@ambushsoftworks/nestjs-auth-graphql 0.15.1 → 0.16.0-rc.2

package/dist/services/passkey.service.js

@@ -0,0 +1,519 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+var PasskeyService_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PasskeyService = void 0;
+const common_1 = require("@nestjs/common");
+const crypto_1 = require("crypto");
+const constants_1 = require("../constants");
+const auth_logger_interface_1 = require("../interfaces/auth-logger.interface");
+const passkey_repository_interface_1 = require("../interfaces/passkey-repository.interface");
+const webauthn_adapter_1 = require("../passkey/webauthn-adapter");
+const passkey_exceptions_1 = require("../exceptions/passkey.exceptions");
+const step_up_exceptions_1 = require("../exceptions/step-up.exceptions");
+const ip_hash_1 = require("../utils/ip-hash");
+const provider_helpers_1 = require("../utils/provider-helpers");
+const passkey_rp_1 = require("../utils/passkey-rp");
+const auth_service_1 = require("./auth.service");
+const step_up_token_service_1 = require("./step-up-token.service");
+const CHALLENGE_BYTES = 32;
+const USER_HANDLE_BYTES = 32;
+const DEFAULT_REGISTRATION_TIMEOUT_SECONDS = 300;
+const DEFAULT_AUTHENTICATION_TIMEOUT_SECONDS = 120;
+const DEFAULT_RATE_LIMIT = { maxAttempts: 10, windowMs: 60_000 };
+const MAX_NAME_LENGTH = 64;
+const DEFAULT_NAME = 'Passkey';
+const SWEEP_THROTTLE_MS = 2 * 60_000;
+let PasskeyService = PasskeyService_1 = class PasskeyService {
+    constructor(repository, webauthn, options, securityLogger, lifecycleHooks, rateLimiter, authService, stepUpTokens, emailService = null) {
+        this.repository = repository;
+        this.webauthn = webauthn;
+        this.options = options;
+        this.securityLogger = securityLogger;
+        this.lifecycleHooks = lifecycleHooks;
+        this.rateLimiter = rateLimiter;
+        this.authService = authService;
+        this.stepUpTokens = stepUpTokens;
+        this.emailService = emailService;
+        this.logger = new common_1.Logger(PasskeyService_1.name);
+        this.lastSweepAt = 0;
+        this.warnedMissingIp = false;
+        this.realmsEnabled = Boolean(options.realmExtractorInstance);
+        this.ipHashSalt = process.env.AUTH_IP_HASH_SALT || options.jwtSecret || '';
+    }
+    get enabled() {
+        return this.repository !== null && this.webauthn !== null;
+    }
+    async registrationOptions(userId, input, opts = {}) {
+        const { repository, webauthn } = this.require();
+        this.requireRealm(opts.realm);
+        if (!(await this.stepUpTokens.verify(input.stepUpToken, userId, opts.realm))) {
+            throw new step_up_exceptions_1.StepUpRequiredException();
+        }
+        const user = await this.authService.requireActiveUser(userId);
+        await this.enforceRateLimit(`auth:passkeyReg:${scope(opts.realm)}${userId}`);
+        const rp = this.relyingParty(opts.realm);
+        const existing = await repository.listCredentials(userId, opts.realm);
+        const userHandle = existing[0]?.userHandle ?? Buffer.from((0, crypto_1.randomBytes)(USER_HANDLE_BYTES)).toString('base64url');
+        const timeoutSeconds = this.options.passkey?.registrationTimeoutSeconds ?? DEFAULT_REGISTRATION_TIMEOUT_SECONDS;
+        const options = await webauthn.registrationOptions({
+            rp,
+            challenge: freshBytes(CHALLENGE_BYTES),
+            userHandle: new Uint8Array(Buffer.from(userHandle, 'base64url')),
+            userName: user.email || user.id,
+            userDisplayName: this.displayName(user),
+            excludeCredentials: existing
+                .filter((c) => c.isActive)
+                .map((c) => ({ id: c.credentialId, transports: c.transports })),
+            userVerification: this.userVerification,
+            timeoutMs: timeoutSeconds * 1000,
+        });
+        const challengeId = await this.storeChallenge('registration', options.challenge, timeoutSeconds, {
+            userId,
+            realm: opts.realm,
+            userHandle,
+        });
+        return { challengeId, options };
+    }
+    async verifyRegistration(userId, input, opts = {}) {
+        const { repository, webauthn } = this.require();
+        this.requireRealm(opts.realm);
+        const fail = (reason) => {
+            this.securityLogger.log(auth_logger_interface_1.SecurityEvent.PASSKEY_REGISTRATION_FAILURE, {
+                userId,
+                realm: opts.realm,
+                ipAddress: opts.ipAddress,
+                reason,
+            });
+            throw new common_1.BadRequestException('Passkey registration failed');
+        };
+        const challenge = await repository.consumeChallenge(input.challengeId);
+        if (!challenge)
+            return fail('challenge_unavailable');
+        const mismatch = challengeMismatch(challenge, 'registration', opts.realm, userId);
+        if (mismatch)
+            return fail(mismatch);
+        const user = await this.authService.requireActiveUser(userId);
+        const response = (0, webauthn_adapter_1.parseRegistrationResponse)(input.responseJson);
+        if (!response)
+            return fail('response_malformed');
+        const rp = this.relyingParty(opts.realm);
+        const outcome = await webauthn.verifyRegistration({
+            response,
+            expectedChallenge: challenge.challenge,
+            rp,
+            requireUserVerification: this.userVerification === 'required',
+        });
+        if (!outcome.ok)
+            return fail(outcome.reason);
+        if (!challenge.userHandle)
+            return fail('challenge_user_handle_missing');
+        const now = new Date();
+        const record = {
+            credentialId: outcome.value.credentialId,
+            userId,
+            ...(opts.realm !== undefined ? { realm: opts.realm } : {}),
+            publicKey: outcome.value.publicKey,
+            counter: outcome.value.counter,
+            userHandle: challenge.userHandle,
+            ...(outcome.value.transports ? { transports: outcome.value.transports } : {}),
+            deviceType: outcome.value.deviceType,
+            backedUp: outcome.value.backedUp,
+            aaguid: outcome.value.aaguid,
+            name: normaliseName(input.name),
+            createdAt: now,
+            lastUsedAt: null,
+            isActive: true,
+        };
+        try {
+            await repository.createCredential(record);
+        }
+        catch (error) {
+            if (error instanceof passkey_repository_interface_1.PasskeyCredentialExistsError) {
+                this.securityLogger.log(auth_logger_interface_1.SecurityEvent.PASSKEY_REGISTRATION_FAILURE, {
+                    userId,
+                    realm: opts.realm,
+                    ipAddress: opts.ipAddress,
+                    credentialId: record.credentialId,
+                    reason: 'credential_exists',
+                });
+                throw new passkey_exceptions_1.PasskeyAlreadyRegisteredException();
+            }
+            throw error;
+        }
+        const summary = summarise(record);
+        this.securityLogger.log(auth_logger_interface_1.SecurityEvent.PASSKEY_REGISTERED, {
+            userId,
+            credentialId: record.credentialId,
+            realm: opts.realm,
+            ipAddress: opts.ipAddress,
+            deviceType: record.deviceType,
+            aaguid: record.aaguid,
+        });
+        this.fireHook('onPasskeyRegistered', user, summary, opts.realm);
+        this.notify('added', user, summary.name, now);
+        return summary;
+    }
+    async authenticationOptions(opts = {}) {
+        const { webauthn } = this.require();
+        this.requireRealm(opts.realm);
+        if (opts.ipAddress) {
+            await this.enforceRateLimit(`auth:passkeyAuth:${scope(opts.realm)}${(0, ip_hash_1.hashIp)(opts.ipAddress, this.ipHashSalt)}`);
+        }
+        else if (!this.warnedMissingIp) {
+            this.warnedMissingIp = true;
+            this.logger.warn('Passkey sign-in options were requested without an IP address, so the per-IP rate ' +
+                'limit on that public route does not apply. Pass ipAddress.');
+        }
+        const timeoutSeconds = this.authenticationTimeoutSeconds;
+        const options = await webauthn.authenticationOptions({
+            rp: this.relyingParty(opts.realm),
+            challenge: freshBytes(CHALLENGE_BYTES),
+            allowCredentials: [],
+            userVerification: this.userVerification,
+            timeoutMs: timeoutSeconds * 1000,
+        });
+        const challengeId = await this.storeChallenge('authentication', options.challenge, timeoutSeconds, {
+            realm: opts.realm,
+        });
+        return { challengeId, options };
+    }
+    async verifyAuthentication(input, opts = {}) {
+        const { repository } = this.require();
+        this.requireRealm(opts.realm);
+        const fail = (reason, credentialId) => {
+            this.securityLogger.log(auth_logger_interface_1.SecurityEvent.PASSKEY_LOGIN_FAILURE, {
+                credentialId,
+                realm: opts.realm,
+                ipAddress: opts.ipAddress,
+                reason,
+            });
+            throw new passkey_exceptions_1.PasskeyAuthenticationFailedException();
+        };
+        const challenge = await repository.consumeChallenge(input.challengeId);
+        if (!challenge)
+            return fail('challenge_unavailable');
+        const mismatch = challengeMismatch(challenge, 'authentication', opts.realm);
+        if (mismatch)
+            return fail(mismatch);
+        const outcome = await this.assertion(challenge, input.responseJson, {
+            realm: opts.realm,
+            requireUserHandle: true,
+        });
+        if (!outcome.ok)
+            return fail(outcome.reason, outcome.credentialId);
+        const { credential } = outcome;
+        const session = await this.authService.issueAuthSession(credential.userId, opts.res, opts.realm);
+        this.securityLogger.log(auth_logger_interface_1.SecurityEvent.PASSKEY_LOGIN_SUCCESS, {
+            userId: credential.userId,
+            credentialId: credential.credentialId,
+            realm: opts.realm,
+            ipAddress: opts.ipAddress,
+        });
+        return { ...session, userId: credential.userId };
+    }
+    async stepUpOptions(userId, opts = {}) {
+        const { repository, webauthn } = this.require();
+        this.requireRealm(opts.realm);
+        const active = (await repository.listCredentials(userId, opts.realm)).filter((c) => c.isActive && (c.realm ?? undefined) === opts.realm);
+        if (active.length === 0) {
+            throw new step_up_exceptions_1.StepUpUnavailableException('passkey');
+        }
+        await this.enforceRateLimit(`auth:passkeyStepUp:${scope(opts.realm)}${userId}`);
+        const timeoutSeconds = this.authenticationTimeoutSeconds;
+        const options = await webauthn.authenticationOptions({
+            rp: this.relyingParty(opts.realm),
+            challenge: freshBytes(CHALLENGE_BYTES),
+            allowCredentials: active.map((c) => ({ id: c.credentialId, transports: c.transports })),
+            userVerification: this.userVerification,
+            timeoutMs: timeoutSeconds * 1000,
+        });
+        const challengeId = await this.storeChallenge('step-up', options.challenge, timeoutSeconds, {
+            userId,
+            realm: opts.realm,
+        });
+        return { challengeId, options };
+    }
+    async verifyStepUpAssertion(userId, input, opts = {}) {
+        const { repository } = this.require();
+        this.requireRealm(opts.realm);
+        const challenge = await repository.consumeChallenge(input.challengeId);
+        if (!challenge)
+            return { ok: false, reason: 'challenge_unavailable' };
+        const mismatch = challengeMismatch(challenge, 'step-up', opts.realm, userId);
+        if (mismatch)
+            return { ok: false, reason: mismatch };
+        const outcome = await this.assertion(challenge, input.responseJson, {
+            realm: opts.realm,
+            requireUserHandle: false,
+        });
+        if (!outcome.ok)
+            return { ok: false, reason: outcome.reason };
+        if (outcome.credential.userId !== userId) {
+            return { ok: false, reason: 'credential_other_user' };
+        }
+        return { ok: true };
+    }
+    async hasActivePasskey(userId, realm) {
+        if (!this.enabled) {
+            return false;
+        }
+        return (await this.repository.listCredentials(userId, realm)).some((c) => c.isActive && (c.realm ?? undefined) === realm);
+    }
+    async listPasskeys(userId, opts = {}) {
+        const { repository } = this.require();
+        this.requireRealm(opts.realm);
+        return (await repository.listCredentials(userId, opts.realm))
+            .filter((c) => c.isActive && (c.realm ?? undefined) === opts.realm)
+            .map(summarise);
+    }
+    async renamePasskey(userId, input, opts = {}) {
+        const { repository } = this.require();
+        this.requireRealm(opts.realm);
+        const credential = await this.ownCredential(userId, input.credentialId, opts.realm);
+        const name = normaliseName(input.name);
+        await repository.renameCredential(credential.credentialId, name);
+        this.securityLogger.log(auth_logger_interface_1.SecurityEvent.PASSKEY_RENAMED, {
+            userId,
+            credentialId: credential.credentialId,
+            realm: opts.realm,
+        });
+        return summarise({ ...credential, name });
+    }
+    async removePasskey(userId, input, opts = {}) {
+        const { repository } = this.require();
+        this.requireRealm(opts.realm);
+        const credential = await this.ownCredential(userId, input.credentialId, opts.realm);
+        const user = await this.authService.requireActiveUser(userId);
+        const othersActive = (await repository.listCredentials(userId, opts.realm)).some((c) => c.isActive &&
+            c.credentialId !== credential.credentialId &&
+            (c.realm ?? undefined) === opts.realm);
+        if (!othersActive && !user.passwordHash && !(0, provider_helpers_1.hasSocialIdentity)(user)) {
+            throw new passkey_exceptions_1.CannotRemoveLastAuthMethodException();
+        }
+        await repository.deactivateCredential(credential.credentialId);
+        const summary = summarise(credential);
+        this.securityLogger.log(auth_logger_interface_1.SecurityEvent.PASSKEY_REMOVED, {
+            userId,
+            credentialId: credential.credentialId,
+            realm: opts.realm,
+        });
+        this.fireHook('onPasskeyRemoved', user, summary, opts.realm);
+        this.notify('removed', user, summary.name, new Date());
+    }
+    async assertion(challenge, responseJson, opts) {
+        const repository = this.repository;
+        const webauthn = this.webauthn;
+        const response = (0, webauthn_adapter_1.parseAuthenticationResponse)(responseJson);
+        if (!response)
+            return { ok: false, reason: 'response_malformed' };
+        const credentialId = response.id;
+        const credential = await repository.getCredential(credentialId, opts.realm);
+        if (!credential)
+            return { ok: false, reason: 'credential_unknown', credentialId };
+        if (!credential.isActive)
+            return { ok: false, reason: 'credential_inactive', credentialId };
+        if ((credential.realm ?? undefined) !== opts.realm) {
+            return { ok: false, reason: 'credential_realm_mismatch', credentialId };
+        }
+        const userHandle = response.response.userHandle;
+        if (userHandle ? userHandle !== credential.userHandle : opts.requireUserHandle) {
+            return { ok: false, reason: 'user_handle_mismatch', credentialId };
+        }
+        const outcome = await webauthn.verifyAuthentication({
+            response,
+            expectedChallenge: challenge.challenge,
+            rp: this.relyingParty(opts.realm),
+            requireUserVerification: this.userVerification === 'required',
+            credential: {
+                credentialId: credential.credentialId,
+                publicKey: credential.publicKey,
+                counter: 0,
+                transports: credential.transports,
+            },
+        });
+        if (!outcome.ok)
+            return { ok: false, reason: outcome.reason, credentialId };
+        const { newCounter } = outcome.value;
+        if ((newCounter > 0 || credential.counter > 0) && newCounter <= credential.counter) {
+            this.securityLogger.log(auth_logger_interface_1.SecurityEvent.PASSKEY_COUNTER_REGRESSION, {
+                userId: credential.userId,
+                credentialId,
+                storedCounter: credential.counter,
+                receivedCounter: newCounter,
+                realm: opts.realm,
+            });
+            return { ok: false, reason: 'counter_regression', credentialId };
+        }
+        const advanced = await repository.updateCounter({
+            credentialId,
+            expectedCounter: credential.counter,
+            newCounter,
+            backedUp: outcome.value.backedUp,
+            lastUsedAt: new Date(),
+        });
+        if (!advanced) {
+            return { ok: false, reason: 'counter_race', credentialId };
+        }
+        return { ok: true, credential };
+    }
+    async ownCredential(userId, credentialId, realm) {
+        const credential = await this.repository.getCredential(credentialId, realm);
+        if (!credential ||
+            !credential.isActive ||
+            credential.userId !== userId ||
+            (credential.realm ?? undefined) !== realm) {
+            throw new common_1.NotFoundException('Passkey not found');
+        }
+        return credential;
+    }
+    async storeChallenge(purpose, challenge, timeoutSeconds, extra) {
+        const challengeId = await this.repository.storeChallenge({
+            challenge,
+            purpose,
+            ...(extra.userId !== undefined ? { userId: extra.userId } : {}),
+            ...(extra.realm !== undefined ? { realm: extra.realm } : {}),
+            ...(extra.userHandle !== undefined ? { userHandle: extra.userHandle } : {}),
+            expiresAt: new Date(Date.now() + timeoutSeconds * 1000),
+        });
+        void this.sweep();
+        return challengeId;
+    }
+    async sweep() {
+        const now = Date.now();
+        if (now - this.lastSweepAt < SWEEP_THROTTLE_MS) {
+            return;
+        }
+        this.lastSweepAt = now;
+        try {
+            await this.repository.deleteExpiredChallenges();
+        }
+        catch (error) {
+            this.logger.warn(`Sweeping expired passkey challenges failed: ${error instanceof Error ? error.message : String(error)}. Challenges still expire: consumeChallenge checks expiry.`);
+        }
+    }
+    async enforceRateLimit(key) {
+        const { maxAttempts, windowMs } = this.options.passkey?.rateLimit ?? DEFAULT_RATE_LIMIT;
+        const { allowed } = await this.rateLimiter.checkRateLimit(key, maxAttempts, windowMs);
+        if (!allowed) {
+            throw new step_up_exceptions_1.AuthRateLimitException('Too many passkey requests. Please try again later.');
+        }
+        await this.rateLimiter.recordAttempt(key, windowMs);
+    }
+    relyingParty(realm) {
+        return (0, passkey_rp_1.resolveRelyingParty)(this.options.passkey.rp, realm);
+    }
+    get userVerification() {
+        return this.options.passkey?.userVerification ?? 'required';
+    }
+    get authenticationTimeoutSeconds() {
+        return this.options.passkey?.authenticationTimeoutSeconds ?? DEFAULT_AUTHENTICATION_TIMEOUT_SECONDS;
+    }
+    displayName(user) {
+        const custom = this.options.passkey?.userDisplayName;
+        if (custom) {
+            try {
+                const name = custom(user);
+                if (typeof name === 'string' && name.trim() !== '') {
+                    return name;
+                }
+            }
+            catch (error) {
+                this.logger.warn(`passkey.userDisplayName threw for user ${user.id}: ${error instanceof Error ? error.message : String(error)}. Using the email.`);
+            }
+        }
+        return user.email || user.id;
+    }
+    require() {
+        if (!this.repository || !this.webauthn) {
+            throw new common_1.InternalServerErrorException('Passkeys are not configured: set passkeyRepositoryInstance and passkey.rp.');
+        }
+        return { repository: this.repository, webauthn: this.webauthn };
+    }
+    requireRealm(realm) {
+        if (this.realmsEnabled && (realm === undefined || realm === null)) {
+            throw new common_1.BadRequestException('Realm required');
+        }
+    }
+    notify(kind, user, passkeyName, at) {
+        if (this.options.passkey?.emailNotifications?.[kind] === false || !user.email) {
+            return;
+        }
+        const send = kind === 'added'
+            ? this.emailService?.sendPasskeyAddedEmail
+            : this.emailService?.sendPasskeyRemovedEmail;
+        if (typeof send !== 'function') {
+            return;
+        }
+        Promise.resolve()
+            .then(() => send.call(this.emailService, user.email, passkeyName, at))
+            .catch((error) => {
+            this.securityLogger.error(`Passkey-${kind} email failed for user ${user.id}`, error instanceof Error ? error.stack : String(error), 'PasskeyService');
+        });
+    }
+    fireHook(name, user, summary, realm) {
+        const hook = this.lifecycleHooks?.[name];
+        if (!hook) {
+            return;
+        }
+        Promise.resolve()
+            .then(() => hook.call(this.lifecycleHooks, user, summary, realm))
+            .catch((error) => {
+            this.securityLogger.error(`Lifecycle hook ${name} failed for user ${user.id}`, error instanceof Error ? error.stack : String(error), 'PasskeyService');
+        });
+    }
+};
+exports.PasskeyService = PasskeyService;
+exports.PasskeyService = PasskeyService = PasskeyService_1 = __decorate([
+    (0, common_1.Injectable)(),
+    __param(0, (0, common_1.Inject)(constants_1.PASSKEY_REPOSITORY)),
+    __param(1, (0, common_1.Inject)(constants_1.WEBAUTHN_ADAPTER)),
+    __param(2, (0, common_1.Inject)(constants_1.AUTH_MODULE_OPTIONS)),
+    __param(3, (0, common_1.Inject)(constants_1.AUTH_LOGGER)),
+    __param(4, (0, common_1.Inject)(constants_1.AUTH_LIFECYCLE_HOOKS)),
+    __param(5, (0, common_1.Inject)(constants_1.RATE_LIMITER)),
+    __param(8, (0, common_1.Inject)(constants_1.EMAIL_SERVICE)),
+    __metadata("design:paramtypes", [Object, Object, Object, Object, Object, Object, auth_service_1.AuthService,
+        step_up_token_service_1.StepUpTokenService, Object])
+], PasskeyService);
+function scope(realm) {
+    return realm ? `${realm}:` : '';
+}
+function freshBytes(length) {
+    return new Uint8Array((0, crypto_1.randomBytes)(length));
+}
+function normaliseName(name) {
+    const trimmed = (name ?? '').trim();
+    return trimmed === '' ? DEFAULT_NAME : trimmed.slice(0, MAX_NAME_LENGTH);
+}
+function challengeMismatch(challenge, purpose, realm, userId) {
+    if (challenge.purpose !== purpose)
+        return 'challenge_purpose_mismatch';
+    if ((challenge.realm ?? undefined) !== realm)
+        return 'challenge_realm_mismatch';
+    if (userId !== undefined && challenge.userId !== userId)
+        return 'challenge_user_mismatch';
+    return null;
+}
+function summarise(record) {
+    return {
+        credentialId: record.credentialId,
+        name: record.name,
+        deviceType: record.deviceType,
+        backedUp: record.backedUp,
+        createdAt: record.createdAt,
+        lastUsedAt: record.lastUsedAt,
+    };
+}
+//# sourceMappingURL=passkey.service.js.map

package/dist/services/passkey.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"passkey.service.js","sourceRoot":"","sources":["../../src/services/passkey.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,2CAOwB;AACxB,mCAAqC;AACrC,4CAQsB;AAEtB,+EAAiF;AAIjF,6FAMoD;AAGpD,kEAIqC;AACrC,yEAI0C;AAC1C,yEAI0C;AAC1C,8CAA0C;AAC1C,gEAA8D;AAC9D,oDAAsF;AACtF,iDAA6C;AAC7C,mEAA6D;AAE7D,MAAM,eAAe,GAAG,EAAE,CAAC;AAC3B,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAC7B,MAAM,oCAAoC,GAAG,GAAG,CAAC;AACjD,MAAM,sCAAsC,GAAG,GAAG,CAAC;AACnD,MAAM,kBAAkB,GAAG,EAAE,WAAW,EAAE,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;AACjE,MAAM,eAAe,GAAG,EAAE,CAAC;AAC3B,MAAM,YAAY,GAAG,SAAS,CAAC;AAC/B,MAAM,iBAAiB,GAAG,CAAC,GAAG,MAAM,CAAC;AAyC9B,IAAM,cAAc,sBAApB,MAAM,cAAc;IAOzB,YAEE,UAAsD,EAEtD,QAAiD,EAEjD,OAA2C,EAE3C,cAA4C,EAE5C,cAAoD,EAEpD,WAA0C,EACzB,WAAwB,EACxB,YAAgC,EAEjD,eAAsD,IAAI;QAdzC,eAAU,GAAV,UAAU,CAA2B;QAErC,aAAQ,GAAR,QAAQ,CAAwB;QAEhC,YAAO,GAAP,OAAO,CAAmB;QAE1B,mBAAc,GAAd,cAAc,CAAa;QAE3B,mBAAc,GAAd,cAAc,CAAqB;QAEnC,gBAAW,GAAX,WAAW,CAAc;QACzB,gBAAW,GAAX,WAAW,CAAa;QACxB,iBAAY,GAAZ,YAAY,CAAoB;QAEhC,iBAAY,GAAZ,YAAY,CAA6B;QAtB3C,WAAM,GAAG,IAAI,eAAM,CAAC,gBAAc,CAAC,IAAI,CAAC,CAAC;QAGlD,gBAAW,GAAG,CAAC,CAAC;QAChB,oBAAe,GAAG,KAAK,CAAC;QAoB9B,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,OAAO,CAAC,sBAAsB,CAAC,CAAC;QAC7D,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,OAAO,CAAC,SAAS,IAAI,EAAE,CAAC;IAC7E,CAAC;IAGD,IAAI,OAAO;QACT,OAAO,IAAI,CAAC,UAAU,KAAK,IAAI,IAAI,IAAI,CAAC,QAAQ,KAAK,IAAI,CAAC;IAC5D,CAAC;IAaD,KAAK,CAAC,mBAAmB,CACvB,MAAc,EACd,KAA+B,EAC/B,OAA2B,EAAE;QAE7B,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;QAChD,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAI9B,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,EAAE,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YAC7E,MAAM,IAAI,4CAAuB,EAAE,CAAC;QACtC,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC;QAC9D,MAAM,IAAI,CAAC,gBAAgB,CAAC,mBAAmB,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,MAAM,EAAE,CAAC,CAAC;QAE7E,MAAM,EAAE,GAAG,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACzC,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,eAAe,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QAGtE,MAAM,UAAU,GACd,QAAQ,CAAC,CAAC,CAAC,EAAE,UAAU,IAAI,MAAM,CAAC,IAAI,CAAC,IAAA,oBAAW,EAAC,iBAAiB,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QAE/F,MAAM,cAAc,GAClB,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,0BAA0B,IAAI,oCAAoC,CAAC;QAC3F,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,mBAAmB,CAAC;YACjD,EAAE;YACF,SAAS,EAAE,UAAU,CAAC,eAAe,CAAC;YACtC,UAAU,EAAE,IAAI,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;YAChE,QAAQ,EAAE,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,EAAE;YAC/B,eAAe,EAAE,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC;YAGvC,kBAAkB,EAAE,QAAQ;iBACzB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC;iBACzB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,YAAY,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC;YACjE,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;YACvC,SAAS,EAAE,cAAc,GAAG,IAAI;SACjC,CAAC,CAAC;QAEH,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,cAAc,EAAE,OAAO,CAAC,SAAS,EAAE,cAAc,EAAE;YAC/F,MAAM;YACN,KAAK,EAAE,IAAI,CAAC,KAAK;YAGjB,UAAU;SACX,CAAC,CAAC;QACH,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC;IAClC,CAAC;IAWD,KAAK,CAAC,kBAAkB,CACtB,MAAc,EACd,KAAmE,EACnE,OAA+C,EAAE;QAEjD,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;QAChD,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAE9B,MAAM,IAAI,GAAG,CAAC,MAAc,EAAS,EAAE;YACrC,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,qCAAa,CAAC,4BAA4B,EAAE;gBAClE,MAAM;gBACN,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,MAAM;aACP,CAAC,CAAC;YACH,MAAM,IAAI,4BAAmB,CAAC,6BAA6B,CAAC,CAAC;QAC/D,CAAC,CAAC;QAGF,MAAM,SAAS,GAAG,MAAM,UAAU,CAAC,gBAAgB,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QACvE,IAAI,CAAC,SAAS;YAAE,OAAO,IAAI,CAAC,uBAAuB,CAAC,CAAC;QAGrD,MAAM,QAAQ,GAAG,iBAAiB,CAAC,SAAS,EAAE,cAAc,EAAE,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAClF,IAAI,QAAQ;YAAE,OAAO,IAAI,CAAC,QAAQ,CAAC,CAAC;QAEpC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC;QAE9D,MAAM,QAAQ,GAAG,IAAA,4CAAyB,EAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QAC/D,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC,oBAAoB,CAAC,CAAC;QAEjD,MAAM,EAAE,GAAG,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACzC,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,kBAAkB,CAAC;YAChD,QAAQ;YACR,iBAAiB,EAAE,SAAS,CAAC,SAAS;YACtC,EAAE;YACF,uBAAuB,EAAE,IAAI,CAAC,gBAAgB,KAAK,UAAU;SAC9D,CAAC,CAAC;QACH,IAAI,CAAC,OAAO,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAE7C,IAAI,CAAC,SAAS,CAAC,UAAU;YAAE,OAAO,IAAI,CAAC,+BAA+B,CAAC,CAAC;QAExE,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,MAAM,GAA4B;YACtC,YAAY,EAAE,OAAO,CAAC,KAAK,CAAC,YAAY;YACxC,MAAM;YACN,GAAG,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1D,SAAS,EAAE,OAAO,CAAC,KAAK,CAAC,SAAS;YAClC,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,OAAO;YAE9B,UAAU,EAAE,SAAS,CAAC,UAAU;YAChC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7E,UAAU,EAAE,OAAO,CAAC,KAAK,CAAC,UAAU;YACpC,QAAQ,EAAE,OAAO,CAAC,KAAK,CAAC,QAAQ;YAChC,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,MAAM;YAC5B,IAAI,EAAE,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC;YAC/B,SAAS,EAAE,GAAG;YACd,UAAU,EAAE,IAAI;YAChB,QAAQ,EAAE,IAAI;SACf,CAAC;QAEF,IAAI,CAAC;YACH,MAAM,UAAU,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC;QAC5C,CAAC;QAAC,OAAO,KAAc,EAAE,CAAC;YACxB,IAAI,KAAK,YAAY,2DAA4B,EAAE,CAAC;gBAClD,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,qCAAa,CAAC,4BAA4B,EAAE;oBAClE,MAAM;oBACN,KAAK,EAAE,IAAI,CAAC,KAAK;oBACjB,SAAS,EAAE,IAAI,CAAC,SAAS;oBACzB,YAAY,EAAE,MAAM,CAAC,YAAY;oBACjC,MAAM,EAAE,mBAAmB;iBAC5B,CAAC,CAAC;gBAEH,MAAM,IAAI,sDAAiC,EAAE,CAAC;YAChD,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;QAED,MAAM,OAAO,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;QAClC,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,qCAAa,CAAC,kBAAkB,EAAE;YACxD,MAAM;YACN,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,MAAM,EAAE,MAAM,CAAC,MAAM;SACtB,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,qBAAqB,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QAChE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAC9C,OAAO,OAAO,CAAC;IACjB,CAAC;IAeD,KAAK,CAAC,qBAAqB,CACzB,OAA+C,EAAE;QAEjD,MAAM,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;QACpC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAE9B,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACnB,MAAM,IAAI,CAAC,gBAAgB,CACzB,oBAAoB,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,IAAA,gBAAM,EAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,UAAU,CAAC,EAAE,CAClF,CAAC;QACJ,CAAC;aAAM,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC;YACjC,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC;YAC5B,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,mFAAmF;gBACjF,4DAA4D,CAC/D,CAAC;QACJ,CAAC;QAED,MAAM,cAAc,GAAG,IAAI,CAAC,4BAA4B,CAAC;QACzD,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,qBAAqB,CAAC;YACnD,EAAE,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC;YACjC,SAAS,EAAE,UAAU,CAAC,eAAe,CAAC;YACtC,gBAAgB,EAAE,EAAE;YACpB,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;YACvC,SAAS,EAAE,cAAc,GAAG,IAAI;SACjC,CAAC,CAAC;QACH,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,gBAAgB,EAAE,OAAO,CAAC,SAAS,EAAE,cAAc,EAAE;YACjG,KAAK,EAAE,IAAI,CAAC,KAAK;SAClB,CAAC,CAAC;QACH,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC;IAClC,CAAC;IAWD,KAAK,CAAC,oBAAoB,CACxB,KAAoD,EACpD,OAAqE,EAAE;QAEvE,MAAM,EAAE,UAAU,EAAE,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;QACtC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAE9B,MAAM,IAAI,GAAG,CAAC,MAAc,EAAE,YAAqB,EAAS,EAAE;YAC5D,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,qCAAa,CAAC,qBAAqB,EAAE;gBAC3D,YAAY;gBACZ,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,MAAM;aACP,CAAC,CAAC;YACH,MAAM,IAAI,yDAAoC,EAAE,CAAC;QACnD,CAAC,CAAC;QAEF,MAAM,SAAS,GAAG,MAAM,UAAU,CAAC,gBAAgB,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QACvE,IAAI,CAAC,SAAS;YAAE,OAAO,IAAI,CAAC,uBAAuB,CAAC,CAAC;QACrD,MAAM,QAAQ,GAAG,iBAAiB,CAAC,SAAS,EAAE,gBAAgB,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QAC5E,IAAI,QAAQ;YAAE,OAAO,IAAI,CAAC,QAAQ,CAAC,CAAC;QAEpC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,KAAK,CAAC,YAAY,EAAE;YAClE,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,iBAAiB,EAAE,IAAI;SACxB,CAAC,CAAC;QACH,IAAI,CAAC,OAAO,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;QAEnE,MAAM,EAAE,UAAU,EAAE,GAAG,OAAO,CAAC;QAC/B,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,gBAAgB,CAAC,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QAEjG,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,qCAAa,CAAC,qBAAqB,EAAE;YAC3D,MAAM,EAAE,UAAU,CAAC,MAAM;YACzB,YAAY,EAAE,UAAU,CAAC,YAAY;YACrC,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,SAAS,EAAE,IAAI,CAAC,SAAS;SAC1B,CAAC,CAAC;QACH,OAAO,EAAE,GAAG,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC;IACnD,CAAC;IAYD,KAAK,CAAC,aAAa,CAAC,MAAc,EAAE,OAA2B,EAAE;QAC/D,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;QAChD,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAE9B,MAAM,MAAM,GAAG,CAAC,MAAM,UAAU,CAAC,eAAe,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAC1E,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,SAAS,CAAC,KAAK,IAAI,CAAC,KAAK,CAC3D,CAAC;QACF,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxB,MAAM,IAAI,+CAA0B,CAAC,SAAS,CAAC,CAAC;QAClD,CAAC;QACD,MAAM,IAAI,CAAC,gBAAgB,CAAC,sBAAsB,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,MAAM,EAAE,CAAC,CAAC;QAEhF,MAAM,cAAc,GAAG,IAAI,CAAC,4BAA4B,CAAC;QACzD,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,qBAAqB,CAAC;YACnD,EAAE,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC;YACjC,SAAS,EAAE,UAAU,CAAC,eAAe,CAAC;YACtC,gBAAgB,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,YAAY,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC;YACvF,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;YACvC,SAAS,EAAE,cAAc,GAAG,IAAI;SACjC,CAAC,CAAC;QACH,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,cAAc,EAAE;YAC1F,MAAM;YACN,KAAK,EAAE,IAAI,CAAC,KAAK;SAClB,CAAC,CAAC;QACH,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC;IAClC,CAAC;IAMD,KAAK,CAAC,qBAAqB,CACzB,MAAc,EACd,KAAoD,EACpD,OAA2B,EAAE;QAE7B,MAAM,EAAE,UAAU,EAAE,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;QACtC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAE9B,MAAM,SAAS,GAAG,MAAM,UAAU,CAAC,gBAAgB,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QACvE,IAAI,CAAC,SAAS;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,uBAAuB,EAAE,CAAC;QACtE,MAAM,QAAQ,GAAG,iBAAiB,CAAC,SAAS,EAAE,SAAS,EAAE,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAC7E,IAAI,QAAQ;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;QAErD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,KAAK,CAAC,YAAY,EAAE;YAClE,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,iBAAiB,EAAE,KAAK;SACzB,CAAC,CAAC;QACH,IAAI,CAAC,OAAO,CAAC,EAAE;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;QAC9D,IAAI,OAAO,CAAC,UAAU,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YACzC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,uBAAuB,EAAE,CAAC;QACxD,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACtB,CAAC;IAGD,KAAK,CAAC,gBAAgB,CAAC,MAAc,EAAE,KAAc;QACnD,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAClB,OAAO,KAAK,CAAC;QACf,CAAC;QACD,OAAO,CAAC,MAAM,IAAI,CAAC,UAAW,CAAC,eAAe,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,CACjE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,SAAS,CAAC,KAAK,KAAK,CACtD,CAAC;IACJ,CAAC;IAOD,KAAK,CAAC,YAAY,CAAC,MAAc,EAAE,OAA2B,EAAE;QAC9D,MAAM,EAAE,UAAU,EAAE,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;QACtC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC9B,OAAO,CAAC,MAAM,UAAU,CAAC,eAAe,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;aAC1D,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,SAAS,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC;aAClE,GAAG,CAAC,SAAS,CAAC,CAAC;IACpB,CAAC;IAGD,KAAK,CAAC,aAAa,CACjB,MAAc,EACd,KAA6C,EAC7C,OAA2B,EAAE;QAE7B,MAAM,EAAE,UAAU,EAAE,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;QACtC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC9B,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,KAAK,CAAC,YAAY,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QACpF,MAAM,IAAI,GAAG,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAEvC,MAAM,UAAU,CAAC,gBAAgB,CAAC,UAAU,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC;QACjE,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,qCAAa,CAAC,eAAe,EAAE;YACrD,MAAM;YACN,YAAY,EAAE,UAAU,CAAC,YAAY;YACrC,KAAK,EAAE,IAAI,CAAC,KAAK;SAClB,CAAC,CAAC;QACH,OAAO,SAAS,CAAC,EAAE,GAAG,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5C,CAAC;IAQD,KAAK,CAAC,aAAa,CACjB,MAAc,EACd,KAA+B,EAC/B,OAA2B,EAAE;QAE7B,MAAM,EAAE,UAAU,EAAE,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;QACtC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC9B,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,KAAK,CAAC,YAAY,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QACpF,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC;QAE9D,MAAM,YAAY,GAAG,CAAC,MAAM,UAAU,CAAC,eAAe,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAC9E,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,CAAC,QAAQ;YACV,CAAC,CAAC,YAAY,KAAK,UAAU,CAAC,YAAY;YAC1C,CAAC,CAAC,CAAC,KAAK,IAAI,SAAS,CAAC,KAAK,IAAI,CAAC,KAAK,CACxC,CAAC;QACF,IAAI,CAAC,YAAY,IAAI,CAAC,IAAI,CAAC,YAAY,IAAI,CAAC,IAAA,oCAAiB,EAAC,IAAI,CAAC,EAAE,CAAC;YACpE,MAAM,IAAI,wDAAmC,EAAE,CAAC;QAClD,CAAC;QAED,MAAM,UAAU,CAAC,oBAAoB,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;QAC/D,MAAM,OAAO,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC;QACtC,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,qCAAa,CAAC,eAAe,EAAE;YACrD,MAAM;YACN,YAAY,EAAE,UAAU,CAAC,YAAY;YACrC,KAAK,EAAE,IAAI,CAAC,KAAK;SAClB,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,kBAAkB,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QAC7D,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC;IACzD,CAAC;IAUO,KAAK,CAAC,SAAS,CACrB,SAAiC,EACjC,YAAoB,EACpB,IAAoD;QAEpD,MAAM,UAAU,GAAG,IAAI,CAAC,UAAW,CAAC;QACpC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAS,CAAC;QAEhC,MAAM,QAAQ,GAAG,IAAA,8CAA2B,EAAC,YAAY,CAAC,CAAC;QAC3D,IAAI,CAAC,QAAQ;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;QAElE,MAAM,YAAY,GAAG,QAAQ,CAAC,EAAE,CAAC;QACjC,MAAM,UAAU,GAAG,MAAM,UAAU,CAAC,aAAa,CAAC,YAAY,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QAC5E,IAAI,CAAC,UAAU;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,YAAY,EAAE,CAAC;QAClF,IAAI,CAAC,UAAU,CAAC,QAAQ;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,qBAAqB,EAAE,YAAY,EAAE,CAAC;QAE5F,IAAI,CAAC,UAAU,CAAC,KAAK,IAAI,SAAS,CAAC,KAAK,IAAI,CAAC,KAAK,EAAE,CAAC;YACnD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,2BAA2B,EAAE,YAAY,EAAE,CAAC;QAC1E,CAAC;QAED,MAAM,UAAU,GAAG,QAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC;QAChD,IAAI,UAAU,CAAC,CAAC,CAAC,UAAU,KAAK,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,iBAAiB,EAAE,CAAC;YAC/E,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,sBAAsB,EAAE,YAAY,EAAE,CAAC;QACrE,CAAC;QAOD,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,oBAAoB,CAAC;YAClD,QAAQ;YACR,iBAAiB,EAAE,SAAS,CAAC,SAAS;YACtC,EAAE,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC;YACjC,uBAAuB,EAAE,IAAI,CAAC,gBAAgB,KAAK,UAAU;YAC7D,UAAU,EAAE;gBACV,YAAY,EAAE,UAAU,CAAC,YAAY;gBACrC,SAAS,EAAE,UAAU,CAAC,SAAS;gBAC/B,OAAO,EAAE,CAAC;gBACV,UAAU,EAAE,UAAU,CAAC,UAAU;aAClC;SACF,CAAC,CAAC;QACH,IAAI,CAAC,OAAO,CAAC,EAAE;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,YAAY,EAAE,CAAC;QAE5E,MAAM,EAAE,UAAU,EAAE,GAAG,OAAO,CAAC,KAAK,CAAC;QACrC,IAAI,CAAC,UAAU,GAAG,CAAC,IAAI,UAAU,CAAC,OAAO,GAAG,CAAC,CAAC,IAAI,UAAU,IAAI,UAAU,CAAC,OAAO,EAAE,CAAC;YACnF,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,qCAAa,CAAC,0BAA0B,EAAE;gBAChE,MAAM,EAAE,UAAU,CAAC,MAAM;gBACzB,YAAY;gBACZ,aAAa,EAAE,UAAU,CAAC,OAAO;gBACjC,eAAe,EAAE,UAAU;gBAC3B,KAAK,EAAE,IAAI,CAAC,KAAK;aAClB,CAAC,CAAC;YAGH,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,YAAY,EAAE,CAAC;QACnE,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,aAAa,CAAC;YAC9C,YAAY;YACZ,eAAe,EAAE,UAAU,CAAC,OAAO;YACnC,UAAU;YACV,QAAQ,EAAE,OAAO,CAAC,KAAK,CAAC,QAAQ;YAChC,UAAU,EAAE,IAAI,IAAI,EAAE;SACvB,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC;QAC7D,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;IAClC,CAAC;IAEO,KAAK,CAAC,aAAa,CACzB,MAAc,EACd,YAAoB,EACpB,KAAyB;QAEzB,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,UAAW,CAAC,aAAa,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;QAC7E,IACE,CAAC,UAAU;YACX,CAAC,UAAU,CAAC,QAAQ;YACpB,UAAU,CAAC,MAAM,KAAK,MAAM;YAC5B,CAAC,UAAU,CAAC,KAAK,IAAI,SAAS,CAAC,KAAK,KAAK,EACzC,CAAC;YAED,MAAM,IAAI,0BAAiB,CAAC,mBAAmB,CAAC,CAAC;QACnD,CAAC;QACD,OAAO,UAAU,CAAC;IACpB,CAAC;IAEO,KAAK,CAAC,cAAc,CAC1B,OAAgC,EAChC,SAAiB,EACjB,cAAsB,EACtB,KAA+D;QAE/D,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,UAAW,CAAC,cAAc,CAAC;YACxD,SAAS;YACT,OAAO;YACP,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/D,GAAG,CAAC,KAAK,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5D,GAAG,CAAC,KAAK,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3E,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,cAAc,GAAG,IAAI,CAAC;SACxD,CAAC,CAAC;QACH,KAAK,IAAI,CAAC,KAAK,EAAE,CAAC;QAClB,OAAO,WAAW,CAAC;IACrB,CAAC;IAGO,KAAK,CAAC,KAAK;QACjB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,IAAI,GAAG,GAAG,IAAI,CAAC,WAAW,GAAG,iBAAiB,EAAE,CAAC;YAC/C,OAAO;QACT,CAAC;QACD,IAAI,CAAC,WAAW,GAAG,GAAG,CAAC;QACvB,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,UAAW,CAAC,uBAAuB,EAAE,CAAC;QACnD,CAAC;QAAC,OAAO,KAAc,EAAE,CAAC;YACxB,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,+CACE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CACvD,4DAA4D,CAC7D,CAAC;QACJ,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,gBAAgB,CAAC,GAAW;QACxC,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,SAAS,IAAI,kBAAkB,CAAC;QACxF,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,cAAc,CAAC,GAAG,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;QACtF,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,2CAAsB,CAAC,oDAAoD,CAAC,CAAC;QACzF,CAAC;QACD,MAAM,IAAI,CAAC,WAAW,CAAC,aAAa,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IACtD,CAAC;IAEO,YAAY,CAAC,KAAyB;QAC5C,OAAO,IAAA,gCAAmB,EAAC,IAAI,CAAC,OAAO,CAAC,OAAQ,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;IAC9D,CAAC;IAED,IAAY,gBAAgB;QAC1B,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,gBAAgB,IAAI,UAAU,CAAC;IAC9D,CAAC;IAED,IAAY,4BAA4B;QACtC,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,4BAA4B,IAAI,sCAAsC,CAAC;IACtG,CAAC;IAEO,WAAW,CAAC,IAAe;QACjC,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,eAAe,CAAC;QACrD,IAAI,MAAM,EAAE,CAAC;YACX,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;gBAC1B,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;oBACnD,OAAO,IAAI,CAAC;gBACd,CAAC;YACH,CAAC;YAAC,OAAO,KAAc,EAAE,CAAC;gBACxB,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,0CAA0C,IAAI,CAAC,EAAE,KAC/C,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CACvD,oBAAoB,CACrB,CAAC;YACJ,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,EAAE,CAAC;IAC/B,CAAC;IAEO,OAAO;QACb,IAAI,CAAC,IAAI,CAAC,UAAU,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACvC,MAAM,IAAI,qCAA4B,CACpC,4EAA4E,CAC7E,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC;IAClE,CAAC;IAGO,YAAY,CAAC,KAAyB;QAC5C,IAAI,IAAI,CAAC,aAAa,IAAI,CAAC,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,CAAC,EAAE,CAAC;YAClE,MAAM,IAAI,4BAAmB,CAAC,gBAAgB,CAAC,CAAC;QAClD,CAAC;IACH,CAAC;IAWO,MAAM,CACZ,IAAyB,EACzB,IAAe,EACf,WAAmB,EACnB,EAAQ;QAER,IAAI,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,kBAAkB,EAAE,CAAC,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;YAC9E,OAAO;QACT,CAAC;QACD,MAAM,IAAI,GACR,IAAI,KAAK,OAAO;YACd,CAAC,CAAC,IAAI,CAAC,YAAY,EAAE,qBAAqB;YAC1C,CAAC,CAAC,IAAI,CAAC,YAAY,EAAE,uBAAuB,CAAC;QACjD,IAAI,OAAO,IAAI,KAAK,UAAU,EAAE,CAAC;YAC/B,OAAO;QACT,CAAC;QACD,OAAO,CAAC,OAAO,EAAE;aACd,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,KAAK,EAAE,WAAW,EAAE,EAAE,CAAC,CAAC;aACrE,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;YACxB,IAAI,CAAC,cAAc,CAAC,KAAK,CACvB,WAAW,IAAI,0BAA0B,IAAI,CAAC,EAAE,EAAE,EAClD,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EACpD,gBAAgB,CACjB,CAAC;QACJ,CAAC,CAAC,CAAC;IACP,CAAC;IAEO,QAAQ,CACd,IAAgD,EAChD,IAAe,EACf,OAAuB,EACvB,KAAyB;QAEzB,MAAM,IAAI,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC,IAAI,CAAC,CAAC;QACzC,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO;QACT,CAAC;QAGD,OAAO,CAAC,OAAO,EAAE;aACd,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;aAChE,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;YACxB,IAAI,CAAC,cAAc,CAAC,KAAK,CACvB,kBAAkB,IAAI,oBAAoB,IAAI,CAAC,EAAE,EAAE,EACnD,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EACpD,gBAAgB,CACjB,CAAC;QACJ,CAAC,CAAC,CAAC;IACP,CAAC;CACF,CAAA;AA3qBY,wCAAc;yBAAd,cAAc;IAD1B,IAAA,mBAAU,GAAE;IASR,WAAA,IAAA,eAAM,EAAC,8BAAkB,CAAC,CAAA;IAE1B,WAAA,IAAA,eAAM,EAAC,4BAAgB,CAAC,CAAA;IAExB,WAAA,IAAA,eAAM,EAAC,+BAAmB,CAAC,CAAA;IAE3B,WAAA,IAAA,eAAM,EAAC,uBAAW,CAAC,CAAA;IAEnB,WAAA,IAAA,eAAM,EAAC,gCAAoB,CAAC,CAAA;IAE5B,WAAA,IAAA,eAAM,EAAC,wBAAY,CAAC,CAAA;IAIpB,WAAA,IAAA,eAAM,EAAC,yBAAa,CAAC,CAAA;qFAFQ,0BAAW;QACV,0CAAkB;GArBxC,cAAc,CA2qB1B;AAED,SAAS,KAAK,CAAC,KAAyB;IACtC,OAAO,KAAK,CAAC,CAAC,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;AAClC,CAAC;AAGD,SAAS,UAAU,CAAC,MAAc;IAChC,OAAO,IAAI,UAAU,CAAC,IAAA,oBAAW,EAAC,MAAM,CAAC,CAAC,CAAC;AAC7C,CAAC;AAED,SAAS,aAAa,CAAC,IAAwB;IAC7C,MAAM,OAAO,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACpC,OAAO,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,eAAe,CAAC,CAAC;AAC3E,CAAC;AAMD,SAAS,iBAAiB,CACxB,SAAiC,EACjC,OAAgC,EAChC,KAAyB,EACzB,MAAe;IAEf,IAAI,SAAS,CAAC,OAAO,KAAK,OAAO;QAAE,OAAO,4BAA4B,CAAC;IACvE,IAAI,CAAC,SAAS,CAAC,KAAK,IAAI,SAAS,CAAC,KAAK,KAAK;QAAE,OAAO,0BAA0B,CAAC;IAChF,IAAI,MAAM,KAAK,SAAS,IAAI,SAAS,CAAC,MAAM,KAAK,MAAM;QAAE,OAAO,yBAAyB,CAAC;IAC1F,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,SAAS,CAAC,MAA+B;IAChD,OAAO;QACL,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,UAAU,EAAE,MAAM,CAAC,UAAU;KAC9B,CAAC;AACJ,CAAC"}

package/dist/services/step-up-token.service.d.ts

@@ -0,0 +1,15 @@
+import { JwtService } from '@nestjs/jwt';
+import type { AuthModuleOptions } from '../auth.module';
+export type StepUpMethod = 'password' | 'passkey' | 'email';
+export declare class StepUpTokenService {
+    private readonly jwtService;
+    private readonly key;
+    private readonly ttlSeconds;
+    constructor(options: AuthModuleOptions, jwtService: JwtService);
+    mint(userId: string, realm: string | undefined, method: StepUpMethod): Promise<{
+        stepUpToken: string;
+        expiresAt: Date;
+    }>;
+    verify(token: string | undefined, userId: string, realm: string | undefined): Promise<boolean>;
+}
+//# sourceMappingURL=step-up-token.service.d.ts.map

package/dist/services/step-up-token.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"step-up-token.service.d.ts","sourceRoot":"","sources":["../../src/services/step-up-token.service.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAGzC,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAGxD,MAAM,MAAM,YAAY,GAAG,UAAU,GAAG,SAAS,GAAG,OAAO,CAAC;AAmC5D,qBACa,kBAAkB;IAM3B,OAAO,CAAC,QAAQ,CAAC,UAAU;IAL7B,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAS;IAC7B,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;gBAGL,OAAO,EAAE,iBAAiB,EACtC,UAAU,EAAE,UAAU;IAQnC,IAAI,CACR,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,GAAG,SAAS,EACzB,MAAM,EAAE,YAAY,GACnB,OAAO,CAAC;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,IAAI,CAAA;KAAE,CAAC;IAqB9C,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC;CAmBrG"}

package/dist/services/step-up-token.service.js

@@ -0,0 +1,71 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.StepUpTokenService = void 0;
+const common_1 = require("@nestjs/common");
+const jwt_1 = require("@nestjs/jwt");
+const crypto_1 = require("crypto");
+const constants_1 = require("../constants");
+const DEFAULT_TTL_SECONDS = 300;
+const AUDIENCE = 'nestjs-auth-graphql:step-up';
+const PURPOSE = 'step-up';
+const HKDF_INFO = 'nestjs-auth-graphql step-up/v1';
+let StepUpTokenService = class StepUpTokenService {
+    constructor(options, jwtService) {
+        this.jwtService = jwtService;
+        this.key = Buffer.from((0, crypto_1.hkdfSync)('sha256', options.jwtSecret, Buffer.alloc(0), HKDF_INFO, 32)).toString('hex');
+        this.ttlSeconds = options.stepUp?.ttlSeconds ?? DEFAULT_TTL_SECONDS;
+    }
+    async mint(userId, realm, method) {
+        const claims = {
+            sub: userId,
+            ...(realm !== undefined ? { realm } : {}),
+            purpose: PURPOSE,
+            method,
+            jti: (0, crypto_1.randomUUID)(),
+        };
+        const stepUpToken = await this.jwtService.signAsync(claims, {
+            secret: this.key,
+            algorithm: 'HS256',
+            audience: AUDIENCE,
+            expiresIn: this.ttlSeconds,
+        });
+        return { stepUpToken, expiresAt: new Date(Date.now() + this.ttlSeconds * 1000) };
+    }
+    async verify(token, userId, realm) {
+        if (!token) {
+            return false;
+        }
+        try {
+            const claims = await this.jwtService.verifyAsync(token, {
+                secret: this.key,
+                algorithms: ['HS256'],
+                audience: AUDIENCE,
+            });
+            return (claims.purpose === PURPOSE &&
+                claims.sub === userId &&
+                (claims.realm ?? undefined) === realm);
+        }
+        catch {
+            return false;
+        }
+    }
+};
+exports.StepUpTokenService = StepUpTokenService;
+exports.StepUpTokenService = StepUpTokenService = __decorate([
+    (0, common_1.Injectable)(),
+    __param(0, (0, common_1.Inject)(constants_1.AUTH_MODULE_OPTIONS)),
+    __metadata("design:paramtypes", [Object, jwt_1.JwtService])
+], StepUpTokenService);
+//# sourceMappingURL=step-up-token.service.js.map

package/dist/services/step-up-token.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"step-up-token.service.js","sourceRoot":"","sources":["../../src/services/step-up-token.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,2CAAoD;AACpD,qCAAyC;AACzC,mCAA8C;AAC9C,4CAAmD;AAMnD,MAAM,mBAAmB,GAAG,GAAG,CAAC;AAChC,MAAM,QAAQ,GAAG,6BAA6B,CAAC;AAC/C,MAAM,OAAO,GAAG,SAAS,CAAC;AAC1B,MAAM,SAAS,GAAG,gCAAgC,CAAC;AA+B5C,IAAM,kBAAkB,GAAxB,MAAM,kBAAkB;IAI7B,YAC+B,OAA0B,EACtC,UAAsB;QAAtB,eAAU,GAAV,UAAU,CAAY;QAEvC,IAAI,CAAC,GAAG,GAAG,MAAM,CAAC,IAAI,CACpB,IAAA,iBAAQ,EAAC,QAAQ,EAAE,OAAO,CAAC,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,EAAE,CAAC,CACtE,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAClB,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,MAAM,EAAE,UAAU,IAAI,mBAAmB,CAAC;IACtE,CAAC;IAED,KAAK,CAAC,IAAI,CACR,MAAc,EACd,KAAyB,EACzB,MAAoB;QAEpB,MAAM,MAAM,GAAiB;YAC3B,GAAG,EAAE,MAAM;YACX,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACzC,OAAO,EAAE,OAAO;YAChB,MAAM;YACN,GAAG,EAAE,IAAA,mBAAU,GAAE;SAClB,CAAC;QACF,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,MAAM,EAAE;YAC1D,MAAM,EAAE,IAAI,CAAC,GAAG;YAChB,SAAS,EAAE,OAAO;YAClB,QAAQ,EAAE,QAAQ;YAClB,SAAS,EAAE,IAAI,CAAC,UAAU;SAC3B,CAAC,CAAC;QACH,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,EAAE,CAAC;IACnF,CAAC;IAMD,KAAK,CAAC,MAAM,CAAC,KAAyB,EAAE,MAAc,EAAE,KAAyB;QAC/E,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,WAAW,CAAe,KAAK,EAAE;gBACpE,MAAM,EAAE,IAAI,CAAC,GAAG;gBAChB,UAAU,EAAE,CAAC,OAAO,CAAC;gBACrB,QAAQ,EAAE,QAAQ;aACnB,CAAC,CAAC;YACH,OAAO,CACL,MAAM,CAAC,OAAO,KAAK,OAAO;gBAC1B,MAAM,CAAC,GAAG,KAAK,MAAM;gBACrB,CAAC,MAAM,CAAC,KAAK,IAAI,SAAS,CAAC,KAAK,KAAK,CACtC,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;CACF,CAAA;AA1DY,gDAAkB;6BAAlB,kBAAkB;IAD9B,IAAA,mBAAU,GAAE;IAMR,WAAA,IAAA,eAAM,EAAC,+BAAmB,CAAC,CAAA;6CACC,gBAAU;GAN9B,kBAAkB,CA0D9B"}