libre-webui 0.22.0 → 0.23.0

package/backend/dist/services/securityAuditService.d.ts

@@ -0,0 +1,35 @@
+import type { AuditResult, StoredSecurityAuditEventRecord } from '../persistence/index.js';
+export type AuditActorKind = 'user' | 'api-token' | 'system' | 'anonymous';
+export interface SecurityAuditEventInput {
+    action: string;
+    result: AuditResult;
+    actorUserId?: string | null;
+    actorKind?: AuditActorKind;
+    targetType?: string;
+    targetId?: string;
+    requestId?: string;
+    ipHash?: string | null;
+    details?: Record<string, unknown>;
+}
+export declare const auditRetentionMs: () => number;
+/** Serialize event details with secret keys removed and size bounded. */
+export declare const redactAuditDetails: (details: Record<string, unknown> | undefined) => string | null;
+/** One-way IP digest: correlates events without storing addresses. */
+export declare const hashClientIp: (ip: string | undefined) => string | null;
+/** Build the persisted row shape for direct or transactional inserts. */
+export declare const buildAuditEvent: (input: SecurityAuditEventInput) => StoredSecurityAuditEventRecord;
+/**
+ * Best-effort audit write for observations. Never throws: an audit outage
+ * must not turn into an authentication or authorization outage.
+ */
+export declare const recordAuditEvent: (input: SecurityAuditEventInput) => Promise<void>;
+export declare const queryAuditEvents: (query: {
+    action?: string;
+    actorUserId?: string;
+    result?: AuditResult;
+    targetType?: string;
+    before?: number;
+    after?: number;
+    limit?: number;
+}) => Promise<StoredSecurityAuditEventRecord[]>;
+//# sourceMappingURL=securityAuditService.d.ts.map

package/backend/dist/services/securityAuditService.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"securityAuditService.d.ts","sourceRoot":"","sources":["../../src/services/securityAuditService.ts"],"names":[],"mappings":"AAqCA,OAAO,KAAK,EACV,WAAW,EAEX,8BAA8B,EAC/B,MAAM,yBAAyB,CAAC;AAMjC,MAAM,MAAM,cAAc,GAAG,MAAM,GAAG,WAAW,GAAG,QAAQ,GAAG,WAAW,CAAC;AAE3E,MAAM,WAAW,uBAAuB;IACtC,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,WAAW,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,SAAS,CAAC,EAAE,cAAc,CAAC;IAC3B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACnC;AAYD,eAAO,MAAM,gBAAgB,QAAO,MAOnC,CAAC;AAyBF,yEAAyE;AACzE,eAAO,MAAM,kBAAkB,YACpB,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,KAC3C,MAAM,GAAG,IAYX,CAAC;AAEF,sEAAsE;AACtE,eAAO,MAAM,YAAY,OAAQ,MAAM,GAAG,SAAS,KAAG,MAAM,GAAG,IAG9D,CAAC;AAEF,yEAAyE;AACzE,eAAO,MAAM,eAAe,UACnB,uBAAuB,KAC7B,8BAYD,CAAC;AAgBH;;;GAGG;AACH,eAAO,MAAM,gBAAgB,UACpB,uBAAuB,KAC7B,OAAO,CAAC,IAAI,CAad,CAAC;AAEF,eAAO,MAAM,gBAAgB,UAAiB;IAC5C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,KAAG,OAAO,CAAC,8BAA8B,EAAE,CAY3C,CAAC"}

package/backend/dist/services/securityAuditService.js

@@ -0,0 +1,159 @@
+/*
+ * Libre WebUI
+ * Copyright (C) 2025 Kroonen AI, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/**
+ * Security audit log (AUDIT-01/02).
+ *
+ * Records security-sensitive actions and denials as append-only events that
+ * are separate from usage analytics. Details are redacted before persistence:
+ * secret-like keys are dropped, strings are truncated, and the serialized
+ * payload is capped, so prompts, passwords, tokens, and provider bodies can
+ * never enter the log.
+ *
+ * Two write paths exist:
+ * - `recordAuditEvent` for observations (logins, denials): best-effort, never
+ *   throws, so a logging failure cannot block authentication.
+ * - `buildAuditEvent` + the transactional audit repositories for
+ *   security-critical mutations (group/grant/token/user changes): the caller
+ *   writes the event inside the same database transaction as the mutation,
+ *   so the mutation cannot commit without its audit trail.
+ */
+import { createHash, randomUUID } from 'node:crypto';
+import { getPersistence } from '../persistence/index.js';
+import { encryptionService } from './encryptionService.js';
+import { createLogger } from '../utils/logger.js';
+const logger = createLogger('services:security-audit');
+const SECRET_KEY_PATTERN = /pass(word)?|secret|token|key|authorization|cookie|credential|bearer|jwt/i;
+const MAX_DETAIL_STRING = 256;
+const MAX_DETAIL_BYTES = 4096;
+const MAX_DETAIL_DEPTH = 4;
+const AUDIT_RETENTION_DAYS_DEFAULT = 180;
+const PRUNE_EVERY_N_WRITES = 512;
+let writesSincePrune = 0;
+export const auditRetentionMs = () => {
+    const parsed = Number.parseInt(process.env.AUDIT_RETENTION_DAYS ?? '', 10);
+    const days = Number.isFinite(parsed) && parsed > 0
+        ? parsed
+        : AUDIT_RETENTION_DAYS_DEFAULT;
+    return days * 24 * 60 * 60 * 1000;
+};
+const redactValue = (value, depth) => {
+    if (value === null || value === undefined)
+        return value;
+    if (typeof value === 'string') {
+        return value.length > MAX_DETAIL_STRING
+            ? `${value.slice(0, MAX_DETAIL_STRING)}…`
+            : value;
+    }
+    if (typeof value === 'number' || typeof value === 'boolean')
+        return value;
+    if (depth >= MAX_DETAIL_DEPTH)
+        return '[truncated]';
+    if (Array.isArray(value)) {
+        return value.slice(0, 32).map(item => redactValue(item, depth + 1));
+    }
+    if (typeof value === 'object') {
+        const redacted = {};
+        for (const [key, item] of Object.entries(value)) {
+            if (SECRET_KEY_PATTERN.test(key))
+                continue;
+            redacted[key] = redactValue(item, depth + 1);
+        }
+        return redacted;
+    }
+    return String(value);
+};
+/** Serialize event details with secret keys removed and size bounded. */
+export const redactAuditDetails = (details) => {
+    if (!details)
+        return null;
+    try {
+        const serialized = JSON.stringify(redactValue(details, 0));
+        if (!serialized || serialized === '{}')
+            return null;
+        if (Buffer.byteLength(serialized, 'utf8') > MAX_DETAIL_BYTES) {
+            return JSON.stringify({ truncated: true });
+        }
+        return serialized;
+    }
+    catch {
+        return null;
+    }
+};
+/** One-way IP digest: correlates events without storing addresses. */
+export const hashClientIp = (ip) => {
+    if (!ip)
+        return null;
+    return createHash('sha256').update(ip).digest('hex').slice(0, 32);
+};
+/** Build the persisted row shape for direct or transactional inserts. */
+export const buildAuditEvent = (input) => ({
+    id: randomUUID(),
+    occurred_at: Date.now(),
+    actor_user_id: input.actorUserId ?? null,
+    actor_kind: input.actorKind ?? (input.actorUserId ? 'user' : 'anonymous'),
+    action: input.action,
+    target_type: input.targetType ?? null,
+    target_id: input.targetId ?? null,
+    result: input.result,
+    request_id: input.requestId ?? null,
+    ip_hash: input.ipHash ?? null,
+    details: redactAuditDetails(input.details),
+});
+const pruneOpportunistically = async () => {
+    writesSincePrune += 1;
+    if (writesSincePrune < PRUNE_EVERY_N_WRITES)
+        return;
+    writesSincePrune = 0;
+    try {
+        const persistence = getPersistence(encryptionService);
+        await persistence.repositories.security.audit.deleteBefore(Date.now() - auditRetentionMs());
+    }
+    catch (error) {
+        logger.warn('Audit retention prune failed', { error });
+    }
+};
+/**
+ * Best-effort audit write for observations. Never throws: an audit outage
+ * must not turn into an authentication or authorization outage.
+ */
+export const recordAuditEvent = async (input) => {
+    try {
+        const persistence = getPersistence(encryptionService);
+        await persistence.repositories.security.audit.insert(buildAuditEvent(input));
+        await pruneOpportunistically();
+    }
+    catch (error) {
+        logger.error('Failed to record security audit event', {
+            action: input.action,
+            error,
+        });
+    }
+};
+export const queryAuditEvents = async (query) => {
+    const persistence = getPersistence(encryptionService);
+    const bounded = {
+        ...(query.action ? { action: query.action } : {}),
+        ...(query.actorUserId ? { actorUserId: query.actorUserId } : {}),
+        ...(query.result ? { result: query.result } : {}),
+        ...(query.targetType ? { targetType: query.targetType } : {}),
+        ...(query.before !== undefined ? { before: query.before } : {}),
+        ...(query.after !== undefined ? { after: query.after } : {}),
+        limit: Math.min(Math.max(query.limit ?? 100, 1), 500),
+    };
+    return persistence.repositories.security.audit.query(bounded);
+};
+//# sourceMappingURL=securityAuditService.js.map

package/backend/dist/services/securityAuditService.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"securityAuditService.js","sourceRoot":"","sources":["../../src/services/securityAuditService.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAMzD,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAElD,MAAM,MAAM,GAAG,YAAY,CAAC,yBAAyB,CAAC,CAAC;AAgBvD,MAAM,kBAAkB,GACtB,0EAA0E,CAAC;AAC7E,MAAM,iBAAiB,GAAG,GAAG,CAAC;AAC9B,MAAM,gBAAgB,GAAG,IAAI,CAAC;AAC9B,MAAM,gBAAgB,GAAG,CAAC,CAAC;AAE3B,MAAM,4BAA4B,GAAG,GAAG,CAAC;AACzC,MAAM,oBAAoB,GAAG,GAAG,CAAC;AACjC,IAAI,gBAAgB,GAAG,CAAC,CAAC;AAEzB,MAAM,CAAC,MAAM,gBAAgB,GAAG,GAAW,EAAE;IAC3C,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;IAC3E,MAAM,IAAI,GACR,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC;QACnC,CAAC,CAAC,MAAM;QACR,CAAC,CAAC,4BAA4B,CAAC;IACnC,OAAO,IAAI,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AACpC,CAAC,CAAC;AAEF,MAAM,WAAW,GAAG,CAAC,KAAc,EAAE,KAAa,EAAW,EAAE;IAC7D,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACxD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,KAAK,CAAC,MAAM,GAAG,iBAAiB;YACrC,CAAC,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,iBAAiB,CAAC,GAAG;YACzC,CAAC,CAAC,KAAK,CAAC;IACZ,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAC1E,IAAI,KAAK,IAAI,gBAAgB;QAAE,OAAO,aAAa,CAAC;IACpD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC;IACtE,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,QAAQ,GAA4B,EAAE,CAAC;QAC7C,KAAK,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAe,CAAC,EAAE,CAAC;YAC1D,IAAI,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC;gBAAE,SAAS;YAC3C,QAAQ,CAAC,GAAG,CAAC,GAAG,WAAW,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;QAC/C,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;AACvB,CAAC,CAAC;AAEF,yEAAyE;AACzE,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAChC,OAA4C,EAC7B,EAAE;IACjB,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1B,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;QAC3D,IAAI,CAAC,UAAU,IAAI,UAAU,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QACpD,IAAI,MAAM,CAAC,UAAU,CAAC,UAAU,EAAE,MAAM,CAAC,GAAG,gBAAgB,EAAE,CAAC;YAC7D,OAAO,IAAI,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7C,CAAC;QACD,OAAO,UAAU,CAAC;IACpB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC,CAAC;AAEF,sEAAsE;AACtE,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,EAAsB,EAAiB,EAAE;IACpE,IAAI,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IACrB,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AACpE,CAAC,CAAC;AAEF,yEAAyE;AACzE,MAAM,CAAC,MAAM,eAAe,GAAG,CAC7B,KAA8B,EACE,EAAE,CAAC,CAAC;IACpC,EAAE,EAAE,UAAU,EAAE;IAChB,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE;IACvB,aAAa,EAAE,KAAK,CAAC,WAAW,IAAI,IAAI;IACxC,UAAU,EAAE,KAAK,CAAC,SAAS,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC;IACzE,MAAM,EAAE,KAAK,CAAC,MAAM;IACpB,WAAW,EAAE,KAAK,CAAC,UAAU,IAAI,IAAI;IACrC,SAAS,EAAE,KAAK,CAAC,QAAQ,IAAI,IAAI;IACjC,MAAM,EAAE,KAAK,CAAC,MAAM;IACpB,UAAU,EAAE,KAAK,CAAC,SAAS,IAAI,IAAI;IACnC,OAAO,EAAE,KAAK,CAAC,MAAM,IAAI,IAAI;IAC7B,OAAO,EAAE,kBAAkB,CAAC,KAAK,CAAC,OAAO,CAAC;CAC3C,CAAC,CAAC;AAEH,MAAM,sBAAsB,GAAG,KAAK,IAAmB,EAAE;IACvD,gBAAgB,IAAI,CAAC,CAAC;IACtB,IAAI,gBAAgB,GAAG,oBAAoB;QAAE,OAAO;IACpD,gBAAgB,GAAG,CAAC,CAAC;IACrB,IAAI,CAAC;QACH,MAAM,WAAW,GAAG,cAAc,CAAC,iBAAiB,CAAC,CAAC;QACtD,MAAM,WAAW,CAAC,YAAY,CAAC,QAAQ,CAAC,KAAK,CAAC,YAAY,CACxD,IAAI,CAAC,GAAG,EAAE,GAAG,gBAAgB,EAAE,CAChC,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,IAAI,CAAC,8BAA8B,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;IACzD,CAAC;AACH,CAAC,CAAC;AAEF;;;GAGG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,KAAK,EACnC,KAA8B,EACf,EAAE;IACjB,IAAI,CAAC;QACH,MAAM,WAAW,GAAG,cAAc,CAAC,iBAAiB,CAAC,CAAC;QACtD,MAAM,WAAW,CAAC,YAAY,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAClD,eAAe,CAAC,KAAK,CAAC,CACvB,CAAC;QACF,MAAM,sBAAsB,EAAE,CAAC;IACjC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,KAAK,CAAC,uCAAuC,EAAE;YACpD,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,KAAK;SACN,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,gBAAgB,GAAG,KAAK,EAAE,KAQtC,EAA6C,EAAE;IAC9C,MAAM,WAAW,GAAG,cAAc,CAAC,iBAAiB,CAAC,CAAC;IACtD,MAAM,OAAO,GAAuB;QAClC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjD,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChE,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjD,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7D,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/D,GAAG,CAAC,KAAK,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5D,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,IAAI,GAAG,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC;KACtD,CAAC;IACF,OAAO,WAAW,CAAC,YAAY,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;AAChE,CAAC,CAAC"}

package/backend/dist/services/simpleGitHubOAuth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"simpleGitHubOAuth.d.ts","sourceRoot":"","sources":["../../src/services/simpleGitHubOAuth.ts"],"names":[],"mappings":"AAkBA,OAAO,EAAa,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAM/D,UAAU,aAAa;IACrB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,qBAAa,kBAAkB;IAC7B,cAEC;IAED,OAAO,KAAK,QAAQ,GAEnB;IAED,OAAO,KAAK,YAAY,GAEvB;IAED,OAAO,KAAK,WAAW,GAKtB;IAED;;OAEG;IACH,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAgBhC;IAED;;OAEG;IACH,YAAY,IAAI,OAAO,CAEtB;IAED;;OAEG;IACG,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAiC/D;IAED;;OAEG;IACG,cAAc,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CA2CvE;IAED;;OAEG;IACG,eAAe,CACnB,IAAI,EAAE,MAAM,GACX,OAAO,CAAC;QAAE,IAAI,EAAE,UAAU,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC,CAuBrD;IAED;;OAEG;IACG,WAAW,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAEpE;IAED;;OAEG;YACW,gBAAgB;CAiD/B;AAGD,eAAO,MAAM,kBAAkB,oBAA2B,CAAC"}
+{"version":3,"file":"simpleGitHubOAuth.d.ts","sourceRoot":"","sources":["../../src/services/simpleGitHubOAuth.ts"],"names":[],"mappings":"AAkBA,OAAO,EAAa,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAM/D,UAAU,aAAa;IACrB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,qBAAa,kBAAkB;IAC7B,cAEC;IAED,OAAO,KAAK,QAAQ,GAEnB;IAED,OAAO,KAAK,YAAY,GAEvB;IAED,OAAO,KAAK,WAAW,GAKtB;IAED;;OAEG;IACH,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAgBhC;IAED;;OAEG;IACH,YAAY,IAAI,OAAO,CAEtB;IAED;;OAEG;IACG,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAiC/D;IAED;;OAEG;IACG,cAAc,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CA2CvE;IAED;;OAEG;IACG,eAAe,CACnB,IAAI,EAAE,MAAM,GACX,OAAO,CAAC;QAAE,IAAI,EAAE,UAAU,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC,CAyBrD;IAED;;OAEG;IACG,WAAW,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAEpE;IAED;;OAEG;YACW,gBAAgB;CAiD/B;AAGD,eAAO,MAAM,kBAAkB,oBAA2B,CAAC"}

package/backend/dist/services/simpleGitHubOAuth.js

@@ -141,8 +141,10 @@ export class GitHubOAuthService {
                 return null;
             if (user.status !== 'active')
                 return null;
-            // Generate JWT token
-            const jwtToken = authService.generateToken(user);
+            // Issue a revocable session-bound JWT
+            const jwtToken = await authService.issueSession(user, {
+                kind: 'oauth:github',
+            });
             return { user, token: jwtToken };
         }
         catch (error) {

package/backend/dist/services/simpleGitHubOAuth.js.map

@@ -1 +1 @@
-{"version":3,"file":"simpleGitHubOAuth.js","sourceRoot":"","sources":["../../src/services/simpleGitHubOAuth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,EAAE,SAAS,EAAc,MAAM,wBAAwB,CAAC;AAC/D,OAAO,KAAK,MAAM,MAAM,QAAQ,CAAC;AACjC,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAElD,MAAM,MAAM,GAAG,YAAY,CAAC,+BAA+B,CAAC,CAAC;AAU7D,MAAM,OAAO,kBAAkB;IAC7B;QACE,oDAAoD;IACtD,CAAC;IAED,IAAY,QAAQ;QAClB,OAAO,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC;IACtC,CAAC;IAED,IAAY,YAAY;QACtB,OAAO,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC;IAC1C,CAAC;IAED,IAAY,WAAW;QACrB,OAAO,CACL,OAAO,CAAC,GAAG,CAAC,mBAAmB;YAC/B,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,IAAI,uBAAuB,iCAAiC,CACpF,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,UAAU,CAAC,KAAa;QACtB,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACnB,MAAM,IAAI,KAAK,CACb,wFAAwF,CACzF,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;YACjC,SAAS,EAAE,IAAI,CAAC,QAAQ;YACxB,YAAY,EAAE,IAAI,CAAC,WAAW;YAC9B,KAAK,EAAE,YAAY;YACnB,aAAa,EAAE,MAAM;YACrB,KAAK;SACN,CAAC,CAAC;QAEH,OAAO,4CAA4C,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC;IACzE,CAAC;IAED;;OAEG;IACH,YAAY;QACV,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,YAAY,CAAC,CAAC;IAChD,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,oBAAoB,CAAC,IAAY;QACrC,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;YACzC,MAAM,CAAC,KAAK,CAAC,yCAAyC,CAAC,CAAC;YACxD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAC1B,6CAA6C,EAC7C;gBACE,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,MAAM,EAAE,kBAAkB;oBAC1B,cAAc,EAAE,kBAAkB;iBACnC;gBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;oBACnB,SAAS,EAAE,IAAI,CAAC,QAAQ;oBACxB,aAAa,EAAE,IAAI,CAAC,YAAY;oBAChC,IAAI;oBACJ,YAAY,EAAE,IAAI,CAAC,WAAW;iBAC/B,CAAC;aACH,CACF,CAAC;YAEF,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAGlC,CAAC;YACF,OAAO,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC;QACnC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,CAAC,8BAA8B,EAAE,KAAK,CAAC,CAAC;YACpD,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,cAAc,CAAC,WAAmB;QACtC,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,6BAA6B,EAAE;gBAC1D,OAAO,EAAE;oBACP,aAAa,EAAE,SAAS,WAAW,EAAE;oBACrC,MAAM,EAAE,kBAAkB;iBAC3B;aACF,CAAC,CAAC;YAEH,IAAI,CAAC,QAAQ,CAAC,EAAE;gBAAE,OAAO,IAAI,CAAC;YAE9B,MAAM,OAAO,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAkB,CAAC;YAEzD,iCAAiC;YACjC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;gBACnB,MAAM,aAAa,GAAG,MAAM,KAAK,CAC/B,oCAAoC,EACpC;oBACE,OAAO,EAAE;wBACP,aAAa,EAAE,SAAS,WAAW,EAAE;wBACrC,MAAM,EAAE,kBAAkB;qBAC3B;iBACF,CACF,CAAC;gBAEF,IAAI,aAAa,CAAC,EAAE,EAAE,CAAC;oBACrB,MAAM,MAAM,GAAG,CAAC,MAAM,aAAa,CAAC,IAAI,EAAE,CAIvC,CAAC;oBACJ,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;oBACzD,IAAI,YAAY,EAAE,CAAC;wBACjB,OAAO,CAAC,KAAK,GAAG,YAAY,CAAC,KAAK,CAAC;oBACrC,CAAC;gBACH,CAAC;YACH,CAAC;YAED,OAAO,OAAO,CAAC;QACjB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,CAAC,6BAA6B,EAAE,KAAK,CAAC,CAAC;YACnD,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,eAAe,CACnB,IAAY;QAEZ,IAAI,CAAC;YACH,iCAAiC;YACjC,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC;YAC1D,IAAI,CAAC,WAAW;gBAAE,OAAO,IAAI,CAAC;YAE9B,mBAAmB;YACnB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,WAAW,CAAC,CAAC;YACvD,IAAI,CAAC,OAAO;gBAAE,OAAO,IAAI,CAAC;YAE1B,sBAAsB;YACtB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;YAClD,IAAI,CAAC,IAAI;gBAAE,OAAO,IAAI,CAAC;YACvB,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ;gBAAE,OAAO,IAAI,CAAC;YAE1C,qBAAqB;YACrB,MAAM,QAAQ,GAAG,WAAW,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;YAEjD,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;QACnC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,CAAC,8BAA8B,EAAE,KAAK,CAAC,CAAC;YACpD,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,WAAW,CAAC,OAAsB;QACtC,OAAO,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;IACxC,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,gBAAgB,CAC5B,OAAsB;QAEtB,IAAI,CAAC;YACH,qCAAqC;YACrC,IAAI,cAAc,GAAG,MAAM,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,EAAE,EAAE,CAAC;YAEzD,+BAA+B;YAC/B,MAAM,YAAY,GAAG,MAAM,SAAS,CAAC,iBAAiB,CAAC,cAAc,CAAC,CAAC;YAEvE,IAAI,YAAY,EAAE,CAAC;gBACjB,MAAM,CAAC,KAAK,CAAC,6BAA6B,EAAE,YAAY,CAAC,QAAQ,CAAC,CAAC;gBACnE,OAAO,MAAM,SAAS,CAAC,WAAW,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;YACtD,CAAC;YAED,IAAI,CAAC,WAAW,CAAC,2BAA2B,EAAE,EAAE,CAAC;gBAC/C,MAAM,CAAC,IAAI,CACT,wEAAwE,CACzE,CAAC;gBACF,OAAO,IAAI,CAAC;YACd,CAAC;YAED,gCAAgC;YAChC,IAAI,cAAc,GAAG,cAAc,CAAC;YACpC,IAAI,OAAO,GAAG,CAAC,CAAC;YAChB,OAAO,MAAM,SAAS,CAAC,cAAc,CAAC,cAAc,CAAC,EAAE,CAAC;gBACtD,cAAc,GAAG,GAAG,cAAc,IAAI,OAAO,EAAE,CAAC;gBAChD,OAAO,EAAE,CAAC;YACZ,CAAC;YAED,kBAAkB;YAClB,MAAM,CAAC,KAAK,CAAC,2BAA2B,EAAE,cAAc,CAAC,CAAC;YAE1D,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,gBAAgB,CAAC;gBAC/C,QAAQ,EAAE,cAAc;gBACxB,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,IAAI;gBAC5B,4FAA4F;gBAC5F,4EAA4E;gBAC5E,QAAQ,EAAE,QAAQ,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;aAC/D,CAAC,CAAC;YACH,IAAI,CAAC,OAAO;gBAAE,OAAO,IAAI,CAAC;YAE1B,MAAM,CAAC,KAAK,CAAC,0BAA0B,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;YAC3D,OAAO,OAAO,CAAC;QACjB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,CAAC,qCAAqC,EAAE,KAAK,CAAC,CAAC;YAC3D,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;CACF;AAED,4BAA4B;AAC5B,MAAM,CAAC,MAAM,kBAAkB,GAAG,IAAI,kBAAkB,EAAE,CAAC"}
+{"version":3,"file":"simpleGitHubOAuth.js","sourceRoot":"","sources":["../../src/services/simpleGitHubOAuth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,EAAE,SAAS,EAAc,MAAM,wBAAwB,CAAC;AAC/D,OAAO,KAAK,MAAM,MAAM,QAAQ,CAAC;AACjC,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAElD,MAAM,MAAM,GAAG,YAAY,CAAC,+BAA+B,CAAC,CAAC;AAU7D,MAAM,OAAO,kBAAkB;IAC7B;QACE,oDAAoD;IACtD,CAAC;IAED,IAAY,QAAQ;QAClB,OAAO,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC;IACtC,CAAC;IAED,IAAY,YAAY;QACtB,OAAO,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC;IAC1C,CAAC;IAED,IAAY,WAAW;QACrB,OAAO,CACL,OAAO,CAAC,GAAG,CAAC,mBAAmB;YAC/B,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,IAAI,uBAAuB,iCAAiC,CACpF,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,UAAU,CAAC,KAAa;QACtB,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACnB,MAAM,IAAI,KAAK,CACb,wFAAwF,CACzF,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;YACjC,SAAS,EAAE,IAAI,CAAC,QAAQ;YACxB,YAAY,EAAE,IAAI,CAAC,WAAW;YAC9B,KAAK,EAAE,YAAY;YACnB,aAAa,EAAE,MAAM;YACrB,KAAK;SACN,CAAC,CAAC;QAEH,OAAO,4CAA4C,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC;IACzE,CAAC;IAED;;OAEG;IACH,YAAY;QACV,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,YAAY,CAAC,CAAC;IAChD,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,oBAAoB,CAAC,IAAY;QACrC,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;YACzC,MAAM,CAAC,KAAK,CAAC,yCAAyC,CAAC,CAAC;YACxD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAC1B,6CAA6C,EAC7C;gBACE,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,MAAM,EAAE,kBAAkB;oBAC1B,cAAc,EAAE,kBAAkB;iBACnC;gBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;oBACnB,SAAS,EAAE,IAAI,CAAC,QAAQ;oBACxB,aAAa,EAAE,IAAI,CAAC,YAAY;oBAChC,IAAI;oBACJ,YAAY,EAAE,IAAI,CAAC,WAAW;iBAC/B,CAAC;aACH,CACF,CAAC;YAEF,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAGlC,CAAC;YACF,OAAO,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC;QACnC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,CAAC,8BAA8B,EAAE,KAAK,CAAC,CAAC;YACpD,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,cAAc,CAAC,WAAmB;QACtC,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,6BAA6B,EAAE;gBAC1D,OAAO,EAAE;oBACP,aAAa,EAAE,SAAS,WAAW,EAAE;oBACrC,MAAM,EAAE,kBAAkB;iBAC3B;aACF,CAAC,CAAC;YAEH,IAAI,CAAC,QAAQ,CAAC,EAAE;gBAAE,OAAO,IAAI,CAAC;YAE9B,MAAM,OAAO,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAkB,CAAC;YAEzD,iCAAiC;YACjC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;gBACnB,MAAM,aAAa,GAAG,MAAM,KAAK,CAC/B,oCAAoC,EACpC;oBACE,OAAO,EAAE;wBACP,aAAa,EAAE,SAAS,WAAW,EAAE;wBACrC,MAAM,EAAE,kBAAkB;qBAC3B;iBACF,CACF,CAAC;gBAEF,IAAI,aAAa,CAAC,EAAE,EAAE,CAAC;oBACrB,MAAM,MAAM,GAAG,CAAC,MAAM,aAAa,CAAC,IAAI,EAAE,CAIvC,CAAC;oBACJ,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;oBACzD,IAAI,YAAY,EAAE,CAAC;wBACjB,OAAO,CAAC,KAAK,GAAG,YAAY,CAAC,KAAK,CAAC;oBACrC,CAAC;gBACH,CAAC;YACH,CAAC;YAED,OAAO,OAAO,CAAC;QACjB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,CAAC,6BAA6B,EAAE,KAAK,CAAC,CAAC;YACnD,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,eAAe,CACnB,IAAY;QAEZ,IAAI,CAAC;YACH,iCAAiC;YACjC,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC;YAC1D,IAAI,CAAC,WAAW;gBAAE,OAAO,IAAI,CAAC;YAE9B,mBAAmB;YACnB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,WAAW,CAAC,CAAC;YACvD,IAAI,CAAC,OAAO;gBAAE,OAAO,IAAI,CAAC;YAE1B,sBAAsB;YACtB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;YAClD,IAAI,CAAC,IAAI;gBAAE,OAAO,IAAI,CAAC;YACvB,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ;gBAAE,OAAO,IAAI,CAAC;YAE1C,sCAAsC;YACtC,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,YAAY,CAAC,IAAI,EAAE;gBACpD,IAAI,EAAE,cAAc;aACrB,CAAC,CAAC;YAEH,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;QACnC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,CAAC,8BAA8B,EAAE,KAAK,CAAC,CAAC;YACpD,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,WAAW,CAAC,OAAsB;QACtC,OAAO,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;IACxC,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,gBAAgB,CAC5B,OAAsB;QAEtB,IAAI,CAAC;YACH,qCAAqC;YACrC,IAAI,cAAc,GAAG,MAAM,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,EAAE,EAAE,CAAC;YAEzD,+BAA+B;YAC/B,MAAM,YAAY,GAAG,MAAM,SAAS,CAAC,iBAAiB,CAAC,cAAc,CAAC,CAAC;YAEvE,IAAI,YAAY,EAAE,CAAC;gBACjB,MAAM,CAAC,KAAK,CAAC,6BAA6B,EAAE,YAAY,CAAC,QAAQ,CAAC,CAAC;gBACnE,OAAO,MAAM,SAAS,CAAC,WAAW,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;YACtD,CAAC;YAED,IAAI,CAAC,WAAW,CAAC,2BAA2B,EAAE,EAAE,CAAC;gBAC/C,MAAM,CAAC,IAAI,CACT,wEAAwE,CACzE,CAAC;gBACF,OAAO,IAAI,CAAC;YACd,CAAC;YAED,gCAAgC;YAChC,IAAI,cAAc,GAAG,cAAc,CAAC;YACpC,IAAI,OAAO,GAAG,CAAC,CAAC;YAChB,OAAO,MAAM,SAAS,CAAC,cAAc,CAAC,cAAc,CAAC,EAAE,CAAC;gBACtD,cAAc,GAAG,GAAG,cAAc,IAAI,OAAO,EAAE,CAAC;gBAChD,OAAO,EAAE,CAAC;YACZ,CAAC;YAED,kBAAkB;YAClB,MAAM,CAAC,KAAK,CAAC,2BAA2B,EAAE,cAAc,CAAC,CAAC;YAE1D,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,gBAAgB,CAAC;gBAC/C,QAAQ,EAAE,cAAc;gBACxB,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,IAAI;gBAC5B,4FAA4F;gBAC5F,4EAA4E;gBAC5E,QAAQ,EAAE,QAAQ,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;aAC/D,CAAC,CAAC;YACH,IAAI,CAAC,OAAO;gBAAE,OAAO,IAAI,CAAC;YAE1B,MAAM,CAAC,KAAK,CAAC,0BAA0B,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;YAC3D,OAAO,OAAO,CAAC;QACjB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,CAAC,qCAAqC,EAAE,KAAK,CAAC,CAAC;YAC3D,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;CACF;AAED,4BAA4B;AAC5B,MAAM,CAAC,MAAM,kBAAkB,GAAG,IAAI,kBAAkB,EAAE,CAAC"}

package/backend/dist/services/simpleOidcOAuth.d.ts

@@ -0,0 +1,62 @@
+import { type UserPublic } from '../models/userModel.js';
+interface DiscoveryDocument {
+    issuer: string;
+    authorization_endpoint: string;
+    token_endpoint: string;
+    jwks_uri: string;
+    userinfo_endpoint?: string;
+}
+export interface OidcClaims {
+    sub: string;
+    email?: string;
+    email_verified?: boolean;
+    preferred_username?: string;
+    name?: string;
+    nonce?: string;
+    [claim: string]: unknown;
+}
+export declare class OidcError extends Error {
+    readonly code: string;
+    constructor(message: string, code: string);
+}
+export declare class OidcOAuthService {
+    private discoveryCache;
+    private jwksCache;
+    private get issuerUrl();
+    private get clientId();
+    private get clientSecret();
+    private get callbackUrl();
+    private get scopes();
+    get displayName(): string;
+    private get allowedEmailDomains();
+    private get groupClaim();
+    private get adminGroups();
+    private get syncGroups();
+    isConfigured(): boolean;
+    discover(): Promise<DiscoveryDocument>;
+    /** PKCE pair for one flow. */
+    createPkcePair(): {
+        verifier: string;
+        challenge: string;
+    };
+    createNonce(): string;
+    getAuthUrl(state: string, nonce: string, codeChallenge: string): Promise<string>;
+    exchangeCode(code: string, verifier: string): Promise<{
+        idToken: string;
+        accessToken?: string;
+    }>;
+    private signingKeyFor;
+    /** Verify signature, issuer, audience, expiry, and nonce. */
+    verifyIdToken(idToken: string, expectedNonce: string): Promise<OidcClaims>;
+    private claimGroups;
+    private assertEmailPolicy;
+    private syncRoleAndGroups;
+    /**
+     * Resolve the verified claims to a Libre account: linked identity first,
+     * then policy-checked account creation. Never links by bare email.
+     */
+    processClaims(claims: OidcClaims): Promise<UserPublic>;
+}
+export declare const oidcOAuthService: OidcOAuthService;
+export {};
+//# sourceMappingURL=simpleOidcOAuth.d.ts.map

package/backend/dist/services/simpleOidcOAuth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"simpleOidcOAuth.d.ts","sourceRoot":"","sources":["../../src/services/simpleOidcOAuth.ts"],"names":[],"mappings":"AA+CA,OAAO,EAAa,KAAK,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAMpE,UAAU,iBAAiB;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,sBAAsB,EAAE,MAAM,CAAC;IAC/B,cAAc,EAAE,MAAM,CAAC;IACvB,QAAQ,EAAE,MAAM,CAAC;IACjB,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,UAAU;IACzB,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;CAC1B;AAED,qBAAa,SAAU,SAAQ,KAAK;IAGhC,QAAQ,CAAC,IAAI,EAAE,MAAM;IAFvB,YACE,OAAO,EAAE,MAAM,EACN,IAAI,EAAE,MAAM,EAItB;CACF;AAoBD,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,cAAc,CAER;IACd,OAAO,CAAC,SAAS,CAEH;IAEd,OAAO,KAAK,SAAS,GAEpB;IAED,OAAO,KAAK,QAAQ,GAEnB;IAED,OAAO,KAAK,YAAY,GAEvB;IAED,OAAO,KAAK,WAAW,GAKtB;IAED,OAAO,KAAK,MAAM,GAEjB;IAED,IAAI,WAAW,IAAI,MAAM,CAExB;IAED,OAAO,KAAK,mBAAmB,GAK9B;IAED,OAAO,KAAK,UAAU,GAErB;IAED,OAAO,KAAK,WAAW,GAKtB;IAED,OAAO,KAAK,UAAU,GAErB;IAED,YAAY,IAAI,OAAO,CAEtB;IAEK,QAAQ,IAAI,OAAO,CAAC,iBAAiB,CAAC,CA8B3C;IAED,8BAA8B;IAC9B,cAAc,IAAI;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAIxD;IAED,WAAW,IAAI,MAAM,CAEpB;IAEK,UAAU,CACd,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,MAAM,EACb,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC,MAAM,CAAC,CAajB;IAEK,YAAY,CAChB,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAwBpD;YAEa,aAAa;IAoC3B,6DAA6D;IACvD,aAAa,CACjB,OAAO,EAAE,MAAM,EACf,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC,UAAU,CAAC,CAmCrB;IAED,OAAO,CAAC,WAAW;IAWnB,OAAO,CAAC,iBAAiB;YAiBX,iBAAiB;IAmD/B;;;OAGG;IACG,aAAa,CAAC,MAAM,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,CAqF3D;CACF;AAED,eAAO,MAAM,gBAAgB,kBAAyB,CAAC"}