@acorex-platform/framework-server 0.0.32 → 0.0.37

package/security/src/lib/auth/login-attempt.service.js

@@ -4,12 +4,15 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.LoginAttemptService = void 0;
 const tslib_1 = require("tslib");
 const common_1 = require("@nestjs/common");
+const event_emitter_1 = require("@nestjs/event-emitter");
 const auth_config_1 = require("./auth.config");
 const auth_lockout_policy_1 = require("./auth-lockout-policy");
 const auth_local_credentials_service_1 = require("./auth-local-credentials.service");
+const auth_events_1 = require("./auth.events");
 let LoginAttemptService = LoginAttemptService_1 = class LoginAttemptService {
-    constructor(credentials) {
+    constructor(credentials, events) {
         this.credentials = credentials;
+        this.events = events;
         this.logger = new common_1.Logger(LoginAttemptService_1.name);
         this.attempts = new Map();
     }
@@ -49,7 +52,7 @@ let LoginAttemptService = LoginAttemptService_1 = class LoginAttemptService {
             await this.credentials.restoreUserAccess(user.id);
         }
     }
-    async recordFailure(strategy, username) {
+    async recordFailure(strategy, username, meta) {
         const key = this.buildAttemptKey(strategy, username);
         const previous = this.attempts.get(key);
         const failures = (previous?.failures ?? 0) + 1;
@@ -65,13 +68,25 @@ let LoginAttemptService = LoginAttemptService_1 = class LoginAttemptService {
                 : {}),
         };
         this.attempts.set(key, state);
-        if (locked) {
-            const user = await this.credentials.findUserByUsername(username);
-            if (user) {
-                await this.credentials.blockUserAccess(user.id);
-            }
+        const user = await this.credentials.findUserByUsername(username);
+        if (locked && user) {
+            await this.credentials.blockUserAccess(user.id);
             this.logger.warn(`Account locked after ${failures} failed attempts for ${username}`);
         }
+        if (user?.id) {
+            const alert = {
+                kind: locked ? 'account_locked' : 'login_failed',
+                userId: user.id,
+                at: new Date().toISOString(),
+            };
+            if (meta?.clientName?.trim()) {
+                alert.deviceSummary = meta.clientName.trim();
+            }
+            if (meta?.ipAddress?.trim()) {
+                alert.ipAddress = meta.ipAddress.trim();
+            }
+            this.emitSecurityAlert(alert);
+        }
         throw new common_1.UnauthorizedException({
             statusCode: 401,
             message: locked
@@ -88,7 +103,7 @@ let LoginAttemptService = LoginAttemptService_1 = class LoginAttemptService {
             },
         });
     }
-    async authenticateLocal(strategy, username, password) {
+    async authenticateLocal(strategy, username, password, meta) {
         await this.assertNotLocked(strategy, username);
         try {
             const user = await this.credentials.validate(username, password);
@@ -101,7 +116,7 @@ let LoginAttemptService = LoginAttemptService_1 = class LoginAttemptService {
                 if (typeof response === 'object' &&
                     response !== null &&
                     response['error'] === 'InvalidCredentials') {
-                    await this.recordFailure(strategy, username);
+                    await this.recordFailure(strategy, username, meta);
                 }
             }
             throw error;
@@ -110,11 +125,21 @@ let LoginAttemptService = LoginAttemptService_1 = class LoginAttemptService {
     strategyName() {
         return auth_config_1.AUTH_STRATEGY_USER_PASS;
     }
+    emitSecurityAlert(payload) {
+        try {
+            this.events?.emit(auth_events_1.AUTH_SECURITY_ALERT_EVENT, payload);
+        }
+        catch (error) {
+            this.logger.debug(`Auth security alert emit failed: ${String(error)}`);
+        }
+    }
 };
 exports.LoginAttemptService = LoginAttemptService;
 exports.LoginAttemptService = LoginAttemptService = LoginAttemptService_1 = tslib_1.__decorate([
     (0, common_1.Injectable)(),
-    tslib_1.__metadata("design:paramtypes", [auth_local_credentials_service_1.AuthLocalCredentialsService])
+    tslib_1.__param(1, (0, common_1.Optional)()),
+    tslib_1.__metadata("design:paramtypes", [auth_local_credentials_service_1.AuthLocalCredentialsService,
+        event_emitter_1.EventEmitter2])
 ], LoginAttemptService);
 //#endregion
 //# sourceMappingURL=login-attempt.service.js.map

package/security/src/lib/auth/login-attempt.service.js.map

@@ -1 +1 @@
-{"version":3,"file":"login-attempt.service.js","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/auth/login-attempt.service.ts"],"names":[],"mappings":";;;;;AAAA,2CAKwB;AACxB,+CAAwD;AACxD,+DAAiE;AACjE,qFAA+E;AAoBxE,IAAM,mBAAmB,2BAAzB,MAAM,mBAAmB;IAI9B,YAA6B,WAAwC;QAAxC,gBAAW,GAAX,WAAW,CAA6B;QAHpD,WAAM,GAAG,IAAI,eAAM,CAAC,qBAAmB,CAAC,IAAI,CAAC,CAAC;QAC9C,aAAQ,GAAG,IAAI,GAAG,EAAwB,CAAC;IAEY,CAAC;IAEzE,eAAe,CAAC,QAAgB,EAAE,QAAgB;QAChD,OAAO,GAAG,QAAQ,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;IACxD,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,QAAgB,EAAE,QAAgB;QACtD,MAAM,GAAG,GAAG,IAAI,CAAC,eAAe,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QACrD,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACrC,IAAI,CAAC,KAAK,EAAE,WAAW,EAAE,CAAC;YACxB,OAAO;QACT,CAAC;QAED,IAAI,KAAK,CAAC,WAAW,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YAC7C,MAAM,IAAI,sBAAa,CACrB;gBACE,UAAU,EAAE,GAAG;gBACf,OAAO,EAAE,iDAAiD;gBAC1D,IAAI,EAAE,eAAe;gBACrB,KAAK,EAAE,eAAe;gBACtB,OAAO,EAAE;oBACP,MAAM,EAAE,IAAI;oBACZ,WAAW,EAAE,KAAK,CAAC,WAAW,CAAC,WAAW,EAAE;oBAC5C,eAAe,EAAE,IAAI;iBACtB;aACF,EACD,GAAG,CACJ,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC1B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC;QACjE,IAAI,IAAI,EAAE,WAAW,KAAK,SAAS,EAAE,CAAC;YACpC,MAAM,IAAI,CAAC,WAAW,CAAC,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACpD,CAAC;IACH,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,QAAgB,EAAE,QAAgB;QACpD,MAAM,GAAG,GAAG,IAAI,CAAC,eAAe,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QACrD,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAE1B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC;QACjE,IAAI,IAAI,EAAE,WAAW,KAAK,SAAS,EAAE,CAAC;YACpC,MAAM,IAAI,CAAC,WAAW,CAAC,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACpD,CAAC;IACH,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,QAAgB,EAAE,QAAgB;QACpD,MAAM,GAAG,GAAG,IAAI,CAAC,eAAe,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QACrD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACxC,MAAM,QAAQ,GAAG,CAAC,QAAQ,EAAE,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;QAC/C,MAAM,MAAM,GAAG,MAAM,IAAA,8CAAwB,GAAE,CAAC;QAChD,MAAM,WAAW,GAAG,MAAM,CAAC,gBAAgB,CAAC;QAC5C,MAAM,MAAM,GAAG,QAAQ,IAAI,WAAW,CAAC;QAEvC,MAAM,KAAK,GAAiB;YAC1B,QAAQ;YACR,aAAa,EAAE,IAAI,IAAI,EAAE;YACzB,QAAQ;YACR,GAAG,CAAC,MAAM;gBACR,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,sBAAsB,GAAG,MAAM,CAAC,EAAE;gBAChF,CAAC,CAAC,EAAE,CAAC;SACR,CAAC;QAEF,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAE9B,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC;YACjE,IAAI,IAAI,EAAE,CAAC;gBACT,MAAM,IAAI,CAAC,WAAW,CAAC,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAClD,CAAC;YACD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,wBAAwB,QAAQ,wBAAwB,QAAQ,EAAE,CAAC,CAAC;QACvF,CAAC;QAED,MAAM,IAAI,8BAAqB,CAAC;YAC9B,UAAU,EAAE,GAAG;YACf,OAAO,EAAE,MAAM;gBACb,CAAC,CAAC,sDAAsD,MAAM,CAAC,sBAAsB,WAAW;gBAChG,CAAC,CAAC,8BAA8B;YAClC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,oBAAoB;YACrD,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,oBAAoB;YACtD,OAAO,EAAE;gBACP,QAAQ;gBACR,iBAAiB,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,WAAW,GAAG,QAAQ,CAAC;gBACtD,eAAe,EAAE,QAAQ,IAAI,MAAM,CAAC,uBAAuB;gBAC3D,MAAM;gBACN,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,WAAW,EAAE;aAC9C;SACF,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,QAAgB,EAAE,QAAgB,EAAE,QAAgB;QAC1E,MAAM,IAAI,CAAC,eAAe,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QAE/C,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;YACjE,MAAM,IAAI,CAAC,aAAa,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;YAC7C,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,8BAAqB,EAAE,CAAC;gBAC3C,MAAM,QAAQ,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;gBACrC,IACE,OAAO,QAAQ,KAAK,QAAQ;oBAC5B,QAAQ,KAAK,IAAI;oBAChB,QAAoC,CAAC,OAAO,CAAC,KAAK,oBAAoB,EACvE,CAAC;oBACD,MAAM,IAAI,CAAC,aAAa,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;gBAC/C,CAAC;YACH,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED,YAAY;QACV,OAAO,qCAAuB,CAAC;IACjC,CAAC;CACF,CAAA;AAxHY,kDAAmB;8BAAnB,mBAAmB;IAD/B,IAAA,mBAAU,GAAE;6CAK+B,4DAA2B;GAJ1D,mBAAmB,CAwH/B;AAED,YAAY"}
+{"version":3,"file":"login-attempt.service.js","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/auth/login-attempt.service.ts"],"names":[],"mappings":";;;;;AAAA,2CAMwB;AACxB,yDAAsD;AACtD,+CAAwD;AACxD,+DAAiE;AACjE,qFAA+E;AAC/E,+CAGuB;AAoBhB,IAAM,mBAAmB,2BAAzB,MAAM,mBAAmB;IAI9B,YACmB,WAAwC,EAC7C,MAAuC;QADlC,gBAAW,GAAX,WAAW,CAA6B;QAC5B,WAAM,GAAN,MAAM,CAAgB;QALpC,WAAM,GAAG,IAAI,eAAM,CAAC,qBAAmB,CAAC,IAAI,CAAC,CAAC;QAC9C,aAAQ,GAAG,IAAI,GAAG,EAAwB,CAAC;IAKzD,CAAC;IAEJ,eAAe,CAAC,QAAgB,EAAE,QAAgB;QAChD,OAAO,GAAG,QAAQ,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;IACxD,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,QAAgB,EAAE,QAAgB;QACtD,MAAM,GAAG,GAAG,IAAI,CAAC,eAAe,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QACrD,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACrC,IAAI,CAAC,KAAK,EAAE,WAAW,EAAE,CAAC;YACxB,OAAO;QACT,CAAC;QAED,IAAI,KAAK,CAAC,WAAW,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YAC7C,MAAM,IAAI,sBAAa,CACrB;gBACE,UAAU,EAAE,GAAG;gBACf,OAAO,EAAE,iDAAiD;gBAC1D,IAAI,EAAE,eAAe;gBACrB,KAAK,EAAE,eAAe;gBACtB,OAAO,EAAE;oBACP,MAAM,EAAE,IAAI;oBACZ,WAAW,EAAE,KAAK,CAAC,WAAW,CAAC,WAAW,EAAE;oBAC5C,eAAe,EAAE,IAAI;iBACtB;aACF,EACD,GAAG,CACJ,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC1B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC;QACjE,IAAI,IAAI,EAAE,WAAW,KAAK,SAAS,EAAE,CAAC;YACpC,MAAM,IAAI,CAAC,WAAW,CAAC,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACpD,CAAC;IACH,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,QAAgB,EAAE,QAAgB;QACpD,MAAM,GAAG,GAAG,IAAI,CAAC,eAAe,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QACrD,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAE1B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC;QACjE,IAAI,IAAI,EAAE,WAAW,KAAK,SAAS,EAAE,CAAC;YACpC,MAAM,IAAI,CAAC,WAAW,CAAC,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACpD,CAAC;IACH,CAAC;IAED,KAAK,CAAC,aAAa,CACjB,QAAgB,EAChB,QAAgB,EAChB,IAAsE;QAEtE,MAAM,GAAG,GAAG,IAAI,CAAC,eAAe,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QACrD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACxC,MAAM,QAAQ,GAAG,CAAC,QAAQ,EAAE,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;QAC/C,MAAM,MAAM,GAAG,MAAM,IAAA,8CAAwB,GAAE,CAAC;QAChD,MAAM,WAAW,GAAG,MAAM,CAAC,gBAAgB,CAAC;QAC5C,MAAM,MAAM,GAAG,QAAQ,IAAI,WAAW,CAAC;QAEvC,MAAM,KAAK,GAAiB;YAC1B,QAAQ;YACR,aAAa,EAAE,IAAI,IAAI,EAAE;YACzB,QAAQ;YACR,GAAG,CAAC,MAAM;gBACR,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,sBAAsB,GAAG,MAAM,CAAC,EAAE;gBAChF,CAAC,CAAC,EAAE,CAAC;SACR,CAAC;QAEF,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAE9B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC;QACjE,IAAI,MAAM,IAAI,IAAI,EAAE,CAAC;YACnB,MAAM,IAAI,CAAC,WAAW,CAAC,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAChD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,wBAAwB,QAAQ,wBAAwB,QAAQ,EAAE,CAAC,CAAC;QACvF,CAAC;QAED,IAAI,IAAI,EAAE,EAAE,EAAE,CAAC;YACb,MAAM,KAAK,GAAkC;gBAC3C,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,cAAc;gBAChD,MAAM,EAAE,IAAI,CAAC,EAAE;gBACf,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;aAC7B,CAAC;YACF,IAAI,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,EAAE,CAAC;gBAC7B,KAAK,CAAC,aAAa,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;YAC/C,CAAC;YACD,IAAI,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,CAAC;gBAC5B,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;YAC1C,CAAC;YACD,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC;QAChC,CAAC;QAED,MAAM,IAAI,8BAAqB,CAAC;YAC9B,UAAU,EAAE,GAAG;YACf,OAAO,EAAE,MAAM;gBACb,CAAC,CAAC,sDAAsD,MAAM,CAAC,sBAAsB,WAAW;gBAChG,CAAC,CAAC,8BAA8B;YAClC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,oBAAoB;YACrD,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,oBAAoB;YACtD,OAAO,EAAE;gBACP,QAAQ;gBACR,iBAAiB,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,WAAW,GAAG,QAAQ,CAAC;gBACtD,eAAe,EAAE,QAAQ,IAAI,MAAM,CAAC,uBAAuB;gBAC3D,MAAM;gBACN,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,WAAW,EAAE;aAC9C;SACF,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,iBAAiB,CACrB,QAAgB,EAChB,QAAgB,EAChB,QAAgB,EAChB,IAAsE;QAEtE,MAAM,IAAI,CAAC,eAAe,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QAE/C,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;YACjE,MAAM,IAAI,CAAC,aAAa,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;YAC7C,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,8BAAqB,EAAE,CAAC;gBAC3C,MAAM,QAAQ,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;gBACrC,IACE,OAAO,QAAQ,KAAK,QAAQ;oBAC5B,QAAQ,KAAK,IAAI;oBAChB,QAAoC,CAAC,OAAO,CAAC,KAAK,oBAAoB,EACvE,CAAC;oBACD,MAAM,IAAI,CAAC,aAAa,CAAC,QAAQ,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;gBACrD,CAAC;YACH,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED,YAAY;QACV,OAAO,qCAAuB,CAAC;IACjC,CAAC;IAEO,iBAAiB,CAAC,OAAsC;QAC9D,IAAI,CAAC;YACH,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,uCAAyB,EAAE,OAAO,CAAC,CAAC;QACxD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,oCAAoC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACzE,CAAC;IACH,CAAC;CACF,CAAA;AAzJY,kDAAmB;8BAAnB,mBAAmB;IAD/B,IAAA,mBAAU,GAAE;IAOR,mBAAA,IAAA,iBAAQ,GAAE,CAAA;6CADmB,4DAA2B;QACnB,6BAAa;GAN1C,mBAAmB,CAyJ/B;AAED,YAAY"}

package/security/src/lib/auth/request-meta.util.js

@@ -27,43 +27,96 @@ function resolveClientName(userAgent) {
 }
 function parseUserAgent(userAgent) {
     const ua = userAgent.toLowerCase();
+    const uaRaw = userAgent.trim();
     let browser = 'Unknown Browser';
     if (ua.includes('edg/')) {
         browser = 'Edge';
     }
-    else if (ua.includes('chrome/')) {
+    else if (ua.includes('chrome/') || ua.includes('crios/')) {
         browser = 'Chrome';
     }
-    else if (ua.includes('firefox/')) {
+    else if (ua.includes('firefox/') || ua.includes('fxios/')) {
         browser = 'Firefox';
     }
-    else if (ua.includes('safari/') && !ua.includes('chrome/')) {
+    else if (ua.includes('safari/') && !ua.includes('chrome/') && !ua.includes('crios/')) {
         browser = 'Safari';
     }
+    else if (ua.includes('opr/') || ua.includes('opera/')) {
+        browser = 'Opera';
+    }
     let operatingSystem = 'Unknown OS';
     if (ua.includes('windows')) {
         operatingSystem = 'Windows';
     }
-    else if (ua.includes('mac os')) {
+    else if (ua.includes('mac os') || ua.includes('macintosh')) {
         operatingSystem = 'macOS';
     }
     else if (ua.includes('android')) {
         operatingSystem = 'Android';
     }
-    else if (ua.includes('iphone') || ua.includes('ipad')) {
+    else if (ua.includes('iphone') || ua.includes('ipad') || ua.includes('ipod')) {
         operatingSystem = 'iOS';
     }
+    else if (ua.includes('cros')) {
+        operatingSystem = 'Chrome OS';
+    }
     else if (ua.includes('linux')) {
         operatingSystem = 'Linux';
     }
-    let deviceName = 'Desktop';
-    if (ua.includes('mobile')) {
-        deviceName = 'Mobile';
+    const deviceName = resolveDeviceName(uaRaw, ua);
+    return { browser, operatingSystem, deviceName };
+}
+function resolveDeviceName(uaRaw, ua) {
+    if (ua.includes('iphone')) {
+        return 'iPhone';
+    }
+    if (ua.includes('ipad')) {
+        return 'iPad';
     }
-    else if (ua.includes('tablet') || ua.includes('ipad')) {
-        deviceName = 'Tablet';
+    if (ua.includes('ipod')) {
+        return 'iPod';
     }
-    return { browser, operatingSystem, deviceName };
+    // Android: "... Android 13; SM-G991B Build/..." or "... Pixel 7 Build/..."
+    const androidModel = uaRaw.match(/Android\s+[\d.]+;\s*([^;)]+?)\s+Build\//i)?.[1]?.trim();
+    if (androidModel && !/^wv$/i.test(androidModel) && !/^linux$/i.test(androidModel)) {
+        return friendlyAndroidDeviceName(androidModel);
+    }
+    if (ua.includes('tablet') || ua.includes('ipad')) {
+        return 'Tablet';
+    }
+    if (ua.includes('mobile') || ua.includes('android')) {
+        return 'Mobile';
+    }
+    return 'Desktop';
+}
+/** Maps common Android model tokens to marketing names when known. */
+function friendlyAndroidDeviceName(model) {
+    const normalized = model.trim();
+    const upper = normalized.toUpperCase();
+    if (/^PIXEL\b/i.test(normalized)) {
+        return normalized.replace(/^pixel/i, 'Pixel');
+    }
+    for (const [prefix, name] of SAMSUNG_MODEL_PREFIXES) {
+        if (upper.startsWith(prefix)) {
+            return name;
+        }
+    }
+    return normalized;
 }
+/** Prefix → marketing name (longest prefixes first). */
+const SAMSUNG_MODEL_PREFIXES = [
+    ['SM-S918', 'Galaxy S23 Ultra'],
+    ['SM-S916', 'Galaxy S23+'],
+    ['SM-S911', 'Galaxy S23'],
+    ['SM-S908', 'Galaxy S22 Ultra'],
+    ['SM-S906', 'Galaxy S22+'],
+    ['SM-S901', 'Galaxy S22'],
+    ['SM-G998', 'Galaxy S21 Ultra'],
+    ['SM-G996', 'Galaxy S21+'],
+    ['SM-G991', 'Galaxy S21'],
+    ['SM-G990', 'Galaxy S21 FE'],
+    ['SM-A546', 'Galaxy A54'],
+    ['SM-A536', 'Galaxy A53'],
+];
 //#endregion
 //# sourceMappingURL=request-meta.util.js.map

package/security/src/lib/auth/request-meta.util.js.map

@@ -1 +1 @@
-{"version":3,"file":"request-meta.util.js","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/auth/request-meta.util.ts"],"names":[],"mappings":";;AAUA,wDAoBC;AAOD,wCAuCC;AAlED,SAAgB,sBAAsB,CAAC,GAAwB;IAC7D,IAAI,CAAC,GAAG,EAAE,OAAO,EAAE,CAAC;QAClB,OAAO;YACL,SAAS,EAAE,SAAS;YACpB,SAAS,EAAE,SAAS;YACpB,UAAU,EAAE,+BAA+B;SAC5C,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,YAAY,CAAC,IAAI,SAAS,CAAC,CAAC;IACjE,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;IACjD,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC;QACxC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,EAAE,IAAI,SAAS,CAAC;QAC7C,CAAC,CAAC,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,GAAG,CAAC,EAAE,IAAI,SAAS,CAAC,CAAC;IAEpE,OAAO;QACL,SAAS;QACT,SAAS;QACT,UAAU,EAAE,iBAAiB,CAAC,SAAS,CAAC;KACzC,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,SAAiB;IAC1C,MAAM,MAAM,GAAG,cAAc,CAAC,SAAS,CAAC,CAAC;IACzC,OAAO,GAAG,MAAM,CAAC,OAAO,OAAO,MAAM,CAAC,eAAe,EAAE,CAAC;AAC1D,CAAC;AAED,SAAgB,cAAc,CAAC,SAAiB;IAK9C,MAAM,EAAE,GAAG,SAAS,CAAC,WAAW,EAAE,CAAC;IAEnC,IAAI,OAAO,GAAG,iBAAiB,CAAC;IAChC,IAAI,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACxB,OAAO,GAAG,MAAM,CAAC;IACnB,CAAC;SAAM,IAAI,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QAClC,OAAO,GAAG,QAAQ,CAAC;IACrB,CAAC;SAAM,IAAI,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;QACnC,OAAO,GAAG,SAAS,CAAC;IACtB,CAAC;SAAM,IAAI,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QAC7D,OAAO,GAAG,QAAQ,CAAC;IACrB,CAAC;IAED,IAAI,eAAe,GAAG,YAAY,CAAC;IACnC,IAAI,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QAC3B,eAAe,GAAG,SAAS,CAAC;IAC9B,CAAC;SAAM,IAAI,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QACjC,eAAe,GAAG,OAAO,CAAC;IAC5B,CAAC;SAAM,IAAI,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QAClC,eAAe,GAAG,SAAS,CAAC;IAC9B,CAAC;SAAM,IAAI,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACxD,eAAe,GAAG,KAAK,CAAC;IAC1B,CAAC;SAAM,IAAI,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QAChC,eAAe,GAAG,OAAO,CAAC;IAC5B,CAAC;IAED,IAAI,UAAU,GAAG,SAAS,CAAC;IAC3B,IAAI,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC1B,UAAU,GAAG,QAAQ,CAAC;IACxB,CAAC;SAAM,IAAI,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACxD,UAAU,GAAG,QAAQ,CAAC;IACxB,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,UAAU,EAAE,CAAC;AAClD,CAAC;AAED,YAAY"}
+{"version":3,"file":"request-meta.util.js","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/auth/request-meta.util.ts"],"names":[],"mappings":";;AAUA,wDAoBC;AAOD,wCAuCC;AAlED,SAAgB,sBAAsB,CAAC,GAAwB;IAC7D,IAAI,CAAC,GAAG,EAAE,OAAO,EAAE,CAAC;QAClB,OAAO;YACL,SAAS,EAAE,SAAS;YACpB,SAAS,EAAE,SAAS;YACpB,UAAU,EAAE,+BAA+B;SAC5C,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,YAAY,CAAC,IAAI,SAAS,CAAC,CAAC;IACjE,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;IACjD,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC;QACxC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,EAAE,IAAI,SAAS,CAAC;QAC7C,CAAC,CAAC,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,GAAG,CAAC,EAAE,IAAI,SAAS,CAAC,CAAC;IAEpE,OAAO;QACL,SAAS;QACT,SAAS;QACT,UAAU,EAAE,iBAAiB,CAAC,SAAS,CAAC;KACzC,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,SAAiB;IAC1C,MAAM,MAAM,GAAG,cAAc,CAAC,SAAS,CAAC,CAAC;IACzC,OAAO,GAAG,MAAM,CAAC,OAAO,OAAO,MAAM,CAAC,eAAe,EAAE,CAAC;AAC1D,CAAC;AAED,SAAgB,cAAc,CAAC,SAAiB;IAK9C,MAAM,EAAE,GAAG,SAAS,CAAC,WAAW,EAAE,CAAC;IACnC,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC;IAE/B,IAAI,OAAO,GAAG,iBAAiB,CAAC;IAChC,IAAI,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACxB,OAAO,GAAG,MAAM,CAAC;IACnB,CAAC;SAAM,IAAI,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC3D,OAAO,GAAG,QAAQ,CAAC;IACrB,CAAC;SAAM,IAAI,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC5D,OAAO,GAAG,SAAS,CAAC;IACtB,CAAC;SAAM,IAAI,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QACvF,OAAO,GAAG,QAAQ,CAAC;IACrB,CAAC;SAAM,IAAI,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QACxD,OAAO,GAAG,OAAO,CAAC;IACpB,CAAC;IAED,IAAI,eAAe,GAAG,YAAY,CAAC;IACnC,IAAI,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QAC3B,eAAe,GAAG,SAAS,CAAC;IAC9B,CAAC;SAAM,IAAI,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;QAC7D,eAAe,GAAG,OAAO,CAAC;IAC5B,CAAC;SAAM,IAAI,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QAClC,eAAe,GAAG,SAAS,CAAC;IAC9B,CAAC;SAAM,IAAI,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAC/E,eAAe,GAAG,KAAK,CAAC;IAC1B,CAAC;SAAM,IAAI,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAC/B,eAAe,GAAG,WAAW,CAAC;IAChC,CAAC;SAAM,IAAI,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QAChC,eAAe,GAAG,OAAO,CAAC;IAC5B,CAAC;IAED,MAAM,UAAU,GAAG,iBAAiB,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAEhD,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,UAAU,EAAE,CAAC;AAClD,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAa,EAAE,EAAU;IAClD,IAAI,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC1B,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,IAAI,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACxB,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,IAAI,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACxB,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,2EAA2E;IAC3E,MAAM,YAAY,GAAG,KAAK,CAAC,KAAK,CAAC,0CAA0C,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;IAC1F,IAAI,YAAY,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;QAClF,OAAO,yBAAyB,CAAC,YAAY,CAAC,CAAC;IACjD,CAAC;IAED,IAAI,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACjD,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,IAAI,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QACpD,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,sEAAsE;AACtE,SAAS,yBAAyB,CAAC,KAAa;IAC9C,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAChC,MAAM,KAAK,GAAG,UAAU,CAAC,WAAW,EAAE,CAAC;IAEvC,IAAI,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QACjC,OAAO,UAAU,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IAChD,CAAC;IAED,KAAK,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,sBAAsB,EAAE,CAAC;QACpD,IAAI,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YAC7B,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,wDAAwD;AACxD,MAAM,sBAAsB,GAA6C;IACvE,CAAC,SAAS,EAAE,kBAAkB,CAAC;IAC/B,CAAC,SAAS,EAAE,aAAa,CAAC;IAC1B,CAAC,SAAS,EAAE,YAAY,CAAC;IACzB,CAAC,SAAS,EAAE,kBAAkB,CAAC;IAC/B,CAAC,SAAS,EAAE,aAAa,CAAC;IAC1B,CAAC,SAAS,EAAE,YAAY,CAAC;IACzB,CAAC,SAAS,EAAE,kBAAkB,CAAC;IAC/B,CAAC,SAAS,EAAE,aAAa,CAAC;IAC1B,CAAC,SAAS,EAAE,YAAY,CAAC;IACzB,CAAC,SAAS,EAAE,eAAe,CAAC;IAC5B,CAAC,SAAS,EAAE,YAAY,CAAC;IACzB,CAAC,SAAS,EAAE,YAAY,CAAC;CAC1B,CAAC;AAEF,YAAY"}

package/security/src/lib/auth/token-revocation.constants.d.ts

@@ -0,0 +1,9 @@
+/** Refresh `jti` consumed once (reuse detection). */
+export declare const OAUTH_REFRESH_REPLAY_KEY_PREFIX = "axp:oauth:refresh:jti:";
+/** Explicitly revoked refresh `jti` (logout / revoke). */
+export declare const OAUTH_REFRESH_REVOKED_KEY_PREFIX = "axp:oauth:refresh:revoked:";
+/** Session-level revoke (`sid`) — all tokens for that login. */
+export declare const OAUTH_SESSION_REVOKED_KEY_PREFIX = "axp:oauth:session:revoked:";
+/** Access-token-level revoke (`jti`) — single AT. */
+export declare const OAUTH_ACCESS_REVOKED_KEY_PREFIX = "axp:oauth:access:revoked:";
+//# sourceMappingURL=token-revocation.constants.d.ts.map

package/security/src/lib/auth/token-revocation.constants.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-revocation.constants.d.ts","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/auth/token-revocation.constants.ts"],"names":[],"mappings":"AAEA,qDAAqD;AACrD,eAAO,MAAM,+BAA+B,2BAA2B,CAAC;AAExE,0DAA0D;AAC1D,eAAO,MAAM,gCAAgC,+BAA+B,CAAC;AAE7E,gEAAgE;AAChE,eAAO,MAAM,gCAAgC,+BAA+B,CAAC;AAE7E,qDAAqD;AACrD,eAAO,MAAM,+BAA+B,8BAA8B,CAAC"}

package/security/src/lib/auth/token-revocation.constants.js

@@ -0,0 +1,14 @@
+"use strict";
+//#region ----- Token revocation Redis keys (OD-09) -----
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OAUTH_ACCESS_REVOKED_KEY_PREFIX = exports.OAUTH_SESSION_REVOKED_KEY_PREFIX = exports.OAUTH_REFRESH_REVOKED_KEY_PREFIX = exports.OAUTH_REFRESH_REPLAY_KEY_PREFIX = void 0;
+/** Refresh `jti` consumed once (reuse detection). */
+exports.OAUTH_REFRESH_REPLAY_KEY_PREFIX = 'axp:oauth:refresh:jti:';
+/** Explicitly revoked refresh `jti` (logout / revoke). */
+exports.OAUTH_REFRESH_REVOKED_KEY_PREFIX = 'axp:oauth:refresh:revoked:';
+/** Session-level revoke (`sid`) — all tokens for that login. */
+exports.OAUTH_SESSION_REVOKED_KEY_PREFIX = 'axp:oauth:session:revoked:';
+/** Access-token-level revoke (`jti`) — single AT. */
+exports.OAUTH_ACCESS_REVOKED_KEY_PREFIX = 'axp:oauth:access:revoked:';
+//#endregion
+//# sourceMappingURL=token-revocation.constants.js.map

package/security/src/lib/auth/token-revocation.constants.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-revocation.constants.js","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/auth/token-revocation.constants.ts"],"names":[],"mappings":";AAAA,yDAAyD;;;AAEzD,qDAAqD;AACxC,QAAA,+BAA+B,GAAG,wBAAwB,CAAC;AAExE,0DAA0D;AAC7C,QAAA,gCAAgC,GAAG,4BAA4B,CAAC;AAE7E,gEAAgE;AACnD,QAAA,gCAAgC,GAAG,4BAA4B,CAAC;AAE7E,qDAAqD;AACxC,QAAA,+BAA+B,GAAG,2BAA2B,CAAC;AAE3E,YAAY"}

package/security/src/lib/auth/token.service.d.ts

@@ -5,17 +5,42 @@ export interface IssueTokenContext {
     tenant?: AuthTenantDto;
     application?: AuthApplicationDto;
     sessionId?: string;
+    /** Fixed Platform OP audience (`aud=platform`). Override only for explicit tests. */
+    audience?: string;
+    /** Remember-me — stamped on refresh JWT so cookie maxAge survives rotation. */
+    persist?: boolean;
 }
 export declare class TokenService {
     private readonly logger;
+    private idTokenKeyPair;
+    private getIdTokenKeyPair;
+    /**
+     * Public JWKS for OIDC discovery clients to validate Platform-issued `id_token`.
+     * Served by ConnectController `/.well-known/jwks.json` — never includes private material.
+     */
+    getJwks(): {
+        keys: Array<Record<string, unknown>>;
+    };
+    /**
+     * Private signing JWKS for in-process OpenID Provider engines (`oidc-provider`).
+     * Must not be exposed over HTTP.
+     */
+    getSigningJwks(): {
+        keys: Array<Record<string, unknown>>;
+    };
     issueTokenResponse(user: AuthUserDto, context?: IssueTokenContext): AuthTokenResponseDto;
-    verifyAccessToken(token: string): AccessTokenPayload;
+    verifyAccessToken(token: string, expectedAudience?: string): AccessTokenPayload;
     verifyRefreshToken(token: string): RefreshTokenPayload;
+    decodeIdTokenHint(token: string): {
+        sub?: string;
+        sid?: string;
+    } | null;
     accessTokenMaxAgeMs(): number;
     accessTokenExpiresInSeconds(): number;
     issueIdToken(user: AuthUserDto, audience: string, claims?: {
         email?: string;
         picture?: string;
+        nonce?: string;
     }): string;
     refreshTokenMaxAgeMs(): number;
     jwtSecret(): string;

package/security/src/lib/auth/token.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"token.service.d.ts","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/auth/token.service.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EACV,kBAAkB,EAClB,kBAAkB,EAClB,aAAa,EACb,oBAAoB,EACpB,WAAW,EACX,mBAAmB,EACpB,MAAM,cAAc,CAAC;AAItB,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,MAAM,CAAC,EAAE,aAAa,CAAC;IACvB,WAAW,CAAC,EAAE,kBAAkB,CAAC;IACjC,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,qBACa,YAAY;IACvB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAiC;IAExD,kBAAkB,CAAC,IAAI,EAAE,WAAW,EAAE,OAAO,GAAE,iBAAsB,GAAG,oBAAoB;IAyC5F,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,kBAAkB;IAYpD,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,mBAAmB;IAYtD,mBAAmB,IAAI,MAAM;IAI7B,2BAA2B,IAAI,MAAM;IAIrC,YAAY,CACV,IAAI,EAAE,WAAW,EACjB,QAAQ,EAAE,MAAM,EAChB,MAAM,GAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAO,GAChD,MAAM;IAoBT,oBAAoB,IAAI,MAAM;IAI9B,SAAS,IAAI,MAAM;IASnB,cAAc,IAAI,MAAM;IAIxB,eAAe,IAAI,MAAM;IAIzB,OAAO,CAAC,YAAY;CAUrB"}
+{"version":3,"file":"token.service.d.ts","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/auth/token.service.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EACV,kBAAkB,EAClB,kBAAkB,EAClB,aAAa,EACb,oBAAoB,EACpB,WAAW,EACX,mBAAmB,EACpB,MAAM,cAAc,CAAC;AAItB,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,MAAM,CAAC,EAAE,aAAa,CAAC;IACvB,WAAW,CAAC,EAAE,kBAAkB,CAAC;IACjC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,qFAAqF;IACrF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,+EAA+E;IAC/E,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,qBACa,YAAY;IACvB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAiC;IAExD,OAAO,CAAC,cAAc,CAON;IAEhB,OAAO,CAAC,iBAAiB;IAyCzB;;;OAGG;IACH,OAAO,IAAI;QAAE,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;KAAE;IAcnD;;;OAGG;IACH,cAAc,IAAI;QAAE,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;KAAE;IAkB1D,kBAAkB,CAAC,IAAI,EAAE,WAAW,EAAE,OAAO,GAAE,iBAAsB,GAAG,oBAAoB;IAgD5F,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,gBAAgB,CAAC,EAAE,MAAM,GAAG,kBAAkB;IAqB/E,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,mBAAmB;IAYtD,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG;QAAE,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI;IAQvE,mBAAmB,IAAI,MAAM;IAI7B,2BAA2B,IAAI,MAAM;IAIrC,YAAY,CACV,IAAI,EAAE,WAAW,EACjB,QAAQ,EAAE,MAAM,EAChB,MAAM,GAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAO,GAChE,MAAM;IA8BT,oBAAoB,IAAI,MAAM;IAI9B,SAAS,IAAI,MAAM;IAanB,cAAc,IAAI,MAAM;IAIxB,eAAe,IAAI,MAAM;IAIzB,OAAO,CAAC,YAAY;CAUrB"}

package/security/src/lib/auth/token.service.js

@@ -6,9 +6,82 @@ const tslib_1 = require("tslib");
 const common_1 = require("@nestjs/common");
 const jwt = tslib_1.__importStar(require("jsonwebtoken"));
 const crypto_1 = require("crypto");
+const oauth_issuer_util_1 = require("../oauth/oauth-issuer.util");
+const oauth_claims_util_1 = require("../oauth/oauth-claims.util");
+const auth_config_1 = require("./auth.config");
 let TokenService = TokenService_1 = class TokenService {
     constructor() {
         this.logger = new common_1.Logger(TokenService_1.name);
+        this.idTokenKeyPair = null;
+    }
+    getIdTokenKeyPair() {
+        if (this.idTokenKeyPair) {
+            return this.idTokenKeyPair;
+        }
+        const privateKeyFromEnv = process.env['JWT_PRIVATE_KEY']?.trim();
+        const publicKeyFromEnv = process.env['JWT_PUBLIC_KEY']?.trim();
+        let privateKeyPem;
+        let publicKeyPem;
+        if (privateKeyFromEnv && publicKeyFromEnv) {
+            privateKeyPem = privateKeyFromEnv;
+            publicKeyPem = publicKeyFromEnv;
+        }
+        else {
+            // Local/dev fallback: ephemeral keypair.
+            // Production deployments should set JWT_PRIVATE_KEY/JWT_PUBLIC_KEY.
+            const generated = (0, crypto_1.generateKeyPairSync)('rsa', {
+                modulusLength: 2048,
+                publicKeyEncoding: { type: 'spki', format: 'pem' },
+                privateKeyEncoding: { type: 'pkcs8', format: 'pem' },
+            });
+            privateKeyPem = generated.privateKey;
+            publicKeyPem = generated.publicKey;
+        }
+        const publicKeyObject = (0, crypto_1.createPublicKey)(publicKeyPem);
+        const publicJwk = publicKeyObject.export({ format: 'jwk' });
+        const kid = (0, crypto_1.createHash)('sha256').update(publicKeyPem).digest('base64url');
+        this.idTokenKeyPair = {
+            privateKeyPem,
+            publicKeyPem,
+            publicJwk,
+            kid,
+        };
+        return this.idTokenKeyPair;
+    }
+    /**
+     * Public JWKS for OIDC discovery clients to validate Platform-issued `id_token`.
+     * Served by ConnectController `/.well-known/jwks.json` — never includes private material.
+     */
+    getJwks() {
+        const { publicJwk, kid } = this.getIdTokenKeyPair();
+        return {
+            keys: [
+                {
+                    ...publicJwk,
+                    use: 'sig',
+                    alg: 'RS256',
+                    kid,
+                },
+            ],
+        };
+    }
+    /**
+     * Private signing JWKS for in-process OpenID Provider engines (`oidc-provider`).
+     * Must not be exposed over HTTP.
+     */
+    getSigningJwks() {
+        const { privateKeyPem, kid } = this.getIdTokenKeyPair();
+        const privateJwk = (0, crypto_1.createPrivateKey)(privateKeyPem).export({ format: 'jwk' });
+        return {
+            keys: [
+                {
+                    ...privateJwk,
+                    use: 'sig',
+                    alg: 'RS256',
+                    kid,
+                },
+            ],
+        };
     }
     issueTokenResponse(user, context = {}) {
         const sessionId = context.sessionId ?? (0, crypto_1.randomUUID)();
@@ -17,9 +90,13 @@ let TokenService = TokenService_1 = class TokenService {
             username: user.name,
             type: 'access',
             sid: sessionId,
+            jti: (0, crypto_1.randomUUID)(),
+            typ: 'at+jwt',
+            aud: context.audience?.trim() || auth_config_1.PLATFORM_ACCESS_TOKEN_AUDIENCE,
             ...(context.tenantId ? { tid: context.tenantId } : {}),
             ...(context.applicationId ? { aid: context.applicationId } : {}),
         };
+        const persist = context.persist !== false;
         const refreshPayload = {
             sub: user.id,
             type: 'refresh',
@@ -27,6 +104,7 @@ let TokenService = TokenService_1 = class TokenService {
             sid: sessionId,
             ...(context.tenantId ? { tid: context.tenantId } : {}),
             ...(context.applicationId ? { aid: context.applicationId } : {}),
+            ...(persist ? { persist: true } : { persist: false }),
         };
         const accessToken = jwt.sign(accessPayload, this.jwtSecret(), {
             expiresIn: this.accessTokenTtl(),
@@ -39,18 +117,26 @@ let TokenService = TokenService_1 = class TokenService {
             refreshToken,
             expiresIn: this.accessTokenTtl(),
             sessionId,
+            persist,
             user,
             tenant: context.tenant ?? (context.tenantId ? { id: context.tenantId } : null),
             application: context.application ??
                 (context.applicationId ? { id: context.applicationId } : null),
         };
     }
-    verifyAccessToken(token) {
+    verifyAccessToken(token, expectedAudience) {
         try {
             const payload = jwt.verify(token, this.jwtSecret());
             if (payload.type !== 'access' || !payload.sub) {
                 throw new Error('Invalid access token');
             }
+            if (expectedAudience?.trim()) {
+                const aud = payload.aud;
+                const audiences = Array.isArray(aud) ? aud : aud ? [aud] : [];
+                if (!audiences.includes(expectedAudience.trim())) {
+                    throw new Error('Invalid access token audience');
+                }
+            }
             return payload;
         }
         catch {
@@ -69,6 +155,13 @@ let TokenService = TokenService_1 = class TokenService {
             throw new Error('Invalid or expired refresh token');
         }
     }
+    decodeIdTokenHint(token) {
+        const decoded = jwt.decode(token);
+        if (!decoded || typeof decoded !== 'object') {
+            return null;
+        }
+        return decoded;
+    }
     accessTokenMaxAgeMs() {
         return this.parseTtlToMs(this.accessTokenTtl());
     }
@@ -76,14 +169,18 @@ let TokenService = TokenService_1 = class TokenService {
         return Math.floor(this.accessTokenMaxAgeMs() / 1000);
     }
     issueIdToken(user, audience, claims = {}) {
-        const issuer = process.env['AUTH_OAUTH_ISSUER']?.trim()?.replace(/\/$/, '') ||
-            `http://localhost:${process.env['PORT']?.trim() || '5500'}/api`;
+        (0, oauth_claims_util_1.assertAllowedClaimInputs)(claims, new Set(['email', 'picture', 'nonce']), 'id_token');
+        const issuer = (0, oauth_issuer_util_1.resolveOAuthIssuer)();
+        const { privateKeyPem, kid } = this.getIdTokenKeyPair();
         return jwt.sign({
             sub: user.id,
             name: user.title,
             email: claims.email,
             picture: claims.picture,
-        }, this.jwtSecret(), {
+            ...(claims.nonce?.trim() ? { nonce: claims.nonce.trim() } : {}),
+        }, privateKeyPem, {
+            algorithm: 'RS256',
+            keyid: kid,
             expiresIn: this.accessTokenTtl(),
             issuer,
             audience,
@@ -95,6 +192,10 @@ let TokenService = TokenService_1 = class TokenService {
     jwtSecret() {
         const secret = process.env['JWT_SECRET']?.trim();
         if (!secret) {
+            const env = process.env['NODE_ENV']?.trim()?.toLowerCase() ?? '';
+            if (env === 'production') {
+                throw new Error('JWT_SECRET is not set (fail-closed in production).');
+            }
             this.logger.warn('JWT_SECRET is not set; using insecure development default');
             return 'acorex-dev-jwt-secret-change-me';
         }

package/security/src/lib/auth/token.service.js.map

@@ -1 +1 @@
-{"version":3,"file":"token.service.js","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/auth/token.service.ts"],"names":[],"mappings":";;;;;AAAA,2CAAoD;AACpD,0DAAoC;AACpC,mCAAoC;AAqB7B,IAAM,YAAY,oBAAlB,MAAM,YAAY;IAAlB;QACY,WAAM,GAAG,IAAI,eAAM,CAAC,cAAY,CAAC,IAAI,CAAC,CAAC;IAkI1D,CAAC;IAhIC,kBAAkB,CAAC,IAAiB,EAAE,UAA6B,EAAE;QACnE,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,IAAA,mBAAU,GAAE,CAAC;QACpD,MAAM,aAAa,GAAuB;YACxC,GAAG,EAAE,IAAI,CAAC,EAAE;YACZ,QAAQ,EAAE,IAAI,CAAC,IAAI;YACnB,IAAI,EAAE,QAAQ;YACd,GAAG,EAAE,SAAS;YACd,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACtD,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACjE,CAAC;QAEF,MAAM,cAAc,GAAwB;YAC1C,GAAG,EAAE,IAAI,CAAC,EAAE;YACZ,IAAI,EAAE,SAAS;YACf,GAAG,EAAE,IAAA,mBAAU,GAAE;YACjB,GAAG,EAAE,SAAS;YACd,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACtD,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACjE,CAAC;QAEF,MAAM,WAAW,GAAG,GAAG,CAAC,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,SAAS,EAAE,EAAE;YAC5D,SAAS,EAAE,IAAI,CAAC,cAAc,EAAkC;SACjE,CAAC,CAAC;QAEH,MAAM,YAAY,GAAG,GAAG,CAAC,IAAI,CAAC,cAAc,EAAE,IAAI,CAAC,SAAS,EAAE,EAAE;YAC9D,SAAS,EAAE,IAAI,CAAC,eAAe,EAAkC;SAClE,CAAC,CAAC;QAEH,OAAO;YACL,WAAW;YACX,YAAY;YACZ,SAAS,EAAE,IAAI,CAAC,cAAc,EAAE;YAChC,SAAS;YACT,IAAI;YACJ,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;YAC9E,WAAW,EACT,OAAO,CAAC,WAAW;gBACnB,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;SACjE,CAAC;IACJ,CAAC;IAED,iBAAiB,CAAC,KAAa;QAC7B,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,EAAE,CAAuB,CAAC;YAC1E,IAAI,OAAO,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;gBAC9C,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;YAC1C,CAAC;YACD,OAAO,OAAO,CAAC;QACjB,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;QACrD,CAAC;IACH,CAAC;IAED,kBAAkB,CAAC,KAAa;QAC9B,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,EAAE,CAAwB,CAAC;YAC3E,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;gBAC/D,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;YAC3C,CAAC;YACD,OAAO,OAAO,CAAC;QACjB,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;QACtD,CAAC;IACH,CAAC;IAED,mBAAmB;QACjB,OAAO,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC,CAAC;IAClD,CAAC;IAED,2BAA2B;QACzB,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,mBAAmB,EAAE,GAAG,IAAI,CAAC,CAAC;IACvD,CAAC;IAED,YAAY,CACV,IAAiB,EACjB,QAAgB,EAChB,SAA+C,EAAE;QAEjD,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,EAAE,IAAI,EAAE,EAAE,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;YACzE,oBAAoB,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,MAAM,MAAM,CAAC;QAElE,OAAO,GAAG,CAAC,IAAI,CACb;YACE,GAAG,EAAE,IAAI,CAAC,EAAE;YACZ,IAAI,EAAE,IAAI,CAAC,KAAK;YAChB,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,OAAO,EAAE,MAAM,CAAC,OAAO;SACxB,EACD,IAAI,CAAC,SAAS,EAAE,EAChB;YACE,SAAS,EAAE,IAAI,CAAC,cAAc,EAAkC;YAChE,MAAM;YACN,QAAQ;SACT,CACF,CAAC;IACJ,CAAC;IAED,oBAAoB;QAClB,OAAO,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC,CAAC;IACnD,CAAC;IAED,SAAS;QACP,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,CAAC;QACjD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,2DAA2D,CAAC,CAAC;YAC9E,OAAO,iCAAiC,CAAC;QAC3C,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,cAAc;QACZ,OAAO,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,EAAE,IAAI,EAAE,IAAI,KAAK,CAAC;IAC/D,CAAC;IAED,eAAe;QACb,OAAO,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC;IAC/D,CAAC;IAEO,YAAY,CAAC,GAAW;QAC9B,MAAM,KAAK,GAAG,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;QAClD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;QAC5B,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAC/B,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;QACpC,MAAM,WAAW,GAA2B,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC;QAChG,OAAO,KAAK,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC,CAAC;IAClD,CAAC;CACF,CAAA;AAnIY,oCAAY;uBAAZ,YAAY;IADxB,IAAA,mBAAU,GAAE;GACA,YAAY,CAmIxB;AAED,YAAY"}
+{"version":3,"file":"token.service.js","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/auth/token.service.ts"],"names":[],"mappings":";;;;;AAAA,2CAAoD;AACpD,0DAAoC;AACpC,mCAMgB;AAChB,kEAAgE;AAChE,kEAAsE;AACtE,+CAA+D;AAyBxD,IAAM,YAAY,oBAAlB,MAAM,YAAY;IAAlB;QACY,WAAM,GAAG,IAAI,eAAM,CAAC,cAAY,CAAC,IAAI,CAAC,CAAC;QAEhD,mBAAc,GAOX,IAAI,CAAC;IAyPlB,CAAC;IAvPS,iBAAiB;QACvB,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;YACxB,OAAO,IAAI,CAAC,cAAc,CAAC;QAC7B,CAAC;QAED,MAAM,iBAAiB,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,EAAE,IAAI,EAAE,CAAC;QACjE,MAAM,gBAAgB,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,EAAE,IAAI,EAAE,CAAC;QAE/D,IAAI,aAAqB,CAAC;QAC1B,IAAI,YAAoB,CAAC;QAEzB,IAAI,iBAAiB,IAAI,gBAAgB,EAAE,CAAC;YAC1C,aAAa,GAAG,iBAAiB,CAAC;YAClC,YAAY,GAAG,gBAAgB,CAAC;QAClC,CAAC;aAAM,CAAC;YACN,yCAAyC;YACzC,oEAAoE;YACpE,MAAM,SAAS,GAAG,IAAA,4BAAmB,EAAC,KAAK,EAAE;gBAC3C,aAAa,EAAE,IAAI;gBACnB,iBAAiB,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE;gBAClD,kBAAkB,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE;aACrD,CAAC,CAAC;YACH,aAAa,GAAG,SAAS,CAAC,UAAU,CAAC;YACrC,YAAY,GAAG,SAAS,CAAC,SAAS,CAAC;QACrC,CAAC;QAED,MAAM,eAAe,GAAG,IAAA,wBAAe,EAAC,YAAY,CAAC,CAAC;QACtD,MAAM,SAAS,GAAG,eAAe,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAA4B,CAAC;QAEvF,MAAM,GAAG,GAAG,IAAA,mBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QAE1E,IAAI,CAAC,cAAc,GAAG;YACpB,aAAa;YACb,YAAY;YACZ,SAAS;YACT,GAAG;SACJ,CAAC;QAEF,OAAO,IAAI,CAAC,cAAc,CAAC;IAC7B,CAAC;IAED;;;OAGG;IACH,OAAO;QACL,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACpD,OAAO;YACL,IAAI,EAAE;gBACJ;oBACE,GAAG,SAAS;oBACZ,GAAG,EAAE,KAAK;oBACV,GAAG,EAAE,OAAO;oBACZ,GAAG;iBACJ;aACF;SACF,CAAC;IACJ,CAAC;IAED;;;OAGG;IACH,cAAc;QACZ,MAAM,EAAE,aAAa,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACxD,MAAM,UAAU,GAAG,IAAA,yBAAgB,EAAC,aAAa,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAG1E,CAAC;QACF,OAAO;YACL,IAAI,EAAE;gBACJ;oBACE,GAAG,UAAU;oBACb,GAAG,EAAE,KAAK;oBACV,GAAG,EAAE,OAAO;oBACZ,GAAG;iBACJ;aACF;SACF,CAAC;IACJ,CAAC;IAED,kBAAkB,CAAC,IAAiB,EAAE,UAA6B,EAAE;QACnE,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,IAAA,mBAAU,GAAE,CAAC;QACpD,MAAM,aAAa,GAAuB;YACxC,GAAG,EAAE,IAAI,CAAC,EAAE;YACZ,QAAQ,EAAE,IAAI,CAAC,IAAI;YACnB,IAAI,EAAE,QAAQ;YACd,GAAG,EAAE,SAAS;YACd,GAAG,EAAE,IAAA,mBAAU,GAAE;YACjB,GAAG,EAAE,QAAQ;YACb,GAAG,EAAE,OAAO,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,4CAA8B;YAC/D,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACtD,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACjE,CAAC;QAEF,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,KAAK,KAAK,CAAC;QAE1C,MAAM,cAAc,GAAwB;YAC1C,GAAG,EAAE,IAAI,CAAC,EAAE;YACZ,IAAI,EAAE,SAAS;YACf,GAAG,EAAE,IAAA,mBAAU,GAAE;YACjB,GAAG,EAAE,SAAS;YACd,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACtD,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAChE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;SACtD,CAAC;QAEF,MAAM,WAAW,GAAG,GAAG,CAAC,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,SAAS,EAAE,EAAE;YAC5D,SAAS,EAAE,IAAI,CAAC,cAAc,EAAkC;SACjE,CAAC,CAAC;QAEH,MAAM,YAAY,GAAG,GAAG,CAAC,IAAI,CAAC,cAAc,EAAE,IAAI,CAAC,SAAS,EAAE,EAAE;YAC9D,SAAS,EAAE,IAAI,CAAC,eAAe,EAAkC;SAClE,CAAC,CAAC;QAEH,OAAO;YACL,WAAW;YACX,YAAY;YACZ,SAAS,EAAE,IAAI,CAAC,cAAc,EAAE;YAChC,SAAS;YACT,OAAO;YACP,IAAI;YACJ,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;YAC9E,WAAW,EACT,OAAO,CAAC,WAAW;gBACnB,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;SACjE,CAAC;IACJ,CAAC;IAED,iBAAiB,CAAC,KAAa,EAAE,gBAAyB;QACxD,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,EAAE,CAAuB,CAAC;YAC1E,IAAI,OAAO,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;gBAC9C,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;YAC1C,CAAC;YAED,IAAI,gBAAgB,EAAE,IAAI,EAAE,EAAE,CAAC;gBAC7B,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;gBACxB,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC9D,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,gBAAgB,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;oBACjD,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;gBACnD,CAAC;YACH,CAAC;YAED,OAAO,OAAO,CAAC;QACjB,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;QACrD,CAAC;IACH,CAAC;IAED,kBAAkB,CAAC,KAAa;QAC9B,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,EAAE,CAAwB,CAAC;YAC3E,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;gBAC/D,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;YAC3C,CAAC;YACD,OAAO,OAAO,CAAC;QACjB,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;QACtD,CAAC;IACH,CAAC;IAED,iBAAiB,CAAC,KAAa;QAC7B,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,CAA0C,CAAC;QAC3E,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;YAC5C,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,mBAAmB;QACjB,OAAO,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC,CAAC;IAClD,CAAC;IAED,2BAA2B;QACzB,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,mBAAmB,EAAE,GAAG,IAAI,CAAC,CAAC;IACvD,CAAC;IAED,YAAY,CACV,IAAiB,EACjB,QAAgB,EAChB,SAA+D,EAAE;QAEjE,IAAA,4CAAwB,EACtB,MAAiC,EACjC,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC,EACtC,UAAU,CACX,CAAC;QAEF,MAAM,MAAM,GAAG,IAAA,sCAAkB,GAAE,CAAC;QAEpC,MAAM,EAAE,aAAa,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAExD,OAAO,GAAG,CAAC,IAAI,CACb;YACE,GAAG,EAAE,IAAI,CAAC,EAAE;YACZ,IAAI,EAAE,IAAI,CAAC,KAAK;YAChB,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAChE,EACD,aAAa,EACb;YACE,SAAS,EAAE,OAAO;YAClB,KAAK,EAAE,GAAG;YACV,SAAS,EAAE,IAAI,CAAC,cAAc,EAAkC;YAChE,MAAM;YACN,QAAQ;SACT,CACF,CAAC;IACJ,CAAC;IAED,oBAAoB;QAClB,OAAO,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC,CAAC;IACnD,CAAC;IAED,SAAS;QACP,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,CAAC;QACjD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,IAAI,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;YACjE,IAAI,GAAG,KAAK,YAAY,EAAE,CAAC;gBACzB,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;YACxE,CAAC;YACD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,2DAA2D,CAAC,CAAC;YAC9E,OAAO,iCAAiC,CAAC;QAC3C,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,cAAc;QACZ,OAAO,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,EAAE,IAAI,EAAE,IAAI,KAAK,CAAC;IAC/D,CAAC;IAED,eAAe;QACb,OAAO,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC;IAC/D,CAAC;IAEO,YAAY,CAAC,GAAW;QAC9B,MAAM,KAAK,GAAG,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;QAClD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;QAC5B,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAC/B,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;QACpC,MAAM,WAAW,GAA2B,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC;QAChG,OAAO,KAAK,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC,CAAC;IAClD,CAAC;CACF,CAAA;AAnQY,oCAAY;uBAAZ,YAAY;IADxB,IAAA,mBAAU,GAAE;GACA,YAAY,CAmQxB;AAED,YAAY"}