@acorex-platform/framework-server 0.0.32 → 0.0.37

package/security/src/lib/auth/auth-runtime.handlers.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.AUTH_RUNTIME_QUERIES = exports.AuthGetAccessPolicyRuntimeQuery = exports.AuthListApplicationsRuntimeQuery = exports.AuthListTenantsRuntimeQuery = exports.AuthListProvidersRuntimeQuery = exports.AUTH_RUNTIME_COMMANDS = exports.AuthUpdateSessionRuntimeCommand = exports.AuthLogoutRuntimeCommand = exports.AuthRefreshRuntimeCommand = exports.AuthRegisterRuntimeCommand = exports.AuthSignInRuntimeCommand = void 0;
+exports.AUTH_RUNTIME_QUERIES = exports.AuthGetAccessPolicyRuntimeQuery = exports.AuthListOwnDeviceSessionsRuntimeQuery = exports.AuthListApplicationsRuntimeQuery = exports.AuthListTenantsRuntimeQuery = exports.AuthListProvidersRuntimeQuery = exports.AUTH_RUNTIME_COMMANDS = exports.AuthTerminateOwnDeviceSessionRuntimeCommand = exports.AuthUpdateSessionRuntimeCommand = exports.AuthLogoutRuntimeCommand = exports.AuthRefreshRuntimeCommand = exports.AuthRegisterRuntimeCommand = exports.AuthSignInRuntimeCommand = void 0;
 const tslib_1 = require("tslib");
 const core_1 = require("@acorex-platform/framework-shared/core");
 const runtime_1 = require("@acorex-platform/framework-shared/runtime");
@@ -30,10 +30,12 @@ let AuthSignInRuntimeCommand = class AuthSignInRuntimeCommand {
         this.auth.assertSupportedSignInStrategy(input.strategy);
         const username = String(input.username ?? '').trim();
         const password = String(input.password ?? '');
-        const user = await this.loginAttempts.authenticateLocal(this.loginAttempts.strategyName(), username, password);
         const request = (0, auth_http_request_util_1.resolveAuthHttpRequest)();
         const meta = (0, request_meta_util_1.resolveAuthRequestMeta)(request);
-        const data = await this.auth.completeSignIn(user, meta);
+        const user = await this.loginAttempts.authenticateLocal(this.loginAttempts.strategyName(), username, password, meta);
+        const data = await this.auth.completeSignIn(user, meta, {
+            ...(typeof input.rememberMe === 'boolean' ? { persist: input.rememberMe } : {}),
+        });
         (0, auth_cookie_response_util_1.applyAuthTokenCookies)(request, this.cookies, this.tokens, data);
         return { success: true, kind: 'object', data };
     }
@@ -147,12 +149,35 @@ exports.AuthUpdateSessionRuntimeCommand = AuthUpdateSessionRuntimeCommand = tsli
         auth_cookie_service_1.AuthCookieService,
         token_service_1.TokenService])
 ], AuthUpdateSessionRuntimeCommand);
+let AuthTerminateOwnDeviceSessionRuntimeCommand = class AuthTerminateOwnDeviceSessionRuntimeCommand {
+    constructor(auth, tokenResolver) {
+        this.auth = auth;
+        this.tokenResolver = tokenResolver;
+    }
+    async execute(input) {
+        const request = (0, auth_http_request_util_1.resolveAuthHttpRequest)();
+        const resolved = this.tokenResolver.resolveAccessToken(request.headers, request.cookies);
+        if (!resolved) {
+            throw new common_1.UnauthorizedException('Access token is required');
+        }
+        await this.auth.terminateOwnDeviceSession(resolved.token, String(input.id ?? ''));
+        return (0, core_1.runtimeCommandSuccessObject)(undefined);
+    }
+};
+exports.AuthTerminateOwnDeviceSessionRuntimeCommand = AuthTerminateOwnDeviceSessionRuntimeCommand;
+exports.AuthTerminateOwnDeviceSessionRuntimeCommand = AuthTerminateOwnDeviceSessionRuntimeCommand = tslib_1.__decorate([
+    (0, abstract_1.ServerHandler)({ key: runtime_1.AUTH_TERMINATE_OWN_DEVICE_SESSION_DEFAULT, auth: 'session' }),
+    (0, common_1.Injectable)(),
+    tslib_1.__metadata("design:paramtypes", [auth_service_1.AuthService,
+        token_resolver_service_1.TokenResolverService])
+], AuthTerminateOwnDeviceSessionRuntimeCommand);
 exports.AUTH_RUNTIME_COMMANDS = [
     AuthSignInRuntimeCommand,
     AuthRegisterRuntimeCommand,
     AuthRefreshRuntimeCommand,
     AuthLogoutRuntimeCommand,
     AuthUpdateSessionRuntimeCommand,
+    AuthTerminateOwnDeviceSessionRuntimeCommand,
 ];
 //#endregion
 //#region ---- Auth runtime queries ----
@@ -226,6 +251,28 @@ exports.AuthListApplicationsRuntimeQuery = AuthListApplicationsRuntimeQuery = ts
     tslib_1.__metadata("design:paramtypes", [session_context_service_1.SessionContextService,
         backend_session_service_1.BackendSessionService])
 ], AuthListApplicationsRuntimeQuery);
+let AuthListOwnDeviceSessionsRuntimeQuery = class AuthListOwnDeviceSessionsRuntimeQuery {
+    constructor(auth, tokenResolver) {
+        this.auth = auth;
+        this.tokenResolver = tokenResolver;
+    }
+    async execute(input) {
+        const request = (0, auth_http_request_util_1.resolveAuthHttpRequest)();
+        const resolved = this.tokenResolver.resolveAccessToken(request.headers, request.cookies);
+        if (!resolved) {
+            throw new common_1.UnauthorizedException('Access token is required');
+        }
+        const items = await this.auth.listOwnActiveDeviceSessions(resolved.token, String(input?.tenantId ?? ''));
+        return (0, core_1.runtimeQuerySuccessCollection)(items);
+    }
+};
+exports.AuthListOwnDeviceSessionsRuntimeQuery = AuthListOwnDeviceSessionsRuntimeQuery;
+exports.AuthListOwnDeviceSessionsRuntimeQuery = AuthListOwnDeviceSessionsRuntimeQuery = tslib_1.__decorate([
+    (0, abstract_1.ServerQueryHandler)({ key: runtime_1.AUTH_LIST_OWN_DEVICE_SESSIONS_DEFAULT, auth: 'session' }),
+    (0, common_1.Injectable)(),
+    tslib_1.__metadata("design:paramtypes", [auth_service_1.AuthService,
+        token_resolver_service_1.TokenResolverService])
+], AuthListOwnDeviceSessionsRuntimeQuery);
 let AuthGetAccessPolicyRuntimeQuery = class AuthGetAccessPolicyRuntimeQuery {
     constructor(sessionContext, backendSession) {
         this.sessionContext = sessionContext;
@@ -248,6 +295,7 @@ exports.AUTH_RUNTIME_QUERIES = [
     AuthListProvidersRuntimeQuery,
     AuthListTenantsRuntimeQuery,
     AuthListApplicationsRuntimeQuery,
+    AuthListOwnDeviceSessionsRuntimeQuery,
     AuthGetAccessPolicyRuntimeQuery,
 ];
 //#endregion

package/security/src/lib/auth/auth-runtime.handlers.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth-runtime.handlers.js","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/auth/auth-runtime.handlers.ts"],"names":[],"mappings":";;;;AACA,iEAIgD;AAEhD,uEAUmD;AACnD,gFAAkI;AAClI,2CAAmE;AACnE,uCAAyC;AAEzC,qEAAkE;AAClE,2EAGqC;AACrC,+DAA0D;AAC1D,iDAA6C;AAQ7C,mEAA8D;AAC9D,2DAA6D;AAC7D,qEAAgE;AAChE,mDAA+C;AAC/C,gFAA2E;AAC3E,gFAA2E;AAC3E,mFAKyC;AAOzC,yCAAyC;AAIlC,IAAM,wBAAwB,GAA9B,MAAM,wBAAwB;IACnC,YACmB,IAAiB,EACjB,aAAkC,EAClC,OAA0B,EAC1B,MAAoB;QAHpB,SAAI,GAAJ,IAAI,CAAa;QACjB,kBAAa,GAAb,aAAa,CAAqB;QAClC,YAAO,GAAP,OAAO,CAAmB;QAC1B,WAAM,GAAN,MAAM,CAAc;IACpC,CAAC;IAEJ,KAAK,CAAC,OAAO,CAAC,KAAuB;QACnC,IAAI,CAAC,IAAI,CAAC,6BAA6B,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAExD,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACrD,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC;QAE9C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,iBAAiB,CACrD,IAAI,CAAC,aAAa,CAAC,YAAY,EAAE,EACjC,QAAQ,EACR,QAAQ,CACT,CAAC;QAEF,MAAM,OAAO,GAAG,IAAA,+CAAsB,GAAE,CAAC;QACzC,MAAM,IAAI,GAAG,IAAA,0CAAsB,EAAC,OAAO,CAAC,CAAC;QAC7C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACxD,IAAA,iDAAqB,EAAC,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAEhE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IACjD,CAAC;CACF,CAAA;AA3BY,4DAAwB;mCAAxB,wBAAwB;IAFpC,IAAA,wBAAa,EAAC,EAAE,GAAG,EAAE,8BAAoB,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IAC5D,IAAA,mBAAU,GAAE;6CAGc,0BAAW;QACF,2CAAmB;QACzB,uCAAiB;QAClB,4BAAY;GAL5B,wBAAwB,CA2BpC;AAIM,IAAM,0BAA0B,GAAhC,MAAM,0BAA0B;IACrC,YACmB,IAAiB,EACjB,OAA0B,EAC1B,MAAoB;QAFpB,SAAI,GAAJ,IAAI,CAAa;QACjB,YAAO,GAAP,OAAO,CAAmB;QAC1B,WAAM,GAAN,MAAM,CAAc;IACpC,CAAC;IAEJ,KAAK,CAAC,OAAO,CAAC,KAAyB;QACrC,MAAM,OAAO,GAAG,IAAA,+CAAsB,GAAE,CAAC;QACzC,MAAM,IAAI,GAAG,IAAA,0CAAsB,EAAC,OAAO,CAAC,CAAC;QAC7C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QACnD,IAAA,iDAAqB,EAAC,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAEhE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IACjD,CAAC;CACF,CAAA;AAfY,gEAA0B;qCAA1B,0BAA0B;IAFtC,IAAA,wBAAa,EAAC,EAAE,GAAG,EAAE,+BAAqB,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IAC7D,IAAA,mBAAU,GAAE;6CAGc,0BAAW;QACR,uCAAiB;QAClB,4BAAY;GAJ5B,0BAA0B,CAetC;AAIM,IAAM,yBAAyB,GAA/B,MAAM,yBAAyB;IAGpC,YACmB,IAAiB,EACjB,OAA0B,EAC1B,MAAoB;QAFpB,SAAI,GAAJ,IAAI,CAAa;QACjB,YAAO,GAAP,OAAO,CAAmB;QAC1B,WAAM,GAAN,MAAM,CAAc;IACpC,CAAC;IAEJ,KAAK,CAAC,OAAO,CAAC,KAA6B;QACzC,MAAM,OAAO,GAAG,IAAA,+CAAsB,GAAE,CAAC;QACzC,MAAM,YAAY,GAChB,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,OAAO,CAAC,OAAkC,CAAC;YACzE,KAAK,CAAC,YAAY,EAAE,IAAI,EAAE;YAC1B,IAAI,CAAC;QAEP,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,MAAM,IAAI,8BAAqB,CAAC,0BAA0B,CAAC,CAAC;QAC9D,CAAC;QAED,MAAM,IAAI,GAAG,IAAA,0CAAsB,EAAC,OAAO,CAAC,CAAC;QAC7C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC;QAChE,IAAA,iDAAqB,EAAC,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAEhE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IACjD,CAAC;CACF,CAAA;AA1BY,8DAAyB;oCAAzB,yBAAyB;IAFrC,IAAA,wBAAa,EAAC,EAAE,GAAG,EAAE,8BAAoB,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IAC5D,IAAA,mBAAU,GAAE;6CAKc,0BAAW;QACR,uCAAiB;QAClB,4BAAY;GAN5B,yBAAyB,CA0BrC;AAIM,IAAM,wBAAwB,GAA9B,MAAM,wBAAwB;IACnC,YACmB,IAAiB,EACjB,OAA0B;QAD1B,SAAI,GAAJ,IAAI,CAAa;QACjB,YAAO,GAAP,OAAO,CAAmB;IAC1C,CAAC;IAEJ,KAAK,CAAC,OAAO,CAAC,KAA6B;QACzC,MAAM,OAAO,GAAG,IAAA,+CAAsB,GAAE,CAAC;QACzC,MAAM,YAAY,GAChB,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,OAAO,CAAC,OAAkC,CAAC;YACzE,KAAK,CAAC,YAAY,EAAE,IAAI,EAAE;YAC1B,IAAI,CAAC;QAEP,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QACrC,IAAA,iDAAqB,EAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;QAE7C,OAAO,IAAA,kCAA2B,EAAC,SAAS,CAAC,CAAC;IAChD,CAAC;CACF,CAAA;AAlBY,4DAAwB;mCAAxB,wBAAwB;IAFpC,IAAA,wBAAa,EAAC,EAAE,GAAG,EAAE,6BAAmB,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IAC3D,IAAA,mBAAU,GAAE;6CAGc,0BAAW;QACR,uCAAiB;GAHlC,wBAAwB,CAkBpC;AAIM,IAAM,+BAA+B,GAArC,MAAM,+BAA+B;IAG1C,YACmB,IAAiB,EACjB,aAAmC,EACnC,OAA0B,EAC1B,MAAoB;QAHpB,SAAI,GAAJ,IAAI,CAAa;QACjB,kBAAa,GAAb,aAAa,CAAsB;QACnC,YAAO,GAAP,OAAO,CAAmB;QAC1B,WAAM,GAAN,MAAM,CAAc;IACpC,CAAC;IAEJ,KAAK,CAAC,OAAO,CAAC,KAA8B;QAC1C,MAAM,OAAO,GAAG,IAAA,+CAAsB,GAAE,CAAC;QACzC,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,CAAC,kBAAkB,CACpD,OAAO,CAAC,OAAwD,EAChE,OAAO,CAAC,OAAkC,CAC3C,CAAC;QAEF,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,8BAAqB,CAAC,0BAA0B,CAAC,CAAC;QAC9D,CAAC;QAED,MAAM,IAAI,GAAG,IAAA,0CAAsB,EAAC,OAAO,CAAC,CAAC;QAC7C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;QACxE,IAAA,iDAAqB,EAAC,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAEhE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IACjD,CAAC;CACF,CAAA;AA3BY,0EAA+B;0CAA/B,+BAA+B;IAF3C,IAAA,wBAAa,EAAC,EAAE,GAAG,EAAE,qCAA2B,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IACpE,IAAA,mBAAU,GAAE;6CAKc,0BAAW;QACF,6CAAoB;QAC1B,uCAAiB;QAClB,4BAAY;GAP5B,+BAA+B,CA2B3C;AAEY,QAAA,qBAAqB,GAAG;IACnC,wBAAwB;IACxB,0BAA0B;IAC1B,yBAAyB;IACzB,wBAAwB;IACxB,+BAA+B;CAChC,CAAC;AAEF,YAAY;AAEZ,wCAAwC;AAIjC,IAAM,6BAA6B,GAAnC,MAAM,6BAA6B;IACxC,YAA6B,SAAoB;QAApB,cAAS,GAAT,SAAS,CAAW;IAAG,CAAC;IAErD,KAAK,CAAC,OAAO;QACX,MAAM,YAAY,GAA+B;YAC/C;gBACE,EAAE,EAAE,WAAW;gBACf,KAAK,EAAE,UAAU;gBACjB,QAAQ,EAAE,UAAU;gBACpB,OAAO,EAAE,IAAI;aACd;SACF,CAAC;QAEF,MAAM,OAAO,GAAG,IAAI,CAAC,8BAA8B,EAAE,CAAC;QACtD,MAAM,iBAAiB,GAAG,OAAO,CAAC,CAAC,CAAC,MAAM,OAAO,CAAC,mBAAmB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAE7E,OAAO,IAAA,gCAAyB,EAAC,EAAE,YAAY,EAAE,iBAAiB,EAAE,CAAC,CAAC;IACxE,CAAC;IAEO,8BAA8B;QACpC,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAA8B,8DAA8B,EAAE;gBACrF,MAAM,EAAE,KAAK;aACd,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;CACF,CAAA;AA5BY,sEAA6B;wCAA7B,6BAA6B;IAFzC,IAAA,6BAAkB,EAAC,EAAE,GAAG,EAAE,qCAA2B,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IACxE,IAAA,mBAAU,GAAE;6CAE6B,gBAAS;GADtC,6BAA6B,CA4BzC;AAIM,IAAM,2BAA2B,GAAjC,MAAM,2BAA2B;IAGtC,YACmB,cAAqC,EACrC,cAAqC;QADrC,mBAAc,GAAd,cAAc,CAAuB;QACrC,mBAAc,GAAd,cAAc,CAAuB;IACrD,CAAC;IAEJ,KAAK,CAAC,OAAO;QACX,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,oBAAoB,EAAE,CAAC;QAC3D,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,0BAA0B,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAClF,OAAO,IAAA,oCAA6B,EAAC,IAAI,CAAC,CAAC;IAC7C,CAAC;CACF,CAAA;AAbY,kEAA2B;sCAA3B,2BAA2B;IAFvC,IAAA,6BAAkB,EAAC,EAAE,GAAG,EAAE,mCAAyB,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IACvE,IAAA,mBAAU,GAAE;6CAKwB,+CAAqB;QACrB,+CAAqB;GAL7C,2BAA2B,CAavC;AAIM,IAAM,gCAAgC,GAAtC,MAAM,gCAAgC;IAG3C,YACmB,cAAqC,EACrC,cAAqC;QADrC,mBAAc,GAAd,cAAc,CAAuB;QACrC,mBAAc,GAAd,cAAc,CAAuB;IACrD,CAAC;IAEJ,KAAK,CAAC,OAAO;QACX,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,oBAAoB,EAAE,CAAC;QAC3D,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,+BAA+B,CACpE,OAAO,CAAC,MAAM,EACd,OAAO,CAAC,QAAQ,CACjB,CAAC;QACF,OAAO,IAAA,oCAA6B,EAAC,IAAI,CAAC,CAAC;IAC7C,CAAC;CACF,CAAA;AAhBY,4EAAgC;2CAAhC,gCAAgC;IAF5C,IAAA,6BAAkB,EAAC,EAAE,GAAG,EAAE,wCAA8B,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IAC5E,IAAA,mBAAU,GAAE;6CAKwB,+CAAqB;QACrB,+CAAqB;GAL7C,gCAAgC,CAgB5C;AAIM,IAAM,+BAA+B,GAArC,MAAM,+BAA+B;IAC1C,YACmB,cAAqC,EACrC,cAAqC;QADrC,mBAAc,GAAd,cAAc,CAAuB;QACrC,mBAAc,GAAd,cAAc,CAAuB;IACrD,CAAC;IAEJ,KAAK,CAAC,OAAO;QACX,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,oBAAoB,EAAE,CAAC;QAC3D,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,eAAe,CACpD,OAAO,CAAC,MAAM,EACd,OAAO,CAAC,QAAQ,EAChB,OAAO,CAAC,aAAa,CACtB,CAAC;QACF,OAAO,IAAA,gCAAyB,EAAC,IAAI,CAAC,CAAC;IACzC,CAAC;CACF,CAAA;AAfY,0EAA+B;0CAA/B,+BAA+B;IAF3C,IAAA,6BAAkB,EAAC,EAAE,GAAG,EAAE,wCAA8B,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IAC5E,IAAA,mBAAU,GAAE;6CAGwB,+CAAqB;QACrB,+CAAqB;GAH7C,+BAA+B,CAe3C;AAEY,QAAA,oBAAoB,GAAG;IAClC,6BAA6B;IAC7B,2BAA2B;IAC3B,gCAAgC;IAChC,+BAA+B;CAChC,CAAC;AAEF,YAAY"}
+{"version":3,"file":"auth-runtime.handlers.js","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/auth/auth-runtime.handlers.ts"],"names":[],"mappings":";;;;AACA,iEAIgD;AAEhD,uEAYmD;AACnD,gFAAkI;AAClI,2CAAmE;AACnE,uCAAyC;AAEzC,qEAAkE;AAClE,2EAGqC;AACrC,+DAA0D;AAC1D,iDAA6C;AAW7C,mEAA8D;AAC9D,2DAA6D;AAC7D,qEAAgE;AAChE,mDAA+C;AAC/C,gFAA2E;AAC3E,gFAA2E;AAC3E,mFAKyC;AAOzC,yCAAyC;AAIlC,IAAM,wBAAwB,GAA9B,MAAM,wBAAwB;IACnC,YACmB,IAAiB,EACjB,aAAkC,EAClC,OAA0B,EAC1B,MAAoB;QAHpB,SAAI,GAAJ,IAAI,CAAa;QACjB,kBAAa,GAAb,aAAa,CAAqB;QAClC,YAAO,GAAP,OAAO,CAAmB;QAC1B,WAAM,GAAN,MAAM,CAAc;IACpC,CAAC;IAEJ,KAAK,CAAC,OAAO,CAAC,KAAuB;QACnC,IAAI,CAAC,IAAI,CAAC,6BAA6B,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAExD,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACrD,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC;QAE9C,MAAM,OAAO,GAAG,IAAA,+CAAsB,GAAE,CAAC;QACzC,MAAM,IAAI,GAAG,IAAA,0CAAsB,EAAC,OAAO,CAAC,CAAC;QAC7C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,iBAAiB,CACrD,IAAI,CAAC,aAAa,CAAC,YAAY,EAAE,EACjC,QAAQ,EACR,QAAQ,EACR,IAAI,CACL,CAAC;QAEF,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,EAAE,IAAI,EAAE;YACtD,GAAG,CAAC,OAAO,KAAK,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAChF,CAAC,CAAC;QACH,IAAA,iDAAqB,EAAC,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAEhE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IACjD,CAAC;CACF,CAAA;AA9BY,4DAAwB;mCAAxB,wBAAwB;IAFpC,IAAA,wBAAa,EAAC,EAAE,GAAG,EAAE,8BAAoB,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IAC5D,IAAA,mBAAU,GAAE;6CAGc,0BAAW;QACF,2CAAmB;QACzB,uCAAiB;QAClB,4BAAY;GAL5B,wBAAwB,CA8BpC;AAIM,IAAM,0BAA0B,GAAhC,MAAM,0BAA0B;IACrC,YACmB,IAAiB,EACjB,OAA0B,EAC1B,MAAoB;QAFpB,SAAI,GAAJ,IAAI,CAAa;QACjB,YAAO,GAAP,OAAO,CAAmB;QAC1B,WAAM,GAAN,MAAM,CAAc;IACpC,CAAC;IAEJ,KAAK,CAAC,OAAO,CAAC,KAAyB;QACrC,MAAM,OAAO,GAAG,IAAA,+CAAsB,GAAE,CAAC;QACzC,MAAM,IAAI,GAAG,IAAA,0CAAsB,EAAC,OAAO,CAAC,CAAC;QAC7C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QACnD,IAAA,iDAAqB,EAAC,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAEhE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IACjD,CAAC;CACF,CAAA;AAfY,gEAA0B;qCAA1B,0BAA0B;IAFtC,IAAA,wBAAa,EAAC,EAAE,GAAG,EAAE,+BAAqB,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IAC7D,IAAA,mBAAU,GAAE;6CAGc,0BAAW;QACR,uCAAiB;QAClB,4BAAY;GAJ5B,0BAA0B,CAetC;AAIM,IAAM,yBAAyB,GAA/B,MAAM,yBAAyB;IAGpC,YACmB,IAAiB,EACjB,OAA0B,EAC1B,MAAoB;QAFpB,SAAI,GAAJ,IAAI,CAAa;QACjB,YAAO,GAAP,OAAO,CAAmB;QAC1B,WAAM,GAAN,MAAM,CAAc;IACpC,CAAC;IAEJ,KAAK,CAAC,OAAO,CAAC,KAA6B;QACzC,MAAM,OAAO,GAAG,IAAA,+CAAsB,GAAE,CAAC;QACzC,MAAM,YAAY,GAChB,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,OAAO,CAAC,OAAkC,CAAC;YACzE,KAAK,CAAC,YAAY,EAAE,IAAI,EAAE;YAC1B,IAAI,CAAC;QAEP,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,MAAM,IAAI,8BAAqB,CAAC,0BAA0B,CAAC,CAAC;QAC9D,CAAC;QAED,MAAM,IAAI,GAAG,IAAA,0CAAsB,EAAC,OAAO,CAAC,CAAC;QAC7C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC;QAChE,IAAA,iDAAqB,EAAC,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAEhE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IACjD,CAAC;CACF,CAAA;AA1BY,8DAAyB;oCAAzB,yBAAyB;IAFrC,IAAA,wBAAa,EAAC,EAAE,GAAG,EAAE,8BAAoB,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IAC5D,IAAA,mBAAU,GAAE;6CAKc,0BAAW;QACR,uCAAiB;QAClB,4BAAY;GAN5B,yBAAyB,CA0BrC;AAIM,IAAM,wBAAwB,GAA9B,MAAM,wBAAwB;IACnC,YACmB,IAAiB,EACjB,OAA0B;QAD1B,SAAI,GAAJ,IAAI,CAAa;QACjB,YAAO,GAAP,OAAO,CAAmB;IAC1C,CAAC;IAEJ,KAAK,CAAC,OAAO,CAAC,KAA6B;QACzC,MAAM,OAAO,GAAG,IAAA,+CAAsB,GAAE,CAAC;QACzC,MAAM,YAAY,GAChB,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,OAAO,CAAC,OAAkC,CAAC;YACzE,KAAK,CAAC,YAAY,EAAE,IAAI,EAAE;YAC1B,IAAI,CAAC;QAEP,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QACrC,IAAA,iDAAqB,EAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;QAE7C,OAAO,IAAA,kCAA2B,EAAC,SAAS,CAAC,CAAC;IAChD,CAAC;CACF,CAAA;AAlBY,4DAAwB;mCAAxB,wBAAwB;IAFpC,IAAA,wBAAa,EAAC,EAAE,GAAG,EAAE,6BAAmB,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IAC3D,IAAA,mBAAU,GAAE;6CAGc,0BAAW;QACR,uCAAiB;GAHlC,wBAAwB,CAkBpC;AAIM,IAAM,+BAA+B,GAArC,MAAM,+BAA+B;IAG1C,YACmB,IAAiB,EACjB,aAAmC,EACnC,OAA0B,EAC1B,MAAoB;QAHpB,SAAI,GAAJ,IAAI,CAAa;QACjB,kBAAa,GAAb,aAAa,CAAsB;QACnC,YAAO,GAAP,OAAO,CAAmB;QAC1B,WAAM,GAAN,MAAM,CAAc;IACpC,CAAC;IAEJ,KAAK,CAAC,OAAO,CAAC,KAA8B;QAC1C,MAAM,OAAO,GAAG,IAAA,+CAAsB,GAAE,CAAC;QACzC,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,CAAC,kBAAkB,CACpD,OAAO,CAAC,OAAwD,EAChE,OAAO,CAAC,OAAkC,CAC3C,CAAC;QAEF,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,8BAAqB,CAAC,0BAA0B,CAAC,CAAC;QAC9D,CAAC;QAED,MAAM,IAAI,GAAG,IAAA,0CAAsB,EAAC,OAAO,CAAC,CAAC;QAC7C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;QACxE,IAAA,iDAAqB,EAAC,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAEhE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IACjD,CAAC;CACF,CAAA;AA3BY,0EAA+B;0CAA/B,+BAA+B;IAF3C,IAAA,wBAAa,EAAC,EAAE,GAAG,EAAE,qCAA2B,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IACpE,IAAA,mBAAU,GAAE;6CAKc,0BAAW;QACF,6CAAoB;QAC1B,uCAAiB;QAClB,4BAAY;GAP5B,+BAA+B,CA2B3C;AAIM,IAAM,2CAA2C,GAAjD,MAAM,2CAA2C;IAGtD,YACmB,IAAiB,EACjB,aAAmC;QADnC,SAAI,GAAJ,IAAI,CAAa;QACjB,kBAAa,GAAb,aAAa,CAAsB;IACnD,CAAC;IAEJ,KAAK,CAAC,OAAO,CAAC,KAA8C;QAC1D,MAAM,OAAO,GAAG,IAAA,+CAAsB,GAAE,CAAC;QACzC,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,CAAC,kBAAkB,CACpD,OAAO,CAAC,OAAwD,EAChE,OAAO,CAAC,OAAkC,CAC3C,CAAC;QAEF,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,8BAAqB,CAAC,0BAA0B,CAAC,CAAC;QAC9D,CAAC;QAED,MAAM,IAAI,CAAC,IAAI,CAAC,yBAAyB,CAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QAClF,OAAO,IAAA,kCAA2B,EAAC,SAAS,CAAC,CAAC;IAChD,CAAC;CACF,CAAA;AAtBY,kGAA2C;sDAA3C,2CAA2C;IAFvD,IAAA,wBAAa,EAAC,EAAE,GAAG,EAAE,mDAAyC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IAClF,IAAA,mBAAU,GAAE;6CAKc,0BAAW;QACF,6CAAoB;GAL3C,2CAA2C,CAsBvD;AAEY,QAAA,qBAAqB,GAAG;IACnC,wBAAwB;IACxB,0BAA0B;IAC1B,yBAAyB;IACzB,wBAAwB;IACxB,+BAA+B;IAC/B,2CAA2C;CAC5C,CAAC;AAEF,YAAY;AAEZ,wCAAwC;AAIjC,IAAM,6BAA6B,GAAnC,MAAM,6BAA6B;IACxC,YAA6B,SAAoB;QAApB,cAAS,GAAT,SAAS,CAAW;IAAG,CAAC;IAErD,KAAK,CAAC,OAAO;QACX,MAAM,YAAY,GAA+B;YAC/C;gBACE,EAAE,EAAE,WAAW;gBACf,KAAK,EAAE,UAAU;gBACjB,QAAQ,EAAE,UAAU;gBACpB,OAAO,EAAE,IAAI;aACd;SACF,CAAC;QAEF,MAAM,OAAO,GAAG,IAAI,CAAC,8BAA8B,EAAE,CAAC;QACtD,MAAM,iBAAiB,GAAG,OAAO,CAAC,CAAC,CAAC,MAAM,OAAO,CAAC,mBAAmB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAE7E,OAAO,IAAA,gCAAyB,EAAC,EAAE,YAAY,EAAE,iBAAiB,EAAE,CAAC,CAAC;IACxE,CAAC;IAEO,8BAA8B;QACpC,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAA8B,8DAA8B,EAAE;gBACrF,MAAM,EAAE,KAAK;aACd,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;CACF,CAAA;AA5BY,sEAA6B;wCAA7B,6BAA6B;IAFzC,IAAA,6BAAkB,EAAC,EAAE,GAAG,EAAE,qCAA2B,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IACxE,IAAA,mBAAU,GAAE;6CAE6B,gBAAS;GADtC,6BAA6B,CA4BzC;AAIM,IAAM,2BAA2B,GAAjC,MAAM,2BAA2B;IAGtC,YACmB,cAAqC,EACrC,cAAqC;QADrC,mBAAc,GAAd,cAAc,CAAuB;QACrC,mBAAc,GAAd,cAAc,CAAuB;IACrD,CAAC;IAEJ,KAAK,CAAC,OAAO;QACX,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,oBAAoB,EAAE,CAAC;QAC3D,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,0BAA0B,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAClF,OAAO,IAAA,oCAA6B,EAAC,IAAI,CAAC,CAAC;IAC7C,CAAC;CACF,CAAA;AAbY,kEAA2B;sCAA3B,2BAA2B;IAFvC,IAAA,6BAAkB,EAAC,EAAE,GAAG,EAAE,mCAAyB,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IACvE,IAAA,mBAAU,GAAE;6CAKwB,+CAAqB;QACrB,+CAAqB;GAL7C,2BAA2B,CAavC;AAIM,IAAM,gCAAgC,GAAtC,MAAM,gCAAgC;IAG3C,YACmB,cAAqC,EACrC,cAAqC;QADrC,mBAAc,GAAd,cAAc,CAAuB;QACrC,mBAAc,GAAd,cAAc,CAAuB;IACrD,CAAC;IAEJ,KAAK,CAAC,OAAO;QACX,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,oBAAoB,EAAE,CAAC;QAC3D,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,+BAA+B,CACpE,OAAO,CAAC,MAAM,EACd,OAAO,CAAC,QAAQ,CACjB,CAAC;QACF,OAAO,IAAA,oCAA6B,EAAC,IAAI,CAAC,CAAC;IAC7C,CAAC;CACF,CAAA;AAhBY,4EAAgC;2CAAhC,gCAAgC;IAF5C,IAAA,6BAAkB,EAAC,EAAE,GAAG,EAAE,wCAA8B,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IAC5E,IAAA,mBAAU,GAAE;6CAKwB,+CAAqB;QACrB,+CAAqB;GAL7C,gCAAgC,CAgB5C;AAIM,IAAM,qCAAqC,GAA3C,MAAM,qCAAqC;IAGhD,YACmB,IAAiB,EACjB,aAAmC;QADnC,SAAI,GAAJ,IAAI,CAAa;QACjB,kBAAa,GAAb,aAAa,CAAsB;IACnD,CAAC;IAEJ,KAAK,CAAC,OAAO,CACX,KAA0C;QAE1C,MAAM,OAAO,GAAG,IAAA,+CAAsB,GAAE,CAAC;QACzC,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,CAAC,kBAAkB,CACpD,OAAO,CAAC,OAAwD,EAChE,OAAO,CAAC,OAAkC,CAC3C,CAAC;QAEF,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,8BAAqB,CAAC,0BAA0B,CAAC,CAAC;QAC9D,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,2BAA2B,CACvD,QAAQ,CAAC,KAAK,EACd,MAAM,CAAC,KAAK,EAAE,QAAQ,IAAI,EAAE,CAAC,CAC9B,CAAC;QACF,OAAO,IAAA,oCAA6B,EAAC,KAAK,CAAC,CAAC;IAC9C,CAAC;CACF,CAAA;AA3BY,sFAAqC;gDAArC,qCAAqC;IAFjD,IAAA,6BAAkB,EAAC,EAAE,GAAG,EAAE,+CAAqC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IACnF,IAAA,mBAAU,GAAE;6CAKc,0BAAW;QACF,6CAAoB;GAL3C,qCAAqC,CA2BjD;AAIM,IAAM,+BAA+B,GAArC,MAAM,+BAA+B;IAC1C,YACmB,cAAqC,EACrC,cAAqC;QADrC,mBAAc,GAAd,cAAc,CAAuB;QACrC,mBAAc,GAAd,cAAc,CAAuB;IACrD,CAAC;IAEJ,KAAK,CAAC,OAAO;QACX,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,oBAAoB,EAAE,CAAC;QAC3D,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,eAAe,CACpD,OAAO,CAAC,MAAM,EACd,OAAO,CAAC,QAAQ,EAChB,OAAO,CAAC,aAAa,CACtB,CAAC;QACF,OAAO,IAAA,gCAAyB,EAAC,IAAI,CAAC,CAAC;IACzC,CAAC;CACF,CAAA;AAfY,0EAA+B;0CAA/B,+BAA+B;IAF3C,IAAA,6BAAkB,EAAC,EAAE,GAAG,EAAE,wCAA8B,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IAC5E,IAAA,mBAAU,GAAE;6CAGwB,+CAAqB;QACrB,+CAAqB;GAH7C,+BAA+B,CAe3C;AAEY,QAAA,oBAAoB,GAAG;IAClC,6BAA6B;IAC7B,2BAA2B;IAC3B,gCAAgC;IAChC,qCAAqC;IACrC,+BAA+B;CAChC,CAAC;AAEF,YAAY"}

package/security/src/lib/auth/auth.config.d.ts

@@ -1,7 +1,14 @@
 export declare const AUTH_COOKIE_REFRESH_TOKEN = "acx_refresh_token";
 /** HttpOnly access token cookie (primary SPA credential). */
 export declare const AUTH_COOKIE_ACCESS_TOKEN = "acx_access_token";
+/** Double-submit CSRF cookie (readable by SPA for `X-CSRF-Token`). */
+export declare const AUTH_COOKIE_CSRF_TOKEN = "acx_csrf_token";
 export declare const AUTH_STRATEGY_USER_PASS = "user-pass";
+/**
+ * Fixed audience for Platform-issued access tokens (OP / application auth).
+ * Not a Resource Server selector — Entity/Business APIs are not split by `aud`.
+ */
+export declare const PLATFORM_ACCESS_TOKEN_AUDIENCE = "platform";
 export declare const AUTH_COOKIE_SECURE: () => boolean;
 export declare const AUTH_COOKIE_SAME_SITE: () => "lax" | "strict" | "none";
 /** Path scoped so refresh cookies are sent to all `/api` routes (incl. runtime). */

package/security/src/lib/auth/auth.config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.config.d.ts","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/auth/auth.config.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,yBAAyB,sBAAsB,CAAC;AAE7D,6DAA6D;AAC7D,eAAO,MAAM,wBAAwB,qBAAqB,CAAC;AAE3D,eAAO,MAAM,uBAAuB,cAAc,CAAC;AAEnD,eAAO,MAAM,kBAAkB,QAAO,OACoD,CAAC;AAE3F,eAAO,MAAM,qBAAqB,QAAO,KAAK,GAAG,QAAQ,GAAG,MAM3D,CAAC;AAEF,oFAAoF;AACpF,eAAO,MAAM,wBAAwB,QAAO,MACe,CAAC"}
+{"version":3,"file":"auth.config.d.ts","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/auth/auth.config.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,yBAAyB,sBAAsB,CAAC;AAE7D,6DAA6D;AAC7D,eAAO,MAAM,wBAAwB,qBAAqB,CAAC;AAE3D,sEAAsE;AACtE,eAAO,MAAM,sBAAsB,mBAAmB,CAAC;AAEvD,eAAO,MAAM,uBAAuB,cAAc,CAAC;AAEnD;;;GAGG;AACH,eAAO,MAAM,8BAA8B,aAAa,CAAC;AAEzD,eAAO,MAAM,kBAAkB,QAAO,OACoD,CAAC;AAE3F,eAAO,MAAM,qBAAqB,QAAO,KAAK,GAAG,QAAQ,GAAG,MAM3D,CAAC;AAEF,oFAAoF;AACpF,eAAO,MAAM,wBAAwB,QAAO,MACe,CAAC"}

package/security/src/lib/auth/auth.config.js

@@ -1,11 +1,18 @@
 "use strict";
 //#region ---- Auth configuration ----
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.AUTH_REFRESH_COOKIE_PATH = exports.AUTH_COOKIE_SAME_SITE = exports.AUTH_COOKIE_SECURE = exports.AUTH_STRATEGY_USER_PASS = exports.AUTH_COOKIE_ACCESS_TOKEN = exports.AUTH_COOKIE_REFRESH_TOKEN = void 0;
+exports.AUTH_REFRESH_COOKIE_PATH = exports.AUTH_COOKIE_SAME_SITE = exports.AUTH_COOKIE_SECURE = exports.PLATFORM_ACCESS_TOKEN_AUDIENCE = exports.AUTH_STRATEGY_USER_PASS = exports.AUTH_COOKIE_CSRF_TOKEN = exports.AUTH_COOKIE_ACCESS_TOKEN = exports.AUTH_COOKIE_REFRESH_TOKEN = void 0;
 exports.AUTH_COOKIE_REFRESH_TOKEN = 'acx_refresh_token';
 /** HttpOnly access token cookie (primary SPA credential). */
 exports.AUTH_COOKIE_ACCESS_TOKEN = 'acx_access_token';
+/** Double-submit CSRF cookie (readable by SPA for `X-CSRF-Token`). */
+exports.AUTH_COOKIE_CSRF_TOKEN = 'acx_csrf_token';
 exports.AUTH_STRATEGY_USER_PASS = 'user-pass';
+/**
+ * Fixed audience for Platform-issued access tokens (OP / application auth).
+ * Not a Resource Server selector — Entity/Business APIs are not split by `aud`.
+ */
+exports.PLATFORM_ACCESS_TOKEN_AUDIENCE = 'platform';
 const AUTH_COOKIE_SECURE = () => process.env['NODE_ENV'] === 'production' || process.env['AUTH_COOKIE_SECURE'] === 'true';
 exports.AUTH_COOKIE_SECURE = AUTH_COOKIE_SECURE;
 const AUTH_COOKIE_SAME_SITE = () => {

package/security/src/lib/auth/auth.config.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.config.js","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/auth/auth.config.ts"],"names":[],"mappings":";AAAA,sCAAsC;;;AAEzB,QAAA,yBAAyB,GAAG,mBAAmB,CAAC;AAE7D,6DAA6D;AAChD,QAAA,wBAAwB,GAAG,kBAAkB,CAAC;AAE9C,QAAA,uBAAuB,GAAG,WAAW,CAAC;AAE5C,MAAM,kBAAkB,GAAG,GAAY,EAAE,CAC9C,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,YAAY,IAAI,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,KAAK,MAAM,CAAC;AAD9E,QAAA,kBAAkB,sBAC4D;AAEpF,MAAM,qBAAqB,GAAG,GAA8B,EAAE;IACnE,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACzE,IAAI,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,MAAM,EAAE,CAAC;QAC3C,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC,CAAC;AANW,QAAA,qBAAqB,yBAMhC;AAEF,oFAAoF;AAC7E,MAAM,wBAAwB,GAAG,GAAW,EAAE,CACnD,OAAO,CAAC,GAAG,CAAC,0BAA0B,CAAC,EAAE,IAAI,EAAE,IAAI,MAAM,CAAC;AAD/C,QAAA,wBAAwB,4BACuB;AAE5D,YAAY"}
+{"version":3,"file":"auth.config.js","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/auth/auth.config.ts"],"names":[],"mappings":";AAAA,sCAAsC;;;AAEzB,QAAA,yBAAyB,GAAG,mBAAmB,CAAC;AAE7D,6DAA6D;AAChD,QAAA,wBAAwB,GAAG,kBAAkB,CAAC;AAE3D,sEAAsE;AACzD,QAAA,sBAAsB,GAAG,gBAAgB,CAAC;AAE1C,QAAA,uBAAuB,GAAG,WAAW,CAAC;AAEnD;;;GAGG;AACU,QAAA,8BAA8B,GAAG,UAAU,CAAC;AAElD,MAAM,kBAAkB,GAAG,GAAY,EAAE,CAC9C,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,YAAY,IAAI,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,KAAK,MAAM,CAAC;AAD9E,QAAA,kBAAkB,sBAC4D;AAEpF,MAAM,qBAAqB,GAAG,GAA8B,EAAE;IACnE,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACzE,IAAI,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,MAAM,EAAE,CAAC;QAC3C,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC,CAAC;AANW,QAAA,qBAAqB,yBAMhC;AAEF,oFAAoF;AAC7E,MAAM,wBAAwB,GAAG,GAAW,EAAE,CACnD,OAAO,CAAC,GAAG,CAAC,0BAA0B,CAAC,EAAE,IAAI,EAAE,IAAI,MAAM,CAAC;AAD/C,QAAA,wBAAwB,4BACuB;AAE5D,YAAY"}

package/security/src/lib/auth/auth.events.d.ts

@@ -4,4 +4,26 @@ export interface AuthLogoutEventPayload {
     tenantId?: string;
     at: string;
 }
+/** Cross-session security signal (login success/failure) → realtime fan-out. */
+export declare const AUTH_SECURITY_ALERT_EVENT = "auth.security-alert";
+export type AuthSecurityAlertKind = 'login_success' | 'login_failed' | 'account_locked' | 'logout'
+/** Remote DeviceSessions terminate — force the target browser to leave after OK. */
+ | 'session_terminated';
+export interface AuthSecurityAlertEventPayload {
+    kind: AuthSecurityAlertKind;
+    userId: string;
+    at: string;
+    /** Login `sid` for this attempt (success only) — other sessions should toast. */
+    actorSessionId?: string;
+    /**
+     * JWT `sid` of the session that was revoked.
+     * For `session_terminated`, realtime delivers only to that session’s socket room.
+     */
+    targetSessionId?: string;
+    deviceSummary?: string;
+    ipAddress?: string;
+    browser?: string;
+    deviceName?: string;
+    operatingSystem?: string;
+}
 //# sourceMappingURL=auth.events.d.ts.map

package/security/src/lib/auth/auth.events.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.events.d.ts","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/auth/auth.events.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,iBAAiB,gBAAgB,CAAC;AAE/C,MAAM,WAAW,sBAAsB;IACrC,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,EAAE,EAAE,MAAM,CAAC;CACZ"}
+{"version":3,"file":"auth.events.d.ts","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/auth/auth.events.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,iBAAiB,gBAAgB,CAAC;AAE/C,MAAM,WAAW,sBAAsB;IACrC,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,EAAE,EAAE,MAAM,CAAC;CACZ;AAED,gFAAgF;AAChF,eAAO,MAAM,yBAAyB,wBAAwB,CAAC;AAE/D,MAAM,MAAM,qBAAqB,GAC7B,eAAe,GACf,cAAc,GACd,gBAAgB,GAChB,QAAQ;AACV,oFAAoF;GAClF,oBAAoB,CAAC;AAEzB,MAAM,WAAW,6BAA6B;IAC5C,IAAI,EAAE,qBAAqB,CAAC;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,EAAE,EAAE,MAAM,CAAC;IACX,iFAAiF;IACjF,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;OAGG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B"}

package/security/src/lib/auth/auth.events.js

@@ -1,7 +1,9 @@
 "use strict";
 //#region ----- Auth lifecycle events -----
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.AUTH_LOGOUT_EVENT = void 0;
+exports.AUTH_SECURITY_ALERT_EVENT = exports.AUTH_LOGOUT_EVENT = void 0;
 exports.AUTH_LOGOUT_EVENT = 'auth.logout';
+/** Cross-session security signal (login success/failure) → realtime fan-out. */
+exports.AUTH_SECURITY_ALERT_EVENT = 'auth.security-alert';
 //#endregion
 //# sourceMappingURL=auth.events.js.map

package/security/src/lib/auth/auth.events.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.events.js","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/auth/auth.events.ts"],"names":[],"mappings":";AAAA,2CAA2C;;;AAE9B,QAAA,iBAAiB,GAAG,aAAa,CAAC;AAQ/C,YAAY"}
+{"version":3,"file":"auth.events.js","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/auth/auth.events.ts"],"names":[],"mappings":";AAAA,2CAA2C;;;AAE9B,QAAA,iBAAiB,GAAG,aAAa,CAAC;AAQ/C,gFAAgF;AACnE,QAAA,yBAAyB,GAAG,qBAAqB,CAAC;AA4B/D,YAAY"}

package/security/src/lib/auth/auth.service.d.ts

@@ -1,34 +1,83 @@
+import { OnModuleDestroy } from '@nestjs/common';
 import { EntityStorageMiddlewareService } from '@acorex-platform/framework-server/core';
 import { EventEmitter2 } from '@nestjs/event-emitter';
 import { AuthLocalCredentialsService } from './auth-local-credentials.service';
 import { DeviceSessionService } from './device-session.service';
 import type { AuthRequestMeta } from './request-meta.util';
 import { TokenService } from './token.service';
-import type { AuthTokenResponseDto, RegisterRequestDto, SecurityManagementUserRecord, UpdateSessionRequestDto } from './auth.types';
+import type { AccessTokenPayload, AuthOwnDeviceSessionDto, AuthTokenResponseDto, RegisterRequestDto, SecurityManagementUserRecord, UpdateSessionRequestDto } from './auth.types';
 /** Stable client i18n mapping key — not shown raw in UI. */
 export declare const SESSION_MEMBERSHIP_DENIED_CODE = "SESSION_MEMBERSHIP_DENIED";
-export declare class AuthService {
+/** Stable client i18n mapping key — tenant max active device sessions exceeded. */
+export declare const MAX_ACTIVE_DEVICE_SESSIONS_CODE = "MAX_ACTIVE_DEVICE_SESSIONS";
+export declare class AuthService implements OnModuleDestroy {
     private readonly entityStorage;
     private readonly tokenService;
     private readonly localCredentials;
     private readonly deviceSessions;
     private readonly events?;
     private readonly logger;
+    private readonly refreshReplayRedis;
     constructor(entityStorage: EntityStorageMiddlewareService, tokenService: TokenService, localCredentials: AuthLocalCredentialsService, deviceSessions: DeviceSessionService, events?: EventEmitter2 | undefined);
-    completeSignIn(user: SecurityManagementUserRecord, meta: AuthRequestMeta): Promise<AuthTokenResponseDto>;
+    onModuleDestroy(): Promise<void>;
+    completeSignIn(user: SecurityManagementUserRecord, meta: AuthRequestMeta, options?: {
+        audience?: string;
+        persist?: boolean;
+    }): Promise<AuthTokenResponseDto>;
     assertSupportedSignInStrategy(strategy?: string): void;
     register(dto: RegisterRequestDto, meta: AuthRequestMeta): Promise<AuthTokenResponseDto>;
-    refreshSession(refreshToken: string, meta: AuthRequestMeta): Promise<AuthTokenResponseDto>;
+    refreshSession(refreshToken: string, meta: AuthRequestMeta, options?: {
+        audience?: string;
+    }): Promise<AuthTokenResponseDto>;
     logout(refreshToken?: string | null): Promise<{
         success: true;
     }>;
     updateSession(currentAccessToken: string, dto: UpdateSessionRequestDto, meta: AuthRequestMeta): Promise<AuthTokenResponseDto>;
-    verifyAccessToken(token: string): import("./auth.types").AccessTokenPayload;
+    /**
+     * Cryptographic verify only (signature / exp / type / aud).
+     * Prefer {@link validateAccessToken} for request auth (OD-09 sid/jti checks).
+     */
+    verifyAccessToken(token: string, expectedAudience?: string): AccessTokenPayload;
+    /**
+     * OD-09 access-token validation: signature → expiration → `sid` → `jti`.
+     */
+    validateAccessToken(token: string, expectedAudience?: string): Promise<AccessTokenPayload>;
     verifyRefreshToken(token: string): import("./auth.types").RefreshTokenPayload;
     accessTokenMaxAgeMs(): number;
     refreshTokenMaxAgeMs(): number;
+    revokeSessionById(sessionId: string): Promise<void>;
+    /**
+     * Projects DeviceSessions revoke (SoT) onto Redis for the JWT `sid` family.
+     * Request paths check Redis only — this stamp is required for terminate to take effect.
+     */
+    invalidateLoginSession(sessionId: string): Promise<void>;
+    /**
+     * Realtime kick for a remote DeviceSessions terminate (Active Sessions UI, etc.).
+     * Does not change Redis revoke — call after {@link invalidateLoginSession}.
+     */
+    notifyRemoteSessionTerminated(userId: string, sessionId: string): void;
+    decodeIdTokenHint(token: string): {
+        sub?: string;
+        sid?: string;
+    } | null;
     private completeAuthentication;
+    /**
+     * Tenant setting MaxActiveDeviceSessions — per user + tenant.
+     * Enforced when a real tenant is known (tenant chooser bind / auto-bind, or create with tid).
+     * Same device upsert (create) and re-bind of the current session to the same tenant are allowed.
+     */
+    private assertMaxActiveDeviceSessionsAllowed;
+    /**
+     * Active DeviceSessions for the authenticated user in a tenant (session-limit chooser).
+     */
+    listOwnActiveDeviceSessions(accessToken: string, tenantId: string): Promise<AuthOwnDeviceSessionDto[]>;
+    /**
+     * Terminate one of the caller's DeviceSessions (by entity id) during session-limit recovery.
+     */
+    terminateOwnDeviceSession(accessToken: string, deviceSessionId: string): Promise<void>;
     private emitLogoutEvent;
+    private emitSecurityAlert;
+    private securityAlertDeviceFields;
     private toAuthUser;
     private normalizeAvatar;
     /**
@@ -39,5 +88,16 @@ export declare class AuthService {
     private assertActiveMembership;
     private resolveTenantDto;
     private resolveApplicationDto;
+    private assertRefreshNotRevoked;
+    private markRefreshRevoked;
+    private markSessionRevoked;
+    /** Invalidates prior login families when the same device row is reused (per-device upsert). */
+    private revokeReplacedDeviceSessions;
+    /**
+     * OD-09 hot path: Redis projection only. DeviceSessions is SoT on write;
+     * do not query Mongo here (see device-session-revocation.mdc).
+     */
+    private assertSessionAllowed;
+    private assertAccessJtiNotRevoked;
 }
 //# sourceMappingURL=auth.service.d.ts.map

package/security/src/lib/auth/auth.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.service.d.ts","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/auth/auth.service.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,8BAA8B,EAAE,MAAM,wCAAwC,CAAC;AAcxF,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAGtD,OAAO,EAAE,2BAA2B,EAAE,MAAM,kCAAkC,CAAC;AAC/E,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAChE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,KAAK,EAGV,oBAAoB,EAEpB,kBAAkB,EAClB,4BAA4B,EAC5B,uBAAuB,EACxB,MAAM,cAAc,CAAC;AAUtB,4DAA4D;AAC5D,eAAO,MAAM,8BAA8B,8BAA8B,CAAC;AAE1E,qBACa,WAAW;IAIpB,OAAO,CAAC,QAAQ,CAAC,aAAa;IAC9B,OAAO,CAAC,QAAQ,CAAC,YAAY;IAC7B,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IACjC,OAAO,CAAC,QAAQ,CAAC,cAAc;IACnB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;IAPtC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAgC;gBAGpC,aAAa,EAAE,8BAA8B,EAC7C,YAAY,EAAE,YAAY,EAC1B,gBAAgB,EAAE,2BAA2B,EAC7C,cAAc,EAAE,oBAAoB,EACxB,MAAM,CAAC,EAAE,aAAa,YAAA;IAG/C,cAAc,CAClB,IAAI,EAAE,4BAA4B,EAClC,IAAI,EAAE,eAAe,GACpB,OAAO,CAAC,oBAAoB,CAAC;IAIhC,6BAA6B,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI;IAOhD,QAAQ,CAAC,GAAG,EAAE,kBAAkB,EAAE,IAAI,EAAE,eAAe,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAqCvF,cAAc,CAAC,YAAY,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAyB1F,MAAM,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,IAAI,CAAA;KAAE,CAAC;IAoBhE,aAAa,CACjB,kBAAkB,EAAE,MAAM,EAC1B,GAAG,EAAE,uBAAuB,EAC5B,IAAI,EAAE,eAAe,GACpB,OAAO,CAAC,oBAAoB,CAAC;IAqChC,iBAAiB,CAAC,KAAK,EAAE,MAAM;IAQ/B,kBAAkB,CAAC,KAAK,EAAE,MAAM;IAQhC,mBAAmB,IAAI,MAAM;IAI7B,oBAAoB,IAAI,MAAM;YAIhB,sBAAsB;IAuDpC,OAAO,CAAC,eAAe;IAQvB,OAAO,CAAC,UAAU;IASlB,OAAO,CAAC,eAAe;IAcvB;;;;OAIG;YACW,sBAAsB;YA+FtB,gBAAgB;YAyChB,qBAAqB;CAuCpC"}
+{"version":3,"file":"auth.service.d.ts","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/auth/auth.service.ts"],"names":[],"mappings":"AAAA,OAAO,EAKL,eAAe,EAIhB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,8BAA8B,EAAE,MAAM,wCAAwC,CAAC;AAexF,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAGtD,OAAO,EAAE,2BAA2B,EAAE,MAAM,kCAAkC,CAAC;AAE/E,OAAO,EAAE,oBAAoB,EAAkC,MAAM,0BAA0B,CAAC;AAChG,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAE3D,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAO/C,OAAO,KAAK,EACV,kBAAkB,EAElB,uBAAuB,EAEvB,oBAAoB,EAEpB,kBAAkB,EAClB,4BAA4B,EAC5B,uBAAuB,EACxB,MAAM,cAAc,CAAC;AAUtB,4DAA4D;AAC5D,eAAO,MAAM,8BAA8B,8BAA8B,CAAC;AAC1E,mFAAmF;AACnF,eAAO,MAAM,+BAA+B,+BAA+B,CAAC;AA4B5E,qBACa,WAAY,YAAW,eAAe;IAK/C,OAAO,CAAC,QAAQ,CAAC,aAAa;IAC9B,OAAO,CAAC,QAAQ,CAAC,YAAY;IAC7B,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IACjC,OAAO,CAAC,QAAQ,CAAC,cAAc;IACnB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;IARtC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAgC;IACvD,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAe;gBAG/B,aAAa,EAAE,8BAA8B,EAC7C,YAAY,EAAE,YAAY,EAC1B,gBAAgB,EAAE,2BAA2B,EAC7C,cAAc,EAAE,oBAAoB,EACxB,MAAM,CAAC,EAAE,aAAa,YAAA;IAM/C,eAAe,IAAI,OAAO,CAAC,IAAI,CAAC;IAIhC,cAAc,CAClB,IAAI,EAAE,4BAA4B,EAClC,IAAI,EAAE,eAAe,EACrB,OAAO,CAAC,EAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,OAAO,CAAA;KAAE,GACjD,OAAO,CAAC,oBAAoB,CAAC;IAOhC,6BAA6B,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI;IAOhD,QAAQ,CAAC,GAAG,EAAE,kBAAkB,EAAE,IAAI,EAAE,eAAe,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAqCvF,cAAc,CAClB,YAAY,EAAE,MAAM,EACpB,IAAI,EAAE,eAAe,EACrB,OAAO,CAAC,EAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,GAC9B,OAAO,CAAC,oBAAoB,CAAC;IAsD1B,MAAM,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,IAAI,CAAA;KAAE,CAAC;IA8BhE,aAAa,CACjB,kBAAkB,EAAE,MAAM,EAC1B,GAAG,EAAE,uBAAuB,EAC5B,IAAI,EAAE,eAAe,GACpB,OAAO,CAAC,oBAAoB,CAAC;IAqChC;;;OAGG;IACH,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,gBAAgB,CAAC,EAAE,MAAM,GAAG,kBAAkB;IAQ/E;;OAEG;IACG,mBAAmB,CACvB,KAAK,EAAE,MAAM,EACb,gBAAgB,CAAC,EAAE,MAAM,GACxB,OAAO,CAAC,kBAAkB,CAAC;IAO9B,kBAAkB,CAAC,KAAK,EAAE,MAAM;IAQhC,mBAAmB,IAAI,MAAM;IAI7B,oBAAoB,IAAI,MAAM;IAIxB,iBAAiB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAMzD;;;OAGG;IACG,sBAAsB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAI9D;;;OAGG;IACH,6BAA6B,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI;IActE,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG;QAAE,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI;YAIzD,sBAAsB;IA6EpC;;;;OAIG;YACW,oCAAoC;IAoDlD;;OAEG;IACG,2BAA2B,CAC/B,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,uBAAuB,EAAE,CAAC;IAsBrC;;OAEG;IACG,yBAAyB,CAAC,WAAW,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAiB5F,OAAO,CAAC,eAAe;IAQvB,OAAO,CAAC,iBAAiB;IAQzB,OAAO,CAAC,yBAAyB;IAcjC,OAAO,CAAC,UAAU;IASlB,OAAO,CAAC,eAAe;IAcvB;;;;OAIG;YACW,sBAAsB;YA+FtB,gBAAgB;YAyChB,qBAAqB;YAwCrB,uBAAuB;YAWvB,kBAAkB;YASlB,kBAAkB;IA0BhC,+FAA+F;YACjF,4BAA4B;IAM1C;;;OAGG;YACW,oBAAoB;YAiBpB,yBAAyB;CAWxC"}