@acorex-platform/framework-server 0.0.32 → 0.0.37

package/security/src/lib/auth/device-session.service.d.ts

@@ -9,23 +9,81 @@ export interface CreateDeviceSessionInput {
     tenantId?: string;
     applicationId?: string;
 }
+/** Result of create/upsert — callers must revoke replaced login session ids. */
+export interface CreateDeviceSessionResult {
+    id: string;
+    /** Prior `sid` values superseded on this device (invalidate in Redis). */
+    replacedSessionIds: string[];
+}
 export interface UpdateDeviceSessionBindingInput {
     sessionId: string;
     authorizationId: string;
     tenantId?: string;
     applicationId?: string;
 }
+/** Placeholder tenant stamped at create-login before tenant chooser bind. */
+export declare const DEVICE_SESSION_UNBOUND_TENANT_ID = "default";
+/** Active login row used to resolve Socket.IO fan-out rooms (`t:{tenantId}:u:{userId}`). */
+export interface ActiveDeviceSessionDestination {
+    id: string;
+    sessionId: string;
+    tenantId: string;
+    applicationId: string;
+    deviceName: string;
+    browser: string;
+    operatingSystem: string;
+    ipAddress: string;
+    userAgent: string;
+    lastLoginAt?: string;
+}
+export declare function isUnboundDeviceSessionTenantId(tenantId: string | undefined | null): boolean;
 export declare class DeviceSessionService {
     private readonly entityStorage;
     private readonly logger;
     constructor(entityStorage: EntityStorageMiddlewareService);
-    createSession(input: CreateDeviceSessionInput): Promise<string>;
+    /**
+     * Ensures one active DeviceSessions row per user+device (Telegram-style).
+     * Re-login on the same browser/UA updates the existing row instead of inserting.
+     */
+    createSession(input: CreateDeviceSessionInput): Promise<CreateDeviceSessionResult>;
     /**
      * Tenant/app/token rotation during an existing sign-in journey.
      * Updates the primary row for {@link sessionId} and revokes duplicate legacy rows.
      */
     updateSessionBinding(input: UpdateDeviceSessionBindingInput): Promise<boolean>;
     revokeByAuthorizationId(authorizationId: string): Promise<void>;
+    /**
+     * Family revoke on refresh-token replay.
+     * Revoke all active device session rows bound to the same `sessionId`.
+     */
+    revokeBySessionId(sessionId: string): Promise<void>;
+    isSessionActive(sessionId: string): Promise<boolean>;
+    /**
+     * Active DeviceSessions for a user across all tenants (engine query — no RLS).
+     * Used to resolve Socket.IO destinations: room `t:{tenantId}:u:{userId}` per row.
+     */
+    listActiveSessionsForUser(userId: string): Promise<ActiveDeviceSessionDestination[]>;
+    /** Distinct tenant ids that have at least one active session for the user. */
+    listActiveTenantIdsForUser(userId: string): Promise<string[]>;
+    /** True when the user already has an active DeviceSessions row for this device. */
+    hasActiveDeviceForUser(userId: string, meta: AuthRequestMeta): Promise<boolean>;
+    /** Count of active DeviceSessions for the user in a specific tenant. */
+    countActiveForUserTenant(userId: string, tenantId: string, options?: {
+        excludeSessionIds?: string[];
+    }): Promise<number>;
+    /** Active DeviceSessions for a user in one tenant (engine query — no RLS). */
+    listActiveSessionsForUserTenant(userId: string, tenantId: string): Promise<ActiveDeviceSessionDestination[]>;
+    /** Tenant id currently stamped on the active DeviceSessions row for this login `sid`. */
+    getActiveTenantIdForSession(sessionId: string): Promise<string | undefined>;
+    /**
+     * Revoke an active DeviceSessions row by entity id (or login `sid`) when it belongs to `userId`.
+     * Uses engine update so tenant isolation on the unbound session-limit page cannot block revoke.
+     * Returns the login `sid` that was revoked (for Redis projection), or null when not found/owned.
+     */
+    revokeOwnedSessionById(userId: string, deviceSessionId: string): Promise<string | null>;
+    private upsertExistingDeviceSession;
+    private findActiveByDevice;
+    private queryActiveDeviceRows;
     private findBySessionId;
     /** Legacy rows stored only under `config.sessionId`. */
     private findBySessionIdFromConfig;

package/security/src/lib/auth/device-session.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"device-session.service.d.ts","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/auth/device-session.service.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,8BAA8B,EAAE,MAAM,wCAAwC,CAAC;AAExF,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAE3D,OAAO,KAAK,EAAE,WAAW,EAAE,4BAA4B,EAAE,MAAM,cAAc,CAAC;AAO9E,MAAM,WAAW,wBAAwB;IACvC,IAAI,EAAE,WAAW,GAAG,4BAA4B,CAAC;IACjD,eAAe,EAAE,MAAM,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,eAAe,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,+BAA+B;IAC9C,SAAS,EAAE,MAAM,CAAC;IAClB,eAAe,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAWD,qBACa,oBAAoB;IAGnB,OAAO,CAAC,QAAQ,CAAC,aAAa;IAF1C,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAyC;gBAEnC,aAAa,EAAE,8BAA8B;IAEpE,aAAa,CAAC,KAAK,EAAE,wBAAwB,GAAG,OAAO,CAAC,MAAM,CAAC;IA0CrE;;;OAGG;IACG,oBAAoB,CAAC,KAAK,EAAE,+BAA+B,GAAG,OAAO,CAAC,OAAO,CAAC;IAoC9E,uBAAuB,CAAC,eAAe,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;YAwBvD,eAAe;IAoC7B,wDAAwD;YAC1C,yBAAyB;YAgCzB,0BAA0B;YAW1B,gBAAgB;CAQ/B"}
+{"version":3,"file":"device-session.service.d.ts","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/auth/device-session.service.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,8BAA8B,EAAE,MAAM,wCAAwC,CAAC;AAExF,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAE3D,OAAO,KAAK,EAAE,WAAW,EAAE,4BAA4B,EAAE,MAAM,cAAc,CAAC;AAO9E,MAAM,WAAW,wBAAwB;IACvC,IAAI,EAAE,WAAW,GAAG,4BAA4B,CAAC;IACjD,eAAe,EAAE,MAAM,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,eAAe,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,gFAAgF;AAChF,MAAM,WAAW,yBAAyB;IACxC,EAAE,EAAE,MAAM,CAAC;IACX,0EAA0E;IAC1E,kBAAkB,EAAE,MAAM,EAAE,CAAC;CAC9B;AAED,MAAM,WAAW,+BAA+B;IAC9C,SAAS,EAAE,MAAM,CAAC;IAClB,eAAe,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,6EAA6E;AAC7E,eAAO,MAAM,gCAAgC,YAAY,CAAC;AAE1D,4FAA4F;AAC5F,MAAM,WAAW,8BAA8B;IAC7C,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,MAAM,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,eAAe,EAAE,MAAM,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,wBAAgB,8BAA8B,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,GAAG,OAAO,CAG3F;AAiBD,qBACa,oBAAoB;IAGnB,OAAO,CAAC,QAAQ,CAAC,aAAa;IAF1C,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAyC;gBAEnC,aAAa,EAAE,8BAA8B;IAE1E;;;OAGG;IACG,aAAa,CAAC,KAAK,EAAE,wBAAwB,GAAG,OAAO,CAAC,yBAAyB,CAAC;IA0DxF;;;OAGG;IACG,oBAAoB,CAAC,KAAK,EAAE,+BAA+B,GAAG,OAAO,CAAC,OAAO,CAAC;IAoC9E,uBAAuB,CAAC,eAAe,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAwBrE;;;OAGG;IACG,iBAAiB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IASnD,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAS1D;;;OAGG;IACG,yBAAyB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,8BAA8B,EAAE,CAAC;IAsC1F,8EAA8E;IACxE,0BAA0B,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAKnE,mFAAmF;IAC7E,sBAAsB,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe,GAAG,OAAO,CAAC,OAAO,CAAC;IAYrF,wEAAwE;IAClE,wBAAwB,CAC5B,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE;QAAE,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,GACzC,OAAO,CAAC,MAAM,CAAC;IAclB,8EAA8E;IACxE,+BAA+B,CACnC,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,8BAA8B,EAAE,CAAC;IAU5C,yFAAyF;IACnF,2BAA2B,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;IAYjF;;;;OAIG;IACG,sBAAsB,CAAC,MAAM,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;YA4B/E,2BAA2B;YAiD3B,kBAAkB;YAsBlB,qBAAqB;YAyBrB,eAAe;IAoC7B,wDAAwD;YAC1C,yBAAyB;YAgCzB,0BAA0B;YAW1B,gBAAgB;CAQ/B"}

package/security/src/lib/auth/device-session.service.js

@@ -1,7 +1,8 @@
 "use strict";
 var DeviceSessionService_1;
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.DeviceSessionService = void 0;
+exports.DeviceSessionService = exports.DEVICE_SESSION_UNBOUND_TENANT_ID = void 0;
+exports.isUnboundDeviceSessionTenantId = isUnboundDeviceSessionTenantId;
 const tslib_1 = require("tslib");
 const common_1 = require("@nestjs/common");
 const core_1 = require("@acorex-platform/framework-server/core");
@@ -10,48 +11,74 @@ const request_meta_util_1 = require("./request-meta.util");
 //#region ---- Device session service ----
 const DEVICE_SESSION_ENTITY = 'SecurityManagement.DeviceSessions';
 const SESSION_QUERY_PAGE = 100;
+/** Placeholder tenant stamped at create-login before tenant chooser bind. */
+exports.DEVICE_SESSION_UNBOUND_TENANT_ID = 'default';
+function isUnboundDeviceSessionTenantId(tenantId) {
+    const tid = tenantId?.trim();
+    return !tid || tid === exports.DEVICE_SESSION_UNBOUND_TENANT_ID;
+}
 let DeviceSessionService = DeviceSessionService_1 = class DeviceSessionService {
     constructor(entityStorage) {
         this.entityStorage = entityStorage;
         this.logger = new common_1.Logger(DeviceSessionService_1.name);
     }
+    /**
+     * Ensures one active DeviceSessions row per user+device (Telegram-style).
+     * Re-login on the same browser/UA updates the existing row instead of inserting.
+     */
     async createSession(input) {
         const userId = input.user.id;
         const username = 'name' in input.user && 'title' in input.user
             ? input.user.name
             : input.user.username ?? userId;
         const parsed = (0, request_meta_util_1.parseUserAgent)(input.meta.userAgent);
-        const tenantId = input.tenantId ?? 'default';
-        const applicationId = input.applicationId ?? 'default';
+        const deviceKey = buildDeviceKey(input.meta.userAgent, parsed);
+        const tenantId = input.tenantId?.trim() || exports.DEVICE_SESSION_UNBOUND_TENANT_ID;
+        const applicationId = input.applicationId?.trim() || 'default';
         const now = new Date();
-        const record = {
-            id: (0, crypto_1.randomUUID)(),
-            clientName: input.meta.clientName,
-            ipAddress: input.meta.ipAddress,
-            userAgent: input.meta.userAgent,
-            authorizationId: input.authorizationId,
-            status: 'active',
-            userId,
-            user: { id: userId, name: username },
-            applicationId,
-            application: { id: applicationId, name: applicationId },
-            tenantId,
-            tenant: { id: tenantId, name: tenantId },
-            isActiveSession: true,
-            deviceName: parsed.deviceName,
-            operatingSystem: parsed.operatingSystem,
-            browser: parsed.browser,
-            location: 'Unknown',
-            lastLoginDate: now,
-            sessionId: input.sessionId,
-            config: { sessionId: input.sessionId },
-        };
         try {
-            return await this.entityStorage.insertOne(DEVICE_SESSION_ENTITY, record);
+            const existing = await this.findActiveByDevice(userId, deviceKey, input.meta.userAgent);
+            if (existing.length > 0) {
+                return await this.upsertExistingDeviceSession({
+                    existing,
+                    input,
+                    deviceKey,
+                    parsed,
+                    username,
+                    tenantId,
+                    applicationId,
+                    now,
+                });
+            }
+            const id = (0, crypto_1.randomUUID)();
+            await this.entityStorage.insertOne(DEVICE_SESSION_ENTITY, {
+                id,
+                clientName: input.meta.clientName,
+                ipAddress: input.meta.ipAddress,
+                userAgent: input.meta.userAgent,
+                deviceKey,
+                authorizationId: input.authorizationId,
+                status: 'active',
+                userId,
+                user: { id: userId, name: username },
+                applicationId,
+                application: { id: applicationId, name: applicationId },
+                tenantId,
+                tenant: { id: tenantId, name: tenantId },
+                isActiveSession: true,
+                deviceName: parsed.deviceName,
+                operatingSystem: parsed.operatingSystem,
+                browser: parsed.browser,
+                location: 'Unknown',
+                lastLoginDate: now,
+                sessionId: input.sessionId,
+                config: { sessionId: input.sessionId, deviceKey },
+            });
+            return { id, replacedSessionIds: [] };
         }
         catch (error) {
             this.logger.warn(`Failed to create device session: ${String(error)}`);
-            return record.id;
+            return { id: (0, crypto_1.randomUUID)(), replacedSessionIds: [] };
         }
     }
     /**
@@ -79,7 +106,7 @@ let DeviceSessionService = DeviceSessionService_1 = class DeviceSessionService {
                 applicationId,
                 application: { id: applicationId, name: applicationId },
                 sessionId,
-                config: { sessionId },
+                config: { sessionId, deviceKey: primary.deviceKey || undefined },
                 status: 'active',
                 isActiveSession: true,
             });
@@ -113,6 +140,216 @@ let DeviceSessionService = DeviceSessionService_1 = class DeviceSessionService {
             this.logger.warn(`Failed to revoke device session: ${String(error)}`);
         }
     }
+    /**
+     * Family revoke on refresh-token replay.
+     * Revoke all active device session rows bound to the same `sessionId`.
+     */
+    async revokeBySessionId(sessionId) {
+        try {
+            const rows = await this.findBySessionId(sessionId);
+            await Promise.all(rows.map((row) => this.revokeSessionRow(row.id)));
+        }
+        catch (error) {
+            this.logger.warn(`Failed to revoke device sessions by sessionId: ${String(error)}`);
+        }
+    }
+    async isSessionActive(sessionId) {
+        if (!sessionId.trim()) {
+            return false;
+        }
+        const rows = await this.findBySessionId(sessionId);
+        return rows.some((row) => row.status.toLowerCase() === 'active');
+    }
+    /**
+     * Active DeviceSessions for a user across all tenants (engine query — no RLS).
+     * Used to resolve Socket.IO destinations: room `t:{tenantId}:u:{userId}` per row.
+     */
+    async listActiveSessionsForUser(userId) {
+        const uid = userId.trim();
+        if (!uid) {
+            return [];
+        }
+        try {
+            const items = [];
+            let skip = 0;
+            for (;;) {
+                const page = await this.entityStorage.queryAsEngine(DEVICE_SESSION_ENTITY, {
+                    skip,
+                    take: SESSION_QUERY_PAGE,
+                    filter: {
+                        logic: 'and',
+                        filters: [
+                            { field: 'userId', operator: { type: 'equal' }, value: uid },
+                            { field: 'status', operator: { type: 'equal' }, value: 'active' },
+                        ],
+                    },
+                });
+                const batch = (page.items ?? []);
+                items.push(...batch);
+                if (batch.length < SESSION_QUERY_PAGE) {
+                    break;
+                }
+                skip += SESSION_QUERY_PAGE;
+            }
+            return items
+                .map(asActiveDeviceSessionDestination)
+                .filter((row) => row != null);
+        }
+        catch (error) {
+            this.logger.warn(`Failed to list active device sessions for user ${uid}: ${String(error)}`);
+            return [];
+        }
+    }
+    /** Distinct tenant ids that have at least one active session for the user. */
+    async listActiveTenantIdsForUser(userId) {
+        const rows = await this.listActiveSessionsForUser(userId);
+        return [...new Set(rows.map((row) => row.tenantId).filter(Boolean))];
+    }
+    /** True when the user already has an active DeviceSessions row for this device. */
+    async hasActiveDeviceForUser(userId, meta) {
+        const uid = userId.trim();
+        if (!uid) {
+            return false;
+        }
+        const parsed = (0, request_meta_util_1.parseUserAgent)(meta.userAgent);
+        const deviceKey = buildDeviceKey(meta.userAgent, parsed);
+        const existing = await this.findActiveByDevice(uid, deviceKey, meta.userAgent);
+        return existing.length > 0;
+    }
+    /** Count of active DeviceSessions for the user in a specific tenant. */
+    async countActiveForUserTenant(userId, tenantId, options) {
+        const uid = userId.trim();
+        const tid = tenantId.trim();
+        if (!uid || !tid || isUnboundDeviceSessionTenantId(tid)) {
+            return 0;
+        }
+        const excluded = new Set((options?.excludeSessionIds ?? []).map((id) => id.trim()).filter(Boolean));
+        const rows = await this.listActiveSessionsForUserTenant(uid, tid);
+        return rows.filter((row) => !excluded.has(row.sessionId)).length;
+    }
+    /** Active DeviceSessions for a user in one tenant (engine query — no RLS). */
+    async listActiveSessionsForUserTenant(userId, tenantId) {
+        const tid = tenantId.trim();
+        if (!tid || isUnboundDeviceSessionTenantId(tid)) {
+            return [];
+        }
+        const rows = await this.listActiveSessionsForUser(userId);
+        return rows.filter((row) => row.tenantId === tid);
+    }
+    /** Tenant id currently stamped on the active DeviceSessions row for this login `sid`. */
+    async getActiveTenantIdForSession(sessionId) {
+        const sid = sessionId.trim();
+        if (!sid) {
+            return undefined;
+        }
+        const rows = await this.findBySessionId(sid);
+        const primary = rows.find((row) => row.status.toLowerCase() === 'active') ?? rows[0];
+        const tid = primary?.tenantId?.trim();
+        return tid && !isUnboundDeviceSessionTenantId(tid) ? tid : undefined;
+    }
+    /**
+     * Revoke an active DeviceSessions row by entity id (or login `sid`) when it belongs to `userId`.
+     * Uses engine update so tenant isolation on the unbound session-limit page cannot block revoke.
+     * Returns the login `sid` that was revoked (for Redis projection), or null when not found/owned.
+     */
+    async revokeOwnedSessionById(userId, deviceSessionId) {
+        const uid = userId.trim();
+        const id = deviceSessionId.trim();
+        if (!uid || !id) {
+            return null;
+        }
+        try {
+            const rows = await this.listActiveSessionsForUser(uid);
+            const match = rows.find((row) => row.id === id || row.sessionId === id);
+            if (!match) {
+                return null;
+            }
+            const loggedOutAt = new Date();
+            await this.entityStorage.updateOneAsEngine(DEVICE_SESSION_ENTITY, match.id, {
+                status: 'revoked',
+                isActiveSession: false,
+                loggedOutAt,
+            });
+            // Empty string = revoked but no JWT sid to stamp (caller treats null as not-found).
+            return match.sessionId?.trim() || '';
+        }
+        catch (error) {
+            this.logger.warn(`Failed to revoke owned device session ${id}: ${String(error)}`);
+            return null;
+        }
+    }
+    async upsertExistingDeviceSession(args) {
+        const { existing, input, deviceKey, parsed, username, tenantId, applicationId, now } = args;
+        const primary = pickPrimarySessionRow(existing);
+        const replacedSessionIds = new Set();
+        for (const row of existing) {
+            if (row.sessionId && row.sessionId !== input.sessionId) {
+                replacedSessionIds.add(row.sessionId);
+            }
+            if (row.id !== primary.id && row.status.toLowerCase() === 'active') {
+                await this.revokeSessionRow(row.id);
+            }
+        }
+        await this.entityStorage.updateOne(DEVICE_SESSION_ENTITY, primary.id, {
+            clientName: input.meta.clientName,
+            ipAddress: input.meta.ipAddress,
+            userAgent: input.meta.userAgent,
+            deviceKey,
+            authorizationId: input.authorizationId,
+            status: 'active',
+            userId: input.user.id,
+            user: { id: input.user.id, name: username },
+            applicationId,
+            application: { id: applicationId, name: applicationId },
+            tenantId,
+            tenant: { id: tenantId, name: tenantId },
+            isActiveSession: true,
+            deviceName: parsed.deviceName,
+            operatingSystem: parsed.operatingSystem,
+            browser: parsed.browser,
+            lastLoginDate: now,
+            loggedOutAt: null,
+            sessionId: input.sessionId,
+            config: { sessionId: input.sessionId, deviceKey },
+        });
+        return { id: primary.id, replacedSessionIds: [...replacedSessionIds] };
+    }
+    async findActiveByDevice(userId, deviceKey, userAgent) {
+        const byKey = await this.queryActiveDeviceRows([
+            { field: 'userId', operator: { type: 'equal' }, value: userId },
+            { field: 'status', operator: { type: 'equal' }, value: 'active' },
+            { field: 'deviceKey', operator: { type: 'equal' }, value: deviceKey },
+        ]);
+        if (byKey.length > 0) {
+            return byKey;
+        }
+        // Legacy rows created before deviceKey existed.
+        return this.queryActiveDeviceRows([
+            { field: 'userId', operator: { type: 'equal' }, value: userId },
+            { field: 'status', operator: { type: 'equal' }, value: 'active' },
+            { field: 'userAgent', operator: { type: 'equal' }, value: userAgent },
+        ]);
+    }
+    async queryActiveDeviceRows(filters) {
+        const items = [];
+        let skip = 0;
+        for (;;) {
+            const page = await this.entityStorage.query(DEVICE_SESSION_ENTITY, {
+                skip,
+                take: SESSION_QUERY_PAGE,
+                filter: { logic: 'and', filters },
+            });
+            const batch = (page.items ?? []);
+            items.push(...batch);
+            if (batch.length < SESSION_QUERY_PAGE) {
+                break;
+            }
+            skip += SESSION_QUERY_PAGE;
+        }
+        return items
+            .map(asStoredDeviceSessionRow)
+            .filter((row) => row != null);
+    }
     async findBySessionId(sessionId) {
         const items = [];
         let skip = 0;
@@ -196,6 +433,13 @@ exports.DeviceSessionService = DeviceSessionService = DeviceSessionService_1 = t
 ], DeviceSessionService);
 //#endregion
 //#region ----- Helpers -----
+function buildDeviceKey(userAgent, parsed) {
+    const normalizedUa = userAgent.trim().toLowerCase();
+    return (0, crypto_1.createHash)('sha256')
+        .update(`${parsed.browser}|${parsed.operatingSystem}|${parsed.deviceName}|${normalizedUa}`)
+        .digest('hex')
+        .slice(0, 32);
+}
 function pickPrimarySessionRow(rows) {
     const sorted = [...rows].sort((a, b) => (b.lastLoginDate?.getTime() ?? 0) - (a.lastLoginDate?.getTime() ?? 0));
     return sorted.find((row) => row.status.toLowerCase() === 'active') ?? sorted[0];
@@ -209,6 +453,9 @@ function asStoredDeviceSessionRow(raw) {
     const sessionId = (typeof raw['sessionId'] === 'string' && raw['sessionId'].trim()) ||
         (typeof config?.sessionId === 'string' && config.sessionId.trim()) ||
         '';
+    const deviceKey = (typeof raw['deviceKey'] === 'string' && raw['deviceKey'].trim()) ||
+        (typeof config?.deviceKey === 'string' && config.deviceKey.trim()) ||
+        '';
     return {
         id,
         status: typeof raw['status'] === 'string' ? raw['status'] : 'unknown',
@@ -216,6 +463,30 @@ function asStoredDeviceSessionRow(raw) {
         tenantId: typeof raw['tenantId'] === 'string' ? raw['tenantId'] : 'default',
         applicationId: typeof raw['applicationId'] === 'string' ? raw['applicationId'] : 'default',
         sessionId,
+        userAgent: typeof raw['userAgent'] === 'string' ? raw['userAgent'] : '',
+        deviceKey,
+        deviceName: typeof raw['deviceName'] === 'string' ? raw['deviceName'] : undefined,
+        browser: typeof raw['browser'] === 'string' ? raw['browser'] : undefined,
+        operatingSystem: typeof raw['operatingSystem'] === 'string' ? raw['operatingSystem'] : undefined,
+        ipAddress: typeof raw['ipAddress'] === 'string' ? raw['ipAddress'] : undefined,
+    };
+}
+function asActiveDeviceSessionDestination(raw) {
+    const row = asStoredDeviceSessionRow(raw);
+    if (!row?.sessionId || !row.tenantId) {
+        return null;
+    }
+    return {
+        id: row.id,
+        sessionId: row.sessionId,
+        tenantId: row.tenantId,
+        applicationId: row.applicationId,
+        deviceName: row.deviceName?.trim() || 'Desktop',
+        browser: row.browser?.trim() || 'Unknown Browser',
+        operatingSystem: row.operatingSystem?.trim() || 'Unknown OS',
+        ipAddress: row.ipAddress?.trim() || '',
+        userAgent: row.userAgent,
+        lastLoginAt: row.lastLoginDate?.toISOString(),
     };
 }
 function toDate(value) {

package/security/src/lib/auth/device-session.service.js.map

@@ -1 +1 @@
-{"version":3,"file":"device-session.service.js","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/auth/device-session.service.ts"],"names":[],"mappings":";;;;;AAAA,2CAAoD;AACpD,iEAAwF;AACxF,mCAAoC;AAEpC,2DAAqD;AAGrD,0CAA0C;AAE1C,MAAM,qBAAqB,GAAG,mCAAmC,CAAC;AAClE,MAAM,kBAAkB,GAAG,GAAG,CAAC;AA4BxB,IAAM,oBAAoB,4BAA1B,MAAM,oBAAoB;IAG/B,YAA6B,aAA6C;QAA7C,kBAAa,GAAb,aAAa,CAAgC;QAFzD,WAAM,GAAG,IAAI,eAAM,CAAC,sBAAoB,CAAC,IAAI,CAAC,CAAC;IAEa,CAAC;IAE9E,KAAK,CAAC,aAAa,CAAC,KAA+B;QACjD,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7B,MAAM,QAAQ,GACZ,MAAM,IAAI,KAAK,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,CAAC,IAAI;YAC3C,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI;YACjB,CAAC,CAAE,KAAK,CAAC,IAAqC,CAAC,QAAQ,IAAI,MAAM,CAAC;QACtE,MAAM,MAAM,GAAG,IAAA,kCAAc,EAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACpD,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,IAAI,SAAS,CAAC;QAC7C,MAAM,aAAa,GAAG,KAAK,CAAC,aAAa,IAAI,SAAS,CAAC;QACvD,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;QAEvB,MAAM,MAAM,GAAG;YACb,EAAE,EAAE,IAAA,mBAAU,GAAE;YAChB,UAAU,EAAE,KAAK,CAAC,IAAI,CAAC,UAAU;YACjC,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC,SAAS;YAC/B,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC,SAAS;YAC/B,eAAe,EAAE,KAAK,CAAC,eAAe;YACtC,MAAM,EAAE,QAAQ;YAChB,MAAM;YACN,IAAI,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE;YACpC,aAAa;YACb,WAAW,EAAE,EAAE,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,aAAa,EAAE;YACvD,QAAQ;YACR,MAAM,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE;YACxC,eAAe,EAAE,IAAI;YACrB,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,eAAe,EAAE,MAAM,CAAC,eAAe;YACvC,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,QAAQ,EAAE,SAAS;YACnB,aAAa,EAAE,GAAG;YAClB,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,MAAM,EAAE,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE;SACvC,CAAC;QAEF,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;QAC3E,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,oCAAoC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YACtE,OAAO,MAAM,CAAC,EAAE,CAAC;QACnB,CAAC;IACH,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,oBAAoB,CAAC,KAAsC;QAC/D,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;QACzC,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC;QACnD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtB,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,OAAO,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC;QAC5C,MAAM,IAAI,CAAC,0BAA0B,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;QAExD,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC;QACpD,MAAM,aAAa,GAAG,KAAK,CAAC,aAAa,IAAI,OAAO,CAAC,aAAa,CAAC;QAEnE,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,qBAAqB,EAAE,OAAO,CAAC,EAAE,EAAE;gBACpE,eAAe,EAAE,KAAK,CAAC,eAAe;gBACtC,QAAQ;gBACR,MAAM,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE;gBACxC,aAAa;gBACb,WAAW,EAAE,EAAE,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,aAAa,EAAE;gBACvD,SAAS;gBACT,MAAM,EAAE,EAAE,SAAS,EAAE;gBACrB,MAAM,EAAE,QAAQ;gBAChB,eAAe,EAAE,IAAI;aACtB,CAAC,CAAC;YACH,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,4CAA4C,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YAC9E,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED,KAAK,CAAC,uBAAuB,CAAC,eAAuB;QACnD,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,qBAAqB,EAAE;gBACnE,IAAI,EAAE,CAAC;gBACP,IAAI,EAAE,CAAC;gBACP,MAAM,EAAE;oBACN,KAAK,EAAE,KAAK;oBACZ,OAAO,EAAE;wBACP;4BACE,KAAK,EAAE,iBAAiB;4BACxB,QAAQ,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE;4BAC3B,KAAK,EAAE,eAAe;yBACvB;qBACF;iBACF;aACF,CAAC,CAAC;YAEH,MAAM,KAAK,GAAG,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAA0B,CAAC;YAC5D,MAAM,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QACzE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,oCAAoC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACxE,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,eAAe,CAAC,SAAiB;QAC7C,MAAM,KAAK,GAA8B,EAAE,CAAC;QAC5C,IAAI,IAAI,GAAG,CAAC,CAAC;QAEb,SAAS,CAAC;YACR,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,qBAAqB,EAAE;gBACjE,IAAI;gBACJ,IAAI,EAAE,kBAAkB;gBACxB,MAAM,EAAE;oBACN,KAAK,EAAE,KAAK;oBACZ,OAAO,EAAE;wBACP;4BACE,KAAK,EAAE,WAAW;4BAClB,QAAQ,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE;4BAC3B,KAAK,EAAE,SAAS;yBACjB;qBACF;iBACF;aACF,CAAC,CAAC;YACH,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAA8B,CAAC;YAC9D,KAAK,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC;YACrB,IAAI,KAAK,CAAC,MAAM,GAAG,kBAAkB,EAAE,CAAC;gBACtC,MAAM;YACR,CAAC;YACD,IAAI,IAAI,kBAAkB,CAAC;QAC7B,CAAC;QAED,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,OAAO,IAAI,CAAC,yBAAyB,CAAC,SAAS,CAAC,CAAC;QACnD,CAAC;QAED,OAAO,KAAK;aACT,GAAG,CAAC,wBAAwB,CAAC;aAC7B,MAAM,CAAC,CAAC,GAAG,EAAiC,EAAE,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC;IACjE,CAAC;IAED,wDAAwD;IAChD,KAAK,CAAC,yBAAyB,CAAC,SAAiB;QACvD,MAAM,KAAK,GAA8B,EAAE,CAAC;QAC5C,IAAI,IAAI,GAAG,CAAC,CAAC;QAEb,SAAS,CAAC;YACR,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,qBAAqB,EAAE;gBACjE,IAAI;gBACJ,IAAI,EAAE,kBAAkB;gBACxB,MAAM,EAAE;oBACN,KAAK,EAAE,KAAK;oBACZ,OAAO,EAAE;wBACP;4BACE,KAAK,EAAE,kBAAkB;4BACzB,QAAQ,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE;4BAC3B,KAAK,EAAE,SAAS;yBACjB;qBACF;iBACF;aACF,CAAC,CAAC;YACH,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAA8B,CAAC;YAC9D,KAAK,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC;YACrB,IAAI,KAAK,CAAC,MAAM,GAAG,kBAAkB,EAAE,CAAC;gBACtC,MAAM;YACR,CAAC;YACD,IAAI,IAAI,kBAAkB,CAAC;QAC7B,CAAC;QAED,OAAO,KAAK;aACT,GAAG,CAAC,wBAAwB,CAAC;aAC7B,MAAM,CAAC,CAAC,GAAG,EAAiC,EAAE,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC;IACjE,CAAC;IAEO,KAAK,CAAC,0BAA0B,CACtC,IAA8B,EAC9B,MAAc;QAEd,MAAM,OAAO,CAAC,GAAG,CACf,IAAI;aACD,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,KAAK,MAAM,IAAI,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,KAAK,QAAQ,CAAC;aAC3E,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAC/C,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,gBAAgB,CAAC,EAAU;QACvC,MAAM,WAAW,GAAG,IAAI,IAAI,EAAE,CAAC;QAC/B,MAAM,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,qBAAqB,EAAE,EAAE,EAAE;YAC5D,MAAM,EAAE,SAAS;YACjB,eAAe,EAAE,KAAK;YACtB,WAAW;SACZ,CAAC,CAAC;IACL,CAAC;CACF,CAAA;AAvMY,oDAAoB;+BAApB,oBAAoB;IADhC,IAAA,mBAAU,GAAE;6CAIiC,qCAA8B;GAH/D,oBAAoB,CAuMhC;AAED,YAAY;AAEZ,6BAA6B;AAE7B,SAAS,qBAAqB,CAAC,IAA8B;IAC3D,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC,IAAI,CAC3B,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,aAAa,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,aAAa,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,CAChF,CAAC;IACF,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,KAAK,QAAQ,CAAC,IAAI,MAAM,CAAC,CAAC,CAAE,CAAC;AACnF,CAAC;AAED,SAAS,wBAAwB,CAAC,GAA4B;IAC5D,MAAM,EAAE,GAAG,OAAO,GAAG,CAAC,IAAI,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC1D,IAAI,CAAC,EAAE,EAAE,CAAC;QACR,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,MAAM,GAAG,GAAG,CAAC,QAAQ,CAAwC,CAAC;IACpE,MAAM,SAAS,GACb,CAAC,OAAO,GAAG,CAAC,WAAW,CAAC,KAAK,QAAQ,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC,IAAI,EAAE,CAAC;QACjE,CAAC,OAAO,MAAM,EAAE,SAAS,KAAK,QAAQ,IAAI,MAAM,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;QAClE,EAAE,CAAC;IAEL,OAAO;QACL,EAAE;QACF,MAAM,EAAE,OAAO,GAAG,CAAC,QAAQ,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS;QACrE,aAAa,EAAE,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;QAC3C,QAAQ,EAAE,OAAO,GAAG,CAAC,UAAU,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS;QAC3E,aAAa,EAAE,OAAO,GAAG,CAAC,eAAe,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,SAAS;QAC1F,SAAS;KACV,CAAC;AACJ,CAAC;AAED,SAAS,MAAM,CAAC,KAAc;IAC5B,IAAI,KAAK,YAAY,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;QAC5D,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;QAC9C,MAAM,MAAM,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC;QAC/B,OAAO,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC;IACxD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,YAAY"}
+{"version":3,"file":"device-session.service.js","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/auth/device-session.service.ts"],"names":[],"mappings":";;;;AAoDA,wEAGC;;AAvDD,2CAAoD;AACpD,iEAAwF;AACxF,mCAAgD;AAEhD,2DAAqD;AAGrD,0CAA0C;AAE1C,MAAM,qBAAqB,GAAG,mCAAmC,CAAC;AAClE,MAAM,kBAAkB,GAAG,GAAG,CAAC;AAyB/B,6EAA6E;AAChE,QAAA,gCAAgC,GAAG,SAAS,CAAC;AAgB1D,SAAgB,8BAA8B,CAAC,QAAmC;IAChF,MAAM,GAAG,GAAG,QAAQ,EAAE,IAAI,EAAE,CAAC;IAC7B,OAAO,CAAC,GAAG,IAAI,GAAG,KAAK,wCAAgC,CAAC;AAC1D,CAAC;AAkBM,IAAM,oBAAoB,4BAA1B,MAAM,oBAAoB;IAG/B,YAA6B,aAA6C;QAA7C,kBAAa,GAAb,aAAa,CAAgC;QAFzD,WAAM,GAAG,IAAI,eAAM,CAAC,sBAAoB,CAAC,IAAI,CAAC,CAAC;IAEa,CAAC;IAE9E;;;OAGG;IACH,KAAK,CAAC,aAAa,CAAC,KAA+B;QACjD,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7B,MAAM,QAAQ,GACZ,MAAM,IAAI,KAAK,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,CAAC,IAAI;YAC3C,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI;YACjB,CAAC,CAAE,KAAK,CAAC,IAAqC,CAAC,QAAQ,IAAI,MAAM,CAAC;QACtE,MAAM,MAAM,GAAG,IAAA,kCAAc,EAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACpD,MAAM,SAAS,GAAG,cAAc,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QAC/D,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,wCAAgC,CAAC;QAC5E,MAAM,aAAa,GAAG,KAAK,CAAC,aAAa,EAAE,IAAI,EAAE,IAAI,SAAS,CAAC;QAC/D,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;QAEvB,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,MAAM,EAAE,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACxF,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACxB,OAAO,MAAM,IAAI,CAAC,2BAA2B,CAAC;oBAC5C,QAAQ;oBACR,KAAK;oBACL,SAAS;oBACT,MAAM;oBACN,QAAQ;oBACR,QAAQ;oBACR,aAAa;oBACb,GAAG;iBACJ,CAAC,CAAC;YACL,CAAC;YAED,MAAM,EAAE,GAAG,IAAA,mBAAU,GAAE,CAAC;YACxB,MAAM,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,qBAAqB,EAAE;gBACxD,EAAE;gBACF,UAAU,EAAE,KAAK,CAAC,IAAI,CAAC,UAAU;gBACjC,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC,SAAS;gBAC/B,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC,SAAS;gBAC/B,SAAS;gBACT,eAAe,EAAE,KAAK,CAAC,eAAe;gBACtC,MAAM,EAAE,QAAQ;gBAChB,MAAM;gBACN,IAAI,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE;gBACpC,aAAa;gBACb,WAAW,EAAE,EAAE,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,aAAa,EAAE;gBACvD,QAAQ;gBACR,MAAM,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE;gBACxC,eAAe,EAAE,IAAI;gBACrB,UAAU,EAAE,MAAM,CAAC,UAAU;gBAC7B,eAAe,EAAE,MAAM,CAAC,eAAe;gBACvC,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,QAAQ,EAAE,SAAS;gBACnB,aAAa,EAAE,GAAG;gBAClB,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,MAAM,EAAE,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,SAAS,EAAE;aAClD,CAAC,CAAC;YACH,OAAO,EAAE,EAAE,EAAE,kBAAkB,EAAE,EAAE,EAAE,CAAC;QACxC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,oCAAoC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YACtE,OAAO,EAAE,EAAE,EAAE,IAAA,mBAAU,GAAE,EAAE,kBAAkB,EAAE,EAAE,EAAE,CAAC;QACtD,CAAC;IACH,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,oBAAoB,CAAC,KAAsC;QAC/D,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;QACzC,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC;QACnD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtB,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,OAAO,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC;QAC5C,MAAM,IAAI,CAAC,0BAA0B,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;QAExD,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC;QACpD,MAAM,aAAa,GAAG,KAAK,CAAC,aAAa,IAAI,OAAO,CAAC,aAAa,CAAC;QAEnE,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,qBAAqB,EAAE,OAAO,CAAC,EAAE,EAAE;gBACpE,eAAe,EAAE,KAAK,CAAC,eAAe;gBACtC,QAAQ;gBACR,MAAM,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE;gBACxC,aAAa;gBACb,WAAW,EAAE,EAAE,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,aAAa,EAAE;gBACvD,SAAS;gBACT,MAAM,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,SAAS,EAAE;gBAChE,MAAM,EAAE,QAAQ;gBAChB,eAAe,EAAE,IAAI;aACtB,CAAC,CAAC;YACH,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,4CAA4C,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YAC9E,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED,KAAK,CAAC,uBAAuB,CAAC,eAAuB;QACnD,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,qBAAqB,EAAE;gBACnE,IAAI,EAAE,CAAC;gBACP,IAAI,EAAE,CAAC;gBACP,MAAM,EAAE;oBACN,KAAK,EAAE,KAAK;oBACZ,OAAO,EAAE;wBACP;4BACE,KAAK,EAAE,iBAAiB;4BACxB,QAAQ,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE;4BAC3B,KAAK,EAAE,eAAe;yBACvB;qBACF;iBACF;aACF,CAAC,CAAC;YAEH,MAAM,KAAK,GAAG,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAA0B,CAAC;YAC5D,MAAM,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QACzE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,oCAAoC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACxE,CAAC;IACH,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,iBAAiB,CAAC,SAAiB;QACvC,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC;YACnD,MAAM,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QACtE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,kDAAkD,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACtF,CAAC;IACH,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,SAAiB;QACrC,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,EAAE,CAAC;YACtB,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC;QACnD,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,KAAK,QAAQ,CAAC,CAAC;IACnE,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,yBAAyB,CAAC,MAAc;QAC5C,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;QAC1B,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,IAAI,CAAC;YACH,MAAM,KAAK,GAA8B,EAAE,CAAC;YAC5C,IAAI,IAAI,GAAG,CAAC,CAAC;YACb,SAAS,CAAC;gBACR,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,aAAa,CAAC,qBAAqB,EAAE;oBACzE,IAAI;oBACJ,IAAI,EAAE,kBAAkB;oBACxB,MAAM,EAAE;wBACN,KAAK,EAAE,KAAK;wBACZ,OAAO,EAAE;4BACP,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE;4BAC5D,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE;yBAClE;qBACF;iBACF,CAAC,CAAC;gBACH,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAA8B,CAAC;gBAC9D,KAAK,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC;gBACrB,IAAI,KAAK,CAAC,MAAM,GAAG,kBAAkB,EAAE,CAAC;oBACtC,MAAM;gBACR,CAAC;gBACD,IAAI,IAAI,kBAAkB,CAAC;YAC7B,CAAC;YAED,OAAO,KAAK;iBACT,GAAG,CAAC,gCAAgC,CAAC;iBACrC,MAAM,CAAC,CAAC,GAAG,EAAyC,EAAE,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC;QACzE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,kDAAkD,GAAG,KAAK,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YAC5F,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IAED,8EAA8E;IAC9E,KAAK,CAAC,0BAA0B,CAAC,MAAc;QAC7C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,yBAAyB,CAAC,MAAM,CAAC,CAAC;QAC1D,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IACvE,CAAC;IAED,mFAAmF;IACnF,KAAK,CAAC,sBAAsB,CAAC,MAAc,EAAE,IAAqB;QAChE,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;QAC1B,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,MAAM,GAAG,IAAA,kCAAc,EAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC9C,MAAM,SAAS,GAAG,cAAc,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QACzD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,GAAG,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QAC/E,OAAO,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;IAC7B,CAAC;IAED,wEAAwE;IACxE,KAAK,CAAC,wBAAwB,CAC5B,MAAc,EACd,QAAgB,EAChB,OAA0C;QAE1C,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;QAC1B,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,IAAI,8BAA8B,CAAC,GAAG,CAAC,EAAE,CAAC;YACxD,OAAO,CAAC,CAAC;QACX,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,GAAG,CACtB,CAAC,OAAO,EAAE,iBAAiB,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAC1E,CAAC;QACF,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,+BAA+B,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAClE,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC;IACnE,CAAC;IAED,8EAA8E;IAC9E,KAAK,CAAC,+BAA+B,CACnC,MAAc,EACd,QAAgB;QAEhB,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,CAAC,GAAG,IAAI,8BAA8B,CAAC,GAAG,CAAC,EAAE,CAAC;YAChD,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,yBAAyB,CAAC,MAAM,CAAC,CAAC;QAC1D,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,KAAK,GAAG,CAAC,CAAC;IACpD,CAAC;IAED,yFAAyF;IACzF,KAAK,CAAC,2BAA2B,CAAC,SAAiB;QACjD,MAAM,GAAG,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC;QAC7B,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;QAC7C,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,KAAK,QAAQ,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC;QACrF,MAAM,GAAG,GAAG,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;QACtC,OAAO,GAAG,IAAI,CAAC,8BAA8B,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;IACvE,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,sBAAsB,CAAC,MAAc,EAAE,eAAuB;QAClE,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;QAC1B,MAAM,EAAE,GAAG,eAAe,CAAC,IAAI,EAAE,CAAC;QAClC,IAAI,CAAC,GAAG,IAAI,CAAC,EAAE,EAAE,CAAC;YAChB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,yBAAyB,CAAC,GAAG,CAAC,CAAC;YACvD,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,IAAI,GAAG,CAAC,SAAS,KAAK,EAAE,CAAC,CAAC;YACxE,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,OAAO,IAAI,CAAC;YACd,CAAC;YAED,MAAM,WAAW,GAAG,IAAI,IAAI,EAAE,CAAC;YAC/B,MAAM,IAAI,CAAC,aAAa,CAAC,iBAAiB,CAAC,qBAAqB,EAAE,KAAK,CAAC,EAAE,EAAE;gBAC1E,MAAM,EAAE,SAAS;gBACjB,eAAe,EAAE,KAAK;gBACtB,WAAW;aACZ,CAAC,CAAC;YACH,oFAAoF;YACpF,OAAO,KAAK,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;QACvC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,yCAAyC,EAAE,KAAK,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YAClF,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,2BAA2B,CAAC,IASzC;QACC,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,aAAa,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;QAC5F,MAAM,OAAO,GAAG,qBAAqB,CAAC,QAAQ,CAAC,CAAC;QAChD,MAAM,kBAAkB,GAAG,IAAI,GAAG,EAAU,CAAC;QAE7C,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;YAC3B,IAAI,GAAG,CAAC,SAAS,IAAI,GAAG,CAAC,SAAS,KAAK,KAAK,CAAC,SAAS,EAAE,CAAC;gBACvD,kBAAkB,CAAC,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YACxC,CAAC;YACD,IAAI,GAAG,CAAC,EAAE,KAAK,OAAO,CAAC,EAAE,IAAI,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,KAAK,QAAQ,EAAE,CAAC;gBACnE,MAAM,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACtC,CAAC;QACH,CAAC;QAED,MAAM,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,qBAAqB,EAAE,OAAO,CAAC,EAAE,EAAE;YACpE,UAAU,EAAE,KAAK,CAAC,IAAI,CAAC,UAAU;YACjC,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC,SAAS;YAC/B,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC,SAAS;YAC/B,SAAS;YACT,eAAe,EAAE,KAAK,CAAC,eAAe;YACtC,MAAM,EAAE,QAAQ;YAChB,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE;YACrB,IAAI,EAAE,EAAE,EAAE,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YAC3C,aAAa;YACb,WAAW,EAAE,EAAE,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,aAAa,EAAE;YACvD,QAAQ;YACR,MAAM,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE;YACxC,eAAe,EAAE,IAAI;YACrB,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,eAAe,EAAE,MAAM,CAAC,eAAe;YACvC,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,aAAa,EAAE,GAAG;YAClB,WAAW,EAAE,IAAI;YACjB,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,MAAM,EAAE,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,SAAS,EAAE;SAClD,CAAC,CAAC;QAEH,OAAO,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,kBAAkB,EAAE,CAAC,GAAG,kBAAkB,CAAC,EAAE,CAAC;IACzE,CAAC;IAEO,KAAK,CAAC,kBAAkB,CAC9B,MAAc,EACd,SAAiB,EACjB,SAAiB;QAEjB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC;YAC7C,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE;YAC/D,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE;YACjE,EAAE,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE;SACtE,CAAC,CAAC;QACH,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACrB,OAAO,KAAK,CAAC;QACf,CAAC;QAED,gDAAgD;QAChD,OAAO,IAAI,CAAC,qBAAqB,CAAC;YAChC,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE;YAC/D,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE;YACjE,EAAE,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE;SACtE,CAAC,CAAC;IACL,CAAC;IAEO,KAAK,CAAC,qBAAqB,CACjC,OAA4E;QAE5E,MAAM,KAAK,GAA8B,EAAE,CAAC;QAC5C,IAAI,IAAI,GAAG,CAAC,CAAC;QAEb,SAAS,CAAC;YACR,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,qBAAqB,EAAE;gBACjE,IAAI;gBACJ,IAAI,EAAE,kBAAkB;gBACxB,MAAM,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE;aAClC,CAAC,CAAC;YACH,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAA8B,CAAC;YAC9D,KAAK,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC;YACrB,IAAI,KAAK,CAAC,MAAM,GAAG,kBAAkB,EAAE,CAAC;gBACtC,MAAM;YACR,CAAC;YACD,IAAI,IAAI,kBAAkB,CAAC;QAC7B,CAAC;QAED,OAAO,KAAK;aACT,GAAG,CAAC,wBAAwB,CAAC;aAC7B,MAAM,CAAC,CAAC,GAAG,EAAiC,EAAE,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC;IACjE,CAAC;IAEO,KAAK,CAAC,eAAe,CAAC,SAAiB;QAC7C,MAAM,KAAK,GAA8B,EAAE,CAAC;QAC5C,IAAI,IAAI,GAAG,CAAC,CAAC;QAEb,SAAS,CAAC;YACR,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,qBAAqB,EAAE;gBACjE,IAAI;gBACJ,IAAI,EAAE,kBAAkB;gBACxB,MAAM,EAAE;oBACN,KAAK,EAAE,KAAK;oBACZ,OAAO,EAAE;wBACP;4BACE,KAAK,EAAE,WAAW;4BAClB,QAAQ,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE;4BAC3B,KAAK,EAAE,SAAS;yBACjB;qBACF;iBACF;aACF,CAAC,CAAC;YACH,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAA8B,CAAC;YAC9D,KAAK,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC;YACrB,IAAI,KAAK,CAAC,MAAM,GAAG,kBAAkB,EAAE,CAAC;gBACtC,MAAM;YACR,CAAC;YACD,IAAI,IAAI,kBAAkB,CAAC;QAC7B,CAAC;QAED,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,OAAO,IAAI,CAAC,yBAAyB,CAAC,SAAS,CAAC,CAAC;QACnD,CAAC;QAED,OAAO,KAAK;aACT,GAAG,CAAC,wBAAwB,CAAC;aAC7B,MAAM,CAAC,CAAC,GAAG,EAAiC,EAAE,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC;IACjE,CAAC;IAED,wDAAwD;IAChD,KAAK,CAAC,yBAAyB,CAAC,SAAiB;QACvD,MAAM,KAAK,GAA8B,EAAE,CAAC;QAC5C,IAAI,IAAI,GAAG,CAAC,CAAC;QAEb,SAAS,CAAC;YACR,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,qBAAqB,EAAE;gBACjE,IAAI;gBACJ,IAAI,EAAE,kBAAkB;gBACxB,MAAM,EAAE;oBACN,KAAK,EAAE,KAAK;oBACZ,OAAO,EAAE;wBACP;4BACE,KAAK,EAAE,kBAAkB;4BACzB,QAAQ,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE;4BAC3B,KAAK,EAAE,SAAS;yBACjB;qBACF;iBACF;aACF,CAAC,CAAC;YACH,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAA8B,CAAC;YAC9D,KAAK,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC;YACrB,IAAI,KAAK,CAAC,MAAM,GAAG,kBAAkB,EAAE,CAAC;gBACtC,MAAM;YACR,CAAC;YACD,IAAI,IAAI,kBAAkB,CAAC;QAC7B,CAAC;QAED,OAAO,KAAK;aACT,GAAG,CAAC,wBAAwB,CAAC;aAC7B,MAAM,CAAC,CAAC,GAAG,EAAiC,EAAE,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC;IACjE,CAAC;IAEO,KAAK,CAAC,0BAA0B,CACtC,IAA8B,EAC9B,MAAc;QAEd,MAAM,OAAO,CAAC,GAAG,CACf,IAAI;aACD,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,KAAK,MAAM,IAAI,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,KAAK,QAAQ,CAAC;aAC3E,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAC/C,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,gBAAgB,CAAC,EAAU;QACvC,MAAM,WAAW,GAAG,IAAI,IAAI,EAAE,CAAC;QAC/B,MAAM,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,qBAAqB,EAAE,EAAE,EAAE;YAC5D,MAAM,EAAE,SAAS;YACjB,eAAe,EAAE,KAAK;YACtB,WAAW;SACZ,CAAC,CAAC;IACL,CAAC;CACF,CAAA;AA7dY,oDAAoB;+BAApB,oBAAoB;IADhC,IAAA,mBAAU,GAAE;6CAIiC,qCAA8B;GAH/D,oBAAoB,CA6dhC;AAED,YAAY;AAEZ,6BAA6B;AAE7B,SAAS,cAAc,CACrB,SAAiB,EACjB,MAAyC;IAEzC,MAAM,YAAY,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACpD,OAAO,IAAA,mBAAU,EAAC,QAAQ,CAAC;SACxB,MAAM,CAAC,GAAG,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,eAAe,IAAI,MAAM,CAAC,UAAU,IAAI,YAAY,EAAE,CAAC;SAC1F,MAAM,CAAC,KAAK,CAAC;SACb,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAClB,CAAC;AAED,SAAS,qBAAqB,CAAC,IAA8B;IAC3D,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC,IAAI,CAC3B,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,aAAa,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,aAAa,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,CAChF,CAAC;IACF,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,KAAK,QAAQ,CAAC,IAAI,MAAM,CAAC,CAAC,CAAE,CAAC;AACnF,CAAC;AAED,SAAS,wBAAwB,CAAC,GAA4B;IAC5D,MAAM,EAAE,GAAG,OAAO,GAAG,CAAC,IAAI,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC1D,IAAI,CAAC,EAAE,EAAE,CAAC;QACR,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,MAAM,GAAG,GAAG,CAAC,QAAQ,CAA6D,CAAC;IACzF,MAAM,SAAS,GACb,CAAC,OAAO,GAAG,CAAC,WAAW,CAAC,KAAK,QAAQ,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC,IAAI,EAAE,CAAC;QACjE,CAAC,OAAO,MAAM,EAAE,SAAS,KAAK,QAAQ,IAAI,MAAM,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;QAClE,EAAE,CAAC;IACL,MAAM,SAAS,GACb,CAAC,OAAO,GAAG,CAAC,WAAW,CAAC,KAAK,QAAQ,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC,IAAI,EAAE,CAAC;QACjE,CAAC,OAAO,MAAM,EAAE,SAAS,KAAK,QAAQ,IAAI,MAAM,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;QAClE,EAAE,CAAC;IAEL,OAAO;QACL,EAAE;QACF,MAAM,EAAE,OAAO,GAAG,CAAC,QAAQ,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS;QACrE,aAAa,EAAE,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;QAC3C,QAAQ,EAAE,OAAO,GAAG,CAAC,UAAU,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS;QAC3E,aAAa,EAAE,OAAO,GAAG,CAAC,eAAe,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,SAAS;QAC1F,SAAS;QACT,SAAS,EAAE,OAAO,GAAG,CAAC,WAAW,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,EAAE;QACvE,SAAS;QACT,UAAU,EAAE,OAAO,GAAG,CAAC,YAAY,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,SAAS;QACjF,OAAO,EAAE,OAAO,GAAG,CAAC,SAAS,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS;QACxE,eAAe,EAAE,OAAO,GAAG,CAAC,iBAAiB,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,SAAS;QAChG,SAAS,EAAE,OAAO,GAAG,CAAC,WAAW,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS;KAC/E,CAAC;AACJ,CAAC;AAED,SAAS,gCAAgC,CACvC,GAA4B;IAE5B,MAAM,GAAG,GAAG,wBAAwB,CAAC,GAAG,CAAC,CAAC;IAC1C,IAAI,CAAC,GAAG,EAAE,SAAS,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;QACrC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO;QACL,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,aAAa,EAAE,GAAG,CAAC,aAAa;QAChC,UAAU,EAAE,GAAG,CAAC,UAAU,EAAE,IAAI,EAAE,IAAI,SAAS;QAC/C,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,iBAAiB;QACjD,eAAe,EAAE,GAAG,CAAC,eAAe,EAAE,IAAI,EAAE,IAAI,YAAY;QAC5D,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE;QACtC,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,WAAW,EAAE,GAAG,CAAC,aAAa,EAAE,WAAW,EAAE;KAC9C,CAAC;AACJ,CAAC;AAED,SAAS,MAAM,CAAC,KAAc;IAC5B,IAAI,KAAK,YAAY,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;QAC5D,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;QAC9C,MAAM,MAAM,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC;QAC/B,OAAO,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC;IACxD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,YAAY"}

package/security/src/lib/auth/jwt-auth.guard.d.ts

@@ -6,6 +6,7 @@ import { TokenResolverService } from './token-resolver.service';
 /**
  * Opt-in guard for routes that require a valid access token.
  * Supports legacy Bearer header and optional access-token cookie.
+ * Applies OD-09 validation (signature, exp, `sid`, `jti`).
  */
 export declare class JwtAuthGuard implements CanActivate {
     private readonly reflector;
@@ -13,6 +14,6 @@ export declare class JwtAuthGuard implements CanActivate {
     private readonly machineTokenService;
     private readonly tokenResolver;
     constructor(reflector: Reflector, authService: AuthService, machineTokenService: MachineTokenService, tokenResolver: TokenResolverService);
-    canActivate(context: ExecutionContext): boolean;
+    canActivate(context: ExecutionContext): Promise<boolean>;
 }
 //# sourceMappingURL=jwt-auth.guard.d.ts.map

package/security/src/lib/auth/jwt-auth.guard.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"jwt-auth.guard.d.ts","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/auth/jwt-auth.guard.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,WAAW,EACX,gBAAgB,EAGjB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAEzC,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC7C,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAE9D,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAYhE;;;GAGG;AACH,qBACa,YAAa,YAAW,WAAW;IAE5C,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,WAAW;IAC5B,OAAO,CAAC,QAAQ,CAAC,mBAAmB;IACpC,OAAO,CAAC,QAAQ,CAAC,aAAa;gBAHb,SAAS,EAAE,SAAS,EACpB,WAAW,EAAE,WAAW,EACxB,mBAAmB,EAAE,mBAAmB,EACxC,aAAa,EAAE,oBAAoB;IAGtD,WAAW,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO;CA0ChD"}
+{"version":3,"file":"jwt-auth.guard.d.ts","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/auth/jwt-auth.guard.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,WAAW,EACX,gBAAgB,EAGjB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAEzC,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC7C,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAE9D,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAYhE;;;;GAIG;AACH,qBACa,YAAa,YAAW,WAAW;IAE5C,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,WAAW;IAC5B,OAAO,CAAC,QAAQ,CAAC,mBAAmB;IACpC,OAAO,CAAC,QAAQ,CAAC,aAAa;gBAHb,SAAS,EAAE,SAAS,EACpB,WAAW,EAAE,WAAW,EACxB,mBAAmB,EAAE,mBAAmB,EACxC,aAAa,EAAE,oBAAoB;IAGhD,WAAW,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,OAAO,CAAC;CA2C/D"}

package/security/src/lib/auth/jwt-auth.guard.js

@@ -12,6 +12,7 @@ const current_session_decorator_1 = require("../session/current-session.decorato
 /**
  * Opt-in guard for routes that require a valid access token.
  * Supports legacy Bearer header and optional access-token cookie.
+ * Applies OD-09 validation (signature, exp, `sid`, `jti`).
  */
 let JwtAuthGuard = class JwtAuthGuard {
     constructor(reflector, authService, machineTokenService, tokenResolver) {
@@ -20,7 +21,7 @@ let JwtAuthGuard = class JwtAuthGuard {
         this.machineTokenService = machineTokenService;
         this.tokenResolver = tokenResolver;
     }
-    canActivate(context) {
+    async canActivate(context) {
         const isPublic = this.reflector.getAllAndOverride(public_decorator_1.IS_PUBLIC_KEY, [
             context.getHandler(),
             context.getClass(),
@@ -40,7 +41,7 @@ let JwtAuthGuard = class JwtAuthGuard {
         }
         let payload;
         try {
-            payload = this.authService.verifyAccessToken(resolved.token);
+            payload = await this.authService.validateAccessToken(resolved.token);
         }
         catch (error) {
             if (error instanceof common_1.UnauthorizedException) {
@@ -53,6 +54,7 @@ let JwtAuthGuard = class JwtAuthGuard {
             username: payload.username,
             tenantId: payload.tid,
             applicationId: payload.aid,
+            sid: payload.sid,
         };
         return true;
     }

package/security/src/lib/auth/jwt-auth.guard.js.map

@@ -1 +1 @@
-{"version":3,"file":"jwt-auth.guard.js","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/auth/jwt-auth.guard.ts"],"names":[],"mappings":";;;;AAAA,2CAKwB;AACxB,uCAAyC;AAEzC,iDAA6C;AAC7C,mEAA8D;AAC9D,yDAAmD;AACnD,qEAAgE;AAChE,oFAA2E;AAW3E;;;GAGG;AAEI,IAAM,YAAY,GAAlB,MAAM,YAAY;IACvB,YACmB,SAAoB,EACpB,WAAwB,EACxB,mBAAwC,EACxC,aAAmC;QAHnC,cAAS,GAAT,SAAS,CAAW;QACpB,gBAAW,GAAX,WAAW,CAAa;QACxB,wBAAmB,GAAnB,mBAAmB,CAAqB;QACxC,kBAAa,GAAb,aAAa,CAAsB;IACnD,CAAC;IAEJ,WAAW,CAAC,OAAyB;QACnC,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAAU,gCAAa,EAAE;YACxE,OAAO,CAAC,UAAU,EAAE;YACpB,OAAO,CAAC,QAAQ,EAAE;SACnB,CAAC,CAAC;QAEH,IAAI,QAAQ,EAAE,CAAC;YACb,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAAsB,CAAC;QAExE,MAAM,cAAc,GAAG,IAAI,CAAC,mBAAmB,CAAC,cAAc,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAChF,IAAI,cAAc,EAAE,CAAC;YACnB,OAAO,CAAC,+CAAmB,CAAC,GAAG,cAAc,CAAC;YAC9C,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,CAAC,kBAAkB,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;QACzF,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,8BAAqB,CAAC,iCAAiC,CAAC,CAAC;QACrE,CAAC;QAED,IAAI,OAAO,CAAC;QACZ,IAAI,CAAC;YACH,OAAO,GAAG,IAAI,CAAC,WAAW,CAAC,iBAAiB,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC/D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,8BAAqB,EAAE,CAAC;gBAC3C,MAAM,KAAK,CAAC;YACd,CAAC;YACD,MAAM,IAAI,8BAAqB,CAAC,iCAAiC,CAAC,CAAC;QACrE,CAAC;QAED,OAAO,CAAC,+CAAmB,CAAC,GAAG;YAC7B,MAAM,EAAE,OAAO,CAAC,GAAG;YACnB,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,QAAQ,EAAE,OAAO,CAAC,GAAG;YACrB,aAAa,EAAE,OAAO,CAAC,GAAG;SAC3B,CAAC;QAEF,OAAO,IAAI,CAAC;IACd,CAAC;CACF,CAAA;AAlDY,oCAAY;uBAAZ,YAAY;IADxB,IAAA,mBAAU,GAAE;6CAGmB,gBAAS;QACP,0BAAW;QACH,2CAAmB;QACzB,6CAAoB;GAL3C,YAAY,CAkDxB;AAED,YAAY"}
+{"version":3,"file":"jwt-auth.guard.js","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/auth/jwt-auth.guard.ts"],"names":[],"mappings":";;;;AAAA,2CAKwB;AACxB,uCAAyC;AAEzC,iDAA6C;AAC7C,mEAA8D;AAC9D,yDAAmD;AACnD,qEAAgE;AAChE,oFAA2E;AAW3E;;;;GAIG;AAEI,IAAM,YAAY,GAAlB,MAAM,YAAY;IACvB,YACmB,SAAoB,EACpB,WAAwB,EACxB,mBAAwC,EACxC,aAAmC;QAHnC,cAAS,GAAT,SAAS,CAAW;QACpB,gBAAW,GAAX,WAAW,CAAa;QACxB,wBAAmB,GAAnB,mBAAmB,CAAqB;QACxC,kBAAa,GAAb,aAAa,CAAsB;IACnD,CAAC;IAEJ,KAAK,CAAC,WAAW,CAAC,OAAyB;QACzC,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAAU,gCAAa,EAAE;YACxE,OAAO,CAAC,UAAU,EAAE;YACpB,OAAO,CAAC,QAAQ,EAAE;SACnB,CAAC,CAAC;QAEH,IAAI,QAAQ,EAAE,CAAC;YACb,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAAsB,CAAC;QAExE,MAAM,cAAc,GAAG,IAAI,CAAC,mBAAmB,CAAC,cAAc,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAChF,IAAI,cAAc,EAAE,CAAC;YACnB,OAAO,CAAC,+CAAmB,CAAC,GAAG,cAAc,CAAC;YAC9C,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,CAAC,kBAAkB,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;QACzF,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,8BAAqB,CAAC,iCAAiC,CAAC,CAAC;QACrE,CAAC;QAED,IAAI,OAAO,CAAC;QACZ,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,mBAAmB,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACvE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,8BAAqB,EAAE,CAAC;gBAC3C,MAAM,KAAK,CAAC;YACd,CAAC;YACD,MAAM,IAAI,8BAAqB,CAAC,iCAAiC,CAAC,CAAC;QACrE,CAAC;QAED,OAAO,CAAC,+CAAmB,CAAC,GAAG;YAC7B,MAAM,EAAE,OAAO,CAAC,GAAG;YACnB,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,QAAQ,EAAE,OAAO,CAAC,GAAG;YACrB,aAAa,EAAE,OAAO,CAAC,GAAG;YAC1B,GAAG,EAAE,OAAO,CAAC,GAAG;SACjB,CAAC;QAEF,OAAO,IAAI,CAAC;IACd,CAAC;CACF,CAAA;AAnDY,oCAAY;uBAAZ,YAAY;IADxB,IAAA,mBAAU,GAAE;6CAGmB,gBAAS;QACP,0BAAW;QACH,2CAAmB;QACzB,6CAAoB;GAL3C,YAAY,CAmDxB;AAED,YAAY"}

package/security/src/lib/auth/login-attempt.service.d.ts

@@ -1,3 +1,4 @@
+import { EventEmitter2 } from '@nestjs/event-emitter';
 import { AuthLocalCredentialsService } from './auth-local-credentials.service';
 export interface LoginAttemptFailureResult {
     failures: number;
@@ -8,14 +9,24 @@ export interface LoginAttemptFailureResult {
 }
 export declare class LoginAttemptService {
     private readonly credentials;
+    private readonly events?;
     private readonly logger;
     private readonly attempts;
-    constructor(credentials: AuthLocalCredentialsService);
+    constructor(credentials: AuthLocalCredentialsService, events?: EventEmitter2 | undefined);
     buildAttemptKey(strategy: string, username: string): string;
     assertNotLocked(strategy: string, username: string): Promise<void>;
     recordSuccess(strategy: string, username: string): Promise<void>;
-    recordFailure(strategy: string, username: string): Promise<never>;
-    authenticateLocal(strategy: string, username: string, password: string): Promise<import("./auth.types").SecurityManagementUserRecord>;
+    recordFailure(strategy: string, username: string, meta?: {
+        ipAddress?: string;
+        userAgent?: string;
+        clientName?: string;
+    }): Promise<never>;
+    authenticateLocal(strategy: string, username: string, password: string, meta?: {
+        ipAddress?: string;
+        userAgent?: string;
+        clientName?: string;
+    }): Promise<import("./auth.types").SecurityManagementUserRecord>;
     strategyName(): string;
+    private emitSecurityAlert;
 }
 //# sourceMappingURL=login-attempt.service.d.ts.map

package/security/src/lib/auth/login-attempt.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"login-attempt.service.d.ts","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/auth/login-attempt.service.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,2BAA2B,EAAE,MAAM,kCAAkC,CAAC;AAW/E,MAAM,WAAW,yBAAyB;IACxC,QAAQ,EAAE,MAAM,CAAC;IACjB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,eAAe,EAAE,OAAO,CAAC;IACzB,MAAM,EAAE,OAAO,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,qBACa,mBAAmB;IAIlB,OAAO,CAAC,QAAQ,CAAC,WAAW;IAHxC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAwC;IAC/D,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAmC;gBAE/B,WAAW,EAAE,2BAA2B;IAErE,eAAe,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM;IAIrD,eAAe,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IA+BlE,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAUhE,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC;IA4CjE,iBAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM;IAsB5E,YAAY,IAAI,MAAM;CAGvB"}
+{"version":3,"file":"login-attempt.service.d.ts","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/auth/login-attempt.service.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAGtD,OAAO,EAAE,2BAA2B,EAAE,MAAM,kCAAkC,CAAC;AAe/E,MAAM,WAAW,yBAAyB;IACxC,QAAQ,EAAE,MAAM,CAAC;IACjB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,eAAe,EAAE,OAAO,CAAC;IACzB,MAAM,EAAE,OAAO,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,qBACa,mBAAmB;IAK5B,OAAO,CAAC,QAAQ,CAAC,WAAW;IAChB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;IALtC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAwC;IAC/D,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAmC;gBAGzC,WAAW,EAAE,2BAA2B,EAC5B,MAAM,CAAC,EAAE,aAAa,YAAA;IAGrD,eAAe,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM;IAIrD,eAAe,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IA+BlE,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAUhE,aAAa,CACjB,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,EAChB,IAAI,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,GACrE,OAAO,CAAC,KAAK,CAAC;IAyDX,iBAAiB,CACrB,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,EAChB,IAAI,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE;IAuBxE,YAAY,IAAI,MAAM;IAItB,OAAO,CAAC,iBAAiB;CAO1B"}