@wildo-ai/saas-backend-lib 1.1.2 → 1.1.4

package/dist/esm/security/authentications/services/auth-methods/webauthn.backend.service.d.ts

@@ -35,6 +35,27 @@ export declare enum PasskeyAuthenticationCeremony {
     LOGIN = "login",
     STEP_UP = "step_up"
 }
+/**
+ * What a passkey assertion verification answers.
+ *
+ * `cloneSuspicion` is present ONLY when the assertion's signature verified and its counter did not
+ * advance — the W3C cloned-authenticator signal. It is returned rather than audited here because
+ * this service deliberately emits no audit rows (see the class header): the caller holds the
+ * request's device information and is where the trail is written.
+ */
+export interface PasskeyAuthenticationVerificationResult {
+    verified: boolean;
+    credentialId: string;
+    cloneSuspicion?: {
+        credentialId: string;
+        storedCounter: number;
+        receivedCounter: number;
+        credentialDeviceType: string;
+        credentialBackedUp: boolean;
+        aaguid?: string;
+        ceremony: PasskeyAuthenticationCeremony;
+    };
+}
 /**
  * WebAuthnBackendService
  *
@@ -83,12 +104,15 @@ export declare class WebAuthnBackendService {
      * Verify a WebAuthn authentication response.
      * Updates the credential counter and lastUsedAt on success.
      */
-    verifyAuthenticationResponse(ec: ExecutionContext<any>, userId: string, response: AuthenticationResponseJSON, ceremony?: PasskeyAuthenticationCeremony): Promise<{
-        verified: boolean;
-        credentialId: string;
-    }>;
+    verifyAuthenticationResponse(ec: ExecutionContext<any>, userId: string, response: AuthenticationResponseJSON, ceremony?: PasskeyAuthenticationCeremony): Promise<PasskeyAuthenticationVerificationResult>;
     /**
-     * List all passkey credentials for a user (safe fields only — no publicKey/counter).
+     * List all passkey credentials for a user, as STORED.
+     *
+     * This returns the whole `PasskeyCredentialEntry`, `publicKey` and `counter` included. It is not a
+     * safe-field projection, and must not be handed to a caller as one: the projection that reaches a
+     * client is built at the controller (`handlePasskeyList`), which selects the credential id, name,
+     * timestamps and device flags and nothing else. A new consumer of this method owes its own
+     * projection, or it will disclose the stored credential material.
      */
     getCredentials(ec: ExecutionContext<any>, userId: string): Promise<PasskeyCredentialEntry[]>;
     /**

package/dist/esm/security/authentications/services/auth-methods/webauthn.backend.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"webauthn.backend.service.d.ts","sourceRoot":"","sources":["../../../../../../../src/security/authentications/services/auth-methods/webauthn.backend.service.ts"],"names":[],"mappings":"AAAA,OAAO,kBAAkB,CAAC;AAQ1B,OAAO,KAAK,EACV,sCAAsC,EACtC,qCAAqC,EACrC,wBAAwB,EACxB,0BAA0B,EAC3B,MAAM,wBAAwB,CAAC;AAGhC,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAC7F,OAAO,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AAE/G,OAAO,EAAE,YAAY,EAAE,MAAM,qDAAqD,CAAC;AACnF,OAAO,EAAE,+BAA+B,EAAE,MAAM,gGAAgG,CAAC;AACjJ,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAC9G,OAAO,EAAE,gBAAgB,EAAE,MAAM,qEAAqE,CAAC;AACvG,OAAO,EAEL,sBAAsB,EAGvB,MAAM,uBAAuB,CAAC;AAW/B;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,oBAAY,6BAA6B;IACvC,KAAK,UAAU;IACf,OAAO,YAAY;CACpB;AAED;;;;;;;;;;;;GAYG;AACH,qBACa,sBAAsB;IAII,OAAO,CAAC,QAAQ,CAAC,MAAM;IACb,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IACrC,OAAO,CAAC,QAAQ,CAAC,YAAY;IACjB,OAAO,CAAC,QAAQ,CAAC,aAAa;IACnC,OAAO,CAAC,QAAQ,CAAC,YAAY;IAP/E,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA+D;gBAGlC,MAAM,EAAE,aAAa,EACX,gBAAgB,EAAE,uBAAuB,EAC7C,YAAY,EAAE,YAAY,EACd,aAAa,EAAE,+BAA+B,EACnD,YAAY,EAAE,0BAA0B;IAQ3G,OAAO,KAAK,IAAI,GAEf;IAED,OAAO,KAAK,MAAM,GAEjB;IAED,OAAO,KAAK,UAAU,GAErB;IAED;;;OAGG;IACH,OAAO,KAAK,eAAe,GAY1B;IAID;;;OAGG;IACG,2BAA2B,CAC/B,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACzB,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,sCAAsC,CAAC;IAuClD;;;OAGG;IACG,0BAA0B,CAC9B,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACzB,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,wBAAwB,EAClC,cAAc,CAAC,EAAE,MAAM,GACtB,OAAO,CAAC,sBAAsB,CAAC;IAoDlC;;;OAGG;IACG,6BAA6B,CACjC,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACzB,MAAM,EAAE,MAAM,EACd,QAAQ,GAAE,6BAAmE,GAC5E,OAAO,CAAC,qCAAqC,CAAC;IA2BjD;;;OAGG;IACG,4BAA4B,CAChC,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACzB,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,0BAA0B,EACpC,QAAQ,GAAE,6BAAmE,GAC5E,OAAO,CAAC;QAAE,QAAQ,EAAE,OAAO,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,CAAC;IAkEvD;;OAEG;IACG,cAAc,CAAC,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,EAAE,CAAC;IAKlG;;OAEG;IACG,gBAAgB,CAAC,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAgBtG;;OAEG;IACG,gBAAgB,CAAC,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAsBvH;;;OAGG;IACH,OAAO,CAAC,gBAAgB;IAOxB;;;;;;;;OAQG;IACH,OAAO,CAAC,oBAAoB;YAMd,eAAe;IAI7B;;;;;;;OAOG;YACW,sBAAsB;IAMpC;;;OAGG;YACW,wBAAwB;CAcvC"}
+{"version":3,"file":"webauthn.backend.service.d.ts","sourceRoot":"","sources":["../../../../../../src/security/authentications/services/auth-methods/webauthn.backend.service.ts"],"names":[],"mappings":"AAAA,OAAO,kBAAkB,CAAC;AAQ1B,OAAO,KAAK,EACV,sCAAsC,EACtC,qCAAqC,EACrC,wBAAwB,EACxB,0BAA0B,EAC3B,MAAM,wBAAwB,CAAC;AAGhC,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAC7F,OAAO,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AAE/G,OAAO,EAAE,YAAY,EAAE,MAAM,qDAAqD,CAAC;AACnF,OAAO,EAAE,+BAA+B,EAAE,MAAM,gGAAgG,CAAC;AACjJ,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAC9G,OAAO,EAAE,gBAAgB,EAAE,MAAM,qEAAqE,CAAC;AACvG,OAAO,EAEL,sBAAsB,EAGvB,MAAM,uBAAuB,CAAC;AAW/B;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,oBAAY,6BAA6B;IACvC,KAAK,UAAU;IACf,OAAO,YAAY;CACpB;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,uCAAuC;IACtD,QAAQ,EAAE,OAAO,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,cAAc,CAAC,EAAE;QACf,YAAY,EAAE,MAAM,CAAC;QACrB,aAAa,EAAE,MAAM,CAAC;QACtB,eAAe,EAAE,MAAM,CAAC;QACxB,oBAAoB,EAAE,MAAM,CAAC;QAC7B,kBAAkB,EAAE,OAAO,CAAC;QAC5B,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,QAAQ,EAAE,6BAA6B,CAAC;KACzC,CAAC;CACH;AAED;;;;;;;;;;;;GAYG;AACH,qBAEa,sBAAsB;IAII,OAAO,CAAC,QAAQ,CAAC,MAAM;IACb,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IACrC,OAAO,CAAC,QAAQ,CAAC,YAAY;IACjB,OAAO,CAAC,QAAQ,CAAC,aAAa;IACnC,OAAO,CAAC,QAAQ,CAAC,YAAY;IAP/E,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA+D;gBAGlC,MAAM,EAAE,aAAa,EACX,gBAAgB,EAAE,uBAAuB,EAC7C,YAAY,EAAE,YAAY,EACd,aAAa,EAAE,+BAA+B,EACnD,YAAY,EAAE,0BAA0B;IAQ3G,OAAO,KAAK,IAAI,GAEf;IAED,OAAO,KAAK,MAAM,GAEjB;IAED,OAAO,KAAK,UAAU,GAErB;IAED;;;OAGG;IACH,OAAO,KAAK,eAAe,GAY1B;IAID;;;OAGG;IACG,2BAA2B,CAC/B,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACzB,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,sCAAsC,CAAC;IAuClD;;;OAGG;IACG,0BAA0B,CAC9B,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACzB,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,wBAAwB,EAClC,cAAc,CAAC,EAAE,MAAM,GACtB,OAAO,CAAC,sBAAsB,CAAC;IAoDlC;;;OAGG;IACG,6BAA6B,CACjC,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACzB,MAAM,EAAE,MAAM,EACd,QAAQ,GAAE,6BAAmE,GAC5E,OAAO,CAAC,qCAAqC,CAAC;IA2BjD;;;OAGG;IACG,4BAA4B,CAChC,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACzB,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,0BAA0B,EACpC,QAAQ,GAAE,6BAAmE,GAC5E,OAAO,CAAC,uCAAuC,CAAC;IAoInD;;;;;;;;OAQG;IACG,cAAc,CAAC,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,EAAE,CAAC;IAKlG;;OAEG;IACG,gBAAgB,CAAC,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAgBtG;;OAEG;IACG,gBAAgB,CAAC,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAsBvH;;;OAGG;IACH,OAAO,CAAC,gBAAgB;IAOxB;;;;;;;;OAQG;IACH,OAAO,CAAC,oBAAoB;YAMd,eAAe;IAI7B;;;;;;;OAOG;YACW,sBAAsB;IAMpC;;;OAGG;YACW,wBAAwB;CAcvC"}

package/dist/esm/security/authentications/services/auth-methods/webauthn.backend.service.js

@@ -258,22 +258,88 @@ let WebAuthnBackendService = class WebAuthnBackendService {
             credential: {
                 id: matchedCredential.credentialId,
                 publicKey: Buffer.from(matchedCredential.publicKey, 'base64url'),
-                counter: matchedCredential.counter,
+                /*
+                 * DELIBERATELY 0, NOT the stored counter — and this line is load-bearing, so read the
+                 * reason before "fixing" it.
+                 *
+                 * `@simplewebauthn/server` evaluates its own counter guard BEFORE `verifySignature`
+                 * (verifyAuthenticationResponse.js:144-151 in 13.3.x, then :154). Handing it the real
+                 * stored value therefore refuses a counter regression on an assertion whose signature was
+                 * never checked — so ANY caller who knows a credential id could trigger the refusal, and
+                 * an alert raised there would be forgeable by an unauthenticated party.
+                 *
+                 * W3C WebAuthn L3 puts the counter comparison at §7.2 step 22, AFTER signature
+                 * verification at step 21, precisely because a counter regression only means something
+                 * when the assertion is known to come from something holding the private key. Passing 0
+                 * makes the library's predicate unsatisfiable — `(counter > 0 || 0 > 0) && counter <= 0`
+                 * is false for every input — so the library does what we want from it (verify the
+                 * signature) and the counter decision stays here, below, where it is ours and where it is
+                 * post-authentication.
+                 *
+                 * spec-cite: W3C Web Authentication Level 3 §7.2 steps 21-22
+                 * (https://www.w3.org/TR/webauthn-3/#sctn-verifying-assertion).
+                 */
+                counter: 0,
                 transports: matchedCredential.transports,
             },
         });
         if (!verification.verified) {
             return { verified: false, credentialId: response.id };
         }
-        // Counter verification (clone detection)
+        /*
+         * CLONE DETECTION — the spec's predicate, on a signature-verified assertion.
+         *
+         * "If either is non-zero, and the new signCount value is less than or equal to the stored
+         * value, a cloned authenticator may exist, or the authenticator may be malfunctioning, or a
+         * race condition might exist" — W3C WebAuthn L3 §6.1.1.
+         *
+         * EITHER non-zero, not just the received one. The previous check here read
+         * `newCounter > 0 && newCounter <= stored`, which misses the case that matters most
+         * operationally: a credential that previously counted and now reports 0. It was also dead
+         * code — the library threw first — and it only warned.
+         *
+         * A credential whose counter is permanently 0 — which every SYNCED passkey is, because a set
+         * of devices cannot maintain a coherent counter — compares 0-against-0, fails the first
+         * disjunct, and authenticates normally. That is the whole passkey accommodation and it is why
+         * refusing here is not hostile to passkeys.
+         *
+         * Refusal, not step-up, and not configurable: three of the four major server implementations
+         * fail closed with no switch (SimpleWebAuthn, Duo py_webauthn, ASP.NET Core Identity) and the
+         * fourth (Yubico) defaults to it. Nothing authoritative recommends escalating instead.
+         *
+         * Returned rather than thrown so BOTH callers take their existing `!verified` branch and
+         * produce the same clean AUTHENTICATION refusal — the step-up path used to wrap a library
+         * throw as a generic error while login refused cleanly.
+         *
+         * spec-cite: W3C Web Authentication Level 3 §6.1.1
+         * (https://www.w3.org/TR/webauthn-3/#sctn-sign-counter).
+         */
         const newCounter = verification.authenticationInfo.newCounter;
-        if (newCounter > 0 && newCounter <= matchedCredential.counter) {
-            this.logger.warn('WebAuthn counter did not increment — possible credential clone', {
+        if ((newCounter > 0 || matchedCredential.counter > 0) && newCounter <= matchedCredential.counter) {
+            this.logger.warn('WebAuthn signature counter did not advance on a verified assertion — refusing', {
                 userId,
                 credentialId: matchedCredential.credentialId,
                 storedCounter: matchedCredential.counter,
                 receivedCounter: newCounter,
             });
+            // The stored counter is NOT advanced: a refused assertion must not move the baseline a later
+            // legitimate assertion is compared against.
+            return {
+                verified: false,
+                credentialId: matchedCredential.credentialId,
+                cloneSuspicion: {
+                    credentialId: matchedCredential.credentialId,
+                    storedCounter: matchedCredential.counter,
+                    receivedCounter: newCounter,
+                    // Carried for TRIAGE only — nothing branches on them. A synced credential that once
+                    // reported a non-zero counter and then regresses is still a signal, so exempting by
+                    // device type would disable clone detection for the majority of credentials.
+                    credentialDeviceType: matchedCredential.credentialDeviceType,
+                    credentialBackedUp: matchedCredential.credentialBackedUp,
+                    ...(matchedCredential.aaguid ? { aaguid: matchedCredential.aaguid } : {}),
+                    ceremony,
+                },
+            };
         }
         // Update counter and lastUsedAt
         const updatedCredentials = existingCredentials.map((c) => c.credentialId === matchedCredential.credentialId
@@ -285,7 +351,13 @@ let WebAuthnBackendService = class WebAuthnBackendService {
     }
     // ─── Credential CRUD ─────────────────────────────────────────
     /**
-     * List all passkey credentials for a user (safe fields only — no publicKey/counter).
+     * List all passkey credentials for a user, as STORED.
+     *
+     * This returns the whole `PasskeyCredentialEntry`, `publicKey` and `counter` included. It is not a
+     * safe-field projection, and must not be handed to a caller as one: the projection that reaches a
+     * client is built at the controller (`handlePasskeyList`), which selects the credential id, name,
+     * timestamps and device flags and nothing else. A new consumer of this method owes its own
+     * projection, or it will disclose the stored credential material.
      */
     async getCredentials(ec, userId) {
         const { cred } = await this._resolveCredentialRecord(ec, userId);

package/dist/esm/security/authentications/services/auth-methods/webauthn.backend.service.js.map

@@ -1 +1 @@
-{"version":3,"file":"webauthn.backend.service.js","sourceRoot":"","sources":["../../../../../../../src/security/authentications/services/auth-methods/webauthn.backend.service.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,OAAO,kBAAkB,CAAC;AAC1B,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAC/C,OAAO,EACL,2BAA2B,EAC3B,0BAA0B,EAC1B,6BAA6B,EAC7B,4BAA4B,GAC7B,MAAM,wBAAwB,CAAC;AAQhC,OAAO,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AACpF,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAC7F,OAAO,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AAC/G,OAAO,EAAE,gBAAgB,EAAE,MAAM,6DAA6D,CAAC;AAC/F,OAAO,EAAE,YAAY,EAAE,MAAM,qDAAqD,CAAC;AACnF,OAAO,EAAE,+BAA+B,EAAE,MAAM,gGAAgG,CAAC;AACjJ,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAE9G,OAAO,EAGL,SAAS,EACT,2BAA2B,GAC5B,MAAM,uBAAuB,CAAC;AAE/B,MAAM,qBAAqB,GAAG,GAAG,CAAC,CAAC,YAAY;AAC/C,MAAM,wBAAwB,GAAG,yBAAyB,CAAC;AAC3D,MAAM,yBAAyB,GAAG,0BAA0B,CAAC;AAC7D;;;GAGG;AACH,MAAM,4BAA4B,GAAG,4BAA4B,CAAC;AAElE;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,CAAN,IAAY,6BAGX;AAHD,WAAY,6BAA6B;IACvC,gDAAe,CAAA;IACf,oDAAmB,CAAA;AACrB,CAAC,EAHW,6BAA6B,KAA7B,6BAA6B,QAGxC;AAED;;;;;;;;;;;;GAYG;AAEI,IAAM,sBAAsB,GAA5B,MAAM,sBAAsB;IAIqB;IACU;IACJ;IACY;IACL;IAPlD,QAAQ,CAA+D;IAExF,YACsD,MAAqB,EACX,gBAAyC,EAC7C,YAA0B,EACd,aAA8C,EACnD,YAAwC;QAJrD,WAAM,GAAN,MAAM,CAAe;QACX,qBAAgB,GAAhB,gBAAgB,CAAyB;QAC7C,iBAAY,GAAZ,YAAY,CAAc;QACd,kBAAa,GAAb,aAAa,CAAiC;QACnD,iBAAY,GAAZ,YAAY,CAA4B;QAEzG,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC;QACpD,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IACrD,CAAC;IAED,gEAAgE;IAEhE,IAAY,IAAI;QACd,OAAO,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC;IAC9D,CAAC;IAED,IAAY,MAAM;QAChB,OAAO,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC;IAChE,CAAC;IAED,IAAY,UAAU;QACpB,OAAO,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,IAAI,CAAC,kBAAkB,CAAC;IAC9D,CAAC;IAED;;;OAGG;IACH,IAAY,eAAe;QACzB,MAAM,SAAS,GAAG,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC;QACjE,MAAM,OAAO,GAAa,EAAE,CAAC;QAC7B,KAAK,MAAM,CAAC,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;YACjD,IAAI,IAAI,EAAE,SAAS,EAAE,CAAC;gBACpB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC;YAClD,CAAC;QACH,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,OAAO,CAAC,IAAI,CAAC,WAAW,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QACvC,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,gEAAgE;IAEhE;;;OAGG;IACH,KAAK,CAAC,2BAA2B,CAC/B,EAAyB,EACzB,MAAc,EACd,KAAa;QAEb,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,wBAAwB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QACjE,MAAM,mBAAmB,GAAI,IAAwB,CAAC,kBAAkB,IAAI,EAAE,CAAC;QAE/E,MAAM,WAAW,GAAG,IAAI,CAAC,gBAAgB,CAAC,MAAM,EAAE,IAAI,EAAE,aAAa,EAAE,kBAAkB,IAAI,EAAE,CAAC;QAChG,IAAI,mBAAmB,CAAC,MAAM,IAAI,WAAW,EAAE,CAAC;YAC9C,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,SAAS,EAAE;gBAClE,OAAO,EAAE,EAAE,MAAM,EAAE,cAAc,WAAW,mBAAmB,EAAE;aAClE,CAAC,CAAC;QACL,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,CAAC;QAC5B,MAAM,OAAO,GAAG,MAAM,2BAA2B,CAAC;YAChD,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,QAAQ,EAAE,KAAK;YACf,eAAe,EAAE,KAAK;YACtB,MAAM,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC;YACxC,wEAAwE;YACxE,0EAA0E;YAC1E,eAAe,EAAE,GAAG,CAAC,WAA+C;YACpE,OAAO,EAAE,GAAG,CAAC,cAAc,GAAG,IAAI;YAClC,sBAAsB,EAAE;gBACtB,uBAAuB,EAAE,GAAG,CAAC,uBAAuB,KAAK,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,uBAAuB;gBACxG,WAAW,EAAE,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,WAAW;gBAC9D,gBAAgB,EAAE,GAAG,CAAC,gBAAgB;aACvC;YACD,kBAAkB,EAAE,mBAAmB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBAClD,EAAE,EAAE,CAAC,CAAC,YAAY;gBAClB,UAAU,EAAE,CAAC,CAAC,UAAsC;aACrD,CAAC,CAAC;SACJ,CAAC,CAAC;QAEH,MAAM,IAAI,CAAC,eAAe,CAAC,wBAAwB,GAAG,MAAM,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;QACjF,IAAI,CAAC,QAAQ,CAAC,gCAAgC,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,mBAAmB,CAAC,MAAM,EAAE,CAAC,CAAC;QAEtG,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,0BAA0B,CAC9B,EAAyB,EACzB,MAAc,EACd,QAAkC,EAClC,cAAuB;QAEvB,MAAM,iBAAiB,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,wBAAwB,GAAG,MAAM,CAAC,CAAC;QAC/F,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACvB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;gBACtE,sBAAsB,EAAE,2BAA2B,CAAC,uCAAuC;gBAC3F,OAAO,EAAE,EAAE,MAAM,EAAE,sDAAsD,EAAE;aAC5E,CAAC,CAAC;QACL,CAAC;QAED,MAAM,YAAY,GAAG,MAAM,0BAA0B,CAAC;YACpD,QAAQ;YACR,iBAAiB;YACjB,cAAc,EAAE,IAAI,CAAC,eAAe;YACpC,YAAY,EAAE,IAAI,CAAC,IAAI;YACvB,uBAAuB,EAAE,IAAI,CAAC,UAAU,CAAC,gBAAgB,KAAK,UAAU;SACzE,CAAC,CAAC;QAEH,IAAI,CAAC,YAAY,CAAC,QAAQ,IAAI,CAAC,YAAY,CAAC,gBAAgB,EAAE,CAAC;YAC7D,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;gBACtE,sBAAsB,EAAE,2BAA2B,CAAC,uCAAuC;gBAC3F,OAAO,EAAE,EAAE,MAAM,EAAE,2CAA2C,EAAE;aACjE,CAAC,CAAC;QACL,CAAC;QAED,MAAM,EAAE,UAAU,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,GAAG,YAAY,CAAC,gBAAgB,CAAC;QAE/F,MAAM,aAAa,GAA2B;YAC5C,YAAY,EAAE,UAAU,CAAC,EAAE;YAC3B,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC;YAClE,OAAO,EAAE,UAAU,CAAC,OAAO;YAC3B,UAAU,EAAE,CAAC,UAAU,CAAC,UAAU,IAAI,EAAE,CAAa;YACrD,oBAAoB,EAAE,oBAAoB,IAAI,cAAc;YAC5D,kBAAkB,EAAE,kBAAkB,IAAI,KAAK;YAC/C,IAAI,EAAE,cAAc,IAAI,SAAS;YACjC,MAAM,EAAE,YAAY,CAAC,gBAAgB,CAAC,MAAM;YAC5C,SAAS,EAAE,IAAI,IAAI,EAAE;YACrB,UAAU,EAAE,SAAS;SACtB,CAAC;QAEF,kCAAkC;QAClC,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,wBAAwB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QACjE,MAAM,mBAAmB,GAAI,IAAwB,CAAC,kBAAkB,IAAI,EAAE,CAAC;QAC/E,MAAM,kBAAkB,GAAG,CAAC,GAAG,mBAAmB,EAAE,aAAa,CAAC,CAAC;QAEnE,MAAM,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,kBAAkB,EAAE,kBAAkB,EAA8B,CAAC,CAAC;QAE1H,IAAI,CAAC,QAAQ,CAAC,oBAAoB,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,aAAa,CAAC,YAAY,EAAE,CAAC,CAAC;QAC1F,OAAO,aAAa,CAAC;IACvB,CAAC;IAED,gEAAgE;IAEhE;;;OAGG;IACH,KAAK,CAAC,6BAA6B,CACjC,EAAyB,EACzB,MAAc,EACd,WAA0C,6BAA6B,CAAC,KAAK;QAE7E,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,wBAAwB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QACjE,MAAM,mBAAmB,GAAI,IAAwB,CAAC,kBAAkB,IAAI,EAAE,CAAC;QAE/E,IAAI,mBAAmB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACrC,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;gBACtE,sBAAsB,EAAE,2BAA2B,CAAC,uCAAuC;gBAC3F,OAAO,EAAE,EAAE,MAAM,EAAE,iDAAiD,EAAE;aACvE,CAAC,CAAC;QACL,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,6BAA6B,CAAC;YAClD,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,gBAAgB,EAAE,IAAI,CAAC,oBAAoB,CAAC,QAAQ,CAAC;YACrD,OAAO,EAAE,IAAI,CAAC,UAAU,CAAC,cAAc,GAAG,IAAI;YAC9C,gBAAgB,EAAE,mBAAmB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBAChD,EAAE,EAAE,CAAC,CAAC,YAAY;gBAClB,UAAU,EAAE,CAAC,CAAC,UAAsC;aACrD,CAAC,CAAC;SACJ,CAAC,CAAC;QAEH,MAAM,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,gBAAgB,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;QACvF,IAAI,CAAC,QAAQ,CAAC,kCAAkC,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,eAAe,EAAE,mBAAmB,CAAC,MAAM,EAAE,CAAC,CAAC;QAErH,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,4BAA4B,CAChC,EAAyB,EACzB,MAAc,EACd,QAAoC,EACpC,WAA0C,6BAA6B,CAAC,KAAK;QAE7E,gGAAgG;QAChG,iEAAiE;QACjE,MAAM,iBAAiB,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,gBAAgB,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;QACrG,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACvB,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,YAAY,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC;QACxD,CAAC;QAED,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,wBAAwB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QACjE,MAAM,mBAAmB,GAAI,IAAwB,CAAC,kBAAkB,IAAI,EAAE,CAAC;QAC/E,MAAM,iBAAiB,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,KAAK,QAAQ,CAAC,EAAE,CAAC,CAAC;QAE1F,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACvB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,sDAAsD,EAAE;gBACvE,MAAM;gBACN,YAAY,EAAE,QAAQ,CAAC,EAAE;aAC1B,CAAC,CAAC;YACH,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,YAAY,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC;QACxD,CAAC;QAED,MAAM,YAAY,GAAG,MAAM,4BAA4B,CAAC;YACtD,QAAQ;YACR,iBAAiB;YACjB,cAAc,EAAE,IAAI,CAAC,eAAe;YACpC,YAAY,EAAE,IAAI,CAAC,IAAI;YACvB,4FAA4F;YAC5F,wFAAwF;YACxF,uBAAuB,EAAE,IAAI,CAAC,oBAAoB,CAAC,QAAQ,CAAC,KAAK,gBAAgB,CAAC,QAAQ;YAC1F,UAAU,EAAE;gBACV,EAAE,EAAE,iBAAiB,CAAC,YAAY;gBAClC,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,SAAS,EAAE,WAAW,CAAC;gBAChE,OAAO,EAAE,iBAAiB,CAAC,OAAO;gBAClC,UAAU,EAAE,iBAAiB,CAAC,UAAsC;aACrE;SACF,CAAC,CAAC;QAEH,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,CAAC;YAC3B,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,YAAY,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC;QACxD,CAAC;QAED,yCAAyC;QACzC,MAAM,UAAU,GAAG,YAAY,CAAC,kBAAkB,CAAC,UAAU,CAAC;QAC9D,IAAI,UAAU,GAAG,CAAC,IAAI,UAAU,IAAI,iBAAiB,CAAC,OAAO,EAAE,CAAC;YAC9D,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,gEAAgE,EAAE;gBACjF,MAAM;gBACN,YAAY,EAAE,iBAAiB,CAAC,YAAY;gBAC5C,aAAa,EAAE,iBAAiB,CAAC,OAAO;gBACxC,eAAe,EAAE,UAAU;aAC5B,CAAC,CAAC;QACL,CAAC;QAED,gCAAgC;QAChC,MAAM,kBAAkB,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CACvD,CAAC,CAAC,YAAY,KAAK,iBAAiB,CAAC,YAAY;YAC/C,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,IAAI,IAAI,EAAE,EAAE;YACvD,CAAC,CAAC,CAAC,CACN,CAAC;QAEF,MAAM,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,kBAAkB,EAAE,kBAAkB,EAA8B,CAAC,CAAC;QAE1H,IAAI,CAAC,QAAQ,CAAC,iCAAiC,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,iBAAiB,CAAC,YAAY,EAAE,CAAC,CAAC;QAC3G,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,EAAE,iBAAiB,CAAC,YAAY,EAAE,CAAC;IAC1E,CAAC;IAED,gEAAgE;IAEhE;;OAEG;IACH,KAAK,CAAC,cAAc,CAAC,EAAyB,EAAE,MAAc;QAC5D,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,wBAAwB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QACjE,OAAQ,IAAwB,CAAC,kBAAkB,IAAI,EAAE,CAAC;IAC5D,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,gBAAgB,CAAC,EAAyB,EAAE,MAAc,EAAE,YAAoB;QACpF,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,wBAAwB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QACjE,MAAM,mBAAmB,GAAI,IAAwB,CAAC,kBAAkB,IAAI,EAAE,CAAC;QAC/E,MAAM,kBAAkB,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,KAAK,YAAY,CAAC,CAAC;QAE9F,IAAI,kBAAkB,CAAC,MAAM,KAAK,mBAAmB,CAAC,MAAM,EAAE,CAAC;YAC7D,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,SAAS,EAAE,SAAS,EAAE;gBACjE,OAAO,EAAE,EAAE,MAAM,EAAE,8BAA8B,EAAE,YAAY,EAAE;aAClE,CAAC,CAAC;QACL,CAAC;QAED,MAAM,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,kBAAkB,EAAE,kBAAkB,EAA8B,CAAC,CAAC;QAE1H,IAAI,CAAC,QAAQ,CAAC,iBAAiB,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC;IAC7D,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,gBAAgB,CAAC,EAAyB,EAAE,MAAc,EAAE,YAAoB,EAAE,OAAe;QACrG,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,wBAAwB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QACjE,MAAM,mBAAmB,GAAI,IAAwB,CAAC,kBAAkB,IAAI,EAAE,CAAC;QAC/E,MAAM,KAAK,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,KAAK,YAAY,CAAC,CAAC;QAE/E,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,SAAS,EAAE,SAAS,EAAE;gBACjE,OAAO,EAAE,EAAE,MAAM,EAAE,8BAA8B,EAAE,YAAY,EAAE;aAClE,CAAC,CAAC;QACL,CAAC;QAED,MAAM,kBAAkB,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CACvD,CAAC,CAAC,YAAY,KAAK,YAAY,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAC9D,CAAC;QAEF,MAAM,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,kBAAkB,EAAE,kBAAkB,EAA8B,CAAC,CAAC;QAE1H,IAAI,CAAC,QAAQ,CAAC,iBAAiB,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC,CAAC;IACtE,CAAC;IAED,gEAAgE;IAEhE;;;OAGG;IACK,gBAAgB,CAAC,QAAuC,EAAE,MAAc;QAC9E,MAAM,MAAM,GAAG,QAAQ,KAAK,6BAA6B,CAAC,OAAO;YAC/D,CAAC,CAAC,4BAA4B;YAC9B,CAAC,CAAC,yBAAyB,CAAC;QAC9B,OAAO,MAAM,GAAG,MAAM,CAAC;IACzB,CAAC;IAED;;;;;;;;OAQG;IACK,oBAAoB,CAAC,QAAuC;QAClE,OAAO,QAAQ,KAAK,6BAA6B,CAAC,OAAO;YACvD,CAAC,CAAC,gBAAgB,CAAC,QAAQ;YAC3B,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,gBAAgB,CAAC;IACvC,CAAC;IAEO,KAAK,CAAC,eAAe,CAAC,GAAW,EAAE,SAAiB;QAC1D,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,SAAS,EAAE,EAAE,GAAG,EAAE,qBAAqB,EAAE,CAAC,CAAC;IAC9E,CAAC;IAED;;;;;;;OAOG;IACK,KAAK,CAAC,sBAAsB,CAAC,GAAW;QAC9C,OAAO,IAAI,CAAC,YAAY,CAAC,MAAM,CAAS,GAAG,CAAC,CAAC;IAC/C,CAAC;IAED,gEAAgE;IAEhE;;;OAGG;IACK,KAAK,CAAC,wBAAwB,CACpC,EAAyB,EACzB,MAAc;QAId,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,YAAY,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QAC/D,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,SAAS,EAAE,SAAS,EAAE;gBACjE,OAAO,EAAE,EAAE,MAAM,EAAE,4BAA4B,EAAE,MAAM,EAAE;aAC1D,CAAC,CAAC;QACL,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,CAAC;IAClB,CAAC;CACF,CAAA;AA5XY,sBAAsB;IADlC,UAAU,EAAE;IAKR,WAAA,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAA;IACjC,WAAA,MAAM,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,CAAA;IAC3C,WAAA,MAAM,CAAC,kBAAkB,CAAC,YAAY,CAAC,CAAA;IACvC,WAAA,MAAM,CAAC,kBAAkB,CAAC,wBAAwB,CAAC,CAAA;IACnD,WAAA,MAAM,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,CAAA;qCAJa,aAAa;QACO,uBAAuB;QAC/B,YAAY;QACC,+BAA+B;QACrC,0BAA0B;GARhG,sBAAsB,CA4XlC","sourcesContent":["import 'reflect-metadata';\nimport { inject, injectable } from 'inversify';\nimport {\n  generateRegistrationOptions,\n  verifyRegistrationResponse,\n  generateAuthenticationOptions,\n  verifyAuthenticationResponse,\n} from '@simplewebauthn/server';\nimport type {\n  PublicKeyCredentialCreationOptionsJSON,\n  PublicKeyCredentialRequestOptionsJSON,\n  RegistrationResponseJSON,\n  AuthenticationResponseJSON,\n} from '@simplewebauthn/server';\n\nimport { SAAS_SERVICE_TYPES } from '~wildo-backend-lib/inject/models/service-types';\nimport { LoggerService } from '~wildo-backend-lib/monitoring/logger/services/logger.service';\nimport { AppConfigurationService } from '~wildo-backend-lib/config/services/app-configuration.backend.service';\nimport { UserVerification } from '~wildo-backend-lib/config/models/app-config.backend.schemas';\nimport { RedisService } from '~wildo-backend-lib/databases/services/redis.service';\nimport { AuthCredentialOpsBackendService } from '~wildo-backend-lib/security/authentications/services/utils/auth-credential-ops.backend.service';\nimport { ErrorBuilderBackendService } from '~wildo-backend-lib/errors/services/error-builder.backend.service';\nimport { ExecutionContext } from '~wildo-backend-lib/runtime/models/execution-context.backend.schemas';\nimport {\n  UserCredentials,\n  PasskeyCredentialEntry,\n  ErrorType,\n  ErrorCustomMessageReference,\n} from '@wildo-ai/saas-models';\n\nconst CHALLENGE_TTL_SECONDS = 300; // 5 minutes\nconst CHALLENGE_KEY_PREFIX_REG = 'webauthn_challenge:reg:';\nconst CHALLENGE_KEY_PREFIX_AUTH = 'webauthn_challenge:auth:';\n/**\n * SEPARATE from the login prefix on purpose — see {@link PasskeyAuthenticationCeremony}. Sharing one\n * key would let an assertion the user produced for LOGIN be redeemed at the step-up door.\n */\nconst CHALLENGE_KEY_PREFIX_STEP_UP = 'webauthn_challenge:stepup:';\n\n/**\n * Which ceremony a passkey assertion belongs to.\n *\n * The two differ in the QUESTION they answer, and therefore in what they must demand:\n *\n * - **LOGIN** asks \"which principal is this?\". The passkey IS the factor, so possession of the\n *   authenticator is the claim, and the app's `passkeyOperational.userVerification` policy decides\n *   whether a PIN/biometric is also required.\n * - **STEP_UP** asks \"is the human still here, right now, and do they intend this irreversible\n *   thing?\". Possession alone cannot answer that — a resident credential on an already-unlocked\n *   machine would satisfy it with no human intent — so this ceremony pins user verification to\n *   REQUIRED regardless of the app policy. Under the common `preferred` setting a login assertion\n *   may legitimately carry no UV, and accepting one here would make the strongest-LOOKING factor the\n *   weakest door onto the operations `requiresStepUpAuthentication` guards.\n *\n * They also use SEPARATE challenge keys, which is the load-bearing half. Both challenges are\n * single-use (atomic get-and-delete), but single-use alone does not say WHICH door a signed\n * assertion may open: with a shared key, an assertion the user produced for a login could be\n * replayed to `/auth/reauth` and minted into a step-up token. Distinct keys make a login challenge\n * structurally unredeemable at the step-up door and vice versa.\n *\n * assurance-control: WILDO.IDENTITY.STEP_UP_AUTHENTICATION — a re-proof ceremony must not be\n * satisfiable by a credential presented for a different purpose.\n */\nexport enum PasskeyAuthenticationCeremony {\n  LOGIN = 'login',\n  STEP_UP = 'step_up',\n}\n\n/**\n * WebAuthnBackendService\n *\n * Encapsulates all WebAuthn/FIDO2 ceremony logic using @simplewebauthn/server.\n * Handles option generation, response verification, challenge management (Redis),\n * and credential CRUD on user credential documents.\n *\n * This service does NOT:\n * - Manage sessions (AuthSessionStore)\n * - Issue tokens (AuthTokenIssuer)\n * - Audit log (orchestrator/controller responsibility)\n * - Know about the authentication flow (orchestrator's job)\n */\n@injectable()\nexport class WebAuthnBackendService {\n  private readonly logDebug: (message: string, context?: Record<string, unknown>) => void;\n\n  constructor(\n    @inject(SAAS_SERVICE_TYPES.Logger) private readonly logger: LoggerService,\n    @inject(SAAS_SERVICE_TYPES.AppConfigService) private readonly appConfigService: AppConfigurationService,\n    @inject(SAAS_SERVICE_TYPES.RedisService) private readonly redisService: RedisService,\n    @inject(SAAS_SERVICE_TYPES.AuthCredentialOpsService) private readonly credentialOps: AuthCredentialOpsBackendService,\n    @inject(SAAS_SERVICE_TYPES.ErrorBuilderService) private readonly errorBuilder: ErrorBuilderBackendService,\n  ) {\n    this.logDebug = this.logger.debugByType('WebAuthn');\n    this.logger.setDebugTypeLogging('WebAuthn', false);\n  }\n\n  // ─── Configuration ───────────────────────────────────────────\n\n  private get rpId(): string {\n    return this.appConfigService.config.auth.passkeyConfig.rpId;\n  }\n\n  private get rpName(): string {\n    return this.appConfigService.config.auth.passkeyConfig.rpName;\n  }\n\n  private get passkeyOps() {\n    return this.appConfigService.config.auth.passkeyOperational;\n  }\n\n  /**\n   * Derive the expected origin(s) from the app config's runtime endpoints.\n   * Returns all configured publicUrl values as valid origins.\n   */\n  private get expectedOrigins(): string[] {\n    const endPoints = this.appConfigService.config.runtime.endPoints;\n    const origins: string[] = [];\n    for (const [, urls] of Object.entries(endPoints)) {\n      if (urls?.publicUrl) {\n        origins.push(urls.publicUrl.replace(/\\/$/, ''));\n      }\n    }\n    if (origins.length === 0) {\n      origins.push(`https://${this.rpId}`);\n    }\n    return origins;\n  }\n\n  // ─── Registration ────────────────────────────────────────────\n\n  /**\n   * Generate WebAuthn registration options for a user.\n   * The caller is responsible for ensuring the user is authenticated.\n   */\n  async generateRegistrationOptions(\n    ec: ExecutionContext<any>,\n    userId: string,\n    email: string,\n  ): Promise<PublicKeyCredentialCreationOptionsJSON> {\n    const { cred } = await this._resolveCredentialRecord(ec, userId);\n    const existingCredentials = (cred as UserCredentials).passkeyCredentials ?? [];\n\n    const maxPasskeys = this.appConfigService.config?.auth?.passkeyConfig?.maxPasskeysPerUser ?? 10;\n    if (existingCredentials.length >= maxPasskeys) {\n      throw this.errorBuilder.buildError(ErrorType.VALIDATION, undefined, {\n        context: { reason: `Maximum of ${maxPasskeys} passkeys reached` },\n      });\n    }\n\n    const ops = this.passkeyOps;\n    const options = await generateRegistrationOptions({\n      rpName: this.rpName,\n      rpID: this.rpId,\n      userName: email,\n      userDisplayName: email,\n      userID: new TextEncoder().encode(userId),\n      // Cast: @simplewebauthn narrows to 'direct'|'enterprise'|'none' but W3C\n      // AttestationConveyancePreference includes 'indirect' — valid at runtime.\n      attestationType: ops.attestation as 'direct' | 'enterprise' | 'none',\n      timeout: ops.timeoutSeconds * 1000,\n      authenticatorSelection: {\n        authenticatorAttachment: ops.authenticatorAttachment === 'any' ? undefined : ops.authenticatorAttachment,\n        residentKey: ops.requireResidentKey ? 'required' : 'preferred',\n        userVerification: ops.userVerification,\n      },\n      excludeCredentials: existingCredentials.map((c) => ({\n        id: c.credentialId,\n        transports: c.transports as AuthenticatorTransport[],\n      })),\n    });\n\n    await this._storeChallenge(CHALLENGE_KEY_PREFIX_REG + userId, options.challenge);\n    this.logDebug('Registration options generated', { userId, excludeCount: existingCredentials.length });\n\n    return options;\n  }\n\n  /**\n   * Verify a WebAuthn registration response and store the new credential.\n   * Returns the new credential entry on success.\n   */\n  async verifyRegistrationResponse(\n    ec: ExecutionContext<any>,\n    userId: string,\n    response: RegistrationResponseJSON,\n    credentialName?: string,\n  ): Promise<PasskeyCredentialEntry> {\n    const expectedChallenge = await this._getAndDeleteChallenge(CHALLENGE_KEY_PREFIX_REG + userId);\n    if (!expectedChallenge) {\n      throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n        customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_USER_CREDENTIALS_INVALID,\n        context: { reason: 'WebAuthn registration challenge expired or not found' },\n      });\n    }\n\n    const verification = await verifyRegistrationResponse({\n      response,\n      expectedChallenge,\n      expectedOrigin: this.expectedOrigins,\n      expectedRPID: this.rpId,\n      requireUserVerification: this.passkeyOps.userVerification === 'required',\n    });\n\n    if (!verification.verified || !verification.registrationInfo) {\n      throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n        customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_USER_CREDENTIALS_INVALID,\n        context: { reason: 'WebAuthn registration verification failed' },\n      });\n    }\n\n    const { credential, credentialDeviceType, credentialBackedUp } = verification.registrationInfo;\n\n    const newCredential: PasskeyCredentialEntry = {\n      credentialId: credential.id,\n      publicKey: Buffer.from(credential.publicKey).toString('base64url'),\n      counter: credential.counter,\n      transports: (credential.transports ?? []) as string[],\n      credentialDeviceType: credentialDeviceType ?? 'singleDevice',\n      credentialBackedUp: credentialBackedUp ?? false,\n      name: credentialName ?? 'Passkey',\n      aaguid: verification.registrationInfo.aaguid,\n      createdAt: new Date(),\n      lastUsedAt: undefined,\n    };\n\n    // Append to the credential record\n    const { cred } = await this._resolveCredentialRecord(ec, userId);\n    const existingCredentials = (cred as UserCredentials).passkeyCredentials ?? [];\n    const updatedCredentials = [...existingCredentials, newCredential];\n\n    await this.credentialOps.updateById(ec, cred._id, { passkeyCredentials: updatedCredentials } as Partial<UserCredentials>);\n\n    this.logDebug('Passkey registered', { userId, credentialId: newCredential.credentialId });\n    return newCredential;\n  }\n\n  // ─── Authentication ──────────────────────────────────────────\n\n  /**\n    * Generate WebAuthn authentication options for a user.\n   * Populates allowCredentials from the user's stored passkeys.\n   */\n  async generateAuthenticationOptions(\n    ec: ExecutionContext<any>,\n    userId: string,\n    ceremony: PasskeyAuthenticationCeremony = PasskeyAuthenticationCeremony.LOGIN,\n  ): Promise<PublicKeyCredentialRequestOptionsJSON> {\n    const { cred } = await this._resolveCredentialRecord(ec, userId);\n    const existingCredentials = (cred as UserCredentials).passkeyCredentials ?? [];\n\n    if (existingCredentials.length === 0) {\n      throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n        customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_USER_CREDENTIALS_INVALID,\n        context: { reason: 'No passkey credentials registered for this user' },\n      });\n    }\n\n    const options = await generateAuthenticationOptions({\n      rpID: this.rpId,\n      userVerification: this._userVerificationFor(ceremony),\n      timeout: this.passkeyOps.timeoutSeconds * 1000,\n      allowCredentials: existingCredentials.map((c) => ({\n        id: c.credentialId,\n        transports: c.transports as AuthenticatorTransport[],\n      })),\n    });\n\n    await this._storeChallenge(this._challengeKeyFor(ceremony, userId), options.challenge);\n    this.logDebug('Authentication options generated', { userId, ceremony, credentialCount: existingCredentials.length });\n\n    return options;\n  }\n\n  /**\n   * Verify a WebAuthn authentication response.\n   * Updates the credential counter and lastUsedAt on success.\n   */\n  async verifyAuthenticationResponse(\n    ec: ExecutionContext<any>,\n    userId: string,\n    response: AuthenticationResponseJSON,\n    ceremony: PasskeyAuthenticationCeremony = PasskeyAuthenticationCeremony.LOGIN,\n  ): Promise<{ verified: boolean; credentialId: string }> {\n    // Reads ONLY this ceremony's challenge, so an assertion signed for the other door finds nothing\n    // to match and is refused — see `PasskeyAuthenticationCeremony`.\n    const expectedChallenge = await this._getAndDeleteChallenge(this._challengeKeyFor(ceremony, userId));\n    if (!expectedChallenge) {\n      return { verified: false, credentialId: response.id };\n    }\n\n    const { cred } = await this._resolveCredentialRecord(ec, userId);\n    const existingCredentials = (cred as UserCredentials).passkeyCredentials ?? [];\n    const matchedCredential = existingCredentials.find((c) => c.credentialId === response.id);\n\n    if (!matchedCredential) {\n      this.logger.warn('WebAuthn authentication failed: credential not found', {\n        userId,\n        credentialId: response.id,\n      });\n      return { verified: false, credentialId: response.id };\n    }\n\n    const verification = await verifyAuthenticationResponse({\n      response,\n      expectedChallenge,\n      expectedOrigin: this.expectedOrigins,\n      expectedRPID: this.rpId,\n      // STEP_UP pins this true even when the app policy is `preferred` — an assertion carrying no\n      // user verification proves possession of the authenticator, not presence of the person.\n      requireUserVerification: this._userVerificationFor(ceremony) === UserVerification.REQUIRED,\n      credential: {\n        id: matchedCredential.credentialId,\n        publicKey: Buffer.from(matchedCredential.publicKey, 'base64url'),\n        counter: matchedCredential.counter,\n        transports: matchedCredential.transports as AuthenticatorTransport[],\n      },\n    });\n\n    if (!verification.verified) {\n      return { verified: false, credentialId: response.id };\n    }\n\n    // Counter verification (clone detection)\n    const newCounter = verification.authenticationInfo.newCounter;\n    if (newCounter > 0 && newCounter <= matchedCredential.counter) {\n      this.logger.warn('WebAuthn counter did not increment — possible credential clone', {\n        userId,\n        credentialId: matchedCredential.credentialId,\n        storedCounter: matchedCredential.counter,\n        receivedCounter: newCounter,\n      });\n    }\n\n    // Update counter and lastUsedAt\n    const updatedCredentials = existingCredentials.map((c) =>\n      c.credentialId === matchedCredential.credentialId\n        ? { ...c, counter: newCounter, lastUsedAt: new Date() }\n        : c,\n    );\n\n    await this.credentialOps.updateById(ec, cred._id, { passkeyCredentials: updatedCredentials } as Partial<UserCredentials>);\n\n    this.logDebug('Passkey authentication verified', { userId, credentialId: matchedCredential.credentialId });\n    return { verified: true, credentialId: matchedCredential.credentialId };\n  }\n\n  // ─── Credential CRUD ─────────────────────────────────────────\n\n  /**\n   * List all passkey credentials for a user (safe fields only — no publicKey/counter).\n   */\n  async getCredentials(ec: ExecutionContext<any>, userId: string): Promise<PasskeyCredentialEntry[]> {\n    const { cred } = await this._resolveCredentialRecord(ec, userId);\n    return (cred as UserCredentials).passkeyCredentials ?? [];\n  }\n\n  /**\n   * Remove a passkey credential by its credential ID.\n   */\n  async removeCredential(ec: ExecutionContext<any>, userId: string, credentialId: string): Promise<void> {\n    const { cred } = await this._resolveCredentialRecord(ec, userId);\n    const existingCredentials = (cred as UserCredentials).passkeyCredentials ?? [];\n    const updatedCredentials = existingCredentials.filter((c) => c.credentialId !== credentialId);\n\n    if (updatedCredentials.length === existingCredentials.length) {\n      throw this.errorBuilder.buildError(ErrorType.NOT_FOUND, undefined, {\n        context: { reason: 'Passkey credential not found', credentialId },\n      });\n    }\n\n    await this.credentialOps.updateById(ec, cred._id, { passkeyCredentials: updatedCredentials } as Partial<UserCredentials>);\n\n    this.logDebug('Passkey removed', { userId, credentialId });\n  }\n\n  /**\n   * Rename a passkey credential.\n   */\n  async renameCredential(ec: ExecutionContext<any>, userId: string, credentialId: string, newName: string): Promise<void> {\n    const { cred } = await this._resolveCredentialRecord(ec, userId);\n    const existingCredentials = (cred as UserCredentials).passkeyCredentials ?? [];\n    const found = existingCredentials.find((c) => c.credentialId === credentialId);\n\n    if (!found) {\n      throw this.errorBuilder.buildError(ErrorType.NOT_FOUND, undefined, {\n        context: { reason: 'Passkey credential not found', credentialId },\n      });\n    }\n\n    const updatedCredentials = existingCredentials.map((c) =>\n      c.credentialId === credentialId ? { ...c, name: newName } : c,\n    );\n\n    await this.credentialOps.updateById(ec, cred._id, { passkeyCredentials: updatedCredentials } as Partial<UserCredentials>);\n\n    this.logDebug('Passkey renamed', { userId, credentialId, newName });\n  }\n\n  // ─── Challenge Management (Redis) ────────────────────────────\n\n  /**\n   * The Redis challenge key for a ceremony. Distinct per ceremony so a challenge issued for one door\n   * cannot be redeemed at the other — see {@link PasskeyAuthenticationCeremony}.\n   */\n  private _challengeKeyFor(ceremony: PasskeyAuthenticationCeremony, userId: string): string {\n    const prefix = ceremony === PasskeyAuthenticationCeremony.STEP_UP\n      ? CHALLENGE_KEY_PREFIX_STEP_UP\n      : CHALLENGE_KEY_PREFIX_AUTH;\n    return prefix + userId;\n  }\n\n  /**\n   * The user-verification requirement for a ceremony.\n   *\n   * STEP_UP is REQUIRED unconditionally; LOGIN follows the app's `passkeyOperational` policy. The\n   * override deliberately does not read the policy at all: an application that lowers it to\n   * `preferred` (the common setting) is making a decision about LOGIN ergonomics, and inheriting it\n   * here would silently weaken the re-proof that guards irreversible operations. Same reasoning as\n   * `requiresStepUpAuthentication` refusing to inherit the per-user-type freshness policy.\n   */\n  private _userVerificationFor(ceremony: PasskeyAuthenticationCeremony): UserVerification {\n    return ceremony === PasskeyAuthenticationCeremony.STEP_UP\n      ? UserVerification.REQUIRED\n      : this.passkeyOps.userVerification;\n  }\n\n  private async _storeChallenge(key: string, challenge: string): Promise<void> {\n    await this.redisService.set(key, challenge, { ttl: CHALLENGE_TTL_SECONDS });\n  }\n\n  /**\n   * Atomically read-and-consume a stored challenge. Delegates to\n   * `RedisService.getDel`, which applies the same tenant-key scoping and\n   * `JSON.parse` deserialization as the `set()` used by `_storeChallenge` —\n   * keeping the store/read serialization contract symmetric. (The prior\n   * hand-rolled `eval` GETDEL skipped `JSON.parse`, so the challenge came\n   * back wrapped in literal quotes and every verification failed.)\n   */\n  private async _getAndDeleteChallenge(key: string): Promise<string | null> {\n    return this.redisService.getDel<string>(key);\n  }\n\n  // ─── Internal Helpers ────────────────────────────────────────\n\n  /**\n   * Resolve the credential record for a user.\n   * Returns the credential document (throws if not found).\n   */\n  private async _resolveCredentialRecord(\n    ec: ExecutionContext<any>,\n    userId: string,\n  ): Promise<{\n    cred: UserCredentials;\n  }> {\n    const cred = await this.credentialOps.readByUserId(ec, userId);\n    if (!cred) {\n      throw this.errorBuilder.buildError(ErrorType.NOT_FOUND, undefined, {\n        context: { reason: 'User credentials not found', userId },\n      });\n    }\n    return { cred };\n  }\n}\n\ntype AuthenticatorTransport = 'ble' | 'cable' | 'hybrid' | 'internal' | 'nfc' | 'smart-card' | 'usb';\n"]}
+{"version":3,"file":"webauthn.backend.service.js","sourceRoot":"","sources":["../../../../../../src/security/authentications/services/auth-methods/webauthn.backend.service.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,OAAO,kBAAkB,CAAC;AAC1B,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAC/C,OAAO,EACL,2BAA2B,EAC3B,0BAA0B,EAC1B,6BAA6B,EAC7B,4BAA4B,GAC7B,MAAM,wBAAwB,CAAC;AAQhC,OAAO,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AACpF,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAC7F,OAAO,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AAC/G,OAAO,EAAE,gBAAgB,EAAE,MAAM,6DAA6D,CAAC;AAC/F,OAAO,EAAE,YAAY,EAAE,MAAM,qDAAqD,CAAC;AACnF,OAAO,EAAE,+BAA+B,EAAE,MAAM,gGAAgG,CAAC;AACjJ,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAE9G,OAAO,EAGL,SAAS,EACT,2BAA2B,GAC5B,MAAM,uBAAuB,CAAC;AAE/B,MAAM,qBAAqB,GAAG,GAAG,CAAC,CAAC,YAAY;AAC/C,MAAM,wBAAwB,GAAG,yBAAyB,CAAC;AAC3D,MAAM,yBAAyB,GAAG,0BAA0B,CAAC;AAC7D;;;GAGG;AACH,MAAM,4BAA4B,GAAG,4BAA4B,CAAC;AAElE;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,CAAN,IAAY,6BAGX;AAHD,WAAY,6BAA6B;IACvC,gDAAe,CAAA;IACf,oDAAmB,CAAA;AACrB,CAAC,EAHW,6BAA6B,KAA7B,6BAA6B,QAGxC;AAwBD;;;;;;;;;;;;GAYG;AAGI,IAAM,sBAAsB,GAA5B,MAAM,sBAAsB;IAIqB;IACU;IACJ;IACY;IACL;IAPlD,QAAQ,CAA+D;IAExF,YACsD,MAAqB,EACX,gBAAyC,EAC7C,YAA0B,EACd,aAA8C,EACnD,YAAwC;QAJrD,WAAM,GAAN,MAAM,CAAe;QACX,qBAAgB,GAAhB,gBAAgB,CAAyB;QAC7C,iBAAY,GAAZ,YAAY,CAAc;QACd,kBAAa,GAAb,aAAa,CAAiC;QACnD,iBAAY,GAAZ,YAAY,CAA4B;QAEzG,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC;QACpD,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IACrD,CAAC;IAED,gEAAgE;IAEhE,IAAY,IAAI;QACd,OAAO,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC;IAC9D,CAAC;IAED,IAAY,MAAM;QAChB,OAAO,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC;IAChE,CAAC;IAED,IAAY,UAAU;QACpB,OAAO,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,IAAI,CAAC,kBAAkB,CAAC;IAC9D,CAAC;IAED;;;OAGG;IACH,IAAY,eAAe;QACzB,MAAM,SAAS,GAAG,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC;QACjE,MAAM,OAAO,GAAa,EAAE,CAAC;QAC7B,KAAK,MAAM,CAAC,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;YACjD,IAAI,IAAI,EAAE,SAAS,EAAE,CAAC;gBACpB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC;YAClD,CAAC;QACH,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,OAAO,CAAC,IAAI,CAAC,WAAW,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QACvC,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,gEAAgE;IAEhE;;;OAGG;IACH,KAAK,CAAC,2BAA2B,CAC/B,EAAyB,EACzB,MAAc,EACd,KAAa;QAEb,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,wBAAwB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QACjE,MAAM,mBAAmB,GAAI,IAAwB,CAAC,kBAAkB,IAAI,EAAE,CAAC;QAE/E,MAAM,WAAW,GAAG,IAAI,CAAC,gBAAgB,CAAC,MAAM,EAAE,IAAI,EAAE,aAAa,EAAE,kBAAkB,IAAI,EAAE,CAAC;QAChG,IAAI,mBAAmB,CAAC,MAAM,IAAI,WAAW,EAAE,CAAC;YAC9C,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,SAAS,EAAE;gBAClE,OAAO,EAAE,EAAE,MAAM,EAAE,cAAc,WAAW,mBAAmB,EAAE;aAClE,CAAC,CAAC;QACL,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,CAAC;QAC5B,MAAM,OAAO,GAAG,MAAM,2BAA2B,CAAC;YAChD,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,QAAQ,EAAE,KAAK;YACf,eAAe,EAAE,KAAK;YACtB,MAAM,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC;YACxC,wEAAwE;YACxE,0EAA0E;YAC1E,eAAe,EAAE,GAAG,CAAC,WAA+C;YACpE,OAAO,EAAE,GAAG,CAAC,cAAc,GAAG,IAAI;YAClC,sBAAsB,EAAE;gBACtB,uBAAuB,EAAE,GAAG,CAAC,uBAAuB,KAAK,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,uBAAuB;gBACxG,WAAW,EAAE,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,WAAW;gBAC9D,gBAAgB,EAAE,GAAG,CAAC,gBAAgB;aACvC;YACD,kBAAkB,EAAE,mBAAmB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBAClD,EAAE,EAAE,CAAC,CAAC,YAAY;gBAClB,UAAU,EAAE,CAAC,CAAC,UAAsC;aACrD,CAAC,CAAC;SACJ,CAAC,CAAC;QAEH,MAAM,IAAI,CAAC,eAAe,CAAC,wBAAwB,GAAG,MAAM,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;QACjF,IAAI,CAAC,QAAQ,CAAC,gCAAgC,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,mBAAmB,CAAC,MAAM,EAAE,CAAC,CAAC;QAEtG,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,0BAA0B,CAC9B,EAAyB,EACzB,MAAc,EACd,QAAkC,EAClC,cAAuB;QAEvB,MAAM,iBAAiB,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,wBAAwB,GAAG,MAAM,CAAC,CAAC;QAC/F,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACvB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;gBACtE,sBAAsB,EAAE,2BAA2B,CAAC,uCAAuC;gBAC3F,OAAO,EAAE,EAAE,MAAM,EAAE,sDAAsD,EAAE;aAC5E,CAAC,CAAC;QACL,CAAC;QAED,MAAM,YAAY,GAAG,MAAM,0BAA0B,CAAC;YACpD,QAAQ;YACR,iBAAiB;YACjB,cAAc,EAAE,IAAI,CAAC,eAAe;YACpC,YAAY,EAAE,IAAI,CAAC,IAAI;YACvB,uBAAuB,EAAE,IAAI,CAAC,UAAU,CAAC,gBAAgB,KAAK,UAAU;SACzE,CAAC,CAAC;QAEH,IAAI,CAAC,YAAY,CAAC,QAAQ,IAAI,CAAC,YAAY,CAAC,gBAAgB,EAAE,CAAC;YAC7D,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;gBACtE,sBAAsB,EAAE,2BAA2B,CAAC,uCAAuC;gBAC3F,OAAO,EAAE,EAAE,MAAM,EAAE,2CAA2C,EAAE;aACjE,CAAC,CAAC;QACL,CAAC;QAED,MAAM,EAAE,UAAU,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,GAAG,YAAY,CAAC,gBAAgB,CAAC;QAE/F,MAAM,aAAa,GAA2B;YAC5C,YAAY,EAAE,UAAU,CAAC,EAAE;YAC3B,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC;YAClE,OAAO,EAAE,UAAU,CAAC,OAAO;YAC3B,UAAU,EAAE,CAAC,UAAU,CAAC,UAAU,IAAI,EAAE,CAAa;YACrD,oBAAoB,EAAE,oBAAoB,IAAI,cAAc;YAC5D,kBAAkB,EAAE,kBAAkB,IAAI,KAAK;YAC/C,IAAI,EAAE,cAAc,IAAI,SAAS;YACjC,MAAM,EAAE,YAAY,CAAC,gBAAgB,CAAC,MAAM;YAC5C,SAAS,EAAE,IAAI,IAAI,EAAE;YACrB,UAAU,EAAE,SAAS;SACtB,CAAC;QAEF,kCAAkC;QAClC,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,wBAAwB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QACjE,MAAM,mBAAmB,GAAI,IAAwB,CAAC,kBAAkB,IAAI,EAAE,CAAC;QAC/E,MAAM,kBAAkB,GAAG,CAAC,GAAG,mBAAmB,EAAE,aAAa,CAAC,CAAC;QAEnE,MAAM,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,kBAAkB,EAAE,kBAAkB,EAA8B,CAAC,CAAC;QAE1H,IAAI,CAAC,QAAQ,CAAC,oBAAoB,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,aAAa,CAAC,YAAY,EAAE,CAAC,CAAC;QAC1F,OAAO,aAAa,CAAC;IACvB,CAAC;IAED,gEAAgE;IAEhE;;;OAGG;IACH,KAAK,CAAC,6BAA6B,CACjC,EAAyB,EACzB,MAAc,EACd,WAA0C,6BAA6B,CAAC,KAAK;QAE7E,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,wBAAwB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QACjE,MAAM,mBAAmB,GAAI,IAAwB,CAAC,kBAAkB,IAAI,EAAE,CAAC;QAE/E,IAAI,mBAAmB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACrC,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,EAAE;gBACtE,sBAAsB,EAAE,2BAA2B,CAAC,uCAAuC;gBAC3F,OAAO,EAAE,EAAE,MAAM,EAAE,iDAAiD,EAAE;aACvE,CAAC,CAAC;QACL,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,6BAA6B,CAAC;YAClD,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,gBAAgB,EAAE,IAAI,CAAC,oBAAoB,CAAC,QAAQ,CAAC;YACrD,OAAO,EAAE,IAAI,CAAC,UAAU,CAAC,cAAc,GAAG,IAAI;YAC9C,gBAAgB,EAAE,mBAAmB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBAChD,EAAE,EAAE,CAAC,CAAC,YAAY;gBAClB,UAAU,EAAE,CAAC,CAAC,UAAsC;aACrD,CAAC,CAAC;SACJ,CAAC,CAAC;QAEH,MAAM,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,gBAAgB,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;QACvF,IAAI,CAAC,QAAQ,CAAC,kCAAkC,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,eAAe,EAAE,mBAAmB,CAAC,MAAM,EAAE,CAAC,CAAC;QAErH,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,4BAA4B,CAChC,EAAyB,EACzB,MAAc,EACd,QAAoC,EACpC,WAA0C,6BAA6B,CAAC,KAAK;QAE7E,gGAAgG;QAChG,iEAAiE;QACjE,MAAM,iBAAiB,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,gBAAgB,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;QACrG,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACvB,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,YAAY,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC;QACxD,CAAC;QAED,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,wBAAwB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QACjE,MAAM,mBAAmB,GAAI,IAAwB,CAAC,kBAAkB,IAAI,EAAE,CAAC;QAC/E,MAAM,iBAAiB,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,KAAK,QAAQ,CAAC,EAAE,CAAC,CAAC;QAE1F,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACvB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,sDAAsD,EAAE;gBACvE,MAAM;gBACN,YAAY,EAAE,QAAQ,CAAC,EAAE;aAC1B,CAAC,CAAC;YACH,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,YAAY,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC;QACxD,CAAC;QAED,MAAM,YAAY,GAAG,MAAM,4BAA4B,CAAC;YACtD,QAAQ;YACR,iBAAiB;YACjB,cAAc,EAAE,IAAI,CAAC,eAAe;YACpC,YAAY,EAAE,IAAI,CAAC,IAAI;YACvB,4FAA4F;YAC5F,wFAAwF;YACxF,uBAAuB,EAAE,IAAI,CAAC,oBAAoB,CAAC,QAAQ,CAAC,KAAK,gBAAgB,CAAC,QAAQ;YAC1F,UAAU,EAAE;gBACV,EAAE,EAAE,iBAAiB,CAAC,YAAY;gBAClC,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,SAAS,EAAE,WAAW,CAAC;gBAChE;;;;;;;;;;;;;;;;;;;;mBAoBG;gBACH,OAAO,EAAE,CAAC;gBACV,UAAU,EAAE,iBAAiB,CAAC,UAAsC;aACrE;SACF,CAAC,CAAC;QAEH,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,CAAC;YAC3B,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,YAAY,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC;QACxD,CAAC;QAED;;;;;;;;;;;;;;;;;;;;;;;;;;;WA2BG;QACH,MAAM,UAAU,GAAG,YAAY,CAAC,kBAAkB,CAAC,UAAU,CAAC;QAC9D,IAAI,CAAC,UAAU,GAAG,CAAC,IAAI,iBAAiB,CAAC,OAAO,GAAG,CAAC,CAAC,IAAI,UAAU,IAAI,iBAAiB,CAAC,OAAO,EAAE,CAAC;YACjG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,+EAA+E,EAAE;gBAChG,MAAM;gBACN,YAAY,EAAE,iBAAiB,CAAC,YAAY;gBAC5C,aAAa,EAAE,iBAAiB,CAAC,OAAO;gBACxC,eAAe,EAAE,UAAU;aAC5B,CAAC,CAAC;YACH,6FAA6F;YAC7F,4CAA4C;YAC5C,OAAO;gBACL,QAAQ,EAAE,KAAK;gBACf,YAAY,EAAE,iBAAiB,CAAC,YAAY;gBAC5C,cAAc,EAAE;oBACd,YAAY,EAAE,iBAAiB,CAAC,YAAY;oBAC5C,aAAa,EAAE,iBAAiB,CAAC,OAAO;oBACxC,eAAe,EAAE,UAAU;oBAC3B,oFAAoF;oBACpF,oFAAoF;oBACpF,6EAA6E;oBAC7E,oBAAoB,EAAE,iBAAiB,CAAC,oBAAoB;oBAC5D,kBAAkB,EAAE,iBAAiB,CAAC,kBAAkB;oBACxD,GAAG,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,iBAAiB,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACzE,QAAQ;iBACT;aACF,CAAC;QACJ,CAAC;QAED,gCAAgC;QAChC,MAAM,kBAAkB,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CACvD,CAAC,CAAC,YAAY,KAAK,iBAAiB,CAAC,YAAY;YAC/C,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,IAAI,IAAI,EAAE,EAAE;YACvD,CAAC,CAAC,CAAC,CACN,CAAC;QAEF,MAAM,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,kBAAkB,EAAE,kBAAkB,EAA8B,CAAC,CAAC;QAE1H,IAAI,CAAC,QAAQ,CAAC,iCAAiC,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,iBAAiB,CAAC,YAAY,EAAE,CAAC,CAAC;QAC3G,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,EAAE,iBAAiB,CAAC,YAAY,EAAE,CAAC;IAC1E,CAAC;IAED,gEAAgE;IAEhE;;;;;;;;OAQG;IACH,KAAK,CAAC,cAAc,CAAC,EAAyB,EAAE,MAAc;QAC5D,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,wBAAwB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QACjE,OAAQ,IAAwB,CAAC,kBAAkB,IAAI,EAAE,CAAC;IAC5D,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,gBAAgB,CAAC,EAAyB,EAAE,MAAc,EAAE,YAAoB;QACpF,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,wBAAwB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QACjE,MAAM,mBAAmB,GAAI,IAAwB,CAAC,kBAAkB,IAAI,EAAE,CAAC;QAC/E,MAAM,kBAAkB,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,KAAK,YAAY,CAAC,CAAC;QAE9F,IAAI,kBAAkB,CAAC,MAAM,KAAK,mBAAmB,CAAC,MAAM,EAAE,CAAC;YAC7D,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,SAAS,EAAE,SAAS,EAAE;gBACjE,OAAO,EAAE,EAAE,MAAM,EAAE,8BAA8B,EAAE,YAAY,EAAE;aAClE,CAAC,CAAC;QACL,CAAC;QAED,MAAM,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,kBAAkB,EAAE,kBAAkB,EAA8B,CAAC,CAAC;QAE1H,IAAI,CAAC,QAAQ,CAAC,iBAAiB,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC;IAC7D,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,gBAAgB,CAAC,EAAyB,EAAE,MAAc,EAAE,YAAoB,EAAE,OAAe;QACrG,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,wBAAwB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QACjE,MAAM,mBAAmB,GAAI,IAAwB,CAAC,kBAAkB,IAAI,EAAE,CAAC;QAC/E,MAAM,KAAK,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,KAAK,YAAY,CAAC,CAAC;QAE/E,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,SAAS,EAAE,SAAS,EAAE;gBACjE,OAAO,EAAE,EAAE,MAAM,EAAE,8BAA8B,EAAE,YAAY,EAAE;aAClE,CAAC,CAAC;QACL,CAAC;QAED,MAAM,kBAAkB,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CACvD,CAAC,CAAC,YAAY,KAAK,YAAY,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAC9D,CAAC;QAEF,MAAM,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,kBAAkB,EAAE,kBAAkB,EAA8B,CAAC,CAAC;QAE1H,IAAI,CAAC,QAAQ,CAAC,iBAAiB,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC,CAAC;IACtE,CAAC;IAED,gEAAgE;IAEhE;;;OAGG;IACK,gBAAgB,CAAC,QAAuC,EAAE,MAAc;QAC9E,MAAM,MAAM,GAAG,QAAQ,KAAK,6BAA6B,CAAC,OAAO;YAC/D,CAAC,CAAC,4BAA4B;YAC9B,CAAC,CAAC,yBAAyB,CAAC;QAC9B,OAAO,MAAM,GAAG,MAAM,CAAC;IACzB,CAAC;IAED;;;;;;;;OAQG;IACK,oBAAoB,CAAC,QAAuC;QAClE,OAAO,QAAQ,KAAK,6BAA6B,CAAC,OAAO;YACvD,CAAC,CAAC,gBAAgB,CAAC,QAAQ;YAC3B,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,gBAAgB,CAAC;IACvC,CAAC;IAEO,KAAK,CAAC,eAAe,CAAC,GAAW,EAAE,SAAiB;QAC1D,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,SAAS,EAAE,EAAE,GAAG,EAAE,qBAAqB,EAAE,CAAC,CAAC;IAC9E,CAAC;IAED;;;;;;;OAOG;IACK,KAAK,CAAC,sBAAsB,CAAC,GAAW;QAC9C,OAAO,IAAI,CAAC,YAAY,CAAC,MAAM,CAAS,GAAG,CAAC,CAAC;IAC/C,CAAC;IAED,gEAAgE;IAEhE;;;OAGG;IACK,KAAK,CAAC,wBAAwB,CACpC,EAAyB,EACzB,MAAc;QAId,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,YAAY,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QAC/D,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,SAAS,EAAE,SAAS,EAAE;gBACjE,OAAO,EAAE,EAAE,MAAM,EAAE,4BAA4B,EAAE,MAAM,EAAE;aAC1D,CAAC,CAAC;QACL,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,CAAC;IAClB,CAAC;CACF,CAAA;AApcY,sBAAsB;IAFlC,UAAU,EAAE;IAMR,WAAA,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAA;IACjC,WAAA,MAAM,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,CAAA;IAC3C,WAAA,MAAM,CAAC,kBAAkB,CAAC,YAAY,CAAC,CAAA;IACvC,WAAA,MAAM,CAAC,kBAAkB,CAAC,wBAAwB,CAAC,CAAA;IACnD,WAAA,MAAM,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,CAAA;qCAJa,aAAa;QACO,uBAAuB;QAC/B,YAAY;QACC,+BAA+B;QACrC,0BAA0B;GARhG,sBAAsB,CAoclC","sourcesContent":["import 'reflect-metadata';\nimport { inject, injectable } from 'inversify';\nimport {\n  generateRegistrationOptions,\n  verifyRegistrationResponse,\n  generateAuthenticationOptions,\n  verifyAuthenticationResponse,\n} from '@simplewebauthn/server';\nimport type {\n  PublicKeyCredentialCreationOptionsJSON,\n  PublicKeyCredentialRequestOptionsJSON,\n  RegistrationResponseJSON,\n  AuthenticationResponseJSON,\n} from '@simplewebauthn/server';\n\nimport { SAAS_SERVICE_TYPES } from '~wildo-backend-lib/inject/models/service-types';\nimport { LoggerService } from '~wildo-backend-lib/monitoring/logger/services/logger.service';\nimport { AppConfigurationService } from '~wildo-backend-lib/config/services/app-configuration.backend.service';\nimport { UserVerification } from '~wildo-backend-lib/config/models/app-config.backend.schemas';\nimport { RedisService } from '~wildo-backend-lib/databases/services/redis.service';\nimport { AuthCredentialOpsBackendService } from '~wildo-backend-lib/security/authentications/services/utils/auth-credential-ops.backend.service';\nimport { ErrorBuilderBackendService } from '~wildo-backend-lib/errors/services/error-builder.backend.service';\nimport { ExecutionContext } from '~wildo-backend-lib/runtime/models/execution-context.backend.schemas';\nimport {\n  UserCredentials,\n  PasskeyCredentialEntry,\n  ErrorType,\n  ErrorCustomMessageReference,\n} from '@wildo-ai/saas-models';\n\nconst CHALLENGE_TTL_SECONDS = 300; // 5 minutes\nconst CHALLENGE_KEY_PREFIX_REG = 'webauthn_challenge:reg:';\nconst CHALLENGE_KEY_PREFIX_AUTH = 'webauthn_challenge:auth:';\n/**\n * SEPARATE from the login prefix on purpose — see {@link PasskeyAuthenticationCeremony}. Sharing one\n * key would let an assertion the user produced for LOGIN be redeemed at the step-up door.\n */\nconst CHALLENGE_KEY_PREFIX_STEP_UP = 'webauthn_challenge:stepup:';\n\n/**\n * Which ceremony a passkey assertion belongs to.\n *\n * The two differ in the QUESTION they answer, and therefore in what they must demand:\n *\n * - **LOGIN** asks \"which principal is this?\". The passkey IS the factor, so possession of the\n *   authenticator is the claim, and the app's `passkeyOperational.userVerification` policy decides\n *   whether a PIN/biometric is also required.\n * - **STEP_UP** asks \"is the human still here, right now, and do they intend this irreversible\n *   thing?\". Possession alone cannot answer that — a resident credential on an already-unlocked\n *   machine would satisfy it with no human intent — so this ceremony pins user verification to\n *   REQUIRED regardless of the app policy. Under the common `preferred` setting a login assertion\n *   may legitimately carry no UV, and accepting one here would make the strongest-LOOKING factor the\n *   weakest door onto the operations `requiresStepUpAuthentication` guards.\n *\n * They also use SEPARATE challenge keys, which is the load-bearing half. Both challenges are\n * single-use (atomic get-and-delete), but single-use alone does not say WHICH door a signed\n * assertion may open: with a shared key, an assertion the user produced for a login could be\n * replayed to `/auth/reauth` and minted into a step-up token. Distinct keys make a login challenge\n * structurally unredeemable at the step-up door and vice versa.\n *\n * assurance-control: WILDO.IDENTITY.STEP_UP_AUTHENTICATION — a re-proof ceremony must not be\n * satisfiable by a credential presented for a different purpose.\n */\nexport enum PasskeyAuthenticationCeremony {\n  LOGIN = 'login',\n  STEP_UP = 'step_up',\n}\n\n/**\n * What a passkey assertion verification answers.\n *\n * `cloneSuspicion` is present ONLY when the assertion's signature verified and its counter did not\n * advance — the W3C cloned-authenticator signal. It is returned rather than audited here because\n * this service deliberately emits no audit rows (see the class header): the caller holds the\n * request's device information and is where the trail is written.\n */\nexport interface PasskeyAuthenticationVerificationResult {\n  verified: boolean;\n  credentialId: string;\n  cloneSuspicion?: {\n    credentialId: string;\n    storedCounter: number;\n    receivedCounter: number;\n    credentialDeviceType: string;\n    credentialBackedUp: boolean;\n    aaguid?: string;\n    ceremony: PasskeyAuthenticationCeremony;\n  };\n}\n\n/**\n * WebAuthnBackendService\n *\n * Encapsulates all WebAuthn/FIDO2 ceremony logic using @simplewebauthn/server.\n * Handles option generation, response verification, challenge management (Redis),\n * and credential CRUD on user credential documents.\n *\n * This service does NOT:\n * - Manage sessions (AuthSessionStore)\n * - Issue tokens (AuthTokenIssuer)\n * - Audit log (orchestrator/controller responsibility)\n * - Know about the authentication flow (orchestrator's job)\n */\n@injectable()\n\nexport class WebAuthnBackendService {\n  private readonly logDebug: (message: string, context?: Record<string, unknown>) => void;\n\n  constructor(\n    @inject(SAAS_SERVICE_TYPES.Logger) private readonly logger: LoggerService,\n    @inject(SAAS_SERVICE_TYPES.AppConfigService) private readonly appConfigService: AppConfigurationService,\n    @inject(SAAS_SERVICE_TYPES.RedisService) private readonly redisService: RedisService,\n    @inject(SAAS_SERVICE_TYPES.AuthCredentialOpsService) private readonly credentialOps: AuthCredentialOpsBackendService,\n    @inject(SAAS_SERVICE_TYPES.ErrorBuilderService) private readonly errorBuilder: ErrorBuilderBackendService,\n  ) {\n    this.logDebug = this.logger.debugByType('WebAuthn');\n    this.logger.setDebugTypeLogging('WebAuthn', false);\n  }\n\n  // ─── Configuration ───────────────────────────────────────────\n\n  private get rpId(): string {\n    return this.appConfigService.config.auth.passkeyConfig.rpId;\n  }\n\n  private get rpName(): string {\n    return this.appConfigService.config.auth.passkeyConfig.rpName;\n  }\n\n  private get passkeyOps() {\n    return this.appConfigService.config.auth.passkeyOperational;\n  }\n\n  /**\n   * Derive the expected origin(s) from the app config's runtime endpoints.\n   * Returns all configured publicUrl values as valid origins.\n   */\n  private get expectedOrigins(): string[] {\n    const endPoints = this.appConfigService.config.runtime.endPoints;\n    const origins: string[] = [];\n    for (const [, urls] of Object.entries(endPoints)) {\n      if (urls?.publicUrl) {\n        origins.push(urls.publicUrl.replace(/\\/$/, ''));\n      }\n    }\n    if (origins.length === 0) {\n      origins.push(`https://${this.rpId}`);\n    }\n    return origins;\n  }\n\n  // ─── Registration ────────────────────────────────────────────\n\n  /**\n   * Generate WebAuthn registration options for a user.\n   * The caller is responsible for ensuring the user is authenticated.\n   */\n  async generateRegistrationOptions(\n    ec: ExecutionContext<any>,\n    userId: string,\n    email: string,\n  ): Promise<PublicKeyCredentialCreationOptionsJSON> {\n    const { cred } = await this._resolveCredentialRecord(ec, userId);\n    const existingCredentials = (cred as UserCredentials).passkeyCredentials ?? [];\n\n    const maxPasskeys = this.appConfigService.config?.auth?.passkeyConfig?.maxPasskeysPerUser ?? 10;\n    if (existingCredentials.length >= maxPasskeys) {\n      throw this.errorBuilder.buildError(ErrorType.VALIDATION, undefined, {\n        context: { reason: `Maximum of ${maxPasskeys} passkeys reached` },\n      });\n    }\n\n    const ops = this.passkeyOps;\n    const options = await generateRegistrationOptions({\n      rpName: this.rpName,\n      rpID: this.rpId,\n      userName: email,\n      userDisplayName: email,\n      userID: new TextEncoder().encode(userId),\n      // Cast: @simplewebauthn narrows to 'direct'|'enterprise'|'none' but W3C\n      // AttestationConveyancePreference includes 'indirect' — valid at runtime.\n      attestationType: ops.attestation as 'direct' | 'enterprise' | 'none',\n      timeout: ops.timeoutSeconds * 1000,\n      authenticatorSelection: {\n        authenticatorAttachment: ops.authenticatorAttachment === 'any' ? undefined : ops.authenticatorAttachment,\n        residentKey: ops.requireResidentKey ? 'required' : 'preferred',\n        userVerification: ops.userVerification,\n      },\n      excludeCredentials: existingCredentials.map((c) => ({\n        id: c.credentialId,\n        transports: c.transports as AuthenticatorTransport[],\n      })),\n    });\n\n    await this._storeChallenge(CHALLENGE_KEY_PREFIX_REG + userId, options.challenge);\n    this.logDebug('Registration options generated', { userId, excludeCount: existingCredentials.length });\n\n    return options;\n  }\n\n  /**\n   * Verify a WebAuthn registration response and store the new credential.\n   * Returns the new credential entry on success.\n   */\n  async verifyRegistrationResponse(\n    ec: ExecutionContext<any>,\n    userId: string,\n    response: RegistrationResponseJSON,\n    credentialName?: string,\n  ): Promise<PasskeyCredentialEntry> {\n    const expectedChallenge = await this._getAndDeleteChallenge(CHALLENGE_KEY_PREFIX_REG + userId);\n    if (!expectedChallenge) {\n      throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n        customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_USER_CREDENTIALS_INVALID,\n        context: { reason: 'WebAuthn registration challenge expired or not found' },\n      });\n    }\n\n    const verification = await verifyRegistrationResponse({\n      response,\n      expectedChallenge,\n      expectedOrigin: this.expectedOrigins,\n      expectedRPID: this.rpId,\n      requireUserVerification: this.passkeyOps.userVerification === 'required',\n    });\n\n    if (!verification.verified || !verification.registrationInfo) {\n      throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n        customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_USER_CREDENTIALS_INVALID,\n        context: { reason: 'WebAuthn registration verification failed' },\n      });\n    }\n\n    const { credential, credentialDeviceType, credentialBackedUp } = verification.registrationInfo;\n\n    const newCredential: PasskeyCredentialEntry = {\n      credentialId: credential.id,\n      publicKey: Buffer.from(credential.publicKey).toString('base64url'),\n      counter: credential.counter,\n      transports: (credential.transports ?? []) as string[],\n      credentialDeviceType: credentialDeviceType ?? 'singleDevice',\n      credentialBackedUp: credentialBackedUp ?? false,\n      name: credentialName ?? 'Passkey',\n      aaguid: verification.registrationInfo.aaguid,\n      createdAt: new Date(),\n      lastUsedAt: undefined,\n    };\n\n    // Append to the credential record\n    const { cred } = await this._resolveCredentialRecord(ec, userId);\n    const existingCredentials = (cred as UserCredentials).passkeyCredentials ?? [];\n    const updatedCredentials = [...existingCredentials, newCredential];\n\n    await this.credentialOps.updateById(ec, cred._id, { passkeyCredentials: updatedCredentials } as Partial<UserCredentials>);\n\n    this.logDebug('Passkey registered', { userId, credentialId: newCredential.credentialId });\n    return newCredential;\n  }\n\n  // ─── Authentication ──────────────────────────────────────────\n\n  /**\n    * Generate WebAuthn authentication options for a user.\n   * Populates allowCredentials from the user's stored passkeys.\n   */\n  async generateAuthenticationOptions(\n    ec: ExecutionContext<any>,\n    userId: string,\n    ceremony: PasskeyAuthenticationCeremony = PasskeyAuthenticationCeremony.LOGIN,\n  ): Promise<PublicKeyCredentialRequestOptionsJSON> {\n    const { cred } = await this._resolveCredentialRecord(ec, userId);\n    const existingCredentials = (cred as UserCredentials).passkeyCredentials ?? [];\n\n    if (existingCredentials.length === 0) {\n      throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {\n        customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_USER_CREDENTIALS_INVALID,\n        context: { reason: 'No passkey credentials registered for this user' },\n      });\n    }\n\n    const options = await generateAuthenticationOptions({\n      rpID: this.rpId,\n      userVerification: this._userVerificationFor(ceremony),\n      timeout: this.passkeyOps.timeoutSeconds * 1000,\n      allowCredentials: existingCredentials.map((c) => ({\n        id: c.credentialId,\n        transports: c.transports as AuthenticatorTransport[],\n      })),\n    });\n\n    await this._storeChallenge(this._challengeKeyFor(ceremony, userId), options.challenge);\n    this.logDebug('Authentication options generated', { userId, ceremony, credentialCount: existingCredentials.length });\n\n    return options;\n  }\n\n  /**\n   * Verify a WebAuthn authentication response.\n   * Updates the credential counter and lastUsedAt on success.\n   */\n  async verifyAuthenticationResponse(\n    ec: ExecutionContext<any>,\n    userId: string,\n    response: AuthenticationResponseJSON,\n    ceremony: PasskeyAuthenticationCeremony = PasskeyAuthenticationCeremony.LOGIN,\n  ): Promise<PasskeyAuthenticationVerificationResult> {\n    // Reads ONLY this ceremony's challenge, so an assertion signed for the other door finds nothing\n    // to match and is refused — see `PasskeyAuthenticationCeremony`.\n    const expectedChallenge = await this._getAndDeleteChallenge(this._challengeKeyFor(ceremony, userId));\n    if (!expectedChallenge) {\n      return { verified: false, credentialId: response.id };\n    }\n\n    const { cred } = await this._resolveCredentialRecord(ec, userId);\n    const existingCredentials = (cred as UserCredentials).passkeyCredentials ?? [];\n    const matchedCredential = existingCredentials.find((c) => c.credentialId === response.id);\n\n    if (!matchedCredential) {\n      this.logger.warn('WebAuthn authentication failed: credential not found', {\n        userId,\n        credentialId: response.id,\n      });\n      return { verified: false, credentialId: response.id };\n    }\n\n    const verification = await verifyAuthenticationResponse({\n      response,\n      expectedChallenge,\n      expectedOrigin: this.expectedOrigins,\n      expectedRPID: this.rpId,\n      // STEP_UP pins this true even when the app policy is `preferred` — an assertion carrying no\n      // user verification proves possession of the authenticator, not presence of the person.\n      requireUserVerification: this._userVerificationFor(ceremony) === UserVerification.REQUIRED,\n      credential: {\n        id: matchedCredential.credentialId,\n        publicKey: Buffer.from(matchedCredential.publicKey, 'base64url'),\n        /*\n         * DELIBERATELY 0, NOT the stored counter — and this line is load-bearing, so read the\n         * reason before \"fixing\" it.\n         *\n         * `@simplewebauthn/server` evaluates its own counter guard BEFORE `verifySignature`\n         * (verifyAuthenticationResponse.js:144-151 in 13.3.x, then :154). Handing it the real\n         * stored value therefore refuses a counter regression on an assertion whose signature was\n         * never checked — so ANY caller who knows a credential id could trigger the refusal, and\n         * an alert raised there would be forgeable by an unauthenticated party.\n         *\n         * W3C WebAuthn L3 puts the counter comparison at §7.2 step 22, AFTER signature\n         * verification at step 21, precisely because a counter regression only means something\n         * when the assertion is known to come from something holding the private key. Passing 0\n         * makes the library's predicate unsatisfiable — `(counter > 0 || 0 > 0) && counter <= 0`\n         * is false for every input — so the library does what we want from it (verify the\n         * signature) and the counter decision stays here, below, where it is ours and where it is\n         * post-authentication.\n         *\n         * spec-cite: W3C Web Authentication Level 3 §7.2 steps 21-22\n         * (https://www.w3.org/TR/webauthn-3/#sctn-verifying-assertion).\n         */\n        counter: 0,\n        transports: matchedCredential.transports as AuthenticatorTransport[],\n      },\n    });\n\n    if (!verification.verified) {\n      return { verified: false, credentialId: response.id };\n    }\n\n    /*\n     * CLONE DETECTION — the spec's predicate, on a signature-verified assertion.\n     *\n     * \"If either is non-zero, and the new signCount value is less than or equal to the stored\n     * value, a cloned authenticator may exist, or the authenticator may be malfunctioning, or a\n     * race condition might exist\" — W3C WebAuthn L3 §6.1.1.\n     *\n     * EITHER non-zero, not just the received one. The previous check here read\n     * `newCounter > 0 && newCounter <= stored`, which misses the case that matters most\n     * operationally: a credential that previously counted and now reports 0. It was also dead\n     * code — the library threw first — and it only warned.\n     *\n     * A credential whose counter is permanently 0 — which every SYNCED passkey is, because a set\n     * of devices cannot maintain a coherent counter — compares 0-against-0, fails the first\n     * disjunct, and authenticates normally. That is the whole passkey accommodation and it is why\n     * refusing here is not hostile to passkeys.\n     *\n     * Refusal, not step-up, and not configurable: three of the four major server implementations\n     * fail closed with no switch (SimpleWebAuthn, Duo py_webauthn, ASP.NET Core Identity) and the\n     * fourth (Yubico) defaults to it. Nothing authoritative recommends escalating instead.\n     *\n     * Returned rather than thrown so BOTH callers take their existing `!verified` branch and\n     * produce the same clean AUTHENTICATION refusal — the step-up path used to wrap a library\n     * throw as a generic error while login refused cleanly.\n     *\n     * spec-cite: W3C Web Authentication Level 3 §6.1.1\n     * (https://www.w3.org/TR/webauthn-3/#sctn-sign-counter).\n     */\n    const newCounter = verification.authenticationInfo.newCounter;\n    if ((newCounter > 0 || matchedCredential.counter > 0) && newCounter <= matchedCredential.counter) {\n      this.logger.warn('WebAuthn signature counter did not advance on a verified assertion — refusing', {\n        userId,\n        credentialId: matchedCredential.credentialId,\n        storedCounter: matchedCredential.counter,\n        receivedCounter: newCounter,\n      });\n      // The stored counter is NOT advanced: a refused assertion must not move the baseline a later\n      // legitimate assertion is compared against.\n      return {\n        verified: false,\n        credentialId: matchedCredential.credentialId,\n        cloneSuspicion: {\n          credentialId: matchedCredential.credentialId,\n          storedCounter: matchedCredential.counter,\n          receivedCounter: newCounter,\n          // Carried for TRIAGE only — nothing branches on them. A synced credential that once\n          // reported a non-zero counter and then regresses is still a signal, so exempting by\n          // device type would disable clone detection for the majority of credentials.\n          credentialDeviceType: matchedCredential.credentialDeviceType,\n          credentialBackedUp: matchedCredential.credentialBackedUp,\n          ...(matchedCredential.aaguid ? { aaguid: matchedCredential.aaguid } : {}),\n          ceremony,\n        },\n      };\n    }\n\n    // Update counter and lastUsedAt\n    const updatedCredentials = existingCredentials.map((c) =>\n      c.credentialId === matchedCredential.credentialId\n        ? { ...c, counter: newCounter, lastUsedAt: new Date() }\n        : c,\n    );\n\n    await this.credentialOps.updateById(ec, cred._id, { passkeyCredentials: updatedCredentials } as Partial<UserCredentials>);\n\n    this.logDebug('Passkey authentication verified', { userId, credentialId: matchedCredential.credentialId });\n    return { verified: true, credentialId: matchedCredential.credentialId };\n  }\n\n  // ─── Credential CRUD ─────────────────────────────────────────\n\n  /**\n   * List all passkey credentials for a user, as STORED.\n   *\n   * This returns the whole `PasskeyCredentialEntry`, `publicKey` and `counter` included. It is not a\n   * safe-field projection, and must not be handed to a caller as one: the projection that reaches a\n   * client is built at the controller (`handlePasskeyList`), which selects the credential id, name,\n   * timestamps and device flags and nothing else. A new consumer of this method owes its own\n   * projection, or it will disclose the stored credential material.\n   */\n  async getCredentials(ec: ExecutionContext<any>, userId: string): Promise<PasskeyCredentialEntry[]> {\n    const { cred } = await this._resolveCredentialRecord(ec, userId);\n    return (cred as UserCredentials).passkeyCredentials ?? [];\n  }\n\n  /**\n   * Remove a passkey credential by its credential ID.\n   */\n  async removeCredential(ec: ExecutionContext<any>, userId: string, credentialId: string): Promise<void> {\n    const { cred } = await this._resolveCredentialRecord(ec, userId);\n    const existingCredentials = (cred as UserCredentials).passkeyCredentials ?? [];\n    const updatedCredentials = existingCredentials.filter((c) => c.credentialId !== credentialId);\n\n    if (updatedCredentials.length === existingCredentials.length) {\n      throw this.errorBuilder.buildError(ErrorType.NOT_FOUND, undefined, {\n        context: { reason: 'Passkey credential not found', credentialId },\n      });\n    }\n\n    await this.credentialOps.updateById(ec, cred._id, { passkeyCredentials: updatedCredentials } as Partial<UserCredentials>);\n\n    this.logDebug('Passkey removed', { userId, credentialId });\n  }\n\n  /**\n   * Rename a passkey credential.\n   */\n  async renameCredential(ec: ExecutionContext<any>, userId: string, credentialId: string, newName: string): Promise<void> {\n    const { cred } = await this._resolveCredentialRecord(ec, userId);\n    const existingCredentials = (cred as UserCredentials).passkeyCredentials ?? [];\n    const found = existingCredentials.find((c) => c.credentialId === credentialId);\n\n    if (!found) {\n      throw this.errorBuilder.buildError(ErrorType.NOT_FOUND, undefined, {\n        context: { reason: 'Passkey credential not found', credentialId },\n      });\n    }\n\n    const updatedCredentials = existingCredentials.map((c) =>\n      c.credentialId === credentialId ? { ...c, name: newName } : c,\n    );\n\n    await this.credentialOps.updateById(ec, cred._id, { passkeyCredentials: updatedCredentials } as Partial<UserCredentials>);\n\n    this.logDebug('Passkey renamed', { userId, credentialId, newName });\n  }\n\n  // ─── Challenge Management (Redis) ────────────────────────────\n\n  /**\n   * The Redis challenge key for a ceremony. Distinct per ceremony so a challenge issued for one door\n   * cannot be redeemed at the other — see {@link PasskeyAuthenticationCeremony}.\n   */\n  private _challengeKeyFor(ceremony: PasskeyAuthenticationCeremony, userId: string): string {\n    const prefix = ceremony === PasskeyAuthenticationCeremony.STEP_UP\n      ? CHALLENGE_KEY_PREFIX_STEP_UP\n      : CHALLENGE_KEY_PREFIX_AUTH;\n    return prefix + userId;\n  }\n\n  /**\n   * The user-verification requirement for a ceremony.\n   *\n   * STEP_UP is REQUIRED unconditionally; LOGIN follows the app's `passkeyOperational` policy. The\n   * override deliberately does not read the policy at all: an application that lowers it to\n   * `preferred` (the common setting) is making a decision about LOGIN ergonomics, and inheriting it\n   * here would silently weaken the re-proof that guards irreversible operations. Same reasoning as\n   * `requiresStepUpAuthentication` refusing to inherit the per-user-type freshness policy.\n   */\n  private _userVerificationFor(ceremony: PasskeyAuthenticationCeremony): UserVerification {\n    return ceremony === PasskeyAuthenticationCeremony.STEP_UP\n      ? UserVerification.REQUIRED\n      : this.passkeyOps.userVerification;\n  }\n\n  private async _storeChallenge(key: string, challenge: string): Promise<void> {\n    await this.redisService.set(key, challenge, { ttl: CHALLENGE_TTL_SECONDS });\n  }\n\n  /**\n   * Atomically read-and-consume a stored challenge. Delegates to\n   * `RedisService.getDel`, which applies the same tenant-key scoping and\n   * `JSON.parse` deserialization as the `set()` used by `_storeChallenge` —\n   * keeping the store/read serialization contract symmetric. (The prior\n   * hand-rolled `eval` GETDEL skipped `JSON.parse`, so the challenge came\n   * back wrapped in literal quotes and every verification failed.)\n   */\n  private async _getAndDeleteChallenge(key: string): Promise<string | null> {\n    return this.redisService.getDel<string>(key);\n  }\n\n  // ─── Internal Helpers ────────────────────────────────────────\n\n  /**\n   * Resolve the credential record for a user.\n   * Returns the credential document (throws if not found).\n   */\n  private async _resolveCredentialRecord(\n    ec: ExecutionContext<any>,\n    userId: string,\n  ): Promise<{\n    cred: UserCredentials;\n  }> {\n    const cred = await this.credentialOps.readByUserId(ec, userId);\n    if (!cred) {\n      throw this.errorBuilder.buildError(ErrorType.NOT_FOUND, undefined, {\n        context: { reason: 'User credentials not found', userId },\n      });\n    }\n    return { cred };\n  }\n}\n\ntype AuthenticatorTransport = 'ble' | 'cable' | 'hybrid' | 'internal' | 'nfc' | 'smart-card' | 'usb';\n"]}

package/dist/esm/security/authentications/services/auth-session-store.backend.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-session-store.backend.service.d.ts","sourceRoot":"","sources":["../../../../../../src/security/authentications/services/auth-session-store.backend.service.ts"],"names":[],"mappings":"AAAA,OAAO,kBAAkB,CAAC;AAI1B,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAC7F,OAAO,EAAE,YAAY,EAAE,MAAM,qDAAqD,CAAC;AACnF,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAC9G,OAAO,EAAE,qBAAqB,EAA+B,MAAM,uBAAuB,CAAC;AAK3F;;;GAGG;AACH,MAAM,WAAW,iBAAiB;IAChC,iEAAiE;IACjE,GAAG,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC,CAAC;IAC9D,6CAA6C;IAC7C,GAAG,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,qBAAqB,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1F,wBAAwB;IACxB,MAAM,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACzC,iCAAiC;IACjC,MAAM,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC5C,sDAAsD;IACtD,iBAAiB,IAAI,MAAM,CAAC;CAC7B;AAED;;;;;;;;;;;GAWG;AACH,qBACa,8BAA+B,YAAW,iBAAiB;IAIjC,OAAO,CAAC,QAAQ,CAAC,MAAM;IACjB,OAAO,CAAC,QAAQ,CAAC,YAAY;IACtB,OAAO,CAAC,QAAQ,CAAC,YAAY;IAL/E,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA+D;gBAGlC,MAAM,EAAE,aAAa,EACf,YAAY,EAAE,YAAY,EACnB,YAAY,EAAE,0BAA0B;IAM3G;;;OAGG;IACI,iBAAiB,IAAI,MAAM;IAIrB,GAAG,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC;IA6B7D,GAAG,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,qBAAqB,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAkBzF,MAAM,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAaxC,MAAM,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAYxD;;;;;;;;;OASG;IACU,YAAY,CACvB,SAAS,EAAE,MAAM,EACjB,cAAc,EAAE,qBAAqB,EACrC,eAAe,EAAE,MAAM,EACvB,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC;IAuDxC;;;OAGG;IACH,OAAO,CAAC,GAAG;CAGZ"}
+{"version":3,"file":"auth-session-store.backend.service.d.ts","sourceRoot":"","sources":["../../../../../src/security/authentications/services/auth-session-store.backend.service.ts"],"names":[],"mappings":"AAAA,OAAO,kBAAkB,CAAC;AAI1B,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAC7F,OAAO,EAAE,YAAY,EAAE,MAAM,qDAAqD,CAAC;AACnF,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAC9G,OAAO,EAAE,qBAAqB,EAA+B,MAAM,uBAAuB,CAAC;AAK3F;;;GAGG;AACH,MAAM,WAAW,iBAAiB;IAChC,iEAAiE;IACjE,GAAG,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC,CAAC;IAC9D,6CAA6C;IAC7C,GAAG,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,qBAAqB,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1F,wBAAwB;IACxB,MAAM,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACzC,iCAAiC;IACjC,MAAM,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC5C,sDAAsD;IACtD,iBAAiB,IAAI,MAAM,CAAC;CAC7B;AAED;;;;;;;;;;;GAWG;AACH,qBACa,8BAA+B,YAAW,iBAAiB;IAIjC,OAAO,CAAC,QAAQ,CAAC,MAAM;IACjB,OAAO,CAAC,QAAQ,CAAC,YAAY;IACtB,OAAO,CAAC,QAAQ,CAAC,YAAY;IAL/E,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA+D;gBAGlC,MAAM,EAAE,aAAa,EACf,YAAY,EAAE,YAAY,EACnB,YAAY,EAAE,0BAA0B;IAM3G;;;OAGG;IACI,iBAAiB,IAAI,MAAM;IAIrB,GAAG,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC;IA6B7D,GAAG,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,qBAAqB,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAkBzF,MAAM,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAaxC,MAAM,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAYxD;;;;;;;;;OASG;IACU,YAAY,CACvB,SAAS,EAAE,MAAM,EACjB,cAAc,EAAE,qBAAqB,EACrC,eAAe,EAAE,MAAM,EACvB,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC;IAuDxC;;;OAGG;IACH,OAAO,CAAC,GAAG;CAGZ"}

package/dist/esm/security/authentications/services/auth-token-issuer.backend.service.d.ts

@@ -8,6 +8,7 @@ import { AuditLogsBackendService } from '../../../compliance/audit-trails/servic
 import type { ServicesRegistryHandlerBackendService } from '../../../base-classes/services/services/services-registry-handler.backend.service';
 import { AuthExecutionContextFactoryBackendService } from '../../../security/authentications/services/auth-execution-context-factory.backend.service';
 import { AuthenticationSession, SessionType } from '@wildo-ai/saas-models';
+import { type AuditObservationLossMetricsRecorder } from '../../../monitoring/observability/audit-observation-emission.backend';
 /**
  * Result of token issuance.
  */
@@ -65,8 +66,9 @@ export declare class AuthTokenIssuerBackendService {
     private readonly servicesRegistryHandler;
     private readonly authEcFactory;
     private readonly auditLogsService;
+    private readonly metricsService?;
     private readonly logDebug;
-    constructor(logger: LoggerService, appConfigService: AppConfigurationService, jwtService: JwtBackendService, errorBuilder: ErrorBuilderBackendService, redisService: RedisService, servicesRegistryHandler: ServicesRegistryHandlerBackendService, authEcFactory: AuthExecutionContextFactoryBackendService, auditLogsService?: AuditLogsBackendService | null);
+    constructor(logger: LoggerService, appConfigService: AppConfigurationService, jwtService: JwtBackendService, errorBuilder: ErrorBuilderBackendService, redisService: RedisService, servicesRegistryHandler: ServicesRegistryHandlerBackendService, authEcFactory: AuthExecutionContextFactoryBackendService, auditLogsService?: AuditLogsBackendService | null, metricsService?: AuditObservationLossMetricsRecorder);
     /**
      * Issue access + refresh tokens for a completed authentication session.
      */
@@ -174,6 +176,20 @@ export declare class AuthTokenIssuerBackendService {
      * adding a `log*` method breaks partially-mocked doubles, the property is absent, and the CALL
      * throws synchronously before any `.catch()` can make it fire-and-forget.
      *
+     * ## Why the detection decides an ARGUMENT rather than an early return
+     *
+     * Every emission goes through {@link emitAuditObservation}, which counts a lost one on
+     * `audit_observation_dropped_total`. Handing the seam `undefined` is how this site reports
+     * `SERVICE_UNAVAILABLE` — the loss shape that reaches no `_createAuditLog` and therefore used to
+     * leave nothing behind at all. Returning early on an absent method would restore that silence,
+     * which matters here more than it looks: an unbound audit service makes the eviction trail
+     * PERMANENTLY empty, and an empty eviction trail reads as "the cap never fired".
+     *
+     * The count is per RETIRED CHAIN, not per enforcement — one lost row is one lost row, and a cap
+     * that evicts four chains while the sink is down has lost four pieces of evidence. The
+     * `!evictedJti` skip stays ABOVE the emission for the opposite reason: a pair with no jti is
+     * nothing owed, and counting a deliberate skip would fire the loss signal on correct behaviour.
+     *
      * assurance-control: WILDO.IDENTITY.SESSION_CONCURRENCY_LIMIT — the bound's enforcement is
      * evidenced, naming WHICH chain was retired and when it was issued.
      */

package/dist/esm/security/authentications/services/auth-token-issuer.backend.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-token-issuer.backend.service.d.ts","sourceRoot":"","sources":["../../../../../../src/security/authentications/services/auth-token-issuer.backend.service.ts"],"names":[],"mappings":"AAAA,OAAO,kBAAkB,CAAC;AAI1B,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAC7F,OAAO,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AAC/G,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAC9G,OAAO,EAAE,YAAY,EAAE,MAAM,qDAAqD,CAAC;AACnF,OAAO,EAAE,iBAAiB,EAAE,MAAM,8DAA8D,CAAC;AACjG,OAAO,EAAE,uBAAuB,EAAE,MAAM,gFAAgF,CAAC;AAEzH,OAAO,KAAK,EAAE,qCAAqC,EAAE,MAAM,6FAA6F,CAAC;AACzJ,OAAO,EAAE,yCAAyC,EAAE,MAAM,qGAAqG,CAAC;AAChK,OAAO,EAAE,qBAAqB,EAAkC,WAAW,EAAwE,MAAM,uBAAuB,CAAC;AAuBjL;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,uBAAuB;IACtC,kEAAkE;IAClE,MAAM,EAAE,MAAM,CAAC;IACf,qEAAqE;IACrE,SAAS,EAAE,MAAM,CAAC;IAClB,2EAA2E;IAC3E,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,iGAAiG;IACjG,aAAa,EAAE,OAAO,CAAC;CACxB;AAUD;;;GAGG;AACH,wBAAgB,0BAA0B,CAAC,CAAC,SAAS,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,uBAAuB,GAAG,CAAC,CAQzG;AAED;;;;GAIG;AACH,wBAAgB,8BAA8B,CAAC,KAAK,EAAE,OAAO,GAAG,uBAAuB,GAAG,IAAI,CAK7F;AAED;;;;;;;;;;;GAWG;AACH,qBACa,6BAA6B;IAIH,OAAO,CAAC,QAAQ,CAAC,MAAM;IACb,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IAChC,OAAO,CAAC,QAAQ,CAAC,UAAU;IACzB,OAAO,CAAC,QAAQ,CAAC,YAAY;IACpC,OAAO,CAAC,QAAQ,CAAC,YAAY;IACX,OAAO,CAAC,QAAQ,CAAC,uBAAuB;IAC3C,OAAO,CAAC,QAAQ,CAAC,aAAa;IAQtF,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IAjBnC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA+D;gBAGlC,MAAM,EAAE,aAAa,EACX,gBAAgB,EAAE,uBAAuB,EACxC,UAAU,EAAE,iBAAiB,EAC3B,YAAY,EAAE,0BAA0B,EAC/C,YAAY,EAAE,YAAY,EACR,uBAAuB,EAAE,qCAAqC,EACjE,aAAa,EAAE,yCAAyC,EAQhH,gBAAgB,GAAE,uBAAuB,GAAG,IAAW;IAM1E;;OAEG;IACU,WAAW,CACtB,OAAO,EAAE,qBAAqB,EAC9B,OAAO,GAAE;QAAE,mBAAmB,CAAC,EAAE,OAAO,CAAC;QAAC,mBAAmB,CAAC,EAAE,MAAM,CAAC;QAAC,cAAc,CAAC,EAAE,MAAM,CAAA;KAAO,GACrG,OAAO,CAAC,UAAU,CAAC;IAgBtB;;;;OAIG;IACU,kBAAkB,CAC7B,MAAM,EAAE,MAAM,EACd,SAAS,CAAC,EAAE,MAAM,EAClB,YAAY,CAAC,EAAE;QACb,mBAAmB,CAAC,EAAE,MAAM,CAAC;QAC7B,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,WAAW,CAAC,EAAE,WAAW,CAAC;KAC3B,EACD,OAAO,CAAC,EAAE;QACR,mBAAmB,CAAC,EAAE,OAAO,CAAC;QAC9B,qBAAqB,CAAC,EAAE,IAAI,CAAC;KAC9B,GACA,OAAO,CAAC,UAAU,CAAC;IAItB;;;OAGG;YACW,mBAAmB;IAiKjC;;;;;;;;;;;;OAYG;IACU,kBAAkB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;IAkS1E;;;;;OAKG;IACU,kBAAkB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IA+CpE;;;;;;;;OAQG;IACU,0BAA0B,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAWtE;;;;;;;;;;;;;OAaG;IACU,iBAAiB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAWhE;;;;;;;;;;;;;;;OAeG;YACW,4BAA4B;IAkD1C;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,OAAO,CAAC,eAAe;CA0BxB"}
+{"version":3,"file":"auth-token-issuer.backend.service.d.ts","sourceRoot":"","sources":["../../../../../src/security/authentications/services/auth-token-issuer.backend.service.ts"],"names":[],"mappings":"AAAA,OAAO,kBAAkB,CAAC;AAI1B,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAC7F,OAAO,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AAC/G,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAC9G,OAAO,EAAE,YAAY,EAAE,MAAM,qDAAqD,CAAC;AACnF,OAAO,EAAE,iBAAiB,EAAE,MAAM,8DAA8D,CAAC;AACjG,OAAO,EAAE,uBAAuB,EAAE,MAAM,gFAAgF,CAAC;AAEzH,OAAO,KAAK,EAAE,qCAAqC,EAAE,MAAM,6FAA6F,CAAC;AACzJ,OAAO,EAAE,yCAAyC,EAAE,MAAM,qGAAqG,CAAC;AAChK,OAAO,EAAE,qBAAqB,EAAkC,WAAW,EAAwE,MAAM,uBAAuB,CAAC;AAejL,OAAO,EAEL,KAAK,mCAAmC,EAEzC,MAAM,gFAAgF,CAAC;AASxF;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,uBAAuB;IACtC,kEAAkE;IAClE,MAAM,EAAE,MAAM,CAAC;IACf,qEAAqE;IACrE,SAAS,EAAE,MAAM,CAAC;IAClB,2EAA2E;IAC3E,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,iGAAiG;IACjG,aAAa,EAAE,OAAO,CAAC;CACxB;AAUD;;;GAGG;AACH,wBAAgB,0BAA0B,CAAC,CAAC,SAAS,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,uBAAuB,GAAG,CAAC,CAQzG;AAED;;;;GAIG;AACH,wBAAgB,8BAA8B,CAAC,KAAK,EAAE,OAAO,GAAG,uBAAuB,GAAG,IAAI,CAK7F;AAED;;;;;;;;;;;GAWG;AACH,qBACa,6BAA6B;IAIH,OAAO,CAAC,QAAQ,CAAC,MAAM;IACb,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IAChC,OAAO,CAAC,QAAQ,CAAC,UAAU;IACzB,OAAO,CAAC,QAAQ,CAAC,YAAY;IACpC,OAAO,CAAC,QAAQ,CAAC,YAAY;IACX,OAAO,CAAC,QAAQ,CAAC,uBAAuB;IAC3C,OAAO,CAAC,QAAQ,CAAC,aAAa;IAQtF,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IASjC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC;IA1BlC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA+D;gBAGlC,MAAM,EAAE,aAAa,EACX,gBAAgB,EAAE,uBAAuB,EACxC,UAAU,EAAE,iBAAiB,EAC3B,YAAY,EAAE,0BAA0B,EAC/C,YAAY,EAAE,YAAY,EACR,uBAAuB,EAAE,qCAAqC,EACjE,aAAa,EAAE,yCAAyC,EAQhH,gBAAgB,GAAE,uBAAuB,GAAG,IAAW,EASvD,cAAc,CAAC,EAAE,mCAAmC;IAMvE;;OAEG;IACU,WAAW,CACtB,OAAO,EAAE,qBAAqB,EAC9B,OAAO,GAAE;QAAE,mBAAmB,CAAC,EAAE,OAAO,CAAC;QAAC,mBAAmB,CAAC,EAAE,MAAM,CAAC;QAAC,cAAc,CAAC,EAAE,MAAM,CAAA;KAAO,GACrG,OAAO,CAAC,UAAU,CAAC;IAgBtB;;;;OAIG;IACU,kBAAkB,CAC7B,MAAM,EAAE,MAAM,EACd,SAAS,CAAC,EAAE,MAAM,EAClB,YAAY,CAAC,EAAE;QACb,mBAAmB,CAAC,EAAE,MAAM,CAAC;QAC7B,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,WAAW,CAAC,EAAE,WAAW,CAAC;KAC3B,EACD,OAAO,CAAC,EAAE;QACR,mBAAmB,CAAC,EAAE,OAAO,CAAC;QAC9B,qBAAqB,CAAC,EAAE,IAAI,CAAC;KAC9B,GACA,OAAO,CAAC,UAAU,CAAC;IAItB;;;OAGG;YACW,mBAAmB;IAiKjC;;;;;;;;;;;;OAYG;IACU,kBAAkB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;IAkS1E;;;;;OAKG;IACU,kBAAkB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IA+CpE;;;;;;;;OAQG;IACU,0BAA0B,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAWtE;;;;;;;;;;;;;OAaG;IACU,iBAAiB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAWhE;;;;;;;;;;;;;;;OAeG;YACW,4BAA4B;IAkD1C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAkCG;IACH,OAAO,CAAC,eAAe;CAyCxB"}

package/dist/esm/security/authentications/services/auth-token-issuer.backend.service.js

@@ -28,6 +28,7 @@ import { AUTH_REDIS_KEYS, RefreshTokenBlacklistReason, REFRESH_TOKEN_ROTATION_GR
 import { buildSessionOrderingScore, CONCURRENT_SESSION_EVICTION_LUA, readIssuedAtMilliseconds, resolveEvictedJtiBlacklistSeconds, } from '../../../security/authentications/services/utils/concurrent-session-eviction.backend.utils.js';
 import { evaluateUserTokenInvalidationFence } from '../../../security/token-invalidation-fence.backend.utils.js';
 import { evaluateSessionInvalidationFence } from '../../../security/session-invalidation-fence.backend.utils.js';
+import { AuditObservationKind, emitAuditObservation, } from '../../../monitoring/observability/audit-observation-emission.backend.js';
 import { getUserAuthorizationVersion, } from '../../../security/authentications/models/user-authorization-version.backend.utils.js';
 /** L3: Default max concurrent refresh tokens per user. */
 const DEFAULT_MAX_CONCURRENT_SESSIONS = 10;
@@ -83,8 +84,9 @@ let AuthTokenIssuerBackendService = class AuthTokenIssuerBackendService {
     servicesRegistryHandler;
     authEcFactory;
     auditLogsService;
+    metricsService;
     logDebug;
-    constructor(logger, appConfigService, jwtService, errorBuilder, redisService, servicesRegistryHandler, authEcFactory, auditLogsService = null) {
+    constructor(logger, appConfigService, jwtService, errorBuilder, redisService, servicesRegistryHandler, authEcFactory, auditLogsService = null, metricsService) {
         this.logger = logger;
         this.appConfigService = appConfigService;
         this.jwtService = jwtService;
@@ -93,6 +95,7 @@ let AuthTokenIssuerBackendService = class AuthTokenIssuerBackendService {
         this.servicesRegistryHandler = servicesRegistryHandler;
         this.authEcFactory = authEcFactory;
         this.auditLogsService = auditLogsService;
+        this.metricsService = metricsService;
         this.logDebug = this.logger.debugByType('AuthTokenIssuer');
         this.logger.setDebugTypeLogging('AuthTokenIssuer', false);
     }
@@ -604,30 +607,57 @@ let AuthTokenIssuerBackendService = class AuthTokenIssuerBackendService {
      * adding a `log*` method breaks partially-mocked doubles, the property is absent, and the CALL
      * throws synchronously before any `.catch()` can make it fire-and-forget.
      *
+     * ## Why the detection decides an ARGUMENT rather than an early return
+     *
+     * Every emission goes through {@link emitAuditObservation}, which counts a lost one on
+     * `audit_observation_dropped_total`. Handing the seam `undefined` is how this site reports
+     * `SERVICE_UNAVAILABLE` — the loss shape that reaches no `_createAuditLog` and therefore used to
+     * leave nothing behind at all. Returning early on an absent method would restore that silence,
+     * which matters here more than it looks: an unbound audit service makes the eviction trail
+     * PERMANENTLY empty, and an empty eviction trail reads as "the cap never fired".
+     *
+     * The count is per RETIRED CHAIN, not per enforcement — one lost row is one lost row, and a cap
+     * that evicts four chains while the sink is down has lost four pieces of evidence. The
+     * `!evictedJti` skip stays ABOVE the emission for the opposite reason: a pair with no jti is
+     * nothing owed, and counting a deliberate skip would fire the loss signal on correct behaviour.
+     *
      * assurance-control: WILDO.IDENTITY.SESSION_CONCURRENCY_LIMIT — the bound's enforcement is
      * evidenced, naming WHICH chain was retired and when it was issued.
      */
     recordEvictions(input) {
-        const auditLogsService = this.auditLogsService;
-        if (typeof auditLogsService?.logUserSessionEvicted !== 'function')
-            return;
+        // Narrowed to a VALUE rather than to a boolean flag: the emitting closure is created inside the
+        // loop, and a captured `const` that is already non-nullish needs no narrowing to survive into it.
+        const emitter = typeof this.auditLogsService?.logUserSessionEvicted === 'function'
+            ? this.auditLogsService
+            : undefined;
         for (let index = 0; index < input.evictedPairs.length; index += 2) {
             const evictedJti = input.evictedPairs[index];
+            // Nothing was owed for this pair — a deliberate skip, kept above the emission so it can never
+            // be counted as a loss.
             if (!evictedJti)
                 continue;
             const issuedAtMilliseconds = readIssuedAtMilliseconds(input.evictedPairs[index + 1]);
-            try {
-                void auditLogsService.logUserSessionEvicted({
-                    userId: input.userId,
-                    evictedJti,
-                    ...(issuedAtMilliseconds === undefined ? {} : { evictedIssuedAt: new Date(issuedAtMilliseconds) }),
-                    configuredMaximum: input.maxSessions,
-                    retainedCount: input.maxSessions,
-                }).catch(() => undefined);
-            }
-            catch {
-                /* An observer must never fail the issuance it observes. */
-            }
+            emitAuditObservation({
+                observation: AuditObservationKind.USER_SESSION_EVICTED,
+                emit: emitter
+                    ? () => emitter.logUserSessionEvicted({
+                        userId: input.userId,
+                        evictedJti,
+                        ...(issuedAtMilliseconds === undefined ? {} : { evictedIssuedAt: new Date(issuedAtMilliseconds) }),
+                        configuredMaximum: input.maxSessions,
+                        retainedCount: input.maxSessions,
+                    })
+                    : undefined,
+                metricsService: this.metricsService,
+                logger: this.logger,
+                // Enough to reconstruct the lost row from the application log: WHOSE session, WHICH chain,
+                // and under what bound. The jti is the identity the audit row itself would have carried.
+                context: {
+                    observedUserId: input.userId,
+                    observedEvictedJti: evictedJti,
+                    observedConfiguredMaximum: input.maxSessions,
+                },
+            });
         }
     }
 };
@@ -642,12 +672,14 @@ AuthTokenIssuerBackendService = __decorate([
     __param(6, inject(SAAS_SERVICE_TYPES.AuthExecutionContextFactory)),
     __param(7, inject(SAAS_SERVICE_TYPES.AuditLogsService)),
     __param(7, optional()),
+    __param(8, inject(SAAS_SERVICE_TYPES.MetricsService)),
+    __param(8, optional()),
     __metadata("design:paramtypes", [LoggerService,
         AppConfigurationService,
         JwtBackendService,
         ErrorBuilderBackendService,
         RedisService, Function, AuthExecutionContextFactoryBackendService,
-        AuditLogsBackendService])
+        AuditLogsBackendService, Object])
 ], AuthTokenIssuerBackendService);
 export { AuthTokenIssuerBackendService };
 //# sourceMappingURL=auth-token-issuer.backend.service.js.map