@ambushsoftworks/nestjs-auth-graphql 0.11.0 → 0.12.0

package/CHANGELOG.md

@@ -27,6 +27,143 @@ for buried obligations. **The marker was introduced in 0.9.0 and has not been
 retro-applied**, so it is reliable from 0.9.0 onward only. Convention adopted
 from `@ambushsoftworks/nestjs-payments-graphql`.
 
+## [0.12.0] - 2026-09-20
+
+Ambush Desk asked for two things: verifying JWTs that other systems sign, and API
+keys with scopes, expiry and prefixes. They also reported duplicate security
+events, and checking that turned up a false one. Jobsites then filed two more:
+a verification link that cannot follow a realm, and a password reset that
+silently skips accounts it should not. See **Fixed**.
+
+### Fixed
+- **Every signup, login and logout was logged twice.** `BaseAuthResolver` logged
+  `SIGNUP_SUCCESS`, `LOGIN_SUCCESS` and `LOGOUT_SUCCESS` after `AuthService` had
+  already logged each, so an `IAuthLogger` writing to an audit table stored two
+  rows per operation. `AuthService` keeps its copies: they also cover flows that
+  never reach the resolver. Reported by Ambush Desk, and reproduced end to end
+  before the fix.
+- **A signup refused by `features.preventEnumerationOnSignup` logged
+  `SIGNUP_SUCCESS`** for an account that was never created, carrying the
+  synthetic response's random user ID. The resolver logged it without being able
+  to tell the signup apart from a real one; `AuthService`, which can, does not.
+- **A password reset for an account with no password sent nothing, silently.**
+  Both `requestPasswordReset` and `resetPassword` tested `passwordHash == null`
+  and read it as "this user signed in with Google". It is also how an
+  operator-provisioned account starts, so an account created by an admin CLI
+  got no email — and the request returned the same generic success as a real
+  send, so the operator saw success for an account nobody could ever sign into.
+  Both guards now test for an actual social identity via the exported
+  `hasSocialIdentity(user)` (`googleId`, `facebookId` or `appleId`). A
+  social-only account behaves exactly as before. **The two guards have to agree**
+  — correcting only the first would email a credential the second refuses, which
+  is worse than the silence. A skip is now reported through `IAuthLogger` as
+  `PASSWORD_RESET_REQUESTED` with `result: 'SKIPPED_SOCIAL_ONLY'`; the public
+  response is deliberately unchanged, since `performRequestPasswordReset` is
+  reachable unauthenticated and a distinguishable return value would be an
+  enumeration oracle. Reported by jobsites.
+  - Consequence worth deciding on rather than discovering: a half-finished
+    signup row with no password and no social identity can now be claimed by
+    whoever controls the address. Previously it was unreachable, which is not
+    the same as safe.
+
+### Added
+- **`createExternalJwtStrategy(name, options | { inject, useFactory })`**: a
+  Passport strategy for JWTs another system signs, with
+  `secretProvider(kid, request)`, required `algorithms`, `issuer`, `audience`,
+  `clockToleranceSec`, `maxTokenBytes` (default 8192), `mapClaims` and
+  `jwtFromRequest`. Separate from the package's `jwt` strategy: no realm check
+  and no user lookup. Every rejection fails softly, so it composes in
+  `createAuthGuard`. Requested by Ambush Desk.
+  - Unsafe configuration fails boot: missing or empty `algorithms`, `none`, an
+    algorithm jsonwebtoken does not know, HMAC mixed with asymmetric families
+    (which lets a public key be used as an HMAC secret), or one of the package's
+    own strategy names.
+  - The `{ inject, useFactory }` form wires constructor injection, so
+    `secretProvider` can use application services without a subclass.
+- **API key scopes**: `@RequireScopes(...)` and `ScopeGuard`, with
+  `IApiKeyAccount.scopes?: string[]`. A key needs every listed scope, and
+  otherwise gets 403 `INSUFFICIENT_SCOPE` naming what the operation requires. A
+  key with no `scopes` has none. Signed-in people pass, since their access is
+  `PermissionGuard`'s job. Requested by Ambush Desk.
+- **API key expiry**: `IApiKeyAccount.expiresAt?: Date | null`. A key past it is
+  refused with `401 API key has expired`. Requested by Ambush Desk.
+- **`apiKey.headerName`**, such as `'X-API-Key'`, read before
+  `Authorization: Bearer`, which keeps working. `CsrfGuard` treats a request
+  carrying it as credentialed, as it already does for `Authorization`. Requested
+  by Ambush Desk.
+- **`apiKey.prefix`**, such as `'ait_'`. A token without it is not an API key and
+  goes to the next strategy with no lookup; one with it that matches no key is
+  refused with `401 Invalid API key`, since it cannot be a JWT. That replaces the
+  requested `onUnknownKey: 'fail' | 'error'` switch. Requested by Ambush Desk.
+- **`IApiKeyRepository.touchLastUsed?(id)`**, called once per successful match
+  and never for a refused key. It is not awaited, and a failure is logged rather
+  than failing the request. Requested by Ambush Desk.
+- **`verification.baseUrl` accepts a resolver**: `string | ((realm?: string) =>
+  string)`. One deployment serving several brands needs a link that opens on the
+  site the user came from; the realm already reached the credential and was
+  dropped one line before the URL. It applies to both verification modes, since
+  the token link and the code page link are built from the same resolved base.
+  Purely additive — a string behaves exactly as before. Requested by jobsites.
+  - Called once per link and synchronous: resolve from a map, not a query.
+  - Must return a URL for `realm === undefined` too — a request exempted by
+    `realm.skip`, or a single-realm deployment, has no realm.
+  - Boot validation is necessarily weaker for a resolver: it is probed once with
+    `undefined`, because there is no request at startup to supply a realm. A
+    per-realm value is checked when the link is built, where token mode throws
+    (the link carries the only copy of the credential) and code mode warns and
+    sends without a link (the code is in the body).
+
+### Changed
+- **The `jwt` strategy pins `algorithms: ['HS256']`**, the algorithm the module's
+  `JwtModule` signs with. Unpinned, jsonwebtoken 9 also accepted HS384 and HS512
+  tokens signed with `jwtSecret`. Tokens this package issues are unaffected.
+- **`ApiKeyStrategy`'s constructor takes the `apiKey` options** as an optional
+  second argument. This matters only if you construct the strategy yourself.
+
+### Declined
+- **Publishable, origin-restricted API keys.** A key an app embeds is public by
+  construction: it identifies an app rather than authenticating anyone, and
+  `Origin` is set freely by any non-browser client, so restricting it is abuse
+  control rather than authentication. Keeping them out means every credential
+  this package accepts is a secret one. Requested by Ambush Desk, which keeps
+  ingest keys as its own concept.
+
+### Documentation
+- README: **External JWTs**; **API Key Authentication** extended with the prefix,
+  header, expiry, scopes and last-used tracking; `ScopeGuard` and
+  `@RequireScopes` in the guard and decorator tables; the new options; and
+  **Migrating to v0.12.0**.
+- CLAUDE.md: **API Keys, Scopes and External JWTs**, and the rule that each
+  security event is logged once, by the layer that performs the action.
+- README: **One API, several brands: `baseUrl` per realm**, the widened
+  `verification.baseUrl` row, and both new **Migrating to v0.12.0** notes.
+- CLAUDE.md: base URL resolution is realm-aware through one seam, with the
+  warning not to answer it by handing the raw token to the email renderer; and
+  the rule that password reset tests for a social identity, never for a missing
+  password hash.
+
+### Testing
+- **End-to-end** (`test/e2e/tokens-and-keys.e2e-spec.ts`), on both NestJS majors:
+  a customer token through `createAuthGuard(['customer-jwt'])` on an HTTP route
+  and in a resolver, both guard orders with staff tokens, and refusals for
+  another algorithm, an unknown key ID, another audience and an expired token.
+  For API keys: a staff JWT accepted with a prefix set, a key in `X-API-Key` with
+  its use recorded, an unknown prefixed key, an expired key, `@RequireScopes`
+  against keys and people, and the CSRF skip.
+- **Signup, login and logout now run end to end through `BaseAuthResolver`**,
+  counting the events each produces, including a signup refused by
+  `preventEnumerationOnSignup`.
+- **Per-realm links**, in `auth.service.verification-mode.spec.ts` against a real
+  `VerificationService`, and end to end in `auth-module.e2e-spec.ts` — the realm
+  is attached by `RealmMiddleware`, so only an assembled app proves it survives
+  the whole path from header to emailed link. Each test parses the rendered URL
+  and feeds the credential back through `resetPassword`, rather than asserting
+  that a send happened.
+- **43 mutation checks**, each reintroducing one defect: every one failed a test.
+  The five added here include reverting each password-reset guard separately —
+  reverting only `resetPassword` is caught by the close-the-loop test, which is
+  the half-fix worth guarding against.
+
 ## [0.11.0] - 2026-09-15
 
 Ambush Desk asked for two things: refresh retries that survive a second API

package/README.md

@@ -13,6 +13,7 @@ Production-grade authentication module for NestJS GraphQL + REST APIs. JWT, cook
   - [Multi-Tenancy](#multi-tenancy)
   - [Realm-Based Identity Isolation](#realm-based-identity-isolation)
   - [API Key Authentication](#api-key-authentication)
+  - [External JWTs](#external-jwts)
   - [Email System](#email-system)
   - [Verification Modes](#verification-modes)
   - [OAuth](#oauth)
@@ -39,6 +40,7 @@ Production-grade authentication module for NestJS GraphQL + REST APIs. JWT, cook
   - [GraphQL Subscriptions](#graphql-subscriptions)
 - [Utilities](#utilities)
 - [Security Features](#security-features)
+- [Migrating to v0.12.0](#migrating-to-v0120)
 - [Migrating to v0.11.0](#migrating-to-v0110)
 - [Migrating to v0.10.0](#migrating-to-v0100)
 - [Migrating to v0.9.0](#migrating-to-v090)
@@ -559,6 +561,73 @@ The `ApiKeyStrategy` hashes the bearer token with SHA-256 and calls `findByKeyHa
 
 Before 0.10.0 the API key strategy rejected an unknown bearer token itself, which stopped the chain: `['api-key', 'jwt']` rejected every JWT.
 
+#### Key options
+
+| Option | Example | Effect |
+|--------|---------|--------|
+| `apiKey.headerName` | `'X-API-Key'` | A header carrying the raw key, read before `Authorization: Bearer`, which keeps working. `CsrfGuard` treats a request carrying it as credentialed, as it already does for `Authorization` |
+| `apiKey.prefix` | `'ait_'` | The prefix every key you issue starts with. See below |
+
+Both are read only with `apiKeyRepositoryInstance`, and `apiKey.prefix` without it warns at boot. `headerName` must be a header name other than `Authorization`, and `prefix` must not be empty -- an empty one matches every token, so every unknown bearer token, JWTs included, would be refused. Boot fails on either.
+
+**A prefix makes an unknown key unambiguous.** Without one, the strategy cannot tell a mistyped key from a JWT:
+
+| Token | Without `prefix` | With `prefix` |
+|-------|------------------|---------------|
+| Does not start with the prefix (a JWT, say) | Looked up, then passed to the next strategy | Passed to the next strategy, with no lookup |
+| Starts with it, matches no key | Passed to the next strategy; a single-strategy guard answers a generic 401 | `401 Invalid API key` -- it cannot be a JWT, so no other strategy tries it |
+| Matches a key | Authenticated, unless the key is inactive or expired | The same |
+
+#### Expiry, scopes and last use
+
+`IApiKeyAccount` carries optional `scopes?: string[]` and `expiresAt?: Date | null`, and `IApiKeyRepository` may implement `touchLastUsed?(id)`. Existing repositories keep working.
+
+- **Expiry.** A key whose `expiresAt` has passed is refused with `401 API key has expired`, and no other strategy tries it. A key without one never expires.
+- **Scopes.** Mark the operation and register `ScopeGuard` after your authentication guard:
+
+  ```typescript
+  @Get('tickets')
+  @UseGuards(createAuthGuard(['api-key', 'jwt']), ScopeGuard)
+  @RequireScopes('tickets:read')
+  listTickets() { /* ... */ }
+  ```
+
+  A key must hold every listed scope. One that does not gets 403 with `{ message: 'Insufficient scope', code: 'INSUFFICIENT_SCOPE', requiredScopes, statusCode: 403 }`, naming what the operation requires. A key with no `scopes` holds none. **Signed-in people pass**: scopes restrict keys, while a person's access is `PermissionGuard`'s job. With no authenticated principal at all, `ScopeGuard` answers 401 -- which is why it goes after the auth guard.
+- **Last use.** `touchLastUsed(id)` is called once per successful match, and only then -- never for a key that is refused. It is not awaited: a failure is logged and never fails the request.
+
+### External JWTs
+
+`createExternalJwtStrategy(name, options)` verifies tokens another system signs -- each app's backend signing for its own users, say. It registers a separate Passport strategy under `name`, with no realm check and no user lookup, so the package's own `jwt` strategy is untouched.
+
+```typescript
+export const CustomerJwtStrategy = createExternalJwtStrategy('customer-jwt', {
+  inject: [AppSecretsService],           // optional; pass a plain options object instead
+  useFactory: (secrets: AppSecretsService) => ({
+    algorithms: ['HS256'],               // required
+    audience: 'ambush-desk',
+    secretProvider: (kid) => secrets.findSecret(kid),
+    mapClaims: (claims) => ({ id: claims.sub, app: claims.app, segments: claims.segments }),
+  }),
+});
+
+// providers: [CustomerJwtStrategy]
+// @UseGuards(createAuthGuard(['customer-jwt']))
+```
+
+| Option | Default | Description |
+|--------|---------|-------------|
+| `secretProvider(kid, request)` | -- | The key that verifies a token: a shared secret for `HS*`, a PEM public key for `RS*`, `PS*` and `ES*`. May be async. `null` rejects the token; so does a throw, which is logged |
+| `algorithms` | -- | **Required.** The algorithms the issuer signs with |
+| `issuer`, `audience` | -- | Required `iss` / `aud`, when set |
+| `clockToleranceSec` | `0` | Clock skew allowed on `exp` and `nbf` |
+| `maxTokenBytes` | `8192` | A longer token is refused before anything parses it |
+| `mapClaims(payload)` | the payload | Builds `request.user`, arrays and custom claims intact. `null`, `undefined` or a throw rejects the token |
+| `jwtFromRequest(request)` | `Authorization: Bearer` | Where the token comes from |
+
+**Algorithms are pinned, one family at a time.** Boot fails with `InvalidAuthConfigException` for missing or empty `algorithms`, for `none`, for an algorithm jsonwebtoken does not know, and for HMAC (`HS*`) mixed with asymmetric algorithms -- the mix that lets a public key be used as an HMAC secret. `'jwt'` and `'api-key'` are refused as names, since Passport would replace the package's own strategy.
+
+**Every rejection fails softly**, so the strategy composes: `createAuthGuard(['customer-jwt', 'jwt'])` accepts either kind of token, in either order, and answers 401 when both fail.
+
 ### Email System
 
 The email system uses a composable architecture: a **sender** (transport) and a **template renderer** (HTML generation).
@@ -688,6 +757,40 @@ variable (deprecated — logged once). With neither, code-mode emails carry no
 link and nothing is logged: the code is in the body, so no link is needed. The
 code itself is never placed in a query string in either mode.
 
+#### One API, several brands: `baseUrl` per realm
+
+With [realms](#realm-based-identity-isolation) enabled, one deployment serves
+several frontends and a link must open on the site the user actually came from.
+`baseUrl` accepts a resolver as well as a string; it is called with the realm of
+the request the credential is being issued for:
+
+```typescript
+const SITES: Record<string, string> = {
+  'site-a': 'https://a.example.com',
+  'site-b': 'https://b.example.com',
+};
+
+verification: {
+  baseUrl: (realm?: string) => SITES[realm ?? ''] ?? 'https://www.example.com',
+},
+```
+
+It applies to both modes — the token link and the code page link — because both
+are built from the same resolved base. It is called once per link, so resolve
+from a map rather than a query, and it must be synchronous.
+
+**Boot validation is weaker for a resolver, by necessity.** A string is checked
+in full at startup. A resolver is only called once, with `undefined`, so the
+realm-less case is checked and a per-realm return value is not — there is no
+request at startup to supply a realm. What it returns for a specific realm is
+checked when the link is built, and the two modes differ exactly as they do
+elsewhere: token mode throws, because the link carries the only copy of the
+credential; code mode logs a warning and sends the email without a link,
+because the code is in the body.
+
+Returning a value for `realm === undefined` is required. A request exempted by
+`realm.skip`, or a single-realm deployment, has no realm.
+
 **Custom `IEmailService` implementations.** Both send methods receive the
 credential and its URL, and the mode determines which one is actionable:
 
@@ -1020,6 +1123,8 @@ These sit beside `useFactory`, not in the object it returns.
 | `bruteForce.ipRateLimit` | `{ maxAttempts, windowMs }` | -- | IP rate-limit policy for `checkIpRateLimit`. When set, `rateLimiterInstance` MUST also be provided explicitly (boot fails with `InvalidAuthConfigException` otherwise). See [IP Rate Limiting](#ip-rate-limiting). |
 | `realm.skip` | `(path, request) => boolean` | -- | Requests that need no realm, such as health checks and webhooks. Read only with `realmExtractorInstance`. See [Realm-Based Identity Isolation](#realm-based-identity-isolation) |
 | `refreshGracePeriodSeconds` | `number` | `10` | How long a retried refresh gets the same token pair. `0` turns retries off. See [Refresh Retries](#refresh-retries) |
+| `apiKey.headerName` | `string` | -- | A header carrying the raw API key, e.g. `'X-API-Key'`, read before `Authorization`. See [API Key Authentication](#api-key-authentication) |
+| `apiKey.prefix` | `string` | -- | The prefix every API key you issue starts with, e.g. `'ait_'`. Makes an unknown key unambiguous. See [API Key Authentication](#api-key-authentication) |
 
 ### Feature Flags (`features`)
 
@@ -1094,7 +1199,7 @@ When `email` is provided, it takes precedence over `emailServiceInstance`.
 |--------|------|---------|-------------|
 | `tokenLength` | `number` | `64` | Token length in bytes (token mode) |
 | `tokenExpiresInMinutes` | `number` | `60` | Token expiration (token mode) |
-| `baseUrl` | `string` | -- | Absolute http(s) base URL for verification/reset links. **Required when `verificationMode` is `'token'`** (validated at boot); optional in code mode |
+| `baseUrl` | `string \| (realm?: string) => string` | — | Absolute http(s) base URL for verification/reset links, or a resolver called with the request's realm. **Required when `verificationMode` is `'token'`** (validated at boot); optional in code mode |
 
 ### Optional Instance Options
 
@@ -1126,6 +1231,7 @@ When `email` is provided, it takes precedence over `emailServiceInstance`.
 | `@PublicEndpoint()` | Method/Class | Skip authentication + tenant resolution (combines `@Public()` + `@SkipTenant()`) |
 | `@SkipTenant()` | Method/Class | Skip tenant resolution |
 | `@RequirePermissions('p1', 'p2')` | Method/Class | Require specific permissions |
+| `@RequireScopes('s1', 's2')` | Method/Class | Require API key scopes, enforced by `ScopeGuard`. People are unaffected. See [API Key Authentication](#api-key-authentication) |
 | `@CurrentUser()` | Parameter | Inject authenticated user |
 | `@CurrentTenant()` | Parameter | Inject resolved tenant context |
 | `@CurrentRealm()` | Parameter | Inject resolved realm from request context |
@@ -1139,6 +1245,7 @@ When `email` is provided, it takes precedence over `emailServiceInstance`.
 | `CsrfGuard` | CSRF header validation for cookie auth |
 | `TenantGuard` | Multi-tenant context resolution |
 | `PermissionGuard` | Permission checking against tenant context |
+| `ScopeGuard` | `@RequireScopes()` enforcement for API keys; register it after the authentication guard |
 | `JwtAuthGuard` | JWT-only guard for GraphQL and HTTP routes (prefer `createAuthGuard` for several strategies or `@Public()`) |
 
 ### Recommended Guard Chains
@@ -1149,8 +1256,9 @@ When realm support is enabled, `RealmMiddleware` runs before all guards (as Nest
 // JWT only
 { provide: APP_GUARD, useClass: createAuthGuard(['jwt'], { allowPublic: true }) }
 
-// JWT + API keys
-{ provide: APP_GUARD, useClass: createAuthGuard(['jwt', 'api-key'], { allowPublic: true }) }
+// JWT + API keys, with scopes enforced on the keys
+{ provide: APP_GUARD, useClass: createAuthGuard(['jwt', 'api-key'], { allowPublic: true }) },
+{ provide: APP_GUARD, useClass: ScopeGuard },
 
 // Full stack with cookie auth + multi-tenancy
 { provide: APP_GUARD, useClass: CsrfGuard },
@@ -1231,8 +1339,28 @@ export class CustomGuard implements CanActivate {
 - **`__Host-` cookie prefix** support for enhanced cookie security
 - **Separate HMAC secrets** for refresh tokens, verification codes, and OAuth state
 - **Realm-based identity isolation** with JWT realm claim validation, realm-scoped rate limiting and lockout, and auth flows that refuse a request without a realm
+- **Pinned JWT algorithms** -- the package's own `jwt` strategy verifies `HS256` only, and `createExternalJwtStrategy` requires an explicit `algorithms` list from one family (see [External JWTs](#external-jwts))
+- **API keys with scopes and expiry**, refused hard when they carry your prefix and match no key, so no other strategy accepts them
 - **No raw personal data in package logs** — log lines use the user ID or a salted hash (`emailHash=`, `ipHash=`, under `AUTH_IP_HASH_SALT` or `jwtSecret`), phone numbers keep only their last two digits, and the default `ConsoleAuthLogger` redacts security-event metadata. A custom `authLoggerInstance` receives the raw fields; pass them through `redactSecurityEventMetadata` to store them redacted.
 
+## Migrating to v0.12.0
+
+**Password reset now reaches accounts that have no password and no social login.** The guard on `requestPasswordReset` and `resetPassword` tested `passwordHash == null` and treated it as "this user signed in with Google". That is also how an operator-provisioned account starts, so an account created by an admin CLI was skipped silently — the request returned the same success message as a real send, and the reset would have been refused even if a code had arrived. Both guards now test for an actual social identity (`googleId`, `facebookId` or `appleId`), so a social-only account behaves exactly as before, and a password-less account with no social identity receives a reset code and can redeem it.
+
+Two consequences worth deciding on rather than discovering. A half-finished signup row with no password and no social identity can now be claimed by whoever controls the address — previously it was unreachable, which is not the same as safe. And if you wrote a placeholder password hash to work around the old behaviour, you can drop it; `hasSocialIdentity` is exported if you want the same predicate.
+
+The public response is unchanged in both cases. `requestPasswordReset` still returns the same generic message whether it sent, skipped or found nothing, because it is reachable unauthenticated and anything else would be an enumeration oracle. A skip is reported to your `IAuthLogger` instead, as `PASSWORD_RESET_REQUESTED` with `result: 'SKIPPED_SOCIAL_ONLY'`.
+
+**`verification.baseUrl` accepts a resolver.** Purely additive — a string behaves exactly as before. See [`baseUrl` per realm](#one-api-several-brands-baseurl-per-realm).
+
+**The `jwt` strategy now pins `HS256`.** That is the algorithm `JwtModule` signs with, so every token this package issues keeps working. A token signed with `jwtSecret` under HS384 or HS512 -- which jsonwebtoken accepted while nothing was pinned -- is now rejected. If another system mints tokens for the `jwt` strategy, check that it signs HS256, or give it its own strategy with [`createExternalJwtStrategy`](#external-jwts).
+
+**Each security event is logged once.** `BaseAuthResolver` logged `SIGNUP_SUCCESS`, `LOGIN_SUCCESS` and `LOGOUT_SUCCESS` on top of `AuthService`, so an `IAuthLogger` writing to an audit table stored two rows per signup, login and logout. The service's copy is the one that remains: it also covers flows that never reach the resolver. Counts built on those events halve, and `LOGOUT_SUCCESS` metadata is now `{ userId }` -- the resolver's copy also carried `email`. `SIGNUP_ATTEMPT` and `LOGOUT_ALL`, which only the resolver logs, are unchanged.
+
+**A signup refused by `features.preventEnumerationOnSignup` no longer logs `SIGNUP_SUCCESS`.** It used to log one, with the synthetic response's random user ID, for an account that was never created.
+
+**API keys.** Nothing changes until you set `apiKey.prefix` or `apiKey.headerName`, or store `scopes` / `expiresAt`. `ApiKeyStrategy`'s constructor takes the `apiKey` options as an optional second argument, which matters only if you construct it yourself.
+
 ## Migrating to v0.11.0
 
 **`getRequestFromContext` may return `undefined`.** It now also finds a `graphql-ws` subscription's upgrade request, and returns `undefined` where there is no request at all. TypeScript flags each call that assumes a request. In a guard that cannot decide without one, use `requireRequestFromContext`.

package/dist/auth.module.d.ts

@@ -56,6 +56,10 @@ export interface AuthModuleOptions {
     resourcePermissionRepositoryInstance?: IResourcePermissionRepository;
     jwtPayloadFactoryInstance?: IJwtPayloadFactory;
     apiKeyRepositoryInstance?: IApiKeyRepository;
+    apiKey?: {
+        headerName?: string;
+        prefix?: string;
+    };
     jwtValidation?: 'full' | 'payload-only';
     isUserActive?: (user: IAuthUser) => boolean;
     bcryptRounds?: number;
@@ -120,9 +124,10 @@ export interface AuthModuleOptions {
     verification?: {
         tokenLength?: number;
         tokenExpiresInMinutes?: number;
-        baseUrl?: string;
+        baseUrl?: string | VerificationBaseUrlResolver;
     };
 }
+export type VerificationBaseUrlResolver = (realm?: string) => string;
 export interface AuthModuleAsyncOptions extends Pick<ModuleMetadata, 'imports'> {
     useFactory: (...args: any[]) => Promise<AuthModuleOptions> | AuthModuleOptions;
     inject?: any[];

package/dist/auth.module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.module.d.ts","sourceRoot":"","sources":["../src/auth.module.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,aAAa,EACb,kBAAkB,EAElB,UAAU,EAGX,MAAM,gBAAgB,CAAC;AAIxB,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AA0B3D,OAAO,EAAE,eAAe,EAAE,MAAM,wCAAwC,CAAC;AACzE,OAAO,EAAE,SAAS,EAAE,MAAM,kCAAkC,CAAC;AAC7D,OAAO,EAAE,aAAa,EAAE,MAAM,sCAAsC,CAAC;AACrE,OAAO,EAAE,WAAW,EAAE,MAAM,oCAAoC,CAAC;AACjE,OAAO,EAAE,mBAAmB,EAAE,MAAM,6CAA6C,CAAC;AAClF,OAAO,EAAE,uBAAuB,EAAE,MAAM,iDAAiD,CAAC;AAC1F,OAAO,EAAE,uBAAuB,EAAE,MAAM,gDAAgD,CAAC;AACzF,OAAO,EAAE,qBAAqB,EAAE,MAAM,+CAA+C,CAAC;AACtF,OAAO,EAAE,oBAAoB,EAAE,MAAM,6CAA6C,CAAC;AACnF,OAAO,EAAE,WAAW,EAAE,MAAM,oCAAoC,CAAC;AAYjE,OAAO,EAAE,iBAAiB,EAAE,MAAM,0CAA0C,CAAC;AAC7E,OAAO,EAAE,gBAAgB,EAAE,MAAM,yCAAyC,CAAC;AAC3E,OAAO,EAAE,eAAe,EAAE,MAAM,wCAAwC,CAAC;AACzE,OAAO,EAAE,6BAA6B,EAAE,MAAM,uDAAuD,CAAC;AACtG,OAAO,EAAE,kBAAkB,EAAE,MAAM,4CAA4C,CAAC;AAChF,OAAO,EAAE,iBAAiB,EAAE,MAAM,2CAA2C,CAAC;AA8B9E,OAAO,EAAE,oBAAoB,EAAE,MAAM,+CAA+C,CAAC;AAGrF,OAAO,EAAE,YAAY,EAAE,MAAM,qCAAqC,CAAC;AAEnE,OAAO,EAAE,kBAAkB,EAAE,MAAM,4CAA4C,CAAC;AAIhF,OAAO,EAAE,YAAY,EAAE,MAAM,qCAAqC,CAAC;AACnE,OAAO,EAAE,sBAAsB,EAAE,MAAM,gDAAgD,CAAC;AAIxF,OAAO,EAAE,mBAAmB,EAAE,MAAM,8CAA8C,CAAC;AAwBnF,MAAM,WAAW,iBAAiB;IAMhC,sBAAsB,EAAE,eAAe,CAAC;IAOxC,8BAA8B,EAAE,uBAAuB,CAAC;IAOxD,oBAAoB,CAAC,EAAE,aAAa,CAAC;IAOrC,kBAAkB,CAAC,EAAE,WAAW,CAAC;IAMjC,sBAAsB,CAAC,EAAE,mBAAmB,CAAC;IAM7C,8BAA8B,CAAC,EAAE,uBAAuB,CAAC;IAMzD,4BAA4B,CAAC,EAAE,qBAAqB,CAAC;IAMrD,2BAA2B,CAAC,EAAE,oBAAoB,CAAC;IAQnD,kBAAkB,CAAC,EAAE,WAAW,CAAC;IAQjC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAQ5B,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAQhC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAQ1B,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAMhC,MAAM,CAAC,EAAE;QACP,UAAU,EAAE,MAAM,CAAC;QACnB,SAAS,EAAE,MAAM,CAAC;QAClB,WAAW,EAAE,MAAM,CAAC;KACrB,CAAC;IAMF,QAAQ,CAAC,EAAE;QACT,MAAM,EAAE,MAAM,CAAC;QACf,SAAS,EAAE,MAAM,CAAC;QAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;KACnB,CAAC;IAOF,OAAO,CAAC,EAAE,MAAM,CAAC;IASjB,wBAAwB,CAAC,EAAE,iBAAiB,CAAC;IAS7C,uBAAuB,CAAC,EAAE,gBAAgB,CAAC;IAa3C,sBAAsB,CAAC,EAAE,eAAe,CAAC;IAKzC,KAAK,CAAC,EAAE;QA4BN,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,KAAK,OAAO,CAAC;KAChE,CAAC;IAQF,oCAAoC,CAAC,EAAE,6BAA6B,CAAC;IAOrE,yBAAyB,CAAC,EAAE,kBAAkB,CAAC;IAO/C,wBAAwB,CAAC,EAAE,iBAAiB,CAAC;IAmB7C,aAAa,CAAC,EAAE,MAAM,GAAG,cAAc,CAAC;IAyBxC,YAAY,CAAC,EAAE,CAAC,IAAI,EAAE,SAAS,KAAK,OAAO,CAAC;IAO5C,YAAY,CAAC,EAAE,MAAM,CAAC;IAmBtB,QAAQ,CAAC,EAAE;QAOT,0BAA0B,CAAC,EAAE,OAAO,CAAC;QAQrC,UAAU,CAAC,EAAE,OAAO,CAAC;QAOrB,gBAAgB,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;KACrC,CAAC;IAMF,MAAM,CAAC,EAAE;QAEP,QAAQ,CAAC,EAAE,OAAO,CAAC;QAEnB,MAAM,CAAC,EAAE,OAAO,CAAC;QAEjB,QAAQ,CAAC,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,CAAC;QAErC,MAAM,CAAC,EAAE,MAAM,CAAC;QAEhB,IAAI,CAAC,EAAE,MAAM,CAAC;QAEd,iBAAiB,CAAC,EAAE,MAAM,CAAC;QAE3B,kBAAkB,CAAC,EAAE,MAAM,CAAC;QAE5B,eAAe,CAAC,EAAE,MAAM,CAAC;QAEzB,gBAAgB,CAAC,EAAE,MAAM,CAAC;QAc1B,aAAa,CAAC,EAAE,OAAO,CAAC;KACzB,CAAC;IAMF,IAAI,CAAC,EAAE;QAEL,UAAU,CAAC,EAAE,MAAM,CAAC;QAEpB,mBAAmB,CAAC,EAAE,OAAO,CAAC;QAE9B,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;QAc5B,SAAS,CAAC,EAAE,QAAQ,GAAG,MAAM,CAAC;KAC/B,CAAC;IAMF,SAAS,EAAE,MAAM,CAAC;IAMlB,YAAY,CAAC,EAAE,MAAM,CAAC;IAMtB,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAK/B,KAAK,CAAC,EAAE;QACN,MAAM,CAAC,EAAE;YACP,QAAQ,EAAE,MAAM,CAAC;YACjB,YAAY,EAAE,MAAM,CAAC;YACrB,WAAW,EAAE,MAAM,CAAC;SACrB,CAAC;QACF,QAAQ,CAAC,EAAE;YACT,QAAQ,EAAE,MAAM,CAAC;YACjB,YAAY,EAAE,MAAM,CAAC;YACrB,WAAW,EAAE,MAAM,CAAC;SACrB,CAAC;KACH,CAAC;IAOF,aAAa,CAAC,EAAE,MAAM,CAAC;IAsBvB,cAAc,CAAC,EAAE,oBAAoB,CAAC;IAqBtC,mBAAmB,CAAC,EAAE,YAAY,CAAC;IAWnC,yBAAyB,CAAC,EAAE,MAAM,CAAC;IAenC,yBAAyB,CAAC,EAAE,kBAAkB,CAAC;IAuB/C,UAAU,CAAC,EAAE;QAeX,WAAW,CAAC,EAAE;YAEZ,WAAW,EAAE,MAAM,CAAC;YAEpB,QAAQ,EAAE,MAAM,CAAC;SAClB,CAAC;KACH,CAAC;IAiBF,KAAK,CAAC,EAAE;QAEN,MAAM,EAAE,YAAY,CAAC;QAErB,IAAI,EAAE;YAAE,KAAK,EAAE,MAAM,CAAC;YAAC,IAAI,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;QAEvC,QAAQ,CAAC,EAAE,mBAAmB,CAAC;QAE/B,gBAAgB,CAAC,EAAE,sBAAsB,CAAC;KAC3C,CAAC;IAKF,YAAY,CAAC,EAAE;QAEb,WAAW,CAAC,EAAE,MAAM,CAAC;QAErB,qBAAqB,CAAC,EAAE,MAAM,CAAC;QAE/B,OAAO,CAAC,EAAE,MAAM,CAAC;KAClB,CAAC;CACH;AAKD,MAAM,WAAW,sBAAuB,SAAQ,IAAI,CAAC,cAAc,EAAE,SAAS,CAAC;IAC7E,UAAU,EAAE,CACV,GAAG,IAAI,EAAE,GAAG,EAAE,KACX,OAAO,CAAC,iBAAiB,CAAC,GAAG,iBAAiB,CAAC;IACpD,MAAM,CAAC,EAAE,GAAG,EAAE,CAAC;IAef,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B;AA8BD,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,iBAAiB,GAAG,IAAI,CAwCvE;AA2ED,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,iBAAiB,GAAG,MAAM,EAAE,CAwB7E;AASD,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,iBAAiB,GAAG,MAAM,EAAE,CAmBxE;AAWD,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,iBAAiB,GAAG,MAAM,EAAE,CAsB1E;AA0HD,OAAO,EACL,mBAAmB,EACnB,eAAe,EACf,wBAAwB,EACxB,aAAa,EACb,WAAW,EACX,oBAAoB,EACpB,uBAAuB,EACvB,sBAAsB,EACtB,oBAAoB,EACpB,WAAW,EACX,YAAY,EACZ,iBAAiB,EACjB,gBAAgB,EAChB,8BAA8B,EAC9B,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,aAAa,CAAC;AAuCrB,qBACa,UAAW,YAAW,UAAU;IAC3C,SAAS,CAAC,QAAQ,EAAE,kBAAkB,GAAG,IAAI;IAkC7C,MAAM,CAAC,YAAY,CAAC,OAAO,EAAE,sBAAsB,GAAG,aAAa;CAoZpE"}
+{"version":3,"file":"auth.module.d.ts","sourceRoot":"","sources":["../src/auth.module.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,aAAa,EACb,kBAAkB,EAElB,UAAU,EAGX,MAAM,gBAAgB,CAAC;AAIxB,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AA0B3D,OAAO,EAAE,eAAe,EAAE,MAAM,wCAAwC,CAAC;AACzE,OAAO,EAAE,SAAS,EAAE,MAAM,kCAAkC,CAAC;AAC7D,OAAO,EAAE,aAAa,EAAE,MAAM,sCAAsC,CAAC;AACrE,OAAO,EAAE,WAAW,EAAE,MAAM,oCAAoC,CAAC;AACjE,OAAO,EAAE,mBAAmB,EAAE,MAAM,6CAA6C,CAAC;AAClF,OAAO,EAAE,uBAAuB,EAAE,MAAM,iDAAiD,CAAC;AAC1F,OAAO,EAAE,uBAAuB,EAAE,MAAM,gDAAgD,CAAC;AACzF,OAAO,EAAE,qBAAqB,EAAE,MAAM,+CAA+C,CAAC;AACtF,OAAO,EAAE,oBAAoB,EAAE,MAAM,6CAA6C,CAAC;AACnF,OAAO,EAAE,WAAW,EAAE,MAAM,oCAAoC,CAAC;AAYjE,OAAO,EAAE,iBAAiB,EAAE,MAAM,0CAA0C,CAAC;AAC7E,OAAO,EAAE,gBAAgB,EAAE,MAAM,yCAAyC,CAAC;AAC3E,OAAO,EAAE,eAAe,EAAE,MAAM,wCAAwC,CAAC;AACzE,OAAO,EAAE,6BAA6B,EAAE,MAAM,uDAAuD,CAAC;AACtG,OAAO,EAAE,kBAAkB,EAAE,MAAM,4CAA4C,CAAC;AAChF,OAAO,EAAE,iBAAiB,EAAE,MAAM,2CAA2C,CAAC;AA+B9E,OAAO,EAAE,oBAAoB,EAAE,MAAM,+CAA+C,CAAC;AAGrF,OAAO,EAAE,YAAY,EAAE,MAAM,qCAAqC,CAAC;AAEnE,OAAO,EAAE,kBAAkB,EAAE,MAAM,4CAA4C,CAAC;AAIhF,OAAO,EAAE,YAAY,EAAE,MAAM,qCAAqC,CAAC;AACnE,OAAO,EAAE,sBAAsB,EAAE,MAAM,gDAAgD,CAAC;AAKxF,OAAO,EAAE,mBAAmB,EAAE,MAAM,8CAA8C,CAAC;AAwBnF,MAAM,WAAW,iBAAiB;IAMhC,sBAAsB,EAAE,eAAe,CAAC;IAOxC,8BAA8B,EAAE,uBAAuB,CAAC;IAOxD,oBAAoB,CAAC,EAAE,aAAa,CAAC;IAOrC,kBAAkB,CAAC,EAAE,WAAW,CAAC;IAMjC,sBAAsB,CAAC,EAAE,mBAAmB,CAAC;IAM7C,8BAA8B,CAAC,EAAE,uBAAuB,CAAC;IAMzD,4BAA4B,CAAC,EAAE,qBAAqB,CAAC;IAMrD,2BAA2B,CAAC,EAAE,oBAAoB,CAAC;IAQnD,kBAAkB,CAAC,EAAE,WAAW,CAAC;IAQjC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAQ5B,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAQhC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAQ1B,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAMhC,MAAM,CAAC,EAAE;QACP,UAAU,EAAE,MAAM,CAAC;QACnB,SAAS,EAAE,MAAM,CAAC;QAClB,WAAW,EAAE,MAAM,CAAC;KACrB,CAAC;IAMF,QAAQ,CAAC,EAAE;QACT,MAAM,EAAE,MAAM,CAAC;QACf,SAAS,EAAE,MAAM,CAAC;QAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;KACnB,CAAC;IAOF,OAAO,CAAC,EAAE,MAAM,CAAC;IASjB,wBAAwB,CAAC,EAAE,iBAAiB,CAAC;IAS7C,uBAAuB,CAAC,EAAE,gBAAgB,CAAC;IAa3C,sBAAsB,CAAC,EAAE,eAAe,CAAC;IAKzC,KAAK,CAAC,EAAE;QA4BN,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,KAAK,OAAO,CAAC;KAChE,CAAC;IAQF,oCAAoC,CAAC,EAAE,6BAA6B,CAAC;IAOrE,yBAAyB,CAAC,EAAE,kBAAkB,CAAC;IAO/C,wBAAwB,CAAC,EAAE,iBAAiB,CAAC;IAK7C,MAAM,CAAC,EAAE;QAMP,UAAU,CAAC,EAAE,MAAM,CAAC;QAOpB,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,CAAC;IAmBF,aAAa,CAAC,EAAE,MAAM,GAAG,cAAc,CAAC;IAyBxC,YAAY,CAAC,EAAE,CAAC,IAAI,EAAE,SAAS,KAAK,OAAO,CAAC;IAO5C,YAAY,CAAC,EAAE,MAAM,CAAC;IAmBtB,QAAQ,CAAC,EAAE;QAOT,0BAA0B,CAAC,EAAE,OAAO,CAAC;QAQrC,UAAU,CAAC,EAAE,OAAO,CAAC;QAOrB,gBAAgB,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;KACrC,CAAC;IAMF,MAAM,CAAC,EAAE;QAEP,QAAQ,CAAC,EAAE,OAAO,CAAC;QAEnB,MAAM,CAAC,EAAE,OAAO,CAAC;QAEjB,QAAQ,CAAC,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,CAAC;QAErC,MAAM,CAAC,EAAE,MAAM,CAAC;QAEhB,IAAI,CAAC,EAAE,MAAM,CAAC;QAEd,iBAAiB,CAAC,EAAE,MAAM,CAAC;QAE3B,kBAAkB,CAAC,EAAE,MAAM,CAAC;QAE5B,eAAe,CAAC,EAAE,MAAM,CAAC;QAEzB,gBAAgB,CAAC,EAAE,MAAM,CAAC;QAc1B,aAAa,CAAC,EAAE,OAAO,CAAC;KACzB,CAAC;IAMF,IAAI,CAAC,EAAE;QAEL,UAAU,CAAC,EAAE,MAAM,CAAC;QAEpB,mBAAmB,CAAC,EAAE,OAAO,CAAC;QAE9B,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;QAc5B,SAAS,CAAC,EAAE,QAAQ,GAAG,MAAM,CAAC;KAC/B,CAAC;IAMF,SAAS,EAAE,MAAM,CAAC;IAMlB,YAAY,CAAC,EAAE,MAAM,CAAC;IAMtB,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAK/B,KAAK,CAAC,EAAE;QACN,MAAM,CAAC,EAAE;YACP,QAAQ,EAAE,MAAM,CAAC;YACjB,YAAY,EAAE,MAAM,CAAC;YACrB,WAAW,EAAE,MAAM,CAAC;SACrB,CAAC;QACF,QAAQ,CAAC,EAAE;YACT,QAAQ,EAAE,MAAM,CAAC;YACjB,YAAY,EAAE,MAAM,CAAC;YACrB,WAAW,EAAE,MAAM,CAAC;SACrB,CAAC;KACH,CAAC;IAOF,aAAa,CAAC,EAAE,MAAM,CAAC;IAsBvB,cAAc,CAAC,EAAE,oBAAoB,CAAC;IAqBtC,mBAAmB,CAAC,EAAE,YAAY,CAAC;IAWnC,yBAAyB,CAAC,EAAE,MAAM,CAAC;IAenC,yBAAyB,CAAC,EAAE,kBAAkB,CAAC;IAuB/C,UAAU,CAAC,EAAE;QAeX,WAAW,CAAC,EAAE;YAEZ,WAAW,EAAE,MAAM,CAAC;YAEpB,QAAQ,EAAE,MAAM,CAAC;SAClB,CAAC;KACH,CAAC;IAiBF,KAAK,CAAC,EAAE;QAEN,MAAM,EAAE,YAAY,CAAC;QAErB,IAAI,EAAE;YAAE,KAAK,EAAE,MAAM,CAAC;YAAC,IAAI,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;QAEvC,QAAQ,CAAC,EAAE,mBAAmB,CAAC;QAE/B,gBAAgB,CAAC,EAAE,sBAAsB,CAAC;KAC3C,CAAC;IAKF,YAAY,CAAC,EAAE;QAEb,WAAW,CAAC,EAAE,MAAM,CAAC;QAErB,qBAAqB,CAAC,EAAE,MAAM,CAAC;QAe/B,OAAO,CAAC,EAAE,MAAM,GAAG,2BAA2B,CAAC;KAChD,CAAC;CACH;AASD,MAAM,MAAM,2BAA2B,GAAG,CAAC,KAAK,CAAC,EAAE,MAAM,KAAK,MAAM,CAAC;AAKrE,MAAM,WAAW,sBAAuB,SAAQ,IAAI,CAAC,cAAc,EAAE,SAAS,CAAC;IAC7E,UAAU,EAAE,CACV,GAAG,IAAI,EAAE,GAAG,EAAE,KACX,OAAO,CAAC,iBAAiB,CAAC,GAAG,iBAAiB,CAAC;IACpD,MAAM,CAAC,EAAE,GAAG,EAAE,CAAC;IAef,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B;AAgCD,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,iBAAiB,GAAG,IAAI,CAyCvE;AA2ED,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,iBAAiB,GAAG,MAAM,EAAE,CAwB7E;AASD,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,iBAAiB,GAAG,MAAM,EAAE,CA0BxE;AAWD,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,iBAAiB,GAAG,MAAM,EAAE,CAsB1E;AAsKD,OAAO,EACL,mBAAmB,EACnB,eAAe,EACf,wBAAwB,EACxB,aAAa,EACb,WAAW,EACX,oBAAoB,EACpB,uBAAuB,EACvB,sBAAsB,EACtB,oBAAoB,EACpB,WAAW,EACX,YAAY,EACZ,iBAAiB,EACjB,gBAAgB,EAChB,8BAA8B,EAC9B,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,aAAa,CAAC;AAuCrB,qBACa,UAAW,YAAW,UAAU;IAC3C,SAAS,CAAC,QAAQ,EAAE,kBAAkB,GAAG,IAAI;IAkC7C,MAAM,CAAC,YAAY,CAAC,OAAO,EAAE,sBAAsB,GAAG,aAAa;CAwZpE"}

package/dist/auth.module.js

@@ -40,12 +40,14 @@ const noop_email_service_1 = require("./services/noop-email.service");
 const noop_sms_service_1 = require("./services/noop-sms.service");
 const tenant_guard_1 = require("./guards/tenant.guard");
 const permission_guard_1 = require("./guards/permission.guard");
+const scope_guard_1 = require("./guards/scope.guard");
 const api_key_strategy_1 = require("./strategies/api-key.strategy");
 const default_jwt_payload_factory_1 = require("./services/default-jwt-payload-factory");
 const constants_1 = require("./constants");
 const in_memory_rate_limiter_service_1 = require("./services/in-memory-rate-limiter.service");
 const in_memory_refresh_retry_cache_1 = require("./services/in-memory-refresh-retry-cache");
 const invalid_auth_config_exception_1 = require("./exceptions/invalid-auth-config.exception");
+const verification_base_url_1 = require("./utils/verification-base-url");
 const configurable_email_service_1 = require("./services/configurable-email.service");
 const default_email_template_renderer_1 = require("./services/default-email-template-renderer");
 function validateAuthModuleOptions(opts) {
@@ -53,6 +55,7 @@ function validateAuthModuleOptions(opts) {
     validateRealmOptions(opts);
     validateRefreshRetryOptions(opts);
     validateCsrfOptions(opts);
+    validateApiKeyOptions(opts);
     const ipRateLimit = opts.bruteForce?.ipRateLimit;
     if (ipRateLimit && !opts.rateLimiterInstance) {
         throw new invalid_auth_config_exception_1.InvalidAuthConfigException('[AuthModule] bruteForce.ipRateLimit is configured but rateLimiterInstance ' +
@@ -138,6 +141,10 @@ function describeIgnoredOptions(opts) {
             'which is not set, so no request is asked for a realm and none needs skipping. ' +
             'Remove realm.skip, or set realmExtractorInstance.');
     }
+    if (opts.apiKey?.prefix !== undefined && !opts.apiKeyRepositoryInstance) {
+        messages.push('[AuthModule] apiKey.prefix is ignored: API key authentication is enabled by ' +
+            '`apiKeyRepositoryInstance`, which is not set. Remove it, or set apiKeyRepositoryInstance.');
+    }
     if (opts.refreshRetryCacheInstance && opts.refreshGracePeriodSeconds === 0) {
         messages.push('[AuthModule] refreshRetryCacheInstance is ignored: refreshGracePeriodSeconds is 0, ' +
             'which turns refresh retries off. Remove one of the two.');
@@ -160,6 +167,20 @@ function describeInMemoryDefaults(opts) {
     }
     return messages;
 }
+function validateApiKeyOptions(opts) {
+    const headerName = opts.apiKey?.headerName;
+    if (headerName !== undefined &&
+        (typeof headerName !== 'string' ||
+            !/^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/.test(headerName) ||
+            headerName.toLowerCase() === 'authorization')) {
+        throw new invalid_auth_config_exception_1.InvalidAuthConfigException(`[AuthModule] apiKey.headerName must be a header name other than Authorization (which is always ` +
+            `read), e.g. 'X-API-Key'; received ${JSON.stringify(headerName)}.`);
+    }
+    const prefix = opts.apiKey?.prefix;
+    if (prefix !== undefined && (typeof prefix !== 'string' || prefix === '')) {
+        throw new invalid_auth_config_exception_1.InvalidAuthConfigException(`[AuthModule] apiKey.prefix must be a non-empty string, e.g. 'ait_'; received ${JSON.stringify(prefix)}.`);
+    }
+}
 function validateCsrfOptions(opts) {
     const webSocket = opts.csrf?.webSocket;
     if (webSocket === undefined || webSocket === 'reject' || webSocket === 'skip') {
@@ -199,22 +220,32 @@ function validateVerificationOptions(opts) {
             'is not set. Token-mode emails contain a link and no readable code, so ' +
             'without a base URL every verification and password-reset email would be ' +
             'unusable. Set verification.baseUrl to the absolute URL of your frontend ' +
-            "(e.g. 'https://app.example.com'); the package appends /verify-email and " +
-            '/reset-password with `token` and `email` query parameters. To keep using ' +
-            "6-digit codes instead, set features.verificationMode to 'code'.");
+            "(e.g. 'https://app.example.com'), or to a resolver taking the realm; the " +
+            'package appends /verify-email and /reset-password with `token` and `email` ' +
+            "query parameters. To keep using 6-digit codes instead, set " +
+            "features.verificationMode to 'code'.");
+    }
+    if (typeof baseUrl === 'string') {
+        (0, verification_base_url_1.assertUsableBaseUrl)(baseUrl, 'verification.baseUrl');
+        return;
     }
-    let parsed;
+    let probed;
     try {
-        parsed = new URL(baseUrl);
+        probed = baseUrl(undefined);
     }
-    catch {
-        throw new invalid_auth_config_exception_1.InvalidAuthConfigException(`[AuthModule] verification.baseUrl must be an absolute URL; received "${baseUrl}". ` +
-            "Include the scheme and host, e.g. 'https://app.example.com'.");
+    catch (error) {
+        throw new invalid_auth_config_exception_1.InvalidAuthConfigException('[AuthModule] verification.baseUrl is a resolver that threw when called ' +
+            `with no realm: ${error instanceof Error ? error.message : String(error)}. ` +
+            'It must return an absolute URL for every request, including one with no ' +
+            'realm — realm.skip exempts requests, and a single-realm deployment has ' +
+            'none at all.');
     }
-    if (parsed.protocol !== 'https:' && parsed.protocol !== 'http:') {
-        throw new invalid_auth_config_exception_1.InvalidAuthConfigException(`[AuthModule] verification.baseUrl must use http or https; received "${baseUrl}". ` +
-            'Verification links are opened in a browser from an email client.');
+    if (typeof probed !== 'string' || probed.length === 0) {
+        throw new invalid_auth_config_exception_1.InvalidAuthConfigException('[AuthModule] verification.baseUrl is a resolver that returned ' +
+            `${probed === undefined ? 'undefined' : JSON.stringify(probed)} when called ` +
+            'with no realm. It must return an absolute http(s) URL string.');
     }
+    (0, verification_base_url_1.assertUsableBaseUrl)(probed, 'verification.baseUrl (resolver called with no realm)');
 }
 var constants_2 = require("./constants");
 Object.defineProperty(exports, "AUTH_MODULE_OPTIONS", { enumerable: true, get: function () { return constants_2.AUTH_MODULE_OPTIONS; } });
@@ -488,12 +519,13 @@ let AuthModule = AuthModule_1 = class AuthModule {
                         if (!options.apiKeyRepositoryInstance) {
                             return null;
                         }
-                        return new api_key_strategy_1.ApiKeyStrategy(options.apiKeyRepositoryInstance);
+                        return new api_key_strategy_1.ApiKeyStrategy(options.apiKeyRepositoryInstance, options.apiKey);
                     },
                 },
                 realm_middleware_1.RealmMiddleware,
                 tenant_guard_1.TenantGuard,
                 permission_guard_1.PermissionGuard,
+                scope_guard_1.ScopeGuard,
             ],
             exports: [
                 constants_1.AUTH_MODULE_OPTIONS,
@@ -517,6 +549,7 @@ let AuthModule = AuthModule_1 = class AuthModule {
                 constants_1.API_KEY_REPOSITORY,
                 tenant_guard_1.TenantGuard,
                 permission_guard_1.PermissionGuard,
+                scope_guard_1.ScopeGuard,
                 jwt_1.JwtModule,
                 passport_1.PassportModule,
             ],

package/dist/auth.module.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.module.js","sourceRoot":"","sources":["../src/auth.module.ts"],"names":[],"mappings":";;;;;;;;;;AAuuBA,8DAwCC;AA2ED,kEAwBC;AASD,wDAmBC;AAWD,4DAsBC;AA/6BD,2CAOwB;AACxB,oEAAgE;AAChE,qCAAwC;AACxC,+CAAkD;AAIlD,0DAAsD;AACtD,4EAAuE;AACvE,0EAAsE;AACtE,sEAAkE;AAClE,wEAAmE;AACnE,8FAAwF;AAExF,8EAAyE;AAEzE,8FAAyF;AACzF,wFAAkF;AAGlF,4DAAwD;AACxD,kEAA8D;AAC9D,sEAAkE;AAClE,4EAAuE;AACvE,gFAA2E;AAG3E,mEAA+D;AAe/D,8FAAyF;AACzF,4FAAsF;AACtF,wFAAmF;AACnF,8EAAsE;AACtE,yDAA+D;AAC/D,sEAAiE;AACjE,kEAA6D;AAW7D,wDAAoD;AACpD,gEAA4D;AAC5D,oEAA+D;AAC/D,wFAAkF;AAGlF,2CAkBqB;AAOrB,8FAAuF;AAEvF,4FAAqF;AAOrF,8FAAwF;AAExF,sFAAiF;AACjF,gGAA0F;AA0nB1F,SAAgB,yBAAyB,CAAC,IAAuB;IAC/D,2BAA2B,CAAC,IAAI,CAAC,CAAC;IAClC,oBAAoB,CAAC,IAAI,CAAC,CAAC;IAC3B,2BAA2B,CAAC,IAAI,CAAC,CAAC;IAClC,mBAAmB,CAAC,IAAI,CAAC,CAAC;IAE1B,MAAM,WAAW,GAAG,IAAI,CAAC,UAAU,EAAE,WAAW,CAAC;IAEjD,IAAI,WAAW,IAAI,CAAC,IAAI,CAAC,mBAAmB,EAAE,CAAC;QAC7C,MAAM,IAAI,0DAA0B,CAClC,4EAA4E;YAC1E,qEAAqE;YACrE,qEAAqE;YACrE,4EAA4E;YAC5E,+DAA+D;YAC/D,2EAA2E;YAC3E,sEAAsE,CACzE,CAAC;IACJ,CAAC;IAED,IAAI,WAAW,EAAE,CAAC;QAChB,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,GAAG,WAAW,CAAC;QAE9C,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,CAAC,IAAI,WAAW,IAAI,CAAC,EAAE,CAAC;YACvD,MAAM,IAAI,0DAA0B,CAClC,wFAAwF,MAAM,CAC5F,WAAW,CACZ,qEAAqE;gBACpE,sEAAsE,CACzE,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,QAAQ,IAAI,CAAC,EAAE,CAAC;YACjD,MAAM,IAAI,0DAA0B,CAClC,qFAAqF,MAAM,CACzF,QAAQ,CACT,2EAA2E,CAC7E,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAKD,MAAM,kBAAkB,GAAG,CAAC,YAAY,EAAE,4BAA4B,EAAE,kBAAkB,CAAU,CAAC;AASrG,MAAM,qBAAqB,GAMvB;IACF,iBAAiB,EAAE;QACjB,YAAY,EACV,qHAAqH;QACvH,MAAM,EAAE;YACN,CAAC,mCAAmC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,oBAAoB,CAAC,CAAC;YACxF,CAAC,kCAAkC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,8BAA8B,CAAC,CAAC;SACvF;KACF;IACD,eAAe,EAAE;QACf,YAAY,EACV,sGAAsG;QACxG,MAAM,EAAE;YACN,CAAC,sBAAsB,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC;YAC9D,CAAC,kCAAkC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,8BAA8B,CAAC,CAAC;SACvF;KACF;IACD,WAAW,EAAE;QACX,YAAY,EAAE,6CAA6C;QAC3D,MAAM,EAAE,CAAC,CAAC,yBAAyB,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;KACjF;IACD,aAAa,EAAE;QACb,YAAY,EAAE,iDAAiD;QAC/D,MAAM,EAAE;YACN,CAAC,2BAA2B,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;YAC1E,CAAC,+BAA+B,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC;SACnF;KACF;IACD,aAAa,EAAE;QACb,YAAY,EAAE,sEAAsE;QACpF,MAAM,EAAE,CAAC,CAAC,+BAA+B,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,2BAA2B,CAAC,CAAC,CAAC;KAC3F;IACD,oBAAoB,EAAE;QACpB,YAAY,EACV,oGAAoG;QACtG,MAAM,EAAE,CAAC,CAAC,gCAAgC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,4BAA4B,CAAC,CAAC,CAAC;KAC7F;IACD,YAAY,EAAE;QACZ,YAAY,EACV,gHAAgH;QAClH,MAAM,EAAE,CAAC,CAAC,4BAA4B,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC;KACrF;CACF,CAAC;AAaF,SAAgB,2BAA2B,CAAC,IAAuB;IACjE,MAAM,SAAS,GAAsB,kBAAkB,CAAC;IAExD,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC;SACpC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;SACzC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;QACX,MAAM,OAAO,GAAG,qBAAqB,CAAC,GAAG,CAAC,CAAC;QAE3C,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,CACL,yBAAyB,GAAG,yCAAyC;gBACrE,oCAAoC,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CACrE,CAAC;QACJ,CAAC;QAED,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM;aACzB,GAAG,CAAC,CAAC,CAAC,OAAO,EAAE,UAAU,CAAC,EAAE,EAAE,CAAC,GAAG,OAAO,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;aACvF,IAAI,CAAC,IAAI,CAAC,CAAC;QAEd,OAAO,CACL,yBAAyB,GAAG,qEAAqE;YACjG,GAAG,OAAO,CAAC,YAAY,4BAA4B,KAAK,mBAAmB,CAC5E,CAAC;IACJ,CAAC,CAAC,CAAC;AACP,CAAC;AASD,SAAgB,sBAAsB,CAAC,IAAuB;IAC5D,MAAM,QAAQ,GAAG,2BAA2B,CAAC,IAAI,CAAC,CAAC;IAEnD,IAAI,IAAI,CAAC,KAAK,EAAE,IAAI,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,sBAAsB,EAAE,CAAC;QACnE,QAAQ,CAAC,IAAI,CACX,sFAAsF;YACpF,gFAAgF;YAChF,mDAAmD,CACtD,CAAC;IACJ,CAAC;IAED,IAAI,IAAI,CAAC,yBAAyB,IAAI,IAAI,CAAC,yBAAyB,KAAK,CAAC,EAAE,CAAC;QAC3E,QAAQ,CAAC,IAAI,CACX,qFAAqF;YACnF,yDAAyD,CAC5D,CAAC;IACJ,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAWD,SAAgB,wBAAwB,CAAC,IAAuB;IAC9D,MAAM,QAAQ,GAAa,EAAE,CAAC;IAE9B,IAAI,CAAC,IAAI,CAAC,mBAAmB,EAAE,CAAC;QAC9B,QAAQ,CAAC,IAAI,CACX,4FAA4F;YAC1F,yFAAyF;YACzF,6EAA6E;YAC7E,kEAAkE,CACrE,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,IAAI,CAAC,yBAAyB,IAAI,IAAI,CAAC,yBAAyB,KAAK,CAAC,EAAE,CAAC;QAC5E,QAAQ,CAAC,IAAI,CACX,wFAAwF;YACtF,0FAA0F;YAC1F,0FAA0F;YAC1F,6FAA6F,CAChG,CAAC;IACJ,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAOD,SAAS,mBAAmB,CAAC,IAAuB;IAClD,MAAM,SAAS,GAAY,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC;IAChD,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,KAAK,QAAQ,IAAI,SAAS,KAAK,MAAM,EAAE,CAAC;QAC9E,OAAO;IACT,CAAC;IACD,MAAM,IAAI,0DAA0B,CAClC,oEAAoE,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,GAAG,CACjG,CAAC;AACJ,CAAC;AAQD,SAAS,2BAA2B,CAAC,IAAuB;IAC1D,MAAM,WAAW,GAAG,IAAI,CAAC,yBAAyB,CAAC;IAEnD,IAAI,WAAW,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,CAAC,IAAI,WAAW,GAAG,CAAC,CAAC,EAAE,CAAC;QACrF,MAAM,IAAI,0DAA0B,CAClC,mFAAmF,MAAM,CACvF,WAAW,CACZ,sCAAsC,CACxC,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAG,IAAI,CAAC,yBAAyB,CAAC;IAC7C,IAAI,KAAK,IAAI,CAAC,CAAC,KAAK,YAAY,yDAAyB,CAAC,IAAI,WAAW,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;QACvG,MAAM,IAAI,0DAA0B,CAClC,sFAAsF;YACpF,wFAAwF;YACxF,0FAA0F;YAC1F,0BAA0B,CAC7B,CAAC;IACJ,CAAC;AACH,CAAC;AAUD,SAAS,oBAAoB,CAAC,IAAuB;IACnD,MAAM,IAAI,GAAY,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC;IAEvC,IAAI,CAAC,IAAI,CAAC,sBAAsB,IAAI,IAAI,KAAK,SAAS,IAAI,OAAO,IAAI,KAAK,UAAU,EAAE,CAAC;QACrF,OAAO;IACT,CAAC;IAED,MAAM,IAAI,0DAA0B,CAClC,mFACE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,IAC5C,6EAA6E;QAC3E,oFAAoF;QACpF,gCAAgC,CACnC,CAAC;AACJ,CAAC;AAcD,SAAS,2BAA2B,CAAC,IAAuB;IAC1D,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,gBAAgB,IAAI,MAAM,CAAC,KAAK,OAAO,EAAE,CAAC;QAC5D,OAAO;IACT,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,EAAE,OAAO,CAAC;IAE3C,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,0DAA0B,CAClC,6EAA6E;YAC3E,wEAAwE;YACxE,0EAA0E;YAC1E,0EAA0E;YAC1E,0EAA0E;YAC1E,2EAA2E;YAC3E,iEAAiE,CACpE,CAAC;IACJ,CAAC;IAED,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,0DAA0B,CAClC,wEAAwE,OAAO,KAAK;YAClF,8DAA8D,CACjE,CAAC;IACJ,CAAC;IAED,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QAChE,MAAM,IAAI,0DAA0B,CAClC,uEAAuE,OAAO,KAAK;YACjF,kEAAkE,CACrE,CAAC;IACJ,CAAC;AACH,CAAC;AAMD,yCAiBqB;AAhBnB,gHAAA,mBAAmB,OAAA;AACnB,4GAAA,eAAe,OAAA;AACf,qHAAA,wBAAwB,OAAA;AACxB,0GAAA,aAAa,OAAA;AACb,wGAAA,WAAW,OAAA;AACX,iHAAA,oBAAoB,OAAA;AACpB,oHAAA,uBAAuB,OAAA;AACvB,mHAAA,sBAAsB,OAAA;AACtB,iHAAA,oBAAoB,OAAA;AACpB,wGAAA,WAAW,OAAA;AACX,yGAAA,YAAY,OAAA;AACZ,8GAAA,iBAAiB,OAAA;AACjB,6GAAA,gBAAgB,OAAA;AAChB,2HAAA,8BAA8B,OAAA;AAC9B,gHAAA,mBAAmB,OAAA;AACnB,+GAAA,kBAAkB,OAAA;AAyCb,IAAM,UAAU,kBAAhB,MAAM,UAAU;IACrB,SAAS,CAAC,QAA4B;QACpC,QAAQ,CAAC,KAAK,CAAC,kCAAe,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IACjD,CAAC;IAgCD,MAAM,CAAC,YAAY,CAAC,OAA+B;QACjD,MAAM,eAAe,GAAa;YAChC,OAAO,EAAE,+BAAmB;YAC5B,UAAU,EAAE,KAAK,EAAE,GAAG,IAAW,EAAE,EAAE;gBACnC,MAAM,IAAI,GAAsB,MAAM,OAAO,CAAC,UAAU,CAAC,GAAG,IAAI,CAAC,CAAC;gBAIlE,yBAAyB,CAAC,IAAI,CAAC,CAAC;gBAIhC,KAAK,MAAM,OAAO,IAAI,sBAAsB,CAAC,IAAI,CAAC,EAAE,CAAC;oBACnD,eAAM,CAAC,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;gBACrC,CAAC;gBAID,KAAK,MAAM,OAAO,IAAI,wBAAwB,CAAC,IAAI,CAAC,EAAE,CAAC;oBACrD,eAAM,CAAC,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;gBACrC,CAAC;gBAKD,IAAA,sCAAsB,EAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC;gBAGxE,IAAI,IAAI,CAAC,MAAM,EAAE,aAAa,EAAE,CAAC;oBAC/B,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;wBACjC,MAAM,IAAI,KAAK,CACb,kFAAkF;4BAClF,8CAA8C,CAC/C,CAAC;oBACJ,CAAC;oBACD,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,GAAG,EAAE,CAAC;wBACjD,MAAM,IAAI,KAAK,CACb,+EAA+E;4BAC/E,qCAAqC,CACtC,CAAC;oBACJ,CAAC;oBACD,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;wBACvB,MAAM,IAAI,KAAK,CACb,wEAAwE;4BACxE,oDAAoD,CACrD,CAAC;oBACJ,CAAC;gBACH,CAAC;gBAED,OAAO,IAAI,CAAC;YACd,CAAC;YACD,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,EAAE;SAC7B,CAAC;QAEF,OAAO;YACL,MAAM,EAAE,YAAU;YAClB,MAAM,EAAE,IAAI;YACZ,OAAO,EAAE;gBACP,GAAG,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC;gBAC1B,yBAAc,CAAC,QAAQ,CAAC,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC;gBACnD,eAAS,CAAC,aAAa,CAAC;oBACtB,MAAM,EAAE,CAAC,+BAAmB,CAAC;oBAC7B,UAAU,EAAE,KAAK,EAAE,aAAgC,EAAE,EAAE,CAAC,CAAC;wBACvD,MAAM,EAAE,aAAa,CAAC,SAAS;wBAC/B,WAAW,EAAE;4BACX,SAAS,EAAE,CAAC,aAAa,CAAC,YAAY,IAAI,KAAK,CAAQ;yBACxD;qBACF,CAAC;iBACH,CAAC;aACH;YACD,WAAW,EAAE,OAAO,CAAC,eAAe,KAAK,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,kCAAe,CAAC;YACvE,SAAS,EAAE;gBACT,eAAe;gBAGf;oBACE,OAAO,EAAE,2BAAe;oBACxB,MAAM,EAAE,CAAC,+BAAmB,CAAC;oBAC7B,UAAU,EAAE,CAAC,IAAuB,EAAE,EAAE;wBACtC,IAAI,CAAC,IAAI,CAAC,sBAAsB,EAAE,CAAC;4BACjC,MAAM,IAAI,KAAK,CACb,+BAA+B;gCAC/B,iHAAiH,CAClH,CAAC;wBACJ,CAAC;wBACD,OAAO,IAAI,CAAC,sBAAsB,CAAC;oBACrC,CAAC;iBACF;gBAGD;oBACE,OAAO,EAAE,oCAAwB;oBACjC,MAAM,EAAE,CAAC,+BAAmB,CAAC;oBAC7B,UAAU,EAAE,CAAC,IAAuB,EAAE,EAAE;wBACtC,IAAI,CAAC,IAAI,CAAC,8BAA8B,EAAE,CAAC;4BACzC,MAAM,IAAI,KAAK,CACb,wCAAwC;gCACxC,gIAAgI,CACjI,CAAC;wBACJ,CAAC;wBACD,OAAO,IAAI,CAAC,8BAA8B,CAAC;oBAC7C,CAAC;iBACF;gBAGD;oBACE,OAAO,EAAE,mCAAuB;oBAChC,MAAM,EAAE,CAAC,+BAAmB,CAAC;oBAC7B,UAAU,EAAE,CAAC,IAAuB,EAAE,EAAE;wBACtC,OAAO,IAAI,CAAC,8BAA8B,IAAI,IAAI,yDAA0B,EAAE,CAAC;oBACjF,CAAC;iBACF;gBAGD;oBACE,OAAO,EAAE,kCAAsB;oBAC/B,MAAM,EAAE,CAAC,+BAAmB,CAAC;oBAC7B,UAAU,EAAE,CAAC,IAAuB,EAAE,EAAE;wBACtC,OAAO,IAAI,CAAC,4BAA4B,IAAI,IAAI,sDAAwB,EAAE,CAAC;oBAC7E,CAAC;iBACF;gBAGD;oBACE,OAAO,EAAE,gCAAoB;oBAC7B,MAAM,EAAE,CAAC,+BAAmB,CAAC;oBAC7B,UAAU,EAAE,CAAC,IAAuB,EAAE,EAAE;wBACtC,OAAO,IAAI,CAAC,2BAA2B,IAAI,IAAI,mDAAuB,EAAE,CAAC;oBAC3E,CAAC;iBACF;gBAMD;oBACE,OAAO,EAAE,yBAAa;oBACtB,MAAM,EAAE,CAAC,+BAAmB,CAAC;oBAC7B,UAAU,EAAE,CAAC,IAAuB,EAAE,EAAE;wBACtC,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;4BACf,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,gBAAgB;mCACvC,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ;oCACrB,CAAC,CAAC,IAAI,8DAA4B,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC;oCACvD,CAAC,CAAC,SAAS,CAAC,CAAC;4BAEjB,IAAI,CAAC,QAAQ,EAAE,CAAC;gCACd,MAAM,IAAI,KAAK,CACb,oEAAoE;oCACpE,iDAAiD;oCACjD,iFAAiF,CAClF,CAAC;4BACJ,CAAC;4BAED,MAAM,IAAI,GAAG;gCACX,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK;gCAC5B,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,OAAO;6BAC3D,CAAC;4BAEF,MAAM,gBAAgB,GAAG,IAAI,CAAC,QAAQ,EAAE,gBAAgB,IAAI,MAAM,CAAC;4BAEnE,OAAO,IAAI,qDAAwB,CACjC,QAAQ,EACR,IAAI,CAAC,KAAK,CAAC,MAAM,EACjB,IAAI,EACJ,gBAAgB,CACjB,CAAC;wBACJ,CAAC;wBACD,OAAO,IAAI,CAAC,oBAAoB,IAAI,IAAI,qCAAgB,EAAE,CAAC;oBAC7D,CAAC;iBACF;gBAGD;oBACE,OAAO,EAAE,uBAAW;oBACpB,MAAM,EAAE,CAAC,+BAAmB,CAAC;oBAC7B,UAAU,EAAE,CAAC,IAAuB,EAAE,EAAE;wBACtC,OAAO,IAAI,CAAC,kBAAkB,IAAI,IAAI,iCAAc,EAAE,CAAC;oBACzD,CAAC;iBACF;gBAGD;oBACE,OAAO,EAAE,gCAAoB;oBAC7B,MAAM,EAAE,CAAC,+BAAmB,CAAC;oBAC7B,UAAU,EAAE,CAAC,IAAuB,EAAE,EAAE;wBACtC,OAAO,IAAI,CAAC,sBAAsB,IAAI,EAAE,CAAC;oBAC3C,CAAC;iBACF;gBAGD;oBACE,OAAO,EAAE,uBAAW;oBACpB,MAAM,EAAE,CAAC,+BAAmB,CAAC;oBAC7B,UAAU,EAAE,CAAC,IAAuB,EAAE,EAAE;wBACtC,OAAO,IAAI,CAAC,kBAAkB,IAAI,IAAI,0CAAiB,EAAE,CAAC;oBAC5D,CAAC;iBACF;gBAGD;oBACE,OAAO,EAAE,wBAAY;oBACrB,MAAM,EAAE,CAAC,+BAAmB,CAAC;oBAC7B,UAAU,EAAE,CAAC,IAAuB,EAAE,EAAE;wBACtC,OAAO,IAAI,CAAC,mBAAmB,IAAI,IAAI,2DAA0B,EAAE,CAAC;oBACtE,CAAC;iBACF;gBAGD;oBACE,OAAO,EAAE,6BAAiB;oBAC1B,MAAM,EAAE,CAAC,+BAAmB,CAAC;oBAC7B,UAAU,EAAE,CAAC,IAAuB,EAAE,EAAE;wBACtC,OAAO,IAAI,CAAC,wBAAwB,IAAI,IAAI,CAAC;oBAC/C,CAAC;iBACF;gBAGD;oBACE,OAAO,EAAE,4BAAgB;oBACzB,MAAM,EAAE,CAAC,+BAAmB,CAAC;oBAC7B,UAAU,EAAE,CAAC,IAAuB,EAAE,EAAE;wBACtC,OAAO,IAAI,CAAC,uBAAuB,IAAI,IAAI,CAAC;oBAC9C,CAAC;iBACF;gBAGD;oBACE,OAAO,EAAE,2BAAe;oBACxB,MAAM,EAAE,CAAC,+BAAmB,CAAC;oBAC7B,UAAU,EAAE,CAAC,IAAuB,EAAE,EAAE;wBACtC,OAAO,IAAI,CAAC,sBAAsB,IAAI,IAAI,CAAC;oBAC7C,CAAC;iBACF;gBAGD;oBACE,OAAO,EAAE,0CAA8B;oBACvC,MAAM,EAAE,CAAC,+BAAmB,CAAC;oBAC7B,UAAU,EAAE,CAAC,IAAuB,EAAE,EAAE;wBACtC,OAAO,IAAI,CAAC,oCAAoC,IAAI,IAAI,CAAC;oBAC3D,CAAC;iBACF;gBAGD;oBACE,OAAO,EAAE,+BAAmB;oBAC5B,MAAM,EAAE,CAAC,+BAAmB,CAAC;oBAC7B,UAAU,EAAE,CAAC,IAAuB,EAAE,EAAE;wBACtC,OAAO,IAAI,CAAC,yBAAyB,IAAI,IAAI,sDAAwB,EAAE,CAAC;oBAC1E,CAAC;iBACF;gBAGD;oBACE,OAAO,EAAE,8BAAkB;oBAC3B,MAAM,EAAE,CAAC,+BAAmB,CAAC;oBAC7B,UAAU,EAAE,CAAC,IAAuB,EAAE,EAAE;wBACtC,OAAO,IAAI,CAAC,wBAAwB,IAAI,IAAI,CAAC;oBAC/C,CAAC;iBACF;gBAGD,0BAAW;gBACX,2CAAmB;gBACnB,0CAAmB;gBACnB,uCAAiB;gBACjB,4DAA2B;gBAE3B,6CAAoB;gBAEpB,6DAA4B;gBAC5B,sDAAwB;gBAGxB;oBACE,OAAO,EAAE,sCAAiB;oBAC1B,MAAM,EAAE,CAAC,+BAAmB,CAAC;oBAC7B,UAAU,EAAE,CAAC,OAA0B,EAAE,EAAE;wBACzC,OAAO,IAAI,sCAAiB,CAAC,OAAO,CAAC,CAAC;oBACxC,CAAC;iBACF;gBAGD;oBACE,OAAO,EAAE,0BAAW;oBACpB,MAAM,EAAE,CAAC,+BAAmB,EAAE,0BAAW,EAAE,+BAAmB,CAAC;oBAC/D,UAAU,EAAE,CACV,OAA0B,EAC1B,WAAwB,EACxB,iBAAqC,EACrC,EAAE;wBACF,OAAO,IAAI,0BAAW,CAAC,OAAO,EAAE,WAAW,EAAE,iBAAiB,CAAC,CAAC;oBAClE,CAAC;iBACF;gBACD;oBACE,OAAO,EAAE,gCAAc;oBACvB,MAAM,EAAE,CAAC,+BAAmB,CAAC;oBAC7B,UAAU,EAAE,CAAC,OAA0B,EAAE,EAAE;wBACzC,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC;wBAEjD,IAAI,CAAC,QAAQ,EAAE,CAAC;4BACd,eAAM,CAAC,IAAI,CACT,8HAA8H,EAC9H,YAAY,CACb,CAAC;4BACF,OAAO,IAAI,yCAAkB,EAAE,CAAC;wBAClC,CAAC;wBAGD,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC;4BAC3B,MAAM,IAAI,KAAK,CACb,uEAAuE;gCACvE,mEAAmE;gCACnE,0FAA0F,CAC3F,CAAC;wBACJ,CAAC;wBAED,OAAO,IAAI,gCAAc,CAAC,OAAO,CAAC,CAAC;oBACrC,CAAC;iBACF;gBACD;oBACE,OAAO,EAAE,oCAAgB;oBACzB,MAAM,EAAE,CAAC,+BAAmB,CAAC;oBAC7B,UAAU,EAAE,CAAC,OAA0B,EAAE,EAAE;wBACzC,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,EAAE,QAAQ,EAAE,QAAQ,CAAC;wBACnD,MAAM,YAAY,GAAG,OAAO,CAAC,KAAK,EAAE,QAAQ,EAAE,YAAY,CAAC;wBAE3D,IAAI,CAAC,QAAQ,IAAI,CAAC,YAAY,EAAE,CAAC;4BAC/B,eAAM,CAAC,IAAI,CACT,oJAAoJ,EACpJ,YAAY,CACb,CAAC;4BACF,OAAO,IAAI,6CAAoB,EAAE,CAAC;wBACpC,CAAC;wBAGD,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC;4BAC3B,MAAM,IAAI,KAAK,CACb,yEAAyE;gCACzE,mEAAmE;gCACnE,0FAA0F,CAC3F,CAAC;wBACJ,CAAC;wBAED,OAAO,IAAI,oCAAgB,CAAC,OAAO,CAAC,CAAC;oBACvC,CAAC;iBACF;gBAGD;oBACE,OAAO,EAAE,iCAAc;oBACvB,MAAM,EAAE,CAAC,+BAAmB,CAAC;oBAC7B,UAAU,EAAE,CAAC,OAA0B,EAAE,EAAE;wBACzC,IAAI,CAAC,OAAO,CAAC,wBAAwB,EAAE,CAAC;4BAEtC,OAAO,IAAI,CAAC;wBACd,CAAC;wBACD,OAAO,IAAI,iCAAc,CAAC,OAAO,CAAC,wBAAwB,CAAC,CAAC;oBAC9D,CAAC;iBACF;gBAGD,kCAAe;gBAGf,0BAAW;gBAGX,kCAAe;aAMhB;YACD,OAAO,EAAE;gBACP,+BAAmB;gBACnB,0BAAW;gBACX,2CAAmB;gBACnB,0CAAmB;gBACnB,sCAAiB;gBACjB,uCAAiB;gBACjB,4DAA2B;gBAE3B,6CAAoB;gBAEpB,6DAA4B;gBAC5B,sDAAwB;gBACxB,uBAAW;gBACX,2BAAe;gBACf,oCAAwB;gBACxB,6BAAiB;gBACjB,4BAAgB;gBAChB,2BAAe;gBACf,0CAA8B;gBAC9B,+BAAmB;gBACnB,8BAAkB;gBAClB,0BAAW;gBACX,kCAAe;gBACf,eAAS;gBACT,yBAAc;aACf;SACF,CAAC;IACJ,CAAC;CACF,CAAA;AAvbY,gCAAU;qBAAV,UAAU;IADtB,IAAA,eAAM,EAAC,EAAE,CAAC;GACE,UAAU,CAubtB"}
+{"version":3,"file":"auth.module.js","sourceRoot":"","sources":["../src/auth.module.ts"],"names":[],"mappings":";;;;;;;;;;AAoxBA,8DAyCC;AA2ED,kEAwBC;AASD,wDA0BC;AAWD,4DAsBC;AAp+BD,2CAOwB;AACxB,oEAAgE;AAChE,qCAAwC;AACxC,+CAAkD;AAIlD,0DAAsD;AACtD,4EAAuE;AACvE,0EAAsE;AACtE,sEAAkE;AAClE,wEAAmE;AACnE,8FAAwF;AAExF,8EAAyE;AAEzE,8FAAyF;AACzF,wFAAkF;AAGlF,4DAAwD;AACxD,kEAA8D;AAC9D,sEAAkE;AAClE,4EAAuE;AACvE,gFAA2E;AAG3E,mEAA+D;AAe/D,8FAAyF;AACzF,4FAAsF;AACtF,wFAAmF;AACnF,8EAAsE;AACtE,yDAA+D;AAC/D,sEAAiE;AACjE,kEAA6D;AAW7D,wDAAoD;AACpD,gEAA4D;AAC5D,sDAAkD;AAClD,oEAA+D;AAC/D,wFAAkF;AAGlF,2CAkBqB;AAOrB,8FAAuF;AAEvF,4FAAqF;AAOrF,8FAAwF;AACxF,yEAAoE;AAEpE,sFAAiF;AACjF,gGAA0F;AAqqB1F,SAAgB,yBAAyB,CAAC,IAAuB;IAC/D,2BAA2B,CAAC,IAAI,CAAC,CAAC;IAClC,oBAAoB,CAAC,IAAI,CAAC,CAAC;IAC3B,2BAA2B,CAAC,IAAI,CAAC,CAAC;IAClC,mBAAmB,CAAC,IAAI,CAAC,CAAC;IAC1B,qBAAqB,CAAC,IAAI,CAAC,CAAC;IAE5B,MAAM,WAAW,GAAG,IAAI,CAAC,UAAU,EAAE,WAAW,CAAC;IAEjD,IAAI,WAAW,IAAI,CAAC,IAAI,CAAC,mBAAmB,EAAE,CAAC;QAC7C,MAAM,IAAI,0DAA0B,CAClC,4EAA4E;YAC1E,qEAAqE;YACrE,qEAAqE;YACrE,4EAA4E;YAC5E,+DAA+D;YAC/D,2EAA2E;YAC3E,sEAAsE,CACzE,CAAC;IACJ,CAAC;IAED,IAAI,WAAW,EAAE,CAAC;QAChB,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,GAAG,WAAW,CAAC;QAE9C,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,CAAC,IAAI,WAAW,IAAI,CAAC,EAAE,CAAC;YACvD,MAAM,IAAI,0DAA0B,CAClC,wFAAwF,MAAM,CAC5F,WAAW,CACZ,qEAAqE;gBACpE,sEAAsE,CACzE,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,QAAQ,IAAI,CAAC,EAAE,CAAC;YACjD,MAAM,IAAI,0DAA0B,CAClC,qFAAqF,MAAM,CACzF,QAAQ,CACT,2EAA2E,CAC7E,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAKD,MAAM,kBAAkB,GAAG,CAAC,YAAY,EAAE,4BAA4B,EAAE,kBAAkB,CAAU,CAAC;AASrG,MAAM,qBAAqB,GAMvB;IACF,iBAAiB,EAAE;QACjB,YAAY,EACV,qHAAqH;QACvH,MAAM,EAAE;YACN,CAAC,mCAAmC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,oBAAoB,CAAC,CAAC;YACxF,CAAC,kCAAkC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,8BAA8B,CAAC,CAAC;SACvF;KACF;IACD,eAAe,EAAE;QACf,YAAY,EACV,sGAAsG;QACxG,MAAM,EAAE;YACN,CAAC,sBAAsB,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC;YAC9D,CAAC,kCAAkC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,8BAA8B,CAAC,CAAC;SACvF;KACF;IACD,WAAW,EAAE;QACX,YAAY,EAAE,6CAA6C;QAC3D,MAAM,EAAE,CAAC,CAAC,yBAAyB,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;KACjF;IACD,aAAa,EAAE;QACb,YAAY,EAAE,iDAAiD;QAC/D,MAAM,EAAE;YACN,CAAC,2BAA2B,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;YAC1E,CAAC,+BAA+B,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC;SACnF;KACF;IACD,aAAa,EAAE;QACb,YAAY,EAAE,sEAAsE;QACpF,MAAM,EAAE,CAAC,CAAC,+BAA+B,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,2BAA2B,CAAC,CAAC,CAAC;KAC3F;IACD,oBAAoB,EAAE;QACpB,YAAY,EACV,oGAAoG;QACtG,MAAM,EAAE,CAAC,CAAC,gCAAgC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,4BAA4B,CAAC,CAAC,CAAC;KAC7F;IACD,YAAY,EAAE;QACZ,YAAY,EACV,gHAAgH;QAClH,MAAM,EAAE,CAAC,CAAC,4BAA4B,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC;KACrF;CACF,CAAC;AAaF,SAAgB,2BAA2B,CAAC,IAAuB;IACjE,MAAM,SAAS,GAAsB,kBAAkB,CAAC;IAExD,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC;SACpC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;SACzC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;QACX,MAAM,OAAO,GAAG,qBAAqB,CAAC,GAAG,CAAC,CAAC;QAE3C,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,CACL,yBAAyB,GAAG,yCAAyC;gBACrE,oCAAoC,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CACrE,CAAC;QACJ,CAAC;QAED,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM;aACzB,GAAG,CAAC,CAAC,CAAC,OAAO,EAAE,UAAU,CAAC,EAAE,EAAE,CAAC,GAAG,OAAO,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;aACvF,IAAI,CAAC,IAAI,CAAC,CAAC;QAEd,OAAO,CACL,yBAAyB,GAAG,qEAAqE;YACjG,GAAG,OAAO,CAAC,YAAY,4BAA4B,KAAK,mBAAmB,CAC5E,CAAC;IACJ,CAAC,CAAC,CAAC;AACP,CAAC;AASD,SAAgB,sBAAsB,CAAC,IAAuB;IAC5D,MAAM,QAAQ,GAAG,2BAA2B,CAAC,IAAI,CAAC,CAAC;IAEnD,IAAI,IAAI,CAAC,KAAK,EAAE,IAAI,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,sBAAsB,EAAE,CAAC;QACnE,QAAQ,CAAC,IAAI,CACX,sFAAsF;YACpF,gFAAgF;YAChF,mDAAmD,CACtD,CAAC;IACJ,CAAC;IAED,IAAI,IAAI,CAAC,MAAM,EAAE,MAAM,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,wBAAwB,EAAE,CAAC;QACxE,QAAQ,CAAC,IAAI,CACX,8EAA8E;YAC5E,2FAA2F,CAC9F,CAAC;IACJ,CAAC;IAED,IAAI,IAAI,CAAC,yBAAyB,IAAI,IAAI,CAAC,yBAAyB,KAAK,CAAC,EAAE,CAAC;QAC3E,QAAQ,CAAC,IAAI,CACX,qFAAqF;YACnF,yDAAyD,CAC5D,CAAC;IACJ,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAWD,SAAgB,wBAAwB,CAAC,IAAuB;IAC9D,MAAM,QAAQ,GAAa,EAAE,CAAC;IAE9B,IAAI,CAAC,IAAI,CAAC,mBAAmB,EAAE,CAAC;QAC9B,QAAQ,CAAC,IAAI,CACX,4FAA4F;YAC1F,yFAAyF;YACzF,6EAA6E;YAC7E,kEAAkE,CACrE,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,IAAI,CAAC,yBAAyB,IAAI,IAAI,CAAC,yBAAyB,KAAK,CAAC,EAAE,CAAC;QAC5E,QAAQ,CAAC,IAAI,CACX,wFAAwF;YACtF,0FAA0F;YAC1F,0FAA0F;YAC1F,6FAA6F,CAChG,CAAC;IACJ,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAOD,SAAS,qBAAqB,CAAC,IAAuB;IACpD,MAAM,UAAU,GAAY,IAAI,CAAC,MAAM,EAAE,UAAU,CAAC;IACpD,IACE,UAAU,KAAK,SAAS;QACxB,CAAC,OAAO,UAAU,KAAK,QAAQ;YAC7B,CAAC,+BAA+B,CAAC,IAAI,CAAC,UAAU,CAAC;YACjD,UAAU,CAAC,WAAW,EAAE,KAAK,eAAe,CAAC,EAC/C,CAAC;QACD,MAAM,IAAI,0DAA0B,CAClC,iGAAiG;YAC/F,qCAAqC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,GAAG,CACrE,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAY,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC;IAC5C,IAAI,MAAM,KAAK,SAAS,IAAI,CAAC,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,EAAE,CAAC,EAAE,CAAC;QAC1E,MAAM,IAAI,0DAA0B,CAClC,gFAAgF,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,CAC1G,CAAC;IACJ,CAAC;AACH,CAAC;AAOD,SAAS,mBAAmB,CAAC,IAAuB;IAClD,MAAM,SAAS,GAAY,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC;IAChD,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,KAAK,QAAQ,IAAI,SAAS,KAAK,MAAM,EAAE,CAAC;QAC9E,OAAO;IACT,CAAC;IACD,MAAM,IAAI,0DAA0B,CAClC,oEAAoE,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,GAAG,CACjG,CAAC;AACJ,CAAC;AAQD,SAAS,2BAA2B,CAAC,IAAuB;IAC1D,MAAM,WAAW,GAAG,IAAI,CAAC,yBAAyB,CAAC;IAEnD,IAAI,WAAW,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,CAAC,IAAI,WAAW,GAAG,CAAC,CAAC,EAAE,CAAC;QACrF,MAAM,IAAI,0DAA0B,CAClC,mFAAmF,MAAM,CACvF,WAAW,CACZ,sCAAsC,CACxC,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAG,IAAI,CAAC,yBAAyB,CAAC;IAC7C,IAAI,KAAK,IAAI,CAAC,CAAC,KAAK,YAAY,yDAAyB,CAAC,IAAI,WAAW,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;QACvG,MAAM,IAAI,0DAA0B,CAClC,sFAAsF;YACpF,wFAAwF;YACxF,0FAA0F;YAC1F,0BAA0B,CAC7B,CAAC;IACJ,CAAC;AACH,CAAC;AAUD,SAAS,oBAAoB,CAAC,IAAuB;IACnD,MAAM,IAAI,GAAY,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC;IAEvC,IAAI,CAAC,IAAI,CAAC,sBAAsB,IAAI,IAAI,KAAK,SAAS,IAAI,OAAO,IAAI,KAAK,UAAU,EAAE,CAAC;QACrF,OAAO;IACT,CAAC;IAED,MAAM,IAAI,0DAA0B,CAClC,mFACE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,IAC5C,6EAA6E;QAC3E,oFAAoF;QACpF,gCAAgC,CACnC,CAAC;AACJ,CAAC;AAcD,SAAS,2BAA2B,CAAC,IAAuB;IAC1D,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,gBAAgB,IAAI,MAAM,CAAC,KAAK,OAAO,EAAE,CAAC;QAC5D,OAAO;IACT,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,EAAE,OAAO,CAAC;IAE3C,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,0DAA0B,CAClC,6EAA6E;YAC3E,wEAAwE;YACxE,0EAA0E;YAC1E,0EAA0E;YAC1E,2EAA2E;YAC3E,6EAA6E;YAC7E,6DAA6D;YAC7D,sCAAsC,CACzC,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;QAChC,IAAA,2CAAmB,EAAC,OAAO,EAAE,sBAAsB,CAAC,CAAC;QACrD,OAAO;IACT,CAAC;IAOD,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IAC9B,CAAC;IAAC,OAAO,KAAc,EAAE,CAAC;QACxB,MAAM,IAAI,0DAA0B,CAClC,yEAAyE;YACvE,kBAAkB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI;YAC5E,0EAA0E;YAC1E,yEAAyE;YACzE,cAAc,CACjB,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtD,MAAM,IAAI,0DAA0B,CAClC,gEAAgE;YAC9D,GAAG,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,eAAe;YAC7E,+DAA+D,CAClE,CAAC;IACJ,CAAC;IAED,IAAA,2CAAmB,EAAC,MAAM,EAAE,sDAAsD,CAAC,CAAC;AACtF,CAAC;AAMD,yCAiBqB;AAhBnB,gHAAA,mBAAmB,OAAA;AACnB,4GAAA,eAAe,OAAA;AACf,qHAAA,wBAAwB,OAAA;AACxB,0GAAA,aAAa,OAAA;AACb,wGAAA,WAAW,OAAA;AACX,iHAAA,oBAAoB,OAAA;AACpB,oHAAA,uBAAuB,OAAA;AACvB,mHAAA,sBAAsB,OAAA;AACtB,iHAAA,oBAAoB,OAAA;AACpB,wGAAA,WAAW,OAAA;AACX,yGAAA,YAAY,OAAA;AACZ,8GAAA,iBAAiB,OAAA;AACjB,6GAAA,gBAAgB,OAAA;AAChB,2HAAA,8BAA8B,OAAA;AAC9B,gHAAA,mBAAmB,OAAA;AACnB,+GAAA,kBAAkB,OAAA;AAyCb,IAAM,UAAU,kBAAhB,MAAM,UAAU;IACrB,SAAS,CAAC,QAA4B;QACpC,QAAQ,CAAC,KAAK,CAAC,kCAAe,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IACjD,CAAC;IAgCD,MAAM,CAAC,YAAY,CAAC,OAA+B;QACjD,MAAM,eAAe,GAAa;YAChC,OAAO,EAAE,+BAAmB;YAC5B,UAAU,EAAE,KAAK,EAAE,GAAG,IAAW,EAAE,EAAE;gBACnC,MAAM,IAAI,GAAsB,MAAM,OAAO,CAAC,UAAU,CAAC,GAAG,IAAI,CAAC,CAAC;gBAIlE,yBAAyB,CAAC,IAAI,CAAC,CAAC;gBAIhC,KAAK,MAAM,OAAO,IAAI,sBAAsB,CAAC,IAAI,CAAC,EAAE,CAAC;oBACnD,eAAM,CAAC,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;gBACrC,CAAC;gBAID,KAAK,MAAM,OAAO,IAAI,wBAAwB,CAAC,IAAI,CAAC,EAAE,CAAC;oBACrD,eAAM,CAAC,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;gBACrC,CAAC;gBAKD,IAAA,sCAAsB,EAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC;gBAGxE,IAAI,IAAI,CAAC,MAAM,EAAE,aAAa,EAAE,CAAC;oBAC/B,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;wBACjC,MAAM,IAAI,KAAK,CACb,kFAAkF;4BAClF,8CAA8C,CAC/C,CAAC;oBACJ,CAAC;oBACD,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,GAAG,EAAE,CAAC;wBACjD,MAAM,IAAI,KAAK,CACb,+EAA+E;4BAC/E,qCAAqC,CACtC,CAAC;oBACJ,CAAC;oBACD,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;wBACvB,MAAM,IAAI,KAAK,CACb,wEAAwE;4BACxE,oDAAoD,CACrD,CAAC;oBACJ,CAAC;gBACH,CAAC;gBAED,OAAO,IAAI,CAAC;YACd,CAAC;YACD,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,EAAE;SAC7B,CAAC;QAEF,OAAO;YACL,MAAM,EAAE,YAAU;YAClB,MAAM,EAAE,IAAI;YACZ,OAAO,EAAE;gBACP,GAAG,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC;gBAC1B,yBAAc,CAAC,QAAQ,CAAC,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC;gBACnD,eAAS,CAAC,aAAa,CAAC;oBACtB,MAAM,EAAE,CAAC,+BAAmB,CAAC;oBAC7B,UAAU,EAAE,KAAK,EAAE,aAAgC,EAAE,EAAE,CAAC,CAAC;wBACvD,MAAM,EAAE,aAAa,CAAC,SAAS;wBAC/B,WAAW,EAAE;4BACX,SAAS,EAAE,CAAC,aAAa,CAAC,YAAY,IAAI,KAAK,CAAQ;yBACxD;qBACF,CAAC;iBACH,CAAC;aACH;YACD,WAAW,EAAE,OAAO,CAAC,eAAe,KAAK,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,kCAAe,CAAC;YACvE,SAAS,EAAE;gBACT,eAAe;gBAGf;oBACE,OAAO,EAAE,2BAAe;oBACxB,MAAM,EAAE,CAAC,+BAAmB,CAAC;oBAC7B,UAAU,EAAE,CAAC,IAAuB,EAAE,EAAE;wBACtC,IAAI,CAAC,IAAI,CAAC,sBAAsB,EAAE,CAAC;4BACjC,MAAM,IAAI,KAAK,CACb,+BAA+B;gCAC/B,iHAAiH,CAClH,CAAC;wBACJ,CAAC;wBACD,OAAO,IAAI,CAAC,sBAAsB,CAAC;oBACrC,CAAC;iBACF;gBAGD;oBACE,OAAO,EAAE,oCAAwB;oBACjC,MAAM,EAAE,CAAC,+BAAmB,CAAC;oBAC7B,UAAU,EAAE,CAAC,IAAuB,EAAE,EAAE;wBACtC,IAAI,CAAC,IAAI,CAAC,8BAA8B,EAAE,CAAC;4BACzC,MAAM,IAAI,KAAK,CACb,wCAAwC;gCACxC,gIAAgI,CACjI,CAAC;wBACJ,CAAC;wBACD,OAAO,IAAI,CAAC,8BAA8B,CAAC;oBAC7C,CAAC;iBACF;gBAGD;oBACE,OAAO,EAAE,mCAAuB;oBAChC,MAAM,EAAE,CAAC,+BAAmB,CAAC;oBAC7B,UAAU,EAAE,CAAC,IAAuB,EAAE,EAAE;wBACtC,OAAO,IAAI,CAAC,8BAA8B,IAAI,IAAI,yDAA0B,EAAE,CAAC;oBACjF,CAAC;iBACF;gBAGD;oBACE,OAAO,EAAE,kCAAsB;oBAC/B,MAAM,EAAE,CAAC,+BAAmB,CAAC;oBAC7B,UAAU,EAAE,CAAC,IAAuB,EAAE,EAAE;wBACtC,OAAO,IAAI,CAAC,4BAA4B,IAAI,IAAI,sDAAwB,EAAE,CAAC;oBAC7E,CAAC;iBACF;gBAGD;oBACE,OAAO,EAAE,gCAAoB;oBAC7B,MAAM,EAAE,CAAC,+BAAmB,CAAC;oBAC7B,UAAU,EAAE,CAAC,IAAuB,EAAE,EAAE;wBACtC,OAAO,IAAI,CAAC,2BAA2B,IAAI,IAAI,mDAAuB,EAAE,CAAC;oBAC3E,CAAC;iBACF;gBAMD;oBACE,OAAO,EAAE,yBAAa;oBACtB,MAAM,EAAE,CAAC,+BAAmB,CAAC;oBAC7B,UAAU,EAAE,CAAC,IAAuB,EAAE,EAAE;wBACtC,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;4BACf,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,gBAAgB;mCACvC,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ;oCACrB,CAAC,CAAC,IAAI,8DAA4B,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC;oCACvD,CAAC,CAAC,SAAS,CAAC,CAAC;4BAEjB,IAAI,CAAC,QAAQ,EAAE,CAAC;gCACd,MAAM,IAAI,KAAK,CACb,oEAAoE;oCACpE,iDAAiD;oCACjD,iFAAiF,CAClF,CAAC;4BACJ,CAAC;4BAED,MAAM,IAAI,GAAG;gCACX,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK;gCAC5B,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,OAAO;6BAC3D,CAAC;4BAEF,MAAM,gBAAgB,GAAG,IAAI,CAAC,QAAQ,EAAE,gBAAgB,IAAI,MAAM,CAAC;4BAEnE,OAAO,IAAI,qDAAwB,CACjC,QAAQ,EACR,IAAI,CAAC,KAAK,CAAC,MAAM,EACjB,IAAI,EACJ,gBAAgB,CACjB,CAAC;wBACJ,CAAC;wBACD,OAAO,IAAI,CAAC,oBAAoB,IAAI,IAAI,qCAAgB,EAAE,CAAC;oBAC7D,CAAC;iBACF;gBAGD;oBACE,OAAO,EAAE,uBAAW;oBACpB,MAAM,EAAE,CAAC,+BAAmB,CAAC;oBAC7B,UAAU,EAAE,CAAC,IAAuB,EAAE,EAAE;wBACtC,OAAO,IAAI,CAAC,kBAAkB,IAAI,IAAI,iCAAc,EAAE,CAAC;oBACzD,CAAC;iBACF;gBAGD;oBACE,OAAO,EAAE,gCAAoB;oBAC7B,MAAM,EAAE,CAAC,+BAAmB,CAAC;oBAC7B,UAAU,EAAE,CAAC,IAAuB,EAAE,EAAE;wBACtC,OAAO,IAAI,CAAC,sBAAsB,IAAI,EAAE,CAAC;oBAC3C,CAAC;iBACF;gBAGD;oBACE,OAAO,EAAE,uBAAW;oBACpB,MAAM,EAAE,CAAC,+BAAmB,CAAC;oBAC7B,UAAU,EAAE,CAAC,IAAuB,EAAE,EAAE;wBACtC,OAAO,IAAI,CAAC,kBAAkB,IAAI,IAAI,0CAAiB,EAAE,CAAC;oBAC5D,CAAC;iBACF;gBAGD;oBACE,OAAO,EAAE,wBAAY;oBACrB,MAAM,EAAE,CAAC,+BAAmB,CAAC;oBAC7B,UAAU,EAAE,CAAC,IAAuB,EAAE,EAAE;wBACtC,OAAO,IAAI,CAAC,mBAAmB,IAAI,IAAI,2DAA0B,EAAE,CAAC;oBACtE,CAAC;iBACF;gBAGD;oBACE,OAAO,EAAE,6BAAiB;oBAC1B,MAAM,EAAE,CAAC,+BAAmB,CAAC;oBAC7B,UAAU,EAAE,CAAC,IAAuB,EAAE,EAAE;wBACtC,OAAO,IAAI,CAAC,wBAAwB,IAAI,IAAI,CAAC;oBAC/C,CAAC;iBACF;gBAGD;oBACE,OAAO,EAAE,4BAAgB;oBACzB,MAAM,EAAE,CAAC,+BAAmB,CAAC;oBAC7B,UAAU,EAAE,CAAC,IAAuB,EAAE,EAAE;wBACtC,OAAO,IAAI,CAAC,uBAAuB,IAAI,IAAI,CAAC;oBAC9C,CAAC;iBACF;gBAGD;oBACE,OAAO,EAAE,2BAAe;oBACxB,MAAM,EAAE,CAAC,+BAAmB,CAAC;oBAC7B,UAAU,EAAE,CAAC,IAAuB,EAAE,EAAE;wBACtC,OAAO,IAAI,CAAC,sBAAsB,IAAI,IAAI,CAAC;oBAC7C,CAAC;iBACF;gBAGD;oBACE,OAAO,EAAE,0CAA8B;oBACvC,MAAM,EAAE,CAAC,+BAAmB,CAAC;oBAC7B,UAAU,EAAE,CAAC,IAAuB,EAAE,EAAE;wBACtC,OAAO,IAAI,CAAC,oCAAoC,IAAI,IAAI,CAAC;oBAC3D,CAAC;iBACF;gBAGD;oBACE,OAAO,EAAE,+BAAmB;oBAC5B,MAAM,EAAE,CAAC,+BAAmB,CAAC;oBAC7B,UAAU,EAAE,CAAC,IAAuB,EAAE,EAAE;wBACtC,OAAO,IAAI,CAAC,yBAAyB,IAAI,IAAI,sDAAwB,EAAE,CAAC;oBAC1E,CAAC;iBACF;gBAGD;oBACE,OAAO,EAAE,8BAAkB;oBAC3B,MAAM,EAAE,CAAC,+BAAmB,CAAC;oBAC7B,UAAU,EAAE,CAAC,IAAuB,EAAE,EAAE;wBACtC,OAAO,IAAI,CAAC,wBAAwB,IAAI,IAAI,CAAC;oBAC/C,CAAC;iBACF;gBAGD,0BAAW;gBACX,2CAAmB;gBACnB,0CAAmB;gBACnB,uCAAiB;gBACjB,4DAA2B;gBAE3B,6CAAoB;gBAEpB,6DAA4B;gBAC5B,sDAAwB;gBAGxB;oBACE,OAAO,EAAE,sCAAiB;oBAC1B,MAAM,EAAE,CAAC,+BAAmB,CAAC;oBAC7B,UAAU,EAAE,CAAC,OAA0B,EAAE,EAAE;wBACzC,OAAO,IAAI,sCAAiB,CAAC,OAAO,CAAC,CAAC;oBACxC,CAAC;iBACF;gBAGD;oBACE,OAAO,EAAE,0BAAW;oBACpB,MAAM,EAAE,CAAC,+BAAmB,EAAE,0BAAW,EAAE,+BAAmB,CAAC;oBAC/D,UAAU,EAAE,CACV,OAA0B,EAC1B,WAAwB,EACxB,iBAAqC,EACrC,EAAE;wBACF,OAAO,IAAI,0BAAW,CAAC,OAAO,EAAE,WAAW,EAAE,iBAAiB,CAAC,CAAC;oBAClE,CAAC;iBACF;gBACD;oBACE,OAAO,EAAE,gCAAc;oBACvB,MAAM,EAAE,CAAC,+BAAmB,CAAC;oBAC7B,UAAU,EAAE,CAAC,OAA0B,EAAE,EAAE;wBACzC,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC;wBAEjD,IAAI,CAAC,QAAQ,EAAE,CAAC;4BACd,eAAM,CAAC,IAAI,CACT,8HAA8H,EAC9H,YAAY,CACb,CAAC;4BACF,OAAO,IAAI,yCAAkB,EAAE,CAAC;wBAClC,CAAC;wBAGD,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC;4BAC3B,MAAM,IAAI,KAAK,CACb,uEAAuE;gCACvE,mEAAmE;gCACnE,0FAA0F,CAC3F,CAAC;wBACJ,CAAC;wBAED,OAAO,IAAI,gCAAc,CAAC,OAAO,CAAC,CAAC;oBACrC,CAAC;iBACF;gBACD;oBACE,OAAO,EAAE,oCAAgB;oBACzB,MAAM,EAAE,CAAC,+BAAmB,CAAC;oBAC7B,UAAU,EAAE,CAAC,OAA0B,EAAE,EAAE;wBACzC,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,EAAE,QAAQ,EAAE,QAAQ,CAAC;wBACnD,MAAM,YAAY,GAAG,OAAO,CAAC,KAAK,EAAE,QAAQ,EAAE,YAAY,CAAC;wBAE3D,IAAI,CAAC,QAAQ,IAAI,CAAC,YAAY,EAAE,CAAC;4BAC/B,eAAM,CAAC,IAAI,CACT,oJAAoJ,EACpJ,YAAY,CACb,CAAC;4BACF,OAAO,IAAI,6CAAoB,EAAE,CAAC;wBACpC,CAAC;wBAGD,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC;4BAC3B,MAAM,IAAI,KAAK,CACb,yEAAyE;gCACzE,mEAAmE;gCACnE,0FAA0F,CAC3F,CAAC;wBACJ,CAAC;wBAED,OAAO,IAAI,oCAAgB,CAAC,OAAO,CAAC,CAAC;oBACvC,CAAC;iBACF;gBAGD;oBACE,OAAO,EAAE,iCAAc;oBACvB,MAAM,EAAE,CAAC,+BAAmB,CAAC;oBAC7B,UAAU,EAAE,CAAC,OAA0B,EAAE,EAAE;wBACzC,IAAI,CAAC,OAAO,CAAC,wBAAwB,EAAE,CAAC;4BAEtC,OAAO,IAAI,CAAC;wBACd,CAAC;wBACD,OAAO,IAAI,iCAAc,CAAC,OAAO,CAAC,wBAAwB,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;oBAC9E,CAAC;iBACF;gBAGD,kCAAe;gBAGf,0BAAW;gBAGX,kCAAe;gBAGf,wBAAU;aAMX;YACD,OAAO,EAAE;gBACP,+BAAmB;gBACnB,0BAAW;gBACX,2CAAmB;gBACnB,0CAAmB;gBACnB,sCAAiB;gBACjB,uCAAiB;gBACjB,4DAA2B;gBAE3B,6CAAoB;gBAEpB,6DAA4B;gBAC5B,sDAAwB;gBACxB,uBAAW;gBACX,2BAAe;gBACf,oCAAwB;gBACxB,6BAAiB;gBACjB,4BAAgB;gBAChB,2BAAe;gBACf,0CAA8B;gBAC9B,+BAAmB;gBACnB,8BAAkB;gBAClB,0BAAW;gBACX,kCAAe;gBACf,wBAAU;gBACV,eAAS;gBACT,yBAAc;aACf;SACF,CAAC;IACJ,CAAC;CACF,CAAA;AA3bY,gCAAU;qBAAV,UAAU;IADtB,IAAA,eAAM,EAAC,EAAE,CAAC;GACE,UAAU,CA2btB"}

package/dist/constants.d.ts

@@ -17,6 +17,7 @@ export declare const API_KEY_REPOSITORY = "API_KEY_REPOSITORY";
 export declare const TENANT_HEADER_NAME = "TENANT_HEADER_NAME";
 export declare const REALM_EXTRACTOR = "REALM_EXTRACTOR";
 export declare const PERMISSIONS_KEY = "permissions";
+export declare const SCOPES_KEY = "scopes";
 export declare const SKIP_TENANT_KEY = "skipTenant";
 export declare const PUBLIC_ENDPOINT_KEY = "isPublicEndpoint";
 export declare const RESOURCE_SCOPE_KEY = "resourceScope";

package/dist/constants.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../src/constants.ts"],"names":[],"mappings":"AAgBA,eAAO,MAAM,mBAAmB,wBAAwB,CAAC;AAMzD,eAAO,MAAM,eAAe,oBAAoB,CAAC;AAMjD,eAAO,MAAM,wBAAwB,6BAA6B,CAAC;AAMnE,eAAO,MAAM,aAAa,kBAAkB,CAAC;AAM7C,eAAO,MAAM,WAAW,gBAAgB,CAAC;AAMzC,eAAO,MAAM,oBAAoB,yBAAyB,CAAC;AAM3D,eAAO,MAAM,uBAAuB,4BAA4B,CAAC;AAMjE,eAAO,MAAM,sBAAsB,2BAA2B,CAAC;AAM/D,eAAO,MAAM,oBAAoB,yBAAyB,CAAC;AAO3D,eAAO,MAAM,WAAW,gBAAgB,CAAC;AAOzC,eAAO,MAAM,YAAY,iBAAiB,CAAC;AAU3C,eAAO,MAAM,iBAAiB,sBAAsB,CAAC;AAMrD,eAAO,MAAM,gBAAgB,qBAAqB,CAAC;AAMnD,eAAO,MAAM,8BAA8B,mCAAmC,CAAC;AAM/E,eAAO,MAAM,mBAAmB,wBAAwB,CAAC;AAMzD,eAAO,MAAM,kBAAkB,uBAAuB,CAAC;AAMvD,eAAO,MAAM,kBAAkB,uBAAuB,CAAC;AAWvD,eAAO,MAAM,eAAe,oBAAoB,CAAC;AAOjD,eAAO,MAAM,eAAe,gBAAgB,CAAC;AAG7C,eAAO,MAAM,eAAe,eAAe,CAAC;AAG5C,eAAO,MAAM,mBAAmB,qBAAqB,CAAC;AAGtD,eAAO,MAAM,kBAAkB,kBAAkB,CAAC;AAUlD,eAAO,MAAM,qBAAqB,0BAA0B,CAAC;AAM7D,eAAO,MAAM,yBAAyB,8BAA8B,CAAC;AAMrE,eAAO,MAAM,qBAAqB,0BAA0B,CAAC"}
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../src/constants.ts"],"names":[],"mappings":"AAgBA,eAAO,MAAM,mBAAmB,wBAAwB,CAAC;AAMzD,eAAO,MAAM,eAAe,oBAAoB,CAAC;AAMjD,eAAO,MAAM,wBAAwB,6BAA6B,CAAC;AAMnE,eAAO,MAAM,aAAa,kBAAkB,CAAC;AAM7C,eAAO,MAAM,WAAW,gBAAgB,CAAC;AAMzC,eAAO,MAAM,oBAAoB,yBAAyB,CAAC;AAM3D,eAAO,MAAM,uBAAuB,4BAA4B,CAAC;AAMjE,eAAO,MAAM,sBAAsB,2BAA2B,CAAC;AAM/D,eAAO,MAAM,oBAAoB,yBAAyB,CAAC;AAO3D,eAAO,MAAM,WAAW,gBAAgB,CAAC;AAOzC,eAAO,MAAM,YAAY,iBAAiB,CAAC;AAU3C,eAAO,MAAM,iBAAiB,sBAAsB,CAAC;AAMrD,eAAO,MAAM,gBAAgB,qBAAqB,CAAC;AAMnD,eAAO,MAAM,8BAA8B,mCAAmC,CAAC;AAM/E,eAAO,MAAM,mBAAmB,wBAAwB,CAAC;AAMzD,eAAO,MAAM,kBAAkB,uBAAuB,CAAC;AAMvD,eAAO,MAAM,kBAAkB,uBAAuB,CAAC;AAWvD,eAAO,MAAM,eAAe,oBAAoB,CAAC;AAOjD,eAAO,MAAM,eAAe,gBAAgB,CAAC;AAG7C,eAAO,MAAM,UAAU,WAAW,CAAC;AAGnC,eAAO,MAAM,eAAe,eAAe,CAAC;AAG5C,eAAO,MAAM,mBAAmB,qBAAqB,CAAC;AAGtD,eAAO,MAAM,kBAAkB,kBAAkB,CAAC;AAUlD,eAAO,MAAM,qBAAqB,0BAA0B,CAAC;AAM7D,eAAO,MAAM,yBAAyB,8BAA8B,CAAC;AAMrE,eAAO,MAAM,qBAAqB,0BAA0B,CAAC"}

package/dist/constants.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.USER_REPOSITORY_PHONE = exports.USER_REPOSITORY_BIOMETRIC = exports.USER_REPOSITORY_OAUTH = exports.RESOURCE_SCOPE_KEY = exports.PUBLIC_ENDPOINT_KEY = exports.SKIP_TENANT_KEY = exports.PERMISSIONS_KEY = exports.REALM_EXTRACTOR = exports.TENANT_HEADER_NAME = exports.API_KEY_REPOSITORY = exports.JWT_PAYLOAD_FACTORY = exports.RESOURCE_PERMISSION_REPOSITORY = exports.TENANT_EXTRACTOR = exports.TENANT_REPOSITORY = exports.RATE_LIMITER = exports.AUTH_LOGGER = exports.BIOMETRIC_REPOSITORY = exports.BRUTE_FORCE_REPOSITORY = exports.VERIFICATION_REPOSITORY = exports.AUTH_LIFECYCLE_HOOKS = exports.SMS_SERVICE = exports.EMAIL_SERVICE = exports.REFRESH_TOKEN_REPOSITORY = exports.USER_REPOSITORY = exports.AUTH_MODULE_OPTIONS = void 0;
+exports.USER_REPOSITORY_PHONE = exports.USER_REPOSITORY_BIOMETRIC = exports.USER_REPOSITORY_OAUTH = exports.RESOURCE_SCOPE_KEY = exports.PUBLIC_ENDPOINT_KEY = exports.SKIP_TENANT_KEY = exports.SCOPES_KEY = exports.PERMISSIONS_KEY = exports.REALM_EXTRACTOR = exports.TENANT_HEADER_NAME = exports.API_KEY_REPOSITORY = exports.JWT_PAYLOAD_FACTORY = exports.RESOURCE_PERMISSION_REPOSITORY = exports.TENANT_EXTRACTOR = exports.TENANT_REPOSITORY = exports.RATE_LIMITER = exports.AUTH_LOGGER = exports.BIOMETRIC_REPOSITORY = exports.BRUTE_FORCE_REPOSITORY = exports.VERIFICATION_REPOSITORY = exports.AUTH_LIFECYCLE_HOOKS = exports.SMS_SERVICE = exports.EMAIL_SERVICE = exports.REFRESH_TOKEN_REPOSITORY = exports.USER_REPOSITORY = exports.AUTH_MODULE_OPTIONS = void 0;
 exports.AUTH_MODULE_OPTIONS = 'AUTH_MODULE_OPTIONS';
 exports.USER_REPOSITORY = 'USER_REPOSITORY';
 exports.REFRESH_TOKEN_REPOSITORY = 'REFRESH_TOKEN_REPOSITORY';
@@ -20,6 +20,7 @@ exports.API_KEY_REPOSITORY = 'API_KEY_REPOSITORY';
 exports.TENANT_HEADER_NAME = 'TENANT_HEADER_NAME';
 exports.REALM_EXTRACTOR = 'REALM_EXTRACTOR';
 exports.PERMISSIONS_KEY = 'permissions';
+exports.SCOPES_KEY = 'scopes';
 exports.SKIP_TENANT_KEY = 'skipTenant';
 exports.PUBLIC_ENDPOINT_KEY = 'isPublicEndpoint';
 exports.RESOURCE_SCOPE_KEY = 'resourceScope';