@wildo-ai/saas-backend-lib 1.1.1 → 1.1.3

package/dist/esm/security/authentications/services/cimd-client-metadata.backend.service.d.ts

@@ -174,11 +174,17 @@ export declare class CimdClientMetadataBackendService {
      * checked, not just the first: a hostile resolver can return one public and one private address
      * and rely on the client picking the other.
      *
-     * ⚠️ Residual, stated rather than hidden: this is a check-then-fetch, so a DNS entry that changes
-     * between the two (DNS rebinding) is not covered. Closing it needs the fetch pinned to the
-     * validated address, which Node's `fetch` does not expose. The bounded timeout and size cap limit
-     * what a successful rebind yields, and the identity check means a rebound internal endpoint still
-     * has to return a document naming this exact URL.
+     * This is a check-then-fetch, and on its own it would leave DNS rebinding open — a name that
+     * answers a public address to THIS resolution and a private one to the connection. That residual
+     * is now closed one layer down rather than here: {@link fetchDocument} connects through
+     * `pinnedOutboundFetch`, which classifies inside the connection's `lookup` hook, so the address
+     * validated and the address connected to are the same value in the same event.
+     *
+     * This check is KEPT rather than folded into the pinned client, for two reasons. It refuses before
+     * anything leaves the process, which is this service's stated order of operations ("every cheap
+     * refusal happens before anything leaves the process"). And it is the only place that can tell
+     * UNRESOLVABLE from INTERNAL — the pinned client's hook sees a resolver failure as a transport
+     * failure, and collapsing the two would report a NXDOMAIN as an SSRF attempt.
      */
     private refuseInternalTarget;
     /**
@@ -188,6 +194,23 @@ export declare class CimdClientMetadataBackendService {
      * lose the diagnostic the caller reports.
      */
     private resolveAddresses;
+    /**
+     * The outbound request itself, isolated behind one method so a test can substitute it exactly as
+     * it substitutes {@link resolveAddresses}. Those two together are the whole external world this
+     * service touches.
+     *
+     * `pinnedOutboundFetch`, not `fetch`, and the difference is the point. It classifies inside the
+     * connection's `lookup` hook, so a `client_id` host that answers a public address to
+     * {@link refuseInternalTarget} and a private one to the connection — DNS rebinding, the residual
+     * this service documented and could not close — never gets a socket. It also cannot follow a
+     * redirect at all, which is strictly stronger than the `redirect: 'error'` this call used to pass:
+     * following one would re-point the request at a target no check ever saw.
+     *
+     * The resolver is the service's OWN {@link resolveAddresses}, so the pre-check and the connection
+     * ask the same resolver — a substituted resolver therefore drives both, which is what makes a
+     * rebinding pin expressible at all.
+     */
+    private performOutboundRequest;
     private fetchDocument;
     /**
      * Read the body with a running BYTE counter, abandoning the transfer the moment it exceeds the cap.

package/dist/esm/security/authentications/services/cimd-client-metadata.backend.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cimd-client-metadata.backend.service.d.ts","sourceRoot":"","sources":["../../../../../../src/security/authentications/services/cimd-client-metadata.backend.service.ts"],"names":[],"mappings":"AAAA,OAAO,kBAAkB,CAAC;AAK1B,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAM7F,OAAO,EAEL,mBAAmB,EACnB,eAAe,EAQf,KAAK,kBAAkB,EACxB,MAAM,yEAAyE,CAAC;AACjF,OAAO,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AAE/G,uEAAuE;AACvE,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,eAAe,CAAC;IACxB,kGAAkG;IAClG,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAClC;AAED,MAAM,MAAM,cAAc,GACtB;IAAE,IAAI,EAAE,IAAI,CAAC;IAAC,QAAQ,EAAE,kBAAkB,CAAA;CAAE,GAC5C;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,MAAM,EAAE,mBAAmB,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAItE;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,qBACa,gCAAgC;IAmBN,OAAO,CAAC,QAAQ,CAAC,MAAM;IACb,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IAnBhF;;;;;;;;;;;;;;OAcG;IACH,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAqC;gBAGL,MAAM,EAAE,aAAa,EACX,gBAAgB,EAAE,uBAAuB;IAGzG;;;;;;;;;;;;OAYG;IACI,uBAAuB,IAAI,iBAAiB;IAQnD,6FAA6F;IACtF,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO;IAInC,OAAO,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,iBAAiB,EAAE,KAAK,SAAa,GAAG,OAAO,CAAC,cAAc,CAAC;IAsF9G;;;;;;;;;;;;;;;;;;OAkBG;IACH,OAAO,CAAC,YAAY;IAYpB;;;;;;;;;;;;;;;;;OAiBG;IACH,OAAO,CAAC,sCAAsC;IAe9C;;;;;;;;;;OAUG;IACI,kBAAkB,CAAC,QAAQ,EAAE,kBAAkB,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO;IAIrF;;;;;;;;;;;;OAYG;IACI,2BAA2B,CAAC,QAAQ,EAAE,kBAAkB,GAAG,OAAO;IAWzE;;;;;;;;;;;;;;;;;OAiBG;IACH,OAAO,CAAC,aAAa;IAYrB;;;;;;;;;;;;;;OAcG;YACW,oBAAoB;IAalC;;;;;OAKG;YACW,gBAAgB;YAUhB,aAAa;IA2C3B;;;;;;;;;;OAUG;YACW,eAAe;IA8B7B,2FAA2F;IAC3F,OAAO,CAAC,iBAAiB;IAQzB,OAAO,CAAC,MAAM;CAGf"}
+{"version":3,"file":"cimd-client-metadata.backend.service.d.ts","sourceRoot":"","sources":["../../../../../../src/security/authentications/services/cimd-client-metadata.backend.service.ts"],"names":[],"mappings":"AAAA,OAAO,kBAAkB,CAAC;AAM1B,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAU7F,OAAO,EAEL,mBAAmB,EACnB,eAAe,EAQf,KAAK,kBAAkB,EACxB,MAAM,yEAAyE,CAAC;AACjF,OAAO,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AAa/G,uEAAuE;AACvE,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,eAAe,CAAC;IACxB,kGAAkG;IAClG,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAClC;AAED,MAAM,MAAM,cAAc,GACtB;IAAE,IAAI,EAAE,IAAI,CAAC;IAAC,QAAQ,EAAE,kBAAkB,CAAA;CAAE,GAC5C;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,MAAM,EAAE,mBAAmB,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAItE;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,qBACa,gCAAgC;IAmBN,OAAO,CAAC,QAAQ,CAAC,MAAM;IACb,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IAnBhF;;;;;;;;;;;;;;OAcG;IACH,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAqC;gBAGL,MAAM,EAAE,aAAa,EACX,gBAAgB,EAAE,uBAAuB;IAGzG;;;;;;;;;;;;OAYG;IACI,uBAAuB,IAAI,iBAAiB;IAQnD,6FAA6F;IACtF,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO;IAInC,OAAO,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,iBAAiB,EAAE,KAAK,SAAa,GAAG,OAAO,CAAC,cAAc,CAAC;IAsF9G;;;;;;;;;;;;;;;;;;OAkBG;IACH,OAAO,CAAC,YAAY;IAYpB;;;;;;;;;;;;;;;;;OAiBG;IACH,OAAO,CAAC,sCAAsC;IAe9C;;;;;;;;;;OAUG;IACI,kBAAkB,CAAC,QAAQ,EAAE,kBAAkB,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO;IAIrF;;;;;;;;;;;;OAYG;IACI,2BAA2B,CAAC,QAAQ,EAAE,kBAAkB,GAAG,OAAO;IAWzE;;;;;;;;;;;;;;;;;OAiBG;IACH,OAAO,CAAC,aAAa;IAYrB;;;;;;;;;;;;;;;;;;;;OAoBG;YACW,oBAAoB;IAalC;;;;;OAKG;YACW,gBAAgB;IAU9B;;;;;;;;;;;;;;;OAeG;YACW,sBAAsB;YAgBtB,aAAa;IAsD3B;;;;;;;;;;OAUG;YACW,eAAe;IA8B7B,2FAA2F;IAC3F,OAAO,CAAC,iBAAiB;IAQzB,OAAO,CAAC,MAAM;CAGf"}

package/dist/esm/security/authentications/services/cimd-client-metadata.backend.service.js

@@ -13,12 +13,24 @@ var __param = (this && this.__param) || function (paramIndex, decorator) {
 import 'reflect-metadata';
 import { injectable, inject } from 'inversify';
 import { lookup as dnsLookup } from 'node:dns/promises';
+import { isIP } from 'node:net';
 import { SAAS_SERVICE_TYPES } from '../../../inject/models/service-types.js';
 import { LoggerService } from '../../../monitoring/logger/services/logger.service.js';
 import { projectCaughtErrorLogFields } from '../../../errors/utils/error-log-level-classification.backend.utils.js';
 import { OutboundTargetResolution, resolvesOnlyToPublicAddresses, } from '../../../security/ssrf/outbound-target-guard.backend.utils.js';
+import { OutboundTargetRefusedError, pinnedOutboundFetch, } from '../../../security/ssrf/pinned-outbound-fetch.backend.utils.js';
 import { CimdClientMetadataSchema, CimdRejectionReason, CimdTrustPolicy, CIMD_CACHE_MAX_TTL_MS, CIMD_CACHE_MIN_TTL_MS, CIMD_FETCH_TIMEOUT_MS, CIMD_MAX_DOCUMENT_BYTES, CIMD_MAX_CACHE_ENTRIES, CIMD_ACCEPTED_TOKEN_ENDPOINT_AUTH_METHOD, CIMD_ASYMMETRIC_TOKEN_ENDPOINT_AUTH_METHODS, } from '../../../security/authentications/models/cimd.backend.schemas.js';
 import { AppConfigurationService } from '../../../config/services/app-configuration.backend.service.js';
+/**
+ * The scheme the egress client will issue on.
+ *
+ * A `client_id` that is not `https:` is already refused at shape time (`refuseMalformedClientId`),
+ * so this restates a decision rather than making a new one — deliberately. The pinned client takes
+ * the scheme policy as a required input precisely so no caller can inherit a permissive default, and
+ * a second statement at the egress point costs one line and survives a future refactor that moves
+ * the shape check.
+ */
+const CIMD_ADMITTED_PROTOCOLS = ['https:'];
 /**
  * Resolve an HTTPS `client_id` URL into validated client metadata (CIMD).
  *
@@ -307,11 +319,17 @@ let CimdClientMetadataBackendService = class CimdClientMetadataBackendService {
      * checked, not just the first: a hostile resolver can return one public and one private address
      * and rely on the client picking the other.
      *
-     * ⚠️ Residual, stated rather than hidden: this is a check-then-fetch, so a DNS entry that changes
-     * between the two (DNS rebinding) is not covered. Closing it needs the fetch pinned to the
-     * validated address, which Node's `fetch` does not expose. The bounded timeout and size cap limit
-     * what a successful rebind yields, and the identity check means a rebound internal endpoint still
-     * has to return a document naming this exact URL.
+     * This is a check-then-fetch, and on its own it would leave DNS rebinding open — a name that
+     * answers a public address to THIS resolution and a private one to the connection. That residual
+     * is now closed one layer down rather than here: {@link fetchDocument} connects through
+     * `pinnedOutboundFetch`, which classifies inside the connection's `lookup` hook, so the address
+     * validated and the address connected to are the same value in the same event.
+     *
+     * This check is KEPT rather than folded into the pinned client, for two reasons. It refuses before
+     * anything leaves the process, which is this service's stated order of operations ("every cheap
+     * refusal happens before anything leaves the process"). And it is the only place that can tell
+     * UNRESOLVABLE from INTERNAL — the pinned client's hook sees a resolver failure as a transport
+     * failure, and collapsing the two would report a NXDOMAIN as an SSRF attempt.
      */
     async refuseInternalTarget(url) {
         const resolution = await resolvesOnlyToPublicAddresses(url.hostname, (hostname) => this.resolveAddresses(hostname));
@@ -340,15 +358,40 @@ let CimdClientMetadataBackendService = class CimdClientMetadataBackendService {
             throw error;
         }
     }
+    /**
+     * The outbound request itself, isolated behind one method so a test can substitute it exactly as
+     * it substitutes {@link resolveAddresses}. Those two together are the whole external world this
+     * service touches.
+     *
+     * `pinnedOutboundFetch`, not `fetch`, and the difference is the point. It classifies inside the
+     * connection's `lookup` hook, so a `client_id` host that answers a public address to
+     * {@link refuseInternalTarget} and a private one to the connection — DNS rebinding, the residual
+     * this service documented and could not close — never gets a socket. It also cannot follow a
+     * redirect at all, which is strictly stronger than the `redirect: 'error'` this call used to pass:
+     * following one would re-point the request at a target no check ever saw.
+     *
+     * The resolver is the service's OWN {@link resolveAddresses}, so the pre-check and the connection
+     * ask the same resolver — a substituted resolver therefore drives both, which is what makes a
+     * rebinding pin expressible at all.
+     */
+    async performOutboundRequest(url) {
+        return pinnedOutboundFetch(url.toString(), {
+            admittedProtocols: CIMD_ADMITTED_PROTOCOLS,
+            headers: { accept: 'application/json' },
+            signal: AbortSignal.timeout(CIMD_FETCH_TIMEOUT_MS),
+            // Never `admitPrivateAddresses` here, under any configuration. A `client_id` URL comes from an
+            // UNAUTHENTICATED stranger, so an escape on this path would be an operator declaring that
+            // strangers may address the deployment's internal network — a sentence with no legitimate
+            // reading. The escape exists only for a target class an operator authors themselves.
+            resolveAddresses: async (hostname) => {
+                const addresses = await this.resolveAddresses(hostname);
+                return addresses.map((address) => ({ address, family: isIP(address) }));
+            },
+        });
+    }
     async fetchDocument(url) {
         try {
-            const response = await fetch(url.toString(), {
-                // `redirect: 'error'` on purpose: following a redirect would re-point the fetch at a target
-                // the SSRF check never saw, which is the guard's most obvious bypass.
-                redirect: 'error',
-                headers: { accept: 'application/json' },
-                signal: AbortSignal.timeout(CIMD_FETCH_TIMEOUT_MS),
-            });
+            const response = await this.performOutboundRequest(url);
             if (!response.ok) {
                 return this.reject(CimdRejectionReason.UNREACHABLE, `client metadata document responded ${response.status}`);
             }
@@ -379,6 +422,23 @@ let CimdClientMetadataBackendService = class CimdClientMetadataBackendService {
             }
         }
         catch (error) {
+            /**
+             * A connect-time SSRF refusal is NOT "unreachable", and collapsing the two would lose the
+             * signal this whole guard exists to produce. `SSRF_TARGET_REFUSED` is counted and alerted on —
+             * the enum's own JSDoc says an operator watching a spike in it "is watching an attack, not a
+             * misconfiguration" — while `UNREACHABLE` is ordinary noise from strangers' broken hosts.
+             *
+             * A rebind lands HERE rather than at {@link refuseInternalTarget}, because by construction it
+             * passed that check. This branch is the only place it can be named.
+             */
+            if (error instanceof OutboundTargetRefusedError) {
+                this.logger.debug('[cimd] outbound target refused at connect time', {
+                    clientId: url.toString(),
+                    rejection: error.rejection,
+                    refusedAddress: error.refusedAddress,
+                });
+                return this.reject(CimdRejectionReason.SSRF_TARGET_REFUSED, 'client_id host connects to a non-public address');
+            }
             return this.reject(CimdRejectionReason.UNREACHABLE, 'client metadata document could not be fetched');
         }
     }

package/dist/esm/security/authentications/services/cimd-client-metadata.backend.service.js.map

@@ -1 +1 @@
-{"version":3,"file":"cimd-client-metadata.backend.service.js","sourceRoot":"","sources":["../../../../../../src/security/authentications/services/cimd-client-metadata.backend.service.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,OAAO,kBAAkB,CAAC;AAC1B,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAC/C,OAAO,EAAE,MAAM,IAAI,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAExD,OAAO,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AACpF,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAC7F,OAAO,EAAE,2BAA2B,EAAE,MAAM,8EAA8E,CAAC;AAC3H,OAAO,EACL,wBAAwB,EACxB,6BAA6B,GAC9B,MAAM,sEAAsE,CAAC;AAC9E,OAAO,EACL,wBAAwB,EACxB,mBAAmB,EACnB,eAAe,EACf,qBAAqB,EACrB,qBAAqB,EACrB,qBAAqB,EACrB,uBAAuB,EACvB,sBAAsB,EACtB,wCAAwC,EACxC,2CAA2C,GAE5C,MAAM,yEAAyE,CAAC;AACjF,OAAO,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AAe/G;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEI,IAAM,gCAAgC,GAAtC,MAAM,gCAAgC;IAmBW;IACU;IAnBhE;;;;;;;;;;;;;;OAcG;IACc,KAAK,GAAG,IAAI,GAAG,EAA0B,CAAC;IAE3D,YACsD,MAAqB,EACX,gBAAyC;QADnD,WAAM,GAAN,MAAM,CAAe;QACX,qBAAgB,GAAhB,gBAAgB,CAAyB;IACtG,CAAC;IAEJ;;;;;;;;;;;;OAYG;IACI,uBAAuB;QAC5B,MAAM,QAAQ,GAAI,IAAI,CAAC,gBAAgB,CAAC,MAAM,EAAE,IAAuF,EAAE,IAAI,CAAC;QAC9I,OAAO;YACL,MAAM,EAAE,QAAQ,EAAE,MAAM,IAAI,eAAe,CAAC,QAAQ;YACpD,YAAY,EAAE,QAAQ,EAAE,cAAc,IAAI,EAAE;SAC7C,CAAC;IACJ,CAAC;IAED,6FAA6F;IACtF,cAAc,CAAC,QAAgB;QACpC,OAAO,QAAQ,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;IACzC,CAAC;IAEM,KAAK,CAAC,OAAO,CAAC,QAAgB,EAAE,MAAyB,EAAE,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE;QAClF,2FAA2F;QAC3F,+FAA+F;QAC/F,IAAI,MAAM,CAAC,MAAM,KAAK,eAAe,CAAC,QAAQ,EAAE,CAAC;YAC/C,OAAO,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,eAAe,EAAE,8CAA8C,CAAC,CAAC;QAC1G,CAAC;QAED,6FAA6F;QAC7F,6GAA6G;QAC7G,6FAA6F;QAC7F,qEAAqE;QACrE,IAAI,GAAQ,CAAC;QACb,IAAI,CAAC;YACH,GAAG,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC1B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,mBAAmB,EAAE,wBAAwB,CAAC,CAAC;QACxF,CAAC;QACD,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAC9B,OAAO,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,mBAAmB,EAAE,qCAAqC,CAAC,CAAC;QACrG,CAAC;QACD,IAAI,GAAG,CAAC,QAAQ,KAAK,GAAG,IAAI,GAAG,CAAC,QAAQ,KAAK,EAAE,EAAE,CAAC;YAChD,OAAO,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,mBAAmB,EAAE,yCAAyC,CAAC,CAAC;QACzG,CAAC;QACD,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;YACb,6FAA6F;YAC7F,4FAA4F;YAC5F,OAAO,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,mBAAmB,EAAE,uCAAuC,CAAC,CAAC;QACvG,CAAC;QAED,gCAAgC;QAChC,IAAI,MAAM,CAAC,MAAM,KAAK,eAAe,CAAC,SAAS,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,GAAG,EAAE,MAAM,CAAC,YAAY,IAAI,EAAE,CAAC,EAAE,CAAC;YACvG,OAAO,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,gBAAgB,EAAE,gDAAgD,CAAC,CAAC;QAC7G,CAAC;QAED,8FAA8F;QAC9F,2FAA2F;QAC3F,uDAAuD;QACvD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC9C,IAAI,MAAM,IAAI,MAAM,CAAC,WAAW,GAAG,KAAK,EAAE,CAAC;YACzC,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC;QACnD,CAAC;QAED,6FAA6F;QAC7F,4CAA4C;QAC5C,uEAAuE;QACvE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,CAAC;QAClD,IAAI,IAAI;YAAE,OAAO,IAAI,CAAC;QAEtB,qBAAqB;QACrB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC;QAC9C,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS;YAAE,OAAO,OAAO,CAAC;QAE/C,iBAAiB;QACjB,MAAM,MAAM,GAAG,wBAAwB,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAChE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,sFAAsF;YACtF,6FAA6F;YAC7F,aAAa;YACb,mEAAmE;YACnE,OAAO,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,kBAAkB,EAAE,kDAAkD,CAAC,CAAC;QACjH,CAAC;QAED,8FAA8F;QAC9F,+FAA+F;QAC/F,sBAAsB;QACtB,uEAAuE;QACvE,EAAE;QACF,+FAA+F;QAC/F,sEAAsE;QACtE,IAAI,MAAM,CAAC,IAAI,CAAC,SAAS,KAAK,GAAG,CAAC,QAAQ,EAAE,EAAE,CAAC;YAC7C,OAAO,IAAI,CAAC,MAAM,CAChB,mBAAmB,CAAC,iBAAiB,EACrC,sEAAsE,CACvE,CAAC;QACJ,CAAC;QAED,+FAA+F;QAC/F,gGAAgG;QAChG,gGAAgG;QAChG,MAAM,UAAU,GAAG,IAAI,CAAC,sCAAsC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC5E,IAAI,UAAU;YAAE,OAAO,UAAU,CAAC;QAElC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,MAAM,CAAC,IAAI,EAAE,KAAK,GAAG,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,KAAK,CAAC,CAAC;QAC5G,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;IAC/C,CAAC;IAED;;;;;;;;;;;;;;;;;;OAkBG;IACK,YAAY,CAAC,GAAW,EAAE,QAA4B,EAAE,WAAmB,EAAE,KAAa;QAChG,KAAK,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YAC7C,IAAI,MAAM,CAAC,WAAW,IAAI,KAAK;gBAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAChE,CAAC;QACD,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,sBAAsB,EAAE,CAAC;YACjD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC;YACxC,IAAI,MAAM,CAAC,IAAI;gBAAE,MAAM;YACvB,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAClC,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC,CAAC;IACjD,CAAC;IAED;;;;;;;;;;;;;;;;;OAiBG;IACK,sCAAsC,CAAC,QAA4B;QACzE,MAAM,QAAQ,GAAG,QAAQ,CAAC,0BAA0B,CAAC;QACrD,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,wCAAwC;YAAE,OAAO,SAAS,CAAC;QACtG,IAAI,2CAA2C,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YACnE,OAAO,IAAI,CAAC,MAAM,CAChB,mBAAmB,CAAC,iCAAiC,EACrD,iCAAiC,QAAQ,iDAAiD,CAC3F,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,CAAC,MAAM,CAChB,mBAAmB,CAAC,+BAA+B,EACnD,iCAAiC,QAAQ,sDAAsD,CAChG,CAAC;IACJ,CAAC;IAED;;;;;;;;;;OAUG;IACI,kBAAkB,CAAC,QAA4B,EAAE,WAAmB;QACzE,OAAO,QAAQ,CAAC,aAAa,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACtD,CAAC;IAED;;;;;;;;;;;;OAYG;IACI,2BAA2B,CAAC,QAA4B;QAC7D,OAAO,QAAQ,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YAC1C,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;gBACjD,OAAO,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,OAAO,CAAC;YAC5F,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;;;;;;;;;OAiBG;IACK,aAAa,CAAC,GAAQ,EAAE,OAA0B;QACxD,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,EAAE,CAAC;QAChC,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;QACxC,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE;YAC5B,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;YAC3B,IAAI,CAAC,KAAK;gBAAE,OAAO,KAAK,CAAC;YACzB,OAAO,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC;gBAC1B,CAAC,CAAC,KAAK,KAAK,QAAQ;gBACpB,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,IAAI,CAAC;QACnC,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;;;;;;OAcG;IACK,KAAK,CAAC,oBAAoB,CAAC,GAAQ;QACzC,MAAM,UAAU,GAAG,MAAM,6BAA6B,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC,CAAC;QAEpH,QAAQ,UAAU,EAAE,CAAC;YACnB,KAAK,wBAAwB,CAAC,MAAM;gBAClC,OAAO,SAAS,CAAC;YACnB,KAAK,wBAAwB,CAAC,YAAY;gBACxC,OAAO,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,WAAW,EAAE,iCAAiC,CAAC,CAAC;YACzF,KAAK,wBAAwB,CAAC,QAAQ;gBACpC,OAAO,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,mBAAmB,EAAE,iDAAiD,CAAC,CAAC;QACnH,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACK,KAAK,CAAC,gBAAgB,CAAC,QAAgB;QAC7C,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,QAAQ,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC;YACzD,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACjD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,uCAAuC,EAAE,EAAE,QAAQ,EAAE,GAAG,2BAA2B,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YAChH,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,aAAa,CAAC,GAAQ;QAClC,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE;gBAC3C,4FAA4F;gBAC5F,sEAAsE;gBACtE,QAAQ,EAAE,OAAO;gBACjB,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;gBACvC,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,qBAAqB,CAAC;aACnD,CAAC,CAAC;YACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,OAAO,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,WAAW,EAAE,sCAAsC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;YAC/G,CAAC;YAED,2FAA2F;YAC3F,EAAE;YACF,4FAA4F;YAC5F,6FAA6F;YAC7F,8FAA8F;YAC9F,8FAA8F;YAC9F,yDAAyD;YACzD,EAAE;YACF,+FAA+F;YAC/F,kDAAkD;YAClD,MAAM,cAAc,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC;YACtE,IAAI,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,IAAI,cAAc,GAAG,uBAAuB,EAAE,CAAC;gBAChF,yFAAyF;gBACzF,wFAAwF;gBACxF,OAAO,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,WAAW,EAAE,qDAAqD,CAAC,CAAC;YAC7G,CAAC;YAED,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC;YAClD,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM;gBAAE,OAAO,IAAI,CAAC;YAEtC,IAAI,CAAC;gBACH,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,YAAY,EAAE,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,CAAC;YAC/G,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,kBAAkB,EAAE,4CAA4C,CAAC,CAAC;YAC3G,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,WAAW,EAAE,+CAA+C,CAAC,CAAC;QACvG,CAAC;IACH,CAAC;IAED;;;;;;;;;;OAUG;IACK,KAAK,CAAC,eAAe,CAAC,QAAkB;QAC9C,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC;QAC7B,IAAI,CAAC,MAAM,IAAI,OAAQ,MAAqC,CAAC,SAAS,KAAK,UAAU,EAAE,CAAC;YACtF,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YACnC,OAAO,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,GAAG,uBAAuB;gBAC9D,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,WAAW,EAAE,qDAAqD,CAAC;gBACrG,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;QAC7B,CAAC;QAED,MAAM,MAAM,GAAI,MAAqC,CAAC,SAAS,EAAE,CAAC;QAClE,MAAM,MAAM,GAAiB,EAAE,CAAC;QAChC,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,IAAI,CAAC;YACH,SAAS,CAAC;gBACR,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;gBAC5C,IAAI,IAAI;oBAAE,MAAM;gBAChB,IAAI,CAAC,KAAK;oBAAE,SAAS;gBACrB,KAAK,IAAI,KAAK,CAAC,UAAU,CAAC;gBAC1B,IAAI,KAAK,GAAG,uBAAuB,EAAE,CAAC;oBACpC,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;oBAC7C,OAAO,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,WAAW,EAAE,qDAAqD,CAAC,CAAC;gBAC7G,CAAC;gBACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACrB,CAAC;QACH,CAAC;gBAAS,CAAC;YACT,MAAM,CAAC,WAAW,EAAE,EAAE,CAAC;QACzB,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;IACxE,CAAC;IAED,2FAA2F;IACnF,iBAAiB,CAAC,YAA2B;QACnD,MAAM,MAAM,GAAG,YAAY,EAAE,KAAK,CAAC,sBAAsB,CAAC,CAAC;QAC3D,IAAI,CAAC,MAAM;YAAE,OAAO,qBAAqB,CAAC;QAC1C,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC;QAC3C,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC;YAAE,OAAO,qBAAqB,CAAC;QAC9D,OAAO,IAAI,CAAC,GAAG,CAAC,qBAAqB,EAAE,IAAI,CAAC,GAAG,CAAC,qBAAqB,EAAE,SAAS,CAAC,CAAC,CAAC;IACrF,CAAC;IAEO,MAAM,CAAC,MAA2B,EAAE,MAAc;QACxD,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IAC9C,CAAC;CACF,CAAA;AAxZY,gCAAgC;IAD5C,UAAU,EAAE;IAoBR,WAAA,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAA;IACjC,WAAA,MAAM,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,CAAA;qCADgB,aAAa;QACO,uBAAuB;GApB9F,gCAAgC,CAwZ5C","sourcesContent":["import 'reflect-metadata';\nimport { injectable, inject } from 'inversify';\nimport { lookup as dnsLookup } from 'node:dns/promises';\n\nimport { SAAS_SERVICE_TYPES } from '~wildo-backend-lib/inject/models/service-types';\nimport { LoggerService } from '~wildo-backend-lib/monitoring/logger/services/logger.service';\nimport { projectCaughtErrorLogFields } from '~wildo-backend-lib/errors/utils/error-log-level-classification.backend.utils';\nimport {\n  OutboundTargetResolution,\n  resolvesOnlyToPublicAddresses,\n} from '~wildo-backend-lib/security/ssrf/outbound-target-guard.backend.utils';\nimport {\n  CimdClientMetadataSchema,\n  CimdRejectionReason,\n  CimdTrustPolicy,\n  CIMD_CACHE_MAX_TTL_MS,\n  CIMD_CACHE_MIN_TTL_MS,\n  CIMD_FETCH_TIMEOUT_MS,\n  CIMD_MAX_DOCUMENT_BYTES,\n  CIMD_MAX_CACHE_ENTRIES,\n  CIMD_ACCEPTED_TOKEN_ENDPOINT_AUTH_METHOD,\n  CIMD_ASYMMETRIC_TOKEN_ENDPOINT_AUTH_METHODS,\n  type CimdClientMetadata,\n} from '~wildo-backend-lib/security/authentications/models/cimd.backend.schemas';\nimport { AppConfigurationService } from '~wildo-backend-lib/config/services/app-configuration.backend.service';\n\n/** The deployment's CIMD posture, resolved from application config. */\nexport interface CimdConfiguration {\n  policy: CimdTrustPolicy;\n  /** Hosts accepted under {@link CimdTrustPolicy.ALLOWLIST}. Exact host match, case-insensitive. */\n  allowedHosts?: readonly string[];\n}\n\nexport type CimdResolution =\n  | { kind: 'ok'; metadata: CimdClientMetadata }\n  | { kind: 'rejected'; reason: CimdRejectionReason; detail: string };\n\ninterface CachedDocument { metadata: CimdClientMetadata; expiresAtMs: number }\n\n/**\n * Resolve an HTTPS `client_id` URL into validated client metadata (CIMD).\n *\n * ## What makes this different from every other lookup in the provider\n *\n * Every other client resolution reads a row this application minted. This one takes a URL from an\n * UNAUTHENTICATED stranger and makes an outbound request to it. That inverts the usual trust\n * direction, and the draft is explicit about the consequence:\n *\n *   \"The authorization server takes a URL as input from an unknown client and fetches that URL. A\n *    malicious client could use this to trigger the authorization server to make requests to\n *    arbitrary URLs, such as requests to private administration endpoints the authorization server\n *    has access to.\"\n *   spec-cite: MCP 2025-11-25 — Authorization § Client ID Metadata Document Security\n *\n * So the order of operations is itself a control: POLICY first (is this deployment even accepting\n * stranger URLs?), then SHAPE, then the SSRF target check, and only then a bounded fetch. Every\n * cheap refusal happens before anything leaves the process.\n *\n * ## What this deliberately does NOT do\n *\n * It does not decide whether the caller may have a token. It resolves an IDENTITY and the redirect\n * URIs that identity claims; consent, scope and audience remain the caller's own gates. A client\n * that resolves here is a client whose NAME the consent screen may show — nothing more.\n *\n * assurance-control: WILDO.IDENTITY.CLIENT_IDENTITY_ASSERTION — a client identity is bound to a\n * domain the client demonstrably controls\n */\n@injectable()\nexport class CimdClientMetadataBackendService {\n  /**\n   * In-process, per-pod. Deliberately not Redis.\n   *\n   * The document is public by construction — anyone can fetch it — so a shared cache buys only\n   * fewer outbound requests, at the cost of a shared mutable surface keyed on attacker-supplied\n   * strings. A per-pod cache cannot be poisoned across pods and disappears on restart, which is also\n   * the crudest revocation path available.\n   *\n   * **It is bounded by {@link CIMD_MAX_CACHE_ENTRIES}, and that bound is load-bearing.** An earlier\n   * revision of this comment claimed the cache was bounded when nothing bounded it: the key is an\n   * attacker-supplied URL, entries were only SKIPPED when stale and never reclaimed, and there was\n   * no ceiling — so the map grew for the life of the pod. Insertion order is eviction order (a Map\n   * preserves it), which is the right policy here because every entry has a short, bounded TTL: the\n   * oldest entry is also the closest to expiry.\n   */\n  private readonly cache = new Map<string, CachedDocument>();\n\n  constructor(\n    @inject(SAAS_SERVICE_TYPES.Logger) private readonly logger: LoggerService,\n    @inject(SAAS_SERVICE_TYPES.AppConfigService) private readonly appConfigService: AppConfigurationService,\n  ) {}\n\n  /**\n   * The deployment's CIMD posture, read from `auth.cimd` in the application configuration.\n   *\n   * **One reader, deliberately.** Two facts must never disagree: what the discovery document\n   * ADVERTISES (`client_id_metadata_document_supported`) and what the authorize path ACCEPTS. When\n   * each read the config for itself, a divergence between them would be invisible — the server would\n   * advertise a capability it refuses, or refuse one it advertises, and every client would blame its\n   * own implementation. Both now call this.\n   *\n   * Defaults to `DISABLED` when unconfigured: nothing fetches a stranger's URL until an application\n   * opts in. A framework that shipped `OPEN` by default would open an SSRF surface on every\n   * deployment that never asked for one.\n   */\n  public deploymentConfiguration(): CimdConfiguration {\n    const authored = (this.appConfigService.config?.auth as { cimd?: { policy?: CimdTrustPolicy; allowedClients?: string[] } } | undefined)?.cimd;\n    return {\n      policy: authored?.policy ?? CimdTrustPolicy.DISABLED,\n      allowedHosts: authored?.allowedClients ?? [],\n    };\n  }\n\n  /** Does this `client_id` even look like a CIMD identifier? Cheap, allocation-free triage. */\n  public isCimdClientId(clientId: string): boolean {\n    return clientId.startsWith('https://');\n  }\n\n  public async resolve(clientId: string, config: CimdConfiguration, nowMs = Date.now()): Promise<CimdResolution> {\n    // 1 — POLICY, before anything else. A disabled deployment must not even parse the URL, let\n    //     alone resolve DNS for it: refusing later would still have leaked that this server looks.\n    if (config.policy === CimdTrustPolicy.DISABLED) {\n      return this.reject(CimdRejectionReason.POLICY_DISABLED, 'client id metadata documents are not enabled');\n    }\n\n    // 2 — SHAPE. \"The `client_id` URL MUST use the \"https\" scheme and contain a path component\".\n    //     spec-cite: MCP 2025-11-25 — Authorization § Client ID Metadata Documents → Implementation Requirements\n    //     The path requirement is not cosmetic: it stops a bare origin being an identity, so one\n    //     compromised host cannot claim to be every client on that host.\n    let url: URL;\n    try {\n      url = new URL(clientId);\n    } catch {\n      return this.reject(CimdRejectionReason.MALFORMED_CLIENT_ID, 'client_id is not a URL');\n    }\n    if (url.protocol !== 'https:') {\n      return this.reject(CimdRejectionReason.MALFORMED_CLIENT_ID, 'client_id must use the https scheme');\n    }\n    if (url.pathname === '/' || url.pathname === '') {\n      return this.reject(CimdRejectionReason.MALFORMED_CLIENT_ID, 'client_id must contain a path component');\n    }\n    if (url.hash) {\n      // A fragment is never sent to the server, so two client_ids differing only by fragment would\n      // fetch the same document and then fail the identity comparison — confusing, and pointless.\n      return this.reject(CimdRejectionReason.MALFORMED_CLIENT_ID, 'client_id must not contain a fragment');\n    }\n\n    // 3 — TRUST POLICY on the host.\n    if (config.policy === CimdTrustPolicy.ALLOWLIST && !this.isAllowListed(url, config.allowedHosts ?? [])) {\n      return this.reject(CimdRejectionReason.HOST_NOT_ALLOWED, 'client_id is not on this deployment allow-list');\n    }\n\n    // 4 — CACHE, keyed on the exact URL. Read before the SSRF check because a cached document was\n    //     already validated against every gate above at the time it was stored, and the policy\n    //     gates above have already re-run on THIS request.\n    const cached = this.cache.get(url.toString());\n    if (cached && cached.expiresAtMs > nowMs) {\n      return { kind: 'ok', metadata: cached.metadata };\n    }\n\n    // 5 — SSRF. Resolved BEFORE the fetch: \"Authorization servers SHOULD avoid fetching any URLs\n    //     using private or loopback addresses\".\n    //     spec-cite: draft-ietf-oauth-client-id-metadata-document-00 § 6.5\n    const ssrf = await this.refuseInternalTarget(url);\n    if (ssrf) return ssrf;\n\n    // 6 — Bounded fetch.\n    const fetched = await this.fetchDocument(url);\n    if (fetched.kind !== 'fetched') return fetched;\n\n    // 7 — STRUCTURE.\n    const parsed = CimdClientMetadataSchema.safeParse(fetched.body);\n    if (!parsed.success) {\n      // NOT cached: \"The authorization server MUST NOT cache documents which are invalid or\n      // malformed.\" Caching a malformed document would let one bad deploy pin a client out for the\n      // whole TTL.\n      // spec-cite: draft-ietf-oauth-client-id-metadata-document-00 § 4.4\n      return this.reject(CimdRejectionReason.MALFORMED_DOCUMENT, 'document is not a valid client metadata document');\n    }\n\n    // 8 — IDENTITY. \"The client metadata document MUST contain a `client_id` property whose value\n    //     MUST match the URL of the document using simple string comparison as defined in RFC 3986\n    //     Section 6.2.1.\"\n    //     spec-cite: draft-ietf-oauth-client-id-metadata-document-00 § 4.1\n    //\n    //     This is the load-bearing check of the whole mechanism: without it, anyone who can host a\n    //     JSON file could claim any other client's identity by naming it.\n    if (parsed.data.client_id !== url.toString()) {\n      return this.reject(\n        CimdRejectionReason.IDENTITY_MISMATCH,\n        'the document\\'s client_id does not match the URL it was fetched from',\n      );\n    }\n\n    // 9 — CLIENT AUTHENTICATION. Checked BEFORE the cache write, alongside structure and identity,\n    //     for the same reason those are: a document this server will never accept must not occupy a\n    //     cache slot, and must not be re-served to a later request as though it had been validated.\n    const authMethod = this.refuseUnacceptableClientAuthentication(parsed.data);\n    if (authMethod) return authMethod;\n\n    this.storeInCache(url.toString(), parsed.data, nowMs + this.resolveCacheTtlMs(fetched.cacheControl), nowMs);\n    return { kind: 'ok', metadata: parsed.data };\n  }\n\n  /**\n   * Write a validated document, reclaiming space first so the map cannot grow without limit.\n   *\n   * Two steps, in this order:\n   *\n   *  1. **Sweep the expired.** Reclaiming stale entries before evicting live ones means a steady\n   *     state of legitimate traffic never evicts anything — the TTL does the work, and eviction is\n   *     reserved for genuine pressure.\n   *  2. **Evict the oldest** while still at the ceiling. `Map` iterates in insertion order, and\n   *     because every entry carries a short bounded TTL the oldest is also the nearest to expiry —\n   *     so insertion order is a good proxy for \"least valuable\" without tracking access times.\n   *\n   * There is deliberately NO delete-before-set for an existing key. A first draft had one, to move a\n   * refreshed document to the end of the order — but this method is only ever reached after a cache\n   * MISS: a live entry returns from `resolve` before the fetch, and an expired one is removed by the\n   * sweep above. The key can never still be present, so the delete was guarding a state that cannot\n   * occur, and a test written to prove it necessarily failed. Removed rather than kept as defence,\n   * because dead code with a plausible comment is how the next reader is misled.\n   */\n  private storeInCache(key: string, metadata: CimdClientMetadata, expiresAtMs: number, nowMs: number): void {\n    for (const [cachedKey, cached] of this.cache) {\n      if (cached.expiresAtMs <= nowMs) this.cache.delete(cachedKey);\n    }\n    while (this.cache.size >= CIMD_MAX_CACHE_ENTRIES) {\n      const oldest = this.cache.keys().next();\n      if (oldest.done) break;\n      this.cache.delete(oldest.value);\n    }\n    this.cache.set(key, { metadata, expiresAtMs });\n  }\n\n  /**\n   * Refuse a document whose declared client authentication method this provider will not honour.\n   *\n   * Two refusals with two reasons, because they are two different facts about the world:\n   *\n   * - A SYMMETRIC method is the client violating the draft — \"the `token_endpoint_auth_method`\n   *   property MUST NOT include `client_secret_post`, `client_secret_basic`, `client_secret_jwt`, or\n   *   any other method based around a shared symmetric secret.\"\n   *   spec-cite: draft-ietf-oauth-client-id-metadata-document-00 § 4.1\n   * - `private_key_jwt` is permitted by § 6.2 (\"clients MAY establish credentials at the\n   *   authorization server by using authentication methods that use public/private key pairs, by\n   *   publishing the public key in their metadata document\") and simply is not implemented here.\n   *\n   * Both refuse. The alternative — accept the document and treat the client as public — is a silent\n   * downgrade: the client believes it authenticates, this server never checks, and neither side can\n   * observe the disagreement. An absent `token_endpoint_auth_method` IS accepted as public, which is\n   * what the specification's own worked example declares (`\"token_endpoint_auth_method\": \"none\"`).\n   */\n  private refuseUnacceptableClientAuthentication(metadata: CimdClientMetadata): CimdResolution | undefined {\n    const declared = metadata.token_endpoint_auth_method;\n    if (declared === undefined || declared === CIMD_ACCEPTED_TOKEN_ENDPOINT_AUTH_METHOD) return undefined;\n    if (CIMD_ASYMMETRIC_TOKEN_ENDPOINT_AUTH_METHODS.includes(declared)) {\n      return this.reject(\n        CimdRejectionReason.UNSUPPORTED_CLIENT_AUTHENTICATION,\n        `client authentication method '${declared}' is not supported by this authorization server`,\n      );\n    }\n    return this.reject(\n      CimdRejectionReason.FORBIDDEN_CLIENT_AUTHENTICATION,\n      `client authentication method '${declared}' is not permitted for a client id metadata document`,\n    );\n  }\n\n  /**\n   * Is a redirect URI one this client actually claims?\n   *\n   * \"MUST validate redirect URIs presented in an authorization request against those in the metadata\n   * document.\"\n   * spec-cite: MCP 2025-11-25 — Authorization § Client ID Metadata Documents → Implementation Requirements\n   *\n   * EXACT string comparison, not prefix or origin matching: a prefix rule turns one claimed\n   * `https://app.example/cb` into authority over `https://app.example/cb.attacker/...`, and OAuth\n   * 2.1 requires exact redirect matching independently of CIMD.\n   */\n  public permitsRedirectUri(metadata: CimdClientMetadata, redirectUri: string): boolean {\n    return metadata.redirect_uris.includes(redirectUri);\n  }\n\n  /**\n   * Does this client's claimed redirect set consist ONLY of loopback URIs?\n   *\n   * Callers use this to decide whether the consent screen needs a stronger warning. CIMD \"cannot\n   * prevent `localhost` URL impersonation by themselves\": an attacker presents the LEGITIMATE\n   * client's metadata URL, binds any localhost port, and receives the code — while the user sees the\n   * legitimate client's name.\n   * spec-cite: MCP 2025-11-25 — Authorization § Client ID Metadata Document Security → Localhost Redirect URI Risks\n   *\n   * Reported rather than refused: loopback redirects are how every CLI and desktop MCP client works,\n   * so refusing them would exclude the majority of real callers. The mitigation the spec names is\n   * display, and display needs this signal.\n   */\n  public claimsOnlyLoopbackRedirects(metadata: CimdClientMetadata): boolean {\n    return metadata.redirect_uris.every((uri) => {\n      try {\n        const host = new URL(uri).hostname.toLowerCase();\n        return host === 'localhost' || host === '127.0.0.1' || host === '::1' || host === '[::1]';\n      } catch {\n        return false;\n      }\n    });\n  }\n\n  /**\n   * Is this `client_id` admitted by the deployment's allow-list?\n   *\n   * An entry is matched at ONE OF TWO precisions, decided by the entry itself:\n   *\n   * - **A full `https://…` URL** matches that exact `client_id` and nothing else.\n   * - **A bare host** matches every `client_id` on that host.\n   *\n   * Both exist because they answer different questions. Clerk's CIMD admission is per-Client-ID-URL,\n   * and that is the stricter and usually correct grain: a host entry admits EVERY client hosted\n   * there, which is wrong the moment the domain is a shared platform hosting many vendors' metadata —\n   * allow-listing one vendor would silently admit all of them. The host form is kept for the common\n   * case where a deployment trusts a vendor's whole domain and does not want to re-edit config each\n   * time that vendor publishes a new client.\n   *\n   * The first implementation offered ONLY the host form. Checking it against a shipping\n   * implementation is what surfaced the shared-domain hole.\n   */\n  private isAllowListed(url: URL, entries: readonly string[]): boolean {\n    const clientId = url.toString();\n    const host = url.hostname.toLowerCase();\n    return entries.some((entry) => {\n      const value = entry.trim();\n      if (!value) return false;\n      return value.includes('://')\n        ? value === clientId\n        : value.toLowerCase() === host;\n    });\n  }\n\n  /**\n   * Refuse a target that resolves to an address this server can reach but the public internet\n   * cannot.\n   *\n   * DNS is resolved HERE rather than trusting the hostname, because `internal.example.com` may be a\n   * public name with a private A record — the attack the guard exists for. Every resolved address is\n   * checked, not just the first: a hostile resolver can return one public and one private address\n   * and rely on the client picking the other.\n   *\n   * ⚠️ Residual, stated rather than hidden: this is a check-then-fetch, so a DNS entry that changes\n   * between the two (DNS rebinding) is not covered. Closing it needs the fetch pinned to the\n   * validated address, which Node's `fetch` does not expose. The bounded timeout and size cap limit\n   * what a successful rebind yields, and the identity check means a rebound internal endpoint still\n   * has to return a document naming this exact URL.\n   */\n  private async refuseInternalTarget(url: URL): Promise<CimdResolution | undefined> {\n    const resolution = await resolvesOnlyToPublicAddresses(url.hostname, (hostname) => this.resolveAddresses(hostname));\n\n    switch (resolution) {\n      case OutboundTargetResolution.PUBLIC:\n        return undefined;\n      case OutboundTargetResolution.UNRESOLVABLE:\n        return this.reject(CimdRejectionReason.UNREACHABLE, 'client_id host does not resolve');\n      case OutboundTargetResolution.INTERNAL:\n        return this.reject(CimdRejectionReason.SSRF_TARGET_REFUSED, 'client_id host resolves to a non-public address');\n    }\n  }\n\n  /**\n   * Throws on failure rather than returning `undefined`, because the shared resolver distinguishes\n   * \"the resolver refused\" (UNRESOLVABLE) from \"the resolver answered with nothing usable\"\n   * (INTERNAL) — collapsing both into an empty array would turn a NXDOMAIN into an SSRF verdict and\n   * lose the diagnostic the caller reports.\n   */\n  private async resolveAddresses(hostname: string): Promise<string[]> {\n    try {\n      const records = await dnsLookup(hostname, { all: true });\n      return records.map((record) => record.address);\n    } catch (error) {\n      this.logger.debug('[cimd] client_id host did not resolve', { hostname, ...projectCaughtErrorLogFields(error) });\n      throw error;\n    }\n  }\n\n  private async fetchDocument(url: URL): Promise<{ kind: 'fetched'; body: unknown; cacheControl: string | null } | CimdResolution> {\n    try {\n      const response = await fetch(url.toString(), {\n        // `redirect: 'error'` on purpose: following a redirect would re-point the fetch at a target\n        // the SSRF check never saw, which is the guard's most obvious bypass.\n        redirect: 'error',\n        headers: { accept: 'application/json' },\n        signal: AbortSignal.timeout(CIMD_FETCH_TIMEOUT_MS),\n      });\n      if (!response.ok) {\n        return this.reject(CimdRejectionReason.UNREACHABLE, `client metadata document responded ${response.status}`);\n      }\n\n      // ── SIZE, enforced DURING the read rather than after it ─────────────────────────────────\n      //\n      // The previous implementation did `await response.text()` and then measured — which buffers\n      // the ENTIRE body first, so a hostile URL returning a gigabyte was fully downloaded and held\n      // in memory before being rejected. The cap existed and bounded nothing; the denial-of-service\n      // primitive it was written to remove was still there, and the 5 s timeout does not substitute\n      // because a fast server delivers a great deal inside it.\n      //\n      // It also measured `text.length` — UTF-16 code units — against a constant named `_BYTES`, so a\n      // multi-byte document read as smaller than it is.\n      const declaredLength = Number(response.headers.get('content-length'));\n      if (Number.isFinite(declaredLength) && declaredLength > CIMD_MAX_DOCUMENT_BYTES) {\n        // Cheapest possible refusal: the server told us, so nothing needs to be read at all. Not\n        // TRUSTED — a lying or absent header just falls through to the streaming counter below.\n        return this.reject(CimdRejectionReason.UNREACHABLE, 'client metadata document exceeds the permitted size');\n      }\n\n      const read = await this.readBoundedBody(response);\n      if (read.kind !== 'read') return read;\n\n      try {\n        return { kind: 'fetched', body: JSON.parse(read.text), cacheControl: response.headers.get('cache-control') };\n      } catch {\n        return this.reject(CimdRejectionReason.MALFORMED_DOCUMENT, 'client metadata document is not valid JSON');\n      }\n    } catch (error) {\n      return this.reject(CimdRejectionReason.UNREACHABLE, 'client metadata document could not be fetched');\n    }\n  }\n\n  /**\n   * Read the body with a running BYTE counter, abandoning the transfer the moment it exceeds the cap.\n   *\n   * This is the half that actually bounds memory: the counter is checked per chunk, so the most that\n   * is ever retained is the cap plus one chunk, whatever the server intended to send. `reader.cancel()`\n   * tears the connection down rather than politely draining a body we have already refused.\n   *\n   * Falls back to `response.text()` when the response exposes no stream. That is not a test\n   * accommodation — `fetch` may legitimately yield a null body (a 204, or a HEAD-like response) — and\n   * the byte length is still measured properly there, via `Buffer.byteLength` rather than `String.length`.\n   */\n  private async readBoundedBody(response: Response): Promise<{ kind: 'read'; text: string } | CimdResolution> {\n    const stream = response.body;\n    if (!stream || typeof (stream as ReadableStream<Uint8Array>).getReader !== 'function') {\n      const text = await response.text();\n      return Buffer.byteLength(text, 'utf8') > CIMD_MAX_DOCUMENT_BYTES\n        ? this.reject(CimdRejectionReason.UNREACHABLE, 'client metadata document exceeds the permitted size')\n        : { kind: 'read', text };\n    }\n\n    const reader = (stream as ReadableStream<Uint8Array>).getReader();\n    const chunks: Uint8Array[] = [];\n    let total = 0;\n    try {\n      for (;;) {\n        const { done, value } = await reader.read();\n        if (done) break;\n        if (!value) continue;\n        total += value.byteLength;\n        if (total > CIMD_MAX_DOCUMENT_BYTES) {\n          await reader.cancel().catch(() => undefined);\n          return this.reject(CimdRejectionReason.UNREACHABLE, 'client metadata document exceeds the permitted size');\n        }\n        chunks.push(value);\n      }\n    } finally {\n      reader.releaseLock?.();\n    }\n    return { kind: 'read', text: Buffer.concat(chunks).toString('utf8') };\n  }\n\n  /** Honour `max-age`, bounded at both ends. See the constants for why each bound exists. */\n  private resolveCacheTtlMs(cacheControl: string | null): number {\n    const maxAge = cacheControl?.match(/max-age\\s*=\\s*(\\d+)/i);\n    if (!maxAge) return CIMD_CACHE_MIN_TTL_MS;\n    const requested = Number(maxAge[1]) * 1000;\n    if (!Number.isFinite(requested)) return CIMD_CACHE_MIN_TTL_MS;\n    return Math.min(CIMD_CACHE_MAX_TTL_MS, Math.max(CIMD_CACHE_MIN_TTL_MS, requested));\n  }\n\n  private reject(reason: CimdRejectionReason, detail: string): CimdResolution {\n    return { kind: 'rejected', reason, detail };\n  }\n}\n"]}
+{"version":3,"file":"cimd-client-metadata.backend.service.js","sourceRoot":"","sources":["../../../../../../src/security/authentications/services/cimd-client-metadata.backend.service.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,OAAO,kBAAkB,CAAC;AAC1B,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAC/C,OAAO,EAAE,MAAM,IAAI,SAAS,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAC;AAEhC,OAAO,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AACpF,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAC7F,OAAO,EAAE,2BAA2B,EAAE,MAAM,8EAA8E,CAAC;AAC3H,OAAO,EACL,wBAAwB,EACxB,6BAA6B,GAC9B,MAAM,sEAAsE,CAAC;AAC9E,OAAO,EACL,0BAA0B,EAC1B,mBAAmB,GACpB,MAAM,sEAAsE,CAAC;AAC9E,OAAO,EACL,wBAAwB,EACxB,mBAAmB,EACnB,eAAe,EACf,qBAAqB,EACrB,qBAAqB,EACrB,qBAAqB,EACrB,uBAAuB,EACvB,sBAAsB,EACtB,wCAAwC,EACxC,2CAA2C,GAE5C,MAAM,yEAAyE,CAAC;AACjF,OAAO,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AAE/G;;;;;;;;GAQG;AACH,MAAM,uBAAuB,GAAsB,CAAC,QAAQ,CAAC,CAAC;AAe9D;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEI,IAAM,gCAAgC,GAAtC,MAAM,gCAAgC;IAmBW;IACU;IAnBhE;;;;;;;;;;;;;;OAcG;IACc,KAAK,GAAG,IAAI,GAAG,EAA0B,CAAC;IAE3D,YACsD,MAAqB,EACX,gBAAyC;QADnD,WAAM,GAAN,MAAM,CAAe;QACX,qBAAgB,GAAhB,gBAAgB,CAAyB;IACtG,CAAC;IAEJ;;;;;;;;;;;;OAYG;IACI,uBAAuB;QAC5B,MAAM,QAAQ,GAAI,IAAI,CAAC,gBAAgB,CAAC,MAAM,EAAE,IAAuF,EAAE,IAAI,CAAC;QAC9I,OAAO;YACL,MAAM,EAAE,QAAQ,EAAE,MAAM,IAAI,eAAe,CAAC,QAAQ;YACpD,YAAY,EAAE,QAAQ,EAAE,cAAc,IAAI,EAAE;SAC7C,CAAC;IACJ,CAAC;IAED,6FAA6F;IACtF,cAAc,CAAC,QAAgB;QACpC,OAAO,QAAQ,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;IACzC,CAAC;IAEM,KAAK,CAAC,OAAO,CAAC,QAAgB,EAAE,MAAyB,EAAE,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE;QAClF,2FAA2F;QAC3F,+FAA+F;QAC/F,IAAI,MAAM,CAAC,MAAM,KAAK,eAAe,CAAC,QAAQ,EAAE,CAAC;YAC/C,OAAO,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,eAAe,EAAE,8CAA8C,CAAC,CAAC;QAC1G,CAAC;QAED,6FAA6F;QAC7F,6GAA6G;QAC7G,6FAA6F;QAC7F,qEAAqE;QACrE,IAAI,GAAQ,CAAC;QACb,IAAI,CAAC;YACH,GAAG,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC1B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,mBAAmB,EAAE,wBAAwB,CAAC,CAAC;QACxF,CAAC;QACD,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAC9B,OAAO,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,mBAAmB,EAAE,qCAAqC,CAAC,CAAC;QACrG,CAAC;QACD,IAAI,GAAG,CAAC,QAAQ,KAAK,GAAG,IAAI,GAAG,CAAC,QAAQ,KAAK,EAAE,EAAE,CAAC;YAChD,OAAO,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,mBAAmB,EAAE,yCAAyC,CAAC,CAAC;QACzG,CAAC;QACD,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;YACb,6FAA6F;YAC7F,4FAA4F;YAC5F,OAAO,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,mBAAmB,EAAE,uCAAuC,CAAC,CAAC;QACvG,CAAC;QAED,gCAAgC;QAChC,IAAI,MAAM,CAAC,MAAM,KAAK,eAAe,CAAC,SAAS,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,GAAG,EAAE,MAAM,CAAC,YAAY,IAAI,EAAE,CAAC,EAAE,CAAC;YACvG,OAAO,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,gBAAgB,EAAE,gDAAgD,CAAC,CAAC;QAC7G,CAAC;QAED,8FAA8F;QAC9F,2FAA2F;QAC3F,uDAAuD;QACvD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC9C,IAAI,MAAM,IAAI,MAAM,CAAC,WAAW,GAAG,KAAK,EAAE,CAAC;YACzC,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC;QACnD,CAAC;QAED,6FAA6F;QAC7F,4CAA4C;QAC5C,uEAAuE;QACvE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,CAAC;QAClD,IAAI,IAAI;YAAE,OAAO,IAAI,CAAC;QAEtB,qBAAqB;QACrB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC;QAC9C,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS;YAAE,OAAO,OAAO,CAAC;QAE/C,iBAAiB;QACjB,MAAM,MAAM,GAAG,wBAAwB,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAChE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,sFAAsF;YACtF,6FAA6F;YAC7F,aAAa;YACb,mEAAmE;YACnE,OAAO,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,kBAAkB,EAAE,kDAAkD,CAAC,CAAC;QACjH,CAAC;QAED,8FAA8F;QAC9F,+FAA+F;QAC/F,sBAAsB;QACtB,uEAAuE;QACvE,EAAE;QACF,+FAA+F;QAC/F,sEAAsE;QACtE,IAAI,MAAM,CAAC,IAAI,CAAC,SAAS,KAAK,GAAG,CAAC,QAAQ,EAAE,EAAE,CAAC;YAC7C,OAAO,IAAI,CAAC,MAAM,CAChB,mBAAmB,CAAC,iBAAiB,EACrC,sEAAsE,CACvE,CAAC;QACJ,CAAC;QAED,+FAA+F;QAC/F,gGAAgG;QAChG,gGAAgG;QAChG,MAAM,UAAU,GAAG,IAAI,CAAC,sCAAsC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC5E,IAAI,UAAU;YAAE,OAAO,UAAU,CAAC;QAElC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,MAAM,CAAC,IAAI,EAAE,KAAK,GAAG,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,KAAK,CAAC,CAAC;QAC5G,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;IAC/C,CAAC;IAED;;;;;;;;;;;;;;;;;;OAkBG;IACK,YAAY,CAAC,GAAW,EAAE,QAA4B,EAAE,WAAmB,EAAE,KAAa;QAChG,KAAK,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YAC7C,IAAI,MAAM,CAAC,WAAW,IAAI,KAAK;gBAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAChE,CAAC;QACD,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,sBAAsB,EAAE,CAAC;YACjD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC;YACxC,IAAI,MAAM,CAAC,IAAI;gBAAE,MAAM;YACvB,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAClC,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC,CAAC;IACjD,CAAC;IAED;;;;;;;;;;;;;;;;;OAiBG;IACK,sCAAsC,CAAC,QAA4B;QACzE,MAAM,QAAQ,GAAG,QAAQ,CAAC,0BAA0B,CAAC;QACrD,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,wCAAwC;YAAE,OAAO,SAAS,CAAC;QACtG,IAAI,2CAA2C,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YACnE,OAAO,IAAI,CAAC,MAAM,CAChB,mBAAmB,CAAC,iCAAiC,EACrD,iCAAiC,QAAQ,iDAAiD,CAC3F,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,CAAC,MAAM,CAChB,mBAAmB,CAAC,+BAA+B,EACnD,iCAAiC,QAAQ,sDAAsD,CAChG,CAAC;IACJ,CAAC;IAED;;;;;;;;;;OAUG;IACI,kBAAkB,CAAC,QAA4B,EAAE,WAAmB;QACzE,OAAO,QAAQ,CAAC,aAAa,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACtD,CAAC;IAED;;;;;;;;;;;;OAYG;IACI,2BAA2B,CAAC,QAA4B;QAC7D,OAAO,QAAQ,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YAC1C,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;gBACjD,OAAO,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,OAAO,CAAC;YAC5F,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;;;;;;;;;OAiBG;IACK,aAAa,CAAC,GAAQ,EAAE,OAA0B;QACxD,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,EAAE,CAAC;QAChC,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;QACxC,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE;YAC5B,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;YAC3B,IAAI,CAAC,KAAK;gBAAE,OAAO,KAAK,CAAC;YACzB,OAAO,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC;gBAC1B,CAAC,CAAC,KAAK,KAAK,QAAQ;gBACpB,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,IAAI,CAAC;QACnC,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;;;;;;;;;;;;OAoBG;IACK,KAAK,CAAC,oBAAoB,CAAC,GAAQ;QACzC,MAAM,UAAU,GAAG,MAAM,6BAA6B,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC,CAAC;QAEpH,QAAQ,UAAU,EAAE,CAAC;YACnB,KAAK,wBAAwB,CAAC,MAAM;gBAClC,OAAO,SAAS,CAAC;YACnB,KAAK,wBAAwB,CAAC,YAAY;gBACxC,OAAO,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,WAAW,EAAE,iCAAiC,CAAC,CAAC;YACzF,KAAK,wBAAwB,CAAC,QAAQ;gBACpC,OAAO,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,mBAAmB,EAAE,iDAAiD,CAAC,CAAC;QACnH,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACK,KAAK,CAAC,gBAAgB,CAAC,QAAgB;QAC7C,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,QAAQ,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC;YACzD,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACjD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,uCAAuC,EAAE,EAAE,QAAQ,EAAE,GAAG,2BAA2B,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YAChH,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;;;;OAeG;IACK,KAAK,CAAC,sBAAsB,CAAC,GAAQ;QAC3C,OAAO,mBAAmB,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE;YACzC,iBAAiB,EAAE,uBAAuB;YAC1C,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;YACvC,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,qBAAqB,CAAC;YAClD,+FAA+F;YAC/F,0FAA0F;YAC1F,0FAA0F;YAC1F,qFAAqF;YACrF,gBAAgB,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE;gBACnC,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC;gBACxD,OAAO,SAAS,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;YAC1E,CAAC;SACF,CAAC,CAAC;IACL,CAAC;IAEO,KAAK,CAAC,aAAa,CAAC,GAAQ;QAClC,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC,CAAC;YACxD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,OAAO,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,WAAW,EAAE,sCAAsC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;YAC/G,CAAC;YAED,2FAA2F;YAC3F,EAAE;YACF,4FAA4F;YAC5F,6FAA6F;YAC7F,8FAA8F;YAC9F,8FAA8F;YAC9F,yDAAyD;YACzD,EAAE;YACF,+FAA+F;YAC/F,kDAAkD;YAClD,MAAM,cAAc,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC;YACtE,IAAI,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,IAAI,cAAc,GAAG,uBAAuB,EAAE,CAAC;gBAChF,yFAAyF;gBACzF,wFAAwF;gBACxF,OAAO,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,WAAW,EAAE,qDAAqD,CAAC,CAAC;YAC7G,CAAC;YAED,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC;YAClD,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM;gBAAE,OAAO,IAAI,CAAC;YAEtC,IAAI,CAAC;gBACH,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,YAAY,EAAE,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,CAAC;YAC/G,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,kBAAkB,EAAE,4CAA4C,CAAC,CAAC;YAC3G,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf;;;;;;;;eAQG;YACH,IAAI,KAAK,YAAY,0BAA0B,EAAE,CAAC;gBAChD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,gDAAgD,EAAE;oBAClE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE;oBACxB,SAAS,EAAE,KAAK,CAAC,SAAS;oBAC1B,cAAc,EAAE,KAAK,CAAC,cAAc;iBACrC,CAAC,CAAC;gBACH,OAAO,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,mBAAmB,EAAE,iDAAiD,CAAC,CAAC;YACjH,CAAC;YACD,OAAO,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,WAAW,EAAE,+CAA+C,CAAC,CAAC;QACvG,CAAC;IACH,CAAC;IAED;;;;;;;;;;OAUG;IACK,KAAK,CAAC,eAAe,CAAC,QAAkB;QAC9C,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC;QAC7B,IAAI,CAAC,MAAM,IAAI,OAAQ,MAAqC,CAAC,SAAS,KAAK,UAAU,EAAE,CAAC;YACtF,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YACnC,OAAO,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,GAAG,uBAAuB;gBAC9D,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,WAAW,EAAE,qDAAqD,CAAC;gBACrG,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;QAC7B,CAAC;QAED,MAAM,MAAM,GAAI,MAAqC,CAAC,SAAS,EAAE,CAAC;QAClE,MAAM,MAAM,GAAiB,EAAE,CAAC;QAChC,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,IAAI,CAAC;YACH,SAAS,CAAC;gBACR,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;gBAC5C,IAAI,IAAI;oBAAE,MAAM;gBAChB,IAAI,CAAC,KAAK;oBAAE,SAAS;gBACrB,KAAK,IAAI,KAAK,CAAC,UAAU,CAAC;gBAC1B,IAAI,KAAK,GAAG,uBAAuB,EAAE,CAAC;oBACpC,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;oBAC7C,OAAO,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,WAAW,EAAE,qDAAqD,CAAC,CAAC;gBAC7G,CAAC;gBACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACrB,CAAC;QACH,CAAC;gBAAS,CAAC;YACT,MAAM,CAAC,WAAW,EAAE,EAAE,CAAC;QACzB,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;IACxE,CAAC;IAED,2FAA2F;IACnF,iBAAiB,CAAC,YAA2B;QACnD,MAAM,MAAM,GAAG,YAAY,EAAE,KAAK,CAAC,sBAAsB,CAAC,CAAC;QAC3D,IAAI,CAAC,MAAM;YAAE,OAAO,qBAAqB,CAAC;QAC1C,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC;QAC3C,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC;YAAE,OAAO,qBAAqB,CAAC;QAC9D,OAAO,IAAI,CAAC,GAAG,CAAC,qBAAqB,EAAE,IAAI,CAAC,GAAG,CAAC,qBAAqB,EAAE,SAAS,CAAC,CAAC,CAAC;IACrF,CAAC;IAEO,MAAM,CAAC,MAA2B,EAAE,MAAc;QACxD,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IAC9C,CAAC;CACF,CAAA;AAzcY,gCAAgC;IAD5C,UAAU,EAAE;IAoBR,WAAA,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAA;IACjC,WAAA,MAAM,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,CAAA;qCADgB,aAAa;QACO,uBAAuB;GApB9F,gCAAgC,CAyc5C","sourcesContent":["import 'reflect-metadata';\nimport { injectable, inject } from 'inversify';\nimport { lookup as dnsLookup } from 'node:dns/promises';\nimport { isIP } from 'node:net';\n\nimport { SAAS_SERVICE_TYPES } from '~wildo-backend-lib/inject/models/service-types';\nimport { LoggerService } from '~wildo-backend-lib/monitoring/logger/services/logger.service';\nimport { projectCaughtErrorLogFields } from '~wildo-backend-lib/errors/utils/error-log-level-classification.backend.utils';\nimport {\n  OutboundTargetResolution,\n  resolvesOnlyToPublicAddresses,\n} from '~wildo-backend-lib/security/ssrf/outbound-target-guard.backend.utils';\nimport {\n  OutboundTargetRefusedError,\n  pinnedOutboundFetch,\n} from '~wildo-backend-lib/security/ssrf/pinned-outbound-fetch.backend.utils';\nimport {\n  CimdClientMetadataSchema,\n  CimdRejectionReason,\n  CimdTrustPolicy,\n  CIMD_CACHE_MAX_TTL_MS,\n  CIMD_CACHE_MIN_TTL_MS,\n  CIMD_FETCH_TIMEOUT_MS,\n  CIMD_MAX_DOCUMENT_BYTES,\n  CIMD_MAX_CACHE_ENTRIES,\n  CIMD_ACCEPTED_TOKEN_ENDPOINT_AUTH_METHOD,\n  CIMD_ASYMMETRIC_TOKEN_ENDPOINT_AUTH_METHODS,\n  type CimdClientMetadata,\n} from '~wildo-backend-lib/security/authentications/models/cimd.backend.schemas';\nimport { AppConfigurationService } from '~wildo-backend-lib/config/services/app-configuration.backend.service';\n\n/**\n * The scheme the egress client will issue on.\n *\n * A `client_id` that is not `https:` is already refused at shape time (`refuseMalformedClientId`),\n * so this restates a decision rather than making a new one — deliberately. The pinned client takes\n * the scheme policy as a required input precisely so no caller can inherit a permissive default, and\n * a second statement at the egress point costs one line and survives a future refactor that moves\n * the shape check.\n */\nconst CIMD_ADMITTED_PROTOCOLS: readonly string[] = ['https:'];\n\n/** The deployment's CIMD posture, resolved from application config. */\nexport interface CimdConfiguration {\n  policy: CimdTrustPolicy;\n  /** Hosts accepted under {@link CimdTrustPolicy.ALLOWLIST}. Exact host match, case-insensitive. */\n  allowedHosts?: readonly string[];\n}\n\nexport type CimdResolution =\n  | { kind: 'ok'; metadata: CimdClientMetadata }\n  | { kind: 'rejected'; reason: CimdRejectionReason; detail: string };\n\ninterface CachedDocument { metadata: CimdClientMetadata; expiresAtMs: number }\n\n/**\n * Resolve an HTTPS `client_id` URL into validated client metadata (CIMD).\n *\n * ## What makes this different from every other lookup in the provider\n *\n * Every other client resolution reads a row this application minted. This one takes a URL from an\n * UNAUTHENTICATED stranger and makes an outbound request to it. That inverts the usual trust\n * direction, and the draft is explicit about the consequence:\n *\n *   \"The authorization server takes a URL as input from an unknown client and fetches that URL. A\n *    malicious client could use this to trigger the authorization server to make requests to\n *    arbitrary URLs, such as requests to private administration endpoints the authorization server\n *    has access to.\"\n *   spec-cite: MCP 2025-11-25 — Authorization § Client ID Metadata Document Security\n *\n * So the order of operations is itself a control: POLICY first (is this deployment even accepting\n * stranger URLs?), then SHAPE, then the SSRF target check, and only then a bounded fetch. Every\n * cheap refusal happens before anything leaves the process.\n *\n * ## What this deliberately does NOT do\n *\n * It does not decide whether the caller may have a token. It resolves an IDENTITY and the redirect\n * URIs that identity claims; consent, scope and audience remain the caller's own gates. A client\n * that resolves here is a client whose NAME the consent screen may show — nothing more.\n *\n * assurance-control: WILDO.IDENTITY.CLIENT_IDENTITY_ASSERTION — a client identity is bound to a\n * domain the client demonstrably controls\n */\n@injectable()\nexport class CimdClientMetadataBackendService {\n  /**\n   * In-process, per-pod. Deliberately not Redis.\n   *\n   * The document is public by construction — anyone can fetch it — so a shared cache buys only\n   * fewer outbound requests, at the cost of a shared mutable surface keyed on attacker-supplied\n   * strings. A per-pod cache cannot be poisoned across pods and disappears on restart, which is also\n   * the crudest revocation path available.\n   *\n   * **It is bounded by {@link CIMD_MAX_CACHE_ENTRIES}, and that bound is load-bearing.** An earlier\n   * revision of this comment claimed the cache was bounded when nothing bounded it: the key is an\n   * attacker-supplied URL, entries were only SKIPPED when stale and never reclaimed, and there was\n   * no ceiling — so the map grew for the life of the pod. Insertion order is eviction order (a Map\n   * preserves it), which is the right policy here because every entry has a short, bounded TTL: the\n   * oldest entry is also the closest to expiry.\n   */\n  private readonly cache = new Map<string, CachedDocument>();\n\n  constructor(\n    @inject(SAAS_SERVICE_TYPES.Logger) private readonly logger: LoggerService,\n    @inject(SAAS_SERVICE_TYPES.AppConfigService) private readonly appConfigService: AppConfigurationService,\n  ) {}\n\n  /**\n   * The deployment's CIMD posture, read from `auth.cimd` in the application configuration.\n   *\n   * **One reader, deliberately.** Two facts must never disagree: what the discovery document\n   * ADVERTISES (`client_id_metadata_document_supported`) and what the authorize path ACCEPTS. When\n   * each read the config for itself, a divergence between them would be invisible — the server would\n   * advertise a capability it refuses, or refuse one it advertises, and every client would blame its\n   * own implementation. Both now call this.\n   *\n   * Defaults to `DISABLED` when unconfigured: nothing fetches a stranger's URL until an application\n   * opts in. A framework that shipped `OPEN` by default would open an SSRF surface on every\n   * deployment that never asked for one.\n   */\n  public deploymentConfiguration(): CimdConfiguration {\n    const authored = (this.appConfigService.config?.auth as { cimd?: { policy?: CimdTrustPolicy; allowedClients?: string[] } } | undefined)?.cimd;\n    return {\n      policy: authored?.policy ?? CimdTrustPolicy.DISABLED,\n      allowedHosts: authored?.allowedClients ?? [],\n    };\n  }\n\n  /** Does this `client_id` even look like a CIMD identifier? Cheap, allocation-free triage. */\n  public isCimdClientId(clientId: string): boolean {\n    return clientId.startsWith('https://');\n  }\n\n  public async resolve(clientId: string, config: CimdConfiguration, nowMs = Date.now()): Promise<CimdResolution> {\n    // 1 — POLICY, before anything else. A disabled deployment must not even parse the URL, let\n    //     alone resolve DNS for it: refusing later would still have leaked that this server looks.\n    if (config.policy === CimdTrustPolicy.DISABLED) {\n      return this.reject(CimdRejectionReason.POLICY_DISABLED, 'client id metadata documents are not enabled');\n    }\n\n    // 2 — SHAPE. \"The `client_id` URL MUST use the \"https\" scheme and contain a path component\".\n    //     spec-cite: MCP 2025-11-25 — Authorization § Client ID Metadata Documents → Implementation Requirements\n    //     The path requirement is not cosmetic: it stops a bare origin being an identity, so one\n    //     compromised host cannot claim to be every client on that host.\n    let url: URL;\n    try {\n      url = new URL(clientId);\n    } catch {\n      return this.reject(CimdRejectionReason.MALFORMED_CLIENT_ID, 'client_id is not a URL');\n    }\n    if (url.protocol !== 'https:') {\n      return this.reject(CimdRejectionReason.MALFORMED_CLIENT_ID, 'client_id must use the https scheme');\n    }\n    if (url.pathname === '/' || url.pathname === '') {\n      return this.reject(CimdRejectionReason.MALFORMED_CLIENT_ID, 'client_id must contain a path component');\n    }\n    if (url.hash) {\n      // A fragment is never sent to the server, so two client_ids differing only by fragment would\n      // fetch the same document and then fail the identity comparison — confusing, and pointless.\n      return this.reject(CimdRejectionReason.MALFORMED_CLIENT_ID, 'client_id must not contain a fragment');\n    }\n\n    // 3 — TRUST POLICY on the host.\n    if (config.policy === CimdTrustPolicy.ALLOWLIST && !this.isAllowListed(url, config.allowedHosts ?? [])) {\n      return this.reject(CimdRejectionReason.HOST_NOT_ALLOWED, 'client_id is not on this deployment allow-list');\n    }\n\n    // 4 — CACHE, keyed on the exact URL. Read before the SSRF check because a cached document was\n    //     already validated against every gate above at the time it was stored, and the policy\n    //     gates above have already re-run on THIS request.\n    const cached = this.cache.get(url.toString());\n    if (cached && cached.expiresAtMs > nowMs) {\n      return { kind: 'ok', metadata: cached.metadata };\n    }\n\n    // 5 — SSRF. Resolved BEFORE the fetch: \"Authorization servers SHOULD avoid fetching any URLs\n    //     using private or loopback addresses\".\n    //     spec-cite: draft-ietf-oauth-client-id-metadata-document-00 § 6.5\n    const ssrf = await this.refuseInternalTarget(url);\n    if (ssrf) return ssrf;\n\n    // 6 — Bounded fetch.\n    const fetched = await this.fetchDocument(url);\n    if (fetched.kind !== 'fetched') return fetched;\n\n    // 7 — STRUCTURE.\n    const parsed = CimdClientMetadataSchema.safeParse(fetched.body);\n    if (!parsed.success) {\n      // NOT cached: \"The authorization server MUST NOT cache documents which are invalid or\n      // malformed.\" Caching a malformed document would let one bad deploy pin a client out for the\n      // whole TTL.\n      // spec-cite: draft-ietf-oauth-client-id-metadata-document-00 § 4.4\n      return this.reject(CimdRejectionReason.MALFORMED_DOCUMENT, 'document is not a valid client metadata document');\n    }\n\n    // 8 — IDENTITY. \"The client metadata document MUST contain a `client_id` property whose value\n    //     MUST match the URL of the document using simple string comparison as defined in RFC 3986\n    //     Section 6.2.1.\"\n    //     spec-cite: draft-ietf-oauth-client-id-metadata-document-00 § 4.1\n    //\n    //     This is the load-bearing check of the whole mechanism: without it, anyone who can host a\n    //     JSON file could claim any other client's identity by naming it.\n    if (parsed.data.client_id !== url.toString()) {\n      return this.reject(\n        CimdRejectionReason.IDENTITY_MISMATCH,\n        'the document\\'s client_id does not match the URL it was fetched from',\n      );\n    }\n\n    // 9 — CLIENT AUTHENTICATION. Checked BEFORE the cache write, alongside structure and identity,\n    //     for the same reason those are: a document this server will never accept must not occupy a\n    //     cache slot, and must not be re-served to a later request as though it had been validated.\n    const authMethod = this.refuseUnacceptableClientAuthentication(parsed.data);\n    if (authMethod) return authMethod;\n\n    this.storeInCache(url.toString(), parsed.data, nowMs + this.resolveCacheTtlMs(fetched.cacheControl), nowMs);\n    return { kind: 'ok', metadata: parsed.data };\n  }\n\n  /**\n   * Write a validated document, reclaiming space first so the map cannot grow without limit.\n   *\n   * Two steps, in this order:\n   *\n   *  1. **Sweep the expired.** Reclaiming stale entries before evicting live ones means a steady\n   *     state of legitimate traffic never evicts anything — the TTL does the work, and eviction is\n   *     reserved for genuine pressure.\n   *  2. **Evict the oldest** while still at the ceiling. `Map` iterates in insertion order, and\n   *     because every entry carries a short bounded TTL the oldest is also the nearest to expiry —\n   *     so insertion order is a good proxy for \"least valuable\" without tracking access times.\n   *\n   * There is deliberately NO delete-before-set for an existing key. A first draft had one, to move a\n   * refreshed document to the end of the order — but this method is only ever reached after a cache\n   * MISS: a live entry returns from `resolve` before the fetch, and an expired one is removed by the\n   * sweep above. The key can never still be present, so the delete was guarding a state that cannot\n   * occur, and a test written to prove it necessarily failed. Removed rather than kept as defence,\n   * because dead code with a plausible comment is how the next reader is misled.\n   */\n  private storeInCache(key: string, metadata: CimdClientMetadata, expiresAtMs: number, nowMs: number): void {\n    for (const [cachedKey, cached] of this.cache) {\n      if (cached.expiresAtMs <= nowMs) this.cache.delete(cachedKey);\n    }\n    while (this.cache.size >= CIMD_MAX_CACHE_ENTRIES) {\n      const oldest = this.cache.keys().next();\n      if (oldest.done) break;\n      this.cache.delete(oldest.value);\n    }\n    this.cache.set(key, { metadata, expiresAtMs });\n  }\n\n  /**\n   * Refuse a document whose declared client authentication method this provider will not honour.\n   *\n   * Two refusals with two reasons, because they are two different facts about the world:\n   *\n   * - A SYMMETRIC method is the client violating the draft — \"the `token_endpoint_auth_method`\n   *   property MUST NOT include `client_secret_post`, `client_secret_basic`, `client_secret_jwt`, or\n   *   any other method based around a shared symmetric secret.\"\n   *   spec-cite: draft-ietf-oauth-client-id-metadata-document-00 § 4.1\n   * - `private_key_jwt` is permitted by § 6.2 (\"clients MAY establish credentials at the\n   *   authorization server by using authentication methods that use public/private key pairs, by\n   *   publishing the public key in their metadata document\") and simply is not implemented here.\n   *\n   * Both refuse. The alternative — accept the document and treat the client as public — is a silent\n   * downgrade: the client believes it authenticates, this server never checks, and neither side can\n   * observe the disagreement. An absent `token_endpoint_auth_method` IS accepted as public, which is\n   * what the specification's own worked example declares (`\"token_endpoint_auth_method\": \"none\"`).\n   */\n  private refuseUnacceptableClientAuthentication(metadata: CimdClientMetadata): CimdResolution | undefined {\n    const declared = metadata.token_endpoint_auth_method;\n    if (declared === undefined || declared === CIMD_ACCEPTED_TOKEN_ENDPOINT_AUTH_METHOD) return undefined;\n    if (CIMD_ASYMMETRIC_TOKEN_ENDPOINT_AUTH_METHODS.includes(declared)) {\n      return this.reject(\n        CimdRejectionReason.UNSUPPORTED_CLIENT_AUTHENTICATION,\n        `client authentication method '${declared}' is not supported by this authorization server`,\n      );\n    }\n    return this.reject(\n      CimdRejectionReason.FORBIDDEN_CLIENT_AUTHENTICATION,\n      `client authentication method '${declared}' is not permitted for a client id metadata document`,\n    );\n  }\n\n  /**\n   * Is a redirect URI one this client actually claims?\n   *\n   * \"MUST validate redirect URIs presented in an authorization request against those in the metadata\n   * document.\"\n   * spec-cite: MCP 2025-11-25 — Authorization § Client ID Metadata Documents → Implementation Requirements\n   *\n   * EXACT string comparison, not prefix or origin matching: a prefix rule turns one claimed\n   * `https://app.example/cb` into authority over `https://app.example/cb.attacker/...`, and OAuth\n   * 2.1 requires exact redirect matching independently of CIMD.\n   */\n  public permitsRedirectUri(metadata: CimdClientMetadata, redirectUri: string): boolean {\n    return metadata.redirect_uris.includes(redirectUri);\n  }\n\n  /**\n   * Does this client's claimed redirect set consist ONLY of loopback URIs?\n   *\n   * Callers use this to decide whether the consent screen needs a stronger warning. CIMD \"cannot\n   * prevent `localhost` URL impersonation by themselves\": an attacker presents the LEGITIMATE\n   * client's metadata URL, binds any localhost port, and receives the code — while the user sees the\n   * legitimate client's name.\n   * spec-cite: MCP 2025-11-25 — Authorization § Client ID Metadata Document Security → Localhost Redirect URI Risks\n   *\n   * Reported rather than refused: loopback redirects are how every CLI and desktop MCP client works,\n   * so refusing them would exclude the majority of real callers. The mitigation the spec names is\n   * display, and display needs this signal.\n   */\n  public claimsOnlyLoopbackRedirects(metadata: CimdClientMetadata): boolean {\n    return metadata.redirect_uris.every((uri) => {\n      try {\n        const host = new URL(uri).hostname.toLowerCase();\n        return host === 'localhost' || host === '127.0.0.1' || host === '::1' || host === '[::1]';\n      } catch {\n        return false;\n      }\n    });\n  }\n\n  /**\n   * Is this `client_id` admitted by the deployment's allow-list?\n   *\n   * An entry is matched at ONE OF TWO precisions, decided by the entry itself:\n   *\n   * - **A full `https://…` URL** matches that exact `client_id` and nothing else.\n   * - **A bare host** matches every `client_id` on that host.\n   *\n   * Both exist because they answer different questions. Clerk's CIMD admission is per-Client-ID-URL,\n   * and that is the stricter and usually correct grain: a host entry admits EVERY client hosted\n   * there, which is wrong the moment the domain is a shared platform hosting many vendors' metadata —\n   * allow-listing one vendor would silently admit all of them. The host form is kept for the common\n   * case where a deployment trusts a vendor's whole domain and does not want to re-edit config each\n   * time that vendor publishes a new client.\n   *\n   * The first implementation offered ONLY the host form. Checking it against a shipping\n   * implementation is what surfaced the shared-domain hole.\n   */\n  private isAllowListed(url: URL, entries: readonly string[]): boolean {\n    const clientId = url.toString();\n    const host = url.hostname.toLowerCase();\n    return entries.some((entry) => {\n      const value = entry.trim();\n      if (!value) return false;\n      return value.includes('://')\n        ? value === clientId\n        : value.toLowerCase() === host;\n    });\n  }\n\n  /**\n   * Refuse a target that resolves to an address this server can reach but the public internet\n   * cannot.\n   *\n   * DNS is resolved HERE rather than trusting the hostname, because `internal.example.com` may be a\n   * public name with a private A record — the attack the guard exists for. Every resolved address is\n   * checked, not just the first: a hostile resolver can return one public and one private address\n   * and rely on the client picking the other.\n   *\n   * This is a check-then-fetch, and on its own it would leave DNS rebinding open — a name that\n   * answers a public address to THIS resolution and a private one to the connection. That residual\n   * is now closed one layer down rather than here: {@link fetchDocument} connects through\n   * `pinnedOutboundFetch`, which classifies inside the connection's `lookup` hook, so the address\n   * validated and the address connected to are the same value in the same event.\n   *\n   * This check is KEPT rather than folded into the pinned client, for two reasons. It refuses before\n   * anything leaves the process, which is this service's stated order of operations (\"every cheap\n   * refusal happens before anything leaves the process\"). And it is the only place that can tell\n   * UNRESOLVABLE from INTERNAL — the pinned client's hook sees a resolver failure as a transport\n   * failure, and collapsing the two would report a NXDOMAIN as an SSRF attempt.\n   */\n  private async refuseInternalTarget(url: URL): Promise<CimdResolution | undefined> {\n    const resolution = await resolvesOnlyToPublicAddresses(url.hostname, (hostname) => this.resolveAddresses(hostname));\n\n    switch (resolution) {\n      case OutboundTargetResolution.PUBLIC:\n        return undefined;\n      case OutboundTargetResolution.UNRESOLVABLE:\n        return this.reject(CimdRejectionReason.UNREACHABLE, 'client_id host does not resolve');\n      case OutboundTargetResolution.INTERNAL:\n        return this.reject(CimdRejectionReason.SSRF_TARGET_REFUSED, 'client_id host resolves to a non-public address');\n    }\n  }\n\n  /**\n   * Throws on failure rather than returning `undefined`, because the shared resolver distinguishes\n   * \"the resolver refused\" (UNRESOLVABLE) from \"the resolver answered with nothing usable\"\n   * (INTERNAL) — collapsing both into an empty array would turn a NXDOMAIN into an SSRF verdict and\n   * lose the diagnostic the caller reports.\n   */\n  private async resolveAddresses(hostname: string): Promise<string[]> {\n    try {\n      const records = await dnsLookup(hostname, { all: true });\n      return records.map((record) => record.address);\n    } catch (error) {\n      this.logger.debug('[cimd] client_id host did not resolve', { hostname, ...projectCaughtErrorLogFields(error) });\n      throw error;\n    }\n  }\n\n  /**\n   * The outbound request itself, isolated behind one method so a test can substitute it exactly as\n   * it substitutes {@link resolveAddresses}. Those two together are the whole external world this\n   * service touches.\n   *\n   * `pinnedOutboundFetch`, not `fetch`, and the difference is the point. It classifies inside the\n   * connection's `lookup` hook, so a `client_id` host that answers a public address to\n   * {@link refuseInternalTarget} and a private one to the connection — DNS rebinding, the residual\n   * this service documented and could not close — never gets a socket. It also cannot follow a\n   * redirect at all, which is strictly stronger than the `redirect: 'error'` this call used to pass:\n   * following one would re-point the request at a target no check ever saw.\n   *\n   * The resolver is the service's OWN {@link resolveAddresses}, so the pre-check and the connection\n   * ask the same resolver — a substituted resolver therefore drives both, which is what makes a\n   * rebinding pin expressible at all.\n   */\n  private async performOutboundRequest(url: URL): Promise<Response> {\n    return pinnedOutboundFetch(url.toString(), {\n      admittedProtocols: CIMD_ADMITTED_PROTOCOLS,\n      headers: { accept: 'application/json' },\n      signal: AbortSignal.timeout(CIMD_FETCH_TIMEOUT_MS),\n      // Never `admitPrivateAddresses` here, under any configuration. A `client_id` URL comes from an\n      // UNAUTHENTICATED stranger, so an escape on this path would be an operator declaring that\n      // strangers may address the deployment's internal network — a sentence with no legitimate\n      // reading. The escape exists only for a target class an operator authors themselves.\n      resolveAddresses: async (hostname) => {\n        const addresses = await this.resolveAddresses(hostname);\n        return addresses.map((address) => ({ address, family: isIP(address) }));\n      },\n    });\n  }\n\n  private async fetchDocument(url: URL): Promise<{ kind: 'fetched'; body: unknown; cacheControl: string | null } | CimdResolution> {\n    try {\n      const response = await this.performOutboundRequest(url);\n      if (!response.ok) {\n        return this.reject(CimdRejectionReason.UNREACHABLE, `client metadata document responded ${response.status}`);\n      }\n\n      // ── SIZE, enforced DURING the read rather than after it ─────────────────────────────────\n      //\n      // The previous implementation did `await response.text()` and then measured — which buffers\n      // the ENTIRE body first, so a hostile URL returning a gigabyte was fully downloaded and held\n      // in memory before being rejected. The cap existed and bounded nothing; the denial-of-service\n      // primitive it was written to remove was still there, and the 5 s timeout does not substitute\n      // because a fast server delivers a great deal inside it.\n      //\n      // It also measured `text.length` — UTF-16 code units — against a constant named `_BYTES`, so a\n      // multi-byte document read as smaller than it is.\n      const declaredLength = Number(response.headers.get('content-length'));\n      if (Number.isFinite(declaredLength) && declaredLength > CIMD_MAX_DOCUMENT_BYTES) {\n        // Cheapest possible refusal: the server told us, so nothing needs to be read at all. Not\n        // TRUSTED — a lying or absent header just falls through to the streaming counter below.\n        return this.reject(CimdRejectionReason.UNREACHABLE, 'client metadata document exceeds the permitted size');\n      }\n\n      const read = await this.readBoundedBody(response);\n      if (read.kind !== 'read') return read;\n\n      try {\n        return { kind: 'fetched', body: JSON.parse(read.text), cacheControl: response.headers.get('cache-control') };\n      } catch {\n        return this.reject(CimdRejectionReason.MALFORMED_DOCUMENT, 'client metadata document is not valid JSON');\n      }\n    } catch (error) {\n      /**\n       * A connect-time SSRF refusal is NOT \"unreachable\", and collapsing the two would lose the\n       * signal this whole guard exists to produce. `SSRF_TARGET_REFUSED` is counted and alerted on —\n       * the enum's own JSDoc says an operator watching a spike in it \"is watching an attack, not a\n       * misconfiguration\" — while `UNREACHABLE` is ordinary noise from strangers' broken hosts.\n       *\n       * A rebind lands HERE rather than at {@link refuseInternalTarget}, because by construction it\n       * passed that check. This branch is the only place it can be named.\n       */\n      if (error instanceof OutboundTargetRefusedError) {\n        this.logger.debug('[cimd] outbound target refused at connect time', {\n          clientId: url.toString(),\n          rejection: error.rejection,\n          refusedAddress: error.refusedAddress,\n        });\n        return this.reject(CimdRejectionReason.SSRF_TARGET_REFUSED, 'client_id host connects to a non-public address');\n      }\n      return this.reject(CimdRejectionReason.UNREACHABLE, 'client metadata document could not be fetched');\n    }\n  }\n\n  /**\n   * Read the body with a running BYTE counter, abandoning the transfer the moment it exceeds the cap.\n   *\n   * This is the half that actually bounds memory: the counter is checked per chunk, so the most that\n   * is ever retained is the cap plus one chunk, whatever the server intended to send. `reader.cancel()`\n   * tears the connection down rather than politely draining a body we have already refused.\n   *\n   * Falls back to `response.text()` when the response exposes no stream. That is not a test\n   * accommodation — `fetch` may legitimately yield a null body (a 204, or a HEAD-like response) — and\n   * the byte length is still measured properly there, via `Buffer.byteLength` rather than `String.length`.\n   */\n  private async readBoundedBody(response: Response): Promise<{ kind: 'read'; text: string } | CimdResolution> {\n    const stream = response.body;\n    if (!stream || typeof (stream as ReadableStream<Uint8Array>).getReader !== 'function') {\n      const text = await response.text();\n      return Buffer.byteLength(text, 'utf8') > CIMD_MAX_DOCUMENT_BYTES\n        ? this.reject(CimdRejectionReason.UNREACHABLE, 'client metadata document exceeds the permitted size')\n        : { kind: 'read', text };\n    }\n\n    const reader = (stream as ReadableStream<Uint8Array>).getReader();\n    const chunks: Uint8Array[] = [];\n    let total = 0;\n    try {\n      for (;;) {\n        const { done, value } = await reader.read();\n        if (done) break;\n        if (!value) continue;\n        total += value.byteLength;\n        if (total > CIMD_MAX_DOCUMENT_BYTES) {\n          await reader.cancel().catch(() => undefined);\n          return this.reject(CimdRejectionReason.UNREACHABLE, 'client metadata document exceeds the permitted size');\n        }\n        chunks.push(value);\n      }\n    } finally {\n      reader.releaseLock?.();\n    }\n    return { kind: 'read', text: Buffer.concat(chunks).toString('utf8') };\n  }\n\n  /** Honour `max-age`, bounded at both ends. See the constants for why each bound exists. */\n  private resolveCacheTtlMs(cacheControl: string | null): number {\n    const maxAge = cacheControl?.match(/max-age\\s*=\\s*(\\d+)/i);\n    if (!maxAge) return CIMD_CACHE_MIN_TTL_MS;\n    const requested = Number(maxAge[1]) * 1000;\n    if (!Number.isFinite(requested)) return CIMD_CACHE_MIN_TTL_MS;\n    return Math.min(CIMD_CACHE_MAX_TTL_MS, Math.max(CIMD_CACHE_MIN_TTL_MS, requested));\n  }\n\n  private reject(reason: CimdRejectionReason, detail: string): CimdResolution {\n    return { kind: 'rejected', reason, detail };\n  }\n}\n"]}

package/dist/esm/security/authentications/services/custom-impls/auth-custom-implementations.backend.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-custom-implementations.backend.d.ts","sourceRoot":"","sources":["../../../../../../../src/security/authentications/services/custom-impls/auth-custom-implementations.backend.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,0CAA0C,EAAE,MAAM,4GAA4G,CAAC;AAsB7K,eAAO,MAAM,yBAAyB,EAAE,0CAA0C,EAmBjF,CAAC"}
+{"version":3,"file":"auth-custom-implementations.backend.d.ts","sourceRoot":"","sources":["../../../../../../../src/security/authentications/services/custom-impls/auth-custom-implementations.backend.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,0CAA0C,EAAE,MAAM,4GAA4G,CAAC;AAuB7K,eAAO,MAAM,yBAAyB,EAAE,0CAA0C,EAqBjF,CAAC"}

package/dist/esm/security/authentications/services/custom-impls/auth-custom-implementations.backend.js

@@ -10,6 +10,7 @@
  */
 import { createSsoConnectionCreateFactories, createSsoConnectionUpdateFactories, createSsoConnectionDeleteFactories, createSsoConnectionTestConnectionFactories, createSsoConnectionDiscoverEndpointsFactories, } from './sso-connection.custom-impl.backend.service.js';
 import { createSsoConfigUpdateFactories } from './sso-config.custom-impl.backend.service.js';
+import { createSsoConfigDomainVerificationFactories } from './sso-config-domain-verification.custom-impl.backend.service.js';
 import { createSiemDlqRetrySingleFactories, createSiemDlqRetryAllFactories, createSiemDlqPurgeAllFactories, } from './siem-delivery-dlq.custom-impl.backend.service.js';
 import { createScimTokenGenerateFactories, createScimTokenRevokeFactories, createScimTokenRotateFactories, } from './scim-tokens.custom-impl.backend.service.js';
 // ── All auth custom implementation factories ─────────────────────────
@@ -24,6 +25,8 @@ export const authCustomImplementations = [
     ...createSsoConnectionDiscoverEndpointsFactories(),
     // SSO Config operations
     ...createSsoConfigUpdateFactories(),
+    // SSO Config domain-ownership operations (claim / verify / revoke) — #424
+    ...createSsoConfigDomainVerificationFactories(),
     // SIEM Delivery DLQ operations
     ...createSiemDlqRetrySingleFactories(),
     ...createSiemDlqRetryAllFactories(),

package/dist/esm/security/authentications/services/custom-impls/auth-custom-implementations.backend.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth-custom-implementations.backend.js","sourceRoot":"","sources":["../../../../../../../src/security/authentications/services/custom-impls/auth-custom-implementations.backend.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAGH,OAAO,EACL,kCAAkC,EAClC,kCAAkC,EAClC,kCAAkC,EAClC,0CAA0C,EAC1C,6CAA6C,GAC9C,MAAM,8CAA8C,CAAC;AACtD,OAAO,EAAE,8BAA8B,EAAE,MAAM,0CAA0C,CAAC;AAC1F,OAAO,EACL,iCAAiC,EACjC,8BAA8B,EAC9B,8BAA8B,GAC/B,MAAM,iDAAiD,CAAC;AACzD,OAAO,EACL,gCAAgC,EAChC,8BAA8B,EAC9B,8BAA8B,GAC/B,MAAM,2CAA2C,CAAC;AAEnD,wEAAwE;AAExE,MAAM,CAAC,MAAM,yBAAyB,GAAiD;IACrF,4BAA4B;IAC5B,+EAA+E;IAC/E,iFAAiF;IACjF,GAAG,kCAAkC,EAAE;IACvC,GAAG,kCAAkC,EAAE;IACvC,GAAG,kCAAkC,EAAE;IACvC,GAAG,0CAA0C,EAAE;IAC/C,GAAG,6CAA6C,EAAE;IAClD,wBAAwB;IACxB,GAAG,8BAA8B,EAAE;IACnC,+BAA+B;IAC/B,GAAG,iCAAiC,EAAE;IACtC,GAAG,8BAA8B,EAAE;IACnC,GAAG,8BAA8B,EAAE;IACnC,wBAAwB;IACxB,GAAG,gCAAgC,EAAE;IACrC,GAAG,8BAA8B,EAAE;IACnC,GAAG,8BAA8B,EAAE;CACpC,CAAC","sourcesContent":["/**\n * Auth Custom Implementations — Aggregator\n *\n * Exports all auth resource custom implementations for registration\n * in CoreBackend_ServiceImplementationsFactories.\n *\n * Only operations with real runtime behavior are registered. Unsupported\n * integration work is absent rather than exposed through placeholder success\n * handlers. No late-binding initialization is needed yet.\n */\n\nimport type { ResourceCustomServiceImplementationFactory } from '~wildo-backend-lib/base-classes/services/services/resource-operation-custom-implementation.factory.backend';\nimport {\n  createSsoConnectionCreateFactories,\n  createSsoConnectionUpdateFactories,\n  createSsoConnectionDeleteFactories,\n  createSsoConnectionTestConnectionFactories,\n  createSsoConnectionDiscoverEndpointsFactories,\n} from './sso-connection.custom-impl.backend.service';\nimport { createSsoConfigUpdateFactories } from './sso-config.custom-impl.backend.service';\nimport {\n  createSiemDlqRetrySingleFactories,\n  createSiemDlqRetryAllFactories,\n  createSiemDlqPurgeAllFactories,\n} from './siem-delivery-dlq.custom-impl.backend.service';\nimport {\n  createScimTokenGenerateFactories,\n  createScimTokenRevokeFactories,\n  createScimTokenRotateFactories,\n} from './scim-tokens.custom-impl.backend.service';\n\n// ── All auth custom implementation factories ─────────────────────────\n\nexport const authCustomImplementations: ResourceCustomServiceImplementationFactory[] = [\n  // SSO Connection operations\n  // (READ has no custom impl — oidc.clientSecret masking is framework-driven via\n  // `.isWriteOnlySecret()`; the UPDATE prefix re-injects the stored nested secret)\n  ...createSsoConnectionCreateFactories(),\n  ...createSsoConnectionUpdateFactories(),\n  ...createSsoConnectionDeleteFactories(),\n  ...createSsoConnectionTestConnectionFactories(),\n  ...createSsoConnectionDiscoverEndpointsFactories(),\n  // SSO Config operations\n  ...createSsoConfigUpdateFactories(),\n  // SIEM Delivery DLQ operations\n  ...createSiemDlqRetrySingleFactories(),\n  ...createSiemDlqRetryAllFactories(),\n  ...createSiemDlqPurgeAllFactories(),\n  // SCIM Token operations\n  ...createScimTokenGenerateFactories(),\n  ...createScimTokenRevokeFactories(),\n  ...createScimTokenRotateFactories(),\n];\n"]}
+{"version":3,"file":"auth-custom-implementations.backend.js","sourceRoot":"","sources":["../../../../../../../src/security/authentications/services/custom-impls/auth-custom-implementations.backend.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAGH,OAAO,EACL,kCAAkC,EAClC,kCAAkC,EAClC,kCAAkC,EAClC,0CAA0C,EAC1C,6CAA6C,GAC9C,MAAM,8CAA8C,CAAC;AACtD,OAAO,EAAE,8BAA8B,EAAE,MAAM,0CAA0C,CAAC;AAC1F,OAAO,EAAE,0CAA0C,EAAE,MAAM,8DAA8D,CAAC;AAC1H,OAAO,EACL,iCAAiC,EACjC,8BAA8B,EAC9B,8BAA8B,GAC/B,MAAM,iDAAiD,CAAC;AACzD,OAAO,EACL,gCAAgC,EAChC,8BAA8B,EAC9B,8BAA8B,GAC/B,MAAM,2CAA2C,CAAC;AAEnD,wEAAwE;AAExE,MAAM,CAAC,MAAM,yBAAyB,GAAiD;IACrF,4BAA4B;IAC5B,+EAA+E;IAC/E,iFAAiF;IACjF,GAAG,kCAAkC,EAAE;IACvC,GAAG,kCAAkC,EAAE;IACvC,GAAG,kCAAkC,EAAE;IACvC,GAAG,0CAA0C,EAAE;IAC/C,GAAG,6CAA6C,EAAE;IAClD,wBAAwB;IACxB,GAAG,8BAA8B,EAAE;IACnC,0EAA0E;IAC1E,GAAG,0CAA0C,EAAE;IAC/C,+BAA+B;IAC/B,GAAG,iCAAiC,EAAE;IACtC,GAAG,8BAA8B,EAAE;IACnC,GAAG,8BAA8B,EAAE;IACnC,wBAAwB;IACxB,GAAG,gCAAgC,EAAE;IACrC,GAAG,8BAA8B,EAAE;IACnC,GAAG,8BAA8B,EAAE;CACpC,CAAC","sourcesContent":["/**\n * Auth Custom Implementations — Aggregator\n *\n * Exports all auth resource custom implementations for registration\n * in CoreBackend_ServiceImplementationsFactories.\n *\n * Only operations with real runtime behavior are registered. Unsupported\n * integration work is absent rather than exposed through placeholder success\n * handlers. No late-binding initialization is needed yet.\n */\n\nimport type { ResourceCustomServiceImplementationFactory } from '~wildo-backend-lib/base-classes/services/services/resource-operation-custom-implementation.factory.backend';\nimport {\n  createSsoConnectionCreateFactories,\n  createSsoConnectionUpdateFactories,\n  createSsoConnectionDeleteFactories,\n  createSsoConnectionTestConnectionFactories,\n  createSsoConnectionDiscoverEndpointsFactories,\n} from './sso-connection.custom-impl.backend.service';\nimport { createSsoConfigUpdateFactories } from './sso-config.custom-impl.backend.service';\nimport { createSsoConfigDomainVerificationFactories } from './sso-config-domain-verification.custom-impl.backend.service';\nimport {\n  createSiemDlqRetrySingleFactories,\n  createSiemDlqRetryAllFactories,\n  createSiemDlqPurgeAllFactories,\n} from './siem-delivery-dlq.custom-impl.backend.service';\nimport {\n  createScimTokenGenerateFactories,\n  createScimTokenRevokeFactories,\n  createScimTokenRotateFactories,\n} from './scim-tokens.custom-impl.backend.service';\n\n// ── All auth custom implementation factories ─────────────────────────\n\nexport const authCustomImplementations: ResourceCustomServiceImplementationFactory[] = [\n  // SSO Connection operations\n  // (READ has no custom impl — oidc.clientSecret masking is framework-driven via\n  // `.isWriteOnlySecret()`; the UPDATE prefix re-injects the stored nested secret)\n  ...createSsoConnectionCreateFactories(),\n  ...createSsoConnectionUpdateFactories(),\n  ...createSsoConnectionDeleteFactories(),\n  ...createSsoConnectionTestConnectionFactories(),\n  ...createSsoConnectionDiscoverEndpointsFactories(),\n  // SSO Config operations\n  ...createSsoConfigUpdateFactories(),\n  // SSO Config domain-ownership operations (claim / verify / revoke) — #424\n  ...createSsoConfigDomainVerificationFactories(),\n  // SIEM Delivery DLQ operations\n  ...createSiemDlqRetrySingleFactories(),\n  ...createSiemDlqRetryAllFactories(),\n  ...createSiemDlqPurgeAllFactories(),\n  // SCIM Token operations\n  ...createScimTokenGenerateFactories(),\n  ...createScimTokenRevokeFactories(),\n  ...createScimTokenRotateFactories(),\n];\n"]}

package/dist/esm/security/authentications/services/custom-impls/sso-config-domain-verification.custom-impl.backend.service.d.ts

@@ -0,0 +1,28 @@
+/**
+ * SSO Config — domain-ownership operations (#424)
+ *
+ * Three public operations that turn enterprise domain routing from an out-of-band database write
+ * into a self-service admin flow:
+ *
+ *   claimDomain   → mints a DNS-TXT challenge, records the domain as `pending`, returns the record
+ *   verifyDomain  → resolves the record, records `verified` or `failed`
+ *   revokeDomain  → removes the claim, its status, its nonce and its `ssoEnabledDomains` entry
+ *
+ * ## Why PREFIX, and not OVERRIDE_ALL
+ *
+ * Each handler computes the new `domains` block and returns it; the framework's own core UPDATE
+ * persists it. `OVERRIDE_ALL` returns before the post-operation lane, so it emits NO
+ * `RESOURCE_OPERATION_PERFORMED` audit event — and the audit row is the control that makes a
+ * privileged configuration change with cross-tenant reach accountable. An operation that granted a
+ * tenant SSO routing authority and left no trail would be strictly worse than the database write it
+ * replaces, which at least happens where a DBA can see it.
+ *
+ * ## Where the domain-ownership rules live
+ *
+ * In `DomainVerificationBackendService`, as pure planners. This file is the door: it resolves the
+ * scope, enforces the refusals, and hands the plan to the framework. Nothing here re-implements
+ * what a claim or a revocation means.
+ */
+import { type ResourceCustomServiceImplementationFactory } from '../../../../base-classes/services/services/resource-operation-custom-implementation.factory.backend';
+export declare function createSsoConfigDomainVerificationFactories(): ResourceCustomServiceImplementationFactory[];
+//# sourceMappingURL=sso-config-domain-verification.custom-impl.backend.service.d.ts.map

package/dist/esm/security/authentications/services/custom-impls/sso-config-domain-verification.custom-impl.backend.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sso-config-domain-verification.custom-impl.backend.service.d.ts","sourceRoot":"","sources":["../../../../../../../src/security/authentications/services/custom-impls/sso-config-domain-verification.custom-impl.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAaH,OAAO,EAEL,KAAK,0CAA0C,EAChD,MAAM,4GAA4G,CAAC;AA+TpH,wBAAgB,0CAA0C,IAAI,0CAA0C,EAAE,CAMzG"}