npm - @wildo-ai/saas-backend-lib - Versions diffs - 1.1.2 → 1.1.3 - Mend

@wildo-ai/saas-backend-lib 1.1.2 → 1.1.3

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (853) hide show

package/dist/esm/security/authentications/services/auth-methods/auth-method-management.backend.service.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"auth-method-management.backend.service.js","sourceRoot":"","sources":["../../../../../../../src/security/authentications/services/auth-methods/auth-method-management.backend.service.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,OAAO,kBAAkB,CAAC;AAC1B,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAC/C,OAAO,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AACpF,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAG9G,OAAO,EAAE,oCAAoC,EAAE,MAAM,+FAA+F,CAAC;AACrJ,OAAO,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AAC/G,OAAO,EAAE,uBAAuB,EAAE,MAAM,gFAAgF,CAAC;AACzH,OAAO,EAAE,6BAA6B,EAAE,MAAM,yFAAyF,CAAC;AACxI,OAAO,EAAE,6BAA6B,EAAE,MAAM,wFAAwF,CAAC;AACvI,OAAO,EAAE,4BAA4B,EAAE,MAAM,6FAA6F,CAAC;AAC3I,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAC7F,OAAO,EACL,gBAAgB,EAChB,SAAS,EACT,2BAA2B,EAC3B,mBAAmB,EACnB,UAAU,EACV,wBAAwB,EACxB,+BAA+B,EAC/B,sBAAsB,EACtB,iBAAiB,GAClB,MAAM,uBAAuB,CAAC;AAK/B,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AACxD,OAAO,EAAE,qBAAqB,EAAE,MAAM,4FAA4F,CAAC;AACnI,OAAO,EAAE,6BAA6B,EAAE,sBAAsB,EAAE,MAAM,4FAA4F,CAAC;AAe5J,IAAM,kCAAkC,GAAxC,MAAM,kCAAkC;IAIS;IACa;IACW;IACR;IACN;IACA;IACM;IACP;IACM;IAMF;IAIL;IAEC;IAvB9C,QAAQ,CAA+D;IAExF,YACsD,MAAqB,EACR,YAAwC,EAC7B,uBAA8D,EACtE,kBAAwD,EAC9D,gBAAyC,EACzC,gBAAyC,EACnC,sBAAqD,EAC5D,WAA0C,EACpC,UAAwC,EAM1C,mBAA+C,EAIpD,cAAqC,EAEpC,eAAuC;QApBhD,WAAM,GAAN,MAAM,CAAe;QACR,iBAAY,GAAZ,YAAY,CAA4B;QAC7B,4BAAuB,GAAvB,uBAAuB,CAAuC;QACtE,uBAAkB,GAAlB,kBAAkB,CAAsC;QAC9D,qBAAgB,GAAhB,gBAAgB,CAAyB;QACzC,qBAAgB,GAAhB,gBAAgB,CAAyB;QACnC,2BAAsB,GAAtB,sBAAsB,CAA+B;QAC5D,gBAAW,GAAX,WAAW,CAA+B;QACpC,eAAU,GAAV,UAAU,CAA8B;QAM1C,wBAAmB,GAAnB,mBAAmB,CAA4B;QAIpD,mBAAc,GAAd,cAAc,CAAuB;QAEpC,oBAAe,GAAf,eAAe,CAAwB;QAEpG,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,oCAAoC,CAAC,CAAC;QAC9E,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,oCAAoC,EAAE,IAAI,CAAC,CAAC;IAC9E,CAAC;IAED,6EAA6E;IAC7E,mBAAmB;IACnB,6EAA6E;IAErE,SAAS,CAAC,KAAa;QAC7B,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,MAAM,CAAC;QAC9C,OAAO,MAAM,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACjC,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,sBAAsB,CAAC,EAAyB,EAAE,MAAc;QAC5E,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAA2B,gBAAgB,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC;YAC5H,IAAI,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;gBAC5B,OAAO,IAAI,CAAC,UAAU,CAAC,0BAA0B,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;YACnF,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,0CAA0C;QAC5C,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAEM,KAAK,CAAC,+BAA+B,CAAC,EAAyB,EAAE,MAAc;QACpF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QAC7D,MAAM,gBAAgB,GAAG,MAAM,EAAE,gBAAgB,CAAC;QAClD,IAAI,gBAAgB,IAAI,CAAC,gBAAgB,CAAC,sBAAsB,EAAE,CAAC;YACjE,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;gBACrE,sBAAsB,EAAE,2BAA2B,CAAC,aAAa;gBACjE,OAAO,EAAE,EAAE,MAAM,EAAE,0DAA0D,EAAE;aAChF,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,6EAA6E;IAC7E,sBAAsB;IACtB,6EAA6E;IAEtE,KAAK,CAAC,cAAc,CACzB,EAAyB,EACzB,MAAc,EACd,eAAuB,EACvB,WAAmB,EACnB,SAAiB,EACjB,SAAiB;QAEjB,IAAI,CAAC;YAEH,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;YAEjF,IAAI,CAAC,WAAW,IAAI,CAAC,WAAW,CAAC,YAAY,EAAE,CAAC;gBAC9C,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,SAAS,EAAE;oBAClE,sBAAsB,EAAE,2BAA2B,CAAC,UAAU;oBAC9D,OAAO,EAAE,EAAE,MAAM,EAAE,iDAAiD,EAAE;iBACvE,CAAC,CAAC;YACL,CAAC;YAED,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,cAAc,CACjE,WAAW,CAAC,YAAY,EAAE,eAAe,CAC1C,CAAC;YACF,IAAI,CAAC,cAAc,EAAE,CAAC;gBACpB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;oBACtE,sBAAsB,EAAE,2BAA2B,CAAC,UAAU;oBAC9D,OAAO,EAAE,EAAE,MAAM,EAAE,+BAA+B,EAAE;iBACrD,CAAC,CAAC;YACL,CAAC;YAED,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;YACrE,MAAM,cAAc,GAAG,cAAc,EAAE,cAAc,CAAC;YACtD,MAAM,YAAY,GAAG,IAAI,CAAC,kBAAkB,CAAC,sBAAsB,CAAC,WAAW,EAAE,cAAc,CAAC,CAAC;YACjG,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;gBACxB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,SAAS,EAAE;oBAClE,sBAAsB,EAAE,2BAA2B,CAAC,oCAAoC;oBACxF,OAAO,EAAE,EAAE,UAAU,EAAE,YAAY,CAAC,UAAU,EAAE,SAAS,EAAE,cAAc,EAAE,SAAS,EAAE,SAAS,EAAE,cAAc,EAAE,SAAS,EAAE;iBAC7H,CAAC,CAAC;YACL,CAAC;YAED,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,YAAY,CAAC,WAAW,EAAE,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;YACnI,MAAM,IAAI,CAAC,WAAW,CAAC,0BAA0B,CAAC,MAAM,CAAC,CAAC;YAC1D,MAAM,IAAI,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,EAAE,EAAE,MAAM,EAAE,eAAe,CAAC,CAAC;YAE9E,MAAM,IAAI,CAAC,gBAAgB,CAAC,sBAAsB,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC;QACnG,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,mBAAmB,CAAC,KAAK,CAAC;gBAAE,MAAM,KAAK,CAAC;YAC5C,MAAM,IAAI,CAAC,YAAY,CAAC,sBAAsB,CAAC,KAAK,EAAE,SAAS,EAAE;gBAC/D,OAAO,EAAE,EAAE,MAAM,EAAE,2BAA2B,EAAE;aACjD,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAEM,KAAK,CAAC,WAAW,CACtB,EAAyB,EACzB,MAAc,EACd,WAAmB,EACnB,SAAiB,EACjB,SAAiB;QAEjB,IAAI,CAAC;YAEH,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;YAEjF,IAAI,WAAW,EAAE,YAAY,EAAE,CAAC;gBAC9B,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,SAAS,EAAE;oBAClE,sBAAsB,EAAE,2BAA2B,CAAC,UAAU;oBAC9D,OAAO,EAAE,EAAE,MAAM,EAAE,yDAAyD,EAAE;iBAC/E,CAAC,CAAC;YACL,CAAC;YAED,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;YACrE,MAAM,cAAc,GAAG,cAAc,EAAE,cAAc,CAAC;YACtD,MAAM,YAAY,GAAG,IAAI,CAAC,kBAAkB,CAAC,sBAAsB,CAAC,WAAW,EAAE,cAAc,CAAC,CAAC;YACjG,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;gBACxB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,SAAS,EAAE;oBAClE,sBAAsB,EAAE,2BAA2B,CAAC,oCAAoC;oBACxF,OAAO,EAAE,EAAE,UAAU,EAAE,YAAY,CAAC,UAAU,EAAE,SAAS,EAAE,cAAc,EAAE,SAAS,EAAE,SAAS,EAAE,cAAc,EAAE,SAAS,EAAE;iBAC7H,CAAC,CAAC;YACL,CAAC;YAED,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,YAAY,CAAC,WAAW,EAAE,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;YACnI,MAAM,IAAI,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,EAAE,EAAE,MAAM,EAAE,eAAe,CAAC,CAAC;YAE9E,MAAM,IAAI,CAAC,gBAAgB,CAAC,kBAAkB,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC;QAC/F,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,mBAAmB,CAAC,KAAK,CAAC;gBAAE,MAAM,KAAK,CAAC;YAC5C,MAAM,IAAI,CAAC,YAAY,CAAC,sBAAsB,CAAC,KAAK,EAAE,SAAS,EAAE;gBAC/D,OAAO,EAAE,EAAE,MAAM,EAAE,wBAAwB,EAAE;aAC9C,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,6EAA6E;IAC7E,kBAAkB;IAClB,6EAA6E;IAEtE,KAAK,CAAC,WAAW,CACtB,EAAyB,EACzB,MAAc,EACd,WAA+B,EAC/B,SAAiB,EACjB,SAAiB;QAEjB,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,+BAA+B,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;YAEvD,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;YAErE,IAAI,cAAc,EAAE,gBAAgB,EAAE,6BAA6B,EAAE,CAAC;gBACpE,IAAI,CAAC,WAAW,EAAE,CAAC;oBACjB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;wBACtE,OAAO,EAAE,EAAE,MAAM,EAAE,+CAA+C,EAAE;qBACrE,CAAC,CAAC;gBACL,CAAC;gBACD,IAAI,CAAC;oBACH,MAAM,IAAI,CAAC,sBAAsB,CAAC,aAAa,CAAC,WAAW,EAAE,CAAC,wBAAwB,CAAC,MAAM,CAAC,CAAC,CAAC;oBAChG,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC;oBAC1E,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;wBAC5B,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;4BACrE,OAAO,EAAE,EAAE,MAAM,EAAE,sDAAsD,EAAE;yBAC5E,CAAC,CAAC;oBACL,CAAC;gBACH,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,IAAI,mBAAmB,CAAC,KAAK,CAAC;wBAAE,MAAM,KAAK,CAAC;oBAC5C,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;wBACtE,OAAO,EAAE,EAAE,MAAM,EAAE,4CAA4C,EAAE;qBAClE,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YAED,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;YAEjF,IAAI,CAAC,WAAW,EAAE,YAAY,EAAE,CAAC;gBAC/B,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,SAAS,EAAE;oBAClE,sBAAsB,EAAE,2BAA2B,CAAC,UAAU;oBAC9D,OAAO,EAAE,EAAE,MAAM,EAAE,qBAAqB,EAAE;iBAC3C,CAAC,CAAC;YACL,CAAC;YAED,MAAM,WAAW,GAAG,CAAC,CAAC,cAAc,EAAE,SAAS,EAAE,UAAU,CAAC;YAC5D,IAAI,WAAW,EAAE,CAAC;gBAChB,MAAM,WAAW,GACf,CAAC,WAAW,CAAC,kBAAkB,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC;oBACjD,WAAW,CAAC,mBAAmB,KAAK,IAAI,CAAC;gBAE3C,IAAI,CAAC,WAAW,EAAE,CAAC;oBACjB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,SAAS,EAAE;wBAClE,sBAAsB,EAAE,2BAA2B,CAAC,UAAU;wBAC9D,OAAO,EAAE,EAAE,MAAM,EAAE,2DAA2D,EAAE;qBACjF,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YAED,4EAA4E;YAC5E,4EAA4E;YAC5E,gFAAgF;YAChF,8EAA8E;YAC9E,+BAA+B;YAC/B,MAAM,IAAI,CAAC,mBAAmB,CAAC,cAAc,CAAC,gBAAgB,CAAC,gBAAgB,EAAE,EAAE,MAAM,EAAE,EAAE;gBAC3F,YAAY,EAAE,IAAI;gBAClB,YAAY,EAAE,KAAK;gBACnB,iBAAiB,EAAE,EAAE;gBACrB,cAAc,EAAE,IAAI;aACrB,CAAC,CAAC;YAEH,MAAM,IAAI,CAAC,gBAAgB,CAAC,mBAAmB,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC;QAChG,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,mBAAmB,CAAC,KAAK,CAAC;gBAAE,MAAM,KAAK,CAAC;YAC5C,MAAM,IAAI,CAAC,YAAY,CAAC,sBAAsB,CAAC,KAAK,EAAE,SAAS,EAAE;gBAC/D,OAAO,EAAE,EAAE,MAAM,EAAE,wBAAwB,EAAE;aAC9C,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,6EAA6E;IAC7E,uBAAuB;IACvB,6EAA6E;IAEtE,KAAK,CAAC,YAAY,CACvB,EAAyB,EACzB,MAAc;QAEd,IAAI,CAAC;YAEH,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;YAEjF,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAC3D,gBAAgB,CAAC,mBAAmB,EACpC,EAAE,EACF,EAAE,MAAM,EAAE,EACV,SAAS,EACT,EAAE,SAAS,EAAE,KAAK,EAAE,CACC,IAAI,EAAE,CAAC;YAE9B,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;YACrE,MAAM,kBAAkB,GAAG,cAAc,EAAE,kBAAkB,CAAC;YAE9D,MAAM,UAAU,GAA2G,EAAE,CAAC;YAE9H,MAAM,aAAa,GAAG,CAAC,MAAkB,EAAW,EAAE;gBACpD,IAAI,CAAC,kBAAkB;oBAAE,OAAO,IAAI,CAAC;gBACrC,OAAO,CAAC,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC;YACtC,CAAC,CAAC;YAEF,IAAI,aAAa,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACvC,UAAU,CAAC,IAAI,CAAC;oBACd,MAAM,EAAE,UAAU,CAAC,QAAQ;oBAC3B,QAAQ,EAAE,CAAC,CAAC,WAAW,EAAE,YAAY;iBACtC,CAAC,CAAC;YACL,CAAC;YAED,IAAI,aAAa,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;gBACnC,UAAU,CAAC,IAAI,CAAC;oBACd,MAAM,EAAE,UAAU,CAAC,IAAI;oBACvB,QAAQ,EAAE,WAAW,EAAE,YAAY,KAAK,IAAI;oBAC5C,UAAU,EAAE,WAAW,EAAE,cAAc,IAAI,SAAS;iBACrD,CAAC,CAAC;YACL,CAAC;YAED,IAAI,aAAa,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;gBACtC,UAAU,CAAC,IAAI,CAAC;oBACd,MAAM,EAAE,UAAU,CAAC,OAAO;oBAC1B,QAAQ,EAAE,CAAC,WAAW,EAAE,kBAAkB,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC;oBAC5D,OAAO,EAAE,EAAE,YAAY,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,IAAI,CAAC,EAAE;iBACxE,CAAC,CAAC;YACL,CAAC;YAED,IAAI,aAAa,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;gBACtC,UAAU,CAAC,IAAI,CAAC;oBACd,MAAM,EAAE,UAAU,CAAC,OAAO;oBAC1B,QAAQ,EAAE,WAAW,EAAE,mBAAmB,KAAK,IAAI;oBACnD,OAAO,EAAE,WAAW,EAAE,mBAAmB;wBACvC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,WAAY,CAAC,EAAE;wBAC3D,CAAC,CAAC,SAAS;iBACd,CAAC,CAAC;YACL,CAAC;YAED,IAAI,aAAa,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;gBACxC,UAAU,CAAC,IAAI,CAAC;oBACd,MAAM,EAAE,UAAU,CAAC,SAAS;oBAC5B,QAAQ,EAAE,IAAI;iBACf,CAAC,CAAC;YACL,CAAC;YAED,IAAI,aAAa,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;gBACzC,UAAU,CAAC,IAAI,CAAC;oBACd,MAAM,EAAE,UAAU,CAAC,UAAU;oBAC7B,QAAQ,EAAE,IAAI;iBACf,CAAC,CAAC;YACL,CAAC;YAED,IAAI,aAAa,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,CAAC;gBAC9C,MAAM,WAAW,GAAG,aAAa,CAAC,MAAM,CACtC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,cAAc,KAAK,iBAAiB,CAAC,MAAM,CAC3D,CAAC;gBACF,UAAU,CAAC,IAAI,CAAC;oBACd,MAAM,EAAE,UAAU,CAAC,eAAe;oBAClC,QAAQ,EAAE,WAAW,CAAC,MAAM,GAAG,CAAC;iBACjC,CAAC,CAAC;YACL,CAAC;YAED,IAAI,aAAa,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACvC,UAAU,CAAC,IAAI,CAAC;oBACd,MAAM,EAAE,UAAU,CAAC,QAAQ;oBAC3B,QAAQ,EAAE,aAAa,CAAC,IAAI,CAC1B,CAAC,IAAI,EAAE,EAAE,CACP,IAAI,CAAC,cAAc,KAAK,iBAAiB,CAAC,UAAU;2BACjD,IAAI,CAAC,MAAM,KAAK,sBAAsB,CAAC,IAAI,CACjD;iBACF,CAAC,CAAC;YACL,CAAC;YAED,IAAI,aAAa,CAAC,UAAU,CAAC,kBAAkB,CAAC,EAAE,CAAC;gBACjD,UAAU,CAAC,IAAI,CAAC;oBACd,MAAM,EAAE,UAAU,CAAC,kBAAkB;oBACrC,QAAQ,EAAE,aAAa,CAAC,IAAI,CAC1B,CAAC,IAAI,EAAE,EAAE,CACP,IAAI,CAAC,cAAc,KAAK,iBAAiB,CAAC,UAAU;2BACjD,IAAI,CAAC,MAAM,KAAK,sBAAsB,CAAC,IAAI,CACjD;iBACF,CAAC,CAAC;YACL,CAAC;YAED,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC;QACjC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,mBAAmB,CAAC,KAAK,CAAC;gBAAE,MAAM,KAAK,CAAC;YAC5C,MAAM,IAAI,CAAC,YAAY,CAAC,sBAAsB,CAAC,KAAK,EAAE,SAAS,EAAE;gBAC/D,OAAO,EAAE,EAAE,MAAM,EAAE,4BAA4B,EAAE;aAClD,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,6EAA6E;IAC7E,iBAAiB;IACjB,6EAA6E;IAEtE,KAAK,CAAC,gBAAgB,CAC3B,EAAyB,EACzB,MAAc;QAEd,IAAI,CAAC;YAEH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,IAAI,CACtD,gBAAgB,CAAC,mBAAmB,EACpC,EAAE,EACF,EAAE,MAAM,EAAE,EACV,SAAS,EACT,EAAE,SAAS,EAAE,KAAK,EAAE,CACC,CAAC;YAExB,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;gBACpC,GAAG,EAAE,IAAI,CAAC,GAAG;gBACb,cAAc,EAAE,IAAI,CAAC,cAAc;gBACnC,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,aAAa,EAAE,IAAI,CAAC,aAAa;gBACjC,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,UAAU,EAAE,IAAI,CAAC,UAAU;aAC5B,CAAC,CAAC,CAAC;YAEJ,OAAO,EAAE,KAAK,EAAE,CAAC;QACnB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,mBAAmB,CAAC,KAAK,CAAC;gBAAE,MAAM,KAAK,CAAC;YAC5C,MAAM,IAAI,CAAC,YAAY,CAAC,sBAAsB,CAAC,KAAK,EAAE,SAAS,EAAE;gBAC/D,OAAO,EAAE,EAAE,MAAM,EAAE,8BAA8B,EAAE;aACpD,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAEM,KAAK,CAAC,kBAAkB,CAC7B,EAAyB,EACzB,MAAc,EACd,MAAc,EACd,SAAiB,EACjB,SAAiB;QAEjB,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,+BAA+B,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;YAEvD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAClD,gBAAgB,CAAC,mBAAmB,EACpC,EAAE,EACF,EAAE,GAAG,EAAE,MAAM,EAAE,CAChB,CAAC;YAEF,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,SAAS,EAAE,SAAS,EAAE;oBACjE,OAAO,EAAE,EAAE,MAAM,EAAE,yBAAyB,EAAE;iBAC/C,CAAC,CAAC;YACL,CAAC;YAED,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBAC3B,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,SAAS,EAAE,SAAS,EAAE;oBACjE,OAAO,EAAE,EAAE,MAAM,EAAE,yBAAyB,EAAE;iBAC/C,CAAC,CAAC;YACL,CAAC;YAED,MAAM,gBAAgB,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;YACjE,IAAI,gBAAgB,CAAC,KAAK,IAAI,CAAC,EAAE,CAAC;gBAChC,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,SAAS,EAAE;oBAClE,sBAAsB,EAAE,2BAA2B,CAAC,UAAU;oBAC9D,OAAO,EAAE,EAAE,MAAM,EAAE,+CAA+C,EAAE;iBACrE,CAAC,CAAC;YACL,CAAC;YAED,MAAM,IAAI,CAAC,uBAAuB,CAAC,MAAM,CAAC,gBAAgB,CAAC,mBAAmB,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;YAE5F,MAAM,IAAI,CAAC,gBAAgB,CAAC,0BAA0B,CAAC;gBACrD,MAAM,EAAE,MAAM;gBACd,MAAM;gBACN,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,SAAS;gBACT,SAAS;aACV,EAAE,EAAE,CAAC,CAAC;QACT,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,mBAAmB,CAAC,KAAK,CAAC;gBAAE,MAAM,KAAK,CAAC;YAC5C,MAAM,IAAI,CAAC,YAAY,CAAC,sBAAsB,CAAC,KAAK,EAAE,SAAS,EAAE;gBAC/D,OAAO,EAAE,EAAE,MAAM,EAAE,gCAAgC,EAAE;aACtD,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,6EAA6E;IAC7E,oBAAoB;IACpB,6EAA6E;IAE7E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAuCG;IACI,KAAK,CAAC,cAAc,CACzB,EAAyB,EACzB,MAAc,EACd,MAAkB,EAClB,QAAiB,EACjB,eAAyB,EACzB,SAAkB,EAClB,SAAkB;IAClB;;;OAGG;IACH,QAAiB;QAEjB,IAAI,CAAC;YAEH,IAAI,MAAM,KAAK,UAAU,CAAC,IAAI,EAAE,CAAC;gBAC/B,IAAI,CAAC,QAAQ,EAAE,CAAC;oBACd,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,SAAS,EAAE;wBAClE,OAAO,EAAE,EAAE,MAAM,EAAE,+CAA+C,EAAE;qBACrE,CAAC,CAAC;gBACL,CAAC;gBAED,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,0BAA0B,CAAC,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;gBAEhG,IAAI,YAAY,CAAC,WAAW,EAAE,CAAC;oBAC7B,wFAAwF;oBACxF,4EAA4E;oBAC5E,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;wBACtE,OAAO,EAAE,EAAE,MAAM,EAAE,4CAA4C,EAAE;qBAClE,CAAC,CAAC;gBACL,CAAC;gBAED,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;oBACxB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;wBACtE,OAAO,EAAE,EAAE,MAAM,EAAE,cAAc,EAAE;qBACpC,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;iBAAM,IAAI,MAAM,KAAK,UAAU,CAAC,QAAQ,EAAE,CAAC;gBAC1C,IAAI,CAAC,QAAQ,EAAE,CAAC;oBACd,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,SAAS,EAAE;wBAClE,OAAO,EAAE,EAAE,MAAM,EAAE,qDAAqD,EAAE;qBAC3E,CAAC,CAAC;gBACL,CAAC;gBAED,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;gBAEjF,IAAI,CAAC,WAAW,EAAE,YAAY,EAAE,CAAC;oBAC/B,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;wBACtE,OAAO,EAAE,EAAE,MAAM,EAAE,kCAAkC,EAAE;qBACxD,CAAC,CAAC;gBACL,CAAC;gBAED,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,cAAc,CAC1D,WAAW,CAAC,YAAY,EAAE,QAAQ,CACnC,CAAC;gBACF,IAAI,CAAC,OAAO,EAAE,CAAC;oBACb,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;wBACtE,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;qBACxC,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;iBAAM,IAAI,MAAM,KAAK,UAAU,CAAC,OAAO,EAAE,CAAC;gBACzC,IAAI,CAAC,eAAe,EAAE,CAAC;oBACrB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,SAAS,EAAE;wBAClE,OAAO,EAAE,EAAE,MAAM,EAAE,+DAA+D,EAAE;qBACrF,CAAC,CAAC;gBACL,CAAC;gBAED,6FAA6F;gBAC7F,4FAA4F;gBAC5F,oDAAoD;gBACpD,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,4BAA4B,CAC1E,EAAE,EACF,MAAM,EACN,eAA6C,EAC7C,6BAA6B,CAAC,OAAO,CACtC,CAAC;gBAEF,IAAI,CAAC,QAAQ,EAAE,CAAC;oBACd,oFAAoF;oBACpF,yFAAyF;oBACzF,0FAA0F;oBAC1F,sBAAsB;oBACtB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;wBACtE,OAAO,EAAE,EAAE,MAAM,EAAE,kCAAkC,EAAE;qBACxD,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,SAAS,EAAE;oBAClE,OAAO,EAAE,EAAE,MAAM,EAAE,yCAAyC,MAAM,EAAE,EAAE;iBACvE,CAAC,CAAC;YACL,CAAC;YAED,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,WAAW,CAAC;gBAC1D,SAAS,EAAE,wBAAwB,CAAC,MAAM;gBAC1C,eAAe,EAAE,+BAA+B,CAAC,UAAU;gBAC3D,SAAS,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,YAAY,CAAC,OAAO,EAAE;gBACnD,MAAM,EAAE,MAAM;gBACd,kBAAkB,EAAE,gBAAgB,CAAC,KAAK;gBAC1C,SAAS,EAAE,MAAM;aAClB,CAAC,CAAC;YAEH,OAAO,EAAE,WAAW,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC;QACtC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,mBAAmB,CAAC,KAAK,CAAC;gBAAE,MAAM,KAAK,CAAC;YAC5C,MAAM,IAAI,CAAC,YAAY,CAAC,sBAAsB,CAAC,KAAK,EAAE,SAAS,EAAE;gBAC/D,OAAO,EAAE,EAAE,MAAM,EAAE,2BAA2B,EAAE;aACjD,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,6EAA6E;IAC7E,yCAAyC;IACzC,6EAA6E;IAEtE,KAAK,CAAC,gBAAgB,CAC3B,EAAyB,EACzB,MAAc;QAEd,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QAEjF,MAAM,aAAa,GAAG,WAAW,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACxD,MAAM,YAAY,GAAG,WAAW,EAAE,kBAAkB,EAAE,MAAM,IAAI,CAAC,CAAC;QAElE,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAC3D,gBAAgB,CAAC,mBAAmB,EACpC,EAAE,EACF,EAAE,MAAM,EAAE,EACV,SAAS,EACT,EAAE,SAAS,EAAE,KAAK,EAAE,CACC,CAAC;QACxB,MAAM,iBAAiB,GAAG,aAAa,CAAC,MAAM,CAAC;QAE/C,OAAO;YACL,aAAa;YACb,YAAY;YACZ,iBAAiB;YACjB,KAAK,EAAE,aAAa,GAAG,YAAY,GAAG,iBAAiB;SACxD,CAAC;IACJ,CAAC;CACF,CAAA;AA5nBY,kCAAkC;IAD9C,UAAU,EAAE;IAKR,WAAA,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAA;IACjC,WAAA,MAAM,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,CAAA;IAC9C,WAAA,MAAM,CAAC,kBAAkB,CAAC,8BAA8B,CAAC,CAAA;IACzD,WAAA,MAAM,CAAC,kBAAkB,CAAC,sBAAsB,CAAC,CAAA;IACjD,WAAA,MAAM,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,CAAA;IAC3C,WAAA,MAAM,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,CAAA;IAC3C,WAAA,MAAM,CAAC,kBAAkB,CAAC,sBAAsB,CAAC,CAAA;IACjD,WAAA,MAAM,CAAC,kBAAkB,CAAC,eAAe,CAAC,CAAA;IAC1C,WAAA,MAAM,CAAC,kBAAkB,CAAC,qBAAqB,CAAC,CAAA;IAMhD,WAAA,MAAM,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,CAAA;IAI9C,YAAA,MAAM,CAAC,kBAAkB,CAAC,cAAc,CAAC,CAAA;IAEzC,YAAA,MAAM,CAAC,kBAAkB,CAAC,eAAe,CAAC,CAAA;qCApBiB,aAAa;QACM,0BAA0B,YAEjB,oCAAoC;QAC5C,uBAAuB;QACvB,uBAAuB;QACX,6BAA6B;QAC/C,6BAA6B;QACxB,4BAA4B,YAU/B,qBAAqB;QAEnB,sBAAsB;GAxB3F,kCAAkC,CA4nB9C","sourcesContent":["import 'reflect-metadata';\nimport { inject, injectable } from 'inversify';\nimport { SAAS_SERVICE_TYPES } from '~wildo-backend-lib/inject/models/service-types';\nimport { ErrorBuilderBackendService } from '~wildo-backend-lib/errors/services/error-builder.backend.service';\nimport type { ServicesRegistryHandlerBackendService } from '~wildo-backend-lib/base-classes/services/services/services-registry-handler.backend.service';\nimport type { SystemAccessBackendService } from '~wildo-backend-lib/base-classes/services/services/system-access.backend.service';\nimport { AuthCredentialVerifierBackendService } from '~wildo-backend-lib/security/authentications/services/auth-credential-verifier.backend.service';\nimport { AppConfigurationService } from '~wildo-backend-lib/config/services/app-configuration.backend.service';\nimport { AuditLogsBackendService } from '~wildo-backend-lib/compliance/audit-trails/services/audit-logs.backend.service';\nimport { ConsumableTokenBackendService } from '~wildo-backend-lib/security/consumable-tokens/services/consumable-token.backend.service';\nimport { AuthTokenIssuerBackendService } from '~wildo-backend-lib/security/authentications/services/auth-token-issuer.backend.service';\nimport { AuthUserLookupBackendService } from '~wildo-backend-lib/security/authentications/services/utils/auth-user-lookup.backend.service';\nimport { LoggerService } from '~wildo-backend-lib/monitoring/logger/services/logger.service';\nimport {\n CoreResourceType,\n ErrorType,\n ErrorCustomMessageReference,\n isWildoBackendError,\n AuthMethod,\n CoreConsumableTokenTypes,\n ConsumableToken_ConsumptionMode,\n ExternalIdentitySource,\n SsoConnectionType,\n} from '@wildo-ai/saas-models';\nimport type {\n UserIdentityLink,\n UserTypeAuthPolicy,\n} from '@wildo-ai/saas-models';\nimport { DurationUnit } from '@wildo-ai/zod-decorators';\nimport { AuthMfaBackendService } from '~wildo-backend-lib/security/authentications/services/auth-methods/auth-mfa.backend.service';\nimport { PasskeyAuthenticationCeremony, WebAuthnBackendService } from '~wildo-backend-lib/security/authentications/services/auth-methods/webauthn.backend.service';\nimport type { AuthenticationResponseJSON } from '@simplewebauthn/server';\nimport type { ExecutionContext } from '~wildo-backend-lib/runtime/models/execution-context.backend.schemas';\n\ninterface IdentityLinkSummary {\n _id: string;\n connectionType: SsoConnectionType;\n source: ExternalIdentitySource;\n providerRef: string;\n providerEmail: string;\n linkedAt: Date;\n lastUsedAt: Date;\n}\n\n@injectable()\nexport class AuthMethodManagementBackendService {\n private readonly logDebug: (message: string, context?: Record<string, unknown>) => void;\n\n constructor(\n @inject(SAAS_SERVICE_TYPES.Logger) private readonly logger: LoggerService,\n @inject(SAAS_SERVICE_TYPES.ErrorBuilderService) private readonly errorBuilder: ErrorBuilderBackendService,\n @inject(SAAS_SERVICE_TYPES.ServicesRegistryHandlerService) private readonly servicesRegistryHandler: ServicesRegistryHandlerBackendService,\n @inject(SAAS_SERVICE_TYPES.AuthCredentialVerifier) private readonly credentialVerifier: AuthCredentialVerifierBackendService,\n @inject(SAAS_SERVICE_TYPES.AppConfigService) private readonly appConfigService: AppConfigurationService,\n @inject(SAAS_SERVICE_TYPES.AuditLogsService) private readonly auditLogsService: AuditLogsBackendService,\n @inject(SAAS_SERVICE_TYPES.ConsumableTokenService) private readonly consumableTokenService: ConsumableTokenBackendService,\n @inject(SAAS_SERVICE_TYPES.AuthTokenIssuer) private readonly tokenIssuer: AuthTokenIssuerBackendService,\n @inject(SAAS_SERVICE_TYPES.AuthUserLookupService) private readonly userLookup: AuthUserLookupBackendService,\n // TOTP-disable clears `secretBase32` + `backupCodesHashed` (both `.isBackendOnly()`),\n // which a plain handler update strips → the secret and backup codes would silently\n // survive a \"disable\". `updateAsSystem` re-attaches the cleared values after the\n // strict parse, fail-closed behind USER_CREDENTIALS' `systemAccessPolicy.update`.\n // Appended LAST to keep the positional test construction stable.\n @inject(SAAS_SERVICE_TYPES.SystemAccessService) private readonly systemAccessService: SystemAccessBackendService,\n // Appended LAST for the same reason as the parameter above — keeps positional test\n // construction stable. Supplies the enrolled-second-factor authority `reAuthenticate` uses for\n // `AuthMethod.TOTP`, shared with the login second-factor step.\n @inject(SAAS_SERVICE_TYPES.AuthMfaService) private readonly authMfaService: AuthMfaBackendService,\n // Appended LAST, same reason as the two above. Supplies the STEP_UP passkey ceremony.\n @inject(SAAS_SERVICE_TYPES.WebAuthnService) private readonly webAuthnService: WebAuthnBackendService,\n ) {\n this.logDebug = this.logger.debugByType('AuthMethodManagementBackendService');\n this.logger.setDebugTypeLogging('AuthMethodManagementBackendService', true);\n }\n\n // ==========================================================================\n // INTERNAL HELPERS\n // ==========================================================================\n\n private maskPhone(phone: string): string {\n if (!phone \|\| phone.length < 4) return '**';\n return `${phone.slice(-4)}`;\n }\n\n /\n W6.8 + AUTH-14: Resolve effective auth policy for a user, including org override merging.\n * Falls back to null if the user or user type is not found.\n /\n private async _resolveUserTypePolicy(ec: ExecutionContext<any>, userId: string): Promise<UserTypeAuthPolicy \| null> {\n try {\n const user = await this.servicesRegistryHandler.read<{ userTypes?: string[] }>(CoreResourceType.USERS, ec, { _id: userId });\n if (user?.userTypes?.length) {\n return this.userLookup.resolveEffectiveAuthPolicy(ec, userId, user.userTypes[0]);\n }\n } catch {\n // Suppress — non-fatal, will use defaults\n }\n return null;\n }\n\n public async enforceUserMethodRemovalAllowed(ec: ExecutionContext<any>, userId: string): Promise<void> {\n const policy = await this._resolveUserTypePolicy(ec, userId);\n const methodManagement = policy?.methodManagement;\n if (methodManagement && !methodManagement.allowUserMethodRemoval) {\n throw this.errorBuilder.buildError(ErrorType.AUTHORIZATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHORIZATION,\n context: { reason: 'User-initiated auth method removal is disabled by policy' },\n });\n }\n }\n\n // ==========================================================================\n // PASSWORD MANAGEMENT\n // ==========================================================================\n\n public async changePassword(\n ec: ExecutionContext<any>,\n userId: string,\n currentPassword: string,\n newPassword: string,\n ipAddress: string,\n userAgent: string,\n ): Promise<void> {\n try {\n\n const credentials = await this.credentialVerifier.resolveCredentials(ec, userId);\n\n if (!credentials \|\| !credentials.passwordHash) {\n throw this.errorBuilder.buildError(ErrorType.VALIDATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.VALIDATION,\n context: { reason: 'No password set. Use /auth/password/set instead' },\n });\n }\n\n const isCurrentValid = await this.credentialVerifier.verifyPassword(\n credentials.passwordHash, currentPassword,\n );\n if (!isCurrentValid) {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.VALIDATION,\n context: { reason: 'Current password is incorrect' },\n });\n }\n\n const userTypePolicy = await this._resolveUserTypePolicy(ec, userId);\n const passwordPolicy = userTypePolicy?.passwordPolicy;\n const policyResult = this.credentialVerifier.validatePasswordPolicy(newPassword, passwordPolicy);\n if (!policyResult.valid) {\n throw this.errorBuilder.buildError(ErrorType.VALIDATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.VALIDATION_PASSWORD_POLICY_VIOLATION,\n context: { violations: policyResult.violations, minLength: passwordPolicy?.minLength, maxLength: passwordPolicy?.maxLength },\n });\n }\n\n const newPasswordHash = await this.credentialVerifier.hashPassword(newPassword, this.appConfigService.config.auth.passwordHashing);\n await this.tokenIssuer.invalidateAllTokensForUser(userId);\n await this.credentialVerifier.updatePasswordHash(ec, userId, newPasswordHash);\n\n await this.auditLogsService.logUserPasswordChanged({ userId: userId, ipAddress, userAgent }, ec);\n } catch (error) {\n if (isWildoBackendError(error)) throw error;\n throw this.errorBuilder.buildFromStandardError(error, undefined, {\n context: { reason: 'Failed to change password' },\n });\n }\n }\n\n public async setPassword(\n ec: ExecutionContext<any>,\n userId: string,\n newPassword: string,\n ipAddress: string,\n userAgent: string,\n ): Promise<void> {\n try {\n\n const credentials = await this.credentialVerifier.resolveCredentials(ec, userId);\n\n if (credentials?.passwordHash) {\n throw this.errorBuilder.buildError(ErrorType.VALIDATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.VALIDATION,\n context: { reason: 'Password already set. Use /auth/password/change instead' },\n });\n }\n\n const userTypePolicy = await this._resolveUserTypePolicy(ec, userId);\n const passwordPolicy = userTypePolicy?.passwordPolicy;\n const policyResult = this.credentialVerifier.validatePasswordPolicy(newPassword, passwordPolicy);\n if (!policyResult.valid) {\n throw this.errorBuilder.buildError(ErrorType.VALIDATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.VALIDATION_PASSWORD_POLICY_VIOLATION,\n context: { violations: policyResult.violations, minLength: passwordPolicy?.minLength, maxLength: passwordPolicy?.maxLength },\n });\n }\n\n const newPasswordHash = await this.credentialVerifier.hashPassword(newPassword, this.appConfigService.config.auth.passwordHashing);\n await this.credentialVerifier.updatePasswordHash(ec, userId, newPasswordHash);\n\n await this.auditLogsService.logUserPasswordSet({ userId: userId, ipAddress, userAgent }, ec);\n } catch (error) {\n if (isWildoBackendError(error)) throw error;\n throw this.errorBuilder.buildFromStandardError(error, undefined, {\n context: { reason: 'Failed to set password' },\n });\n }\n }\n\n // ==========================================================================\n // TOTP MANAGEMENT\n // ==========================================================================\n\n public async disableTotp(\n ec: ExecutionContext<any>,\n userId: string,\n reAuthToken: string \| undefined,\n ipAddress: string,\n userAgent: string,\n ): Promise<void> {\n try {\n await this.enforceUserMethodRemovalAllowed(ec, userId);\n\n const userTypePolicy = await this._resolveUserTypePolicy(ec, userId);\n\n if (userTypePolicy?.methodManagement?.requireReauthForMethodChanges) {\n if (!reAuthToken) {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n context: { reason: 'Re-authentication is required for this action' },\n });\n }\n try {\n await this.consumableTokenService.validateToken(reAuthToken, [CoreConsumableTokenTypes.REAUTH]);\n const token = await this.consumableTokenService.consumeToken(reAuthToken);\n if (token.userId !== userId) {\n throw this.errorBuilder.buildError(ErrorType.AUTHORIZATION, undefined, {\n context: { reason: 'Re-authentication token does not belong to this user' },\n });\n }\n } catch (error) {\n if (isWildoBackendError(error)) throw error;\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n context: { reason: 'Invalid or expired re-authentication token' },\n });\n }\n }\n\n const credentials = await this.credentialVerifier.resolveCredentials(ec, userId);\n\n if (!credentials?.totpVerified) {\n throw this.errorBuilder.buildError(ErrorType.VALIDATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.VALIDATION,\n context: { reason: 'TOTP is not enabled' },\n });\n }\n\n const mfaRequired = !!userTypePolicy?.mfaPolicy?.requireMFA;\n if (mfaRequired) {\n const hasOtherMFA =\n (credentials.passkeyCredentials?.length ?? 0) > 0 \|\|\n credentials.phoneNumberVerified === true;\n\n if (!hasOtherMFA) {\n throw this.errorBuilder.buildError(ErrorType.VALIDATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.VALIDATION,\n context: { reason: 'Cannot disable your only MFA method while MFA is required' },\n });\n }\n }\n\n // Trusted system write: clearing `secretBase32` + `backupCodesHashed` (both\n // backendOnly) must survive the strict parse, otherwise the TOTP secret and\n // backup codes silently persist after a \"disable\". `updateAsSystem` re-attaches\n // the cleared values; `totpVerified`/`totpVerifiedAt` are plain fields parsed\n // normally, exactly as before.\n await this.systemAccessService.updateAsSystem(CoreResourceType.USER_CREDENTIALS, { userId }, {\n secretBase32: null,\n totpVerified: false,\n backupCodesHashed: [],\n totpVerifiedAt: null,\n });\n\n await this.auditLogsService.logUserTOTPDisabled({ userId: userId, ipAddress, userAgent }, ec);\n } catch (error) {\n if (isWildoBackendError(error)) throw error;\n throw this.errorBuilder.buildFromStandardError(error, undefined, {\n context: { reason: 'Failed to disable TOTP' },\n });\n }\n }\n\n // ==========================================================================\n // METHOD INTROSPECTION\n // ==========================================================================\n\n public async getMyMethods(\n ec: ExecutionContext<any>,\n userId: string,\n ): Promise<{ methods: Array<{ method: AuthMethod; enrolled: boolean; enrolledAt?: Date; details?: Record<string, unknown> }> }> {\n try {\n\n const credentials = await this.credentialVerifier.resolveCredentials(ec, userId);\n\n const identityLinks = await this.servicesRegistryHandler.list<UserIdentityLink>(\n CoreResourceType.USER_IDENTITY_LINKS,\n ec,\n { userId },\n undefined,\n { paginated: false },\n ) as UserIdentityLink[] ?? [];\n\n const userTypePolicy = await this._resolveUserTypePolicy(ec, userId);\n const authMethodsEnabled = userTypePolicy?.authMethodsEnabled;\n\n const allMethods: Array<{ method: AuthMethod; enrolled: boolean; enrolledAt?: Date; details?: Record<string, unknown> }> = [];\n\n const shouldInclude = (method: AuthMethod): boolean => {\n if (!authMethodsEnabled) return true;\n return !!authMethodsEnabled[method];\n };\n\n if (shouldInclude(AuthMethod.PASSWORD)) {\n allMethods.push({\n method: AuthMethod.PASSWORD,\n enrolled: !!credentials?.passwordHash,\n });\n }\n\n if (shouldInclude(AuthMethod.TOTP)) {\n allMethods.push({\n method: AuthMethod.TOTP,\n enrolled: credentials?.totpVerified === true,\n enrolledAt: credentials?.totpVerifiedAt ?? undefined,\n });\n }\n\n if (shouldInclude(AuthMethod.PASSKEY)) {\n allMethods.push({\n method: AuthMethod.PASSKEY,\n enrolled: (credentials?.passkeyCredentials?.length ?? 0) > 0,\n details: { passkeyCount: credentials?.passkeyCredentials?.length ?? 0 },\n });\n }\n\n if (shouldInclude(AuthMethod.SMS_OTP)) {\n allMethods.push({\n method: AuthMethod.SMS_OTP,\n enrolled: credentials?.phoneNumberVerified === true,\n details: credentials?.phoneNumberVerified\n ? { phoneNumber: this.maskPhone(credentials.phoneNumber!) }\n : undefined,\n });\n }\n\n if (shouldInclude(AuthMethod.EMAIL_OTP)) {\n allMethods.push({\n method: AuthMethod.EMAIL_OTP,\n enrolled: true,\n });\n }\n\n if (shouldInclude(AuthMethod.MAGIC_LINK)) {\n allMethods.push({\n method: AuthMethod.MAGIC_LINK,\n enrolled: true,\n });\n }\n\n if (shouldInclude(AuthMethod.EXTERNAL_OAUTH2)) {\n const socialLinks = identityLinks.filter(\n (link) => link.connectionType === SsoConnectionType.SOCIAL,\n );\n allMethods.push({\n method: AuthMethod.EXTERNAL_OAUTH2,\n enrolled: socialLinks.length > 0,\n });\n }\n\n if (shouldInclude(AuthMethod.ORG_SAML)) {\n allMethods.push({\n method: AuthMethod.ORG_SAML,\n enrolled: identityLinks.some(\n (link) =>\n link.connectionType === SsoConnectionType.ENTERPRISE\n && link.source === ExternalIdentitySource.SAML,\n ),\n });\n }\n\n if (shouldInclude(AuthMethod.ORG_OPENID_CONNECT)) {\n allMethods.push({\n method: AuthMethod.ORG_OPENID_CONNECT,\n enrolled: identityLinks.some(\n (link) =>\n link.connectionType === SsoConnectionType.ENTERPRISE\n && link.source === ExternalIdentitySource.OIDC,\n ),\n });\n }\n\n return { methods: allMethods };\n } catch (error) {\n if (isWildoBackendError(error)) throw error;\n throw this.errorBuilder.buildFromStandardError(error, undefined, {\n context: { reason: 'Failed to get auth methods' },\n });\n }\n }\n\n // ==========================================================================\n // IDENTITY LINKS\n // ==========================================================================\n\n public async getIdentityLinks(\n ec: ExecutionContext<any>,\n userId: string,\n ): Promise<{ links: IdentityLinkSummary[] }> {\n try {\n\n const rawLinks = await this.servicesRegistryHandler.list<UserIdentityLink>(\n CoreResourceType.USER_IDENTITY_LINKS,\n ec,\n { userId },\n undefined,\n { paginated: false },\n ) as UserIdentityLink[];\n\n const links = rawLinks.map((link) => ({\n _id: link._id,\n connectionType: link.connectionType,\n source: link.source,\n providerRef: link.providerRef,\n providerEmail: link.providerEmail,\n linkedAt: link.linkedAt,\n lastUsedAt: link.lastUsedAt,\n }));\n\n return { links };\n } catch (error) {\n if (isWildoBackendError(error)) throw error;\n throw this.errorBuilder.buildFromStandardError(error, undefined, {\n context: { reason: 'Failed to get identity links' },\n });\n }\n }\n\n public async unlinkIdentityLink(\n ec: ExecutionContext<any>,\n userId: string,\n linkId: string,\n ipAddress: string,\n userAgent: string,\n ): Promise<void> {\n try {\n await this.enforceUserMethodRemovalAllowed(ec, userId);\n\n const link = await this.servicesRegistryHandler.read<UserIdentityLink>(\n CoreResourceType.USER_IDENTITY_LINKS,\n ec,\n { _id: linkId },\n );\n\n if (!link) {\n throw this.errorBuilder.buildError(ErrorType.NOT_FOUND, undefined, {\n context: { reason: 'Identity link not found' },\n });\n }\n\n if (link.userId !== userId) {\n throw this.errorBuilder.buildError(ErrorType.NOT_FOUND, undefined, {\n context: { reason: 'Identity link not found' },\n });\n }\n\n const authMethodCounts = await this.countAuthMethods(ec, userId);\n if (authMethodCounts.total <= 1) {\n throw this.errorBuilder.buildError(ErrorType.VALIDATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.VALIDATION,\n context: { reason: 'Cannot remove your only authentication method' },\n });\n }\n\n await this.servicesRegistryHandler.delete(CoreResourceType.USER_IDENTITY_LINKS, ec, linkId);\n\n await this.auditLogsService.logUserIdentityLinkRemoved({\n userId: userId,\n linkId,\n providerRef: link.providerRef,\n ipAddress,\n userAgent,\n }, ec);\n } catch (error) {\n if (isWildoBackendError(error)) throw error;\n throw this.errorBuilder.buildFromStandardError(error, undefined, {\n context: { reason: 'Failed to unlink identity link' },\n });\n }\n }\n\n // ==========================================================================\n // RE-AUTHENTICATION\n // ==========================================================================\n\n /\n Prove the caller is still themselves, and mint a single-use `REAUTH` token on success.\n \n # Which factors are accepted, and why TOTP had to be one of them\n \n `requiresStepUpAuthentication` operations are cleared ONLY by the token this method mints, so\n * the factor list here decides who can perform them at all. While it was PASSWORD-only, two\n * populations were structurally locked out of every gated verb:\n \n - user types whose `authMethodsEnabled` excludes `PASSWORD` (SSO-only, passkey-only) — also\n * reachable through a per-ORGANIZATION `authMethodsEnabled` override;\n * - directory-managed (SCIM) users, whose `passwordHash` AND passkeys the framework\n * deliberately destroys so a local first factor cannot survive IdP deprovisioning\n * (`_reconcileLocalCredentialsForDirectoryManaged`).\n \n That second group is not an edge case: once tenant teardown split into `request_deletion` +\n * purge, an ORG_ADMIN of a directory-managed tenant could not start even the NORMAL teardown.\n * TOTP is the right remedy precisely because the same reconciliation leaves it INTACT — it is a\n * second factor sitting on top of the IdP first factor, so it survives deprovisioning by design.\n \n `TOTP` here means \"an enrolled second factor\": a TOTP code or one of the principal's backup\n * codes, verified through the single shared authority\n * ({@link AuthMfaBackendService.verifyEnrolledSecondFactor}) that login uses — including its\n * anti-replay. The anti-replay is load-bearing for step-up specifically: without it a code\n * observed during login would still be valid moments later, and step-up would authorize a\n * destructive operation on a credential the caller never freshly proved.\n \n `PASSKEY` is SUPPORTED, through a dedicated two-legged ceremony rather than the one call\n * password and TOTP take: `POST /auth/reauth/passkey/options` then `POST /auth/reauth` with the\n * assertion, because WebAuthn is challenge-response. It is a re-proof rather than a possession\n * check — the branch below verifies under `PasskeyAuthenticationCeremony.STEP_UP`, which reads a\n * SEPARATE challenge (so an assertion minted for a login cannot be redeemed here) and demands\n * user verification even where the app policy is `preferred`.\n \n Any other `AuthMethod` is refused explicitly by the trailing `else`, rather than silently\n * unsupported.\n \n assurance-control: WILDO.IDENTITY.STEP_UP_AUTHENTICATION — re-proof of identity before a\n * high-impact action, over any factor the principal actually holds.\n /\n public async reAuthenticate(\n ec: ExecutionContext<any>,\n userId: string,\n method: AuthMethod,\n password?: string,\n passkeyResponse?: unknown,\n ipAddress?: string,\n userAgent?: string,\n /\n The enrolled-second-factor code for `method === TOTP` (a TOTP code or a backup code).\n * Appended LAST so every existing positional caller keeps its meaning.\n */\n totpCode?: string,\n ): Promise<{ reAuthToken: string }> {\n try {\n\n if (method === AuthMethod.TOTP) {\n if (!totpCode) {\n throw this.errorBuilder.buildError(ErrorType.VALIDATION, undefined, {\n context: { reason: 'A code is required for TOTP re-authentication' },\n });\n }\n\n const verification = await this.authMfaService.verifyEnrolledSecondFactor(ec, userId, totpCode);\n\n if (verification.notEnrolled) {\n // Distinct from a wrong code on purpose: this account has NO enrolled second factor, so\n // retrying cannot help. The caller needs a different factor, or enrollment.\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n context: { reason: 'No enrolled second factor for this account' },\n });\n }\n\n if (!verification.valid) {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n context: { reason: 'Invalid code' },\n });\n }\n } else if (method === AuthMethod.PASSWORD) {\n if (!password) {\n throw this.errorBuilder.buildError(ErrorType.VALIDATION, undefined, {\n context: { reason: 'Password is required for password re-authentication' },\n });\n }\n\n const credentials = await this.credentialVerifier.resolveCredentials(ec, userId);\n\n if (!credentials?.passwordHash) {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n context: { reason: 'No password set for this account' },\n });\n }\n\n const isValid = await this.credentialVerifier.verifyPassword(\n credentials.passwordHash, password,\n );\n if (!isValid) {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n context: { reason: 'Invalid password' },\n });\n }\n } else if (method === AuthMethod.PASSKEY) {\n if (!passkeyResponse) {\n throw this.errorBuilder.buildError(ErrorType.VALIDATION, undefined, {\n context: { reason: 'A passkey assertion is required for passkey re-authentication' },\n });\n }\n\n // STEP_UP ceremony, NOT login: it reads a separate challenge (so an assertion produced for a\n // login cannot be redeemed here) and demands user verification even where the app policy is\n // `preferred`. See `PasskeyAuthenticationCeremony`.\n const { verified } = await this.webAuthnService.verifyAuthenticationResponse(\n ec,\n userId,\n passkeyResponse as AuthenticationResponseJSON,\n PasskeyAuthenticationCeremony.STEP_UP,\n );\n\n if (!verified) {\n // Deliberately ONE refusal for every failure mode below the verifier — no challenge\n // outstanding, wrong credential, absent user verification, bad signature. Distinguishing\n // them here would tell an attacker which half of the ceremony to attack; the service logs\n // the specific cause.\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n context: { reason: 'Passkey re-authentication failed' },\n });\n }\n } else {\n throw this.errorBuilder.buildError(ErrorType.VALIDATION, undefined, {\n context: { reason: `Unsupported re-authentication method: ${method}` },\n });\n }\n\n const token = await this.consumableTokenService.createToken({\n tokenType: CoreConsumableTokenTypes.REAUTH,\n consumptionMode: ConsumableToken_ConsumptionMode.SINGLE_USE,\n expiresIn: { value: 5, unit: DurationUnit.MINUTES },\n userId: userId,\n resourceIdentifier: CoreResourceType.USERS,\n relatedId: userId,\n });\n\n return { reAuthToken: token.token };\n } catch (error) {\n if (isWildoBackendError(error)) throw error;\n throw this.errorBuilder.buildFromStandardError(error, undefined, {\n context: { reason: 'Failed to re-authenticate' },\n });\n }\n }\n\n // ==========================================================================\n // AUTH METHOD COUNTING (D9 Safety Check)\n // ==========================================================================\n\n public async countAuthMethods(\n ec: ExecutionContext<any>,\n userId: string,\n ): Promise<{ passwordCount: number; passkeyCount: number; identityLinkCount: number; total: number }> {\n const credentials = await this.credentialVerifier.resolveCredentials(ec, userId);\n\n const passwordCount = credentials?.passwordHash ? 1 : 0;\n const passkeyCount = credentials?.passkeyCredentials?.length ?? 0;\n\n const identityLinks = await this.servicesRegistryHandler.list<UserIdentityLink>(\n CoreResourceType.USER_IDENTITY_LINKS,\n ec,\n { userId },\n undefined,\n { paginated: false },\n ) as UserIdentityLink[];\n const identityLinkCount = identityLinks.length;\n\n return {\n passwordCount,\n passkeyCount,\n identityLinkCount,\n total: passwordCount + passkeyCount + identityLinkCount,\n };\n }\n}\n"]}
1	+ {"version":3,"file":"auth-method-management.backend.service.js","sourceRoot":"","sources":["../../../../../../../src/security/authentications/services/auth-methods/auth-method-management.backend.service.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,OAAO,kBAAkB,CAAC;AAC1B,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAC/C,OAAO,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AACpF,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAG9G,OAAO,EAAE,oCAAoC,EAAE,MAAM,+FAA+F,CAAC;AACrJ,OAAO,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AAC/G,OAAO,EAAE,uBAAuB,EAAE,MAAM,gFAAgF,CAAC;AACzH,OAAO,EAAE,6BAA6B,EAAE,MAAM,yFAAyF,CAAC;AACxI,OAAO,EAAE,6BAA6B,EAAE,MAAM,wFAAwF,CAAC;AACvI,OAAO,EAAE,4BAA4B,EAAE,MAAM,6FAA6F,CAAC;AAC3I,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAC7F,OAAO,EACL,gBAAgB,EAChB,SAAS,EACT,2BAA2B,EAC3B,mBAAmB,EACnB,UAAU,EACV,wBAAwB,EACxB,+BAA+B,EAC/B,sBAAsB,EACtB,iBAAiB,GAClB,MAAM,uBAAuB,CAAC;AAK/B,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AACxD,OAAO,EAAE,qBAAqB,EAAE,MAAM,4FAA4F,CAAC;AACnI,OAAO,EAAE,6BAA6B,EAAE,sBAAsB,EAAE,MAAM,4FAA4F,CAAC;AAe5J,IAAM,kCAAkC,GAAxC,MAAM,kCAAkC;IAIS;IACa;IACW;IACR;IACN;IACA;IACM;IACP;IACM;IAMF;IAIL;IAEC;IAvB9C,QAAQ,CAA+D;IAExF,YACsD,MAAqB,EACR,YAAwC,EAC7B,uBAA8D,EACtE,kBAAwD,EAC9D,gBAAyC,EACzC,gBAAyC,EACnC,sBAAqD,EAC5D,WAA0C,EACpC,UAAwC,EAM1C,mBAA+C,EAIpD,cAAqC,EAEpC,eAAuC;QApBhD,WAAM,GAAN,MAAM,CAAe;QACR,iBAAY,GAAZ,YAAY,CAA4B;QAC7B,4BAAuB,GAAvB,uBAAuB,CAAuC;QACtE,uBAAkB,GAAlB,kBAAkB,CAAsC;QAC9D,qBAAgB,GAAhB,gBAAgB,CAAyB;QACzC,qBAAgB,GAAhB,gBAAgB,CAAyB;QACnC,2BAAsB,GAAtB,sBAAsB,CAA+B;QAC5D,gBAAW,GAAX,WAAW,CAA+B;QACpC,eAAU,GAAV,UAAU,CAA8B;QAM1C,wBAAmB,GAAnB,mBAAmB,CAA4B;QAIpD,mBAAc,GAAd,cAAc,CAAuB;QAEpC,oBAAe,GAAf,eAAe,CAAwB;QAEpG,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,oCAAoC,CAAC,CAAC;QAC9E,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,oCAAoC,EAAE,IAAI,CAAC,CAAC;IAC9E,CAAC;IAED,6EAA6E;IAC7E,mBAAmB;IACnB,6EAA6E;IAErE,SAAS,CAAC,KAAa;QAC7B,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,MAAM,CAAC;QAC9C,OAAO,MAAM,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACjC,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,sBAAsB,CAAC,EAAyB,EAAE,MAAc;QAC5E,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAA2B,gBAAgB,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC;YAC5H,IAAI,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;gBAC5B,OAAO,IAAI,CAAC,UAAU,CAAC,0BAA0B,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;YACnF,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,0CAA0C;QAC5C,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAEM,KAAK,CAAC,+BAA+B,CAAC,EAAyB,EAAE,MAAc;QACpF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QAC7D,MAAM,gBAAgB,GAAG,MAAM,EAAE,gBAAgB,CAAC;QAClD,IAAI,gBAAgB,IAAI,CAAC,gBAAgB,CAAC,sBAAsB,EAAE,CAAC;YACjE,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;gBACrE,sBAAsB,EAAE,2BAA2B,CAAC,aAAa;gBACjE,OAAO,EAAE,EAAE,MAAM,EAAE,0DAA0D,EAAE;aAChF,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,6EAA6E;IAC7E,sBAAsB;IACtB,6EAA6E;IAEtE,KAAK,CAAC,cAAc,CACzB,EAAyB,EACzB,MAAc,EACd,eAAuB,EACvB,WAAmB,EACnB,SAAiB,EACjB,SAAiB;QAEjB,IAAI,CAAC;YAEH,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;YAEjF,IAAI,CAAC,WAAW,IAAI,CAAC,WAAW,CAAC,YAAY,EAAE,CAAC;gBAC9C,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,SAAS,EAAE;oBAClE,sBAAsB,EAAE,2BAA2B,CAAC,UAAU;oBAC9D,OAAO,EAAE,EAAE,MAAM,EAAE,iDAAiD,EAAE;iBACvE,CAAC,CAAC;YACL,CAAC;YAED,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,cAAc,CACjE,WAAW,CAAC,YAAY,EAAE,eAAe,CAC1C,CAAC;YACF,IAAI,CAAC,cAAc,EAAE,CAAC;gBACpB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;oBACtE,sBAAsB,EAAE,2BAA2B,CAAC,UAAU;oBAC9D,OAAO,EAAE,EAAE,MAAM,EAAE,+BAA+B,EAAE;iBACrD,CAAC,CAAC;YACL,CAAC;YAED,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;YACrE,MAAM,cAAc,GAAG,cAAc,EAAE,cAAc,CAAC;YACtD,MAAM,YAAY,GAAG,IAAI,CAAC,kBAAkB,CAAC,sBAAsB,CAAC,WAAW,EAAE,cAAc,CAAC,CAAC;YACjG,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;gBACxB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,SAAS,EAAE;oBAClE,sBAAsB,EAAE,2BAA2B,CAAC,oCAAoC;oBACxF,OAAO,EAAE,EAAE,UAAU,EAAE,YAAY,CAAC,UAAU,EAAE,SAAS,EAAE,cAAc,EAAE,SAAS,EAAE,SAAS,EAAE,cAAc,EAAE,SAAS,EAAE;iBAC7H,CAAC,CAAC;YACL,CAAC;YAED,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,YAAY,CAAC,WAAW,EAAE,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;YACnI,MAAM,IAAI,CAAC,WAAW,CAAC,0BAA0B,CAAC,MAAM,CAAC,CAAC;YAC1D,MAAM,IAAI,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,EAAE,EAAE,MAAM,EAAE,eAAe,CAAC,CAAC;YAE9E,MAAM,IAAI,CAAC,gBAAgB,CAAC,sBAAsB,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC;QACnG,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,mBAAmB,CAAC,KAAK,CAAC;gBAAE,MAAM,KAAK,CAAC;YAC5C,MAAM,IAAI,CAAC,YAAY,CAAC,sBAAsB,CAAC,KAAK,EAAE,SAAS,EAAE;gBAC/D,OAAO,EAAE,EAAE,MAAM,EAAE,2BAA2B,EAAE;aACjD,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAEM,KAAK,CAAC,WAAW,CACtB,EAAyB,EACzB,MAAc,EACd,WAAmB,EACnB,SAAiB,EACjB,SAAiB;QAEjB,IAAI,CAAC;YAEH,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;YAEjF,IAAI,WAAW,EAAE,YAAY,EAAE,CAAC;gBAC9B,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,SAAS,EAAE;oBAClE,sBAAsB,EAAE,2BAA2B,CAAC,UAAU;oBAC9D,OAAO,EAAE,EAAE,MAAM,EAAE,yDAAyD,EAAE;iBAC/E,CAAC,CAAC;YACL,CAAC;YAED,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;YACrE,MAAM,cAAc,GAAG,cAAc,EAAE,cAAc,CAAC;YACtD,MAAM,YAAY,GAAG,IAAI,CAAC,kBAAkB,CAAC,sBAAsB,CAAC,WAAW,EAAE,cAAc,CAAC,CAAC;YACjG,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;gBACxB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,SAAS,EAAE;oBAClE,sBAAsB,EAAE,2BAA2B,CAAC,oCAAoC;oBACxF,OAAO,EAAE,EAAE,UAAU,EAAE,YAAY,CAAC,UAAU,EAAE,SAAS,EAAE,cAAc,EAAE,SAAS,EAAE,SAAS,EAAE,cAAc,EAAE,SAAS,EAAE;iBAC7H,CAAC,CAAC;YACL,CAAC;YAED,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,YAAY,CAAC,WAAW,EAAE,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;YACnI,MAAM,IAAI,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,EAAE,EAAE,MAAM,EAAE,eAAe,CAAC,CAAC;YAE9E,MAAM,IAAI,CAAC,gBAAgB,CAAC,kBAAkB,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC;QAC/F,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,mBAAmB,CAAC,KAAK,CAAC;gBAAE,MAAM,KAAK,CAAC;YAC5C,MAAM,IAAI,CAAC,YAAY,CAAC,sBAAsB,CAAC,KAAK,EAAE,SAAS,EAAE;gBAC/D,OAAO,EAAE,EAAE,MAAM,EAAE,wBAAwB,EAAE;aAC9C,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,6EAA6E;IAC7E,kBAAkB;IAClB,6EAA6E;IAEtE,KAAK,CAAC,WAAW,CACtB,EAAyB,EACzB,MAAc,EACd,WAA+B,EAC/B,SAAiB,EACjB,SAAiB;QAEjB,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,+BAA+B,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;YAEvD,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;YAErE,IAAI,cAAc,EAAE,gBAAgB,EAAE,6BAA6B,EAAE,CAAC;gBACpE,IAAI,CAAC,WAAW,EAAE,CAAC;oBACjB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;wBACtE,OAAO,EAAE,EAAE,MAAM,EAAE,+CAA+C,EAAE;qBACrE,CAAC,CAAC;gBACL,CAAC;gBACD,IAAI,CAAC;oBACH,MAAM,IAAI,CAAC,sBAAsB,CAAC,aAAa,CAAC,WAAW,EAAE,CAAC,wBAAwB,CAAC,MAAM,CAAC,CAAC,CAAC;oBAChG,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC;oBAC1E,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;wBAC5B,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;4BACrE,OAAO,EAAE,EAAE,MAAM,EAAE,sDAAsD,EAAE;yBAC5E,CAAC,CAAC;oBACL,CAAC;gBACH,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,IAAI,mBAAmB,CAAC,KAAK,CAAC;wBAAE,MAAM,KAAK,CAAC;oBAC5C,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;wBACtE,OAAO,EAAE,EAAE,MAAM,EAAE,4CAA4C,EAAE;qBAClE,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YAED,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;YAEjF,IAAI,CAAC,WAAW,EAAE,YAAY,EAAE,CAAC;gBAC/B,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,SAAS,EAAE;oBAClE,sBAAsB,EAAE,2BAA2B,CAAC,UAAU;oBAC9D,OAAO,EAAE,EAAE,MAAM,EAAE,qBAAqB,EAAE;iBAC3C,CAAC,CAAC;YACL,CAAC;YAED,MAAM,WAAW,GAAG,CAAC,CAAC,cAAc,EAAE,SAAS,EAAE,UAAU,CAAC;YAC5D,IAAI,WAAW,EAAE,CAAC;gBAChB,MAAM,WAAW,GACf,CAAC,WAAW,CAAC,kBAAkB,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC;oBACjD,WAAW,CAAC,mBAAmB,KAAK,IAAI,CAAC;gBAE3C,IAAI,CAAC,WAAW,EAAE,CAAC;oBACjB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,SAAS,EAAE;wBAClE,sBAAsB,EAAE,2BAA2B,CAAC,UAAU;wBAC9D,OAAO,EAAE,EAAE,MAAM,EAAE,2DAA2D,EAAE;qBACjF,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YAED,4EAA4E;YAC5E,4EAA4E;YAC5E,gFAAgF;YAChF,8EAA8E;YAC9E,+BAA+B;YAC/B,MAAM,IAAI,CAAC,mBAAmB,CAAC,cAAc,CAAC,gBAAgB,CAAC,gBAAgB,EAAE,EAAE,MAAM,EAAE,EAAE;gBAC3F,YAAY,EAAE,IAAI;gBAClB,YAAY,EAAE,KAAK;gBACnB,iBAAiB,EAAE,EAAE;gBACrB,cAAc,EAAE,IAAI;aACrB,CAAC,CAAC;YAEH,MAAM,IAAI,CAAC,gBAAgB,CAAC,mBAAmB,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC;QAChG,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,mBAAmB,CAAC,KAAK,CAAC;gBAAE,MAAM,KAAK,CAAC;YAC5C,MAAM,IAAI,CAAC,YAAY,CAAC,sBAAsB,CAAC,KAAK,EAAE,SAAS,EAAE;gBAC/D,OAAO,EAAE,EAAE,MAAM,EAAE,wBAAwB,EAAE;aAC9C,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,6EAA6E;IAC7E,uBAAuB;IACvB,6EAA6E;IAEtE,KAAK,CAAC,YAAY,CACvB,EAAyB,EACzB,MAAc;QAEd,IAAI,CAAC;YAEH,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;YAEjF,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAC3D,gBAAgB,CAAC,mBAAmB,EACpC,EAAE,EACF,EAAE,MAAM,EAAE,EACV,SAAS,EACT,EAAE,SAAS,EAAE,KAAK,EAAE,CACC,IAAI,EAAE,CAAC;YAE9B,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;YACrE,MAAM,kBAAkB,GAAG,cAAc,EAAE,kBAAkB,CAAC;YAE9D,MAAM,UAAU,GAA2G,EAAE,CAAC;YAE9H,MAAM,aAAa,GAAG,CAAC,MAAkB,EAAW,EAAE;gBACpD,IAAI,CAAC,kBAAkB;oBAAE,OAAO,IAAI,CAAC;gBACrC,OAAO,CAAC,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC;YACtC,CAAC,CAAC;YAEF,IAAI,aAAa,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACvC,UAAU,CAAC,IAAI,CAAC;oBACd,MAAM,EAAE,UAAU,CAAC,QAAQ;oBAC3B,QAAQ,EAAE,CAAC,CAAC,WAAW,EAAE,YAAY;iBACtC,CAAC,CAAC;YACL,CAAC;YAED,IAAI,aAAa,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;gBACnC,UAAU,CAAC,IAAI,CAAC;oBACd,MAAM,EAAE,UAAU,CAAC,IAAI;oBACvB,QAAQ,EAAE,WAAW,EAAE,YAAY,KAAK,IAAI;oBAC5C,UAAU,EAAE,WAAW,EAAE,cAAc,IAAI,SAAS;iBACrD,CAAC,CAAC;YACL,CAAC;YAED,IAAI,aAAa,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;gBACtC,UAAU,CAAC,IAAI,CAAC;oBACd,MAAM,EAAE,UAAU,CAAC,OAAO;oBAC1B,QAAQ,EAAE,CAAC,WAAW,EAAE,kBAAkB,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC;oBAC5D,OAAO,EAAE,EAAE,YAAY,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,IAAI,CAAC,EAAE;iBACxE,CAAC,CAAC;YACL,CAAC;YAED,IAAI,aAAa,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;gBACtC,UAAU,CAAC,IAAI,CAAC;oBACd,MAAM,EAAE,UAAU,CAAC,OAAO;oBAC1B,QAAQ,EAAE,WAAW,EAAE,mBAAmB,KAAK,IAAI;oBACnD,OAAO,EAAE,WAAW,EAAE,mBAAmB;wBACvC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,WAAY,CAAC,EAAE;wBAC3D,CAAC,CAAC,SAAS;iBACd,CAAC,CAAC;YACL,CAAC;YAED,IAAI,aAAa,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;gBACxC,UAAU,CAAC,IAAI,CAAC;oBACd,MAAM,EAAE,UAAU,CAAC,SAAS;oBAC5B,QAAQ,EAAE,IAAI;iBACf,CAAC,CAAC;YACL,CAAC;YAED,IAAI,aAAa,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;gBACzC,UAAU,CAAC,IAAI,CAAC;oBACd,MAAM,EAAE,UAAU,CAAC,UAAU;oBAC7B,QAAQ,EAAE,IAAI;iBACf,CAAC,CAAC;YACL,CAAC;YAED,IAAI,aAAa,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,CAAC;gBAC9C,MAAM,WAAW,GAAG,aAAa,CAAC,MAAM,CACtC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,cAAc,KAAK,iBAAiB,CAAC,MAAM,CAC3D,CAAC;gBACF,UAAU,CAAC,IAAI,CAAC;oBACd,MAAM,EAAE,UAAU,CAAC,eAAe;oBAClC,QAAQ,EAAE,WAAW,CAAC,MAAM,GAAG,CAAC;iBACjC,CAAC,CAAC;YACL,CAAC;YAED,IAAI,aAAa,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACvC,UAAU,CAAC,IAAI,CAAC;oBACd,MAAM,EAAE,UAAU,CAAC,QAAQ;oBAC3B,QAAQ,EAAE,aAAa,CAAC,IAAI,CAC1B,CAAC,IAAI,EAAE,EAAE,CACP,IAAI,CAAC,cAAc,KAAK,iBAAiB,CAAC,UAAU;2BACjD,IAAI,CAAC,MAAM,KAAK,sBAAsB,CAAC,IAAI,CACjD;iBACF,CAAC,CAAC;YACL,CAAC;YAED,IAAI,aAAa,CAAC,UAAU,CAAC,kBAAkB,CAAC,EAAE,CAAC;gBACjD,UAAU,CAAC,IAAI,CAAC;oBACd,MAAM,EAAE,UAAU,CAAC,kBAAkB;oBACrC,QAAQ,EAAE,aAAa,CAAC,IAAI,CAC1B,CAAC,IAAI,EAAE,EAAE,CACP,IAAI,CAAC,cAAc,KAAK,iBAAiB,CAAC,UAAU;2BACjD,IAAI,CAAC,MAAM,KAAK,sBAAsB,CAAC,IAAI,CACjD;iBACF,CAAC,CAAC;YACL,CAAC;YAED,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC;QACjC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,mBAAmB,CAAC,KAAK,CAAC;gBAAE,MAAM,KAAK,CAAC;YAC5C,MAAM,IAAI,CAAC,YAAY,CAAC,sBAAsB,CAAC,KAAK,EAAE,SAAS,EAAE;gBAC/D,OAAO,EAAE,EAAE,MAAM,EAAE,4BAA4B,EAAE;aAClD,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,6EAA6E;IAC7E,iBAAiB;IACjB,6EAA6E;IAEtE,KAAK,CAAC,gBAAgB,CAC3B,EAAyB,EACzB,MAAc;QAEd,IAAI,CAAC;YAEH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,IAAI,CACtD,gBAAgB,CAAC,mBAAmB,EACpC,EAAE,EACF,EAAE,MAAM,EAAE,EACV,SAAS,EACT,EAAE,SAAS,EAAE,KAAK,EAAE,CACC,CAAC;YAExB,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;gBACpC,GAAG,EAAE,IAAI,CAAC,GAAG;gBACb,cAAc,EAAE,IAAI,CAAC,cAAc;gBACnC,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,aAAa,EAAE,IAAI,CAAC,aAAa;gBACjC,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,UAAU,EAAE,IAAI,CAAC,UAAU;aAC5B,CAAC,CAAC,CAAC;YAEJ,OAAO,EAAE,KAAK,EAAE,CAAC;QACnB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,mBAAmB,CAAC,KAAK,CAAC;gBAAE,MAAM,KAAK,CAAC;YAC5C,MAAM,IAAI,CAAC,YAAY,CAAC,sBAAsB,CAAC,KAAK,EAAE,SAAS,EAAE;gBAC/D,OAAO,EAAE,EAAE,MAAM,EAAE,8BAA8B,EAAE;aACpD,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAEM,KAAK,CAAC,kBAAkB,CAC7B,EAAyB,EACzB,MAAc,EACd,MAAc,EACd,SAAiB,EACjB,SAAiB;QAEjB,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,+BAA+B,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;YAEvD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAClD,gBAAgB,CAAC,mBAAmB,EACpC,EAAE,EACF,EAAE,GAAG,EAAE,MAAM,EAAE,CAChB,CAAC;YAEF,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,SAAS,EAAE,SAAS,EAAE;oBACjE,OAAO,EAAE,EAAE,MAAM,EAAE,yBAAyB,EAAE;iBAC/C,CAAC,CAAC;YACL,CAAC;YAED,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBAC3B,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,SAAS,EAAE,SAAS,EAAE;oBACjE,OAAO,EAAE,EAAE,MAAM,EAAE,yBAAyB,EAAE;iBAC/C,CAAC,CAAC;YACL,CAAC;YAED,MAAM,gBAAgB,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;YACjE,IAAI,gBAAgB,CAAC,KAAK,IAAI,CAAC,EAAE,CAAC;gBAChC,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,SAAS,EAAE;oBAClE,sBAAsB,EAAE,2BAA2B,CAAC,UAAU;oBAC9D,OAAO,EAAE,EAAE,MAAM,EAAE,+CAA+C,EAAE;iBACrE,CAAC,CAAC;YACL,CAAC;YAED,MAAM,IAAI,CAAC,uBAAuB,CAAC,MAAM,CAAC,gBAAgB,CAAC,mBAAmB,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;YAE5F,MAAM,IAAI,CAAC,gBAAgB,CAAC,0BAA0B,CAAC;gBACrD,MAAM,EAAE,MAAM;gBACd,MAAM;gBACN,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,SAAS;gBACT,SAAS;aACV,EAAE,EAAE,CAAC,CAAC;QACT,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,mBAAmB,CAAC,KAAK,CAAC;gBAAE,MAAM,KAAK,CAAC;YAC5C,MAAM,IAAI,CAAC,YAAY,CAAC,sBAAsB,CAAC,KAAK,EAAE,SAAS,EAAE;gBAC/D,OAAO,EAAE,EAAE,MAAM,EAAE,gCAAgC,EAAE;aACtD,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,6EAA6E;IAC7E,oBAAoB;IACpB,6EAA6E;IAE7E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAuCG;IACI,KAAK,CAAC,cAAc,CACzB,EAAyB,EACzB,MAAc,EACd,MAAkB,EAClB,QAAiB,EACjB,eAAyB,EACzB,SAAkB,EAClB,SAAkB;IAClB;;;OAGG;IACH,QAAiB;QAEjB,IAAI,CAAC;YACH;;;;;;;;;;;;;;;;;;;;;;;;;;eA0BG;YACH,MAAM,UAAU,GAAG,EAAE,CAAC,cAAc;gBAClC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,qBAAqB,CAAC,EAAE,CAAC,cAAc,CAAC,EAAE,UAAU;gBAC5E,CAAC,CAAC,SAAS,CAAC;YACd,IAAI,UAAU,EAAE,OAAO,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;gBAChE,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,EAAE,EAAE;oBAC/D,OAAO,EAAE;wBACP,MAAM,EAAE,gFAAgF;wBACxF,eAAe,EAAE,MAAM;wBACvB,eAAe,EAAE,UAAU,CAAC,OAAO;qBACpC;iBACF,CAAC,CAAC;YACL,CAAC;YAED,IAAI,MAAM,KAAK,UAAU,CAAC,IAAI,EAAE,CAAC;gBAC/B,IAAI,CAAC,QAAQ,EAAE,CAAC;oBACd,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,SAAS,EAAE;wBAClE,OAAO,EAAE,EAAE,MAAM,EAAE,+CAA+C,EAAE;qBACrE,CAAC,CAAC;gBACL,CAAC;gBAED,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,0BAA0B,CAAC,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;gBAEhG,IAAI,YAAY,CAAC,WAAW,EAAE,CAAC;oBAC7B,wFAAwF;oBACxF,4EAA4E;oBAC5E,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;wBACtE,OAAO,EAAE,EAAE,MAAM,EAAE,4CAA4C,EAAE;qBAClE,CAAC,CAAC;gBACL,CAAC;gBAED,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;oBACxB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;wBACtE,OAAO,EAAE,EAAE,MAAM,EAAE,cAAc,EAAE;qBACpC,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;iBAAM,IAAI,MAAM,KAAK,UAAU,CAAC,QAAQ,EAAE,CAAC;gBAC1C,IAAI,CAAC,QAAQ,EAAE,CAAC;oBACd,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,SAAS,EAAE;wBAClE,OAAO,EAAE,EAAE,MAAM,EAAE,qDAAqD,EAAE;qBAC3E,CAAC,CAAC;gBACL,CAAC;gBAED,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;gBAEjF,IAAI,CAAC,WAAW,EAAE,YAAY,EAAE,CAAC;oBAC/B,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;wBACtE,OAAO,EAAE,EAAE,MAAM,EAAE,kCAAkC,EAAE;qBACxD,CAAC,CAAC;gBACL,CAAC;gBAED,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,cAAc,CAC1D,WAAW,CAAC,YAAY,EAAE,QAAQ,CACnC,CAAC;gBACF,IAAI,CAAC,OAAO,EAAE,CAAC;oBACb,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;wBACtE,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;qBACxC,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;iBAAM,IAAI,MAAM,KAAK,UAAU,CAAC,OAAO,EAAE,CAAC;gBACzC,IAAI,CAAC,eAAe,EAAE,CAAC;oBACrB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,SAAS,EAAE;wBAClE,OAAO,EAAE,EAAE,MAAM,EAAE,+DAA+D,EAAE;qBACrF,CAAC,CAAC;gBACL,CAAC;gBAED,6FAA6F;gBAC7F,4FAA4F;gBAC5F,oDAAoD;gBACpD,MAAM,EAAE,QAAQ,EAAE,cAAc,EAAE,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,4BAA4B,CAC1F,EAAE,EACF,MAAM,EACN,eAA6C,EAC7C,6BAA6B,CAAC,OAAO,CACtC,CAAC;gBAEF;;;;;;;;;;;;;mBAaG;gBACH,IAAI,cAAc,EAAE,CAAC;oBACnB,MAAM,IAAI,CAAC,gBAAgB,CAAC,4BAA4B,CAAC;wBACvD,MAAM;wBACN,YAAY,EAAE,cAAc,CAAC,YAAY;wBACzC,aAAa,EAAE,cAAc,CAAC,aAAa;wBAC3C,eAAe,EAAE,cAAc,CAAC,eAAe;wBAC/C,oBAAoB,EAAE,cAAc,CAAC,oBAAoB;wBACzD,kBAAkB,EAAE,cAAc,CAAC,kBAAkB;wBACrD,GAAG,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,cAAc,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;wBACnE,QAAQ,EAAE,cAAc,CAAC,QAAQ;wBACjC,SAAS,EAAE,SAAS,IAAI,SAAS;wBACjC,SAAS,EAAE,SAAS,IAAI,SAAS;qBAClC,EAAE,EAAE,CAAC,CAAC;gBACT,CAAC;gBAED,IAAI,CAAC,QAAQ,EAAE,CAAC;oBACd,oFAAoF;oBACpF,yFAAyF;oBACzF,0FAA0F;oBAC1F,sBAAsB;oBACtB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;wBACtE,OAAO,EAAE,EAAE,MAAM,EAAE,kCAAkC,EAAE;qBACxD,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,SAAS,EAAE;oBAClE,OAAO,EAAE,EAAE,MAAM,EAAE,yCAAyC,MAAM,EAAE,EAAE;iBACvE,CAAC,CAAC;YACL,CAAC;YAED,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,WAAW,CAAC;gBAC1D,SAAS,EAAE,wBAAwB,CAAC,MAAM;gBAC1C,eAAe,EAAE,+BAA+B,CAAC,UAAU;gBAC3D,SAAS,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,YAAY,CAAC,OAAO,EAAE;gBACnD,MAAM,EAAE,MAAM;gBACd,kBAAkB,EAAE,gBAAgB,CAAC,KAAK;gBAC1C,SAAS,EAAE,MAAM;aAClB,CAAC,CAAC;YAEH,OAAO,EAAE,WAAW,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC;QACtC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,mBAAmB,CAAC,KAAK,CAAC;gBAAE,MAAM,KAAK,CAAC;YAC5C,MAAM,IAAI,CAAC,YAAY,CAAC,sBAAsB,CAAC,KAAK,EAAE,SAAS,EAAE;gBAC/D,OAAO,EAAE,EAAE,MAAM,EAAE,2BAA2B,EAAE;aACjD,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,6EAA6E;IAC7E,yCAAyC;IACzC,6EAA6E;IAEtE,KAAK,CAAC,gBAAgB,CAC3B,EAAyB,EACzB,MAAc;QAEd,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QAEjF,MAAM,aAAa,GAAG,WAAW,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACxD,MAAM,YAAY,GAAG,WAAW,EAAE,kBAAkB,EAAE,MAAM,IAAI,CAAC,CAAC;QAElE,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAC3D,gBAAgB,CAAC,mBAAmB,EACpC,EAAE,EACF,EAAE,MAAM,EAAE,EACV,SAAS,EACT,EAAE,SAAS,EAAE,KAAK,EAAE,CACC,CAAC;QACxB,MAAM,iBAAiB,GAAG,aAAa,CAAC,MAAM,CAAC;QAE/C,OAAO;YACL,aAAa;YACb,YAAY;YACZ,iBAAiB;YACjB,KAAK,EAAE,aAAa,GAAG,YAAY,GAAG,iBAAiB;SACxD,CAAC;IACJ,CAAC;CACF,CAAA;AAhsBY,kCAAkC;IAD9C,UAAU,EAAE;IAKR,WAAA,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAA;IACjC,WAAA,MAAM,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,CAAA;IAC9C,WAAA,MAAM,CAAC,kBAAkB,CAAC,8BAA8B,CAAC,CAAA;IACzD,WAAA,MAAM,CAAC,kBAAkB,CAAC,sBAAsB,CAAC,CAAA;IACjD,WAAA,MAAM,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,CAAA;IAC3C,WAAA,MAAM,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,CAAA;IAC3C,WAAA,MAAM,CAAC,kBAAkB,CAAC,sBAAsB,CAAC,CAAA;IACjD,WAAA,MAAM,CAAC,kBAAkB,CAAC,eAAe,CAAC,CAAA;IAC1C,WAAA,MAAM,CAAC,kBAAkB,CAAC,qBAAqB,CAAC,CAAA;IAMhD,WAAA,MAAM,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,CAAA;IAI9C,YAAA,MAAM,CAAC,kBAAkB,CAAC,cAAc,CAAC,CAAA;IAEzC,YAAA,MAAM,CAAC,kBAAkB,CAAC,eAAe,CAAC,CAAA;qCApBiB,aAAa;QACM,0BAA0B,YAEjB,oCAAoC;QAC5C,uBAAuB;QACvB,uBAAuB;QACX,6BAA6B;QAC/C,6BAA6B;QACxB,4BAA4B,YAU/B,qBAAqB;QAEnB,sBAAsB;GAxB3F,kCAAkC,CAgsB9C","sourcesContent":["import 'reflect-metadata';\nimport { inject, injectable } from 'inversify';\nimport { SAAS_SERVICE_TYPES } from '~wildo-backend-lib/inject/models/service-types';\nimport { ErrorBuilderBackendService } from '~wildo-backend-lib/errors/services/error-builder.backend.service';\nimport type { ServicesRegistryHandlerBackendService } from '~wildo-backend-lib/base-classes/services/services/services-registry-handler.backend.service';\nimport type { SystemAccessBackendService } from '~wildo-backend-lib/base-classes/services/services/system-access.backend.service';\nimport { AuthCredentialVerifierBackendService } from '~wildo-backend-lib/security/authentications/services/auth-credential-verifier.backend.service';\nimport { AppConfigurationService } from '~wildo-backend-lib/config/services/app-configuration.backend.service';\nimport { AuditLogsBackendService } from '~wildo-backend-lib/compliance/audit-trails/services/audit-logs.backend.service';\nimport { ConsumableTokenBackendService } from '~wildo-backend-lib/security/consumable-tokens/services/consumable-token.backend.service';\nimport { AuthTokenIssuerBackendService } from '~wildo-backend-lib/security/authentications/services/auth-token-issuer.backend.service';\nimport { AuthUserLookupBackendService } from '~wildo-backend-lib/security/authentications/services/utils/auth-user-lookup.backend.service';\nimport { LoggerService } from '~wildo-backend-lib/monitoring/logger/services/logger.service';\nimport {\n CoreResourceType,\n ErrorType,\n ErrorCustomMessageReference,\n isWildoBackendError,\n AuthMethod,\n CoreConsumableTokenTypes,\n ConsumableToken_ConsumptionMode,\n ExternalIdentitySource,\n SsoConnectionType,\n} from '@wildo-ai/saas-models';\nimport type {\n UserIdentityLink,\n UserTypeAuthPolicy,\n} from '@wildo-ai/saas-models';\nimport { DurationUnit } from '@wildo-ai/zod-decorators';\nimport { AuthMfaBackendService } from '~wildo-backend-lib/security/authentications/services/auth-methods/auth-mfa.backend.service';\nimport { PasskeyAuthenticationCeremony, WebAuthnBackendService } from '~wildo-backend-lib/security/authentications/services/auth-methods/webauthn.backend.service';\nimport type { AuthenticationResponseJSON } from '@simplewebauthn/server';\nimport type { ExecutionContext } from '~wildo-backend-lib/runtime/models/execution-context.backend.schemas';\n\ninterface IdentityLinkSummary {\n _id: string;\n connectionType: SsoConnectionType;\n source: ExternalIdentitySource;\n providerRef: string;\n providerEmail: string;\n linkedAt: Date;\n lastUsedAt: Date;\n}\n\n@injectable()\nexport class AuthMethodManagementBackendService {\n private readonly logDebug: (message: string, context?: Record<string, unknown>) => void;\n\n constructor(\n @inject(SAAS_SERVICE_TYPES.Logger) private readonly logger: LoggerService,\n @inject(SAAS_SERVICE_TYPES.ErrorBuilderService) private readonly errorBuilder: ErrorBuilderBackendService,\n @inject(SAAS_SERVICE_TYPES.ServicesRegistryHandlerService) private readonly servicesRegistryHandler: ServicesRegistryHandlerBackendService,\n @inject(SAAS_SERVICE_TYPES.AuthCredentialVerifier) private readonly credentialVerifier: AuthCredentialVerifierBackendService,\n @inject(SAAS_SERVICE_TYPES.AppConfigService) private readonly appConfigService: AppConfigurationService,\n @inject(SAAS_SERVICE_TYPES.AuditLogsService) private readonly auditLogsService: AuditLogsBackendService,\n @inject(SAAS_SERVICE_TYPES.ConsumableTokenService) private readonly consumableTokenService: ConsumableTokenBackendService,\n @inject(SAAS_SERVICE_TYPES.AuthTokenIssuer) private readonly tokenIssuer: AuthTokenIssuerBackendService,\n @inject(SAAS_SERVICE_TYPES.AuthUserLookupService) private readonly userLookup: AuthUserLookupBackendService,\n // TOTP-disable clears `secretBase32` + `backupCodesHashed` (both `.isBackendOnly()`),\n // which a plain handler update strips → the secret and backup codes would silently\n // survive a \"disable\". `updateAsSystem` re-attaches the cleared values after the\n // strict parse, fail-closed behind USER_CREDENTIALS' `systemAccessPolicy.update`.\n // Appended LAST to keep the positional test construction stable.\n @inject(SAAS_SERVICE_TYPES.SystemAccessService) private readonly systemAccessService: SystemAccessBackendService,\n // Appended LAST for the same reason as the parameter above — keeps positional test\n // construction stable. Supplies the enrolled-second-factor authority `reAuthenticate` uses for\n // `AuthMethod.TOTP`, shared with the login second-factor step.\n @inject(SAAS_SERVICE_TYPES.AuthMfaService) private readonly authMfaService: AuthMfaBackendService,\n // Appended LAST, same reason as the two above. Supplies the STEP_UP passkey ceremony.\n @inject(SAAS_SERVICE_TYPES.WebAuthnService) private readonly webAuthnService: WebAuthnBackendService,\n ) {\n this.logDebug = this.logger.debugByType('AuthMethodManagementBackendService');\n this.logger.setDebugTypeLogging('AuthMethodManagementBackendService', true);\n }\n\n // ==========================================================================\n // INTERNAL HELPERS\n // ==========================================================================\n\n private maskPhone(phone: string): string {\n if (!phone \|\| phone.length < 4) return '**';\n return `${phone.slice(-4)}`;\n }\n\n /\n W6.8 + AUTH-14: Resolve effective auth policy for a user, including org override merging.\n * Falls back to null if the user or user type is not found.\n /\n private async _resolveUserTypePolicy(ec: ExecutionContext<any>, userId: string): Promise<UserTypeAuthPolicy \| null> {\n try {\n const user = await this.servicesRegistryHandler.read<{ userTypes?: string[] }>(CoreResourceType.USERS, ec, { _id: userId });\n if (user?.userTypes?.length) {\n return this.userLookup.resolveEffectiveAuthPolicy(ec, userId, user.userTypes[0]);\n }\n } catch {\n // Suppress — non-fatal, will use defaults\n }\n return null;\n }\n\n public async enforceUserMethodRemovalAllowed(ec: ExecutionContext<any>, userId: string): Promise<void> {\n const policy = await this._resolveUserTypePolicy(ec, userId);\n const methodManagement = policy?.methodManagement;\n if (methodManagement && !methodManagement.allowUserMethodRemoval) {\n throw this.errorBuilder.buildError(ErrorType.AUTHORIZATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.AUTHORIZATION,\n context: { reason: 'User-initiated auth method removal is disabled by policy' },\n });\n }\n }\n\n // ==========================================================================\n // PASSWORD MANAGEMENT\n // ==========================================================================\n\n public async changePassword(\n ec: ExecutionContext<any>,\n userId: string,\n currentPassword: string,\n newPassword: string,\n ipAddress: string,\n userAgent: string,\n ): Promise<void> {\n try {\n\n const credentials = await this.credentialVerifier.resolveCredentials(ec, userId);\n\n if (!credentials \|\| !credentials.passwordHash) {\n throw this.errorBuilder.buildError(ErrorType.VALIDATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.VALIDATION,\n context: { reason: 'No password set. Use /auth/password/set instead' },\n });\n }\n\n const isCurrentValid = await this.credentialVerifier.verifyPassword(\n credentials.passwordHash, currentPassword,\n );\n if (!isCurrentValid) {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.VALIDATION,\n context: { reason: 'Current password is incorrect' },\n });\n }\n\n const userTypePolicy = await this._resolveUserTypePolicy(ec, userId);\n const passwordPolicy = userTypePolicy?.passwordPolicy;\n const policyResult = this.credentialVerifier.validatePasswordPolicy(newPassword, passwordPolicy);\n if (!policyResult.valid) {\n throw this.errorBuilder.buildError(ErrorType.VALIDATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.VALIDATION_PASSWORD_POLICY_VIOLATION,\n context: { violations: policyResult.violations, minLength: passwordPolicy?.minLength, maxLength: passwordPolicy?.maxLength },\n });\n }\n\n const newPasswordHash = await this.credentialVerifier.hashPassword(newPassword, this.appConfigService.config.auth.passwordHashing);\n await this.tokenIssuer.invalidateAllTokensForUser(userId);\n await this.credentialVerifier.updatePasswordHash(ec, userId, newPasswordHash);\n\n await this.auditLogsService.logUserPasswordChanged({ userId: userId, ipAddress, userAgent }, ec);\n } catch (error) {\n if (isWildoBackendError(error)) throw error;\n throw this.errorBuilder.buildFromStandardError(error, undefined, {\n context: { reason: 'Failed to change password' },\n });\n }\n }\n\n public async setPassword(\n ec: ExecutionContext<any>,\n userId: string,\n newPassword: string,\n ipAddress: string,\n userAgent: string,\n ): Promise<void> {\n try {\n\n const credentials = await this.credentialVerifier.resolveCredentials(ec, userId);\n\n if (credentials?.passwordHash) {\n throw this.errorBuilder.buildError(ErrorType.VALIDATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.VALIDATION,\n context: { reason: 'Password already set. Use /auth/password/change instead' },\n });\n }\n\n const userTypePolicy = await this._resolveUserTypePolicy(ec, userId);\n const passwordPolicy = userTypePolicy?.passwordPolicy;\n const policyResult = this.credentialVerifier.validatePasswordPolicy(newPassword, passwordPolicy);\n if (!policyResult.valid) {\n throw this.errorBuilder.buildError(ErrorType.VALIDATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.VALIDATION_PASSWORD_POLICY_VIOLATION,\n context: { violations: policyResult.violations, minLength: passwordPolicy?.minLength, maxLength: passwordPolicy?.maxLength },\n });\n }\n\n const newPasswordHash = await this.credentialVerifier.hashPassword(newPassword, this.appConfigService.config.auth.passwordHashing);\n await this.credentialVerifier.updatePasswordHash(ec, userId, newPasswordHash);\n\n await this.auditLogsService.logUserPasswordSet({ userId: userId, ipAddress, userAgent }, ec);\n } catch (error) {\n if (isWildoBackendError(error)) throw error;\n throw this.errorBuilder.buildFromStandardError(error, undefined, {\n context: { reason: 'Failed to set password' },\n });\n }\n }\n\n // ==========================================================================\n // TOTP MANAGEMENT\n // ==========================================================================\n\n public async disableTotp(\n ec: ExecutionContext<any>,\n userId: string,\n reAuthToken: string \| undefined,\n ipAddress: string,\n userAgent: string,\n ): Promise<void> {\n try {\n await this.enforceUserMethodRemovalAllowed(ec, userId);\n\n const userTypePolicy = await this._resolveUserTypePolicy(ec, userId);\n\n if (userTypePolicy?.methodManagement?.requireReauthForMethodChanges) {\n if (!reAuthToken) {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n context: { reason: 'Re-authentication is required for this action' },\n });\n }\n try {\n await this.consumableTokenService.validateToken(reAuthToken, [CoreConsumableTokenTypes.REAUTH]);\n const token = await this.consumableTokenService.consumeToken(reAuthToken);\n if (token.userId !== userId) {\n throw this.errorBuilder.buildError(ErrorType.AUTHORIZATION, undefined, {\n context: { reason: 'Re-authentication token does not belong to this user' },\n });\n }\n } catch (error) {\n if (isWildoBackendError(error)) throw error;\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n context: { reason: 'Invalid or expired re-authentication token' },\n });\n }\n }\n\n const credentials = await this.credentialVerifier.resolveCredentials(ec, userId);\n\n if (!credentials?.totpVerified) {\n throw this.errorBuilder.buildError(ErrorType.VALIDATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.VALIDATION,\n context: { reason: 'TOTP is not enabled' },\n });\n }\n\n const mfaRequired = !!userTypePolicy?.mfaPolicy?.requireMFA;\n if (mfaRequired) {\n const hasOtherMFA =\n (credentials.passkeyCredentials?.length ?? 0) > 0 \|\|\n credentials.phoneNumberVerified === true;\n\n if (!hasOtherMFA) {\n throw this.errorBuilder.buildError(ErrorType.VALIDATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.VALIDATION,\n context: { reason: 'Cannot disable your only MFA method while MFA is required' },\n });\n }\n }\n\n // Trusted system write: clearing `secretBase32` + `backupCodesHashed` (both\n // backendOnly) must survive the strict parse, otherwise the TOTP secret and\n // backup codes silently persist after a \"disable\". `updateAsSystem` re-attaches\n // the cleared values; `totpVerified`/`totpVerifiedAt` are plain fields parsed\n // normally, exactly as before.\n await this.systemAccessService.updateAsSystem(CoreResourceType.USER_CREDENTIALS, { userId }, {\n secretBase32: null,\n totpVerified: false,\n backupCodesHashed: [],\n totpVerifiedAt: null,\n });\n\n await this.auditLogsService.logUserTOTPDisabled({ userId: userId, ipAddress, userAgent }, ec);\n } catch (error) {\n if (isWildoBackendError(error)) throw error;\n throw this.errorBuilder.buildFromStandardError(error, undefined, {\n context: { reason: 'Failed to disable TOTP' },\n });\n }\n }\n\n // ==========================================================================\n // METHOD INTROSPECTION\n // ==========================================================================\n\n public async getMyMethods(\n ec: ExecutionContext<any>,\n userId: string,\n ): Promise<{ methods: Array<{ method: AuthMethod; enrolled: boolean; enrolledAt?: Date; details?: Record<string, unknown> }> }> {\n try {\n\n const credentials = await this.credentialVerifier.resolveCredentials(ec, userId);\n\n const identityLinks = await this.servicesRegistryHandler.list<UserIdentityLink>(\n CoreResourceType.USER_IDENTITY_LINKS,\n ec,\n { userId },\n undefined,\n { paginated: false },\n ) as UserIdentityLink[] ?? [];\n\n const userTypePolicy = await this._resolveUserTypePolicy(ec, userId);\n const authMethodsEnabled = userTypePolicy?.authMethodsEnabled;\n\n const allMethods: Array<{ method: AuthMethod; enrolled: boolean; enrolledAt?: Date; details?: Record<string, unknown> }> = [];\n\n const shouldInclude = (method: AuthMethod): boolean => {\n if (!authMethodsEnabled) return true;\n return !!authMethodsEnabled[method];\n };\n\n if (shouldInclude(AuthMethod.PASSWORD)) {\n allMethods.push({\n method: AuthMethod.PASSWORD,\n enrolled: !!credentials?.passwordHash,\n });\n }\n\n if (shouldInclude(AuthMethod.TOTP)) {\n allMethods.push({\n method: AuthMethod.TOTP,\n enrolled: credentials?.totpVerified === true,\n enrolledAt: credentials?.totpVerifiedAt ?? undefined,\n });\n }\n\n if (shouldInclude(AuthMethod.PASSKEY)) {\n allMethods.push({\n method: AuthMethod.PASSKEY,\n enrolled: (credentials?.passkeyCredentials?.length ?? 0) > 0,\n details: { passkeyCount: credentials?.passkeyCredentials?.length ?? 0 },\n });\n }\n\n if (shouldInclude(AuthMethod.SMS_OTP)) {\n allMethods.push({\n method: AuthMethod.SMS_OTP,\n enrolled: credentials?.phoneNumberVerified === true,\n details: credentials?.phoneNumberVerified\n ? { phoneNumber: this.maskPhone(credentials.phoneNumber!) }\n : undefined,\n });\n }\n\n if (shouldInclude(AuthMethod.EMAIL_OTP)) {\n allMethods.push({\n method: AuthMethod.EMAIL_OTP,\n enrolled: true,\n });\n }\n\n if (shouldInclude(AuthMethod.MAGIC_LINK)) {\n allMethods.push({\n method: AuthMethod.MAGIC_LINK,\n enrolled: true,\n });\n }\n\n if (shouldInclude(AuthMethod.EXTERNAL_OAUTH2)) {\n const socialLinks = identityLinks.filter(\n (link) => link.connectionType === SsoConnectionType.SOCIAL,\n );\n allMethods.push({\n method: AuthMethod.EXTERNAL_OAUTH2,\n enrolled: socialLinks.length > 0,\n });\n }\n\n if (shouldInclude(AuthMethod.ORG_SAML)) {\n allMethods.push({\n method: AuthMethod.ORG_SAML,\n enrolled: identityLinks.some(\n (link) =>\n link.connectionType === SsoConnectionType.ENTERPRISE\n && link.source === ExternalIdentitySource.SAML,\n ),\n });\n }\n\n if (shouldInclude(AuthMethod.ORG_OPENID_CONNECT)) {\n allMethods.push({\n method: AuthMethod.ORG_OPENID_CONNECT,\n enrolled: identityLinks.some(\n (link) =>\n link.connectionType === SsoConnectionType.ENTERPRISE\n && link.source === ExternalIdentitySource.OIDC,\n ),\n });\n }\n\n return { methods: allMethods };\n } catch (error) {\n if (isWildoBackendError(error)) throw error;\n throw this.errorBuilder.buildFromStandardError(error, undefined, {\n context: { reason: 'Failed to get auth methods' },\n });\n }\n }\n\n // ==========================================================================\n // IDENTITY LINKS\n // ==========================================================================\n\n public async getIdentityLinks(\n ec: ExecutionContext<any>,\n userId: string,\n ): Promise<{ links: IdentityLinkSummary[] }> {\n try {\n\n const rawLinks = await this.servicesRegistryHandler.list<UserIdentityLink>(\n CoreResourceType.USER_IDENTITY_LINKS,\n ec,\n { userId },\n undefined,\n { paginated: false },\n ) as UserIdentityLink[];\n\n const links = rawLinks.map((link) => ({\n _id: link._id,\n connectionType: link.connectionType,\n source: link.source,\n providerRef: link.providerRef,\n providerEmail: link.providerEmail,\n linkedAt: link.linkedAt,\n lastUsedAt: link.lastUsedAt,\n }));\n\n return { links };\n } catch (error) {\n if (isWildoBackendError(error)) throw error;\n throw this.errorBuilder.buildFromStandardError(error, undefined, {\n context: { reason: 'Failed to get identity links' },\n });\n }\n }\n\n public async unlinkIdentityLink(\n ec: ExecutionContext<any>,\n userId: string,\n linkId: string,\n ipAddress: string,\n userAgent: string,\n ): Promise<void> {\n try {\n await this.enforceUserMethodRemovalAllowed(ec, userId);\n\n const link = await this.servicesRegistryHandler.read<UserIdentityLink>(\n CoreResourceType.USER_IDENTITY_LINKS,\n ec,\n { _id: linkId },\n );\n\n if (!link) {\n throw this.errorBuilder.buildError(ErrorType.NOT_FOUND, undefined, {\n context: { reason: 'Identity link not found' },\n });\n }\n\n if (link.userId !== userId) {\n throw this.errorBuilder.buildError(ErrorType.NOT_FOUND, undefined, {\n context: { reason: 'Identity link not found' },\n });\n }\n\n const authMethodCounts = await this.countAuthMethods(ec, userId);\n if (authMethodCounts.total <= 1) {\n throw this.errorBuilder.buildError(ErrorType.VALIDATION, undefined, {\n customMessageReference: ErrorCustomMessageReference.VALIDATION,\n context: { reason: 'Cannot remove your only authentication method' },\n });\n }\n\n await this.servicesRegistryHandler.delete(CoreResourceType.USER_IDENTITY_LINKS, ec, linkId);\n\n await this.auditLogsService.logUserIdentityLinkRemoved({\n userId: userId,\n linkId,\n providerRef: link.providerRef,\n ipAddress,\n userAgent,\n }, ec);\n } catch (error) {\n if (isWildoBackendError(error)) throw error;\n throw this.errorBuilder.buildFromStandardError(error, undefined, {\n context: { reason: 'Failed to unlink identity link' },\n });\n }\n }\n\n // ==========================================================================\n // RE-AUTHENTICATION\n // ==========================================================================\n\n /\n Prove the caller is still themselves, and mint a single-use `REAUTH` token on success.\n \n # Which factors are accepted, and why TOTP had to be one of them\n \n `requiresStepUpAuthentication` operations are cleared ONLY by the token this method mints, so\n * the factor list here decides who can perform them at all. While it was PASSWORD-only, two\n * populations were structurally locked out of every gated verb:\n \n - user types whose `authMethodsEnabled` excludes `PASSWORD` (SSO-only, passkey-only) — also\n * reachable through a per-ORGANIZATION `authMethodsEnabled` override;\n * - directory-managed (SCIM) users, whose `passwordHash` AND passkeys the framework\n * deliberately destroys so a local first factor cannot survive IdP deprovisioning\n * (`_reconcileLocalCredentialsForDirectoryManaged`).\n \n That second group is not an edge case: once tenant teardown split into `request_deletion` +\n * purge, an ORG_ADMIN of a directory-managed tenant could not start even the NORMAL teardown.\n * TOTP is the right remedy precisely because the same reconciliation leaves it INTACT — it is a\n * second factor sitting on top of the IdP first factor, so it survives deprovisioning by design.\n \n `TOTP` here means \"an enrolled second factor\": a TOTP code or one of the principal's backup\n * codes, verified through the single shared authority\n * ({@link AuthMfaBackendService.verifyEnrolledSecondFactor}) that login uses — including its\n * anti-replay. The anti-replay is load-bearing for step-up specifically: without it a code\n * observed during login would still be valid moments later, and step-up would authorize a\n * destructive operation on a credential the caller never freshly proved.\n \n `PASSKEY` is SUPPORTED, through a dedicated two-legged ceremony rather than the one call\n * password and TOTP take: `POST /auth/reauth/passkey/options` then `POST /auth/reauth` with the\n * assertion, because WebAuthn is challenge-response. It is a re-proof rather than a possession\n * check — the branch below verifies under `PasskeyAuthenticationCeremony.STEP_UP`, which reads a\n * SEPARATE challenge (so an assertion minted for a login cannot be redeemed here) and demands\n * user verification even where the app policy is `preferred`.\n \n Any other `AuthMethod` is refused explicitly by the trailing `else`, rather than silently\n * unsupported.\n \n assurance-control: WILDO.IDENTITY.STEP_UP_AUTHENTICATION — re-proof of identity before a\n * high-impact action, over any factor the principal actually holds.\n /\n public async reAuthenticate(\n ec: ExecutionContext<any>,\n userId: string,\n method: AuthMethod,\n password?: string,\n passkeyResponse?: unknown,\n ipAddress?: string,\n userAgent?: string,\n /\n The enrolled-second-factor code for `method === TOTP` (a TOTP code or a backup code).\n * Appended LAST so every existing positional caller keeps its meaning.\n /\n totpCode?: string,\n ): Promise<{ reAuthToken: string }> {\n try {\n /\n * The user type's step-up policy decides WHICH FACTORS may satisfy a step-up (#422).\n \n `stepUpAuth.methods` was read only by a startup warning: the gate in\n * `services-registry-handler.backend.service.ts` consumed any `REAUTH` token whose `userId`\n * matched, whatever produced it. So a policy naming WebAuthn was satisfied by a password\n * re-authentication, and an operator who configured a phishing-resistant factor got a\n * password prompt and NO error — the same shape as an OIDC `acrValues` that is never sent.\n \n Enforced at MINT rather than at the gate, deliberately:\n * - the factor is known here and is NOT recorded on the token, so gate-time enforcement\n * would need a token-payload change and a migration for tokens already in flight;\n * - a refusal here names the allowed factors while the person is still choosing one,\n * instead of accepting their proof and refusing the operation afterwards;\n * - it makes the wrong token UNMINTABLE rather than merely rejected, so the gate keeps its\n * single question (\"is there a valid REAUTH token for this user?\") and cannot drift from\n * the policy.\n \n NO ENROLMENT FALLBACK, and that is the decision rather than an oversight. A user whose only\n * enrolled factor is outside the policy cannot mint a token and is told to enrol. Falling back\n * to an unnamed factor would reopen exactly the hole this closes — a policy that names a\n * factor and accepts a weaker one is what the defect was.\n \n The residual, stated: a token minted under one policy and redeemed after the policy narrows\n * is still accepted. REAUTH tokens live five minutes and are single-use, so the window is that\n * long; closing it entirely is the token-payload change rejected above.\n /\n const stepUpAuth = ec.activeUserType\n ? this.appConfigService.getUserTypeAuthPolicy(ec.activeUserType)?.stepUpAuth\n : undefined;\n if (stepUpAuth?.enabled && !stepUpAuth.methods.includes(method)) {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, ec, {\n context: {\n reason: 'This factor is not accepted for step-up re-authentication by this account type',\n requestedMethod: method,\n acceptedMethods: stepUpAuth.methods,\n },\n });\n }\n\n if (method === AuthMethod.TOTP) {\n if (!totpCode) {\n throw this.errorBuilder.buildError(ErrorType.VALIDATION, undefined, {\n context: { reason: 'A code is required for TOTP re-authentication' },\n });\n }\n\n const verification = await this.authMfaService.verifyEnrolledSecondFactor(ec, userId, totpCode);\n\n if (verification.notEnrolled) {\n // Distinct from a wrong code on purpose: this account has NO enrolled second factor, so\n // retrying cannot help. The caller needs a different factor, or enrollment.\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n context: { reason: 'No enrolled second factor for this account' },\n });\n }\n\n if (!verification.valid) {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n context: { reason: 'Invalid code' },\n });\n }\n } else if (method === AuthMethod.PASSWORD) {\n if (!password) {\n throw this.errorBuilder.buildError(ErrorType.VALIDATION, undefined, {\n context: { reason: 'Password is required for password re-authentication' },\n });\n }\n\n const credentials = await this.credentialVerifier.resolveCredentials(ec, userId);\n\n if (!credentials?.passwordHash) {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n context: { reason: 'No password set for this account' },\n });\n }\n\n const isValid = await this.credentialVerifier.verifyPassword(\n credentials.passwordHash, password,\n );\n if (!isValid) {\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n context: { reason: 'Invalid password' },\n });\n }\n } else if (method === AuthMethod.PASSKEY) {\n if (!passkeyResponse) {\n throw this.errorBuilder.buildError(ErrorType.VALIDATION, undefined, {\n context: { reason: 'A passkey assertion is required for passkey re-authentication' },\n });\n }\n\n // STEP_UP ceremony, NOT login: it reads a separate challenge (so an assertion produced for a\n // login cannot be redeemed here) and demands user verification even where the app policy is\n // `preferred`. See `PasskeyAuthenticationCeremony`.\n const { verified, cloneSuspicion } = await this.webAuthnService.verifyAuthenticationResponse(\n ec,\n userId,\n passkeyResponse as AuthenticationResponseJSON,\n PasskeyAuthenticationCeremony.STEP_UP,\n );\n\n /\n * A verified assertion whose signature counter did not advance is the cloned-authenticator\n * signal, and it gets the same CRITICAL row here as at the login door — a regression met\n * while re-proving identity for a privileged action is if anything the more interesting of\n * the two. It is reachable only after signature verification, so it cannot be forged by\n * someone who merely knows a credential id.\n \n It does NOT change the refusal below: this branch already produces the deliberately\n * uniform `Passkey re-authentication failed`. Until 2026-09-08 a counter regression escaped\n * that uniformity — the library threw before the verifier returned, and the catch at the\n * end of this method wrapped it through `buildFromStandardError` as a generic error rather\n * than an AUTHENTICATION refusal. Returning `verified: false` instead of throwing is what\n * put it back on this path.\n */\n if (cloneSuspicion) {\n await this.auditLogsService.logUserPasskeyCloneSuspected({\n userId,\n credentialId: cloneSuspicion.credentialId,\n storedCounter: cloneSuspicion.storedCounter,\n receivedCounter: cloneSuspicion.receivedCounter,\n credentialDeviceType: cloneSuspicion.credentialDeviceType,\n credentialBackedUp: cloneSuspicion.credentialBackedUp,\n ...(cloneSuspicion.aaguid ? { aaguid: cloneSuspicion.aaguid } : {}),\n ceremony: cloneSuspicion.ceremony,\n ipAddress: ipAddress \|\| 'unknown',\n userAgent: userAgent \|\| 'unknown',\n }, ec);\n }\n\n if (!verified) {\n // Deliberately ONE refusal for every failure mode below the verifier — no challenge\n // outstanding, wrong credential, absent user verification, bad signature. Distinguishing\n // them here would tell an attacker which half of the ceremony to attack; the service logs\n // the specific cause.\n throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n context: { reason: 'Passkey re-authentication failed' },\n });\n }\n } else {\n throw this.errorBuilder.buildError(ErrorType.VALIDATION, undefined, {\n context: { reason: `Unsupported re-authentication method: ${method}` },\n });\n }\n\n const token = await this.consumableTokenService.createToken({\n tokenType: CoreConsumableTokenTypes.REAUTH,\n consumptionMode: ConsumableToken_ConsumptionMode.SINGLE_USE,\n expiresIn: { value: 5, unit: DurationUnit.MINUTES },\n userId: userId,\n resourceIdentifier: CoreResourceType.USERS,\n relatedId: userId,\n });\n\n return { reAuthToken: token.token };\n } catch (error) {\n if (isWildoBackendError(error)) throw error;\n throw this.errorBuilder.buildFromStandardError(error, undefined, {\n context: { reason: 'Failed to re-authenticate' },\n });\n }\n }\n\n // ==========================================================================\n // AUTH METHOD COUNTING (D9 Safety Check)\n // ==========================================================================\n\n public async countAuthMethods(\n ec: ExecutionContext<any>,\n userId: string,\n ): Promise<{ passwordCount: number; passkeyCount: number; identityLinkCount: number; total: number }> {\n const credentials = await this.credentialVerifier.resolveCredentials(ec, userId);\n\n const passwordCount = credentials?.passwordHash ? 1 : 0;\n const passkeyCount = credentials?.passkeyCredentials?.length ?? 0;\n\n const identityLinks = await this.servicesRegistryHandler.list<UserIdentityLink>(\n CoreResourceType.USER_IDENTITY_LINKS,\n ec,\n { userId },\n undefined,\n { paginated: false },\n ) as UserIdentityLink[];\n const identityLinkCount = identityLinks.length;\n\n return {\n passwordCount,\n passkeyCount,\n identityLinkCount,\n total: passwordCount + passkeyCount + identityLinkCount,\n };\n }\n}\n"]}

package/dist/esm/security/authentications/services/auth-methods/auth-registration.backend.service.d.ts CHANGED Viewed

@@ -18,6 +18,7 @@ import { AuthenticationOrchestratorBackendService } from '../../../../security/a
 import type { EmailVerificationInitiatorBackendService } from '../../../../security/authentications/services/email-verification-initiator.backend.service';
 import type { WebAuthnBackendService } from '../../../../security/authentications/services/auth-methods/webauthn.backend.service';
 import type { PublicKeyCredentialCreationOptionsJSON } from '@simplewebauthn/server';
+import { AuthMethod } from '@wildo-ai/saas-models';
 import type { AuthInvitationInfoResponse, InvitationAcceptCredentialMethod } from '@wildo-ai/saas-models';
 import type { ExecutionContext } from '../../../../runtime/models/execution-context.backend.schemas';
 export interface RegisterUserParams {
@@ -27,6 +28,14 @@ export interface RegisterUserParams {
     password?: string;
     /** W5.5: Org name provided during registration when orgNameSource is 'ask'. */
     organizationName?: string;
+    /**
+     * How the registrant will authenticate afterwards. Absent ⇒ {@link AuthMethod.PASSWORD}, which is
+     * what every caller meant before there was a choice (#463).
+     *
+     * Only a method the user type lists in `registration.allowedMethods` is accepted, and only
+     * PASSWORD, MAGIC_LINK and PASSKEY have a public-signup implementation.
+     */
+    method?: AuthMethod;
 }
 export interface RegisterUserContext {
     frontendUrl: string;
@@ -178,6 +187,38 @@ export declare class AuthRegistrationBackendService {
     /**
      * User registration.
      * Returns generic success on email collision (anti-enumeration).
+     *
+     * ## Password-less registration, and the three questions it owed (#463)
+     *
+     * `params.method` selects how the registrant will authenticate afterwards. PASSWORD is unchanged
+     * and is the default. MAGIC_LINK and PASSKEY create the account with NO credential and hand back a
+     * magic link; there is no session at signup, because nothing has been proven yet.
+     *
+     * **Verification.** The link IS the proof — clicking it establishes both the address and the first
+     * session, so a magic-link registration cannot reach an authenticated state without verifying. For
+     * PASSKEY this is the only available proof: a passkey attests possession of an authenticator and
+     * says nothing whatsoever about an email address, and enrolling one needs a session bound to a
+     * user, which public signup has no invitation token to stand in for. So a public passkey signup
+     * necessarily routes through the link.
+     *
+     * **Anti-enumeration.** Unchanged and load-bearing: an address already in use returns the same
+     * success response and sends nothing. The observable a magic-link signup adds — whether a mail
+     * arrives — is exactly the one the existing password flow already exposes through its verification
+     * mail, so the surface is not widened. No `userId` is returned for a password-less registration,
+     * which the password path does return under DEFERRED: handing an unauthenticated caller an
+     * identifier for an account they have not shown they own would be a new disclosure.
+     *
+     * **Recovery — the question this issue said to settle first, and the design answers it.** A
+     * passkey-only account that loses its authenticator is NOT locked out, because the account always
+     * has a proven address and the magic link is a standing way in. The registrant requests a link,
+     * signs in, and enrolls a replacement passkey through the authenticated route. No separate recovery
+     * mechanism was needed, and none was invented — which is the strongest form the answer could take,
+     * because a recovery path that exists only for one method is a path nobody maintains.
+     *
+     * The corollary is worth stating so it is not weakened later: **a passkey-only account must keep a
+     * usable email address**, and anything that would let an application disable magic links for a user
+     * type while allowing passkey registration would recreate the lockout. That pairing belongs in
+     * `registration.allowedMethods` validation the day such a switch exists.
      */
     registerUser(ec: ExecutionContext<any>, params: RegisterUserParams, ctx: RegisterUserContext): Promise<{
         messageRef: string;

package/dist/esm/security/authentications/services/auth-methods/auth-registration.backend.service.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"auth-registration.backend.service.d.ts","sourceRoot":"","sources":["../../../../../../../src/security/authentications/services/auth-methods/auth-registration.backend.service.ts"],"names":[],"mappings":"AAAA,OAAO,kBAAkB,CAAC;AAK1B,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,yEAAyE,CAAC;AAC/H,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAC7F,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAC9G,OAAO,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AAC/G,OAAO,EAAE,6BAA6B,EAAE,MAAM,yFAAyF,CAAC;AACxI,OAAO,KAAK,EAAE,yCAAyC,EAAE,MAAM,qGAAqG,CAAC;AACrK,OAAO,EAAE,oCAAoC,EAAE,MAAM,+FAA+F,CAAC;AACrJ,OAAO,EAAE,6BAA6B,EAAE,MAAM,wFAAwF,CAAC;AACvI,OAAO,EAAE,4BAA4B,EAAE,MAAM,6FAA6F,CAAC;AAC3I,OAAO,EAAE,gCAAgC,EAAE,MAAM,iGAAiG,CAAC;AAEnJ,OAAO,EAAE,+BAA+B,EAAE,MAAM,wGAAwG,CAAC;AACzJ,OAAO,EAAE,uBAAuB,EAAE,MAAM,gFAAgF,CAAC;AACzH,OAAO,KAAK,EAAE,qCAAqC,EAAE,MAAM,6FAA6F,CAAC;AACzJ,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,iFAAiF,CAAC;AAClI,OAAO,KAAK,EAAE,2CAA2C,EAAE,MAAM,yFAAyF,CAAC;AAiB3J,OAAO,EAAE,wCAAwC,EAAE,MAAM,kGAAkG,CAAC;AAC5J,OAAO,KAAK,EAAE,wCAAwC,EAAE,MAAM,mGAAmG,CAAC;AAClK,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,4FAA4F,CAAC;AACzI,OAAO,KAAK,EAAE,sCAAsC,EAAE,MAAM,wBAAwB,CAAC;~~AA6BrF~~,OAAO,KAAK,EAA4B,0BAA0B,EAAmB,gCAAgC,EAAE,MAAM,uBAAuB,CAAC;AAErJ,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qEAAqE,CAAC;AAE5G,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,+EAA+E;IAC/E,gBAAgB,CAAC,EAAE,MAAM,CAAC;~~CAC3B~~;AAED,MAAM,WAAW,mBAAmB;IAClC,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,uIAAuI;IACvI,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,wBAAwB;IACvC,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,sBAAsB;IACrC,eAAe,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,2FAA2F;IAC3F,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB;;;;;;;OAOG;IACH,gBAAgB,CAAC,EAAE,gCAAgC,CAAC;CACrD;AAED;;;;;GAKG;AACH,oBAAY,uBAAuB;IACjC,mGAAmG;IACnG,OAAO,YAAY;IACnB,uEAAuE;IACvE,eAAe,oBAAoB;CACpC;AAED,wEAAwE;AACxE,MAAM,WAAW,6BAA6B;IAC5C,OAAO,EAAE,uBAAuB,CAAC,OAAO,CAAC;IACzC,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,0BAA0B,CAAC,EAAE,MAAM,EAAE,CAAC;IACtC;;;;;OAKG;IACH,0BAA0B,CAAC,EAAE,sCAAsC,CAAC;CACrE;AAED;;;;;GAKG;AACH,MAAM,WAAW,+BAA+B;IAC9C,OAAO,EAAE,uBAAuB,CAAC,eAAe,CAAC;IACjD,iBAAiB,EAAE;QACjB,KAAK,EAAE,MAAM,CAAC;QACd,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,KAAK,EAAE,MAAM,CAAC;QACd,MAAM,EAAE,MAAM,CAAC;QACf,gBAAgB,CAAC,EAAE,MAAM,CAAC;KAC3B,CAAC;CACH;AAED,MAAM,MAAM,sBAAsB,GAAG,6BAA6B,GAAG,+BAA+B,CAAC;AAErG,0FAA0F;AAC1F,MAAM,WAAW,mBAAmB;IAClC,wFAAwF;IACxF,YAAY,EAAE,MAAM,CAAC;IACrB,cAAc,EAAE,MAAM,CAAC;IACvB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,qBACa,8BAA8B;IAIJ,OAAO,CAAC,QAAQ,CAAC,MAAM;IACV,OAAO,CAAC,QAAQ,CAAC,YAAY;IAChC,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IAC3B,OAAO,CAAC,QAAQ,CAAC,sBAAsB;IACvC,OAAO,CAAC,QAAQ,CAAC,kBAAkB;IAC1C,OAAO,CAAC,QAAQ,CAAC,WAAW;IACtB,OAAO,CAAC,QAAQ,CAAC,UAAU;IACvB,OAAO,CAAC,QAAQ,CAAC,kBAAkB;IACpC,OAAO,CAAC,QAAQ,CAAC,YAAY;IACrC,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IACnB,OAAO,CAAC,QAAQ,CAAC,uBAAuB;IACrC,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IAK/C,OAAO,CAAC,QAAQ,CAAC,mBAAmB;IAM5B,OAAO,CAAC,QAAQ,CAAC,aAAa;IAI1C,OAAO,CAAC,QAAQ,CAAC,eAAe;IAId,OAAO,CAAC,QAAQ,CAAC,0BAA0B;IAIpD,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IAEvF,OAAO,CAAC,QAAQ,CAAC,6BAA6B;IAvChD,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA+D;gBAGlC,MAAM,EAAE,aAAa,EACR,YAAY,EAAE,0BAA0B,EAC3C,gBAAgB,EAAE,uBAAuB,EACnC,sBAAsB,EAAE,6BAA6B,EACrD,kBAAkB,EAAE,oCAAoC,EAC/D,WAAW,EAAE,6BAA6B,EACpC,UAAU,EAAE,4BAA4B,EACpC,kBAAkB,EAAE,gCAAgC,EACrD,YAAY,EAAE,+BAA+B,EACrD,gBAAgB,EAAE,uBAAuB,EAC3B,uBAAuB,EAAE,qCAAqC,EAC3D,gBAAgB,EAAE,wCAAwC,EAKxE,mBAAmB,EAAE,0BAA0B,EAMvC,aAAa,EAAE,yCAAyC,EAIpE,eAAe,EAAE,sBAAsB,EAIrB,0BAA0B,EAAE,wCAAwC,EAI7E,iBAAiB,EAAE,+BAA+B,EAEvG,6BAA6B,EAC5C,2CAA2C;IAM/C;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACG,iBAAiB,CACrB,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACzB,eAAe,EAAE,MAAM,GACtB,OAAO,CAAC,0BAA0B,CAAC;IA4ItC~~;;;OAGG~~;IACG,YAAY,CAChB,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACzB,MAAM,EAAE,kBAAkB,EAC1B,GAAG,EAAE,mBAAmB,GACvB,OAAO,CAAC;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,eAAe,CAAC,EAAE,OAAO,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;~~IA8ZzO~~;;;;;OAKG;IACG,WAAW,CACf,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACzB,MAAM,EAAE,iBAAiB,GACxB,OAAO,CAAC;QACT,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,SAAS,EAAE,MAAM,CAAC;QAClB,KAAK,EAAE,MAAM,CAAC;QACd,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,iBAAiB,CAAC,EAAE,MAAM,CAAC;QAC3B,WAAW,CAAC,EAAE,OAAO,CAAC;QACtB,0BAA0B,CAAC,EAAE,MAAM,EAAE,CAAC;QACtC,gBAAgB,CAAC,EAAE,OAAO,CAAC;KAC5B,CAAC;IAmHF;;OAEG;IACG,uBAAuB,CAC3B,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACzB,MAAM,EAAE,wBAAwB,GAC/B,OAAO,CAAC;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IAiCnD;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACG,gBAAgB,CACpB,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACzB,MAAM,EAAE,sBAAsB,GAC7B,OAAO,CAAC,sBAAsB,CAAC;IAolBlC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAgCG;YACW,uBAAuB;IAkCrC;;;;;;;;;OASG;IACH,OAAO,CAAC,wCAAwC;~~IAiChD~~;;;;;;OAMG;YACW,mCAAmC;IAajD;;;;;;OAMG;IACG,gBAAgB,CACpB,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACzB,MAAM,EAAE;QACN,eAAe,EAAE,MAAM,CAAC;QACxB,eAAe,CAAC,EAAE,MAAM,CAAC;KAC1B,GACA,OAAO,CAAC;QAAE,QAAQ,EAAE,IAAI,CAAA;KAAE,CAAC;IAwE9B;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;YACW,4BAA4B;IA0B1C;;;;;;;;;;;;;OAaG;IACG,wBAAwB,CAC5B,GAAG,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAC1B,MAAM,EAAE;QAAE,YAAY,EAAE,MAAM,CAAA;KAAE,GAC/B,OAAO,CAAC,mBAAmB,EAAE,CAAC;IA+BjC;;;;;OAKG;IACG,kBAAkB,CACtB,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACzB,MAAM,EAAE;QAAE,YAAY,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,GACrD,OAAO,CAAC;QAAE,QAAQ,EAAE,IAAI,CAAC;QAAC,cAAc,EAAE,MAAM,CAAA;KAAE,CAAC;IA0DtD;;;;;OAKG;IACG,kBAAkB,CACtB,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACzB,MAAM,EAAE;QAAE,YAAY,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,eAAe,CAAC,EAAE,MAAM,CAAA;KAAE,GAC/E,OAAO,CAAC;QAAE,QAAQ,EAAE,IAAI,CAAC;QAAC,cAAc,EAAE,MAAM,CAAA;KAAE,CAAC;IAQtD;;;;;;;;;OASG;YACW,0BAA0B;IAgCxC;;;;OAIG;IACG,qBAAqB,CACzB,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACzB,MAAM,EAAE;QACN,SAAS,EAAE,MAAM,CAAC;QAClB,gBAAgB,EAAE,MAAM,CAAC;KAC1B,GACA,OAAO,CAAC;QACT,SAAS,EAAE,MAAM,CAAC;QAClB,KAAK,EAAE,MAAM,CAAC;QACd,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB,CAAC;CA6BH"}
1	+ {"version":3,"file":"auth-registration.backend.service.d.ts","sourceRoot":"","sources":["../../../../../../../src/security/authentications/services/auth-methods/auth-registration.backend.service.ts"],"names":[],"mappings":"AAAA,OAAO,kBAAkB,CAAC;AAK1B,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,yEAAyE,CAAC;AAC/H,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAC7F,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAC9G,OAAO,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AAC/G,OAAO,EAAE,6BAA6B,EAAE,MAAM,yFAAyF,CAAC;AACxI,OAAO,KAAK,EAAE,yCAAyC,EAAE,MAAM,qGAAqG,CAAC;AACrK,OAAO,EAAE,oCAAoC,EAAE,MAAM,+FAA+F,CAAC;AACrJ,OAAO,EAAE,6BAA6B,EAAE,MAAM,wFAAwF,CAAC;AACvI,OAAO,EAAE,4BAA4B,EAAE,MAAM,6FAA6F,CAAC;AAC3I,OAAO,EAAE,gCAAgC,EAAE,MAAM,iGAAiG,CAAC;AAEnJ,OAAO,EAAE,+BAA+B,EAAE,MAAM,wGAAwG,CAAC;AACzJ,OAAO,EAAE,uBAAuB,EAAE,MAAM,gFAAgF,CAAC;AACzH,OAAO,KAAK,EAAE,qCAAqC,EAAE,MAAM,6FAA6F,CAAC;AACzJ,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,iFAAiF,CAAC;AAClI,OAAO,KAAK,EAAE,2CAA2C,EAAE,MAAM,yFAAyF,CAAC;AAiB3J,OAAO,EAAE,wCAAwC,EAAE,MAAM,kGAAkG,CAAC;AAC5J,OAAO,KAAK,EAAE,wCAAwC,EAAE,MAAM,mGAAmG,CAAC;AAClK,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,4FAA4F,CAAC;AACzI,OAAO,KAAK,EAAE,sCAAsC,EAAE,MAAM,wBAAwB,CAAC;AAErF,OAAO,EAUL,UAAU,EAgBX,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EAA4B,0BAA0B,EAAmB,gCAAgC,EAAE,MAAM,uBAAuB,CAAC;AAErJ,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qEAAqE,CAAC;AAE5G,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,+EAA+E;IAC/E,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;;;;;OAMG;IACH,MAAM,CAAC,EAAE,UAAU,CAAC;CACrB;AAED,MAAM,WAAW,mBAAmB;IAClC,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,uIAAuI;IACvI,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,wBAAwB;IACvC,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,sBAAsB;IACrC,eAAe,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,2FAA2F;IAC3F,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB;;;;;;;OAOG;IACH,gBAAgB,CAAC,EAAE,gCAAgC,CAAC;CACrD;AAED;;;;;GAKG;AACH,oBAAY,uBAAuB;IACjC,mGAAmG;IACnG,OAAO,YAAY;IACnB,uEAAuE;IACvE,eAAe,oBAAoB;CACpC;AAED,wEAAwE;AACxE,MAAM,WAAW,6BAA6B;IAC5C,OAAO,EAAE,uBAAuB,CAAC,OAAO,CAAC;IACzC,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,0BAA0B,CAAC,EAAE,MAAM,EAAE,CAAC;IACtC;;;;;OAKG;IACH,0BAA0B,CAAC,EAAE,sCAAsC,CAAC;CACrE;AAED;;;;;GAKG;AACH,MAAM,WAAW,+BAA+B;IAC9C,OAAO,EAAE,uBAAuB,CAAC,eAAe,CAAC;IACjD,iBAAiB,EAAE;QACjB,KAAK,EAAE,MAAM,CAAC;QACd,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,KAAK,EAAE,MAAM,CAAC;QACd,MAAM,EAAE,MAAM,CAAC;QACf,gBAAgB,CAAC,EAAE,MAAM,CAAC;KAC3B,CAAC;CACH;AAED,MAAM,MAAM,sBAAsB,GAAG,6BAA6B,GAAG,+BAA+B,CAAC;AAErG,0FAA0F;AAC1F,MAAM,WAAW,mBAAmB;IAClC,wFAAwF;IACxF,YAAY,EAAE,MAAM,CAAC;IACrB,cAAc,EAAE,MAAM,CAAC;IACvB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,qBACa,8BAA8B;IAIJ,OAAO,CAAC,QAAQ,CAAC,MAAM;IACV,OAAO,CAAC,QAAQ,CAAC,YAAY;IAChC,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IAC3B,OAAO,CAAC,QAAQ,CAAC,sBAAsB;IACvC,OAAO,CAAC,QAAQ,CAAC,kBAAkB;IAC1C,OAAO,CAAC,QAAQ,CAAC,WAAW;IACtB,OAAO,CAAC,QAAQ,CAAC,UAAU;IACvB,OAAO,CAAC,QAAQ,CAAC,kBAAkB;IACpC,OAAO,CAAC,QAAQ,CAAC,YAAY;IACrC,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IACnB,OAAO,CAAC,QAAQ,CAAC,uBAAuB;IACrC,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IAK/C,OAAO,CAAC,QAAQ,CAAC,mBAAmB;IAM5B,OAAO,CAAC,QAAQ,CAAC,aAAa;IAI1C,OAAO,CAAC,QAAQ,CAAC,eAAe;IAId,OAAO,CAAC,QAAQ,CAAC,0BAA0B;IAIpD,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IAEvF,OAAO,CAAC,QAAQ,CAAC,6BAA6B;IAvChD,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA+D;gBAGlC,MAAM,EAAE,aAAa,EACR,YAAY,EAAE,0BAA0B,EAC3C,gBAAgB,EAAE,uBAAuB,EACnC,sBAAsB,EAAE,6BAA6B,EACrD,kBAAkB,EAAE,oCAAoC,EAC/D,WAAW,EAAE,6BAA6B,EACpC,UAAU,EAAE,4BAA4B,EACpC,kBAAkB,EAAE,gCAAgC,EACrD,YAAY,EAAE,+BAA+B,EACrD,gBAAgB,EAAE,uBAAuB,EAC3B,uBAAuB,EAAE,qCAAqC,EAC3D,gBAAgB,EAAE,wCAAwC,EAKxE,mBAAmB,EAAE,0BAA0B,EAMvC,aAAa,EAAE,yCAAyC,EAIpE,eAAe,EAAE,sBAAsB,EAIrB,0BAA0B,EAAE,wCAAwC,EAI7E,iBAAiB,EAAE,+BAA+B,EAEvG,6BAA6B,EAC5C,2CAA2C;IAM/C;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACG,iBAAiB,CACrB,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACzB,eAAe,EAAE,MAAM,GACtB,OAAO,CAAC,0BAA0B,CAAC;IA4ItC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAmCG;IACG,YAAY,CAChB,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACzB,MAAM,EAAE,kBAAkB,EAC1B,GAAG,EAAE,mBAAmB,GACvB,OAAO,CAAC;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,eAAe,CAAC,EAAE,OAAO,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAuhBzO;;;;;OAKG;IACG,WAAW,CACf,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACzB,MAAM,EAAE,iBAAiB,GACxB,OAAO,CAAC;QACT,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,SAAS,EAAE,MAAM,CAAC;QAClB,KAAK,EAAE,MAAM,CAAC;QACd,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,iBAAiB,CAAC,EAAE,MAAM,CAAC;QAC3B,WAAW,CAAC,EAAE,OAAO,CAAC;QACtB,0BAA0B,CAAC,EAAE,MAAM,EAAE,CAAC;QACtC,gBAAgB,CAAC,EAAE,OAAO,CAAC;KAC5B,CAAC;IAmHF;;OAEG;IACG,uBAAuB,CAC3B,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACzB,MAAM,EAAE,wBAAwB,GAC/B,OAAO,CAAC;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IAiCnD;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACG,gBAAgB,CACpB,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACzB,MAAM,EAAE,sBAAsB,GAC7B,OAAO,CAAC,sBAAsB,CAAC;IAolBlC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAgCG;YACW,uBAAuB;IAkCrC;;;;;;;;;OASG;IACH,OAAO,CAAC,wCAAwC;IAkEhD;;;;;;OAMG;YACW,mCAAmC;IAajD;;;;;;OAMG;IACG,gBAAgB,CACpB,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACzB,MAAM,EAAE;QACN,eAAe,EAAE,MAAM,CAAC;QACxB,eAAe,CAAC,EAAE,MAAM,CAAC;KAC1B,GACA,OAAO,CAAC;QAAE,QAAQ,EAAE,IAAI,CAAA;KAAE,CAAC;IAwE9B;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;YACW,4BAA4B;IA0B1C;;;;;;;;;;;;;OAaG;IACG,wBAAwB,CAC5B,GAAG,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAC1B,MAAM,EAAE;QAAE,YAAY,EAAE,MAAM,CAAA;KAAE,GAC/B,OAAO,CAAC,mBAAmB,EAAE,CAAC;IA+BjC;;;;;OAKG;IACG,kBAAkB,CACtB,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACzB,MAAM,EAAE;QAAE,YAAY,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,GACrD,OAAO,CAAC;QAAE,QAAQ,EAAE,IAAI,CAAC;QAAC,cAAc,EAAE,MAAM,CAAA;KAAE,CAAC;IA0DtD;;;;;OAKG;IACG,kBAAkB,CACtB,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACzB,MAAM,EAAE;QAAE,YAAY,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,eAAe,CAAC,EAAE,MAAM,CAAA;KAAE,GAC/E,OAAO,CAAC;QAAE,QAAQ,EAAE,IAAI,CAAC;QAAC,cAAc,EAAE,MAAM,CAAA;KAAE,CAAC;IAQtD;;;;;;;;;OASG;YACW,0BAA0B;IAgCxC;;;;OAIG;IACG,qBAAqB,CACzB,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACzB,MAAM,EAAE;QACN,SAAS,EAAE,MAAM,CAAC;QAClB,gBAAgB,EAAE,MAAM,CAAC;KAC1B,GACA,OAAO,CAAC;QACT,SAAS,EAAE,MAAM,CAAC;QAClB,KAAK,EAAE,MAAM,CAAC;QACd,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB,CAAC;CA6BH"}

package/dist/esm/security/authentications/services/auth-methods/auth-registration.backend.service.js CHANGED Viewed

@@ -242,9 +242,59 @@ let AuthRegistrationBackendService = class AuthRegistrationBackendService {
     /**
      * User registration.
      * Returns generic success on email collision (anti-enumeration).
+     *
+     * ## Password-less registration, and the three questions it owed (#463)
+     *
+     * `params.method` selects how the registrant will authenticate afterwards. PASSWORD is unchanged
+     * and is the default. MAGIC_LINK and PASSKEY create the account with NO credential and hand back a
+     * magic link; there is no session at signup, because nothing has been proven yet.
+     *
+     * **Verification.** The link IS the proof — clicking it establishes both the address and the first
+     * session, so a magic-link registration cannot reach an authenticated state without verifying. For
+     * PASSKEY this is the only available proof: a passkey attests possession of an authenticator and
+     * says nothing whatsoever about an email address, and enrolling one needs a session bound to a
+     * user, which public signup has no invitation token to stand in for. So a public passkey signup
+     * necessarily routes through the link.
+     *
+     * **Anti-enumeration.** Unchanged and load-bearing: an address already in use returns the same
+     * success response and sends nothing. The observable a magic-link signup adds — whether a mail
+     * arrives — is exactly the one the existing password flow already exposes through its verification
+     * mail, so the surface is not widened. No `userId` is returned for a password-less registration,
+     * which the password path does return under DEFERRED: handing an unauthenticated caller an
+     * identifier for an account they have not shown they own would be a new disclosure.
+     *
+     * **Recovery — the question this issue said to settle first, and the design answers it.** A
+     * passkey-only account that loses its authenticator is NOT locked out, because the account always
+     * has a proven address and the magic link is a standing way in. The registrant requests a link,
+     * signs in, and enrolls a replacement passkey through the authenticated route. No separate recovery
+     * mechanism was needed, and none was invented — which is the strongest form the answer could take,
+     * because a recovery path that exists only for one method is a path nobody maintains.
+     *
+     * The corollary is worth stating so it is not weakened later: **a passkey-only account must keep a
+     * usable email address**, and anything that would let an application disable magic links for a user
+     * type while allowing passkey registration would recreate the lockout. That pairing belongs in
+     * `registration.allowedMethods` validation the day such a switch exists.
      */
     async registerUser(ec, params, ctx) {
         const { email, firstName, lastName, password, organizationName } = params;
+        /*
+         * PASSWORD when unstated — every caller predating #463 meant that, and defaulting keeps a
+         * registration that omits the field behaving exactly as it did.
+         */
+        const method = params.method ?? AuthMethod.PASSWORD;
+        /*
+         * MAGIC_LINK and PASSKEY both establish the account WITHOUT a local credential and prove the
+         * address by a link the registrant must click. So neither can issue a session at signup — there
+         * is nothing yet to authenticate — and both are handled by one branch below.
+         *
+         * PASSKEY is that branch plus an enrollment step, and the reason is worth stating because it was
+         * the design question this issue said to settle first: a passkey proves possession of an
+         * authenticator and says NOTHING about an email address, and enrolling one needs a session bound
+         * to a user. Public signup has no invitation token to stand in for that proof. So a passkey
+         * registration necessarily routes through an address proof, which is the magic link — and that
+         * is also what answers the recovery question, below.
+         */
+        const isPasswordlessMethod = method === AuthMethod.MAGIC_LINK || method === AuthMethod.PASSKEY;
         const { frontendUrl, ipAddress, userAgent, frontendServiceName, activeUserType } = ctx;
         const successResponse = this.authResponseHelper.getAuthResponse(AuthResponseMessageRef.REGISTRATION_SUCCESS);
         this.logDebug('Registration attempt', { email, activeUserType });
@@ -360,29 +410,38 @@ let AuthRegistrationBackendService = class AuthRegistrationBackendService {
             });
         }
         const allowedMethods = registrationConfig.allowedMethods;
-        if (!allowedMethods.includes(AuthMethod.PASSWORD)) {
+        // The requested method, not a hardcoded PASSWORD. An application that lists only MAGIC_LINK now
+        // refuses a password signup, which is the point of the list.
+        if (!allowedMethods.includes(method)) {
             throw this.errorBuilder.buildError(ErrorType.AUTHORIZATION, undefined, {
                 customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_METHOD_NOT_SUPPORTED,
-                context: { method: AuthMethod.PASSWORD, allowedMethods },
+                context: { method, allowedMethods },
             });
         }
-        if (!password) {
-            throw this.errorBuilder.buildError(ErrorType.VALIDATION, undefined, {
-                customMessageReference: ErrorCustomMessageReference.REGISTRATION_PASSWORD_REQUIRED,
-            });
-        }
-        const passwordPolicy = userTypeAuthPolicy?.passwordPolicy;
-        const policyValidation = this.credentialVerifier.validatePasswordPolicy(password, passwordPolicy);
-        if (!policyValidation.valid) {
-            throw this.errorBuilder.buildError(ErrorType.VALIDATION, undefined, {
-                customMessageReference: ErrorCustomMessageReference
-                    .VALIDATION_PASSWORD_POLICY_VIOLATION,
-                context: {
-                    violations: policyValidation.violations,
-                    minLength: passwordPolicy?.minLength,
-                    maxLength: passwordPolicy?.maxLength,
-                },
-            });
+        /*
+         * The credential the method requires, and ONLY for the method that requires one. A password sent
+         * alongside `method: MAGIC_LINK` is ignored rather than refused: the registrant's client may
+         * carry a stale field, and refusing would fail a signup for a value that changes nothing.
+         */
+        if (method === AuthMethod.PASSWORD) {
+            if (!password) {
+                throw this.errorBuilder.buildError(ErrorType.VALIDATION, undefined, {
+                    customMessageReference: ErrorCustomMessageReference.REGISTRATION_PASSWORD_REQUIRED,
+                });
+            }
+            const passwordPolicy = userTypeAuthPolicy?.passwordPolicy;
+            const policyValidation = this.credentialVerifier.validatePasswordPolicy(password, passwordPolicy);
+            if (!policyValidation.valid) {
+                throw this.errorBuilder.buildError(ErrorType.VALIDATION, undefined, {
+                    customMessageReference: ErrorCustomMessageReference
+                        .VALIDATION_PASSWORD_POLICY_VIOLATION,
+                    context: {
+                        violations: policyValidation.violations,
+                        minLength: passwordPolicy?.minLength,
+                        maxLength: passwordPolicy?.maxLength,
+                    },
+                });
+            }
         }
         const existing = await this.userLookup.findUserByEmail(ec, email);
         if (existing) {
@@ -400,10 +459,37 @@ let AuthRegistrationBackendService = class AuthRegistrationBackendService {
                 }
             }
         }
-        const passwordHash = await this.credentialVerifier.hashPassword(password, config.auth.passwordHashing);
-        // W2.6: Email verification mode — DEFERRED creates user as ACTIVE immediately
+        // Undefined for a password-less method, which the persistence request already understands:
+        // `includeCredentials: passwordHash !== undefined` below was written for exactly this shape.
+        const passwordHash = method === AuthMethod.PASSWORD && password
+            ? await this.credentialVerifier.hashPassword(password, config.auth.passwordHashing)
+            : undefined;
+        // W2.6: Email verification mode — DEFERRED creates user as ACTIVE immediately.
         const isDeferredVerification = registrationConfig.emailVerification === EmailVerificationMode.DEFERRED;
-        const initialStatus = isDeferredVerification ? UserStatus.ACTIVE : UserStatus.PENDING_VERIFICATION;
+        /*
+         * A PASSWORD-LESS registrant is created ACTIVE whatever the verification mode says, and the
+         * status is what makes the flow work at all (#463).
+         *
+         * `verifyMagicLink` REFUSES any non-ACTIVE user (generically, as an invalid link — the status is
+         * recorded in the audit trail rather than told to the caller). So a magic-link or passkey
+         * registrant created `PENDING_VERIFICATION` would be sent a link that is rejected the moment they
+         * click it — an account reachable by nobody, created by the flow meant to reach it. The
+         * invitation-accept path already does exactly this: it ACTIVATES the invitee and only then mints
+         * the link.
+         *
+         * ACTIVE here does not mean "access granted". A password-less account holds no credential, so
+         * possession of the emailed link is the ONLY way in, and clicking it is what proves the address.
+         * The status gate and the verification gate are not the same gate, and conflating them is what
+         * makes this look wrong at first glance.
+         *
+         * Recorded because the first version of this code had it exactly inverted — it forced
+         * `PENDING_VERIFICATION` reasoning that "an ACTIVE account with an unproven address is worse",
+         * which reads well and would have shipped a flow that could not complete.
+         */
+        const initialStatusForMethod = isPasswordlessMethod
+            ? UserStatus.ACTIVE
+            : (isDeferredVerification ? UserStatus.ACTIVE : UserStatus.PENDING_VERIFICATION);
+        const initialStatus = initialStatusForMethod;
         // W3.4: Resolve userTypes and defaultAppRoles from the active user type definition
         const userTypes = activeUserType ? [activeUserType] : [];
         const userTypeDefinition = activeUserType
@@ -514,7 +600,10 @@ let AuthRegistrationBackendService = class AuthRegistrationBackendService {
         }
         // W2.6: Only send verification email when emailVerification !== DEFERRED. Delegated to the
         // shared initiator (one implementation across registration / resend / SCIM provisioning).
-        if (!isDeferredVerification) {
+        // Not for a password-less registration: the magic link below IS the address proof, and a second
+        // "confirm your address" mail arriving beside it asks the registrant to do the same thing twice
+        // through a link that grants less.
+        if (!isDeferredVerification && !isPasswordlessMethod) {
             await this.emailVerificationInitiator.sendVerificationEmail({
                 userId: newUser._id,
                 email: newUser.email,
@@ -523,6 +612,64 @@ let AuthRegistrationBackendService = class AuthRegistrationBackendService {
             });
         }
         this.auditLogsService.logUserRegistered({ userId: newUser._id, email: newUser.email, ipAddress, userAgent }, ec).catch(() => { });
+        /*
+         * PASSWORD-LESS REGISTRATION (#463) — the account exists, holds no credential, and its address is
+         * still unproven. A magic link is what closes both: clicking it proves the address AND
+         * establishes the first session.
+         *
+         * No session, no tokens and no `userId` are returned. That is not caution, it is the only honest
+         * answer: nothing has been proven yet, and returning a `userId` here would hand an unauthenticated
+         * caller a fact about an account they have not shown they own.
+         *
+         * No separate verification mail is sent: this link IS the address proof, and a second "confirm
+         * your address" message beside it would ask the registrant to do the same thing twice through a
+         * link that grants less.
+         */
+        if (isPasswordlessMethod) {
+            /*
+             * PASSKEY only: the WebAuthn challenge and the later verify both require a USER_CREDENTIALS row
+             * to exist, and a brand-new registrant has none. Provisioned here for the same reason and in the
+             * same non-fatal way as the invitation-accept path — a failure must not strand an account that
+             * has already been created, and the registrant can still enroll later through the authenticated
+             * route once the magic link has let them in.
+             */
+            if (method === AuthMethod.PASSKEY) {
+                try {
+                    await this._ensurePasswordlessCredentialRecord(ec, newUser._id);
+                }
+                catch (error) {
+                    this.logger.error('Password-less credential row provisioning failed at passkey registration (non-fatal)', {
+                        userId: newUser._id,
+                        ...projectCaughtErrorLogFields(error),
+                    });
+                }
+            }
+            /*
+             * `skipGlobalEnablementCheck: true`, for the reason the invitation path records: the method was
+             * already authorized above against this user type's own `registration.allowedMethods`, and we
+             * are PAST the account creation. Re-rejecting on `sendMagicLink`'s coarser base-policy gate
+             * would strand an account that now exists and has no other way in.
+             */
+            const magic = await this.authOrchestrator.sendMagicLink(ec, { email: newUser.email }, { ipAddress, userAgent }, true);
+            this.logDebug('Password-less registration completed — magic link minted for delivery', {
+                userId: newUser._id,
+                method,
+                // Diagnostic only: an absent token is the anti-enumeration no-op, which cannot happen for an
+                // account we have just created and activated-by-construction, so its absence is worth seeing.
+                hasToken: Boolean(magic.token),
+            });
+            return {
+                ...successResponse,
+                /*
+                 * The registrant's next act differs by method and the client cannot infer it: a magic-link
+                 * signup is finished once they click, a passkey signup has an enrollment step waiting on the
+                 * other side of the same click.
+                 */
+                nextStep: method === AuthMethod.PASSKEY
+                    ? AuthNextStep.PASSKEY_ENROLLMENT
+                    : AuthNextStep.MAGIC_LINK_SENT,
+            };
+        }
         // F7 fix: When email verification is deferred, the user is ACTIVE immediately.
         // Process through the registration pipeline (MFA check, etc.) and issue tokens
         // so the user can start using the app without a separate login step.
@@ -1319,6 +1466,38 @@ let AuthRegistrationBackendService = class AuthRegistrationBackendService {
             : new Set();
         const registrationMethodAllowed = credentialMethod !== AuthMethod.PASSWORD
             || resolvedPolicy?.registration.allowedMethods.includes(AuthMethod.PASSWORD) === true;
+        /*
+         * An UNRESOLVABLE policy and a DISABLED method are different faults, and they must not share a
+         * message (#388).
+         *
+         * When no user type resolves for the organization being joined, `resolvedPolicy` is null and the
+         * enabled set is EMPTY — so every method fails the check below identically, and reporting that as
+         * `AUTHENTICATION_METHOD_NOT_SUPPORTED` names the one thing that is NOT the cause. Measured: an
+         * application whose `userTypes.member` enabled PASSWORD *and* listed it in
+         * `registration.allowedMethods` was refused for PASSWORD, MAGIC_LINK and PASSKEY alike, because
+         * it declared no `organizationTypes` at all. Three methods were tried before anyone looked one
+         * level up, and the first written diagnosis was a false claim that the application had no auth
+         * policy.
+         *
+         * The refusal itself is unchanged and still fail-closed — an unresolvable policy must never
+         * silently permit a method. Only the DIAGNOSTIC is split, so the message names the missing
+         * declaration rather than the method that could never have satisfied it.
+         */
+        if (!resolvedPolicy) {
+            throw this.errorBuilder.buildError(ErrorType.AUTHORIZATION, undefined, {
+                customMessageReference: ErrorCustomMessageReference.INVITATION_ORGANIZATION_TYPE_UNRESOLVED,
+                context: {
+                    // Diagnostic (log-only): AUTHORIZATION strips non-allowlisted context at the wire.
+                    organizationId,
+                    orgType,
+                    resolutionUserType,
+                    method: credentialMethod,
+                    hint: orgType
+                        ? 'No user type resolved for this organization type. Declare `organizationTypes[<orgType>].userTypes` in the application configuration.'
+                        : 'The organization carries no `type`, so no organization-type entry could be looked up. Set the organization type, and declare `organizationTypes` in the application configuration.',
+                },
+            });
+        }
         if (!registrationMethodAllowed
             || !enabledMethods.has(credentialMethod)) {
             throw this.errorBuilder.buildError(ErrorType.AUTHORIZATION, undefined, {