@acorex-platform/module-security-management-server 0.0.15 → 2.0.0-next.42

package/server/src/lib/two-factor/user-two-factor.service.js

@@ -0,0 +1,573 @@
+"use strict";
+var UserTwoFactorService_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.UserTwoFactorService = void 0;
+const tslib_1 = require("tslib");
+const crypto_1 = require("crypto");
+const common_1 = require("@nestjs/common");
+const event_emitter_1 = require("@nestjs/event-emitter");
+const lodash_1 = require("lodash");
+const core_1 = require("@acorex-platform/framework-server/core");
+const security_1 = require("@acorex-platform/framework-server/security");
+const core_2 = require("@acorex-platform/framework-shared/core");
+const module_auth_contracts_1 = require("@acorex-platform/module-auth-client/contracts");
+const module_security_management_contracts_1 = require("@acorex-platform/module-security-management-client/contracts");
+const module_settings_management_server_1 = require("@acorex-platform/module-settings-management-server");
+const recovery_codes_util_1 = require("./recovery-codes.util");
+const totp_util_1 = require("./totp.util");
+const two_factor_encryption_util_1 = require("./two-factor-encryption.util");
+const two_factor_redis_store_1 = require("./two-factor-redis.store");
+//#endregion
+//#region ----- Constants -----
+const USER_ENTITY = 'SecurityManagement.User';
+const USER_TWO_FACTOR_ENTITY = 'SecurityManagement.UserTwoFactor';
+const ENABLED_SETTING_KEY = module_auth_contracts_1.AXPAuthSettings.UserTwoFactorEnabled;
+//#endregion
+//#region ----- User two-factor service -----
+let UserTwoFactorService = UserTwoFactorService_1 = class UserTwoFactorService {
+    constructor(entityStorage, settingsStore, redisStore, deviceSessions, auth, events) {
+        this.entityStorage = entityStorage;
+        this.settingsStore = settingsStore;
+        this.redisStore = redisStore;
+        this.deviceSessions = deviceSessions;
+        this.auth = auth;
+        this.events = events;
+        this.logger = new common_1.Logger(UserTwoFactorService_1.name);
+    }
+    //#region ----- Status -----
+    getStatus(userId) {
+        return tslib_1.__awaiter(this, void 0, void 0, function* () {
+            var _a, _b;
+            const uid = (userId === null || userId === void 0 ? void 0 : userId.trim()) || this.readSessionUserId();
+            if (!uid) {
+                return { success: false, code: module_security_management_contracts_1.AXM_TWO_FACTOR_ERROR_CODES.NotSignedIn };
+            }
+            const { enabled, row } = yield this.resolveEffectiveTwoFactorState(uid);
+            const recoveryCodes = (_a = row === null || row === void 0 ? void 0 : row.recoveryCodes) !== null && _a !== void 0 ? _a : [];
+            const unusedRecoveryCodeCount = recoveryCodes.filter((c) => !c.usedAt).length;
+            return {
+                success: true,
+                data: {
+                    enabled,
+                    enrolled: !!row,
+                    verifiedAt: (_b = row === null || row === void 0 ? void 0 : row.verifiedAt) !== null && _b !== void 0 ? _b : null,
+                    hasRecoveryCodes: recoveryCodes.length > 0,
+                    unusedRecoveryCodeCount,
+                },
+            };
+        });
+    }
+    //#endregion
+    //#region ----- Enrollment -----
+    startEnrollment(input) {
+        return tslib_1.__awaiter(this, void 0, void 0, function* () {
+            var _a, _b;
+            const userId = this.readSessionUserId();
+            if (!userId) {
+                return { success: false, code: module_security_management_contracts_1.AXM_TWO_FACTOR_ERROR_CODES.NotSignedIn };
+            }
+            const password = String((_a = input.password) !== null && _a !== void 0 ? _a : '');
+            if (!password) {
+                return { success: false, code: module_security_management_contracts_1.AXM_TWO_FACTOR_ERROR_CODES.InvalidInput };
+            }
+            const user = yield this.getUser(userId);
+            if (!user) {
+                return { success: false, code: module_security_management_contracts_1.AXM_TWO_FACTOR_ERROR_CODES.NotSignedIn };
+            }
+            if (!(yield this.verifyUserPassword(user, password))) {
+                return { success: false, code: module_security_management_contracts_1.AXM_TWO_FACTOR_ERROR_CODES.IncorrectPassword };
+            }
+            if (yield this.findByUserId(userId)) {
+                return { success: false, code: module_security_management_contracts_1.AXM_TWO_FACTOR_ERROR_CODES.AlreadyEnabled };
+            }
+            const secretBytes = (0, totp_util_1.generateTotpSecretBytes)();
+            const secretBase32 = (0, totp_util_1.base32Encode)(secretBytes);
+            const encrypted = (0, two_factor_encryption_util_1.encryptTwoFactorSecret)(secretBytes);
+            const enrollmentId = (0, crypto_1.randomUUID)();
+            const now = Date.now();
+            const expiresAt = new Date(now + two_factor_redis_store_1.TWO_FACTOR_TTL_MS).toISOString();
+            yield this.redisStore.saveEnrollment(enrollmentId, {
+                userId,
+                secret: encrypted,
+                createdAt: new Date(now).toISOString(),
+                expiresAt,
+            });
+            const accountName = String(user.username || user.email || userId).trim() || userId;
+            const issuer = ((_b = process.env['AUTH_2FA_ISSUER']) === null || _b === void 0 ? void 0 : _b.trim()) || 'ACoreX';
+            const otpauthUri = (0, totp_util_1.buildOtpAuthUri)({
+                secretBase32,
+                accountName,
+                issuer,
+            });
+            return {
+                success: true,
+                data: { enrollmentId, otpauthUri, secretBase32, expiresAt },
+            };
+        });
+    }
+    confirmEnrollment(input) {
+        return tslib_1.__awaiter(this, void 0, void 0, function* () {
+            var _a, _b;
+            const userId = this.readSessionUserId();
+            if (!userId) {
+                return { success: false, code: module_security_management_contracts_1.AXM_TWO_FACTOR_ERROR_CODES.NotSignedIn };
+            }
+            const enrollmentId = String((_a = input.enrollmentId) !== null && _a !== void 0 ? _a : '').trim();
+            const code = String((_b = input.code) !== null && _b !== void 0 ? _b : '').trim();
+            if (!enrollmentId || !code) {
+                return { success: false, code: module_security_management_contracts_1.AXM_TWO_FACTOR_ERROR_CODES.InvalidInput };
+            }
+            const enrollment = yield this.redisStore.getEnrollment(enrollmentId);
+            if (!enrollment || enrollment.userId !== userId) {
+                return { success: false, code: module_security_management_contracts_1.AXM_TWO_FACTOR_ERROR_CODES.EnrollmentExpired };
+            }
+            if (yield this.findByUserId(userId)) {
+                yield this.redisStore.deleteEnrollment(enrollmentId);
+                return { success: false, code: module_security_management_contracts_1.AXM_TWO_FACTOR_ERROR_CODES.AlreadyEnabled };
+            }
+            let secretBytes;
+            try {
+                secretBytes = (0, two_factor_encryption_util_1.decryptTwoFactorSecret)(enrollment.secret);
+            }
+            catch (error) {
+                this.logger.warn(`2FA enrollment decrypt failed for user ${userId}: ${String(error)}`);
+                return { success: false, code: module_security_management_contracts_1.AXM_TWO_FACTOR_ERROR_CODES.EnrollmentExpired };
+            }
+            const verified = (0, totp_util_1.verifyTotp)(secretBytes, code);
+            if (!verified.valid || verified.step == null) {
+                return { success: false, code: module_security_management_contracts_1.AXM_TWO_FACTOR_ERROR_CODES.IncorrectCode };
+            }
+            const consumed = yield this.redisStore.consumeEnrollment(enrollmentId);
+            if (!consumed) {
+                return { success: false, code: module_security_management_contracts_1.AXM_TWO_FACTOR_ERROR_CODES.EnrollmentExpired };
+            }
+            const verifiedAt = new Date().toISOString();
+            const id = (0, crypto_1.randomUUID)();
+            const envelope = (0, two_factor_encryption_util_1.encryptTwoFactorSecret)(secretBytes);
+            try {
+                yield this.entityStorage.insertOneAsEngine(USER_TWO_FACTOR_ENTITY, {
+                    id,
+                    userId,
+                    method: 'authenticator',
+                    encryptedSecret: envelope.encryptedSecret,
+                    iv: envelope.iv,
+                    authTag: envelope.authTag,
+                    keyVersion: envelope.keyVersion,
+                    verifiedAt,
+                    lastAcceptedStep: verified.step,
+                    recoveryCodes: [],
+                    scopeInfo: {},
+                });
+                yield this.writeEnabledSetting(userId, true);
+            }
+            catch (error) {
+                this.logger.error(`2FA confirm enrollment failed for user ${userId}: ${String(error)}`);
+                try {
+                    const row = yield this.findByUserId(userId);
+                    if (row === null || row === void 0 ? void 0 : row.id) {
+                        yield this.entityStorage.deleteOneAsEngine(USER_TWO_FACTOR_ENTITY, row.id);
+                    }
+                    yield this.writeEnabledSetting(userId, false);
+                }
+                catch (rollbackError) {
+                    this.logger.error(`2FA confirm rollback failed for user ${userId}: ${String(rollbackError)}`);
+                }
+                return { success: false, code: module_security_management_contracts_1.AXM_TWO_FACTOR_ERROR_CODES.InvalidInput };
+            }
+            this.emitSecurityAlert({
+                kind: 'two_factor_enabled',
+                userId,
+                at: verifiedAt,
+            });
+            this.logger.log(`2FA enabled for user ${userId}`);
+            return { success: true, data: { enabled: true, verifiedAt } };
+        });
+    }
+    //#endregion
+    //#region ----- Disable / generate recovery / admin reset -----
+    disable(input) {
+        return tslib_1.__awaiter(this, void 0, void 0, function* () {
+            const userId = this.readSessionUserId();
+            if (!userId) {
+                return { success: false, code: module_security_management_contracts_1.AXM_TWO_FACTOR_ERROR_CODES.NotSignedIn };
+            }
+            const proof = yield this.verifySensitiveProof(userId, input.password, input.totpCode);
+            if (!proof.ok) {
+                return { success: false, code: proof.code };
+            }
+            const { enabled, row } = yield this.resolveEffectiveTwoFactorState(userId);
+            if (!enabled && !row) {
+                return { success: false, code: module_security_management_contracts_1.AXM_TWO_FACTOR_ERROR_CODES.NotEnabled };
+            }
+            yield this.wipeEnrollment(userId, row);
+            yield this.redisStore.invalidateChallengesForUser(userId);
+            this.emitSecurityAlert({
+                kind: 'two_factor_disabled',
+                userId,
+                at: new Date().toISOString(),
+            });
+            this.logger.log(`2FA disabled for user ${userId}`);
+            return { success: true, data: { enabled: false } };
+        });
+    }
+    generateRecoveryCodes(input) {
+        return tslib_1.__awaiter(this, void 0, void 0, function* () {
+            var _a;
+            const userId = this.readSessionUserId();
+            if (!userId) {
+                return { success: false, code: module_security_management_contracts_1.AXM_TWO_FACTOR_ERROR_CODES.NotSignedIn };
+            }
+            const proof = yield this.verifySensitiveProof(userId, input.password, input.totpCode);
+            if (!proof.ok) {
+                return { success: false, code: proof.code };
+            }
+            const { enabled, row } = yield this.resolveEffectiveTwoFactorState(userId);
+            if (!enabled || !(row === null || row === void 0 ? void 0 : row.id)) {
+                return { success: false, code: module_security_management_contracts_1.AXM_TWO_FACTOR_ERROR_CODES.NotEnabled };
+            }
+            const previousCodes = (_a = row.recoveryCodes) !== null && _a !== void 0 ? _a : [];
+            const hadExistingCodes = previousCodes.length > 0;
+            const generated = yield (0, recovery_codes_util_1.generateRecoveryCodeSet)();
+            yield this.entityStorage.updateOneAsEngine(USER_TWO_FACTOR_ENTITY, row.id, {
+                recoveryCodes: generated.stored,
+            });
+            // First-time issue after enroll is not a "regenerate" — skip the security alert toast.
+            if (hadExistingCodes) {
+                this.emitSecurityAlert({
+                    kind: 'two_factor_recovery_codes_regenerated',
+                    userId,
+                    at: new Date().toISOString(),
+                });
+                this.logger.log(`2FA recovery codes regenerated for user ${userId}`);
+            }
+            else {
+                this.logger.log(`2FA recovery codes issued for user ${userId}`);
+            }
+            return { success: true, data: { codes: generated.plaintext } };
+        });
+    }
+    adminReset(input) {
+        return tslib_1.__awaiter(this, void 0, void 0, function* () {
+            var _a;
+            const targetUserId = String((_a = input.userId) !== null && _a !== void 0 ? _a : '').trim();
+            if (!targetUserId) {
+                return { success: false, code: module_security_management_contracts_1.AXM_TWO_FACTOR_ERROR_CODES.InvalidInput };
+            }
+            const user = yield this.getUser(targetUserId);
+            if (!user) {
+                return { success: false, code: module_security_management_contracts_1.AXM_TWO_FACTOR_ERROR_CODES.UserNotFound };
+            }
+            const { enabled, row } = yield this.resolveEffectiveTwoFactorState(targetUserId);
+            if (!enabled || !row) {
+                return { success: false, code: module_security_management_contracts_1.AXM_TWO_FACTOR_ERROR_CODES.NotEnabled };
+            }
+            if (input.dryRun) {
+                return { success: true, data: { reset: false } };
+            }
+            yield this.wipeEnrollment(targetUserId, row);
+            yield this.redisStore.invalidateChallengesForUser(targetUserId);
+            yield this.revokeAllUserSessions(targetUserId);
+            const actorId = this.readSessionUserId();
+            this.emitSecurityAlert({
+                kind: 'two_factor_admin_reset',
+                userId: targetUserId,
+                at: new Date().toISOString(),
+            });
+            this.logger.log(`2FA admin reset for user ${targetUserId}${actorId ? ` by ${actorId}` : ''}`);
+            return { success: true, data: { reset: true } };
+        });
+    }
+    //#endregion
+    //#region ----- Login challenge -----
+    /**
+     * After password OK: if user setting Enabled=true, create Redis challenge (fail-closed without row).
+     * Returns null when 2FA is not required.
+     */
+    createLoginChallengeAfterPassword(user, options) {
+        return tslib_1.__awaiter(this, void 0, void 0, function* () {
+            var _a;
+            const userId = String((_a = user.id) !== null && _a !== void 0 ? _a : '').trim();
+            if (!userId) {
+                return null;
+            }
+            const { enabled, row } = yield this.resolveEffectiveTwoFactorState(userId);
+            if (!enabled) {
+                return null;
+            }
+            if (!row) {
+                this.logger.error(`Invalid 2FA configuration: Enabled=true without UserTwoFactor row for user ${userId}`);
+                throw Object.assign(new Error(module_security_management_contracts_1.AXM_TWO_FACTOR_ERROR_CODES.InvalidConfiguration), {
+                    code: module_security_management_contracts_1.AXM_TWO_FACTOR_ERROR_CODES.InvalidConfiguration,
+                });
+            }
+            const challengeId = (0, crypto_1.randomUUID)();
+            const now = Date.now();
+            yield this.redisStore.saveLoginChallenge(challengeId, {
+                userId,
+                username: user.username,
+                rememberMe: options === null || options === void 0 ? void 0 : options.rememberMe,
+                createdAt: new Date(now).toISOString(),
+                expiresAt: new Date(now + two_factor_redis_store_1.TWO_FACTOR_TTL_MS).toISOString(),
+            });
+            return { requiresTwoFactor: true, challengeId };
+        });
+    }
+    verifyLoginChallenge(challengeId, code) {
+        return tslib_1.__awaiter(this, void 0, void 0, function* () {
+            const id = String(challengeId !== null && challengeId !== void 0 ? challengeId : '').trim();
+            const rawCode = String(code !== null && code !== void 0 ? code : '').trim();
+            if (!id || !rawCode) {
+                return { success: false, code: module_security_management_contracts_1.AXM_TWO_FACTOR_ERROR_CODES.InvalidInput };
+            }
+            const challenge = yield this.redisStore.getLoginChallenge(id);
+            if (!challenge) {
+                return { success: false, code: module_security_management_contracts_1.AXM_TWO_FACTOR_ERROR_CODES.ChallengeExpired };
+            }
+            const { userId } = challenge;
+            const { enabled, row } = yield this.resolveEffectiveTwoFactorState(userId);
+            if (enabled && !row) {
+                this.logger.error(`Invalid 2FA configuration during login: Enabled=true without row for user ${userId}`);
+                return { success: false, code: module_security_management_contracts_1.AXM_TWO_FACTOR_ERROR_CODES.InvalidConfiguration };
+            }
+            if (!enabled || !(row === null || row === void 0 ? void 0 : row.id)) {
+                return { success: false, code: module_security_management_contracts_1.AXM_TWO_FACTOR_ERROR_CODES.NotEnabled };
+            }
+            const policy = yield (0, security_1.resolveAuthLockoutPolicy)();
+            const attempts = yield this.redisStore.getAttemptCounters(id, userId);
+            if (attempts.challengeAttempts >= policy.maxLoginAttempts ||
+                attempts.userAttempts >= policy.maxLoginAttempts) {
+                return { success: false, code: module_security_management_contracts_1.AXM_TWO_FACTOR_ERROR_CODES.RateLimited };
+            }
+            const isTotp = /^\d{6}$/.test(rawCode.replace(/\s+/g, ''));
+            let accepted = false;
+            let acceptedStep;
+            if (isTotp) {
+                let secretBytes;
+                try {
+                    secretBytes = (0, two_factor_encryption_util_1.decryptTwoFactorSecret)(row);
+                }
+                catch (error) {
+                    this.logger.error(`2FA secret decrypt failed for user ${userId}: ${String(error)}`);
+                    return { success: false, code: module_security_management_contracts_1.AXM_TWO_FACTOR_ERROR_CODES.InvalidConfiguration };
+                }
+                const verified = (0, totp_util_1.verifyTotp)(secretBytes, rawCode);
+                if (verified.valid && verified.step != null) {
+                    const last = row.lastAcceptedStep;
+                    if (typeof last === 'number' && verified.step <= last) {
+                        accepted = false;
+                    }
+                    else {
+                        const locked = yield this.redisStore.tryAcquireStepLock(userId, verified.step, totp_util_1.TOTP_PERIOD_SECONDS * 2 * 1000);
+                        if (locked) {
+                            accepted = true;
+                            acceptedStep = verified.step;
+                        }
+                    }
+                }
+            }
+            else {
+                const normalized = (0, recovery_codes_util_1.normalizeRecoveryCode)(rawCode);
+                const locked = yield this.redisStore.tryAcquireRecoveryLock(userId, normalized, two_factor_redis_store_1.TWO_FACTOR_TTL_MS);
+                if (locked) {
+                    const consumed = yield (0, recovery_codes_util_1.consumeRecoveryCode)(row.recoveryCodes, rawCode);
+                    if (consumed.matched) {
+                        yield this.entityStorage.updateOneAsEngine(USER_TWO_FACTOR_ENTITY, row.id, {
+                            recoveryCodes: consumed.next,
+                        });
+                        accepted = true;
+                    }
+                }
+            }
+            if (!accepted) {
+                yield this.redisStore.incrementAttemptCounters(id, userId);
+                this.logger.warn(`2FA verification failed for user ${userId}`);
+                return { success: false, code: module_security_management_contracts_1.AXM_TWO_FACTOR_ERROR_CODES.IncorrectCode };
+            }
+            if (acceptedStep != null) {
+                yield this.entityStorage.updateOneAsEngine(USER_TWO_FACTOR_ENTITY, row.id, {
+                    lastAcceptedStep: acceptedStep,
+                });
+            }
+            const consumedChallenge = yield this.redisStore.consumeLoginChallenge(id);
+            if (!consumedChallenge) {
+                return { success: false, code: module_security_management_contracts_1.AXM_TWO_FACTOR_ERROR_CODES.ChallengeExpired };
+            }
+            yield this.redisStore.clearAttemptCounters(id, userId);
+            return {
+                success: true,
+                data: {
+                    userId,
+                    rememberMe: consumedChallenge.rememberMe,
+                },
+            };
+        });
+    }
+    //#endregion
+    //#region ----- Private helpers -----
+    wipeEnrollment(userId, row) {
+        return tslib_1.__awaiter(this, void 0, void 0, function* () {
+            yield this.writeEnabledSetting(userId, false);
+            if (row === null || row === void 0 ? void 0 : row.id) {
+                yield this.entityStorage.deleteOneAsEngine(USER_TWO_FACTOR_ENTITY, row.id);
+            }
+        });
+    }
+    revokeAllUserSessions(userId) {
+        return tslib_1.__awaiter(this, void 0, void 0, function* () {
+            const sessions = yield this.deviceSessions.listActiveSessionsForUser(userId);
+            for (const session of sessions) {
+                const revokedSid = yield this.deviceSessions.revokeOwnedSessionById(userId, session.id);
+                if (revokedSid == null) {
+                    continue;
+                }
+                if (revokedSid !== '') {
+                    yield this.auth.invalidateLoginSession(revokedSid);
+                    this.auth.notifyRemoteSessionTerminated(userId, revokedSid);
+                }
+            }
+        });
+    }
+    verifySensitiveProof(userId, password, totpCode) {
+        return tslib_1.__awaiter(this, void 0, void 0, function* () {
+            const pwd = String(password !== null && password !== void 0 ? password : '');
+            const totp = String(totpCode !== null && totpCode !== void 0 ? totpCode : '').trim();
+            if (!pwd && !totp) {
+                return { ok: false, code: module_security_management_contracts_1.AXM_TWO_FACTOR_ERROR_CODES.ProofRequired };
+            }
+            if (pwd) {
+                const user = yield this.getUser(userId);
+                if (!user) {
+                    return { ok: false, code: module_security_management_contracts_1.AXM_TWO_FACTOR_ERROR_CODES.NotSignedIn };
+                }
+                if (!(yield this.verifyUserPassword(user, pwd))) {
+                    return { ok: false, code: module_security_management_contracts_1.AXM_TWO_FACTOR_ERROR_CODES.IncorrectPassword };
+                }
+                return { ok: true };
+            }
+            const row = yield this.findByUserId(userId);
+            if (!row) {
+                return { ok: false, code: module_security_management_contracts_1.AXM_TWO_FACTOR_ERROR_CODES.NotEnabled };
+            }
+            let secretBytes;
+            try {
+                secretBytes = (0, two_factor_encryption_util_1.decryptTwoFactorSecret)(row);
+            }
+            catch (_a) {
+                return { ok: false, code: module_security_management_contracts_1.AXM_TWO_FACTOR_ERROR_CODES.IncorrectCode };
+            }
+            const verified = (0, totp_util_1.verifyTotp)(secretBytes, totp);
+            if (!verified.valid || verified.step == null) {
+                return { ok: false, code: module_security_management_contracts_1.AXM_TWO_FACTOR_ERROR_CODES.IncorrectCode };
+            }
+            if (typeof row.lastAcceptedStep === 'number' && verified.step <= row.lastAcceptedStep) {
+                return { ok: false, code: module_security_management_contracts_1.AXM_TWO_FACTOR_ERROR_CODES.IncorrectCode };
+            }
+            if (row.id) {
+                yield this.entityStorage.updateOneAsEngine(USER_TWO_FACTOR_ENTITY, row.id, {
+                    lastAcceptedStep: verified.step,
+                });
+            }
+            return { ok: true };
+        });
+    }
+    findByUserId(userId) {
+        return tslib_1.__awaiter(this, void 0, void 0, function* () {
+            var _a;
+            const result = yield this.entityStorage.queryAsEngine(USER_TWO_FACTOR_ENTITY, {
+                skip: 0,
+                take: 1,
+                filter: {
+                    logic: 'and',
+                    filters: [{ field: 'userId', operator: { type: 'equal' }, value: userId }],
+                },
+            });
+            const item = ((_a = result.items) !== null && _a !== void 0 ? _a : [])[0];
+            return (item === null || item === void 0 ? void 0 : item.id) ? item : null;
+        });
+    }
+    getUser(userId) {
+        return tslib_1.__awaiter(this, void 0, void 0, function* () {
+            return (yield this.entityStorage.getOneAsEngine(USER_ENTITY, userId));
+        });
+    }
+    verifyUserPassword(user, password) {
+        return tslib_1.__awaiter(this, void 0, void 0, function* () {
+            const stored = (0, lodash_1.get)(user, 'password');
+            return (0, core_2.verifyPassword)(password, stored);
+        });
+    }
+    userSettingsPartition(userId) {
+        return {
+            scope: 'U',
+            documentId: `U:${userId}`,
+            userId,
+        };
+    }
+    readEnabledSetting(userId) {
+        return tslib_1.__awaiter(this, void 0, void 0, function* () {
+            var _a;
+            const document = yield this.settingsStore.findByPartition(this.userSettingsPartition(userId));
+            const value = (_a = document === null || document === void 0 ? void 0 : document.values) === null || _a === void 0 ? void 0 : _a[ENABLED_SETTING_KEY];
+            return value === true || value === 'true';
+        });
+    }
+    /**
+     * Effective 2FA on/off for UI + login.
+     * Heals drift when a verified enrollment row exists but the user setting is missing/false
+     * (otherwise profile shows "Not enabled" while StartEnrollment returns AlreadyEnabled).
+     */
+    resolveEffectiveTwoFactorState(userId) {
+        return tslib_1.__awaiter(this, void 0, void 0, function* () {
+            const row = yield this.findByUserId(userId);
+            let enabled = yield this.readEnabledSetting(userId);
+            if (row && !enabled) {
+                this.logger.warn(`Healing 2FA Enabled setting for user ${userId} (UserTwoFactor enrollment exists)`);
+                try {
+                    yield this.writeEnabledSetting(userId, true);
+                    enabled = true;
+                }
+                catch (error) {
+                    this.logger.error(`Failed to heal 2FA Enabled setting for user ${userId}: ${String(error)}`);
+                    // Enrollment is the source of truth for "is set up" when the setting write fails.
+                    enabled = true;
+                }
+            }
+            return { enabled, row };
+        });
+    }
+    writeEnabledSetting(userId, enabled) {
+        return tslib_1.__awaiter(this, void 0, void 0, function* () {
+            yield this.settingsStore.upsertValues(this.userSettingsPartition(userId), {
+                [ENABLED_SETTING_KEY]: enabled,
+            });
+        });
+    }
+    readSessionUserId() {
+        var _a, _b;
+        const req = (0, core_1.getEntityStorageRequest)();
+        const userId = (_b = (_a = req === null || req === void 0 ? void 0 : req[security_1.CURRENT_SESSION_KEY]) === null || _a === void 0 ? void 0 : _a.userId) === null || _b === void 0 ? void 0 : _b.trim();
+        return userId || undefined;
+    }
+    emitSecurityAlert(payload) {
+        var _a;
+        try {
+            (_a = this.events) === null || _a === void 0 ? void 0 : _a.emit(security_1.AUTH_SECURITY_ALERT_EVENT, payload);
+        }
+        catch (error) {
+            this.logger.debug(`2FA security alert emit failed: ${String(error)}`);
+        }
+    }
+};
+exports.UserTwoFactorService = UserTwoFactorService;
+exports.UserTwoFactorService = UserTwoFactorService = UserTwoFactorService_1 = tslib_1.__decorate([
+    (0, common_1.Injectable)(),
+    tslib_1.__param(5, (0, common_1.Optional)()),
+    tslib_1.__metadata("design:paramtypes", [core_1.EntityStorageMiddlewareService,
+        module_settings_management_server_1.SettingsManagementStoreService,
+        two_factor_redis_store_1.TwoFactorRedisStore,
+        security_1.DeviceSessionService,
+        security_1.AuthService,
+        event_emitter_1.EventEmitter2])
+], UserTwoFactorService);
+//#endregion
+//# sourceMappingURL=user-two-factor.service.js.map

package/server/src/lib/two-factor/user-two-factor.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"user-two-factor.service.js","sourceRoot":"","sources":["../../../../../../../libs/modules/security-management/server/src/lib/two-factor/user-two-factor.service.ts"],"names":[],"mappings":";;;;;AAAA,mCAAoC;AACpC,2CAA8D;AAC9D,yDAAsD;AACtD,mCAA6B;AAE7B,iEAAiH;AACjH,yEASoD;AACpD,iEAAwE;AACxE,kFAAyE;AACzE,gHAe+D;AAC/D,0GAAoG;AAEpG,+DAA4G;AAC5G,2CAMqB;AACrB,6EAGsC;AACtC,qEAAkF;AAsBlF,YAAY;AAEZ,+BAA+B;AAE/B,MAAM,WAAW,GAAG,yBAAyB,CAAC;AAC9C,MAAM,sBAAsB,GAAG,kCAAkC,CAAC;AAClE,MAAM,mBAAmB,GAAG,uCAAe,CAAC,oBAAoB,CAAC;AAEjE,YAAY;AAEZ,6CAA6C;AAGtC,IAAM,oBAAoB,4BAA1B,MAAM,oBAAoB;IAG/B,YACmB,aAA6C,EAC7C,aAA6C,EAC7C,UAA+B,EAC/B,cAAoC,EACpC,IAAiB,EACtB,MAAuC;QALlC,kBAAa,GAAb,aAAa,CAAgC;QAC7C,kBAAa,GAAb,aAAa,CAAgC;QAC7C,eAAU,GAAV,UAAU,CAAqB;QAC/B,mBAAc,GAAd,cAAc,CAAsB;QACpC,SAAI,GAAJ,IAAI,CAAa;QACL,WAAM,GAAN,MAAM,CAAgB;QARpC,WAAM,GAAG,IAAI,eAAM,CAAC,sBAAoB,CAAC,IAAI,CAAC,CAAC;IAS7D,CAAC;IAEJ,4BAA4B;IAEtB,SAAS,CAAC,MAAe;;;YAC7B,MAAM,GAAG,GAAG,CAAA,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,IAAI,EAAE,KAAI,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACvD,IAAI,CAAC,GAAG,EAAE,CAAC;gBACT,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,iEAA0B,CAAC,WAAW,EAAE,CAAC;YAC1E,CAAC;YAED,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,MAAM,IAAI,CAAC,8BAA8B,CAAC,GAAG,CAAC,CAAC;YACxE,MAAM,aAAa,GAAG,MAAA,GAAG,aAAH,GAAG,uBAAH,GAAG,CAAE,aAAa,mCAAI,EAAE,CAAC;YAC/C,MAAM,uBAAuB,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC;YAE9E,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,IAAI,EAAE;oBACJ,OAAO;oBACP,QAAQ,EAAE,CAAC,CAAC,GAAG;oBACf,UAAU,EAAE,MAAA,GAAG,aAAH,GAAG,uBAAH,GAAG,CAAE,UAAU,mCAAI,IAAI;oBACnC,gBAAgB,EAAE,aAAa,CAAC,MAAM,GAAG,CAAC;oBAC1C,uBAAuB;iBACxB;aACF,CAAC;QACJ,CAAC;KAAA;IAED,YAAY;IAEZ,gCAAgC;IAE1B,eAAe,CACnB,KAAuC;;;YAEvC,MAAM,MAAM,GAAG,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACxC,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,iEAA0B,CAAC,WAAW,EAAE,CAAC;YAC1E,CAAC;YAED,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAA,KAAK,CAAC,QAAQ,mCAAI,EAAE,CAAC,CAAC;YAC9C,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,iEAA0B,CAAC,YAAY,EAAE,CAAC;YAC3E,CAAC;YAED,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YACxC,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,iEAA0B,CAAC,WAAW,EAAE,CAAC;YAC1E,CAAC;YAED,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,kBAAkB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,EAAE,CAAC;gBACrD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,iEAA0B,CAAC,iBAAiB,EAAE,CAAC;YAChF,CAAC;YAED,IAAI,MAAM,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,EAAE,CAAC;gBACpC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,iEAA0B,CAAC,cAAc,EAAE,CAAC;YAC7E,CAAC;YAED,MAAM,WAAW,GAAG,IAAA,mCAAuB,GAAE,CAAC;YAC9C,MAAM,YAAY,GAAG,IAAA,wBAAY,EAAC,WAAW,CAAC,CAAC;YAC/C,MAAM,SAAS,GAAG,IAAA,mDAAsB,EAAC,WAAW,CAAC,CAAC;YACtD,MAAM,YAAY,GAAG,IAAA,mBAAU,GAAE,CAAC;YAClC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACvB,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,GAAG,GAAG,0CAAiB,CAAC,CAAC,WAAW,EAAE,CAAC;YAElE,MAAM,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC,YAAY,EAAE;gBACjD,MAAM;gBACN,MAAM,EAAE,SAAS;gBACjB,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE;gBACtC,SAAS;aACV,CAAC,CAAC;YAEH,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,KAAK,IAAI,MAAM,CAAC,CAAC,IAAI,EAAE,IAAI,MAAM,CAAC;YACnF,MAAM,MAAM,GAAG,CAAA,MAAA,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,0CAAE,IAAI,EAAE,KAAI,QAAQ,CAAC;YAClE,MAAM,UAAU,GAAG,IAAA,2BAAe,EAAC;gBACjC,YAAY;gBACZ,WAAW;gBACX,MAAM;aACP,CAAC,CAAC;YAEH,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,IAAI,EAAE,EAAE,YAAY,EAAE,UAAU,EAAE,YAAY,EAAE,SAAS,EAAE;aAC5D,CAAC;QACJ,CAAC;KAAA;IAEK,iBAAiB,CACrB,KAAyC;;;YAEzC,MAAM,MAAM,GAAG,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACxC,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,iEAA0B,CAAC,WAAW,EAAE,CAAC;YAC1E,CAAC;YAED,MAAM,YAAY,GAAG,MAAM,CAAC,MAAA,KAAK,CAAC,YAAY,mCAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;YAC7D,MAAM,IAAI,GAAG,MAAM,CAAC,MAAA,KAAK,CAAC,IAAI,mCAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;YAC7C,IAAI,CAAC,YAAY,IAAI,CAAC,IAAI,EAAE,CAAC;gBAC3B,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,iEAA0B,CAAC,YAAY,EAAE,CAAC;YAC3E,CAAC;YAED,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC;YACrE,IAAI,CAAC,UAAU,IAAI,UAAU,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBAChD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,iEAA0B,CAAC,iBAAiB,EAAE,CAAC;YAChF,CAAC;YAED,IAAI,MAAM,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,EAAE,CAAC;gBACpC,MAAM,IAAI,CAAC,UAAU,CAAC,gBAAgB,CAAC,YAAY,CAAC,CAAC;gBACrD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,iEAA0B,CAAC,cAAc,EAAE,CAAC;YAC7E,CAAC;YAED,IAAI,WAAmB,CAAC;YACxB,IAAI,CAAC;gBACH,WAAW,GAAG,IAAA,mDAAsB,EAAC,UAAU,CAAC,MAAM,CAAC,CAAC;YAC1D,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,0CAA0C,MAAM,KAAK,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;gBACvF,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,iEAA0B,CAAC,iBAAiB,EAAE,CAAC;YAChF,CAAC;YAED,MAAM,QAAQ,GAAG,IAAA,sBAAU,EAAC,WAAW,EAAE,IAAI,CAAC,CAAC;YAC/C,IAAI,CAAC,QAAQ,CAAC,KAAK,IAAI,QAAQ,CAAC,IAAI,IAAI,IAAI,EAAE,CAAC;gBAC7C,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,iEAA0B,CAAC,aAAa,EAAE,CAAC;YAC5E,CAAC;YAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,iBAAiB,CAAC,YAAY,CAAC,CAAC;YACvE,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,iEAA0B,CAAC,iBAAiB,EAAE,CAAC;YAChF,CAAC;YAED,MAAM,UAAU,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;YAC5C,MAAM,EAAE,GAAG,IAAA,mBAAU,GAAE,CAAC;YACxB,MAAM,QAAQ,GAAG,IAAA,mDAAsB,EAAC,WAAW,CAAC,CAAC;YAErD,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,aAAa,CAAC,iBAAiB,CAAC,sBAAsB,EAAE;oBACjE,EAAE;oBACF,MAAM;oBACN,MAAM,EAAE,eAAe;oBACvB,eAAe,EAAE,QAAQ,CAAC,eAAe;oBACzC,EAAE,EAAE,QAAQ,CAAC,EAAE;oBACf,OAAO,EAAE,QAAQ,CAAC,OAAO;oBACzB,UAAU,EAAE,QAAQ,CAAC,UAAU;oBAC/B,UAAU;oBACV,gBAAgB,EAAE,QAAQ,CAAC,IAAI;oBAC/B,aAAa,EAAE,EAAE;oBACjB,SAAS,EAAE,EAAE;iBACmD,CAAC,CAAC;gBAEpE,MAAM,IAAI,CAAC,mBAAmB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YAC/C,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,0CAA0C,MAAM,KAAK,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;gBACxF,IAAI,CAAC;oBACH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;oBAC5C,IAAI,GAAG,aAAH,GAAG,uBAAH,GAAG,CAAE,EAAE,EAAE,CAAC;wBACZ,MAAM,IAAI,CAAC,aAAa,CAAC,iBAAiB,CAAC,sBAAsB,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;oBAC7E,CAAC;oBACD,MAAM,IAAI,CAAC,mBAAmB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;gBAChD,CAAC;gBAAC,OAAO,aAAa,EAAE,CAAC;oBACvB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,wCAAwC,MAAM,KAAK,MAAM,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;gBAChG,CAAC;gBACD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,iEAA0B,CAAC,YAAY,EAAE,CAAC;YAC3E,CAAC;YAED,IAAI,CAAC,iBAAiB,CAAC;gBACrB,IAAI,EAAE,oBAAoB;gBAC1B,MAAM;gBACN,EAAE,EAAE,UAAU;aACf,CAAC,CAAC;YAEH,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,wBAAwB,MAAM,EAAE,CAAC,CAAC;YAClD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,CAAC;QAChE,CAAC;KAAA;IAED,YAAY;IAEZ,+DAA+D;IAEzD,OAAO,CACX,KAA+B;;YAE/B,MAAM,MAAM,GAAG,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACxC,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,iEAA0B,CAAC,WAAW,EAAE,CAAC;YAC1E,CAAC;YAED,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;YACtF,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;gBACd,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC;YAC9C,CAAC;YAED,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,MAAM,IAAI,CAAC,8BAA8B,CAAC,MAAM,CAAC,CAAC;YAC3E,IAAI,CAAC,OAAO,IAAI,CAAC,GAAG,EAAE,CAAC;gBACrB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,iEAA0B,CAAC,UAAU,EAAE,CAAC;YACzE,CAAC;YAED,MAAM,IAAI,CAAC,cAAc,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;YACvC,MAAM,IAAI,CAAC,UAAU,CAAC,2BAA2B,CAAC,MAAM,CAAC,CAAC;YAE1D,IAAI,CAAC,iBAAiB,CAAC;gBACrB,IAAI,EAAE,qBAAqB;gBAC3B,MAAM;gBACN,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;aAC7B,CAAC,CAAC;YAEH,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,yBAAyB,MAAM,EAAE,CAAC,CAAC;YACnD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,CAAC;QACrD,CAAC;KAAA;IAEK,qBAAqB,CACzB,KAA6C;;;YAE7C,MAAM,MAAM,GAAG,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACxC,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,iEAA0B,CAAC,WAAW,EAAE,CAAC;YAC1E,CAAC;YAED,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;YACtF,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;gBACd,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC;YAC9C,CAAC;YAED,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,MAAM,IAAI,CAAC,8BAA8B,CAAC,MAAM,CAAC,CAAC;YAC3E,IAAI,CAAC,OAAO,IAAI,CAAC,CAAA,GAAG,aAAH,GAAG,uBAAH,GAAG,CAAE,EAAE,CAAA,EAAE,CAAC;gBACzB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,iEAA0B,CAAC,UAAU,EAAE,CAAC;YACzE,CAAC;YAED,MAAM,aAAa,GAAG,MAAA,GAAG,CAAC,aAAa,mCAAI,EAAE,CAAC;YAC9C,MAAM,gBAAgB,GAAG,aAAa,CAAC,MAAM,GAAG,CAAC,CAAC;YAElD,MAAM,SAAS,GAAG,MAAM,IAAA,6CAAuB,GAAE,CAAC;YAClD,MAAM,IAAI,CAAC,aAAa,CAAC,iBAAiB,CAAC,sBAAsB,EAAE,GAAG,CAAC,EAAE,EAAE;gBACzE,aAAa,EAAE,SAAS,CAAC,MAAM;aAChC,CAAC,CAAC;YAEH,uFAAuF;YACvF,IAAI,gBAAgB,EAAE,CAAC;gBACrB,IAAI,CAAC,iBAAiB,CAAC;oBACrB,IAAI,EAAE,uCAAuC;oBAC7C,MAAM;oBACN,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;iBAC7B,CAAC,CAAC;gBACH,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,2CAA2C,MAAM,EAAE,CAAC,CAAC;YACvE,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,sCAAsC,MAAM,EAAE,CAAC,CAAC;YAClE,CAAC;YAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,SAAS,CAAC,SAAS,EAAE,EAAE,CAAC;QACjE,CAAC;KAAA;IAEK,UAAU,CACd,KAAkC;;;YAElC,MAAM,YAAY,GAAG,MAAM,CAAC,MAAA,KAAK,CAAC,MAAM,mCAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;YACvD,IAAI,CAAC,YAAY,EAAE,CAAC;gBAClB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,iEAA0B,CAAC,YAAY,EAAE,CAAC;YAC3E,CAAC;YAED,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;YAC9C,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,iEAA0B,CAAC,YAAY,EAAE,CAAC;YAC3E,CAAC;YAED,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,MAAM,IAAI,CAAC,8BAA8B,CAAC,YAAY,CAAC,CAAC;YACjF,IAAI,CAAC,OAAO,IAAI,CAAC,GAAG,EAAE,CAAC;gBACrB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,iEAA0B,CAAC,UAAU,EAAE,CAAC;YACzE,CAAC;YAED,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;gBACjB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC;YACnD,CAAC;YAED,MAAM,IAAI,CAAC,cAAc,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC;YAC7C,MAAM,IAAI,CAAC,UAAU,CAAC,2BAA2B,CAAC,YAAY,CAAC,CAAC;YAChE,MAAM,IAAI,CAAC,qBAAqB,CAAC,YAAY,CAAC,CAAC;YAE/C,MAAM,OAAO,GAAG,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACzC,IAAI,CAAC,iBAAiB,CAAC;gBACrB,IAAI,EAAE,wBAAwB;gBAC9B,MAAM,EAAE,YAAY;gBACpB,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;aAC7B,CAAC,CAAC;YAEH,IAAI,CAAC,MAAM,CAAC,GAAG,CACb,4BAA4B,YAAY,GAAG,OAAO,CAAC,CAAC,CAAC,OAAO,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAC7E,CAAC;YACF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC;QAClD,CAAC;KAAA;IAED,YAAY;IAEZ,qCAAqC;IAErC;;;OAGG;IACG,iCAAiC,CACrC,IAAkC,EAClC,OAAkC;;;YAElC,MAAM,MAAM,GAAG,MAAM,CAAC,MAAA,IAAI,CAAC,EAAE,mCAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;YAC5C,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,OAAO,IAAI,CAAC;YACd,CAAC;YAED,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,MAAM,IAAI,CAAC,8BAA8B,CAAC,MAAM,CAAC,CAAC;YAC3E,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO,IAAI,CAAC;YACd,CAAC;YAED,IAAI,CAAC,GAAG,EAAE,CAAC;gBACT,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,8EAA8E,MAAM,EAAE,CACvF,CAAC;gBACF,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,iEAA0B,CAAC,oBAAoB,CAAC,EAAE;oBAC9E,IAAI,EAAE,iEAA0B,CAAC,oBAAoB;iBACtD,CAAC,CAAC;YACL,CAAC;YAED,MAAM,WAAW,GAAG,IAAA,mBAAU,GAAE,CAAC;YACjC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACvB,MAAM,IAAI,CAAC,UAAU,CAAC,kBAAkB,CAAC,WAAW,EAAE;gBACpD,MAAM;gBACN,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,UAAU,EAAE,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,UAAU;gBAC/B,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE;gBACtC,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,GAAG,0CAAiB,CAAC,CAAC,WAAW,EAAE;aAC3D,CAAC,CAAC;YAEH,OAAO,EAAE,iBAAiB,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;QAClD,CAAC;KAAA;IAEK,oBAAoB,CACxB,WAAmB,EACnB,IAAY;;YAEZ,MAAM,EAAE,GAAG,MAAM,CAAC,WAAW,aAAX,WAAW,cAAX,WAAW,GAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;YAC5C,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,aAAJ,IAAI,cAAJ,IAAI,GAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;YAC1C,IAAI,CAAC,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC;gBACpB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,iEAA0B,CAAC,YAAY,EAAE,CAAC;YAC3E,CAAC;YAED,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC;YAC9D,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,iEAA0B,CAAC,gBAAgB,EAAE,CAAC;YAC/E,CAAC;YAED,MAAM,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC;YAC7B,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,MAAM,IAAI,CAAC,8BAA8B,CAAC,MAAM,CAAC,CAAC;YAE3E,IAAI,OAAO,IAAI,CAAC,GAAG,EAAE,CAAC;gBACpB,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,6EAA6E,MAAM,EAAE,CACtF,CAAC;gBACF,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,iEAA0B,CAAC,oBAAoB,EAAE,CAAC;YACnF,CAAC;YACD,IAAI,CAAC,OAAO,IAAI,CAAC,CAAA,GAAG,aAAH,GAAG,uBAAH,GAAG,CAAE,EAAE,CAAA,EAAE,CAAC;gBACzB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,iEAA0B,CAAC,UAAU,EAAE,CAAC;YACzE,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,IAAA,mCAAwB,GAAE,CAAC;YAChD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,kBAAkB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;YACtE,IACE,QAAQ,CAAC,iBAAiB,IAAI,MAAM,CAAC,gBAAgB;gBACrD,QAAQ,CAAC,YAAY,IAAI,MAAM,CAAC,gBAAgB,EAChD,CAAC;gBACD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,iEAA0B,CAAC,WAAW,EAAE,CAAC;YAC1E,CAAC;YAED,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC;YAC3D,IAAI,QAAQ,GAAG,KAAK,CAAC;YACrB,IAAI,YAAgC,CAAC;YAErC,IAAI,MAAM,EAAE,CAAC;gBACX,IAAI,WAAmB,CAAC;gBACxB,IAAI,CAAC;oBACH,WAAW,GAAG,IAAA,mDAAsB,EAAC,GAAG,CAAC,CAAC;gBAC5C,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,sCAAsC,MAAM,KAAK,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;oBACpF,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,iEAA0B,CAAC,oBAAoB,EAAE,CAAC;gBACnF,CAAC;gBAED,MAAM,QAAQ,GAAG,IAAA,sBAAU,EAAC,WAAW,EAAE,OAAO,CAAC,CAAC;gBAClD,IAAI,QAAQ,CAAC,KAAK,IAAI,QAAQ,CAAC,IAAI,IAAI,IAAI,EAAE,CAAC;oBAC5C,MAAM,IAAI,GAAG,GAAG,CAAC,gBAAgB,CAAC;oBAClC,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,QAAQ,CAAC,IAAI,IAAI,IAAI,EAAE,CAAC;wBACtD,QAAQ,GAAG,KAAK,CAAC;oBACnB,CAAC;yBAAM,CAAC;wBACN,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,kBAAkB,CACrD,MAAM,EACN,QAAQ,CAAC,IAAI,EACb,+BAAmB,GAAG,CAAC,GAAG,IAAI,CAC/B,CAAC;wBACF,IAAI,MAAM,EAAE,CAAC;4BACX,QAAQ,GAAG,IAAI,CAAC;4BAChB,YAAY,GAAG,QAAQ,CAAC,IAAI,CAAC;wBAC/B,CAAC;oBACH,CAAC;gBACH,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,MAAM,UAAU,GAAG,IAAA,2CAAqB,EAAC,OAAO,CAAC,CAAC;gBAClD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,sBAAsB,CAAC,MAAM,EAAE,UAAU,EAAE,0CAAiB,CAAC,CAAC;gBACnG,IAAI,MAAM,EAAE,CAAC;oBACX,MAAM,QAAQ,GAAG,MAAM,IAAA,yCAAmB,EAAC,GAAG,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;oBACvE,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;wBACrB,MAAM,IAAI,CAAC,aAAa,CAAC,iBAAiB,CAAC,sBAAsB,EAAE,GAAG,CAAC,EAAE,EAAE;4BACzE,aAAa,EAAE,QAAQ,CAAC,IAAI;yBAC7B,CAAC,CAAC;wBACH,QAAQ,GAAG,IAAI,CAAC;oBAClB,CAAC;gBACH,CAAC;YACH,CAAC;YAED,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,MAAM,IAAI,CAAC,UAAU,CAAC,wBAAwB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;gBAC3D,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,oCAAoC,MAAM,EAAE,CAAC,CAAC;gBAC/D,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,iEAA0B,CAAC,aAAa,EAAE,CAAC;YAC5E,CAAC;YAED,IAAI,YAAY,IAAI,IAAI,EAAE,CAAC;gBACzB,MAAM,IAAI,CAAC,aAAa,CAAC,iBAAiB,CAAC,sBAAsB,EAAE,GAAG,CAAC,EAAE,EAAE;oBACzE,gBAAgB,EAAE,YAAY;iBAC/B,CAAC,CAAC;YACL,CAAC;YAED,MAAM,iBAAiB,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,qBAAqB,CAAC,EAAE,CAAC,CAAC;YAC1E,IAAI,CAAC,iBAAiB,EAAE,CAAC;gBACvB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,iEAA0B,CAAC,gBAAgB,EAAE,CAAC;YAC/E,CAAC;YAED,MAAM,IAAI,CAAC,UAAU,CAAC,oBAAoB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;YAEvD,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,IAAI,EAAE;oBACJ,MAAM;oBACN,UAAU,EAAE,iBAAiB,CAAC,UAAU;iBACzC;aACF,CAAC;QACJ,CAAC;KAAA;IAED,YAAY;IAEZ,qCAAqC;IAEvB,cAAc,CAC1B,MAAc,EACd,GAAyD;;YAEzD,MAAM,IAAI,CAAC,mBAAmB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;YAC9C,IAAI,GAAG,aAAH,GAAG,uBAAH,GAAG,CAAE,EAAE,EAAE,CAAC;gBACZ,MAAM,IAAI,CAAC,aAAa,CAAC,iBAAiB,CAAC,sBAAsB,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;YAC7E,CAAC;QACH,CAAC;KAAA;IAEa,qBAAqB,CAAC,MAAc;;YAChD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,yBAAyB,CAAC,MAAM,CAAC,CAAC;YAC7E,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;gBAC/B,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,sBAAsB,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;gBACxF,IAAI,UAAU,IAAI,IAAI,EAAE,CAAC;oBACvB,SAAS;gBACX,CAAC;gBACD,IAAI,UAAU,KAAK,EAAE,EAAE,CAAC;oBACtB,MAAM,IAAI,CAAC,IAAI,CAAC,sBAAsB,CAAC,UAAU,CAAC,CAAC;oBACnD,IAAI,CAAC,IAAI,CAAC,6BAA6B,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;gBAC9D,CAAC;YACH,CAAC;QACH,CAAC;KAAA;IAEa,oBAAoB,CAChC,MAAc,EACd,QAAiB,EACjB,QAAiB;;YAEjB,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,aAAR,QAAQ,cAAR,QAAQ,GAAI,EAAE,CAAC,CAAC;YACnC,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,aAAR,QAAQ,cAAR,QAAQ,GAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;YAC3C,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;gBAClB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,iEAA0B,CAAC,aAAa,EAAE,CAAC;YACvE,CAAC;YAED,IAAI,GAAG,EAAE,CAAC;gBACR,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;gBACxC,IAAI,CAAC,IAAI,EAAE,CAAC;oBACV,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,iEAA0B,CAAC,WAAW,EAAE,CAAC;gBACrE,CAAC;gBACD,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,kBAAkB,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC;oBAChD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,iEAA0B,CAAC,iBAAiB,EAAE,CAAC;gBAC3E,CAAC;gBACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;YACtB,CAAC;YAED,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;YAC5C,IAAI,CAAC,GAAG,EAAE,CAAC;gBACT,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,iEAA0B,CAAC,UAAU,EAAE,CAAC;YACpE,CAAC;YAED,IAAI,WAAmB,CAAC;YACxB,IAAI,CAAC;gBACH,WAAW,GAAG,IAAA,mDAAsB,EAAC,GAAG,CAAC,CAAC;YAC5C,CAAC;YAAC,WAAM,CAAC;gBACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,iEAA0B,CAAC,aAAa,EAAE,CAAC;YACvE,CAAC;YAED,MAAM,QAAQ,GAAG,IAAA,sBAAU,EAAC,WAAW,EAAE,IAAI,CAAC,CAAC;YAC/C,IAAI,CAAC,QAAQ,CAAC,KAAK,IAAI,QAAQ,CAAC,IAAI,IAAI,IAAI,EAAE,CAAC;gBAC7C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,iEAA0B,CAAC,aAAa,EAAE,CAAC;YACvE,CAAC;YACD,IAAI,OAAO,GAAG,CAAC,gBAAgB,KAAK,QAAQ,IAAI,QAAQ,CAAC,IAAI,IAAI,GAAG,CAAC,gBAAgB,EAAE,CAAC;gBACtF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,iEAA0B,CAAC,aAAa,EAAE,CAAC;YACvE,CAAC;YAED,IAAI,GAAG,CAAC,EAAE,EAAE,CAAC;gBACX,MAAM,IAAI,CAAC,aAAa,CAAC,iBAAiB,CAAC,sBAAsB,EAAE,GAAG,CAAC,EAAE,EAAE;oBACzE,gBAAgB,EAAE,QAAQ,CAAC,IAAI;iBAChC,CAAC,CAAC;YACL,CAAC;YACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;QACtB,CAAC;KAAA;IAEa,YAAY,CACxB,MAAc;;;YAEd,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,aAAa,CAAC,sBAAsB,EAAE;gBAC5E,IAAI,EAAE,CAAC;gBACP,IAAI,EAAE,CAAC;gBACP,MAAM,EAAE;oBACN,KAAK,EAAE,KAAK;oBACZ,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;iBAC3E;aACF,CAAC,CAAC;YACH,MAAM,IAAI,GAAG,CAAC,MAAA,MAAM,CAAC,KAAK,mCAAI,EAAE,CAAC,CAAC,CAAC,CAA8D,CAAC;YAClG,OAAO,CAAA,IAAI,aAAJ,IAAI,uBAAJ,IAAI,CAAE,EAAE,EAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;QAChC,CAAC;KAAA;IAEa,OAAO,CACnB,MAAc;;YAEd,OAAO,CAAC,MAAM,IAAI,CAAC,aAAa,CAAC,cAAc,CAC7C,WAAW,EACX,MAAM,CACP,CAAiD,CAAC;QACrD,CAAC;KAAA;IAEa,kBAAkB,CAC9B,IAA2C,EAC3C,QAAgB;;YAEhB,MAAM,MAAM,GAAG,IAAA,YAAG,EAAC,IAAI,EAAE,UAAU,CAAC,CAAC;YACrC,OAAO,IAAA,qBAAc,EAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAC1C,CAAC;KAAA;IAEO,qBAAqB,CAAC,MAAc;QAC1C,OAAO;YACL,KAAK,EAAE,GAAY;YACnB,UAAU,EAAE,KAAK,MAAM,EAAE;YACzB,MAAM;SACP,CAAC;IACJ,CAAC;IAEa,kBAAkB,CAAC,MAAc;;;YAC7C,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,eAAe,CAAC,IAAI,CAAC,qBAAqB,CAAC,MAAM,CAAC,CAAC,CAAC;YAC9F,MAAM,KAAK,GAAG,MAAA,QAAQ,aAAR,QAAQ,uBAAR,QAAQ,CAAE,MAAM,0CAAG,mBAAmB,CAAC,CAAC;YACtD,OAAO,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,MAAM,CAAC;QAC5C,CAAC;KAAA;IAED;;;;OAIG;IACW,8BAA8B,CAAC,MAAc;;YAIzD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;YAC5C,IAAI,OAAO,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC;YAEpD,IAAI,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;gBACpB,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,wCAAwC,MAAM,oCAAoC,CACnF,CAAC;gBACF,IAAI,CAAC;oBACH,MAAM,IAAI,CAAC,mBAAmB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;oBAC7C,OAAO,GAAG,IAAI,CAAC;gBACjB,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,+CAA+C,MAAM,KAAK,MAAM,CAAC,KAAK,CAAC,EAAE,CAC1E,CAAC;oBACF,kFAAkF;oBAClF,OAAO,GAAG,IAAI,CAAC;gBACjB,CAAC;YACH,CAAC;YAED,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;QAC1B,CAAC;KAAA;IAEa,mBAAmB,CAAC,MAAc,EAAE,OAAgB;;YAChE,MAAM,IAAI,CAAC,aAAa,CAAC,YAAY,CAAC,IAAI,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;gBACxE,CAAC,mBAAmB,CAAC,EAAE,OAAO;aAC/B,CAAC,CAAC;QACL,CAAC;KAAA;IAEO,iBAAiB;;QACvB,MAAM,GAAG,GAAG,IAAA,8BAAuB,GAAoC,CAAC;QACxE,MAAM,MAAM,GAAG,MAAA,MAAA,GAAG,aAAH,GAAG,uBAAH,GAAG,CAAG,8BAAmB,CAAC,0CAAE,MAAM,0CAAE,IAAI,EAAE,CAAC;QAC1D,OAAO,MAAM,IAAI,SAAS,CAAC;IAC7B,CAAC;IAEO,iBAAiB,CAAC,OAAsC;;QAC9D,IAAI,CAAC;YACH,MAAA,IAAI,CAAC,MAAM,0CAAE,IAAI,CAAC,oCAAyB,EAAE,OAAO,CAAC,CAAC;QACxD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,mCAAmC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACxE,CAAC;IACH,CAAC;CAGF,CAAA;AAhnBY,oDAAoB;+BAApB,oBAAoB;IADhC,IAAA,mBAAU,GAAE;IAUR,mBAAA,IAAA,iBAAQ,GAAE,CAAA;6CALqB,qCAA8B;QAC9B,kEAA8B;QACjC,4CAAmB;QACf,+BAAoB;QAC9B,sBAAW;QACI,6BAAa;GAT1C,oBAAoB,CAgnBhC;AAED,YAAY"}

package/server/src/lib/two-factor/verify-two-factor-login.command.d.ts

@@ -0,0 +1,18 @@
+import type { AXPCommand, AXPCommandExecuteResultPromise } from '@acorex-platform/framework-shared/runtime';
+import { AuthCookieService, AuthService, AuthLocalCredentialsService, TokenService, type AuthTokenResponseDto } from '@acorex-platform/framework-server/security';
+import { type AXMVerifyTwoFactorLoginInput } from '@acorex-platform/module-security-management-client/contracts';
+import { UserTwoFactorService } from './user-two-factor.service';
+/**
+ * Public command that completes login after a 2FA challenge.
+ * Prefer {@link AUTH_VERIFY_TWO_FACTOR_DEFAULT} for cookie-aware SPA sign-in;
+ * this key remains available for catalog/runtime callers.
+ */
+export declare class VerifyTwoFactorLoginCommand implements AXPCommand<AXMVerifyTwoFactorLoginInput, AuthTokenResponseDto> {
+    private readonly twoFactor;
+    private readonly auth;
+    private readonly credentials;
+    private readonly cookies;
+    private readonly tokens;
+    constructor(twoFactor: UserTwoFactorService, auth: AuthService, credentials: AuthLocalCredentialsService, cookies: AuthCookieService, tokens: TokenService);
+    execute(input?: AXMVerifyTwoFactorLoginInput): AXPCommandExecuteResultPromise<AuthTokenResponseDto>;
+}