npm - @wildo-ai/saas-models - Versions diffs - 1.1.4 → 1.1.6 - Mend

@wildo-ai/saas-models 1.1.4 → 1.1.6

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (1399) hide show

package/dist/esm/security/authentications/authentication.shared.schemas.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"authentication.shared.schemas.js","sourceRoot":"","sources":["../../../../src/security/authentications/authentication.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,gBAAgB,EAAE,kCAAkC,EAAE,MAAM,mDAAmD,CAAC;AAGzH;;;;;;;GAOG;AAGH,MAAM,CAAC,MAAM,mBAAmB,GAAmC;IACjE,EAAE,kBAAkB,EAAE,gBAAgB,CAAC,aAAa,EAAE,qBAAqB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,cAAc,EAAE,IAAI,EAAE;IACvK,EAAE,kBAAkB,EAAE,gBAAgB,CAAC,WAAW,EAAI,qBAAqB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAI,cAAc,EAAE,IAAI,EAAE;CACxK,CAAC;AAGF,kCAAkC;AAClC,oCAAoC;AACpC,kCAAkC;AAElC;;;GAGG;AACH,MAAM,CAAN,IAAY,cAKX;AALD,WAAY,cAAc;IACxB,2CAAyB,CAAA;IACzB,6CAA2B,CAAA;IAC3B,qDAAmC,CAAA;IACnC,6BAAW,CAAA,CAAsB,4DAA4D;AAC/F,CAAC,EALW,cAAc,KAAd,cAAc,QAKzB;AAED;;;GAGG;AACH,MAAM,CAAN,IAAY,kBAMX;AAND,WAAY,kBAAkB;IAC5B,+CAAyB,CAAA;IACzB,yDAAmC,CAAA;IACnC,yCAAmB,CAAA;IACnB,6CAAuB,CAAA;IACvB,6CAAuB,CAAA,CAAa,wCAAwC;AAC9E,CAAC,EANW,kBAAkB,KAAlB,kBAAkB,QAM7B;AAED;;;;;;;;;;;;;;;;GAgBG;AACH;;;GAGG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,mBAA4B,CAAC;AAEnE,MAAM,CAAN,IAAY,cASX;AATD,WAAY,cAAc;IACtB,wDAAwD;IACxD,+EAA6D,CAAA;IAC7D,sDAAsD;IACtD,2EAAyD,CAAA;IACzD,mCAAmC;IACnC,6DAA2C,CAAA;IAC3C,sCAAsC;IACtC,mEAAiD,CAAA;AACrD,CAAC,EATW,cAAc,KAAd,cAAc,QASzB;AAED;;;;;;GAMG;AACH,MAAM,CAAN,IAAY,aAMX;AAND,WAAY,aAAa;IACrB,qEAAqE;IACrE,gEAA+C,CAAA;IAE/C,0EAA0E;IAC1E,wFAAuE,CAAA;AAC3E,CAAC,EANW,aAAa,KAAb,aAAa,QAMxB;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,kCAAkC,GAAwB,IAAI,GAAG,CAAC;IAC7E,wGAAwG;IACxG,0GAA0G;IAC1G,mGAAmG;IACnG,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK;CACvH,CAAC,CAAC;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+DG;AACH,MAAM,CAAN,IAAY,UAqBX;AArBD,WAAY,UAAU;IACpB,uCAAuC;IACvC,mCAAqB,CAAA;IAErB,sEAAsE;IACtE,iDAAmC,CAAA;IAEnC,uDAAuD;IACvD,mCAAqB,CAAA;IACrB,uDAAyC,CAAA;IAEzC,mCAAmC;IACnC,uCAAyB,CAAA;IAEzB,2EAA2E;IAC3E,2BAAa,CAAA;IACb,iCAAmB,CAAA;IACnB,qCAAuB,CAAA;IAEvB,4CAA4C;IAC5C,iCAAmB,CAAA,CAAc,0BAA0B;AAC7D,CAAC,EArBW,UAAU,KAAV,UAAU,QAqBrB;AACD,sDAAsD;AAEtD;;GAEG;AACH,MAAM,CAAN,IAAY,UAGX;AAHD,WAAY,UAAU;IACpB,+BAAiB,CAAA;IACjB,6BAAe,CAAA,CAAU,uCAAuC;AAClE,CAAC,EAHW,UAAU,KAAV,UAAU,QAGrB;AAED;;GAEG;AACH,MAAM,CAAN,IAAY,eAIX;AAJD,WAAY,eAAe;IACzB,oDAAiC,CAAA;IACjC,kCAAe,CAAA;IACf,oCAAiB,CAAA,CAAQ,qCAAqC;AAChE,CAAC,EAJW,eAAe,KAAf,eAAe,QAI1B;AAED;;;GAGG;AACH,MAAM,CAAN,IAAY,YA0BX;AA1BD,WAAY,YAAY;IACtB,iDAAiC,CAAA;IACjC,yCAAyB,CAAA;IACzB,qCAAqB,CAAA;IACrB,yDAAyC,CAAA;IACzC,mDAAmC,CAAA;IACnC;;;;OAIG;IACH,mDAAmC,CAAA;IACnC;;;;;;;;;;;;OAYG;IACH,yDAAyC,CAAA;AAC3C,CAAC,EA1BW,YAAY,KAAZ,YAAY,QA0BvB;AAED;;GAEG;AACH,MAAM,CAAN,IAAY,kBAMX;AAND,WAAY,kBAAkB;IAC5B,qCAAe,CAAA;IACf,mDAA6B,CAAA;IAC7B,+CAAyB,CAAA;IACzB,uCAAiB,CAAA;IACjB,iDAA2B,CAAA;AAC7B,CAAC,EANW,kBAAkB,KAAlB,kBAAkB,QAM7B;AAED;;;GAGG;AACH,MAAM,CAAN,IAAY,kBAKX;AALD,WAAY,kBAAkB;IAC5B,mDAA6B,CAAA;IAC7B,yCAAmB,CAAA;IACnB,qCAAe,CAAA;IACf,2CAAqB,CAAA;AACvB,CAAC,EALW,kBAAkB,KAAlB,kBAAkB,QAK7B;AAED,kCAAkC;AAClC,uCAAuC;AACvC,kCAAkC;AAElC;;GAEG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAuC;IACxE,0CAA0C;IAC1C,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,cAAc,CAAC,UAAU;IAEhD,6CAA6C;IAC7C,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,cAAc,CAAC,UAAU;IAElD,0EAA0E;IAC1E,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,cAAc,CAAC,UAAU;IACvD,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,cAAc,CAAC,UAAU;IAChD,CAAC,UAAU,CAAC,kBAAkB,CAAC,EAAE,cAAc,CAAC,UAAU;IAE1D,gFAAgF;IAChF,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,cAAc,CAAC,WAAW;IAC7C,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,cAAc,CAAC,eAAe;IACpD,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,cAAc,CAAC,WAAW;IAElD,4CAA4C;IAC5C,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,cAAc,CAAC,eAAe;CACrD,CAAC;AAEF;;GAEG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAA2C;IAC9E,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,kBAAkB,CAAC,UAAU;IACpD,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,kBAAkB,CAAC,UAAU;IACtD,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,kBAAkB,CAAC,eAAe;IAChE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,kBAAkB,CAAC,OAAO;IACjD,CAAC,UAAU,CAAC,kBAAkB,CAAC,EAAE,kBAAkB,CAAC,OAAO;IAC3D,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,kBAAkB,CAAC,SAAS;IAC/C,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,kBAAkB,CAAC,SAAS;IAClD,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,kBAAkB,CAAC,SAAS;IACpD,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,kBAAkB,CAAC,SAAS;CACnD,CAAC;AAEF;;;;;GAKG;AACH,MAAM,CAAN,IAAY,aAGX;AAHD,WAAY,aAAa;IACvB,8CAA6B,CAAA;IAC7B,4CAA2B,CAAA;AAC7B,CAAC,EAHW,aAAa,KAAb,aAAa,QAGxB;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;IAClD,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACnC,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,QAAQ,EAAE;IAC3C,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC9B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAChC,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC;IAC1B,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC;IAClC,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC;IACpC,gBAAgB,EAAE,CAAC,CAAC,OAAO,EAAE;IAC7B,iBAAiB,EAAE,CAAC,CAAC,OAAO,EAAE;IAC9B,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE;IAErB,gCAAgC;IAChC,kBAAkB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,EAAE,yBAAyB;IAC7E,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,EAAE,uBAAuB;IAC/D,sBAAsB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAElD,2BAA2B;IAC3B,oBAAoB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAChD,qBAAqB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;IAEjE,uBAAuB;IACvB,MAAM,EAAE,2BAA2B,CAAC,QAAQ,EAAE;CAC/C,CAAC,CAAC;AAKH,kCAAkC;AAClC,wBAAwB;AACxB,kCAAkC;AAElC;;;GAGG;AACH,MAAM,CAAN,IAAY,qBAMX;AAND,WAAY,qBAAqB;IAC/B,gEAAuC,CAAA;IACvC,8DAAqC,CAAA;IACrC,4DAAmC,CAAA;IACnC,0DAAiC,CAAA;IACjC,sDAA6B,CAAA;AAC/B,CAAC,EANW,qBAAqB,KAArB,qBAAqB,QAMhC;AAED;;;;;;GAMG;AACH,MAAM,CAAN,IAAY,iBAGX;AAHD,WAAY,iBAAiB;IAC3B,sCAAiB,CAAA;IACjB,8CAAyB,CAAA;AAC3B,CAAC,EAHW,iBAAiB,KAAjB,iBAAiB,QAG5B;AAED;;;;;GAKG;AACH,MAAM,CAAN,IAAY,sBAKX;AALD,WAAY,sBAAsB;IAChC,2CAAiB,CAAA;IACjB,uCAAa,CAAA;IACb,uCAAa,CAAA;IACb,uCAAa,CAAA;AACf,CAAC,EALW,sBAAsB,KAAtB,sBAAsB,QAKjC","sourcesContent":["/*\n Authentication Shared Schemas\n \n Core authentication schemas shared between frontend and backend\n /\n\nimport { z } from 'zod';\n\nimport { CoreResourceType, coreResourceShared_FieldIdentifier } from '../../resources/resources.shared.core.definitions';\nimport type { PolymorphicVariantDefinition } from '../../resources/utils/resource-polymorphism.schemas';\n\n/\n Auth Scope Variants (Shared)\n \n The 2 auth scope variants — shared across all auth polymorphic resources\n * (SsoConfig, SsoConnection, SiemExportConfig, SiemDeliveryDlq,\n * ScimTokens, ScimProvisioningConfig).\n \n /\n\n\nexport const AUTH_SCOPE_VARIANTS: PolymorphicVariantDefinition[] = [\n { parentResourceType: CoreResourceType.ORGANIZATIONS, parentFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.ORGANIZATIONS], isPrimaryScope: true },\n { parentResourceType: CoreResourceType.APPLICATION, parentFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.APPLICATION], isPrimaryScope: true },\n];\n\n\n// ===============================\n// AUTHENTICATION METHOD DEFINITIONS\n// ===============================\n\n/*\n Authentication Factor Classification\n * Defines when an authentication method can be used in the flow\n /\nexport enum AuthFactorType {\n FIRST_ONLY = 'FIRST_ONLY', // Can only be used as first factor (primary auth)\n SECOND_ONLY = 'SECOND_ONLY', // Can only be used as second factor (MFA)\n FIRST_OR_SECOND = 'FIRST_OR_SECOND', // Can be used as either first or second factor\n ANY = 'ANY' // Can be used in any context (first, second, or standalone)\n}\n\n/\n Authentication Method Categories\n * Separates different types of authentication methods by scope and configuration\n /\nexport enum AuthMethodCategory {\n CREDENTIAL = 'CREDENTIAL', // Password-based credentials\n EXTERNAL_OAUTH2 = 'EXTERNAL_OAUTH2', // Extensible third-party SaaS OAuth2 (application-level)\n ORG_SSO = 'ORG_SSO', // Organization-restricted SSO (SAML/OpenID Connect)\n MFA_TOKEN = 'MFA_TOKEN', // Time-based or generated tokens for MFA\n BIOMETRIC = 'BIOMETRIC' // Modern biometric/passwordless methods\n}\n\n/\n The signing-key purposes an application holds, and the platform-service keys it verifies against.\n \n MOVED HERE FROM `saas-backend-lib` on 2026-09-02. These name identities that CROSS A PROCESS\n * BOUNDARY — the platform issues a token, the application verifies it; the application signs a\n * webhook, an integrator verifies it — and a name that crosses a boundary belongs in the shared\n * package rather than in the runtime on one side of it. The signing and verification MACHINERY did\n * not move; `jwt.backend.schemas.ts` re-exports both so no consumer changed.\n \n It also unblocked attesting `WILDO.IDENTITY.SIGNING_KEY_LIFECYCLE`: the retirement guarantee is\n * per key, and the assurance layer could not name the keys it applies to from a package it must not\n * depend on.\n \n Storage locations (unchanged, and stated here because the names are meaningless without them):\n * - private: `wildo_application_secrets.security.jwt.privateKey[key]`\n * - public: `wildo_application_config.jwt.publicKey[key]`, env `PLATFORM_<SERVICE_NAME>_PUBLIC_KEY`\n /\n/\n `iss` claim on every JWT the application signs, whichever key kind signs it. Receivers of\n * webhooks, workers and platform services pin this value; it is application-wide, not per key.\n /\nexport const APPLICATION_JWT_ISSUER = 'wildo-application' as const;\n\nexport enum JwtPrivateKeys {\n /* Application signing requests to platform services /\n APPLICATION_PLATFORM_REQUEST = 'APPLICATION_PLATFORM_REQUEST',\n /* Application signing requests to worker runtimes /\n APPLICATION_WORKER_REQUEST = 'APPLICATION_WORKER_REQUEST',\n /* Application signing webhooks /\n APPLICATION_WEBHOOK = 'APPLICATION_WEBHOOK',\n /* Application signing auth tokens /\n APPLICATION_AUTH_TOKEN = 'APPLICATION_AUTH_TOKEN',\n}\n\n/\n Platform Service JWT Public Keys\n * \n * Used to verify JWTs from platform services.\n * Public keys are stored in apps-manager env config.\n * Env var pattern: PLATFORM_<SERVICE_NAME>_PUBLIC_KEY\n /\nexport enum JwtPublicKeys {\n /* Platform service: apps-manager - central platform orchestrator /\n PLATFORM_APPS_MANAGER = 'PLATFORM_APPS_MANAGER',\n\n /* Platform service: crontabs-batches-manager - handles scheduled jobs /\n PLATFORM_CRONTABS_BATCHES_MANAGER = 'PLATFORM_CRONTABS_BATCHES_MANAGER',\n}\n\n/\n The OIDC / RFC 7519 protocol + security claim names the ID-token builder OWNS. `extraClaims` (the\n * scope-gated IDENTITY claims from the userinfo/ID-token resolver) must carry ONLY identity claims — these\n * reserved names are stripped BEFORE `extraClaims` is spread, so a same-named entry can never ride into the\n * ID token uncontrolled: a smuggled `nbf` (which would later make the token fail verification), a forged\n * `nonce` / `acr` / `amr` / `at_hash`, or a spoofed `iss` / `aud` / `sub` (the last are already overridden by\n * the server-set claims below — these are the ones the builder does NOT otherwise re-set). ONE named source\n * (closed vocabulary) so the strip list can never drift from the builder's own claim set.\n * semantic-literal-boundary: OIDC Core / RFC 7519 registered claim names.\n * assurance-control: WILDO.IDENTITY.TOKEN_INTEGRITY — an ID token's protocol/security claims are server-authored only.\n /\nexport const OIDC_RESERVED_ID_TOKEN_CLAIM_NAMES: ReadonlySet<string> = new Set([\n // `sid` (OIDC Session Management / Front-Channel & Back-Channel Logout) is SERVER-AUTHORED here — it is\n // the End-User's OP session id the RP-Initiated Logout endpoint keys on (revocation-C). Reserving it bars\n // a client from smuggling its own `sid` via `extraClaims`, exactly like `nonce`/`acr`/`azp` below.\n 'iss', 'sub', 'aud', 'exp', 'nbf', 'iat', 'jti', 'azp', 'nonce', 'auth_time', 'at_hash', 'c_hash', 'acr', 'amr', 'sid',\n]);\n\n/\n @wildo_source:part:start saas.models.auth.methods facet:layer:shared facet:audience:app-developer\n \n Every way a person can prove who they are. An application chooses per USER TYPE which of these are\n * enabled, under `authMethodsEnabled` in the backend-authored config.\n \n Imported from `@wildo-ai/saas-models`.\n \n ## Enabling a method is necessary, and for four of them it is not sufficient\n \n \| method \| may be \| also required before it works \|\n * \|---\|---\|---\|\n * \| `PASSWORD` \| first \| a `passwordPolicy` on the user type \|\n * \| `MAGIC_LINK` \| first \| — \|\n * \| `PASSKEY` \| first or second \| `auth.passkeyConfig` (`rpName`, `rpId`) — the app does not boot without it \|\n * \| `SMS_OTP` \| first or second \| a verified phone number on the account \|\n * \| `TOTP` \| second \| enrolment (authenticator app or backup codes) \|\n * \| `EMAIL_OTP` \| second \| — \|\n * \| `EXTERNAL_OAUTH2` \| any \| a `socialOAuth2Providers` entry (client id + secret reference) AND a declared provider scope \|\n * \| `ORG_SAML` \| first or second \| a connection resource on the organization, AND a Java runtime with the schema-validation helper compiled on every host that serves SAML \|\n * \| `ORG_OPENID_CONNECT` \| first or second \| a connection resource on the organization \|\n \n ## ⚠️ The organization SSO methods are gated by the USER TYPE first\n \n A perfectly configured SSO connection is never offered unless the user type enables `ORG_SAML` /\n * `ORG_OPENID_CONNECT`: the connection lookup only runs when the resolved policy already has the\n * method, so the organization is never consulted. The symptom is a login screen that simply does not\n * show the option, with nothing wrong on the connection and nothing in the logs. Enable the method on\n * the user type BEFORE debugging the connection.\n \n ## Other refusals worth knowing before you pick one\n \n - *`EXTERNAL_OAUTH2` will not link or create an account from a provider that does not report the\n email address as VERIFIED.** That is a refusal, not a warning — a provider whose claim mapping\n * does not surface a verified flag cannot be used for sign-up until the mapping is corrected.\n * - A missing SAML validation helper surfaces as an invalid signature, not as a missing\n * dependency, which sends an operator to the certificate instead of to the host.\n * - A person in an actively directory-managed organization loses every LOCAL first factor, by\n * design, so a credential minted before the directory took over cannot complete a session.\n * `EMAIL_OTP` is deliberately exempt because it is a second factor.\n \n ## ⚠️ Signing IN and signing UP are two different lists\n \n `authMethodsEnabled` decides how an EXISTING account authenticates. It does not create accounts.\n * Public registration is gated separately by `registration.allowedMethods` on the same user type,\n * which defaults to `[PASSWORD]` — so enabling `MAGIC_LINK` for sign-in and expecting people to\n * sign up with it gets a password-only signup and no error.\n \n Only four methods have a public-signup implementation — `PASSWORD`, `EXTERNAL_OAUTH2`,\n * `MAGIC_LINK`, `PASSKEY`. Listing any other (an SSO method, an MFA factor) is refused when the\n * config is built, deliberately: a method advertised to a registrant that the runtime cannot execute\n * fails them AFTER they have committed to it. Open registration also requires the list to be\n * non-empty.\n \n ## Which methods count as a second factor is a separate question\n \n `mfaPolicy` on the user type decides whether a second factor is required and narrows which of these\n * count. The guard that stops somebody removing their last second factor counts passkeys and a\n * verified phone number — it does NOT count `EMAIL_OTP`, so the arithmetic differs from what a person\n * might expect.\n \n Extensible at application level for `EXTERNAL_OAUTH2` providers; the method vocabulary itself is\n * closed.\n /\nexport enum AuthMethod {\n // Credential-based (First factor only)\n PASSWORD = 'PASSWORD',\n\n // Third-party SaaS OAuth2 (Application-level, extensible, any factor)\n EXTERNAL_OAUTH2 = 'EXTERNAL_OAUTH2', // Generic extensible OAuth2 provider\n\n // Organization-restricted SSO (First or second factor)\n ORG_SAML = 'ORG_SAML', // Organization SAML SSO\n ORG_OPENID_CONNECT = 'ORG_OPENID_CONNECT', // Organization OpenID Connect SSO\n\n // Passwordless (First factor only)\n MAGIC_LINK = 'MAGIC_LINK', // Magic Link via email\n\n // MFA tokens (Second factor only, except SMS_OTP which is FIRST_OR_SECOND)\n TOTP = 'TOTP', // Time-based One-Time Password\n SMS_OTP = 'SMS_OTP', // SMS One-Time Password\n EMAIL_OTP = 'EMAIL_OTP', // Email One-Time Password\n\n // Biometric/Modern (First or second factor)\n PASSKEY = 'PASSKEY' // WebAuthn/FIDO2 Passkeys\n}\n/* @wildo_source:part:end saas.models.auth.methods /\n\n/\n Authentication Factor Levels\n /\nexport enum AuthFactor {\n SINGLE = 'SINGLE', // Single factor authentication\n MULTI = 'MULTI' // Multi-factor authentication required\n}\n\n/\n Authentication Factor Level (First or Second Factor)\n /\nexport enum AuthFactorLevel {\n IDENTIFICATION = 'IDENTIFICATION', // Identification only\n FIRST = 'FIRST', // First factor authentication\n SECOND = 'SECOND' // Second factor authentication (MFA)\n}\n\n/\n W4: Next step hint for frontend routing after auth state transitions.\n * Drives UI flow (MFA enrollment, onboarding, email verification, etc.).\n /\nexport enum AuthNextStep {\n MFA_ENROLLMENT = 'mfa_enrollment',\n ONBOARDING = 'onboarding',\n COMPLETE = 'complete',\n EMAIL_VERIFICATION = 'email_verification',\n PASSWORD_CHANGE = 'password_change',\n /\n A password-less public registration completed and a magic link is on its way (#463). Clicking it\n * proves the address and establishes the first session — there is nothing else for the registrant\n * to do, and nothing to authenticate with until they do it.\n /\n MAGIC_LINK_SENT = 'magic_link_sent',\n /\n As {@link MAGIC_LINK_SENT}, and the click leads to enrolling a passkey.\n \n A separate member rather than a flag on the one above, because the client renders different copy\n * from the first screen onward — \"check your email to finish\" versus \"check your email, then set up\n * your passkey\" — and a registrant told the wrong one abandons at the step they were not warned\n * about.\n \n The magic link is not incidental here: a passkey proves possession of an authenticator and says\n * nothing about an address, so a public passkey signup must prove the address some other way, and\n * the link is that proof. It is also, permanently, the recovery path — see the note on\n * `registerUser`.\n /\n PASSKEY_ENROLLMENT = 'passkey_enrollment',\n}\n\n/\n W4.2: Session purpose — drives UI rendering and valid state transitions.\n /\nexport enum AuthSessionPurpose {\n LOGIN = 'login',\n REGISTRATION = 'registration',\n INVITATION = 'invitation',\n REAUTH = 'reauth',\n DEVICE_AUTH = 'device_auth',\n}\n\n/\n W4.6: MFA enrollment lifecycle state on UserCredentials.\n * Computed at user creation and updated on enrollment completion.\n /\nexport enum MfaEnrollmentState {\n NOT_REQUIRED = 'not_required',\n PENDING = 'pending',\n GRACE = 'grace',\n ENROLLED = 'enrolled',\n}\n\n// ===============================\n// AUTHENTICATION METHOD CLASSIFICATION\n// ===============================\n\n/\n Authentication Method Factor Classification Map\n /\nexport const AUTH_METHOD_FACTOR_MAP: Record<AuthMethod, AuthFactorType> = {\n // First factor only - Primary credentials\n [AuthMethod.PASSWORD]: AuthFactorType.FIRST_ONLY,\n\n // First factor only - Passwordless via email\n [AuthMethod.MAGIC_LINK]: AuthFactorType.FIRST_ONLY,\n\n // First factor only - SSO redirect flows are not MFA ceremonies (B-SEC-1)\n [AuthMethod.EXTERNAL_OAUTH2]: AuthFactorType.FIRST_ONLY,\n [AuthMethod.ORG_SAML]: AuthFactorType.FIRST_ONLY,\n [AuthMethod.ORG_OPENID_CONNECT]: AuthFactorType.FIRST_ONLY,\n\n // Second factor only - MFA tokens (except SMS_OTP which can be first or second)\n [AuthMethod.TOTP]: AuthFactorType.SECOND_ONLY,\n [AuthMethod.SMS_OTP]: AuthFactorType.FIRST_OR_SECOND,\n [AuthMethod.EMAIL_OTP]: AuthFactorType.SECOND_ONLY,\n\n // First or second factor - Modern biometric\n [AuthMethod.PASSKEY]: AuthFactorType.FIRST_OR_SECOND\n};\n\n/\n Authentication Method Category Map\n /\nexport const AUTH_METHOD_CATEGORY_MAP: Record<AuthMethod, AuthMethodCategory> = {\n [AuthMethod.PASSWORD]: AuthMethodCategory.CREDENTIAL,\n [AuthMethod.MAGIC_LINK]: AuthMethodCategory.CREDENTIAL,\n [AuthMethod.EXTERNAL_OAUTH2]: AuthMethodCategory.EXTERNAL_OAUTH2,\n [AuthMethod.ORG_SAML]: AuthMethodCategory.ORG_SSO,\n [AuthMethod.ORG_OPENID_CONNECT]: AuthMethodCategory.ORG_SSO,\n [AuthMethod.TOTP]: AuthMethodCategory.MFA_TOKEN,\n [AuthMethod.SMS_OTP]: AuthMethodCategory.MFA_TOKEN,\n [AuthMethod.EMAIL_OTP]: AuthMethodCategory.MFA_TOKEN,\n [AuthMethod.PASSKEY]: AuthMethodCategory.BIOMETRIC\n};\n\n/\n Scope type for auth policies — organization-level vs application-level.\n \n Declared before the browser-safe available-method schema because that schema\n * evaluates this enum at module initialization time.\n /\nexport enum AuthScopeType {\n ORGANIZATION = 'organization',\n APPLICATION = 'application',\n}\n\n/\n Public, browser-safe configuration attached to an available auth method.\n \n The fields span passkey and enterprise-SSO methods, but every field is named\n * and typed: this cross-layer contract must never collapse back to\n * `Record<string, any>`, which previously forced frontend assertions for the\n * tenant scope and connection identity.\n /\nexport const AvailableMethodConfigSchema = z.object({\n rpName: z.string().optional(),\n rpId: z.string().optional(),\n displayName: z.string().optional(),\n providerRef: z.string().optional(),\n connectionId: z.string().optional(),\n scopeType: z.enum(AuthScopeType).optional(),\n scopeId: z.string().optional(),\n loginUrl: z.string().optional(),\n});\n\nexport type AvailableMethodConfig = z.infer<typeof AvailableMethodConfigSchema>;\n\nexport const AvailableMethodSchema = z.object({\n method: z.enum(AuthMethod),\n factorType: z.enum(AuthFactorType),\n category: z.enum(AuthMethodCategory),\n canBeFirstFactor: z.boolean(),\n canBeSecondFactor: z.boolean(),\n required: z.boolean(),\n\n // Provider-specific information\n oauth2ProviderRefs: z.array(z.string()).optional(), // For third-party OAuth2\n ssoIds: z.array(z.string()).optional(), // For organization SSO\n organizationRestricted: z.boolean().default(false),\n\n // Integration capabilities\n supportsIntegrations: z.boolean().default(false),\n availableIntegrations: z.array(z.string()).default([]).optional(),\n\n // Public configuration\n config: AvailableMethodConfigSchema.optional()\n});\n\n\nexport type AvailableMethod = z.infer<typeof AvailableMethodSchema>;\n\n// ===============================\n// CROSS-LAYER CONSTANTS\n// ===============================\n\n/\n Error codes used in redirect query params (backend → frontend).\n * Backend appends `?error=<code>` to redirect URLs; frontend reads and displays.\n /\nexport enum AuthRedirectErrorCode {\n SAML_LOGIN_FAILED = 'saml_login_failed',\n SAML_AUTH_FAILED = 'saml_auth_failed',\n SAML_SLO_FAILED = 'saml_slo_failed',\n MISSING_PARAMS = 'missing_params',\n OAUTH_FAILED = 'oauth_failed',\n}\n\n/\n Ownership class of an external authentication connection.\n \n This is intentionally independent from {@link AuthScopeType}: a social\n * connection has no enterprise tenant scope, while an enterprise connection\n * must carry one.\n /\nexport enum SsoConnectionType {\n SOCIAL = 'social',\n ENTERPRISE = 'enterprise',\n}\n\n/\n Mechanism that established an external identity.\n \n This is wider than the SSO protocol vocabulary because SCIM establishes and\n * maintains identity links without being an interactive SSO protocol.\n */\nexport enum ExternalIdentitySource {\n OAUTH2 = 'oauth2',\n OIDC = 'oidc',\n SAML = 'saml',\n SCIM = 'scim',\n}\n"]}
1	+ {"version":3,"file":"authentication.shared.schemas.js","sourceRoot":"","sources":["../../../../../src/security/authentications/authentication.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,gBAAgB,EAAE,kCAAkC,EAAE,MAAM,mDAAmD,CAAC;AAGzH;;;;;;;GAOG;AAGH,MAAM,CAAC,MAAM,mBAAmB,GAAmC;IACjE,EAAE,kBAAkB,EAAE,gBAAgB,CAAC,aAAa,EAAE,qBAAqB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,cAAc,EAAE,IAAI,EAAE;IACvK,EAAE,kBAAkB,EAAE,gBAAgB,CAAC,WAAW,EAAI,qBAAqB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAI,cAAc,EAAE,IAAI,EAAE;CACxK,CAAC;AAGF,kCAAkC;AAClC,oCAAoC;AACpC,kCAAkC;AAElC;;;GAGG;AACH,MAAM,CAAN,IAAY,cAKX;AALD,WAAY,cAAc;IACxB,2CAAyB,CAAA;IACzB,6CAA2B,CAAA;IAC3B,qDAAmC,CAAA;IACnC,6BAAW,CAAA,CAAsB,4DAA4D;AAC/F,CAAC,EALW,cAAc,KAAd,cAAc,QAKzB;AAED;;;GAGG;AACH,MAAM,CAAN,IAAY,kBAMX;AAND,WAAY,kBAAkB;IAC5B,+CAAyB,CAAA;IACzB,yDAAmC,CAAA;IACnC,yCAAmB,CAAA;IACnB,6CAAuB,CAAA;IACvB,6CAAuB,CAAA,CAAa,wCAAwC;AAC9E,CAAC,EANW,kBAAkB,KAAlB,kBAAkB,QAM7B;AAED;;;;;;;;;;;;;;;;GAgBG;AACH;;;GAGG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,mBAA4B,CAAC;AAEnE,MAAM,CAAN,IAAY,cASX;AATD,WAAY,cAAc;IACtB,wDAAwD;IACxD,+EAA6D,CAAA;IAC7D,sDAAsD;IACtD,2EAAyD,CAAA;IACzD,mCAAmC;IACnC,6DAA2C,CAAA;IAC3C,sCAAsC;IACtC,mEAAiD,CAAA;AACrD,CAAC,EATW,cAAc,KAAd,cAAc,QASzB;AAED;;;;;;GAMG;AACH,MAAM,CAAN,IAAY,aAMX;AAND,WAAY,aAAa;IACrB,qEAAqE;IACrE,gEAA+C,CAAA;IAE/C,0EAA0E;IAC1E,wFAAuE,CAAA;AAC3E,CAAC,EANW,aAAa,KAAb,aAAa,QAMxB;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,kCAAkC,GAAwB,IAAI,GAAG,CAAC;IAC7E,wGAAwG;IACxG,0GAA0G;IAC1G,mGAAmG;IACnG,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK;CACvH,CAAC,CAAC;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+EG;AACH,MAAM,CAAN,IAAY,UAqBX;AArBD,WAAY,UAAU;IACpB,uCAAuC;IACvC,mCAAqB,CAAA;IAErB,sEAAsE;IACtE,iDAAmC,CAAA;IAEnC,uDAAuD;IACvD,mCAAqB,CAAA;IACrB,uDAAyC,CAAA;IAEzC,mCAAmC;IACnC,uCAAyB,CAAA;IAEzB,2EAA2E;IAC3E,2BAAa,CAAA;IACb,iCAAmB,CAAA;IACnB,qCAAuB,CAAA;IAEvB,4CAA4C;IAC5C,iCAAmB,CAAA,CAAc,0BAA0B;AAC7D,CAAC,EArBW,UAAU,KAAV,UAAU,QAqBrB;AACD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAAkB;IACrD,OAAO,oBAAoB,CAAC,MAAM,CAAC,CAAC,OAAO,KAAK,gBAAgB,CAAC,KAAK,CAAC;AACzE,CAAC;AACD,sDAAsD;AAEtD;;GAEG;AACH,MAAM,CAAN,IAAY,UAGX;AAHD,WAAY,UAAU;IACpB,+BAAiB,CAAA;IACjB,6BAAe,CAAA,CAAU,uCAAuC;AAClE,CAAC,EAHW,UAAU,KAAV,UAAU,QAGrB;AAED;;GAEG;AACH,MAAM,CAAN,IAAY,eAIX;AAJD,WAAY,eAAe;IACzB,oDAAiC,CAAA;IACjC,kCAAe,CAAA;IACf,oCAAiB,CAAA,CAAQ,qCAAqC;AAChE,CAAC,EAJW,eAAe,KAAf,eAAe,QAI1B;AAED;;;GAGG;AACH,MAAM,CAAN,IAAY,YAgCX;AAhCD,WAAY,YAAY;IACtB,iDAAiC,CAAA;IACjC,yCAAyB,CAAA;IACzB,qCAAqB,CAAA;IACrB,yDAAyC,CAAA;IACzC,mDAAmC,CAAA;IACnC;;;;OAIG;IACH,mDAAmC,CAAA;IACnC;;;;;;;;;;;;OAYG;IACH,yDAAyC,CAAA;IACzC;;;;OAIG;IACH,qDAAqC,CAAA;AACvC,CAAC,EAhCW,YAAY,KAAZ,YAAY,QAgCvB;AAED;;;;;;;;GAQG;AACH,MAAM,CAAN,IAAY,uBAGX;AAHD,WAAY,uBAAuB;IACjC,8CAAmB,CAAA;IACnB,oEAAyC,CAAA;AAC3C,CAAC,EAHW,uBAAuB,KAAvB,uBAAuB,QAGlC;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,mCAAmC,GAAG,uBAAuB,CAAC;AAsB3E;;GAEG;AACH,MAAM,CAAN,IAAY,kBAMX;AAND,WAAY,kBAAkB;IAC5B,qCAAe,CAAA;IACf,mDAA6B,CAAA;IAC7B,+CAAyB,CAAA;IACzB,uCAAiB,CAAA;IACjB,iDAA2B,CAAA;AAC7B,CAAC,EANW,kBAAkB,KAAlB,kBAAkB,QAM7B;AAED;;;GAGG;AACH,MAAM,CAAN,IAAY,kBAKX;AALD,WAAY,kBAAkB;IAC5B,mDAA6B,CAAA;IAC7B,yCAAmB,CAAA;IACnB,qCAAe,CAAA;IACf,2CAAqB,CAAA;AACvB,CAAC,EALW,kBAAkB,KAAlB,kBAAkB,QAK7B;AAED,kCAAkC;AAClC,uCAAuC;AACvC,kCAAkC;AAElC;;;;;;;;;;;;GAYG;AAEH;;GAEG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAuC;IACxE,0CAA0C;IAC1C,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,cAAc,CAAC,UAAU;IAEhD,6CAA6C;IAC7C,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,cAAc,CAAC,UAAU;IAElD,0EAA0E;IAC1E,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,cAAc,CAAC,UAAU;IACvD,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,cAAc,CAAC,UAAU;IAChD,CAAC,UAAU,CAAC,kBAAkB,CAAC,EAAE,cAAc,CAAC,UAAU;IAE1D,gFAAgF;IAChF,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,cAAc,CAAC,WAAW;IAC7C,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,cAAc,CAAC,eAAe;IACpD,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,cAAc,CAAC,WAAW;IAElD,4CAA4C;IAC5C,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,cAAc,CAAC,eAAe;CACrD,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAA0B;IAC3D,UAAU,CAAC,QAAQ;IACnB,UAAU,CAAC,kBAAkB;IAC7B,UAAU,CAAC,QAAQ;IACnB,UAAU,CAAC,OAAO;IAClB,UAAU,CAAC,UAAU;IACrB,UAAU,CAAC,eAAe;IAC1B,UAAU,CAAC,IAAI;IACf,UAAU,CAAC,OAAO;IAClB,UAAU,CAAC,SAAS;CACZ,CAAC;AAEX;;GAEG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAA2C;IAC9E,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,kBAAkB,CAAC,UAAU;IACpD,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,kBAAkB,CAAC,UAAU;IACtD,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,kBAAkB,CAAC,eAAe;IAChE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,kBAAkB,CAAC,OAAO;IACjD,CAAC,UAAU,CAAC,kBAAkB,CAAC,EAAE,kBAAkB,CAAC,OAAO;IAC3D,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,kBAAkB,CAAC,SAAS;IAC/C,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,kBAAkB,CAAC,SAAS;IAClD,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,kBAAkB,CAAC,SAAS;IACpD,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,kBAAkB,CAAC,SAAS;CACnD,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,CAAN,IAAY,kBASX;AATD,WAAY,kBAAkB;IAC5B,0BAA0B;IAC1B,6CAAuB,CAAA;IACvB,0BAA0B;IAC1B,+CAAyB,CAAA;IACzB,yBAAyB;IACzB,6CAAuB,CAAA;IACvB,+DAA+D;IAC/D,6CAAuB,CAAA;AACzB,CAAC,EATW,kBAAkB,KAAlB,kBAAkB,QAS7B;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAN,IAAY,gBAWX;AAXD,WAAY,gBAAgB;IAC1B,8DAA8D;IAC9D,iCAAa,CAAA;IACb,8BAA8B;IAC9B,mCAAe,CAAA;IACf,4DAA4D;IAC5D,iCAAa,CAAA;IACb,yEAAyE;IACzE,+DAA2C,CAAA;IAC3C,yDAAyD;IACzD,2CAAuB,CAAA;AACzB,CAAC,EAXW,gBAAgB,KAAhB,gBAAgB,QAW3B;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAN,IAAY,6BAKX;AALD,WAAY,6BAA6B;IACvC,yCAAyC;IACzC,gDAAe,CAAA;IACf,2FAA2F;IAC3F,0EAAyC,CAAA;AAC3C,CAAC,EALW,6BAA6B,KAA7B,6BAA6B,QAKxC;AAwBD;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAA2C;IAC1E,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE;QACrB,cAAc,EAAE,kBAAkB,CAAC,SAAS;QAC5C,OAAO,EAAE,gBAAgB,CAAC,IAAI;QAC9B,iBAAiB,EAAE,KAAK;QACxB,yBAAyB,EAAE,6BAA6B,CAAC,KAAK;KAC/D;IACD,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE;QACvB,cAAc,EAAE,kBAAkB,CAAC,UAAU;QAC7C,OAAO,EAAE,gBAAgB,CAAC,KAAK;QAC/B,iBAAiB,EAAE,KAAK;QACxB,yBAAyB,EAAE,6BAA6B,CAAC,KAAK;KAC/D;IACD,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE;QACtB,cAAc,EAAE,kBAAkB,CAAC,UAAU;QAC7C,OAAO,EAAE,gBAAgB,CAAC,KAAK;QAC/B,iBAAiB,EAAE,KAAK;QACxB,yBAAyB,EAAE,6BAA6B,CAAC,KAAK;KAC/D;IACD,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE;QACpB,cAAc,EAAE,kBAAkB,CAAC,UAAU;QAC7C,OAAO,EAAE,gBAAgB,CAAC,IAAI;QAC9B,iBAAiB,EAAE,KAAK;QACxB,yBAAyB,EAAE,6BAA6B,CAAC,KAAK;KAC/D;IACD,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE;QACjB,cAAc,EAAE,kBAAkB,CAAC,UAAU;QAC7C,OAAO,EAAE,gBAAgB,CAAC,IAAI;QAC9B,iBAAiB,EAAE,KAAK;QACxB,yBAAyB,EAAE,6BAA6B,CAAC,KAAK;KAC/D;IACD,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE;QACpB,cAAc,EAAE,kBAAkB,CAAC,UAAU;QAC7C,OAAO,EAAE,gBAAgB,CAAC,mBAAmB;QAC7C,iBAAiB,EAAE,IAAI;QACvB,yBAAyB,EAAE,6BAA6B,CAAC,kBAAkB;KAC5E;IACD,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE;QAC5B,cAAc,EAAE,kBAAkB,CAAC,SAAS;QAC5C,OAAO,EAAE,gBAAgB,CAAC,SAAS;QACnC,iBAAiB,EAAE,KAAK;QACxB,yBAAyB,EAAE,6BAA6B,CAAC,KAAK;KAC/D;IACD,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE;QACrB,cAAc,EAAE,kBAAkB,CAAC,SAAS;QAC5C,OAAO,EAAE,gBAAgB,CAAC,SAAS;QACnC,iBAAiB,EAAE,KAAK;QACxB,yBAAyB,EAAE,6BAA6B,CAAC,KAAK;KAC/D;IACD,CAAC,UAAU,CAAC,kBAAkB,CAAC,EAAE;QAC/B,cAAc,EAAE,kBAAkB,CAAC,SAAS;QAC5C,OAAO,EAAE,gBAAgB,CAAC,SAAS;QACnC,iBAAiB,EAAE,KAAK;QACxB,yBAAyB,EAAE,6BAA6B,CAAC,KAAK;KAC/D;CACF,CAAC;AAEF;;;;;;;;;;GAUG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAAiB,EAAE,MAAkB;IACtE,MAAM,YAAY,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC;IACzD,IAAI,YAAY,KAAK,gBAAgB,CAAC,IAAI,EAAE,CAAC;QAC3C,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,YAAY,KAAK,oBAAoB,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC;AAC/D,CAAC;AACD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,MAAM,CAAC,MAAM,eAAe,GAA0C;IACpE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC,KAAK,CAAC;IAC9B,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC;IAC1B,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC;IACpC,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC;IACtC,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC,KAAK,CAAC;IAChC,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC,MAAM,CAAC;IAC9B,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,EAAE;IAChC,CAAC,UAAU,CAAC,kBAAkB,CAAC,EAAE,EAAE;IACnC,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,EAAE;CAC1B,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,UAAU,oCAAoC,CAClD,gBAAuC,EACvC,QAA4C;IAE5C,MAAM,MAAM,GAAG,IAAI,GAAG,EAAU,CAAC;IACjC,KAAK,MAAM,MAAM,IAAI,gBAAgB,EAAE,CAAC;QACtC,KAAK,MAAM,KAAK,IAAI,eAAe,CAAC,MAAM,CAAC,IAAI,EAAE;YAAE,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACvE,CAAC;IAED,MAAM,mBAAmB,GAAG,gBAAgB,CAAC,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,QAAQ,EAAE,mBAAmB,KAAK,IAAI,CAAC;IACpH,MAAM,eAAe,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAC7D,gBAAgB,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,kBAAkB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;IAC1F,IAAI,mBAAmB,IAAI,eAAe;QAAE,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAE9D,mGAAmG;IACnG,6FAA6F;IAC7F,OAAO,CAAC,GAAG,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;AAC5B,CAAC;AAED,sDAAsD;AAEtD;;;;;GAKG;AACH,MAAM,CAAN,IAAY,aAGX;AAHD,WAAY,aAAa;IACvB,8CAA6B,CAAA;IAC7B,4CAA2B,CAAA;AAC7B,CAAC,EAHW,aAAa,KAAb,aAAa,QAGxB;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;IAClD,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACnC,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,QAAQ,EAAE;IAC3C,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC9B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAChC,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC;IAC1B,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC;IAClC,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC;IACpC,gBAAgB,EAAE,CAAC,CAAC,OAAO,EAAE;IAC7B,iBAAiB,EAAE,CAAC,CAAC,OAAO,EAAE;IAE9B;;;;;;;;;OASG;IACH,mBAAmB,EAAE,CAAC,CAAC,OAAO,EAAE;IAEhC;;;;;;;;;;;;;;;;;;OAkBG;IACH,6BAA6B,EAAE,CAAC,CAAC,OAAO,EAAE;IAE1C,gCAAgC;IAChC,kBAAkB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,EAAE,yBAAyB;IAC7E,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,EAAE,uBAAuB;IAC/D,sBAAsB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAElD,2BAA2B;IAC3B,oBAAoB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAChD,qBAAqB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;IAEjE,uBAAuB;IACvB,MAAM,EAAE,2BAA2B,CAAC,QAAQ,EAAE;CAC/C,CAAC,CAAC;AAKH,kCAAkC;AAClC,wBAAwB;AACxB,kCAAkC;AAElC;;;GAGG;AACH,MAAM,CAAN,IAAY,qBAMX;AAND,WAAY,qBAAqB;IAC/B,gEAAuC,CAAA;IACvC,8DAAqC,CAAA;IACrC,4DAAmC,CAAA;IACnC,0DAAiC,CAAA;IACjC,sDAA6B,CAAA;AAC/B,CAAC,EANW,qBAAqB,KAArB,qBAAqB,QAMhC;AAED;;;;;;GAMG;AACH,MAAM,CAAN,IAAY,iBAGX;AAHD,WAAY,iBAAiB;IAC3B,sCAAiB,CAAA;IACjB,8CAAyB,CAAA;AAC3B,CAAC,EAHW,iBAAiB,KAAjB,iBAAiB,QAG5B;AAED;;;;;GAKG;AACH,MAAM,CAAN,IAAY,sBAKX;AALD,WAAY,sBAAsB;IAChC,2CAAiB,CAAA;IACjB,uCAAa,CAAA;IACb,uCAAa,CAAA;IACb,uCAAa,CAAA;AACf,CAAC,EALW,sBAAsB,KAAtB,sBAAsB,QAKjC","sourcesContent":["/*\n Authentication Shared Schemas\n \n Core authentication schemas shared between frontend and backend\n /\n\nimport { z } from 'zod';\n\nimport { CoreResourceType, coreResourceShared_FieldIdentifier } from '../../resources/resources.shared.core.definitions';\nimport type { PolymorphicVariantDefinition } from '../../resources/utils/resource-polymorphism.schemas';\n\n/\n Auth Scope Variants (Shared)\n \n The 2 auth scope variants — shared across all auth polymorphic resources\n * (SsoConfig, SsoConnection, SiemExportConfig, SiemDeliveryDlq,\n * ScimTokens, ScimProvisioningConfig).\n \n /\n\n\nexport const AUTH_SCOPE_VARIANTS: PolymorphicVariantDefinition[] = [\n { parentResourceType: CoreResourceType.ORGANIZATIONS, parentFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.ORGANIZATIONS], isPrimaryScope: true },\n { parentResourceType: CoreResourceType.APPLICATION, parentFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.APPLICATION], isPrimaryScope: true },\n];\n\n\n// ===============================\n// AUTHENTICATION METHOD DEFINITIONS\n// ===============================\n\n/*\n Authentication Factor Classification\n * Defines when an authentication method can be used in the flow\n /\nexport enum AuthFactorType {\n FIRST_ONLY = 'FIRST_ONLY', // Can only be used as first factor (primary auth)\n SECOND_ONLY = 'SECOND_ONLY', // Can only be used as second factor (MFA)\n FIRST_OR_SECOND = 'FIRST_OR_SECOND', // Can be used as either first or second factor\n ANY = 'ANY' // Can be used in any context (first, second, or standalone)\n}\n\n/\n Authentication Method Categories\n * Separates different types of authentication methods by scope and configuration\n /\nexport enum AuthMethodCategory {\n CREDENTIAL = 'CREDENTIAL', // Password-based credentials\n EXTERNAL_OAUTH2 = 'EXTERNAL_OAUTH2', // Extensible third-party SaaS OAuth2 (application-level)\n ORG_SSO = 'ORG_SSO', // Organization-restricted SSO (SAML/OpenID Connect)\n MFA_TOKEN = 'MFA_TOKEN', // Time-based or generated tokens for MFA\n BIOMETRIC = 'BIOMETRIC' // Modern biometric/passwordless methods\n}\n\n/\n The signing-key purposes an application holds, and the platform-service keys it verifies against.\n \n MOVED HERE FROM `saas-backend-lib` on 2026-09-02. These name identities that CROSS A PROCESS\n * BOUNDARY — the platform issues a token, the application verifies it; the application signs a\n * webhook, an integrator verifies it — and a name that crosses a boundary belongs in the shared\n * package rather than in the runtime on one side of it. The signing and verification MACHINERY did\n * not move; `jwt.backend.schemas.ts` re-exports both so no consumer changed.\n \n It also unblocked attesting `WILDO.IDENTITY.SIGNING_KEY_LIFECYCLE`: the retirement guarantee is\n * per key, and the assurance layer could not name the keys it applies to from a package it must not\n * depend on.\n \n Storage locations (unchanged, and stated here because the names are meaningless without them):\n * - private: `wildo_application_secrets.security.jwt.privateKey[key]`\n * - public: `wildo_application_config.jwt.publicKey[key]`, env `PLATFORM_<SERVICE_NAME>_PUBLIC_KEY`\n /\n/\n `iss` claim on every JWT the application signs, whichever key kind signs it. Receivers of\n * webhooks, workers and platform services pin this value; it is application-wide, not per key.\n /\nexport const APPLICATION_JWT_ISSUER = 'wildo-application' as const;\n\nexport enum JwtPrivateKeys {\n /* Application signing requests to platform services /\n APPLICATION_PLATFORM_REQUEST = 'APPLICATION_PLATFORM_REQUEST',\n /* Application signing requests to worker runtimes /\n APPLICATION_WORKER_REQUEST = 'APPLICATION_WORKER_REQUEST',\n /* Application signing webhooks /\n APPLICATION_WEBHOOK = 'APPLICATION_WEBHOOK',\n /* Application signing auth tokens /\n APPLICATION_AUTH_TOKEN = 'APPLICATION_AUTH_TOKEN',\n}\n\n/\n Platform Service JWT Public Keys\n * \n * Used to verify JWTs from platform services.\n * Public keys are stored in apps-manager env config.\n * Env var pattern: PLATFORM_<SERVICE_NAME>_PUBLIC_KEY\n /\nexport enum JwtPublicKeys {\n /* Platform service: apps-manager - central platform orchestrator /\n PLATFORM_APPS_MANAGER = 'PLATFORM_APPS_MANAGER',\n\n /* Platform service: crontabs-batches-manager - handles scheduled jobs /\n PLATFORM_CRONTABS_BATCHES_MANAGER = 'PLATFORM_CRONTABS_BATCHES_MANAGER',\n}\n\n/\n The OIDC / RFC 7519 protocol + security claim names the ID-token builder OWNS. `extraClaims` (the\n * scope-gated IDENTITY claims from the userinfo/ID-token resolver) must carry ONLY identity claims — these\n * reserved names are stripped BEFORE `extraClaims` is spread, so a same-named entry can never ride into the\n * ID token uncontrolled: a smuggled `nbf` (which would later make the token fail verification), a forged\n * `nonce` / `acr` / `amr` / `at_hash`, or a spoofed `iss` / `aud` / `sub` (the last are already overridden by\n * the server-set claims below — these are the ones the builder does NOT otherwise re-set). ONE named source\n * (closed vocabulary) so the strip list can never drift from the builder's own claim set.\n * semantic-literal-boundary: OIDC Core / RFC 7519 registered claim names.\n * assurance-control: WILDO.IDENTITY.TOKEN_INTEGRITY — an ID token's protocol/security claims are server-authored only.\n /\nexport const OIDC_RESERVED_ID_TOKEN_CLAIM_NAMES: ReadonlySet<string> = new Set([\n // `sid` (OIDC Session Management / Front-Channel & Back-Channel Logout) is SERVER-AUTHORED here — it is\n // the End-User's OP session id the RP-Initiated Logout endpoint keys on (revocation-C). Reserving it bars\n // a client from smuggling its own `sid` via `extraClaims`, exactly like `nonce`/`acr`/`azp` below.\n 'iss', 'sub', 'aud', 'exp', 'nbf', 'iat', 'jti', 'azp', 'nonce', 'auth_time', 'at_hash', 'c_hash', 'acr', 'amr', 'sid',\n]);\n\n/\n @wildo_source:part:start saas.models.auth.methods facet:layer:shared facet:audience:app-developer\n \n Every way a person can prove who they are. An application chooses per USER TYPE which of these are\n * enabled, under `authMethodsEnabled` in the backend-authored config.\n \n Imported from `@wildo-ai/saas-models`.\n \n ## Enabling a method is necessary, and for four of them it is not sufficient\n \n \| method \| may be \| also required before it works \|\n * \|---\|---\|---\|\n * \| `PASSWORD` \| first \| a `passwordPolicy` on the user type \|\n * \| `MAGIC_LINK` \| first \| — \|\n * \| `PASSKEY` \| first or second \| `auth.passkeyConfig` (`rpName`, `rpId`) — the app does not boot without it \|\n * \| `SMS_OTP` \| first or second \| a verified phone number on the account \|\n * \| `TOTP` \| second \| enrolment (authenticator app or backup codes) \|\n * \| `EMAIL_OTP` \| second \| — \|\n * \| `EXTERNAL_OAUTH2` \| any \| a `socialOAuth2Providers` entry (client id + secret reference) AND a declared provider scope \|\n * \| `ORG_SAML` \| first or second \| a connection resource on the organization, AND a Java runtime with the schema-validation helper compiled on every host that serves SAML \|\n * \| `ORG_OPENID_CONNECT` \| first or second \| a connection resource on the organization \|\n \n ## Passkeys sign in without an email, and several accounts can share one device\n \n Enabling `PASSKEY` gives the sign-in screen two username-less entries on top of the passkey method\n * shown after an email: passkey AUTOFILL on the email field, and a \"Sign in with a passkey\" button. The\n * device lists every account the person holds a passkey for on this site, and the account that signs\n * in is the one the chosen passkey belongs to — whatever email, if any, was typed.\n \n - Every passkey is a discoverable credential. There is no setting to turn this off: sign-in\n * names no account to the device, so the device must be able to offer the account itself.\n * - The sign-in options are identical for every email, so they never reveal whether an account\n * exists or holds a passkey.\n * - A signed-in account is held to the same rules as a typed email: the frontend must be allowed\n * to sign in that account's user type, and an organization that restricts its domain to SSO refuses\n * a passkey sign-in exactly as it refuses a password.\n * - Re-authentication does not offer the username-less entries — a re-proof must be the same person.\n \n ## Organization SSO also requires an enabled method in the effective policy\n \n A configured connection alone does not enable `ORG_SAML` / `ORG_OPENID_CONNECT`. Check the user\n * type's methods and the application's `auth.orgAuthMethodPolicy`: RESTRICT_ONLY intersects,\n * EXPAND_WITHIN_SET permits additions from `auth.expandableOrgMethods`, and UNRESTRICTED uses the\n * organization's set. Explicit organization method overrides intersect across memberships.\n * Login-method expansion does not weaken the separate MFA, password or step-up requirements.\n \n ## Other refusals worth knowing before you pick one\n \n - *`EXTERNAL_OAUTH2` will not automatically link by email or create an account from a provider that does not report the\n email address as VERIFIED.** That is a refusal, not a warning — a provider whose claim mapping\n * does not surface a verified flag cannot be used for sign-up until the mapping is corrected.\n * - A missing SAML validation helper surfaces as an invalid signature, not as a missing\n * dependency, which sends an operator to the certificate instead of to the host.\n * - A person in an actively directory-managed organization loses every LOCAL first factor, by\n * design, so a credential minted before the directory took over cannot complete a session.\n * `EMAIL_OTP` is deliberately exempt because it is a second factor.\n \n ## ⚠️ Signing IN and signing UP are two different lists\n \n `authMethodsEnabled` decides how an EXISTING account authenticates. It does not create accounts.\n * Public registration is gated separately by `registration.allowedMethods` on the same user type,\n * which defaults to `[PASSWORD]` — so enabling `MAGIC_LINK` for sign-in and expecting people to\n * sign up with it gets a password-only signup and no error.\n \n Only four methods have a public-signup implementation — `PASSWORD`, `EXTERNAL_OAUTH2`,\n * `MAGIC_LINK`, `PASSKEY`. Listing any other (an SSO method, an MFA factor) is refused when the\n * config is built, deliberately: a method advertised to a registrant that the runtime cannot execute\n * fails them AFTER they have committed to it. Open registration also requires the list to be\n * non-empty.\n \n ## Which methods count as a second factor is a separate question\n \n `mfaPolicy` on the user type decides whether a second factor is required and narrows which of these\n * count. The guard that stops somebody removing their last second factor counts passkeys and a\n * verified phone number — it does NOT count `EMAIL_OTP`, so the arithmetic differs from what a person\n * might expect.\n \n Extensible at application level for `EXTERNAL_OAUTH2` providers; the method vocabulary itself is\n * closed.\n /\nexport enum AuthMethod {\n // Credential-based (First factor only)\n PASSWORD = 'PASSWORD',\n\n // Third-party SaaS OAuth2 (Application-level, extensible, any factor)\n EXTERNAL_OAUTH2 = 'EXTERNAL_OAUTH2', // Generic extensible OAuth2 provider\n\n // Organization-restricted SSO (First or second factor)\n ORG_SAML = 'ORG_SAML', // Organization SAML SSO\n ORG_OPENID_CONNECT = 'ORG_OPENID_CONNECT', // Organization OpenID Connect SSO\n\n // Passwordless (First factor only)\n MAGIC_LINK = 'MAGIC_LINK', // Magic Link via email\n\n // MFA tokens (Second factor only, except SMS_OTP which is FIRST_OR_SECOND)\n TOTP = 'TOTP', // Time-based One-Time Password\n SMS_OTP = 'SMS_OTP', // SMS One-Time Password\n EMAIL_OTP = 'EMAIL_OTP', // Email One-Time Password\n\n // Biometric/Modern (First or second factor)\n PASSKEY = 'PASSKEY' // WebAuthn/FIDO2 Passkeys\n}\n/\n Is this method strong enough for a policy that demands a STRONG second factor?\n \n Derived from the method's own channel rather than from a hand-kept weak list: a second factor\n * delivered to an email address is excluded, because email is not an acceptable channel for\n * out-of-band authentication at all — \"Email SHALL NOT be used for out-of-band authentication because\n * it may be vulnerable to: Access using only a password; Interception in transit or at intermediate\n * mail servers; Rerouting attacks\".\n \n spec-cite: NIST SP 800-63B-4 §3.1.3.1 \"Out-of-Band Authenticators\"\n * (https://pages.nist.gov/800-63-4/sp800-63b.html).\n \n This reproduces the set the previous rule produced, and that is deliberate. `requireStrongMFA`\n * used to be expressed as \"drop the factors that need no enrolment\", which removed `EMAIL_OTP`\n * because an address the account already proved needs no setup. That reasoning is sound and it was\n * reaching the right answer by a property that only coincides with the one it meant — a second\n * always-available factor on another channel would have been excluded for no reason, and a weak\n * factor that DID need enrolment would have passed. Deriving from the channel says the thing itself.\n \n What it deliberately does NOT change: `SMS_OTP` stays strong. NIST classes PSTN out-of-band as\n * the one RESTRICTED authenticator (§3.2.9) — permitted, with an obligation to offer an unrestricted\n * alternative — rather than as a prohibited channel, and promoting \"restricted\" to \"not strong\" is a\n * posture decision an application should make, not one this predicate should make for it.\n /\nexport function isStrongSecondFactor(method: AuthMethod): boolean {\n return AUTH_METHOD_EVIDENCE[method].channel !== AuthProofChannel.EMAIL;\n}\n/* @wildo_source:part:end saas.models.auth.methods /\n\n/\n Authentication Factor Levels\n /\nexport enum AuthFactor {\n SINGLE = 'SINGLE', // Single factor authentication\n MULTI = 'MULTI' // Multi-factor authentication required\n}\n\n/\n Authentication Factor Level (First or Second Factor)\n /\nexport enum AuthFactorLevel {\n IDENTIFICATION = 'IDENTIFICATION', // Identification only\n FIRST = 'FIRST', // First factor authentication\n SECOND = 'SECOND' // Second factor authentication (MFA)\n}\n\n/\n W4: Next step hint for frontend routing after auth state transitions.\n * Drives UI flow (MFA enrollment, onboarding, email verification, etc.).\n /\nexport enum AuthNextStep {\n MFA_ENROLLMENT = 'mfa_enrollment',\n ONBOARDING = 'onboarding',\n COMPLETE = 'complete',\n EMAIL_VERIFICATION = 'email_verification',\n PASSWORD_CHANGE = 'password_change',\n /\n A password-less public registration completed and a magic link is on its way (#463). Clicking it\n * proves the address and establishes the first session — there is nothing else for the registrant\n * to do, and nothing to authenticate with until they do it.\n /\n MAGIC_LINK_SENT = 'magic_link_sent',\n /\n As {@link MAGIC_LINK_SENT}, and the click leads to enrolling a passkey.\n \n A separate member rather than a flag on the one above, because the client renders different copy\n * from the first screen onward — \"check your email to finish\" versus \"check your email, then set up\n * your passkey\" — and a registrant told the wrong one abandons at the step they were not warned\n * about.\n \n The magic link is not incidental here: a passkey proves possession of an authenticator and says\n * nothing about an address, so a public passkey signup must prove the address some other way, and\n * the link is that proof. It is also, permanently, the recovery path — see the note on\n * `registerUser`.\n /\n PASSKEY_ENROLLMENT = 'passkey_enrollment',\n /\n An invitation was accepted and no session was issued (#1158). The user's effective policy disables the sign-in the\n * invitation link amounts to (possession of the email address), so they continue on the sign-in page with a method\n * their policy allows.\n /\n SIGN_IN_REQUIRED = 'sign_in_required',\n}\n\n/\n What a re-authentication proof is FOR (#1417). It decides which factors may mint the proof and which\n * doors accept it.\n \n - `STEP_UP`: a sensitive operation, removing a way to sign in, or turning TOTP off. Minted only from\n * a factor the effective `stepUpAuth.methods` accepts, as a `REAUTH` token.\n * - `BIND_AUTHENTICATOR`: adding a way to sign in. Minted from any factor the account holds, as a\n * `REAUTH_BIND` token, which only the binding doors accept.\n /\nexport enum ReAuthenticationPurpose {\n STEP_UP = 'step_up',\n BIND_AUTHENTICATOR = 'bind_authenticator',\n}\n\n/\n The frontend page a federated re-authentication returns to (#1441), inside the popup the step-up\n * dialog opened. The backend redirects there with `?code=` (a one-time `REAUTH_CODE_EXCHANGE` code) or\n * `?error=`; the page hands either to the window that opened it and closes. ONE constant, so the URL the\n * backend writes and the route the frontend mounts cannot disagree.\n /\nexport const REAUTHENTICATION_CALLBACK_PAGE_PATH = '/auth/reauth/callback';\n\n/\n A linked identity that can re-authenticate its account through its provider (#1441): what the step-up\n * dialog shows as \"Continue with <displayName>\", what `GET /auth/reauth/methods` lists beside the local\n * factors, and what `POST /auth/reauth/federated/authorize` accepts by `identityLinkId`.\n /\nexport interface ReAuthenticationIdentityLink {\n identityLinkId: string;\n providerRef: string;\n /* The provider's (social) or the connection's (enterprise) display name. /\n displayName: string;\n /* What a step-up policy names this factor by. /\n method: FederatedReAuthenticationMethod;\n}\n\n/\n The methods a linked identity re-authenticates with (#1441): `EXTERNAL_OAUTH2` for a social OIDC link,\n * `ORG_OPENID_CONNECT` for an enterprise OIDC one, `ORG_SAML` for an enterprise SAML one.\n /\nexport type FederatedReAuthenticationMethod = AuthMethod.EXTERNAL_OAUTH2 \| AuthMethod.ORG_OPENID_CONNECT \| AuthMethod.ORG_SAML;\n\n/\n W4.2: Session purpose — drives UI rendering and valid state transitions.\n /\nexport enum AuthSessionPurpose {\n LOGIN = 'login',\n REGISTRATION = 'registration',\n INVITATION = 'invitation',\n REAUTH = 'reauth',\n DEVICE_AUTH = 'device_auth',\n}\n\n/\n W4.6: MFA enrollment lifecycle state on UserCredentials.\n * Computed at user creation and updated on enrollment completion.\n /\nexport enum MfaEnrollmentState {\n NOT_REQUIRED = 'not_required',\n PENDING = 'pending',\n GRACE = 'grace',\n ENROLLED = 'enrolled',\n}\n\n// ===============================\n// AUTHENTICATION METHOD CLASSIFICATION\n// ===============================\n\n/\n @wildo_source:part:start saas.models.auth.methods facet:layer:shared facet:audience:app-developer\n \n ## What each method PROVES, and how the engine decides with it\n \n Three maps classify a method, and they answer different questions. Reach for the right one:\n \n \| map \| answers \|\n * \|---\|---\|\n * \| `AUTH_METHOD_FACTOR_MAP` \| WHERE it may sit — first factor, second factor, or either \|\n * \| `AUTH_METHOD_CATEGORY_MAP` \| which GROUP the sign-in page renders it in \|\n * \| `AUTH_METHOD_EVIDENCE` \| what it PROVES — the one the engine's factor rules read \|\n /\n\n/\n Authentication Method Factor Classification Map\n /\nexport const AUTH_METHOD_FACTOR_MAP: Record<AuthMethod, AuthFactorType> = {\n // First factor only - Primary credentials\n [AuthMethod.PASSWORD]: AuthFactorType.FIRST_ONLY,\n\n // First factor only - Passwordless via email\n [AuthMethod.MAGIC_LINK]: AuthFactorType.FIRST_ONLY,\n\n // First factor only - SSO redirect flows are not MFA ceremonies (B-SEC-1)\n [AuthMethod.EXTERNAL_OAUTH2]: AuthFactorType.FIRST_ONLY,\n [AuthMethod.ORG_SAML]: AuthFactorType.FIRST_ONLY,\n [AuthMethod.ORG_OPENID_CONNECT]: AuthFactorType.FIRST_ONLY,\n\n // Second factor only - MFA tokens (except SMS_OTP which can be first or second)\n [AuthMethod.TOTP]: AuthFactorType.SECOND_ONLY,\n [AuthMethod.SMS_OTP]: AuthFactorType.FIRST_OR_SECOND,\n [AuthMethod.EMAIL_OTP]: AuthFactorType.SECOND_ONLY,\n\n // First or second factor - Modern biometric\n [AuthMethod.PASSKEY]: AuthFactorType.FIRST_OR_SECOND\n};\n\n/\n The order authentication methods are PRESENTED in, and the order that decides which one is offered first.\n \n ONE authority, deliberately. Until #1218 there were two and neither was: the backend returned methods in\n * `AUTH_METHOD_FACTOR_MAP` declaration order — so `defaultFirstFactorMethod` was `PASSWORD` because PASSWORD happens to\n * be the first key of an unrelated map — and the frontend threw that order away and re-sorted by a display list only it\n * could see. A domain routed to an enterprise identity provider still met the password form, with \"Continue with your\n * provider\" relegated to \"other methods\".\n \n The head is the one the sign-in page already used, promoted rather than invented: the organization's own identity\n * provider first, because a domain that routes to one is telling you where this person signs in; then the credentials a\n * person holds directly; then the delegated and one-time channels.\n \n The TRAILER orders the second-factor challenge, and it is strongest-first. Those members are second-factor-only\n * (or, for `SMS_OTP`, first-or-second), so they never appear in a first-factor list and their position here decides one\n * thing: what the MFA screen offers first. `TOTP` leads them because it is an unrestricted authenticator; `SMS_OTP`\n * follows because NIST classes PSTN out-of-band as RESTRICTED — permitted, with an obligation to offer an unrestricted\n * alternative — and `EMAIL_OTP` is last because email \"SHALL NOT be used for out-of-band authentication\".\n * spec-cite: NIST SP 800-63B-4 §3.2.9 (restricted authenticators) and §3.1.3.1 (out-of-band authenticators)\n * (https://pages.nist.gov/800-63-4/sp800-63b.html). The same two sections `isStrongSecondFactor` cites.\n \n The frontend's deleted display order put `TOTP` last, behind both OTP channels, for no recorded reason — that is what\n * this replaces, and the change is deliberate rather than incidental.\n \n TOTAL over the vocabulary, and pinned as total: a method added to `AuthMethod` tomorrow must be PLACED here, rather\n * than appearing silently at the end of whichever list happened to be sorted last.\n /\nexport const AUTH_METHOD_PRECEDENCE: readonly AuthMethod[] = [\n AuthMethod.ORG_SAML,\n AuthMethod.ORG_OPENID_CONNECT,\n AuthMethod.PASSWORD,\n AuthMethod.PASSKEY,\n AuthMethod.MAGIC_LINK,\n AuthMethod.EXTERNAL_OAUTH2,\n AuthMethod.TOTP,\n AuthMethod.SMS_OTP,\n AuthMethod.EMAIL_OTP,\n] as const;\n\n/\n Authentication Method Category Map\n /\nexport const AUTH_METHOD_CATEGORY_MAP: Record<AuthMethod, AuthMethodCategory> = {\n [AuthMethod.PASSWORD]: AuthMethodCategory.CREDENTIAL,\n [AuthMethod.MAGIC_LINK]: AuthMethodCategory.CREDENTIAL,\n [AuthMethod.EXTERNAL_OAUTH2]: AuthMethodCategory.EXTERNAL_OAUTH2,\n [AuthMethod.ORG_SAML]: AuthMethodCategory.ORG_SSO,\n [AuthMethod.ORG_OPENID_CONNECT]: AuthMethodCategory.ORG_SSO,\n [AuthMethod.TOTP]: AuthMethodCategory.MFA_TOKEN,\n [AuthMethod.SMS_OTP]: AuthMethodCategory.MFA_TOKEN,\n [AuthMethod.EMAIL_OTP]: AuthMethodCategory.MFA_TOKEN,\n [AuthMethod.PASSKEY]: AuthMethodCategory.BIOMETRIC\n};\n\n/\n The factor CATEGORY a method proves, in the classical three — plus the one Wildo cannot classify.\n \n `FEDERATED` is not a fourth kind of factor. It means the proof happened at an identity provider, so\n * what was proved is the IdP's answer and not ours: the engine reads it from the assertion's `acr`\n * demands and assurance evidence rather than declaring it here. Giving a federated method a concrete\n * category would be asserting something about somebody else's ceremony.\n /\nexport enum AuthFactorCategory {\n /* Something you know. /\n KNOWLEDGE = 'KNOWLEDGE',\n /* Something you have. /\n POSSESSION = 'POSSESSION',\n /* Something you are. /\n INHERENCE = 'INHERENCE',\n /* Proved elsewhere; the assertion says what, not this map. /\n FEDERATED = 'FEDERATED',\n}\n\n/\n The CHANNEL a method's proof travels over — the axis that decides whether two factors are\n * independent.\n \n Two factors that share a channel are one factor counted twice: whoever holds the channel holds\n * both. A magic link and an email one-time code are the worked example, and the law states the rule\n * directly — \"the breach of one of the elements does not compromise the reliability of the other\n * elements\".\n \n spec-cite: Commission Delegated Regulation (EU) 2018/389, Art. 9(1) \"Independence of the elements\"\n * (https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32018R0389). That regulation binds\n * payment service providers; it is cited here as the clearest statement of the principle, never as an\n * obligation a Wildo application inherits.\n \n `NONE` means the proof does not travel: a password is typed, a TOTP code is computed from a secret\n * shared once at enrolment. Those can never collide with anything, which is why the rule is expressed\n * as \"not the same channel\" rather than as a list of forbidden pairs.\n /\nexport enum AuthProofChannel {\n /* Nothing is delivered — the proof is presented directly. /\n NONE = 'NONE',\n /* Delivered to a mailbox. /\n EMAIL = 'EMAIL',\n /* Delivered over the public switched telephone network. /\n PSTN = 'PSTN',\n /* Produced by an authenticator on the device, and never transmitted. /\n LOCAL_AUTHENTICATOR = 'LOCAL_AUTHENTICATOR',\n /* Carried in an assertion from an identity provider. /\n FEDERATED = 'FEDERATED',\n}\n\n/\n Whether ONE ceremony of this method can prove TWO factors by itself.\n \n Only a cryptographic authenticator can, and only when an activation factor unlocked its key —\n * \"a multi-factor cryptographic authenticator is 'something you have' and is activated by an\n * activation factor that represents either 'something you know' or 'something you are'\".\n \n spec-cite: NIST SP 800-63B-4 §3.1.7 \"Multi-Factor Cryptographic Authentication\"\n * (https://pages.nist.gov/800-63-4/sp800-63b.html).\n \n `WHEN_USER_VERIFIED` is therefore a CONDITION, not a property: the same passkey proves two factors\n * in a ceremony that verified the person and one in a ceremony that did not, and both produce a valid\n * assertion. The engine reads the WebAuthn `UV` flag off the assertion to tell them apart.\n /\nexport enum AuthSelfSufficientMultiFactor {\n /* One ceremony, one factor — always. /\n NEVER = 'NEVER',\n /* Two factors when the authenticator locally verified the person, one when it did not. /\n WHEN_USER_VERIFIED = 'WHEN_USER_VERIFIED',\n}\n\n/* What one authentication method proves. See {@link AUTH_METHOD_EVIDENCE}. /\nexport interface AuthMethodEvidence {\n readonly factorCategory: AuthFactorCategory;\n readonly channel: AuthProofChannel;\n /\n Whether presenting this method to an impostor verifier is useless to the impostor.\n \n True for `PASSKEY` alone, and that is not a judgement — \"authenticators that involve the manual\n * entry of an authenticator output (e.g., out-of-band and OTP authenticators) SHALL NOT be\n * considered phishing-resistant because the manual entry does not bind the authenticator output to\n * the specific session being authenticated\". A typed code is relayable, TOTP included.\n \n spec-cite: NIST SP 800-63B-4 §3.2.5 \"Phishing Resistance\"\n * (https://pages.nist.gov/800-63-4/sp800-63b.html).\n \n A federated method is `false` because Wildo cannot know how the IdP authenticated the person;\n * that question is answered by the connection's `acr` demands, not by this map.\n /\n readonly phishingResistant: boolean;\n readonly selfSufficientMultiFactor: AuthSelfSufficientMultiFactor;\n}\n\n/\n Authentication Method Evidence Map — what each method PROVES.\n \n The two maps above say where a method may sit and how it is grouped on screen. Neither says what it\n * proves, so every rule that depends on the strength of a proof used to be hand-applied at its own\n * door and derived differently at each one: the MFA waiver matched a method NAME, `requireStrongMFA`\n * was expressed as \"drop the ones needing no enrolment\", and nothing anywhere expressed the channel —\n * which is why a magic-link sign-in could be completed by an email code to the same mailbox.\n \n Being `Record<AuthMethod, …>` is the point: a method added to the vocabulary tomorrow does not\n * compile until it declares what it proves, so the rules below stay total over the vocabulary instead\n * of quietly omitting it.\n \n ## Reading the rows\n \n - `MAGIC_LINK` is POSSESSION, not knowledge. It sits beside `PASSWORD` in\n * `AUTH_METHOD_CATEGORY_MAP` because both are rendered as \"credentials\", and that grouping is a\n * screen concern. What a magic link proves is control of a mailbox.\n * - `TOTP` has NO channel. The secret is shared once at enrolment and the code is computed\n * locally, so nothing is delivered and it can never collide with another factor's channel.\n * - The three federated methods are `FEDERATED` on both axes. Their strength question already has\n * an answer — `externalAssuranceEnforcement` and the connection's `acr` demands — and this map must\n * not grow a second, competing one.\n \n Imported from `@wildo-ai/saas-models`.\n /\nexport const AUTH_METHOD_EVIDENCE: Record<AuthMethod, AuthMethodEvidence> = {\n [AuthMethod.PASSWORD]: {\n factorCategory: AuthFactorCategory.KNOWLEDGE,\n channel: AuthProofChannel.NONE,\n phishingResistant: false,\n selfSufficientMultiFactor: AuthSelfSufficientMultiFactor.NEVER,\n },\n [AuthMethod.MAGIC_LINK]: {\n factorCategory: AuthFactorCategory.POSSESSION,\n channel: AuthProofChannel.EMAIL,\n phishingResistant: false,\n selfSufficientMultiFactor: AuthSelfSufficientMultiFactor.NEVER,\n },\n [AuthMethod.EMAIL_OTP]: {\n factorCategory: AuthFactorCategory.POSSESSION,\n channel: AuthProofChannel.EMAIL,\n phishingResistant: false,\n selfSufficientMultiFactor: AuthSelfSufficientMultiFactor.NEVER,\n },\n [AuthMethod.SMS_OTP]: {\n factorCategory: AuthFactorCategory.POSSESSION,\n channel: AuthProofChannel.PSTN,\n phishingResistant: false,\n selfSufficientMultiFactor: AuthSelfSufficientMultiFactor.NEVER,\n },\n [AuthMethod.TOTP]: {\n factorCategory: AuthFactorCategory.POSSESSION,\n channel: AuthProofChannel.NONE,\n phishingResistant: false,\n selfSufficientMultiFactor: AuthSelfSufficientMultiFactor.NEVER,\n },\n [AuthMethod.PASSKEY]: {\n factorCategory: AuthFactorCategory.POSSESSION,\n channel: AuthProofChannel.LOCAL_AUTHENTICATOR,\n phishingResistant: true,\n selfSufficientMultiFactor: AuthSelfSufficientMultiFactor.WHEN_USER_VERIFIED,\n },\n [AuthMethod.EXTERNAL_OAUTH2]: {\n factorCategory: AuthFactorCategory.FEDERATED,\n channel: AuthProofChannel.FEDERATED,\n phishingResistant: false,\n selfSufficientMultiFactor: AuthSelfSufficientMultiFactor.NEVER,\n },\n [AuthMethod.ORG_SAML]: {\n factorCategory: AuthFactorCategory.FEDERATED,\n channel: AuthProofChannel.FEDERATED,\n phishingResistant: false,\n selfSufficientMultiFactor: AuthSelfSufficientMultiFactor.NEVER,\n },\n [AuthMethod.ORG_OPENID_CONNECT]: {\n factorCategory: AuthFactorCategory.FEDERATED,\n channel: AuthProofChannel.FEDERATED,\n phishingResistant: false,\n selfSufficientMultiFactor: AuthSelfSufficientMultiFactor.NEVER,\n },\n};\n\n/\n Do these two methods prove things a single breach could reach?\n \n The rule the engine applies when it offers or accepts a SECOND factor: a factor whose channel the\n * FIRST factor already proved is not a second factor. `NONE` never collides, because nothing is\n * delivered over it.\n \n @example\n * sharesProofChannel(AuthMethod.MAGIC_LINK, AuthMethod.EMAIL_OTP); // true — one mailbox, counted twice\n * sharesProofChannel(AuthMethod.PASSWORD, AuthMethod.EMAIL_OTP); // false — nothing is delivered to prove a password\n /\nexport function sharesProofChannel(first: AuthMethod, second: AuthMethod): boolean {\n const firstChannel = AUTH_METHOD_EVIDENCE[first].channel;\n if (firstChannel === AuthProofChannel.NONE) {\n return false;\n }\n return firstChannel === AUTH_METHOD_EVIDENCE[second].channel;\n}\n/\n The RFC 8176 `amr` values each method may claim, and nothing else (#1248).\n \n `amr` is what an ID token tells a relying party about HOW the person authenticated. Wildo demands\n * exactly this of every identity provider it trusts — `oauth2-authentication` reads an upstream `amr`\n * as session evidence — and published none of its own, so a client receiving a Wildo ID token could not\n * make the decision Wildo insists on making about its own upstreams. That asymmetry is the defect.\n \n spec-cite: RFC 8176 \"Authentication Method Reference Values\", §2 — the registry of short names and\n * their definitions (https://www.rfc-editor.org/rfc/rfc8176.html). Every value below is taken from\n * that registry; none is invented.\n \n ## Only REGISTERED values, which is why three methods contribute none\n \n A value outside the registry is a private string a generic relying party cannot read, so an\n * unregistered \"email\" or \"sso\" would be worse than silence — the same reasoning that keeps `acr`\n * unpublished until Wildo defines what its values mean.\n \n - The federated methods contribute nothing. The registry has no value for \"the person proved\n * themselves to somebody else and that party vouched for them\", and restating the UPSTREAM's `amr`\n * as our own would assert a proof this application never observed. What the upstream proved is the\n * upstream's claim to make.\n * - `MAGIC_LINK` and `EMAIL_OTP` claim `mca`, \"Multiple-channel authentication involving\n * communication over distinct channels\", which is literally what they are: the credential travels by\n * email, a channel distinct from the browser. That is applying a registered definition, not\n * stretching one. `EMAIL_OTP` also claims `otp`, which it plainly is; `MAGIC_LINK` is not an OTP —\n * the link itself is the credential.\n * - `PASSKEY` claims `user`, \"User presence test\", because WebAuthn always tests presence. It does\n * NOT claim `hwk` or `swk`: which is true depends on whether the credential is single-device or\n * synced, and the session does not carry the credential's device type. Claiming either would be a\n * guess about the authenticator, and `hwk` is precisely what a relying party reads as\n * phishing-resistant hardware.\n /\nexport const AUTH_METHOD_AMR: Record<AuthMethod, readonly string[]> = {\n [AuthMethod.PASSWORD]: ['pwd'],\n [AuthMethod.TOTP]: ['otp'],\n [AuthMethod.SMS_OTP]: ['sms', 'otp'],\n [AuthMethod.EMAIL_OTP]: ['mca', 'otp'],\n [AuthMethod.MAGIC_LINK]: ['mca'],\n [AuthMethod.PASSKEY]: ['user'],\n [AuthMethod.EXTERNAL_OAUTH2]: [],\n [AuthMethod.ORG_OPENID_CONNECT]: [],\n [AuthMethod.ORG_SAML]: [],\n};\n\n/\n What an ID token may say about how THIS session was authenticated (#1248).\n \n Returns the sorted, de-duplicated registered `amr` values for the factors the session actually\n * completed — never for the factors it could have used. An empty result means the session has nothing\n * a relying party could read, and the caller omits the claim rather than emitting `[]`: an empty array\n * asserts \"authenticated by no method\", which is false, where an absent claim correctly says nothing.\n \n ## `mfa` is DERIVED, and it is the value that matters most\n \n \"Multiple-factor authentication\" is claimed when the session genuinely holds two independent proofs,\n * decided by the same {@link AUTH_METHOD_EVIDENCE} channels that decide whether a second factor is\n * admissible — so an ID token cannot claim `mfa` for a pair this application's own sign-in doors would\n * refuse as sharing a channel. A password plus an email OTP is two methods and one mailbox; it does\n * not claim `mfa`.\n \n A single passkey claims `mfa` when the authenticator locally verified the person, because that\n * ceremony IS two factors — possession of the authenticator and the activation that unlocked it — and\n * the WebAuthn UV flag is the only report that the activation happened. That is the distinction the\n * acceptance asks an ID token to carry, and it is readable only because the verifier reads the flag\n * off the assertion rather than inferring it from the policy that requested it.\n /\nexport function deriveAuthenticationMethodReferences(\n completedFactors: readonly AuthMethod[],\n ceremony?: { passkeyUserVerified?: boolean },\n): string[] {\n const values = new Set<string>();\n for (const method of completedFactors) {\n for (const value of AUTH_METHOD_AMR[method] ?? []) values.add(value);\n }\n\n const userVerifiedPasskey = completedFactors.includes(AuthMethod.PASSKEY) && ceremony?.passkeyUserVerified === true;\n const independentPair = completedFactors.some((first, index) =>\n completedFactors.slice(index + 1).some((second) => !sharesProofChannel(first, second)));\n if (userVerifiedPasskey \|\| independentPair) values.add('mfa');\n\n // Sorted so the claim is stable across sign-ins completing the same factors in a different order —\n // a relying party comparing tokens should not see a difference that is only iteration order.\n return [...values].sort();\n}\n\n/* @wildo_source:part:end saas.models.auth.methods /\n\n/\n Scope type for auth policies — organization-level vs application-level.\n \n Declared before the browser-safe available-method schema because that schema\n * evaluates this enum at module initialization time.\n /\nexport enum AuthScopeType {\n ORGANIZATION = 'organization',\n APPLICATION = 'application',\n}\n\n/\n Public, browser-safe configuration attached to an available auth method.\n \n The fields span passkey and enterprise-SSO methods, but every field is named\n * and typed: this cross-layer contract must never collapse back to\n * `Record<string, any>`, which previously forced frontend assertions for the\n * tenant scope and connection identity.\n /\nexport const AvailableMethodConfigSchema = z.object({\n rpName: z.string().optional(),\n rpId: z.string().optional(),\n displayName: z.string().optional(),\n providerRef: z.string().optional(),\n connectionId: z.string().optional(),\n scopeType: z.enum(AuthScopeType).optional(),\n scopeId: z.string().optional(),\n loginUrl: z.string().optional(),\n});\n\nexport type AvailableMethodConfig = z.infer<typeof AvailableMethodConfigSchema>;\n\nexport const AvailableMethodSchema = z.object({\n method: z.enum(AuthMethod),\n factorType: z.enum(AuthFactorType),\n category: z.enum(AuthMethodCategory),\n canBeFirstFactor: z.boolean(),\n canBeSecondFactor: z.boolean(),\n\n /\n The organization that owns this address requires THIS method as the first factor.\n \n True only where an enterprise connection's `enforcement.requireSSO` is set, so it appears on\n * `ORG_SAML` and `ORG_OPENID_CONNECT` and nowhere else. It is not the same statement as \"this is\n * the only method offered\": when the tenant allows a password fallback, or names break-glass\n * accounts, the offered list deliberately KEEPS the password field for every address at the domain\n * (enumeration safety — narrowing it for the listed accounts would publish who they are). This flag\n * is what lets the sign-in page say that the password beside it is a fallback rather than a peer.\n /\n enforcedFirstFactor: z.boolean(),\n\n /\n The account's policy requires a second factor, and this method can serve as one.\n \n Meaningful only in a SECOND-factor list. It is derived from `mfaPolicy.requireMFA` together with\n * the method's factor classification, so it is true of every acceptable second factor at once — it\n * says \"a second factor is mandatory\", never \"this particular one is\".\n \n ## Why this is two fields and not one\n \n Both of these were a single `required: boolean` until #1220, written by two branches with\n * incompatible meanings, and `_buildAvailableMethodObject` builds BOTH the first- and second-factor\n * lists — so each writer was noise in the other's list. In the FIRST-factor list a passkey came back\n * `required: true` merely because the user type demands MFA, where it means nothing at all; the flag\n * was read by no frontend code, so nothing ever noticed. A consumer taking it at face value would\n * have presented a passkey as a mandatory first factor, which is the opposite of true.\n \n Two names, one writer each, each meaningful in exactly one list. Merging them back would restore a\n * field whose meaning depends on which list you found it in, which is not a meaning.\n /\n satisfiesRequiredSecondFactor: z.boolean(),\n\n // Provider-specific information\n oauth2ProviderRefs: z.array(z.string()).optional(), // For third-party OAuth2\n ssoIds: z.array(z.string()).optional(), // For organization SSO\n organizationRestricted: z.boolean().default(false),\n\n // Integration capabilities\n supportsIntegrations: z.boolean().default(false),\n availableIntegrations: z.array(z.string()).default([]).optional(),\n\n // Public configuration\n config: AvailableMethodConfigSchema.optional()\n});\n\n\nexport type AvailableMethod = z.infer<typeof AvailableMethodSchema>;\n\n// ===============================\n// CROSS-LAYER CONSTANTS\n// ===============================\n\n/\n Error codes used in redirect query params (backend → frontend).\n * Backend appends `?error=<code>` to redirect URLs; frontend reads and displays.\n /\nexport enum AuthRedirectErrorCode {\n SAML_LOGIN_FAILED = 'saml_login_failed',\n SAML_AUTH_FAILED = 'saml_auth_failed',\n SAML_SLO_FAILED = 'saml_slo_failed',\n MISSING_PARAMS = 'missing_params',\n OAUTH_FAILED = 'oauth_failed',\n}\n\n/\n Ownership class of an external authentication connection.\n \n This is intentionally independent from {@link AuthScopeType}: a social\n * connection has no enterprise tenant scope, while an enterprise connection\n * must carry one.\n /\nexport enum SsoConnectionType {\n SOCIAL = 'social',\n ENTERPRISE = 'enterprise',\n}\n\n/\n Mechanism that established an external identity.\n \n This is wider than the SSO protocol vocabulary because SCIM establishes and\n * maintains identity links without being an interactive SSO protocol.\n */\nexport enum ExternalIdentitySource {\n OAUTH2 = 'oauth2',\n OIDC = 'oidc',\n SAML = 'saml',\n SCIM = 'scim',\n}\n"]}

package/dist/esm/security/authentications/authentication.shared.utils.d.ts CHANGED Viewed

@@ -1,6 +1,7 @@
 import { AuthMethod, AuthFactorType } from './authentication.shared.schemas';
 import { AuthMethodCategory } from './authentication.shared.schemas';
 import { PasswordPolicyRules } from '../../config/app-configuration-shared.shared.schemas';
+import { type PasswordBlocklistContext } from './password-blocklist.shared.utils';
 /**
  * Helper functions for authentication factor classification
  */
@@ -13,6 +14,22 @@ export declare class AuthUtils {
      * Check if method can be used as second factor (MFA)
      */
     static canBeSecondFactor(method: AuthMethod): boolean;
+    /**
+     * Order method entries by {@link AUTH_METHOD_PRECEDENCE} — the ONE presentation order (#1218).
+     *
+     * The BACKEND sorts, and every surface renders what it is given. A client that re-sorts is a second authority, and a
+     * second authority is how the list a person sees came to disagree with the `defaultFirstFactorMethod` shipped beside
+     * it.
+     *
+     * It takes `AuthMethod` rather than a widened string, and carries NO not-found fallback, because
+     * `AUTH_METHOD_PRECEDENCE` is total over the vocabulary and pinned as total: an unplaced member cannot exist, so a
+     * branch handling one could never run and would read as coverage it is not
+     * (`invariant-call-site-enumeration.md` #19 — an unreachable guard is an untested claim). A method added to
+     * `AuthMethod` fails the totality pin instead, which is where that answer belongs.
+     */
+    static sortByPrecedence<T extends {
+        method: AuthMethod;
+    }>(methods: readonly T[]): T[];
     /**
      * Get all methods that can be used as first factor
      */
@@ -42,15 +59,65 @@ export declare class AuthUtils {
      */
     static validateMethodForFactor(method: AuthMethod, isFirstFactor: boolean): boolean;
     /**
-     * Determine which second-factor methods a user has actually enrolled,
-     * based on their credential record. Mirrors the enrollment check in
-     * AuthenticationOrchestratorBackendService._shouldRequireMFA().
+     * The second-factor methods that need NO enrollment act, because the account already holds what
+     * they require.
+     *
+     * Today that is `EMAIL_OTP` alone: the address is proven before the account is usable, so a code
+     * can be sent to it without the user ever setting anything up.
+     *
+     * **Kept separate from {@link getEnrolledSecondFactorMethods} rather than folded into it, and the
+     * reason is the defect that forced the split.** That method used to append `EMAIL_OTP`
+     * unconditionally, so "the methods this user has enrolled" was NEVER EMPTY — and it therefore
+     * could not answer the one question every caller asked of it: *has this person set up a second
+     * factor at all?* Four backend sites recovered the real answer by re-filtering
+     * `m !== AuthMethod.EMAIL_OTP` by hand, a frontend settings page re-derived it from a literal
+     * three-member list, and the startup config validator re-implemented the whole predicate. One
+     * merged concept produced six hand-applications of the rule that distinguishes them.
+     *
+     * **Unconditional on purpose** — it takes no credential record. A missing `UserCredentials` row
+     * does not mean a missing email address; the old function returned `[]` (no `EMAIL_OTP`) for a
+     * credential-less user, which was an artifact of an early return rather than a statement about
+     * what that user can do.
+     */
+    static getAlwaysAvailableSecondFactorMethods(): AuthMethod[];
+    /**
+     * The second-factor methods that CAN be enrolled — the vocabulary minus the ones that need no
+     * enrollment. Total over {@link AUTH_METHOD_FACTOR_MAP}, so a second factor added to the
+     * vocabulary tomorrow is offered by every enrollment surface without one of them being edited.
+     *
+     * This is the VOCABULARY-level answer and takes no policy. For the policy-level answer — what
+     * THIS application's configuration actually permits — use `resolveEnrollableSecondFactorMethods`.
+     */
+    static getEnrollableSecondFactorMethods(): AuthMethod[];
+    /**
+     * The second-factor methods this user has actually ENROLLED — each one required a deliberate
+     * setup act, recorded on the credential row.
+     *
+     * **An empty result means exactly that: nothing is set up.** That is the whole point of the
+     * split described on {@link getAlwaysAvailableSecondFactorMethods}; callers asking "must this
+     * user enroll something?" read this and nothing else.
+     *
+     * See {@link getPresentableSecondFactorMethods} for the union with the no-setup factors, which
+     * is what a CHALLENGE may offer.
      */
     static getEnrolledSecondFactorMethods(cred: {
         totpVerified?: boolean;
         passkeyCredentials?: unknown[];
         phoneNumberVerified?: boolean;
     } | null | undefined): AuthMethod[];
+    /**
+     * Every second factor this user could present today — enrolled ∪ always-available.
+     *
+     * This is the set a CHALLENGE is built from (after intersecting it with what the policy accepts).
+     * It is deliberately NOT the set an ENROLLMENT offer is built from: you cannot enroll a factor
+     * that needs no enrollment, and offering one as a setup step is how a user ends up staring at a
+     * screen with nothing actionable on it.
+     */
+    static getPresentableSecondFactorMethods(cred: {
+        totpVerified?: boolean;
+        passkeyCredentials?: unknown[];
+        phoneNumberVerified?: boolean;
+    } | null | undefined): AuthMethod[];
     /**
      * Validate a password against policy rules.
      * Returns an object with `valid` flag and an array of `violations` (i18n label keys).
@@ -58,8 +125,24 @@ export declare class AuthUtils {
      * Single source of truth for password policy validation — used by both frontend
      * (real-time validation) and backend (AuthCredentialVerifierBackendService).
      * Frontend resolves violations via t(violationCode) with {minLength}/{maxLength} replacement.
+     *
+     * ## The blocklist check is UNCONDITIONAL, and that is the point
+     *
+     * Every other rule here is gated on a policy flag, so an application can turn it off. The
+     * blocklist is not, because NIST SP 800-63B-4 §3.1.1.2 states it as a flat obligation on the
+     * verifier — "verifiers SHALL compare the prospective secret against a blocklist" — with no
+     * configurable half, in the same section that FORBIDS the composition rules above. Making it
+     * optional would let an application keep the shape of a password policy while removing the only
+     * rule the standard still asks for.
+     *
+     * spec-cite: NIST SP 800-63B-4 §3.1.1.2 (https://pages.nist.gov/800-63-4/sp800-63b.html).
+     *
+     * `blocklistContext` is what an attacker guesses about THIS application and THIS person — the
+     * service's own name, the user's own email local part. It is optional because the bundled list is
+     * the floor and must run whether or not a caller knows who is setting the password; a caller that
+     * DOES know should pass it, since those two guesses come before anything in the list.
      */
-    static validatePasswordAgainstPolicy(password: string, policy: PasswordPolicyRules): {
+    static validatePasswordAgainstPolicy(password: string, policy: PasswordPolicyRules, blocklistContext?: PasswordBlocklistContext): {
         valid: boolean;
         violations: string[];
     };

package/dist/esm/security/authentications/authentication.shared.utils.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"authentication.shared.utils.d.ts","sourceRoot":"","sources":["~~../../../../~~src/security/authentications/authentication.shared.utils.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,UAAU,EAAE,cAAc,~~EAAoD~~,MAAM,iCAAiC,CAAC;~~AAC/H~~,OAAO,EAAE,kBAAkB,EAAE,MAAM,iCAAiC,CAAC;AACrE,OAAO,EAAE,mBAAmB,EAA+B,MAAM,sDAAsD,CAAC;~~AAGxH~~;;GAEG;AACH,qBAAa,SAAS;IACpB;;OAEG;IACH,MAAM,CAAC,gBAAgB,CAAC,MAAM,EAAE,UAAU,GAAG,OAAO;IAOpD;;OAEG;IACH,MAAM,CAAC,iBAAiB,CAAC,MAAM,EAAE,UAAU,GAAG,OAAO;IAOrD;;OAEG;IACH,MAAM,CAAC,qBAAqB,IAAI,UAAU,EAAE;IAU5C;;OAEG;IACH,MAAM,CAAC,sBAAsB,IAAI,UAAU,EAAE;IAU7C;;OAEG;IACH,MAAM,CAAC,aAAa,CAAC,MAAM,EAAE,UAAU,GAAG,cAAc;IAIxD;;OAEG;IACH,MAAM,CAAC,iBAAiB,CAAC,MAAM,EAAE,UAAU,GAAG,kBAAkB;IAIhE;;OAEG;IACH,MAAM,CAAC,wBAAwB,CAAC,MAAM,EAAE,UAAU,GAAG,OAAO;IAI5D;;OAEG;IACH,MAAM,CAAC,yBAAyB,CAAC,MAAM,EAAE,UAAU,GAAG,OAAO;IAK7D;;OAEG;IACH,MAAM,CAAC,uBAAuB,CAAC,MAAM,EAAE,UAAU,EAAE,aAAa,EAAE,OAAO,GAAG,OAAO;IAOnF~~;;;;OAIG~~;IACH,MAAM,CAAC,8BAA8B,CAAC,IAAI,EAAE;QAC1C,YAAY,CAAC,EAAE,OAAO,CAAC;QACvB,kBAAkB,CAAC,EAAE,OAAO,EAAE,CAAC;QAC/B,mBAAmB,CAAC,EAAE,OAAO,CAAC;KAC/B,GAAG,IAAI,GAAG,SAAS,GAAG,UAAU,EAAE;~~IAUnC~~;;;;;;;OAOG;IACH,MAAM,CAAC,~~6BAA6B~~,CAAC,~~QAAQ~~,EAAE,MAAM,EAAE,MAAM,EAAE,mBAAmB,~~GAAG~~;QAAE,KAAK,EAAE,OAAO,CAAC;QAAC,UAAU,EAAE,MAAM,EAAE,CAAA;KAAE;~~CAyB9H~~"}
1	+ {"version":3,"file":"authentication.shared.utils.d.ts","sourceRoot":"","sources":["../../../../../src/security/authentications/authentication.shared.utils.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,UAAU,EAAE,cAAc,EAA4E,MAAM,iCAAiC,CAAC;AACvJ,OAAO,EAAE,kBAAkB,EAAE,MAAM,iCAAiC,CAAC;AACrE,OAAO,EAAE,mBAAmB,EAA+B,MAAM,sDAAsD,CAAC;AACxH,OAAO,EAAyB,KAAK,wBAAwB,EAAE,MAAM,mCAAmC,CAAC;AAGzG;;GAEG;AACH,qBAAa,SAAS;IACpB;;OAEG;IACH,MAAM,CAAC,gBAAgB,CAAC,MAAM,EAAE,UAAU,GAAG,OAAO;IAOpD;;OAEG;IACH,MAAM,CAAC,iBAAiB,CAAC,MAAM,EAAE,UAAU,GAAG,OAAO;IAOrD;;;;;;;;;;;;OAYG;IACH,MAAM,CAAC,gBAAgB,CAAC,CAAC,SAAS;QAAE,MAAM,EAAE,UAAU,CAAA;KAAE,EAAE,OAAO,EAAE,SAAS,CAAC,EAAE,GAAG,CAAC,EAAE;IAKrF;;OAEG;IACH,MAAM,CAAC,qBAAqB,IAAI,UAAU,EAAE;IAU5C;;OAEG;IACH,MAAM,CAAC,sBAAsB,IAAI,UAAU,EAAE;IAU7C;;OAEG;IACH,MAAM,CAAC,aAAa,CAAC,MAAM,EAAE,UAAU,GAAG,cAAc;IAIxD;;OAEG;IACH,MAAM,CAAC,iBAAiB,CAAC,MAAM,EAAE,UAAU,GAAG,kBAAkB;IAIhE;;OAEG;IACH,MAAM,CAAC,wBAAwB,CAAC,MAAM,EAAE,UAAU,GAAG,OAAO;IAI5D;;OAEG;IACH,MAAM,CAAC,yBAAyB,CAAC,MAAM,EAAE,UAAU,GAAG,OAAO;IAK7D;;OAEG;IACH,MAAM,CAAC,uBAAuB,CAAC,MAAM,EAAE,UAAU,EAAE,aAAa,EAAE,OAAO,GAAG,OAAO;IAOnF;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,MAAM,CAAC,qCAAqC,IAAI,UAAU,EAAE;IAI5D;;;;;;;OAOG;IACH,MAAM,CAAC,gCAAgC,IAAI,UAAU,EAAE;IAKvD;;;;;;;;;;OAUG;IACH,MAAM,CAAC,8BAA8B,CAAC,IAAI,EAAE;QAC1C,YAAY,CAAC,EAAE,OAAO,CAAC;QACvB,kBAAkB,CAAC,EAAE,OAAO,EAAE,CAAC;QAC/B,mBAAmB,CAAC,EAAE,OAAO,CAAC;KAC/B,GAAG,IAAI,GAAG,SAAS,GAAG,UAAU,EAAE;IASnC;;;;;;;OAOG;IACH,MAAM,CAAC,iCAAiC,CAAC,IAAI,EAAE;QAC7C,YAAY,CAAC,EAAE,OAAO,CAAC;QACvB,kBAAkB,CAAC,EAAE,OAAO,EAAE,CAAC;QAC/B,mBAAmB,CAAC,EAAE,OAAO,CAAC;KAC/B,GAAG,IAAI,GAAG,SAAS,GAAG,UAAU,EAAE;IAInC;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,MAAM,CAAC,6BAA6B,CAClC,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,mBAAmB,EAC3B,gBAAgB,CAAC,EAAE,wBAAwB,GAC1C;QAAE,KAAK,EAAE,OAAO,CAAC;QAAC,UAAU,EAAE,MAAM,EAAE,CAAA;KAAE;CA4B5C"}

package/dist/esm/security/authentications/authentication.shared.utils.js CHANGED Viewed

@@ -1,6 +1,7 @@
-import { AuthMethod, AuthFactorType, AUTH_METHOD_FACTOR_MAP, AUTH_METHOD_CATEGORY_MAP } from './authentication.shared.schemas.js';
+import { AuthMethod, AuthFactorType, AUTH_METHOD_FACTOR_MAP, AUTH_METHOD_CATEGORY_MAP, AUTH_METHOD_PRECEDENCE } from './authentication.shared.schemas.js';
 import { AuthMethodCategory } from './authentication.shared.schemas.js';
 import { PasswordPolicyViolationCode } from '../../config/app-configuration-shared.shared.schemas.js';
+import { isPasswordBlocklisted } from './password-blocklist.shared.utils.js';
 /**
  * Helper functions for authentication factor classification
  */
@@ -23,6 +24,23 @@ export class AuthUtils {
             factorType === AuthFactorType.FIRST_OR_SECOND ||
             factorType === AuthFactorType.ANY;
     }
+    /**
+     * Order method entries by {@link AUTH_METHOD_PRECEDENCE} — the ONE presentation order (#1218).
+     *
+     * The BACKEND sorts, and every surface renders what it is given. A client that re-sorts is a second authority, and a
+     * second authority is how the list a person sees came to disagree with the `defaultFirstFactorMethod` shipped beside
+     * it.
+     *
+     * It takes `AuthMethod` rather than a widened string, and carries NO not-found fallback, because
+     * `AUTH_METHOD_PRECEDENCE` is total over the vocabulary and pinned as total: an unplaced member cannot exist, so a
+     * branch handling one could never run and would read as coverage it is not
+     * (`invariant-call-site-enumeration.md` #19 — an unreachable guard is an untested claim). A method added to
+     * `AuthMethod` fails the totality pin instead, which is where that answer belongs.
+     */
+    static sortByPrecedence(methods) {
+        const rank = (method) => AUTH_METHOD_PRECEDENCE.indexOf(method);
+        return [...methods].sort((left, right) => rank(left.method) - rank(right.method));
+    }
     /**
      * Get all methods that can be used as first factor
      */
@@ -75,9 +93,51 @@ export class AuthUtils {
         return isFirstFactor ? this.canBeFirstFactor(method) : this.canBeSecondFactor(method);
     }
     /**
-     * Determine which second-factor methods a user has actually enrolled,
-     * based on their credential record. Mirrors the enrollment check in
-     * AuthenticationOrchestratorBackendService._shouldRequireMFA().
+     * The second-factor methods that need NO enrollment act, because the account already holds what
+     * they require.
+     *
+     * Today that is `EMAIL_OTP` alone: the address is proven before the account is usable, so a code
+     * can be sent to it without the user ever setting anything up.
+     *
+     * **Kept separate from {@link getEnrolledSecondFactorMethods} rather than folded into it, and the
+     * reason is the defect that forced the split.** That method used to append `EMAIL_OTP`
+     * unconditionally, so "the methods this user has enrolled" was NEVER EMPTY — and it therefore
+     * could not answer the one question every caller asked of it: *has this person set up a second
+     * factor at all?* Four backend sites recovered the real answer by re-filtering
+     * `m !== AuthMethod.EMAIL_OTP` by hand, a frontend settings page re-derived it from a literal
+     * three-member list, and the startup config validator re-implemented the whole predicate. One
+     * merged concept produced six hand-applications of the rule that distinguishes them.
+     *
+     * **Unconditional on purpose** — it takes no credential record. A missing `UserCredentials` row
+     * does not mean a missing email address; the old function returned `[]` (no `EMAIL_OTP`) for a
+     * credential-less user, which was an artifact of an early return rather than a statement about
+     * what that user can do.
+     */
+    static getAlwaysAvailableSecondFactorMethods() {
+        return [AuthMethod.EMAIL_OTP];
+    }
+    /**
+     * The second-factor methods that CAN be enrolled — the vocabulary minus the ones that need no
+     * enrollment. Total over {@link AUTH_METHOD_FACTOR_MAP}, so a second factor added to the
+     * vocabulary tomorrow is offered by every enrollment surface without one of them being edited.
+     *
+     * This is the VOCABULARY-level answer and takes no policy. For the policy-level answer — what
+     * THIS application's configuration actually permits — use `resolveEnrollableSecondFactorMethods`.
+     */
+    static getEnrollableSecondFactorMethods() {
+        const alwaysAvailable = new Set(this.getAlwaysAvailableSecondFactorMethods());
+        return this.getSecondFactorMethods().filter((method) => !alwaysAvailable.has(method));
+    }
+    /**
+     * The second-factor methods this user has actually ENROLLED — each one required a deliberate
+     * setup act, recorded on the credential row.
+     *
+     * **An empty result means exactly that: nothing is set up.** That is the whole point of the
+     * split described on {@link getAlwaysAvailableSecondFactorMethods}; callers asking "must this
+     * user enroll something?" read this and nothing else.
+     *
+     * See {@link getPresentableSecondFactorMethods} for the union with the no-setup factors, which
+     * is what a CHALLENGE may offer.
      */
     static getEnrolledSecondFactorMethods(cred) {
         const methods = [];
@@ -89,9 +149,19 @@ export class AuthUtils {
             methods.push(AuthMethod.PASSKEY);
         if (cred.phoneNumberVerified)
             methods.push(AuthMethod.SMS_OTP);
-        methods.push(AuthMethod.EMAIL_OTP);
         return methods;
     }
+    /**
+     * Every second factor this user could present today — enrolled ∪ always-available.
+     *
+     * This is the set a CHALLENGE is built from (after intersecting it with what the policy accepts).
+     * It is deliberately NOT the set an ENROLLMENT offer is built from: you cannot enroll a factor
+     * that needs no enrollment, and offering one as a setup step is how a user ends up staring at a
+     * screen with nothing actionable on it.
+     */
+    static getPresentableSecondFactorMethods(cred) {
+        return [...this.getEnrolledSecondFactorMethods(cred), ...this.getAlwaysAvailableSecondFactorMethods()];
+    }
     /**
      * Validate a password against policy rules.
      * Returns an object with `valid` flag and an array of `violations` (i18n label keys).
@@ -99,8 +169,24 @@ export class AuthUtils {
      * Single source of truth for password policy validation — used by both frontend
      * (real-time validation) and backend (AuthCredentialVerifierBackendService).
      * Frontend resolves violations via t(violationCode) with {minLength}/{maxLength} replacement.
+     *
+     * ## The blocklist check is UNCONDITIONAL, and that is the point
+     *
+     * Every other rule here is gated on a policy flag, so an application can turn it off. The
+     * blocklist is not, because NIST SP 800-63B-4 §3.1.1.2 states it as a flat obligation on the
+     * verifier — "verifiers SHALL compare the prospective secret against a blocklist" — with no
+     * configurable half, in the same section that FORBIDS the composition rules above. Making it
+     * optional would let an application keep the shape of a password policy while removing the only
+     * rule the standard still asks for.
+     *
+     * spec-cite: NIST SP 800-63B-4 §3.1.1.2 (https://pages.nist.gov/800-63-4/sp800-63b.html).
+     *
+     * `blocklistContext` is what an attacker guesses about THIS application and THIS person — the
+     * service's own name, the user's own email local part. It is optional because the bundled list is
+     * the floor and must run whether or not a caller knows who is setting the password; a caller that
+     * DOES know should pass it, since those two guesses come before anything in the list.
      */
-    static validatePasswordAgainstPolicy(password, policy) {
+    static validatePasswordAgainstPolicy(password, policy, blocklistContext) {
         const violations = [];
         if (password.length < policy.minLength) {
             violations.push(PasswordPolicyViolationCode.MIN_LENGTH);
@@ -120,6 +206,9 @@ export class AuthUtils {
         if (policy.requireSpecialChars && !/[^A-Za-z0-9]/.test(password)) {
             violations.push(PasswordPolicyViolationCode.SPECIAL_CHAR);
         }
+        if (isPasswordBlocklisted(password, blocklistContext)) {
+            violations.push(PasswordPolicyViolationCode.BLOCKLISTED);
+        }
         return { valid: violations.length === 0, violations };
     }
 }

package/dist/esm/security/authentications/authentication.shared.utils.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"authentication.shared.utils.js","sourceRoot":"","sources":["../../../../../src/security/authentications/authentication.shared.utils.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,sBAAsB,EAAE,wBAAwB,EAAE,MAAM,iCAAiC,CAAC;AAC/H,OAAO,EAAE,kBAAkB,EAAE,MAAM,iCAAiC,CAAC;AACrE,OAAO,EAAuB,2BAA2B,EAAE,MAAM,sDAAsD,CAAC;AAGxH;;GAEG;AACH,MAAM,OAAO,SAAS;IACpB;;OAEG;IACH,MAAM,CAAC,gBAAgB,CAAC,MAAkB;QACxC,MAAM,UAAU,GAAG,sBAAsB,CAAC,MAAM,CAAC,CAAC;QAClD,OAAO,UAAU,KAAK,cAAc,CAAC,UAAU;YACxC,UAAU,KAAK,cAAc,CAAC,eAAe;YAC7C,UAAU,KAAK,cAAc,CAAC,GAAG,CAAC;IAC3C,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,iBAAiB,CAAC,MAAkB;QACzC,MAAM,UAAU,GAAG,sBAAsB,CAAC,MAAM,CAAC,CAAC;QAClD,OAAO,UAAU,KAAK,cAAc,CAAC,WAAW;YACzC,UAAU,KAAK,cAAc,CAAC,eAAe;YAC7C,UAAU,KAAK,cAAc,CAAC,GAAG,CAAC;IAC3C,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,qBAAqB;QAC1B,OAAO,MAAM,CAAC,OAAO,CAAC,sBAAsB,CAAC;aAC1C,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,UAAU,CAAC,EAAE,EAAE,CAC1B,UAAU,KAAK,cAAc,CAAC,UAAU;YACxC,UAAU,KAAK,cAAc,CAAC,eAAe;YAC7C,UAAU,KAAK,cAAc,CAAC,GAAG,CAClC;aACA,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,MAAoB,CAAC,CAAC;IAC7C,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,sBAAsB;QAC3B,OAAO,MAAM,CAAC,OAAO,CAAC,sBAAsB,CAAC;aAC1C,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,UAAU,CAAC,EAAE,EAAE,CAC1B,UAAU,KAAK,cAAc,CAAC,WAAW;YACzC,UAAU,KAAK,cAAc,CAAC,eAAe;YAC7C,UAAU,KAAK,cAAc,CAAC,GAAG,CAClC;aACA,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,MAAoB,CAAC,CAAC;IAC7C,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,aAAa,CAAC,MAAkB;QACrC,OAAO,sBAAsB,CAAC,MAAM,CAAC,CAAC;IACxC,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,iBAAiB,CAAC,MAAkB;QACzC,OAAO,wBAAwB,CAAC,MAAM,CAAC,CAAC;IAC1C,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,wBAAwB,CAAC,MAAkB;QAChD,OAAO,wBAAwB,CAAC,MAAM,CAAC,KAAK,kBAAkB,CAAC,OAAO,CAAC;IACzE,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,yBAAyB,CAAC,MAAkB;QACjD,OAAO,wBAAwB,CAAC,MAAM,CAAC,KAAK,kBAAkB,CAAC,eAAe;YACvE,wBAAwB,CAAC,MAAM,CAAC,KAAK,kBAAkB,CAAC,OAAO,CAAC;IACzE,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,uBAAuB,CAAC,MAAkB,EAAE,aAAsB;QACvE,OAAO,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC;IACxF,CAAC;IAKD;;;;OAIG;IACH,MAAM,CAAC,8BAA8B,CAAC,IAIlB;QAClB,MAAM,OAAO,GAAiB,EAAE,CAAC;QACjC,IAAI,CAAC,IAAI;YAAE,OAAO,OAAO,CAAC;QAC1B,IAAI,IAAI,CAAC,YAAY;YAAE,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QACrD,IAAI,IAAI,CAAC,kBAAkB,IAAI,IAAI,CAAC,kBAAkB,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;QACpG,IAAI,IAAI,CAAC,mBAAmB;YAAE,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;QAC/D,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QACnC,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;;;;;;OAOG;IACH,MAAM,CAAC,6BAA6B,CAAC,QAAgB,EAAE,MAA2B;QAChF,MAAM,UAAU,GAAa,EAAE,CAAC;QAEhC,IAAI,QAAQ,CAAC,MAAM,GAAG,MAAM,CAAC,SAAS,EAAE,CAAC;YACvC,UAAU,CAAC,IAAI,CAAC,2BAA2B,CAAC,UAAU,CAAC,CAAC;QAC1D,CAAC;QACD,IAAI,QAAQ,CAAC,MAAM,GAAG,MAAM,CAAC,SAAS,EAAE,CAAC;YACvC,UAAU,CAAC,IAAI,CAAC,2BAA2B,CAAC,UAAU,CAAC,CAAC;QAC1D,CAAC;QACD,IAAI,MAAM,CAAC,gBAAgB,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YACvD,UAAU,CAAC,IAAI,CAAC,2BAA2B,CAAC,SAAS,CAAC,CAAC;QACzD,CAAC;QACD,IAAI,MAAM,CAAC,gBAAgB,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YACvD,UAAU,CAAC,IAAI,CAAC,2BAA2B,CAAC,SAAS,CAAC,CAAC;QACzD,CAAC;QACD,IAAI,MAAM,CAAC,cAAc,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAClD,UAAU,CAAC,IAAI,CAAC,2BAA2B,CAAC,MAAM,CAAC,CAAC;QACtD,CAAC;QACD,IAAI,MAAM,CAAC,mBAAmB,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YACjE,UAAU,CAAC,IAAI,CAAC,2BAA2B,CAAC,YAAY,CAAC,CAAC;QAC5D,CAAC;QAED,OAAO,EAAE,KAAK,EAAE,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,UAAU,EAAE,CAAC;IACxD,CAAC;CAEF","sourcesContent":["\nimport { z } from 'zod';\nimport { AuthMethod, AuthFactorType, AUTH_METHOD_FACTOR_MAP, AUTH_METHOD_CATEGORY_MAP } from './authentication.shared.schemas';\nimport { AuthMethodCategory } from './authentication.shared.schemas';\nimport { PasswordPolicyRules, PasswordPolicyViolationCode } from '../../config/app-configuration-shared.shared.schemas';\n\n\n/*\n Helper functions for authentication factor classification\n /\nexport class AuthUtils {\n /\n Check if method can be used as first factor\n /\n static canBeFirstFactor(method: AuthMethod): boolean {\n const factorType = AUTH_METHOD_FACTOR_MAP[method];\n return factorType === AuthFactorType.FIRST_ONLY \|\|\n factorType === AuthFactorType.FIRST_OR_SECOND \|\|\n factorType === AuthFactorType.ANY;\n }\n\n /\n Check if method can be used as second factor (MFA)\n /\n static canBeSecondFactor(method: AuthMethod): boolean {\n const factorType = AUTH_METHOD_FACTOR_MAP[method];\n return factorType === AuthFactorType.SECOND_ONLY \|\|\n factorType === AuthFactorType.FIRST_OR_SECOND \|\|\n factorType === AuthFactorType.ANY;\n }\n\n /\n Get all methods that can be used as first factor\n /\n static getFirstFactorMethods(): AuthMethod[] {\n return Object.entries(AUTH_METHOD_FACTOR_MAP)\n .filter(([_, factorType]) =>\n factorType === AuthFactorType.FIRST_ONLY \|\|\n factorType === AuthFactorType.FIRST_OR_SECOND \|\|\n factorType === AuthFactorType.ANY\n )\n .map(([method]) => method as AuthMethod);\n }\n\n /\n Get all methods that can be used as second factor\n /\n static getSecondFactorMethods(): AuthMethod[] {\n return Object.entries(AUTH_METHOD_FACTOR_MAP)\n .filter(([_, factorType]) =>\n factorType === AuthFactorType.SECOND_ONLY \|\|\n factorType === AuthFactorType.FIRST_OR_SECOND \|\|\n factorType === AuthFactorType.ANY\n )\n .map(([method]) => method as AuthMethod);\n }\n\n /\n Get factor classification for a method\n /\n static getFactorType(method: AuthMethod): AuthFactorType {\n return AUTH_METHOD_FACTOR_MAP[method];\n }\n\n /\n Get category for a method\n /\n static getMethodCategory(method: AuthMethod): AuthMethodCategory {\n return AUTH_METHOD_CATEGORY_MAP[method];\n }\n\n /\n Check if method is organization-restricted\n /\n static isOrganizationRestricted(method: AuthMethod): boolean {\n return AUTH_METHOD_CATEGORY_MAP[method] === AuthMethodCategory.ORG_SSO;\n }\n\n /\n Check if method supports integration access\n /\n static supportsIntegrationAccess(method: AuthMethod): boolean {\n return AUTH_METHOD_CATEGORY_MAP[method] === AuthMethodCategory.EXTERNAL_OAUTH2 \|\|\n AUTH_METHOD_CATEGORY_MAP[method] === AuthMethodCategory.ORG_SSO;\n }\n\n /\n Validate if a method is appropriate for the current factor level\n /\n static validateMethodForFactor(method: AuthMethod, isFirstFactor: boolean): boolean {\n return isFirstFactor ? this.canBeFirstFactor(method) : this.canBeSecondFactor(method);\n }\n\n\n\n\n /\n Determine which second-factor methods a user has actually enrolled,\n * based on their credential record. Mirrors the enrollment check in\n * AuthenticationOrchestratorBackendService._shouldRequireMFA().\n /\n static getEnrolledSecondFactorMethods(cred: {\n totpVerified?: boolean;\n passkeyCredentials?: unknown[];\n phoneNumberVerified?: boolean;\n } \| null \| undefined): AuthMethod[] {\n const methods: AuthMethod[] = [];\n if (!cred) return methods;\n if (cred.totpVerified) methods.push(AuthMethod.TOTP);\n if (cred.passkeyCredentials && cred.passkeyCredentials.length > 0) methods.push(AuthMethod.PASSKEY);\n if (cred.phoneNumberVerified) methods.push(AuthMethod.SMS_OTP);\n methods.push(AuthMethod.EMAIL_OTP);\n return methods;\n }\n\n /\n Validate a password against policy rules.\n * Returns an object with `valid` flag and an array of `violations` (i18n label keys).\n \n Single source of truth for password policy validation — used by both frontend\n * (real-time validation) and backend (AuthCredentialVerifierBackendService).\n * Frontend resolves violations via t(violationCode) with {minLength}/{maxLength} replacement.\n */\n static validatePasswordAgainstPolicy(password: string, policy: PasswordPolicyRules): { valid: boolean; violations: string[] } {\n const violations: string[] = [];\n\n if (password.length < policy.minLength) {\n violations.push(PasswordPolicyViolationCode.MIN_LENGTH);\n }\n if (password.length > policy.maxLength) {\n violations.push(PasswordPolicyViolationCode.MAX_LENGTH);\n }\n if (policy.requireUppercase && !/[A-Z]/.test(password)) {\n violations.push(PasswordPolicyViolationCode.UPPERCASE);\n }\n if (policy.requireLowercase && !/[a-z]/.test(password)) {\n violations.push(PasswordPolicyViolationCode.LOWERCASE);\n }\n if (policy.requireNumbers && !/\\d/.test(password)) {\n violations.push(PasswordPolicyViolationCode.NUMBER);\n }\n if (policy.requireSpecialChars && !/[^A-Za-z0-9]/.test(password)) {\n violations.push(PasswordPolicyViolationCode.SPECIAL_CHAR);\n }\n\n return { valid: violations.length === 0, violations };\n }\n\n}\n"]}
1	+ {"version":3,"file":"authentication.shared.utils.js","sourceRoot":"","sources":["../../../../../src/security/authentications/authentication.shared.utils.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,sBAAsB,EAAE,wBAAwB,EAAE,sBAAsB,EAAE,MAAM,iCAAiC,CAAC;AACvJ,OAAO,EAAE,kBAAkB,EAAE,MAAM,iCAAiC,CAAC;AACrE,OAAO,EAAuB,2BAA2B,EAAE,MAAM,sDAAsD,CAAC;AACxH,OAAO,EAAE,qBAAqB,EAAiC,MAAM,mCAAmC,CAAC;AAGzG;;GAEG;AACH,MAAM,OAAO,SAAS;IACpB;;OAEG;IACH,MAAM,CAAC,gBAAgB,CAAC,MAAkB;QACxC,MAAM,UAAU,GAAG,sBAAsB,CAAC,MAAM,CAAC,CAAC;QAClD,OAAO,UAAU,KAAK,cAAc,CAAC,UAAU;YACxC,UAAU,KAAK,cAAc,CAAC,eAAe;YAC7C,UAAU,KAAK,cAAc,CAAC,GAAG,CAAC;IAC3C,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,iBAAiB,CAAC,MAAkB;QACzC,MAAM,UAAU,GAAG,sBAAsB,CAAC,MAAM,CAAC,CAAC;QAClD,OAAO,UAAU,KAAK,cAAc,CAAC,WAAW;YACzC,UAAU,KAAK,cAAc,CAAC,eAAe;YAC7C,UAAU,KAAK,cAAc,CAAC,GAAG,CAAC;IAC3C,CAAC;IAED;;;;;;;;;;;;OAYG;IACH,MAAM,CAAC,gBAAgB,CAAmC,OAAqB;QAC7E,MAAM,IAAI,GAAG,CAAC,MAAkB,EAAU,EAAE,CAAC,sBAAsB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACpF,OAAO,CAAC,GAAG,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;IACpF,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,qBAAqB;QAC1B,OAAO,MAAM,CAAC,OAAO,CAAC,sBAAsB,CAAC;aAC1C,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,UAAU,CAAC,EAAE,EAAE,CAC1B,UAAU,KAAK,cAAc,CAAC,UAAU;YACxC,UAAU,KAAK,cAAc,CAAC,eAAe;YAC7C,UAAU,KAAK,cAAc,CAAC,GAAG,CAClC;aACA,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,MAAoB,CAAC,CAAC;IAC7C,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,sBAAsB;QAC3B,OAAO,MAAM,CAAC,OAAO,CAAC,sBAAsB,CAAC;aAC1C,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,UAAU,CAAC,EAAE,EAAE,CAC1B,UAAU,KAAK,cAAc,CAAC,WAAW;YACzC,UAAU,KAAK,cAAc,CAAC,eAAe;YAC7C,UAAU,KAAK,cAAc,CAAC,GAAG,CAClC;aACA,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,MAAoB,CAAC,CAAC;IAC7C,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,aAAa,CAAC,MAAkB;QACrC,OAAO,sBAAsB,CAAC,MAAM,CAAC,CAAC;IACxC,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,iBAAiB,CAAC,MAAkB;QACzC,OAAO,wBAAwB,CAAC,MAAM,CAAC,CAAC;IAC1C,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,wBAAwB,CAAC,MAAkB;QAChD,OAAO,wBAAwB,CAAC,MAAM,CAAC,KAAK,kBAAkB,CAAC,OAAO,CAAC;IACzE,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,yBAAyB,CAAC,MAAkB;QACjD,OAAO,wBAAwB,CAAC,MAAM,CAAC,KAAK,kBAAkB,CAAC,eAAe;YACvE,wBAAwB,CAAC,MAAM,CAAC,KAAK,kBAAkB,CAAC,OAAO,CAAC;IACzE,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,uBAAuB,CAAC,MAAkB,EAAE,aAAsB;QACvE,OAAO,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC;IACxF,CAAC;IAKD;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,MAAM,CAAC,qCAAqC;QAC1C,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;IAChC,CAAC;IAED;;;;;;;OAOG;IACH,MAAM,CAAC,gCAAgC;QACrC,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,qCAAqC,EAAE,CAAC,CAAC;QAC9E,OAAO,IAAI,CAAC,sBAAsB,EAAE,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;IACxF,CAAC;IAED;;;;;;;;;;OAUG;IACH,MAAM,CAAC,8BAA8B,CAAC,IAIlB;QAClB,MAAM,OAAO,GAAiB,EAAE,CAAC;QACjC,IAAI,CAAC,IAAI;YAAE,OAAO,OAAO,CAAC;QAC1B,IAAI,IAAI,CAAC,YAAY;YAAE,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QACrD,IAAI,IAAI,CAAC,kBAAkB,IAAI,IAAI,CAAC,kBAAkB,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;QACpG,IAAI,IAAI,CAAC,mBAAmB;YAAE,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;QAC/D,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;;;;;;OAOG;IACH,MAAM,CAAC,iCAAiC,CAAC,IAIrB;QAClB,OAAO,CAAC,GAAG,IAAI,CAAC,8BAA8B,CAAC,IAAI,CAAC,EAAE,GAAG,IAAI,CAAC,qCAAqC,EAAE,CAAC,CAAC;IACzG,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,MAAM,CAAC,6BAA6B,CAClC,QAAgB,EAChB,MAA2B,EAC3B,gBAA2C;QAE3C,MAAM,UAAU,GAAa,EAAE,CAAC;QAEhC,IAAI,QAAQ,CAAC,MAAM,GAAG,MAAM,CAAC,SAAS,EAAE,CAAC;YACvC,UAAU,CAAC,IAAI,CAAC,2BAA2B,CAAC,UAAU,CAAC,CAAC;QAC1D,CAAC;QACD,IAAI,QAAQ,CAAC,MAAM,GAAG,MAAM,CAAC,SAAS,EAAE,CAAC;YACvC,UAAU,CAAC,IAAI,CAAC,2BAA2B,CAAC,UAAU,CAAC,CAAC;QAC1D,CAAC;QACD,IAAI,MAAM,CAAC,gBAAgB,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YACvD,UAAU,CAAC,IAAI,CAAC,2BAA2B,CAAC,SAAS,CAAC,CAAC;QACzD,CAAC;QACD,IAAI,MAAM,CAAC,gBAAgB,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YACvD,UAAU,CAAC,IAAI,CAAC,2BAA2B,CAAC,SAAS,CAAC,CAAC;QACzD,CAAC;QACD,IAAI,MAAM,CAAC,cAAc,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAClD,UAAU,CAAC,IAAI,CAAC,2BAA2B,CAAC,MAAM,CAAC,CAAC;QACtD,CAAC;QACD,IAAI,MAAM,CAAC,mBAAmB,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YACjE,UAAU,CAAC,IAAI,CAAC,2BAA2B,CAAC,YAAY,CAAC,CAAC;QAC5D,CAAC;QACD,IAAI,qBAAqB,CAAC,QAAQ,EAAE,gBAAgB,CAAC,EAAE,CAAC;YACtD,UAAU,CAAC,IAAI,CAAC,2BAA2B,CAAC,WAAW,CAAC,CAAC;QAC3D,CAAC;QAED,OAAO,EAAE,KAAK,EAAE,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,UAAU,EAAE,CAAC;IACxD,CAAC;CAEF","sourcesContent":["\nimport { z } from 'zod';\nimport { AuthMethod, AuthFactorType, AUTH_METHOD_FACTOR_MAP, AUTH_METHOD_CATEGORY_MAP, AUTH_METHOD_PRECEDENCE } from './authentication.shared.schemas';\nimport { AuthMethodCategory } from './authentication.shared.schemas';\nimport { PasswordPolicyRules, PasswordPolicyViolationCode } from '../../config/app-configuration-shared.shared.schemas';\nimport { isPasswordBlocklisted, type PasswordBlocklistContext } from './password-blocklist.shared.utils';\n\n\n/*\n Helper functions for authentication factor classification\n /\nexport class AuthUtils {\n /\n Check if method can be used as first factor\n /\n static canBeFirstFactor(method: AuthMethod): boolean {\n const factorType = AUTH_METHOD_FACTOR_MAP[method];\n return factorType === AuthFactorType.FIRST_ONLY \|\|\n factorType === AuthFactorType.FIRST_OR_SECOND \|\|\n factorType === AuthFactorType.ANY;\n }\n\n /\n Check if method can be used as second factor (MFA)\n /\n static canBeSecondFactor(method: AuthMethod): boolean {\n const factorType = AUTH_METHOD_FACTOR_MAP[method];\n return factorType === AuthFactorType.SECOND_ONLY \|\|\n factorType === AuthFactorType.FIRST_OR_SECOND \|\|\n factorType === AuthFactorType.ANY;\n }\n\n /\n Order method entries by {@link AUTH_METHOD_PRECEDENCE} — the ONE presentation order (#1218).\n \n The BACKEND sorts, and every surface renders what it is given. A client that re-sorts is a second authority, and a\n * second authority is how the list a person sees came to disagree with the `defaultFirstFactorMethod` shipped beside\n * it.\n \n It takes `AuthMethod` rather than a widened string, and carries NO not-found fallback, because\n * `AUTH_METHOD_PRECEDENCE` is total over the vocabulary and pinned as total: an unplaced member cannot exist, so a\n * branch handling one could never run and would read as coverage it is not\n * (`invariant-call-site-enumeration.md` #19 — an unreachable guard is an untested claim). A method added to\n * `AuthMethod` fails the totality pin instead, which is where that answer belongs.\n /\n static sortByPrecedence<T extends { method: AuthMethod }>(methods: readonly T[]): T[] {\n const rank = (method: AuthMethod): number => AUTH_METHOD_PRECEDENCE.indexOf(method);\n return [...methods].sort((left, right) => rank(left.method) - rank(right.method));\n }\n\n /\n Get all methods that can be used as first factor\n /\n static getFirstFactorMethods(): AuthMethod[] {\n return Object.entries(AUTH_METHOD_FACTOR_MAP)\n .filter(([_, factorType]) =>\n factorType === AuthFactorType.FIRST_ONLY \|\|\n factorType === AuthFactorType.FIRST_OR_SECOND \|\|\n factorType === AuthFactorType.ANY\n )\n .map(([method]) => method as AuthMethod);\n }\n\n /\n Get all methods that can be used as second factor\n /\n static getSecondFactorMethods(): AuthMethod[] {\n return Object.entries(AUTH_METHOD_FACTOR_MAP)\n .filter(([_, factorType]) =>\n factorType === AuthFactorType.SECOND_ONLY \|\|\n factorType === AuthFactorType.FIRST_OR_SECOND \|\|\n factorType === AuthFactorType.ANY\n )\n .map(([method]) => method as AuthMethod);\n }\n\n /\n Get factor classification for a method\n /\n static getFactorType(method: AuthMethod): AuthFactorType {\n return AUTH_METHOD_FACTOR_MAP[method];\n }\n\n /\n Get category for a method\n /\n static getMethodCategory(method: AuthMethod): AuthMethodCategory {\n return AUTH_METHOD_CATEGORY_MAP[method];\n }\n\n /\n Check if method is organization-restricted\n /\n static isOrganizationRestricted(method: AuthMethod): boolean {\n return AUTH_METHOD_CATEGORY_MAP[method] === AuthMethodCategory.ORG_SSO;\n }\n\n /\n Check if method supports integration access\n /\n static supportsIntegrationAccess(method: AuthMethod): boolean {\n return AUTH_METHOD_CATEGORY_MAP[method] === AuthMethodCategory.EXTERNAL_OAUTH2 \|\|\n AUTH_METHOD_CATEGORY_MAP[method] === AuthMethodCategory.ORG_SSO;\n }\n\n /\n Validate if a method is appropriate for the current factor level\n /\n static validateMethodForFactor(method: AuthMethod, isFirstFactor: boolean): boolean {\n return isFirstFactor ? this.canBeFirstFactor(method) : this.canBeSecondFactor(method);\n }\n\n\n\n\n /\n The second-factor methods that need NO enrollment act, because the account already holds what\n * they require.\n \n Today that is `EMAIL_OTP` alone: the address is proven before the account is usable, so a code\n * can be sent to it without the user ever setting anything up.\n \n *Kept separate from {@link getEnrolledSecondFactorMethods} rather than folded into it, and the\n reason is the defect that forced the split.** That method used to append `EMAIL_OTP`\n * unconditionally, so \"the methods this user has enrolled\" was NEVER EMPTY — and it therefore\n * could not answer the one question every caller asked of it: has this person set up a second\n factor at all?* Four backend sites recovered the real answer by re-filtering\n * `m !== AuthMethod.EMAIL_OTP` by hand, a frontend settings page re-derived it from a literal\n * three-member list, and the startup config validator re-implemented the whole predicate. One\n * merged concept produced six hand-applications of the rule that distinguishes them.\n \n Unconditional on purpose — it takes no credential record. A missing `UserCredentials` row\n * does not mean a missing email address; the old function returned `[]` (no `EMAIL_OTP`) for a\n * credential-less user, which was an artifact of an early return rather than a statement about\n * what that user can do.\n /\n static getAlwaysAvailableSecondFactorMethods(): AuthMethod[] {\n return [AuthMethod.EMAIL_OTP];\n }\n\n /\n The second-factor methods that CAN be enrolled — the vocabulary minus the ones that need no\n * enrollment. Total over {@link AUTH_METHOD_FACTOR_MAP}, so a second factor added to the\n * vocabulary tomorrow is offered by every enrollment surface without one of them being edited.\n \n This is the VOCABULARY-level answer and takes no policy. For the policy-level answer — what\n * THIS application's configuration actually permits — use `resolveEnrollableSecondFactorMethods`.\n /\n static getEnrollableSecondFactorMethods(): AuthMethod[] {\n const alwaysAvailable = new Set(this.getAlwaysAvailableSecondFactorMethods());\n return this.getSecondFactorMethods().filter((method) => !alwaysAvailable.has(method));\n }\n\n /\n The second-factor methods this user has actually ENROLLED — each one required a deliberate\n * setup act, recorded on the credential row.\n \n An empty result means exactly that: nothing is set up. That is the whole point of the\n * split described on {@link getAlwaysAvailableSecondFactorMethods}; callers asking \"must this\n * user enroll something?\" read this and nothing else.\n \n See {@link getPresentableSecondFactorMethods} for the union with the no-setup factors, which\n * is what a CHALLENGE may offer.\n /\n static getEnrolledSecondFactorMethods(cred: {\n totpVerified?: boolean;\n passkeyCredentials?: unknown[];\n phoneNumberVerified?: boolean;\n } \| null \| undefined): AuthMethod[] {\n const methods: AuthMethod[] = [];\n if (!cred) return methods;\n if (cred.totpVerified) methods.push(AuthMethod.TOTP);\n if (cred.passkeyCredentials && cred.passkeyCredentials.length > 0) methods.push(AuthMethod.PASSKEY);\n if (cred.phoneNumberVerified) methods.push(AuthMethod.SMS_OTP);\n return methods;\n }\n\n /\n Every second factor this user could present today — enrolled ∪ always-available.\n \n This is the set a CHALLENGE is built from (after intersecting it with what the policy accepts).\n * It is deliberately NOT the set an ENROLLMENT offer is built from: you cannot enroll a factor\n * that needs no enrollment, and offering one as a setup step is how a user ends up staring at a\n * screen with nothing actionable on it.\n /\n static getPresentableSecondFactorMethods(cred: {\n totpVerified?: boolean;\n passkeyCredentials?: unknown[];\n phoneNumberVerified?: boolean;\n } \| null \| undefined): AuthMethod[] {\n return [...this.getEnrolledSecondFactorMethods(cred), ...this.getAlwaysAvailableSecondFactorMethods()];\n }\n\n /\n Validate a password against policy rules.\n * Returns an object with `valid` flag and an array of `violations` (i18n label keys).\n \n Single source of truth for password policy validation — used by both frontend\n * (real-time validation) and backend (AuthCredentialVerifierBackendService).\n * Frontend resolves violations via t(violationCode) with {minLength}/{maxLength} replacement.\n \n ## The blocklist check is UNCONDITIONAL, and that is the point\n \n Every other rule here is gated on a policy flag, so an application can turn it off. The\n * blocklist is not, because NIST SP 800-63B-4 §3.1.1.2 states it as a flat obligation on the\n * verifier — \"verifiers SHALL compare the prospective secret against a blocklist\" — with no\n * configurable half, in the same section that FORBIDS the composition rules above. Making it\n * optional would let an application keep the shape of a password policy while removing the only\n * rule the standard still asks for.\n \n spec-cite: NIST SP 800-63B-4 §3.1.1.2 (https://pages.nist.gov/800-63-4/sp800-63b.html).\n \n `blocklistContext` is what an attacker guesses about THIS application and THIS person — the\n * service's own name, the user's own email local part. It is optional because the bundled list is\n * the floor and must run whether or not a caller knows who is setting the password; a caller that\n * DOES know should pass it, since those two guesses come before anything in the list.\n */\n static validatePasswordAgainstPolicy(\n password: string,\n policy: PasswordPolicyRules,\n blocklistContext?: PasswordBlocklistContext,\n ): { valid: boolean; violations: string[] } {\n const violations: string[] = [];\n\n if (password.length < policy.minLength) {\n violations.push(PasswordPolicyViolationCode.MIN_LENGTH);\n }\n if (password.length > policy.maxLength) {\n violations.push(PasswordPolicyViolationCode.MAX_LENGTH);\n }\n if (policy.requireUppercase && !/[A-Z]/.test(password)) {\n violations.push(PasswordPolicyViolationCode.UPPERCASE);\n }\n if (policy.requireLowercase && !/[a-z]/.test(password)) {\n violations.push(PasswordPolicyViolationCode.LOWERCASE);\n }\n if (policy.requireNumbers && !/\\d/.test(password)) {\n violations.push(PasswordPolicyViolationCode.NUMBER);\n }\n if (policy.requireSpecialChars && !/[^A-Za-z0-9]/.test(password)) {\n violations.push(PasswordPolicyViolationCode.SPECIAL_CHAR);\n }\n if (isPasswordBlocklisted(password, blocklistContext)) {\n violations.push(PasswordPolicyViolationCode.BLOCKLISTED);\n }\n\n return { valid: violations.length === 0, violations };\n }\n\n}\n"]}

package/dist/esm/security/authentications/consumable-token.shared.schemas.d.ts CHANGED Viewed

@@ -21,8 +21,30 @@ export declare enum CoreConsumableTokenTypes {
     PHONE_VERIFICATION = "phone_verification",
     /** SAML AuthnRequest correlation state (AUTH-2: SAML Protocol Engine) */
     SAML_AUTH_STATE = "saml_auth_state",
-    /** Re-authentication token for sensitive method changes (#13f) */
+    /**
+     * Step-up proof: the account holder re-proved who they are, with a factor the user type's
+     * `stepUpAuth.methods` accepts. The ONLY type a sensitive operation, a method removal or a TOTP
+     * disable accepts (#13f, #422).
+     */
     REAUTH = "reauth",
+    /**
+     * Binding proof (#1417): the account holder re-proved who they are in order to ADD a way to sign in,
+     * with any factor they hold, whatever the step-up policy names. Accepted by the binding doors and by
+     * nothing else, so it cannot unlock a sensitive operation.
+     *
+     * It exists because a step-up policy that names a factor the account does not hold yet would
+     * otherwise deadlock: a password-only account told to enrol a passkey could only mint a password
+     * proof, and the policy refuses a password. Separating the proof by purpose lets the policy bind the
+     * step-up without locking the enrolment it asks for.
+     */
+    REAUTH_BIND = "reauth_bind",
+    /**
+     * One-time code carrying a re-authentication proof (`REAUTH` or `REAUTH_BIND`) minted by a
+     * federated re-authentication (#1441). The identity provider's callback lands in a popup; the code
+     * is handed to the window that opened it, which redeems it with its OWN bearer, so the proof can be
+     * redeemed only by the account it was minted for, and the proof itself never travels in a URL.
+     */
+    REAUTH_CODE_EXCHANGE = "reauth_code_exchange",
     /**
      * OIDC authorization code (Wildo-as-provider authorization_code flow). Single-use,
      * short-TTL; its metadata binds the code to the authenticated `userId`, the requesting

package/dist/esm/security/authentications/consumable-token.shared.schemas.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"consumable-token.shared.schemas.d.ts","sourceRoot":"","sources":["~~../../../../~~src/security/authentications/consumable-token.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAClE,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,gDAAgD,CAAC;AAOhG,oBAAY,wBAAwB;IAChC,8BAA8B,mCAAmC;IACjE,cAAc,mBAAmC;IACjD,kBAAkB,uBAAmC;IACrD,kBAAkB,uBAAmC;IACrD,YAAY,iBAAmC;IAC/C,uBAAuB,4BAAmC;IAC1D,oBAAoB,yBAAmC;IACvD,wFAAwF;IACxF,kBAAkB,uBAAmC;IACrD,kEAAkE;IAClE,SAAS,cAAmC;IAC5C,+EAA+E;IAC/E,UAAU,eAAmC;IAC7C,qEAAqE;IACrE,OAAO,YAAmC;IAC1C,sFAAsF;IACtF,kBAAkB,uBAAmC;IACrD,yEAAyE;IACzE,eAAe,oBAAmC;IAClD~~,kEAAkE~~;~~IAClE~~,MAAM,WAAmC;IACzC;;;;;OAKG;IACH,uBAAuB,4BAAmC;IAC1D;;;;;;;;OAQG;IACH,oBAAoB,yBAAmC;IACvD;;;;;;;;;;;OAWG;IACH,wBAAwB,6BAAmC;IAC3D;;;;;;;;;;;;;;OAcG;IACH,iBAAiB,sBAAmC;CACvD;AAED,eAAO,MAAM,0BAA0B,gFAGrC,CAAC;AAGH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAO9E;;;;;;GAMG;AACH,oBAAY,+BAA+B;IACvC,UAAU,eAAoB;IAC9B,aAAa,kBAAoB;IACjC,eAAe,oBAAoB;CACtC;AAOD;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,eAAe,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;AAOjF;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,MAAM,wBAAwB,GAAG,CAAC,MAAM,EAAE;IAAE,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;CAAE,KAAK,OAAO,CAAC;AACnG,0EAA0E;AAE1E;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,MAAM,qBAAqB,GAAG;IAChC,+EAA+E;IAC/E,SAAS,EAAE,oBAAoB,CAAC;IAEhC,sCAAsC;IACtC,eAAe,EAAE,+BAA+B,CAAC;IAEjD;;;;;OAKG;IACH,SAAS,EAAE,eAAe,CAAC,iBAAiB,CAAC,CAAC;IAE9C;;;;;;;;;;;;OAYG;IACH,SAAS,CAAC,EAAE,wBAAwB,CAAC;IAErC;;;;OAIG;IACH,YAAY,CAAC,EAAE,eAAe,CAAC,yBAAyB,EAAE,CAAC,CAAC;IAE5D,uFAAuF;IACvF,OAAO,CAAC,EAAE,MAAM,CAAC;IAEjB,oGAAoG;IACpG,4BAA4B,CAAC,EAAE,OAAO,CAAC;IAEvC,4FAA4F;IAC5F,cAAc,CAAC,EAAE,MAAM,CAAC;IAExB;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IAErB;;;OAGG;IACH,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAE/B;;;;;OAKG;IACH,SAAS,CAAC,EAAE,UAAU,GAAG,kBAAkB,CAAC;IAE5C;;;;;;;OAOG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAEzC;;;;;;;;OAQG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;CAC1B,CAAC;AACF,0EAA0E;AAE1E;;;;;;;;;GASG;AACH,MAAM,MAAM,qBAAqB,GAAG;IAChC,+DAA+D;IAC/D,UAAU,EAAE,oBAAoB,EAAE,CAAC;IAEnC,0FAA0F;IAC1F,cAAc,CAAC,EAAE,MAAM,CAAC;CAC3B,CAAC;AAEF;;;;GAIG;AACH,oBAAY,yBAAyB;IACjC,WAAW,gBAAgB;IAC3B,QAAQ,aAAa;CACxB;AAED;;;;;;;GAOG;AACH,MAAM,MAAM,yBAAyB,GAAG;IACpC,kEAAkE;IAClE,KAAK,EAAE,oBAAoB,EAAE,CAAC;IAC9B,MAAM,EAAE,yBAAyB,CAAC;CACrC,CAAC"}
1	+ {"version":3,"file":"consumable-token.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/security/authentications/consumable-token.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAClE,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,gDAAgD,CAAC;AAOhG,oBAAY,wBAAwB;IAChC,8BAA8B,mCAAmC;IACjE,cAAc,mBAAmC;IACjD,kBAAkB,uBAAmC;IACrD,kBAAkB,uBAAmC;IACrD,YAAY,iBAAmC;IAC/C,uBAAuB,4BAAmC;IAC1D,oBAAoB,yBAAmC;IACvD,wFAAwF;IACxF,kBAAkB,uBAAmC;IACrD,kEAAkE;IAClE,SAAS,cAAmC;IAC5C,+EAA+E;IAC/E,UAAU,eAAmC;IAC7C,qEAAqE;IACrE,OAAO,YAAmC;IAC1C,sFAAsF;IACtF,kBAAkB,uBAAmC;IACrD,yEAAyE;IACzE,eAAe,oBAAmC;IAClD;;;;OAIG;IACH,MAAM,WAAmC;IACzC;;;;;;;;;OASG;IACH,WAAW,gBAAmC;IAC9C;;;;;OAKG;IACH,oBAAoB,yBAAmC;IACvD;;;;;OAKG;IACH,uBAAuB,4BAAmC;IAC1D;;;;;;;;OAQG;IACH,oBAAoB,yBAAmC;IACvD;;;;;;;;;;;OAWG;IACH,wBAAwB,6BAAmC;IAC3D;;;;;;;;;;;;;;OAcG;IACH,iBAAiB,sBAAmC;CACvD;AAED,eAAO,MAAM,0BAA0B,gFAGrC,CAAC;AAGH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAO9E;;;;;;GAMG;AACH,oBAAY,+BAA+B;IACvC,UAAU,eAAoB;IAC9B,aAAa,kBAAoB;IACjC,eAAe,oBAAoB;CACtC;AAOD;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,eAAe,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;AAOjF;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,MAAM,wBAAwB,GAAG,CAAC,MAAM,EAAE;IAAE,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;CAAE,KAAK,OAAO,CAAC;AACnG,0EAA0E;AAE1E;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,MAAM,qBAAqB,GAAG;IAChC,+EAA+E;IAC/E,SAAS,EAAE,oBAAoB,CAAC;IAEhC,sCAAsC;IACtC,eAAe,EAAE,+BAA+B,CAAC;IAEjD;;;;;OAKG;IACH,SAAS,EAAE,eAAe,CAAC,iBAAiB,CAAC,CAAC;IAE9C;;;;;;;;;;;;OAYG;IACH,SAAS,CAAC,EAAE,wBAAwB,CAAC;IAErC;;;;OAIG;IACH,YAAY,CAAC,EAAE,eAAe,CAAC,yBAAyB,EAAE,CAAC,CAAC;IAE5D,uFAAuF;IACvF,OAAO,CAAC,EAAE,MAAM,CAAC;IAEjB,oGAAoG;IACpG,4BAA4B,CAAC,EAAE,OAAO,CAAC;IAEvC,4FAA4F;IAC5F,cAAc,CAAC,EAAE,MAAM,CAAC;IAExB;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IAErB;;;OAGG;IACH,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAE/B;;;;;OAKG;IACH,SAAS,CAAC,EAAE,UAAU,GAAG,kBAAkB,CAAC;IAE5C;;;;;;;OAOG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAEzC;;;;;;;;OAQG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;CAC1B,CAAC;AACF,0EAA0E;AAE1E;;;;;;;;;GASG;AACH,MAAM,MAAM,qBAAqB,GAAG;IAChC,+DAA+D;IAC/D,UAAU,EAAE,oBAAoB,EAAE,CAAC;IAEnC,0FAA0F;IAC1F,cAAc,CAAC,EAAE,MAAM,CAAC;CAC3B,CAAC;AAEF;;;;GAIG;AACH,oBAAY,yBAAyB;IACjC,WAAW,gBAAgB;IAC3B,QAAQ,aAAa;CACxB;AAED;;;;;;;GAOG;AACH,MAAM,MAAM,yBAAyB,GAAG;IACpC,kEAAkE;IAClE,KAAK,EAAE,oBAAoB,EAAE,CAAC;IAC9B,MAAM,EAAE,yBAAyB,CAAC;CACrC,CAAC"}

package/dist/esm/security/authentications/consumable-token.shared.schemas.js CHANGED Viewed

@@ -23,8 +23,30 @@ export var CoreConsumableTokenTypes;
     CoreConsumableTokenTypes["PHONE_VERIFICATION"] = "phone_verification";
     /** SAML AuthnRequest correlation state (AUTH-2: SAML Protocol Engine) */
     CoreConsumableTokenTypes["SAML_AUTH_STATE"] = "saml_auth_state";
-    /** Re-authentication token for sensitive method changes (#13f) */
+    /**
+     * Step-up proof: the account holder re-proved who they are, with a factor the user type's
+     * `stepUpAuth.methods` accepts. The ONLY type a sensitive operation, a method removal or a TOTP
+     * disable accepts (#13f, #422).
+     */
     CoreConsumableTokenTypes["REAUTH"] = "reauth";
+    /**
+     * Binding proof (#1417): the account holder re-proved who they are in order to ADD a way to sign in,
+     * with any factor they hold, whatever the step-up policy names. Accepted by the binding doors and by
+     * nothing else, so it cannot unlock a sensitive operation.
+     *
+     * It exists because a step-up policy that names a factor the account does not hold yet would
+     * otherwise deadlock: a password-only account told to enrol a passkey could only mint a password
+     * proof, and the policy refuses a password. Separating the proof by purpose lets the policy bind the
+     * step-up without locking the enrolment it asks for.
+     */
+    CoreConsumableTokenTypes["REAUTH_BIND"] = "reauth_bind";
+    /**
+     * One-time code carrying a re-authentication proof (`REAUTH` or `REAUTH_BIND`) minted by a
+     * federated re-authentication (#1441). The identity provider's callback lands in a popup; the code
+     * is handed to the window that opened it, which redeems it with its OWN bearer, so the proof can be
+     * redeemed only by the account it was minted for, and the proof itself never travels in a URL.
+     */
+    CoreConsumableTokenTypes["REAUTH_CODE_EXCHANGE"] = "reauth_code_exchange";
     /**
      * OIDC authorization code (Wildo-as-provider authorization_code flow). Single-use,
      * short-TTL; its metadata binds the code to the authenticated `userId`, the requesting