Arquitectura

// access-token hook (reference pseudocode)
async function accessTokenHook(request) {
  const { claims, user_id } = request;
  const clientId = claims.client_id; // from the OAuth engine

  // Non-OAuth session token: leave untouched.
  if (!clientId) return { claims };

  // OAuth token: resolve identity + enablement + account (no permissions).
  const result = await resolveOauthIdentity({ userId: user_id, clientId });

  if (!result?.enabled) {
    return { error: { http_code: 403, message: "access_denied_not_enabled" } };
  }

  return {
    claims: {
      ...claims,
      iss: ISSUER,                       // canonical per-environment auth.* issuer
      aud: AUDIENCE,                     // fixed IdP audience: "bbrands-idp"
      jti: claims.jti ?? generateJti(),  // guaranteed, drives the blacklist
      "https://bbrands.io/client_handle": result.client_handle,
      "https://bbrands.io/platform_type": result.platform_type,
      "https://bbrands.io/profile": {
        account: result.account,             // account bound via primary_user role
        odoo: result.account_external_id,    // account.external_id, null if unmapped
        user: claims.sub,
      },
    },
  };
}