@wildo-ai/saas-backend-lib 1.1.1 → 1.1.3

package/dist/esm/security/authentications/services/auth-methods/oauth2-connection-resolver.backend.service.js

@@ -37,10 +37,10 @@ import { ErrorBuilderBackendService } from '../../../../errors/services/error-bu
 import { ExternalProvidersRegistryBackendService } from '../../../../external-providers/services/external-providers-registry.backend.service.js';
 import { AuthOrganizationConfigurationService } from '../../../../security/authentications/services/admin-config/auth-organization-configuration.service.js';
 import { OIDCDiscoveryBackendService } from '../../../../security/authentications/services/admin-config/oidc-discovery.backend.service.js';
-import { ErrorType, ErrorCustomMessageReference, AuthScopeType, ExternalIdentitySource, SSOPKCEMethod, SSOTemplateMode, SsoConnectionType, SsoProtocol, isWildoBackendError, } from '@wildo-ai/saas-models';
+import { ErrorType, ErrorCustomMessageReference, AuthScopeType, ExternalIdentitySource, SSOPKCEMethod, SSOResponseType, SSOTemplateMode, SsoConnectionType, SsoProtocol, isWildoBackendError, } from '@wildo-ai/saas-models';
 import { buildEnterpriseConnectionScope } from '../../../../security/authentications/models/sso-connection.backend.schemas.js';
 import jwt from 'jsonwebtoken';
-import { ExternalProvider_ExchangeProtocol_Kind } from '@wildo-ai/external-connectors-models';
+import { ExternalProvider_ExchangeProtocol_Kind, ProviderProtocolRuntimeKind } from '@wildo-ai/external-connectors-models';
 import { isSocialOAuth2LoginPurpose } from '../../../../security/authentications/utils/social-oauth2-purpose.backend.utils.js';
 const signedJwtCache = new Map();
 const SIGNED_JWT_CACHE_SKEW_MS = 5 * 60 * 1000;
@@ -148,7 +148,7 @@ let OAuth2ConnectionResolverBackendService = class OAuth2ConnectionResolverBacke
         this.logDebug('Resolving social connection', { providerRef, scopeId: options?.scopeId });
         // 1. Look up provider OAuth2 runtime contract from the effective runtime registry.
         const oauth2Contract = this.getOAuth2RuntimeContract(providerRef);
-        if (oauth2Contract?.kind !== 'oauth2-sso') {
+        if (oauth2Contract?.kind !== ProviderProtocolRuntimeKind.OAUTH2_SSO) {
             throw this.errorBuilder.buildError(ErrorType.NOT_FOUND, undefined, {
                 customMessageReference: ErrorCustomMessageReference.OAUTH_PROVIDER_NOT_FOUND,
             });
@@ -330,6 +330,9 @@ let OAuth2ConnectionResolverBackendService = class OAuth2ConnectionResolverBacke
             scopes,
             pkceMethod,
             responseMode,
+            // A social provider's contract does not express authorization-request shaping; the engine
+            // drives the authorization-code flow for all of them.
+            responseType: SSOResponseType.CODE,
             identitySource,
             profileMapping,
             extraAuthParams: Object.keys(extraAuthParams).length > 0 ? extraAuthParams : undefined,
@@ -448,6 +451,29 @@ let OAuth2ConnectionResolverBackendService = class OAuth2ConnectionResolverBacke
         const profileMapping = this.buildEnterpriseProfileMapping(oidcConfig.claimsMapping);
         // 6. Build response mode
         const responseMode = oidcConfig.responseMode || 'query';
+        /*
+         * 6b. Authorization-request shaping (#419). Until 2026-09-08 these were persisted, audit-marked
+         * and never sent — so an operator who set `acrValues` to demand step-up at the IdP got no such
+         * demand and no error.
+         *
+         * `responseType` is REFUSED rather than forwarded when it names a flow the engine does not
+         * implement. `SSOResponseType` offers `code`, `id_token` and `token`; the callback path only
+         * exchanges an authorization CODE, so sending `id_token` would trade a silent no-op for a
+         * silently broken login — strictly worse. A refusal at resolution time names the connection and
+         * the value, and lifts on its own the day the implicit flows are implemented.
+         */
+        const responseType = oidcConfig.responseType ?? SSOResponseType.CODE;
+        if (responseType !== SSOResponseType.CODE) {
+            throw this.errorBuilder.buildError(ErrorType.CONFIGURATION, undefined, {
+                customMessageReference: ErrorCustomMessageReference.CONFIGURATION,
+                context: {
+                    message: `SSO connection declares oidc.responseType "${responseType}", and this engine implements the authorization-code flow only. `
+                        + 'Set it to "code", or implement the implicit flow before selecting it.',
+                    connectionId,
+                    providerRef: oidcConfig.externalProviderId,
+                },
+            });
+        }
         // 7. Assemble OAuth2ResolvedConnection
         const connection = {
             source: ExternalIdentitySource.OIDC,
@@ -466,6 +492,10 @@ let OAuth2ConnectionResolverBackendService = class OAuth2ConnectionResolverBacke
             scopes,
             pkceMethod,
             responseMode: responseMode,
+            responseType: SSOResponseType.CODE,
+            acrValues: oidcConfig.acrValues && oidcConfig.acrValues.length > 0 ? oidcConfig.acrValues : undefined,
+            maxAge: oidcConfig.maxAge,
+            prompt: oidcConfig.prompt,
             identitySource: userInfoUrl ? 'userinfo' : 'id_token',
             profileMapping,
             extraAuthParams,
@@ -572,7 +602,7 @@ let OAuth2ConnectionResolverBackendService = class OAuth2ConnectionResolverBacke
     }
     getOAuth2RuntimeContract(providerRef) {
         const protocolConfig = this.externalProvidersRegistry.getProviderConfiguration(providerRef, ExternalProvider_ExchangeProtocol_Kind.SSO_OAUTH2);
-        return protocolConfig?.runtimeContract?.kind === 'oauth2-sso'
+        return protocolConfig?.runtimeContract?.kind === ProviderProtocolRuntimeKind.OAUTH2_SSO
             ? protocolConfig.runtimeContract
             : undefined;
     }

package/dist/esm/security/authentications/services/auth-methods/oauth2-connection-resolver.backend.service.js.map

@@ -1 +1 @@
-{"version":3,"file":"oauth2-connection-resolver.backend.service.js","sourceRoot":"","sources":["../../../../../../../src/security/authentications/services/auth-methods/oauth2-connection-resolver.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;;;;;;;;;;;;;AAEH,OAAO,kBAAkB,CAAC;AAC1B,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAC/C,OAAO,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AACpF,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAC7F,OAAO,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AAC/G,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAC9G,OAAO,EAAE,uCAAuC,EAAE,MAAM,4FAA4F,CAAC;AACrJ,OAAO,EAAE,oCAAoC,EAAE,MAAM,2GAA2G,CAAC;AACjK,OAAO,EAAE,2BAA2B,EAAE,MAAM,kGAAkG,CAAC;AAC/I,OAAO,EACL,SAAS,EACT,2BAA2B,EAC3B,aAAa,EACb,sBAAsB,EACtB,aAAa,EACb,eAAe,EACf,iBAAiB,EACjB,WAAW,EACX,mBAAmB,GACpB,MAAM,uBAAuB,CAAC;AAM/B,OAAO,EAAE,8BAA8B,EAAE,MAAM,mFAAmF,CAAC;AAEnI,OAAO,GAAG,MAAM,cAAc,CAAC;AAC/B,OAAO,EAAE,sCAAsC,EAAE,MAAM,sCAAsC,CAAC;AAC9F,OAAO,EAAE,0BAA0B,EAAE,MAAM,uFAAuF,CAAC;AAgBnI,MAAM,cAAc,GAAG,IAAI,GAAG,EAA8C,CAAC;AAC7E,MAAM,wBAAwB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAC/C,MAAM,0BAA0B,GAAG,YAAY,CAAC;AAwBhD;;;;;;;;;;GAUG;AACH,MAAM,4BAA4B,GAAyB;IACzD,EAAE,EAAE,KAAK;IACT,KAAK,EAAE,OAAO;IACd,SAAS,EAAE,YAAY;IACvB,QAAQ,EAAE,aAAa;IACvB,IAAI,EAAE,MAAM;IACZ,KAAK,EAAE,SAAS;IAChB,aAAa,EAAE,gBAAgB;CAChC,CAAC;AAEF,SAAS,kCAAkC,CACzC,WAAmB,EACnB,QAAgB,EAChB,MAAmC;IAEnC,MAAM,QAAQ,GAAG;QACf,WAAW;QACX,QAAQ;QACR,MAAM,CAAC,KAAK;QACZ,MAAM,CAAC,MAAM;QACb,MAAM,CAAC,SAAS;QAChB,MAAM,CAAC,QAAQ;QACf,MAAM,CAAC,kBAAkB;KAC1B,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACZ,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC5C,IAAI,MAAM,IAAI,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;QAC5C,OAAO,MAAM,CAAC,GAAG,CAAC;IACpB,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC5B,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,CAAC,UAAU,EAAE;QAC5C,SAAS,EAAE,MAAM,CAAC,SAA0B;QAC5C,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,OAAO,EAAE,MAAM,CAAC,QAAQ;QACxB,SAAS,EAAE,MAAM,CAAC,kBAAkB;KACrC,CAAC,CAAC;IAEH,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,kBAAkB,GAAG,IAAI,GAAG,wBAAwB,CAAC,CAAC;IAC5F,cAAc,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,GAAG,UAAU,EAAE,CAAC,CAAC;IAC/E,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;GAIG;AAEI,IAAM,sCAAsC,GAA5C,MAAM,sCAAsC;IAIK;IACU;IACG;IACa;IACI;IAChB;IARnD,QAAQ,CAA+D;IAExF,YACsD,MAAqB,EACX,gBAAyC,EACtC,YAAwC,EAC3B,yBAAkE,EAC9D,gBAAsD,EACtE,aAA0C;QALxD,WAAM,GAAN,MAAM,CAAe;QACX,qBAAgB,GAAhB,gBAAgB,CAAyB;QACtC,iBAAY,GAAZ,YAAY,CAA4B;QAC3B,8BAAyB,GAAzB,yBAAyB,CAAyC;QAC9D,qBAAgB,GAAhB,gBAAgB,CAAsC;QACtE,kBAAa,GAAb,aAAa,CAA6B;QAE5G,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,0BAA0B,CAAC,CAAC;QACpE,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,0BAA0B,EAAE,KAAK,CAAC,CAAC;IACrE,CAAC;IAED,kEAAkE;IAClE,+BAA+B;IAC/B,kEAAkE;IAElE;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACI,KAAK,CAAC,uBAAuB,CAClC,WAAmB,EACnB,OAAqF;QAErF,IAAI,CAAC,QAAQ,CAAC,6BAA6B,EAAE,EAAE,WAAW,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;QAEzF,mFAAmF;QACnF,MAAM,cAAc,GAAG,IAAI,CAAC,wBAAwB,CAAC,WAAW,CAAC,CAAC;QAClE,IAAI,cAAc,EAAE,IAAI,KAAK,YAAY,EAAE,CAAC;YAC1C,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,SAAS,EAAE,SAAS,EAAE;gBACjE,sBAAsB,EAAE,2BAA2B,CAAC,wBAAwB;aAC7E,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC;YACH,IAAI,CAAC,IAAI,CAAC,yBAAyB,CAAC,iBAAiB,CAAC,WAAW,EAAE,sCAAsC,CAAC,UAAU,CAAC,EAAE,CAAC;gBACtH,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;oBACrE,sBAAsB,EAAE,2BAA2B,CAAC,iCAAiC;oBACrF,OAAO,EAAE,EAAE,OAAO,EAAE,oBAAoB,WAAW,6CAA6C,EAAE;iBACnG,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,mBAAmB,CAAC,KAAK,CAAC;gBAAE,MAAM,KAAK,CAAC;YAC5C,IAAI,CAAC,QAAQ,CAAC,gHAAgH,EAAE;gBAC9H,WAAW;aACZ,CAAC,CAAC;QACL,CAAC;QAED,4CAA4C;QAC5C,MAAM,SAAS,GAAG,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC;QAC/C,MAAM,0BAA0B,GAAG,SAAS,CAAC,IAAI,EAAE,qBAAqB,EAAE,CAAC,WAAW,CAAC,CAAC;QACxF,IAAI,CAAC,0BAA0B,IAAI,0BAA0B,CAAC,OAAO,KAAK,KAAK,EAAE,CAAC;YAChF,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;gBACrE,sBAAsB,EAAE,2BAA2B,CAAC,iCAAiC;gBACrF,OAAO,EAAE,EAAE,OAAO,EAAE,2BAA2B,WAAW,uCAAuC,EAAE;aACpG,CAAC,CAAC;QACL,CAAC;QACD,IAAI,CAAC,0BAA0B,CAAC,0BAA0B,CAAC,OAAO,CAAC,EAAE,CAAC;YACpE,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;gBACrE,sBAAsB,EAAE,2BAA2B,CAAC,iCAAiC;gBACrF,OAAO,EAAE,EAAE,OAAO,EAAE,2BAA2B,WAAW,sCAAsC,EAAE;aACnG,CAAC,CAAC;QACL,CAAC;QAED,yDAAyD;QACzD,MAAM,eAAe,GAAG,SAAS,CAAC,sBAAsB,EAAE,CAAC,WAAW,CAAC,CAAC;QACxE,MAAM,cAAc,GAAG,eAAe,EAAE,CAAC,0BAA0B,CAAoC,CAAC;QAExG,IAAI,QAAQ,GAAG,cAAc,EAAE,UAAU,EAAE,QAAQ;eAC9C,cAAc,EAAE,QAAQ;eACxB,CAAC,cAAc,CAAC,uBAAuB,CAAC,CAAC,CAAC,cAAc,EAAE,CAAC,cAAc,CAAC,uBAAuB,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAErH,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;gBACrE,sBAAsB,EAAE,2BAA2B,CAAC,iCAAiC;gBACrF,OAAO,EAAE,EAAE,OAAO,EAAE,yCAAyC,WAAW,GAAG,EAAE;aAC9E,CAAC,CAAC;QACL,CAAC;QAED,qEAAqE;QACrE,MAAM,SAAS,GAAG,cAAc,EAAE,UAAU,EAAE,SAAS,IAAI,cAAc,CAAC,eAAe,CAAC;QAC1F,IAAI,YAAY,GAAG,EAAE,CAAC;QAEtB,IAAI,SAAS,EAAE,CAAC;YACd,YAAY,GAAG,IAAI,CAAC,yBAAyB,CAAC,iBAAiB,CAC7D,WAAW,EACX,0BAAiC,EACjC,SAAS,CACV,IAAI,EAAE,CAAC;QACV,CAAC;QAED,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;gBACrE,sBAAsB,EAAE,2BAA2B,CAAC,iCAAiC;gBACrF,OAAO,EAAE,EAAE,OAAO,EAAE,0DAA0D,WAAW,2BAA2B,SAAS,IAAI,EAAE;aACpI,CAAC,CAAC;QACL,CAAC;QAED,oDAAoD;QACpD,oFAAoF;QACpF,0EAA0E;QAC1E,EAAE;QACF,iFAAiF;QACjF,6EAA6E;QAC7E,4EAA4E;QAC5E,IAAI,sBAA0C,CAAC;QAC/C,IAAI,uBAA2C,CAAC;QAChD,IAAI,OAAO,EAAE,OAAO,IAAI,OAAO,CAAC,EAAE,EAAE,CAAC;YACnC,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,aAAa,CAAC,YAAY,CAAC;YAClE,IAAI,CAAC;gBACH,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,aAAa,CAAC,OAAO,CAAC,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;gBACpG,MAAM,SAAS,GAAG,SAAS,EAAE,yBAAyB,CAAC;gBACvD,MAAM,QAAQ,GAAG,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,KAAK,WAAW,CAAC,CAAC;gBACrE,IAAI,QAAQ,EAAE,CAAC;oBACb,QAAQ,GAAG,QAAQ,CAAC,QAAQ,CAAC;oBAC7B,YAAY,GAAG,QAAQ,CAAC,YAAY,CAAC;oBACrC,sBAAsB,GAAG,QAAQ,CAAC,cAAc,CAAC;oBACjD,uBAAuB,GAAG,QAAQ,CAAC,eAAe,CAAC;oBACnD,IAAI,CAAC,QAAQ,CAAC,+CAA+C,EAAE;wBAC7D,WAAW,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO;qBACjD,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC;oBAAE,MAAM,GAAG,CAAC;gBACzC,IAAI,CAAC,QAAQ,CAAC,gEAAgE,EAAE;oBAC9E,WAAW,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO;iBACjD,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,2CAA2C;QAC3C,mFAAmF;QACnF,oFAAoF;QACpF,qCAAqC;QACrC,EAAE;QACF,qFAAqF;QACrF,8EAA8E;QAC9E,0EAA0E;QAC1E,MAAM,UAAU,GAAG,cAAc,CAAC,UAAU,IAAI,EAAE,CAAC;QACnD,IAAI,UAAU,CAAC,gBAAgB,KAAK,YAAY,EAAE,CAAC;YACjD,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,CAAC,qBAAqB,IAAI,OAAO,CAAC,CAAC;YACtE,MAAM,QAAQ,GAAG,MAAM,CAAC,UAAU,CAAC,oBAAoB,IAAI,2BAA2B,CAAC,CAAC;YACxF,MAAM,kBAAkB,GAAG,MAAM,CAAC,UAAU,CAAC,8BAA8B,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,GAAG,CAAC,CAAC;YACnG,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,CAAC,eAAe,IAAI,GAAG,WAAW,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;YAC/F,MAAM,QAAQ,GAAG,MAAM,CAAC,UAAU,CAAC,cAAc,IAAI,GAAG,WAAW,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;YAC5F,MAAM,MAAM,GAAG,uBAAuB,IAAI,IAAI,CAAC,yBAAyB,CAAC,iBAAiB,CACxF,WAAW,EACX,0BAAiC,EACjC,SAAS,CACV,CAAC;YACF,MAAM,KAAK,GAAG,sBAAsB,IAAI,IAAI,CAAC,yBAAyB,CAAC,iBAAiB,CACtF,WAAW,EACX,0BAAiC,EACjC,QAAQ,CACT,CAAC;YAEF,IAAI,CAAC,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;gBACtB,MAAM,OAAO,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBAC9F,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;oBACrE,sBAAsB,EAAE,2BAA2B,CAAC,iCAAiC;oBACrF,OAAO,EAAE,EAAE,OAAO,EAAE,aAAa,WAAW,yDAAyD,OAAO,EAAE,EAAE;iBACjH,CAAC,CAAC;YACL,CAAC;YAED,YAAY,GAAG,kCAAkC,CAC/C,WAAW,EACX,QAAQ,EACR,EAAE,UAAU,EAAE,YAAY,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,kBAAkB,EAAE,CAC/F,CAAC;YACF,IAAI,CAAC,QAAQ,CAAC,oCAAoC,EAAE,EAAE,WAAW,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAC;QAC5F,CAAC;QAED,wEAAwE;QACxE,MAAM,SAAS,GAAG,SAAS,CAAC,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,SAAS,CAAC;QAC5E,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;gBACrE,sBAAsB,EAAE,2BAA2B,CAAC,iCAAiC;gBACrF,OAAO,EAAE,EAAE,OAAO,EAAE,6FAA6F,EAAE;aACpH,CAAC,CAAC;QACL,CAAC;QACD,MAAM,WAAW,GAAG,GAAG,SAAS,gCAAgC,WAAW,EAAE,CAAC;QAE9E,mCAAmC;QACnC,MAAM,uBAAuB,GAAG,IAAI,CAAC,8BAA8B,CACjE,cAAc,EAAE,uBAAuB,IAAI,cAAc,CAAC,uBAAuB,CAClF,CAAC;QACF,MAAM,YAAY,GAAG,cAAc,CAAC,YAAY,IAAI,IAAI,CAAC,mBAAmB,CAAC;YAC3E,GAAG,cAAc,CAAC,eAAe;YACjC,GAAG,cAAc,EAAE,eAAe;SACnC,CAAC,CAAC;QACH,MAAM,cAAc,GAAG,cAAc,CAAC,cAAc;eAC/C,IAAI,CAAC,qBAAqB,CAAC,UAAU,EAAE,cAAc,CAAC,gBAAgB,CAAC,CAAC;QAC7E,MAAM,UAAU,GAAG,cAAc,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;QAE/D,6DAA6D;QAC7D,MAAM,aAAa,GAAG,cAAc,CAAC,MAAM,IAAI,EAAE,CAAC;QAClD,MAAM,gBAAgB,GAAG,0BAA0B,CAAC,gBAAgB,IAAI,EAAE,CAAC;QAC3E,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,aAAa,EAAE,GAAG,gBAAgB,CAAC,CAAC,CAAC,CAAC;QAErE,kBAAkB;QAClB,MAAM,cAAc,GAAG,cAAc,CAAC,cAAc,IAAI,4BAA4B,CAAC;QAErF,mBAAmB;QACnB,MAAM,eAAe,GAAG;YACtB,GAAG,CAAC,cAAc,CAAC,eAAe,IAAI,EAAE,CAAC;YACzC,GAAG,CAAC,cAAc,EAAE,eAAe,IAAI,EAAE,CAAC;SAC3C,CAAC;QACF,MAAM,gBAAgB,GAAG;YACvB,GAAG,CAAC,cAAc,CAAC,gBAAgB,IAAI,EAAE,CAAC;YAC1C,GAAG,CAAC,cAAc,EAAE,gBAAgB,IAAI,EAAE,CAAC;SAC5C,CAAC;QACF,MAAM,mBAAmB,GAAG;YAC1B,GAAG,CAAC,cAAc,CAAC,mBAAmB,IAAI,EAAE,CAAC;YAC7C,GAAG,CAAC,cAAc,EAAE,mBAAmB,IAAI,EAAE,CAAC;SAC/C,CAAC;QACF,MAAM,kBAAkB,GAAG;YACzB,GAAG,UAAU;YACb,GAAG,CAAC,cAAc,EAAE,UAAU,IAAI,EAAE,CAAC;SACtC,CAAC;QAEF,0CAA0C;QAC1C,MAAM,MAAM,GAAG,cAAc,CAAC,MAAM,CAAC;QACrC,MAAM,OAAO,GAAG,cAAc,CAAC,OAAO,CAAC;QAEvC,MAAM,UAAU,GAA6B;YAC3C,MAAM,EAAE,cAAc,CAAC,YAAY;gBACjC,CAAC,CAAC,sBAAsB,CAAC,IAAI;gBAC7B,CAAC,CAAC,sBAAsB,CAAC,MAAM;YACjC,cAAc,EAAE,iBAAiB,CAAC,MAAM;YACxC,WAAW;YACX,WAAW,EAAE,0BAA0B,CAAC,WAAW,IAAI,WAAW;YAClE,gBAAgB,EAAE,cAAc,CAAC,qBAAqB;YACtD,QAAQ,EAAE,cAAc,CAAC,aAAa;YACtC,WAAW,EAAE,cAAc,CAAC,gBAAgB;YAC5C,WAAW;YACX,MAAM;YACN,OAAO;YACP,QAAQ;YACR,YAAY;YACZ,uBAAuB;YACvB,MAAM;YACN,UAAU;YACV,YAAY;YACZ,cAAc;YACd,cAAc;YACd,eAAe,EAAE,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,SAAS;YACtF,gBAAgB,EAAE,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,SAAS;YACzF,mBAAmB,EAAE,MAAM,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,SAAS;YAClG,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,SAAS;SACxF,CAAC;QAEF,IAAI,CAAC,QAAQ,CAAC,4BAA4B,EAAE;YAC1C,WAAW;YACX,cAAc,EAAE,iBAAiB,CAAC,MAAM;YACxC,YAAY;YACZ,cAAc;YACd,UAAU;YACV,UAAU,EAAE,MAAM,CAAC,MAAM;SAC1B,CAAC,CAAC;QAEH,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,kEAAkE;IAClE,6CAA6C;IAC7C,kEAAkE;IAElE;;;;;;;;;;;;;OAaG;IACI,KAAK,CAAC,2BAA2B,CACtC,SAAwB,EACxB,OAAe,EACf,YAAoB;QAEpB,IAAI,CAAC,QAAQ,CAAC,iCAAiC,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC,CAAC;QAEvF,sDAAsD;QACtD,sEAAsE;QACtE,6EAA6E;QAC7E,2EAA2E;QAC3E,+EAA+E;QAC/E,sEAAsE;QACtE,wEAAwE;QACxE,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,yBAAyB,CAAC,SAAS,EAAE,OAAO,EAAE,YAAY,CAAC,CAAC;QAE9G,IAAI,CAAC,aAAa,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,CAAC;YAC7C,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,SAAS,EAAE,SAAS,EAAE;gBACjE,sBAAsB,EAAE,2BAA2B,CAAC,wBAAwB;aAC7E,CAAC,CAAC;QACL,CAAC;QAED,+FAA+F;QAC/F,IAAI,aAAa,CAAC,QAAQ,KAAK,WAAW,CAAC,IAAI,EAAE,CAAC;YAChD,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;gBACrE,sBAAsB,EAAE,2BAA2B,CAAC,iCAAiC;gBACrF,OAAO,EAAE,EAAE,OAAO,EAAE,yHAAyH,EAAE;aAChJ,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC;YACxB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;gBACrE,sBAAsB,EAAE,2BAA2B,CAAC,iCAAiC;gBACrF,OAAO,EAAE,EAAE,OAAO,EAAE,mBAAmB,YAAY,yDAAyD,EAAE;aAC/G,CAAC,CAAC;QACL,CAAC;QAED,yEAAyE;QACzE,MAAM,UAAU,GAAwB;YACtC,GAAG,aAAa,CAAC,IAAI;YACrB,kBAAkB,EAAE,aAAa,CAAC,kBAAkB;YACpD,WAAW,EAAE,aAAa,CAAC,WAAW;YACtC,cAAc,EAAE,aAAa,CAAC,cAAc;YAC5C,eAAe,EAAE,aAAa,CAAC,eAAe;YAC9C,eAAe,EAAE,aAAa,CAAC,eAAe;YAC9C,WAAW,EAAE,aAAa,CAAC,WAAW;YACtC,WAAW,EAAE,aAAa,CAAC,WAAW;YACtC,YAAY,EAAE,aAAa,CAAC,YAAY;SACzC,CAAC;QAEF,6CAA6C;QAC7C,MAAM,YAAY,GAAG,UAAU,CAAC,YAAY,IAAI,eAAe,CAAC,MAAM,CAAC;QACvE,IAAI,gBAAwB,CAAC;QAC7B,IAAI,QAAgB,CAAC;QACrB,IAAI,WAA+B,CAAC;QACpC,IAAI,OAA2B,CAAC;QAChC,IAAI,kBAAsC,CAAC;QAC3C,IAAI,MAA0B,CAAC;QAC/B,IAAI,MAAgB,CAAC;QACrB,IAAI,eAAmD,CAAC;QACxD,IAAI,UAAU,GAA2C,UAAU,CAAC,WAAW;YAC7E,CAAC,CAAC,CACA,UAAU,CAAC,UAAU,KAAK,aAAa,CAAC,KAAK;gBAC3C,CAAC,CAAC,aAAa,CAAC,KAAK;gBACrB,CAAC,CAAC,aAAa,CAAC,IAAI,CACvB;YACD,CAAC,CAAC,IAAI,CAAC;QAET,QAAQ,YAAY,EAAE,CAAC;YACrB,KAAK,eAAe,CAAC,QAAQ;gBAC3B,CAAC,EAAE,gBAAgB,EAAE,QAAQ,EAAE,WAAW,EAAE,OAAO,EAAE,kBAAkB,EAAE,MAAM,EAAE,MAAM,EAAE,eAAe,EAAE,UAAU,EAAE;oBACpH,MAAM,IAAI,CAAC,mBAAmB,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC,CAAC;gBAC1D,MAAM;YAER,KAAK,eAAe,CAAC,SAAS;gBAC5B,CAAC,EAAE,gBAAgB,EAAE,QAAQ,EAAE,WAAW,EAAE,OAAO,EAAE,kBAAkB,EAAE,MAAM,EAAE,MAAM,EAAE;oBACvF,MAAM,IAAI,CAAC,oBAAoB,CAAC,UAAU,CAAC,CAAC,CAAC;gBAC/C,MAAM;YAER,KAAK,eAAe,CAAC,MAAM,CAAC;YAC5B;gBACE,CAAC,EAAE,gBAAgB,EAAE,QAAQ,EAAE,WAAW,EAAE,OAAO,EAAE,kBAAkB,EAAE,MAAM,EAAE,MAAM,EAAE;oBACvF,IAAI,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAC,CAAC;gBACtC,MAAM;QACV,CAAC;QAED,uCAAuC;QACvC,MAAM,SAAS,GAAG,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,SAAS,CAAC;QAC/F,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;gBACrE,sBAAsB,EAAE,2BAA2B,CAAC,iCAAiC;gBACrF,OAAO,EAAE,EAAE,OAAO,EAAE,6FAA6F,EAAE;aACpH,CAAC,CAAC;QACL,CAAC;QACD,MAAM,WAAW,GAAG,UAAU,CAAC,kBAAkB,IAAI,iBAAiB,CAAC;QACvE,MAAM,WAAW,GAAG,GAAG,SAAS,gCAAgC,WAAW,EAAE,CAAC;QAE9E,sDAAsD;QACtD,MAAM,cAAc,GAAG,IAAI,CAAC,6BAA6B,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;QAEpF,yBAAyB;QACzB,MAAM,YAAY,GAAG,UAAU,CAAC,YAAY,IAAI,OAAO,CAAC;QAExD,uCAAuC;QACvC,MAAM,UAAU,GAA6B;YAC3C,MAAM,EAAE,sBAAsB,CAAC,IAAI;YACnC,cAAc,EAAE,iBAAiB,CAAC,UAAU;YAC5C,WAAW;YACX,WAAW,EAAE,UAAU,CAAC,WAAW;YACnC,gBAAgB;YAChB,QAAQ;YACR,WAAW;YACX,WAAW;YACX,MAAM;YACN,OAAO;YACP,QAAQ,EAAE,UAAU,CAAC,QAAQ;YAC7B,YAAY,EAAE,UAAU,CAAC,YAAY;YACrC,uBAAuB,EAAE,oBAAoB;YAC7C,MAAM;YACN,UAAU;YACV,YAAY,EAAE,YAAkD;YAChE,cAAc,EAAE,WAAW,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU;YACrD,cAAc;YACd,eAAe;YACf,KAAK,EAAE,8BAA8B,CAAC,SAAS,EAAE,OAAO,EAAE,YAAY,CAAC;YACvE,yFAAyF;YACzF,qGAAqG;YACrG,wFAAwF;YACxF,kBAAkB,EAAE;gBAClB,eAAe,EAAE,UAAU,CAAC,eAAe,IAAI,IAAI;gBACnD,eAAe,EAAE,UAAU,CAAC,eAAe,IAAI,IAAI;gBACnD,WAAW,EAAE,UAAU,CAAC,WAAW;gBACnC,WAAW,EAAE,UAAU,CAAC,WAAW;gBACnC,YAAY,EAAE,UAAU,CAAC,YAAY;gBACrC,cAAc,EAAE,UAAU,CAAC,cAAc,IAAI,EAAE;aAChD;SACF,CAAC;QAEF,IAAI,CAAC,QAAQ,CAAC,gCAAgC,EAAE;YAC9C,SAAS;YACT,OAAO;YACP,YAAY;YACZ,YAAY;YACZ,WAAW;YACX,cAAc,EAAE,CAAC,CAAC,WAAW;SAC9B,CAAC,CAAC;QAEH,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,kEAAkE;IAClE,mCAAmC;IACnC,kEAAkE;IAElE;;;OAGG;IACK,KAAK,CAAC,mBAAmB,CAC/B,UAA+B,EAC/B,iBAA0C;QAO1C,MAAM,kBAAkB,GAAG,UAAU,CAAC,kBAAkB,CAAC;QACzD,IAAI,CAAC,kBAAkB,EAAE,CAAC;YACxB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;gBACrE,sBAAsB,EAAE,2BAA2B,CAAC,iCAAiC;gBACrF,OAAO,EAAE,EAAE,OAAO,EAAE,mDAAmD,EAAE;aAC1E,CAAC,CAAC;QACL,CAAC;QAED,MAAM,cAAc,GAAG,IAAI,CAAC,wBAAwB,CAAC,kBAAkB,CAAC,CAAC;QACzE,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,SAAS,EAAE,SAAS,EAAE;gBACjE,sBAAsB,EAAE,2BAA2B,CAAC,wBAAwB;aAC7E,CAAC,CAAC;QACL,CAAC;QAED,MAAM,iBAAiB,GAAG,UAAU,CAAC,iBAAiB,IAAI,EAAE,CAAC;QAE7D,wDAAwD;QACxD,MAAM,gBAAgB,GAAG,IAAI,CAAC,aAAa,CAAC,kBAAkB,CAAC,cAAc,CAAC,qBAAqB,IAAI,EAAE,EAAE,iBAAiB,CAAC,CAAC;QAC9H,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,CAAC,kBAAkB,CAAC,cAAc,CAAC,aAAa,IAAI,EAAE,EAAE,iBAAiB,CAAC,CAAC;QAC9G,MAAM,WAAW,GAAG,cAAc,CAAC,gBAAgB;YACjD,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,kBAAkB,CAAC,cAAc,CAAC,gBAAgB,EAAE,iBAAiB,CAAC;YAC3F,CAAC,CAAC,SAAS,CAAC;QACd,MAAM,OAAO,GAAG,cAAc,CAAC,OAAO;YACpC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,kBAAkB,CAAC,cAAc,CAAC,OAAO,EAAE,iBAAiB,CAAC;YAClF,CAAC,CAAC,SAAS,CAAC;QACd,MAAM,kBAAkB,GAAG,SAAS,CAAC,CAAC,8CAA8C;QAEpF,6CAA6C;QAC7C,MAAM,MAAM,GAAG,cAAc,CAAC,MAAM;YAClC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,kBAAkB,CAAC,cAAc,CAAC,MAAM,EAAE,iBAAiB,CAAC;YACjF,CAAC,CAAC,SAAS,CAAC;QAEd,gDAAgD;QAChD,MAAM,aAAa,GAAG,cAAc,CAAC,MAAM,IAAI,CAAC,QAAQ,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;QAC9E,MAAM,YAAY,GAAG,UAAU,CAAC,YAAY,IAAI,EAAE,CAAC;QACnD,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,aAAa,EAAE,GAAG,UAAU,CAAC,MAAM,EAAE,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC;QAEvF,8CAA8C;QAC9C,IAAI,eAAmD,CAAC;QACxD,MAAM,uBAAuB,GAAG;YAC9B,GAAG,CAAC,cAAc,CAAC,eAAe,IAAI,EAAE,CAAC;YACzC,GAAG,CAAC,UAAU,CAAC,eAAe,IAAI,EAAE,CAAC;SACtC,CAAC;QACF,IAAI,MAAM,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACpD,eAAe,GAAG,IAAI,CAAC,aAAa,CAAC,qBAAqB,CAAC,uBAAuB,EAAE,iBAAiB,CAAC,CAAC;QACzG,CAAC;QAED,kCAAkC;QAClC,MAAM,UAAU,GAAG,cAAc,CAAC,YAAY,CAAC,CAAC,CAAC,MAAe,CAAC,CAAC,CAAC,iBAAiB,CAAC;QAErF,OAAO,EAAE,gBAAgB,EAAE,QAAQ,EAAE,WAAW,EAAE,OAAO,EAAE,kBAAkB,EAAE,MAAM,EAAE,MAAM,EAAE,eAAe,EAAE,UAAU,EAAE,CAAC;IAC/H,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,oBAAoB,CAChC,UAA+B;QAM/B,MAAM,SAAS,GAAG,UAAU,CAAC,MAAM,IAAI,UAAU,CAAC,YAAY,EAAE,OAAO,CAAC,mCAAmC,EAAE,EAAE,CAAC,CAAC;QACjH,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;gBACrE,sBAAsB,EAAE,2BAA2B,CAAC,iCAAiC;gBACrF,OAAO,EAAE,EAAE,OAAO,EAAE,wDAAwD,EAAE;aAC/E,CAAC,CAAC;QACL,CAAC;QAED,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC;QAElE,MAAM,YAAY,GAAG,UAAU,CAAC,YAAY,IAAI,EAAE,CAAC;QACnD,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,UAAU,CAAC,MAAM,EAAE,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC;QAErE,OAAO;YACL,gBAAgB,EAAE,GAAG,CAAC,sBAAsB;YAC5C,QAAQ,EAAE,GAAG,CAAC,cAAc;YAC5B,WAAW,EAAE,GAAG,CAAC,iBAAiB;YAClC,OAAO,EAAE,GAAG,CAAC,QAAQ;YACrB,kBAAkB,EAAE,GAAG,CAAC,oBAAoB;YAC5C,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,MAAM;SACP,CAAC;IACJ,CAAC;IAEO,wBAAwB,CAAC,WAAmB;QAClD,MAAM,cAAc,GAAG,IAAI,CAAC,yBAAyB,CAAC,wBAAwB,CAC5E,WAAW,EACX,sCAAsC,CAAC,UAAU,CACf,CAAC;QAErC,OAAO,cAAc,EAAE,eAAe,EAAE,IAAI,KAAK,YAAY;YAC3D,CAAC,CAAC,cAAc,CAAC,eAA2C;YAC5D,CAAC,CAAC,SAAS,CAAC;IAChB,CAAC;IAED;;OAEG;IACK,iBAAiB,CACvB,UAA+B;QAM/B,IAAI,CAAC,UAAU,CAAC,qBAAqB,IAAI,CAAC,UAAU,CAAC,aAAa,EAAE,CAAC;YACnE,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;gBACrE,sBAAsB,EAAE,2BAA2B,CAAC,iCAAiC;gBACrF,OAAO,EAAE,EAAE,OAAO,EAAE,sEAAsE,EAAE;aAC7F,CAAC,CAAC;QACL,CAAC;QAED,MAAM,YAAY,GAAG,UAAU,CAAC,YAAY,IAAI,EAAE,CAAC;QACnD,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,UAAU,CAAC,MAAM,EAAE,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC;QAErE,OAAO;YACL,gBAAgB,EAAE,UAAU,CAAC,qBAAqB;YAClD,QAAQ,EAAE,UAAU,CAAC,aAAa;YAClC,WAAW,EAAE,UAAU,CAAC,gBAAgB;YACxC,OAAO,EAAE,UAAU,CAAC,OAAO;YAC3B,kBAAkB,EAAE,UAAU,CAAC,kBAAkB;YACjD,MAAM,EAAE,UAAU,CAAC,MAAM;YACzB,MAAM;SACP,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAsCG;IACK,6BAA6B,CAAC,aAAmC;QACvE,MAAM,CAAC,GAAG,aAAa,IAAI,EAAE,CAAC;QAC9B,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,CAAC,CAAC,KAAK,IAAI,OAAO;YACzB,SAAS,EAAE,CAAC,CAAC,SAAS,IAAI,YAAY;YACtC,QAAQ,EAAE,CAAC,CAAC,QAAQ,IAAI,aAAa;YACrC,IAAI,EAAE,MAAM;YACZ,KAAK,EAAE,SAAS;YAChB,aAAa,EAAE,gBAAgB;YAC/B,KAAK,EAAE,CAAC,CAAC,KAAK;YACd,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,UAAU,EAAE,CAAC,CAAC,UAAU;YACxB,UAAU,EAAE,CAAC,CAAC,UAAU;SACzB,CAAC;IACJ,CAAC;IAED,kEAAkE;IAClE,6CAA6C;IAC7C,kEAAkE;IAElE;;;;;;;;;OASG;IACI,KAAK,CAAC,iBAAiB,CAC5B,EAAyB,EACzB,SAAwB,EACxB,OAAe,EACf,WAAmB;QAEnB,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;QACpF,IAAI,CAAE,SAAiB,EAAE,0BAA0B,EAAE,CAAC;YACpD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC3B,CAAC;QAED,MAAM,YAAY,GAAI,SAAiB,CAAC,0BAA0B,CAAC;QAEnE,IAAI,YAAY,CAAC,wBAAwB,EAAE,CAAC;YAC1C,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,2CAA2C,EAAE,CAAC;QACjF,CAAC;QAED,IAAI,YAAY,CAAC,gBAAgB,EAAE,MAAM,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,gBAAgB,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;YACtG,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,wCAAwC,EAAE,CAAC;QAC9E,CAAC;QAED,IAAI,YAAY,CAAC,gBAAgB,EAAE,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;YACzD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,yCAAyC,EAAE,CAAC;QAC/E,CAAC;QAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IAED;;;OAGG;IACI,KAAK,CAAC,eAAe,CAC1B,EAAyB,EACzB,SAAwB,EACxB,OAAe,EACf,YAAsB;QAEtB,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAC/B,YAAY,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;YAC7B,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;YAC9E,OAAO,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;QAC9B,CAAC,CAAC,CACH,CAAC;QACF,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC,GAAG,EAAiB,EAAE,CAAC,GAAG,KAAK,IAAI,CAAC,CAAC;IAC9D,CAAC;IAED,kEAAkE;IAClE,2CAA2C;IAC3C,kEAAkE;IAElE;;;;;;;;;;;;;;OAcG;IACI,KAAK,CAAC,gBAAgB,CAC3B,EAAyB,EACzB,aAAuC;QAEvC,MAAM,OAAO,GAAG,aAAa,CAAC,OAAO,CAAC;QACtC,MAAM,SAAS,GAAG,aAAa,CAAC,SAAS,CAAC;QAC1C,IAAI,CAAC,OAAO,KAAK,SAAS,CAAC,KAAK,CAAC,SAAS,KAAK,SAAS,CAAC,EAAE,CAAC;YAC1D,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,SAAS,EAAE;gBAClE,sBAAsB,EAAE,2BAA2B,CAAC,4BAA4B;aACjF,CAAC,CAAC;QACL,CAAC;QAED,IAAI,aAAa,CAAC,cAAc,KAAK,iBAAiB,CAAC,UAAU,EAAE,CAAC;YAClE,IAAI,CAAC,SAAS,IAAI,CAAC,OAAO,IAAI,CAAC,aAAa,CAAC,YAAY,EAAE,CAAC;gBAC1D,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,SAAS,EAAE;oBAClE,sBAAsB,EAAE,2BAA2B,CAAC,4BAA4B;iBACjF,CAAC,CAAC;YACL,CAAC;YACD,OAAO,IAAI,CAAC,2BAA2B,CACrC,SAAS,EACT,OAAO,EACP,aAAa,CAAC,YAAY,CAC3B,CAAC;QACJ,CAAC;QAED,OAAO,IAAI,CAAC,uBAAuB,CAAC,aAAa,CAAC,WAAW,EAAE,OAAO,IAAI,SAAS,CAAC,CAAC,CAAC;YACpF,EAAE;YACF,SAAS;YACT,OAAO;SACR,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACjB,CAAC;IAED,kEAAkE;IAClE,kBAAkB;IAClB,kEAAkE;IAE1D,8BAA8B,CACpC,MAAe;QAEf,QAAQ,MAAM,EAAE,CAAC;YACf,KAAK,qBAAqB;gBACxB,OAAO,qBAAqB,CAAC;YAC/B,KAAK,MAAM;gBACT,OAAO,MAAM,CAAC;YAChB;gBACE,OAAO,oBAAoB,CAAC;QAChC,CAAC;IACH,CAAC;IAEO,mBAAmB,CACzB,eAAwC;QAExC,MAAM,IAAI,GAAG,eAAe,EAAE,aAAa,CAAC;QAC5C,IAAI,IAAI,KAAK,WAAW;YAAE,OAAO,WAAW,CAAC;QAC7C,IAAI,IAAI,KAAK,UAAU;YAAE,OAAO,UAAU,CAAC;QAC3C,OAAO,OAAO,CAAC;IACjB,CAAC;IAEO,qBAAqB,CAC3B,UAAmC,EACnC,WAAoB;QAEpB,IAAI,UAAU,CAAC,cAAc,KAAK,UAAU;YAAE,OAAO,UAAU,CAAC;QAChE,IAAI,UAAU,CAAC,cAAc,KAAK,eAAe;YAAE,OAAO,eAAe,CAAC;QAC1E,IAAI,WAAW;YAAE,OAAO,UAAU,CAAC;QACnC,OAAO,UAAU,CAAC,CAAC,0CAA0C;IAC/D,CAAC;IAEO,iBAAiB,CACvB,YAAqC;QAErC,IAAI,CAAC,YAAY,CAAC,YAAY;YAAE,OAAO,IAAI,CAAC;QAC5C,MAAM,SAAS,GAAG,YAAY,CAAC,mBAAyC,CAAC;QACzE,IAAI,SAAS,KAAK,OAAO;YAAE,OAAO,OAAO,CAAC;QAC1C,OAAO,MAAM,CAAC,CAAC,yCAAyC;IAC1D,CAAC;IAEO,mBAAmB,CACzB,kBAA2C,EAC3C,UAAoC;QAEpC,MAAM,OAAO,GAAG,kBAAkB,IAAI,EAAE,CAAC;QACzC,OAAO;YACL,EAAE,EAAE,OAAO,CAAC,EAAE,IAAI,KAAK;YACvB,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,OAAO;YAC/B,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,MAAM;YAC5B,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,SAAS;YACjC,aAAa,EAAE,OAAO,CAAC,aAAa,IAAI,gBAAgB;YACxD,6EAA6E;YAC7E,SAAS,EAAE,UAAU,EAAE,cAAoC;YAC3D,QAAQ,EAAE,UAAU,EAAE,aAAmC;SAC1D,CAAC;IACJ,CAAC;CAEF,CAAA;AAl0BY,sCAAsC;IADlD,UAAU,EAAE;IAKR,WAAA,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAA;IACjC,WAAA,MAAM,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,CAAA;IAC3C,WAAA,MAAM,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,CAAA;IAC9C,WAAA,MAAM,CAAC,kBAAkB,CAAC,gCAAgC,CAAC,CAAA;IAC3D,WAAA,MAAM,CAAC,kBAAkB,CAAC,oCAAoC,CAAC,CAAA;IAC/D,WAAA,MAAM,CAAC,kBAAkB,CAAC,oBAAoB,CAAC,CAAA;qCALY,aAAa;QACO,uBAAuB;QACxB,0BAA0B;QACA,uCAAuC;QAC5C,oCAAoC;QACvD,2BAA2B;GATnG,sCAAsC,CAk0BlD","sourcesContent":["/**\n * OAuth2ConnectionResolverBackendService\n *\n * Resolves OAuth2 connection configurations from multiple sources:\n * - Provider definitions from the backend provider registry\n * - App-specific social OAuth2 config from AppConfiguration.auth.socialOAuth2Providers\n * - Client credentials from AppConfiguration.providerConfigurations + secrets\n *\n * Produces an `OAuth2ResolvedConnection` — the canonical input for the OAuth2 engine.\n *\n * Step 4: Implements `resolveSocialConnection()` (fully functional)\n * Step 15: Implements `resolveEnterpriseConnection()` (template/discovery/manual branching)\n *\n * Browser-only OAuth2 / SAML callback model. The redirect URI derived from\n * `runtime.endPoints.main_backend_api.publicUrl` is the OAuth2 callback URL\n * registered at IdPs; the framework targets web stacks exclusively, so\n * there is no native deep-link variant to account for here.\n */\n\nimport 'reflect-metadata';\nimport { injectable, inject } from 'inversify';\nimport { SAAS_SERVICE_TYPES } from '~wildo-backend-lib/inject/models/service-types';\nimport { LoggerService } from '~wildo-backend-lib/monitoring/logger/services/logger.service';\nimport { AppConfigurationService } from '~wildo-backend-lib/config/services/app-configuration.backend.service';\nimport { ErrorBuilderBackendService } from '~wildo-backend-lib/errors/services/error-builder.backend.service';\nimport { ExternalProvidersRegistryBackendService } from '~wildo-backend-lib/external-providers/services/external-providers-registry.backend.service';\nimport { AuthOrganizationConfigurationService } from '~wildo-backend-lib/security/authentications/services/admin-config/auth-organization-configuration.service';\nimport { OIDCDiscoveryBackendService } from '~wildo-backend-lib/security/authentications/services/admin-config/oidc-discovery.backend.service';\nimport {\n  ErrorType,\n  ErrorCustomMessageReference,\n  AuthScopeType,\n  ExternalIdentitySource,\n  SSOPKCEMethod,\n  SSOTemplateMode,\n  SsoConnectionType,\n  SsoProtocol,\n  isWildoBackendError,\n} from '@wildo-ai/saas-models';\nimport type {\n  OAuth2ResolvedConnection,\n  OAuth2ProfileMapping,\n  OAuth2StateTokenMetadata,\n} from '~wildo-backend-lib/security/authentications/models/oauth2-connection.backend.schemas';\nimport { buildEnterpriseConnectionScope } from '~wildo-backend-lib/security/authentications/models/sso-connection.backend.schemas';\nimport type { ExecutionContext } from '~wildo-backend-lib/runtime/models/execution-context.backend.schemas';\nimport jwt from 'jsonwebtoken';\nimport { ExternalProvider_ExchangeProtocol_Kind } from '@wildo-ai/external-connectors-models';\nimport { isSocialOAuth2LoginPurpose } from '~wildo-backend-lib/security/authentications/utils/social-oauth2-purpose.backend.utils';\n\n// ═══════════════════════════════════════════════════════════════\n// Signed JWT Client Secret — Generic (extensions-driven)\n// ═══════════════════════════════════════════════════════════════\n\ninterface SignedJwtClientSecretParams {\n  privateKey: string;\n  keyId: string;\n  teamId: string;\n  clientId: string;\n  algorithm: string;\n  audience: string;\n  maxLifetimeSeconds: number;\n}\n\nconst signedJwtCache = new Map<string, { jwt: string; expiresAt: number }>();\nconst SIGNED_JWT_CACHE_SKEW_MS = 5 * 60 * 1000;\nconst OAUTH2_PROVIDER_CONFIG_KEY = 'sso_oauth2';\n\ninterface OAuth2SsoRuntimeContract {\n  kind: 'oauth2-sso';\n  authorizationEndpoint: string;\n  tokenEndpoint: string;\n  userInfoEndpoint?: string;\n  jwksUri?: string;\n  issuer?: string;\n  scopes: ReadonlyArray<string>;\n  clientIdPublicConfigKey?: string;\n  clientSecretRef: string;\n  supportsPkce: boolean;\n  supportsOidc: boolean;\n  tokenEndpointAuthMethod?: 'client_secret_post' | 'client_secret_basic' | 'none';\n  responseMode?: 'query' | 'fragment' | 'form_post';\n  identitySource?: 'userinfo' | 'id_token' | 'callback_body';\n  profileMapping?: OAuth2ProfileMapping;\n  extraAuthParams?: Record<string, string>;\n  extraTokenParams?: Record<string, string>;\n  tokenRequestHeaders?: Record<string, string>;\n  extensions?: Record<string, unknown>;\n}\n\n/**\n * Generic OIDC profile-mapping default — used when a provider's\n * `runtimeContract.profileMapping` is absent. All four engine-shipped social\n * OAuth2 providers (`google`, `microsoft`, `apple`, `github`) declare their\n * own `profileMapping` on the runtime contract, so this default exists only\n * to keep the resolver total for app-contributed OIDC providers that follow\n * the standard claim names.\n *\n * Per-provider behavior MUST live in the provider module's runtime contract,\n * not branched here on `providerRef`.\n */\nconst GENERIC_OIDC_PROFILE_MAPPING: OAuth2ProfileMapping = {\n  id: 'sub',\n  email: 'email',\n  firstName: 'given_name',\n  lastName: 'family_name',\n  name: 'name',\n  image: 'picture',\n  emailVerified: 'email_verified',\n};\n\nfunction getOrGenerateSignedJwtClientSecret(\n  providerRef: string,\n  clientId: string,\n  params: SignedJwtClientSecretParams,\n): string {\n  const cacheKey = [\n    providerRef,\n    clientId,\n    params.keyId,\n    params.teamId,\n    params.algorithm,\n    params.audience,\n    params.maxLifetimeSeconds,\n  ].join(':');\n  const cached = signedJwtCache.get(cacheKey);\n  if (cached && cached.expiresAt > Date.now()) {\n    return cached.jwt;\n  }\n\n  const issuedAt = Date.now();\n  const token = jwt.sign({}, params.privateKey, {\n    algorithm: params.algorithm as jwt.Algorithm,\n    keyid: params.keyId,\n    issuer: params.teamId,\n    audience: params.audience,\n    subject: params.clientId,\n    expiresIn: params.maxLifetimeSeconds,\n  });\n\n  const tokenTtlMs = Math.max(0, params.maxLifetimeSeconds * 1000 - SIGNED_JWT_CACHE_SKEW_MS);\n  signedJwtCache.set(cacheKey, { jwt: token, expiresAt: issuedAt + tokenTtlMs });\n  return token;\n}\n\n/**\n * Resolves OAuth2 connection configurations for social and enterprise SSO.\n * The engine (OAuth2AuthenticationBackendService) never reads from provider catalogs\n * or AppConfiguration directly — it only operates on OAuth2ResolvedConnection.\n */\n@injectable()\nexport class OAuth2ConnectionResolverBackendService {\n  private readonly logDebug: (message: string, context?: Record<string, unknown>) => void;\n\n  constructor(\n    @inject(SAAS_SERVICE_TYPES.Logger) private readonly logger: LoggerService,\n    @inject(SAAS_SERVICE_TYPES.AppConfigService) private readonly appConfigService: AppConfigurationService,\n    @inject(SAAS_SERVICE_TYPES.ErrorBuilderService) private readonly errorBuilder: ErrorBuilderBackendService,\n    @inject(SAAS_SERVICE_TYPES.ExternalProvidersRegistryService) private readonly externalProvidersRegistry: ExternalProvidersRegistryBackendService,\n    @inject(SAAS_SERVICE_TYPES.AuthOrganizationConfigurationService) private readonly orgConfigService: AuthOrganizationConfigurationService,\n    @inject(SAAS_SERVICE_TYPES.OIDCDiscoveryService) private readonly oidcDiscovery: OIDCDiscoveryBackendService,\n  ) {\n    this.logDebug = this.logger.debugByType('OAuth2ConnectionResolver');\n    this.logger.setDebugTypeLogging('OAuth2ConnectionResolver', false);\n  }\n\n  // ═══════════════════════════════════════════════════════════════\n  // Social Connection Resolution\n  // ═══════════════════════════════════════════════════════════════\n\n  /**\n   * Resolve a social SSO connection from the provider catalog + app config + secrets.\n   *\n   * Resolution chain:\n   * 1. Look up provider definition from the backend provider registry\n   * 2. Find the SSO_OAUTH2 protocol on the provider\n   * 3. Read app-specific social OAuth2 config from auth.socialOAuth2Providers[providerRef]\n   * 4. Read OAuth2 credentials from providerConfigurations[providerRef][sso_oauth2]\n   * 5. Resolve clientSecret from secrets store (app-level baseline)\n   * 5b. Check for org/app-level social credential overrides (P3)\n   * 5c. Generate signed-JWT client secret if provider requires it (e.g. Apple)\n   * 6. Derive redirectUri from publicUrl\n   * 7. Map profile fields, scopes, PKCE, response mode, identity source\n   *\n   * ORDERING CONSTRAINT (5b before 5c):\n   * Override credentials (5b) MUST be resolved before signed-JWT generation (5c).\n   * For providers like Apple, `clientSecret` is a raw private key that needs JWT signing.\n   * If 5c ran first, the override would replace the generated JWT with a raw key,\n   * causing the token exchange to fail at the IdP. By running 5b first, whichever\n   * private key is active (app-level or override) goes through JWT signing in 5c.\n   *\n   * @param providerRef - Provider identifier (e.g. 'google', 'apple')\n   * @param options.ec - Execution context, required when scopeId is set\n   * @param options.scopeType - 'organization' or 'application' (defaults to 'organization')\n   * @param options.scopeId - Org/app ID to check for credential overrides in SsoConfig\n   */\n  public async resolveSocialConnection(\n    providerRef: string,\n    options?: { ec?: ExecutionContext<any>; scopeType?: AuthScopeType; scopeId?: string },\n  ): Promise<OAuth2ResolvedConnection> {\n    this.logDebug('Resolving social connection', { providerRef, scopeId: options?.scopeId });\n\n    // 1. Look up provider OAuth2 runtime contract from the effective runtime registry.\n    const oauth2Contract = this.getOAuth2RuntimeContract(providerRef);\n    if (oauth2Contract?.kind !== 'oauth2-sso') {\n      throw this.errorBuilder.buildError(ErrorType.NOT_FOUND, undefined, {\n        customMessageReference: ErrorCustomMessageReference.OAUTH_PROVIDER_NOT_FOUND,\n      });\n    }\n\n    try {\n      if (!this.externalProvidersRegistry.isProviderEnabled(providerRef, ExternalProvider_ExchangeProtocol_Kind.SSO_OAUTH2)) {\n        throw this.errorBuilder.buildError(ErrorType.CONFIGURATION, undefined, {\n          customMessageReference: ErrorCustomMessageReference.APP_CONFIGURATION_NOT_INITIALIZED,\n          context: { message: `OAuth2 provider '${providerRef}' is restricted by external provider policy` },\n        });\n      }\n    } catch (error) {\n      if (isWildoBackendError(error)) throw error;\n      this.logDebug('External provider policy not initialized for OAuth2 provider check; falling back to auth.socialOAuth2Providers', {\n        providerRef,\n      });\n    }\n\n    // 3. Read app-specific social OAuth2 config\n    const appConfig = this.appConfigService.config;\n    const socialOAuth2ProviderConfig = appConfig.auth?.socialOAuth2Providers?.[providerRef];\n    if (!socialOAuth2ProviderConfig || socialOAuth2ProviderConfig.enabled === false) {\n      throw this.errorBuilder.buildError(ErrorType.CONFIGURATION, undefined, {\n        customMessageReference: ErrorCustomMessageReference.APP_CONFIGURATION_NOT_INITIALIZED,\n        context: { message: `Social OAuth2 provider '${providerRef}' is not enabled in app configuration` },\n      });\n    }\n    if (!isSocialOAuth2LoginPurpose(socialOAuth2ProviderConfig.purpose)) {\n      throw this.errorBuilder.buildError(ErrorType.CONFIGURATION, undefined, {\n        customMessageReference: ErrorCustomMessageReference.APP_CONFIGURATION_NOT_INITIALIZED,\n        context: { message: `Social OAuth2 provider '${providerRef}' is not configured for user sign-in` },\n      });\n    }\n\n    // 4. Read OAuth2 credentials from providerConfigurations\n    const providerConfigs = appConfig.providerConfigurations?.[providerRef];\n    const protocolConfig = providerConfigs?.[OAUTH2_PROVIDER_CONFIG_KEY] as Record<string, any> | undefined;\n\n    let clientId = protocolConfig?.authConfig?.clientId\n      || protocolConfig?.clientId\n      || (oauth2Contract.clientIdPublicConfigKey ? protocolConfig?.[oauth2Contract.clientIdPublicConfigKey] : undefined);\n\n    if (!clientId) {\n      throw this.errorBuilder.buildError(ErrorType.CONFIGURATION, undefined, {\n        customMessageReference: ErrorCustomMessageReference.APP_CONFIGURATION_NOT_INITIALIZED,\n        context: { message: `Missing clientId for OAuth2 provider '${providerRef}'` },\n      });\n    }\n\n    // 5. Resolve clientSecret from env-provided provider secret material\n    const secretRef = protocolConfig?.authConfig?.secretRef || oauth2Contract.clientSecretRef;\n    let clientSecret = '';\n\n    if (secretRef) {\n      clientSecret = this.externalProvidersRegistry.getProviderSecret(\n        providerRef,\n        OAUTH2_PROVIDER_CONFIG_KEY as any,\n        secretRef,\n      ) || '';\n    }\n\n    if (!clientSecret) {\n      throw this.errorBuilder.buildError(ErrorType.CONFIGURATION, undefined, {\n        customMessageReference: ErrorCustomMessageReference.APP_CONFIGURATION_NOT_INITIALIZED,\n        context: { message: `Missing env-provided clientSecret for OAuth2 provider '${providerRef}'. Check env secretRef '${secretRef}'.` },\n      });\n    }\n\n    // 5b. Scope-level social credential overrides (P3).\n    // An org/app can override the platform-level clientId + clientSecret with their own\n    // OAuth2 app credentials (stored in SsoConfig.socialCredentialOverrides).\n    //\n    // MUST run BEFORE step 5c (signed-JWT generation). For providers like Apple, the\n    // override's clientSecret is a raw private key that still needs JWT signing.\n    // signedJwtKeyId/signedJwtTeamId are captured here and consumed in step 5c.\n    let overrideSignedJwtKeyId: string | undefined;\n    let overrideSignedJwtTeamId: string | undefined;\n    if (options?.scopeId && options.ec) {\n      const scopeType = options.scopeType || AuthScopeType.ORGANIZATION;\n      try {\n        const ssoConfig = await this.orgConfigService.loadSSOConfig(options.ec, scopeType, options.scopeId);\n        const overrides = ssoConfig?.socialCredentialOverrides;\n        const override = overrides?.find(o => o.providerRef === providerRef);\n        if (override) {\n          clientId = override.clientId;\n          clientSecret = override.clientSecret;\n          overrideSignedJwtKeyId = override.signedJwtKeyId;\n          overrideSignedJwtTeamId = override.signedJwtTeamId;\n          this.logDebug('Social credentials overridden by scope config', {\n            providerRef, scopeType, scopeId: options.scopeId,\n          });\n        }\n      } catch (err) {\n        if (!isWildoBackendError(err)) throw err;\n        this.logDebug('Scope SSO config not found for credential override (non-fatal)', {\n          providerRef, scopeType, scopeId: options.scopeId,\n        });\n      }\n    }\n\n    // 5c. Signed JWT client secret generation.\n    // Some providers (e.g. Apple) don't accept a static client secret — they require a\n    // short-lived JWT signed with a private key. The provider's extensions declare this\n    // via clientSecretType='signed_jwt'.\n    //\n    // At this point, `clientSecret` holds either the app-level or overridden private key\n    // (determined by step 5b). The JWT params (teamId, keyId) are resolved with a\n    // fallback chain: override values from step 5b → app-level secrets store.\n    const extensions = oauth2Contract.extensions ?? {};\n    if (extensions.clientSecretType === 'signed_jwt') {\n      const algorithm = String(extensions.clientSecretAlgorithm ?? 'ES256');\n      const audience = String(extensions.clientSecretAudience ?? 'https://appleid.apple.com');\n      const maxLifetimeSeconds = Number(extensions.clientSecretMaxLifetimeSeconds ?? 60 * 60 * 24 * 180);\n      const teamIdRef = String(extensions.teamIdSecretRef ?? `${providerRef.toUpperCase()}_TEAM_ID`);\n      const keyIdRef = String(extensions.keyIdSecretRef ?? `${providerRef.toUpperCase()}_KEY_ID`);\n      const teamId = overrideSignedJwtTeamId || this.externalProvidersRegistry.getProviderSecret(\n        providerRef,\n        OAUTH2_PROVIDER_CONFIG_KEY as any,\n        teamIdRef,\n      );\n      const keyId = overrideSignedJwtKeyId || this.externalProvidersRegistry.getProviderSecret(\n        providerRef,\n        OAUTH2_PROVIDER_CONFIG_KEY as any,\n        keyIdRef,\n      );\n\n      if (!teamId || !keyId) {\n        const missing = [!teamId ? teamIdRef : '', !keyId ? keyIdRef : ''].filter(Boolean).join(', ');\n        throw this.errorBuilder.buildError(ErrorType.CONFIGURATION, undefined, {\n          customMessageReference: ErrorCustomMessageReference.APP_CONFIGURATION_NOT_INITIALIZED,\n          context: { message: `Provider '${providerRef}' requires signed JWT client secret. Missing secrets: ${missing}` },\n        });\n      }\n\n      clientSecret = getOrGenerateSignedJwtClientSecret(\n        providerRef,\n        clientId,\n        { privateKey: clientSecret, keyId, teamId, clientId, algorithm, audience, maxLifetimeSeconds },\n      );\n      this.logDebug('Generated signed JWT client secret', { providerRef, algorithm, audience });\n    }\n\n    // 6. Derive redirectUri from publicUrl (TRAP 14: publicUrl is optional)\n    const publicUrl = appConfig.runtime?.endPoints?.main_backend_api?.publicUrl;\n    if (!publicUrl) {\n      throw this.errorBuilder.buildError(ErrorType.CONFIGURATION, undefined, {\n        customMessageReference: ErrorCustomMessageReference.APP_CONFIGURATION_NOT_INITIALIZED,\n        context: { message: 'runtime.endPoints.main_backend_api.publicUrl is required for OAuth2 redirect URI derivation' },\n      });\n    }\n    const redirectUri = `${publicUrl}/api/v1/auth/oauth2/callback/${providerRef}`;\n\n    // 7. Build the resolved connection\n    const tokenEndpointAuthMethod = this.resolveTokenEndpointAuthMethod(\n      protocolConfig?.tokenEndpointAuthMethod ?? oauth2Contract.tokenEndpointAuthMethod,\n    );\n    const responseMode = oauth2Contract.responseMode ?? this.resolveResponseMode({\n      ...oauth2Contract.extraAuthParams,\n      ...protocolConfig?.extraAuthParams,\n    });\n    const identitySource = oauth2Contract.identitySource\n      ?? this.resolveIdentitySource(extensions, oauth2Contract.userInfoEndpoint);\n    const pkceMethod = oauth2Contract.supportsPkce ? 'S256' : null;\n\n    // Scopes: provider defaults + app-specific additional scopes\n    const defaultScopes = oauth2Contract.scopes || [];\n    const additionalScopes = socialOAuth2ProviderConfig.additionalScopes || [];\n    const scopes = [...new Set([...defaultScopes, ...additionalScopes])];\n\n    // Profile mapping\n    const profileMapping = oauth2Contract.profileMapping ?? GENERIC_OIDC_PROFILE_MAPPING;\n\n    // Extra parameters\n    const extraAuthParams = {\n      ...(oauth2Contract.extraAuthParams || {}),\n      ...(protocolConfig?.extraAuthParams || {}),\n    };\n    const extraTokenParams = {\n      ...(oauth2Contract.extraTokenParams || {}),\n      ...(protocolConfig?.extraTokenParams || {}),\n    };\n    const tokenRequestHeaders = {\n      ...(oauth2Contract.tokenRequestHeaders || {}),\n      ...(protocolConfig?.tokenRequestHeaders || {}),\n    };\n    const resolvedExtensions = {\n      ...extensions,\n      ...(protocolConfig?.extensions || {}),\n    };\n\n    // Issuer and JWKS for ID token validation\n    const issuer = oauth2Contract.issuer;\n    const jwksUri = oauth2Contract.jwksUri;\n\n    const connection: OAuth2ResolvedConnection = {\n      source: oauth2Contract.supportsOidc\n        ? ExternalIdentitySource.OIDC\n        : ExternalIdentitySource.OAUTH2,\n      connectionType: SsoConnectionType.SOCIAL,\n      providerRef,\n      displayName: socialOAuth2ProviderConfig.displayName || providerRef,\n      authorizationUrl: oauth2Contract.authorizationEndpoint,\n      tokenUrl: oauth2Contract.tokenEndpoint,\n      userInfoUrl: oauth2Contract.userInfoEndpoint,\n      redirectUri,\n      issuer,\n      jwksUri,\n      clientId,\n      clientSecret,\n      tokenEndpointAuthMethod,\n      scopes,\n      pkceMethod,\n      responseMode,\n      identitySource,\n      profileMapping,\n      extraAuthParams: Object.keys(extraAuthParams).length > 0 ? extraAuthParams : undefined,\n      extraTokenParams: Object.keys(extraTokenParams).length > 0 ? extraTokenParams : undefined,\n      tokenRequestHeaders: Object.keys(tokenRequestHeaders).length > 0 ? tokenRequestHeaders : undefined,\n      extensions: Object.keys(resolvedExtensions).length > 0 ? resolvedExtensions : undefined,\n    };\n\n    this.logDebug('Social connection resolved', {\n      providerRef,\n      connectionType: SsoConnectionType.SOCIAL,\n      responseMode,\n      identitySource,\n      pkceMethod,\n      scopeCount: scopes.length,\n    });\n\n    return connection;\n  }\n\n  // ═══════════════════════════════════════════════════════════════\n  // Enterprise Connection Resolution (Step 15)\n  // ═══════════════════════════════════════════════════════════════\n\n  /**\n   * Resolve an enterprise SSO connection from scope-level OIDC configuration.\n   *\n   * Branches on `templateMode`:\n   * - **template**: Load provider definition from the backend provider registry,\n   *   extract SSO_OAUTH2 protocol, apply templateOverrides to URLs\n   * - **discovery**: Call OIDCDiscoveryService.discoverEndpoints(issuer)\n   * - **manual**: Use provided endpoints directly\n   *\n   * The result is an OAuth2ResolvedConnection with\n   * `connectionType: SsoConnectionType.ENTERPRISE`.\n   * The OAuth2 engine (buildAuthorizationUrl, handleCallback, fetchUserProfile) is\n   * reused unchanged — only the resolver logic is different.\n   */\n  public async resolveEnterpriseConnection(\n    scopeType: AuthScopeType,\n    scopeId: string,\n    connectionId: string,\n  ): Promise<OAuth2ResolvedConnection> {\n    this.logDebug('Resolving enterprise connection', { scopeType, scopeId, connectionId });\n\n    // 1. Load the SsoConnection resource by connectionId.\n    //    This runs PRE-AUTH (enterprise SSO login initiation — no user is\n    //    authenticated yet), so the connection is read through the system-access\n    //    path: the caller holds no ORG_ADMIN / APP_ADMIN role the connection's\n    //    READ ACL demands. `loadSsoConnectionAsSystem` bypasses that ACL under the\n    //    connection resource's `systemAccessPolicy.read = ALLOWED` opt-in\n    //    (fail-closed + audited). See AuthOrganizationConfigurationService.\n    const ssoConnection = await this.orgConfigService.loadSsoConnectionAsSystem(scopeType, scopeId, connectionId);\n\n    if (!ssoConnection || !ssoConnection.enabled) {\n      throw this.errorBuilder.buildError(ErrorType.NOT_FOUND, undefined, {\n        customMessageReference: ErrorCustomMessageReference.SSO_CONNECTION_NOT_FOUND,\n      });\n    }\n\n    // 2. SAML connections use a separate authentication flow — reject if this is a SAML connection\n    if (ssoConnection.protocol === SsoProtocol.SAML) {\n      throw this.errorBuilder.buildError(ErrorType.CONFIGURATION, undefined, {\n        customMessageReference: ErrorCustomMessageReference.APP_CONFIGURATION_NOT_INITIALIZED,\n        context: { message: 'SAML connections use the SAML authentication flow, not the OAuth2 resolver. Use /auth/saml/login/:connectionId instead.' },\n      });\n    }\n\n    if (!ssoConnection.oidc) {\n      throw this.errorBuilder.buildError(ErrorType.CONFIGURATION, undefined, {\n        customMessageReference: ErrorCustomMessageReference.APP_CONFIGURATION_NOT_INITIALIZED,\n        context: { message: `SSO connection '${connectionId}' has protocol 'oidc' but no OIDC configuration object.` },\n      });\n    }\n\n    // 3. Build a flattened config view for the downstream resolution methods\n    const oidcConfig: Record<string, any> = {\n      ...ssoConnection.oidc,\n      externalProviderId: ssoConnection.externalProviderId,\n      displayName: ssoConnection.displayName,\n      allowedDomains: ssoConnection.allowedDomains,\n      autoCreateUsers: ssoConnection.autoCreateUsers,\n      autoVerifyEmail: ssoConnection.autoVerifyEmail,\n      defaultRole: ssoConnection.defaultRole,\n      roleMapping: ssoConnection.roleMapping,\n      groupMapping: ssoConnection.groupMapping,\n    };\n\n    // 4. Resolve endpoints based on templateMode\n    const templateMode = oidcConfig.templateMode || SSOTemplateMode.MANUAL;\n    let authorizationUrl: string;\n    let tokenUrl: string;\n    let userInfoUrl: string | undefined;\n    let jwksUri: string | undefined;\n    let endSessionEndpoint: string | undefined;\n    let issuer: string | undefined;\n    let scopes: string[];\n    let extraAuthParams: Record<string, string> | undefined;\n    let pkceMethod: OAuth2ResolvedConnection['pkceMethod'] = oidcConfig.pkceEnabled\n      ? (\n        oidcConfig.pkceMethod === SSOPKCEMethod.PLAIN\n          ? SSOPKCEMethod.PLAIN\n          : SSOPKCEMethod.S256\n      )\n      : null;\n\n    switch (templateMode) {\n      case SSOTemplateMode.TEMPLATE:\n        ({ authorizationUrl, tokenUrl, userInfoUrl, jwksUri, endSessionEndpoint, issuer, scopes, extraAuthParams, pkceMethod } =\n          await this.resolveFromTemplate(oidcConfig, pkceMethod));\n        break;\n\n      case SSOTemplateMode.DISCOVERY:\n        ({ authorizationUrl, tokenUrl, userInfoUrl, jwksUri, endSessionEndpoint, issuer, scopes } =\n          await this.resolveFromDiscovery(oidcConfig));\n        break;\n\n      case SSOTemplateMode.MANUAL:\n      default:\n        ({ authorizationUrl, tokenUrl, userInfoUrl, jwksUri, endSessionEndpoint, issuer, scopes } =\n          this.resolveFromManual(oidcConfig));\n        break;\n    }\n\n    // 4. Derive redirectUri from publicUrl\n    const publicUrl = this.appConfigService.config.runtime?.endPoints?.main_backend_api?.publicUrl;\n    if (!publicUrl) {\n      throw this.errorBuilder.buildError(ErrorType.CONFIGURATION, undefined, {\n        customMessageReference: ErrorCustomMessageReference.APP_CONFIGURATION_NOT_INITIALIZED,\n        context: { message: 'runtime.endPoints.main_backend_api.publicUrl is required for OAuth2 redirect URI derivation' },\n      });\n    }\n    const providerRef = oidcConfig.externalProviderId || 'enterprise-oidc';\n    const redirectUri = `${publicUrl}/api/v1/auth/oauth2/callback/${providerRef}`;\n\n    // 5. Map org claimsMapping → canonical profileMapping\n    const profileMapping = this.buildEnterpriseProfileMapping(oidcConfig.claimsMapping);\n\n    // 6. Build response mode\n    const responseMode = oidcConfig.responseMode || 'query';\n\n    // 7. Assemble OAuth2ResolvedConnection\n    const connection: OAuth2ResolvedConnection = {\n      source: ExternalIdentitySource.OIDC,\n      connectionType: SsoConnectionType.ENTERPRISE,\n      providerRef,\n      displayName: oidcConfig.displayName,\n      authorizationUrl,\n      tokenUrl,\n      userInfoUrl,\n      redirectUri,\n      issuer,\n      jwksUri,\n      clientId: oidcConfig.clientId,\n      clientSecret: oidcConfig.clientSecret,\n      tokenEndpointAuthMethod: 'client_secret_post',\n      scopes,\n      pkceMethod,\n      responseMode: responseMode as 'query' | 'fragment' | 'form_post',\n      identitySource: userInfoUrl ? 'userinfo' : 'id_token',\n      profileMapping,\n      extraAuthParams,\n      scope: buildEnterpriseConnectionScope(scopeType, scopeId, connectionId),\n      // Build the provisioning config ONCE here (the single source), so the callback passes it\n      // straight to provisionEnterpriseUser with no per-field re-copy. Defaults are centralised (the loose\n      // per-field copies previously diverged — OAuth2 omitted the `allowedDomains` fallback).\n      provisioningConfig: {\n        autoCreateUsers: oidcConfig.autoCreateUsers ?? true,\n        autoVerifyEmail: oidcConfig.autoVerifyEmail ?? true,\n        defaultRole: oidcConfig.defaultRole,\n        roleMapping: oidcConfig.roleMapping,\n        groupMapping: oidcConfig.groupMapping,\n        allowedDomains: oidcConfig.allowedDomains ?? [],\n      },\n    };\n\n    this.logDebug('Enterprise connection resolved', {\n      scopeType,\n      scopeId,\n      connectionId,\n      templateMode,\n      providerRef,\n      hasUserInfoUrl: !!userInfoUrl,\n    });\n\n    return connection;\n  }\n\n  // ═══════════════════════════════════════════════════════════════\n  // Enterprise Resolution Strategies\n  // ═══════════════════════════════════════════════════════════════\n\n  /**\n   * Template mode: Load provider OAuth2 runtime contract and apply org overrides.\n   * Example: Microsoft Azure AD — load Microsoft provider template, substitute {tenant} in URLs.\n   */\n  private async resolveFromTemplate(\n    oidcConfig: Record<string, any>,\n    defaultPkceMethod: 'S256' | 'plain' | null,\n  ): Promise<{\n    authorizationUrl: string; tokenUrl: string; userInfoUrl?: string;\n    jwksUri?: string; endSessionEndpoint?: string; issuer?: string;\n    scopes: string[]; extraAuthParams?: Record<string, string>;\n    pkceMethod: 'S256' | 'plain' | null;\n  }> {\n    const externalProviderId = oidcConfig.externalProviderId;\n    if (!externalProviderId) {\n      throw this.errorBuilder.buildError(ErrorType.CONFIGURATION, undefined, {\n        customMessageReference: ErrorCustomMessageReference.APP_CONFIGURATION_NOT_INITIALIZED,\n        context: { message: 'templateMode=template requires externalProviderId' },\n      });\n    }\n\n    const oauth2Contract = this.getOAuth2RuntimeContract(externalProviderId);\n    if (!oauth2Contract) {\n      throw this.errorBuilder.buildError(ErrorType.NOT_FOUND, undefined, {\n        customMessageReference: ErrorCustomMessageReference.OAUTH_PROVIDER_NOT_FOUND,\n      });\n    }\n\n    const templateOverrides = oidcConfig.templateOverrides || {};\n\n    // Apply template variable substitution to endpoint URLs\n    const authorizationUrl = this.oidcDiscovery.resolveTemplateUrl(oauth2Contract.authorizationEndpoint || '', templateOverrides);\n    const tokenUrl = this.oidcDiscovery.resolveTemplateUrl(oauth2Contract.tokenEndpoint || '', templateOverrides);\n    const userInfoUrl = oauth2Contract.userInfoEndpoint\n      ? this.oidcDiscovery.resolveTemplateUrl(oauth2Contract.userInfoEndpoint, templateOverrides)\n      : undefined;\n    const jwksUri = oauth2Contract.jwksUri\n      ? this.oidcDiscovery.resolveTemplateUrl(oauth2Contract.jwksUri, templateOverrides)\n      : undefined;\n    const endSessionEndpoint = undefined; // Discovery would need to be fetched for this\n\n    // Resolve issuer from discovery URL template\n    const issuer = oauth2Contract.issuer\n      ? this.oidcDiscovery.resolveTemplateUrl(oauth2Contract.issuer, templateOverrides)\n      : undefined;\n\n    // Scopes: template defaults + org custom scopes\n    const defaultScopes = oauth2Contract.scopes || ['openid', 'email', 'profile'];\n    const customScopes = oidcConfig.customScopes || [];\n    const scopes = [...new Set([...defaultScopes, ...oidcConfig.scopes, ...customScopes])];\n\n    // Extra auth params from template + overrides\n    let extraAuthParams: Record<string, string> | undefined;\n    const templateExtraAuthParams = {\n      ...(oauth2Contract.extraAuthParams || {}),\n      ...(oidcConfig.extraAuthParams || {}),\n    };\n    if (Object.keys(templateExtraAuthParams).length > 0) {\n      extraAuthParams = this.oidcDiscovery.resolveTemplateParams(templateExtraAuthParams, templateOverrides);\n    }\n\n    // PKCE from template capabilities\n    const pkceMethod = oauth2Contract.supportsPkce ? 'S256' as const : defaultPkceMethod;\n\n    return { authorizationUrl, tokenUrl, userInfoUrl, jwksUri, endSessionEndpoint, issuer, scopes, extraAuthParams, pkceMethod };\n  }\n\n  /**\n   * Discovery mode: Auto-discover endpoints from .well-known/openid-configuration.\n   * Used for Okta, Auth0, and generic OIDC providers.\n   */\n  private async resolveFromDiscovery(\n    oidcConfig: Record<string, any>,\n  ): Promise<{\n    authorizationUrl: string; tokenUrl: string; userInfoUrl?: string;\n    jwksUri?: string; endSessionEndpoint?: string; issuer?: string;\n    scopes: string[];\n  }> {\n    const issuerUrl = oidcConfig.issuer || oidcConfig.discoveryUrl?.replace('/.well-known/openid-configuration', '');\n    if (!issuerUrl) {\n      throw this.errorBuilder.buildError(ErrorType.CONFIGURATION, undefined, {\n        customMessageReference: ErrorCustomMessageReference.APP_CONFIGURATION_NOT_INITIALIZED,\n        context: { message: 'templateMode=discovery requires issuer or discoveryUrl' },\n      });\n    }\n\n    const doc = await this.oidcDiscovery.discoverEndpoints(issuerUrl);\n\n    const customScopes = oidcConfig.customScopes || [];\n    const scopes = [...new Set([...oidcConfig.scopes, ...customScopes])];\n\n    return {\n      authorizationUrl: doc.authorization_endpoint,\n      tokenUrl: doc.token_endpoint,\n      userInfoUrl: doc.userinfo_endpoint,\n      jwksUri: doc.jwks_uri,\n      endSessionEndpoint: doc.end_session_endpoint,\n      issuer: doc.issuer,\n      scopes,\n    };\n  }\n\n  private getOAuth2RuntimeContract(providerRef: string): OAuth2SsoRuntimeContract | undefined {\n    const protocolConfig = this.externalProvidersRegistry.getProviderConfiguration(\n      providerRef,\n      ExternalProvider_ExchangeProtocol_Kind.SSO_OAUTH2,\n    ) as Record<string, any> | undefined;\n\n    return protocolConfig?.runtimeContract?.kind === 'oauth2-sso'\n      ? protocolConfig.runtimeContract as OAuth2SsoRuntimeContract\n      : undefined;\n  }\n\n  /**\n   * Manual mode: Use all provided endpoints directly (backward-compatible).\n   */\n  private resolveFromManual(\n    oidcConfig: Record<string, any>,\n  ): {\n    authorizationUrl: string; tokenUrl: string; userInfoUrl?: string;\n    jwksUri?: string; endSessionEndpoint?: string; issuer?: string;\n    scopes: string[];\n  } {\n    if (!oidcConfig.authorizationEndpoint || !oidcConfig.tokenEndpoint) {\n      throw this.errorBuilder.buildError(ErrorType.CONFIGURATION, undefined, {\n        customMessageReference: ErrorCustomMessageReference.APP_CONFIGURATION_NOT_INITIALIZED,\n        context: { message: 'templateMode=manual requires authorizationEndpoint and tokenEndpoint' },\n      });\n    }\n\n    const customScopes = oidcConfig.customScopes || [];\n    const scopes = [...new Set([...oidcConfig.scopes, ...customScopes])];\n\n    return {\n      authorizationUrl: oidcConfig.authorizationEndpoint,\n      tokenUrl: oidcConfig.tokenEndpoint,\n      userInfoUrl: oidcConfig.userInfoEndpoint,\n      jwksUri: oidcConfig.jwksUri,\n      endSessionEndpoint: oidcConfig.endSessionEndpoint,\n      issuer: oidcConfig.issuer,\n      scopes,\n    };\n  }\n\n  /**\n   * Build the canonical `OAuth2ProfileMapping` from an enterprise connection's\n   * OIDC `claimsMapping`.\n   *\n   * DEFENSE-IN-DEPTH DEFAULTS (`email` / `firstName` / `lastName`): each falls\n   * back to the standard OIDC claim name (`email`, `given_name`, `family_name`)\n   * when the connection's `claimsMapping` — or an individual field on it — is\n   * absent or empty. The fallbacks mirror {@link GENERIC_OIDC_PROFILE_MAPPING}\n   * and the `oidc.claimsMapping` Zod defaults on `SsoConnectionBaseSchema`\n   * (`@wildo-ai/saas-models`), so the three sources agree on one contract.\n   *\n   * Why this guard is needed — the schema defaults are NOT guaranteed here.\n   * Zod `.default()` fires at WRITE-time input parse and only when the\n   * `claimsMapping` key is present; a `claimsMapping`-absent object throws at\n   * parse rather than synthesizing the key. This value, however, is consumed\n   * straight off a SYSTEM READ of the stored connection\n   * (`loadSsoConnectionAsSystem` → `readAsSystem`), and the read boundary does\n   * not re-synthesize a `claimsMapping` that was never persisted — e.g. a raw\n   * repository row, a mongosh-inserted doc, or a nested-subdocument `$set`\n   * UPDATE that replaced `oidc` without re-supplying `claimsMapping`. Without a\n   * fallback, `profileMapping.email` is `undefined`, `extractUserProfile`\n   * (`oauth2-authentication.backend.service`) then resolves an empty email and\n   * throws `AUTHENTICATION_INVALID_TOKEN` (\"missing providerUserId or email\"),\n   * so EVERY enterprise OIDC login for that connection fails at profile\n   * extraction — after a successful token exchange.\n   *\n   * Additive / no-regression: `||` supplies the standard default whenever the\n   * field is absent OR an empty string. A claim NAME is never legitimately\n   * empty (`z.string()` on `claimsMapping.*` carries no `.min(1)`, so a\n   * form-cleared field or a partial stored doc can persist `''`), so `''` is\n   * treated like absent — closing the exact malformed-doc hole this guard\n   * exists for, which a `null`/`undefined`-only `??` would leave open. An\n   * authored non-standard claim name is preserved untouched. Mirrors the\n   * social-path helper `buildProfileMapping`, which defaults the same way.\n   *\n   * `id` / `name` / `image` / `emailVerified` are framework-fixed standard OIDC\n   * claims (not operator-mappable on the enterprise connection), so they stay\n   * hardcoded rather than reading from `claimsMapping`.\n   */\n  private buildEnterpriseProfileMapping(claimsMapping?: Record<string, any>): OAuth2ProfileMapping {\n    const m = claimsMapping || {};\n    return {\n      id: 'sub',\n      email: m.email || 'email',\n      firstName: m.firstName || 'given_name',\n      lastName: m.lastName || 'family_name',\n      name: 'name',\n      image: 'picture',\n      emailVerified: 'email_verified',\n      roles: m.roles,\n      groups: m.groups,\n      department: m.department,\n      employeeId: m.employeeId,\n    };\n  }\n\n  // ═══════════════════════════════════════════════════════════════\n  // G3: Org-Level OAuth2 Provider Restrictions\n  // ═══════════════════════════════════════════════════════════════\n\n  /**\n   * Check if a specific OAuth2 social provider is allowed for a scope (org or app).\n   *\n   * Evaluation order:\n   * 1. No config / no restrictions → allowed (backward-compatible)\n   * 2. requireEnterpriseSSOOnly → blocked (all social providers)\n   * 3. allowedProviders non-empty and provider not in list → blocked\n   * 4. blockedProviders includes provider → blocked (takes precedence over allowlist)\n   * 5. Otherwise → allowed\n   */\n  public async isProviderAllowed(\n    ec: ExecutionContext<any>,\n    scopeType: AuthScopeType,\n    scopeId: string,\n    providerRef: string,\n  ): Promise<{ allowed: boolean; reason?: string }> {\n    const ssoConfig = await this.orgConfigService.loadSSOConfig(ec, scopeType, scopeId);\n    if (!(ssoConfig as any)?.oauth2ProviderRestrictions) {\n      return { allowed: true };\n    }\n\n    const restrictions = (ssoConfig as any).oauth2ProviderRestrictions;\n\n    if (restrictions.requireEnterpriseSSOOnly) {\n      return { allowed: false, reason: 'Organization requires enterprise SSO only' };\n    }\n\n    if (restrictions.allowedProviders?.length > 0 && !restrictions.allowedProviders.includes(providerRef)) {\n      return { allowed: false, reason: 'Provider not in organization allowlist' };\n    }\n\n    if (restrictions.blockedProviders?.includes(providerRef)) {\n      return { allowed: false, reason: 'Provider blocked by organization policy' };\n    }\n\n    return { allowed: true };\n  }\n\n  /**\n   * Filter a list of OAuth2 social provider refs by scope-level restrictions.\n   * Returns only the providers that are allowed for the scope.\n   */\n  public async filterProviders(\n    ec: ExecutionContext<any>,\n    scopeType: AuthScopeType,\n    scopeId: string,\n    providerRefs: string[],\n  ): Promise<string[]> {\n    const results = await Promise.all(\n      providerRefs.map(async (ref) => {\n        const { allowed } = await this.isProviderAllowed(ec, scopeType, scopeId, ref);\n        return allowed ? ref : null;\n      }),\n    );\n    return results.filter((ref): ref is string => ref !== null);\n  }\n\n  // ═══════════════════════════════════════════════════════════════\n  // State-Based Resolution (Callback Router)\n  // ═══════════════════════════════════════════════════════════════\n\n  /**\n   * Re-resolve a connection from state token metadata on OAuth2 callback.\n   *\n   * The callback handler calls this to get fresh credentials matching the\n   * authorize-time configuration. Dispatches to resolveSocialConnection()\n   * or resolveEnterpriseConnection() based on connectionType in the token.\n   *\n   * For social connections with a scopeId, the scope context is forwarded\n   * to resolveSocialConnection() so it can apply credential overrides (P3)\n   * and signed-JWT generation in the correct order.\n   *\n   * Scope is explicit: enterprise state requires both `scopeType` and `scopeId`.\n   * A partial or mode-less state token fails closed instead of being interpreted\n   * as an organization-scoped legacy token.\n   */\n  public async resolveFromState(\n    ec: ExecutionContext<any>,\n    stateMetadata: OAuth2StateTokenMetadata,\n  ): Promise<OAuth2ResolvedConnection> {\n    const scopeId = stateMetadata.scopeId;\n    const scopeType = stateMetadata.scopeType;\n    if ((scopeId === undefined) !== (scopeType === undefined)) {\n      throw this.errorBuilder.buildError(ErrorType.VALIDATION, undefined, {\n        customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_INVALID_TOKEN,\n      });\n    }\n\n    if (stateMetadata.connectionType === SsoConnectionType.ENTERPRISE) {\n      if (!scopeType || !scopeId || !stateMetadata.connectionId) {\n        throw this.errorBuilder.buildError(ErrorType.VALIDATION, undefined, {\n          customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_INVALID_TOKEN,\n        });\n      }\n      return this.resolveEnterpriseConnection(\n        scopeType,\n        scopeId,\n        stateMetadata.connectionId,\n      );\n    }\n\n    return this.resolveSocialConnection(stateMetadata.providerRef, scopeId && scopeType ? {\n      ec,\n      scopeType,\n      scopeId,\n    } : undefined);\n  }\n\n  // ═══════════════════════════════════════════════════════════════\n  // Private Helpers\n  // ═══════════════════════════════════════════════════════════════\n\n  private resolveTokenEndpointAuthMethod(\n    method?: string,\n  ): 'client_secret_post' | 'client_secret_basic' | 'none' {\n    switch (method) {\n      case 'client_secret_basic':\n        return 'client_secret_basic';\n      case 'none':\n        return 'none';\n      default:\n        return 'client_secret_post';\n    }\n  }\n\n  private resolveResponseMode(\n    extraAuthParams?: Record<string, string>,\n  ): 'query' | 'fragment' | 'form_post' {\n    const mode = extraAuthParams?.response_mode;\n    if (mode === 'form_post') return 'form_post';\n    if (mode === 'fragment') return 'fragment';\n    return 'query';\n  }\n\n  private resolveIdentitySource(\n    extensions: Record<string, unknown>,\n    userInfoUrl?: string,\n  ): 'userinfo' | 'id_token' | 'callback_body' {\n    if (extensions.identitySource === 'id_token') return 'id_token';\n    if (extensions.identitySource === 'callback_body') return 'callback_body';\n    if (userInfoUrl) return 'userinfo';\n    return 'id_token'; // Fallback for providers without userinfo\n  }\n\n  private resolvePKCEMethod(\n    capabilities: Record<string, unknown>,\n  ): 'S256' | 'plain' | null {\n    if (!capabilities.supportsPKCE) return null;\n    const preferred = capabilities.preferredPKCEMethod as string | undefined;\n    if (preferred === 'plain') return 'plain';\n    return 'S256'; // Default to S256 when PKCE is supported\n  }\n\n  private buildProfileMapping(\n    userProfileMapping?: Record<string, string>,\n    extensions?: Record<string, unknown>,\n  ): OAuth2ProfileMapping {\n    const mapping = userProfileMapping || {};\n    return {\n      id: mapping.id || 'sub',\n      email: mapping.email || 'email',\n      name: mapping.name || 'name',\n      image: mapping.image || 'picture',\n      emailVerified: mapping.emailVerified || 'email_verified',\n      // Extension-based fields (Google provides given_name/family_name separately)\n      firstName: extensions?.firstNameField as string | undefined,\n      lastName: extensions?.lastNameField as string | undefined,\n    };\n  }\n\n}\n"]}
+{"version":3,"file":"oauth2-connection-resolver.backend.service.js","sourceRoot":"","sources":["../../../../../../../src/security/authentications/services/auth-methods/oauth2-connection-resolver.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;;;;;;;;;;;;;AAEH,OAAO,kBAAkB,CAAC;AAC1B,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAC/C,OAAO,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AACpF,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAC7F,OAAO,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AAC/G,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAC9G,OAAO,EAAE,uCAAuC,EAAE,MAAM,4FAA4F,CAAC;AACrJ,OAAO,EAAE,oCAAoC,EAAE,MAAM,2GAA2G,CAAC;AACjK,OAAO,EAAE,2BAA2B,EAAE,MAAM,kGAAkG,CAAC;AAC/I,OAAO,EACL,SAAS,EACT,2BAA2B,EAC3B,aAAa,EACb,sBAAsB,EACtB,aAAa,EACb,eAAe,EACf,eAAe,EACf,iBAAiB,EACjB,WAAW,EACX,mBAAmB,GACpB,MAAM,uBAAuB,CAAC;AAM/B,OAAO,EAAE,8BAA8B,EAAE,MAAM,mFAAmF,CAAC;AAEnI,OAAO,GAAG,MAAM,cAAc,CAAC;AAC/B,OAAO,EAAE,sCAAsC,EAAE,2BAA2B,EAAE,MAAM,sCAAsC,CAAC;AAC3H,OAAO,EAAE,0BAA0B,EAAE,MAAM,uFAAuF,CAAC;AAgBnI,MAAM,cAAc,GAAG,IAAI,GAAG,EAA8C,CAAC;AAC7E,MAAM,wBAAwB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAC/C,MAAM,0BAA0B,GAAG,YAAY,CAAC;AAwBhD;;;;;;;;;;GAUG;AACH,MAAM,4BAA4B,GAAyB;IACzD,EAAE,EAAE,KAAK;IACT,KAAK,EAAE,OAAO;IACd,SAAS,EAAE,YAAY;IACvB,QAAQ,EAAE,aAAa;IACvB,IAAI,EAAE,MAAM;IACZ,KAAK,EAAE,SAAS;IAChB,aAAa,EAAE,gBAAgB;CAChC,CAAC;AAEF,SAAS,kCAAkC,CACzC,WAAmB,EACnB,QAAgB,EAChB,MAAmC;IAEnC,MAAM,QAAQ,GAAG;QACf,WAAW;QACX,QAAQ;QACR,MAAM,CAAC,KAAK;QACZ,MAAM,CAAC,MAAM;QACb,MAAM,CAAC,SAAS;QAChB,MAAM,CAAC,QAAQ;QACf,MAAM,CAAC,kBAAkB;KAC1B,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACZ,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC5C,IAAI,MAAM,IAAI,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;QAC5C,OAAO,MAAM,CAAC,GAAG,CAAC;IACpB,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC5B,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,CAAC,UAAU,EAAE;QAC5C,SAAS,EAAE,MAAM,CAAC,SAA0B;QAC5C,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,OAAO,EAAE,MAAM,CAAC,QAAQ;QACxB,SAAS,EAAE,MAAM,CAAC,kBAAkB;KACrC,CAAC,CAAC;IAEH,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,kBAAkB,GAAG,IAAI,GAAG,wBAAwB,CAAC,CAAC;IAC5F,cAAc,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,GAAG,UAAU,EAAE,CAAC,CAAC;IAC/E,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;GAIG;AAEI,IAAM,sCAAsC,GAA5C,MAAM,sCAAsC;IAIK;IACU;IACG;IACa;IACI;IAChB;IARnD,QAAQ,CAA+D;IAExF,YACsD,MAAqB,EACX,gBAAyC,EACtC,YAAwC,EAC3B,yBAAkE,EAC9D,gBAAsD,EACtE,aAA0C;QALxD,WAAM,GAAN,MAAM,CAAe;QACX,qBAAgB,GAAhB,gBAAgB,CAAyB;QACtC,iBAAY,GAAZ,YAAY,CAA4B;QAC3B,8BAAyB,GAAzB,yBAAyB,CAAyC;QAC9D,qBAAgB,GAAhB,gBAAgB,CAAsC;QACtE,kBAAa,GAAb,aAAa,CAA6B;QAE5G,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,0BAA0B,CAAC,CAAC;QACpE,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,0BAA0B,EAAE,KAAK,CAAC,CAAC;IACrE,CAAC;IAED,kEAAkE;IAClE,+BAA+B;IAC/B,kEAAkE;IAElE;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACI,KAAK,CAAC,uBAAuB,CAClC,WAAmB,EACnB,OAAqF;QAErF,IAAI,CAAC,QAAQ,CAAC,6BAA6B,EAAE,EAAE,WAAW,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;QAEzF,mFAAmF;QACnF,MAAM,cAAc,GAAG,IAAI,CAAC,wBAAwB,CAAC,WAAW,CAAC,CAAC;QAClE,IAAI,cAAc,EAAE,IAAI,KAAK,2BAA2B,CAAC,UAAU,EAAE,CAAC;YACpE,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,SAAS,EAAE,SAAS,EAAE;gBACjE,sBAAsB,EAAE,2BAA2B,CAAC,wBAAwB;aAC7E,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC;YACH,IAAI,CAAC,IAAI,CAAC,yBAAyB,CAAC,iBAAiB,CAAC,WAAW,EAAE,sCAAsC,CAAC,UAAU,CAAC,EAAE,CAAC;gBACtH,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;oBACrE,sBAAsB,EAAE,2BAA2B,CAAC,iCAAiC;oBACrF,OAAO,EAAE,EAAE,OAAO,EAAE,oBAAoB,WAAW,6CAA6C,EAAE;iBACnG,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,mBAAmB,CAAC,KAAK,CAAC;gBAAE,MAAM,KAAK,CAAC;YAC5C,IAAI,CAAC,QAAQ,CAAC,gHAAgH,EAAE;gBAC9H,WAAW;aACZ,CAAC,CAAC;QACL,CAAC;QAED,4CAA4C;QAC5C,MAAM,SAAS,GAAG,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC;QAC/C,MAAM,0BAA0B,GAAG,SAAS,CAAC,IAAI,EAAE,qBAAqB,EAAE,CAAC,WAAW,CAAC,CAAC;QACxF,IAAI,CAAC,0BAA0B,IAAI,0BAA0B,CAAC,OAAO,KAAK,KAAK,EAAE,CAAC;YAChF,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;gBACrE,sBAAsB,EAAE,2BAA2B,CAAC,iCAAiC;gBACrF,OAAO,EAAE,EAAE,OAAO,EAAE,2BAA2B,WAAW,uCAAuC,EAAE;aACpG,CAAC,CAAC;QACL,CAAC;QACD,IAAI,CAAC,0BAA0B,CAAC,0BAA0B,CAAC,OAAO,CAAC,EAAE,CAAC;YACpE,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;gBACrE,sBAAsB,EAAE,2BAA2B,CAAC,iCAAiC;gBACrF,OAAO,EAAE,EAAE,OAAO,EAAE,2BAA2B,WAAW,sCAAsC,EAAE;aACnG,CAAC,CAAC;QACL,CAAC;QAED,yDAAyD;QACzD,MAAM,eAAe,GAAG,SAAS,CAAC,sBAAsB,EAAE,CAAC,WAAW,CAAC,CAAC;QACxE,MAAM,cAAc,GAAG,eAAe,EAAE,CAAC,0BAA0B,CAAoC,CAAC;QAExG,IAAI,QAAQ,GAAG,cAAc,EAAE,UAAU,EAAE,QAAQ;eAC9C,cAAc,EAAE,QAAQ;eACxB,CAAC,cAAc,CAAC,uBAAuB,CAAC,CAAC,CAAC,cAAc,EAAE,CAAC,cAAc,CAAC,uBAAuB,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAErH,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;gBACrE,sBAAsB,EAAE,2BAA2B,CAAC,iCAAiC;gBACrF,OAAO,EAAE,EAAE,OAAO,EAAE,yCAAyC,WAAW,GAAG,EAAE;aAC9E,CAAC,CAAC;QACL,CAAC;QAED,qEAAqE;QACrE,MAAM,SAAS,GAAG,cAAc,EAAE,UAAU,EAAE,SAAS,IAAI,cAAc,CAAC,eAAe,CAAC;QAC1F,IAAI,YAAY,GAAG,EAAE,CAAC;QAEtB,IAAI,SAAS,EAAE,CAAC;YACd,YAAY,GAAG,IAAI,CAAC,yBAAyB,CAAC,iBAAiB,CAC7D,WAAW,EACX,0BAAiC,EACjC,SAAS,CACV,IAAI,EAAE,CAAC;QACV,CAAC;QAED,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;gBACrE,sBAAsB,EAAE,2BAA2B,CAAC,iCAAiC;gBACrF,OAAO,EAAE,EAAE,OAAO,EAAE,0DAA0D,WAAW,2BAA2B,SAAS,IAAI,EAAE;aACpI,CAAC,CAAC;QACL,CAAC;QAED,oDAAoD;QACpD,oFAAoF;QACpF,0EAA0E;QAC1E,EAAE;QACF,iFAAiF;QACjF,6EAA6E;QAC7E,4EAA4E;QAC5E,IAAI,sBAA0C,CAAC;QAC/C,IAAI,uBAA2C,CAAC;QAChD,IAAI,OAAO,EAAE,OAAO,IAAI,OAAO,CAAC,EAAE,EAAE,CAAC;YACnC,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,aAAa,CAAC,YAAY,CAAC;YAClE,IAAI,CAAC;gBACH,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,aAAa,CAAC,OAAO,CAAC,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;gBACpG,MAAM,SAAS,GAAG,SAAS,EAAE,yBAAyB,CAAC;gBACvD,MAAM,QAAQ,GAAG,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,KAAK,WAAW,CAAC,CAAC;gBACrE,IAAI,QAAQ,EAAE,CAAC;oBACb,QAAQ,GAAG,QAAQ,CAAC,QAAQ,CAAC;oBAC7B,YAAY,GAAG,QAAQ,CAAC,YAAY,CAAC;oBACrC,sBAAsB,GAAG,QAAQ,CAAC,cAAc,CAAC;oBACjD,uBAAuB,GAAG,QAAQ,CAAC,eAAe,CAAC;oBACnD,IAAI,CAAC,QAAQ,CAAC,+CAA+C,EAAE;wBAC7D,WAAW,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO;qBACjD,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC;oBAAE,MAAM,GAAG,CAAC;gBACzC,IAAI,CAAC,QAAQ,CAAC,gEAAgE,EAAE;oBAC9E,WAAW,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO;iBACjD,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,2CAA2C;QAC3C,mFAAmF;QACnF,oFAAoF;QACpF,qCAAqC;QACrC,EAAE;QACF,qFAAqF;QACrF,8EAA8E;QAC9E,0EAA0E;QAC1E,MAAM,UAAU,GAAG,cAAc,CAAC,UAAU,IAAI,EAAE,CAAC;QACnD,IAAI,UAAU,CAAC,gBAAgB,KAAK,YAAY,EAAE,CAAC;YACjD,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,CAAC,qBAAqB,IAAI,OAAO,CAAC,CAAC;YACtE,MAAM,QAAQ,GAAG,MAAM,CAAC,UAAU,CAAC,oBAAoB,IAAI,2BAA2B,CAAC,CAAC;YACxF,MAAM,kBAAkB,GAAG,MAAM,CAAC,UAAU,CAAC,8BAA8B,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,GAAG,CAAC,CAAC;YACnG,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,CAAC,eAAe,IAAI,GAAG,WAAW,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;YAC/F,MAAM,QAAQ,GAAG,MAAM,CAAC,UAAU,CAAC,cAAc,IAAI,GAAG,WAAW,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;YAC5F,MAAM,MAAM,GAAG,uBAAuB,IAAI,IAAI,CAAC,yBAAyB,CAAC,iBAAiB,CACxF,WAAW,EACX,0BAAiC,EACjC,SAAS,CACV,CAAC;YACF,MAAM,KAAK,GAAG,sBAAsB,IAAI,IAAI,CAAC,yBAAyB,CAAC,iBAAiB,CACtF,WAAW,EACX,0BAAiC,EACjC,QAAQ,CACT,CAAC;YAEF,IAAI,CAAC,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;gBACtB,MAAM,OAAO,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBAC9F,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;oBACrE,sBAAsB,EAAE,2BAA2B,CAAC,iCAAiC;oBACrF,OAAO,EAAE,EAAE,OAAO,EAAE,aAAa,WAAW,yDAAyD,OAAO,EAAE,EAAE;iBACjH,CAAC,CAAC;YACL,CAAC;YAED,YAAY,GAAG,kCAAkC,CAC/C,WAAW,EACX,QAAQ,EACR,EAAE,UAAU,EAAE,YAAY,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,kBAAkB,EAAE,CAC/F,CAAC;YACF,IAAI,CAAC,QAAQ,CAAC,oCAAoC,EAAE,EAAE,WAAW,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAC;QAC5F,CAAC;QAED,wEAAwE;QACxE,MAAM,SAAS,GAAG,SAAS,CAAC,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,SAAS,CAAC;QAC5E,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;gBACrE,sBAAsB,EAAE,2BAA2B,CAAC,iCAAiC;gBACrF,OAAO,EAAE,EAAE,OAAO,EAAE,6FAA6F,EAAE;aACpH,CAAC,CAAC;QACL,CAAC;QACD,MAAM,WAAW,GAAG,GAAG,SAAS,gCAAgC,WAAW,EAAE,CAAC;QAE9E,mCAAmC;QACnC,MAAM,uBAAuB,GAAG,IAAI,CAAC,8BAA8B,CACjE,cAAc,EAAE,uBAAuB,IAAI,cAAc,CAAC,uBAAuB,CAClF,CAAC;QACF,MAAM,YAAY,GAAG,cAAc,CAAC,YAAY,IAAI,IAAI,CAAC,mBAAmB,CAAC;YAC3E,GAAG,cAAc,CAAC,eAAe;YACjC,GAAG,cAAc,EAAE,eAAe;SACnC,CAAC,CAAC;QACH,MAAM,cAAc,GAAG,cAAc,CAAC,cAAc;eAC/C,IAAI,CAAC,qBAAqB,CAAC,UAAU,EAAE,cAAc,CAAC,gBAAgB,CAAC,CAAC;QAC7E,MAAM,UAAU,GAAG,cAAc,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;QAE/D,6DAA6D;QAC7D,MAAM,aAAa,GAAG,cAAc,CAAC,MAAM,IAAI,EAAE,CAAC;QAClD,MAAM,gBAAgB,GAAG,0BAA0B,CAAC,gBAAgB,IAAI,EAAE,CAAC;QAC3E,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,aAAa,EAAE,GAAG,gBAAgB,CAAC,CAAC,CAAC,CAAC;QAErE,kBAAkB;QAClB,MAAM,cAAc,GAAG,cAAc,CAAC,cAAc,IAAI,4BAA4B,CAAC;QAErF,mBAAmB;QACnB,MAAM,eAAe,GAAG;YACtB,GAAG,CAAC,cAAc,CAAC,eAAe,IAAI,EAAE,CAAC;YACzC,GAAG,CAAC,cAAc,EAAE,eAAe,IAAI,EAAE,CAAC;SAC3C,CAAC;QACF,MAAM,gBAAgB,GAAG;YACvB,GAAG,CAAC,cAAc,CAAC,gBAAgB,IAAI,EAAE,CAAC;YAC1C,GAAG,CAAC,cAAc,EAAE,gBAAgB,IAAI,EAAE,CAAC;SAC5C,CAAC;QACF,MAAM,mBAAmB,GAAG;YAC1B,GAAG,CAAC,cAAc,CAAC,mBAAmB,IAAI,EAAE,CAAC;YAC7C,GAAG,CAAC,cAAc,EAAE,mBAAmB,IAAI,EAAE,CAAC;SAC/C,CAAC;QACF,MAAM,kBAAkB,GAAG;YACzB,GAAG,UAAU;YACb,GAAG,CAAC,cAAc,EAAE,UAAU,IAAI,EAAE,CAAC;SACtC,CAAC;QAEF,0CAA0C;QAC1C,MAAM,MAAM,GAAG,cAAc,CAAC,MAAM,CAAC;QACrC,MAAM,OAAO,GAAG,cAAc,CAAC,OAAO,CAAC;QAEvC,MAAM,UAAU,GAA6B;YAC3C,MAAM,EAAE,cAAc,CAAC,YAAY;gBACjC,CAAC,CAAC,sBAAsB,CAAC,IAAI;gBAC7B,CAAC,CAAC,sBAAsB,CAAC,MAAM;YACjC,cAAc,EAAE,iBAAiB,CAAC,MAAM;YACxC,WAAW;YACX,WAAW,EAAE,0BAA0B,CAAC,WAAW,IAAI,WAAW;YAClE,gBAAgB,EAAE,cAAc,CAAC,qBAAqB;YACtD,QAAQ,EAAE,cAAc,CAAC,aAAa;YACtC,WAAW,EAAE,cAAc,CAAC,gBAAgB;YAC5C,WAAW;YACX,MAAM;YACN,OAAO;YACP,QAAQ;YACR,YAAY;YACZ,uBAAuB;YACvB,MAAM;YACN,UAAU;YACV,YAAY;YACZ,0FAA0F;YAC1F,sDAAsD;YACtD,YAAY,EAAE,eAAe,CAAC,IAAI;YAClC,cAAc;YACd,cAAc;YACd,eAAe,EAAE,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,SAAS;YACtF,gBAAgB,EAAE,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,SAAS;YACzF,mBAAmB,EAAE,MAAM,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,SAAS;YAClG,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,SAAS;SACxF,CAAC;QAEF,IAAI,CAAC,QAAQ,CAAC,4BAA4B,EAAE;YAC1C,WAAW;YACX,cAAc,EAAE,iBAAiB,CAAC,MAAM;YACxC,YAAY;YACZ,cAAc;YACd,UAAU;YACV,UAAU,EAAE,MAAM,CAAC,MAAM;SAC1B,CAAC,CAAC;QAEH,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,kEAAkE;IAClE,6CAA6C;IAC7C,kEAAkE;IAElE;;;;;;;;;;;;;OAaG;IACI,KAAK,CAAC,2BAA2B,CACtC,SAAwB,EACxB,OAAe,EACf,YAAoB;QAEpB,IAAI,CAAC,QAAQ,CAAC,iCAAiC,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC,CAAC;QAEvF,sDAAsD;QACtD,sEAAsE;QACtE,6EAA6E;QAC7E,2EAA2E;QAC3E,+EAA+E;QAC/E,sEAAsE;QACtE,wEAAwE;QACxE,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,yBAAyB,CAAC,SAAS,EAAE,OAAO,EAAE,YAAY,CAAC,CAAC;QAE9G,IAAI,CAAC,aAAa,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,CAAC;YAC7C,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,SAAS,EAAE,SAAS,EAAE;gBACjE,sBAAsB,EAAE,2BAA2B,CAAC,wBAAwB;aAC7E,CAAC,CAAC;QACL,CAAC;QAED,+FAA+F;QAC/F,IAAI,aAAa,CAAC,QAAQ,KAAK,WAAW,CAAC,IAAI,EAAE,CAAC;YAChD,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;gBACrE,sBAAsB,EAAE,2BAA2B,CAAC,iCAAiC;gBACrF,OAAO,EAAE,EAAE,OAAO,EAAE,yHAAyH,EAAE;aAChJ,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC;YACxB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;gBACrE,sBAAsB,EAAE,2BAA2B,CAAC,iCAAiC;gBACrF,OAAO,EAAE,EAAE,OAAO,EAAE,mBAAmB,YAAY,yDAAyD,EAAE;aAC/G,CAAC,CAAC;QACL,CAAC;QAED,yEAAyE;QACzE,MAAM,UAAU,GAAwB;YACtC,GAAG,aAAa,CAAC,IAAI;YACrB,kBAAkB,EAAE,aAAa,CAAC,kBAAkB;YACpD,WAAW,EAAE,aAAa,CAAC,WAAW;YACtC,cAAc,EAAE,aAAa,CAAC,cAAc;YAC5C,eAAe,EAAE,aAAa,CAAC,eAAe;YAC9C,eAAe,EAAE,aAAa,CAAC,eAAe;YAC9C,WAAW,EAAE,aAAa,CAAC,WAAW;YACtC,WAAW,EAAE,aAAa,CAAC,WAAW;YACtC,YAAY,EAAE,aAAa,CAAC,YAAY;SACzC,CAAC;QAEF,6CAA6C;QAC7C,MAAM,YAAY,GAAG,UAAU,CAAC,YAAY,IAAI,eAAe,CAAC,MAAM,CAAC;QACvE,IAAI,gBAAwB,CAAC;QAC7B,IAAI,QAAgB,CAAC;QACrB,IAAI,WAA+B,CAAC;QACpC,IAAI,OAA2B,CAAC;QAChC,IAAI,kBAAsC,CAAC;QAC3C,IAAI,MAA0B,CAAC;QAC/B,IAAI,MAAgB,CAAC;QACrB,IAAI,eAAmD,CAAC;QACxD,IAAI,UAAU,GAA2C,UAAU,CAAC,WAAW;YAC7E,CAAC,CAAC,CACA,UAAU,CAAC,UAAU,KAAK,aAAa,CAAC,KAAK;gBAC3C,CAAC,CAAC,aAAa,CAAC,KAAK;gBACrB,CAAC,CAAC,aAAa,CAAC,IAAI,CACvB;YACD,CAAC,CAAC,IAAI,CAAC;QAET,QAAQ,YAAY,EAAE,CAAC;YACrB,KAAK,eAAe,CAAC,QAAQ;gBAC3B,CAAC,EAAE,gBAAgB,EAAE,QAAQ,EAAE,WAAW,EAAE,OAAO,EAAE,kBAAkB,EAAE,MAAM,EAAE,MAAM,EAAE,eAAe,EAAE,UAAU,EAAE;oBACpH,MAAM,IAAI,CAAC,mBAAmB,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC,CAAC;gBAC1D,MAAM;YAER,KAAK,eAAe,CAAC,SAAS;gBAC5B,CAAC,EAAE,gBAAgB,EAAE,QAAQ,EAAE,WAAW,EAAE,OAAO,EAAE,kBAAkB,EAAE,MAAM,EAAE,MAAM,EAAE;oBACvF,MAAM,IAAI,CAAC,oBAAoB,CAAC,UAAU,CAAC,CAAC,CAAC;gBAC/C,MAAM;YAER,KAAK,eAAe,CAAC,MAAM,CAAC;YAC5B;gBACE,CAAC,EAAE,gBAAgB,EAAE,QAAQ,EAAE,WAAW,EAAE,OAAO,EAAE,kBAAkB,EAAE,MAAM,EAAE,MAAM,EAAE;oBACvF,IAAI,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAC,CAAC;gBACtC,MAAM;QACV,CAAC;QAED,uCAAuC;QACvC,MAAM,SAAS,GAAG,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,SAAS,CAAC;QAC/F,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;gBACrE,sBAAsB,EAAE,2BAA2B,CAAC,iCAAiC;gBACrF,OAAO,EAAE,EAAE,OAAO,EAAE,6FAA6F,EAAE;aACpH,CAAC,CAAC;QACL,CAAC;QACD,MAAM,WAAW,GAAG,UAAU,CAAC,kBAAkB,IAAI,iBAAiB,CAAC;QACvE,MAAM,WAAW,GAAG,GAAG,SAAS,gCAAgC,WAAW,EAAE,CAAC;QAE9E,sDAAsD;QACtD,MAAM,cAAc,GAAG,IAAI,CAAC,6BAA6B,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;QAEpF,yBAAyB;QACzB,MAAM,YAAY,GAAG,UAAU,CAAC,YAAY,IAAI,OAAO,CAAC;QAExD;;;;;;;;;;WAUG;QACH,MAAM,YAAY,GAAG,UAAU,CAAC,YAAY,IAAI,eAAe,CAAC,IAAI,CAAC;QACrE,IAAI,YAAY,KAAK,eAAe,CAAC,IAAI,EAAE,CAAC;YAC1C,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;gBACrE,sBAAsB,EAAE,2BAA2B,CAAC,aAAa;gBACjE,OAAO,EAAE;oBACP,OAAO,EAAE,8CAA8C,YAAY,kEAAkE;0BACjI,uEAAuE;oBAC3E,YAAY;oBACZ,WAAW,EAAE,UAAU,CAAC,kBAAkB;iBAC3C;aACF,CAAC,CAAC;QACL,CAAC;QAED,uCAAuC;QACvC,MAAM,UAAU,GAA6B;YAC3C,MAAM,EAAE,sBAAsB,CAAC,IAAI;YACnC,cAAc,EAAE,iBAAiB,CAAC,UAAU;YAC5C,WAAW;YACX,WAAW,EAAE,UAAU,CAAC,WAAW;YACnC,gBAAgB;YAChB,QAAQ;YACR,WAAW;YACX,WAAW;YACX,MAAM;YACN,OAAO;YACP,QAAQ,EAAE,UAAU,CAAC,QAAQ;YAC7B,YAAY,EAAE,UAAU,CAAC,YAAY;YACrC,uBAAuB,EAAE,oBAAoB;YAC7C,MAAM;YACN,UAAU;YACV,YAAY,EAAE,YAAkD;YAChE,YAAY,EAAE,eAAe,CAAC,IAAI;YAClC,SAAS,EAAE,UAAU,CAAC,SAAS,IAAI,UAAU,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;YACrG,MAAM,EAAE,UAAU,CAAC,MAAM;YACzB,MAAM,EAAE,UAAU,CAAC,MAAM;YACzB,cAAc,EAAE,WAAW,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU;YACrD,cAAc;YACd,eAAe;YACf,KAAK,EAAE,8BAA8B,CAAC,SAAS,EAAE,OAAO,EAAE,YAAY,CAAC;YACvE,yFAAyF;YACzF,qGAAqG;YACrG,wFAAwF;YACxF,kBAAkB,EAAE;gBAClB,eAAe,EAAE,UAAU,CAAC,eAAe,IAAI,IAAI;gBACnD,eAAe,EAAE,UAAU,CAAC,eAAe,IAAI,IAAI;gBACnD,WAAW,EAAE,UAAU,CAAC,WAAW;gBACnC,WAAW,EAAE,UAAU,CAAC,WAAW;gBACnC,YAAY,EAAE,UAAU,CAAC,YAAY;gBACrC,cAAc,EAAE,UAAU,CAAC,cAAc,IAAI,EAAE;aAChD;SACF,CAAC;QAEF,IAAI,CAAC,QAAQ,CAAC,gCAAgC,EAAE;YAC9C,SAAS;YACT,OAAO;YACP,YAAY;YACZ,YAAY;YACZ,WAAW;YACX,cAAc,EAAE,CAAC,CAAC,WAAW;SAC9B,CAAC,CAAC;QAEH,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,kEAAkE;IAClE,mCAAmC;IACnC,kEAAkE;IAElE;;;OAGG;IACK,KAAK,CAAC,mBAAmB,CAC/B,UAA+B,EAC/B,iBAA0C;QAO1C,MAAM,kBAAkB,GAAG,UAAU,CAAC,kBAAkB,CAAC;QACzD,IAAI,CAAC,kBAAkB,EAAE,CAAC;YACxB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;gBACrE,sBAAsB,EAAE,2BAA2B,CAAC,iCAAiC;gBACrF,OAAO,EAAE,EAAE,OAAO,EAAE,mDAAmD,EAAE;aAC1E,CAAC,CAAC;QACL,CAAC;QAED,MAAM,cAAc,GAAG,IAAI,CAAC,wBAAwB,CAAC,kBAAkB,CAAC,CAAC;QACzE,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,SAAS,EAAE,SAAS,EAAE;gBACjE,sBAAsB,EAAE,2BAA2B,CAAC,wBAAwB;aAC7E,CAAC,CAAC;QACL,CAAC;QAED,MAAM,iBAAiB,GAAG,UAAU,CAAC,iBAAiB,IAAI,EAAE,CAAC;QAE7D,wDAAwD;QACxD,MAAM,gBAAgB,GAAG,IAAI,CAAC,aAAa,CAAC,kBAAkB,CAAC,cAAc,CAAC,qBAAqB,IAAI,EAAE,EAAE,iBAAiB,CAAC,CAAC;QAC9H,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,CAAC,kBAAkB,CAAC,cAAc,CAAC,aAAa,IAAI,EAAE,EAAE,iBAAiB,CAAC,CAAC;QAC9G,MAAM,WAAW,GAAG,cAAc,CAAC,gBAAgB;YACjD,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,kBAAkB,CAAC,cAAc,CAAC,gBAAgB,EAAE,iBAAiB,CAAC;YAC3F,CAAC,CAAC,SAAS,CAAC;QACd,MAAM,OAAO,GAAG,cAAc,CAAC,OAAO;YACpC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,kBAAkB,CAAC,cAAc,CAAC,OAAO,EAAE,iBAAiB,CAAC;YAClF,CAAC,CAAC,SAAS,CAAC;QACd,MAAM,kBAAkB,GAAG,SAAS,CAAC,CAAC,8CAA8C;QAEpF,6CAA6C;QAC7C,MAAM,MAAM,GAAG,cAAc,CAAC,MAAM;YAClC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,kBAAkB,CAAC,cAAc,CAAC,MAAM,EAAE,iBAAiB,CAAC;YACjF,CAAC,CAAC,SAAS,CAAC;QAEd,gDAAgD;QAChD,MAAM,aAAa,GAAG,cAAc,CAAC,MAAM,IAAI,CAAC,QAAQ,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;QAC9E,MAAM,YAAY,GAAG,UAAU,CAAC,YAAY,IAAI,EAAE,CAAC;QACnD,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,aAAa,EAAE,GAAG,UAAU,CAAC,MAAM,EAAE,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC;QAEvF,8CAA8C;QAC9C,IAAI,eAAmD,CAAC;QACxD,MAAM,uBAAuB,GAAG;YAC9B,GAAG,CAAC,cAAc,CAAC,eAAe,IAAI,EAAE,CAAC;YACzC,GAAG,CAAC,UAAU,CAAC,eAAe,IAAI,EAAE,CAAC;SACtC,CAAC;QACF,IAAI,MAAM,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACpD,eAAe,GAAG,IAAI,CAAC,aAAa,CAAC,qBAAqB,CAAC,uBAAuB,EAAE,iBAAiB,CAAC,CAAC;QACzG,CAAC;QAED,kCAAkC;QAClC,MAAM,UAAU,GAAG,cAAc,CAAC,YAAY,CAAC,CAAC,CAAC,MAAe,CAAC,CAAC,CAAC,iBAAiB,CAAC;QAErF,OAAO,EAAE,gBAAgB,EAAE,QAAQ,EAAE,WAAW,EAAE,OAAO,EAAE,kBAAkB,EAAE,MAAM,EAAE,MAAM,EAAE,eAAe,EAAE,UAAU,EAAE,CAAC;IAC/H,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,oBAAoB,CAChC,UAA+B;QAM/B,MAAM,SAAS,GAAG,UAAU,CAAC,MAAM,IAAI,UAAU,CAAC,YAAY,EAAE,OAAO,CAAC,mCAAmC,EAAE,EAAE,CAAC,CAAC;QACjH,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;gBACrE,sBAAsB,EAAE,2BAA2B,CAAC,iCAAiC;gBACrF,OAAO,EAAE,EAAE,OAAO,EAAE,wDAAwD,EAAE;aAC/E,CAAC,CAAC;QACL,CAAC;QAED,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC;QAElE,MAAM,YAAY,GAAG,UAAU,CAAC,YAAY,IAAI,EAAE,CAAC;QACnD,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,UAAU,CAAC,MAAM,EAAE,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC;QAErE,OAAO;YACL,gBAAgB,EAAE,GAAG,CAAC,sBAAsB;YAC5C,QAAQ,EAAE,GAAG,CAAC,cAAc;YAC5B,WAAW,EAAE,GAAG,CAAC,iBAAiB;YAClC,OAAO,EAAE,GAAG,CAAC,QAAQ;YACrB,kBAAkB,EAAE,GAAG,CAAC,oBAAoB;YAC5C,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,MAAM;SACP,CAAC;IACJ,CAAC;IAEO,wBAAwB,CAAC,WAAmB;QAClD,MAAM,cAAc,GAAG,IAAI,CAAC,yBAAyB,CAAC,wBAAwB,CAC5E,WAAW,EACX,sCAAsC,CAAC,UAAU,CACf,CAAC;QAErC,OAAO,cAAc,EAAE,eAAe,EAAE,IAAI,KAAK,2BAA2B,CAAC,UAAU;YACrF,CAAC,CAAC,cAAc,CAAC,eAA2C;YAC5D,CAAC,CAAC,SAAS,CAAC;IAChB,CAAC;IAED;;OAEG;IACK,iBAAiB,CACvB,UAA+B;QAM/B,IAAI,CAAC,UAAU,CAAC,qBAAqB,IAAI,CAAC,UAAU,CAAC,aAAa,EAAE,CAAC;YACnE,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;gBACrE,sBAAsB,EAAE,2BAA2B,CAAC,iCAAiC;gBACrF,OAAO,EAAE,EAAE,OAAO,EAAE,sEAAsE,EAAE;aAC7F,CAAC,CAAC;QACL,CAAC;QAED,MAAM,YAAY,GAAG,UAAU,CAAC,YAAY,IAAI,EAAE,CAAC;QACnD,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,UAAU,CAAC,MAAM,EAAE,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC;QAErE,OAAO;YACL,gBAAgB,EAAE,UAAU,CAAC,qBAAqB;YAClD,QAAQ,EAAE,UAAU,CAAC,aAAa;YAClC,WAAW,EAAE,UAAU,CAAC,gBAAgB;YACxC,OAAO,EAAE,UAAU,CAAC,OAAO;YAC3B,kBAAkB,EAAE,UAAU,CAAC,kBAAkB;YACjD,MAAM,EAAE,UAAU,CAAC,MAAM;YACzB,MAAM;SACP,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAsCG;IACK,6BAA6B,CAAC,aAAmC;QACvE,MAAM,CAAC,GAAG,aAAa,IAAI,EAAE,CAAC;QAC9B,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,CAAC,CAAC,KAAK,IAAI,OAAO;YACzB,SAAS,EAAE,CAAC,CAAC,SAAS,IAAI,YAAY;YACtC,QAAQ,EAAE,CAAC,CAAC,QAAQ,IAAI,aAAa;YACrC,IAAI,EAAE,MAAM;YACZ,KAAK,EAAE,SAAS;YAChB,aAAa,EAAE,gBAAgB;YAC/B,KAAK,EAAE,CAAC,CAAC,KAAK;YACd,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,UAAU,EAAE,CAAC,CAAC,UAAU;YACxB,UAAU,EAAE,CAAC,CAAC,UAAU;SACzB,CAAC;IACJ,CAAC;IAED,kEAAkE;IAClE,6CAA6C;IAC7C,kEAAkE;IAElE;;;;;;;;;OASG;IACI,KAAK,CAAC,iBAAiB,CAC5B,EAAyB,EACzB,SAAwB,EACxB,OAAe,EACf,WAAmB;QAEnB,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;QACpF,IAAI,CAAE,SAAiB,EAAE,0BAA0B,EAAE,CAAC;YACpD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC3B,CAAC;QAED,MAAM,YAAY,GAAI,SAAiB,CAAC,0BAA0B,CAAC;QAEnE,IAAI,YAAY,CAAC,wBAAwB,EAAE,CAAC;YAC1C,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,2CAA2C,EAAE,CAAC;QACjF,CAAC;QAED,IAAI,YAAY,CAAC,gBAAgB,EAAE,MAAM,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,gBAAgB,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;YACtG,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,wCAAwC,EAAE,CAAC;QAC9E,CAAC;QAED,IAAI,YAAY,CAAC,gBAAgB,EAAE,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;YACzD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,yCAAyC,EAAE,CAAC;QAC/E,CAAC;QAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IAED;;;OAGG;IACI,KAAK,CAAC,eAAe,CAC1B,EAAyB,EACzB,SAAwB,EACxB,OAAe,EACf,YAAsB;QAEtB,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAC/B,YAAY,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;YAC7B,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;YAC9E,OAAO,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;QAC9B,CAAC,CAAC,CACH,CAAC;QACF,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC,GAAG,EAAiB,EAAE,CAAC,GAAG,KAAK,IAAI,CAAC,CAAC;IAC9D,CAAC;IAED,kEAAkE;IAClE,2CAA2C;IAC3C,kEAAkE;IAElE;;;;;;;;;;;;;;OAcG;IACI,KAAK,CAAC,gBAAgB,CAC3B,EAAyB,EACzB,aAAuC;QAEvC,MAAM,OAAO,GAAG,aAAa,CAAC,OAAO,CAAC;QACtC,MAAM,SAAS,GAAG,aAAa,CAAC,SAAS,CAAC;QAC1C,IAAI,CAAC,OAAO,KAAK,SAAS,CAAC,KAAK,CAAC,SAAS,KAAK,SAAS,CAAC,EAAE,CAAC;YAC1D,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,SAAS,EAAE;gBAClE,sBAAsB,EAAE,2BAA2B,CAAC,4BAA4B;aACjF,CAAC,CAAC;QACL,CAAC;QAED,IAAI,aAAa,CAAC,cAAc,KAAK,iBAAiB,CAAC,UAAU,EAAE,CAAC;YAClE,IAAI,CAAC,SAAS,IAAI,CAAC,OAAO,IAAI,CAAC,aAAa,CAAC,YAAY,EAAE,CAAC;gBAC1D,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,SAAS,EAAE;oBAClE,sBAAsB,EAAE,2BAA2B,CAAC,4BAA4B;iBACjF,CAAC,CAAC;YACL,CAAC;YACD,OAAO,IAAI,CAAC,2BAA2B,CACrC,SAAS,EACT,OAAO,EACP,aAAa,CAAC,YAAY,CAC3B,CAAC;QACJ,CAAC;QAED,OAAO,IAAI,CAAC,uBAAuB,CAAC,aAAa,CAAC,WAAW,EAAE,OAAO,IAAI,SAAS,CAAC,CAAC,CAAC;YACpF,EAAE;YACF,SAAS;YACT,OAAO;SACR,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACjB,CAAC;IAED,kEAAkE;IAClE,kBAAkB;IAClB,kEAAkE;IAE1D,8BAA8B,CACpC,MAAe;QAEf,QAAQ,MAAM,EAAE,CAAC;YACf,KAAK,qBAAqB;gBACxB,OAAO,qBAAqB,CAAC;YAC/B,KAAK,MAAM;gBACT,OAAO,MAAM,CAAC;YAChB;gBACE,OAAO,oBAAoB,CAAC;QAChC,CAAC;IACH,CAAC;IAEO,mBAAmB,CACzB,eAAwC;QAExC,MAAM,IAAI,GAAG,eAAe,EAAE,aAAa,CAAC;QAC5C,IAAI,IAAI,KAAK,WAAW;YAAE,OAAO,WAAW,CAAC;QAC7C,IAAI,IAAI,KAAK,UAAU;YAAE,OAAO,UAAU,CAAC;QAC3C,OAAO,OAAO,CAAC;IACjB,CAAC;IAEO,qBAAqB,CAC3B,UAAmC,EACnC,WAAoB;QAEpB,IAAI,UAAU,CAAC,cAAc,KAAK,UAAU;YAAE,OAAO,UAAU,CAAC;QAChE,IAAI,UAAU,CAAC,cAAc,KAAK,eAAe;YAAE,OAAO,eAAe,CAAC;QAC1E,IAAI,WAAW;YAAE,OAAO,UAAU,CAAC;QACnC,OAAO,UAAU,CAAC,CAAC,0CAA0C;IAC/D,CAAC;IAEO,iBAAiB,CACvB,YAAqC;QAErC,IAAI,CAAC,YAAY,CAAC,YAAY;YAAE,OAAO,IAAI,CAAC;QAC5C,MAAM,SAAS,GAAG,YAAY,CAAC,mBAAyC,CAAC;QACzE,IAAI,SAAS,KAAK,OAAO;YAAE,OAAO,OAAO,CAAC;QAC1C,OAAO,MAAM,CAAC,CAAC,yCAAyC;IAC1D,CAAC;IAEO,mBAAmB,CACzB,kBAA2C,EAC3C,UAAoC;QAEpC,MAAM,OAAO,GAAG,kBAAkB,IAAI,EAAE,CAAC;QACzC,OAAO;YACL,EAAE,EAAE,OAAO,CAAC,EAAE,IAAI,KAAK;YACvB,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,OAAO;YAC/B,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,MAAM;YAC5B,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,SAAS;YACjC,aAAa,EAAE,OAAO,CAAC,aAAa,IAAI,gBAAgB;YACxD,6EAA6E;YAC7E,SAAS,EAAE,UAAU,EAAE,cAAoC;YAC3D,QAAQ,EAAE,UAAU,EAAE,aAAmC;SAC1D,CAAC;IACJ,CAAC;CAEF,CAAA;AAj2BY,sCAAsC;IADlD,UAAU,EAAE;IAKR,WAAA,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAA;IACjC,WAAA,MAAM,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,CAAA;IAC3C,WAAA,MAAM,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,CAAA;IAC9C,WAAA,MAAM,CAAC,kBAAkB,CAAC,gCAAgC,CAAC,CAAA;IAC3D,WAAA,MAAM,CAAC,kBAAkB,CAAC,oCAAoC,CAAC,CAAA;IAC/D,WAAA,MAAM,CAAC,kBAAkB,CAAC,oBAAoB,CAAC,CAAA;qCALY,aAAa;QACO,uBAAuB;QACxB,0BAA0B;QACA,uCAAuC;QAC5C,oCAAoC;QACvD,2BAA2B;GATnG,sCAAsC,CAi2BlD","sourcesContent":["/**\n * OAuth2ConnectionResolverBackendService\n *\n * Resolves OAuth2 connection configurations from multiple sources:\n * - Provider definitions from the backend provider registry\n * - App-specific social OAuth2 config from AppConfiguration.auth.socialOAuth2Providers\n * - Client credentials from AppConfiguration.providerConfigurations + secrets\n *\n * Produces an `OAuth2ResolvedConnection` — the canonical input for the OAuth2 engine.\n *\n * Step 4: Implements `resolveSocialConnection()` (fully functional)\n * Step 15: Implements `resolveEnterpriseConnection()` (template/discovery/manual branching)\n *\n * Browser-only OAuth2 / SAML callback model. The redirect URI derived from\n * `runtime.endPoints.main_backend_api.publicUrl` is the OAuth2 callback URL\n * registered at IdPs; the framework targets web stacks exclusively, so\n * there is no native deep-link variant to account for here.\n */\n\nimport 'reflect-metadata';\nimport { injectable, inject } from 'inversify';\nimport { SAAS_SERVICE_TYPES } from '~wildo-backend-lib/inject/models/service-types';\nimport { LoggerService } from '~wildo-backend-lib/monitoring/logger/services/logger.service';\nimport { AppConfigurationService } from '~wildo-backend-lib/config/services/app-configuration.backend.service';\nimport { ErrorBuilderBackendService } from '~wildo-backend-lib/errors/services/error-builder.backend.service';\nimport { ExternalProvidersRegistryBackendService } from '~wildo-backend-lib/external-providers/services/external-providers-registry.backend.service';\nimport { AuthOrganizationConfigurationService } from '~wildo-backend-lib/security/authentications/services/admin-config/auth-organization-configuration.service';\nimport { OIDCDiscoveryBackendService } from '~wildo-backend-lib/security/authentications/services/admin-config/oidc-discovery.backend.service';\nimport {\n  ErrorType,\n  ErrorCustomMessageReference,\n  AuthScopeType,\n  ExternalIdentitySource,\n  SSOPKCEMethod,\n  SSOResponseType,\n  SSOTemplateMode,\n  SsoConnectionType,\n  SsoProtocol,\n  isWildoBackendError,\n} from '@wildo-ai/saas-models';\nimport type {\n  OAuth2ResolvedConnection,\n  OAuth2ProfileMapping,\n  OAuth2StateTokenMetadata,\n} from '~wildo-backend-lib/security/authentications/models/oauth2-connection.backend.schemas';\nimport { buildEnterpriseConnectionScope } from '~wildo-backend-lib/security/authentications/models/sso-connection.backend.schemas';\nimport type { ExecutionContext } from '~wildo-backend-lib/runtime/models/execution-context.backend.schemas';\nimport jwt from 'jsonwebtoken';\nimport { ExternalProvider_ExchangeProtocol_Kind, ProviderProtocolRuntimeKind } from '@wildo-ai/external-connectors-models';\nimport { isSocialOAuth2LoginPurpose } from '~wildo-backend-lib/security/authentications/utils/social-oauth2-purpose.backend.utils';\n\n// ═══════════════════════════════════════════════════════════════\n// Signed JWT Client Secret — Generic (extensions-driven)\n// ═══════════════════════════════════════════════════════════════\n\ninterface SignedJwtClientSecretParams {\n  privateKey: string;\n  keyId: string;\n  teamId: string;\n  clientId: string;\n  algorithm: string;\n  audience: string;\n  maxLifetimeSeconds: number;\n}\n\nconst signedJwtCache = new Map<string, { jwt: string; expiresAt: number }>();\nconst SIGNED_JWT_CACHE_SKEW_MS = 5 * 60 * 1000;\nconst OAUTH2_PROVIDER_CONFIG_KEY = 'sso_oauth2';\n\ninterface OAuth2SsoRuntimeContract {\n  kind: typeof ProviderProtocolRuntimeKind.OAUTH2_SSO;\n  authorizationEndpoint: string;\n  tokenEndpoint: string;\n  userInfoEndpoint?: string;\n  jwksUri?: string;\n  issuer?: string;\n  scopes: ReadonlyArray<string>;\n  clientIdPublicConfigKey?: string;\n  clientSecretRef: string;\n  supportsPkce: boolean;\n  supportsOidc: boolean;\n  tokenEndpointAuthMethod?: 'client_secret_post' | 'client_secret_basic' | 'none';\n  responseMode?: 'query' | 'fragment' | 'form_post';\n  identitySource?: 'userinfo' | 'id_token' | 'callback_body';\n  profileMapping?: OAuth2ProfileMapping;\n  extraAuthParams?: Record<string, string>;\n  extraTokenParams?: Record<string, string>;\n  tokenRequestHeaders?: Record<string, string>;\n  extensions?: Record<string, unknown>;\n}\n\n/**\n * Generic OIDC profile-mapping default — used when a provider's\n * `runtimeContract.profileMapping` is absent. All four engine-shipped social\n * OAuth2 providers (`google`, `microsoft`, `apple`, `github`) declare their\n * own `profileMapping` on the runtime contract, so this default exists only\n * to keep the resolver total for app-contributed OIDC providers that follow\n * the standard claim names.\n *\n * Per-provider behavior MUST live in the provider module's runtime contract,\n * not branched here on `providerRef`.\n */\nconst GENERIC_OIDC_PROFILE_MAPPING: OAuth2ProfileMapping = {\n  id: 'sub',\n  email: 'email',\n  firstName: 'given_name',\n  lastName: 'family_name',\n  name: 'name',\n  image: 'picture',\n  emailVerified: 'email_verified',\n};\n\nfunction getOrGenerateSignedJwtClientSecret(\n  providerRef: string,\n  clientId: string,\n  params: SignedJwtClientSecretParams,\n): string {\n  const cacheKey = [\n    providerRef,\n    clientId,\n    params.keyId,\n    params.teamId,\n    params.algorithm,\n    params.audience,\n    params.maxLifetimeSeconds,\n  ].join(':');\n  const cached = signedJwtCache.get(cacheKey);\n  if (cached && cached.expiresAt > Date.now()) {\n    return cached.jwt;\n  }\n\n  const issuedAt = Date.now();\n  const token = jwt.sign({}, params.privateKey, {\n    algorithm: params.algorithm as jwt.Algorithm,\n    keyid: params.keyId,\n    issuer: params.teamId,\n    audience: params.audience,\n    subject: params.clientId,\n    expiresIn: params.maxLifetimeSeconds,\n  });\n\n  const tokenTtlMs = Math.max(0, params.maxLifetimeSeconds * 1000 - SIGNED_JWT_CACHE_SKEW_MS);\n  signedJwtCache.set(cacheKey, { jwt: token, expiresAt: issuedAt + tokenTtlMs });\n  return token;\n}\n\n/**\n * Resolves OAuth2 connection configurations for social and enterprise SSO.\n * The engine (OAuth2AuthenticationBackendService) never reads from provider catalogs\n * or AppConfiguration directly — it only operates on OAuth2ResolvedConnection.\n */\n@injectable()\nexport class OAuth2ConnectionResolverBackendService {\n  private readonly logDebug: (message: string, context?: Record<string, unknown>) => void;\n\n  constructor(\n    @inject(SAAS_SERVICE_TYPES.Logger) private readonly logger: LoggerService,\n    @inject(SAAS_SERVICE_TYPES.AppConfigService) private readonly appConfigService: AppConfigurationService,\n    @inject(SAAS_SERVICE_TYPES.ErrorBuilderService) private readonly errorBuilder: ErrorBuilderBackendService,\n    @inject(SAAS_SERVICE_TYPES.ExternalProvidersRegistryService) private readonly externalProvidersRegistry: ExternalProvidersRegistryBackendService,\n    @inject(SAAS_SERVICE_TYPES.AuthOrganizationConfigurationService) private readonly orgConfigService: AuthOrganizationConfigurationService,\n    @inject(SAAS_SERVICE_TYPES.OIDCDiscoveryService) private readonly oidcDiscovery: OIDCDiscoveryBackendService,\n  ) {\n    this.logDebug = this.logger.debugByType('OAuth2ConnectionResolver');\n    this.logger.setDebugTypeLogging('OAuth2ConnectionResolver', false);\n  }\n\n  // ═══════════════════════════════════════════════════════════════\n  // Social Connection Resolution\n  // ═══════════════════════════════════════════════════════════════\n\n  /**\n   * Resolve a social SSO connection from the provider catalog + app config + secrets.\n   *\n   * Resolution chain:\n   * 1. Look up provider definition from the backend provider registry\n   * 2. Find the SSO_OAUTH2 protocol on the provider\n   * 3. Read app-specific social OAuth2 config from auth.socialOAuth2Providers[providerRef]\n   * 4. Read OAuth2 credentials from providerConfigurations[providerRef][sso_oauth2]\n   * 5. Resolve clientSecret from secrets store (app-level baseline)\n   * 5b. Check for org/app-level social credential overrides (P3)\n   * 5c. Generate signed-JWT client secret if provider requires it (e.g. Apple)\n   * 6. Derive redirectUri from publicUrl\n   * 7. Map profile fields, scopes, PKCE, response mode, identity source\n   *\n   * ORDERING CONSTRAINT (5b before 5c):\n   * Override credentials (5b) MUST be resolved before signed-JWT generation (5c).\n   * For providers like Apple, `clientSecret` is a raw private key that needs JWT signing.\n   * If 5c ran first, the override would replace the generated JWT with a raw key,\n   * causing the token exchange to fail at the IdP. By running 5b first, whichever\n   * private key is active (app-level or override) goes through JWT signing in 5c.\n   *\n   * @param providerRef - Provider identifier (e.g. 'google', 'apple')\n   * @param options.ec - Execution context, required when scopeId is set\n   * @param options.scopeType - 'organization' or 'application' (defaults to 'organization')\n   * @param options.scopeId - Org/app ID to check for credential overrides in SsoConfig\n   */\n  public async resolveSocialConnection(\n    providerRef: string,\n    options?: { ec?: ExecutionContext<any>; scopeType?: AuthScopeType; scopeId?: string },\n  ): Promise<OAuth2ResolvedConnection> {\n    this.logDebug('Resolving social connection', { providerRef, scopeId: options?.scopeId });\n\n    // 1. Look up provider OAuth2 runtime contract from the effective runtime registry.\n    const oauth2Contract = this.getOAuth2RuntimeContract(providerRef);\n    if (oauth2Contract?.kind !== ProviderProtocolRuntimeKind.OAUTH2_SSO) {\n      throw this.errorBuilder.buildError(ErrorType.NOT_FOUND, undefined, {\n        customMessageReference: ErrorCustomMessageReference.OAUTH_PROVIDER_NOT_FOUND,\n      });\n    }\n\n    try {\n      if (!this.externalProvidersRegistry.isProviderEnabled(providerRef, ExternalProvider_ExchangeProtocol_Kind.SSO_OAUTH2)) {\n        throw this.errorBuilder.buildError(ErrorType.CONFIGURATION, undefined, {\n          customMessageReference: ErrorCustomMessageReference.APP_CONFIGURATION_NOT_INITIALIZED,\n          context: { message: `OAuth2 provider '${providerRef}' is restricted by external provider policy` },\n        });\n      }\n    } catch (error) {\n      if (isWildoBackendError(error)) throw error;\n      this.logDebug('External provider policy not initialized for OAuth2 provider check; falling back to auth.socialOAuth2Providers', {\n        providerRef,\n      });\n    }\n\n    // 3. Read app-specific social OAuth2 config\n    const appConfig = this.appConfigService.config;\n    const socialOAuth2ProviderConfig = appConfig.auth?.socialOAuth2Providers?.[providerRef];\n    if (!socialOAuth2ProviderConfig || socialOAuth2ProviderConfig.enabled === false) {\n      throw this.errorBuilder.buildError(ErrorType.CONFIGURATION, undefined, {\n        customMessageReference: ErrorCustomMessageReference.APP_CONFIGURATION_NOT_INITIALIZED,\n        context: { message: `Social OAuth2 provider '${providerRef}' is not enabled in app configuration` },\n      });\n    }\n    if (!isSocialOAuth2LoginPurpose(socialOAuth2ProviderConfig.purpose)) {\n      throw this.errorBuilder.buildError(ErrorType.CONFIGURATION, undefined, {\n        customMessageReference: ErrorCustomMessageReference.APP_CONFIGURATION_NOT_INITIALIZED,\n        context: { message: `Social OAuth2 provider '${providerRef}' is not configured for user sign-in` },\n      });\n    }\n\n    // 4. Read OAuth2 credentials from providerConfigurations\n    const providerConfigs = appConfig.providerConfigurations?.[providerRef];\n    const protocolConfig = providerConfigs?.[OAUTH2_PROVIDER_CONFIG_KEY] as Record<string, any> | undefined;\n\n    let clientId = protocolConfig?.authConfig?.clientId\n      || protocolConfig?.clientId\n      || (oauth2Contract.clientIdPublicConfigKey ? protocolConfig?.[oauth2Contract.clientIdPublicConfigKey] : undefined);\n\n    if (!clientId) {\n      throw this.errorBuilder.buildError(ErrorType.CONFIGURATION, undefined, {\n        customMessageReference: ErrorCustomMessageReference.APP_CONFIGURATION_NOT_INITIALIZED,\n        context: { message: `Missing clientId for OAuth2 provider '${providerRef}'` },\n      });\n    }\n\n    // 5. Resolve clientSecret from env-provided provider secret material\n    const secretRef = protocolConfig?.authConfig?.secretRef || oauth2Contract.clientSecretRef;\n    let clientSecret = '';\n\n    if (secretRef) {\n      clientSecret = this.externalProvidersRegistry.getProviderSecret(\n        providerRef,\n        OAUTH2_PROVIDER_CONFIG_KEY as any,\n        secretRef,\n      ) || '';\n    }\n\n    if (!clientSecret) {\n      throw this.errorBuilder.buildError(ErrorType.CONFIGURATION, undefined, {\n        customMessageReference: ErrorCustomMessageReference.APP_CONFIGURATION_NOT_INITIALIZED,\n        context: { message: `Missing env-provided clientSecret for OAuth2 provider '${providerRef}'. Check env secretRef '${secretRef}'.` },\n      });\n    }\n\n    // 5b. Scope-level social credential overrides (P3).\n    // An org/app can override the platform-level clientId + clientSecret with their own\n    // OAuth2 app credentials (stored in SsoConfig.socialCredentialOverrides).\n    //\n    // MUST run BEFORE step 5c (signed-JWT generation). For providers like Apple, the\n    // override's clientSecret is a raw private key that still needs JWT signing.\n    // signedJwtKeyId/signedJwtTeamId are captured here and consumed in step 5c.\n    let overrideSignedJwtKeyId: string | undefined;\n    let overrideSignedJwtTeamId: string | undefined;\n    if (options?.scopeId && options.ec) {\n      const scopeType = options.scopeType || AuthScopeType.ORGANIZATION;\n      try {\n        const ssoConfig = await this.orgConfigService.loadSSOConfig(options.ec, scopeType, options.scopeId);\n        const overrides = ssoConfig?.socialCredentialOverrides;\n        const override = overrides?.find(o => o.providerRef === providerRef);\n        if (override) {\n          clientId = override.clientId;\n          clientSecret = override.clientSecret;\n          overrideSignedJwtKeyId = override.signedJwtKeyId;\n          overrideSignedJwtTeamId = override.signedJwtTeamId;\n          this.logDebug('Social credentials overridden by scope config', {\n            providerRef, scopeType, scopeId: options.scopeId,\n          });\n        }\n      } catch (err) {\n        if (!isWildoBackendError(err)) throw err;\n        this.logDebug('Scope SSO config not found for credential override (non-fatal)', {\n          providerRef, scopeType, scopeId: options.scopeId,\n        });\n      }\n    }\n\n    // 5c. Signed JWT client secret generation.\n    // Some providers (e.g. Apple) don't accept a static client secret — they require a\n    // short-lived JWT signed with a private key. The provider's extensions declare this\n    // via clientSecretType='signed_jwt'.\n    //\n    // At this point, `clientSecret` holds either the app-level or overridden private key\n    // (determined by step 5b). The JWT params (teamId, keyId) are resolved with a\n    // fallback chain: override values from step 5b → app-level secrets store.\n    const extensions = oauth2Contract.extensions ?? {};\n    if (extensions.clientSecretType === 'signed_jwt') {\n      const algorithm = String(extensions.clientSecretAlgorithm ?? 'ES256');\n      const audience = String(extensions.clientSecretAudience ?? 'https://appleid.apple.com');\n      const maxLifetimeSeconds = Number(extensions.clientSecretMaxLifetimeSeconds ?? 60 * 60 * 24 * 180);\n      const teamIdRef = String(extensions.teamIdSecretRef ?? `${providerRef.toUpperCase()}_TEAM_ID`);\n      const keyIdRef = String(extensions.keyIdSecretRef ?? `${providerRef.toUpperCase()}_KEY_ID`);\n      const teamId = overrideSignedJwtTeamId || this.externalProvidersRegistry.getProviderSecret(\n        providerRef,\n        OAUTH2_PROVIDER_CONFIG_KEY as any,\n        teamIdRef,\n      );\n      const keyId = overrideSignedJwtKeyId || this.externalProvidersRegistry.getProviderSecret(\n        providerRef,\n        OAUTH2_PROVIDER_CONFIG_KEY as any,\n        keyIdRef,\n      );\n\n      if (!teamId || !keyId) {\n        const missing = [!teamId ? teamIdRef : '', !keyId ? keyIdRef : ''].filter(Boolean).join(', ');\n        throw this.errorBuilder.buildError(ErrorType.CONFIGURATION, undefined, {\n          customMessageReference: ErrorCustomMessageReference.APP_CONFIGURATION_NOT_INITIALIZED,\n          context: { message: `Provider '${providerRef}' requires signed JWT client secret. Missing secrets: ${missing}` },\n        });\n      }\n\n      clientSecret = getOrGenerateSignedJwtClientSecret(\n        providerRef,\n        clientId,\n        { privateKey: clientSecret, keyId, teamId, clientId, algorithm, audience, maxLifetimeSeconds },\n      );\n      this.logDebug('Generated signed JWT client secret', { providerRef, algorithm, audience });\n    }\n\n    // 6. Derive redirectUri from publicUrl (TRAP 14: publicUrl is optional)\n    const publicUrl = appConfig.runtime?.endPoints?.main_backend_api?.publicUrl;\n    if (!publicUrl) {\n      throw this.errorBuilder.buildError(ErrorType.CONFIGURATION, undefined, {\n        customMessageReference: ErrorCustomMessageReference.APP_CONFIGURATION_NOT_INITIALIZED,\n        context: { message: 'runtime.endPoints.main_backend_api.publicUrl is required for OAuth2 redirect URI derivation' },\n      });\n    }\n    const redirectUri = `${publicUrl}/api/v1/auth/oauth2/callback/${providerRef}`;\n\n    // 7. Build the resolved connection\n    const tokenEndpointAuthMethod = this.resolveTokenEndpointAuthMethod(\n      protocolConfig?.tokenEndpointAuthMethod ?? oauth2Contract.tokenEndpointAuthMethod,\n    );\n    const responseMode = oauth2Contract.responseMode ?? this.resolveResponseMode({\n      ...oauth2Contract.extraAuthParams,\n      ...protocolConfig?.extraAuthParams,\n    });\n    const identitySource = oauth2Contract.identitySource\n      ?? this.resolveIdentitySource(extensions, oauth2Contract.userInfoEndpoint);\n    const pkceMethod = oauth2Contract.supportsPkce ? 'S256' : null;\n\n    // Scopes: provider defaults + app-specific additional scopes\n    const defaultScopes = oauth2Contract.scopes || [];\n    const additionalScopes = socialOAuth2ProviderConfig.additionalScopes || [];\n    const scopes = [...new Set([...defaultScopes, ...additionalScopes])];\n\n    // Profile mapping\n    const profileMapping = oauth2Contract.profileMapping ?? GENERIC_OIDC_PROFILE_MAPPING;\n\n    // Extra parameters\n    const extraAuthParams = {\n      ...(oauth2Contract.extraAuthParams || {}),\n      ...(protocolConfig?.extraAuthParams || {}),\n    };\n    const extraTokenParams = {\n      ...(oauth2Contract.extraTokenParams || {}),\n      ...(protocolConfig?.extraTokenParams || {}),\n    };\n    const tokenRequestHeaders = {\n      ...(oauth2Contract.tokenRequestHeaders || {}),\n      ...(protocolConfig?.tokenRequestHeaders || {}),\n    };\n    const resolvedExtensions = {\n      ...extensions,\n      ...(protocolConfig?.extensions || {}),\n    };\n\n    // Issuer and JWKS for ID token validation\n    const issuer = oauth2Contract.issuer;\n    const jwksUri = oauth2Contract.jwksUri;\n\n    const connection: OAuth2ResolvedConnection = {\n      source: oauth2Contract.supportsOidc\n        ? ExternalIdentitySource.OIDC\n        : ExternalIdentitySource.OAUTH2,\n      connectionType: SsoConnectionType.SOCIAL,\n      providerRef,\n      displayName: socialOAuth2ProviderConfig.displayName || providerRef,\n      authorizationUrl: oauth2Contract.authorizationEndpoint,\n      tokenUrl: oauth2Contract.tokenEndpoint,\n      userInfoUrl: oauth2Contract.userInfoEndpoint,\n      redirectUri,\n      issuer,\n      jwksUri,\n      clientId,\n      clientSecret,\n      tokenEndpointAuthMethod,\n      scopes,\n      pkceMethod,\n      responseMode,\n      // A social provider's contract does not express authorization-request shaping; the engine\n      // drives the authorization-code flow for all of them.\n      responseType: SSOResponseType.CODE,\n      identitySource,\n      profileMapping,\n      extraAuthParams: Object.keys(extraAuthParams).length > 0 ? extraAuthParams : undefined,\n      extraTokenParams: Object.keys(extraTokenParams).length > 0 ? extraTokenParams : undefined,\n      tokenRequestHeaders: Object.keys(tokenRequestHeaders).length > 0 ? tokenRequestHeaders : undefined,\n      extensions: Object.keys(resolvedExtensions).length > 0 ? resolvedExtensions : undefined,\n    };\n\n    this.logDebug('Social connection resolved', {\n      providerRef,\n      connectionType: SsoConnectionType.SOCIAL,\n      responseMode,\n      identitySource,\n      pkceMethod,\n      scopeCount: scopes.length,\n    });\n\n    return connection;\n  }\n\n  // ═══════════════════════════════════════════════════════════════\n  // Enterprise Connection Resolution (Step 15)\n  // ═══════════════════════════════════════════════════════════════\n\n  /**\n   * Resolve an enterprise SSO connection from scope-level OIDC configuration.\n   *\n   * Branches on `templateMode`:\n   * - **template**: Load provider definition from the backend provider registry,\n   *   extract SSO_OAUTH2 protocol, apply templateOverrides to URLs\n   * - **discovery**: Call OIDCDiscoveryService.discoverEndpoints(issuer)\n   * - **manual**: Use provided endpoints directly\n   *\n   * The result is an OAuth2ResolvedConnection with\n   * `connectionType: SsoConnectionType.ENTERPRISE`.\n   * The OAuth2 engine (buildAuthorizationUrl, handleCallback, fetchUserProfile) is\n   * reused unchanged — only the resolver logic is different.\n   */\n  public async resolveEnterpriseConnection(\n    scopeType: AuthScopeType,\n    scopeId: string,\n    connectionId: string,\n  ): Promise<OAuth2ResolvedConnection> {\n    this.logDebug('Resolving enterprise connection', { scopeType, scopeId, connectionId });\n\n    // 1. Load the SsoConnection resource by connectionId.\n    //    This runs PRE-AUTH (enterprise SSO login initiation — no user is\n    //    authenticated yet), so the connection is read through the system-access\n    //    path: the caller holds no ORG_ADMIN / APP_ADMIN role the connection's\n    //    READ ACL demands. `loadSsoConnectionAsSystem` bypasses that ACL under the\n    //    connection resource's `systemAccessPolicy.read = ALLOWED` opt-in\n    //    (fail-closed + audited). See AuthOrganizationConfigurationService.\n    const ssoConnection = await this.orgConfigService.loadSsoConnectionAsSystem(scopeType, scopeId, connectionId);\n\n    if (!ssoConnection || !ssoConnection.enabled) {\n      throw this.errorBuilder.buildError(ErrorType.NOT_FOUND, undefined, {\n        customMessageReference: ErrorCustomMessageReference.SSO_CONNECTION_NOT_FOUND,\n      });\n    }\n\n    // 2. SAML connections use a separate authentication flow — reject if this is a SAML connection\n    if (ssoConnection.protocol === SsoProtocol.SAML) {\n      throw this.errorBuilder.buildError(ErrorType.CONFIGURATION, undefined, {\n        customMessageReference: ErrorCustomMessageReference.APP_CONFIGURATION_NOT_INITIALIZED,\n        context: { message: 'SAML connections use the SAML authentication flow, not the OAuth2 resolver. Use /auth/saml/login/:connectionId instead.' },\n      });\n    }\n\n    if (!ssoConnection.oidc) {\n      throw this.errorBuilder.buildError(ErrorType.CONFIGURATION, undefined, {\n        customMessageReference: ErrorCustomMessageReference.APP_CONFIGURATION_NOT_INITIALIZED,\n        context: { message: `SSO connection '${connectionId}' has protocol 'oidc' but no OIDC configuration object.` },\n      });\n    }\n\n    // 3. Build a flattened config view for the downstream resolution methods\n    const oidcConfig: Record<string, any> = {\n      ...ssoConnection.oidc,\n      externalProviderId: ssoConnection.externalProviderId,\n      displayName: ssoConnection.displayName,\n      allowedDomains: ssoConnection.allowedDomains,\n      autoCreateUsers: ssoConnection.autoCreateUsers,\n      autoVerifyEmail: ssoConnection.autoVerifyEmail,\n      defaultRole: ssoConnection.defaultRole,\n      roleMapping: ssoConnection.roleMapping,\n      groupMapping: ssoConnection.groupMapping,\n    };\n\n    // 4. Resolve endpoints based on templateMode\n    const templateMode = oidcConfig.templateMode || SSOTemplateMode.MANUAL;\n    let authorizationUrl: string;\n    let tokenUrl: string;\n    let userInfoUrl: string | undefined;\n    let jwksUri: string | undefined;\n    let endSessionEndpoint: string | undefined;\n    let issuer: string | undefined;\n    let scopes: string[];\n    let extraAuthParams: Record<string, string> | undefined;\n    let pkceMethod: OAuth2ResolvedConnection['pkceMethod'] = oidcConfig.pkceEnabled\n      ? (\n        oidcConfig.pkceMethod === SSOPKCEMethod.PLAIN\n          ? SSOPKCEMethod.PLAIN\n          : SSOPKCEMethod.S256\n      )\n      : null;\n\n    switch (templateMode) {\n      case SSOTemplateMode.TEMPLATE:\n        ({ authorizationUrl, tokenUrl, userInfoUrl, jwksUri, endSessionEndpoint, issuer, scopes, extraAuthParams, pkceMethod } =\n          await this.resolveFromTemplate(oidcConfig, pkceMethod));\n        break;\n\n      case SSOTemplateMode.DISCOVERY:\n        ({ authorizationUrl, tokenUrl, userInfoUrl, jwksUri, endSessionEndpoint, issuer, scopes } =\n          await this.resolveFromDiscovery(oidcConfig));\n        break;\n\n      case SSOTemplateMode.MANUAL:\n      default:\n        ({ authorizationUrl, tokenUrl, userInfoUrl, jwksUri, endSessionEndpoint, issuer, scopes } =\n          this.resolveFromManual(oidcConfig));\n        break;\n    }\n\n    // 4. Derive redirectUri from publicUrl\n    const publicUrl = this.appConfigService.config.runtime?.endPoints?.main_backend_api?.publicUrl;\n    if (!publicUrl) {\n      throw this.errorBuilder.buildError(ErrorType.CONFIGURATION, undefined, {\n        customMessageReference: ErrorCustomMessageReference.APP_CONFIGURATION_NOT_INITIALIZED,\n        context: { message: 'runtime.endPoints.main_backend_api.publicUrl is required for OAuth2 redirect URI derivation' },\n      });\n    }\n    const providerRef = oidcConfig.externalProviderId || 'enterprise-oidc';\n    const redirectUri = `${publicUrl}/api/v1/auth/oauth2/callback/${providerRef}`;\n\n    // 5. Map org claimsMapping → canonical profileMapping\n    const profileMapping = this.buildEnterpriseProfileMapping(oidcConfig.claimsMapping);\n\n    // 6. Build response mode\n    const responseMode = oidcConfig.responseMode || 'query';\n\n    /*\n     * 6b. Authorization-request shaping (#419). Until 2026-09-08 these were persisted, audit-marked\n     * and never sent — so an operator who set `acrValues` to demand step-up at the IdP got no such\n     * demand and no error.\n     *\n     * `responseType` is REFUSED rather than forwarded when it names a flow the engine does not\n     * implement. `SSOResponseType` offers `code`, `id_token` and `token`; the callback path only\n     * exchanges an authorization CODE, so sending `id_token` would trade a silent no-op for a\n     * silently broken login — strictly worse. A refusal at resolution time names the connection and\n     * the value, and lifts on its own the day the implicit flows are implemented.\n     */\n    const responseType = oidcConfig.responseType ?? SSOResponseType.CODE;\n    if (responseType !== SSOResponseType.CODE) {\n      throw this.errorBuilder.buildError(ErrorType.CONFIGURATION, undefined, {\n        customMessageReference: ErrorCustomMessageReference.CONFIGURATION,\n        context: {\n          message: `SSO connection declares oidc.responseType \"${responseType}\", and this engine implements the authorization-code flow only. `\n            + 'Set it to \"code\", or implement the implicit flow before selecting it.',\n          connectionId,\n          providerRef: oidcConfig.externalProviderId,\n        },\n      });\n    }\n\n    // 7. Assemble OAuth2ResolvedConnection\n    const connection: OAuth2ResolvedConnection = {\n      source: ExternalIdentitySource.OIDC,\n      connectionType: SsoConnectionType.ENTERPRISE,\n      providerRef,\n      displayName: oidcConfig.displayName,\n      authorizationUrl,\n      tokenUrl,\n      userInfoUrl,\n      redirectUri,\n      issuer,\n      jwksUri,\n      clientId: oidcConfig.clientId,\n      clientSecret: oidcConfig.clientSecret,\n      tokenEndpointAuthMethod: 'client_secret_post',\n      scopes,\n      pkceMethod,\n      responseMode: responseMode as 'query' | 'fragment' | 'form_post',\n      responseType: SSOResponseType.CODE,\n      acrValues: oidcConfig.acrValues && oidcConfig.acrValues.length > 0 ? oidcConfig.acrValues : undefined,\n      maxAge: oidcConfig.maxAge,\n      prompt: oidcConfig.prompt,\n      identitySource: userInfoUrl ? 'userinfo' : 'id_token',\n      profileMapping,\n      extraAuthParams,\n      scope: buildEnterpriseConnectionScope(scopeType, scopeId, connectionId),\n      // Build the provisioning config ONCE here (the single source), so the callback passes it\n      // straight to provisionEnterpriseUser with no per-field re-copy. Defaults are centralised (the loose\n      // per-field copies previously diverged — OAuth2 omitted the `allowedDomains` fallback).\n      provisioningConfig: {\n        autoCreateUsers: oidcConfig.autoCreateUsers ?? true,\n        autoVerifyEmail: oidcConfig.autoVerifyEmail ?? true,\n        defaultRole: oidcConfig.defaultRole,\n        roleMapping: oidcConfig.roleMapping,\n        groupMapping: oidcConfig.groupMapping,\n        allowedDomains: oidcConfig.allowedDomains ?? [],\n      },\n    };\n\n    this.logDebug('Enterprise connection resolved', {\n      scopeType,\n      scopeId,\n      connectionId,\n      templateMode,\n      providerRef,\n      hasUserInfoUrl: !!userInfoUrl,\n    });\n\n    return connection;\n  }\n\n  // ═══════════════════════════════════════════════════════════════\n  // Enterprise Resolution Strategies\n  // ═══════════════════════════════════════════════════════════════\n\n  /**\n   * Template mode: Load provider OAuth2 runtime contract and apply org overrides.\n   * Example: Microsoft Azure AD — load Microsoft provider template, substitute {tenant} in URLs.\n   */\n  private async resolveFromTemplate(\n    oidcConfig: Record<string, any>,\n    defaultPkceMethod: 'S256' | 'plain' | null,\n  ): Promise<{\n    authorizationUrl: string; tokenUrl: string; userInfoUrl?: string;\n    jwksUri?: string; endSessionEndpoint?: string; issuer?: string;\n    scopes: string[]; extraAuthParams?: Record<string, string>;\n    pkceMethod: 'S256' | 'plain' | null;\n  }> {\n    const externalProviderId = oidcConfig.externalProviderId;\n    if (!externalProviderId) {\n      throw this.errorBuilder.buildError(ErrorType.CONFIGURATION, undefined, {\n        customMessageReference: ErrorCustomMessageReference.APP_CONFIGURATION_NOT_INITIALIZED,\n        context: { message: 'templateMode=template requires externalProviderId' },\n      });\n    }\n\n    const oauth2Contract = this.getOAuth2RuntimeContract(externalProviderId);\n    if (!oauth2Contract) {\n      throw this.errorBuilder.buildError(ErrorType.NOT_FOUND, undefined, {\n        customMessageReference: ErrorCustomMessageReference.OAUTH_PROVIDER_NOT_FOUND,\n      });\n    }\n\n    const templateOverrides = oidcConfig.templateOverrides || {};\n\n    // Apply template variable substitution to endpoint URLs\n    const authorizationUrl = this.oidcDiscovery.resolveTemplateUrl(oauth2Contract.authorizationEndpoint || '', templateOverrides);\n    const tokenUrl = this.oidcDiscovery.resolveTemplateUrl(oauth2Contract.tokenEndpoint || '', templateOverrides);\n    const userInfoUrl = oauth2Contract.userInfoEndpoint\n      ? this.oidcDiscovery.resolveTemplateUrl(oauth2Contract.userInfoEndpoint, templateOverrides)\n      : undefined;\n    const jwksUri = oauth2Contract.jwksUri\n      ? this.oidcDiscovery.resolveTemplateUrl(oauth2Contract.jwksUri, templateOverrides)\n      : undefined;\n    const endSessionEndpoint = undefined; // Discovery would need to be fetched for this\n\n    // Resolve issuer from discovery URL template\n    const issuer = oauth2Contract.issuer\n      ? this.oidcDiscovery.resolveTemplateUrl(oauth2Contract.issuer, templateOverrides)\n      : undefined;\n\n    // Scopes: template defaults + org custom scopes\n    const defaultScopes = oauth2Contract.scopes || ['openid', 'email', 'profile'];\n    const customScopes = oidcConfig.customScopes || [];\n    const scopes = [...new Set([...defaultScopes, ...oidcConfig.scopes, ...customScopes])];\n\n    // Extra auth params from template + overrides\n    let extraAuthParams: Record<string, string> | undefined;\n    const templateExtraAuthParams = {\n      ...(oauth2Contract.extraAuthParams || {}),\n      ...(oidcConfig.extraAuthParams || {}),\n    };\n    if (Object.keys(templateExtraAuthParams).length > 0) {\n      extraAuthParams = this.oidcDiscovery.resolveTemplateParams(templateExtraAuthParams, templateOverrides);\n    }\n\n    // PKCE from template capabilities\n    const pkceMethod = oauth2Contract.supportsPkce ? 'S256' as const : defaultPkceMethod;\n\n    return { authorizationUrl, tokenUrl, userInfoUrl, jwksUri, endSessionEndpoint, issuer, scopes, extraAuthParams, pkceMethod };\n  }\n\n  /**\n   * Discovery mode: Auto-discover endpoints from .well-known/openid-configuration.\n   * Used for Okta, Auth0, and generic OIDC providers.\n   */\n  private async resolveFromDiscovery(\n    oidcConfig: Record<string, any>,\n  ): Promise<{\n    authorizationUrl: string; tokenUrl: string; userInfoUrl?: string;\n    jwksUri?: string; endSessionEndpoint?: string; issuer?: string;\n    scopes: string[];\n  }> {\n    const issuerUrl = oidcConfig.issuer || oidcConfig.discoveryUrl?.replace('/.well-known/openid-configuration', '');\n    if (!issuerUrl) {\n      throw this.errorBuilder.buildError(ErrorType.CONFIGURATION, undefined, {\n        customMessageReference: ErrorCustomMessageReference.APP_CONFIGURATION_NOT_INITIALIZED,\n        context: { message: 'templateMode=discovery requires issuer or discoveryUrl' },\n      });\n    }\n\n    const doc = await this.oidcDiscovery.discoverEndpoints(issuerUrl);\n\n    const customScopes = oidcConfig.customScopes || [];\n    const scopes = [...new Set([...oidcConfig.scopes, ...customScopes])];\n\n    return {\n      authorizationUrl: doc.authorization_endpoint,\n      tokenUrl: doc.token_endpoint,\n      userInfoUrl: doc.userinfo_endpoint,\n      jwksUri: doc.jwks_uri,\n      endSessionEndpoint: doc.end_session_endpoint,\n      issuer: doc.issuer,\n      scopes,\n    };\n  }\n\n  private getOAuth2RuntimeContract(providerRef: string): OAuth2SsoRuntimeContract | undefined {\n    const protocolConfig = this.externalProvidersRegistry.getProviderConfiguration(\n      providerRef,\n      ExternalProvider_ExchangeProtocol_Kind.SSO_OAUTH2,\n    ) as Record<string, any> | undefined;\n\n    return protocolConfig?.runtimeContract?.kind === ProviderProtocolRuntimeKind.OAUTH2_SSO\n      ? protocolConfig.runtimeContract as OAuth2SsoRuntimeContract\n      : undefined;\n  }\n\n  /**\n   * Manual mode: Use all provided endpoints directly (backward-compatible).\n   */\n  private resolveFromManual(\n    oidcConfig: Record<string, any>,\n  ): {\n    authorizationUrl: string; tokenUrl: string; userInfoUrl?: string;\n    jwksUri?: string; endSessionEndpoint?: string; issuer?: string;\n    scopes: string[];\n  } {\n    if (!oidcConfig.authorizationEndpoint || !oidcConfig.tokenEndpoint) {\n      throw this.errorBuilder.buildError(ErrorType.CONFIGURATION, undefined, {\n        customMessageReference: ErrorCustomMessageReference.APP_CONFIGURATION_NOT_INITIALIZED,\n        context: { message: 'templateMode=manual requires authorizationEndpoint and tokenEndpoint' },\n      });\n    }\n\n    const customScopes = oidcConfig.customScopes || [];\n    const scopes = [...new Set([...oidcConfig.scopes, ...customScopes])];\n\n    return {\n      authorizationUrl: oidcConfig.authorizationEndpoint,\n      tokenUrl: oidcConfig.tokenEndpoint,\n      userInfoUrl: oidcConfig.userInfoEndpoint,\n      jwksUri: oidcConfig.jwksUri,\n      endSessionEndpoint: oidcConfig.endSessionEndpoint,\n      issuer: oidcConfig.issuer,\n      scopes,\n    };\n  }\n\n  /**\n   * Build the canonical `OAuth2ProfileMapping` from an enterprise connection's\n   * OIDC `claimsMapping`.\n   *\n   * DEFENSE-IN-DEPTH DEFAULTS (`email` / `firstName` / `lastName`): each falls\n   * back to the standard OIDC claim name (`email`, `given_name`, `family_name`)\n   * when the connection's `claimsMapping` — or an individual field on it — is\n   * absent or empty. The fallbacks mirror {@link GENERIC_OIDC_PROFILE_MAPPING}\n   * and the `oidc.claimsMapping` Zod defaults on `SsoConnectionBaseSchema`\n   * (`@wildo-ai/saas-models`), so the three sources agree on one contract.\n   *\n   * Why this guard is needed — the schema defaults are NOT guaranteed here.\n   * Zod `.default()` fires at WRITE-time input parse and only when the\n   * `claimsMapping` key is present; a `claimsMapping`-absent object throws at\n   * parse rather than synthesizing the key. This value, however, is consumed\n   * straight off a SYSTEM READ of the stored connection\n   * (`loadSsoConnectionAsSystem` → `readAsSystem`), and the read boundary does\n   * not re-synthesize a `claimsMapping` that was never persisted — e.g. a raw\n   * repository row, a mongosh-inserted doc, or a nested-subdocument `$set`\n   * UPDATE that replaced `oidc` without re-supplying `claimsMapping`. Without a\n   * fallback, `profileMapping.email` is `undefined`, `extractUserProfile`\n   * (`oauth2-authentication.backend.service`) then resolves an empty email and\n   * throws `AUTHENTICATION_INVALID_TOKEN` (\"missing providerUserId or email\"),\n   * so EVERY enterprise OIDC login for that connection fails at profile\n   * extraction — after a successful token exchange.\n   *\n   * Additive / no-regression: `||` supplies the standard default whenever the\n   * field is absent OR an empty string. A claim NAME is never legitimately\n   * empty (`z.string()` on `claimsMapping.*` carries no `.min(1)`, so a\n   * form-cleared field or a partial stored doc can persist `''`), so `''` is\n   * treated like absent — closing the exact malformed-doc hole this guard\n   * exists for, which a `null`/`undefined`-only `??` would leave open. An\n   * authored non-standard claim name is preserved untouched. Mirrors the\n   * social-path helper `buildProfileMapping`, which defaults the same way.\n   *\n   * `id` / `name` / `image` / `emailVerified` are framework-fixed standard OIDC\n   * claims (not operator-mappable on the enterprise connection), so they stay\n   * hardcoded rather than reading from `claimsMapping`.\n   */\n  private buildEnterpriseProfileMapping(claimsMapping?: Record<string, any>): OAuth2ProfileMapping {\n    const m = claimsMapping || {};\n    return {\n      id: 'sub',\n      email: m.email || 'email',\n      firstName: m.firstName || 'given_name',\n      lastName: m.lastName || 'family_name',\n      name: 'name',\n      image: 'picture',\n      emailVerified: 'email_verified',\n      roles: m.roles,\n      groups: m.groups,\n      department: m.department,\n      employeeId: m.employeeId,\n    };\n  }\n\n  // ═══════════════════════════════════════════════════════════════\n  // G3: Org-Level OAuth2 Provider Restrictions\n  // ═══════════════════════════════════════════════════════════════\n\n  /**\n   * Check if a specific OAuth2 social provider is allowed for a scope (org or app).\n   *\n   * Evaluation order:\n   * 1. No config / no restrictions → allowed (backward-compatible)\n   * 2. requireEnterpriseSSOOnly → blocked (all social providers)\n   * 3. allowedProviders non-empty and provider not in list → blocked\n   * 4. blockedProviders includes provider → blocked (takes precedence over allowlist)\n   * 5. Otherwise → allowed\n   */\n  public async isProviderAllowed(\n    ec: ExecutionContext<any>,\n    scopeType: AuthScopeType,\n    scopeId: string,\n    providerRef: string,\n  ): Promise<{ allowed: boolean; reason?: string }> {\n    const ssoConfig = await this.orgConfigService.loadSSOConfig(ec, scopeType, scopeId);\n    if (!(ssoConfig as any)?.oauth2ProviderRestrictions) {\n      return { allowed: true };\n    }\n\n    const restrictions = (ssoConfig as any).oauth2ProviderRestrictions;\n\n    if (restrictions.requireEnterpriseSSOOnly) {\n      return { allowed: false, reason: 'Organization requires enterprise SSO only' };\n    }\n\n    if (restrictions.allowedProviders?.length > 0 && !restrictions.allowedProviders.includes(providerRef)) {\n      return { allowed: false, reason: 'Provider not in organization allowlist' };\n    }\n\n    if (restrictions.blockedProviders?.includes(providerRef)) {\n      return { allowed: false, reason: 'Provider blocked by organization policy' };\n    }\n\n    return { allowed: true };\n  }\n\n  /**\n   * Filter a list of OAuth2 social provider refs by scope-level restrictions.\n   * Returns only the providers that are allowed for the scope.\n   */\n  public async filterProviders(\n    ec: ExecutionContext<any>,\n    scopeType: AuthScopeType,\n    scopeId: string,\n    providerRefs: string[],\n  ): Promise<string[]> {\n    const results = await Promise.all(\n      providerRefs.map(async (ref) => {\n        const { allowed } = await this.isProviderAllowed(ec, scopeType, scopeId, ref);\n        return allowed ? ref : null;\n      }),\n    );\n    return results.filter((ref): ref is string => ref !== null);\n  }\n\n  // ═══════════════════════════════════════════════════════════════\n  // State-Based Resolution (Callback Router)\n  // ═══════════════════════════════════════════════════════════════\n\n  /**\n   * Re-resolve a connection from state token metadata on OAuth2 callback.\n   *\n   * The callback handler calls this to get fresh credentials matching the\n   * authorize-time configuration. Dispatches to resolveSocialConnection()\n   * or resolveEnterpriseConnection() based on connectionType in the token.\n   *\n   * For social connections with a scopeId, the scope context is forwarded\n   * to resolveSocialConnection() so it can apply credential overrides (P3)\n   * and signed-JWT generation in the correct order.\n   *\n   * Scope is explicit: enterprise state requires both `scopeType` and `scopeId`.\n   * A partial or mode-less state token fails closed instead of being interpreted\n   * as an organization-scoped legacy token.\n   */\n  public async resolveFromState(\n    ec: ExecutionContext<any>,\n    stateMetadata: OAuth2StateTokenMetadata,\n  ): Promise<OAuth2ResolvedConnection> {\n    const scopeId = stateMetadata.scopeId;\n    const scopeType = stateMetadata.scopeType;\n    if ((scopeId === undefined) !== (scopeType === undefined)) {\n      throw this.errorBuilder.buildError(ErrorType.VALIDATION, undefined, {\n        customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_INVALID_TOKEN,\n      });\n    }\n\n    if (stateMetadata.connectionType === SsoConnectionType.ENTERPRISE) {\n      if (!scopeType || !scopeId || !stateMetadata.connectionId) {\n        throw this.errorBuilder.buildError(ErrorType.VALIDATION, undefined, {\n          customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_INVALID_TOKEN,\n        });\n      }\n      return this.resolveEnterpriseConnection(\n        scopeType,\n        scopeId,\n        stateMetadata.connectionId,\n      );\n    }\n\n    return this.resolveSocialConnection(stateMetadata.providerRef, scopeId && scopeType ? {\n      ec,\n      scopeType,\n      scopeId,\n    } : undefined);\n  }\n\n  // ═══════════════════════════════════════════════════════════════\n  // Private Helpers\n  // ═══════════════════════════════════════════════════════════════\n\n  private resolveTokenEndpointAuthMethod(\n    method?: string,\n  ): 'client_secret_post' | 'client_secret_basic' | 'none' {\n    switch (method) {\n      case 'client_secret_basic':\n        return 'client_secret_basic';\n      case 'none':\n        return 'none';\n      default:\n        return 'client_secret_post';\n    }\n  }\n\n  private resolveResponseMode(\n    extraAuthParams?: Record<string, string>,\n  ): 'query' | 'fragment' | 'form_post' {\n    const mode = extraAuthParams?.response_mode;\n    if (mode === 'form_post') return 'form_post';\n    if (mode === 'fragment') return 'fragment';\n    return 'query';\n  }\n\n  private resolveIdentitySource(\n    extensions: Record<string, unknown>,\n    userInfoUrl?: string,\n  ): 'userinfo' | 'id_token' | 'callback_body' {\n    if (extensions.identitySource === 'id_token') return 'id_token';\n    if (extensions.identitySource === 'callback_body') return 'callback_body';\n    if (userInfoUrl) return 'userinfo';\n    return 'id_token'; // Fallback for providers without userinfo\n  }\n\n  private resolvePKCEMethod(\n    capabilities: Record<string, unknown>,\n  ): 'S256' | 'plain' | null {\n    if (!capabilities.supportsPKCE) return null;\n    const preferred = capabilities.preferredPKCEMethod as string | undefined;\n    if (preferred === 'plain') return 'plain';\n    return 'S256'; // Default to S256 when PKCE is supported\n  }\n\n  private buildProfileMapping(\n    userProfileMapping?: Record<string, string>,\n    extensions?: Record<string, unknown>,\n  ): OAuth2ProfileMapping {\n    const mapping = userProfileMapping || {};\n    return {\n      id: mapping.id || 'sub',\n      email: mapping.email || 'email',\n      name: mapping.name || 'name',\n      image: mapping.image || 'picture',\n      emailVerified: mapping.emailVerified || 'email_verified',\n      // Extension-based fields (Google provides given_name/family_name separately)\n      firstName: extensions?.firstNameField as string | undefined,\n      lastName: extensions?.lastNameField as string | undefined,\n    };\n  }\n\n}\n"]}

package/dist/esm/security/authentications/services/auth-methods/webauthn.backend.service.d.ts

@@ -35,6 +35,27 @@ export declare enum PasskeyAuthenticationCeremony {
     LOGIN = "login",
     STEP_UP = "step_up"
 }
+/**
+ * What a passkey assertion verification answers.
+ *
+ * `cloneSuspicion` is present ONLY when the assertion's signature verified and its counter did not
+ * advance — the W3C cloned-authenticator signal. It is returned rather than audited here because
+ * this service deliberately emits no audit rows (see the class header): the caller holds the
+ * request's device information and is where the trail is written.
+ */
+export interface PasskeyAuthenticationVerificationResult {
+    verified: boolean;
+    credentialId: string;
+    cloneSuspicion?: {
+        credentialId: string;
+        storedCounter: number;
+        receivedCounter: number;
+        credentialDeviceType: string;
+        credentialBackedUp: boolean;
+        aaguid?: string;
+        ceremony: PasskeyAuthenticationCeremony;
+    };
+}
 /**
  * WebAuthnBackendService
  *
@@ -83,12 +104,15 @@ export declare class WebAuthnBackendService {
      * Verify a WebAuthn authentication response.
      * Updates the credential counter and lastUsedAt on success.
      */
-    verifyAuthenticationResponse(ec: ExecutionContext<any>, userId: string, response: AuthenticationResponseJSON, ceremony?: PasskeyAuthenticationCeremony): Promise<{
-        verified: boolean;
-        credentialId: string;
-    }>;
+    verifyAuthenticationResponse(ec: ExecutionContext<any>, userId: string, response: AuthenticationResponseJSON, ceremony?: PasskeyAuthenticationCeremony): Promise<PasskeyAuthenticationVerificationResult>;
     /**
-     * List all passkey credentials for a user (safe fields only — no publicKey/counter).
+     * List all passkey credentials for a user, as STORED.
+     *
+     * This returns the whole `PasskeyCredentialEntry`, `publicKey` and `counter` included. It is not a
+     * safe-field projection, and must not be handed to a caller as one: the projection that reaches a
+     * client is built at the controller (`handlePasskeyList`), which selects the credential id, name,
+     * timestamps and device flags and nothing else. A new consumer of this method owes its own
+     * projection, or it will disclose the stored credential material.
      */
     getCredentials(ec: ExecutionContext<any>, userId: string): Promise<PasskeyCredentialEntry[]>;
     /**

package/dist/esm/security/authentications/services/auth-methods/webauthn.backend.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"webauthn.backend.service.d.ts","sourceRoot":"","sources":["../../../../../../../src/security/authentications/services/auth-methods/webauthn.backend.service.ts"],"names":[],"mappings":"AAAA,OAAO,kBAAkB,CAAC;AAQ1B,OAAO,KAAK,EACV,sCAAsC,EACtC,qCAAqC,EACrC,wBAAwB,EACxB,0BAA0B,EAC3B,MAAM,wBAAwB,CAAC;AAGhC,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAC7F,OAAO,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AAE/G,OAAO,EAAE,YAAY,EAAE,MAAM,qDAAqD,CAAC;AACnF,OAAO,EAAE,+BAA+B,EAAE,MAAM,gGAAgG,CAAC;AACjJ,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAC9G,OAAO,EAAE,gBAAgB,EAAE,MAAM,qEAAqE,CAAC;AACvG,OAAO,EAEL,sBAAsB,EAGvB,MAAM,uBAAuB,CAAC;AAW/B;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,oBAAY,6BAA6B;IACvC,KAAK,UAAU;IACf,OAAO,YAAY;CACpB;AAED;;;;;;;;;;;;GAYG;AACH,qBACa,sBAAsB;IAII,OAAO,CAAC,QAAQ,CAAC,MAAM;IACb,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IACrC,OAAO,CAAC,QAAQ,CAAC,YAAY;IACjB,OAAO,CAAC,QAAQ,CAAC,aAAa;IACnC,OAAO,CAAC,QAAQ,CAAC,YAAY;IAP/E,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA+D;gBAGlC,MAAM,EAAE,aAAa,EACX,gBAAgB,EAAE,uBAAuB,EAC7C,YAAY,EAAE,YAAY,EACd,aAAa,EAAE,+BAA+B,EACnD,YAAY,EAAE,0BAA0B;IAQ3G,OAAO,KAAK,IAAI,GAEf;IAED,OAAO,KAAK,MAAM,GAEjB;IAED,OAAO,KAAK,UAAU,GAErB;IAED;;;OAGG;IACH,OAAO,KAAK,eAAe,GAY1B;IAID;;;OAGG;IACG,2BAA2B,CAC/B,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACzB,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,sCAAsC,CAAC;IAuClD;;;OAGG;IACG,0BAA0B,CAC9B,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACzB,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,wBAAwB,EAClC,cAAc,CAAC,EAAE,MAAM,GACtB,OAAO,CAAC,sBAAsB,CAAC;IAoDlC;;;OAGG;IACG,6BAA6B,CACjC,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACzB,MAAM,EAAE,MAAM,EACd,QAAQ,GAAE,6BAAmE,GAC5E,OAAO,CAAC,qCAAqC,CAAC;IA2BjD;;;OAGG;IACG,4BAA4B,CAChC,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACzB,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,0BAA0B,EACpC,QAAQ,GAAE,6BAAmE,GAC5E,OAAO,CAAC;QAAE,QAAQ,EAAE,OAAO,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,CAAC;IAkEvD;;OAEG;IACG,cAAc,CAAC,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,EAAE,CAAC;IAKlG;;OAEG;IACG,gBAAgB,CAAC,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAgBtG;;OAEG;IACG,gBAAgB,CAAC,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAsBvH;;;OAGG;IACH,OAAO,CAAC,gBAAgB;IAOxB;;;;;;;;OAQG;IACH,OAAO,CAAC,oBAAoB;YAMd,eAAe;IAI7B;;;;;;;OAOG;YACW,sBAAsB;IAMpC;;;OAGG;YACW,wBAAwB;CAcvC"}
+{"version":3,"file":"webauthn.backend.service.d.ts","sourceRoot":"","sources":["../../../../../../../src/security/authentications/services/auth-methods/webauthn.backend.service.ts"],"names":[],"mappings":"AAAA,OAAO,kBAAkB,CAAC;AAQ1B,OAAO,KAAK,EACV,sCAAsC,EACtC,qCAAqC,EACrC,wBAAwB,EACxB,0BAA0B,EAC3B,MAAM,wBAAwB,CAAC;AAGhC,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAC7F,OAAO,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AAE/G,OAAO,EAAE,YAAY,EAAE,MAAM,qDAAqD,CAAC;AACnF,OAAO,EAAE,+BAA+B,EAAE,MAAM,gGAAgG,CAAC;AACjJ,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAC9G,OAAO,EAAE,gBAAgB,EAAE,MAAM,qEAAqE,CAAC;AACvG,OAAO,EAEL,sBAAsB,EAGvB,MAAM,uBAAuB,CAAC;AAW/B;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,oBAAY,6BAA6B;IACvC,KAAK,UAAU;IACf,OAAO,YAAY;CACpB;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,uCAAuC;IACtD,QAAQ,EAAE,OAAO,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,cAAc,CAAC,EAAE;QACf,YAAY,EAAE,MAAM,CAAC;QACrB,aAAa,EAAE,MAAM,CAAC;QACtB,eAAe,EAAE,MAAM,CAAC;QACxB,oBAAoB,EAAE,MAAM,CAAC;QAC7B,kBAAkB,EAAE,OAAO,CAAC;QAC5B,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,QAAQ,EAAE,6BAA6B,CAAC;KACzC,CAAC;CACH;AAED;;;;;;;;;;;;GAYG;AACH,qBAEa,sBAAsB;IAII,OAAO,CAAC,QAAQ,CAAC,MAAM;IACb,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IACrC,OAAO,CAAC,QAAQ,CAAC,YAAY;IACjB,OAAO,CAAC,QAAQ,CAAC,aAAa;IACnC,OAAO,CAAC,QAAQ,CAAC,YAAY;IAP/E,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA+D;gBAGlC,MAAM,EAAE,aAAa,EACX,gBAAgB,EAAE,uBAAuB,EAC7C,YAAY,EAAE,YAAY,EACd,aAAa,EAAE,+BAA+B,EACnD,YAAY,EAAE,0BAA0B;IAQ3G,OAAO,KAAK,IAAI,GAEf;IAED,OAAO,KAAK,MAAM,GAEjB;IAED,OAAO,KAAK,UAAU,GAErB;IAED;;;OAGG;IACH,OAAO,KAAK,eAAe,GAY1B;IAID;;;OAGG;IACG,2BAA2B,CAC/B,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACzB,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,sCAAsC,CAAC;IAuClD;;;OAGG;IACG,0BAA0B,CAC9B,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACzB,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,wBAAwB,EAClC,cAAc,CAAC,EAAE,MAAM,GACtB,OAAO,CAAC,sBAAsB,CAAC;IAoDlC;;;OAGG;IACG,6BAA6B,CACjC,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACzB,MAAM,EAAE,MAAM,EACd,QAAQ,GAAE,6BAAmE,GAC5E,OAAO,CAAC,qCAAqC,CAAC;IA2BjD;;;OAGG;IACG,4BAA4B,CAChC,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACzB,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,0BAA0B,EACpC,QAAQ,GAAE,6BAAmE,GAC5E,OAAO,CAAC,uCAAuC,CAAC;IAoInD;;;;;;;;OAQG;IACG,cAAc,CAAC,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,EAAE,CAAC;IAKlG;;OAEG;IACG,gBAAgB,CAAC,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAgBtG;;OAEG;IACG,gBAAgB,CAAC,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAsBvH;;;OAGG;IACH,OAAO,CAAC,gBAAgB;IAOxB;;;;;;;;OAQG;IACH,OAAO,CAAC,oBAAoB;YAMd,eAAe;IAI7B;;;;;;;OAOG;YACW,sBAAsB;IAMpC;;;OAGG;YACW,wBAAwB;CAcvC"}

package/dist/esm/security/authentications/services/auth-methods/webauthn.backend.service.js

@@ -258,22 +258,88 @@ let WebAuthnBackendService = class WebAuthnBackendService {
             credential: {
                 id: matchedCredential.credentialId,
                 publicKey: Buffer.from(matchedCredential.publicKey, 'base64url'),
-                counter: matchedCredential.counter,
+                /*
+                 * DELIBERATELY 0, NOT the stored counter — and this line is load-bearing, so read the
+                 * reason before "fixing" it.
+                 *
+                 * `@simplewebauthn/server` evaluates its own counter guard BEFORE `verifySignature`
+                 * (verifyAuthenticationResponse.js:144-151 in 13.3.x, then :154). Handing it the real
+                 * stored value therefore refuses a counter regression on an assertion whose signature was
+                 * never checked — so ANY caller who knows a credential id could trigger the refusal, and
+                 * an alert raised there would be forgeable by an unauthenticated party.
+                 *
+                 * W3C WebAuthn L3 puts the counter comparison at §7.2 step 22, AFTER signature
+                 * verification at step 21, precisely because a counter regression only means something
+                 * when the assertion is known to come from something holding the private key. Passing 0
+                 * makes the library's predicate unsatisfiable — `(counter > 0 || 0 > 0) && counter <= 0`
+                 * is false for every input — so the library does what we want from it (verify the
+                 * signature) and the counter decision stays here, below, where it is ours and where it is
+                 * post-authentication.
+                 *
+                 * spec-cite: W3C Web Authentication Level 3 §7.2 steps 21-22
+                 * (https://www.w3.org/TR/webauthn-3/#sctn-verifying-assertion).
+                 */
+                counter: 0,
                 transports: matchedCredential.transports,
             },
         });
         if (!verification.verified) {
             return { verified: false, credentialId: response.id };
         }
-        // Counter verification (clone detection)
+        /*
+         * CLONE DETECTION — the spec's predicate, on a signature-verified assertion.
+         *
+         * "If either is non-zero, and the new signCount value is less than or equal to the stored
+         * value, a cloned authenticator may exist, or the authenticator may be malfunctioning, or a
+         * race condition might exist" — W3C WebAuthn L3 §6.1.1.
+         *
+         * EITHER non-zero, not just the received one. The previous check here read
+         * `newCounter > 0 && newCounter <= stored`, which misses the case that matters most
+         * operationally: a credential that previously counted and now reports 0. It was also dead
+         * code — the library threw first — and it only warned.
+         *
+         * A credential whose counter is permanently 0 — which every SYNCED passkey is, because a set
+         * of devices cannot maintain a coherent counter — compares 0-against-0, fails the first
+         * disjunct, and authenticates normally. That is the whole passkey accommodation and it is why
+         * refusing here is not hostile to passkeys.
+         *
+         * Refusal, not step-up, and not configurable: three of the four major server implementations
+         * fail closed with no switch (SimpleWebAuthn, Duo py_webauthn, ASP.NET Core Identity) and the
+         * fourth (Yubico) defaults to it. Nothing authoritative recommends escalating instead.
+         *
+         * Returned rather than thrown so BOTH callers take their existing `!verified` branch and
+         * produce the same clean AUTHENTICATION refusal — the step-up path used to wrap a library
+         * throw as a generic error while login refused cleanly.
+         *
+         * spec-cite: W3C Web Authentication Level 3 §6.1.1
+         * (https://www.w3.org/TR/webauthn-3/#sctn-sign-counter).
+         */
         const newCounter = verification.authenticationInfo.newCounter;
-        if (newCounter > 0 && newCounter <= matchedCredential.counter) {
-            this.logger.warn('WebAuthn counter did not increment — possible credential clone', {
+        if ((newCounter > 0 || matchedCredential.counter > 0) && newCounter <= matchedCredential.counter) {
+            this.logger.warn('WebAuthn signature counter did not advance on a verified assertion — refusing', {
                 userId,
                 credentialId: matchedCredential.credentialId,
                 storedCounter: matchedCredential.counter,
                 receivedCounter: newCounter,
             });
+            // The stored counter is NOT advanced: a refused assertion must not move the baseline a later
+            // legitimate assertion is compared against.
+            return {
+                verified: false,
+                credentialId: matchedCredential.credentialId,
+                cloneSuspicion: {
+                    credentialId: matchedCredential.credentialId,
+                    storedCounter: matchedCredential.counter,
+                    receivedCounter: newCounter,
+                    // Carried for TRIAGE only — nothing branches on them. A synced credential that once
+                    // reported a non-zero counter and then regresses is still a signal, so exempting by
+                    // device type would disable clone detection for the majority of credentials.
+                    credentialDeviceType: matchedCredential.credentialDeviceType,
+                    credentialBackedUp: matchedCredential.credentialBackedUp,
+                    ...(matchedCredential.aaguid ? { aaguid: matchedCredential.aaguid } : {}),
+                    ceremony,
+                },
+            };
         }
         // Update counter and lastUsedAt
         const updatedCredentials = existingCredentials.map((c) => c.credentialId === matchedCredential.credentialId
@@ -285,7 +351,13 @@ let WebAuthnBackendService = class WebAuthnBackendService {
     }
     // ─── Credential CRUD ─────────────────────────────────────────
     /**
-     * List all passkey credentials for a user (safe fields only — no publicKey/counter).
+     * List all passkey credentials for a user, as STORED.
+     *
+     * This returns the whole `PasskeyCredentialEntry`, `publicKey` and `counter` included. It is not a
+     * safe-field projection, and must not be handed to a caller as one: the projection that reaches a
+     * client is built at the controller (`handlePasskeyList`), which selects the credential id, name,
+     * timestamps and device flags and nothing else. A new consumer of this method owes its own
+     * projection, or it will disclose the stored credential material.
      */
     async getCredentials(ec, userId) {
         const { cred } = await this._resolveCredentialRecord(ec, userId);