@ambushsoftworks/nestjs-auth-graphql 0.9.1 → 0.11.0

package/CHANGELOG.md

@@ -27,6 +27,237 @@ for buried obligations. **The marker was introduced in 0.9.0 and has not been
 retro-applied**, so it is reliable from 0.9.0 onward only. Convention adopted
 from `@ambushsoftworks/nestjs-payments-graphql`.
 
+## [0.11.0] - 2026-09-15
+
+Ambush Desk asked for two things: refresh retries that survive a second API
+instance, and guards that work on GraphQL subscriptions. Checking the first one
+turned up a retry bug that had been there since the first release. See
+**Fixed**.
+
+### Fixed
+- **Guards failed on GraphQL subscriptions over `graphql-ws`.** Guards read
+  `context.req`, which a subscription does not have. With `GraphQLModule`'s
+  `subscriptions: { 'graphql-ws': true }`, Nest puts graphql-ws's connection
+  object there instead. With an app's own `useServer`, there is no `req` at all.
+  Run over a real `graphql-ws` client on 0.10.0, the guard chain
+  `CsrfGuard` → `createAuthGuard(['jwt'])` → `TenantGuard` → `PermissionGuard`
+  refused every subscription:
+  - with `GraphQLModule` subscriptions, `CsrfGuard` answered `CSRF validation failed`
+  - with an own server, it threw `TypeError`s: `Cannot read properties of
+    undefined (reading 'headers')` with a context function, `(reading 'req')`
+    without one
+
+  Guards now read the WebSocket upgrade request. Authentication, realm, tenant
+  and permission checks all work on subscriptions, and with no request to read,
+  guards answer 401 or 403. Reported by Ambush Desk; Ariadne had been working
+  around it with a subclass.
+- **A retried token refresh was always rejected when the repository deletes
+  used tokens.** Refresh deletes the token it used and keeps the result for 10
+  seconds, so that a client that lost the response can retry. The retry then
+  looked up the used token to find the user, found nothing, and answered
+  `401 Invalid refresh token`. That covers every `IRefreshTokenRepository` whose
+  `delete` removes the row, which is what the method is for. The lookup has been
+  there since `v0.1.3`. The kept result now carries the user ID, and the retry
+  still re-checks account status. Reproduced on 0.10.0 before the fix, with a
+  repository that deletes.
+- **A retry arriving between deleting the used token and keeping the result was
+  rejected.** The result is now kept first.
+
+### Added
+- **`csrf.webSocket: 'reject' | 'skip'`**, default `'reject'`. Browsers cannot
+  send the CSRF header on a WebSocket, so this decides for cookie-authenticated
+  subscriptions: 403, or allow. `'skip'` is safe only with an `Origin` check
+  when the socket connects. A subscription whose upgrade request carries an
+  `Authorization` header is allowed either way. Any other value fails boot.
+  Requested by Ambush Desk.
+- **The realm on subscriptions.** `RealmMiddleware` never sees a WebSocket
+  upgrade, so `JwtStrategy` resolves the realm from the upgrade request itself,
+  once per connection, with the same `realm.skip` and extractor rules. A realm
+  the app sets itself (in `onConnect`, say) is kept. Requested by Ambush Desk.
+- **`isWebSocketContext(context)`, `requireRequestFromContext(context)` and
+  `readCookie(request, name)`**, exported. `readCookie` falls back to parsing
+  the `Cookie` header, which is all an upgrade request has.
+- **`refreshRetryCacheInstance?: IRefreshRetryCache`.** A retry that reached a
+  different instance than the first refresh got `401` and a
+  `TOKEN_REUSE_DETECTED` event, because the retry cache lived in one process.
+  Requested by Ambush Desk.
+  - Implement `get`, `set(key, value, ttlMs)` and `delete` over a store the
+    instances share. The interface's JSDoc has a Postgres example.
+  - Entries hold live tokens, so for any store but the in-memory one they are
+    AES-256-GCM encrypted with a key derived from `encryptionKey`, which then
+    becomes required and must match on every instance.
+  - The package enforces expiry itself, and treats store errors as a miss.
+- **`refreshGracePeriodSeconds`**, default 10. `0` turns retries off. Requested
+  by Ambush Desk.
+- **`InMemoryRefreshRetryCache`**, the default, exported so a single-instance app
+  can pass it explicitly.
+- **Boot warnings for in-memory defaults** that only work within one instance:
+  `rateLimiterInstance` (password-reset throttling) and
+  `refreshRetryCacheInstance`. Pass `new InMemoryRateLimiterService()` and
+  `new InMemoryRefreshRetryCache()` to confirm a single instance and silence
+  them. Requested by Ambush Desk.
+
+### Changed
+- **`getRequestFromContext` returns `Record<string, any> | undefined`.** It finds a
+  subscription's upgrade request, and returns `undefined` when a GraphQL context
+  holds no request. It did before too, while typed as never doing so. TypeScript
+  now flags call sites that assume a request.
+- **Cookie auth no longer requires cookie-parser.** The JWT cookie extractor and
+  `readRefreshTokenFromCookie` fall back to the `Cookie` header.
+- **`CsrfGuard` checks `exemptOperations` before reading any header**, and
+  answers 403 rather than throwing when a GraphQL operation's context holds no
+  request. HTTP outcomes are unchanged.
+- **`RefreshTokenService`'s retry cache methods are async and take the user ID:**
+  - `cacheRefreshResult(usedTokenHash, { userId, accessToken, refreshToken })`
+  - `getCachedRefreshResult(usedTokenHash)`, which resolves to that shape or `null`
+  - `invalidateCachedRefresh(usedTokenHash)`
+
+  The class no longer runs a cleanup timer, and `onModuleDestroy` is gone. This
+  only affects code that calls these methods directly or subclasses the service.
+  Implement `IRefreshRetryCache` instead.
+
+### Documentation
+- **CLAUDE.md described a `gracePeriodSeconds` option that never existed**, and a
+  Redis subclass of `RefreshTokenService` that could not work. It overrode the
+  synchronous cache methods with async ones, and the truthy Promise would have
+  sent every refresh down the cached branch. Both are replaced by the port's real
+  design.
+- README: **Refresh Retries**, **GraphQL Subscriptions**, **Migrating to
+  v0.11.0**, and rows for the new options and utilities.
+
+### Testing
+- **End-to-end subscriptions.** The suite drives real `graphql-ws` clients
+  against three server setups on both NestJS majors: `GraphQLModule`-managed, an
+  own `useServer` with a context, and one without. Against each, it checks
+  delivery, a missing cookie, a wrong realm, a missing permission, another
+  tenant, CSRF `'reject'` and `'skip'`, and a bearer token on the upgrade.
+- **Refresh retries end to end:**
+  - a retry gets the same pair
+  - two instances sharing a store
+  - without a shared store: `TOKEN_REUSE_DETECTED`
+  - after the grace period: 401
+  - a user suspended between the refresh and its retry is refused
+
+## [0.10.0] - 2026-09-15
+
+Ambush Desk, a new consumer on NestJS 11, asked for routes that need no realm, a
+way to leave the OAuth REST routes unmounted, and CI on NestJS 11. Building those
+turned up defects on the OAuth REST routes that affect every app mounting them
+today. See **Fixed** first.
+
+Behaviour changes, so the minor version moves. See **Migrating to v0.10.0** in
+the README.
+
+### Fixed
+- **The OAuth REST routes answered 500 for four ordinary failures.** On
+  `POST /auth/google/token` and `POST /auth/facebook/token`:
+
+  | Situation | Before | Now |
+  |---|---|---|
+  | Provider not configured | 500 | 404 `OAUTH_PROVIDER_NOT_CONFIGURED`, with `provider` |
+  | Account locked | 500 | 403 `ACCOUNT_LOCKED`, with `remainingLockoutTime` |
+  | Account suspended or deleted | 500 | 403 `ACCOUNT_INACTIVE` |
+  | Client IP over `bruteForce.ipRateLimit` | 500 | 429 `RATE_LIMIT_EXCEEDED` |
+
+  The no-op strategies and the controller's lockout and rate-limit checks threw
+  plain `Error`. `AccountLockedException` and `AccountInactiveException` extend
+  `GraphQLError`, which Nest's HTTP layer does not recognise, so since 0.9.0 a
+  suspended user signing in with Google also got a 500. The bodies now use the
+  root-level shape of the other OAuth errors: `message`, `code`, `statusCode`,
+  plus fields. An internal `RestErrorInterceptor` converts the GraphQL-shaped
+  errors on these routes only; GraphQL responses are unchanged. The lockout
+  message is now the one `login` uses.
+- **`createAuthGuard(['api-key', 'jwt'])` rejected every JWT.** `ApiKeyStrategy`
+  threw for a bearer token that matched no key, and a throw stops Passport's
+  strategy chain, so JWT was never tried. That is the order the README and
+  `createAuthGuard`'s JSDoc showed. An unknown token now fails softly and the next
+  strategy runs, so either order accepts either credential. A key whose account is
+  inactive still fails with 401 `API key is inactive`. Reported by Ambush Desk.
+- **The OAuth routes checked lockout and the IP rate limit, and reset failed
+  attempts, without the realm.** With realms enabled, `isAccountLocked`,
+  `getRemainingLockoutTime`, `checkIpRateLimit` and `resetFailedAttempts` were
+  called with no realm. Depending on how your repository treats a missing realm,
+  a lock could apply to the same email in another realm, and a successful sign-in
+  could clear another realm's failed attempts. They now receive the request's
+  realm, as `login` already did.
+
+### Added
+- **`realm.skip: (path, request) => boolean`.** Requests that have no realm by
+  nature, such as health checks, webhooks and public downloads, pass
+  `RealmMiddleware` without calling the extractor, get no `_realm`, and never
+  answer `400 Realm required`. Requested by Ambush Desk.
+  - `path` is the requested path, including any global prefix and without the
+    query string. Do not match on `request.path` or `request.url`: Express
+    rewrites both to `/` inside middleware.
+  - Only a synchronous `true` skips. A throw or any other return value fails
+    closed and is logged.
+  - It is a predicate rather than route patterns because the same Nest route
+    pattern matches different paths on NestJS 10 and 11: `hooks/*` excludes
+    `/hooks/glitchtip/issue` on 11 but not on 10.
+  - With realms enabled, a `skip` that is not a function fails boot with
+    `InvalidAuthConfigException`. `skip` without `realmExtractorInstance` logs a
+    warning.
+  - This closes the `@SkipRealm()` follow-up for requests with no realm. A
+    decorator cannot work, because middleware runs before Nest resolves the
+    handler.
+- **`oauthController: false`** on `AuthModule.forRootAsync`, beside `useFactory`,
+  leaves `OAuthController` unmounted, so both routes answer 404 like any unknown
+  path. Defaults to `true`. Requested by Ambush Desk.
+- `OAuthProviderNotConfiguredException` (404, `OAUTH_PROVIDER_NOT_CONFIGURED`),
+  thrown by the no-op strategies.
+- `AuthService.realmsEnabled`.
+
+### Changed
+- **Realm-scoped entry points refuse a request without a realm.** With realms
+  enabled, `BaseAuthResolver` flows (through `getRealmFromContext`) and the OAuth
+  routes answer `400 Realm required` when the request has no realm, instead of
+  running with `realm` undefined, which many repositories read as "any realm".
+  Before `realm.skip` the middleware ruled this out over HTTP; now it also
+  contains a `skip` predicate that matches more than intended. Code that calls
+  `perform*` methods without the GraphQL context gets the 400 too when realms are
+  enabled.
+- **The OAuth routes' IP rate-limit keys include the realm**
+  (`auth:ipRate:<realm>:<ipHash>`, as for `login`), so existing counts for those
+  routes start again after upgrading.
+- With `['api-key']` alone, an unknown key's 401 now carries the guard's generic
+  `Unauthorized` message instead of `Invalid API key`. That also stops confirming
+  to the caller that the token was checked as an API key.
+- `JwtAuthGuard` reads the request through `getRequestFromContext`, as
+  `createAuthGuard` does, instead of through `GqlExecutionContext`. There is no
+  behaviour change: the old lookup also returned the HTTP request on HTTP routes,
+  checked on NestJS 10 and 11.
+
+### Documentation
+- README: routes without a realm, `oauthController`, the OAuth routes' error
+  table, guard order for API keys and JWTs, a **Module Options** table, NestJS 10
+  and 11 support, and **Migrating to v0.10.0**. The OAuth section no longer calls
+  the routes callback routes; they exchange tokens.
+- `IRefreshTokenRepository` documents that entities returned by
+  `findByHashedToken` must carry `id`, `userId` and `createdAt`, and that refresh
+  measures expiry from `createdAt`. `create` is not given `createdAt`, so a store
+  with no default for it fails on refresh. Found by the new end-to-end suite.
+
+### Testing
+- **CI runs on NestJS 11.** A `test:nest11` job runs the build, unit tests and
+  end-to-end suite on NestJS 11, `@nestjs/graphql` 13, Apollo Server 5 and
+  Express 5, beside the NestJS 10 job. Run locally before release: 982 unit tests
+  and 29 end-to-end tests pass on NestJS 11.2.5, `@nestjs/graphql` 13.4.5, Apollo
+  Server 5.5.1 and Express 5.2.1, with no source change for NestJS 11. On Express,
+  `@nestjs/apollo` 13 also needs `@as-integrations/express5`. Requested by Ambush
+  Desk.
+- **An end-to-end suite** (`npm run test:e2e`, in `test/e2e`) boots a real HTTP
+  and GraphQL (Apollo) application against the built package, with in-memory
+  repositories. It covers:
+  - realm skipping and rejection
+  - the OAuth routes mounted, unmounted, and failing with each status above
+  - `createAuthGuard` with API keys and JWTs in both orders, on HTTP and in a
+    resolver
+  - `JwtAuthGuard` on HTTP
+  - login and refresh through a `BaseAuthResolver` subclass
+
+  Each fix above was checked by reintroducing the defect and watching a unit or
+  end-to-end test fail.
+
 ## [0.9.1] - 2026-09-14
 
 Documentation only — no code changes. npm shows the README of the latest

package/README.md

@@ -20,10 +20,12 @@ Production-grade authentication module for NestJS GraphQL + REST APIs. JWT, cook
   - [Password Policy](#password-policy)
   - [Lifecycle Hooks](#lifecycle-hooks)
   - [Account Status](#account-status)
+  - [Refresh Retries](#refresh-retries)
   - [JWT Validation Modes](#jwt-validation-modes)
   - [JWT Payload Factory](#jwt-payload-factory)
 - [Configuration Reference](#configuration-reference)
   - [Required Options](#required-options)
+  - [Module Options](#module-options-forrootasync)
   - [Common Options](#common-options)
   - [Feature Flags](#feature-flags-features)
   - [Security Secrets](#security-secrets)
@@ -34,8 +36,11 @@ Production-grade authentication module for NestJS GraphQL + REST APIs. JWT, cook
   - [Optional Instance Options](#optional-instance-options)
 - [Decorators](#decorators)
 - [Guards](#guards)
+  - [GraphQL Subscriptions](#graphql-subscriptions)
 - [Utilities](#utilities)
 - [Security Features](#security-features)
+- [Migrating to v0.11.0](#migrating-to-v0110)
+- [Migrating to v0.10.0](#migrating-to-v0100)
 - [Migrating to v0.9.0](#migrating-to-v090)
 - [License](#license)
 
@@ -65,6 +70,8 @@ npm install @nestjs/common @nestjs/core @nestjs/graphql @nestjs/jwt @nestjs/pass
 
 `resend` is an optional peer dependency -- install it only if using the Resend email sender.
 
+Supports NestJS 10 and NestJS 11. CI runs the unit and end-to-end suites on both: NestJS 10 with `@nestjs/graphql` 12, Express 4 and Apollo Server 4, and NestJS 11 with `@nestjs/graphql` 13, Express 5 and Apollo Server 5.
+
 ## Quick Start
 
 Minimal setup: JWT authentication with email/password login.
@@ -469,6 +476,29 @@ AuthModule.forRootAsync({
 
 `RealmMiddleware` is automatically registered by `AuthModule` — no manual middleware registration needed. When a `realmExtractorInstance` is provided, the middleware calls `extractor.extractRealm(request)` on every request before any guards run. If the extractor returns `null`, the request is rejected with `400 Bad Request` (strict mode).
 
+**Routes without a realm.** Health checks, inbound webhooks and public downloads have no realm by nature. Match them with `realm.skip`, and the middleware lets them through without calling the extractor:
+
+```typescript
+AuthModule.forRootAsync({
+  // ...
+  useFactory: (usersRepo, tokenRepo, realmExtractor, config) => ({
+    // ...required options
+    realmExtractorInstance: realmExtractor,
+    realm: {
+      skip: (path) => path === '/health' || path.startsWith('/hooks/'),
+    },
+  }),
+})
+```
+
+- `path` is the path the client requested, including any global prefix and without the query string. Match on it, not on `request.path` or `request.url`: Express rewrites both to `/` inside middleware. The request itself is the second argument.
+- A skipped request has no realm: `request._realm` stays undefined.
+- **Skip only routes that are unauthenticated or authenticate by other means.** A JWT's realm claim cannot match a request with no realm, so `JwtStrategy` answers 401. `BaseAuthResolver` flows and the OAuth routes answer `400 Realm required` rather than run outside a realm, which also contains a predicate that matches more than you meant.
+- `skip` must return a boolean synchronously. If it throws or returns anything else, such as the Promise from an `async` function, the request is not skipped and the error is logged.
+- Without `realmExtractorInstance`, `realm.skip` is ignored and a warning is logged at boot. A `realm.skip` that is not a function fails boot with `InvalidAuthConfigException`.
+
+Why a predicate rather than route patterns: the same Nest route pattern matches different paths on NestJS 10 and NestJS 11 — `hooks/*` excludes `/hooks/glitchtip/issue` on 11 but not on 10 — so a pattern list would behave differently depending on your Nest version. A `@SkipRealm()` decorator cannot work either, because middleware runs before Nest resolves the route handler.
+
 **Use `@CurrentRealm()` in resolvers:**
 
 ```typescript
@@ -525,7 +555,9 @@ Then use a multi-strategy guard:
 { provide: APP_GUARD, useClass: createAuthGuard(['api-key', 'jwt'], { allowPublic: true }) }
 ```
 
-The `ApiKeyStrategy` hashes the bearer token with SHA-256 and calls `findByKeyHash()` on your repository. API keys and JWT tokens use the same `Authorization: Bearer` header -- strategies are tried in the order specified. When no bearer token is present (e.g. cookie auth), the API key strategy gracefully falls through to the next strategy.
+The `ApiKeyStrategy` hashes the bearer token with SHA-256 and calls `findByKeyHash()` on your repository. API keys and JWTs share the `Authorization: Bearer` header, and strategies are tried in the order listed. A request with no bearer token, or with one that matches no key, falls through to the next strategy, so `['api-key', 'jwt']` and `['jwt', 'api-key']` both accept either credential. A key that matches an inactive account is rejected with 401 and no other strategy runs. When every strategy fails, the guard answers 401.
+
+Before 0.10.0 the API key strategy rejected an unknown bearer token itself, which stopped the chain: `['api-key', 'jwt']` rejected every JWT.
 
 ### Email System
 
@@ -695,7 +727,33 @@ AuthModule.forRootAsync({
 })
 ```
 
-The `OAuthController` is automatically registered and handles OAuth callback routes. OAuth strategies gracefully degrade to no-ops when credentials are not configured.
+`OAuthController` mounts two token-exchange routes for native mobile sign-in: `POST /auth/google/token` with body `{ "idToken": "..." }`, and `POST /auth/facebook/token` with body `{ "accessToken": "..." }`. Both return `{ accessToken, refreshToken, user }`.
+
+**Not using them?** Leave them unmounted, and they answer 404 like any unknown path:
+
+```typescript
+AuthModule.forRootAsync({
+  oauthController: false, // beside useFactory, not inside it
+  useFactory: () => ({ /* ... */ }),
+})
+```
+
+It sits beside `useFactory` because Nest fixes a module's controllers before async options resolve. GraphQL account linking does not use these routes and keeps working.
+
+**Errors.** The routes answer with an HTTP status and a body carrying `message`, `code` and `statusCode` at the root, plus the fields listed:
+
+| Status | `code` | When | Other fields |
+|--------|--------|------|--------------|
+| 404 | `OAUTH_PROVIDER_NOT_CONFIGURED` | The provider has no credentials in this deployment | `provider` |
+| 401 | `INVALID_OAUTH_TOKEN` | The provider rejected the token | `provider` |
+| 400 | `OAUTH_MISSING_DATA` | The provider returned no email, or an unverified one | `provider`, `missingField`; for a new Facebook user, `fallbackToken` and `providerId` |
+| 409 | `EMAIL_EXISTS_WITH_PASSWORD` | The email belongs to a password account | `email`, `linkingToken` |
+| 409 | `OAUTH_ACCOUNT_ALREADY_LINKED` | The account has a different ID linked for this provider | `provider` |
+| 403 | `ACCOUNT_LOCKED` | Brute-force lockout | `remainingLockoutTime` (seconds) |
+| 403 | `ACCOUNT_INACTIVE` | The account is suspended or deleted | -- |
+| 429 | `RATE_LIMIT_EXCEEDED` | The client IP exceeded `bruteForce.ipRateLimit` | -- |
+
+With realms enabled, a request without a realm gets `400 Realm required` first. Before 0.10.0 the lockout, inactive-account, rate-limit and unconfigured-provider cases answered 500.
 
 ### Brute Force Protection
 
@@ -871,6 +929,35 @@ It must be synchronous and pure: it runs on every authenticated request, against
 
 **Your repository must return inactive users.** `findById` and `findByEmail` should return suspended and soft-deleted users like any other. A repository that hides them turns `ACCOUNT_INACTIVE` into a "not found" failure, and the package can no longer tell the client why.
 
+### Refresh Retries
+
+Refresh tokens rotate: each refresh deletes the token it used. A client that loses the response — a dropped connection, a timeout, an HTTP client that retries — sends the used token again, which looks exactly like a stolen token being replayed. For `refreshGracePeriodSeconds` (default 10) the package remembers the result and answers the retry with the same token pair. `0` turns this off.
+
+**One instance:** nothing to do.
+
+**More than one instance:** give every instance the same store, or a retry that reaches a different instance gets `401` and signs the user out:
+
+```typescript
+AuthModule.forRootAsync({
+  inject: [PgRefreshRetryCache, PgRateLimiter, ConfigService],
+  useFactory: (retryCache, rateLimiter, config) => ({
+    // ...required options
+    refreshRetryCacheInstance: retryCache,
+    encryptionKey: config.getOrThrow('ENCRYPTION_KEY'), // required with a shared store, same on every instance
+    rateLimiterInstance: rateLimiter, // password-reset throttling needs sharing for the same reason
+  }),
+})
+```
+
+- Implement `IRefreshRetryCache` (`get`, `set(key, value, ttlMs)`, `delete`) over Redis, Postgres, or any store the instances share. Its JSDoc has a Postgres example.
+- The values are AES-256-GCM ciphertext, because they hold live tokens. Boot fails with `InvalidAuthConfigException` when `encryptionKey` is missing.
+- The package enforces expiry itself, so the store's TTL can be approximate.
+- A store that errors costs retries, never the refresh itself.
+
+At boot the package warns for each in-memory default in use, `rateLimiterInstance` and `refreshRetryCacheInstance`, because it cannot tell how many instances run. Pass `new InMemoryRateLimiterService()` and `new InMemoryRefreshRetryCache()` explicitly to confirm a single instance and silence them.
+
+Before 0.11.0 a retry got `401` whenever `IRefreshTokenRepository.delete` removed the used token, even on a single instance.
+
 ### JWT Validation Modes
 
 - **`'full'`** (default) -- Calls `userRepository.findById()` on every request, rejecting the request if the user no longer exists or is no longer active (see [Account Status](#account-status)).
@@ -907,6 +994,17 @@ jwtPayloadFactoryInstance: {
 | `refreshTokenRepositoryInstance` | `IRefreshTokenRepository` | Token persistence |
 | `jwtSecret` | `string` | JWT signing secret |
 
+### Module Options (`forRootAsync`)
+
+These sit beside `useFactory`, not in the object it returns.
+
+| Option | Type | Default | Description |
+|--------|------|---------|-------------|
+| `useFactory` | `(...deps) => AuthModuleOptions` | -- | Returns the options in the other tables. Required |
+| `inject` | `any[]` | `[]` | Providers passed to `useFactory` |
+| `imports` | `any[]` | `[]` | Modules that export those providers |
+| `oauthController` | `boolean` | `true` | Mount the REST OAuth token routes. See [OAuth](#oauth) |
+
 ### Common Options
 
 | Option | Type | Default | Description |
@@ -920,6 +1018,8 @@ jwtPayloadFactoryInstance: {
 | `passwordPolicy` | `PasswordPolicyConfig` | See [Password Policy](#password-policy) | Password strength rules |
 | `encryptionKey` | `string` | -- | 32-byte hex string for AES-256-GCM (OAuth token encryption) |
 | `bruteForce.ipRateLimit` | `{ maxAttempts, windowMs }` | -- | IP rate-limit policy for `checkIpRateLimit`. When set, `rateLimiterInstance` MUST also be provided explicitly (boot fails with `InvalidAuthConfigException` otherwise). See [IP Rate Limiting](#ip-rate-limiting). |
+| `realm.skip` | `(path, request) => boolean` | -- | Requests that need no realm, such as health checks and webhooks. Read only with `realmExtractorInstance`. See [Realm-Based Identity Isolation](#realm-based-identity-isolation) |
+| `refreshGracePeriodSeconds` | `number` | `10` | How long a retried refresh gets the same token pair. `0` turns retries off. See [Refresh Retries](#refresh-retries) |
 
 ### Feature Flags (`features`)
 
@@ -975,6 +1075,7 @@ Separate HMAC secrets for security isolation. All fall back to `jwtSecret` if no
 | `headerName` | `string` | `'X-Requested-With'` | Header to check |
 | `requireInProduction` | `boolean` | `true` | Require CSRF header in production |
 | `exemptOperations` | `string[]` | `[]` | GraphQL operations to skip |
+| `webSocket` | `'reject' \| 'skip'` | `'reject'` | Cookie-authenticated GraphQL subscriptions: refuse with 403, or allow. `'skip'` needs an `Origin` check when the socket connects. See [GraphQL Subscriptions](#graphql-subscriptions) |
 
 ### Composable Email (`email`)
 
@@ -1012,6 +1113,7 @@ When `email` is provided, it takes precedence over `emailServiceInstance`.
 | `jwtPayloadFactoryInstance` | `IJwtPayloadFactory` | `DefaultJwtPayloadFactory` |
 | `apiKeyRepositoryInstance` | `IApiKeyRepository` | `null` |
 | `rateLimiterInstance` | `IRateLimiter` | `InMemoryRateLimiterService` (Note: this fallback does NOT apply when `bruteForce.ipRateLimit` is configured — boot fails with `InvalidAuthConfigException` and an explicit `rateLimiterInstance` is required. See [IP Rate Limiting](#ip-rate-limiting) above.) |
+| `refreshRetryCacheInstance` | `IRefreshRetryCache` | `InMemoryRefreshRetryCache`, which answers retries on the same instance only. A shared store requires `encryptionKey`. See [Refresh Retries](#refresh-retries) |
 | `realmExtractorInstance` | `IRealmExtractor` | `null` (realms disabled) |
 
 ---
@@ -1037,7 +1139,7 @@ When `email` is provided, it takes precedence over `emailServiceInstance`.
 | `CsrfGuard` | CSRF header validation for cookie auth |
 | `TenantGuard` | Multi-tenant context resolution |
 | `PermissionGuard` | Permission checking against tenant context |
-| `JwtAuthGuard` | Basic JWT guard (prefer `createAuthGuard`) |
+| `JwtAuthGuard` | JWT-only guard for GraphQL and HTTP routes (prefer `createAuthGuard` for several strategies or `@Public()`) |
 
 ### Recommended Guard Chains
 
@@ -1057,13 +1159,45 @@ When realm support is enabled, `RealmMiddleware` runs before all guards (as Nest
 { provide: APP_GUARD, useClass: PermissionGuard },
 ```
 
+### GraphQL Subscriptions
+
+The guards also protect subscriptions over `graphql-ws`. A socket has no HTTP request, so they read the WebSocket upgrade request instead: the headers and cookies the client opened the connection with.
+
+| Guard | On a subscription |
+|-------|-------------------|
+| `createAuthGuard`, `JwtAuthGuard` | Authenticates from the upgrade request's `Authorization` header or session cookie. `RealmMiddleware` never sees the upgrade, so the realm is resolved from it once per connection |
+| `TenantGuard`, `PermissionGuard` | Resolve the tenant and check permissions from the upgrade request |
+| `CsrfGuard` | Browsers cannot send the CSRF header on a WebSocket, so `csrf.webSocket` decides: `'reject'` (default) answers 403, `'skip'` allows. A connection with an `Authorization` header is allowed either way |
+
+**Use `'skip'` only with an `Origin` check when the socket connects.** That check is what stops another site from opening a socket with your users' cookies.
+
+With your own `graphql-ws` server, also pass the connection through as the context. Without it, guards receive no request and refuse every subscription with 401:
+
+```typescript
+useServer(
+  {
+    schema,
+    context: (ctx) => ctx,
+    onConnect: (ctx) => ALLOWED_ORIGINS.includes(ctx.extra.request.headers.origin ?? ''),
+  },
+  wsServer,
+);
+```
+
+With `GraphQLModule`'s `subscriptions: { 'graphql-ws': { onConnect } }`, the guards find the upgrade request on their own; put the same `onConnect` there.
+
+`isWebSocketContext(context)` and `readCookie(request, name)` are exported for your own guards and connection handlers.
+
 ## Utilities
 
 Helper functions exported for use in custom guards, middleware and loggers:
 
 | Function | Description |
 |----------|-------------|
-| `getRequestFromContext(context)` | Extract request from `ExecutionContext` (handles GraphQL + HTTP) |
+| `getRequestFromContext(context)` | The request behind an `ExecutionContext`: HTTP, GraphQL, or a `graphql-ws` subscription's upgrade request. `undefined` when there is none |
+| `requireRequestFromContext(context)` | The same, but throws `UnauthorizedException` when there is no request |
+| `isWebSocketContext(context)` | Whether the context is a GraphQL subscription over a WebSocket |
+| `readCookie(request, name)` | A cookie's value from `request.cookies`, or parsed from the `Cookie` header (a WebSocket upgrade request has only the header) |
 | `extractIpAddress(request)` | Extract client IP (checks `clientIp`, `req.ip`, falls back to `'unknown'`) |
 | `isUserActiveByDefault(user)` | The default account-active predicate (see [Account Status](#account-status)) |
 | `emailForLog(email)`, `ipForLog(ip)` | An email or IP as it may appear in a log line — `emailHash=…` / `ipHash=…`, salted like the package's own logs |
@@ -1072,12 +1206,12 @@ Helper functions exported for use in custom guards, middleware and loggers:
 | `hashIp(ip, salt)` | HMAC-SHA256 IP hash (16 hex characters) used for rate-limit keys |
 
 ```typescript
-import { getRequestFromContext, extractIpAddress } from '@ambushsoftworks/nestjs-auth-graphql';
+import { requireRequestFromContext, extractIpAddress } from '@ambushsoftworks/nestjs-auth-graphql';
 
 @Injectable()
 export class CustomGuard implements CanActivate {
   canActivate(context: ExecutionContext): boolean {
-    const request = getRequestFromContext(context);
+    const request = requireRequestFromContext(context);
     const ip = extractIpAddress(request);
     // your logic
     return true;
@@ -1087,7 +1221,7 @@ export class CustomGuard implements CanActivate {
 
 ## Security Features
 
-- **Refresh token rotation** with HMAC-SHA256 hashing and idempotent 10-second grace period
+- **Refresh token rotation** with HMAC-SHA256 hashing; a retried refresh gets the same pair for 10 seconds (configurable, shareable across instances, encrypted at rest)
 - **Bcrypt password hashing** with configurable rounds (default: 12)
 - **Account status enforcement** -- suspended and deleted users are rejected at login, on refresh and on every authenticated request (`ACCOUNT_INACTIVE`)
 - **AES-256-GCM encryption** for OAuth tokens at rest
@@ -1096,9 +1230,31 @@ export class CustomGuard implements CanActivate {
 - **Stateless CSRF protection** for OAuth flows via `OAuthStateService`
 - **`__Host-` cookie prefix** support for enhanced cookie security
 - **Separate HMAC secrets** for refresh tokens, verification codes, and OAuth state
-- **Realm-based identity isolation** with JWT realm claim validation and realm-scoped rate limiting
+- **Realm-based identity isolation** with JWT realm claim validation, realm-scoped rate limiting and lockout, and auth flows that refuse a request without a realm
 - **No raw personal data in package logs** — log lines use the user ID or a salted hash (`emailHash=`, `ipHash=`, under `AUTH_IP_HASH_SALT` or `jwtSecret`), phone numbers keep only their last two digits, and the default `ConsoleAuthLogger` redacts security-event metadata. A custom `authLoggerInstance` receives the raw fields; pass them through `redactSecurityEventMetadata` to store them redacted.
 
+## Migrating to v0.11.0
+
+**`getRequestFromContext` may return `undefined`.** It now also finds a `graphql-ws` subscription's upgrade request, and returns `undefined` where there is no request at all. TypeScript flags each call that assumes a request. In a guard that cannot decide without one, use `requireRequestFromContext`.
+
+**Subscriptions through `CsrfGuard`.** With cookie auth they answer 403 unless you set `csrf.webSocket: 'skip'`, together with an `Origin` check when the socket connects. They failed before 0.11.0 as well: with that same 403 on `GraphQLModule` subscriptions, or a `TypeError` on your own `graphql-ws` server. See [GraphQL Subscriptions](#graphql-subscriptions).
+
+**Cookie auth no longer needs cookie-parser.** The access and refresh token cookies are read from the `Cookie` header when `request.cookies` is absent.
+
+**More than one instance.** Set `refreshRetryCacheInstance` and `encryptionKey`, or retried refreshes that reach another instance sign users out; see [Refresh Retries](#refresh-retries). Boot now warns for each in-memory default in use. `RefreshTokenService`'s retry cache methods became async, which only matters if you call or override them.
+
+## Migrating to v0.10.0
+
+No code change is required. Check the items that apply to you.
+
+**Clients of the OAuth REST routes.** Four failures that answered 500 now answer 404, 403 or 429 with a `code`; see the table under [OAuth](#oauth). A client that shows a generic error for any failure keeps working. One that branched on 500, or on the old message `Account is locked. Please try again in N minutes.`, should read `code` instead. The lockout message is now the one `login` uses.
+
+**API key guards.** `createAuthGuard(['api-key', 'jwt'])` now accepts JWTs. With `['api-key']` alone, an unknown key still gets 401, now with the guard's generic `Unauthorized` message rather than `Invalid API key`.
+
+**Realms.** With realms enabled, a `BaseAuthResolver` flow or OAuth route reached by a request without a realm answers `400 Realm required`. Before `realm.skip`, `RealmMiddleware` made that impossible, so in practice this affects only code calling `perform*` methods without the GraphQL context, which now counts as having no realm. The OAuth routes also pass the realm to lockout checks, IP rate limiting and the failed-attempt reset. Their IP rate-limit counters move to the realm-prefixed keys `login` already uses (`auth:ipRate:<realm>:<ipHash>`), so existing counts for those routes start again.
+
+**NestJS 11.** The package needs no change to run on it; CI now tests both majors.
+
 ## Migrating to v0.9.0
 
 **Behaviour change — suspended and deleted accounts are rejected.** Before

package/dist/auth.module.d.ts

@@ -18,6 +18,7 @@ import { IJwtPayloadFactory } from './interfaces/jwt-payload-factory.interface';
 import { IApiKeyRepository } from './interfaces/api-key-repository.interface';
 import { PasswordPolicyConfig } from './interfaces/password-policy-config.interface';
 import { IRateLimiter } from './interfaces/rate-limiter.interface';
+import { IRefreshRetryCache } from './interfaces/refresh-retry-cache.interface';
 import { IEmailSender } from './interfaces/email-sender.interface';
 import { IEmailTemplateRenderer } from './interfaces/email-template-renderer.interface';
 import { EmailBrandingConfig } from './interfaces/email-branding-config.interface';
@@ -49,6 +50,9 @@ export interface AuthModuleOptions {
     tenantRepositoryInstance?: ITenantRepository;
     tenantExtractorInstance?: ITenantExtractor;
     realmExtractorInstance?: IRealmExtractor;
+    realm?: {
+        skip?: (path: string, request: Record<string, any>) => boolean;
+    };
     resourcePermissionRepositoryInstance?: IResourcePermissionRepository;
     jwtPayloadFactoryInstance?: IJwtPayloadFactory;
     apiKeyRepositoryInstance?: IApiKeyRepository;
@@ -76,6 +80,7 @@ export interface AuthModuleOptions {
         headerName?: string;
         requireInProduction?: boolean;
         exemptOperations?: string[];
+        webSocket?: 'reject' | 'skip';
     };
     jwtSecret: string;
     jwtExpiresIn?: string;
@@ -95,6 +100,8 @@ export interface AuthModuleOptions {
     encryptionKey?: string;
     passwordPolicy?: PasswordPolicyConfig;
     rateLimiterInstance?: IRateLimiter;
+    refreshGracePeriodSeconds?: number;
+    refreshRetryCacheInstance?: IRefreshRetryCache;
     bruteForce?: {
         ipRateLimit?: {
             maxAttempts: number;
@@ -119,9 +126,12 @@ export interface AuthModuleOptions {
 export interface AuthModuleAsyncOptions extends Pick<ModuleMetadata, 'imports'> {
     useFactory: (...args: any[]) => Promise<AuthModuleOptions> | AuthModuleOptions;
     inject?: any[];
+    oauthController?: boolean;
 }
 export declare function validateAuthModuleOptions(opts: AuthModuleOptions): void;
 export declare function describeIgnoredFeatureFlags(opts: AuthModuleOptions): string[];
+export declare function describeIgnoredOptions(opts: AuthModuleOptions): string[];
+export declare function describeInMemoryDefaults(opts: AuthModuleOptions): string[];
 export { AUTH_MODULE_OPTIONS, USER_REPOSITORY, REFRESH_TOKEN_REPOSITORY, EMAIL_SERVICE, SMS_SERVICE, AUTH_LIFECYCLE_HOOKS, VERIFICATION_REPOSITORY, BRUTE_FORCE_REPOSITORY, BIOMETRIC_REPOSITORY, AUTH_LOGGER, RATE_LIMITER, TENANT_REPOSITORY, TENANT_EXTRACTOR, RESOURCE_PERMISSION_REPOSITORY, JWT_PAYLOAD_FACTORY, API_KEY_REPOSITORY, } from './constants';
 export declare class AuthModule implements NestModule {
     configure(consumer: MiddlewareConsumer): void;

package/dist/auth.module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.module.d.ts","sourceRoot":"","sources":["../src/auth.module.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,aAAa,EACb,kBAAkB,EAElB,UAAU,EAGX,MAAM,gBAAgB,CAAC;AAIxB,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AA0B3D,OAAO,EAAE,eAAe,EAAE,MAAM,wCAAwC,CAAC;AACzE,OAAO,EAAE,SAAS,EAAE,MAAM,kCAAkC,CAAC;AAC7D,OAAO,EAAE,aAAa,EAAE,MAAM,sCAAsC,CAAC;AACrE,OAAO,EAAE,WAAW,EAAE,MAAM,oCAAoC,CAAC;AACjE,OAAO,EAAE,mBAAmB,EAAE,MAAM,6CAA6C,CAAC;AAClF,OAAO,EAAE,uBAAuB,EAAE,MAAM,iDAAiD,CAAC;AAC1F,OAAO,EAAE,uBAAuB,EAAE,MAAM,gDAAgD,CAAC;AACzF,OAAO,EAAE,qBAAqB,EAAE,MAAM,+CAA+C,CAAC;AACtF,OAAO,EAAE,oBAAoB,EAAE,MAAM,6CAA6C,CAAC;AACnF,OAAO,EAAE,WAAW,EAAE,MAAM,oCAAoC,CAAC;AAYjE,OAAO,EAAE,iBAAiB,EAAE,MAAM,0CAA0C,CAAC;AAC7E,OAAO,EAAE,gBAAgB,EAAE,MAAM,yCAAyC,CAAC;AAC3E,OAAO,EAAE,eAAe,EAAE,MAAM,wCAAwC,CAAC;AACzE,OAAO,EAAE,6BAA6B,EAAE,MAAM,uDAAuD,CAAC;AACtG,OAAO,EAAE,kBAAkB,EAAE,MAAM,4CAA4C,CAAC;AAChF,OAAO,EAAE,iBAAiB,EAAE,MAAM,2CAA2C,CAAC;AA8B9E,OAAO,EAAE,oBAAoB,EAAE,MAAM,+CAA+C,CAAC;AAGrF,OAAO,EAAE,YAAY,EAAE,MAAM,qCAAqC,CAAC;AAInE,OAAO,EAAE,YAAY,EAAE,MAAM,qCAAqC,CAAC;AACnE,OAAO,EAAE,sBAAsB,EAAE,MAAM,gDAAgD,CAAC;AAIxF,OAAO,EAAE,mBAAmB,EAAE,MAAM,8CAA8C,CAAC;AAwBnF,MAAM,WAAW,iBAAiB;IAMhC,sBAAsB,EAAE,eAAe,CAAC;IAOxC,8BAA8B,EAAE,uBAAuB,CAAC;IAOxD,oBAAoB,CAAC,EAAE,aAAa,CAAC;IAOrC,kBAAkB,CAAC,EAAE,WAAW,CAAC;IAMjC,sBAAsB,CAAC,EAAE,mBAAmB,CAAC;IAM7C,8BAA8B,CAAC,EAAE,uBAAuB,CAAC;IAMzD,4BAA4B,CAAC,EAAE,qBAAqB,CAAC;IAMrD,2BAA2B,CAAC,EAAE,oBAAoB,CAAC;IAQnD,kBAAkB,CAAC,EAAE,WAAW,CAAC;IAQjC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAQ5B,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAQhC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAQ1B,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAMhC,MAAM,CAAC,EAAE;QACP,UAAU,EAAE,MAAM,CAAC;QACnB,SAAS,EAAE,MAAM,CAAC;QAClB,WAAW,EAAE,MAAM,CAAC;KACrB,CAAC;IAMF,QAAQ,CAAC,EAAE;QACT,MAAM,EAAE,MAAM,CAAC;QACf,SAAS,EAAE,MAAM,CAAC;QAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;KACnB,CAAC;IAOF,OAAO,CAAC,EAAE,MAAM,CAAC;IASjB,wBAAwB,CAAC,EAAE,iBAAiB,CAAC;IAS7C,uBAAuB,CAAC,EAAE,gBAAgB,CAAC;IAY3C,sBAAsB,CAAC,EAAE,eAAe,CAAC;IAQzC,oCAAoC,CAAC,EAAE,6BAA6B,CAAC;IAOrE,yBAAyB,CAAC,EAAE,kBAAkB,CAAC;IAO/C,wBAAwB,CAAC,EAAE,iBAAiB,CAAC;IAmB7C,aAAa,CAAC,EAAE,MAAM,GAAG,cAAc,CAAC;IAyBxC,YAAY,CAAC,EAAE,CAAC,IAAI,EAAE,SAAS,KAAK,OAAO,CAAC;IAO5C,YAAY,CAAC,EAAE,MAAM,CAAC;IAmBtB,QAAQ,CAAC,EAAE;QAOT,0BAA0B,CAAC,EAAE,OAAO,CAAC;QAQrC,UAAU,CAAC,EAAE,OAAO,CAAC;QAOrB,gBAAgB,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;KACrC,CAAC;IAMF,MAAM,CAAC,EAAE;QAEP,QAAQ,CAAC,EAAE,OAAO,CAAC;QAEnB,MAAM,CAAC,EAAE,OAAO,CAAC;QAEjB,QAAQ,CAAC,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,CAAC;QAErC,MAAM,CAAC,EAAE,MAAM,CAAC;QAEhB,IAAI,CAAC,EAAE,MAAM,CAAC;QAEd,iBAAiB,CAAC,EAAE,MAAM,CAAC;QAE3B,kBAAkB,CAAC,EAAE,MAAM,CAAC;QAE5B,eAAe,CAAC,EAAE,MAAM,CAAC;QAEzB,gBAAgB,CAAC,EAAE,MAAM,CAAC;QAc1B,aAAa,CAAC,EAAE,OAAO,CAAC;KACzB,CAAC;IAMF,IAAI,CAAC,EAAE;QAEL,UAAU,CAAC,EAAE,MAAM,CAAC;QAEpB,mBAAmB,CAAC,EAAE,OAAO,CAAC;QAE9B,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;KAC7B,CAAC;IAMF,SAAS,EAAE,MAAM,CAAC;IAMlB,YAAY,CAAC,EAAE,MAAM,CAAC;IAMtB,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAK/B,KAAK,CAAC,EAAE;QACN,MAAM,CAAC,EAAE;YACP,QAAQ,EAAE,MAAM,CAAC;YACjB,YAAY,EAAE,MAAM,CAAC;YACrB,WAAW,EAAE,MAAM,CAAC;SACrB,CAAC;QACF,QAAQ,CAAC,EAAE;YACT,QAAQ,EAAE,MAAM,CAAC;YACjB,YAAY,EAAE,MAAM,CAAC;YACrB,WAAW,EAAE,MAAM,CAAC;SACrB,CAAC;KACH,CAAC;IAOF,aAAa,CAAC,EAAE,MAAM,CAAC;IAsBvB,cAAc,CAAC,EAAE,oBAAoB,CAAC;IAqBtC,mBAAmB,CAAC,EAAE,YAAY,CAAC;IAuBnC,UAAU,CAAC,EAAE;QAeX,WAAW,CAAC,EAAE;YAEZ,WAAW,EAAE,MAAM,CAAC;YAEpB,QAAQ,EAAE,MAAM,CAAC;SAClB,CAAC;KACH,CAAC;IAiBF,KAAK,CAAC,EAAE;QAEN,MAAM,EAAE,YAAY,CAAC;QAErB,IAAI,EAAE;YAAE,KAAK,EAAE,MAAM,CAAC;YAAC,IAAI,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;QAEvC,QAAQ,CAAC,EAAE,mBAAmB,CAAC;QAE/B,gBAAgB,CAAC,EAAE,sBAAsB,CAAC;KAC3C,CAAC;IAKF,YAAY,CAAC,EAAE;QAEb,WAAW,CAAC,EAAE,MAAM,CAAC;QAErB,qBAAqB,CAAC,EAAE,MAAM,CAAC;QAE/B,OAAO,CAAC,EAAE,MAAM,CAAC;KAClB,CAAC;CACH;AAKD,MAAM,WAAW,sBAAuB,SAAQ,IAAI,CAAC,cAAc,EAAE,SAAS,CAAC;IAC7E,UAAU,EAAE,CACV,GAAG,IAAI,EAAE,GAAG,EAAE,KACX,OAAO,CAAC,iBAAiB,CAAC,GAAG,iBAAiB,CAAC;IACpD,MAAM,CAAC,EAAE,GAAG,EAAE,CAAC;CAChB;AA0BD,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,iBAAiB,GAAG,IAAI,CAqCvE;AA2ED,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,iBAAiB,GAAG,MAAM,EAAE,CAwB7E;AAuDD,OAAO,EACL,mBAAmB,EACnB,eAAe,EACf,wBAAwB,EACxB,aAAa,EACb,WAAW,EACX,oBAAoB,EACpB,uBAAuB,EACvB,sBAAsB,EACtB,oBAAoB,EACpB,WAAW,EACX,YAAY,EACZ,iBAAiB,EACjB,gBAAgB,EAChB,8BAA8B,EAC9B,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,aAAa,CAAC;AAuCrB,qBACa,UAAW,YAAW,UAAU;IAC3C,SAAS,CAAC,QAAQ,EAAE,kBAAkB,GAAG,IAAI;IAkC7C,MAAM,CAAC,YAAY,CAAC,OAAO,EAAE,sBAAsB,GAAG,aAAa;CA8YpE"}
+{"version":3,"file":"auth.module.d.ts","sourceRoot":"","sources":["../src/auth.module.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,aAAa,EACb,kBAAkB,EAElB,UAAU,EAGX,MAAM,gBAAgB,CAAC;AAIxB,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AA0B3D,OAAO,EAAE,eAAe,EAAE,MAAM,wCAAwC,CAAC;AACzE,OAAO,EAAE,SAAS,EAAE,MAAM,kCAAkC,CAAC;AAC7D,OAAO,EAAE,aAAa,EAAE,MAAM,sCAAsC,CAAC;AACrE,OAAO,EAAE,WAAW,EAAE,MAAM,oCAAoC,CAAC;AACjE,OAAO,EAAE,mBAAmB,EAAE,MAAM,6CAA6C,CAAC;AAClF,OAAO,EAAE,uBAAuB,EAAE,MAAM,iDAAiD,CAAC;AAC1F,OAAO,EAAE,uBAAuB,EAAE,MAAM,gDAAgD,CAAC;AACzF,OAAO,EAAE,qBAAqB,EAAE,MAAM,+CAA+C,CAAC;AACtF,OAAO,EAAE,oBAAoB,EAAE,MAAM,6CAA6C,CAAC;AACnF,OAAO,EAAE,WAAW,EAAE,MAAM,oCAAoC,CAAC;AAYjE,OAAO,EAAE,iBAAiB,EAAE,MAAM,0CAA0C,CAAC;AAC7E,OAAO,EAAE,gBAAgB,EAAE,MAAM,yCAAyC,CAAC;AAC3E,OAAO,EAAE,eAAe,EAAE,MAAM,wCAAwC,CAAC;AACzE,OAAO,EAAE,6BAA6B,EAAE,MAAM,uDAAuD,CAAC;AACtG,OAAO,EAAE,kBAAkB,EAAE,MAAM,4CAA4C,CAAC;AAChF,OAAO,EAAE,iBAAiB,EAAE,MAAM,2CAA2C,CAAC;AA8B9E,OAAO,EAAE,oBAAoB,EAAE,MAAM,+CAA+C,CAAC;AAGrF,OAAO,EAAE,YAAY,EAAE,MAAM,qCAAqC,CAAC;AAEnE,OAAO,EAAE,kBAAkB,EAAE,MAAM,4CAA4C,CAAC;AAIhF,OAAO,EAAE,YAAY,EAAE,MAAM,qCAAqC,CAAC;AACnE,OAAO,EAAE,sBAAsB,EAAE,MAAM,gDAAgD,CAAC;AAIxF,OAAO,EAAE,mBAAmB,EAAE,MAAM,8CAA8C,CAAC;AAwBnF,MAAM,WAAW,iBAAiB;IAMhC,sBAAsB,EAAE,eAAe,CAAC;IAOxC,8BAA8B,EAAE,uBAAuB,CAAC;IAOxD,oBAAoB,CAAC,EAAE,aAAa,CAAC;IAOrC,kBAAkB,CAAC,EAAE,WAAW,CAAC;IAMjC,sBAAsB,CAAC,EAAE,mBAAmB,CAAC;IAM7C,8BAA8B,CAAC,EAAE,uBAAuB,CAAC;IAMzD,4BAA4B,CAAC,EAAE,qBAAqB,CAAC;IAMrD,2BAA2B,CAAC,EAAE,oBAAoB,CAAC;IAQnD,kBAAkB,CAAC,EAAE,WAAW,CAAC;IAQjC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAQ5B,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAQhC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAQ1B,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAMhC,MAAM,CAAC,EAAE;QACP,UAAU,EAAE,MAAM,CAAC;QACnB,SAAS,EAAE,MAAM,CAAC;QAClB,WAAW,EAAE,MAAM,CAAC;KACrB,CAAC;IAMF,QAAQ,CAAC,EAAE;QACT,MAAM,EAAE,MAAM,CAAC;QACf,SAAS,EAAE,MAAM,CAAC;QAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;KACnB,CAAC;IAOF,OAAO,CAAC,EAAE,MAAM,CAAC;IASjB,wBAAwB,CAAC,EAAE,iBAAiB,CAAC;IAS7C,uBAAuB,CAAC,EAAE,gBAAgB,CAAC;IAa3C,sBAAsB,CAAC,EAAE,eAAe,CAAC;IAKzC,KAAK,CAAC,EAAE;QA4BN,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,KAAK,OAAO,CAAC;KAChE,CAAC;IAQF,oCAAoC,CAAC,EAAE,6BAA6B,CAAC;IAOrE,yBAAyB,CAAC,EAAE,kBAAkB,CAAC;IAO/C,wBAAwB,CAAC,EAAE,iBAAiB,CAAC;IAmB7C,aAAa,CAAC,EAAE,MAAM,GAAG,cAAc,CAAC;IAyBxC,YAAY,CAAC,EAAE,CAAC,IAAI,EAAE,SAAS,KAAK,OAAO,CAAC;IAO5C,YAAY,CAAC,EAAE,MAAM,CAAC;IAmBtB,QAAQ,CAAC,EAAE;QAOT,0BAA0B,CAAC,EAAE,OAAO,CAAC;QAQrC,UAAU,CAAC,EAAE,OAAO,CAAC;QAOrB,gBAAgB,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;KACrC,CAAC;IAMF,MAAM,CAAC,EAAE;QAEP,QAAQ,CAAC,EAAE,OAAO,CAAC;QAEnB,MAAM,CAAC,EAAE,OAAO,CAAC;QAEjB,QAAQ,CAAC,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,CAAC;QAErC,MAAM,CAAC,EAAE,MAAM,CAAC;QAEhB,IAAI,CAAC,EAAE,MAAM,CAAC;QAEd,iBAAiB,CAAC,EAAE,MAAM,CAAC;QAE3B,kBAAkB,CAAC,EAAE,MAAM,CAAC;QAE5B,eAAe,CAAC,EAAE,MAAM,CAAC;QAEzB,gBAAgB,CAAC,EAAE,MAAM,CAAC;QAc1B,aAAa,CAAC,EAAE,OAAO,CAAC;KACzB,CAAC;IAMF,IAAI,CAAC,EAAE;QAEL,UAAU,CAAC,EAAE,MAAM,CAAC;QAEpB,mBAAmB,CAAC,EAAE,OAAO,CAAC;QAE9B,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;QAc5B,SAAS,CAAC,EAAE,QAAQ,GAAG,MAAM,CAAC;KAC/B,CAAC;IAMF,SAAS,EAAE,MAAM,CAAC;IAMlB,YAAY,CAAC,EAAE,MAAM,CAAC;IAMtB,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAK/B,KAAK,CAAC,EAAE;QACN,MAAM,CAAC,EAAE;YACP,QAAQ,EAAE,MAAM,CAAC;YACjB,YAAY,EAAE,MAAM,CAAC;YACrB,WAAW,EAAE,MAAM,CAAC;SACrB,CAAC;QACF,QAAQ,CAAC,EAAE;YACT,QAAQ,EAAE,MAAM,CAAC;YACjB,YAAY,EAAE,MAAM,CAAC;YACrB,WAAW,EAAE,MAAM,CAAC;SACrB,CAAC;KACH,CAAC;IAOF,aAAa,CAAC,EAAE,MAAM,CAAC;IAsBvB,cAAc,CAAC,EAAE,oBAAoB,CAAC;IAqBtC,mBAAmB,CAAC,EAAE,YAAY,CAAC;IAWnC,yBAAyB,CAAC,EAAE,MAAM,CAAC;IAenC,yBAAyB,CAAC,EAAE,kBAAkB,CAAC;IAuB/C,UAAU,CAAC,EAAE;QAeX,WAAW,CAAC,EAAE;YAEZ,WAAW,EAAE,MAAM,CAAC;YAEpB,QAAQ,EAAE,MAAM,CAAC;SAClB,CAAC;KACH,CAAC;IAiBF,KAAK,CAAC,EAAE;QAEN,MAAM,EAAE,YAAY,CAAC;QAErB,IAAI,EAAE;YAAE,KAAK,EAAE,MAAM,CAAC;YAAC,IAAI,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;QAEvC,QAAQ,CAAC,EAAE,mBAAmB,CAAC;QAE/B,gBAAgB,CAAC,EAAE,sBAAsB,CAAC;KAC3C,CAAC;IAKF,YAAY,CAAC,EAAE;QAEb,WAAW,CAAC,EAAE,MAAM,CAAC;QAErB,qBAAqB,CAAC,EAAE,MAAM,CAAC;QAE/B,OAAO,CAAC,EAAE,MAAM,CAAC;KAClB,CAAC;CACH;AAKD,MAAM,WAAW,sBAAuB,SAAQ,IAAI,CAAC,cAAc,EAAE,SAAS,CAAC;IAC7E,UAAU,EAAE,CACV,GAAG,IAAI,EAAE,GAAG,EAAE,KACX,OAAO,CAAC,iBAAiB,CAAC,GAAG,iBAAiB,CAAC;IACpD,MAAM,CAAC,EAAE,GAAG,EAAE,CAAC;IAef,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B;AA8BD,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,iBAAiB,GAAG,IAAI,CAwCvE;AA2ED,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,iBAAiB,GAAG,MAAM,EAAE,CAwB7E;AASD,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,iBAAiB,GAAG,MAAM,EAAE,CAmBxE;AAWD,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,iBAAiB,GAAG,MAAM,EAAE,CAsB1E;AA0HD,OAAO,EACL,mBAAmB,EACnB,eAAe,EACf,wBAAwB,EACxB,aAAa,EACb,WAAW,EACX,oBAAoB,EACpB,uBAAuB,EACvB,sBAAsB,EACtB,oBAAoB,EACpB,WAAW,EACX,YAAY,EACZ,iBAAiB,EACjB,gBAAgB,EAChB,8BAA8B,EAC9B,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,aAAa,CAAC;AAuCrB,qBACa,UAAW,YAAW,UAAU;IAC3C,SAAS,CAAC,QAAQ,EAAE,kBAAkB,GAAG,IAAI;IAkC7C,MAAM,CAAC,YAAY,CAAC,OAAO,EAAE,sBAAsB,GAAG,aAAa;CAoZpE"}