@wildo-ai/saas-backend-lib 1.1.2 → 1.1.3

package/dist/esm/security/authentications/services/oauth-provider-token.backend.service.js

@@ -20,6 +20,7 @@ import { describeCaughtError, projectCaughtErrorLogFields } from '../../../error
 import { MachineTokenIssuerBackendService } from '../../../security/authentications/services/machine-token-issuer.backend.service.js';
 import { hashOAuthClientSecret } from '../../../security/oauth-clients/oauth-client-generation.backend.utils.js';
 import { extractRefreshTokenReuseSignal } from '../../../security/authentications/services/auth-token-issuer.backend.service.js';
+import { resolveActiveMemberOrgIds } from '../../../security/authentications/services/resolve-active-member-orgs.backend.utils.js';
 import { ApiKeyScope, CoreResourceOperation, CoreResourceType, DELEGATED_TOKEN_RESOURCE_SERVERS, MACHINE_TOKEN_RESOURCE_SERVERS, ErrorCustomMessageReference, ErrorType, ExecutionContext_ExecutionType, MachineAuthMethod, OAuthClientStatus, OAuthGrantType, ResourcePrimaryScope, UserStatus, } from '@wildo-ai/saas-models';
 import { JwtClaim_App_Auth_UserRequest_Schema } from '../../../security/authentications/models/authentications.backend.schemas.js';
 import { isRotationGraceWindowOpen, isCredentialExpired } from '../../../security/credential-rotation-grace.backend.utils.js';
@@ -276,17 +277,35 @@ let OAuthProviderTokenBackendService = class OAuthProviderTokenBackendService {
         // assurance-control: WILDO.IDENTITY.DELEGATED_AUTHORIZATION — issuing a delegated token grants a
         // third-party client the ability to act AS the user (the most security-sensitive access grant the
         // provider makes). Emit the audit/SIEM record (subject, client/azp, audience, granted scopes, TTL).
-        // Fire-and-forget: auditing must never block or fail token issuance. No request EC / verified org at
-        // this mint (the token is not itself an authenticated request), so per-org SIEM dispatch is omitted —
-        // the DB store + Layer-2 immudb sink still record it.
+        // Fire-and-forget: auditing must never block or fail token issuance.
+        //
+        // SIEM-3 (F4 tenant-segregation routing) — the routing org comes from the SUBJECT, not the request.
+        // There is genuinely no authenticated request EC at a token MINT (the client has just redeemed a
+        // code; the token it is being handed is not itself an authenticated request), so the 2nd arg stays
+        // `undefined` and, without the 3rd, this — the provider's most sensitive grant — reached the DB
+        // store and the app-level sinks but NEVER the customer's own security sink. `grant.userId` is
+        // resolved by `exchangeAuthorizationCode` off the STORED authorization code, so it is token-bound
+        // and can never be a caller-supplied value; that is exactly the provenance the magic-link and
+        // first-party-refresh paths already route on, and `_resolveSubjectRoutingOrgIds` turns it into
+        // VERIFIED ACTIVE memberships read as SYSTEM. A delegated grant therefore reaches precisely the
+        // tenants whose data the minted token can act on, which is the F4 question.
+        //
+        // D3/H-20: the DELEGATING CLIENT's own org is deliberately NOT a routing target. The token carries
+        // the USER's authority and the client is only `azp`, so a client registered in org A completing the
+        // flow for a user of org B must not thereby publish that user's grant into org A's SIEM feed.
         const auditLogsForDelegated = this.container.get(SAAS_SERVICE_TYPES.AuditLogsService);
-        void auditLogsForDelegated.logOAuthDelegatedTokenIssued({
-            userId: grant.userId,
-            clientId: grant.clientId,
-            audience: requestedAudience,
-            scopes: grant.scope,
-            ttlSeconds: expiresIn,
-        }).catch((auditError) => this.logger.warn('OAUTH_DELEGATED_TOKEN_ISSUED audit emit failed (non-fatal)', {
+        void (async () => {
+            // Resolved INSIDE the fire-and-forget block: a membership read must never add latency to the
+            // mint, and its failure mode (fail-closed to `[]`) must never reach the token response.
+            const delegatedRoutingOrgIds = await this._resolveSubjectRoutingOrgIds(grant.userId);
+            await auditLogsForDelegated.logOAuthDelegatedTokenIssued({
+                userId: grant.userId,
+                clientId: grant.clientId,
+                audience: requestedAudience,
+                scopes: grant.scope,
+                ttlSeconds: expiresIn,
+            }, undefined, delegatedRoutingOrgIds);
+        })().catch((auditError) => this.logger.warn('OAUTH_DELEGATED_TOKEN_ISSUED audit emit failed (non-fatal)', {
             ...projectCaughtErrorLogFields(auditError),
         }));
         this.logger.debug('Issued authorization_code (user-delegated) token', {
@@ -364,15 +383,23 @@ let OAuthProviderTokenBackendService = class OAuthProviderTokenBackendService {
             // A routine expired/revoked/invalid refresh carries NO signal ⇒ no event (deliberate anti-flood: the
             // security-relevant refresh failure is theft, not routine session expiry). Fire-and-forget.
             // assurance-control: WILDO.IDENTITY.CREDENTIAL_LIFECYCLE — credential-theft detection + response.
+            // SIEM-3 (F4): routed to the VICTIM's verified member orgs, exactly as the first-party refresh
+            // endpoint already does (`authentication-controller.backend.service.ts` refreshToken). This is
+            // credential-THEFT detection — the single event a customer's SOC most needs in its own feed —
+            // and the two refresh surfaces share one issuer, so they must not disagree about who sees it.
+            // `reuseSignal.userId` is read off the STORED token family by the issuer, never off the request.
             const reuseSignal = extractRefreshTokenReuseSignal(refreshError);
             if (reuseSignal) {
                 const auditLogsForReuse = this.container.get(SAAS_SERVICE_TYPES.AuditLogsService);
-                void auditLogsForReuse.logUserRefreshTokenReuseDetected({
-                    userId: reuseSignal.userId,
-                    reusedJti: reuseSignal.reusedJti,
-                    sessionId: reuseSignal.sessionId,
-                    familyRevoked: reuseSignal.familyRevoked,
-                }).catch((auditError) => this.logger.warn('USER_REFRESH_TOKEN_REUSE_DETECTED audit emit failed (non-fatal)', {
+                void (async () => {
+                    const reuseRoutingOrgIds = await this._resolveSubjectRoutingOrgIds(reuseSignal.userId);
+                    await auditLogsForReuse.logUserRefreshTokenReuseDetected({
+                        userId: reuseSignal.userId,
+                        reusedJti: reuseSignal.reusedJti,
+                        sessionId: reuseSignal.sessionId,
+                        familyRevoked: reuseSignal.familyRevoked,
+                    }, undefined, reuseRoutingOrgIds);
+                })().catch((auditError) => this.logger.warn('USER_REFRESH_TOKEN_REUSE_DETECTED audit emit failed (non-fatal)', {
                     ...projectCaughtErrorLogFields(auditError),
                 }));
             }
@@ -406,13 +433,30 @@ let OAuthProviderTokenBackendService = class OAuthProviderTokenBackendService {
         // A-4: audit the SUCCESSFUL provider refresh grant. Low-detail INFO — the security-relevant refresh
         // failure (theft/reuse) is audited via A-9 above; routine failures are intentionally not audited.
         // assurance-control: WILDO.IDENTITY.CREDENTIAL_LIFECYCLE — token lifecycle (refresh). Fire-and-forget.
+        //
+        // SIEM-3 (F4): routed on `refreshedUserId`, which is read back from OUR OWN freshly-minted access
+        // token — server-minted, so token-bound rather than caller-claimed.
+        //
+        // NOT ROUTED on the FIRST-PARTY branch (no `clientId`+`clientSecret`), and that is a decision rather
+        // than an oversight. That branch deliberately performs no JWT verify (`AuthTokens` carries no
+        // subject, and the verify exists only to mint the OIDC §12.2 id_token), so the event has no subject
+        // at all — neither in `routingOrgIds` NOR in its own `userId` data field. Routing an org-anonymous
+        // "a token was refreshed" row into a tenant's SIEM would add noise carrying no attribution, so the
+        // honest ordering is: make the event ATTRIBUTABLE first (a verify inside this fire-and-forget block
+        // would do it, at the cost of retiring the "a first-party refresh performs no verify" pin), and
+        // route it in the same change. Until then the DB store + Layer-2 sinks remain its only record —
+        // and note the first-party refresh ENDPOINT (`/auth/refresh-token`) already audits with a subject
+        // and routes, so nothing is lost for the ordinary session-refresh journey.
         const clientAuthenticated = Boolean(clientId && clientSecret);
         const auditLogsForRefresh = this.container.get(SAAS_SERVICE_TYPES.AuditLogsService);
-        void auditLogsForRefresh.logOAuthTokenRefreshed({
-            userId: refreshedUserId,
-            clientId: clientAuthenticated ? clientId : undefined,
-            clientAuthenticated,
-        }).catch((auditError) => this.logger.warn('OAUTH_TOKEN_REFRESHED audit emit failed (non-fatal)', {
+        void (async () => {
+            const refreshRoutingOrgIds = await this._resolveSubjectRoutingOrgIds(refreshedUserId);
+            await auditLogsForRefresh.logOAuthTokenRefreshed({
+                userId: refreshedUserId,
+                clientId: clientAuthenticated ? clientId : undefined,
+                clientAuthenticated,
+            }, undefined, refreshRoutingOrgIds);
+        })().catch((auditError) => this.logger.warn('OAUTH_TOKEN_REFRESHED audit emit failed (non-fatal)', {
             ...projectCaughtErrorLogFields(auditError),
         }));
         return {
@@ -440,6 +484,52 @@ let OAuthProviderTokenBackendService = class OAuthProviderTokenBackendService {
             this.logger.debug('Token revocation on a non-revocable token treated as success (RFC 7009)', { reason: describeCaughtError(error) });
         }
     }
+    /**
+     * F4 per-org SIEM routing for a provider event whose only trustworthy tenant anchor is the
+     * TOKEN-BOUND SUBJECT.
+     *
+     * Every emit on this service happens at a token MINT or ROTATION, where there is no authenticated
+     * request execution context — the caller has just presented a credential, and the token it is about
+     * to receive is not itself an authenticated request. So the routing org can never come from the
+     * request, and passing nothing left the provider's most sensitive events (a delegated grant, a
+     * detected credential theft) reaching the DB store and the app-level sinks but never a customer's
+     * own security sink.
+     *
+     * The subject is the answer, and only because of WHERE it comes from: each caller passes a user id
+     * the SERVER resolved — off the stored authorization code, off the stored refresh-token family, or
+     * off a token this process just minted and verified — never a value the caller wrote down.
+     * `resolveActiveMemberOrgIds` then reads the ORGANIZATION_MEMBERS junction as SYSTEM with a filter
+     * built entirely from that id plus a constant status, and brands the result `VerifiedOrgId[]`, so no
+     * caller input reaches the routing decision at any point in the chain. That provenance is the whole
+     * requirement — routing on an unverified org is the 2026-07-09 cross-tenant leak, and misrouting a
+     * delegated grant is strictly worse than not routing it.
+     *
+     * Resolved through the container rather than the constructor to match this service's lazy-dependency
+     * posture (the OAuth provider graph is reachable during startup; see the class JSDoc).
+     *
+     * NEVER-THROW, for a reason worth stating: each caller now resolves this BEFORE its emit, so a
+     * throw here would suppress the audit event entirely — turning a per-org DISPATCH failure into the
+     * loss of the authoritative record, which is the opposite of the fail-closed posture. Routing is
+     * best-effort; the DB store and the Layer-2 sink are not. `resolveActiveMemberOrgIds` is itself
+     * never-throw, so the only failure this adds is an unresolvable `SystemAccessService` binding.
+     *
+     * Returns `[]` when there is no subject to route on or when resolution failed. `[]` and `undefined`
+     * are equivalent at the sink boundary here because the request-EC argument is always `undefined` at
+     * these emit sites, so there is no EC org for `undefined` to fall back to; `[]` is passed because it
+     * states that the question WAS asked and the answer was empty.
+     */
+    async _resolveSubjectRoutingOrgIds(userId) {
+        if (!userId) {
+            return [];
+        }
+        try {
+            const systemAccessService = this.container.get(SAAS_SERVICE_TYPES.SystemAccessService);
+            return await resolveActiveMemberOrgIds(systemAccessService, userId);
+        }
+        catch {
+            return [];
+        }
+    }
     /**
      * Build a typed backend error carrying the precise OAuth 2.0 error code in `context.oauthError`
      * so the token-endpoint controller can render the RFC 6749 §5.2 error response body.

package/dist/esm/security/authentications/services/oauth-provider-token.backend.service.js.map

@@ -1 +1 @@
-{"version":3,"file":"oauth-provider-token.backend.service.js","sourceRoot":"","sources":["../../../../../../src/security/authentications/services/oauth-provider-token.backend.service.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,OAAO,kBAAkB,CAAC;AAC1B,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAE/C,OAAO,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AACpF,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAC7F,OAAO,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AAC/G,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAC9G,OAAO,EAAE,mBAAmB,EAAE,2BAA2B,EAAE,MAAM,8EAA8E,CAAC;AAChJ,OAAO,EAAE,gCAAgC,EAAE,MAAM,2FAA2F,CAAC;AAC7I,OAAO,EAAE,qBAAqB,EAAE,MAAM,iFAAiF,CAAC;AAOxH,OAAO,EAAE,8BAA8B,EAAE,MAAM,wFAAwF,CAAC;AAExI,OAAO,EACL,WAAW,EACX,qBAAqB,EACrB,gBAAgB,EAChB,gCAAgC,EAChC,8BAA8B,EAC9B,2BAA2B,EAC3B,SAAS,EACT,8BAA8B,EAC9B,iBAAiB,EACjB,iBAAiB,EACjB,cAAc,EACd,oBAAoB,EACpB,UAAU,GACX,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,oCAAoC,EAAE,MAAM,oFAAoF,CAAC;AAE1I,OAAO,EAAE,yBAAyB,EAAE,mBAAmB,EAAE,MAAM,qEAAqE,CAAC;AAErI,OAAO,EACL,2BAA2B,GAE5B,MAAM,6FAA6F,CAAC;AAErG;;;;;;;GAOG;AACH,MAAM,sCAAsC,GAAG,EAAE,CAAC;AAoClD;;;;;;;;;;;;;;GAcG;AAEI,IAAM,gCAAgC,GAAtC,MAAM,gCAAgC;IAEc;IACH;IACU;IACG;IACD;IALlE,YACyD,SAAoB,EACvB,MAAqB,EACX,gBAAyC,EACtC,YAAwC,EACzC,kBAAoD;QAJ7D,cAAS,GAAT,SAAS,CAAW;QACvB,WAAM,GAAN,MAAM,CAAe;QACX,qBAAgB,GAAhB,gBAAgB,CAAyB;QACtC,iBAAY,GAAZ,YAAY,CAA4B;QACzC,uBAAkB,GAAlB,kBAAkB,CAAkC;IACnH,CAAC;IAEG,KAAK,CAAC,2BAA2B,CAAC,OAA2C;QAClF,MAAM,EAAE,YAAY,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC;QAErD,iFAAiF;QACjF,MAAM,SAAS,GAAG,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC;YAClD,CAAC,CAAC,WAAW,CAAC,YAAY;YAC1B,CAAC,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC;gBAClC,CAAC,CAAC,WAAW,CAAC,WAAW;gBACzB,CAAC,CAAC,SAAS,CAAC;QAChB,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,cAAc,EAAE,2BAA2B,CAAC,8BAA8B,EAAE,gBAAgB,EAAE,mCAAmC,CAAC,CAAC;QACtK,CAAC;QACD,MAAM,YAAY,GAAG,SAAS,KAAK,WAAW,CAAC,YAAY;YACzD,CAAC,CAAC,gBAAgB,CAAC,0BAA0B;YAC7C,CAAC,CAAC,gBAAgB,CAAC,yBAAyB,CAAC;QAE/C,mFAAmF;QACnF,2EAA2E;QAC3E,MAAM,WAAW,GAAG,IAAI,CAAC,gBAAgB,CAAC,0BAA0B,EAAE,CAAC;QACvE,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,aAAa,EAAE,2BAA2B,CAAC,mBAAmB,EAAE,yBAAyB,EAAE,oCAAoC,CAAC,CAAC;QACpK,CAAC;QACD,iGAAiG;QACjG,oGAAoG;QACpG,+FAA+F;QAC/F,mGAAmG;QACnG,+FAA+F;QAC/F,+FAA+F;QAC/F,mFAAmF;QACnF,kGAAkG;QAClG,gGAAgG;QAChG,iGAAiG;QACjG,2CAA2C;QAC3C,MAAM,iBAAiB,GAAG,QAAQ,IAAI,WAAW,CAAC;QAClD,MAAM,yBAAyB,GAAG,IAAI,CAAC,SAAS;aAC7C,GAAG,CAAgD,kBAAkB,CAAC,+BAA+B,CAAC;aACtG,2BAA2B,CAAC,8BAA8B,CAAC,CAAC;QAC/D,IAAI,CAAC,yBAAyB,CAAC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,CAAC;YAC3D,MAAM,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,aAAa,EAAE,2BAA2B,CAAC,4BAA4B,EAAE,gBAAgB,EAAE,yBAAyB,QAAQ,GAAG,CAAC,CAAC;QACpK,CAAC;QAED,6EAA6E;QAC7E,uEAAuE;QACvE,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAwC,kBAAkB,CAAC,qCAAqC,CAAC,CAAC;QACtI,MAAM,oBAAoB,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAA4C,kBAAkB,CAAC,kCAAkC,CAAC,CAAC;QAClJ,MAAM,UAAU,GAAG,MAAM,SAAS,CAAC,oCAAoC,CAAC;YACtE,YAAY;YACZ,mBAAmB,EAAE,qBAAqB,CAAC,IAAI;SAChD,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,oBAAoB,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC;QAG9D,MAAM,aAAa,GAAG,qBAAqB,CAAC,YAAY,CAAC,CAAC;QAC1D,IAAI,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAiB,UAAU,EAAE,EAAE,YAAY,EAAE,aAAa,EAAE,CAAC,CAAC;QAC1F,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,IAAI,CAAiB,UAAU,EAAE,EAAE,oBAAoB,EAAE,aAAa,EAAE,CAAC,CAAC;YACrG,IAAI,OAAO,IAAI,yBAAyB,CAAC,OAAO,CAAC,8BAA8B,CAAC,EAAE,CAAC;gBACjF,MAAM,GAAG,OAAO,CAAC;YACnB,CAAC;QACH,CAAC;QAED,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,iBAAiB,CAAC,MAAM,IAAI,mBAAmB,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;YACnG,MAAM,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,cAAc,EAAE,2BAA2B,CAAC,8BAA8B,EAAE,gBAAgB,EAAE,8BAA8B,CAAC,CAAC;QACjK,CAAC;QACD,2EAA2E;QAC3E,IAAI,QAAQ,IAAI,QAAQ,KAAK,MAAM,CAAC,GAAG,EAAE,CAAC;YACxC,MAAM,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,cAAc,EAAE,2BAA2B,CAAC,8BAA8B,EAAE,gBAAgB,EAAE,2CAA2C,CAAC,CAAC;QAC9K,CAAC;QACD,IAAI,CAAC,CAAC,MAAM,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,cAAc,CAAC,kBAAkB,CAAC,EAAE,CAAC;YAC9E,MAAM,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,aAAa,EAAE,2BAA2B,CAAC,4BAA4B,EAAE,qBAAqB,EAAE,2DAA2D,CAAC,CAAC;QAChM,CAAC;QAED,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,GAGxB,SAAS,KAAK,WAAW,CAAC,YAAY;YACxC,CAAC,CAAC,EAAE,SAAS,EAAE,oBAAoB,CAAC,aAAa,EAAE,OAAO,EAAG,MAAkC,CAAC,cAAc,EAAE;YAChH,CAAC,CAAC,EAAE,SAAS,EAAE,oBAAoB,CAAC,WAAW,EAAE,OAAO,EAAG,MAAiC,CAAC,aAAa,EAAE,CAAC;QAE/G,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,sBAAsB,CAAC;YAClE,QAAQ,EAAE,MAAM,CAAC,GAAG;YACpB,SAAS;YACT,OAAO;YACP,KAAK,EAAE,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAY;YACtC,QAAQ,EAAE,iBAAiB;SAC5B,CAAC,CAAC;QAEH,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,0DAA0D,EAAE;YAC5E,QAAQ,EAAE,MAAM,CAAC,GAAG;YACpB,SAAS;YACT,OAAO;SACR,CAAC,CAAC;QAEH,2FAA2F;QAC3F,8FAA8F;QAC9F,8FAA8F;QAC9F,EAAE;QACF,2FAA2F;QAC3F,6FAA6F;QAC7F,2FAA2F;QAC3F,4FAA4F;QAC5F,8FAA8F;QAC9F,iGAAiG;QACjG,0FAA0F;QAC1F,iGAAiG;QACjG,8FAA8F;QAC9F,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAA0B,kBAAkB,CAAC,gBAAgB,CAAC,CAAC;QACnG,MAAM,wBAAwB,GAAgC,SAAS,KAAK,oBAAoB,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,OAAwB,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACxJ,KAAK,SAAS,CAAC,qBAAqB,CAAC;YACnC,UAAU,EAAE,iBAAiB,CAAC,YAAY;YAC1C,YAAY,EAAE,MAAM,CAAC,GAAG;YACxB,SAAS,EAAE,SAAS,KAAK,oBAAoB,CAAC,aAAa;gBACzD,CAAC,CAAC,8BAA8B,CAAC,oBAAoB;gBACrD,CAAC,CAAC,8BAA8B,CAAC,mBAAmB;YACtD,OAAO;YACP,cAAc,EAAE,SAAS,KAAK,oBAAoB,CAAC,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS;SACvF,EAAE,SAAS,EAAE,wBAAwB,CAAC,CAAC,KAAK,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,oDAAoD,EAAE;YACnI,GAAG,2BAA2B,CAAC,UAAU,CAAC;SAC3C,CAAC,CAAC,CAAC;QAEJ,OAAO;YACL,YAAY,EAAE,MAAM,CAAC,WAAW;YAChC,UAAU,EAAE,QAAQ;YACpB,UAAU,EAAE,MAAM,CAAC,SAAS;SAC7B,CAAC;IACJ,CAAC;IAED;;;;;;;;OAQG;IACI,KAAK,CAAC,2BAA2B,CAAC,OAiBxC;QACC,MAAM,eAAe,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAsC,kBAAkB,CAAC,qBAAqB,CAAC,CAAC;QAC1H,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAoB,kBAAkB,CAAC,iBAAiB,CAAC,CAAC;QAE/F,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,yBAAyB,CAAC;YAC5D,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,YAAY,EAAE,OAAO,CAAC,YAAY;YAClC,qBAAqB,EAAE,OAAO,CAAC,YAAY;SAC5C,CAAC,CAAC;QAEH,4FAA4F;QAC5F,6FAA6F;QAC7F,gGAAgG;QAChG,0FAA0F;QAC1F,+FAA+F;QAC/F,8EAA8E;QAC9E,MAAM,iBAAiB,GAAG,KAAK,CAAC,QAAQ,CAAC;QACzC,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACvB,MAAM,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,aAAa,EAAE,2BAA2B,CAAC,4BAA4B,EAAE,gBAAgB,EACxH,kFAAkF,CAAC,CAAC;QACxF,CAAC;QACD,iGAAiG;QACjG,iGAAiG;QACjG,mFAAmF;QACnF,IAAI,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,KAAK,iBAAiB,EAAE,CAAC;YAC/D,MAAM,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,aAAa,EAAE,2BAA2B,CAAC,4BAA4B,EAAE,gBAAgB,EACxH,mGAAmG,CAAC,CAAC;QACzG,CAAC;QACD,+FAA+F;QAC/F,kGAAkG;QAClG,yFAAyF;QACzF,MAAM,yBAAyB,GAAG,IAAI,CAAC,SAAS;aAC7C,GAAG,CAAgD,kBAAkB,CAAC,+BAA+B,CAAC;aACtG,2BAA2B,CAAC,gCAAgC,CAAC,CAAC;QACjE,IAAI,CAAC,yBAAyB,CAAC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,CAAC;YAC3D,MAAM,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,aAAa,EAAE,2BAA2B,CAAC,4BAA4B,EAAE,gBAAgB,EACxH,aAAa,iBAAiB,mDAAmD,CAAC,CAAC;QACvF,CAAC;QAED,kGAAkG;QAClG,8FAA8F;QAC9F,+FAA+F;QAC/F,oGAAoG;QACpG,iEAAiE;QACjE,MAAM,iBAAiB,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAA+B,kBAAkB,CAAC,cAAc,CAAC,CAAC;QAC9G,MAAM,aAAa,GAAG,MAAM,iBAAiB,CAAC,iBAAiB,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;QAC3F,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,mBAAmB,CAAC;YACnD,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,mGAAmG;YACnG,iGAAiG;YACjG,0EAA0E;YAC1E,GAAG,EAAE,KAAK,CAAC,SAAS;YACpB,WAAW,EAAE,aAAa;SAC3B,CAAC,CAAC;QAEH,0EAA0E;QAC1E,yEAAyE;QACzE,0EAA0E;QAC1E,gDAAgD;QAChD,MAAM,SAAS,GACb,IAAI,CAAC,SAAS,CAAC,GAAG,CAChB,kBAAkB,CAAC,qCAAqC,CACzD,CAAC;QACJ,MAAM,oBAAoB,GACxB,IAAI,CAAC,SAAS,CAAC,GAAG,CAChB,kBAAkB,CAAC,kCAAkC,CACtD,CAAC;QACJ,MAAM,UAAU,GAAG,MAAM,SAAS,CAAC,oCAAoC,CAAC;YACtE,YAAY,EAAE,gBAAgB,CAAC,KAAK;YACpC,mBAAmB,EAAE,qBAAqB,CAAC,IAAI;SAChD,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,oBAAoB;aACpC,aAAa,CAAC,gBAAgB,CAAC,KAAK,CAAC;aACrC,IAAI,CAA6B,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QAC9D,MAAM,oBAAoB,GAAG,2BAA2B,CAAC,IAAI,CAAC,CAAC;QAC/D,IACE,CAAC,IAAI;eACF,IAAI,CAAC,MAAM,KAAK,UAAU,CAAC,MAAM;eACjC,oBAAoB,KAAK,IAAI,EAChC,CAAC;YACD,MAAM,IAAI,CAAC,WAAW,CACpB,SAAS,CAAC,cAAc,EACxB,2BAA2B,CAAC,4BAA4B,EACxD,eAAe,EACf,uDAAuD,CACxD,CAAC;QACJ,CAAC;QAED,+FAA+F;QAC/F,4FAA4F;QAC5F,gGAAgG;QAChG,wBAAwB;QACxB,MAAM,WAAW,GAAG,oCAAoC,CAAC,KAAK,CAAC;YAC7D,IAAI,EAAE,8BAA8B,CAAC,YAAY;YACjD,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,oBAAoB;YACpB,GAAG,EAAE,KAAK,CAAC,QAAQ;YACnB,0FAA0F;YAC1F,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACtD,CAAC,CAAC;QACH,gGAAgG;QAChG,iGAAiG;QACjG,MAAM,mBAAmB,GAAG,IAAI,CAAC,GAAG,CAClC,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,GAAG,CAAC,4BAA4B,EAC7D,sCAAsC,CACvC,CAAC;QACF,MAAM,WAAW,GAAG,MAAM,UAAU,CAAC,8BAA8B,CAAC,WAAW,EAAE;YAC/E,QAAQ,EAAE,iBAAiB;YAC3B,gBAAgB,EAAE,mBAAmB;SACtC,CAAC,CAAC;QACH,MAAM,SAAS,GAAG,mBAAmB,GAAG,EAAE,CAAC;QAE3C,iGAAiG;QACjG,kGAAkG;QAClG,oGAAoG;QACpG,qGAAqG;QACrG,sGAAsG;QACtG,sDAAsD;QACtD,MAAM,qBAAqB,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAA0B,kBAAkB,CAAC,gBAAgB,CAAC,CAAC;QAC/G,KAAK,qBAAqB,CAAC,4BAA4B,CAAC;YACtD,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,QAAQ,EAAE,iBAAiB;YAC3B,MAAM,EAAE,KAAK,CAAC,KAAK;YACnB,UAAU,EAAE,SAAS;SACtB,CAAC,CAAC,KAAK,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,4DAA4D,EAAE;YACtG,GAAG,2BAA2B,CAAC,UAAU,CAAC;SAC3C,CAAC,CAAC,CAAC;QACJ,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,kDAAkD,EAAE;YACpE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,QAAQ,EAAE,iBAAiB,EAAE,UAAU,EAAE,KAAK,CAAC,KAAK,CAAC,MAAM,EAAE,UAAU,EAAE,mBAAmB;SAC7I,CAAC,CAAC;QAEH,OAAO;YACL,YAAY,EAAE,WAAW;YACzB,UAAU,EAAE,QAAQ;YACpB,UAAU,EAAE,SAAS;YACrB,QAAQ,EAAE,OAAO;YACjB,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC;SAC7B,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAwCG;IACI,KAAK,CAAC,sBAAsB,CAAC,YAAoB,EAAE,QAAiB,EAAE,YAAqB;QAChG,yGAAyG;QACzG,yGAAyG;QACzG,iGAAiG;QACjG,wGAAwG;QACxG,0GAA0G;QAC1G,kGAAkG;QAClG,4FAA4F;QAC5F,IAAI,QAAQ,IAAI,YAAY,EAAE,CAAC;YAC7B,MAAM,eAAe,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAsC,kBAAkB,CAAC,qBAAqB,CAAC,CAAC;YAC1H,MAAM,eAAe,CAAC,2BAA2B,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;QAC5E,CAAC;QAED,MAAM,eAAe,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAgC,kBAAkB,CAAC,eAAe,CAAC,CAAC;QAC9G,IAAI,MAAM,CAAC;QACX,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,eAAe,CAAC,kBAAkB,CAAC,YAAY,CAAC,CAAC;QAClE,CAAC;QAAC,OAAO,YAAY,EAAE,CAAC;YACtB,mGAAmG;YACnG,oGAAoG;YACpG,qGAAqG;YACrG,4FAA4F;YAC5F,kGAAkG;YAClG,MAAM,WAAW,GAAG,8BAA8B,CAAC,YAAY,CAAC,CAAC;YACjE,IAAI,WAAW,EAAE,CAAC;gBAChB,MAAM,iBAAiB,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAA0B,kBAAkB,CAAC,gBAAgB,CAAC,CAAC;gBAC3G,KAAK,iBAAiB,CAAC,gCAAgC,CAAC;oBACtD,MAAM,EAAE,WAAW,CAAC,MAAM;oBAC1B,SAAS,EAAE,WAAW,CAAC,SAAS;oBAChC,SAAS,EAAE,WAAW,CAAC,SAAS;oBAChC,aAAa,EAAE,WAAW,CAAC,aAAa;iBACzC,CAAC,CAAC,KAAK,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,iEAAiE,EAAE;oBAC3G,GAAG,2BAA2B,CAAC,UAAU,CAAC;iBAC3C,CAAC,CAAC,CAAC;YACN,CAAC;YACD,MAAM,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,cAAc,EAAE,2BAA2B,CAAC,8BAA8B,EAAE,eAAe,EAAE,4CAA4C,CAAC,CAAC;QAC9K,CAAC;QACD,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,IAAI,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,GAAG,CAAC,4BAA4B,GAAG,EAAE,CAAC;QAEzG,mGAAmG;QACnG,0GAA0G;QAC1G,IAAI,OAA2B,CAAC;QAChC,wGAAwG;QACxG,qGAAqG;QACrG,IAAI,eAAmC,CAAC;QACxC,IAAI,QAAQ,IAAI,YAAY,EAAE,CAAC;YAC7B,IAAI,CAAC;gBACH,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAoB,kBAAkB,CAAC,iBAAiB,CAAC,CAAC;gBAC/F,oGAAoG;gBACpG,oGAAoG;gBACpG,+EAA+E;gBAC/E,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,gCAAgC,CAAC,MAAM,CAAC,WAAW,CAAyC,CAAC;gBAC7H,IAAI,MAAM,CAAC,GAAG,EAAE,CAAC;oBACf,eAAe,GAAG,MAAM,CAAC,GAAG,CAAC;oBAC7B,OAAO,GAAG,MAAM,UAAU,CAAC,mBAAmB,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC;gBAC1G,CAAC;YACH,CAAC;YAAC,OAAO,YAAY,EAAE,CAAC;gBACtB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,uDAAuD,EAAE;oBACzE,MAAM,EAAE,mBAAmB,CAAC,YAAY,CAAC;iBAC1C,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,oGAAoG;QACpG,kGAAkG;QAClG,uGAAuG;QACvG,MAAM,mBAAmB,GAAG,OAAO,CAAC,QAAQ,IAAI,YAAY,CAAC,CAAC;QAC9D,MAAM,mBAAmB,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAA0B,kBAAkB,CAAC,gBAAgB,CAAC,CAAC;QAC7G,KAAK,mBAAmB,CAAC,sBAAsB,CAAC;YAC9C,MAAM,EAAE,eAAe;YACvB,QAAQ,EAAE,mBAAmB,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS;YACpD,mBAAmB;SACpB,CAAC,CAAC,KAAK,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,qDAAqD,EAAE;YAC/F,GAAG,2BAA2B,CAAC,UAAU,CAAC;SAC3C,CAAC,CAAC,CAAC;QAEJ,OAAO;YACL,YAAY,EAAE,MAAM,CAAC,WAAW;YAChC,UAAU,EAAE,QAAQ;YACpB,UAAU,EAAE,SAAS;YACrB,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACtE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACzC,KAAK,EAAE,EAAE;SACV,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACI,KAAK,CAAC,kBAAkB,CAAC,YAAoB;QAClD,MAAM,eAAe,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAgC,kBAAkB,CAAC,eAAe,CAAC,CAAC;QAC9G,IAAI,CAAC;YACH,MAAM,eAAe,CAAC,kBAAkB,CAAC,YAAY,CAAC,CAAC;QACzD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,uFAAuF;YACvF,0CAA0C;YAC1C,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,yEAAyE,EAAE,EAAE,MAAM,EAAE,mBAAmB,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACvI,CAAC;IACH,CAAC;IAED;;;OAGG;IACK,WAAW,CAAC,IAAe,EAAE,GAAgC,EAAE,UAAkB,EAAE,MAAc;QACvG,OAAO,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,IAAI,EAAE,SAAS,EAAE;YACnD,sBAAsB,EAAE,GAAG;YAC3B,OAAO,EAAE,EAAE,UAAU,EAAE,MAAM,EAAE;SAChC,CAAC,CAAC;IACL,CAAC;CACF,CAAA;AA5cY,gCAAgC;IAD5C,UAAU,EAAE;IAGR,WAAA,MAAM,CAAC,kBAAkB,CAAC,SAAS,CAAC,CAAA;IACpC,WAAA,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAA;IACjC,WAAA,MAAM,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,CAAA;IAC3C,WAAA,MAAM,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,CAAA;IAC9C,WAAA,MAAM,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,CAAA;+CAHc,aAAa;QACO,uBAAuB;QACxB,0BAA0B;QACrB,gCAAgC;GAN3G,gCAAgC,CA4c5C","sourcesContent":["import 'reflect-metadata';\nimport { inject, injectable } from 'inversify';\nimport type { Container } from 'inversify';\nimport { SAAS_SERVICE_TYPES } from '~wildo-backend-lib/inject/models/service-types';\nimport { LoggerService } from '~wildo-backend-lib/monitoring/logger/services/logger.service';\nimport { AppConfigurationService } from '~wildo-backend-lib/config/services/app-configuration.backend.service';\nimport { ErrorBuilderBackendService } from '~wildo-backend-lib/errors/services/error-builder.backend.service';\nimport { describeCaughtError, projectCaughtErrorLogFields } from '~wildo-backend-lib/errors/utils/error-log-level-classification.backend.utils';\nimport { MachineTokenIssuerBackendService } from '~wildo-backend-lib/security/authentications/services/machine-token-issuer.backend.service';\nimport { hashOAuthClientSecret } from '~wildo-backend-lib/security/oauth-clients/oauth-client-generation.backend.utils';\nimport type { ExecutionContextCreatorBackendService } from '~wildo-backend-lib/runtime/services/execution-context-creator.backend.service';\nimport type { RepositoriesRegistryHandlerBackendService } from '~wildo-backend-lib/base-classes/services/repositories/repositories-registry-handler.backend.service';\nimport type { OidcAuthorizationCodeBackendService } from '~wildo-backend-lib/security/authentications/services/oidc-authorization-code.backend.service';\nimport type { OidcUserClaimsBackendService } from '~wildo-backend-lib/security/authentications/services/oidc-user-claims.backend.service';\nimport type { JwtBackendService } from '~wildo-backend-lib/security/jwt/services/jwt.backend.service';\nimport type { AuthTokenIssuerBackendService } from '~wildo-backend-lib/security/authentications/services/auth-token-issuer.backend.service';\nimport { extractRefreshTokenReuseSignal } from '~wildo-backend-lib/security/authentications/services/auth-token-issuer.backend.service';\nimport type { ResourceServerInstancesRegistryBackendService } from '~wildo-backend-lib/mcp/services/resource-server-instances-registry.backend.service';\nimport {\n  ApiKeyScope,\n  CoreResourceOperation,\n  CoreResourceType,\n  DELEGATED_TOKEN_RESOURCE_SERVERS,\n  MACHINE_TOKEN_RESOURCE_SERVERS,\n  ErrorCustomMessageReference,\n  ErrorType,\n  ExecutionContext_ExecutionType,\n  MachineAuthMethod,\n  OAuthClientStatus,\n  OAuthGrantType,\n  ResourcePrimaryScope,\n  UserStatus,\n} from '@wildo-ai/saas-models';\nimport { JwtClaim_App_Auth_UserRequest_Schema } from '~wildo-backend-lib/security/authentications/models/authentications.backend.schemas';\nimport type { OAuthClientApplication, OAuthClientOrganization, Roles, VerifiedOrgId } from '@wildo-ai/saas-models';\nimport { isRotationGraceWindowOpen, isCredentialExpired } from '~wildo-backend-lib/security/credential-rotation-grace.backend.utils';\nimport { AuditLogsBackendService } from '~wildo-backend-lib/compliance/audit-trails/services/audit-logs.backend.service';\nimport {\n  getUserAuthorizationVersion,\n  type AuthorizationVersionedUser,\n} from '~wildo-backend-lib/security/authentications/models/user-authorization-version.backend.utils';\n\n/**\n * Upper bound (minutes) on a USER-DELEGATED (`authorization_code`) access-token lifetime. A consented\n * third-party/agent token that acts AS the user is confined more tightly than a first-party session:\n * it gets NO refresh AND a lifetime capped at this bound, so an over-long operator-configured session\n * TTL (`accessTokenExpirationMinutes`, up to 1440) never widens a delegated token's window. The\n * effective TTL is `min(accessTokenExpirationMinutes, this)`. A dedicated operator-authored delegated\n * TTL config knob is the future extension; this cap is the safe default until then.\n */\nconst DELEGATED_ACCESS_TOKEN_MAX_TTL_MINUTES = 30;\n\n/**\n * Parsed input for the OAuth 2.0 `client_credentials` grant. The HTTP token-endpoint\n * controller (OIDC branch) extracts these from the request (`client_secret_basic` /\n * `client_secret_post` for the client secret, plus the `resource` (RFC 8707) form param) and\n * hands them here; this service is transport-agnostic.\n */\nexport interface OAuthClientCredentialsGrantRequest {\n  /** The presented `oc_org_`/`oc_app_` client secret. */\n  clientSecret: string;\n  /** Optional `client_id` for a defensive cross-check against the resolved client. */\n  clientId?: string;\n  /** RFC 8707 resource indicator (the `resource` form param), if supplied. */\n  resource?: string;\n}\n\n/** OAuth 2.0 successful token response (RFC 6749 §5.1) — snake_case is the wire contract. */\nexport interface OAuthTokenSuccessResponse {\n  access_token: string;\n  token_type: 'Bearer';\n  expires_in: number;\n  /**\n   * Optional per RFC 6749 §5.1. Set by the OIDC identity flow (authorization_code, reflecting the\n   * granted identity scopes); OMITTED by client_credentials — machine tokens are roles-only, with\n   * no scope-based authorization.\n   */\n  scope?: string;\n}\n\n/** authorization_code / OIDC token response — adds the ID token + (optional) refresh token. */\nexport interface OidcTokenSuccessResponse extends OAuthTokenSuccessResponse {\n  id_token: string;\n  refresh_token?: string;\n}\n\n/**\n * OAuth 2.0 Authorization Server — `client_credentials` grant issuance. Verifies a\n * registered {@link OAuthClientOrganization}/{@link OAuthClientApplication} by its\n * presented secret and mints a short-lived, audience-bound machine access token via\n * {@link MachineTokenIssuerBackendService}. Transport-agnostic (no HTTP): the OIDC-branch\n * token-endpoint controller is a thin wrapper that parses the request and formats the\n * OAuth response / error.\n *\n * Secret verification MIRRORS the request-auth choke point's direct-secret front\n * (`handle{Organization,Application}OAuthClient`): route by the `oc_` prefix, resolve by\n * `hashedSecret` then the `previousHashedSecret` rotation-grace slot, require `ACTIVE`.\n * The audience is resolved through the SHARED\n * {@link AppConfigurationService.resolveApiResourceAudience} so the token this endpoint\n * mints carries exactly the `aud` the choke point validates (RFC 8707 — no drift).\n */\n@injectable()\nexport class OAuthProviderTokenBackendService {\n  constructor(\n    @inject(SAAS_SERVICE_TYPES.Container) private readonly container: Container,\n    @inject(SAAS_SERVICE_TYPES.Logger) private readonly logger: LoggerService,\n    @inject(SAAS_SERVICE_TYPES.AppConfigService) private readonly appConfigService: AppConfigurationService,\n    @inject(SAAS_SERVICE_TYPES.ErrorBuilderService) private readonly errorBuilder: ErrorBuilderBackendService,\n    @inject(SAAS_SERVICE_TYPES.MachineTokenIssuer) private readonly machineTokenIssuer: MachineTokenIssuerBackendService,\n  ) {}\n\n  public async issueClientCredentialsToken(request: OAuthClientCredentialsGrantRequest): Promise<OAuthTokenSuccessResponse> {\n    const { clientSecret, clientId, resource } = request;\n\n    // Route by secret prefix (same discriminator the request-auth choke point uses).\n    const scopeKind = clientSecret.startsWith('oc_org_')\n      ? ApiKeyScope.ORGANIZATION\n      : clientSecret.startsWith('oc_app_')\n        ? ApiKeyScope.APPLICATION\n        : undefined;\n    if (!scopeKind) {\n      throw this._oauthError(ErrorType.AUTHENTICATION, ErrorCustomMessageReference.AUTHENTICATION_API_KEY_INVALID, 'invalid_client', 'unrecognized client secret prefix');\n    }\n    const resourceType = scopeKind === ApiKeyScope.ORGANIZATION\n      ? CoreResourceType.OAUTH_CLIENTS_ORGANIZATION\n      : CoreResourceType.OAUTH_CLIENTS_APPLICATION;\n\n    // Resolve + validate the RFC 8707 audience up front (fail fast; the SAME value the\n    // choke point validates against — resolved from the one shared authority).\n    const apiAudience = this.appConfigService.resolveApiResourceAudience();\n    if (!apiAudience) {\n      throw this._oauthError(ErrorType.CONFIGURATION, ErrorCustomMessageReference.JWT_TOKEN_NOT_FOUND, 'temporarily_unavailable', 'api resource audience unresolvable');\n    }\n    // RFC 8707 resource indicator. Absent ⇒ the generic API audience (back-compat: clients that omit\n    // `resource` keep getting an API-audience token). Present ⇒ it MUST name one of this app's resource\n    // servers (API / A2A / MCP); the token is minted `aud`-bound to that surface, so a client that\n    // follows an MCP/A2A endpoint's advertised Protected-Resource-Metadata `resource` receives a token\n    // scoped to that endpoint (confused-deputy / token-passthrough defense) — replacing the former\n    // blanket `invalid_target` rejection of every non-API resource. Mirrors the authorization_code\n    // path's resource validation (below), but the machine set includes the API itself.\n    // R-2: the valid set is enumerated from the INSTANCES REGISTRY — each kind's default surface PLUS\n    // every declared named instance (`…/mcp/<ref>`, `…/a2a/<ref>`) — so declaring a server makes it\n    // mintable and addressable in one move, and an undeclared one is `invalid_target` here (the mint\n    // mirror of the 404 its endpoint returns).\n    const requestedAudience = resource ?? apiAudience;\n    const supportedMachineAudiences = this.container\n      .get<ResourceServerInstancesRegistryBackendService>(SAAS_SERVICE_TYPES.ResourceServerInstancesRegistry)\n      .listResourceServerAudiences(MACHINE_TOKEN_RESOURCE_SERVERS);\n    if (!supportedMachineAudiences.includes(requestedAudience)) {\n      throw this._oauthError(ErrorType.AUTHORIZATION, ErrorCustomMessageReference.AUTHORIZATIONS_ACCESS_DENIED, 'invalid_target', `unsupported resource '${resource}'`);\n    }\n\n    // Repository-direct read (raw record incl. roles/scope FK/status/grants), by\n    // hashedSecret then the rotation-grace slot — mirrors the choke point.\n    const ecCreator = this.container.get<ExecutionContextCreatorBackendService>(SAAS_SERVICE_TYPES.ExecutionContextCreatorBackendService);\n    const repositoriesRegistry = this.container.get<RepositoriesRegistryHandlerBackendService>(SAAS_SERVICE_TYPES.RepositoriesRegistryHandlerService);\n    const internalEc = await ecCreator.createForInternalRepositoryOperation({\n      resourceType,\n      operationIdentifier: CoreResourceOperation.READ,\n    });\n    const repo = repositoriesRegistry.getRepository(resourceType);\n\n    type ResolvedClient = (OAuthClientOrganization | OAuthClientApplication) & { previousSecretInvalidationDate?: Date | null };\n    const presentedHash = hashOAuthClientSecret(clientSecret);\n    let client = await repo.read<ResolvedClient>(internalEc, { hashedSecret: presentedHash });\n    if (!client) {\n      const rotated = await repo.read<ResolvedClient>(internalEc, { previousHashedSecret: presentedHash });\n      if (rotated && isRotationGraceWindowOpen(rotated.previousSecretInvalidationDate)) {\n        client = rotated;\n      }\n    }\n\n    if (!client || client.status !== OAuthClientStatus.ACTIVE || isCredentialExpired(client.expiresAt)) {\n      throw this._oauthError(ErrorType.AUTHENTICATION, ErrorCustomMessageReference.AUTHENTICATION_API_KEY_INVALID, 'invalid_client', 'client not found or inactive');\n    }\n    // Defensive: if a client_id was supplied it MUST match the secret's owner.\n    if (clientId && clientId !== client._id) {\n      throw this._oauthError(ErrorType.AUTHENTICATION, ErrorCustomMessageReference.AUTHENTICATION_API_KEY_INVALID, 'invalid_client', 'client_id does not match presented secret');\n    }\n    if (!(client.allowedGrants ?? []).includes(OAuthGrantType.CLIENT_CREDENTIALS)) {\n      throw this._oauthError(ErrorType.AUTHORIZATION, ErrorCustomMessageReference.AUTHORIZATIONS_ACCESS_DENIED, 'unauthorized_client', 'client is not authorized for the client_credentials grant');\n    }\n\n    const { scopeType, scopeId }: {\n      scopeType: ResourcePrimaryScope.ORGANIZATIONS | ResourcePrimaryScope.APPLICATION;\n      scopeId: string;\n    } = scopeKind === ApiKeyScope.ORGANIZATION\n      ? { scopeType: ResourcePrimaryScope.ORGANIZATIONS, scopeId: (client as OAuthClientOrganization).organizationId }\n      : { scopeType: ResourcePrimaryScope.APPLICATION, scopeId: (client as OAuthClientApplication).applicationId };\n\n    const issued = await this.machineTokenIssuer.issueClientAccessToken({\n      clientId: client._id,\n      scopeType,\n      scopeId,\n      roles: (client.roles ?? []) as Roles[],\n      audience: requestedAudience,\n    });\n\n    this.logger.debug('Issued client_credentials token via OAuth token endpoint', {\n      clientId: client._id,\n      scopeType,\n      scopeId,\n    });\n\n    // Audit the successful machine authentication at the OAuth issuance moment — the discrete,\n    // low-volume \"a machine authenticated\" event (as opposed to auditing every subsequent request\n    // the issued token makes). Fire-and-forget: auditing must never block or fail token issuance.\n    //\n    // SIEM-3 (F4 tenant-segregation routing) — the per-org SIEM fan-out routes on the explicit\n    // `routingOrgIds` arg (or the request EC's authenticated org), NEVER on the `organizationId`\n    // event-DATA field. This is a token-MINT: there is NO authenticated request EC (the client\n    // just presented its credentials), so without an explicit `routingOrgIds` the event reaches\n    // the DB store but NEVER the org SIEM. For an ORGANIZATION_MACHINE, `scopeId` IS the verified\n    // `organizationId` read off the authenticated `OAuthClientOrganization` record above (line ~156)\n    // — an F4-safe VERIFIED member org, not an attacker-supplied value — so we pass it as the\n    // single routing org. An APPLICATION_MACHINE has no single tenant SIEM to route to ⇒ `undefined`\n    // (DB store + Layer-2 app-level sinks still receive it; there is simply no per-org dispatch).\n    const auditLogs = this.container.get<AuditLogsBackendService>(SAAS_SERVICE_TYPES.AuditLogsService);\n    const machineAuthRoutingOrgIds: VerifiedOrgId[] | undefined = scopeType === ResourcePrimaryScope.ORGANIZATIONS ? [scopeId as VerifiedOrgId] : undefined;\n    void auditLogs.logMachineAuthSuccess({\n      authMethod: MachineAuthMethod.OAUTH_CLIENT,\n      credentialId: client._id,\n      scopeType: scopeType === ResourcePrimaryScope.ORGANIZATIONS\n        ? ExecutionContext_ExecutionType.ORGANIZATION_MACHINE\n        : ExecutionContext_ExecutionType.APPLICATION_MACHINE,\n      scopeId,\n      organizationId: scopeType === ResourcePrimaryScope.ORGANIZATIONS ? scopeId : undefined,\n    }, undefined, machineAuthRoutingOrgIds).catch((auditError) => this.logger.warn('MACHINE_AUTH_SUCCESS audit emit failed (non-fatal)', {\n      ...projectCaughtErrorLogFields(auditError),\n    }));\n\n    return {\n      access_token: issued.accessToken,\n      token_type: 'Bearer',\n      expires_in: issued.expiresIn,\n    };\n  }\n\n  /**\n   * OIDC `authorization_code` grant. Redeems the code (atomic consume + client/redirect_uri\n   * binding + mandatory PKCE S256 — in `OidcAuthorizationCodeBackendService`), then mints an\n   * ID token (`createJwtForIdToken`) plus a USER access + refresh token (the existing user\n   * issuer — a user-delegated token represents the consenting user). PKCE protects the\n   * exchange (OAuth 2.1 mandatory-PKCE model); a CONFIDENTIAL client (`tokenEndpointAuthMethod !==\n   * NONE`) must ALSO present a valid `client_secret`, enforced inside `exchangeAuthorizationCode`.\n   * Heavy deps are lazily resolved to avoid startup-graph re-entry.\n   */\n  public async issueAuthorizationCodeToken(request: {\n    code: string;\n    clientId: string;\n    redirectUri: string;\n    codeVerifier: string;\n    /**\n     * The client secret presented via client_secret_basic/post, if any. REQUIRED for a confidential\n     * client (verified in `exchangeAuthorizationCode`); ignored for a public (PKCE-only) client.\n     */\n    clientSecret?: string;\n    /**\n     * RFC 8707 §2.2 resource indicator OPTIONALLY echoed on the token request. The audience is\n     * authoritatively bound at authorize time (`grant.resource`); when present here it MUST match\n     * that bound value (a confused-deputy cross-check — a client must not exchange a code authorized\n     * for agent A into a token for agent B), else `invalid_target`.\n     */\n    resource?: string;\n  }): Promise<OidcTokenSuccessResponse> {\n    const authCodeService = this.container.get<OidcAuthorizationCodeBackendService>(SAAS_SERVICE_TYPES.OidcAuthorizationCode);\n    const jwtService = this.container.get<JwtBackendService>(SAAS_SERVICE_TYPES.JwtBackendService);\n\n    const grant = await authCodeService.exchangeAuthorizationCode({\n      code: request.code,\n      clientId: request.clientId,\n      redirectUri: request.redirectUri,\n      codeVerifier: request.codeVerifier,\n      presentedClientSecret: request.clientSecret,\n    });\n\n    // RFC 8707 (mandated by the MCP/A2A authorization specs): the client MUST name the resource\n    // server it wants the token for, and a USER-DELEGATED token may ONLY target an agent surface\n    // (A2A / MCP) — NEVER the main API. This tight audience is the load-bearing confinement (B-S2):\n    // the token is `aud`-bound to that endpoint, so the main resource API (which accepts only\n    // `aud='AUTH_TOKEN'` user tokens) rejects it. A consented third-party client thus acts for the\n    // user at the named agent endpoint ONLY, never as a full first-party session.\n    const requestedAudience = grant.resource;\n    if (!requestedAudience) {\n      throw this._oauthError(ErrorType.AUTHORIZATION, ErrorCustomMessageReference.AUTHORIZATIONS_ACCESS_DENIED, 'invalid_target',\n        'the `resource` parameter (RFC 8707) is required for the authorization_code grant');\n    }\n    // RFC 8707 §2.2 confused-deputy cross-check: if the token request ALSO named a resource, it must\n    // match the one bound to the code at authorize (the user consented to THAT agent). A client must\n    // not redeem a code authorized for agent A into a token audience-bound to agent B.\n    if (request.resource && request.resource !== requestedAudience) {\n      throw this._oauthError(ErrorType.AUTHORIZATION, ErrorCustomMessageReference.AUTHORIZATIONS_ACCESS_DENIED, 'invalid_target',\n        'the token-request `resource` does not match the resource authorized at the authorization endpoint');\n    }\n    // R-2: same instance-aware enumeration as the machine grant, but over the DELEGATED kinds only\n    // (A2A / MCP — never the main API), so a user may delegate to a NAMED agent/server instance while\n    // the B-S2 confinement (no delegated token for the API audience) is preserved unchanged.\n    const allowedDelegatedAudiences = this.container\n      .get<ResourceServerInstancesRegistryBackendService>(SAAS_SERVICE_TYPES.ResourceServerInstancesRegistry)\n      .listResourceServerAudiences(DELEGATED_TOKEN_RESOURCE_SERVERS);\n    if (!allowedDelegatedAudiences.includes(requestedAudience)) {\n      throw this._oauthError(ErrorType.AUTHORIZATION, ErrorCustomMessageReference.AUTHORIZATIONS_ACCESS_DENIED, 'invalid_target',\n        `resource '${requestedAudience}' is not a delegatable agent endpoint (A2A / MCP)`);\n    }\n\n    // OIDC Core §5.4: the ID token carries the SAME scope-gated identity claims (`email` / `profile`)\n    // that `/oauth/userinfo` returns, via the one shared resolver — so an RP reading the ID token\n    // directly gets email/name without a userinfo round-trip, and the two surfaces never disagree.\n    // Cold path (once per authorization, not per request), so the resolver's own User/UserProfile reads\n    // are acceptable alongside the authorization-version read below.\n    const userClaimsService = this.container.get<OidcUserClaimsBackendService>(SAAS_SERVICE_TYPES.OidcUserClaims);\n    const idTokenClaims = await userClaimsService.resolveUserClaims(grant.userId, grant.scope);\n    const idToken = await jwtService.createJwtForIdToken({\n      userId: grant.userId,\n      clientId: grant.clientId,\n      nonce: grant.nonce,\n      // revocation-C: `sid` = the End-User's OP session captured at authorize (threaded through the code\n      // grant). This is the PRIMARY path an RP obtains a `sid`-bearing id_token, and the hint it later\n      // presents to `/oauth/end-session` to terminate that first-party session.\n      sid: grant.sessionId,\n      extraClaims: idTokenClaims,\n    });\n\n    // Bind the delegated token to the same durable User authorization version\n    // as first-party access/refresh tokens. Delegated tokens have no refresh\n    // path, so request-time comparison is their only post-issuance revocation\n    // fence when userTypes/appRoles/status changes.\n    const ecCreator =\n      this.container.get<ExecutionContextCreatorBackendService>(\n        SAAS_SERVICE_TYPES.ExecutionContextCreatorBackendService,\n      );\n    const repositoriesRegistry =\n      this.container.get<RepositoriesRegistryHandlerBackendService>(\n        SAAS_SERVICE_TYPES.RepositoriesRegistryHandlerService,\n      );\n    const userReadEc = await ecCreator.createForInternalRepositoryOperation({\n      resourceType: CoreResourceType.USERS,\n      operationIdentifier: CoreResourceOperation.READ,\n    });\n    const user = await repositoriesRegistry\n      .getRepository(CoreResourceType.USERS)\n      .read<AuthorizationVersionedUser>(userReadEc, grant.userId);\n    const authorizationVersion = getUserAuthorizationVersion(user);\n    if (\n      !user\n      || user.status !== UserStatus.ACTIVE\n      || authorizationVersion === null\n    ) {\n      throw this._oauthError(\n        ErrorType.AUTHENTICATION,\n        ErrorCustomMessageReference.AUTHENTICATION_INVALID_TOKEN,\n        'invalid_grant',\n        'the authorizing user is no longer active or versioned',\n      );\n    }\n\n    // Mint the USER-delegated access token audience-bound to the named agent endpoint. Roles-only:\n    // the user's roles are fetched at request time (NO authz `scope` on the token); `azp` = the\n    // delegating client for attribution. NO refresh token — a confined agent token must not be able\n    // to mint fresh tokens.\n    const accessClaim = JwtClaim_App_Auth_UserRequest_Schema.parse({\n      type: ExecutionContext_ExecutionType.USER_REQUEST,\n      userId: grant.userId,\n      authorizationVersion,\n      azp: grant.clientId,\n      // Identity scopes (openid/…) ride for IDENTITY only — they carry NO authorization weight.\n      ...(grant.scope.length ? { scope: grant.scope } : {}),\n    });\n    // Confine the delegated token to at most DELEGATED_ACCESS_TOKEN_MAX_TTL_MINUTES (never the full\n    // first-party session TTL). expiresIn MUST mirror the minted `exp`, so both derive from the cap.\n    const delegatedTtlMinutes = Math.min(\n      this.appConfigService.config.jwt.accessTokenExpirationMinutes,\n      DELEGATED_ACCESS_TOKEN_MAX_TTL_MINUTES,\n    );\n    const accessToken = await jwtService.createJwtForDelegatedUserToken(accessClaim, {\n      audience: requestedAudience,\n      expiresInMinutes: delegatedTtlMinutes,\n    });\n    const expiresIn = delegatedTtlMinutes * 60;\n\n    // assurance-control: WILDO.IDENTITY.DELEGATED_AUTHORIZATION — issuing a delegated token grants a\n    // third-party client the ability to act AS the user (the most security-sensitive access grant the\n    // provider makes). Emit the audit/SIEM record (subject, client/azp, audience, granted scopes, TTL).\n    // Fire-and-forget: auditing must never block or fail token issuance. No request EC / verified org at\n    // this mint (the token is not itself an authenticated request), so per-org SIEM dispatch is omitted —\n    // the DB store + Layer-2 immudb sink still record it.\n    const auditLogsForDelegated = this.container.get<AuditLogsBackendService>(SAAS_SERVICE_TYPES.AuditLogsService);\n    void auditLogsForDelegated.logOAuthDelegatedTokenIssued({\n      userId: grant.userId,\n      clientId: grant.clientId,\n      audience: requestedAudience,\n      scopes: grant.scope,\n      ttlSeconds: expiresIn,\n    }).catch((auditError) => this.logger.warn('OAUTH_DELEGATED_TOKEN_ISSUED audit emit failed (non-fatal)', {\n      ...projectCaughtErrorLogFields(auditError),\n    }));\n    this.logger.debug('Issued authorization_code (user-delegated) token', {\n      clientId: grant.clientId, userId: grant.userId, audience: requestedAudience, scopeCount: grant.scope.length, ttlMinutes: delegatedTtlMinutes,\n    });\n\n    return {\n      access_token: accessToken,\n      token_type: 'Bearer',\n      expires_in: expiresIn,\n      id_token: idToken,\n      scope: grant.scope.join(' '),\n    };\n  }\n\n  /**\n   * OIDC `refresh_token` grant. Rotates the presented user refresh token via the existing\n   * `AuthTokenIssuer` (reuse-detection + rotation grace preserved) and returns a fresh access +\n   * refresh token. A rejected/reused/expired token maps to the OAuth `invalid_grant` error.\n   *\n   * Item 5 (OIDC Core §12.2): when the token request AUTHENTICATES a client (a `clientId` AND a valid\n   * `clientSecret`), a fresh `id_token` is ALSO re-issued. This is OPTIONAL per §12.2 and omitted for a\n   * pure first-party session refresh (no credentials). The client is AUTHENTICATED FIRST — crucially\n   * BEFORE the refresh token is rotated — via the shared `verifyPresentedClientSecret` (the same\n   * current/rotation-grace secret check as the revocation and code-exchange paths). This ordering matters:\n   * `refreshAccessToken` unconditionally consumes (blacklists + rotates) the presented token, so a bad\n   * secret checked AFTER it would burn the refresh token and, past the grace window, trip reuse-detection\n   * into revoking the whole token family on the legitimate retry. Authenticating first means (a) the\n   * id_token `aud` names a genuinely-verified client rather than a caller-supplied value, and (b) a failed\n   * authentication fails the WHOLE request as `invalid_client` (401) with NO rotation and NO tokens\n   * issued — never a silent access+refresh downgrade. A `clientId` presented WITHOUT a secret is\n   * not authenticated and therefore yields access + refresh only (no id_token). The re-issued id token\n   * is MINIMAL — `sub`/`aud`/`iss` only, WITHOUT the scope-gated identity claims (email/name/locale) and\n   * (per §12.2) WITHOUT a `nonce`: the original grant's scopes are not threaded onto the first-party\n   * refresh path, so an RP that needs identity claims fetches them from `/oauth/userinfo` (which reads\n   * the fresh access token). The user id is read back from the freshly-minted access token rather than\n   * threaded out of `AuthTokenIssuer` (whose `AuthTokens` deliberately carries no subject) — the access\n   * token is the authoritative subject carrier, and it is first-party (`aud='AUTH_TOKEN'`) so it verifies\n   * with the default key/audience. id-token MINTING (after successful client auth) is best-effort: a\n   * verify miss or an unresolvable issuer (`createJwtForIdToken` throws) simply omits the id token — the\n   * access + refresh tokens are the required output and never fail on the id-token addition.\n   *\n   * ── Audit posture (A-4) — a DELIBERATE, narrow-by-design surface (user-confirmed 2026-07-31) ──\n   * This grant emits exactly TWO audit events, and INTENTIONALLY does not emit on routine failure:\n   *   • SUCCESS  → `OAUTH_TOKEN_REFRESHED` (INFO) — one row per successful rotation.\n   *   • THEFT    → `USER_REFRESH_TOKEN_REUSE_DETECTED` (CRITICAL) — only when the issuer's reuse-detection\n   *                fired and revoked the token family (surfaced via the tagged-error signal below).\n   *   • ROUTINE FAILURE (expired / revoked / plain-invalid presented token) → NO audit event, ON PURPOSE.\n   * Rationale: routine refresh failures are HIGH-VOLUME — every ended/idle session eventually presents an\n   * expired-or-revoked refresh token, so auditing them would FLOOD the compliance store with benign noise\n   * and drown the signal a SOC actually monitors. The security-relevant refresh failure is credential\n   * THEFT, which is precisely what reuse-detection catches and A-9 records; a plain expired token is not a\n   * security event. Auditing high-frequency expected failures is a recognised audit-log anti-pattern\n   * (signal-to-noise collapse). If a future control ever needs the full rejected-attempt stream, add a\n   * DEBOUNCED/aggregated counter (a metric, not a per-attempt audit row) rather than a per-request event.\n   */\n  public async issueRefreshTokenGrant(refreshToken: string, clientId?: string, clientSecret?: string): Promise<OAuthTokenSuccessResponse & { refresh_token?: string; id_token?: string }> {\n    // Item 5 — AUTHENTICATE the client BEFORE the (destructive) refresh-token rotation. `refreshAccessToken`\n    // unconditionally blacklists the presented token's jti and mints a successor, so authenticating AFTER it\n    // would CONSUME the refresh token even on a bad secret — and after the rotation-grace window the\n    // legitimate retry would trip reuse-detection and revoke the whole token family (logout everywhere). By\n    // gating here, a bad secret throws `invalid_client` (→ the token endpoint's 401 mapping) with NO rotation\n    // having happened. Only `clientId` + `clientSecret` together require authentication (and yield an\n    // id_token); a first-party session refresh presents neither and skips straight to rotation.\n    if (clientId && clientSecret) {\n      const authCodeService = this.container.get<OidcAuthorizationCodeBackendService>(SAAS_SERVICE_TYPES.OidcAuthorizationCode);\n      await authCodeService.verifyPresentedClientSecret(clientId, clientSecret);\n    }\n\n    const userTokenIssuer = this.container.get<AuthTokenIssuerBackendService>(SAAS_SERVICE_TYPES.AuthTokenIssuer);\n    let tokens;\n    try {\n      tokens = await userTokenIssuer.refreshAccessToken(refreshToken);\n    } catch (refreshError) {\n      // A-9 caller-signal: the issuer performs the family revoke but does NOT audit (TRAP 13); it TAGS a\n      // reuse rejection with the theft signal. If present, emit `USER_REFRESH_TOKEN_REUSE_DETECTED` here.\n      // A routine expired/revoked/invalid refresh carries NO signal ⇒ no event (deliberate anti-flood: the\n      // security-relevant refresh failure is theft, not routine session expiry). Fire-and-forget.\n      // assurance-control: WILDO.IDENTITY.CREDENTIAL_LIFECYCLE — credential-theft detection + response.\n      const reuseSignal = extractRefreshTokenReuseSignal(refreshError);\n      if (reuseSignal) {\n        const auditLogsForReuse = this.container.get<AuditLogsBackendService>(SAAS_SERVICE_TYPES.AuditLogsService);\n        void auditLogsForReuse.logUserRefreshTokenReuseDetected({\n          userId: reuseSignal.userId,\n          reusedJti: reuseSignal.reusedJti,\n          sessionId: reuseSignal.sessionId,\n          familyRevoked: reuseSignal.familyRevoked,\n        }).catch((auditError) => this.logger.warn('USER_REFRESH_TOKEN_REUSE_DETECTED audit emit failed (non-fatal)', {\n          ...projectCaughtErrorLogFields(auditError),\n        }));\n      }\n      throw this._oauthError(ErrorType.AUTHENTICATION, ErrorCustomMessageReference.AUTHENTICATION_API_KEY_INVALID, 'invalid_grant', 'refresh token invalid, expired, or revoked');\n    }\n    const expiresIn = tokens.expiresIn ?? this.appConfigService.config.jwt.accessTokenExpirationMinutes * 60;\n\n    // The client was already authenticated above → mint a MINIMAL id_token from the fresh access token\n    // (best-effort; a verify miss / unresolvable issuer omits it without failing the now-completed rotation).\n    let idToken: string | undefined;\n    // A-4: the subject read off the fresh access token (client-authenticated path only) — threaded into the\n    // success audit below when available; the general first-party refresh path audits without a subject.\n    let refreshedUserId: string | undefined;\n    if (clientId && clientSecret) {\n      try {\n        const jwtService = this.container.get<JwtBackendService>(SAAS_SERVICE_TYPES.JwtBackendService);\n        // Quiet verify (no default backend error LOG) — a best-effort read of OUR OWN freshly-minted token.\n        // The refreshed access token carries the same `sessionId` as its predecessor (revocation-C: refresh\n        // propagates it), so a `sid`-bearing id_token stays coherent across a refresh.\n        const claims = await jwtService.verifyWithoutBackendErrorActions(tokens.accessToken) as { sub?: string; sessionId?: string };\n        if (claims.sub) {\n          refreshedUserId = claims.sub;\n          idToken = await jwtService.createJwtForIdToken({ userId: claims.sub, clientId, sid: claims.sessionId });\n        }\n      } catch (idTokenError) {\n        this.logger.debug('ID token omitted from refresh_token grant (non-fatal)', {\n          reason: describeCaughtError(idTokenError),\n        });\n      }\n    }\n\n    // A-4: audit the SUCCESSFUL provider refresh grant. Low-detail INFO — the security-relevant refresh\n    // failure (theft/reuse) is audited via A-9 above; routine failures are intentionally not audited.\n    // assurance-control: WILDO.IDENTITY.CREDENTIAL_LIFECYCLE — token lifecycle (refresh). Fire-and-forget.\n    const clientAuthenticated = Boolean(clientId && clientSecret);\n    const auditLogsForRefresh = this.container.get<AuditLogsBackendService>(SAAS_SERVICE_TYPES.AuditLogsService);\n    void auditLogsForRefresh.logOAuthTokenRefreshed({\n      userId: refreshedUserId,\n      clientId: clientAuthenticated ? clientId : undefined,\n      clientAuthenticated,\n    }).catch((auditError) => this.logger.warn('OAUTH_TOKEN_REFRESHED audit emit failed (non-fatal)', {\n      ...projectCaughtErrorLogFields(auditError),\n    }));\n\n    return {\n      access_token: tokens.accessToken,\n      token_type: 'Bearer',\n      expires_in: expiresIn,\n      ...(tokens.refreshToken ? { refresh_token: tokens.refreshToken } : {}),\n      ...(idToken ? { id_token: idToken } : {}),\n      scope: '',\n    };\n  }\n\n  /**\n   * OAuth 2.0 token revocation (RFC 7009). Revokes a user refresh token. Per §2.2 the endpoint\n   * returns success even for an unknown/invalid token (no token-status oracle), so this NEVER\n   * throws for a bad token — only unexpected infra failures propagate.\n   */\n  public async revokeRefreshToken(refreshToken: string): Promise<void> {\n    const userTokenIssuer = this.container.get<AuthTokenIssuerBackendService>(SAAS_SERVICE_TYPES.AuthTokenIssuer);\n    try {\n      await userTokenIssuer.revokeRefreshToken(refreshToken);\n    } catch (error) {\n      // RFC 7009 §2.2: an invalid token is still a successful revocation. Swallow validation\n      // errors; log at debug for observability.\n      this.logger.debug('Token revocation on a non-revocable token treated as success (RFC 7009)', { reason: describeCaughtError(error) });\n    }\n  }\n\n  /**\n   * Build a typed backend error carrying the precise OAuth 2.0 error code in `context.oauthError`\n   * so the token-endpoint controller can render the RFC 6749 §5.2 error response body.\n   */\n  private _oauthError(type: ErrorType, ref: ErrorCustomMessageReference, oauthError: string, detail: string) {\n    return this.errorBuilder.buildError(type, undefined, {\n      customMessageReference: ref,\n      context: { oauthError, detail },\n    });\n  }\n}\n"]}
+{"version":3,"file":"oauth-provider-token.backend.service.js","sourceRoot":"","sources":["../../../../../../src/security/authentications/services/oauth-provider-token.backend.service.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,OAAO,kBAAkB,CAAC;AAC1B,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAE/C,OAAO,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AACpF,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAC7F,OAAO,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AAC/G,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAC9G,OAAO,EAAE,mBAAmB,EAAE,2BAA2B,EAAE,MAAM,8EAA8E,CAAC;AAChJ,OAAO,EAAE,gCAAgC,EAAE,MAAM,2FAA2F,CAAC;AAC7I,OAAO,EAAE,qBAAqB,EAAE,MAAM,iFAAiF,CAAC;AAOxH,OAAO,EAAE,8BAA8B,EAAE,MAAM,wFAAwF,CAAC;AACxI,OAAO,EAAE,yBAAyB,EAAE,MAAM,+FAA+F,CAAC;AAG1I,OAAO,EACL,WAAW,EACX,qBAAqB,EACrB,gBAAgB,EAChB,gCAAgC,EAChC,8BAA8B,EAC9B,2BAA2B,EAC3B,SAAS,EACT,8BAA8B,EAC9B,iBAAiB,EACjB,iBAAiB,EACjB,cAAc,EACd,oBAAoB,EACpB,UAAU,GACX,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,oCAAoC,EAAE,MAAM,oFAAoF,CAAC;AAE1I,OAAO,EAAE,yBAAyB,EAAE,mBAAmB,EAAE,MAAM,qEAAqE,CAAC;AAErI,OAAO,EACL,2BAA2B,GAE5B,MAAM,6FAA6F,CAAC;AAErG;;;;;;;GAOG;AACH,MAAM,sCAAsC,GAAG,EAAE,CAAC;AAoClD;;;;;;;;;;;;;;GAcG;AAEI,IAAM,gCAAgC,GAAtC,MAAM,gCAAgC;IAEc;IACH;IACU;IACG;IACD;IALlE,YACyD,SAAoB,EACvB,MAAqB,EACX,gBAAyC,EACtC,YAAwC,EACzC,kBAAoD;QAJ7D,cAAS,GAAT,SAAS,CAAW;QACvB,WAAM,GAAN,MAAM,CAAe;QACX,qBAAgB,GAAhB,gBAAgB,CAAyB;QACtC,iBAAY,GAAZ,YAAY,CAA4B;QACzC,uBAAkB,GAAlB,kBAAkB,CAAkC;IACnH,CAAC;IAEG,KAAK,CAAC,2BAA2B,CAAC,OAA2C;QAClF,MAAM,EAAE,YAAY,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC;QAErD,iFAAiF;QACjF,MAAM,SAAS,GAAG,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC;YAClD,CAAC,CAAC,WAAW,CAAC,YAAY;YAC1B,CAAC,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC;gBAClC,CAAC,CAAC,WAAW,CAAC,WAAW;gBACzB,CAAC,CAAC,SAAS,CAAC;QAChB,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,cAAc,EAAE,2BAA2B,CAAC,8BAA8B,EAAE,gBAAgB,EAAE,mCAAmC,CAAC,CAAC;QACtK,CAAC;QACD,MAAM,YAAY,GAAG,SAAS,KAAK,WAAW,CAAC,YAAY;YACzD,CAAC,CAAC,gBAAgB,CAAC,0BAA0B;YAC7C,CAAC,CAAC,gBAAgB,CAAC,yBAAyB,CAAC;QAE/C,mFAAmF;QACnF,2EAA2E;QAC3E,MAAM,WAAW,GAAG,IAAI,CAAC,gBAAgB,CAAC,0BAA0B,EAAE,CAAC;QACvE,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,aAAa,EAAE,2BAA2B,CAAC,mBAAmB,EAAE,yBAAyB,EAAE,oCAAoC,CAAC,CAAC;QACpK,CAAC;QACD,iGAAiG;QACjG,oGAAoG;QACpG,+FAA+F;QAC/F,mGAAmG;QACnG,+FAA+F;QAC/F,+FAA+F;QAC/F,mFAAmF;QACnF,kGAAkG;QAClG,gGAAgG;QAChG,iGAAiG;QACjG,2CAA2C;QAC3C,MAAM,iBAAiB,GAAG,QAAQ,IAAI,WAAW,CAAC;QAClD,MAAM,yBAAyB,GAAG,IAAI,CAAC,SAAS;aAC7C,GAAG,CAAgD,kBAAkB,CAAC,+BAA+B,CAAC;aACtG,2BAA2B,CAAC,8BAA8B,CAAC,CAAC;QAC/D,IAAI,CAAC,yBAAyB,CAAC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,CAAC;YAC3D,MAAM,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,aAAa,EAAE,2BAA2B,CAAC,4BAA4B,EAAE,gBAAgB,EAAE,yBAAyB,QAAQ,GAAG,CAAC,CAAC;QACpK,CAAC;QAED,6EAA6E;QAC7E,uEAAuE;QACvE,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAwC,kBAAkB,CAAC,qCAAqC,CAAC,CAAC;QACtI,MAAM,oBAAoB,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAA4C,kBAAkB,CAAC,kCAAkC,CAAC,CAAC;QAClJ,MAAM,UAAU,GAAG,MAAM,SAAS,CAAC,oCAAoC,CAAC;YACtE,YAAY;YACZ,mBAAmB,EAAE,qBAAqB,CAAC,IAAI;SAChD,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,oBAAoB,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC;QAG9D,MAAM,aAAa,GAAG,qBAAqB,CAAC,YAAY,CAAC,CAAC;QAC1D,IAAI,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAiB,UAAU,EAAE,EAAE,YAAY,EAAE,aAAa,EAAE,CAAC,CAAC;QAC1F,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,IAAI,CAAiB,UAAU,EAAE,EAAE,oBAAoB,EAAE,aAAa,EAAE,CAAC,CAAC;YACrG,IAAI,OAAO,IAAI,yBAAyB,CAAC,OAAO,CAAC,8BAA8B,CAAC,EAAE,CAAC;gBACjF,MAAM,GAAG,OAAO,CAAC;YACnB,CAAC;QACH,CAAC;QAED,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,iBAAiB,CAAC,MAAM,IAAI,mBAAmB,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;YACnG,MAAM,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,cAAc,EAAE,2BAA2B,CAAC,8BAA8B,EAAE,gBAAgB,EAAE,8BAA8B,CAAC,CAAC;QACjK,CAAC;QACD,2EAA2E;QAC3E,IAAI,QAAQ,IAAI,QAAQ,KAAK,MAAM,CAAC,GAAG,EAAE,CAAC;YACxC,MAAM,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,cAAc,EAAE,2BAA2B,CAAC,8BAA8B,EAAE,gBAAgB,EAAE,2CAA2C,CAAC,CAAC;QAC9K,CAAC;QACD,IAAI,CAAC,CAAC,MAAM,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,cAAc,CAAC,kBAAkB,CAAC,EAAE,CAAC;YAC9E,MAAM,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,aAAa,EAAE,2BAA2B,CAAC,4BAA4B,EAAE,qBAAqB,EAAE,2DAA2D,CAAC,CAAC;QAChM,CAAC;QAED,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,GAGxB,SAAS,KAAK,WAAW,CAAC,YAAY;YACxC,CAAC,CAAC,EAAE,SAAS,EAAE,oBAAoB,CAAC,aAAa,EAAE,OAAO,EAAG,MAAkC,CAAC,cAAc,EAAE;YAChH,CAAC,CAAC,EAAE,SAAS,EAAE,oBAAoB,CAAC,WAAW,EAAE,OAAO,EAAG,MAAiC,CAAC,aAAa,EAAE,CAAC;QAE/G,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,sBAAsB,CAAC;YAClE,QAAQ,EAAE,MAAM,CAAC,GAAG;YACpB,SAAS;YACT,OAAO;YACP,KAAK,EAAE,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAY;YACtC,QAAQ,EAAE,iBAAiB;SAC5B,CAAC,CAAC;QAEH,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,0DAA0D,EAAE;YAC5E,QAAQ,EAAE,MAAM,CAAC,GAAG;YACpB,SAAS;YACT,OAAO;SACR,CAAC,CAAC;QAEH,2FAA2F;QAC3F,8FAA8F;QAC9F,8FAA8F;QAC9F,EAAE;QACF,2FAA2F;QAC3F,6FAA6F;QAC7F,2FAA2F;QAC3F,4FAA4F;QAC5F,8FAA8F;QAC9F,iGAAiG;QACjG,0FAA0F;QAC1F,iGAAiG;QACjG,8FAA8F;QAC9F,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAA0B,kBAAkB,CAAC,gBAAgB,CAAC,CAAC;QACnG,MAAM,wBAAwB,GAAgC,SAAS,KAAK,oBAAoB,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,OAAwB,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACxJ,KAAK,SAAS,CAAC,qBAAqB,CAAC;YACnC,UAAU,EAAE,iBAAiB,CAAC,YAAY;YAC1C,YAAY,EAAE,MAAM,CAAC,GAAG;YACxB,SAAS,EAAE,SAAS,KAAK,oBAAoB,CAAC,aAAa;gBACzD,CAAC,CAAC,8BAA8B,CAAC,oBAAoB;gBACrD,CAAC,CAAC,8BAA8B,CAAC,mBAAmB;YACtD,OAAO;YACP,cAAc,EAAE,SAAS,KAAK,oBAAoB,CAAC,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS;SACvF,EAAE,SAAS,EAAE,wBAAwB,CAAC,CAAC,KAAK,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,oDAAoD,EAAE;YACnI,GAAG,2BAA2B,CAAC,UAAU,CAAC;SAC3C,CAAC,CAAC,CAAC;QAEJ,OAAO;YACL,YAAY,EAAE,MAAM,CAAC,WAAW;YAChC,UAAU,EAAE,QAAQ;YACpB,UAAU,EAAE,MAAM,CAAC,SAAS;SAC7B,CAAC;IACJ,CAAC;IAED;;;;;;;;OAQG;IACI,KAAK,CAAC,2BAA2B,CAAC,OAiBxC;QACC,MAAM,eAAe,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAsC,kBAAkB,CAAC,qBAAqB,CAAC,CAAC;QAC1H,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAoB,kBAAkB,CAAC,iBAAiB,CAAC,CAAC;QAE/F,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,yBAAyB,CAAC;YAC5D,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,YAAY,EAAE,OAAO,CAAC,YAAY;YAClC,qBAAqB,EAAE,OAAO,CAAC,YAAY;SAC5C,CAAC,CAAC;QAEH,4FAA4F;QAC5F,6FAA6F;QAC7F,gGAAgG;QAChG,0FAA0F;QAC1F,+FAA+F;QAC/F,8EAA8E;QAC9E,MAAM,iBAAiB,GAAG,KAAK,CAAC,QAAQ,CAAC;QACzC,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACvB,MAAM,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,aAAa,EAAE,2BAA2B,CAAC,4BAA4B,EAAE,gBAAgB,EACxH,kFAAkF,CAAC,CAAC;QACxF,CAAC;QACD,iGAAiG;QACjG,iGAAiG;QACjG,mFAAmF;QACnF,IAAI,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,KAAK,iBAAiB,EAAE,CAAC;YAC/D,MAAM,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,aAAa,EAAE,2BAA2B,CAAC,4BAA4B,EAAE,gBAAgB,EACxH,mGAAmG,CAAC,CAAC;QACzG,CAAC;QACD,+FAA+F;QAC/F,kGAAkG;QAClG,yFAAyF;QACzF,MAAM,yBAAyB,GAAG,IAAI,CAAC,SAAS;aAC7C,GAAG,CAAgD,kBAAkB,CAAC,+BAA+B,CAAC;aACtG,2BAA2B,CAAC,gCAAgC,CAAC,CAAC;QACjE,IAAI,CAAC,yBAAyB,CAAC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,CAAC;YAC3D,MAAM,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,aAAa,EAAE,2BAA2B,CAAC,4BAA4B,EAAE,gBAAgB,EACxH,aAAa,iBAAiB,mDAAmD,CAAC,CAAC;QACvF,CAAC;QAED,kGAAkG;QAClG,8FAA8F;QAC9F,+FAA+F;QAC/F,oGAAoG;QACpG,iEAAiE;QACjE,MAAM,iBAAiB,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAA+B,kBAAkB,CAAC,cAAc,CAAC,CAAC;QAC9G,MAAM,aAAa,GAAG,MAAM,iBAAiB,CAAC,iBAAiB,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;QAC3F,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,mBAAmB,CAAC;YACnD,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,mGAAmG;YACnG,iGAAiG;YACjG,0EAA0E;YAC1E,GAAG,EAAE,KAAK,CAAC,SAAS;YACpB,WAAW,EAAE,aAAa;SAC3B,CAAC,CAAC;QAEH,0EAA0E;QAC1E,yEAAyE;QACzE,0EAA0E;QAC1E,gDAAgD;QAChD,MAAM,SAAS,GACb,IAAI,CAAC,SAAS,CAAC,GAAG,CAChB,kBAAkB,CAAC,qCAAqC,CACzD,CAAC;QACJ,MAAM,oBAAoB,GACxB,IAAI,CAAC,SAAS,CAAC,GAAG,CAChB,kBAAkB,CAAC,kCAAkC,CACtD,CAAC;QACJ,MAAM,UAAU,GAAG,MAAM,SAAS,CAAC,oCAAoC,CAAC;YACtE,YAAY,EAAE,gBAAgB,CAAC,KAAK;YACpC,mBAAmB,EAAE,qBAAqB,CAAC,IAAI;SAChD,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,oBAAoB;aACpC,aAAa,CAAC,gBAAgB,CAAC,KAAK,CAAC;aACrC,IAAI,CAA6B,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QAC9D,MAAM,oBAAoB,GAAG,2BAA2B,CAAC,IAAI,CAAC,CAAC;QAC/D,IACE,CAAC,IAAI;eACF,IAAI,CAAC,MAAM,KAAK,UAAU,CAAC,MAAM;eACjC,oBAAoB,KAAK,IAAI,EAChC,CAAC;YACD,MAAM,IAAI,CAAC,WAAW,CACpB,SAAS,CAAC,cAAc,EACxB,2BAA2B,CAAC,4BAA4B,EACxD,eAAe,EACf,uDAAuD,CACxD,CAAC;QACJ,CAAC;QAED,+FAA+F;QAC/F,4FAA4F;QAC5F,gGAAgG;QAChG,wBAAwB;QACxB,MAAM,WAAW,GAAG,oCAAoC,CAAC,KAAK,CAAC;YAC7D,IAAI,EAAE,8BAA8B,CAAC,YAAY;YACjD,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,oBAAoB;YACpB,GAAG,EAAE,KAAK,CAAC,QAAQ;YACnB,0FAA0F;YAC1F,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACtD,CAAC,CAAC;QACH,gGAAgG;QAChG,iGAAiG;QACjG,MAAM,mBAAmB,GAAG,IAAI,CAAC,GAAG,CAClC,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,GAAG,CAAC,4BAA4B,EAC7D,sCAAsC,CACvC,CAAC;QACF,MAAM,WAAW,GAAG,MAAM,UAAU,CAAC,8BAA8B,CAAC,WAAW,EAAE;YAC/E,QAAQ,EAAE,iBAAiB;YAC3B,gBAAgB,EAAE,mBAAmB;SACtC,CAAC,CAAC;QACH,MAAM,SAAS,GAAG,mBAAmB,GAAG,EAAE,CAAC;QAE3C,iGAAiG;QACjG,kGAAkG;QAClG,oGAAoG;QACpG,qEAAqE;QACrE,EAAE;QACF,oGAAoG;QACpG,iGAAiG;QACjG,mGAAmG;QACnG,gGAAgG;QAChG,8FAA8F;QAC9F,kGAAkG;QAClG,8FAA8F;QAC9F,+FAA+F;QAC/F,gGAAgG;QAChG,4EAA4E;QAC5E,EAAE;QACF,mGAAmG;QACnG,oGAAoG;QACpG,8FAA8F;QAC9F,MAAM,qBAAqB,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAA0B,kBAAkB,CAAC,gBAAgB,CAAC,CAAC;QAC/G,KAAK,CAAC,KAAK,IAAI,EAAE;YACf,6FAA6F;YAC7F,wFAAwF;YACxF,MAAM,sBAAsB,GAAG,MAAM,IAAI,CAAC,4BAA4B,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YACrF,MAAM,qBAAqB,CAAC,4BAA4B,CAAC;gBACvD,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,QAAQ,EAAE,iBAAiB;gBAC3B,MAAM,EAAE,KAAK,CAAC,KAAK;gBACnB,UAAU,EAAE,SAAS;aACtB,EAAE,SAAS,EAAE,sBAAsB,CAAC,CAAC;QACxC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,4DAA4D,EAAE;YACxG,GAAG,2BAA2B,CAAC,UAAU,CAAC;SAC3C,CAAC,CAAC,CAAC;QACJ,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,kDAAkD,EAAE;YACpE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,QAAQ,EAAE,iBAAiB,EAAE,UAAU,EAAE,KAAK,CAAC,KAAK,CAAC,MAAM,EAAE,UAAU,EAAE,mBAAmB;SAC7I,CAAC,CAAC;QAEH,OAAO;YACL,YAAY,EAAE,WAAW;YACzB,UAAU,EAAE,QAAQ;YACpB,UAAU,EAAE,SAAS;YACrB,QAAQ,EAAE,OAAO;YACjB,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC;SAC7B,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAwCG;IACI,KAAK,CAAC,sBAAsB,CAAC,YAAoB,EAAE,QAAiB,EAAE,YAAqB;QAChG,yGAAyG;QACzG,yGAAyG;QACzG,iGAAiG;QACjG,wGAAwG;QACxG,0GAA0G;QAC1G,kGAAkG;QAClG,4FAA4F;QAC5F,IAAI,QAAQ,IAAI,YAAY,EAAE,CAAC;YAC7B,MAAM,eAAe,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAsC,kBAAkB,CAAC,qBAAqB,CAAC,CAAC;YAC1H,MAAM,eAAe,CAAC,2BAA2B,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;QAC5E,CAAC;QAED,MAAM,eAAe,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAgC,kBAAkB,CAAC,eAAe,CAAC,CAAC;QAC9G,IAAI,MAAM,CAAC;QACX,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,eAAe,CAAC,kBAAkB,CAAC,YAAY,CAAC,CAAC;QAClE,CAAC;QAAC,OAAO,YAAY,EAAE,CAAC;YACtB,mGAAmG;YACnG,oGAAoG;YACpG,qGAAqG;YACrG,4FAA4F;YAC5F,kGAAkG;YAClG,+FAA+F;YAC/F,+FAA+F;YAC/F,8FAA8F;YAC9F,8FAA8F;YAC9F,iGAAiG;YACjG,MAAM,WAAW,GAAG,8BAA8B,CAAC,YAAY,CAAC,CAAC;YACjE,IAAI,WAAW,EAAE,CAAC;gBAChB,MAAM,iBAAiB,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAA0B,kBAAkB,CAAC,gBAAgB,CAAC,CAAC;gBAC3G,KAAK,CAAC,KAAK,IAAI,EAAE;oBACf,MAAM,kBAAkB,GAAG,MAAM,IAAI,CAAC,4BAA4B,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;oBACvF,MAAM,iBAAiB,CAAC,gCAAgC,CAAC;wBACvD,MAAM,EAAE,WAAW,CAAC,MAAM;wBAC1B,SAAS,EAAE,WAAW,CAAC,SAAS;wBAChC,SAAS,EAAE,WAAW,CAAC,SAAS;wBAChC,aAAa,EAAE,WAAW,CAAC,aAAa;qBACzC,EAAE,SAAS,EAAE,kBAAkB,CAAC,CAAC;gBACpC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,iEAAiE,EAAE;oBAC7G,GAAG,2BAA2B,CAAC,UAAU,CAAC;iBAC3C,CAAC,CAAC,CAAC;YACN,CAAC;YACD,MAAM,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,cAAc,EAAE,2BAA2B,CAAC,8BAA8B,EAAE,eAAe,EAAE,4CAA4C,CAAC,CAAC;QAC9K,CAAC;QACD,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,IAAI,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,GAAG,CAAC,4BAA4B,GAAG,EAAE,CAAC;QAEzG,mGAAmG;QACnG,0GAA0G;QAC1G,IAAI,OAA2B,CAAC;QAChC,wGAAwG;QACxG,qGAAqG;QACrG,IAAI,eAAmC,CAAC;QACxC,IAAI,QAAQ,IAAI,YAAY,EAAE,CAAC;YAC7B,IAAI,CAAC;gBACH,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAoB,kBAAkB,CAAC,iBAAiB,CAAC,CAAC;gBAC/F,oGAAoG;gBACpG,oGAAoG;gBACpG,+EAA+E;gBAC/E,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,gCAAgC,CAAC,MAAM,CAAC,WAAW,CAAyC,CAAC;gBAC7H,IAAI,MAAM,CAAC,GAAG,EAAE,CAAC;oBACf,eAAe,GAAG,MAAM,CAAC,GAAG,CAAC;oBAC7B,OAAO,GAAG,MAAM,UAAU,CAAC,mBAAmB,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC;gBAC1G,CAAC;YACH,CAAC;YAAC,OAAO,YAAY,EAAE,CAAC;gBACtB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,uDAAuD,EAAE;oBACzE,MAAM,EAAE,mBAAmB,CAAC,YAAY,CAAC;iBAC1C,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,oGAAoG;QACpG,kGAAkG;QAClG,uGAAuG;QACvG,EAAE;QACF,kGAAkG;QAClG,oEAAoE;QACpE,EAAE;QACF,qGAAqG;QACrG,8FAA8F;QAC9F,oGAAoG;QACpG,mGAAmG;QACnG,mGAAmG;QACnG,oGAAoG;QACpG,gGAAgG;QAChG,gGAAgG;QAChG,kGAAkG;QAClG,2EAA2E;QAC3E,MAAM,mBAAmB,GAAG,OAAO,CAAC,QAAQ,IAAI,YAAY,CAAC,CAAC;QAC9D,MAAM,mBAAmB,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAA0B,kBAAkB,CAAC,gBAAgB,CAAC,CAAC;QAC7G,KAAK,CAAC,KAAK,IAAI,EAAE;YACf,MAAM,oBAAoB,GAAG,MAAM,IAAI,CAAC,4BAA4B,CAAC,eAAe,CAAC,CAAC;YACtF,MAAM,mBAAmB,CAAC,sBAAsB,CAAC;gBAC/C,MAAM,EAAE,eAAe;gBACvB,QAAQ,EAAE,mBAAmB,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS;gBACpD,mBAAmB;aACpB,EAAE,SAAS,EAAE,oBAAoB,CAAC,CAAC;QACtC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,qDAAqD,EAAE;YACjG,GAAG,2BAA2B,CAAC,UAAU,CAAC;SAC3C,CAAC,CAAC,CAAC;QAEJ,OAAO;YACL,YAAY,EAAE,MAAM,CAAC,WAAW;YAChC,UAAU,EAAE,QAAQ;YACpB,UAAU,EAAE,SAAS;YACrB,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACtE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACzC,KAAK,EAAE,EAAE;SACV,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACI,KAAK,CAAC,kBAAkB,CAAC,YAAoB;QAClD,MAAM,eAAe,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAgC,kBAAkB,CAAC,eAAe,CAAC,CAAC;QAC9G,IAAI,CAAC;YACH,MAAM,eAAe,CAAC,kBAAkB,CAAC,YAAY,CAAC,CAAC;QACzD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,uFAAuF;YACvF,0CAA0C;YAC1C,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,yEAAyE,EAAE,EAAE,MAAM,EAAE,mBAAmB,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACvI,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAiCG;IACK,KAAK,CAAC,4BAA4B,CAAC,MAA0B;QACnE,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,IAAI,CAAC;YACH,MAAM,mBAAmB,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAA6B,kBAAkB,CAAC,mBAAmB,CAAC,CAAC;YACnH,OAAO,MAAM,yBAAyB,CAAC,mBAAmB,EAAE,MAAM,CAAC,CAAC;QACtE,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IAED;;;OAGG;IACK,WAAW,CAAC,IAAe,EAAE,GAAgC,EAAE,UAAkB,EAAE,MAAc;QACvG,OAAO,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,IAAI,EAAE,SAAS,EAAE;YACnD,sBAAsB,EAAE,GAAG;YAC3B,OAAO,EAAE,EAAE,UAAU,EAAE,MAAM,EAAE;SAChC,CAAC,CAAC;IACL,CAAC;CACF,CAAA;AAriBY,gCAAgC;IAD5C,UAAU,EAAE;IAGR,WAAA,MAAM,CAAC,kBAAkB,CAAC,SAAS,CAAC,CAAA;IACpC,WAAA,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAA;IACjC,WAAA,MAAM,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,CAAA;IAC3C,WAAA,MAAM,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,CAAA;IAC9C,WAAA,MAAM,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,CAAA;+CAHc,aAAa;QACO,uBAAuB;QACxB,0BAA0B;QACrB,gCAAgC;GAN3G,gCAAgC,CAqiB5C","sourcesContent":["import 'reflect-metadata';\nimport { inject, injectable } from 'inversify';\nimport type { Container } from 'inversify';\nimport { SAAS_SERVICE_TYPES } from '~wildo-backend-lib/inject/models/service-types';\nimport { LoggerService } from '~wildo-backend-lib/monitoring/logger/services/logger.service';\nimport { AppConfigurationService } from '~wildo-backend-lib/config/services/app-configuration.backend.service';\nimport { ErrorBuilderBackendService } from '~wildo-backend-lib/errors/services/error-builder.backend.service';\nimport { describeCaughtError, projectCaughtErrorLogFields } from '~wildo-backend-lib/errors/utils/error-log-level-classification.backend.utils';\nimport { MachineTokenIssuerBackendService } from '~wildo-backend-lib/security/authentications/services/machine-token-issuer.backend.service';\nimport { hashOAuthClientSecret } from '~wildo-backend-lib/security/oauth-clients/oauth-client-generation.backend.utils';\nimport type { ExecutionContextCreatorBackendService } from '~wildo-backend-lib/runtime/services/execution-context-creator.backend.service';\nimport type { RepositoriesRegistryHandlerBackendService } from '~wildo-backend-lib/base-classes/services/repositories/repositories-registry-handler.backend.service';\nimport type { OidcAuthorizationCodeBackendService } from '~wildo-backend-lib/security/authentications/services/oidc-authorization-code.backend.service';\nimport type { OidcUserClaimsBackendService } from '~wildo-backend-lib/security/authentications/services/oidc-user-claims.backend.service';\nimport type { JwtBackendService } from '~wildo-backend-lib/security/jwt/services/jwt.backend.service';\nimport type { AuthTokenIssuerBackendService } from '~wildo-backend-lib/security/authentications/services/auth-token-issuer.backend.service';\nimport { extractRefreshTokenReuseSignal } from '~wildo-backend-lib/security/authentications/services/auth-token-issuer.backend.service';\nimport { resolveActiveMemberOrgIds } from '~wildo-backend-lib/security/authentications/services/resolve-active-member-orgs.backend.utils';\nimport type { SystemAccessBackendService } from '~wildo-backend-lib/base-classes/services/services/system-access.backend.service';\nimport type { ResourceServerInstancesRegistryBackendService } from '~wildo-backend-lib/mcp/services/resource-server-instances-registry.backend.service';\nimport {\n  ApiKeyScope,\n  CoreResourceOperation,\n  CoreResourceType,\n  DELEGATED_TOKEN_RESOURCE_SERVERS,\n  MACHINE_TOKEN_RESOURCE_SERVERS,\n  ErrorCustomMessageReference,\n  ErrorType,\n  ExecutionContext_ExecutionType,\n  MachineAuthMethod,\n  OAuthClientStatus,\n  OAuthGrantType,\n  ResourcePrimaryScope,\n  UserStatus,\n} from '@wildo-ai/saas-models';\nimport { JwtClaim_App_Auth_UserRequest_Schema } from '~wildo-backend-lib/security/authentications/models/authentications.backend.schemas';\nimport type { OAuthClientApplication, OAuthClientOrganization, Roles, VerifiedOrgId } from '@wildo-ai/saas-models';\nimport { isRotationGraceWindowOpen, isCredentialExpired } from '~wildo-backend-lib/security/credential-rotation-grace.backend.utils';\nimport { AuditLogsBackendService } from '~wildo-backend-lib/compliance/audit-trails/services/audit-logs.backend.service';\nimport {\n  getUserAuthorizationVersion,\n  type AuthorizationVersionedUser,\n} from '~wildo-backend-lib/security/authentications/models/user-authorization-version.backend.utils';\n\n/**\n * Upper bound (minutes) on a USER-DELEGATED (`authorization_code`) access-token lifetime. A consented\n * third-party/agent token that acts AS the user is confined more tightly than a first-party session:\n * it gets NO refresh AND a lifetime capped at this bound, so an over-long operator-configured session\n * TTL (`accessTokenExpirationMinutes`, up to 1440) never widens a delegated token's window. The\n * effective TTL is `min(accessTokenExpirationMinutes, this)`. A dedicated operator-authored delegated\n * TTL config knob is the future extension; this cap is the safe default until then.\n */\nconst DELEGATED_ACCESS_TOKEN_MAX_TTL_MINUTES = 30;\n\n/**\n * Parsed input for the OAuth 2.0 `client_credentials` grant. The HTTP token-endpoint\n * controller (OIDC branch) extracts these from the request (`client_secret_basic` /\n * `client_secret_post` for the client secret, plus the `resource` (RFC 8707) form param) and\n * hands them here; this service is transport-agnostic.\n */\nexport interface OAuthClientCredentialsGrantRequest {\n  /** The presented `oc_org_`/`oc_app_` client secret. */\n  clientSecret: string;\n  /** Optional `client_id` for a defensive cross-check against the resolved client. */\n  clientId?: string;\n  /** RFC 8707 resource indicator (the `resource` form param), if supplied. */\n  resource?: string;\n}\n\n/** OAuth 2.0 successful token response (RFC 6749 §5.1) — snake_case is the wire contract. */\nexport interface OAuthTokenSuccessResponse {\n  access_token: string;\n  token_type: 'Bearer';\n  expires_in: number;\n  /**\n   * Optional per RFC 6749 §5.1. Set by the OIDC identity flow (authorization_code, reflecting the\n   * granted identity scopes); OMITTED by client_credentials — machine tokens are roles-only, with\n   * no scope-based authorization.\n   */\n  scope?: string;\n}\n\n/** authorization_code / OIDC token response — adds the ID token + (optional) refresh token. */\nexport interface OidcTokenSuccessResponse extends OAuthTokenSuccessResponse {\n  id_token: string;\n  refresh_token?: string;\n}\n\n/**\n * OAuth 2.0 Authorization Server — `client_credentials` grant issuance. Verifies a\n * registered {@link OAuthClientOrganization}/{@link OAuthClientApplication} by its\n * presented secret and mints a short-lived, audience-bound machine access token via\n * {@link MachineTokenIssuerBackendService}. Transport-agnostic (no HTTP): the OIDC-branch\n * token-endpoint controller is a thin wrapper that parses the request and formats the\n * OAuth response / error.\n *\n * Secret verification MIRRORS the request-auth choke point's direct-secret front\n * (`handle{Organization,Application}OAuthClient`): route by the `oc_` prefix, resolve by\n * `hashedSecret` then the `previousHashedSecret` rotation-grace slot, require `ACTIVE`.\n * The audience is resolved through the SHARED\n * {@link AppConfigurationService.resolveApiResourceAudience} so the token this endpoint\n * mints carries exactly the `aud` the choke point validates (RFC 8707 — no drift).\n */\n@injectable()\nexport class OAuthProviderTokenBackendService {\n  constructor(\n    @inject(SAAS_SERVICE_TYPES.Container) private readonly container: Container,\n    @inject(SAAS_SERVICE_TYPES.Logger) private readonly logger: LoggerService,\n    @inject(SAAS_SERVICE_TYPES.AppConfigService) private readonly appConfigService: AppConfigurationService,\n    @inject(SAAS_SERVICE_TYPES.ErrorBuilderService) private readonly errorBuilder: ErrorBuilderBackendService,\n    @inject(SAAS_SERVICE_TYPES.MachineTokenIssuer) private readonly machineTokenIssuer: MachineTokenIssuerBackendService,\n  ) {}\n\n  public async issueClientCredentialsToken(request: OAuthClientCredentialsGrantRequest): Promise<OAuthTokenSuccessResponse> {\n    const { clientSecret, clientId, resource } = request;\n\n    // Route by secret prefix (same discriminator the request-auth choke point uses).\n    const scopeKind = clientSecret.startsWith('oc_org_')\n      ? ApiKeyScope.ORGANIZATION\n      : clientSecret.startsWith('oc_app_')\n        ? ApiKeyScope.APPLICATION\n        : undefined;\n    if (!scopeKind) {\n      throw this._oauthError(ErrorType.AUTHENTICATION, ErrorCustomMessageReference.AUTHENTICATION_API_KEY_INVALID, 'invalid_client', 'unrecognized client secret prefix');\n    }\n    const resourceType = scopeKind === ApiKeyScope.ORGANIZATION\n      ? CoreResourceType.OAUTH_CLIENTS_ORGANIZATION\n      : CoreResourceType.OAUTH_CLIENTS_APPLICATION;\n\n    // Resolve + validate the RFC 8707 audience up front (fail fast; the SAME value the\n    // choke point validates against — resolved from the one shared authority).\n    const apiAudience = this.appConfigService.resolveApiResourceAudience();\n    if (!apiAudience) {\n      throw this._oauthError(ErrorType.CONFIGURATION, ErrorCustomMessageReference.JWT_TOKEN_NOT_FOUND, 'temporarily_unavailable', 'api resource audience unresolvable');\n    }\n    // RFC 8707 resource indicator. Absent ⇒ the generic API audience (back-compat: clients that omit\n    // `resource` keep getting an API-audience token). Present ⇒ it MUST name one of this app's resource\n    // servers (API / A2A / MCP); the token is minted `aud`-bound to that surface, so a client that\n    // follows an MCP/A2A endpoint's advertised Protected-Resource-Metadata `resource` receives a token\n    // scoped to that endpoint (confused-deputy / token-passthrough defense) — replacing the former\n    // blanket `invalid_target` rejection of every non-API resource. Mirrors the authorization_code\n    // path's resource validation (below), but the machine set includes the API itself.\n    // R-2: the valid set is enumerated from the INSTANCES REGISTRY — each kind's default surface PLUS\n    // every declared named instance (`…/mcp/<ref>`, `…/a2a/<ref>`) — so declaring a server makes it\n    // mintable and addressable in one move, and an undeclared one is `invalid_target` here (the mint\n    // mirror of the 404 its endpoint returns).\n    const requestedAudience = resource ?? apiAudience;\n    const supportedMachineAudiences = this.container\n      .get<ResourceServerInstancesRegistryBackendService>(SAAS_SERVICE_TYPES.ResourceServerInstancesRegistry)\n      .listResourceServerAudiences(MACHINE_TOKEN_RESOURCE_SERVERS);\n    if (!supportedMachineAudiences.includes(requestedAudience)) {\n      throw this._oauthError(ErrorType.AUTHORIZATION, ErrorCustomMessageReference.AUTHORIZATIONS_ACCESS_DENIED, 'invalid_target', `unsupported resource '${resource}'`);\n    }\n\n    // Repository-direct read (raw record incl. roles/scope FK/status/grants), by\n    // hashedSecret then the rotation-grace slot — mirrors the choke point.\n    const ecCreator = this.container.get<ExecutionContextCreatorBackendService>(SAAS_SERVICE_TYPES.ExecutionContextCreatorBackendService);\n    const repositoriesRegistry = this.container.get<RepositoriesRegistryHandlerBackendService>(SAAS_SERVICE_TYPES.RepositoriesRegistryHandlerService);\n    const internalEc = await ecCreator.createForInternalRepositoryOperation({\n      resourceType,\n      operationIdentifier: CoreResourceOperation.READ,\n    });\n    const repo = repositoriesRegistry.getRepository(resourceType);\n\n    type ResolvedClient = (OAuthClientOrganization | OAuthClientApplication) & { previousSecretInvalidationDate?: Date | null };\n    const presentedHash = hashOAuthClientSecret(clientSecret);\n    let client = await repo.read<ResolvedClient>(internalEc, { hashedSecret: presentedHash });\n    if (!client) {\n      const rotated = await repo.read<ResolvedClient>(internalEc, { previousHashedSecret: presentedHash });\n      if (rotated && isRotationGraceWindowOpen(rotated.previousSecretInvalidationDate)) {\n        client = rotated;\n      }\n    }\n\n    if (!client || client.status !== OAuthClientStatus.ACTIVE || isCredentialExpired(client.expiresAt)) {\n      throw this._oauthError(ErrorType.AUTHENTICATION, ErrorCustomMessageReference.AUTHENTICATION_API_KEY_INVALID, 'invalid_client', 'client not found or inactive');\n    }\n    // Defensive: if a client_id was supplied it MUST match the secret's owner.\n    if (clientId && clientId !== client._id) {\n      throw this._oauthError(ErrorType.AUTHENTICATION, ErrorCustomMessageReference.AUTHENTICATION_API_KEY_INVALID, 'invalid_client', 'client_id does not match presented secret');\n    }\n    if (!(client.allowedGrants ?? []).includes(OAuthGrantType.CLIENT_CREDENTIALS)) {\n      throw this._oauthError(ErrorType.AUTHORIZATION, ErrorCustomMessageReference.AUTHORIZATIONS_ACCESS_DENIED, 'unauthorized_client', 'client is not authorized for the client_credentials grant');\n    }\n\n    const { scopeType, scopeId }: {\n      scopeType: ResourcePrimaryScope.ORGANIZATIONS | ResourcePrimaryScope.APPLICATION;\n      scopeId: string;\n    } = scopeKind === ApiKeyScope.ORGANIZATION\n      ? { scopeType: ResourcePrimaryScope.ORGANIZATIONS, scopeId: (client as OAuthClientOrganization).organizationId }\n      : { scopeType: ResourcePrimaryScope.APPLICATION, scopeId: (client as OAuthClientApplication).applicationId };\n\n    const issued = await this.machineTokenIssuer.issueClientAccessToken({\n      clientId: client._id,\n      scopeType,\n      scopeId,\n      roles: (client.roles ?? []) as Roles[],\n      audience: requestedAudience,\n    });\n\n    this.logger.debug('Issued client_credentials token via OAuth token endpoint', {\n      clientId: client._id,\n      scopeType,\n      scopeId,\n    });\n\n    // Audit the successful machine authentication at the OAuth issuance moment — the discrete,\n    // low-volume \"a machine authenticated\" event (as opposed to auditing every subsequent request\n    // the issued token makes). Fire-and-forget: auditing must never block or fail token issuance.\n    //\n    // SIEM-3 (F4 tenant-segregation routing) — the per-org SIEM fan-out routes on the explicit\n    // `routingOrgIds` arg (or the request EC's authenticated org), NEVER on the `organizationId`\n    // event-DATA field. This is a token-MINT: there is NO authenticated request EC (the client\n    // just presented its credentials), so without an explicit `routingOrgIds` the event reaches\n    // the DB store but NEVER the org SIEM. For an ORGANIZATION_MACHINE, `scopeId` IS the verified\n    // `organizationId` read off the authenticated `OAuthClientOrganization` record above (line ~156)\n    // — an F4-safe VERIFIED member org, not an attacker-supplied value — so we pass it as the\n    // single routing org. An APPLICATION_MACHINE has no single tenant SIEM to route to ⇒ `undefined`\n    // (DB store + Layer-2 app-level sinks still receive it; there is simply no per-org dispatch).\n    const auditLogs = this.container.get<AuditLogsBackendService>(SAAS_SERVICE_TYPES.AuditLogsService);\n    const machineAuthRoutingOrgIds: VerifiedOrgId[] | undefined = scopeType === ResourcePrimaryScope.ORGANIZATIONS ? [scopeId as VerifiedOrgId] : undefined;\n    void auditLogs.logMachineAuthSuccess({\n      authMethod: MachineAuthMethod.OAUTH_CLIENT,\n      credentialId: client._id,\n      scopeType: scopeType === ResourcePrimaryScope.ORGANIZATIONS\n        ? ExecutionContext_ExecutionType.ORGANIZATION_MACHINE\n        : ExecutionContext_ExecutionType.APPLICATION_MACHINE,\n      scopeId,\n      organizationId: scopeType === ResourcePrimaryScope.ORGANIZATIONS ? scopeId : undefined,\n    }, undefined, machineAuthRoutingOrgIds).catch((auditError) => this.logger.warn('MACHINE_AUTH_SUCCESS audit emit failed (non-fatal)', {\n      ...projectCaughtErrorLogFields(auditError),\n    }));\n\n    return {\n      access_token: issued.accessToken,\n      token_type: 'Bearer',\n      expires_in: issued.expiresIn,\n    };\n  }\n\n  /**\n   * OIDC `authorization_code` grant. Redeems the code (atomic consume + client/redirect_uri\n   * binding + mandatory PKCE S256 — in `OidcAuthorizationCodeBackendService`), then mints an\n   * ID token (`createJwtForIdToken`) plus a USER access + refresh token (the existing user\n   * issuer — a user-delegated token represents the consenting user). PKCE protects the\n   * exchange (OAuth 2.1 mandatory-PKCE model); a CONFIDENTIAL client (`tokenEndpointAuthMethod !==\n   * NONE`) must ALSO present a valid `client_secret`, enforced inside `exchangeAuthorizationCode`.\n   * Heavy deps are lazily resolved to avoid startup-graph re-entry.\n   */\n  public async issueAuthorizationCodeToken(request: {\n    code: string;\n    clientId: string;\n    redirectUri: string;\n    codeVerifier: string;\n    /**\n     * The client secret presented via client_secret_basic/post, if any. REQUIRED for a confidential\n     * client (verified in `exchangeAuthorizationCode`); ignored for a public (PKCE-only) client.\n     */\n    clientSecret?: string;\n    /**\n     * RFC 8707 §2.2 resource indicator OPTIONALLY echoed on the token request. The audience is\n     * authoritatively bound at authorize time (`grant.resource`); when present here it MUST match\n     * that bound value (a confused-deputy cross-check — a client must not exchange a code authorized\n     * for agent A into a token for agent B), else `invalid_target`.\n     */\n    resource?: string;\n  }): Promise<OidcTokenSuccessResponse> {\n    const authCodeService = this.container.get<OidcAuthorizationCodeBackendService>(SAAS_SERVICE_TYPES.OidcAuthorizationCode);\n    const jwtService = this.container.get<JwtBackendService>(SAAS_SERVICE_TYPES.JwtBackendService);\n\n    const grant = await authCodeService.exchangeAuthorizationCode({\n      code: request.code,\n      clientId: request.clientId,\n      redirectUri: request.redirectUri,\n      codeVerifier: request.codeVerifier,\n      presentedClientSecret: request.clientSecret,\n    });\n\n    // RFC 8707 (mandated by the MCP/A2A authorization specs): the client MUST name the resource\n    // server it wants the token for, and a USER-DELEGATED token may ONLY target an agent surface\n    // (A2A / MCP) — NEVER the main API. This tight audience is the load-bearing confinement (B-S2):\n    // the token is `aud`-bound to that endpoint, so the main resource API (which accepts only\n    // `aud='AUTH_TOKEN'` user tokens) rejects it. A consented third-party client thus acts for the\n    // user at the named agent endpoint ONLY, never as a full first-party session.\n    const requestedAudience = grant.resource;\n    if (!requestedAudience) {\n      throw this._oauthError(ErrorType.AUTHORIZATION, ErrorCustomMessageReference.AUTHORIZATIONS_ACCESS_DENIED, 'invalid_target',\n        'the `resource` parameter (RFC 8707) is required for the authorization_code grant');\n    }\n    // RFC 8707 §2.2 confused-deputy cross-check: if the token request ALSO named a resource, it must\n    // match the one bound to the code at authorize (the user consented to THAT agent). A client must\n    // not redeem a code authorized for agent A into a token audience-bound to agent B.\n    if (request.resource && request.resource !== requestedAudience) {\n      throw this._oauthError(ErrorType.AUTHORIZATION, ErrorCustomMessageReference.AUTHORIZATIONS_ACCESS_DENIED, 'invalid_target',\n        'the token-request `resource` does not match the resource authorized at the authorization endpoint');\n    }\n    // R-2: same instance-aware enumeration as the machine grant, but over the DELEGATED kinds only\n    // (A2A / MCP — never the main API), so a user may delegate to a NAMED agent/server instance while\n    // the B-S2 confinement (no delegated token for the API audience) is preserved unchanged.\n    const allowedDelegatedAudiences = this.container\n      .get<ResourceServerInstancesRegistryBackendService>(SAAS_SERVICE_TYPES.ResourceServerInstancesRegistry)\n      .listResourceServerAudiences(DELEGATED_TOKEN_RESOURCE_SERVERS);\n    if (!allowedDelegatedAudiences.includes(requestedAudience)) {\n      throw this._oauthError(ErrorType.AUTHORIZATION, ErrorCustomMessageReference.AUTHORIZATIONS_ACCESS_DENIED, 'invalid_target',\n        `resource '${requestedAudience}' is not a delegatable agent endpoint (A2A / MCP)`);\n    }\n\n    // OIDC Core §5.4: the ID token carries the SAME scope-gated identity claims (`email` / `profile`)\n    // that `/oauth/userinfo` returns, via the one shared resolver — so an RP reading the ID token\n    // directly gets email/name without a userinfo round-trip, and the two surfaces never disagree.\n    // Cold path (once per authorization, not per request), so the resolver's own User/UserProfile reads\n    // are acceptable alongside the authorization-version read below.\n    const userClaimsService = this.container.get<OidcUserClaimsBackendService>(SAAS_SERVICE_TYPES.OidcUserClaims);\n    const idTokenClaims = await userClaimsService.resolveUserClaims(grant.userId, grant.scope);\n    const idToken = await jwtService.createJwtForIdToken({\n      userId: grant.userId,\n      clientId: grant.clientId,\n      nonce: grant.nonce,\n      // revocation-C: `sid` = the End-User's OP session captured at authorize (threaded through the code\n      // grant). This is the PRIMARY path an RP obtains a `sid`-bearing id_token, and the hint it later\n      // presents to `/oauth/end-session` to terminate that first-party session.\n      sid: grant.sessionId,\n      extraClaims: idTokenClaims,\n    });\n\n    // Bind the delegated token to the same durable User authorization version\n    // as first-party access/refresh tokens. Delegated tokens have no refresh\n    // path, so request-time comparison is their only post-issuance revocation\n    // fence when userTypes/appRoles/status changes.\n    const ecCreator =\n      this.container.get<ExecutionContextCreatorBackendService>(\n        SAAS_SERVICE_TYPES.ExecutionContextCreatorBackendService,\n      );\n    const repositoriesRegistry =\n      this.container.get<RepositoriesRegistryHandlerBackendService>(\n        SAAS_SERVICE_TYPES.RepositoriesRegistryHandlerService,\n      );\n    const userReadEc = await ecCreator.createForInternalRepositoryOperation({\n      resourceType: CoreResourceType.USERS,\n      operationIdentifier: CoreResourceOperation.READ,\n    });\n    const user = await repositoriesRegistry\n      .getRepository(CoreResourceType.USERS)\n      .read<AuthorizationVersionedUser>(userReadEc, grant.userId);\n    const authorizationVersion = getUserAuthorizationVersion(user);\n    if (\n      !user\n      || user.status !== UserStatus.ACTIVE\n      || authorizationVersion === null\n    ) {\n      throw this._oauthError(\n        ErrorType.AUTHENTICATION,\n        ErrorCustomMessageReference.AUTHENTICATION_INVALID_TOKEN,\n        'invalid_grant',\n        'the authorizing user is no longer active or versioned',\n      );\n    }\n\n    // Mint the USER-delegated access token audience-bound to the named agent endpoint. Roles-only:\n    // the user's roles are fetched at request time (NO authz `scope` on the token); `azp` = the\n    // delegating client for attribution. NO refresh token — a confined agent token must not be able\n    // to mint fresh tokens.\n    const accessClaim = JwtClaim_App_Auth_UserRequest_Schema.parse({\n      type: ExecutionContext_ExecutionType.USER_REQUEST,\n      userId: grant.userId,\n      authorizationVersion,\n      azp: grant.clientId,\n      // Identity scopes (openid/…) ride for IDENTITY only — they carry NO authorization weight.\n      ...(grant.scope.length ? { scope: grant.scope } : {}),\n    });\n    // Confine the delegated token to at most DELEGATED_ACCESS_TOKEN_MAX_TTL_MINUTES (never the full\n    // first-party session TTL). expiresIn MUST mirror the minted `exp`, so both derive from the cap.\n    const delegatedTtlMinutes = Math.min(\n      this.appConfigService.config.jwt.accessTokenExpirationMinutes,\n      DELEGATED_ACCESS_TOKEN_MAX_TTL_MINUTES,\n    );\n    const accessToken = await jwtService.createJwtForDelegatedUserToken(accessClaim, {\n      audience: requestedAudience,\n      expiresInMinutes: delegatedTtlMinutes,\n    });\n    const expiresIn = delegatedTtlMinutes * 60;\n\n    // assurance-control: WILDO.IDENTITY.DELEGATED_AUTHORIZATION — issuing a delegated token grants a\n    // third-party client the ability to act AS the user (the most security-sensitive access grant the\n    // provider makes). Emit the audit/SIEM record (subject, client/azp, audience, granted scopes, TTL).\n    // Fire-and-forget: auditing must never block or fail token issuance.\n    //\n    // SIEM-3 (F4 tenant-segregation routing) — the routing org comes from the SUBJECT, not the request.\n    // There is genuinely no authenticated request EC at a token MINT (the client has just redeemed a\n    // code; the token it is being handed is not itself an authenticated request), so the 2nd arg stays\n    // `undefined` and, without the 3rd, this — the provider's most sensitive grant — reached the DB\n    // store and the app-level sinks but NEVER the customer's own security sink. `grant.userId` is\n    // resolved by `exchangeAuthorizationCode` off the STORED authorization code, so it is token-bound\n    // and can never be a caller-supplied value; that is exactly the provenance the magic-link and\n    // first-party-refresh paths already route on, and `_resolveSubjectRoutingOrgIds` turns it into\n    // VERIFIED ACTIVE memberships read as SYSTEM. A delegated grant therefore reaches precisely the\n    // tenants whose data the minted token can act on, which is the F4 question.\n    //\n    // D3/H-20: the DELEGATING CLIENT's own org is deliberately NOT a routing target. The token carries\n    // the USER's authority and the client is only `azp`, so a client registered in org A completing the\n    // flow for a user of org B must not thereby publish that user's grant into org A's SIEM feed.\n    const auditLogsForDelegated = this.container.get<AuditLogsBackendService>(SAAS_SERVICE_TYPES.AuditLogsService);\n    void (async () => {\n      // Resolved INSIDE the fire-and-forget block: a membership read must never add latency to the\n      // mint, and its failure mode (fail-closed to `[]`) must never reach the token response.\n      const delegatedRoutingOrgIds = await this._resolveSubjectRoutingOrgIds(grant.userId);\n      await auditLogsForDelegated.logOAuthDelegatedTokenIssued({\n        userId: grant.userId,\n        clientId: grant.clientId,\n        audience: requestedAudience,\n        scopes: grant.scope,\n        ttlSeconds: expiresIn,\n      }, undefined, delegatedRoutingOrgIds);\n    })().catch((auditError) => this.logger.warn('OAUTH_DELEGATED_TOKEN_ISSUED audit emit failed (non-fatal)', {\n      ...projectCaughtErrorLogFields(auditError),\n    }));\n    this.logger.debug('Issued authorization_code (user-delegated) token', {\n      clientId: grant.clientId, userId: grant.userId, audience: requestedAudience, scopeCount: grant.scope.length, ttlMinutes: delegatedTtlMinutes,\n    });\n\n    return {\n      access_token: accessToken,\n      token_type: 'Bearer',\n      expires_in: expiresIn,\n      id_token: idToken,\n      scope: grant.scope.join(' '),\n    };\n  }\n\n  /**\n   * OIDC `refresh_token` grant. Rotates the presented user refresh token via the existing\n   * `AuthTokenIssuer` (reuse-detection + rotation grace preserved) and returns a fresh access +\n   * refresh token. A rejected/reused/expired token maps to the OAuth `invalid_grant` error.\n   *\n   * Item 5 (OIDC Core §12.2): when the token request AUTHENTICATES a client (a `clientId` AND a valid\n   * `clientSecret`), a fresh `id_token` is ALSO re-issued. This is OPTIONAL per §12.2 and omitted for a\n   * pure first-party session refresh (no credentials). The client is AUTHENTICATED FIRST — crucially\n   * BEFORE the refresh token is rotated — via the shared `verifyPresentedClientSecret` (the same\n   * current/rotation-grace secret check as the revocation and code-exchange paths). This ordering matters:\n   * `refreshAccessToken` unconditionally consumes (blacklists + rotates) the presented token, so a bad\n   * secret checked AFTER it would burn the refresh token and, past the grace window, trip reuse-detection\n   * into revoking the whole token family on the legitimate retry. Authenticating first means (a) the\n   * id_token `aud` names a genuinely-verified client rather than a caller-supplied value, and (b) a failed\n   * authentication fails the WHOLE request as `invalid_client` (401) with NO rotation and NO tokens\n   * issued — never a silent access+refresh downgrade. A `clientId` presented WITHOUT a secret is\n   * not authenticated and therefore yields access + refresh only (no id_token). The re-issued id token\n   * is MINIMAL — `sub`/`aud`/`iss` only, WITHOUT the scope-gated identity claims (email/name/locale) and\n   * (per §12.2) WITHOUT a `nonce`: the original grant's scopes are not threaded onto the first-party\n   * refresh path, so an RP that needs identity claims fetches them from `/oauth/userinfo` (which reads\n   * the fresh access token). The user id is read back from the freshly-minted access token rather than\n   * threaded out of `AuthTokenIssuer` (whose `AuthTokens` deliberately carries no subject) — the access\n   * token is the authoritative subject carrier, and it is first-party (`aud='AUTH_TOKEN'`) so it verifies\n   * with the default key/audience. id-token MINTING (after successful client auth) is best-effort: a\n   * verify miss or an unresolvable issuer (`createJwtForIdToken` throws) simply omits the id token — the\n   * access + refresh tokens are the required output and never fail on the id-token addition.\n   *\n   * ── Audit posture (A-4) — a DELIBERATE, narrow-by-design surface (user-confirmed 2026-07-31) ──\n   * This grant emits exactly TWO audit events, and INTENTIONALLY does not emit on routine failure:\n   *   • SUCCESS  → `OAUTH_TOKEN_REFRESHED` (INFO) — one row per successful rotation.\n   *   • THEFT    → `USER_REFRESH_TOKEN_REUSE_DETECTED` (CRITICAL) — only when the issuer's reuse-detection\n   *                fired and revoked the token family (surfaced via the tagged-error signal below).\n   *   • ROUTINE FAILURE (expired / revoked / plain-invalid presented token) → NO audit event, ON PURPOSE.\n   * Rationale: routine refresh failures are HIGH-VOLUME — every ended/idle session eventually presents an\n   * expired-or-revoked refresh token, so auditing them would FLOOD the compliance store with benign noise\n   * and drown the signal a SOC actually monitors. The security-relevant refresh failure is credential\n   * THEFT, which is precisely what reuse-detection catches and A-9 records; a plain expired token is not a\n   * security event. Auditing high-frequency expected failures is a recognised audit-log anti-pattern\n   * (signal-to-noise collapse). If a future control ever needs the full rejected-attempt stream, add a\n   * DEBOUNCED/aggregated counter (a metric, not a per-attempt audit row) rather than a per-request event.\n   */\n  public async issueRefreshTokenGrant(refreshToken: string, clientId?: string, clientSecret?: string): Promise<OAuthTokenSuccessResponse & { refresh_token?: string; id_token?: string }> {\n    // Item 5 — AUTHENTICATE the client BEFORE the (destructive) refresh-token rotation. `refreshAccessToken`\n    // unconditionally blacklists the presented token's jti and mints a successor, so authenticating AFTER it\n    // would CONSUME the refresh token even on a bad secret — and after the rotation-grace window the\n    // legitimate retry would trip reuse-detection and revoke the whole token family (logout everywhere). By\n    // gating here, a bad secret throws `invalid_client` (→ the token endpoint's 401 mapping) with NO rotation\n    // having happened. Only `clientId` + `clientSecret` together require authentication (and yield an\n    // id_token); a first-party session refresh presents neither and skips straight to rotation.\n    if (clientId && clientSecret) {\n      const authCodeService = this.container.get<OidcAuthorizationCodeBackendService>(SAAS_SERVICE_TYPES.OidcAuthorizationCode);\n      await authCodeService.verifyPresentedClientSecret(clientId, clientSecret);\n    }\n\n    const userTokenIssuer = this.container.get<AuthTokenIssuerBackendService>(SAAS_SERVICE_TYPES.AuthTokenIssuer);\n    let tokens;\n    try {\n      tokens = await userTokenIssuer.refreshAccessToken(refreshToken);\n    } catch (refreshError) {\n      // A-9 caller-signal: the issuer performs the family revoke but does NOT audit (TRAP 13); it TAGS a\n      // reuse rejection with the theft signal. If present, emit `USER_REFRESH_TOKEN_REUSE_DETECTED` here.\n      // A routine expired/revoked/invalid refresh carries NO signal ⇒ no event (deliberate anti-flood: the\n      // security-relevant refresh failure is theft, not routine session expiry). Fire-and-forget.\n      // assurance-control: WILDO.IDENTITY.CREDENTIAL_LIFECYCLE — credential-theft detection + response.\n      // SIEM-3 (F4): routed to the VICTIM's verified member orgs, exactly as the first-party refresh\n      // endpoint already does (`authentication-controller.backend.service.ts` refreshToken). This is\n      // credential-THEFT detection — the single event a customer's SOC most needs in its own feed —\n      // and the two refresh surfaces share one issuer, so they must not disagree about who sees it.\n      // `reuseSignal.userId` is read off the STORED token family by the issuer, never off the request.\n      const reuseSignal = extractRefreshTokenReuseSignal(refreshError);\n      if (reuseSignal) {\n        const auditLogsForReuse = this.container.get<AuditLogsBackendService>(SAAS_SERVICE_TYPES.AuditLogsService);\n        void (async () => {\n          const reuseRoutingOrgIds = await this._resolveSubjectRoutingOrgIds(reuseSignal.userId);\n          await auditLogsForReuse.logUserRefreshTokenReuseDetected({\n            userId: reuseSignal.userId,\n            reusedJti: reuseSignal.reusedJti,\n            sessionId: reuseSignal.sessionId,\n            familyRevoked: reuseSignal.familyRevoked,\n          }, undefined, reuseRoutingOrgIds);\n        })().catch((auditError) => this.logger.warn('USER_REFRESH_TOKEN_REUSE_DETECTED audit emit failed (non-fatal)', {\n          ...projectCaughtErrorLogFields(auditError),\n        }));\n      }\n      throw this._oauthError(ErrorType.AUTHENTICATION, ErrorCustomMessageReference.AUTHENTICATION_API_KEY_INVALID, 'invalid_grant', 'refresh token invalid, expired, or revoked');\n    }\n    const expiresIn = tokens.expiresIn ?? this.appConfigService.config.jwt.accessTokenExpirationMinutes * 60;\n\n    // The client was already authenticated above → mint a MINIMAL id_token from the fresh access token\n    // (best-effort; a verify miss / unresolvable issuer omits it without failing the now-completed rotation).\n    let idToken: string | undefined;\n    // A-4: the subject read off the fresh access token (client-authenticated path only) — threaded into the\n    // success audit below when available; the general first-party refresh path audits without a subject.\n    let refreshedUserId: string | undefined;\n    if (clientId && clientSecret) {\n      try {\n        const jwtService = this.container.get<JwtBackendService>(SAAS_SERVICE_TYPES.JwtBackendService);\n        // Quiet verify (no default backend error LOG) — a best-effort read of OUR OWN freshly-minted token.\n        // The refreshed access token carries the same `sessionId` as its predecessor (revocation-C: refresh\n        // propagates it), so a `sid`-bearing id_token stays coherent across a refresh.\n        const claims = await jwtService.verifyWithoutBackendErrorActions(tokens.accessToken) as { sub?: string; sessionId?: string };\n        if (claims.sub) {\n          refreshedUserId = claims.sub;\n          idToken = await jwtService.createJwtForIdToken({ userId: claims.sub, clientId, sid: claims.sessionId });\n        }\n      } catch (idTokenError) {\n        this.logger.debug('ID token omitted from refresh_token grant (non-fatal)', {\n          reason: describeCaughtError(idTokenError),\n        });\n      }\n    }\n\n    // A-4: audit the SUCCESSFUL provider refresh grant. Low-detail INFO — the security-relevant refresh\n    // failure (theft/reuse) is audited via A-9 above; routine failures are intentionally not audited.\n    // assurance-control: WILDO.IDENTITY.CREDENTIAL_LIFECYCLE — token lifecycle (refresh). Fire-and-forget.\n    //\n    // SIEM-3 (F4): routed on `refreshedUserId`, which is read back from OUR OWN freshly-minted access\n    // token — server-minted, so token-bound rather than caller-claimed.\n    //\n    // NOT ROUTED on the FIRST-PARTY branch (no `clientId`+`clientSecret`), and that is a decision rather\n    // than an oversight. That branch deliberately performs no JWT verify (`AuthTokens` carries no\n    // subject, and the verify exists only to mint the OIDC §12.2 id_token), so the event has no subject\n    // at all — neither in `routingOrgIds` NOR in its own `userId` data field. Routing an org-anonymous\n    // \"a token was refreshed\" row into a tenant's SIEM would add noise carrying no attribution, so the\n    // honest ordering is: make the event ATTRIBUTABLE first (a verify inside this fire-and-forget block\n    // would do it, at the cost of retiring the \"a first-party refresh performs no verify\" pin), and\n    // route it in the same change. Until then the DB store + Layer-2 sinks remain its only record —\n    // and note the first-party refresh ENDPOINT (`/auth/refresh-token`) already audits with a subject\n    // and routes, so nothing is lost for the ordinary session-refresh journey.\n    const clientAuthenticated = Boolean(clientId && clientSecret);\n    const auditLogsForRefresh = this.container.get<AuditLogsBackendService>(SAAS_SERVICE_TYPES.AuditLogsService);\n    void (async () => {\n      const refreshRoutingOrgIds = await this._resolveSubjectRoutingOrgIds(refreshedUserId);\n      await auditLogsForRefresh.logOAuthTokenRefreshed({\n        userId: refreshedUserId,\n        clientId: clientAuthenticated ? clientId : undefined,\n        clientAuthenticated,\n      }, undefined, refreshRoutingOrgIds);\n    })().catch((auditError) => this.logger.warn('OAUTH_TOKEN_REFRESHED audit emit failed (non-fatal)', {\n      ...projectCaughtErrorLogFields(auditError),\n    }));\n\n    return {\n      access_token: tokens.accessToken,\n      token_type: 'Bearer',\n      expires_in: expiresIn,\n      ...(tokens.refreshToken ? { refresh_token: tokens.refreshToken } : {}),\n      ...(idToken ? { id_token: idToken } : {}),\n      scope: '',\n    };\n  }\n\n  /**\n   * OAuth 2.0 token revocation (RFC 7009). Revokes a user refresh token. Per §2.2 the endpoint\n   * returns success even for an unknown/invalid token (no token-status oracle), so this NEVER\n   * throws for a bad token — only unexpected infra failures propagate.\n   */\n  public async revokeRefreshToken(refreshToken: string): Promise<void> {\n    const userTokenIssuer = this.container.get<AuthTokenIssuerBackendService>(SAAS_SERVICE_TYPES.AuthTokenIssuer);\n    try {\n      await userTokenIssuer.revokeRefreshToken(refreshToken);\n    } catch (error) {\n      // RFC 7009 §2.2: an invalid token is still a successful revocation. Swallow validation\n      // errors; log at debug for observability.\n      this.logger.debug('Token revocation on a non-revocable token treated as success (RFC 7009)', { reason: describeCaughtError(error) });\n    }\n  }\n\n  /**\n   * F4 per-org SIEM routing for a provider event whose only trustworthy tenant anchor is the\n   * TOKEN-BOUND SUBJECT.\n   *\n   * Every emit on this service happens at a token MINT or ROTATION, where there is no authenticated\n   * request execution context — the caller has just presented a credential, and the token it is about\n   * to receive is not itself an authenticated request. So the routing org can never come from the\n   * request, and passing nothing left the provider's most sensitive events (a delegated grant, a\n   * detected credential theft) reaching the DB store and the app-level sinks but never a customer's\n   * own security sink.\n   *\n   * The subject is the answer, and only because of WHERE it comes from: each caller passes a user id\n   * the SERVER resolved — off the stored authorization code, off the stored refresh-token family, or\n   * off a token this process just minted and verified — never a value the caller wrote down.\n   * `resolveActiveMemberOrgIds` then reads the ORGANIZATION_MEMBERS junction as SYSTEM with a filter\n   * built entirely from that id plus a constant status, and brands the result `VerifiedOrgId[]`, so no\n   * caller input reaches the routing decision at any point in the chain. That provenance is the whole\n   * requirement — routing on an unverified org is the 2026-07-09 cross-tenant leak, and misrouting a\n   * delegated grant is strictly worse than not routing it.\n   *\n   * Resolved through the container rather than the constructor to match this service's lazy-dependency\n   * posture (the OAuth provider graph is reachable during startup; see the class JSDoc).\n   *\n   * NEVER-THROW, for a reason worth stating: each caller now resolves this BEFORE its emit, so a\n   * throw here would suppress the audit event entirely — turning a per-org DISPATCH failure into the\n   * loss of the authoritative record, which is the opposite of the fail-closed posture. Routing is\n   * best-effort; the DB store and the Layer-2 sink are not. `resolveActiveMemberOrgIds` is itself\n   * never-throw, so the only failure this adds is an unresolvable `SystemAccessService` binding.\n   *\n   * Returns `[]` when there is no subject to route on or when resolution failed. `[]` and `undefined`\n   * are equivalent at the sink boundary here because the request-EC argument is always `undefined` at\n   * these emit sites, so there is no EC org for `undefined` to fall back to; `[]` is passed because it\n   * states that the question WAS asked and the answer was empty.\n   */\n  private async _resolveSubjectRoutingOrgIds(userId: string | undefined): Promise<VerifiedOrgId[]> {\n    if (!userId) {\n      return [];\n    }\n    try {\n      const systemAccessService = this.container.get<SystemAccessBackendService>(SAAS_SERVICE_TYPES.SystemAccessService);\n      return await resolveActiveMemberOrgIds(systemAccessService, userId);\n    } catch {\n      return [];\n    }\n  }\n\n  /**\n   * Build a typed backend error carrying the precise OAuth 2.0 error code in `context.oauthError`\n   * so the token-endpoint controller can render the RFC 6749 §5.2 error response body.\n   */\n  private _oauthError(type: ErrorType, ref: ErrorCustomMessageReference, oauthError: string, detail: string) {\n    return this.errorBuilder.buildError(type, undefined, {\n      customMessageReference: ref,\n      context: { oauthError, detail },\n    });\n  }\n}\n"]}

package/dist/esm/security/authentications/services/oidc-authorization-code.backend.service.d.ts

@@ -206,7 +206,8 @@ export declare class OidcAuthorizationCodeBackendService {
      * back to the relying party. EXACT string match against the resolved client's `postLogoutRedirectUris`
      * allowlist — the SAME anti-open-redirect discipline as the authorization-code `redirect_uri` gate
      * (`exchangeAuthorizationCode`), never a prefix or origin match. A client that cannot be resolved, or
-     * that registered no post-logout URIs (every CIMD client in v1), admits none — fail closed.
+     * that registered no post-logout URIs, admits none — fail closed. (A CIMD client CAN register
+     * them since #464; before that, none could.)
      * spec-cite: OpenID Connect RP-Initiated Logout 1.0 §3 (the OP "MUST NOT perform post-logout redirection
      * if the `post_logout_redirect_uri` value supplied does not exactly match one of the previously
      * registered `post_logout_redirect_uris` values"; registration of those values is §2).
@@ -307,6 +308,18 @@ export declare class OidcAuthorizationCodeBackendService {
      * updateAsSystem — the CREATE DTO strips the context FK `userId`, re-attached from the schema allowlist).
      */
     upsertConsentGrant(userId: string, clientId: string, resource: string | undefined, scopes: string[]): Promise<void>;
+    /**
+     * When a consent granted NOW should lapse (#465).
+     *
+     * The operator's `auth.consentGrantLifetimeDays` when authored, else the framework default — whose
+     * reasoning is at `OAUTH_CONSENT_GRANT_DEFAULT_LIFETIME_DAYS`. There is no "never": that was the
+     * state this replaced.
+     *
+     * Reads config through the container and TOLERATES its absence, deliberately. A consent the user
+     * has just given must not fail to persist because a policy lookup threw — losing the grant is a
+     * worse outcome than applying the default, and the default is the safer of the two anyway.
+     */
+    private consentGrantExpiry;
     /**
      * Widen an existing consent grant's scopes to the UNION of its current scopes + the newly-approved set,
      * via a system update. Shared by the initial-existing path and the concurrency-recovery path so the

package/dist/esm/security/authentications/services/oidc-authorization-code.backend.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oidc-authorization-code.backend.service.d.ts","sourceRoot":"","sources":["../../../../../../src/security/authentications/services/oidc-authorization-code.backend.service.ts"],"names":[],"mappings":"AAAA,OAAO,kBAAkB,CAAC;AAE1B,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAG3C,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAC7F,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAE9G,OAAO,EAAE,6BAA6B,EAAE,MAAM,yFAAyF,CAAC;AA6BxI,OAAO,EACL,yBAAyB,EACzB,0BAA0B,EAE3B,MAAM,yFAAyF,CAAC;AAOjG,gGAAgG;AAChG,MAAM,WAAW,4BAA4B;IAC3C,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;IACtB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;;;;OAOG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;;OAKG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,6FAA6F;AAC7F,MAAM,WAAW,0BAA0B;IACzC,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,6GAA6G;IAC7G,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,mIAAmI;IACnI,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,iCAAiC;IAChD,eAAe,EAAE,OAAO,CAAC;IACzB,UAAU,EAAE,MAAM,CAAC;IACnB,mGAAmG;IACnG,MAAM,EAAE,yBAAyB,CAAC;IAClC;;;;;;OAMG;IACH,OAAO,EAAE,0BAA0B,CAAC;IACpC,yFAAyF;IACzF,mBAAmB,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,0FAA0F;IAC1F,0BAA0B,EAAE,OAAO,CAAC;CACrC;AAED;;;;;;;;;;;GAWG;AACH,qBACa,mCAAmC;IAEN,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC7B,OAAO,CAAC,QAAQ,CAAC,MAAM;IACV,OAAO,CAAC,QAAQ,CAAC,YAAY;IAC1B,OAAO,CAAC,QAAQ,CAAC,gBAAgB;gBAH7B,SAAS,EAAE,SAAS,EACvB,MAAM,EAAE,aAAa,EACR,YAAY,EAAE,0BAA0B,EACrC,gBAAgB,EAAE,6BAA6B;IAGxG,sBAAsB,CAAC,OAAO,EAAE,4BAA4B,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IAkCxF,yBAAyB,CAAC,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,qBAAqB,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,0BAA0B,CAAC;IAqGlM;;;;;;;;OAQG;IACU,iCAAiC,CAAC,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,iCAAiC,CAAC;IAkEjJ,gGAAgG;IAChG,OAAO,CAAC,kBAAkB;IAS1B;;;;;;;OAOG;IACH,OAAO,CAAC,UAAU;IAQlB;;;;OAIG;YACW,iBAAiB;IAoB/B;;;;;OAKG;IACU,oBAAoB,CAAC,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC;QAAE,YAAY,EAAE,MAAM,CAAA;KAAE,CAAC;IAwBjG;;;;;OAKG;IACU,qBAAqB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC;IA8BrF;;;;;;;;;;;OAWG;IACU,wBAAwB,CAAC,OAAO,EAAE;QAC7C,MAAM,EAAE,MAAM,CAAC;QACf,SAAS,EAAE,MAAM,CAAC;QAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,6BAA6B,EAAE,OAAO,CAAC;KACxC,GAAG,OAAO,CAAC;QAAE,iBAAiB,EAAE,MAAM,CAAA;KAAE,CAAC;IAmB1C;;;;;;OAMG;IACU,yBAAyB,CAAC,iBAAiB,EAAE,MAAM,GAAG,OAAO,CAAC;QACzE,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,6BAA6B,CAAC,EAAE,OAAO,CAAC;KACzC,GAAG,IAAI,CAAC;IAoBT;;;;;;;;;;;;OAYG;IACH;;;;;;;;;;OAUG;IACU,iCAAiC,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;YAUjF,0BAA0B;IASxC,sFAAsF;YACxE,wBAAwB;IAWtC;;;;;;OAMG;IACH,OAAO,CAAC,qBAAqB;IAkC7B;;;;;;;;;;;;;;;;;;;OAmBG;YACW,qCAAqC;IA+CnD,OAAO,CAAC,6BAA6B;IA2BrC,OAAO,CAAC,kBAAkB;IAU1B;;;;OAIG;IACH,OAAO,CAAC,yBAAyB;IAYjC;;;;;OAKG;IACH,OAAO,CAAC,qCAAqC;IAc7C;;;OAGG;IACH,OAAO,CAAC,2BAA2B;IAanC;;;;;;;;OAQG;IACH,OAAO,CAAC,8BAA8B;IA+BtC;;;;;;;;;;;;;;;;OAgBG;IACU,2BAA2B,CAAC,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IA8B/F;;;;;;OAMG;IACU,uBAAuB,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,SAAS,EAAE,eAAe,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC;IAYjJ;;;;;OAKG;IACU,kBAAkB,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IA+BhI;;;;OAIG;YACW,uBAAuB;IASrC;;;;OAIG;YACW,gBAAgB;IAY9B,OAAO,CAAC,UAAU;CAQnB"}
+{"version":3,"file":"oidc-authorization-code.backend.service.d.ts","sourceRoot":"","sources":["../../../../../../src/security/authentications/services/oidc-authorization-code.backend.service.ts"],"names":[],"mappings":"AAAA,OAAO,kBAAkB,CAAC;AAE1B,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAG3C,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAC7F,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAE9G,OAAO,EAAE,6BAA6B,EAAE,MAAM,yFAAyF,CAAC;AA+BxI,OAAO,EACL,yBAAyB,EACzB,0BAA0B,EAE3B,MAAM,yFAAyF,CAAC;AAOjG,gGAAgG;AAChG,MAAM,WAAW,4BAA4B;IAC3C,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;IACtB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;;;;OAOG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;;OAKG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,6FAA6F;AAC7F,MAAM,WAAW,0BAA0B;IACzC,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,6GAA6G;IAC7G,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,mIAAmI;IACnI,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,iCAAiC;IAChD,eAAe,EAAE,OAAO,CAAC;IACzB,UAAU,EAAE,MAAM,CAAC;IACnB,mGAAmG;IACnG,MAAM,EAAE,yBAAyB,CAAC;IAClC;;;;;;OAMG;IACH,OAAO,EAAE,0BAA0B,CAAC;IACpC,yFAAyF;IACzF,mBAAmB,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,0FAA0F;IAC1F,0BAA0B,EAAE,OAAO,CAAC;CACrC;AAED;;;;;;;;;;;GAWG;AACH,qBACa,mCAAmC;IAEN,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC7B,OAAO,CAAC,QAAQ,CAAC,MAAM;IACV,OAAO,CAAC,QAAQ,CAAC,YAAY;IAC1B,OAAO,CAAC,QAAQ,CAAC,gBAAgB;gBAH7B,SAAS,EAAE,SAAS,EACvB,MAAM,EAAE,aAAa,EACR,YAAY,EAAE,0BAA0B,EACrC,gBAAgB,EAAE,6BAA6B;IAGxG,sBAAsB,CAAC,OAAO,EAAE,4BAA4B,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IAkCxF,yBAAyB,CAAC,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,qBAAqB,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,0BAA0B,CAAC;IAqGlM;;;;;;;;OAQG;IACU,iCAAiC,CAAC,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,iCAAiC,CAAC;IAkEjJ,gGAAgG;IAChG,OAAO,CAAC,kBAAkB;IAS1B;;;;;;;OAOG;IACH,OAAO,CAAC,UAAU;IAQlB;;;;OAIG;YACW,iBAAiB;IAoB/B;;;;;OAKG;IACU,oBAAoB,CAAC,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC;QAAE,YAAY,EAAE,MAAM,CAAA;KAAE,CAAC;IAwBjG;;;;;OAKG;IACU,qBAAqB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC;IA8BrF;;;;;;;;;;;OAWG;IACU,wBAAwB,CAAC,OAAO,EAAE;QAC7C,MAAM,EAAE,MAAM,CAAC;QACf,SAAS,EAAE,MAAM,CAAC;QAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,6BAA6B,EAAE,OAAO,CAAC;KACxC,GAAG,OAAO,CAAC;QAAE,iBAAiB,EAAE,MAAM,CAAA;KAAE,CAAC;IAmB1C;;;;;;OAMG;IACU,yBAAyB,CAAC,iBAAiB,EAAE,MAAM,GAAG,OAAO,CAAC;QACzE,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,6BAA6B,CAAC,EAAE,OAAO,CAAC;KACzC,GAAG,IAAI,CAAC;IAoBT;;;;;;;;;;;;OAYG;IACH;;;;;;;;;;;OAWG;IACU,iCAAiC,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;YAUjF,0BAA0B;IASxC,sFAAsF;YACxE,wBAAwB;IAWtC;;;;;;OAMG;IACH,OAAO,CAAC,qBAAqB;IAkC7B;;;;;;;;;;;;;;;;;;;OAmBG;YACW,qCAAqC;IAoDnD,OAAO,CAAC,6BAA6B;IA2BrC,OAAO,CAAC,kBAAkB;IAU1B;;;;OAIG;IACH,OAAO,CAAC,yBAAyB;IAYjC;;;;;OAKG;IACH,OAAO,CAAC,qCAAqC;IAc7C;;;OAGG;IACH,OAAO,CAAC,2BAA2B;IAanC;;;;;;;;OAQG;IACH,OAAO,CAAC,8BAA8B;IA+BtC;;;;;;;;;;;;;;;;OAgBG;IACU,2BAA2B,CAAC,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IA8B/F;;;;;;OAMG;IACU,uBAAuB,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,SAAS,EAAE,eAAe,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC;IAYjJ;;;;;OAKG;IACU,kBAAkB,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAkChI;;;;;;;;;;OAUG;IACH,OAAO,CAAC,kBAAkB;IAY1B;;;;OAIG;YACW,uBAAuB;IAgBrC;;;;OAIG;YACW,gBAAgB;IAY9B,OAAO,CAAC,UAAU;CAQnB"}

package/dist/esm/security/authentications/services/oidc-authorization-code.backend.service.js

@@ -19,6 +19,7 @@ import { ErrorBuilderBackendService } from '../../../errors/services/error-build
 import { describeCaughtError, projectCaughtErrorLogFields } from '../../../errors/utils/error-log-level-classification.backend.utils.js';
 import { ConsumableTokenBackendService } from '../../../security/consumable-tokens/services/consumable-token.backend.service.js';
 import { ApiKeyScope, ConsumableToken_ConsumptionMode, CoreConsumableTokenTypes, CoreResourceOperation, CoreResourceType, ErrorCustomMessageReference, ErrorType, isConfidentialTokenEndpointAuthMethod, isWildoBackendError, OAuthClientStatus, OAuthCodeExchangeFailureReason, OAuthGrantType, OAuthClientRegistrationOrigin, OAuthTokenEndpointAuthMethod, OrganizationMemberStatus, } from '@wildo-ai/saas-models';
+import { OAUTH_CONSENT_GRANT_DEFAULT_LIFETIME_DAYS } from '@wildo-ai/saas-models';
 import { isCredentialExpired, isRotationGraceWindowOpen } from '../../../security/credential-rotation-grace.backend.utils.js';
 import { hashOAuthClientSecret } from '../../../security/oauth-clients/oauth-client-generation.backend.utils.js';
 import { isValidPkceCodeVerifier, isValidS256CodeChallenge } from '../../../security/authentications/services/utils/pkce.backend.utils.js';
@@ -436,7 +437,8 @@ let OidcAuthorizationCodeBackendService = class OidcAuthorizationCodeBackendServ
      * back to the relying party. EXACT string match against the resolved client's `postLogoutRedirectUris`
      * allowlist — the SAME anti-open-redirect discipline as the authorization-code `redirect_uri` gate
      * (`exchangeAuthorizationCode`), never a prefix or origin match. A client that cannot be resolved, or
-     * that registered no post-logout URIs (every CIMD client in v1), admits none — fail closed.
+     * that registered no post-logout URIs, admits none — fail closed. (A CIMD client CAN register
+     * them since #464; before that, none could.)
      * spec-cite: OpenID Connect RP-Initiated Logout 1.0 §3 (the OP "MUST NOT perform post-logout redirection
      * if the `post_logout_redirect_uri` value supplied does not exactly match one of the previously
      * registered `post_logout_redirect_uris` values"; registration of those values is §2).
@@ -561,11 +563,16 @@ let OidcAuthorizationCodeBackendService = class OidcAuthorizationCodeBackendServ
             clientId,
             name: metadata.client_name,
             redirectUris: metadata.redirect_uris,
-            // revocation-C: RP-Initiated Logout post-logout redirects are NOT supported for a CIMD client in v1 —
-            // the CIMD metadata schema (`cimd.backend.schemas.ts`) declares no `post_logout_redirect_uris`, so the
-            // OP admits none and lands a CIMD-client logout on its own logged-out page. Fail-closed empty; adding
-            // CIMD post-logout support is a separate spec decision (extend the CIMD document schema first).
-            postLogoutRedirectUris: [],
+            // revocation-C: RP-Initiated Logout post-logout redirects, honoured for a CIMD client since
+            // 2026-09-08 (#464). The document's `post_logout_redirect_uris` is carried through and matched
+            // EXACTLY by `isRegisteredPostLogoutRedirectUri` — the same anti-open-redirect discipline as
+            // the authorization-code `redirect_uri` gate, and the same trust model, since both members
+            // come from the same client-authored document fetched through the same SSRF guard.
+            //
+            // A document that registers none still admits none: fail-closed empty, which is what every
+            // CIMD client got while the member was undeclared. What changed is that a client which DOES
+            // register one stops having its redirect silently ignored.
+            postLogoutRedirectUris: metadata.post_logout_redirect_uris ?? [],
             allowedScopes: OIDC_SUPPORTED_IDENTITY_SCOPES,
             allowedGrants,
             tenancy: { kind: AuthorizationClientTenancy.UNAFFILIATED },
@@ -778,7 +785,10 @@ let OidcAuthorizationCodeBackendService = class OidcAuthorizationCodeBackendServ
             await this.widenConsentGrantScopes(systemAccess, existing, scopes);
             return;
         }
-        const data = { userId, clientId, scopes };
+        // #465: every affirmative consent carries an expiry. The field had a reader and no writer, so a
+        // remembered approval lived until the person revoked it while reading to an operator as a policy
+        // knob that existed.
+        const data = { userId, clientId, scopes, expiresAt: this.consentGrantExpiry() };
         if (resource)
             data.resource = resource;
         try {
@@ -805,6 +815,30 @@ let OidcAuthorizationCodeBackendService = class OidcAuthorizationCodeBackendServ
             await this.widenConsentGrantScopes(systemAccess, winner, scopes);
         }
     }
+    /**
+     * When a consent granted NOW should lapse (#465).
+     *
+     * The operator's `auth.consentGrantLifetimeDays` when authored, else the framework default — whose
+     * reasoning is at `OAUTH_CONSENT_GRANT_DEFAULT_LIFETIME_DAYS`. There is no "never": that was the
+     * state this replaced.
+     *
+     * Reads config through the container and TOLERATES its absence, deliberately. A consent the user
+     * has just given must not fail to persist because a policy lookup threw — losing the grant is a
+     * worse outcome than applying the default, and the default is the safer of the two anyway.
+     */
+    consentGrantExpiry() {
+        let lifetimeDays = OAUTH_CONSENT_GRANT_DEFAULT_LIFETIME_DAYS;
+        try {
+            const configured = this.container.get(SAAS_SERVICE_TYPES.AppConfigService)
+                ?.config?.auth?.consentGrantLifetimeDays;
+            if (typeof configured === 'number')
+                lifetimeDays = configured;
+        }
+        catch {
+            // Unbound in a harness that never looks at consent policy — the default stands.
+        }
+        return new Date(Date.now() + lifetimeDays * 24 * 60 * 60 * 1000);
+    }
     /**
      * Widen an existing consent grant's scopes to the UNION of its current scopes + the newly-approved set,
      * via a system update. Shared by the initial-existing path and the concurrency-recovery path so the
@@ -812,7 +846,14 @@ let OidcAuthorizationCodeBackendService = class OidcAuthorizationCodeBackendServ
      */
     async widenConsentGrantScopes(systemAccess, existing, scopes) {
         const merged = Array.from(new Set([...(existing.scopes ?? []), ...scopes]));
-        await systemAccess.updateAsSystem(CoreResourceType.OAUTH_CONSENT_GRANTS, existing._id, { scopes: merged });
+        // The expiry RESTARTS on a widen (#465): a widen only happens because the user approved again,
+        // and a re-affirmation that left the old clock running would expire a consent the person gave
+        // moments ago. Both callers of this method — the initial-existing path and the
+        // concurrency-recovery path — are affirmative acts, so both refresh.
+        await systemAccess.updateAsSystem(CoreResourceType.OAUTH_CONSENT_GRANTS, existing._id, {
+            scopes: merged,
+            expiresAt: this.consentGrantExpiry(),
+        });
         // A-3: an existing persistent consent grant was WIDENED (scopes unioned). Shared by the initial-existing
         // path AND the concurrency-recovery path, so both audit the durable-authority change once.
         // assurance-control: WILDO.IDENTITY.DELEGATED_AUTHORIZATION — persistent delegated-access authorization (widen).