@wildo-ai/saas-backend-lib 1.1.3 → 1.1.4

package/dist/esm/security/authentications/services/admin-config/oidc-discovery.backend.service.js.map

@@ -1 +1 @@
-{"version":3,"file":"oidc-discovery.backend.service.js","sourceRoot":"","sources":["../../../../../../../src/security/authentications/services/admin-config/oidc-discovery.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;;;;;;;;;;;;;AAEH,OAAO,kBAAkB,CAAC;AAC1B,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAC/C,OAAO,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AACpF,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAC7F,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAC9G,OAAO,EAAE,mBAAmB,EAAE,MAAM,8EAA8E,CAAC;AACnH,OAAO,EAAE,YAAY,EAAE,MAAM,qDAAqD,CAAC;AACnF,OAAO,EACL,SAAS,EACT,2BAA2B,EAC3B,mBAAmB,GACpB,MAAM,uBAAuB,CAAC;AAkB/B,qCAAqC;AACrC,MAAM,2BAA2B,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;AAEjD,gDAAgD;AAChD,MAAM,sBAAsB,GAAG,iBAAiB,CAAC;AAG1C,IAAM,2BAA2B,GAAjC,MAAM,2BAA2B;IAIgB;IACa;IACP;IAL3C,QAAQ,CAA+D;IAExF,YACsD,MAAqB,EACR,YAAwC,EAC/C,KAAmB;QAFzB,WAAM,GAAN,MAAM,CAAe;QACR,iBAAY,GAAZ,YAAY,CAA4B;QAC/C,UAAK,GAAL,KAAK,CAAc;QAE7E,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,eAAe,CAAC,CAAC;QACzD,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,eAAe,EAAE,KAAK,CAAC,CAAC;IAC1D,CAAC;IAED,kEAAkE;IAClE,iBAAiB;IACjB,kEAAkE;IAElE;;;;;;OAMG;IACI,KAAK,CAAC,iBAAiB,CAAC,SAAiB;QAC9C,MAAM,gBAAgB,GAAG,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAEvD,uFAAuF;QACvF,wFAAwF;QACxF,IAAI,CAAC,gBAAgB,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,gBAAgB,CAAC,UAAU,CAAC,kBAAkB,CAAC,EAAE,CAAC;YACjG,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;gBACrE,sBAAsB,EAAE,2BAA2B,CAAC,iCAAiC;gBACrF,OAAO,EAAE,EAAE,OAAO,EAAE,wCAAwC,gBAAgB,GAAG,EAAE;aAClF,CAAC,CAAC;QACL,CAAC;QAED,MAAM,QAAQ,GAAG,GAAG,sBAAsB,GAAG,gBAAgB,EAAE,CAAC;QAEhE,oBAAoB;QACpB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAwB,QAAQ,CAAC,CAAC;QACrE,IAAI,MAAM,EAAE,CAAC;YACX,IAAI,CAAC,QAAQ,CAAC,0BAA0B,EAAE,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC,CAAC;YACxE,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,kCAAkC;QAClC,MAAM,YAAY,GAAG,GAAG,gBAAgB,mCAAmC,CAAC;QAC5E,IAAI,CAAC,QAAQ,CAAC,kCAAkC,EAAE,EAAE,YAAY,EAAE,CAAC,CAAC;QAEpE,IAAI,QAAkB,CAAC;QACvB,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,KAAK,CAAC,YAAY,EAAE;gBACnC,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;gBACvC,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;aACpC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,mBAAmB,CAAC,KAAK,CAAC;gBAAE,MAAM,KAAK,CAAC;YAC5C,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;gBACrE,sBAAsB,EAAE,2BAA2B,CAAC,iCAAiC;gBACrF,OAAO,EAAE,EAAE,OAAO,EAAE,mCAAmC,YAAY,KAAK,mBAAmB,CAAC,KAAK,CAAC,EAAE,EAAE;aACvG,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;gBACrE,sBAAsB,EAAE,2BAA2B,CAAC,iCAAiC;gBACrF,OAAO,EAAE,EAAE,OAAO,EAAE,gCAAgC,QAAQ,CAAC,MAAM,QAAQ,YAAY,EAAE,EAAE;aAC5F,CAAC,CAAC;QACL,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI,EAA6B,CAAC;QAEhE,2BAA2B;QAC3B,MAAM,GAAG,GAAG,IAAI,CAAC,yBAAyB,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;QAErE,8BAA8B;QAC9B,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,GAAG,EAAE,2BAA2B,EAAE,CAAC,CAAC;YAC1E,IAAI,CAAC,QAAQ,CAAC,uBAAuB,EAAE,EAAE,MAAM,EAAE,gBAAgB,EAAE,GAAG,EAAE,2BAA2B,EAAE,CAAC,CAAC;QACzG,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC,QAAQ,CAAC,4CAA4C,EAAE,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC,CAAC;QAC5F,CAAC;QAED,OAAO,GAAG,CAAC;IACb,CAAC;IAED;;;OAGG;IACI,KAAK,CAAC,eAAe,CAAC,SAAiB;QAC5C,MAAM,gBAAgB,GAAG,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACvD,MAAM,QAAQ,GAAG,GAAG,sBAAsB,GAAG,gBAAgB,EAAE,CAAC;QAChE,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC/B,IAAI,CAAC,QAAQ,CAAC,kCAAkC,EAAE,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC,CAAC;IAClF,CAAC;IAED,kEAAkE;IAClE,+BAA+B;IAC/B,kEAAkE;IAElE;;;;;;;;OAQG;IACI,kBAAkB,CAAC,WAAmB,EAAE,iBAAyC;QACtF,IAAI,QAAQ,GAAG,WAAW,CAAC;QAC3B,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,iBAAiB,CAAC,EAAE,CAAC;YAC7D,QAAQ,GAAG,QAAQ,CAAC,UAAU,CAAC,IAAI,GAAG,GAAG,EAAE,KAAK,CAAC,CAAC;QACpD,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED;;;OAGG;IACI,qBAAqB,CAC1B,MAA8B,EAC9B,iBAAyC;QAEzC,MAAM,QAAQ,GAA2B,EAAE,CAAC;QAC5C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YAClD,QAAQ,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,kBAAkB,CAAC,KAAK,EAAE,iBAAiB,CAAC,CAAC;QACpE,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,kEAAkE;IAClE,sBAAsB;IACtB,kEAAkE;IAE1D,yBAAyB,CAC/B,GAA4B,EAC5B,SAAiB;QAEjB,MAAM,qBAAqB,GAAG,GAAG,CAAC,sBAAsB,CAAC;QACzD,MAAM,aAAa,GAAG,GAAG,CAAC,cAAc,CAAC;QACzC,MAAM,OAAO,GAAG,GAAG,CAAC,QAAQ,CAAC;QAE7B,IAAI,OAAO,qBAAqB,KAAK,QAAQ,IAAI,CAAC,qBAAqB,EAAE,CAAC;YACxE,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;gBACrE,sBAAsB,EAAE,2BAA2B,CAAC,iCAAiC;gBACrF,OAAO,EAAE,EAAE,OAAO,EAAE,sBAAsB,SAAS,kCAAkC,EAAE;aACxF,CAAC,CAAC;QACL,CAAC;QAED,IAAI,OAAO,aAAa,KAAK,QAAQ,IAAI,CAAC,aAAa,EAAE,CAAC;YACxD,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;gBACrE,sBAAsB,EAAE,2BAA2B,CAAC,iCAAiC;gBACrF,OAAO,EAAE,EAAE,OAAO,EAAE,sBAAsB,SAAS,0BAA0B,EAAE;aAChF,CAAC,CAAC;QACL,CAAC;QAED,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,CAAC,OAAO,EAAE,CAAC;YAC5C,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;gBACrE,sBAAsB,EAAE,2BAA2B,CAAC,iCAAiC;gBACrF,OAAO,EAAE,EAAE,OAAO,EAAE,sBAAsB,SAAS,oBAAoB,EAAE;aAC1E,CAAC,CAAC;QACL,CAAC;QAED,wFAAwF;QACxF,KAAK,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,cAAc,EAAE,aAAa,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;YAC/I,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,kBAAkB,CAAC,EAAE,CAAC;gBACvE,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;oBACrE,sBAAsB,EAAE,2BAA2B,CAAC,iCAAiC;oBACrF,OAAO,EAAE,EAAE,OAAO,EAAE,sBAAsB,SAAS,KAAK,KAAK,yBAAyB,GAAG,GAAG,EAAE;iBAC/F,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,uEAAuE;QACvE,kFAAkF;QAClF,yFAAyF;QACzF,MAAM,cAAc,GAAG,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5F,MAAM,kBAAkB,GAAG,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACzD,IAAI,CAAC,cAAc,IAAI,cAAc,KAAK,kBAAkB,EAAE,CAAC;YAC7D,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;gBACrE,sBAAsB,EAAE,2BAA2B,CAAC,iCAAiC;gBACrF,OAAO,EAAE,EAAE,OAAO,EAAE,mCAAmC,kBAAkB,WAAW,cAAc,IAAI,WAAW,GAAG,EAAE;aACvH,CAAC,CAAC;QACL,CAAC;QAED,OAAO;YACL,MAAM,EAAE,cAAc;YACtB,sBAAsB,EAAE,qBAAqB;YAC7C,cAAc,EAAE,aAAa;YAC7B,iBAAiB,EAAE,OAAO,GAAG,CAAC,iBAAiB,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,SAAS;YAChG,QAAQ,EAAE,OAAO;YACjB,oBAAoB,EAAE,OAAO,GAAG,CAAC,oBAAoB,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC,CAAC,SAAS;YACzG,gBAAgB,EAAE,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,gBAAgB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS;YACpG,wBAAwB,EAAE,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,wBAAwB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS;YAC5H,qBAAqB,EAAE,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,qBAAqB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS;YACnH,qCAAqC,EAAE,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,qCAAqC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,qCAAqC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS;YACnK,uBAAuB,EAAE,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,uBAAuB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS;YACzH,qCAAqC,EAAE,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,qCAAqC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,qCAAqC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS;SACpK,CAAC;IACJ,CAAC;CACF,CAAA;AA1MY,2BAA2B;IADvC,UAAU,EAAE;IAKR,WAAA,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAA;IACjC,WAAA,MAAM,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,CAAA;IAC9C,WAAA,MAAM,CAAC,kBAAkB,CAAC,YAAY,CAAC,CAAA;qCAFoB,aAAa;QACM,0BAA0B;QACxC,YAAY;GANpE,2BAA2B,CA0MvC","sourcesContent":["/**\n * OIDCDiscoveryBackendService\n *\n * Fetches and caches OIDC discovery documents (.well-known/openid-configuration).\n * Also handles template variable resolution for enterprise OIDC connections\n * (e.g., Microsoft {tenant} substitution in URLs).\n *\n * Step 13: Enterprise SSO — OIDC Discovery Service\n * DI Symbol: OIDCDiscoveryService\n * Used by: Step 15 enterprise resolver (resolveEnterpriseConnection)\n */\n\nimport 'reflect-metadata';\nimport { injectable, inject } from 'inversify';\nimport { SAAS_SERVICE_TYPES } from '~wildo-backend-lib/inject/models/service-types';\nimport { LoggerService } from '~wildo-backend-lib/monitoring/logger/services/logger.service';\nimport { ErrorBuilderBackendService } from '~wildo-backend-lib/errors/services/error-builder.backend.service';\nimport { describeCaughtError } from '~wildo-backend-lib/errors/utils/error-log-level-classification.backend.utils';\nimport { RedisService } from '~wildo-backend-lib/databases/services/redis.service';\nimport {\n  ErrorType,\n  ErrorCustomMessageReference,\n  isWildoBackendError,\n} from '@wildo-ai/saas-models';\n\n/** Parsed OIDC discovery document — standard fields from RFC 8414 / OpenID Connect Discovery 1.0 */\nexport interface OIDCDiscoveryDocument {\n  issuer: string;\n  authorization_endpoint: string;\n  token_endpoint: string;\n  userinfo_endpoint?: string;\n  jwks_uri: string;\n  end_session_endpoint?: string;\n  scopes_supported?: string[];\n  response_types_supported?: string[];\n  grant_types_supported?: string[];\n  token_endpoint_auth_methods_supported?: string[];\n  subject_types_supported?: string[];\n  id_token_signing_alg_values_supported?: string[];\n}\n\n/** Cache TTL: 24 hours in seconds */\nconst DISCOVERY_CACHE_TTL_SECONDS = 24 * 60 * 60;\n\n/** Redis key prefix for OIDC discovery cache */\nconst DISCOVERY_CACHE_PREFIX = 'oidc:discovery:';\n\n@injectable()\nexport class OIDCDiscoveryBackendService {\n  private readonly logDebug: (message: string, context?: Record<string, unknown>) => void;\n\n  constructor(\n    @inject(SAAS_SERVICE_TYPES.Logger) private readonly logger: LoggerService,\n    @inject(SAAS_SERVICE_TYPES.ErrorBuilderService) private readonly errorBuilder: ErrorBuilderBackendService,\n    @inject(SAAS_SERVICE_TYPES.RedisService) private readonly redis: RedisService,\n  ) {\n    this.logDebug = this.logger.debugByType('OIDCDiscovery');\n    this.logger.setDebugTypeLogging('OIDCDiscovery', false);\n  }\n\n  // ═══════════════════════════════════════════════════════════════\n  // OIDC Discovery\n  // ═══════════════════════════════════════════════════════════════\n\n  /**\n   * Discover OIDC endpoints from an issuer's .well-known/openid-configuration.\n   * Results are cached in Redis for 24 hours to avoid repeated HTTP calls.\n   *\n   * @param issuerUrl - The OIDC issuer URL (e.g., https://accounts.google.com)\n   * @returns Parsed OIDC discovery document\n   */\n  public async discoverEndpoints(issuerUrl: string): Promise<OIDCDiscoveryDocument> {\n    const normalizedIssuer = issuerUrl.replace(/\\/+$/, '');\n\n    // M4 fix: Enforce HTTPS on issuer URL itself (not just endpoints inside the document).\n    // An http:// issuer allows MITM of the discovery fetch. Allow http://localhost for dev.\n    if (!normalizedIssuer.startsWith('https://') && !normalizedIssuer.startsWith('http://localhost')) {\n      throw this.errorBuilder.buildError(ErrorType.CONFIGURATION, undefined, {\n        customMessageReference: ErrorCustomMessageReference.APP_CONFIGURATION_NOT_INITIALIZED,\n        context: { message: `OIDC issuer URL must use HTTPS (got: ${normalizedIssuer})` },\n      });\n    }\n\n    const cacheKey = `${DISCOVERY_CACHE_PREFIX}${normalizedIssuer}`;\n\n    // Check cache first\n    const cached = await this.redis.get<OIDCDiscoveryDocument>(cacheKey);\n    if (cached) {\n      this.logDebug('OIDC discovery cache hit', { issuer: normalizedIssuer });\n      return cached;\n    }\n\n    // Fetch from .well-known endpoint\n    const discoveryUrl = `${normalizedIssuer}/.well-known/openid-configuration`;\n    this.logDebug('Fetching OIDC discovery document', { discoveryUrl });\n\n    let response: Response;\n    try {\n      response = await fetch(discoveryUrl, {\n        headers: { Accept: 'application/json' },\n        signal: AbortSignal.timeout(10_000),\n      });\n    } catch (error) {\n      if (isWildoBackendError(error)) throw error;\n      throw this.errorBuilder.buildError(ErrorType.CONFIGURATION, undefined, {\n        customMessageReference: ErrorCustomMessageReference.APP_CONFIGURATION_NOT_INITIALIZED,\n        context: { message: `OIDC discovery fetch failed for ${discoveryUrl}: ${describeCaughtError(error)}` },\n      });\n    }\n\n    if (!response.ok) {\n      throw this.errorBuilder.buildError(ErrorType.CONFIGURATION, undefined, {\n        customMessageReference: ErrorCustomMessageReference.APP_CONFIGURATION_NOT_INITIALIZED,\n        context: { message: `OIDC discovery returned HTTP ${response.status} for ${discoveryUrl}` },\n      });\n    }\n\n    const rawDoc = await response.json() as Record<string, unknown>;\n\n    // Validate required fields\n    const doc = this.validateDiscoveryDocument(rawDoc, normalizedIssuer);\n\n    // Cache in Redis with 24h TTL\n    try {\n      await this.redis.set(cacheKey, doc, { ttl: DISCOVERY_CACHE_TTL_SECONDS });\n      this.logDebug('OIDC discovery cached', { issuer: normalizedIssuer, ttl: DISCOVERY_CACHE_TTL_SECONDS });\n    } catch {\n      this.logDebug('Failed to cache OIDC discovery (non-fatal)', { issuer: normalizedIssuer });\n    }\n\n    return doc;\n  }\n\n  /**\n   * Invalidate the cached discovery document for an issuer.\n   * Useful when an admin updates their IdP configuration.\n   */\n  public async invalidateCache(issuerUrl: string): Promise<void> {\n    const normalizedIssuer = issuerUrl.replace(/\\/+$/, '');\n    const cacheKey = `${DISCOVERY_CACHE_PREFIX}${normalizedIssuer}`;\n    await this.redis.del(cacheKey);\n    this.logDebug('OIDC discovery cache invalidated', { issuer: normalizedIssuer });\n  }\n\n  // ═══════════════════════════════════════════════════════════════\n  // Template Variable Resolution\n  // ═══════════════════════════════════════════════════════════════\n\n  /**\n   * Apply template variable substitution to a URL.\n   * Replaces `{variableName}` placeholders with values from the overrides map.\n   *\n   * Example: Microsoft's authorization URL\n   *   https://login.microsoftonline.com/{tenant}/oauth2/v2.0/authorize\n   *   + templateOverrides: { tenant: 'acme-corp-tenant-id' }\n   *   = https://login.microsoftonline.com/acme-corp-tenant-id/oauth2/v2.0/authorize\n   */\n  public resolveTemplateUrl(urlTemplate: string, templateOverrides: Record<string, string>): string {\n    let resolved = urlTemplate;\n    for (const [key, value] of Object.entries(templateOverrides)) {\n      resolved = resolved.replaceAll(`{${key}}`, value);\n    }\n    return resolved;\n  }\n\n  /**\n   * Apply template variable substitution to all extra auth params.\n   * Used to substitute values like `hd={domain}` for Google domain hint.\n   */\n  public resolveTemplateParams(\n    params: Record<string, string>,\n    templateOverrides: Record<string, string>,\n  ): Record<string, string> {\n    const resolved: Record<string, string> = {};\n    for (const [key, value] of Object.entries(params)) {\n      resolved[key] = this.resolveTemplateUrl(value, templateOverrides);\n    }\n    return resolved;\n  }\n\n  // ═══════════════════════════════════════════════════════════════\n  // Private: Validation\n  // ═══════════════════════════════════════════════════════════════\n\n  private validateDiscoveryDocument(\n    raw: Record<string, unknown>,\n    issuerUrl: string,\n  ): OIDCDiscoveryDocument {\n    const authorizationEndpoint = raw.authorization_endpoint;\n    const tokenEndpoint = raw.token_endpoint;\n    const jwksUri = raw.jwks_uri;\n\n    if (typeof authorizationEndpoint !== 'string' || !authorizationEndpoint) {\n      throw this.errorBuilder.buildError(ErrorType.CONFIGURATION, undefined, {\n        customMessageReference: ErrorCustomMessageReference.APP_CONFIGURATION_NOT_INITIALIZED,\n        context: { message: `OIDC discovery for ${issuerUrl}: missing authorization_endpoint` },\n      });\n    }\n\n    if (typeof tokenEndpoint !== 'string' || !tokenEndpoint) {\n      throw this.errorBuilder.buildError(ErrorType.CONFIGURATION, undefined, {\n        customMessageReference: ErrorCustomMessageReference.APP_CONFIGURATION_NOT_INITIALIZED,\n        context: { message: `OIDC discovery for ${issuerUrl}: missing token_endpoint` },\n      });\n    }\n\n    if (typeof jwksUri !== 'string' || !jwksUri) {\n      throw this.errorBuilder.buildError(ErrorType.CONFIGURATION, undefined, {\n        customMessageReference: ErrorCustomMessageReference.APP_CONFIGURATION_NOT_INITIALIZED,\n        context: { message: `OIDC discovery for ${issuerUrl}: missing jwks_uri` },\n      });\n    }\n\n    // Validate HTTPS for security-critical endpoints (allow http only for localhost in dev)\n    for (const [field, url] of Object.entries({ authorization_endpoint: authorizationEndpoint, token_endpoint: tokenEndpoint, jwks_uri: jwksUri })) {\n      if (!url.startsWith('https://') && !url.startsWith('http://localhost')) {\n        throw this.errorBuilder.buildError(ErrorType.CONFIGURATION, undefined, {\n          customMessageReference: ErrorCustomMessageReference.APP_CONFIGURATION_NOT_INITIALIZED,\n          context: { message: `OIDC discovery for ${issuerUrl}: ${field} must use HTTPS (got: ${url})` },\n        });\n      }\n    }\n\n    // M5 fix: Validate issuer in discovery document matches the fetch URL.\n    // Per OpenID Connect Discovery 1.0 Section 3, the issuer value MUST exactly match\n    // the URL used to fetch the discovery document. Not validating enables issuer confusion.\n    const documentIssuer = typeof raw.issuer === 'string' ? raw.issuer.replace(/\\/+$/, '') : '';\n    const normalizedExpected = issuerUrl.replace(/\\/+$/, '');\n    if (!documentIssuer || documentIssuer !== normalizedExpected) {\n      throw this.errorBuilder.buildError(ErrorType.CONFIGURATION, undefined, {\n        customMessageReference: ErrorCustomMessageReference.APP_CONFIGURATION_NOT_INITIALIZED,\n        context: { message: `OIDC issuer mismatch: expected '${normalizedExpected}', got '${documentIssuer || '(missing)'}'` },\n      });\n    }\n\n    return {\n      issuer: documentIssuer,\n      authorization_endpoint: authorizationEndpoint,\n      token_endpoint: tokenEndpoint,\n      userinfo_endpoint: typeof raw.userinfo_endpoint === 'string' ? raw.userinfo_endpoint : undefined,\n      jwks_uri: jwksUri,\n      end_session_endpoint: typeof raw.end_session_endpoint === 'string' ? raw.end_session_endpoint : undefined,\n      scopes_supported: Array.isArray(raw.scopes_supported) ? raw.scopes_supported.map(String) : undefined,\n      response_types_supported: Array.isArray(raw.response_types_supported) ? raw.response_types_supported.map(String) : undefined,\n      grant_types_supported: Array.isArray(raw.grant_types_supported) ? raw.grant_types_supported.map(String) : undefined,\n      token_endpoint_auth_methods_supported: Array.isArray(raw.token_endpoint_auth_methods_supported) ? raw.token_endpoint_auth_methods_supported.map(String) : undefined,\n      subject_types_supported: Array.isArray(raw.subject_types_supported) ? raw.subject_types_supported.map(String) : undefined,\n      id_token_signing_alg_values_supported: Array.isArray(raw.id_token_signing_alg_values_supported) ? raw.id_token_signing_alg_values_supported.map(String) : undefined,\n    };\n  }\n}\n"]}
+{"version":3,"file":"oidc-discovery.backend.service.js","sourceRoot":"","sources":["../../../../../../src/security/authentications/services/admin-config/oidc-discovery.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;;;;;;;;;;;;;AAEH,OAAO,kBAAkB,CAAC;AAC1B,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAC/C,OAAO,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AACpF,OAAO,EAAE,0CAA0C,EAAE,MAAM,iGAAiG,CAAC;AAC7J,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAC7F,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAC9G,OAAO,EAAE,mBAAmB,EAAE,MAAM,8EAA8E,CAAC;AACnH,OAAO,EAAE,YAAY,EAAE,MAAM,qDAAqD,CAAC;AACnF,OAAO,EACL,SAAS,EACT,2BAA2B,EAC3B,mBAAmB,GACpB,MAAM,uBAAuB,CAAC;AAkB/B,qCAAqC;AACrC,MAAM,2BAA2B,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;AAEjD,gDAAgD;AAChD,MAAM,sBAAsB,GAAG,iBAAiB,CAAC;AAG1C,IAAM,2BAA2B,GAAjC,MAAM,2BAA2B;IAIgB;IACa;IACP;IAL3C,QAAQ,CAA+D;IAExF,YACsD,MAAqB,EACR,YAAwC,EAC/C,KAAmB;QAFzB,WAAM,GAAN,MAAM,CAAe;QACR,iBAAY,GAAZ,YAAY,CAA4B;QAC/C,UAAK,GAAL,KAAK,CAAc;QAE7E,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,eAAe,CAAC,CAAC;QACzD,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,eAAe,EAAE,KAAK,CAAC,CAAC;IAC1D,CAAC;IAED,kEAAkE;IAClE,iBAAiB;IACjB,kEAAkE;IAElE;;;;;;OAMG;IACI,KAAK,CAAC,iBAAiB,CAAC,SAAiB;QAC9C,MAAM,gBAAgB,GAAG,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAEvD,uFAAuF;QACvF,wFAAwF;QACxF,IAAI,CAAC,gBAAgB,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,gBAAgB,CAAC,UAAU,CAAC,kBAAkB,CAAC,EAAE,CAAC;YACjG,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;gBACrE,sBAAsB,EAAE,2BAA2B,CAAC,iCAAiC;gBACrF,OAAO,EAAE,EAAE,OAAO,EAAE,wCAAwC,gBAAgB,GAAG,EAAE;aAClF,CAAC,CAAC;QACL,CAAC;QAED,MAAM,QAAQ,GAAG,GAAG,sBAAsB,GAAG,gBAAgB,EAAE,CAAC;QAEhE,oBAAoB;QACpB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAwB,QAAQ,CAAC,CAAC;QACrE,IAAI,MAAM,EAAE,CAAC;YACX,IAAI,CAAC,QAAQ,CAAC,0BAA0B,EAAE,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC,CAAC;YACxE,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,kCAAkC;QAClC,MAAM,YAAY,GAAG,GAAG,gBAAgB,mCAAmC,CAAC;QAC5E,IAAI,CAAC,QAAQ,CAAC,kCAAkC,EAAE,EAAE,YAAY,EAAE,CAAC,CAAC;QAEpE,IAAI,QAAkB,CAAC;QACvB,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,KAAK,CAAC,YAAY,EAAE;gBACnC,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;gBACvC,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,0CAA0C,CAAC;aACxE,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,mBAAmB,CAAC,KAAK,CAAC;gBAAE,MAAM,KAAK,CAAC;YAC5C,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;gBACrE,sBAAsB,EAAE,2BAA2B,CAAC,iCAAiC;gBACrF,OAAO,EAAE,EAAE,OAAO,EAAE,mCAAmC,YAAY,KAAK,mBAAmB,CAAC,KAAK,CAAC,EAAE,EAAE;aACvG,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;gBACrE,sBAAsB,EAAE,2BAA2B,CAAC,iCAAiC;gBACrF,OAAO,EAAE,EAAE,OAAO,EAAE,gCAAgC,QAAQ,CAAC,MAAM,QAAQ,YAAY,EAAE,EAAE;aAC5F,CAAC,CAAC;QACL,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI,EAA6B,CAAC;QAEhE,2BAA2B;QAC3B,MAAM,GAAG,GAAG,IAAI,CAAC,yBAAyB,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;QAErE,8BAA8B;QAC9B,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,GAAG,EAAE,2BAA2B,EAAE,CAAC,CAAC;YAC1E,IAAI,CAAC,QAAQ,CAAC,uBAAuB,EAAE,EAAE,MAAM,EAAE,gBAAgB,EAAE,GAAG,EAAE,2BAA2B,EAAE,CAAC,CAAC;QACzG,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC,QAAQ,CAAC,4CAA4C,EAAE,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC,CAAC;QAC5F,CAAC;QAED,OAAO,GAAG,CAAC;IACb,CAAC;IAED;;;OAGG;IACI,KAAK,CAAC,eAAe,CAAC,SAAiB;QAC5C,MAAM,gBAAgB,GAAG,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACvD,MAAM,QAAQ,GAAG,GAAG,sBAAsB,GAAG,gBAAgB,EAAE,CAAC;QAChE,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC/B,IAAI,CAAC,QAAQ,CAAC,kCAAkC,EAAE,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC,CAAC;IAClF,CAAC;IAED,kEAAkE;IAClE,+BAA+B;IAC/B,kEAAkE;IAElE;;;;;;;;OAQG;IACI,kBAAkB,CAAC,WAAmB,EAAE,iBAAyC;QACtF,IAAI,QAAQ,GAAG,WAAW,CAAC;QAC3B,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,iBAAiB,CAAC,EAAE,CAAC;YAC7D,QAAQ,GAAG,QAAQ,CAAC,UAAU,CAAC,IAAI,GAAG,GAAG,EAAE,KAAK,CAAC,CAAC;QACpD,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED;;;OAGG;IACI,qBAAqB,CAC1B,MAA8B,EAC9B,iBAAyC;QAEzC,MAAM,QAAQ,GAA2B,EAAE,CAAC;QAC5C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YAClD,QAAQ,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,kBAAkB,CAAC,KAAK,EAAE,iBAAiB,CAAC,CAAC;QACpE,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,kEAAkE;IAClE,sBAAsB;IACtB,kEAAkE;IAE1D,yBAAyB,CAC/B,GAA4B,EAC5B,SAAiB;QAEjB,MAAM,qBAAqB,GAAG,GAAG,CAAC,sBAAsB,CAAC;QACzD,MAAM,aAAa,GAAG,GAAG,CAAC,cAAc,CAAC;QACzC,MAAM,OAAO,GAAG,GAAG,CAAC,QAAQ,CAAC;QAE7B,IAAI,OAAO,qBAAqB,KAAK,QAAQ,IAAI,CAAC,qBAAqB,EAAE,CAAC;YACxE,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;gBACrE,sBAAsB,EAAE,2BAA2B,CAAC,iCAAiC;gBACrF,OAAO,EAAE,EAAE,OAAO,EAAE,sBAAsB,SAAS,kCAAkC,EAAE;aACxF,CAAC,CAAC;QACL,CAAC;QAED,IAAI,OAAO,aAAa,KAAK,QAAQ,IAAI,CAAC,aAAa,EAAE,CAAC;YACxD,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;gBACrE,sBAAsB,EAAE,2BAA2B,CAAC,iCAAiC;gBACrF,OAAO,EAAE,EAAE,OAAO,EAAE,sBAAsB,SAAS,0BAA0B,EAAE;aAChF,CAAC,CAAC;QACL,CAAC;QAED,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,CAAC,OAAO,EAAE,CAAC;YAC5C,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;gBACrE,sBAAsB,EAAE,2BAA2B,CAAC,iCAAiC;gBACrF,OAAO,EAAE,EAAE,OAAO,EAAE,sBAAsB,SAAS,oBAAoB,EAAE;aAC1E,CAAC,CAAC;QACL,CAAC;QAED,wFAAwF;QACxF,KAAK,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,cAAc,EAAE,aAAa,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;YAC/I,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,kBAAkB,CAAC,EAAE,CAAC;gBACvE,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;oBACrE,sBAAsB,EAAE,2BAA2B,CAAC,iCAAiC;oBACrF,OAAO,EAAE,EAAE,OAAO,EAAE,sBAAsB,SAAS,KAAK,KAAK,yBAAyB,GAAG,GAAG,EAAE;iBAC/F,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,uEAAuE;QACvE,kFAAkF;QAClF,yFAAyF;QACzF,MAAM,cAAc,GAAG,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5F,MAAM,kBAAkB,GAAG,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACzD,IAAI,CAAC,cAAc,IAAI,cAAc,KAAK,kBAAkB,EAAE,CAAC;YAC7D,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE;gBACrE,sBAAsB,EAAE,2BAA2B,CAAC,iCAAiC;gBACrF,OAAO,EAAE,EAAE,OAAO,EAAE,mCAAmC,kBAAkB,WAAW,cAAc,IAAI,WAAW,GAAG,EAAE;aACvH,CAAC,CAAC;QACL,CAAC;QAED,OAAO;YACL,MAAM,EAAE,cAAc;YACtB,sBAAsB,EAAE,qBAAqB;YAC7C,cAAc,EAAE,aAAa;YAC7B,iBAAiB,EAAE,OAAO,GAAG,CAAC,iBAAiB,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,SAAS;YAChG,QAAQ,EAAE,OAAO;YACjB,oBAAoB,EAAE,OAAO,GAAG,CAAC,oBAAoB,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC,CAAC,SAAS;YACzG,gBAAgB,EAAE,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,gBAAgB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS;YACpG,wBAAwB,EAAE,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,wBAAwB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS;YAC5H,qBAAqB,EAAE,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,qBAAqB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS;YACnH,qCAAqC,EAAE,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,qCAAqC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,qCAAqC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS;YACnK,uBAAuB,EAAE,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,uBAAuB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS;YACzH,qCAAqC,EAAE,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,qCAAqC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,qCAAqC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS;SACpK,CAAC;IACJ,CAAC;CACF,CAAA;AA1MY,2BAA2B;IADvC,UAAU,EAAE;IAKR,WAAA,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAA;IACjC,WAAA,MAAM,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,CAAA;IAC9C,WAAA,MAAM,CAAC,kBAAkB,CAAC,YAAY,CAAC,CAAA;qCAFoB,aAAa;QACM,0BAA0B;QACxC,YAAY;GANpE,2BAA2B,CA0MvC","sourcesContent":["/**\n * OIDCDiscoveryBackendService\n *\n * Fetches and caches OIDC discovery documents (.well-known/openid-configuration).\n * Also handles template variable resolution for enterprise OIDC connections\n * (e.g., Microsoft {tenant} substitution in URLs).\n *\n * Step 13: Enterprise SSO — OIDC Discovery Service\n * DI Symbol: OIDCDiscoveryService\n * Used by: Step 15 enterprise resolver (resolveEnterpriseConnection)\n */\n\nimport 'reflect-metadata';\nimport { injectable, inject } from 'inversify';\nimport { SAAS_SERVICE_TYPES } from '~wildo-backend-lib/inject/models/service-types';\nimport { FEDERATED_AUTH_PROVIDER_REQUEST_TIMEOUT_MS } from '~wildo-backend-lib/security/authentications/models/federated-auth-transport.backend.definitions';\nimport { LoggerService } from '~wildo-backend-lib/monitoring/logger/services/logger.service';\nimport { ErrorBuilderBackendService } from '~wildo-backend-lib/errors/services/error-builder.backend.service';\nimport { describeCaughtError } from '~wildo-backend-lib/errors/utils/error-log-level-classification.backend.utils';\nimport { RedisService } from '~wildo-backend-lib/databases/services/redis.service';\nimport {\n  ErrorType,\n  ErrorCustomMessageReference,\n  isWildoBackendError,\n} from '@wildo-ai/saas-models';\n\n/** Parsed OIDC discovery document — standard fields from RFC 8414 / OpenID Connect Discovery 1.0 */\nexport interface OIDCDiscoveryDocument {\n  issuer: string;\n  authorization_endpoint: string;\n  token_endpoint: string;\n  userinfo_endpoint?: string;\n  jwks_uri: string;\n  end_session_endpoint?: string;\n  scopes_supported?: string[];\n  response_types_supported?: string[];\n  grant_types_supported?: string[];\n  token_endpoint_auth_methods_supported?: string[];\n  subject_types_supported?: string[];\n  id_token_signing_alg_values_supported?: string[];\n}\n\n/** Cache TTL: 24 hours in seconds */\nconst DISCOVERY_CACHE_TTL_SECONDS = 24 * 60 * 60;\n\n/** Redis key prefix for OIDC discovery cache */\nconst DISCOVERY_CACHE_PREFIX = 'oidc:discovery:';\n\n@injectable()\nexport class OIDCDiscoveryBackendService {\n  private readonly logDebug: (message: string, context?: Record<string, unknown>) => void;\n\n  constructor(\n    @inject(SAAS_SERVICE_TYPES.Logger) private readonly logger: LoggerService,\n    @inject(SAAS_SERVICE_TYPES.ErrorBuilderService) private readonly errorBuilder: ErrorBuilderBackendService,\n    @inject(SAAS_SERVICE_TYPES.RedisService) private readonly redis: RedisService,\n  ) {\n    this.logDebug = this.logger.debugByType('OIDCDiscovery');\n    this.logger.setDebugTypeLogging('OIDCDiscovery', false);\n  }\n\n  // ═══════════════════════════════════════════════════════════════\n  // OIDC Discovery\n  // ═══════════════════════════════════════════════════════════════\n\n  /**\n   * Discover OIDC endpoints from an issuer's .well-known/openid-configuration.\n   * Results are cached in Redis for 24 hours to avoid repeated HTTP calls.\n   *\n   * @param issuerUrl - The OIDC issuer URL (e.g., https://accounts.google.com)\n   * @returns Parsed OIDC discovery document\n   */\n  public async discoverEndpoints(issuerUrl: string): Promise<OIDCDiscoveryDocument> {\n    const normalizedIssuer = issuerUrl.replace(/\\/+$/, '');\n\n    // M4 fix: Enforce HTTPS on issuer URL itself (not just endpoints inside the document).\n    // An http:// issuer allows MITM of the discovery fetch. Allow http://localhost for dev.\n    if (!normalizedIssuer.startsWith('https://') && !normalizedIssuer.startsWith('http://localhost')) {\n      throw this.errorBuilder.buildError(ErrorType.CONFIGURATION, undefined, {\n        customMessageReference: ErrorCustomMessageReference.APP_CONFIGURATION_NOT_INITIALIZED,\n        context: { message: `OIDC issuer URL must use HTTPS (got: ${normalizedIssuer})` },\n      });\n    }\n\n    const cacheKey = `${DISCOVERY_CACHE_PREFIX}${normalizedIssuer}`;\n\n    // Check cache first\n    const cached = await this.redis.get<OIDCDiscoveryDocument>(cacheKey);\n    if (cached) {\n      this.logDebug('OIDC discovery cache hit', { issuer: normalizedIssuer });\n      return cached;\n    }\n\n    // Fetch from .well-known endpoint\n    const discoveryUrl = `${normalizedIssuer}/.well-known/openid-configuration`;\n    this.logDebug('Fetching OIDC discovery document', { discoveryUrl });\n\n    let response: Response;\n    try {\n      response = await fetch(discoveryUrl, {\n        headers: { Accept: 'application/json' },\n        signal: AbortSignal.timeout(FEDERATED_AUTH_PROVIDER_REQUEST_TIMEOUT_MS),\n      });\n    } catch (error) {\n      if (isWildoBackendError(error)) throw error;\n      throw this.errorBuilder.buildError(ErrorType.CONFIGURATION, undefined, {\n        customMessageReference: ErrorCustomMessageReference.APP_CONFIGURATION_NOT_INITIALIZED,\n        context: { message: `OIDC discovery fetch failed for ${discoveryUrl}: ${describeCaughtError(error)}` },\n      });\n    }\n\n    if (!response.ok) {\n      throw this.errorBuilder.buildError(ErrorType.CONFIGURATION, undefined, {\n        customMessageReference: ErrorCustomMessageReference.APP_CONFIGURATION_NOT_INITIALIZED,\n        context: { message: `OIDC discovery returned HTTP ${response.status} for ${discoveryUrl}` },\n      });\n    }\n\n    const rawDoc = await response.json() as Record<string, unknown>;\n\n    // Validate required fields\n    const doc = this.validateDiscoveryDocument(rawDoc, normalizedIssuer);\n\n    // Cache in Redis with 24h TTL\n    try {\n      await this.redis.set(cacheKey, doc, { ttl: DISCOVERY_CACHE_TTL_SECONDS });\n      this.logDebug('OIDC discovery cached', { issuer: normalizedIssuer, ttl: DISCOVERY_CACHE_TTL_SECONDS });\n    } catch {\n      this.logDebug('Failed to cache OIDC discovery (non-fatal)', { issuer: normalizedIssuer });\n    }\n\n    return doc;\n  }\n\n  /**\n   * Invalidate the cached discovery document for an issuer.\n   * Useful when an admin updates their IdP configuration.\n   */\n  public async invalidateCache(issuerUrl: string): Promise<void> {\n    const normalizedIssuer = issuerUrl.replace(/\\/+$/, '');\n    const cacheKey = `${DISCOVERY_CACHE_PREFIX}${normalizedIssuer}`;\n    await this.redis.del(cacheKey);\n    this.logDebug('OIDC discovery cache invalidated', { issuer: normalizedIssuer });\n  }\n\n  // ═══════════════════════════════════════════════════════════════\n  // Template Variable Resolution\n  // ═══════════════════════════════════════════════════════════════\n\n  /**\n   * Apply template variable substitution to a URL.\n   * Replaces `{variableName}` placeholders with values from the overrides map.\n   *\n   * Example: Microsoft's authorization URL\n   *   https://login.microsoftonline.com/{tenant}/oauth2/v2.0/authorize\n   *   + templateOverrides: { tenant: 'acme-corp-tenant-id' }\n   *   = https://login.microsoftonline.com/acme-corp-tenant-id/oauth2/v2.0/authorize\n   */\n  public resolveTemplateUrl(urlTemplate: string, templateOverrides: Record<string, string>): string {\n    let resolved = urlTemplate;\n    for (const [key, value] of Object.entries(templateOverrides)) {\n      resolved = resolved.replaceAll(`{${key}}`, value);\n    }\n    return resolved;\n  }\n\n  /**\n   * Apply template variable substitution to all extra auth params.\n   * Used to substitute values like `hd={domain}` for Google domain hint.\n   */\n  public resolveTemplateParams(\n    params: Record<string, string>,\n    templateOverrides: Record<string, string>,\n  ): Record<string, string> {\n    const resolved: Record<string, string> = {};\n    for (const [key, value] of Object.entries(params)) {\n      resolved[key] = this.resolveTemplateUrl(value, templateOverrides);\n    }\n    return resolved;\n  }\n\n  // ═══════════════════════════════════════════════════════════════\n  // Private: Validation\n  // ═══════════════════════════════════════════════════════════════\n\n  private validateDiscoveryDocument(\n    raw: Record<string, unknown>,\n    issuerUrl: string,\n  ): OIDCDiscoveryDocument {\n    const authorizationEndpoint = raw.authorization_endpoint;\n    const tokenEndpoint = raw.token_endpoint;\n    const jwksUri = raw.jwks_uri;\n\n    if (typeof authorizationEndpoint !== 'string' || !authorizationEndpoint) {\n      throw this.errorBuilder.buildError(ErrorType.CONFIGURATION, undefined, {\n        customMessageReference: ErrorCustomMessageReference.APP_CONFIGURATION_NOT_INITIALIZED,\n        context: { message: `OIDC discovery for ${issuerUrl}: missing authorization_endpoint` },\n      });\n    }\n\n    if (typeof tokenEndpoint !== 'string' || !tokenEndpoint) {\n      throw this.errorBuilder.buildError(ErrorType.CONFIGURATION, undefined, {\n        customMessageReference: ErrorCustomMessageReference.APP_CONFIGURATION_NOT_INITIALIZED,\n        context: { message: `OIDC discovery for ${issuerUrl}: missing token_endpoint` },\n      });\n    }\n\n    if (typeof jwksUri !== 'string' || !jwksUri) {\n      throw this.errorBuilder.buildError(ErrorType.CONFIGURATION, undefined, {\n        customMessageReference: ErrorCustomMessageReference.APP_CONFIGURATION_NOT_INITIALIZED,\n        context: { message: `OIDC discovery for ${issuerUrl}: missing jwks_uri` },\n      });\n    }\n\n    // Validate HTTPS for security-critical endpoints (allow http only for localhost in dev)\n    for (const [field, url] of Object.entries({ authorization_endpoint: authorizationEndpoint, token_endpoint: tokenEndpoint, jwks_uri: jwksUri })) {\n      if (!url.startsWith('https://') && !url.startsWith('http://localhost')) {\n        throw this.errorBuilder.buildError(ErrorType.CONFIGURATION, undefined, {\n          customMessageReference: ErrorCustomMessageReference.APP_CONFIGURATION_NOT_INITIALIZED,\n          context: { message: `OIDC discovery for ${issuerUrl}: ${field} must use HTTPS (got: ${url})` },\n        });\n      }\n    }\n\n    // M5 fix: Validate issuer in discovery document matches the fetch URL.\n    // Per OpenID Connect Discovery 1.0 Section 3, the issuer value MUST exactly match\n    // the URL used to fetch the discovery document. Not validating enables issuer confusion.\n    const documentIssuer = typeof raw.issuer === 'string' ? raw.issuer.replace(/\\/+$/, '') : '';\n    const normalizedExpected = issuerUrl.replace(/\\/+$/, '');\n    if (!documentIssuer || documentIssuer !== normalizedExpected) {\n      throw this.errorBuilder.buildError(ErrorType.CONFIGURATION, undefined, {\n        customMessageReference: ErrorCustomMessageReference.APP_CONFIGURATION_NOT_INITIALIZED,\n        context: { message: `OIDC issuer mismatch: expected '${normalizedExpected}', got '${documentIssuer || '(missing)'}'` },\n      });\n    }\n\n    return {\n      issuer: documentIssuer,\n      authorization_endpoint: authorizationEndpoint,\n      token_endpoint: tokenEndpoint,\n      userinfo_endpoint: typeof raw.userinfo_endpoint === 'string' ? raw.userinfo_endpoint : undefined,\n      jwks_uri: jwksUri,\n      end_session_endpoint: typeof raw.end_session_endpoint === 'string' ? raw.end_session_endpoint : undefined,\n      scopes_supported: Array.isArray(raw.scopes_supported) ? raw.scopes_supported.map(String) : undefined,\n      response_types_supported: Array.isArray(raw.response_types_supported) ? raw.response_types_supported.map(String) : undefined,\n      grant_types_supported: Array.isArray(raw.grant_types_supported) ? raw.grant_types_supported.map(String) : undefined,\n      token_endpoint_auth_methods_supported: Array.isArray(raw.token_endpoint_auth_methods_supported) ? raw.token_endpoint_auth_methods_supported.map(String) : undefined,\n      subject_types_supported: Array.isArray(raw.subject_types_supported) ? raw.subject_types_supported.map(String) : undefined,\n      id_token_signing_alg_values_supported: Array.isArray(raw.id_token_signing_alg_values_supported) ? raw.id_token_signing_alg_values_supported.map(String) : undefined,\n    };\n  }\n}\n"]}

package/dist/esm/security/authentications/services/anonymous-session.backend.service.d.ts

@@ -360,8 +360,11 @@ export declare class AnonymousSessionBackendService {
      * delete rows it owns" has one answer and one place to fix.
      *
      * ### It resolves the operation it can actually serve, and that is not decoration
-     * `isAnonymizable` is validated at config time to require LIST and UPDATE_MANY — the two ADD needs
-     * — and says NOTHING about DELETE_MANY. Measured 2026-09-09: `draftNotes`, the only
+     * `isAnonymizable` is NOW validated at config time to require a SERVICE-RESOLVABLE delete — either
+     * `DELETE_MANY` or `DELETE`, a disjunction chosen to mirror exactly what this method probes for, so
+     * the guard and the resolver cannot disagree. That was NOT true when this method was written: the
+     * factory then required only LIST and UPDATE_MANY, the two ADD needs, and said nothing about
+     * deletion at all. Measured 2026-09-09: `draftNotes`, the only
      * `isAnonymizable` resource in this repository, declares `DELETE` and not `DELETE_MANY`. So the
      * previous unconditional `getServiceOperationPathDefault(resourceType, DELETE_MANY)` threw
      * `RESOURCES_REGISTRY_OPERATION_PATH_NOT_FOUND` for it — which means the cleanup batch's phase 1
@@ -370,6 +373,10 @@ export declare class AnonymousSessionBackendService {
      * run forever. A DISCARD sweep built on the same unconditional call would have shipped equally
      * dead.
      *
+     * The boot guard now refuses that configuration, so the fallback below is no longer the only thing
+     * standing between an anonymizable resource and a cleanup that cannot run. Keep BOTH: the guard
+     * decides what may be DECLARED, this decides which of the two declared shapes to CALL.
+     *
      * So: prefer `DELETE_MANY` when the resource declares a SERVICE-RESOLVABLE default for it, and
      * fall back to per-row `DELETE` otherwise. The probe is
      * {@link isServiceResolvableDefaultOperation} — the very predicate

package/dist/esm/security/authentications/services/anonymous-session.backend.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"anonymous-session.backend.service.d.ts","sourceRoot":"","sources":["../../../../../../src/security/authentications/services/anonymous-session.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAMH,OAAO,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AAC/G,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAElG,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AACnH,OAAO,KAAK,EAAE,qCAAqC,EAAE,MAAM,6FAA6F,CAAC;AACzJ,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,iFAAiF,CAAC;AAClI,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,0EAA0E,CAAC;AAChI,OAAO,KAAK,EAAE,qCAAqC,EAAE,MAAM,+EAA+E,CAAC;AAC3I,OAAO,EAKL,gCAAgC,EAWhC,KAAK,YAAY,EAClB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,+DAA+D,CAAC;AAG7G,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEjD,MAAM,WAAW,mBAAmB;IAClC,eAAe,EAAE,YAAY,EAAE,CAAC;IAChC;;;;;;;;;OASG;IACH,cAAc,EAAE,YAAY,EAAE,CAAC;IAC/B,WAAW,EAAE;QAAE,YAAY,EAAE,YAAY,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IAC7D,MAAM,EAAE,gCAAgC,CAAC;CAC1C;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,iCAAiC;IAChD,kBAAkB,EAAE,MAAM,CAAC;IAC3B,gBAAgB,EAAE,MAAM,CAAC;IACzB,uBAAuB,EAAE,MAAM,CAAC;IAChC,uBAAuB,EAAE,MAAM,CAAC;IAChC,+FAA+F;IAC/F,sBAAsB,EAAE,MAAM,CAAC;IAC/B,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,qBACa,8BAA8B;IAKJ,OAAO,CAAC,QAAQ,CAAC,MAAM;IACV,OAAO,CAAC,QAAQ,CAAC,YAAY;IAChC,OAAO,CAAC,QAAQ,CAAC,aAAa;IAChB,OAAO,CAAC,QAAQ,CAAC,uBAAuB;IAC/C,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IACpB,OAAO,CAAC,QAAQ,CAAC,uBAAuB;IACtD,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IASrC,OAAO,CAAC,QAAQ,CAAC,mBAAmB;IAlBtF,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA+D;gBAGlC,MAAM,EAAE,aAAa,EACR,YAAY,EAAE,0BAA0B,EAC3C,aAAa,EAAE,uBAAuB,EACxB,uBAAuB,EAAE,qCAAqC,EACrE,iBAAiB,EAAE,+BAA+B,EACpC,uBAAuB,EAAE,qCAAqC,EAC5E,gBAAgB,EAAE,uBAAuB,EAS7C,mBAAmB,EAAE,0BAA0B;IAKlH;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACG,mBAAmB,CAAC,eAAe,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;IA8D9F;;;;;;;OAOG;IACH,gBAAgB,CAAC,eAAe,EAAE,MAAM,GAAG,MAAM;IASjD;;;;;;;OAOG;IACH,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG;QAAE,eAAe,EAAE,MAAM,CAAA;KAAE;IA2B9D;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACG,+BAA+B,CAAC,eAAe,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IA+B7E;;;;;;;;;;;;;;;;;;OAkBG;IACH,gBAAgB,CAAC,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI;IAUpD;;;;;;;OAOG;IACH,kBAAkB,CAAC,GAAG,EAAE,QAAQ,GAAG,IAAI;IAQvC;;;;;;;OAOG;IACG,kBAAkB,CACtB,eAAe,EAAE,MAAM,EACvB,mBAAmB,EAAE,MAAM,EAC3B,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,mBAAmB,CAAC;IA+B/B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA+DG;YACW,2BAA2B;IA2GzC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA8BG;YACW,0BAA0B;IAsBxC;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACG,iCAAiC,CAAC,OAAO,CAAC,EAAE;QAChD,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,aAAa,CAAC,EAAE,MAAM,CAAC;KACxB,GAAG,OAAO,CAAC,iCAAiC,CAAC;IAyH9C;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;YACW,iCAAiC;IA8B/C;;;;;;;;;;;;;;;;;;;;;;;OAuBG;YACW,oBAAoB;YAiBpB,iBAAiB;IAc/B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA8BG;YACW,kBAAkB;YAyBlB,yBAAyB;IAgBvC;;;OAGG;IACG,sBAAsB,CAAC,OAAO,CAAC,EAAE;QACrC,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,oBAAoB,CAAC,EAAE,MAAM,CAAC;KAC/B,GAAG,OAAO,CAAC;QACV,iBAAiB,EAAE,MAAM,CAAC;QAC1B,gBAAgB,EAAE,MAAM,CAAC;QACzB,aAAa,EAAE,MAAM,CAAC;QACtB,qBAAqB,EAAE,MAAM,CAAC;QAC9B,MAAM,EAAE,MAAM,CAAC;QACf,wBAAwB,EAAE,iCAAiC,CAAC;KAC7D,CAAC;IA4KF,OAAO,CAAC,4BAA4B;IAYpC,OAAO,CAAC,MAAM;IAId;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,OAAO,CAAC,kCAAkC;CA2C3C"}
+{"version":3,"file":"anonymous-session.backend.service.d.ts","sourceRoot":"","sources":["../../../../../src/security/authentications/services/anonymous-session.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAMH,OAAO,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AAC/G,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAElG,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AACnH,OAAO,KAAK,EAAE,qCAAqC,EAAE,MAAM,6FAA6F,CAAC;AACzJ,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,iFAAiF,CAAC;AAClI,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,0EAA0E,CAAC;AAChI,OAAO,KAAK,EAAE,qCAAqC,EAAE,MAAM,+EAA+E,CAAC;AAC3I,OAAO,EAKL,gCAAgC,EAWhC,KAAK,YAAY,EAClB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,+DAA+D,CAAC;AAG7G,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEjD,MAAM,WAAW,mBAAmB;IAClC,eAAe,EAAE,YAAY,EAAE,CAAC;IAChC;;;;;;;;;OASG;IACH,cAAc,EAAE,YAAY,EAAE,CAAC;IAC/B,WAAW,EAAE;QAAE,YAAY,EAAE,YAAY,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IAC7D,MAAM,EAAE,gCAAgC,CAAC;CAC1C;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,iCAAiC;IAChD,kBAAkB,EAAE,MAAM,CAAC;IAC3B,gBAAgB,EAAE,MAAM,CAAC;IACzB,uBAAuB,EAAE,MAAM,CAAC;IAChC,uBAAuB,EAAE,MAAM,CAAC;IAChC,+FAA+F;IAC/F,sBAAsB,EAAE,MAAM,CAAC;IAC/B,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,qBACa,8BAA8B;IAKJ,OAAO,CAAC,QAAQ,CAAC,MAAM;IACV,OAAO,CAAC,QAAQ,CAAC,YAAY;IAChC,OAAO,CAAC,QAAQ,CAAC,aAAa;IAChB,OAAO,CAAC,QAAQ,CAAC,uBAAuB;IAC/C,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IACpB,OAAO,CAAC,QAAQ,CAAC,uBAAuB;IACtD,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IASrC,OAAO,CAAC,QAAQ,CAAC,mBAAmB;IAlBtF,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA+D;gBAGlC,MAAM,EAAE,aAAa,EACR,YAAY,EAAE,0BAA0B,EAC3C,aAAa,EAAE,uBAAuB,EACxB,uBAAuB,EAAE,qCAAqC,EACrE,iBAAiB,EAAE,+BAA+B,EACpC,uBAAuB,EAAE,qCAAqC,EAC5E,gBAAgB,EAAE,uBAAuB,EAS7C,mBAAmB,EAAE,0BAA0B;IAKlH;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACG,mBAAmB,CAAC,eAAe,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;IA8D9F;;;;;;;OAOG;IACH,gBAAgB,CAAC,eAAe,EAAE,MAAM,GAAG,MAAM;IASjD;;;;;;;OAOG;IACH,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG;QAAE,eAAe,EAAE,MAAM,CAAA;KAAE;IA2B9D;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACG,+BAA+B,CAAC,eAAe,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IA+B7E;;;;;;;;;;;;;;;;;;OAkBG;IACH,gBAAgB,CAAC,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI;IAUpD;;;;;;;OAOG;IACH,kBAAkB,CAAC,GAAG,EAAE,QAAQ,GAAG,IAAI;IAQvC;;;;;;;OAOG;IACG,kBAAkB,CACtB,eAAe,EAAE,MAAM,EACvB,mBAAmB,EAAE,MAAM,EAC3B,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,mBAAmB,CAAC;IA+B/B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA+DG;YACW,2BAA2B;IA2GzC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA8BG;YACW,0BAA0B;IAsBxC;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACG,iCAAiC,CAAC,OAAO,CAAC,EAAE;QAChD,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,aAAa,CAAC,EAAE,MAAM,CAAC;KACxB,GAAG,OAAO,CAAC,iCAAiC,CAAC;IAyH9C;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;YACW,iCAAiC;IA8B/C;;;;;;;;;;;;;;;;;;;;;;;OAuBG;YACW,oBAAoB;YAiBpB,iBAAiB;IAc/B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAqCG;YACW,kBAAkB;YAyBlB,yBAAyB;IAgBvC;;;OAGG;IACG,sBAAsB,CAAC,OAAO,CAAC,EAAE;QACrC,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,oBAAoB,CAAC,EAAE,MAAM,CAAC;KAC/B,GAAG,OAAO,CAAC;QACV,iBAAiB,EAAE,MAAM,CAAC;QAC1B,gBAAgB,EAAE,MAAM,CAAC;QACzB,aAAa,EAAE,MAAM,CAAC;QACtB,qBAAqB,EAAE,MAAM,CAAC;QAC9B,MAAM,EAAE,MAAM,CAAC;QACf,wBAAwB,EAAE,iCAAiC,CAAC;KAC7D,CAAC;IA4KF,OAAO,CAAC,4BAA4B;IAYpC,OAAO,CAAC,MAAM;IAId;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,OAAO,CAAC,kCAAkC;CA2C3C"}

package/dist/esm/security/authentications/services/anonymous-session.backend.service.js

@@ -702,8 +702,11 @@ let AnonymousSessionBackendService = class AnonymousSessionBackendService {
      * delete rows it owns" has one answer and one place to fix.
      *
      * ### It resolves the operation it can actually serve, and that is not decoration
-     * `isAnonymizable` is validated at config time to require LIST and UPDATE_MANY — the two ADD needs
-     * — and says NOTHING about DELETE_MANY. Measured 2026-09-09: `draftNotes`, the only
+     * `isAnonymizable` is NOW validated at config time to require a SERVICE-RESOLVABLE delete — either
+     * `DELETE_MANY` or `DELETE`, a disjunction chosen to mirror exactly what this method probes for, so
+     * the guard and the resolver cannot disagree. That was NOT true when this method was written: the
+     * factory then required only LIST and UPDATE_MANY, the two ADD needs, and said nothing about
+     * deletion at all. Measured 2026-09-09: `draftNotes`, the only
      * `isAnonymizable` resource in this repository, declares `DELETE` and not `DELETE_MANY`. So the
      * previous unconditional `getServiceOperationPathDefault(resourceType, DELETE_MANY)` threw
      * `RESOURCES_REGISTRY_OPERATION_PATH_NOT_FOUND` for it — which means the cleanup batch's phase 1
@@ -712,6 +715,10 @@ let AnonymousSessionBackendService = class AnonymousSessionBackendService {
      * run forever. A DISCARD sweep built on the same unconditional call would have shipped equally
      * dead.
      *
+     * The boot guard now refuses that configuration, so the fallback below is no longer the only thing
+     * standing between an anonymizable resource and a cleanup that cannot run. Keep BOTH: the guard
+     * decides what may be DECLARED, this decides which of the two declared shapes to CALL.
+     *
      * So: prefer `DELETE_MANY` when the resource declares a SERVICE-RESOLVABLE default for it, and
      * fall back to per-row `DELETE` otherwise. The probe is
      * {@link isServiceResolvableDefaultOperation} — the very predicate