Namespace SEBT.Portal.Api.Services

AuthCookies: Helper for the HttpOnly session cookie that carries the portal JWT. The JWT is never returned in response bodies or exposed to JavaScript — the browser transports it automatically via this cookie.

DevelopmentPhoneOverrideProvider: Returns the configured override phone when in Development and config is set; otherwise null.

NullPhoneOverrideProvider: Always returns null — no phone override is applied.

OidcCallbackFailureLogger: Structured logging for OIDC callback failures that send users to id-proofing off-boarding.

OidcSessionCookie: helper for the oidc_session HttpOnly cookie that binds the pre-auth OIDC session to the browser. Short-lived (15 min, matching PreAuthSessionStore TTL). Cleared after complete-login because the session has served its purpose by then.

PkceHelper: server-side PKCE generation. Produces a cryptographically random code_verifier and its S256 code_challenge, plus a random state parameter. These are stored in the pre-auth session; only code_challenge and state are sent to the browser.

PreAuthSessionStore: manages the lifecycle of server-side pre-auth OIDC sessions. Implementations store sessions in a cache (L1 memory + optional L2 Redis) with an automatic TTL so abandoned flows expire without explicit cleanup.

StateAllowlist: Server-side allowlist of state codes permitted to use the OIDC login endpoints. Derived at startup from per-state appsettings overlays that have Oidc:DiscoveryEndpoint configured; an instance loaded with STATE=co and CO's Oidc block exposes {"co"}, nothing else. Any stateCode in a route or request body that isn't in this set is rejected before the OIDC flow touches PingOne, blocking attempts to use an instance as an unintended tenant.

TokenDenylist: Server-side revocation list for portal JWTs, keyed by the token's jti claim. Logout records the surrendered token here; the bearer middleware rejects denylisted tokens on every authenticated request. Entries live only until the token would have expired anyway, so the list stays small.

IStateAllowlist: Server-side allowlist of state codes permitted to use the OIDC login endpoints. Derived at startup from per-state appsettings overlays that have Oidc:DiscoveryEndpoint configured; an instance loaded with STATE=co and CO's Oidc block exposes {"co"}, nothing else. Any stateCode in a route or request body that isn't in this set is rejected before the OIDC flow touches PingOne, blocking attempts to use an instance as an unintended tenant.

ITokenDenylist: Server-side revocation list for portal JWTs, keyed by the token's jti claim. Logout records the surrendered token here; the bearer middleware rejects denylisted tokens on every authenticated request. Entries live only until the token would have expired anyway, so the list stays small.