@wildo-ai/saas-backend-lib 1.1.3 → 1.1.4

package/dist/esm/security/authentications/services/auth-methods/oauth2-authentication.backend.service.d.ts

@@ -92,6 +92,51 @@ export declare class OAuth2AuthenticationBackendService {
         authorizationUrl: string;
         state: string;
     }>;
+    /**
+     * Build the RP-initiated logout redirect to the upstream identity provider (issue #445).
+     *
+     * ## What was wrong
+     *
+     * `endSessionEndpoint` was persisted, audit-marked and resolved from all three template modes into
+     * a local variable that was then DROPPED. Signing out of Wildo left the session at the identity
+     * provider alive, and the next sign-in was silent.
+     *
+     * Note this is the UPSTREAM provider's endpoint. Wildo is separately an OIDC provider with an
+     * `end_session_endpoint` of its own, which works; a search for `end_session` returns mostly that
+     * one and it is not this.
+     *
+     * ## The three decisions
+     *
+     * **Front-channel RP-initiated logout**, not front-channel or back-channel logout — three
+     * different mechanisms, and only this one needs the endpoint already authored on the connection.
+     * spec-cite: OpenID Connect RP-Initiated Logout 1.0 — `end_session_endpoint`, `id_token_hint`,
+     * `post_logout_redirect_uri`, `client_id`.
+     *
+     * **OPT-IN per connection**, through `federatedLogoutEnabled`, mirroring SAML's
+     * `singleLogoutEnabled` rather than inventing a second shape. In DISCOVERY mode the endpoint comes
+     * from the provider's own document, so defaulting on would change the logout behaviour of every
+     * connection that merely happens to advertise one.
+     *
+     * **`client_id`, not `id_token_hint`.** The hint is the provider's preferred way to identify the
+     * session, and supplying it would mean PERSISTING the upstream ID token — a bearer credential at
+     * rest, for the sole purpose of a logout parameter. The specification's own alternative is to send
+     * the `client_id`, so this sends that and stores nothing. A provider that refuses to end a session
+     * without the hint will prompt the user instead, which is a worse experience and not a security
+     * hole; storing the token would be the reverse trade.
+     *
+     * ## What this method does NOT do
+     *
+     * It does not revoke anything. The caller terminates the local session and clears the cookie
+     * BEFORE redirecting, so a user who closes the tab at the provider is still signed out of Wildo —
+     * the ordering #445 names, and the same one the SAML kickoff uses.
+     *
+     * Returns `null` when there is nothing to redirect to, and the three reasons are logged
+     * distinctly: no connection, the operator did not opt in, or the provider advertises no endpoint.
+     * The caller answers 204 for all three.
+     */
+    buildFederatedLogoutRedirect(connectionId: string, postLogoutRedirectUri: string | undefined): Promise<{
+        redirectUrl: string;
+    } | null>;
     /**
      * Process the OAuth2 callback: validate state, exchange code for tokens,
      * extract user profile.
@@ -244,6 +289,58 @@ export declare class OAuth2AuthenticationBackendService {
      * Prefer verifyIdToken() for providers with JWKS.
      */
     private decodeIdToken;
+    /**
+     * Read an ID token's claims — verified against the provider's JWKS when one is available.
+     *
+     * EXTRACTED as its own seam for #444, and the extraction is the point rather than tidiness: the
+     * `acr` enforcement has to read the ID token on connections whose `identitySource` is `userinfo`,
+     * where this code previously never ran. Two copies of "verify if we can, decode if we cannot"
+     * would be two places for the verification policy to drift, and the one that drifted would be the
+     * security check rather than the profile read.
+     *
+     * C3: falls back to an UNSIGNED decode only when no JWKS URI is available, which should not happen
+     * for a well-configured OIDC provider — JWKS is a required discovery field. The fallback is loud.
+     */
+    private readIdTokenClaims;
+    /**
+     * Enforce a connection's `acrValues` demand against what the identity provider actually reported
+     * (issue #444).
+     *
+     * `acr_values` is a REQUEST parameter. The specification is explicit that the provider is not
+     * obliged to satisfy it — the relying party asks, the provider decides, and the ID token's `acr`
+     * claim reports what happened.
+     * spec-cite: OpenID Connect Core 1.0 §3.1.2.1 (`acr_values`: the Authentication Context Class
+     * satisfied by the authentication performed is returned as the `acr` Claim Value) and §2.
+     *
+     * Until this existed the chain was: operator demands hardware-token authentication -> Wildo asks
+     * -> the provider authenticates with a password -> the ID token says so -> Wildo admits the
+     * session. The demand was documented, audit-marked, visible on the screen, and unenforced.
+     *
+     * ## The four decisions, each taken rather than deferred
+     *
+     * **It reads the ID token REGARDLESS of `identitySource`.** The common enterprise connection
+     * authors a `userInfoEndpoint` and therefore takes the `userinfo` branch, where the ID token was
+     * never read at all — so an enforcement conditional on the existing flow would have been inert on
+     * exactly the connections that configure step-up. That is why this is a flow change.
+     *
+     * **A missing ID token, or an ID token that cannot be read, REFUSES.** A demand whose evidence is
+     * unavailable is a demand that was not met; admitting would be asserting an authentication
+     * strength nothing observed.
+     *
+     * **An ID token with NO `acr` claim REFUSES**, and this is the decision most likely to be
+     * questioned. It fails closed, matching how the framework treats an unsatisfiable guard, and it
+     * WILL refuse providers that simply do not emit the claim. That is the correct outcome rather than
+     * an unfortunate one: the alternative admits every such provider while the operator screen says
+     * step-up is required, which is the silent-inertness this issue exists to end. It costs nothing to
+     * a connection that declares no `acrValues`, because this method returns before reading anything.
+     *
+     * **Membership, not hierarchy, and not `amr`.** `acr_values` is an ORDERED list of ACCEPTABLE
+     * values, so any member matching satisfies the demand; an assurance-LEVEL ordering (LoA 2 satisfies
+     * a demand for LoA 1) cannot be derived from strings the framework does not define and is not
+     * invented here. `amr` reports the METHODS used and is a different claim — accepting it as evidence
+     * would mean guessing what the operator's ACR string meant.
+     */
+    private enforceAuthenticationContextDemand;
     /**
      * Verify a JWT ID token against the provider's JWKS endpoint.
      * Uses the `jose` library for cryptographic signature verification + claims validation.

package/dist/esm/security/authentications/services/auth-methods/oauth2-authentication.backend.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oauth2-authentication.backend.service.d.ts","sourceRoot":"","sources":["../../../../../../../src/security/authentications/services/auth-methods/oauth2-authentication.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,kBAAkB,CAAC;AAI1B,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAC7F,OAAO,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AAC/G,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAC9G,OAAO,KAAK,EAAE,qCAAqC,EAAE,MAAM,6FAA6F,CAAC;AACzJ,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,iFAAiF,CAAC;AAElI,OAAO,KAAK,EACV,2CAA2C,EAC5C,MAAM,yFAAyF,CAAC;AAMjG,OAAO,EAAE,yCAAyC,EAAE,MAAM,qGAAqG,CAAC;AAChK,OAAO,EAAE,6BAA6B,EAAE,MAAM,yFAAyF,CAAC;AAExI,OAAO,EAAE,sCAAsC,EAAE,MAAM,8CAA8C,CAAC;AACtG,OAAO,EAAE,+BAA+B,EAAE,MAAM,wGAAwG,CAAC;AACzJ,OAAO,EAAE,wCAAwC,EAAE,MAAM,gHAAgH,CAAC;AAC1K,OAAO,EAAE,uBAAuB,EAAE,MAAM,gFAAgF,CAAC;AAEzH,OAAO,EAWL,aAAa,EAQd,MAAM,uBAAuB,CAAC;AAS/B,OAAO,KAAK,EACV,wBAAwB,EACxB,qBAAqB,EACrB,oBAAoB,EACpB,wBAAwB,EACxB,qBAAqB,EAEtB,MAAM,sFAAsF,CAAC;AAK9F,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,mFAAmF,CAAC;AAqBnI;;;;;;;GAOG;AACH,qBACa,kCAAkC;IAYR,OAAO,CAAC,QAAQ,CAAC,MAAM;IACb,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IAC9B,OAAO,CAAC,QAAQ,CAAC,YAAY;IAClB,OAAO,CAAC,QAAQ,CAAC,uBAAuB;IAC3C,OAAO,CAAC,QAAQ,CAAC,aAAa;IACnC,OAAO,CAAC,QAAQ,CAAC,sBAAsB;IAC9B,OAAO,CAAC,QAAQ,CAAC,QAAQ;IAEhC,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IAEzB,OAAO,CAAC,QAAQ,CAAC,sBAAsB;IAExD,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IAO9B,OAAO,CAAC,QAAQ,CAAC,mBAAmB;IAEpF,OAAO,CAAC,QAAQ,CAAC,6BAA6B;IAhChD,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA+D;IAExF;;;;;OAKG;IACH,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA8B;gBAGH,MAAM,EAAE,aAAa,EACX,gBAAgB,EAAE,uBAAuB,EACtC,YAAY,EAAE,0BAA0B,EAC7B,uBAAuB,EAAE,qCAAqC,EACjE,aAAa,EAAE,yCAAyC,EAC7D,sBAAsB,EAAE,6BAA6B,EAC5C,QAAQ,EAAE,sCAAsC,EAEvD,iBAAiB,EAAE,+BAA+B,EAEzC,sBAAsB,EAAE,wCAAwC,EAEjF,gBAAgB,EAAE,uBAAuB,EAOtC,mBAAmB,EAAE,0BAA0B,EAE/F,6BAA6B,EAAE,2CAA2C;IAU7F;;;;;;;;;;;;;OAaG;IACU,qBAAqB,CAChC,UAAU,EAAE,wBAAwB,EACpC,OAAO,CAAC,EAAE;QAAE,mBAAmB,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,aAAa,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,GAC1G,OAAO,CAAC;QAAE,gBAAgB,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IAmHvD;;;;;;OAMG;IACU,cAAc,CACzB,cAAc,EAAE,oBAAoB,GACnC,OAAO,CAAC;QAAE,iBAAiB,EAAE,qBAAqB,CAAC;QAAC,UAAU,EAAE,wBAAwB,CAAC;QAAC,aAAa,EAAE,wBAAwB,CAAA;KAAE,CAAC;IA6DvI;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACU,mBAAmB,CAC9B,OAAO,EAAE,qBAAqB,EAC9B,UAAU,EAAE,yBAAyB,EACrC,mBAAmB,CAAC,EAAE,MAAM,GAC3B,OAAO,CAAC,qBAAqB,CAAC;IASjC;;;;;;;;;OASG;YACW,0BAA0B;IAmYxC;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;YACW,0BAA0B;IAsExC;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;YACW,sCAAsC;IAgIpD;;;;;OAKG;YACW,wBAAwB;IA4BtC;;;OAGG;YACW,qBAAqB;IAkFnC;;;;;;;;;OASG;YACW,kBAAkB;YA+KlB,aAAa;YA8Bb,kBAAkB;IA2BhC;;;;OAIG;YACW,2BAA2B;IAQzC,OAAO,CAAC,oBAAoB;IAI5B,OAAO,CAAC,qBAAqB;IAQ7B,OAAO,CAAC,4BAA4B;IAkCpC;;OAEG;IACH,OAAO,CAAC,YAAY;IAWpB;;OAEG;IACH,OAAO,CAAC,iBAAiB;IAQzB;;;;OAIG;IACH,OAAO,CAAC,aAAa;IAYrB;;;;;;;;;;OAUG;YACW,aAAa;IAiC3B;;;;;;OAMG;IACH,OAAO,CAAC,kBAAkB;IA+B1B;;;OAGG;IACH,OAAO,CAAC,wBAAwB;IA0DhC;;;;OAIG;IACH,OAAO,CAAC,mBAAmB;CA2B5B"}
+{"version":3,"file":"oauth2-authentication.backend.service.d.ts","sourceRoot":"","sources":["../../../../../../src/security/authentications/services/auth-methods/oauth2-authentication.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,kBAAkB,CAAC;AAK1B,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAC7F,OAAO,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AAC/G,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAC9G,OAAO,KAAK,EAAE,qCAAqC,EAAE,MAAM,6FAA6F,CAAC;AACzJ,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,iFAAiF,CAAC;AAElI,OAAO,KAAK,EACV,2CAA2C,EAC5C,MAAM,yFAAyF,CAAC;AAMjG,OAAO,EAAE,yCAAyC,EAAE,MAAM,qGAAqG,CAAC;AAChK,OAAO,EAAE,6BAA6B,EAAE,MAAM,yFAAyF,CAAC;AAExI,OAAO,EAAE,sCAAsC,EAAE,MAAM,8CAA8C,CAAC;AACtG,OAAO,EAAE,+BAA+B,EAAE,MAAM,wGAAwG,CAAC;AACzJ,OAAO,EAAE,wCAAwC,EAAE,MAAM,gHAAgH,CAAC;AAC1K,OAAO,EAAE,uBAAuB,EAAE,MAAM,gFAAgF,CAAC;AAEzH,OAAO,EAWL,aAAa,EAQd,MAAM,uBAAuB,CAAC;AAS/B,OAAO,KAAK,EACV,wBAAwB,EACxB,qBAAqB,EACrB,oBAAoB,EACpB,wBAAwB,EACxB,qBAAqB,EAEtB,MAAM,sFAAsF,CAAC;AAK9F,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,mFAAmF,CAAC;AAqBnI;;;;;;;GAOG;AACH,qBACa,kCAAkC;IAYR,OAAO,CAAC,QAAQ,CAAC,MAAM;IACb,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IAC9B,OAAO,CAAC,QAAQ,CAAC,YAAY;IAClB,OAAO,CAAC,QAAQ,CAAC,uBAAuB;IAC3C,OAAO,CAAC,QAAQ,CAAC,aAAa;IACnC,OAAO,CAAC,QAAQ,CAAC,sBAAsB;IAC9B,OAAO,CAAC,QAAQ,CAAC,QAAQ;IAEhC,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IAEzB,OAAO,CAAC,QAAQ,CAAC,sBAAsB;IAExD,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IAO9B,OAAO,CAAC,QAAQ,CAAC,mBAAmB;IAEpF,OAAO,CAAC,QAAQ,CAAC,6BAA6B;IAhChD,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA+D;IAExF;;;;;OAKG;IACH,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA8B;gBAGH,MAAM,EAAE,aAAa,EACX,gBAAgB,EAAE,uBAAuB,EACtC,YAAY,EAAE,0BAA0B,EAC7B,uBAAuB,EAAE,qCAAqC,EACjE,aAAa,EAAE,yCAAyC,EAC7D,sBAAsB,EAAE,6BAA6B,EAC5C,QAAQ,EAAE,sCAAsC,EAEvD,iBAAiB,EAAE,+BAA+B,EAEzC,sBAAsB,EAAE,wCAAwC,EAEjF,gBAAgB,EAAE,uBAAuB,EAOtC,mBAAmB,EAAE,0BAA0B,EAE/F,6BAA6B,EAAE,2CAA2C;IAU7F;;;;;;;;;;;;;OAaG;IACU,qBAAqB,CAChC,UAAU,EAAE,wBAAwB,EACpC,OAAO,CAAC,EAAE;QAAE,mBAAmB,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,aAAa,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,GAC1G,OAAO,CAAC;QAAE,gBAAgB,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IAmHvD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAyCG;IACU,4BAA4B,CACvC,YAAY,EAAE,MAAM,EACpB,qBAAqB,EAAE,MAAM,GAAG,SAAS,GACxC,OAAO,CAAC;QAAE,WAAW,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IA0C1C;;;;;;OAMG;IACU,cAAc,CACzB,cAAc,EAAE,oBAAoB,GACnC,OAAO,CAAC;QAAE,iBAAiB,EAAE,qBAAqB,CAAC;QAAC,UAAU,EAAE,wBAAwB,CAAC;QAAC,aAAa,EAAE,wBAAwB,CAAA;KAAE,CAAC;IAoEvI;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACU,mBAAmB,CAC9B,OAAO,EAAE,qBAAqB,EAC9B,UAAU,EAAE,yBAAyB,EACrC,mBAAmB,CAAC,EAAE,MAAM,GAC3B,OAAO,CAAC,qBAAqB,CAAC;IASjC;;;;;;;;;OASG;YACW,0BAA0B;IAmYxC;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;YACW,0BAA0B;IAsExC;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;YACW,sCAAsC;IAgIpD;;;;;OAKG;YACW,wBAAwB;IA4BtC;;;OAGG;YACW,qBAAqB;IAqFnC;;;;;;;;;OASG;YACW,kBAAkB;YAqJlB,aAAa;YAiCb,kBAAkB;IA2BhC;;;;OAIG;YACW,2BAA2B;IAQzC,OAAO,CAAC,oBAAoB;IAI5B,OAAO,CAAC,qBAAqB;IAQ7B,OAAO,CAAC,4BAA4B;IAkCpC;;OAEG;IACH,OAAO,CAAC,YAAY;IAWpB;;OAEG;IACH,OAAO,CAAC,iBAAiB;IAQzB;;;;OAIG;IACH,OAAO,CAAC,aAAa;IAYrB;;;;;;;;;;;OAWG;YACW,iBAAiB;IAyB/B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAqCG;YACW,kCAAkC;IAwDhD;;;;;;;;;;OAUG;YACW,aAAa;IAiC3B;;;;;;OAMG;IACH,OAAO,CAAC,kBAAkB;IA+B1B;;;OAGG;IACH,OAAO,CAAC,wBAAwB;IA0DhC;;;;OAIG;IACH,OAAO,CAAC,mBAAmB;CA2B5B"}

package/dist/esm/security/authentications/services/auth-methods/oauth2-authentication.backend.service.js

@@ -39,6 +39,7 @@ import 'reflect-metadata';
 import { injectable, inject } from 'inversify';
 import * as crypto from 'crypto';
 import { SAAS_SERVICE_TYPES } from '../../../../inject/models/service-types.js';
+import { FEDERATED_AUTH_PROVIDER_REQUEST_TIMEOUT_MS } from '../../../../security/authentications/models/federated-auth-transport.backend.definitions.js';
 import { LoggerService } from '../../../../monitoring/logger/services/logger.service.js';
 import { AppConfigurationService } from '../../../../config/services/app-configuration.backend.service.js';
 import { ErrorBuilderBackendService } from '../../../../errors/services/error-builder.backend.service.js';
@@ -238,6 +239,85 @@ let OAuth2AuthenticationBackendService = class OAuth2AuthenticationBackendServic
     // ═══════════════════════════════════════════════════════════════
     // 2. Handle Callback
     // ═══════════════════════════════════════════════════════════════
+    /**
+     * Build the RP-initiated logout redirect to the upstream identity provider (issue #445).
+     *
+     * ## What was wrong
+     *
+     * `endSessionEndpoint` was persisted, audit-marked and resolved from all three template modes into
+     * a local variable that was then DROPPED. Signing out of Wildo left the session at the identity
+     * provider alive, and the next sign-in was silent.
+     *
+     * Note this is the UPSTREAM provider's endpoint. Wildo is separately an OIDC provider with an
+     * `end_session_endpoint` of its own, which works; a search for `end_session` returns mostly that
+     * one and it is not this.
+     *
+     * ## The three decisions
+     *
+     * **Front-channel RP-initiated logout**, not front-channel or back-channel logout — three
+     * different mechanisms, and only this one needs the endpoint already authored on the connection.
+     * spec-cite: OpenID Connect RP-Initiated Logout 1.0 — `end_session_endpoint`, `id_token_hint`,
+     * `post_logout_redirect_uri`, `client_id`.
+     *
+     * **OPT-IN per connection**, through `federatedLogoutEnabled`, mirroring SAML's
+     * `singleLogoutEnabled` rather than inventing a second shape. In DISCOVERY mode the endpoint comes
+     * from the provider's own document, so defaulting on would change the logout behaviour of every
+     * connection that merely happens to advertise one.
+     *
+     * **`client_id`, not `id_token_hint`.** The hint is the provider's preferred way to identify the
+     * session, and supplying it would mean PERSISTING the upstream ID token — a bearer credential at
+     * rest, for the sole purpose of a logout parameter. The specification's own alternative is to send
+     * the `client_id`, so this sends that and stores nothing. A provider that refuses to end a session
+     * without the hint will prompt the user instead, which is a worse experience and not a security
+     * hole; storing the token would be the reverse trade.
+     *
+     * ## What this method does NOT do
+     *
+     * It does not revoke anything. The caller terminates the local session and clears the cookie
+     * BEFORE redirecting, so a user who closes the tab at the provider is still signed out of Wildo —
+     * the ordering #445 names, and the same one the SAML kickoff uses.
+     *
+     * Returns `null` when there is nothing to redirect to, and the three reasons are logged
+     * distinctly: no connection, the operator did not opt in, or the provider advertises no endpoint.
+     * The caller answers 204 for all three.
+     */
+    async buildFederatedLogoutRedirect(connectionId, postLogoutRedirectUri) {
+        const connection = await this.resolver.resolveEnterpriseConnectionFromAnyScope(connectionId);
+        if (!connection) {
+            this.logger.warn('Federated logout: no enterprise OIDC connection resolved', { connectionId });
+            return null;
+        }
+        if (!connection.federatedLogoutEnabled) {
+            this.logDebug('Federated logout: connection has not opted in — local logout only', {
+                connectionId,
+                providerRef: connection.providerRef,
+            });
+            return null;
+        }
+        if (!connection.endSessionEndpoint) {
+            // Distinct from the opt-out above: the operator ASKED for federated logout and the provider
+            // advertises no endpoint to use, which is a configuration mismatch worth a warning rather
+            // than a debug line.
+            this.logger.warn('Federated logout is enabled but the connection has no end-session endpoint', {
+                connectionId,
+                providerRef: connection.providerRef,
+            });
+            return null;
+        }
+        const url = new URL(connection.endSessionEndpoint);
+        url.searchParams.set('client_id', connection.clientId);
+        if (postLogoutRedirectUri) {
+            /*
+             * The provider REQUIRES this to be pre-registered, and rejects an unregistered value at its
+             * own end — a failure with no local signal, which is why the operator-facing documentation
+             * has to say so. It is omitted rather than guessed when the frontend URL cannot be resolved:
+             * an unregistered value turns a working logout into an error page on someone else's domain.
+             */
+            url.searchParams.set('post_logout_redirect_uri', postLogoutRedirectUri);
+        }
+        this.logDebug('Federated logout redirect built', { connectionId, providerRef: connection.providerRef });
+        return { redirectUrl: url.toString() };
+    }
     /**
      * Process the OAuth2 callback: validate state, exchange code for tokens,
      * extract user profile.
@@ -276,6 +356,12 @@ let OAuth2AuthenticationBackendService = class OAuth2AuthenticationBackendServic
         }
         // 4. Exchange authorization code for tokens
         const tokenResponse = await this.exchangeCodeForTokens(code, connection, stateMetadata.pkceVerifier);
+        /*
+         * 4b. Enforce the connection's authentication-context demand (#444), BEFORE any profile is
+         * extracted or any identity is established. A refusal here must not have provisioned, linked or
+         * even looked up a user — the login did not happen.
+         */
+        await this.enforceAuthenticationContextDemand(tokenResponse, connection);
         // 5. Extract user profile based on identitySource
         const normalizedProfile = await this.extractUserProfile(tokenResponse, connection, body);
         this.logDebug('Callback handled successfully', {
@@ -850,6 +936,9 @@ let OAuth2AuthenticationBackendService = class OAuth2AuthenticationBackendServic
             method: 'POST',
             headers,
             body: new URLSearchParams(bodyParams).toString(),
+            // The browser is parked on the callback URL while this runs, so an unresponsive IdP hangs
+            // the sign-in rather than merely delaying an API call.
+            signal: AbortSignal.timeout(FEDERATED_AUTH_PROVIDER_REQUEST_TIMEOUT_MS),
         });
         if (!response.ok) {
             const errorBody = await response.text();
@@ -890,31 +979,7 @@ let OAuth2AuthenticationBackendService = class OAuth2AuthenticationBackendServic
             rawClaims = await this.fetchUserInfo(connection.userInfoUrl, tokenResponse.access_token, connection);
         }
         else if (connection.identitySource === 'id_token' && tokenResponse.id_token) {
-            // C3 fix: Verify ID token signature against provider's JWKS when available.
-            // Falls back to unsigned decode only when no JWKS URI is available (should not
-            // happen for well-configured OIDC providers — JWKS is a required discovery field).
-            if (connection.jwksUri && connection.issuer) {
-                try {
-                    rawClaims = await this.verifyIdToken(tokenResponse.id_token, connection.jwksUri, connection.issuer, connection.clientId);
-                }
-                catch (verifyError) {
-                    this.logger.error('ID token JWKS verification failed', {
-                        providerRef: connection.providerRef,
-                        ...projectCaughtErrorLogFields(verifyError),
-                    });
-                    throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {
-                        customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_INVALID_TOKEN,
-                    });
-                }
-            }
-            else {
-                this.logger.warn('ID token decoded without signature verification — no JWKS URI available', {
-                    providerRef: connection.providerRef,
-                    hasJwksUri: !!connection.jwksUri,
-                    hasIssuer: !!connection.issuer,
-                });
-                rawClaims = this.decodeIdToken(tokenResponse.id_token);
-            }
+            rawClaims = await this.readIdTokenClaims(tokenResponse.id_token, connection);
         }
         // Supplement with callback body (Apple first-auth: body.user has name)
         if (callbackBody?.user) {
@@ -952,6 +1017,7 @@ let OAuth2AuthenticationBackendService = class OAuth2AuthenticationBackendServic
                 const emailsEndpoint = this.validateProviderExtensionUrl(connection, extensions.emailsEndpoint);
                 const emailsResponse = await fetch(emailsEndpoint, {
                     headers: { Authorization: `Bearer ${tokenResponse.access_token}`, Accept: 'application/json' },
+                    signal: AbortSignal.timeout(FEDERATED_AUTH_PROVIDER_REQUEST_TIMEOUT_MS),
                 });
                 if (emailsResponse.ok) {
                     const emails = await emailsResponse.json();
@@ -1043,7 +1109,10 @@ let OAuth2AuthenticationBackendService = class OAuth2AuthenticationBackendServic
         if (connection.tokenRequestHeaders?.Accept) {
             headers.Accept = connection.tokenRequestHeaders.Accept;
         }
-        const response = await fetch(userInfoUrl, { headers });
+        const response = await fetch(userInfoUrl, {
+            headers,
+            signal: AbortSignal.timeout(FEDERATED_AUTH_PROVIDER_REQUEST_TIMEOUT_MS),
+        });
         if (!response.ok) {
             throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {
                 customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_INVALID_TOKEN,
@@ -1167,6 +1236,129 @@ let OAuth2AuthenticationBackendService = class OAuth2AuthenticationBackendServic
             return {};
         }
     }
+    /**
+     * Read an ID token's claims — verified against the provider's JWKS when one is available.
+     *
+     * EXTRACTED as its own seam for #444, and the extraction is the point rather than tidiness: the
+     * `acr` enforcement has to read the ID token on connections whose `identitySource` is `userinfo`,
+     * where this code previously never ran. Two copies of "verify if we can, decode if we cannot"
+     * would be two places for the verification policy to drift, and the one that drifted would be the
+     * security check rather than the profile read.
+     *
+     * C3: falls back to an UNSIGNED decode only when no JWKS URI is available, which should not happen
+     * for a well-configured OIDC provider — JWKS is a required discovery field. The fallback is loud.
+     */
+    async readIdTokenClaims(idToken, connection) {
+        if (connection.jwksUri && connection.issuer) {
+            try {
+                return await this.verifyIdToken(idToken, connection.jwksUri, connection.issuer, connection.clientId);
+            }
+            catch (verifyError) {
+                this.logger.error('ID token JWKS verification failed', {
+                    providerRef: connection.providerRef,
+                    ...projectCaughtErrorLogFields(verifyError),
+                });
+                throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {
+                    customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_INVALID_TOKEN,
+                });
+            }
+        }
+        this.logger.warn('ID token decoded without signature verification — no JWKS URI available', {
+            providerRef: connection.providerRef,
+            hasJwksUri: !!connection.jwksUri,
+            hasIssuer: !!connection.issuer,
+        });
+        return this.decodeIdToken(idToken);
+    }
+    /**
+     * Enforce a connection's `acrValues` demand against what the identity provider actually reported
+     * (issue #444).
+     *
+     * `acr_values` is a REQUEST parameter. The specification is explicit that the provider is not
+     * obliged to satisfy it — the relying party asks, the provider decides, and the ID token's `acr`
+     * claim reports what happened.
+     * spec-cite: OpenID Connect Core 1.0 §3.1.2.1 (`acr_values`: the Authentication Context Class
+     * satisfied by the authentication performed is returned as the `acr` Claim Value) and §2.
+     *
+     * Until this existed the chain was: operator demands hardware-token authentication -> Wildo asks
+     * -> the provider authenticates with a password -> the ID token says so -> Wildo admits the
+     * session. The demand was documented, audit-marked, visible on the screen, and unenforced.
+     *
+     * ## The four decisions, each taken rather than deferred
+     *
+     * **It reads the ID token REGARDLESS of `identitySource`.** The common enterprise connection
+     * authors a `userInfoEndpoint` and therefore takes the `userinfo` branch, where the ID token was
+     * never read at all — so an enforcement conditional on the existing flow would have been inert on
+     * exactly the connections that configure step-up. That is why this is a flow change.
+     *
+     * **A missing ID token, or an ID token that cannot be read, REFUSES.** A demand whose evidence is
+     * unavailable is a demand that was not met; admitting would be asserting an authentication
+     * strength nothing observed.
+     *
+     * **An ID token with NO `acr` claim REFUSES**, and this is the decision most likely to be
+     * questioned. It fails closed, matching how the framework treats an unsatisfiable guard, and it
+     * WILL refuse providers that simply do not emit the claim. That is the correct outcome rather than
+     * an unfortunate one: the alternative admits every such provider while the operator screen says
+     * step-up is required, which is the silent-inertness this issue exists to end. It costs nothing to
+     * a connection that declares no `acrValues`, because this method returns before reading anything.
+     *
+     * **Membership, not hierarchy, and not `amr`.** `acr_values` is an ORDERED list of ACCEPTABLE
+     * values, so any member matching satisfies the demand; an assurance-LEVEL ordering (LoA 2 satisfies
+     * a demand for LoA 1) cannot be derived from strings the framework does not define and is not
+     * invented here. `amr` reports the METHODS used and is a different claim — accepting it as evidence
+     * would mean guessing what the operator's ACR string meant.
+     */
+    async enforceAuthenticationContextDemand(tokenResponse, connection) {
+        const demanded = connection.acrValues;
+        if (!demanded || demanded.length === 0)
+            return;
+        const refuse = async (receivedAcr, failureReason) => {
+            await this.auditLogsService.logOidcAcrDemandUnsatisfied({
+                providerRef: connection.providerRef,
+                demandedAcrValues: [...demanded],
+                receivedAcr,
+                failureReason,
+            });
+            this.logger.warn('Authentication context demand not satisfied — refusing the login', {
+                providerRef: connection.providerRef,
+                demandedAcrValues: demanded,
+                receivedAcr,
+                failureReason,
+            });
+            throw this.errorBuilder.buildError(ErrorType.AUTHENTICATION, undefined, {
+                customMessageReference: ErrorCustomMessageReference.AUTHENTICATION_INVALID_TOKEN,
+                context: {
+                    // diagnostic (log-only) — `sanitizeErrorForClient` strips this, deliberately: telling an
+                    // unauthenticated caller which authentication context would have been accepted hands them
+                    // the operator's step-up policy.
+                    reason: 'oidc_acr_demand_unsatisfied',
+                },
+            });
+        };
+        const idToken = tokenResponse.id_token;
+        if (typeof idToken !== 'string' || idToken.length === 0) {
+            return refuse(undefined, 'no_id_token_in_token_response');
+        }
+        let claims;
+        try {
+            claims = await this.readIdTokenClaims(idToken, connection);
+        }
+        catch {
+            // `readIdTokenClaims` already logged the verification failure and built its own refusal; this
+            // arm exists so the ACR demand is audited as the reason the login stopped, which is what an
+            // operator is looking for.
+            return refuse(undefined, 'id_token_unreadable');
+        }
+        const receivedAcr = typeof claims.acr === 'string' ? claims.acr : undefined;
+        if (receivedAcr === undefined)
+            return refuse(undefined, 'no_acr_claim');
+        if (!demanded.includes(receivedAcr))
+            return refuse(receivedAcr, undefined);
+        this.logDebug('Authentication context demand satisfied', {
+            providerRef: connection.providerRef,
+            receivedAcr,
+        });
+    }
     /**
      * Verify a JWT ID token against the provider's JWKS endpoint.
      * Uses the `jose` library for cryptographic signature verification + claims validation.