAAgB,CAC3B,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACzB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC;QAAE,aAAa,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,iBAAiB,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;CAsBtG"}
+{"version":3,"file":"auth-method-management.backend.service.d.ts","sourceRoot":"","sources":["../../../../../../../src/security/authentications/services/auth-methods/auth-method-management.backend.service.ts"],"names":[],"mappings":"AAAA,OAAO,kBAAkB,CAAC;AAG1B,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAC9G,OAAO,KAAK,EAAE,qCAAqC,EAAE,MAAM,6FAA6F,CAAC;AACzJ,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,iFAAiF,CAAC;AAClI,OAAO,EAAE,oCAAoC,EAAE,MAAM,+FAA+F,CAAC;AACrJ,OAAO,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AAC/G,OAAO,EAAE,uBAAuB,EAAE,MAAM,gFAAgF,CAAC;AACzH,OAAO,EAAE,6BAA6B,EAAE,MAAM,yFAAyF,CAAC;AACxI,OAAO,EAAE,6BAA6B,EAAE,MAAM,wFAAwF,CAAC;AACvI,OAAO,EAAE,4BAA4B,EAAE,MAAM,6FAA6F,CAAC;AAC3I,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAC7F,OAAO,EAKL,UAAU,EAGV,sBAAsB,EACtB,iBAAiB,EAClB,MAAM,uBAAuB,CAAC;AAM/B,OAAO,EAAE,qBAAqB,EAAE,MAAM,4FAA4F,CAAC;AACnI,OAAO,EAAiC,sBAAsB,EAAE,MAAM,4FAA4F,CAAC;AAEnK,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qEAAqE,CAAC;AAE5G,UAAU,mBAAmB;IAC3B,GAAG,EAAE,MAAM,CAAC;IACZ,cAAc,EAAE,iBAAiB,CAAC;IAClC,MAAM,EAAE,sBAAsB,CAAC;IAC/B,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,IAAI,CAAC;IACf,UAAU,EAAE,IAAI,CAAC;CAClB;AAED,qBACa,kCAAkC;IAIR,OAAO,CAAC,QAAQ,CAAC,MAAM;IACV,OAAO,CAAC,QAAQ,CAAC,YAAY;IAClB,OAAO,CAAC,QAAQ,CAAC,uBAAuB;IAChD,OAAO,CAAC,QAAQ,CAAC,kBAAkB;IACzC,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IACjC,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IAC3B,OAAO,CAAC,QAAQ,CAAC,sBAAsB;IAC9C,OAAO,CAAC,QAAQ,CAAC,WAAW;IACtB,OAAO,CAAC,QAAQ,CAAC,UAAU;IAM7B,OAAO,CAAC,QAAQ,CAAC,mBAAmB;IAIzC,OAAO,CAAC,QAAQ,CAAC,cAAc;IAE9B,OAAO,CAAC,QAAQ,CAAC,eAAe;IAvB9E,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA+D;gBAGlC,MAAM,EAAE,aAAa,EACR,YAAY,EAAE,0BAA0B,EAC7B,uBAAuB,EAAE,qCAAqC,EACtE,kBAAkB,EAAE,oCAAoC,EAC9D,gBAAgB,EAAE,uBAAuB,EACzC,gBAAgB,EAAE,uBAAuB,EACnC,sBAAsB,EAAE,6BAA6B,EAC5D,WAAW,EAAE,6BAA6B,EACpC,UAAU,EAAE,4BAA4B,EAM1C,mBAAmB,EAAE,0BAA0B,EAIpD,cAAc,EAAE,qBAAqB,EAEpC,eAAe,EAAE,sBAAsB;IAUtG,OAAO,CAAC,SAAS;IAKjB;;;OAGG;YACW,sBAAsB;IAYvB,+BAA+B,CAAC,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAezF,cAAc,CACzB,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACzB,MAAM,EAAE,MAAM,EACd,eAAe,EAAE,MAAM,EACvB,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,IAAI,CAAC;IA6CH,WAAW,CACtB,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACzB,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,IAAI,CAAC;IAsCH,WAAW,CACtB,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACzB,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,MAAM,GAAG,SAAS,EAC/B,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,IAAI,CAAC;IA4EH,YAAY,CACvB,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACzB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC;QAAE,OAAO,EAAE,KAAK,CAAC;YAAE,MAAM,EAAE,UAAU,CAAC;YAAC,QAAQ,EAAE,OAAO,CAAC;YAAC,UAAU,CAAC,EAAE,IAAI,CAAC;YAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;SAAE,CAAC,CAAA;KAAE,CAAC;IAmHlH,gBAAgB,CAC3B,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACzB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC;QAAE,KAAK,EAAE,mBAAmB,EAAE,CAAA;KAAE,CAAC;IA8B/B,kBAAkB,CAC7B,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACzB,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,IAAI,CAAC;IAmDhB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAuCG;IACU,cAAc,CACzB,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACzB,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,UAAU,EAClB,QAAQ,CAAC,EAAE,MAAM,EACjB,eAAe,CAAC,EAAE,OAAO,EACzB,SAAS,CAAC,EAAE,MAAM,EAClB,SAAS,CAAC,EAAE,MAAM;IAClB;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC;QAAE,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC;IAsGtB,gBAAgB,CAC3B,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACzB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC;QAAE,aAAa,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,iBAAiB,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;CAsBtG"}

package/dist/esm/security/authentications/services/auth-methods/auth-method-management.backend.service.js

@@ -409,7 +409,15 @@ let AuthMethodManagementBackendService = class AuthMethodManagementBackendServic
      * observed during login would still be valid moments later, and step-up would authorize a
      * destructive operation on a credential the caller never freshly proved.
      *
-     * `PASSKEY` remains explicitly refused rather than silently unsupported.
+     * `PASSKEY` is SUPPORTED, through a dedicated two-legged ceremony rather than the one call
+     * password and TOTP take: `POST /auth/reauth/passkey/options` then `POST /auth/reauth` with the
+     * assertion, because WebAuthn is challenge-response. It is a re-proof rather than a possession
+     * check — the branch below verifies under `PasskeyAuthenticationCeremony.STEP_UP`, which reads a
+     * SEPARATE challenge (so an assertion minted for a login cannot be redeemed here) and demands
+     * user verification even where the app policy is `preferred`.
+     *
+     * Any other `AuthMethod` is refused explicitly by the trailing `else`, rather than silently
+     * unsupported.
      *
      * assurance-control: WILDO.IDENTITY.STEP_UP_AUTHENTICATION — re-proof of identity before a
      * high-impact action, over any factor the principal actually holds.

package/dist/esm/security/authentications/services/auth-methods/auth-method-management.backend.service.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth-method-management.backend.service.js","sourceRoot":"","sources":["../../../../../../../src/security/authentications/services/auth-methods/auth-method-management.backend.service.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,OAAO,kBAAkB,CAAC;AAC1B,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAC/C,OAAO,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AACpF,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAG9G,OAAO,EAAE,oCAAoC,EAAE,MAAM,+FAA+F,CAAC;AACrJ,OAAO,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AAC/G,OAAO,EAAE,uBAAuB,EAAE,MAAM,gFAAgF,CAAC;AACzH,OAAO,EAAE,6BAA6B,EAAE,MAAM,yFAAyF,CAAC;AACxI,OAAO,EAAE,6BAA6B,EAAE,MAAM,wFAAwF,CAAC;AACvI,OAAO,EAAE,4BAA4B,EAAE,MAAM,6FAA6F,CAAC;AAC3I,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAC7F,OAAO,EACL,gBAAgB,EAChB,SAAS,EACT,2BAA2B,EAC3B,mBAAmB,EACnB,UAAU,EACV,wBAAwB,EACxB,+BAA+B,EAC/B,sBAAsB,EACtB,iBAAiB,GAClB,MAAM,uBAAuB,CAAC;AAK/B,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AACxD,OAAO,EAAE,qBAAqB,EAAE,MAAM,4FAA4F,CAAC;AACnI,OAAO,EAAE,6BAA6B,EAAE,sBAAsB,EAAE,MAAM,4FAA4F,CAAC;AAe5J,IAAM,kCAAkC,GAAxC,MAAM,kCAAkC;IAIS;IACa;IACW;IACR;IACN;IACA;IACM;IACP;IACM;IAMF;IAIL;IAEC;IAvB9C,QAAQ,CAA+D;IAExF,YACsD,MAAqB,EACR,YAAwC,EAC7B,uBAA8D,EACtE,kBAAwD,EAC9D,gBAAyC,EACzC,gBAAyC,EACnC,sBAAqD,EAC5D,WAA0C,EACpC,UAAwC,EAM1C,mBAA+C,EAIpD,cAAqC,EAEpC,eAAuC;QApBhD,WAAM,GAAN,MAAM,CAAe;QACR,iBAAY,GAAZ,YAAY,CAA4B;QAC7B,4BAAuB,GAAvB,uBAAuB,CAAuC;QACtE,uBAAkB,GAAlB,kBAAkB,CAAsC;QAC9D,qBAAgB,GAAhB,gBAAgB,CAAyB;QACzC,qBAAgB,GAAhB,gBAAgB,CAAyB;QACnC,2BAAsB,GAAtB,sBAAsB,CAA+B;QAC5D,gBAAW,GAAX,WAAW,CAA+B;QACpC,eAAU,GAAV,UAAU,CAA8B;QAM1C,wBAAmB,GAAnB,mBAAmB,CAA4B;QAIpD,mBAAc,GAAd,cAAc,CAAuB;QAEpC,oBAAe,GAAf,eAAe,CAAwB;QAEpG,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,oCAAoC,CAAC,CAAC;QAC9E,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,oCAAoC,EAAE,IAAI,CAAC,CAAC;IAC9E,CAAC;IAED,6EAA6E;IAC7E,mBAAmB;IACnB,6EAA6E;IAErE,SAAS,CAAC,KAAa;QAC7B,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,MAAM,CAAC;QAC9C,OAAO,MAAM,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACjC,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,sBAAsB,CAAC,EAAyB,EAAE,MAAc;QAC5E,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAA2B,gBAAgB,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC;YAC5H,IAAI,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;gBAC5B,OAAO,IAAI,CAAC,UAAU,CAAC,0BAA0B,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;YACnF,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,0CAA0C;QAC5C,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAEM,KAAK,CAAC,+BAA+B,CAAC,EAAyB,EAAE,MAAc;QACpF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QAC7D,MAAM,gBAAgB,GAAG,MAAM,EAAE,gBAAgB,CAAC;QAClD,IAAI,gBAAgB,IAAI,CAAC,gBAAgB,CAAC,sBAAsB,EAAE,CAAC;YACjE,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;gBACrE,sBAAsB,EAAE,2BAA2B,CAAC,aAAa;gBACjE,OAAO,EAAE,EAAE,MAAM,EAAE,0DAA0D,EAAE;aAChF,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,6EAA6E;IAC7E,sBAAsB;IACtB,6EAA6E;IAEtE,KAAK,CAAC,cAAc,CACzB,EAAyB,EACzB,MAAc,EACd,eAAuB,EACvB,WAAmB,EACnB,SAAiB,EACjB,SAAiB;QAEjB,IAAI,CAAC;YAEH,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;YAEjF,IAAI,CAAC,WAAW,IAAI,CAAC,WAAW,CAAC,YAAY,EAAE,CAAC;gBAC9C,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,SAAS,EAAE;oBAClE,sBAAsB,EAAE,2BAA2B,CAAC,UAAU;oBAC9D,OAAO,EAAE,EAAE,MAAM,EAAE,iDAAiD,EAAE;iBACvE,CAAC,CAAC;YACL,CAAC;YAED,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,cAAc,CACjE,WAAW,CAAC,YAAY,EAAE,eAAe,CAC1C,CAAC;YACF,IAAI,CAAC,cAAc,EAAE,CAAC;gBACpB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;oBACtE,sBAAsB,EAAE,2BAA2B,CAAC,UAAU;oBAC9D,OAAO,EAAE,EAAE,MAAM,EAAE,+BAA+B,EAAE;iBACrD,CAAC,CAAC;YACL,CAAC;YAED,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;YACrE,MAAM,cAAc,GAAG,cAAc,EAAE,cAAc,CAAC;YACtD,MAAM,YAAY,GAAG,IAAI,CAAC,kBAAkB,CAAC,sBAAsB,CAAC,WAAW,EAAE,cAAc,CAAC,CAAC;YACjG,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;gBACxB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,SAAS,EAAE;oBAClE,sBAAsB,EAAE,2BAA2B,CAAC,oCAAoC;oBACxF,OAAO,EAAE,EAAE,UAAU,EAAE,YAAY,CAAC,UAAU,EAAE,SAAS,EAAE,cAAc,EAAE,SAAS,EAAE,SAAS,EAAE,cAAc,EAAE,SAAS,EAAE;iBAC7H,CAAC,CAAC;YACL,CAAC;YAED,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,YAAY,CAAC,WAAW,EAAE,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;YACnI,MAAM,IAAI,CAAC,WAAW,CAAC,0BAA0B,CAAC,MAAM,CAAC,CAAC;YAC1D,MAAM,IAAI,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,EAAE,EAAE,MAAM,EAAE,eAAe,CAAC,CAAC;YAE9E,MAAM,IAAI,CAAC,gBAAgB,CAAC,sBAAsB,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC;QACnG,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,mBAAmB,CAAC,KAAK,CAAC;gBAAE,MAAM,KAAK,CAAC;YAC5C,MAAM,IAAI,CAAC,YAAY,CAAC,sBAAsB,CAAC,KAAK,EAAE,SAAS,EAAE;gBAC/D,OAAO,EAAE,EAAE,MAAM,EAAE,2BAA2B,EAAE;aACjD,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAEM,KAAK,CAAC,WAAW,CACtB,EAAyB,EACzB,MAAc,EACd,WAAmB,EACnB,SAAiB,EACjB,SAAiB;QAEjB,IAAI,CAAC;YAEH,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;YAEjF,IAAI,WAAW,EAAE,YAAY,EAAE,CAAC;gBAC9B,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,SAAS,EAAE;oBAClE,sBAAsB,EAAE,2BAA2B,CAAC,UAAU;oBAC9D,OAAO,EAAE,EAAE,MAAM,EAAE,yDAAyD,EAAE;iBAC/E,CAAC,CAAC;YACL,CAAC;YAED,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;YACrE,MAAM,cAAc,GAAG,cAAc,EAAE,cAAc,CAAC;YACtD,MAAM,YAAY,GAAG,IAAI,CAAC,kBAAkB,CAAC,sBAAsB,CAAC,WAAW,EAAE,cAAc,CAAC,CAAC;YACjG,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;gBACxB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,SAAS,EAAE;oBAClE,sBAAsB,EAAE,2BAA2B,CAAC,oCAAoC;oBACxF,OAAO,EAAE,EAAE,UAAU,EAAE,YAAY,CAAC,UAAU,EAAE,SAAS,EAAE,cAAc,EAAE,SAAS,EAAE,SAAS,EAAE,cAAc,EAAE,SAAS,EAAE;iBAC7H,CAAC,CAAC;YACL,CAAC;YAED,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,YAAY,CAAC,WAAW,EAAE,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;YACnI,MAAM,IAAI,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,EAAE,EAAE,MAAM,EAAE,eAAe,CAAC,CAAC;YAE9E,MAAM,IAAI,CAAC,gBAAgB,CAAC,kBAAkB,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC;QAC/F,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,mBAAmB,CAAC,KAAK,CAAC;gBAAE,MAAM,KAAK,CAAC;YAC5C,MAAM,IAAI,CAAC,YAAY,CAAC,sBAAsB,CAAC,KAAK,EAAE,SAAS,EAAE;gBAC/D,OAAO,EAAE,EAAE,MAAM,EAAE,wBAAwB,EAAE;aAC9C,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,6EAA6E;IAC7E,kBAAkB;IAClB,6EAA6E;IAEtE,KAAK,CAAC,WAAW,CACtB,EAAyB,EACzB,MAAc,EACd,WAA+B,EAC/B,SAAiB,EACjB,SAAiB;QAEjB,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,+BAA+B,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;YAEvD,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;YAErE,IAAI,cAAc,EAAE,gBAAgB,EAAE,6BAA6B,EAAE,CAAC;gBACpE,IAAI,CAAC,WAAW,EAAE,CAAC;oBACjB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;wBACtE,OAAO,EAAE,EAAE,MAAM,EAAE,+CAA+C,EAAE;qBACrE,CAAC,CAAC;gBACL,CAAC;gBACD,IAAI,CAAC;oBACH,MAAM,IAAI,CAAC,sBAAsB,CAAC,aAAa,CAAC,WAAW,EAAE,CAAC,wBAAwB,CAAC,MAAM,CAAC,CAAC,CAAC;oBAChG,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC;oBAC1E,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;wBAC5B,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;4BACrE,OAAO,EAAE,EAAE,MAAM,EAAE,sDAAsD,EAAE;yBAC5E,CAAC,CAAC;oBACL,CAAC;gBACH,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,IAAI,mBAAmB,CAAC,KAAK,CAAC;wBAAE,MAAM,KAAK,CAAC;oBAC5C,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;wBACtE,OAAO,EAAE,EAAE,MAAM,EAAE,4CAA4C,EAAE;qBAClE,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YAED,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;YAEjF,IAAI,CAAC,WAAW,EAAE,YAAY,EAAE,CAAC;gBAC/B,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,SAAS,EAAE;oBAClE,sBAAsB,EAAE,2BAA2B,CAAC,UAAU;oBAC9D,OAAO,EAAE,EAAE,MAAM,EAAE,qBAAqB,EAAE;iBAC3C,CAAC,CAAC;YACL,CAAC;YAED,MAAM,WAAW,GAAG,CAAC,CAAC,cAAc,EAAE,SAAS,EAAE,UAAU,CAAC;YAC5D,IAAI,WAAW,EAAE,CAAC;gBAChB,MAAM,WAAW,GACf,CAAC,WAAW,CAAC,kBAAkB,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC;oBACjD,WAAW,CAAC,mBAAmB,KAAK,IAAI,CAAC;gBAE3C,IAAI,CAAC,WAAW,EAAE,CAAC;oBACjB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,SAAS,EAAE;wBAClE,sBAAsB,EAAE,2BAA2B,CAAC,UAAU;wBAC9D,OAAO,EAAE,EAAE,MAAM,EAAE,2DAA2D,EAAE;qBACjF,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YAED,4EAA4E;YAC5E,4EAA4E;YAC5E,gFAAgF;YAChF,8EAA8E;YAC9E,+BAA+B;YAC/B,MAAM,IAAI,CAAC,mBAAmB,CAAC,cAAc,CAAC,gBAAgB,CAAC,gBAAgB,EAAE,EAAE,MAAM,EAAE,EAAE;gBAC3F,YAAY,EAAE,IAAI;gBAClB,YAAY,EAAE,KAAK;gBACnB,iBAAiB,EAAE,EAAE;gBACrB,cAAc,EAAE,IAAI;aACrB,CAAC,CAAC;YAEH,MAAM,IAAI,CAAC,gBAAgB,CAAC,mBAAmB,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC;QAChG,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,mBAAmB,CAAC,KAAK,CAAC;gBAAE,MAAM,KAAK,CAAC;YAC5C,MAAM,IAAI,CAAC,YAAY,CAAC,sBAAsB,CAAC,KAAK,EAAE,SAAS,EAAE;gBAC/D,OAAO,EAAE,EAAE,MAAM,EAAE,wBAAwB,EAAE;aAC9C,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,6EAA6E;IAC7E,uBAAuB;IACvB,6EAA6E;IAEtE,KAAK,CAAC,YAAY,CACvB,EAAyB,EACzB,MAAc;QAEd,IAAI,CAAC;YAEH,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;YAEjF,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAC3D,gBAAgB,CAAC,mBAAmB,EACpC,EAAE,EACF,EAAE,MAAM,EAAE,EACV,SAAS,EACT,EAAE,SAAS,EAAE,KAAK,EAAE,CACC,IAAI,EAAE,CAAC;YAE9B,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;YACrE,MAAM,kBAAkB,GAAG,cAAc,EAAE,kBAAkB,CAAC;YAE9D,MAAM,UAAU,GAA2G,EAAE,CAAC;YAE9H,MAAM,aAAa,GAAG,CAAC,MAAkB,EAAW,EAAE;gBACpD,IAAI,CAAC,kBAAkB;oBAAE,OAAO,IAAI,CAAC;gBACrC,OAAO,CAAC,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC;YACtC,CAAC,CAAC;YAEF,IAAI,aAAa,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACvC,UAAU,CAAC,IAAI,CAAC;oBACd,MAAM,EAAE,UAAU,CAAC,QAAQ;oBAC3B,QAAQ,EAAE,CAAC,CAAC,WAAW,EAAE,YAAY;iBACtC,CAAC,CAAC;YACL,CAAC;YAED,IAAI,aAAa,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;gBACnC,UAAU,CAAC,IAAI,CAAC;oBACd,MAAM,EAAE,UAAU,CAAC,IAAI;oBACvB,QAAQ,EAAE,WAAW,EAAE,YAAY,KAAK,IAAI;oBAC5C,UAAU,EAAE,WAAW,EAAE,cAAc,IAAI,SAAS;iBACrD,CAAC,CAAC;YACL,CAAC;YAED,IAAI,aAAa,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;gBACtC,UAAU,CAAC,IAAI,CAAC;oBACd,MAAM,EAAE,UAAU,CAAC,OAAO;oBAC1B,QAAQ,EAAE,CAAC,WAAW,EAAE,kBAAkB,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC;oBAC5D,OAAO,EAAE,EAAE,YAAY,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,IAAI,CAAC,EAAE;iBACxE,CAAC,CAAC;YACL,CAAC;YAED,IAAI,aAAa,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;gBACtC,UAAU,CAAC,IAAI,CAAC;oBACd,MAAM,EAAE,UAAU,CAAC,OAAO;oBAC1B,QAAQ,EAAE,WAAW,EAAE,mBAAmB,KAAK,IAAI;oBACnD,OAAO,EAAE,WAAW,EAAE,mBAAmB;wBACvC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,WAAY,CAAC,EAAE;wBAC3D,CAAC,CAAC,SAAS;iBACd,CAAC,CAAC;YACL,CAAC;YAED,IAAI,aAAa,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;gBACxC,UAAU,CAAC,IAAI,CAAC;oBACd,MAAM,EAAE,UAAU,CAAC,SAAS;oBAC5B,QAAQ,EAAE,IAAI;iBACf,CAAC,CAAC;YACL,CAAC;YAED,IAAI,aAAa,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;gBACzC,UAAU,CAAC,IAAI,CAAC;oBACd,MAAM,EAAE,UAAU,CAAC,UAAU;oBAC7B,QAAQ,EAAE,IAAI;iBACf,CAAC,CAAC;YACL,CAAC;YAED,IAAI,aAAa,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,CAAC;gBAC9C,MAAM,WAAW,GAAG,aAAa,CAAC,MAAM,CACtC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,cAAc,KAAK,iBAAiB,CAAC,MAAM,CAC3D,CAAC;gBACF,UAAU,CAAC,IAAI,CAAC;oBACd,MAAM,EAAE,UAAU,CAAC,eAAe;oBAClC,QAAQ,EAAE,WAAW,CAAC,MAAM,GAAG,CAAC;iBACjC,CAAC,CAAC;YACL,CAAC;YAED,IAAI,aAAa,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACvC,UAAU,CAAC,IAAI,CAAC;oBACd,MAAM,EAAE,UAAU,CAAC,QAAQ;oBAC3B,QAAQ,EAAE,aAAa,CAAC,IAAI,CAC1B,CAAC,IAAI,EAAE,EAAE,CACP,IAAI,CAAC,cAAc,KAAK,iBAAiB,CAAC,UAAU;2BACjD,IAAI,CAAC,MAAM,KAAK,sBAAsB,CAAC,IAAI,CACjD;iBACF,CAAC,CAAC;YACL,CAAC;YAED,IAAI,aAAa,CAAC,UAAU,CAAC,kBAAkB,CAAC,EAAE,CAAC;gBACjD,UAAU,CAAC,IAAI,CAAC;oBACd,MAAM,EAAE,UAAU,CAAC,kBAAkB;oBACrC,QAAQ,EAAE,aAAa,CAAC,IAAI,CAC1B,CAAC,IAAI,EAAE,EAAE,CACP,IAAI,CAAC,cAAc,KAAK,iBAAiB,CAAC,UAAU;2BACjD,IAAI,CAAC,MAAM,KAAK,sBAAsB,CAAC,IAAI,CACjD;iBACF,CAAC,CAAC;YACL,CAAC;YAED,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC;QACjC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,mBAAmB,CAAC,KAAK,CAAC;gBAAE,MAAM,KAAK,CAAC;YAC5C,MAAM,IAAI,CAAC,YAAY,CAAC,sBAAsB,CAAC,KAAK,EAAE,SAAS,EAAE;gBAC/D,OAAO,EAAE,EAAE,MAAM,EAAE,4BAA4B,EAAE;aAClD,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,6EAA6E;IAC7E,iBAAiB;IACjB,6EAA6E;IAEtE,KAAK,CAAC,gBAAgB,CAC3B,EAAyB,EACzB,MAAc;QAEd,IAAI,CAAC;YAEH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,IAAI,CACtD,gBAAgB,CAAC,mBAAmB,EACpC,EAAE,EACF,EAAE,MAAM,EAAE,EACV,SAAS,EACT,EAAE,SAAS,EAAE,KAAK,EAAE,CACC,CAAC;YAExB,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;gBACpC,GAAG,EAAE,IAAI,CAAC,GAAG;gBACb,cAAc,EAAE,IAAI,CAAC,cAAc;gBACnC,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,aAAa,EAAE,IAAI,CAAC,aAAa;gBACjC,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,UAAU,EAAE,IAAI,CAAC,UAAU;aAC5B,CAAC,CAAC,CAAC;YAEJ,OAAO,EAAE,KAAK,EAAE,CAAC;QACnB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,mBAAmB,CAAC,KAAK,CAAC;gBAAE,MAAM,KAAK,CAAC;YAC5C,MAAM,IAAI,CAAC,YAAY,CAAC,sBAAsB,CAAC,KAAK,EAAE,SAAS,EAAE;gBAC/D,OAAO,EAAE,EAAE,MAAM,EAAE,8BAA8B,EAAE;aACpD,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAEM,KAAK,CAAC,kBAAkB,CAC7B,EAAyB,EACzB,MAAc,EACd,MAAc,EACd,SAAiB,EACjB,SAAiB;QAEjB,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,+BAA+B,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;YAEvD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAClD,gBAAgB,CAAC,mBAAmB,EACpC,EAAE,EACF,EAAE,GAAG,EAAE,MAAM,EAAE,CAChB,CAAC;YAEF,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,SAAS,EAAE,SAAS,EAAE;oBACjE,OAAO,EAAE,EAAE,MAAM,EAAE,yBAAyB,EAAE;iBAC/C,CAAC,CAAC;YACL,CAAC;YAED,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBAC3B,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,SAAS,EAAE,SAAS,EAAE;oBACjE,OAAO,EAAE,EAAE,MAAM,EAAE,yBAAyB,EAAE;iBAC/C,CAAC,CAAC;YACL,CAAC;YAED,MAAM,gBAAgB,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;YACjE,IAAI,gBAAgB,CAAC,KAAK,IAAI,CAAC,EAAE,CAAC;gBAChC,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,SAAS,EAAE;oBAClE,sBAAsB,EAAE,2BAA2B,CAAC,UAAU;oBAC9D,OAAO,EAAE,EAAE,MAAM,EAAE,+CAA+C,EAAE;iBACrE,CAAC,CAAC;YACL,CAAC;YAED,MAAM,IAAI,CAAC,uBAAuB,CAAC,MAAM,CAAC,gBAAgB,CAAC,mBAAmB,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;YAE5F,MAAM,IAAI,CAAC,gBAAgB,CAAC,0BAA0B,CAAC;gBACrD,MAAM,EAAE,MAAM;gBACd,MAAM;gBACN,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,SAAS;gBACT,SAAS;aACV,EAAE,EAAE,CAAC,CAAC;QACT,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,mBAAmB,CAAC,KAAK,CAAC;gBAAE,MAAM,KAAK,CAAC;YAC5C,MAAM,IAAI,CAAC,YAAY,CAAC,sBAAsB,CAAC,KAAK,EAAE,SAAS,EAAE;gBAC/D,OAAO,EAAE,EAAE,MAAM,EAAE,gCAAgC,EAAE;aACtD,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,6EAA6E;IAC7E,oBAAoB;IACpB,6EAA6E;IAE7E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA+BG;IACI,KAAK,CAAC,cAAc,CACzB,EAAyB,EACzB,MAAc,EACd,MAAkB,EAClB,QAAiB,EACjB,eAAyB,EACzB,SAAkB,EAClB,SAAkB;IAClB;;;OAGG;IACH,QAAiB;QAEjB,IAAI,CAAC;YAEH,IAAI,MAAM,KAAK,UAAU,CAAC,IAAI,EAAE,CAAC;gBAC/B,IAAI,CAAC,QAAQ,EAAE,CAAC;oBACd,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,SAAS,EAAE;wBAClE,OAAO,EAAE,EAAE,MAAM,EAAE,+CAA+C,EAAE;qBACrE,CAAC,CAAC;gBACL,CAAC;gBAED,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,0BAA0B,CAAC,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;gBAEhG,IAAI,YAAY,CAAC,WAAW,EAAE,CAAC;oBAC7B,wFAAwF;oBACxF,4EAA4E;oBAC5E,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;wBACtE,OAAO,EAAE,EAAE,MAAM,EAAE,4CAA4C,EAAE;qBAClE,CAAC,CAAC;gBACL,CAAC;gBAED,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;oBACxB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;wBACtE,OAAO,EAAE,EAAE,MAAM,EAAE,cAAc,EAAE;qBACpC,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;iBAAM,IAAI,MAAM,KAAK,UAAU,CAAC,QAAQ,EAAE,CAAC;gBAC1C,IAAI,CAAC,QAAQ,EAAE,CAAC;oBACd,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,SAAS,EAAE;wBAClE,OAAO,EAAE,EAAE,MAAM,EAAE,qDAAqD,EAAE;qBAC3E,CAAC,CAAC;gBACL,CAAC;gBAED,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;gBAEjF,IAAI,CAAC,WAAW,EAAE,YAAY,EAAE,CAAC;oBAC/B,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;wBACtE,OAAO,EAAE,EAAE,MAAM,EAAE,kCAAkC,EAAE;qBACxD,CAAC,CAAC;gBACL,CAAC;gBAED,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,cAAc,CAC1D,WAAW,CAAC,YAAY,EAAE,QAAQ,CACnC,CAAC;gBACF,IAAI,CAAC,OAAO,EAAE,CAAC;oBACb,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;wBACtE,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;qBACxC,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;iBAAM,IAAI,MAAM,KAAK,UAAU,CAAC,OAAO,EAAE,CAAC;gBACzC,IAAI,CAAC,eAAe,EAAE,CAAC;oBACrB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,SAAS,EAAE;wBAClE,OAAO,EAAE,EAAE,MAAM,EAAE,+DAA+D,EAAE;qBACrF,CAAC,CAAC;gBACL,CAAC;gBAED,6FAA6F;gBAC7F,4FAA4F;gBAC5F,oDAAoD;gBACpD,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,4BAA4B,CAC1E,EAAE,EACF,MAAM,EACN,eAA6C,EAC7C,6BAA6B,CAAC,OAAO,CACtC,CAAC;gBAEF,IAAI,CAAC,QAAQ,EAAE,CAAC;oBACd,oFAAoF;oBACpF,yFAAyF;oBACzF,0FAA0F;oBAC1F,sBAAsB;oBACtB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;wBACtE,OAAO,EAAE,EAAE,MAAM,EAAE,kCAAkC,EAAE;qBACxD,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,SAAS,EAAE;oBAClE,OAAO,EAAE,EAAE,MAAM,EAAE,yCAAyC,MAAM,EAAE,EAAE;iBACvE,CAAC,CAAC;YACL,CAAC;YAED,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,WAAW,CAAC;gBAC1D,SAAS,EAAE,wBAAwB,CAAC,MAAM;gBAC1C,eAAe,EAAE,+BAA+B,CAAC,UAAU;gBAC3D,SAAS,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,YAAY,CAAC,OAAO,EAAE;gBACnD,MAAM,EAAE,MAAM;gBACd,kBAAkB,EAAE,gBAAgB,CAAC,KAAK;gBAC1C,SAAS,EAAE,MAAM;aAClB,CAAC,CAAC;YAEH,OAAO,EAAE,WAAW,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC;QACtC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,mBAAmB,CAAC,KAAK,CAAC;gBAAE,MAAM,KAAK,CAAC;YAC5C,MAAM,IAAI,CAAC,YAAY,CAAC,sBAAsB,CAAC,KAAK,EAAE,SAAS,EAAE;gBAC/D,OAAO,EAAE,EAAE,MAAM,EAAE,2BAA2B,EAAE;aACjD,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,6EAA6E;IAC7E,yCAAyC;IACzC,6EAA6E;IAEtE,KAAK,CAAC,gBAAgB,CAC3B,EAAyB,EACzB,MAAc;QAEd,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QAEjF,MAAM,aAAa,GAAG,WAAW,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACxD,MAAM,YAAY,GAAG,WAAW,EAAE,kBAAkB,EAAE,MAAM,IAAI,CAAC,CAAC;QAElE,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAC3D,gBAAgB,CAAC,mBAAmB,EACpC,EAAE,EACF,EAAE,MAAM,EAAE,EACV,SAAS,EACT,EAAE,SAAS,EAAE,KAAK,EAAE,CACC,CAAC;QACxB,MAAM,iBAAiB,GAAG,aAAa,CAAC,MAAM,CAAC;QAE/C,OAAO;YACL,aAAa;YACb,YAAY;YACZ,iBAAiB;YACjB,KAAK,EAAE,aAAa,GAAG,YAAY,GAAG,iBAAiB;SACxD,CAAC;IACJ,CAAC;CACF,CAAA;AApnBY,kCAAkC;IAD9C,UAAU,EAAE;IAKR,WAAA,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAA;IACjC,WAAA,MAAM,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,CAAA;IAC9C,WAAA,MAAM,CAAC,kBAAkB,CAAC,8BAA8B,CAAC,CAAA;IACzD,WAAA,MAAM,CAAC,kBAAkB,CAAC,sBAAsB,CAAC,CAAA;IACjD,WAAA,MAAM,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,CAAA;IAC3C,WAAA,MAAM,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,CAAA;IAC3C,WAAA,MAAM,CAAC,kBAAkB,CAAC,sBAAsB,CAAC,CAAA;IACjD,WAAA,MAAM,CAAC,kBAAkB,CAAC,eAAe,CAAC,CAAA;IAC1C,WAAA,MAAM,CAAC,kBAAkB,CAAC,qBAAqB,CAAC,CAAA;IAMhD,WAAA,MAAM,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,CAAA;IAI9C,YAAA,MAAM,CAAC,kBAAkB,CAAC,cAAc,CAAC,CAAA;IAEzC,YAAA,MAAM,CAAC,kBAAkB,CAAC,eAAe,CAAC,CAAA;qCApBiB,aAAa;QACM,0BAA0B,YAEjB,oCAAoC;QAC5C,uBAAuB;QACvB,uBAAuB;QACX,6BAA6B;QAC/C,6BAA6B;QACxB,4BAA4B,YAU/B,qBAAqB;QAEnB,sBAAsB;GAxB3F,kCAAkC,CAonB9C","sourcesContent":["import 'reflect-metadata';\nimport { inject, injectable } from 'inversify';\nimport { SAAS_SERVICE_TYPES } from '~wildo-backend-lib/inject/models/service-types';\nimport { ErrorBuilderBackendService } from '~wildo-backend-lib/errors/services/error-builder.backend.service';\nimport type { ServicesRegistryHandlerBackendService } from '~wildo-backend-lib/base-classes/services/services/services-registry-handler.backend.service';\nimport type { SystemAccessBackendService } from '~wildo-backend-lib/base-classes/services/services/system-access.backend.service';\nimport { AuthCredentialVerifierBackendService } from '~wildo-backend-lib/security/authentications/services/auth-credential-verifier.backend.service';\nimport { AppConfigurationService } from '~wildo-backend-lib/config/services/app-configuration.backend.service';\nimport { AuditLogsBackendService } from '~wildo-backend-lib/compliance/audit-trails/services/audit-logs.backend.service';\nimport { ConsumableTokenBackendService } from '~wildo-backend-lib/security/consumable-tokens/services/consumable-token.backend.service';\nimport { AuthTokenIssuerBackendService } from '~wildo-backend-lib/security/authentications/services/auth-token-issuer.backend.service';\nimport { AuthUserLookupBackendService } from '~wildo-backend-lib/security/authentications/services/utils/auth-user-lookup.backend.service';\nimport { LoggerService } from '~wildo-backend-lib/monitoring/logger/services/logger.service';\nimport {\n  CoreResourceType,\n  ErrorType,\n  ErrorCustomMessageReference,\n  isWildoBackendError,\n  AuthMethod,\n  CoreConsumableTokenTypes,\n  ConsumableToken_ConsumptionMode,\n  ExternalIdentitySource,\n  SsoConnectionType,\n} from '@wildo-ai/saas-models';\nimport type {\n  UserIdentityLink,\n  UserTypeAuthPolicy,\n} from '@wildo-ai/saas-models';\nimport { DurationUnit } from '@wildo-ai/zod-decorators';\nimport { AuthMfaBackendService } from '~wildo-backend-lib/security/authentications/services/auth-methods/auth-mfa.backend.service';\nimport { PasskeyAuthenticationCeremony, WebAuthnBackendService } from '~wildo-backend-lib/security/authentications/services/auth-methods/webauthn.backend.service';\nimport type { AuthenticationResponseJSON } from '@simplewebauthn/server';\nimport type { ExecutionContext } from '~wildo-backend-lib/runtime/models/execution-context.backend.schemas';\n\ninterface IdentityLinkSummary {\n  _id: string;\n  connectionType: SsoConnectionType;\n  source: ExternalIdentitySource;\n  providerRef: string;\n  providerEmail: string;\n  linkedAt: Date;\n  lastUsedAt: Date;\n}\n\n@injectable()\nexport class AuthMethodManagementBackendService {\n  private readonly logDebug: (message: string, context?: Record<string, unknown>) => void;\n\n  constructor(\n    @inject(SAAS_SERVICE_TYPES.Logger) private readonly logger: LoggerService,\n    @inject(SAAS_SERVICE_TYPES.ErrorBuilderService) private readonly errorBuilder: ErrorBuilderBackendService,\n    @inject(SAAS_SERVICE_TYPES.ServicesRegistryHandlerService) private readonly servicesRegistryHandler: ServicesRegistryHandlerBackendService,\n    @inject(SAAS_SERVICE_TYPES.AuthCredentialVerifier) private readonly credentialVerifier: AuthCredentialVerifierBackendService,\n    @inject(SAAS_SERVICE_TYPES.AppConfigService) private readonly appConfigService: AppConfigurationService,\n    @inject(SAAS_SERVICE_TYPES.AuditLogsService) private readonly auditLogsService: AuditLogsBackendService,\n    @inject(SAAS_SERVICE_TYPES.ConsumableTokenService) private readonly consumableTokenService: ConsumableTokenBackendService,\n    @inject(SAAS_SERVICE_TYPES.AuthTokenIssuer) private readonly tokenIssuer: AuthTokenIssuerBackendService,\n    @inject(SAAS_SERVICE_TYPES.AuthUserLookupService) private readonly userLookup: AuthUserLookupBackendService,\n    // TOTP-disable clears `secretBase32` + `backupCodesHashed` (both `.isBackendOnly()`),\n    // which a plain handler update strips → the secret and backup codes would silently\n    // survive a \"disable\". `updateAsSystem` re-attaches the cleared values after the\n    // strict parse, fail-closed behind USER_CREDENTIALS' `systemAccessPolicy.update`.\n    // Appended LAST to keep the positional test construction stable.\n    @inject(SAAS_SERVICE_TYPES.SystemAccessService) private readonly systemAccessService: SystemAccessBackendService,\n    // Appended LAST for the same reason as the parameter above — keeps positional test\n    // construction stable. Supplies the enrolled-second-factor authority `reAuthenticate` uses for\n    // `AuthMethod.TOTP`, shared with the login second-factor step.\n    @inject(SAAS_SERVICE_TYPES.AuthMfaService) private readonly authMfaService: AuthMfaBackendService,\n    // Appended LAST, same reason as the two above. Supplies the STEP_UP passkey ceremony.\n    @inject(SAAS_SERVICE_TYPES.WebAuthnService) private readonly webAuthnService: WebAuthnBackendService,\n  ) {\n    this.logDebug = this.logger.debugByType('AuthMethodManagementBackendService');\n    this.logger.setDebugTypeLogging('AuthMethodManagementBackendService', true);\n  }\n\n  // ==========================================================================\n  // INTERNAL HELPERS\n  // ==========================================================================\n\n  private maskPhone(phone: string): string {\n    if (!phone || phone.length < 4) return '****';\n    return `***${phone.slice(-4)}`;\n  }\n\n  /**\n   * W6.8 + AUTH-14: Resolve effective auth policy for a user, including org override merging.\n   * Falls back to null if the user or user type is not found.\n   */\n  private async _resolveUserTypePolicy(ec: ExecutionContext<any>, userId: string): Promise<UserTypeAuthPolicy | null> {\n    try {\n      const user = await this.servicesRegistryHandler.read<{ userTypes?: string[] }>(CoreResourceType.USERS, ec, { _id: userId });\n      if (user?.userTypes?.length) {\n        return this.userLookup.resolveEffectiveAuthPolicy(ec, userId, user.userTypes[0]);\n      }\n    } catch {\n      // Suppress — non-fatal, will use defaults\n    }\n    return null;\n  }\n\n  public async enforceUserMethodRemovalAllowed(ec: ExecutionContext<any>, userId: string): Promise<void> {\n    const policy = await this._resolveUserTypePolicy(ec, userId);\n    const methodManagement = policy?.methodManagement;\n    if (methodManagement && !methodManagement.allowUserMethodRemoval) {\n      throw this.errorBuilder.buildError(ErrorType.AUTHORIZATION, undefined, {\n        customMessageReference: ErrorCustomMessageReference.AUTHORIZATION,\n        context: { reason: 'User-initiated auth method removal is disabled by policy' },\n      });\n    }\n  }\n\n  // ==========================================================================\n  // PASSWORD MANAGEMENT\n  // ==========================================================================\n\n  public async changePassword(\n    ec: ExecutionContext<any>,\n    userId: string,\n    currentPassword: string,\n    newPassword: string,\n    ipAddress: string,\n    userAgent: string,\n  ): Promise<void> {\n    try {\n\n      const credentials = await this.credentialVerifier.resolveCredentials(ec, userId);\n\n      if (!credentials || !credentials.passwordHash) {\n        throw this.errorBuilder.buildError(ErrorType.VALIDATION, undefined, {\n          customMessageReference: ErrorCustomMessageReference.VALIDATION,\n          context: { reason: 'No password set. Use /auth/password/set instead' },\n        });\n      }\n\n      const isCurrentValid = await this.credentialVerifier.verifyPassword(\n        credentials.passwordHash, currentPassword,\n      );\n      if (!isCurrentValid) {\n        throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n          customMessageReference: ErrorCustomMessageReference.VALIDATION,\n          context: { reason: 'Current password is incorrect' },\n        });\n      }\n\n      const userTypePolicy = await this._resolveUserTypePolicy(ec, userId);\n      const passwordPolicy = userTypePolicy?.passwordPolicy;\n      const policyResult = this.credentialVerifier.validatePasswordPolicy(newPassword, passwordPolicy);\n      if (!policyResult.valid) {\n        throw this.errorBuilder.buildError(ErrorType.VALIDATION, undefined, {\n          customMessageReference: ErrorCustomMessageReference.VALIDATION_PASSWORD_POLICY_VIOLATION,\n          context: { violations: policyResult.violations, minLength: passwordPolicy?.minLength, maxLength: passwordPolicy?.maxLength },\n        });\n      }\n\n      const newPasswordHash = await this.credentialVerifier.hashPassword(newPassword, this.appConfigService.config.auth.passwordHashing);\n      await this.tokenIssuer.invalidateAllTokensForUser(userId);\n      await this.credentialVerifier.updatePasswordHash(ec, userId, newPasswordHash);\n\n      await this.auditLogsService.logUserPasswordChanged({ userId: userId, ipAddress, userAgent }, ec);\n    } catch (error) {\n      if (isWildoBackendError(error)) throw error;\n      throw this.errorBuilder.buildFromStandardError(error, undefined, {\n        context: { reason: 'Failed to change password' },\n      });\n    }\n  }\n\n  public async setPassword(\n    ec: ExecutionContext<any>,\n    userId: string,\n    newPassword: string,\n    ipAddress: string,\n    userAgent: string,\n  ): Promise<void> {\n    try {\n\n      const credentials = await this.credentialVerifier.resolveCredentials(ec, userId);\n\n      if (credentials?.passwordHash) {\n        throw this.errorBuilder.buildError(ErrorType.VALIDATION, undefined, {\n          customMessageReference: ErrorCustomMessageReference.VALIDATION,\n          context: { reason: 'Password already set. Use /auth/password/change instead' },\n        });\n      }\n\n      const userTypePolicy = await this._resolveUserTypePolicy(ec, userId);\n      const passwordPolicy = userTypePolicy?.passwordPolicy;\n      const policyResult = this.credentialVerifier.validatePasswordPolicy(newPassword, passwordPolicy);\n      if (!policyResult.valid) {\n        throw this.errorBuilder.buildError(ErrorType.VALIDATION, undefined, {\n          customMessageReference: ErrorCustomMessageReference.VALIDATION_PASSWORD_POLICY_VIOLATION,\n          context: { violations: policyResult.violations, minLength: passwordPolicy?.minLength, maxLength: passwordPolicy?.maxLength },\n        });\n      }\n\n      const newPasswordHash = await this.credentialVerifier.hashPassword(newPassword, this.appConfigService.config.auth.passwordHashing);\n      await this.credentialVerifier.updatePasswordHash(ec, userId, newPasswordHash);\n\n      await this.auditLogsService.logUserPasswordSet({ userId: userId, ipAddress, userAgent }, ec);\n    } catch (error) {\n      if (isWildoBackendError(error)) throw error;\n      throw this.errorBuilder.buildFromStandardError(error, undefined, {\n        context: { reason: 'Failed to set password' },\n      });\n    }\n  }\n\n  // ==========================================================================\n  // TOTP MANAGEMENT\n  // ==========================================================================\n\n  public async disableTotp(\n    ec: ExecutionContext<any>,\n    userId: string,\n    reAuthToken: string | undefined,\n    ipAddress: string,\n    userAgent: string,\n  ): Promise<void> {\n    try {\n      await this.enforceUserMethodRemovalAllowed(ec, userId);\n\n      const userTypePolicy = await this._resolveUserTypePolicy(ec, userId);\n\n      if (userTypePolicy?.methodManagement?.requireReauthForMethodChanges) {\n        if (!reAuthToken) {\n          throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n            context: { reason: 'Re-authentication is required for this action' },\n          });\n        }\n        try {\n          await this.consumableTokenService.validateToken(reAuthToken, [CoreConsumableTokenTypes.REAUTH]);\n          const token = await this.consumableTokenService.consumeToken(reAuthToken);\n          if (token.userId !== userId) {\n            throw this.errorBuilder.buildError(ErrorType.AUTHORIZATION, undefined, {\n              context: { reason: 'Re-authentication token does not belong to this user' },\n            });\n          }\n        } catch (error) {\n          if (isWildoBackendError(error)) throw error;\n          throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n            context: { reason: 'Invalid or expired re-authentication token' },\n          });\n        }\n      }\n\n      const credentials = await this.credentialVerifier.resolveCredentials(ec, userId);\n\n      if (!credentials?.totpVerified) {\n        throw this.errorBuilder.buildError(ErrorType.VALIDATION, undefined, {\n          customMessageReference: ErrorCustomMessageReference.VALIDATION,\n          context: { reason: 'TOTP is not enabled' },\n        });\n      }\n\n      const mfaRequired = !!userTypePolicy?.mfaPolicy?.requireMFA;\n      if (mfaRequired) {\n        const hasOtherMFA =\n          (credentials.passkeyCredentials?.length ?? 0) > 0 ||\n          credentials.phoneNumberVerified === true;\n\n        if (!hasOtherMFA) {\n          throw this.errorBuilder.buildError(ErrorType.VALIDATION, undefined, {\n            customMessageReference: ErrorCustomMessageReference.VALIDATION,\n            context: { reason: 'Cannot disable your only MFA method while MFA is required' },\n          });\n        }\n      }\n\n      // Trusted system write: clearing `secretBase32` + `backupCodesHashed` (both\n      // backendOnly) must survive the strict parse, otherwise the TOTP secret and\n      // backup codes silently persist after a \"disable\". `updateAsSystem` re-attaches\n      // the cleared values; `totpVerified`/`totpVerifiedAt` are plain fields parsed\n      // normally, exactly as before.\n      await this.systemAccessService.updateAsSystem(CoreResourceType.USER_CREDENTIALS, { userId }, {\n        secretBase32: null,\n        totpVerified: false,\n        backupCodesHashed: [],\n        totpVerifiedAt: null,\n      });\n\n      await this.auditLogsService.logUserTOTPDisabled({ userId: userId, ipAddress, userAgent }, ec);\n    } catch (error) {\n      if (isWildoBackendError(error)) throw error;\n      throw this.errorBuilder.buildFromStandardError(error, undefined, {\n        context: { reason: 'Failed to disable TOTP' },\n      });\n    }\n  }\n\n  // ==========================================================================\n  // METHOD INTROSPECTION\n  // ==========================================================================\n\n  public async getMyMethods(\n    ec: ExecutionContext<any>,\n    userId: string,\n  ): Promise<{ methods: Array<{ method: AuthMethod; enrolled: boolean; enrolledAt?: Date; details?: Record<string, unknown> }> }> {\n    try {\n\n      const credentials = await this.credentialVerifier.resolveCredentials(ec, userId);\n\n      const identityLinks = await this.servicesRegistryHandler.list<UserIdentityLink>(\n        CoreResourceType.USER_IDENTITY_LINKS,\n        ec,\n        { userId },\n        undefined,\n        { paginated: false },\n      ) as UserIdentityLink[] ?? [];\n\n      const userTypePolicy = await this._resolveUserTypePolicy(ec, userId);\n      const authMethodsEnabled = userTypePolicy?.authMethodsEnabled;\n\n      const allMethods: Array<{ method: AuthMethod; enrolled: boolean; enrolledAt?: Date; details?: Record<string, unknown> }> = [];\n\n      const shouldInclude = (method: AuthMethod): boolean => {\n        if (!authMethodsEnabled) return true;\n        return !!authMethodsEnabled[method];\n      };\n\n      if (shouldInclude(AuthMethod.PASSWORD)) {\n        allMethods.push({\n          method: AuthMethod.PASSWORD,\n          enrolled: !!credentials?.passwordHash,\n        });\n      }\n\n      if (shouldInclude(AuthMethod.TOTP)) {\n        allMethods.push({\n          method: AuthMethod.TOTP,\n          enrolled: credentials?.totpVerified === true,\n          enrolledAt: credentials?.totpVerifiedAt ?? undefined,\n        });\n      }\n\n      if (shouldInclude(AuthMethod.PASSKEY)) {\n        allMethods.push({\n          method: AuthMethod.PASSKEY,\n          enrolled: (credentials?.passkeyCredentials?.length ?? 0) > 0,\n          details: { passkeyCount: credentials?.passkeyCredentials?.length ?? 0 },\n        });\n      }\n\n      if (shouldInclude(AuthMethod.SMS_OTP)) {\n        allMethods.push({\n          method: AuthMethod.SMS_OTP,\n          enrolled: credentials?.phoneNumberVerified === true,\n          details: credentials?.phoneNumberVerified\n            ? { phoneNumber: this.maskPhone(credentials.phoneNumber!) }\n            : undefined,\n        });\n      }\n\n      if (shouldInclude(AuthMethod.EMAIL_OTP)) {\n        allMethods.push({\n          method: AuthMethod.EMAIL_OTP,\n          enrolled: true,\n        });\n      }\n\n      if (shouldInclude(AuthMethod.MAGIC_LINK)) {\n        allMethods.push({\n          method: AuthMethod.MAGIC_LINK,\n          enrolled: true,\n        });\n      }\n\n      if (shouldInclude(AuthMethod.EXTERNAL_OAUTH2)) {\n        const socialLinks = identityLinks.filter(\n          (link) => link.connectionType === SsoConnectionType.SOCIAL,\n        );\n        allMethods.push({\n          method: AuthMethod.EXTERNAL_OAUTH2,\n          enrolled: socialLinks.length > 0,\n        });\n      }\n\n      if (shouldInclude(AuthMethod.ORG_SAML)) {\n        allMethods.push({\n          method: AuthMethod.ORG_SAML,\n          enrolled: identityLinks.some(\n            (link) =>\n              link.connectionType === SsoConnectionType.ENTERPRISE\n              && link.source === ExternalIdentitySource.SAML,\n          ),\n        });\n      }\n\n      if (shouldInclude(AuthMethod.ORG_OPENID_CONNECT)) {\n        allMethods.push({\n          method: AuthMethod.ORG_OPENID_CONNECT,\n          enrolled: identityLinks.some(\n            (link) =>\n              link.connectionType === SsoConnectionType.ENTERPRISE\n              && link.source === ExternalIdentitySource.OIDC,\n          ),\n        });\n      }\n\n      return { methods: allMethods };\n    } catch (error) {\n      if (isWildoBackendError(error)) throw error;\n      throw this.errorBuilder.buildFromStandardError(error, undefined, {\n        context: { reason: 'Failed to get auth methods' },\n      });\n    }\n  }\n\n  // ==========================================================================\n  // IDENTITY LINKS\n  // ==========================================================================\n\n  public async getIdentityLinks(\n    ec: ExecutionContext<any>,\n    userId: string,\n  ): Promise<{ links: IdentityLinkSummary[] }> {\n    try {\n\n      const rawLinks = await this.servicesRegistryHandler.list<UserIdentityLink>(\n        CoreResourceType.USER_IDENTITY_LINKS,\n        ec,\n        { userId },\n        undefined,\n        { paginated: false },\n      ) as UserIdentityLink[];\n\n      const links = rawLinks.map((link) => ({\n        _id: link._id,\n        connectionType: link.connectionType,\n        source: link.source,\n        providerRef: link.providerRef,\n        providerEmail: link.providerEmail,\n        linkedAt: link.linkedAt,\n        lastUsedAt: link.lastUsedAt,\n      }));\n\n      return { links };\n    } catch (error) {\n      if (isWildoBackendError(error)) throw error;\n      throw this.errorBuilder.buildFromStandardError(error, undefined, {\n        context: { reason: 'Failed to get identity links' },\n      });\n    }\n  }\n\n  public async unlinkIdentityLink(\n    ec: ExecutionContext<any>,\n    userId: string,\n    linkId: string,\n    ipAddress: string,\n    userAgent: string,\n  ): Promise<void> {\n    try {\n      await this.enforceUserMethodRemovalAllowed(ec, userId);\n\n      const link = await this.servicesRegistryHandler.read<UserIdentityLink>(\n        CoreResourceType.USER_IDENTITY_LINKS,\n        ec,\n        { _id: linkId },\n      );\n\n      if (!link) {\n        throw this.errorBuilder.buildError(ErrorType.NOT_FOUND, undefined, {\n          context: { reason: 'Identity link not found' },\n        });\n      }\n\n      if (link.userId !== userId) {\n        throw this.errorBuilder.buildError(ErrorType.NOT_FOUND, undefined, {\n          context: { reason: 'Identity link not found' },\n        });\n      }\n\n      const authMethodCounts = await this.countAuthMethods(ec, userId);\n      if (authMethodCounts.total <= 1) {\n        throw this.errorBuilder.buildError(ErrorType.VALIDATION, undefined, {\n          customMessageReference: ErrorCustomMessageReference.VALIDATION,\n          context: { reason: 'Cannot remove your only authentication method' },\n        });\n      }\n\n      await this.servicesRegistryHandler.delete(CoreResourceType.USER_IDENTITY_LINKS, ec, linkId);\n\n      await this.auditLogsService.logUserIdentityLinkRemoved({\n        userId: userId,\n        linkId,\n        providerRef: link.providerRef,\n        ipAddress,\n        userAgent,\n      }, ec);\n    } catch (error) {\n      if (isWildoBackendError(error)) throw error;\n      throw this.errorBuilder.buildFromStandardError(error, undefined, {\n        context: { reason: 'Failed to unlink identity link' },\n      });\n    }\n  }\n\n  // ==========================================================================\n  // RE-AUTHENTICATION\n  // ==========================================================================\n\n  /**\n   * Prove the caller is still themselves, and mint a single-use `REAUTH` token on success.\n   *\n   * # Which factors are accepted, and why TOTP had to be one of them\n   *\n   * `requiresStepUpAuthentication` operations are cleared ONLY by the token this method mints, so\n   * the factor list here decides who can perform them at all. While it was PASSWORD-only, two\n   * populations were structurally locked out of every gated verb:\n   *\n   *  - user types whose `authMethodsEnabled` excludes `PASSWORD` (SSO-only, passkey-only) — also\n   *    reachable through a per-ORGANIZATION `authMethodsEnabled` override;\n   *  - **directory-managed (SCIM) users**, whose `passwordHash` AND passkeys the framework\n   *    deliberately destroys so a local first factor cannot survive IdP deprovisioning\n   *    (`_reconcileLocalCredentialsForDirectoryManaged`).\n   *\n   * That second group is not an edge case: once tenant teardown split into `request_deletion` +\n   * purge, an ORG_ADMIN of a directory-managed tenant could not start even the NORMAL teardown.\n   * TOTP is the right remedy precisely because the same reconciliation leaves it INTACT — it is a\n   * second factor sitting on top of the IdP first factor, so it survives deprovisioning by design.\n   *\n   * `TOTP` here means \"an enrolled second factor\": a TOTP code or one of the principal's backup\n   * codes, verified through the single shared authority\n   * ({@link AuthMfaBackendService.verifyEnrolledSecondFactor}) that login uses — including its\n   * anti-replay. The anti-replay is load-bearing for step-up specifically: without it a code\n   * observed during login would still be valid moments later, and step-up would authorize a\n   * destructive operation on a credential the caller never freshly proved.\n   *\n   * `PASSKEY` remains explicitly refused rather than silently unsupported.\n   *\n   * assurance-control: WILDO.IDENTITY.STEP_UP_AUTHENTICATION — re-proof of identity before a\n   * high-impact action, over any factor the principal actually holds.\n   */\n  public async reAuthenticate(\n    ec: ExecutionContext<any>,\n    userId: string,\n    method: AuthMethod,\n    password?: string,\n    passkeyResponse?: unknown,\n    ipAddress?: string,\n    userAgent?: string,\n    /**\n     * The enrolled-second-factor code for `method === TOTP` (a TOTP code or a backup code).\n     * Appended LAST so every existing positional caller keeps its meaning.\n     */\n    totpCode?: string,\n  ): Promise<{ reAuthToken: string }> {\n    try {\n\n      if (method === AuthMethod.TOTP) {\n        if (!totpCode) {\n          throw this.errorBuilder.buildError(ErrorType.VALIDATION, undefined, {\n            context: { reason: 'A code is required for TOTP re-authentication' },\n          });\n        }\n\n        const verification = await this.authMfaService.verifyEnrolledSecondFactor(ec, userId, totpCode);\n\n        if (verification.notEnrolled) {\n          // Distinct from a wrong code on purpose: this account has NO enrolled second factor, so\n          // retrying cannot help. The caller needs a different factor, or enrollment.\n          throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n            context: { reason: 'No enrolled second factor for this account' },\n          });\n        }\n\n        if (!verification.valid) {\n          throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n            context: { reason: 'Invalid code' },\n          });\n        }\n      } else if (method === AuthMethod.PASSWORD) {\n        if (!password) {\n          throw this.errorBuilder.buildError(ErrorType.VALIDATION, undefined, {\n            context: { reason: 'Password is required for password re-authentication' },\n          });\n        }\n\n        const credentials = await this.credentialVerifier.resolveCredentials(ec, userId);\n\n        if (!credentials?.passwordHash) {\n          throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n            context: { reason: 'No password set for this account' },\n          });\n        }\n\n        const isValid = await this.credentialVerifier.verifyPassword(\n          credentials.passwordHash, password,\n        );\n        if (!isValid) {\n          throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n            context: { reason: 'Invalid password' },\n          });\n        }\n      } else if (method === AuthMethod.PASSKEY) {\n        if (!passkeyResponse) {\n          throw this.errorBuilder.buildError(ErrorType.VALIDATION, undefined, {\n            context: { reason: 'A passkey assertion is required for passkey re-authentication' },\n          });\n        }\n\n        // STEP_UP ceremony, NOT login: it reads a separate challenge (so an assertion produced for a\n        // login cannot be redeemed here) and demands user verification even where the app policy is\n        // `preferred`. See `PasskeyAuthenticationCeremony`.\n        const { verified } = await this.webAuthnService.verifyAuthenticationResponse(\n          ec,\n          userId,\n          passkeyResponse as AuthenticationResponseJSON,\n          PasskeyAuthenticationCeremony.STEP_UP,\n        );\n\n        if (!verified) {\n          // Deliberately ONE refusal for every failure mode below the verifier — no challenge\n          // outstanding, wrong credential, absent user verification, bad signature. Distinguishing\n          // them here would tell an attacker which half of the ceremony to attack; the service logs\n          // the specific cause.\n          throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n            context: { reason: 'Passkey re-authentication failed' },\n          });\n        }\n      } else {\n        throw this.errorBuilder.buildError(ErrorType.VALIDATION, undefined, {\n          context: { reason: `Unsupported re-authentication method: ${method}` },\n        });\n      }\n\n      const token = await this.consumableTokenService.createToken({\n        tokenType: CoreConsumableTokenTypes.REAUTH,\n        consumptionMode: ConsumableToken_ConsumptionMode.SINGLE_USE,\n        expiresIn: { value: 5, unit: DurationUnit.MINUTES },\n        userId: userId,\n        resourceIdentifier: CoreResourceType.USERS,\n        relatedId: userId,\n      });\n\n      return { reAuthToken: token.token };\n    } catch (error) {\n      if (isWildoBackendError(error)) throw error;\n      throw this.errorBuilder.buildFromStandardError(error, undefined, {\n        context: { reason: 'Failed to re-authenticate' },\n      });\n    }\n  }\n\n  // ==========================================================================\n  // AUTH METHOD COUNTING (D9 Safety Check)\n  // ==========================================================================\n\n  public async countAuthMethods(\n    ec: ExecutionContext<any>,\n    userId: string,\n  ): Promise<{ passwordCount: number; passkeyCount: number; identityLinkCount: number; total: number }> {\n    const credentials = await this.credentialVerifier.resolveCredentials(ec, userId);\n\n    const passwordCount = credentials?.passwordHash ? 1 : 0;\n    const passkeyCount = credentials?.passkeyCredentials?.length ?? 0;\n\n    const identityLinks = await this.servicesRegistryHandler.list<UserIdentityLink>(\n      CoreResourceType.USER_IDENTITY_LINKS,\n      ec,\n      { userId },\n      undefined,\n      { paginated: false },\n    ) as UserIdentityLink[];\n    const identityLinkCount = identityLinks.length;\n\n    return {\n      passwordCount,\n      passkeyCount,\n      identityLinkCount,\n      total: passwordCount + passkeyCount + identityLinkCount,\n    };\n  }\n}\n"]}
+{"version":3,"file":"auth-method-management.backend.service.js","sourceRoot":"","sources":["../../../../../../../src/security/authentications/services/auth-methods/auth-method-management.backend.service.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,OAAO,kBAAkB,CAAC;AAC1B,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAC/C,OAAO,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AACpF,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAG9G,OAAO,EAAE,oCAAoC,EAAE,MAAM,+FAA+F,CAAC;AACrJ,OAAO,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AAC/G,OAAO,EAAE,uBAAuB,EAAE,MAAM,gFAAgF,CAAC;AACzH,OAAO,EAAE,6BAA6B,EAAE,MAAM,yFAAyF,CAAC;AACxI,OAAO,EAAE,6BAA6B,EAAE,MAAM,wFAAwF,CAAC;AACvI,OAAO,EAAE,4BAA4B,EAAE,MAAM,6FAA6F,CAAC;AAC3I,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAC7F,OAAO,EACL,gBAAgB,EAChB,SAAS,EACT,2BAA2B,EAC3B,mBAAmB,EACnB,UAAU,EACV,wBAAwB,EACxB,+BAA+B,EAC/B,sBAAsB,EACtB,iBAAiB,GAClB,MAAM,uBAAuB,CAAC;AAK/B,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AACxD,OAAO,EAAE,qBAAqB,EAAE,MAAM,4FAA4F,CAAC;AACnI,OAAO,EAAE,6BAA6B,EAAE,sBAAsB,EAAE,MAAM,4FAA4F,CAAC;AAe5J,IAAM,kCAAkC,GAAxC,MAAM,kCAAkC;IAIS;IACa;IACW;IACR;IACN;IACA;IACM;IACP;IACM;IAMF;IAIL;IAEC;IAvB9C,QAAQ,CAA+D;IAExF,YACsD,MAAqB,EACR,YAAwC,EAC7B,uBAA8D,EACtE,kBAAwD,EAC9D,gBAAyC,EACzC,gBAAyC,EACnC,sBAAqD,EAC5D,WAA0C,EACpC,UAAwC,EAM1C,mBAA+C,EAIpD,cAAqC,EAEpC,eAAuC;QApBhD,WAAM,GAAN,MAAM,CAAe;QACR,iBAAY,GAAZ,YAAY,CAA4B;QAC7B,4BAAuB,GAAvB,uBAAuB,CAAuC;QACtE,uBAAkB,GAAlB,kBAAkB,CAAsC;QAC9D,qBAAgB,GAAhB,gBAAgB,CAAyB;QACzC,qBAAgB,GAAhB,gBAAgB,CAAyB;QACnC,2BAAsB,GAAtB,sBAAsB,CAA+B;QAC5D,gBAAW,GAAX,WAAW,CAA+B;QACpC,eAAU,GAAV,UAAU,CAA8B;QAM1C,wBAAmB,GAAnB,mBAAmB,CAA4B;QAIpD,mBAAc,GAAd,cAAc,CAAuB;QAEpC,oBAAe,GAAf,eAAe,CAAwB;QAEpG,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,oCAAoC,CAAC,CAAC;QAC9E,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,oCAAoC,EAAE,IAAI,CAAC,CAAC;IAC9E,CAAC;IAED,6EAA6E;IAC7E,mBAAmB;IACnB,6EAA6E;IAErE,SAAS,CAAC,KAAa;QAC7B,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,MAAM,CAAC;QAC9C,OAAO,MAAM,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACjC,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,sBAAsB,CAAC,EAAyB,EAAE,MAAc;QAC5E,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAA2B,gBAAgB,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC;YAC5H,IAAI,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;gBAC5B,OAAO,IAAI,CAAC,UAAU,CAAC,0BAA0B,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;YACnF,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,0CAA0C;QAC5C,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAEM,KAAK,CAAC,+BAA+B,CAAC,EAAyB,EAAE,MAAc;QACpF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QAC7D,MAAM,gBAAgB,GAAG,MAAM,EAAE,gBAAgB,CAAC;QAClD,IAAI,gBAAgB,IAAI,CAAC,gBAAgB,CAAC,sBAAsB,EAAE,CAAC;YACjE,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;gBACrE,sBAAsB,EAAE,2BAA2B,CAAC,aAAa;gBACjE,OAAO,EAAE,EAAE,MAAM,EAAE,0DAA0D,EAAE;aAChF,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,6EAA6E;IAC7E,sBAAsB;IACtB,6EAA6E;IAEtE,KAAK,CAAC,cAAc,CACzB,EAAyB,EACzB,MAAc,EACd,eAAuB,EACvB,WAAmB,EACnB,SAAiB,EACjB,SAAiB;QAEjB,IAAI,CAAC;YAEH,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;YAEjF,IAAI,CAAC,WAAW,IAAI,CAAC,WAAW,CAAC,YAAY,EAAE,CAAC;gBAC9C,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,SAAS,EAAE;oBAClE,sBAAsB,EAAE,2BAA2B,CAAC,UAAU;oBAC9D,OAAO,EAAE,EAAE,MAAM,EAAE,iDAAiD,EAAE;iBACvE,CAAC,CAAC;YACL,CAAC;YAED,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,cAAc,CACjE,WAAW,CAAC,YAAY,EAAE,eAAe,CAC1C,CAAC;YACF,IAAI,CAAC,cAAc,EAAE,CAAC;gBACpB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;oBACtE,sBAAsB,EAAE,2BAA2B,CAAC,UAAU;oBAC9D,OAAO,EAAE,EAAE,MAAM,EAAE,+BAA+B,EAAE;iBACrD,CAAC,CAAC;YACL,CAAC;YAED,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;YACrE,MAAM,cAAc,GAAG,cAAc,EAAE,cAAc,CAAC;YACtD,MAAM,YAAY,GAAG,IAAI,CAAC,kBAAkB,CAAC,sBAAsB,CAAC,WAAW,EAAE,cAAc,CAAC,CAAC;YACjG,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;gBACxB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,SAAS,EAAE;oBAClE,sBAAsB,EAAE,2BAA2B,CAAC,oCAAoC;oBACxF,OAAO,EAAE,EAAE,UAAU,EAAE,YAAY,CAAC,UAAU,EAAE,SAAS,EAAE,cAAc,EAAE,SAAS,EAAE,SAAS,EAAE,cAAc,EAAE,SAAS,EAAE;iBAC7H,CAAC,CAAC;YACL,CAAC;YAED,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,YAAY,CAAC,WAAW,EAAE,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;YACnI,MAAM,IAAI,CAAC,WAAW,CAAC,0BAA0B,CAAC,MAAM,CAAC,CAAC;YAC1D,MAAM,IAAI,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,EAAE,EAAE,MAAM,EAAE,eAAe,CAAC,CAAC;YAE9E,MAAM,IAAI,CAAC,gBAAgB,CAAC,sBAAsB,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC;QACnG,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,mBAAmB,CAAC,KAAK,CAAC;gBAAE,MAAM,KAAK,CAAC;YAC5C,MAAM,IAAI,CAAC,YAAY,CAAC,sBAAsB,CAAC,KAAK,EAAE,SAAS,EAAE;gBAC/D,OAAO,EAAE,EAAE,MAAM,EAAE,2BAA2B,EAAE;aACjD,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAEM,KAAK,CAAC,WAAW,CACtB,EAAyB,EACzB,MAAc,EACd,WAAmB,EACnB,SAAiB,EACjB,SAAiB;QAEjB,IAAI,CAAC;YAEH,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;YAEjF,IAAI,WAAW,EAAE,YAAY,EAAE,CAAC;gBAC9B,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,SAAS,EAAE;oBAClE,sBAAsB,EAAE,2BAA2B,CAAC,UAAU;oBAC9D,OAAO,EAAE,EAAE,MAAM,EAAE,yDAAyD,EAAE;iBAC/E,CAAC,CAAC;YACL,CAAC;YAED,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;YACrE,MAAM,cAAc,GAAG,cAAc,EAAE,cAAc,CAAC;YACtD,MAAM,YAAY,GAAG,IAAI,CAAC,kBAAkB,CAAC,sBAAsB,CAAC,WAAW,EAAE,cAAc,CAAC,CAAC;YACjG,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;gBACxB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,SAAS,EAAE;oBAClE,sBAAsB,EAAE,2BAA2B,CAAC,oCAAoC;oBACxF,OAAO,EAAE,EAAE,UAAU,EAAE,YAAY,CAAC,UAAU,EAAE,SAAS,EAAE,cAAc,EAAE,SAAS,EAAE,SAAS,EAAE,cAAc,EAAE,SAAS,EAAE;iBAC7H,CAAC,CAAC;YACL,CAAC;YAED,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,YAAY,CAAC,WAAW,EAAE,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;YACnI,MAAM,IAAI,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,EAAE,EAAE,MAAM,EAAE,eAAe,CAAC,CAAC;YAE9E,MAAM,IAAI,CAAC,gBAAgB,CAAC,kBAAkB,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC;QAC/F,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,mBAAmB,CAAC,KAAK,CAAC;gBAAE,MAAM,KAAK,CAAC;YAC5C,MAAM,IAAI,CAAC,YAAY,CAAC,sBAAsB,CAAC,KAAK,EAAE,SAAS,EAAE;gBAC/D,OAAO,EAAE,EAAE,MAAM,EAAE,wBAAwB,EAAE;aAC9C,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,6EAA6E;IAC7E,kBAAkB;IAClB,6EAA6E;IAEtE,KAAK,CAAC,WAAW,CACtB,EAAyB,EACzB,MAAc,EACd,WAA+B,EAC/B,SAAiB,EACjB,SAAiB;QAEjB,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,+BAA+B,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;YAEvD,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;YAErE,IAAI,cAAc,EAAE,gBAAgB,EAAE,6BAA6B,EAAE,CAAC;gBACpE,IAAI,CAAC,WAAW,EAAE,CAAC;oBACjB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;wBACtE,OAAO,EAAE,EAAE,MAAM,EAAE,+CAA+C,EAAE;qBACrE,CAAC,CAAC;gBACL,CAAC;gBACD,IAAI,CAAC;oBACH,MAAM,IAAI,CAAC,sBAAsB,CAAC,aAAa,CAAC,WAAW,EAAE,CAAC,wBAAwB,CAAC,MAAM,CAAC,CAAC,CAAC;oBAChG,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC;oBAC1E,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;wBAC5B,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;4BACrE,OAAO,EAAE,EAAE,MAAM,EAAE,sDAAsD,EAAE;yBAC5E,CAAC,CAAC;oBACL,CAAC;gBACH,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,IAAI,mBAAmB,CAAC,KAAK,CAAC;wBAAE,MAAM,KAAK,CAAC;oBAC5C,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;wBACtE,OAAO,EAAE,EAAE,MAAM,EAAE,4CAA4C,EAAE;qBAClE,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YAED,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;YAEjF,IAAI,CAAC,WAAW,EAAE,YAAY,EAAE,CAAC;gBAC/B,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,SAAS,EAAE;oBAClE,sBAAsB,EAAE,2BAA2B,CAAC,UAAU;oBAC9D,OAAO,EAAE,EAAE,MAAM,EAAE,qBAAqB,EAAE;iBAC3C,CAAC,CAAC;YACL,CAAC;YAED,MAAM,WAAW,GAAG,CAAC,CAAC,cAAc,EAAE,SAAS,EAAE,UAAU,CAAC;YAC5D,IAAI,WAAW,EAAE,CAAC;gBAChB,MAAM,WAAW,GACf,CAAC,WAAW,CAAC,kBAAkB,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC;oBACjD,WAAW,CAAC,mBAAmB,KAAK,IAAI,CAAC;gBAE3C,IAAI,CAAC,WAAW,EAAE,CAAC;oBACjB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,SAAS,EAAE;wBAClE,sBAAsB,EAAE,2BAA2B,CAAC,UAAU;wBAC9D,OAAO,EAAE,EAAE,MAAM,EAAE,2DAA2D,EAAE;qBACjF,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YAED,4EAA4E;YAC5E,4EAA4E;YAC5E,gFAAgF;YAChF,8EAA8E;YAC9E,+BAA+B;YAC/B,MAAM,IAAI,CAAC,mBAAmB,CAAC,cAAc,CAAC,gBAAgB,CAAC,gBAAgB,EAAE,EAAE,MAAM,EAAE,EAAE;gBAC3F,YAAY,EAAE,IAAI;gBAClB,YAAY,EAAE,KAAK;gBACnB,iBAAiB,EAAE,EAAE;gBACrB,cAAc,EAAE,IAAI;aACrB,CAAC,CAAC;YAEH,MAAM,IAAI,CAAC,gBAAgB,CAAC,mBAAmB,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC;QAChG,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,mBAAmB,CAAC,KAAK,CAAC;gBAAE,MAAM,KAAK,CAAC;YAC5C,MAAM,IAAI,CAAC,YAAY,CAAC,sBAAsB,CAAC,KAAK,EAAE,SAAS,EAAE;gBAC/D,OAAO,EAAE,EAAE,MAAM,EAAE,wBAAwB,EAAE;aAC9C,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,6EAA6E;IAC7E,uBAAuB;IACvB,6EAA6E;IAEtE,KAAK,CAAC,YAAY,CACvB,EAAyB,EACzB,MAAc;QAEd,IAAI,CAAC;YAEH,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;YAEjF,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAC3D,gBAAgB,CAAC,mBAAmB,EACpC,EAAE,EACF,EAAE,MAAM,EAAE,EACV,SAAS,EACT,EAAE,SAAS,EAAE,KAAK,EAAE,CACC,IAAI,EAAE,CAAC;YAE9B,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;YACrE,MAAM,kBAAkB,GAAG,cAAc,EAAE,kBAAkB,CAAC;YAE9D,MAAM,UAAU,GAA2G,EAAE,CAAC;YAE9H,MAAM,aAAa,GAAG,CAAC,MAAkB,EAAW,EAAE;gBACpD,IAAI,CAAC,kBAAkB;oBAAE,OAAO,IAAI,CAAC;gBACrC,OAAO,CAAC,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC;YACtC,CAAC,CAAC;YAEF,IAAI,aAAa,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACvC,UAAU,CAAC,IAAI,CAAC;oBACd,MAAM,EAAE,UAAU,CAAC,QAAQ;oBAC3B,QAAQ,EAAE,CAAC,CAAC,WAAW,EAAE,YAAY;iBACtC,CAAC,CAAC;YACL,CAAC;YAED,IAAI,aAAa,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;gBACnC,UAAU,CAAC,IAAI,CAAC;oBACd,MAAM,EAAE,UAAU,CAAC,IAAI;oBACvB,QAAQ,EAAE,WAAW,EAAE,YAAY,KAAK,IAAI;oBAC5C,UAAU,EAAE,WAAW,EAAE,cAAc,IAAI,SAAS;iBACrD,CAAC,CAAC;YACL,CAAC;YAED,IAAI,aAAa,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;gBACtC,UAAU,CAAC,IAAI,CAAC;oBACd,MAAM,EAAE,UAAU,CAAC,OAAO;oBAC1B,QAAQ,EAAE,CAAC,WAAW,EAAE,kBAAkB,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC;oBAC5D,OAAO,EAAE,EAAE,YAAY,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,IAAI,CAAC,EAAE;iBACxE,CAAC,CAAC;YACL,CAAC;YAED,IAAI,aAAa,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;gBACtC,UAAU,CAAC,IAAI,CAAC;oBACd,MAAM,EAAE,UAAU,CAAC,OAAO;oBAC1B,QAAQ,EAAE,WAAW,EAAE,mBAAmB,KAAK,IAAI;oBACnD,OAAO,EAAE,WAAW,EAAE,mBAAmB;wBACvC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,WAAY,CAAC,EAAE;wBAC3D,CAAC,CAAC,SAAS;iBACd,CAAC,CAAC;YACL,CAAC;YAED,IAAI,aAAa,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;gBACxC,UAAU,CAAC,IAAI,CAAC;oBACd,MAAM,EAAE,UAAU,CAAC,SAAS;oBAC5B,QAAQ,EAAE,IAAI;iBACf,CAAC,CAAC;YACL,CAAC;YAED,IAAI,aAAa,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;gBACzC,UAAU,CAAC,IAAI,CAAC;oBACd,MAAM,EAAE,UAAU,CAAC,UAAU;oBAC7B,QAAQ,EAAE,IAAI;iBACf,CAAC,CAAC;YACL,CAAC;YAED,IAAI,aAAa,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,CAAC;gBAC9C,MAAM,WAAW,GAAG,aAAa,CAAC,MAAM,CACtC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,cAAc,KAAK,iBAAiB,CAAC,MAAM,CAC3D,CAAC;gBACF,UAAU,CAAC,IAAI,CAAC;oBACd,MAAM,EAAE,UAAU,CAAC,eAAe;oBAClC,QAAQ,EAAE,WAAW,CAAC,MAAM,GAAG,CAAC;iBACjC,CAAC,CAAC;YACL,CAAC;YAED,IAAI,aAAa,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACvC,UAAU,CAAC,IAAI,CAAC;oBACd,MAAM,EAAE,UAAU,CAAC,QAAQ;oBAC3B,QAAQ,EAAE,aAAa,CAAC,IAAI,CAC1B,CAAC,IAAI,EAAE,EAAE,CACP,IAAI,CAAC,cAAc,KAAK,iBAAiB,CAAC,UAAU;2BACjD,IAAI,CAAC,MAAM,KAAK,sBAAsB,CAAC,IAAI,CACjD;iBACF,CAAC,CAAC;YACL,CAAC;YAED,IAAI,aAAa,CAAC,UAAU,CAAC,kBAAkB,CAAC,EAAE,CAAC;gBACjD,UAAU,CAAC,IAAI,CAAC;oBACd,MAAM,EAAE,UAAU,CAAC,kBAAkB;oBACrC,QAAQ,EAAE,aAAa,CAAC,IAAI,CAC1B,CAAC,IAAI,EAAE,EAAE,CACP,IAAI,CAAC,cAAc,KAAK,iBAAiB,CAAC,UAAU;2BACjD,IAAI,CAAC,MAAM,KAAK,sBAAsB,CAAC,IAAI,CACjD;iBACF,CAAC,CAAC;YACL,CAAC;YAED,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC;QACjC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,mBAAmB,CAAC,KAAK,CAAC;gBAAE,MAAM,KAAK,CAAC;YAC5C,MAAM,IAAI,CAAC,YAAY,CAAC,sBAAsB,CAAC,KAAK,EAAE,SAAS,EAAE;gBAC/D,OAAO,EAAE,EAAE,MAAM,EAAE,4BAA4B,EAAE;aAClD,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,6EAA6E;IAC7E,iBAAiB;IACjB,6EAA6E;IAEtE,KAAK,CAAC,gBAAgB,CAC3B,EAAyB,EACzB,MAAc;QAEd,IAAI,CAAC;YAEH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,IAAI,CACtD,gBAAgB,CAAC,mBAAmB,EACpC,EAAE,EACF,EAAE,MAAM,EAAE,EACV,SAAS,EACT,EAAE,SAAS,EAAE,KAAK,EAAE,CACC,CAAC;YAExB,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;gBACpC,GAAG,EAAE,IAAI,CAAC,GAAG;gBACb,cAAc,EAAE,IAAI,CAAC,cAAc;gBACnC,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,aAAa,EAAE,IAAI,CAAC,aAAa;gBACjC,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,UAAU,EAAE,IAAI,CAAC,UAAU;aAC5B,CAAC,CAAC,CAAC;YAEJ,OAAO,EAAE,KAAK,EAAE,CAAC;QACnB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,mBAAmB,CAAC,KAAK,CAAC;gBAAE,MAAM,KAAK,CAAC;YAC5C,MAAM,IAAI,CAAC,YAAY,CAAC,sBAAsB,CAAC,KAAK,EAAE,SAAS,EAAE;gBAC/D,OAAO,EAAE,EAAE,MAAM,EAAE,8BAA8B,EAAE;aACpD,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAEM,KAAK,CAAC,kBAAkB,CAC7B,EAAyB,EACzB,MAAc,EACd,MAAc,EACd,SAAiB,EACjB,SAAiB;QAEjB,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,+BAA+B,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;YAEvD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAClD,gBAAgB,CAAC,mBAAmB,EACpC,EAAE,EACF,EAAE,GAAG,EAAE,MAAM,EAAE,CAChB,CAAC;YAEF,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,SAAS,EAAE,SAAS,EAAE;oBACjE,OAAO,EAAE,EAAE,MAAM,EAAE,yBAAyB,EAAE;iBAC/C,CAAC,CAAC;YACL,CAAC;YAED,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBAC3B,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,SAAS,EAAE,SAAS,EAAE;oBACjE,OAAO,EAAE,EAAE,MAAM,EAAE,yBAAyB,EAAE;iBAC/C,CAAC,CAAC;YACL,CAAC;YAED,MAAM,gBAAgB,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;YACjE,IAAI,gBAAgB,CAAC,KAAK,IAAI,CAAC,EAAE,CAAC;gBAChC,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,SAAS,EAAE;oBAClE,sBAAsB,EAAE,2BAA2B,CAAC,UAAU;oBAC9D,OAAO,EAAE,EAAE,MAAM,EAAE,+CAA+C,EAAE;iBACrE,CAAC,CAAC;YACL,CAAC;YAED,MAAM,IAAI,CAAC,uBAAuB,CAAC,MAAM,CAAC,gBAAgB,CAAC,mBAAmB,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;YAE5F,MAAM,IAAI,CAAC,gBAAgB,CAAC,0BAA0B,CAAC;gBACrD,MAAM,EAAE,MAAM;gBACd,MAAM;gBACN,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,SAAS;gBACT,SAAS;aACV,EAAE,EAAE,CAAC,CAAC;QACT,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,mBAAmB,CAAC,KAAK,CAAC;gBAAE,MAAM,KAAK,CAAC;YAC5C,MAAM,IAAI,CAAC,YAAY,CAAC,sBAAsB,CAAC,KAAK,EAAE,SAAS,EAAE;gBAC/D,OAAO,EAAE,EAAE,MAAM,EAAE,gCAAgC,EAAE;aACtD,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,6EAA6E;IAC7E,oBAAoB;IACpB,6EAA6E;IAE7E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAuCG;IACI,KAAK,CAAC,cAAc,CACzB,EAAyB,EACzB,MAAc,EACd,MAAkB,EAClB,QAAiB,EACjB,eAAyB,EACzB,SAAkB,EAClB,SAAkB;IAClB;;;OAGG;IACH,QAAiB;QAEjB,IAAI,CAAC;YAEH,IAAI,MAAM,KAAK,UAAU,CAAC,IAAI,EAAE,CAAC;gBAC/B,IAAI,CAAC,QAAQ,EAAE,CAAC;oBACd,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,SAAS,EAAE;wBAClE,OAAO,EAAE,EAAE,MAAM,EAAE,+CAA+C,EAAE;qBACrE,CAAC,CAAC;gBACL,CAAC;gBAED,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,0BAA0B,CAAC,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;gBAEhG,IAAI,YAAY,CAAC,WAAW,EAAE,CAAC;oBAC7B,wFAAwF;oBACxF,4EAA4E;oBAC5E,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;wBACtE,OAAO,EAAE,EAAE,MAAM,EAAE,4CAA4C,EAAE;qBAClE,CAAC,CAAC;gBACL,CAAC;gBAED,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;oBACxB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;wBACtE,OAAO,EAAE,EAAE,MAAM,EAAE,cAAc,EAAE;qBACpC,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;iBAAM,IAAI,MAAM,KAAK,UAAU,CAAC,QAAQ,EAAE,CAAC;gBAC1C,IAAI,CAAC,QAAQ,EAAE,CAAC;oBACd,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,SAAS,EAAE;wBAClE,OAAO,EAAE,EAAE,MAAM,EAAE,qDAAqD,EAAE;qBAC3E,CAAC,CAAC;gBACL,CAAC;gBAED,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;gBAEjF,IAAI,CAAC,WAAW,EAAE,YAAY,EAAE,CAAC;oBAC/B,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;wBACtE,OAAO,EAAE,EAAE,MAAM,EAAE,kCAAkC,EAAE;qBACxD,CAAC,CAAC;gBACL,CAAC;gBAED,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,cAAc,CAC1D,WAAW,CAAC,YAAY,EAAE,QAAQ,CACnC,CAAC;gBACF,IAAI,CAAC,OAAO,EAAE,CAAC;oBACb,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;wBACtE,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;qBACxC,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;iBAAM,IAAI,MAAM,KAAK,UAAU,CAAC,OAAO,EAAE,CAAC;gBACzC,IAAI,CAAC,eAAe,EAAE,CAAC;oBACrB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,SAAS,EAAE;wBAClE,OAAO,EAAE,EAAE,MAAM,EAAE,+DAA+D,EAAE;qBACrF,CAAC,CAAC;gBACL,CAAC;gBAED,6FAA6F;gBAC7F,4FAA4F;gBAC5F,oDAAoD;gBACpD,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,4BAA4B,CAC1E,EAAE,EACF,MAAM,EACN,eAA6C,EAC7C,6BAA6B,CAAC,OAAO,CACtC,CAAC;gBAEF,IAAI,CAAC,QAAQ,EAAE,CAAC;oBACd,oFAAoF;oBACpF,yFAAyF;oBACzF,0FAA0F;oBAC1F,sBAAsB;oBACtB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;wBACtE,OAAO,EAAE,EAAE,MAAM,EAAE,kCAAkC,EAAE;qBACxD,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,SAAS,EAAE;oBAClE,OAAO,EAAE,EAAE,MAAM,EAAE,yCAAyC,MAAM,EAAE,EAAE;iBACvE,CAAC,CAAC;YACL,CAAC;YAED,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,WAAW,CAAC;gBAC1D,SAAS,EAAE,wBAAwB,CAAC,MAAM;gBAC1C,eAAe,EAAE,+BAA+B,CAAC,UAAU;gBAC3D,SAAS,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,YAAY,CAAC,OAAO,EAAE;gBACnD,MAAM,EAAE,MAAM;gBACd,kBAAkB,EAAE,gBAAgB,CAAC,KAAK;gBAC1C,SAAS,EAAE,MAAM;aAClB,CAAC,CAAC;YAEH,OAAO,EAAE,WAAW,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC;QACtC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,mBAAmB,CAAC,KAAK,CAAC;gBAAE,MAAM,KAAK,CAAC;YAC5C,MAAM,IAAI,CAAC,YAAY,CAAC,sBAAsB,CAAC,KAAK,EAAE,SAAS,EAAE;gBAC/D,OAAO,EAAE,EAAE,MAAM,EAAE,2BAA2B,EAAE;aACjD,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,6EAA6E;IAC7E,yCAAyC;IACzC,6EAA6E;IAEtE,KAAK,CAAC,gBAAgB,CAC3B,EAAyB,EACzB,MAAc;QAEd,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QAEjF,MAAM,aAAa,GAAG,WAAW,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACxD,MAAM,YAAY,GAAG,WAAW,EAAE,kBAAkB,EAAE,MAAM,IAAI,CAAC,CAAC;QAElE,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAC3D,gBAAgB,CAAC,mBAAmB,EACpC,EAAE,EACF,EAAE,MAAM,EAAE,EACV,SAAS,EACT,EAAE,SAAS,EAAE,KAAK,EAAE,CACC,CAAC;QACxB,MAAM,iBAAiB,GAAG,aAAa,CAAC,MAAM,CAAC;QAE/C,OAAO;YACL,aAAa;YACb,YAAY;YACZ,iBAAiB;YACjB,KAAK,EAAE,aAAa,GAAG,YAAY,GAAG,iBAAiB;SACxD,CAAC;IACJ,CAAC;CACF,CAAA;AA5nBY,kCAAkC;IAD9C,UAAU,EAAE;IAKR,WAAA,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAA;IACjC,WAAA,MAAM,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,CAAA;IAC9C,WAAA,MAAM,CAAC,kBAAkB,CAAC,8BAA8B,CAAC,CAAA;IACzD,WAAA,MAAM,CAAC,kBAAkB,CAAC,sBAAsB,CAAC,CAAA;IACjD,WAAA,MAAM,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,CAAA;IAC3C,WAAA,MAAM,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,CAAA;IAC3C,WAAA,MAAM,CAAC,kBAAkB,CAAC,sBAAsB,CAAC,CAAA;IACjD,WAAA,MAAM,CAAC,kBAAkB,CAAC,eAAe,CAAC,CAAA;IAC1C,WAAA,MAAM,CAAC,kBAAkB,CAAC,qBAAqB,CAAC,CAAA;IAMhD,WAAA,MAAM,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,CAAA;IAI9C,YAAA,MAAM,CAAC,kBAAkB,CAAC,cAAc,CAAC,CAAA;IAEzC,YAAA,MAAM,CAAC,kBAAkB,CAAC,eAAe,CAAC,CAAA;qCApBiB,aAAa;QACM,0BAA0B,YAEjB,oCAAoC;QAC5C,uBAAuB;QACvB,uBAAuB;QACX,6BAA6B;QAC/C,6BAA6B;QACxB,4BAA4B,YAU/B,qBAAqB;QAEnB,sBAAsB;GAxB3F,kCAAkC,CA4nB9C","sourcesContent":["import 'reflect-metadata';\nimport { inject, injectable } from 'inversify';\nimport { SAAS_SERVICE_TYPES } from '~wildo-backend-lib/inject/models/service-types';\nimport { ErrorBuilderBackendService } from '~wildo-backend-lib/errors/services/error-builder.backend.service';\nimport type { ServicesRegistryHandlerBackendService } from '~wildo-backend-lib/base-classes/services/services/services-registry-handler.backend.service';\nimport type { SystemAccessBackendService } from '~wildo-backend-lib/base-classes/services/services/system-access.backend.service';\nimport { AuthCredentialVerifierBackendService } from '~wildo-backend-lib/security/authentications/services/auth-credential-verifier.backend.service';\nimport { AppConfigurationService } from '~wildo-backend-lib/config/services/app-configuration.backend.service';\nimport { AuditLogsBackendService } from '~wildo-backend-lib/compliance/audit-trails/services/audit-logs.backend.service';\nimport { ConsumableTokenBackendService } from '~wildo-backend-lib/security/consumable-tokens/services/consumable-token.backend.service';\nimport { AuthTokenIssuerBackendService } from '~wildo-backend-lib/security/authentications/services/auth-token-issuer.backend.service';\nimport { AuthUserLookupBackendService } from '~wildo-backend-lib/security/authentications/services/utils/auth-user-lookup.backend.service';\nimport { LoggerService } from '~wildo-backend-lib/monitoring/logger/services/logger.service';\nimport {\n  CoreResourceType,\n  ErrorType,\n  ErrorCustomMessageReference,\n  isWildoBackendError,\n  AuthMethod,\n  CoreConsumableTokenTypes,\n  ConsumableToken_ConsumptionMode,\n  ExternalIdentitySource,\n  SsoConnectionType,\n} from '@wildo-ai/saas-models';\nimport type {\n  UserIdentityLink,\n  UserTypeAuthPolicy,\n} from '@wildo-ai/saas-models';\nimport { DurationUnit } from '@wildo-ai/zod-decorators';\nimport { AuthMfaBackendService } from '~wildo-backend-lib/security/authentications/services/auth-methods/auth-mfa.backend.service';\nimport { PasskeyAuthenticationCeremony, WebAuthnBackendService } from '~wildo-backend-lib/security/authentications/services/auth-methods/webauthn.backend.service';\nimport type { AuthenticationResponseJSON } from '@simplewebauthn/server';\nimport type { ExecutionContext } from '~wildo-backend-lib/runtime/models/execution-context.backend.schemas';\n\ninterface IdentityLinkSummary {\n  _id: string;\n  connectionType: SsoConnectionType;\n  source: ExternalIdentitySource;\n  providerRef: string;\n  providerEmail: string;\n  linkedAt: Date;\n  lastUsedAt: Date;\n}\n\n@injectable()\nexport class AuthMethodManagementBackendService {\n  private readonly logDebug: (message: string, context?: Record<string, unknown>) => void;\n\n  constructor(\n    @inject(SAAS_SERVICE_TYPES.Logger) private readonly logger: LoggerService,\n    @inject(SAAS_SERVICE_TYPES.ErrorBuilderService) private readonly errorBuilder: ErrorBuilderBackendService,\n    @inject(SAAS_SERVICE_TYPES.ServicesRegistryHandlerService) private readonly servicesRegistryHandler: ServicesRegistryHandlerBackendService,\n    @inject(SAAS_SERVICE_TYPES.AuthCredentialVerifier) private readonly credentialVerifier: AuthCredentialVerifierBackendService,\n    @inject(SAAS_SERVICE_TYPES.AppConfigService) private readonly appConfigService: AppConfigurationService,\n    @inject(SAAS_SERVICE_TYPES.AuditLogsService) private readonly auditLogsService: AuditLogsBackendService,\n    @inject(SAAS_SERVICE_TYPES.ConsumableTokenService) private readonly consumableTokenService: ConsumableTokenBackendService,\n    @inject(SAAS_SERVICE_TYPES.AuthTokenIssuer) private readonly tokenIssuer: AuthTokenIssuerBackendService,\n    @inject(SAAS_SERVICE_TYPES.AuthUserLookupService) private readonly userLookup: AuthUserLookupBackendService,\n    // TOTP-disable clears `secretBase32` + `backupCodesHashed` (both `.isBackendOnly()`),\n    // which a plain handler update strips → the secret and backup codes would silently\n    // survive a \"disable\". `updateAsSystem` re-attaches the cleared values after the\n    // strict parse, fail-closed behind USER_CREDENTIALS' `systemAccessPolicy.update`.\n    // Appended LAST to keep the positional test construction stable.\n    @inject(SAAS_SERVICE_TYPES.SystemAccessService) private readonly systemAccessService: SystemAccessBackendService,\n    // Appended LAST for the same reason as the parameter above — keeps positional test\n    // construction stable. Supplies the enrolled-second-factor authority `reAuthenticate` uses for\n    // `AuthMethod.TOTP`, shared with the login second-factor step.\n    @inject(SAAS_SERVICE_TYPES.AuthMfaService) private readonly authMfaService: AuthMfaBackendService,\n    // Appended LAST, same reason as the two above. Supplies the STEP_UP passkey ceremony.\n    @inject(SAAS_SERVICE_TYPES.WebAuthnService) private readonly webAuthnService: WebAuthnBackendService,\n  ) {\n    this.logDebug = this.logger.debugByType('AuthMethodManagementBackendService');\n    this.logger.setDebugTypeLogging('AuthMethodManagementBackendService', true);\n  }\n\n  // ==========================================================================\n  // INTERNAL HELPERS\n  // ==========================================================================\n\n  private maskPhone(phone: string): string {\n    if (!phone || phone.length < 4) return '****';\n    return `***${phone.slice(-4)}`;\n  }\n\n  /**\n   * W6.8 + AUTH-14: Resolve effective auth policy for a user, including org override merging.\n   * Falls back to null if the user or user type is not found.\n   */\n  private async _resolveUserTypePolicy(ec: ExecutionContext<any>, userId: string): Promise<UserTypeAuthPolicy | null> {\n    try {\n      const user = await this.servicesRegistryHandler.read<{ userTypes?: string[] }>(CoreResourceType.USERS, ec, { _id: userId });\n      if (user?.userTypes?.length) {\n        return this.userLookup.resolveEffectiveAuthPolicy(ec, userId, user.userTypes[0]);\n      }\n    } catch {\n      // Suppress — non-fatal, will use defaults\n    }\n    return null;\n  }\n\n  public async enforceUserMethodRemovalAllowed(ec: ExecutionContext<any>, userId: string): Promise<void> {\n    const policy = await this._resolveUserTypePolicy(ec, userId);\n    const methodManagement = policy?.methodManagement;\n    if (methodManagement && !methodManagement.allowUserMethodRemoval) {\n      throw this.errorBuilder.buildError(ErrorType.AUTHORIZATION, undefined, {\n        customMessageReference: ErrorCustomMessageReference.AUTHORIZATION,\n        context: { reason: 'User-initiated auth method removal is disabled by policy' },\n      });\n    }\n  }\n\n  // ==========================================================================\n  // PASSWORD MANAGEMENT\n  // ==========================================================================\n\n  public async changePassword(\n    ec: ExecutionContext<any>,\n    userId: string,\n    currentPassword: string,\n    newPassword: string,\n    ipAddress: string,\n    userAgent: string,\n  ): Promise<void> {\n    try {\n\n      const credentials = await this.credentialVerifier.resolveCredentials(ec, userId);\n\n      if (!credentials || !credentials.passwordHash) {\n        throw this.errorBuilder.buildError(ErrorType.VALIDATION, undefined, {\n          customMessageReference: ErrorCustomMessageReference.VALIDATION,\n          context: { reason: 'No password set. Use /auth/password/set instead' },\n        });\n      }\n\n      const isCurrentValid = await this.credentialVerifier.verifyPassword(\n        credentials.passwordHash, currentPassword,\n      );\n      if (!isCurrentValid) {\n        throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n          customMessageReference: ErrorCustomMessageReference.VALIDATION,\n          context: { reason: 'Current password is incorrect' },\n        });\n      }\n\n      const userTypePolicy = await this._resolveUserTypePolicy(ec, userId);\n      const passwordPolicy = userTypePolicy?.passwordPolicy;\n      const policyResult = this.credentialVerifier.validatePasswordPolicy(newPassword, passwordPolicy);\n      if (!policyResult.valid) {\n        throw this.errorBuilder.buildError(ErrorType.VALIDATION, undefined, {\n          customMessageReference: ErrorCustomMessageReference.VALIDATION_PASSWORD_POLICY_VIOLATION,\n          context: { violations: policyResult.violations, minLength: passwordPolicy?.minLength, maxLength: passwordPolicy?.maxLength },\n        });\n      }\n\n      const newPasswordHash = await this.credentialVerifier.hashPassword(newPassword, this.appConfigService.config.auth.passwordHashing);\n      await this.tokenIssuer.invalidateAllTokensForUser(userId);\n      await this.credentialVerifier.updatePasswordHash(ec, userId, newPasswordHash);\n\n      await this.auditLogsService.logUserPasswordChanged({ userId: userId, ipAddress, userAgent }, ec);\n    } catch (error) {\n      if (isWildoBackendError(error)) throw error;\n      throw this.errorBuilder.buildFromStandardError(error, undefined, {\n        context: { reason: 'Failed to change password' },\n      });\n    }\n  }\n\n  public async setPassword(\n    ec: ExecutionContext<any>,\n    userId: string,\n    newPassword: string,\n    ipAddress: string,\n    userAgent: string,\n  ): Promise<void> {\n    try {\n\n      const credentials = await this.credentialVerifier.resolveCredentials(ec, userId);\n\n      if (credentials?.passwordHash) {\n        throw this.errorBuilder.buildError(ErrorType.VALIDATION, undefined, {\n          customMessageReference: ErrorCustomMessageReference.VALIDATION,\n          context: { reason: 'Password already set. Use /auth/password/change instead' },\n        });\n      }\n\n      const userTypePolicy = await this._resolveUserTypePolicy(ec, userId);\n      const passwordPolicy = userTypePolicy?.passwordPolicy;\n      const policyResult = this.credentialVerifier.validatePasswordPolicy(newPassword, passwordPolicy);\n      if (!policyResult.valid) {\n        throw this.errorBuilder.buildError(ErrorType.VALIDATION, undefined, {\n          customMessageReference: ErrorCustomMessageReference.VALIDATION_PASSWORD_POLICY_VIOLATION,\n          context: { violations: policyResult.violations, minLength: passwordPolicy?.minLength, maxLength: passwordPolicy?.maxLength },\n        });\n      }\n\n      const newPasswordHash = await this.credentialVerifier.hashPassword(newPassword, this.appConfigService.config.auth.passwordHashing);\n      await this.credentialVerifier.updatePasswordHash(ec, userId, newPasswordHash);\n\n      await this.auditLogsService.logUserPasswordSet({ userId: userId, ipAddress, userAgent }, ec);\n    } catch (error) {\n      if (isWildoBackendError(error)) throw error;\n      throw this.errorBuilder.buildFromStandardError(error, undefined, {\n        context: { reason: 'Failed to set password' },\n      });\n    }\n  }\n\n  // ==========================================================================\n  // TOTP MANAGEMENT\n  // ==========================================================================\n\n  public async disableTotp(\n    ec: ExecutionContext<any>,\n    userId: string,\n    reAuthToken: string | undefined,\n    ipAddress: string,\n    userAgent: string,\n  ): Promise<void> {\n    try {\n      await this.enforceUserMethodRemovalAllowed(ec, userId);\n\n      const userTypePolicy = await this._resolveUserTypePolicy(ec, userId);\n\n      if (userTypePolicy?.methodManagement?.requireReauthForMethodChanges) {\n        if (!reAuthToken) {\n          throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n            context: { reason: 'Re-authentication is required for this action' },\n          });\n        }\n        try {\n          await this.consumableTokenService.validateToken(reAuthToken, [CoreConsumableTokenTypes.REAUTH]);\n          const token = await this.consumableTokenService.consumeToken(reAuthToken);\n          if (token.userId !== userId) {\n            throw this.errorBuilder.buildError(ErrorType.AUTHORIZATION, undefined, {\n              context: { reason: 'Re-authentication token does not belong to this user' },\n            });\n          }\n        } catch (error) {\n          if (isWildoBackendError(error)) throw error;\n          throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n            context: { reason: 'Invalid or expired re-authentication token' },\n          });\n        }\n      }\n\n      const credentials = await this.credentialVerifier.resolveCredentials(ec, userId);\n\n      if (!credentials?.totpVerified) {\n        throw this.errorBuilder.buildError(ErrorType.VALIDATION, undefined, {\n          customMessageReference: ErrorCustomMessageReference.VALIDATION,\n          context: { reason: 'TOTP is not enabled' },\n        });\n      }\n\n      const mfaRequired = !!userTypePolicy?.mfaPolicy?.requireMFA;\n      if (mfaRequired) {\n        const hasOtherMFA =\n          (credentials.passkeyCredentials?.length ?? 0) > 0 ||\n          credentials.phoneNumberVerified === true;\n\n        if (!hasOtherMFA) {\n          throw this.errorBuilder.buildError(ErrorType.VALIDATION, undefined, {\n            customMessageReference: ErrorCustomMessageReference.VALIDATION,\n            context: { reason: 'Cannot disable your only MFA method while MFA is required' },\n          });\n        }\n      }\n\n      // Trusted system write: clearing `secretBase32` + `backupCodesHashed` (both\n      // backendOnly) must survive the strict parse, otherwise the TOTP secret and\n      // backup codes silently persist after a \"disable\". `updateAsSystem` re-attaches\n      // the cleared values; `totpVerified`/`totpVerifiedAt` are plain fields parsed\n      // normally, exactly as before.\n      await this.systemAccessService.updateAsSystem(CoreResourceType.USER_CREDENTIALS, { userId }, {\n        secretBase32: null,\n        totpVerified: false,\n        backupCodesHashed: [],\n        totpVerifiedAt: null,\n      });\n\n      await this.auditLogsService.logUserTOTPDisabled({ userId: userId, ipAddress, userAgent }, ec);\n    } catch (error) {\n      if (isWildoBackendError(error)) throw error;\n      throw this.errorBuilder.buildFromStandardError(error, undefined, {\n        context: { reason: 'Failed to disable TOTP' },\n      });\n    }\n  }\n\n  // ==========================================================================\n  // METHOD INTROSPECTION\n  // ==========================================================================\n\n  public async getMyMethods(\n    ec: ExecutionContext<any>,\n    userId: string,\n  ): Promise<{ methods: Array<{ method: AuthMethod; enrolled: boolean; enrolledAt?: Date; details?: Record<string, unknown> }> }> {\n    try {\n\n      const credentials = await this.credentialVerifier.resolveCredentials(ec, userId);\n\n      const identityLinks = await this.servicesRegistryHandler.list<UserIdentityLink>(\n        CoreResourceType.USER_IDENTITY_LINKS,\n        ec,\n        { userId },\n        undefined,\n        { paginated: false },\n      ) as UserIdentityLink[] ?? [];\n\n      const userTypePolicy = await this._resolveUserTypePolicy(ec, userId);\n      const authMethodsEnabled = userTypePolicy?.authMethodsEnabled;\n\n      const allMethods: Array<{ method: AuthMethod; enrolled: boolean; enrolledAt?: Date; details?: Record<string, unknown> }> = [];\n\n      const shouldInclude = (method: AuthMethod): boolean => {\n        if (!authMethodsEnabled) return true;\n        return !!authMethodsEnabled[method];\n      };\n\n      if (shouldInclude(AuthMethod.PASSWORD)) {\n        allMethods.push({\n          method: AuthMethod.PASSWORD,\n          enrolled: !!credentials?.passwordHash,\n        });\n      }\n\n      if (shouldInclude(AuthMethod.TOTP)) {\n        allMethods.push({\n          method: AuthMethod.TOTP,\n          enrolled: credentials?.totpVerified === true,\n          enrolledAt: credentials?.totpVerifiedAt ?? undefined,\n        });\n      }\n\n      if (shouldInclude(AuthMethod.PASSKEY)) {\n        allMethods.push({\n          method: AuthMethod.PASSKEY,\n          enrolled: (credentials?.passkeyCredentials?.length ?? 0) > 0,\n          details: { passkeyCount: credentials?.passkeyCredentials?.length ?? 0 },\n        });\n      }\n\n      if (shouldInclude(AuthMethod.SMS_OTP)) {\n        allMethods.push({\n          method: AuthMethod.SMS_OTP,\n          enrolled: credentials?.phoneNumberVerified === true,\n          details: credentials?.phoneNumberVerified\n            ? { phoneNumber: this.maskPhone(credentials.phoneNumber!) }\n            : undefined,\n        });\n      }\n\n      if (shouldInclude(AuthMethod.EMAIL_OTP)) {\n        allMethods.push({\n          method: AuthMethod.EMAIL_OTP,\n          enrolled: true,\n        });\n      }\n\n      if (shouldInclude(AuthMethod.MAGIC_LINK)) {\n        allMethods.push({\n          method: AuthMethod.MAGIC_LINK,\n          enrolled: true,\n        });\n      }\n\n      if (shouldInclude(AuthMethod.EXTERNAL_OAUTH2)) {\n        const socialLinks = identityLinks.filter(\n          (link) => link.connectionType === SsoConnectionType.SOCIAL,\n        );\n        allMethods.push({\n          method: AuthMethod.EXTERNAL_OAUTH2,\n          enrolled: socialLinks.length > 0,\n        });\n      }\n\n      if (shouldInclude(AuthMethod.ORG_SAML)) {\n        allMethods.push({\n          method: AuthMethod.ORG_SAML,\n          enrolled: identityLinks.some(\n            (link) =>\n              link.connectionType === SsoConnectionType.ENTERPRISE\n              && link.source === ExternalIdentitySource.SAML,\n          ),\n        });\n      }\n\n      if (shouldInclude(AuthMethod.ORG_OPENID_CONNECT)) {\n        allMethods.push({\n          method: AuthMethod.ORG_OPENID_CONNECT,\n          enrolled: identityLinks.some(\n            (link) =>\n              link.connectionType === SsoConnectionType.ENTERPRISE\n              && link.source === ExternalIdentitySource.OIDC,\n          ),\n        });\n      }\n\n      return { methods: allMethods };\n    } catch (error) {\n      if (isWildoBackendError(error)) throw error;\n      throw this.errorBuilder.buildFromStandardError(error, undefined, {\n        context: { reason: 'Failed to get auth methods' },\n      });\n    }\n  }\n\n  // ==========================================================================\n  // IDENTITY LINKS\n  // ==========================================================================\n\n  public async getIdentityLinks(\n    ec: ExecutionContext<any>,\n    userId: string,\n  ): Promise<{ links: IdentityLinkSummary[] }> {\n    try {\n\n      const rawLinks = await this.servicesRegistryHandler.list<UserIdentityLink>(\n        CoreResourceType.USER_IDENTITY_LINKS,\n        ec,\n        { userId },\n        undefined,\n        { paginated: false },\n      ) as UserIdentityLink[];\n\n      const links = rawLinks.map((link) => ({\n        _id: link._id,\n        connectionType: link.connectionType,\n        source: link.source,\n        providerRef: link.providerRef,\n        providerEmail: link.providerEmail,\n        linkedAt: link.linkedAt,\n        lastUsedAt: link.lastUsedAt,\n      }));\n\n      return { links };\n    } catch (error) {\n      if (isWildoBackendError(error)) throw error;\n      throw this.errorBuilder.buildFromStandardError(error, undefined, {\n        context: { reason: 'Failed to get identity links' },\n      });\n    }\n  }\n\n  public async unlinkIdentityLink(\n    ec: ExecutionContext<any>,\n    userId: string,\n    linkId: string,\n    ipAddress: string,\n    userAgent: string,\n  ): Promise<void> {\n    try {\n      await this.enforceUserMethodRemovalAllowed(ec, userId);\n\n      const link = await this.servicesRegistryHandler.read<UserIdentityLink>(\n        CoreResourceType.USER_IDENTITY_LINKS,\n        ec,\n        { _id: linkId },\n      );\n\n      if (!link) {\n        throw this.errorBuilder.buildError(ErrorType.NOT_FOUND, undefined, {\n          context: { reason: 'Identity link not found' },\n        });\n      }\n\n      if (link.userId !== userId) {\n        throw this.errorBuilder.buildError(ErrorType.NOT_FOUND, undefined, {\n          context: { reason: 'Identity link not found' },\n        });\n      }\n\n      const authMethodCounts = await this.countAuthMethods(ec, userId);\n      if (authMethodCounts.total <= 1) {\n        throw this.errorBuilder.buildError(ErrorType.VALIDATION, undefined, {\n          customMessageReference: ErrorCustomMessageReference.VALIDATION,\n          context: { reason: 'Cannot remove your only authentication method' },\n        });\n      }\n\n      await this.servicesRegistryHandler.delete(CoreResourceType.USER_IDENTITY_LINKS, ec, linkId);\n\n      await this.auditLogsService.logUserIdentityLinkRemoved({\n        userId: userId,\n        linkId,\n        providerRef: link.providerRef,\n        ipAddress,\n        userAgent,\n      }, ec);\n    } catch (error) {\n      if (isWildoBackendError(error)) throw error;\n      throw this.errorBuilder.buildFromStandardError(error, undefined, {\n        context: { reason: 'Failed to unlink identity link' },\n      });\n    }\n  }\n\n  // ==========================================================================\n  // RE-AUTHENTICATION\n  // ==========================================================================\n\n  /**\n   * Prove the caller is still themselves, and mint a single-use `REAUTH` token on success.\n   *\n   * # Which factors are accepted, and why TOTP had to be one of them\n   *\n   * `requiresStepUpAuthentication` operations are cleared ONLY by the token this method mints, so\n   * the factor list here decides who can perform them at all. While it was PASSWORD-only, two\n   * populations were structurally locked out of every gated verb:\n   *\n   *  - user types whose `authMethodsEnabled` excludes `PASSWORD` (SSO-only, passkey-only) — also\n   *    reachable through a per-ORGANIZATION `authMethodsEnabled` override;\n   *  - **directory-managed (SCIM) users**, whose `passwordHash` AND passkeys the framework\n   *    deliberately destroys so a local first factor cannot survive IdP deprovisioning\n   *    (`_reconcileLocalCredentialsForDirectoryManaged`).\n   *\n   * That second group is not an edge case: once tenant teardown split into `request_deletion` +\n   * purge, an ORG_ADMIN of a directory-managed tenant could not start even the NORMAL teardown.\n   * TOTP is the right remedy precisely because the same reconciliation leaves it INTACT — it is a\n   * second factor sitting on top of the IdP first factor, so it survives deprovisioning by design.\n   *\n   * `TOTP` here means \"an enrolled second factor\": a TOTP code or one of the principal's backup\n   * codes, verified through the single shared authority\n   * ({@link AuthMfaBackendService.verifyEnrolledSecondFactor}) that login uses — including its\n   * anti-replay. The anti-replay is load-bearing for step-up specifically: without it a code\n   * observed during login would still be valid moments later, and step-up would authorize a\n   * destructive operation on a credential the caller never freshly proved.\n   *\n   * `PASSKEY` is SUPPORTED, through a dedicated two-legged ceremony rather than the one call\n   * password and TOTP take: `POST /auth/reauth/passkey/options` then `POST /auth/reauth` with the\n   * assertion, because WebAuthn is challenge-response. It is a re-proof rather than a possession\n   * check — the branch below verifies under `PasskeyAuthenticationCeremony.STEP_UP`, which reads a\n   * SEPARATE challenge (so an assertion minted for a login cannot be redeemed here) and demands\n   * user verification even where the app policy is `preferred`.\n   *\n   * Any other `AuthMethod` is refused explicitly by the trailing `else`, rather than silently\n   * unsupported.\n   *\n   * assurance-control: WILDO.IDENTITY.STEP_UP_AUTHENTICATION — re-proof of identity before a\n   * high-impact action, over any factor the principal actually holds.\n   */\n  public async reAuthenticate(\n    ec: ExecutionContext<any>,\n    userId: string,\n    method: AuthMethod,\n    password?: string,\n    passkeyResponse?: unknown,\n    ipAddress?: string,\n    userAgent?: string,\n    /**\n     * The enrolled-second-factor code for `method === TOTP` (a TOTP code or a backup code).\n     * Appended LAST so every existing positional caller keeps its meaning.\n     */\n    totpCode?: string,\n  ): Promise<{ reAuthToken: string }> {\n    try {\n\n      if (method === AuthMethod.TOTP) {\n        if (!totpCode) {\n          throw this.errorBuilder.buildError(ErrorType.VALIDATION, undefined, {\n            context: { reason: 'A code is required for TOTP re-authentication' },\n          });\n        }\n\n        const verification = await this.authMfaService.verifyEnrolledSecondFactor(ec, userId, totpCode);\n\n        if (verification.notEnrolled) {\n          // Distinct from a wrong code on purpose: this account has NO enrolled second factor, so\n          // retrying cannot help. The caller needs a different factor, or enrollment.\n          throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n            context: { reason: 'No enrolled second factor for this account' },\n          });\n        }\n\n        if (!verification.valid) {\n          throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n            context: { reason: 'Invalid code' },\n          });\n        }\n      } else if (method === AuthMethod.PASSWORD) {\n        if (!password) {\n          throw this.errorBuilder.buildError(ErrorType.VALIDATION, undefined, {\n            context: { reason: 'Password is required for password re-authentication' },\n          });\n        }\n\n        const credentials = await this.credentialVerifier.resolveCredentials(ec, userId);\n\n        if (!credentials?.passwordHash) {\n          throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n            context: { reason: 'No password set for this account' },\n          });\n        }\n\n        const isValid = await this.credentialVerifier.verifyPassword(\n          credentials.passwordHash, password,\n        );\n        if (!isValid) {\n          throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n            context: { reason: 'Invalid password' },\n          });\n        }\n      } else if (method === AuthMethod.PASSKEY) {\n        if (!passkeyResponse) {\n          throw this.errorBuilder.buildError(ErrorType.VALIDATION, undefined, {\n            context: { reason: 'A passkey assertion is required for passkey re-authentication' },\n          });\n        }\n\n        // STEP_UP ceremony, NOT login: it reads a separate challenge (so an assertion produced for a\n        // login cannot be redeemed here) and demands user verification even where the app policy is\n        // `preferred`. See `PasskeyAuthenticationCeremony`.\n        const { verified } = await this.webAuthnService.verifyAuthenticationResponse(\n          ec,\n          userId,\n          passkeyResponse as AuthenticationResponseJSON,\n          PasskeyAuthenticationCeremony.STEP_UP,\n        );\n\n        if (!verified) {\n          // Deliberately ONE refusal for every failure mode below the verifier — no challenge\n          // outstanding, wrong credential, absent user verification, bad signature. Distinguishing\n          // them here would tell an attacker which half of the ceremony to attack; the service logs\n          // the specific cause.\n          throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n            context: { reason: 'Passkey re-authentication failed' },\n          });\n        }\n      } else {\n        throw this.errorBuilder.buildError(ErrorType.VALIDATION, undefined, {\n          context: { reason: `Unsupported re-authentication method: ${method}` },\n        });\n      }\n\n      const token = await this.consumableTokenService.createToken({\n        tokenType: CoreConsumableTokenTypes.REAUTH,\n        consumptionMode: ConsumableToken_ConsumptionMode.SINGLE_USE,\n        expiresIn: { value: 5, unit: DurationUnit.MINUTES },\n        userId: userId,\n        resourceIdentifier: CoreResourceType.USERS,\n        relatedId: userId,\n      });\n\n      return { reAuthToken: token.token };\n    } catch (error) {\n      if (isWildoBackendError(error)) throw error;\n      throw this.errorBuilder.buildFromStandardError(error, undefined, {\n        context: { reason: 'Failed to re-authenticate' },\n      });\n    }\n  }\n\n  // ==========================================================================\n  // AUTH METHOD COUNTING (D9 Safety Check)\n  // ==========================================================================\n\n  public async countAuthMethods(\n    ec: ExecutionContext<any>,\n    userId: string,\n  ): Promise<{ passwordCount: number; passkeyCount: number; identityLinkCount: number; total: number }> {\n    const credentials = await this.credentialVerifier.resolveCredentials(ec, userId);\n\n    const passwordCount = credentials?.passwordHash ? 1 : 0;\n    const passkeyCount = credentials?.passkeyCredentials?.length ?? 0;\n\n    const identityLinks = await this.servicesRegistryHandler.list<UserIdentityLink>(\n      CoreResourceType.USER_IDENTITY_LINKS,\n      ec,\n      { userId },\n      undefined,\n      { paginated: false },\n    ) as UserIdentityLink[];\n    const identityLinkCount = identityLinks.length;\n\n    return {\n      passwordCount,\n      passkeyCount,\n      identityLinkCount,\n      total: passwordCount + passkeyCount + identityLinkCount,\n    };\n  }\n}\n"]}

package/dist/esm/security/authentications/services/auth-methods/auth-mfa.backend.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-mfa.backend.service.d.ts","sourceRoot":"","sources":["../../../../../../../src/security/authentications/services/auth-methods/auth-mfa.backend.service.ts"],"names":[],"mappings":"AAAA,OAAO,kBAAkB,CAAC;AAK1B,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAC7F,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAC9G,OAAO,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AAC/G,OAAO,EAAE,uBAAuB,EAAE,MAAM,gFAAgF,CAAC;AACzH,OAAO,EAAE,4BAA4B,EAAE,MAAM,6FAA6F,CAAC;AAC3I,OAAO,EAAE,+BAA+B,EAAE,MAAM,gGAAgG,CAAC;AACjJ,OAAO,EAAE,YAAY,EAAE,MAAM,qDAAqD,CAAC;AAGnF,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qEAAqE,CAAC;AAE5G,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,EAAE,CAAC;CACvB;AAED,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,qBAAqB;IACpC,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,gCAAgC;IAC/C,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC,oGAAoG;IACpG,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;CAC/B;AAED;;;GAGG;AACH,qBACa,qBAAqB;IAIK,OAAO,CAAC,QAAQ,CAAC,MAAM;IACV,OAAO,CAAC,QAAQ,CAAC,YAAY;IAChC,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IACjC,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IACzB,OAAO,CAAC,QAAQ,CAAC,aAAa;IACjC,OAAO,CAAC,QAAQ,CAAC,UAAU;IAGpC,OAAO,CAAC,QAAQ,CAAC,YAAY;IAXxE,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA+D;gBAGlC,MAAM,EAAE,aAAa,EACR,YAAY,EAAE,0BAA0B,EAC3C,gBAAgB,EAAE,uBAAuB,EACzC,gBAAgB,EAAE,uBAAuB,EACjC,aAAa,EAAE,+BAA+B,EACjD,UAAU,EAAE,4BAA4B,EAGjD,YAAY,EAAE,YAAY;IAMtF;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IACU,0BAA0B,CACrC,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACzB,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,gCAAgC,CAAC;IAqDtC,SAAS,CAAC,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,eAAe,GAAG,OAAO,CAAC,eAAe,CAAC;IAoDvF,eAAe,CAAC,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,qBAAqB,GAAG,OAAO,CAAC;QAAE,QAAQ,EAAE,OAAO,CAAA;KAAE,CAAC;CAkChH"}
+{"version":3,"file":"auth-mfa.backend.service.d.ts","sourceRoot":"","sources":["../../../../../../../src/security/authentications/services/auth-methods/auth-mfa.backend.service.ts"],"names":[],"mappings":"AAAA,OAAO,kBAAkB,CAAC;AAK1B,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAC7F,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAC9G,OAAO,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AAC/G,OAAO,EAAE,uBAAuB,EAAE,MAAM,gFAAgF,CAAC;AACzH,OAAO,EAAE,4BAA4B,EAAE,MAAM,6FAA6F,CAAC;AAC3I,OAAO,EAAE,+BAA+B,EAAE,MAAM,gGAAgG,CAAC;AACjJ,OAAO,EAAE,YAAY,EAAE,MAAM,qDAAqD,CAAC;AAGnF,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qEAAqE,CAAC;AAE5G,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,EAAE,CAAC;CACvB;AAED,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,qBAAqB;IACpC,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,gCAAgC;IAC/C,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC,oGAAoG;IACpG,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;CAC/B;AAED;;;GAGG;AACH,qBACa,qBAAqB;IAIK,OAAO,CAAC,QAAQ,CAAC,MAAM;IACV,OAAO,CAAC,QAAQ,CAAC,YAAY;IAChC,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IACjC,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IACzB,OAAO,CAAC,QAAQ,CAAC,aAAa;IACjC,OAAO,CAAC,QAAQ,CAAC,UAAU;IAGpC,OAAO,CAAC,QAAQ,CAAC,YAAY;IAXxE,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA+D;gBAGlC,MAAM,EAAE,aAAa,EACR,YAAY,EAAE,0BAA0B,EAC3C,gBAAgB,EAAE,uBAAuB,EACzC,gBAAgB,EAAE,uBAAuB,EACjC,aAAa,EAAE,+BAA+B,EACjD,UAAU,EAAE,4BAA4B,EAGjD,YAAY,EAAE,YAAY;IAMtF;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IACU,0BAA0B,CACrC,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACzB,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,gCAAgC,CAAC;IAqDtC,SAAS,CAAC,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,eAAe,GAAG,OAAO,CAAC,eAAe,CAAC;IAsDvF,eAAe,CAAC,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,qBAAqB,GAAG,OAAO,CAAC;QAAE,QAAQ,EAAE,OAAO,CAAA;KAAE,CAAC;CAkChH"}

package/dist/esm/security/authentications/services/auth-methods/auth-mfa.backend.service.js

@@ -23,7 +23,7 @@ import { AuthUserLookupBackendService } from '../../../../security/authenticatio
 import { AuthCredentialOpsBackendService } from '../../../../security/authentications/services/utils/auth-credential-ops.backend.service.js';
 import { RedisService } from '../../../../databases/services/redis.service.js';
 import { AUTH_REDIS_KEYS } from '../../../../security/authentications/models/auth-constants.backend.js';
-import { ErrorType, ErrorCustomMessageReference } from '@wildo-ai/saas-models';
+import { ErrorType, ErrorCustomMessageReference, MFA_BACKUP_CODE_CONTRACT } from '@wildo-ai/saas-models';
 /**
  * TOTP enrollment — setup and verify-setup.
  * Uses static `otpauth` import (cleanup from dynamic import in controller).
@@ -150,8 +150,10 @@ let AuthMfaBackendService = class AuthMfaBackendService {
         const qrCodeUri = totp.toString();
         const backupCodes = [];
         const backupCodesHashed = [];
-        for (let i = 0; i < 10; i++) {
-            const code = crypto.randomBytes(4).toString('hex');
+        // Count and length come from `MFA_BACKUP_CODE_CONTRACT`, which the customer documentation also
+        // projects: what a person is told they receive is what this loop issues.
+        for (let i = 0; i < MFA_BACKUP_CODE_CONTRACT.codeCount; i++) {
+            const code = crypto.randomBytes(MFA_BACKUP_CODE_CONTRACT.codeRandomBytes).toString('hex');
             backupCodes.push(code);
             backupCodesHashed.push(crypto.createHash('sha256').update(code).digest('hex'));
         }