@wildo-ai/saas-backend-lib 1.1.1 → 1.1.3

package/dist/esm/security/authentications/services/auth-methods/oauth2-authentication.backend.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oauth2-authentication.backend.service.d.ts","sourceRoot":"","sources":["../../../../../../../src/security/authentications/services/auth-methods/oauth2-authentication.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,kBAAkB,CAAC;AAI1B,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAC7F,OAAO,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AAC/G,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAC9G,OAAO,KAAK,EAAE,qCAAqC,EAAE,MAAM,6FAA6F,CAAC;AACzJ,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,iFAAiF,CAAC;AAElI,OAAO,KAAK,EACV,2CAA2C,EAC5C,MAAM,yFAAyF,CAAC;AAMjG,OAAO,EAAE,yCAAyC,EAAE,MAAM,qGAAqG,CAAC;AAChK,OAAO,EAAE,6BAA6B,EAAE,MAAM,yFAAyF,CAAC;AAExI,OAAO,EAAE,sCAAsC,EAAE,MAAM,8CAA8C,CAAC;AACtG,OAAO,EAAE,+BAA+B,EAAE,MAAM,wGAAwG,CAAC;AACzJ,OAAO,EAAE,wCAAwC,EAAE,MAAM,gHAAgH,CAAC;AAC1K,OAAO,EAAE,uBAAuB,EAAE,MAAM,gFAAgF,CAAC;AAEzH,OAAO,EAWL,aAAa,EAQd,MAAM,uBAAuB,CAAC;AAS/B,OAAO,KAAK,EACV,wBAAwB,EACxB,qBAAqB,EACrB,oBAAoB,EACpB,wBAAwB,EACxB,qBAAqB,EAEtB,MAAM,sFAAsF,CAAC;AAK9F,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,mFAAmF,CAAC;AAqBnI;;;;;;;GAOG;AACH,qBACa,kCAAkC;IAYR,OAAO,CAAC,QAAQ,CAAC,MAAM;IACb,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IAC9B,OAAO,CAAC,QAAQ,CAAC,YAAY;IAClB,OAAO,CAAC,QAAQ,CAAC,uBAAuB;IAC3C,OAAO,CAAC,QAAQ,CAAC,aAAa;IACnC,OAAO,CAAC,QAAQ,CAAC,sBAAsB;IAC9B,OAAO,CAAC,QAAQ,CAAC,QAAQ;IAEhC,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IAEzB,OAAO,CAAC,QAAQ,CAAC,sBAAsB;IAExD,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IAO9B,OAAO,CAAC,QAAQ,CAAC,mBAAmB;IAEpF,OAAO,CAAC,QAAQ,CAAC,6BAA6B;IAhChD,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA+D;IAExF;;;;;OAKG;IACH,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA8B;gBAGH,MAAM,EAAE,aAAa,EACX,gBAAgB,EAAE,uBAAuB,EACtC,YAAY,EAAE,0BAA0B,EAC7B,uBAAuB,EAAE,qCAAqC,EACjE,aAAa,EAAE,yCAAyC,EAC7D,sBAAsB,EAAE,6BAA6B,EAC5C,QAAQ,EAAE,sCAAsC,EAEvD,iBAAiB,EAAE,+BAA+B,EAEzC,sBAAsB,EAAE,wCAAwC,EAEjF,gBAAgB,EAAE,uBAAuB,EAOtC,mBAAmB,EAAE,0BAA0B,EAE/F,6BAA6B,EAAE,2CAA2C;IAU7F;;;;;;;;;;;;;OAaG;IACU,qBAAqB,CAChC,UAAU,EAAE,wBAAwB,EACpC,OAAO,CAAC,EAAE;QAAE,mBAAmB,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,aAAa,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,GAC1G,OAAO,CAAC;QAAE,gBAAgB,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IAmFvD;;;;;;OAMG;IACU,cAAc,CACzB,cAAc,EAAE,oBAAoB,GACnC,OAAO,CAAC;QAAE,iBAAiB,EAAE,qBAAqB,CAAC;QAAC,UAAU,EAAE,wBAAwB,CAAC;QAAC,aAAa,EAAE,wBAAwB,CAAA;KAAE,CAAC;IA6DvI;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACU,mBAAmB,CAC9B,OAAO,EAAE,qBAAqB,EAC9B,UAAU,EAAE,yBAAyB,EACrC,mBAAmB,CAAC,EAAE,MAAM,GAC3B,OAAO,CAAC,qBAAqB,CAAC;IASjC;;;;;;;;;OASG;YACW,0BAA0B;IAmYxC;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;YACW,0BAA0B;IAsExC;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;YACW,sCAAsC;IAgIpD;;;;;OAKG;YACW,wBAAwB;IA4BtC;;;OAGG;YACW,qBAAqB;IAkFnC;;;;;;;;;OASG;YACW,kBAAkB;YA+KlB,aAAa;YA8Bb,kBAAkB;IA2BhC;;;;OAIG;YACW,2BAA2B;IAQzC,OAAO,CAAC,oBAAoB;IAI5B,OAAO,CAAC,qBAAqB;IAQ7B,OAAO,CAAC,4BAA4B;IAkCpC;;OAEG;IACH,OAAO,CAAC,YAAY;IAWpB;;OAEG;IACH,OAAO,CAAC,iBAAiB;IAQzB;;;;OAIG;IACH,OAAO,CAAC,aAAa;IAYrB;;;;;;;;;;OAUG;YACW,aAAa;IAuB3B;;;;;;OAMG;IACH,OAAO,CAAC,kBAAkB;IA+B1B;;;OAGG;IACH,OAAO,CAAC,wBAAwB;IA0DhC;;;;OAIG;IACH,OAAO,CAAC,mBAAmB;CA2B5B"}
+{"version":3,"file":"oauth2-authentication.backend.service.d.ts","sourceRoot":"","sources":["../../../../../../../src/security/authentications/services/auth-methods/oauth2-authentication.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,kBAAkB,CAAC;AAI1B,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAC7F,OAAO,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AAC/G,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAC9G,OAAO,KAAK,EAAE,qCAAqC,EAAE,MAAM,6FAA6F,CAAC;AACzJ,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,iFAAiF,CAAC;AAElI,OAAO,KAAK,EACV,2CAA2C,EAC5C,MAAM,yFAAyF,CAAC;AAMjG,OAAO,EAAE,yCAAyC,EAAE,MAAM,qGAAqG,CAAC;AAChK,OAAO,EAAE,6BAA6B,EAAE,MAAM,yFAAyF,CAAC;AAExI,OAAO,EAAE,sCAAsC,EAAE,MAAM,8CAA8C,CAAC;AACtG,OAAO,EAAE,+BAA+B,EAAE,MAAM,wGAAwG,CAAC;AACzJ,OAAO,EAAE,wCAAwC,EAAE,MAAM,gHAAgH,CAAC;AAC1K,OAAO,EAAE,uBAAuB,EAAE,MAAM,gFAAgF,CAAC;AAEzH,OAAO,EAWL,aAAa,EAQd,MAAM,uBAAuB,CAAC;AAS/B,OAAO,KAAK,EACV,wBAAwB,EACxB,qBAAqB,EACrB,oBAAoB,EACpB,wBAAwB,EACxB,qBAAqB,EAEtB,MAAM,sFAAsF,CAAC;AAK9F,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,mFAAmF,CAAC;AAqBnI;;;;;;;GAOG;AACH,qBACa,kCAAkC;IAYR,OAAO,CAAC,QAAQ,CAAC,MAAM;IACb,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IAC9B,OAAO,CAAC,QAAQ,CAAC,YAAY;IAClB,OAAO,CAAC,QAAQ,CAAC,uBAAuB;IAC3C,OAAO,CAAC,QAAQ,CAAC,aAAa;IACnC,OAAO,CAAC,QAAQ,CAAC,sBAAsB;IAC9B,OAAO,CAAC,QAAQ,CAAC,QAAQ;IAEhC,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IAEzB,OAAO,CAAC,QAAQ,CAAC,sBAAsB;IAExD,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IAO9B,OAAO,CAAC,QAAQ,CAAC,mBAAmB;IAEpF,OAAO,CAAC,QAAQ,CAAC,6BAA6B;IAhChD,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA+D;IAExF;;;;;OAKG;IACH,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA8B;gBAGH,MAAM,EAAE,aAAa,EACX,gBAAgB,EAAE,uBAAuB,EACtC,YAAY,EAAE,0BAA0B,EAC7B,uBAAuB,EAAE,qCAAqC,EACjE,aAAa,EAAE,yCAAyC,EAC7D,sBAAsB,EAAE,6BAA6B,EAC5C,QAAQ,EAAE,sCAAsC,EAEvD,iBAAiB,EAAE,+BAA+B,EAEzC,sBAAsB,EAAE,wCAAwC,EAEjF,gBAAgB,EAAE,uBAAuB,EAOtC,mBAAmB,EAAE,0BAA0B,EAE/F,6BAA6B,EAAE,2CAA2C;IAU7F;;;;;;;;;;;;;OAaG;IACU,qBAAqB,CAChC,UAAU,EAAE,wBAAwB,EACpC,OAAO,CAAC,EAAE;QAAE,mBAAmB,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,aAAa,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,GAC1G,OAAO,CAAC;QAAE,gBAAgB,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IAmHvD;;;;;;OAMG;IACU,cAAc,CACzB,cAAc,EAAE,oBAAoB,GACnC,OAAO,CAAC;QAAE,iBAAiB,EAAE,qBAAqB,CAAC;QAAC,UAAU,EAAE,wBAAwB,CAAC;QAAC,aAAa,EAAE,wBAAwB,CAAA;KAAE,CAAC;IA6DvI;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACU,mBAAmB,CAC9B,OAAO,EAAE,qBAAqB,EAC9B,UAAU,EAAE,yBAAyB,EACrC,mBAAmB,CAAC,EAAE,MAAM,GAC3B,OAAO,CAAC,qBAAqB,CAAC;IASjC;;;;;;;;;OASG;YACW,0BAA0B;IAmYxC;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;YACW,0BAA0B;IAsExC;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;YACW,sCAAsC;IAgIpD;;;;;OAKG;YACW,wBAAwB;IA4BtC;;;OAGG;YACW,qBAAqB;IAkFnC;;;;;;;;;OASG;YACW,kBAAkB;YA+KlB,aAAa;YA8Bb,kBAAkB;IA2BhC;;;;OAIG;YACW,2BAA2B;IAQzC,OAAO,CAAC,oBAAoB;IAI5B,OAAO,CAAC,qBAAqB;IAQ7B,OAAO,CAAC,4BAA4B;IAkCpC;;OAEG;IACH,OAAO,CAAC,YAAY;IAWpB;;OAEG;IACH,OAAO,CAAC,iBAAiB;IAQzB;;;;OAIG;IACH,OAAO,CAAC,aAAa;IAYrB;;;;;;;;;;OAUG;YACW,aAAa;IAiC3B;;;;;;OAMG;IACH,OAAO,CAAC,kBAAkB;IA+B1B;;;OAGG;IACH,OAAO,CAAC,wBAAwB;IA0DhC;;;;OAIG;IACH,OAAO,CAAC,mBAAmB;CA2B5B"}

package/dist/esm/security/authentications/services/auth-methods/oauth2-authentication.backend.service.js

@@ -177,12 +177,38 @@ let OAuth2AuthenticationBackendService = class OAuth2AuthenticationBackendServic
             redirect_uri: connection.redirectUri,
             scope: connection.scopes.join(' '),
             state: stateToken.token,
-            response_type: 'code',
+            /*
+             * The engine implements the authorization-CODE flow only. The connection carries a
+             * `responseType` and the RESOLVER refuses anything else, so this stays a constant here rather
+             * than becoming a value this method has to validate a second time — one gate, at the point
+             * where the configuration is read.
+             */
+            response_type: connection.responseType,
         });
         if (codeChallenge && codeChallengeMethod) {
             params.set('code_challenge', codeChallenge);
             params.set('code_challenge_method', codeChallengeMethod);
         }
+        /*
+         * OIDC authorization-request shaping (#419). Declared on the enterprise connection, persisted
+         * and audit-marked since the SSO work landed, and never sent until 2026-09-08 — so an operator
+         * who set `acrValues` to demand step-up at the identity provider got no such demand AND no
+         * error, which is the worst of the three possible outcomes.
+         *
+         * Set BEFORE the extras merge below on purpose: `acr_values`, `max_age` and `prompt` are not in
+         * `RESERVED_AUTH_PARAM_KEYS`, so a provider contract's `extraAuthParams` may legitimately carry
+         * a provider-specific value for one of them, and the more specific source should win. Adding
+         * them to the reserved set instead would break social providers that already ship a `prompt`.
+         */
+        if (connection.acrValues && connection.acrValues.length > 0) {
+            params.set('acr_values', connection.acrValues.join(' '));
+        }
+        if (connection.maxAge !== undefined) {
+            params.set('max_age', String(connection.maxAge));
+        }
+        if (connection.prompt) {
+            params.set('prompt', connection.prompt);
+        }
         // Merge extra auth params
         if (connection.extraAuthParams) {
             for (const [key, value] of Object.entries(connection.extraAuthParams)) {
@@ -201,6 +227,11 @@ let OAuth2AuthenticationBackendService = class OAuth2AuthenticationBackendServic
             providerRef: connection.providerRef,
             connectionType: connection.connectionType,
             pkce: !!pkceVerifier,
+            // Logged because their absence used to be invisible: an operator debugging a step-up
+            // requirement that never took effect had nothing to look at.
+            acrValues: connection.acrValues,
+            maxAge: connection.maxAge,
+            prompt: connection.prompt,
         });
         return { authorizationUrl, state: stateToken.token };
     }
@@ -1154,6 +1185,16 @@ let OAuth2AuthenticationBackendService = class OAuth2AuthenticationBackendServic
             JWKS = createRemoteJWKSet(new URL(jwksUri));
             this._jwksCache.set(jwksUri, JWKS);
         }
+        /*
+         * Issuer and audience are verified UNCONDITIONALLY, and `maxTokenAge` is a constant, BY DECISION
+         * (#419, 2026-09-08) — not as a TODO awaiting configurability.
+         *
+         * The SSO connection carried `validateIssuer`, `validateAudience` and `clockTolerance` for as
+         * long as this method existed, and nothing here ever read them. Rather than wire them up, they
+         * were REMOVED from the schema: the guard here is already the strict end of their range, so the
+         * only effect honouring them could have had was to let an operator weaken it. Do not re-add a
+         * configuration path into this call without a reason that is not "the fields exist".
+         */
         const { payload } = await jwtVerify(idToken, JWKS, {
             issuer,
             audience,