@antelopejs/dms 0.0.1

package/dist/routes/auth/oauth/token-exchange.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-exchange.js","sourceRoot":"","sources":["../../../../src/routes/auth/oauth/token-exchange.ts"],"names":[],"mappings":";;AAyBA,gEAgCC;AAzDD,6DAAuD;AACvD,uEAAwD;AACxD,gEAA6D;AAE7D,qCAAiD;AAEjD,MAAM,gBAAgB,GAAG,GAAG,CAAC;AAC7B,MAAM,6BAA6B,GAAG,mCAAmC,CAAC;AAkBnE,KAAK,UAAU,0BAA0B,CAC9C,OAA6B,EAC7B,IAAY;IAEZ,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;QAC/B,UAAU,EAAE,oBAAoB;QAChC,SAAS,EAAE,OAAO,CAAC,WAAW,CAAC,QAAQ;QACvC,aAAa,EAAE,OAAO,CAAC,WAAW,CAAC,YAAY;QAC/C,YAAY,EAAE,IAAA,8BAAqB,EAAC,OAAO,CAAC,EAAE,CAAC;QAC/C,IAAI;KACL,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,EAAE;QACtD,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,MAAM,EAAE,kBAAkB;YAC1B,cAAc,EAAE,mCAAmC;SACpD;QACD,IAAI;KACL,CAAC,CAAC;IAEH,IAAA,2BAAM,EAAC,QAAQ,CAAC,EAAE,EAAE,gBAAgB,EAAE,6BAA6B,CAAC,CAAC;IACrE,MAAM,MAAM,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAkB,CAAC;IAExD,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;QACxB,OAAO,MAAM,CAAC,YAAY,CAAC;IAC7B,CAAC;IAED,iBAAO,CAAC,KAAK,CACX,2CAA2C,OAAO,CAAC,EAAE,MAAM,MAAM,CAAC,KAAK,IAAI,eAAe,EAAE,CAC7F,CAAC;IACF,MAAM,IAAI,0BAAU,CAAC,gBAAgB,EAAE,6BAA6B,CAAC,CAAC;AACxE,CAAC"}

package/dist/routes/auth/pick-tenant.d.ts

@@ -0,0 +1 @@
+export declare function pickInitialTenantId(userId: string): Promise<string | undefined>;

package/dist/routes/auth/pick-tenant.js

@@ -0,0 +1,12 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.pickInitialTenantId = pickInitialTenantId;
+const interface_database_1 = require("@antelopejs/interface-database");
+const interface_database_decorators_1 = require("@antelopejs/interface-database-decorators");
+const db_1 = require("@antelopejs/interface-dms/db");
+async function pickInitialTenantId(userId) {
+    const memberModel = (0, interface_database_decorators_1.GetModel)(db_1.TenantMemberModel, interface_database_1.CROSS_INSTANCE);
+    const oldest = await memberModel.getOldestByUser(userId);
+    return oldest?.tenantId;
+}
+//# sourceMappingURL=pick-tenant.js.map

package/dist/routes/auth/pick-tenant.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pick-tenant.js","sourceRoot":"","sources":["../../../src/routes/auth/pick-tenant.ts"],"names":[],"mappings":";;AAIA,kDAMC;AAVD,uEAAgE;AAChE,6FAAqE;AACrE,qDAAiE;AAE1D,KAAK,UAAU,mBAAmB,CACvC,MAAc;IAEd,MAAM,WAAW,GAAG,IAAA,wCAAQ,EAAC,sBAAiB,EAAE,mCAAc,CAAC,CAAC;IAChE,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;IACzD,OAAO,MAAM,EAAE,QAAQ,CAAC;AAC1B,CAAC"}

package/dist/routes/auth/refresh.d.ts

@@ -0,0 +1,4 @@
+import type { SessionModel, UserModel } from "@antelopejs/interface-dms/auth/db";
+import type { AuthResponse } from "./types";
+export declare const HTTP_FORBIDDEN = 403;
+export declare function refresh(userModel: UserModel, sessionModel: SessionModel, body: unknown): Promise<AuthResponse>;

package/dist/routes/auth/refresh.js

@@ -0,0 +1,61 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.HTTP_FORBIDDEN = void 0;
+exports.refresh = refresh;
+const interface_api_util_1 = require("@antelopejs/interface-api-util");
+const interface_database_decorators_1 = require("@antelopejs/interface-database-decorators");
+const db_1 = require("@antelopejs/interface-dms/db");
+const auth_1 = require("@antelopejs/interface-dms/auth");
+const jsonwebtoken_1 = require("jsonwebtoken");
+const auth_schema_1 = require("../../validation/auth.schema");
+const constants_1 = require("./constants");
+exports.HTTP_FORBIDDEN = 403;
+function shouldRotateRefreshToken(token) {
+    const payload = (0, jsonwebtoken_1.decode)(token);
+    if (!payload?.iat)
+        return false;
+    const tokenAgeMs = Date.now() - payload.iat * 1000;
+    return tokenAgeMs > constants_1.REFRESH_TOKEN_ROTATION_THRESHOLD_MS;
+}
+async function assertTenantAccess(user, tenantId) {
+    if (user.owner)
+        return;
+    const memberModel = (0, interface_database_decorators_1.GetModel)(db_1.TenantMemberModel, tenantId);
+    const membership = await memberModel.getByUser(user._id);
+    (0, interface_api_util_1.assert)(membership, exports.HTTP_FORBIDDEN, "error.not_a_member");
+}
+async function refresh(userModel, sessionModel, body) {
+    const { token } = (0, interface_api_util_1.assertValidation)(body, (v) => auth_schema_1.authSchema.refresh.parse(v));
+    const tokenPayload = await (0, auth_1.validateRefreshToken)(token);
+    const user = await userModel.get(tokenPayload.id);
+    (0, interface_api_util_1.assert)(user, 401, "error.invalid_token");
+    if (tokenPayload.sessionId) {
+        const session = await sessionModel.get(tokenPayload.sessionId);
+        (0, interface_api_util_1.assert)(session, 401, "error.session_expired");
+    }
+    const { tenantId } = tokenPayload;
+    (0, interface_api_util_1.assert)(tenantId, 401, "error.invalid_token");
+    await assertTenantAccess(user, tenantId);
+    const accessTokenData = await (0, auth_1.generateAccessToken)(tenantId, user, tokenPayload.sessionId);
+    let refreshToken = token;
+    if (tokenPayload.sessionId && shouldRotateRefreshToken(token)) {
+        const refreshTokenData = await (0, auth_1.generateRefreshToken)(tenantId, user, tokenPayload.sessionId);
+        const resolvedToken = await sessionModel.rotateRefreshToken(tokenPayload.sessionId, token, refreshTokenData.token);
+        (0, interface_api_util_1.assert)(resolvedToken, 401, "error.session_expired");
+        refreshToken = resolvedToken;
+    }
+    else if (tokenPayload.sessionId) {
+        const session = await sessionModel.get(tokenPayload.sessionId);
+        (0, interface_api_util_1.assert)(session?.refreshToken === token, 401, "error.session_expired");
+        sessionModel
+            .update(tokenPayload.sessionId, { lastActiveAt: new Date() })
+            .catch(() => { });
+    }
+    return {
+        token_type: "Bearer",
+        access_token: accessTokenData.token,
+        expires_in: accessTokenData.expiresIn,
+        refresh_token: refreshToken,
+    };
+}
+//# sourceMappingURL=refresh.js.map

package/dist/routes/auth/refresh.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"refresh.js","sourceRoot":"","sources":["../../../src/routes/auth/refresh.ts"],"names":[],"mappings":";;;AAyCA,0BAuDC;AAhGD,uEAA0E;AAC1E,6FAAqE;AACrE,qDAAiE;AACjE,yDAIwC;AAKxC,+CAAsC;AACtC,8DAA0D;AAC1D,2CAAkE;AAGrD,QAAA,cAAc,GAAG,GAAG,CAAC;AAElC,SAAS,wBAAwB,CAAC,KAAa;IAC7C,MAAM,OAAO,GAAG,IAAA,qBAAM,EAAC,KAAK,CAA4B,CAAC;IACzD,IAAI,CAAC,OAAO,EAAE,GAAG;QAAE,OAAO,KAAK,CAAC;IAChC,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC;IACnD,OAAO,UAAU,GAAG,+CAAmC,CAAC;AAC1D,CAAC;AAOD,KAAK,UAAU,kBAAkB,CAC/B,IAAsB,EACtB,QAAgB;IAEhB,IAAI,IAAI,CAAC,KAAK;QAAE,OAAO;IACvB,MAAM,WAAW,GAAG,IAAA,wCAAQ,EAAC,sBAAiB,EAAE,QAAQ,CAAC,CAAC;IAC1D,MAAM,UAAU,GAAG,MAAM,WAAW,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACzD,IAAA,2BAAM,EAAC,UAAU,EAAE,sBAAc,EAAE,oBAAoB,CAAC,CAAC;AAC3D,CAAC;AAEM,KAAK,UAAU,OAAO,CAC3B,SAAoB,EACpB,YAA0B,EAC1B,IAAa;IAEb,MAAM,EAAE,KAAK,EAAE,GAAG,IAAA,qCAAgB,EAAC,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,wBAAU,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAE7E,MAAM,YAAY,GAAG,MAAM,IAAA,2BAAoB,EAAC,KAAK,CAAC,CAAC;IAEvD,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;IAClD,IAAA,2BAAM,EAAC,IAAI,EAAE,GAAG,EAAE,qBAAqB,CAAC,CAAC;IAEzC,IAAI,YAAY,CAAC,SAAS,EAAE,CAAC;QAC3B,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,GAAG,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC;QAC/D,IAAA,2BAAM,EAAC,OAAO,EAAE,GAAG,EAAE,uBAAuB,CAAC,CAAC;IAChD,CAAC;IAED,MAAM,EAAE,QAAQ,EAAE,GAAG,YAAY,CAAC;IAClC,IAAA,2BAAM,EAAC,QAAQ,EAAE,GAAG,EAAE,qBAAqB,CAAC,CAAC;IAC7C,MAAM,kBAAkB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAEzC,MAAM,eAAe,GAAG,MAAM,IAAA,0BAAmB,EAC/C,QAAQ,EACR,IAAI,EACJ,YAAY,CAAC,SAAS,CACvB,CAAC;IAEF,IAAI,YAAY,GAAG,KAAK,CAAC;IACzB,IAAI,YAAY,CAAC,SAAS,IAAI,wBAAwB,CAAC,KAAK,CAAC,EAAE,CAAC;QAC9D,MAAM,gBAAgB,GAAG,MAAM,IAAA,2BAAoB,EACjD,QAAQ,EACR,IAAI,EACJ,YAAY,CAAC,SAAS,CACvB,CAAC;QACF,MAAM,aAAa,GAAG,MAAM,YAAY,CAAC,kBAAkB,CACzD,YAAY,CAAC,SAAS,EACtB,KAAK,EACL,gBAAgB,CAAC,KAAK,CACvB,CAAC;QACF,IAAA,2BAAM,EAAC,aAAa,EAAE,GAAG,EAAE,uBAAuB,CAAC,CAAC;QACpD,YAAY,GAAG,aAAa,CAAC;IAC/B,CAAC;SAAM,IAAI,YAAY,CAAC,SAAS,EAAE,CAAC;QAClC,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,GAAG,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC;QAC/D,IAAA,2BAAM,EAAC,OAAO,EAAE,YAAY,KAAK,KAAK,EAAE,GAAG,EAAE,uBAAuB,CAAC,CAAC;QACtE,YAAY;aACT,MAAM,CAAC,YAAY,CAAC,SAAS,EAAE,EAAE,YAAY,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC;aAC5D,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACrB,CAAC;IAED,OAAO;QACL,UAAU,EAAE,QAAQ;QACpB,YAAY,EAAE,eAAe,CAAC,KAAK;QACnC,UAAU,EAAE,eAAe,CAAC,SAAS;QACrC,aAAa,EAAE,YAAY;KAC5B,CAAC;AACJ,CAAC"}

package/dist/routes/auth/request-2fa-email.d.ts

@@ -0,0 +1,6 @@
+import type { UserModel } from "@antelopejs/interface-dms/auth/db";
+type Request2FAEmailResult = {
+    success: boolean;
+};
+export declare function request2FAEmail(userModel: UserModel, body: unknown): Promise<Request2FAEmailResult>;
+export {};

package/dist/routes/auth/request-2fa-email.js

@@ -0,0 +1,30 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.request2FAEmail = request2FAEmail;
+const interface_api_util_1 = require("@antelopejs/interface-api-util");
+const auth_1 = require("@antelopejs/interface-dms/auth");
+const randomstring_1 = __importDefault(require("randomstring"));
+const auth_schema_1 = require("../../validation/auth.schema");
+const constants_1 = require("./constants");
+async function request2FAEmail(userModel, body) {
+    const { token } = (0, interface_api_util_1.assertValidation)(body, (v) => auth_schema_1.authSchema.request2FAEmail.parse(v));
+    const { user } = await (0, auth_1.validateTwoFactorToken)(token);
+    (0, interface_api_util_1.assert)(user.twoFactorMethods?.includes("email"), 400, "error.2fa_email_not_enabled");
+    const isRateLimited = user.twoFactorEmailCodeRequestedAt &&
+        Date.now() - new Date(user.twoFactorEmailCodeRequestedAt).getTime() <
+            constants_1.TWO_FACTOR_RATE_LIMIT_MS;
+    (0, interface_api_util_1.assert)(!isRateLimited, 429, "error.rate_limited");
+    const code = randomstring_1.default.generate({
+        length: 6,
+        charset: "numeric",
+    });
+    user.twoFactorEmailCode = code;
+    user.twoFactorEmailCodeRequestedAt = new Date();
+    await userModel.update(user);
+    await (0, auth_1.send2FAEmail)(user, code);
+    return { success: true };
+}
+//# sourceMappingURL=request-2fa-email.js.map

package/dist/routes/auth/request-2fa-email.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"request-2fa-email.js","sourceRoot":"","sources":["../../../src/routes/auth/request-2fa-email.ts"],"names":[],"mappings":";;;;;AAYA,0CAkCC;AA9CD,uEAA0E;AAC1E,yDAGwC;AAExC,gEAAwC;AACxC,8DAA0D;AAC1D,2CAAuD;AAIhD,KAAK,UAAU,eAAe,CACnC,SAAoB,EACpB,IAAa;IAEb,MAAM,EAAE,KAAK,EAAE,GAAG,IAAA,qCAAgB,EAAC,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAC7C,wBAAU,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC,CACpC,CAAC;IAEF,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAA,6BAAsB,EAAC,KAAK,CAAC,CAAC;IAErD,IAAA,2BAAM,EACJ,IAAI,CAAC,gBAAgB,EAAE,QAAQ,CAAC,OAAO,CAAC,EACxC,GAAG,EACH,6BAA6B,CAC9B,CAAC;IAEF,MAAM,aAAa,GACjB,IAAI,CAAC,6BAA6B;QAClC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC,OAAO,EAAE;YACjE,oCAAwB,CAAC;IAC7B,IAAA,2BAAM,EAAC,CAAC,aAAa,EAAE,GAAG,EAAE,oBAAoB,CAAC,CAAC;IAElD,MAAM,IAAI,GAAG,sBAAY,CAAC,QAAQ,CAAC;QACjC,MAAM,EAAE,CAAC;QACT,OAAO,EAAE,SAAS;KACnB,CAAC,CAAC;IAEH,IAAI,CAAC,kBAAkB,GAAG,IAAI,CAAC;IAC/B,IAAI,CAAC,6BAA6B,GAAG,IAAI,IAAI,EAAE,CAAC;IAChD,MAAM,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAE7B,MAAM,IAAA,mBAAY,EAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAE/B,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC3B,CAAC"}

package/dist/routes/auth/request-email-verification.d.ts

@@ -0,0 +1,2 @@
+import type { User, UserModel } from "@antelopejs/interface-dms/auth/db";
+export declare function requestEmailVerification(userModel: UserModel, user: User): Promise<void>;

package/dist/routes/auth/request-email-verification.js

@@ -0,0 +1,28 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.requestEmailVerification = requestEmailVerification;
+const interface_api_util_1 = require("@antelopejs/interface-api-util");
+const auth_1 = require("@antelopejs/interface-dms/auth");
+const randomstring_1 = __importDefault(require("randomstring"));
+const config_1 = require("../../config");
+const EMAIL_VERIFICATION_RATE_LIMIT_MS = 60 * 1000;
+async function requestEmailVerification(userModel, user) {
+    const config = (0, config_1.getAuthConfig)();
+    (0, interface_api_util_1.assert)(config.mustValidateEmail, 400, "error.email_validation_disabled");
+    (0, interface_api_util_1.assert)(!user.isValidated, 400, "error.email_already_validated");
+    if (user.validationRequestedAt) {
+        (0, interface_api_util_1.assert)(Date.now() - user.validationRequestedAt.getTime() >
+            EMAIL_VERIFICATION_RATE_LIMIT_MS, 400, "error.email_already_requested");
+    }
+    user.validationToken = randomstring_1.default.generate({
+        length: 6,
+        capitalization: "uppercase",
+    });
+    user.validationRequestedAt = new Date();
+    await userModel.update(user);
+    await (0, auth_1.sendEmailValidationEmail)(user);
+}
+//# sourceMappingURL=request-email-verification.js.map

package/dist/routes/auth/request-email-verification.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"request-email-verification.js","sourceRoot":"","sources":["../../../src/routes/auth/request-email-verification.ts"],"names":[],"mappings":";;;;;AAQA,4DAyBC;AAjCD,uEAAwD;AACxD,yDAA0E;AAE1E,gEAAwC;AACxC,yCAA6C;AAE7C,MAAM,gCAAgC,GAAG,EAAE,GAAG,IAAI,CAAC;AAE5C,KAAK,UAAU,wBAAwB,CAC5C,SAAoB,EACpB,IAAU;IAEV,MAAM,MAAM,GAAG,IAAA,sBAAa,GAAE,CAAC;IAC/B,IAAA,2BAAM,EAAC,MAAM,CAAC,iBAAiB,EAAE,GAAG,EAAE,iCAAiC,CAAC,CAAC;IAEzE,IAAA,2BAAM,EAAC,CAAC,IAAI,CAAC,WAAW,EAAE,GAAG,EAAE,+BAA+B,CAAC,CAAC;IAChE,IAAI,IAAI,CAAC,qBAAqB,EAAE,CAAC;QAC/B,IAAA,2BAAM,EACJ,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,qBAAqB,CAAC,OAAO,EAAE;YAC/C,gCAAgC,EAClC,GAAG,EACH,+BAA+B,CAChC,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,eAAe,GAAG,sBAAY,CAAC,QAAQ,CAAC;QAC3C,MAAM,EAAE,CAAC;QACT,cAAc,EAAE,WAAW;KAC5B,CAAC,CAAC;IACH,IAAI,CAAC,qBAAqB,GAAG,IAAI,IAAI,EAAE,CAAC;IAExC,MAAM,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC7B,MAAM,IAAA,+BAAwB,EAAC,IAAI,CAAC,CAAC;AACvC,CAAC"}

package/dist/routes/auth/reset-password.d.ts

@@ -0,0 +1,2 @@
+import type { UserModel } from "@antelopejs/interface-dms/auth/db";
+export declare function resetPassword(userModel: UserModel, body: unknown): Promise<void>;

package/dist/routes/auth/reset-password.js

@@ -0,0 +1,23 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resetPassword = resetPassword;
+const interface_api_util_1 = require("@antelopejs/interface-api-util");
+const config_1 = require("../../config");
+const account_notifications_1 = require("../../utils/account-notifications");
+const auth_schema_1 = require("../../validation/auth.schema");
+async function resetPassword(userModel, body) {
+    const config = (0, config_1.getAuthConfig)();
+    const { email, token, password } = (0, interface_api_util_1.assertValidation)(body, (v) => auth_schema_1.authSchema.reset.parse(v));
+    const user = await userModel.getByEmail(email);
+    const isTokenValid = user?.forgotPasswordToken === token &&
+        user?.forgotPasswordRequestedAt &&
+        Date.now() - user.forgotPasswordRequestedAt.getTime() <
+            config.passwordRecoverTokenLifetime;
+    (0, interface_api_util_1.assert)(isTokenValid && user, 400, "error.invalid_or_expired_token");
+    user.forgotPasswordToken = null;
+    user.forgotPasswordRequestedAt = null;
+    user.password = password;
+    await userModel.update(user);
+    void (0, account_notifications_1.notifyPasswordReset)(user._id);
+}
+//# sourceMappingURL=reset-password.js.map

package/dist/routes/auth/reset-password.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"reset-password.js","sourceRoot":"","sources":["../../../src/routes/auth/reset-password.ts"],"names":[],"mappings":";;AAMA,sCAyBC;AA/BD,uEAA0E;AAE1E,yCAA6C;AAC7C,6EAAwE;AACxE,8DAA0D;AAEnD,KAAK,UAAU,aAAa,CACjC,SAAoB,EACpB,IAAa;IAEb,MAAM,MAAM,GAAG,IAAA,sBAAa,GAAE,CAAC;IAC/B,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,IAAA,qCAAgB,EAAC,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAC9D,wBAAU,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAC1B,CAAC;IAEF,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;IAC/C,MAAM,YAAY,GAChB,IAAI,EAAE,mBAAmB,KAAK,KAAK;QACnC,IAAI,EAAE,yBAAyB;QAC/B,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,yBAAyB,CAAC,OAAO,EAAE;YACnD,MAAM,CAAC,4BAA4B,CAAC;IAExC,IAAA,2BAAM,EAAC,YAAY,IAAI,IAAI,EAAE,GAAG,EAAE,gCAAgC,CAAC,CAAC;IAEpE,IAAI,CAAC,mBAAmB,GAAG,IAAI,CAAC;IAChC,IAAI,CAAC,yBAAyB,GAAG,IAAI,CAAC;IACtC,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAEzB,MAAM,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAE7B,KAAK,IAAA,2CAAmB,EAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACrC,CAAC"}

package/dist/routes/auth/session-response.d.ts

@@ -0,0 +1,5 @@
+import type { SessionModel, User } from "@antelopejs/interface-dms/auth/db";
+import type { AuthResponse, TenantAssignmentRequiredResponse, TwoFactorRequiredResponse } from "./types";
+export type LoginOutcome = AuthResponse | TwoFactorRequiredResponse | TenantAssignmentRequiredResponse;
+export declare function issueAuthResponse(sessionModel: SessionModel, tenantId: string, user: User, userAgent: string, ip: string): Promise<AuthResponse>;
+export declare function resolveLoginOutcome(sessionModel: SessionModel, user: User, userAgent: string, ip: string, preferredTenantId?: string): Promise<LoginOutcome>;

package/dist/routes/auth/session-response.js

@@ -0,0 +1,42 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.issueAuthResponse = issueAuthResponse;
+exports.resolveLoginOutcome = resolveLoginOutcome;
+const auth_1 = require("@antelopejs/interface-dms/auth");
+const account_notifications_1 = require("../../utils/account-notifications");
+const pick_tenant_1 = require("./pick-tenant");
+async function issueAuthResponse(sessionModel, tenantId, user, userAgent, ip) {
+    const sessionId = await (0, auth_1.createSession)(sessionModel, user._id, userAgent, ip);
+    const accessTokenData = await (0, auth_1.generateAccessToken)(tenantId, user, sessionId);
+    const refreshTokenData = await (0, auth_1.generateRefreshToken)(tenantId, user, sessionId);
+    await sessionModel.replaceRefreshToken(sessionId, refreshTokenData.token);
+    return {
+        token_type: "Bearer",
+        access_token: accessTokenData.token,
+        expires_in: accessTokenData.expiresIn,
+        refresh_token: refreshTokenData.token,
+        user: await (0, auth_1.sanitizeUser)(user),
+    };
+}
+async function resolveLoginOutcome(sessionModel, user, userAgent, ip, preferredTenantId) {
+    const tenantId = preferredTenantId ?? (await (0, pick_tenant_1.pickInitialTenantId)(user._id));
+    if (tenantId === undefined) {
+        const { token: assignmentToken } = await (0, auth_1.generateTenantAssignmentToken)(user);
+        return {
+            requires_tenant_assignment: true,
+            tenant_assignment_token: assignmentToken,
+            user: await (0, auth_1.sanitizeUser)(user),
+        };
+    }
+    if (user.twoFactorMethods?.length > 0) {
+        const { token } = await (0, auth_1.generateTwoFactorToken)(tenantId, user);
+        return {
+            requires_2fa: true,
+            two_factor_token: token,
+            methods: user.twoFactorMethods,
+        };
+    }
+    void (0, account_notifications_1.notifyNewLogin)(user._id, userAgent, ip);
+    return issueAuthResponse(sessionModel, tenantId, user, userAgent, ip);
+}
+//# sourceMappingURL=session-response.js.map

package/dist/routes/auth/session-response.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-response.js","sourceRoot":"","sources":["../../../src/routes/auth/session-response.ts"],"names":[],"mappings":";;AAgCA,8CAyBC;AAgBD,kDAmCC;AA5GD,yDAOwC;AAExC,6EAAmE;AACnE,+CAAoD;AAsB7C,KAAK,UAAU,iBAAiB,CACrC,YAA0B,EAC1B,QAAgB,EAChB,IAAU,EACV,SAAiB,EACjB,EAAU;IAEV,MAAM,SAAS,GAAG,MAAM,IAAA,oBAAa,EAAC,YAAY,EAAE,IAAI,CAAC,GAAG,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;IAE7E,MAAM,eAAe,GAAG,MAAM,IAAA,0BAAmB,EAAC,QAAQ,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;IAC7E,MAAM,gBAAgB,GAAG,MAAM,IAAA,2BAAoB,EACjD,QAAQ,EACR,IAAI,EACJ,SAAS,CACV,CAAC;IAEF,MAAM,YAAY,CAAC,mBAAmB,CAAC,SAAS,EAAE,gBAAgB,CAAC,KAAK,CAAC,CAAC;IAE1E,OAAO;QACL,UAAU,EAAE,QAAQ;QACpB,YAAY,EAAE,eAAe,CAAC,KAAK;QACnC,UAAU,EAAE,eAAe,CAAC,SAAS;QACrC,aAAa,EAAE,gBAAgB,CAAC,KAAK;QACrC,IAAI,EAAE,MAAM,IAAA,mBAAY,EAAC,IAAI,CAAC;KAC/B,CAAC;AACJ,CAAC;AAgBM,KAAK,UAAU,mBAAmB,CACvC,YAA0B,EAC1B,IAAU,EACV,SAAiB,EACjB,EAAU,EACV,iBAA0B;IAM1B,MAAM,QAAQ,GAAG,iBAAiB,IAAI,CAAC,MAAM,IAAA,iCAAmB,EAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAE5E,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,MAAM,EAAE,KAAK,EAAE,eAAe,EAAE,GAC9B,MAAM,IAAA,oCAA6B,EAAC,IAAI,CAAC,CAAC;QAC5C,OAAO;YACL,0BAA0B,EAAE,IAAI;YAChC,uBAAuB,EAAE,eAAe;YACxC,IAAI,EAAE,MAAM,IAAA,mBAAY,EAAC,IAAI,CAAC;SAC/B,CAAC;IACJ,CAAC;IAED,IAAI,IAAI,CAAC,gBAAgB,EAAE,MAAM,GAAG,CAAC,EAAE,CAAC;QACtC,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,IAAA,6BAAsB,EAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QAC/D,OAAO;YACL,YAAY,EAAE,IAAI;YAClB,gBAAgB,EAAE,KAAK;YACvB,OAAO,EAAE,IAAI,CAAC,gBAAgB;SAC/B,CAAC;IACJ,CAAC;IAED,KAAK,IAAA,sCAAc,EAAC,IAAI,CAAC,GAAG,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;IAE7C,OAAO,iBAAiB,CAAC,YAAY,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;AACxE,CAAC"}

package/dist/routes/auth/signup.d.ts

@@ -0,0 +1,3 @@
+import type { SessionModel, UserModel } from "@antelopejs/interface-dms/auth/db";
+import type { AuthResponse } from "./types";
+export declare function signup(userModel: UserModel, sessionModel: SessionModel, body: unknown, userAgent: string, ip: string): Promise<AuthResponse>;

package/dist/routes/auth/signup.js

@@ -0,0 +1,103 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.signup = signup;
+const interface_api_util_1 = require("@antelopejs/interface-api-util");
+const interface_database_1 = require("@antelopejs/interface-database");
+const interface_database_decorators_1 = require("@antelopejs/interface-database-decorators");
+const db_1 = require("@antelopejs/interface-dms/db");
+const auth_1 = require("@antelopejs/interface-dms/auth");
+const randomstring_1 = __importDefault(require("randomstring"));
+const config_1 = require("../../config");
+const auth_key_1 = require("../../utils/auth-key");
+const fire_and_forget_1 = require("@antelopejs/interface-dms/utils/fire-and-forget");
+const auth_schema_1 = require("../../validation/auth.schema");
+const invite_1 = require("./invite");
+const session_response_1 = require("./session-response");
+const VALIDATION_TOKEN_LENGTH = 6;
+function buildValidationFields(invite) {
+    const config = (0, config_1.getAuthConfig)();
+    const shouldValidate = config.mustValidateEmail && !invite.skipEmailValidation;
+    return {
+        isValidated: invite.skipEmailValidation || false,
+        validationToken: shouldValidate
+            ? randomstring_1.default.generate({
+                length: VALIDATION_TOKEN_LENGTH,
+                capitalization: "uppercase",
+            })
+            : undefined,
+        validationRequestedAt: shouldValidate ? new Date() : undefined,
+    };
+}
+async function createNewUser(userModel, { name, email, password, lang, invite }) {
+    const validation = buildValidationFields(invite);
+    const result = await userModel.insert({
+        createdAt: new Date(),
+        updatedAt: new Date(),
+        name,
+        email: email.toLowerCase(),
+        password,
+        authKey: (0, auth_key_1.generateAuthKey)(),
+        ...validation,
+        owner: false,
+        language: lang || "en",
+    });
+    return result?.[0];
+}
+async function overwriteUnvalidatedUser(userModel, existingUser, { name, email, password, lang, invite }) {
+    const validation = buildValidationFields(invite);
+    existingUser.createdAt = new Date();
+    existingUser.updatedAt = new Date();
+    existingUser.name = name;
+    existingUser.email = email.toLowerCase();
+    existingUser.password = password;
+    existingUser.authKey = (0, auth_key_1.generateAuthKey)();
+    existingUser.validationToken = validation.validationToken;
+    existingUser.validationRequestedAt = validation.validationRequestedAt;
+    existingUser.isValidated = validation.isValidated;
+    existingUser.language = lang || "en";
+    await userModel.update(existingUser);
+    return existingUser._id;
+}
+async function upsertSignupUser(userModel, existingUser, account) {
+    const userId = existingUser
+        ? await overwriteUnvalidatedUser(userModel, existingUser, account)
+        : await createNewUser(userModel, account);
+    (0, interface_api_util_1.assert)(userId, 500, `New user not created : \n`);
+    const user = await userModel.get(userId);
+    (0, interface_api_util_1.assert)(user, 500, `New user not found : \nID:${userId}`);
+    return user;
+}
+async function resolveOverwritableAccount(userModel, email) {
+    const existingUser = await userModel.getByEmail(email.toLowerCase());
+    const belongsToWorkspace = !!existingUser &&
+        (await (0, interface_database_decorators_1.GetModel)(db_1.TenantMemberModel, interface_database_1.CROSS_INSTANCE).existsByUser(existingUser._id));
+    (0, interface_api_util_1.assert)(!existingUser || (!existingUser.isValidated && !belongsToWorkspace), 400, "error.email_already_used");
+    return existingUser;
+}
+async function signup(userModel, sessionModel, body, userAgent, ip) {
+    const { name, email, password, token, lang } = (0, interface_api_util_1.assertValidation)(body, (v) => auth_schema_1.authSchema.signup.parse(v));
+    const config = (0, config_1.getAuthConfig)();
+    const resolvedInvite = await (0, invite_1.resolveValidInvite)(token, email);
+    const { invite: existingInvite, tenantId } = resolvedInvite;
+    const existingUser = await resolveOverwritableAccount(userModel, email);
+    const user = await upsertSignupUser(userModel, existingUser, {
+        name,
+        email,
+        password,
+        lang,
+        invite: existingInvite,
+    });
+    await (0, invite_1.consumeInvite)(userModel, user._id, resolvedInvite);
+    const refreshedUser = await userModel.get(user._id);
+    (0, interface_api_util_1.assert)(refreshedUser, 500, `New user not found : \nID:${user._id}`);
+    const shouldSendValidation = config.mustValidateEmail && !existingInvite.skipEmailValidation;
+    if (shouldSendValidation) {
+        (0, fire_and_forget_1.fireAndForget)((0, auth_1.sendEmailValidationEmail)(refreshedUser), `validation email to "${refreshedUser.email}"`);
+    }
+    await (0, auth_1.announceRegistration)(userModel, refreshedUser, tenantId);
+    return (0, session_response_1.issueAuthResponse)(sessionModel, tenantId, refreshedUser, userAgent, ip);
+}
+//# sourceMappingURL=signup.js.map

package/dist/routes/auth/signup.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"signup.js","sourceRoot":"","sources":["../../../src/routes/auth/signup.ts"],"names":[],"mappings":";;;;;AAoJA,wBAqDC;AAzMD,uEAA0E;AAC1E,uEAAgE;AAChE,6FAAqE;AACrE,qDAGsC;AACtC,yDAGwC;AAKxC,gEAAwC;AACxC,yCAA6C;AAC7C,mDAAuD;AACvD,qFAAgF;AAChF,8DAA0D;AAC1D,qCAA6D;AAC7D,yDAAuD;AAGvD,MAAM,uBAAuB,GAAG,CAAC,CAAC;AAElC,SAAS,qBAAqB,CAAC,MAAkB;IAC/C,MAAM,MAAM,GAAG,IAAA,sBAAa,GAAE,CAAC;IAC/B,MAAM,cAAc,GAClB,MAAM,CAAC,iBAAiB,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC;IAE1D,OAAO;QACL,WAAW,EAAE,MAAM,CAAC,mBAAmB,IAAI,KAAK;QAChD,eAAe,EAAE,cAAc;YAC7B,CAAC,CAAC,sBAAY,CAAC,QAAQ,CAAC;gBACpB,MAAM,EAAE,uBAAuB;gBAC/B,cAAc,EAAE,WAAW;aAC5B,CAAC;YACJ,CAAC,CAAC,SAAS;QACb,qBAAqB,EAAE,cAAc,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS;KAC/D,CAAC;AACJ,CAAC;AAYD,KAAK,UAAU,aAAa,CAC1B,SAAoB,EACpB,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAiB;IAEtD,MAAM,UAAU,GAAG,qBAAqB,CAAC,MAAM,CAAC,CAAC;IACjD,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC;QACpC,SAAS,EAAE,IAAI,IAAI,EAAE;QACrB,SAAS,EAAE,IAAI,IAAI,EAAE;QACrB,IAAI;QACJ,KAAK,EAAE,KAAK,CAAC,WAAW,EAAE;QAC1B,QAAQ;QACR,OAAO,EAAE,IAAA,0BAAe,GAAE;QAC1B,GAAG,UAAU;QACb,KAAK,EAAE,KAAK;QACZ,QAAQ,EAAE,IAAI,IAAI,IAAI;KACvB,CAAC,CAAC;IACH,OAAO,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC;AACrB,CAAC;AAED,KAAK,UAAU,wBAAwB,CACrC,SAAoB,EACpB,YAAgE,EAChE,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAiB;IAEtD,MAAM,UAAU,GAAG,qBAAqB,CAAC,MAAM,CAAC,CAAC;IACjD,YAAY,CAAC,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC;IACpC,YAAY,CAAC,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC;IACpC,YAAY,CAAC,IAAI,GAAG,IAAI,CAAC;IACzB,YAAY,CAAC,KAAK,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;IACzC,YAAY,CAAC,QAAQ,GAAG,QAAQ,CAAC;IACjC,YAAY,CAAC,OAAO,GAAG,IAAA,0BAAe,GAAE,CAAC;IACzC,YAAY,CAAC,eAAe,GAAG,UAAU,CAAC,eAAyB,CAAC;IACpE,YAAY,CAAC,qBAAqB,GAAG,UAAU,CAAC,qBAA6B,CAAC;IAC9E,YAAY,CAAC,WAAW,GAAG,UAAU,CAAC,WAAW,CAAC;IAClD,YAAY,CAAC,QAAQ,GAAG,IAAI,IAAI,IAAI,CAAC;IAErC,MAAM,SAAS,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IACrC,OAAO,YAAY,CAAC,GAAG,CAAC;AAC1B,CAAC;AAED,KAAK,UAAU,gBAAgB,CAC7B,SAAoB,EACpB,YAA0D,EAC1D,OAAsB;IAEtB,MAAM,MAAM,GAAG,YAAY;QACzB,CAAC,CAAC,MAAM,wBAAwB,CAAC,SAAS,EAAE,YAAY,EAAE,OAAO,CAAC;QAClE,CAAC,CAAC,MAAM,aAAa,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IAE5C,IAAA,2BAAM,EAAC,MAAM,EAAE,GAAG,EAAE,2BAA2B,CAAC,CAAC;IAEjD,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACzC,IAAA,2BAAM,EAAC,IAAI,EAAE,GAAG,EAAE,6BAA6B,MAAM,EAAE,CAAC,CAAC;IACzD,OAAO,IAAI,CAAC;AACd,CAAC;AAuBD,KAAK,UAAU,0BAA0B,CACvC,SAAoB,EACpB,KAAa;IAEb,MAAM,YAAY,GAAG,MAAM,SAAS,CAAC,UAAU,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC;IACrE,MAAM,kBAAkB,GACtB,CAAC,CAAC,YAAY;QACd,CAAC,MAAM,IAAA,wCAAQ,EAAC,sBAAiB,EAAE,mCAAc,CAAC,CAAC,YAAY,CAC7D,YAAY,CAAC,GAAG,CACjB,CAAC,CAAC;IACL,IAAA,2BAAM,EACJ,CAAC,YAAY,IAAI,CAAC,CAAC,YAAY,CAAC,WAAW,IAAI,CAAC,kBAAkB,CAAC,EACnE,GAAG,EACH,0BAA0B,CAC3B,CAAC;IACF,OAAO,YAAY,CAAC;AACtB,CAAC;AAEM,KAAK,UAAU,MAAM,CAC1B,SAAoB,EACpB,YAA0B,EAC1B,IAAa,EACb,SAAiB,EACjB,EAAU;IAEV,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,IAAA,qCAAgB,EAAC,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAC1E,wBAAU,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAC3B,CAAC;IAEF,MAAM,MAAM,GAAG,IAAA,sBAAa,GAAE,CAAC;IAM/B,MAAM,cAAc,GAAG,MAAM,IAAA,2BAAkB,EAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAC9D,MAAM,EAAE,MAAM,EAAE,cAAc,EAAE,QAAQ,EAAE,GAAG,cAAc,CAAC;IAE5D,MAAM,YAAY,GAAG,MAAM,0BAA0B,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IAExE,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,SAAS,EAAE,YAAY,EAAE;QAC3D,IAAI;QACJ,KAAK;QACL,QAAQ;QACR,IAAI;QACJ,MAAM,EAAE,cAAc;KACvB,CAAC,CAAC;IAEH,MAAM,IAAA,sBAAa,EAAC,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;IAEzD,MAAM,aAAa,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACpD,IAAA,2BAAM,EAAC,aAAa,EAAE,GAAG,EAAE,6BAA6B,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAEpE,MAAM,oBAAoB,GACxB,MAAM,CAAC,iBAAiB,IAAI,CAAC,cAAc,CAAC,mBAAmB,CAAC;IAClE,IAAI,oBAAoB,EAAE,CAAC;QACzB,IAAA,+BAAa,EACX,IAAA,+BAAwB,EAAC,aAAa,CAAC,EACvC,wBAAwB,aAAa,CAAC,KAAK,GAAG,CAC/C,CAAC;IACJ,CAAC;IAED,MAAM,IAAA,2BAAoB,EAAC,SAAS,EAAE,aAAa,EAAE,QAAQ,CAAC,CAAC;IAE/D,OAAO,IAAA,oCAAiB,EACtB,YAAY,EACZ,QAAQ,EACR,aAAa,EACb,SAAS,EACT,EAAE,CACH,CAAC;AACJ,CAAC"}

package/dist/routes/auth/switch-tenant.d.ts

@@ -0,0 +1,3 @@
+import type { SessionModel, UserModel } from "@antelopejs/interface-dms/auth/db";
+import type { AuthResponse } from "./types";
+export declare function switchTenant(userModel: UserModel, sessionModel: SessionModel, body: unknown): Promise<AuthResponse>;

package/dist/routes/auth/switch-tenant.js

@@ -0,0 +1,46 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.switchTenant = switchTenant;
+const interface_api_util_1 = require("@antelopejs/interface-api-util");
+const interface_database_decorators_1 = require("@antelopejs/interface-database-decorators");
+const db_1 = require("@antelopejs/interface-dms/db");
+const auth_1 = require("@antelopejs/interface-dms/auth");
+const zod_1 = require("zod");
+const HTTP_FORBIDDEN = 403;
+const switchTenantSchema = zod_1.z.object({
+    refreshToken: zod_1.z.string().min(1),
+    tenantId: zod_1.z.string().min(1),
+});
+async function assertMembership(userId, tenantId) {
+    const memberModel = (0, interface_database_decorators_1.GetModel)(db_1.TenantMemberModel, tenantId);
+    const member = await memberModel.getByUser(userId);
+    (0, interface_api_util_1.assert)(member, HTTP_FORBIDDEN, "error.not_a_member");
+}
+async function switchTenant(userModel, sessionModel, body) {
+    const { refreshToken, tenantId } = (0, interface_api_util_1.assertValidation)(body, (v) => switchTenantSchema.parse(v));
+    const tokenPayload = await (0, auth_1.validateRefreshToken)(refreshToken);
+    const user = await userModel.get(tokenPayload.id);
+    (0, interface_api_util_1.assert)(user, 401, "error.invalid_token");
+    await assertMembership(user._id, tenantId);
+    if (tokenPayload.sessionId) {
+        const session = await sessionModel.get(tokenPayload.sessionId);
+        (0, interface_api_util_1.assert)(session, 401, "error.session_expired");
+        (0, interface_api_util_1.assert)(session.refreshToken === refreshToken, 401, "error.session_expired");
+        sessionModel
+            .update(tokenPayload.sessionId, { lastActiveAt: new Date() })
+            .catch(() => { });
+    }
+    const accessTokenData = await (0, auth_1.generateAccessToken)(tenantId, user, tokenPayload.sessionId);
+    const refreshTokenData = await (0, auth_1.generateRefreshToken)(tenantId, user, tokenPayload.sessionId);
+    const nextRefreshToken = refreshTokenData.token;
+    if (tokenPayload.sessionId) {
+        await sessionModel.replaceRefreshToken(tokenPayload.sessionId, nextRefreshToken);
+    }
+    return {
+        token_type: "Bearer",
+        access_token: accessTokenData.token,
+        expires_in: accessTokenData.expiresIn,
+        refresh_token: nextRefreshToken,
+    };
+}
+//# sourceMappingURL=switch-tenant.js.map

package/dist/routes/auth/switch-tenant.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"switch-tenant.js","sourceRoot":"","sources":["../../../src/routes/auth/switch-tenant.ts"],"names":[],"mappings":";;AA+BA,oCAmDC;AAlFD,uEAA0E;AAC1E,6FAAqE;AACrE,qDAAiE;AACjE,yDAIwC;AAKxC,6BAAwB;AAGxB,MAAM,cAAc,GAAG,GAAG,CAAC;AAE3B,MAAM,kBAAkB,GAAG,OAAC,CAAC,MAAM,CAAC;IAClC,YAAY,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/B,QAAQ,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC5B,CAAC,CAAC;AAEH,KAAK,UAAU,gBAAgB,CAC7B,MAAc,EACd,QAAgB;IAEhB,MAAM,WAAW,GAAG,IAAA,wCAAQ,EAAC,sBAAiB,EAAE,QAAQ,CAAC,CAAC;IAC1D,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IACnD,IAAA,2BAAM,EAAC,MAAM,EAAE,cAAc,EAAE,oBAAoB,CAAC,CAAC;AACvD,CAAC;AAEM,KAAK,UAAU,YAAY,CAChC,SAAoB,EACpB,YAA0B,EAC1B,IAAa;IAEb,MAAM,EAAE,YAAY,EAAE,QAAQ,EAAE,GAAG,IAAA,qCAAgB,EAAC,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAC9D,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAC,CAC5B,CAAC;IAEF,MAAM,YAAY,GAAG,MAAM,IAAA,2BAAoB,EAAC,YAAY,CAAC,CAAC;IAE9D,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;IAClD,IAAA,2BAAM,EAAC,IAAI,EAAE,GAAG,EAAE,qBAAqB,CAAC,CAAC;IAEzC,MAAM,gBAAgB,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IAE3C,IAAI,YAAY,CAAC,SAAS,EAAE,CAAC;QAC3B,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,GAAG,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC;QAC/D,IAAA,2BAAM,EAAC,OAAO,EAAE,GAAG,EAAE,uBAAuB,CAAC,CAAC;QAC9C,IAAA,2BAAM,EAAC,OAAO,CAAC,YAAY,KAAK,YAAY,EAAE,GAAG,EAAE,uBAAuB,CAAC,CAAC;QAC5E,YAAY;aACT,MAAM,CAAC,YAAY,CAAC,SAAS,EAAE,EAAE,YAAY,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC;aAC5D,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACrB,CAAC;IAED,MAAM,eAAe,GAAG,MAAM,IAAA,0BAAmB,EAC/C,QAAQ,EACR,IAAI,EACJ,YAAY,CAAC,SAAS,CACvB,CAAC;IAEF,MAAM,gBAAgB,GAAG,MAAM,IAAA,2BAAoB,EACjD,QAAQ,EACR,IAAI,EACJ,YAAY,CAAC,SAAS,CACvB,CAAC;IACF,MAAM,gBAAgB,GAAG,gBAAgB,CAAC,KAAK,CAAC;IAEhD,IAAI,YAAY,CAAC,SAAS,EAAE,CAAC;QAC3B,MAAM,YAAY,CAAC,mBAAmB,CACpC,YAAY,CAAC,SAAS,EACtB,gBAAgB,CACjB,CAAC;IACJ,CAAC;IAED,OAAO;QACL,UAAU,EAAE,QAAQ;QACpB,YAAY,EAAE,eAAe,CAAC,KAAK;QACnC,UAAU,EAAE,eAAe,CAAC,SAAS;QACrC,aAAa,EAAE,gBAAgB;KAChC,CAAC;AACJ,CAAC"}

package/dist/routes/auth/types.d.ts

@@ -0,0 +1,18 @@
+import type { User } from "@antelopejs/interface-dms/auth/db";
+export interface AuthResponse {
+    token_type: string;
+    access_token: string;
+    expires_in: number;
+    refresh_token: string;
+    user?: Partial<User>;
+}
+export interface TwoFactorRequiredResponse {
+    requires_2fa: true;
+    two_factor_token: string;
+    methods: string[];
+}
+export interface TenantAssignmentRequiredResponse {
+    requires_tenant_assignment: true;
+    tenant_assignment_token: string;
+    user: Partial<User>;
+}

package/dist/routes/auth/types.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=types.js.map

package/dist/routes/auth/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/routes/auth/types.ts"],"names":[],"mappings":""}

package/dist/routes/auth/validate-forgot-password-token.d.ts

@@ -0,0 +1,2 @@
+import type { UserModel } from "@antelopejs/interface-dms/auth/db";
+export declare function validateForgotPasswordToken(userModel: UserModel, body: unknown): Promise<void>;

package/dist/routes/auth/validate-forgot-password-token.js

@@ -0,0 +1,17 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.validateForgotPasswordToken = validateForgotPasswordToken;
+const interface_api_util_1 = require("@antelopejs/interface-api-util");
+const config_1 = require("../../config");
+const auth_schema_1 = require("../../validation/auth.schema");
+async function validateForgotPasswordToken(userModel, body) {
+    const config = (0, config_1.getAuthConfig)();
+    const { email, token } = (0, interface_api_util_1.assertValidation)(body, (v) => auth_schema_1.authSchema.validateForgotPasswordToken.parse(v));
+    const user = await userModel.getByEmail(email);
+    const isTokenValid = user?.forgotPasswordToken === token &&
+        user?.forgotPasswordRequestedAt &&
+        Date.now() - user.forgotPasswordRequestedAt.getTime() <
+            config.passwordRecoverTokenLifetime;
+    (0, interface_api_util_1.assert)(isTokenValid, 400, "error.invalid_or_expired_token");
+}
+//# sourceMappingURL=validate-forgot-password-token.js.map

package/dist/routes/auth/validate-forgot-password-token.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate-forgot-password-token.js","sourceRoot":"","sources":["../../../src/routes/auth/validate-forgot-password-token.ts"],"names":[],"mappings":";;AAKA,kEAiBC;AAtBD,uEAA0E;AAE1E,yCAA6C;AAC7C,8DAA0D;AAEnD,KAAK,UAAU,2BAA2B,CAC/C,SAAoB,EACpB,IAAa;IAEb,MAAM,MAAM,GAAG,IAAA,sBAAa,GAAE,CAAC;IAC/B,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,IAAA,qCAAgB,EAAC,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CACpD,wBAAU,CAAC,2BAA2B,CAAC,KAAK,CAAC,CAAC,CAAC,CAChD,CAAC;IAEF,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;IAC/C,MAAM,YAAY,GAChB,IAAI,EAAE,mBAAmB,KAAK,KAAK;QACnC,IAAI,EAAE,yBAAyB;QAC/B,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,yBAAyB,CAAC,OAAO,EAAE;YACnD,MAAM,CAAC,4BAA4B,CAAC;IAExC,IAAA,2BAAM,EAAC,YAAY,EAAE,GAAG,EAAE,gCAAgC,CAAC,CAAC;AAC9D,CAAC"}

package/dist/routes/auth/verify-2fa.d.ts

@@ -0,0 +1,3 @@
+import type { SessionModel, UserModel } from "@antelopejs/interface-dms/auth/db";
+import type { AuthResponse } from "./types";
+export declare function verify2FA(userModel: UserModel, sessionModel: SessionModel, body: unknown, userAgent: string, ip: string): Promise<AuthResponse>;

package/dist/routes/auth/verify-2fa.js

@@ -0,0 +1,62 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.verify2FA = verify2FA;
+const node_crypto_1 = __importDefault(require("node:crypto"));
+const interface_api_util_1 = require("@antelopejs/interface-api-util");
+const auth_1 = require("@antelopejs/interface-dms/auth");
+const _2fa_1 = require("2fa");
+const account_notifications_1 = require("../../utils/account-notifications");
+const auth_schema_1 = require("../../validation/auth.schema");
+const constants_1 = require("./constants");
+const verifyMethods = {
+    async totp({ user, code }) {
+        (0, interface_api_util_1.assert)(user.twoFactorMethods?.includes("totp"), 401, "error.2fa_method_not_enabled");
+        (0, interface_api_util_1.assert)(user.twoFactorSecret, 401, "error.2fa_not_configured");
+        (0, interface_api_util_1.assert)((0, _2fa_1.verifyTOTP)(user.twoFactorSecret, code), 401, "error.invalid_2fa_code");
+    },
+    async email({ user, code, userModel }) {
+        (0, interface_api_util_1.assert)(user.twoFactorMethods?.includes("email"), 401, "error.2fa_method_not_enabled");
+        (0, interface_api_util_1.assert)(user.twoFactorEmailCode, 401, "error.2fa_code_expired");
+        const isExpired = !user.twoFactorEmailCodeRequestedAt ||
+            Date.now() - new Date(user.twoFactorEmailCodeRequestedAt).getTime() >
+                constants_1.TWO_FACTOR_EMAIL_CODE_LIFETIME_MS;
+        (0, interface_api_util_1.assert)(!isExpired, 401, "error.2fa_code_expired");
+        (0, interface_api_util_1.assert)(user.twoFactorEmailCode === code, 401, "error.invalid_2fa_code");
+        user.twoFactorEmailCode = null;
+        user.twoFactorEmailCodeRequestedAt = null;
+        await userModel.update(user);
+    },
+    async backup({ user, code, userModel }) {
+        (0, interface_api_util_1.assert)(user.twoFactorBackupCodes?.length > 0, 401, "error.no_backup_codes");
+        const codeHash = node_crypto_1.default.createHash("sha256").update(code).digest("hex");
+        const matchIndex = user.twoFactorBackupCodes.indexOf(codeHash);
+        (0, interface_api_util_1.assert)(matchIndex >= 0, 401, "error.invalid_backup_code");
+        user.twoFactorBackupCodes.splice(matchIndex, 1);
+        await userModel.update(user);
+    },
+};
+async function verify2FA(userModel, sessionModel, body, userAgent, ip) {
+    const { token, code, method } = (0, interface_api_util_1.assertValidation)(body, (v) => auth_schema_1.authSchema.verify2FA.parse(v));
+    const twoFactorPayload = await (0, auth_1.validateTwoFactorToken)(token);
+    const { user, tenantId } = twoFactorPayload;
+    (0, interface_api_util_1.assert)(tenantId, 401, "error.invalid_token");
+    const verifier = verifyMethods[method];
+    (0, interface_api_util_1.assert)(verifier, 400, "error.invalid_2fa_method");
+    await verifier({ user, code, userModel });
+    const sessionId = await (0, auth_1.createSession)(sessionModel, user._id, userAgent, ip);
+    const accessTokenData = await (0, auth_1.generateAccessToken)(tenantId, user, sessionId);
+    const refreshTokenData = await (0, auth_1.generateRefreshToken)(tenantId, user, sessionId);
+    await sessionModel.replaceRefreshToken(sessionId, refreshTokenData.token);
+    void (0, account_notifications_1.notifyNewLogin)(user._id, userAgent, ip);
+    return {
+        token_type: "Bearer",
+        access_token: accessTokenData.token,
+        expires_in: accessTokenData.expiresIn,
+        refresh_token: refreshTokenData.token,
+        user: await (0, auth_1.sanitizeUser)(user),
+    };
+}
+//# sourceMappingURL=verify-2fa.js.map

package/dist/routes/auth/verify-2fa.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify-2fa.js","sourceRoot":"","sources":["../../../src/routes/auth/verify-2fa.ts"],"names":[],"mappings":";;;;;AA6EA,8BAuCC;AApHD,8DAAiC;AACjC,uEAA0E;AAC1E,yDAMwC;AAKxC,8BAAiC;AACjC,6EAAmE;AACnE,8DAA0D;AAC1D,2CAAgE;AAWhE,MAAM,aAAa,GAGf;IACF,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE;QACvB,IAAA,2BAAM,EACJ,IAAI,CAAC,gBAAgB,EAAE,QAAQ,CAAC,MAAM,CAAC,EACvC,GAAG,EACH,8BAA8B,CAC/B,CAAC;QACF,IAAA,2BAAM,EAAC,IAAI,CAAC,eAAe,EAAE,GAAG,EAAE,0BAA0B,CAAC,CAAC;QAC9D,IAAA,2BAAM,EACJ,IAAA,iBAAU,EAAC,IAAI,CAAC,eAAe,EAAE,IAAI,CAAC,EACtC,GAAG,EACH,wBAAwB,CACzB,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE;QACnC,IAAA,2BAAM,EACJ,IAAI,CAAC,gBAAgB,EAAE,QAAQ,CAAC,OAAO,CAAC,EACxC,GAAG,EACH,8BAA8B,CAC/B,CAAC;QACF,IAAA,2BAAM,EAAC,IAAI,CAAC,kBAAkB,EAAE,GAAG,EAAE,wBAAwB,CAAC,CAAC;QAE/D,MAAM,SAAS,GACb,CAAC,IAAI,CAAC,6BAA6B;YACnC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC,OAAO,EAAE;gBACjE,6CAAiC,CAAC;QACtC,IAAA,2BAAM,EAAC,CAAC,SAAS,EAAE,GAAG,EAAE,wBAAwB,CAAC,CAAC;QAClD,IAAA,2BAAM,EAAC,IAAI,CAAC,kBAAkB,KAAK,IAAI,EAAE,GAAG,EAAE,wBAAwB,CAAC,CAAC;QAExE,IAAI,CAAC,kBAAkB,GAAG,IAAI,CAAC;QAC/B,IAAI,CAAC,6BAA6B,GAAG,IAAI,CAAC;QAC1C,MAAM,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC/B,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE;QACpC,IAAA,2BAAM,EAAC,IAAI,CAAC,oBAAoB,EAAE,MAAM,GAAG,CAAC,EAAE,GAAG,EAAE,uBAAuB,CAAC,CAAC;QAE5E,MAAM,QAAQ,GAAG,qBAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACxE,MAAM,UAAU,GAAG,IAAI,CAAC,oBAAoB,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC/D,IAAA,2BAAM,EAAC,UAAU,IAAI,CAAC,EAAE,GAAG,EAAE,2BAA2B,CAAC,CAAC;QAE1D,IAAI,CAAC,oBAAoB,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;QAChD,MAAM,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC/B,CAAC;CACF,CAAC;AAEK,KAAK,UAAU,SAAS,CAC7B,SAAoB,EACpB,YAA0B,EAC1B,IAAa,EACb,SAAiB,EACjB,EAAU;IAEV,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,IAAA,qCAAgB,EAAC,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAC3D,wBAAU,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAC9B,CAAC;IAEF,MAAM,gBAAgB,GAAG,MAAM,IAAA,6BAAsB,EAAC,KAAK,CAAC,CAAC;IAC7D,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,gBAAgB,CAAC;IAC5C,IAAA,2BAAM,EAAC,QAAQ,EAAE,GAAG,EAAE,qBAAqB,CAAC,CAAC;IAE7C,MAAM,QAAQ,GAAG,aAAa,CAAC,MAAsB,CAAC,CAAC;IACvD,IAAA,2BAAM,EAAC,QAAQ,EAAE,GAAG,EAAE,0BAA0B,CAAC,CAAC;IAClD,MAAM,QAAQ,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;IAE1C,MAAM,SAAS,GAAG,MAAM,IAAA,oBAAa,EAAC,YAAY,EAAE,IAAI,CAAC,GAAG,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;IAE7E,MAAM,eAAe,GAAG,MAAM,IAAA,0BAAmB,EAAC,QAAQ,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;IAC7E,MAAM,gBAAgB,GAAG,MAAM,IAAA,2BAAoB,EACjD,QAAQ,EACR,IAAI,EACJ,SAAS,CACV,CAAC;IAEF,MAAM,YAAY,CAAC,mBAAmB,CAAC,SAAS,EAAE,gBAAgB,CAAC,KAAK,CAAC,CAAC;IAE1E,KAAK,IAAA,sCAAc,EAAC,IAAI,CAAC,GAAG,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;IAE7C,OAAO;QACL,UAAU,EAAE,QAAQ;QACpB,YAAY,EAAE,eAAe,CAAC,KAAK;QACnC,UAAU,EAAE,eAAe,CAAC,SAAS;QACrC,aAAa,EAAE,gBAAgB,CAAC,KAAK;QACrC,IAAI,EAAE,MAAM,IAAA,mBAAY,EAAC,IAAI,CAAC;KAC/B,CAAC;AACJ,CAAC"}

package/dist/routes/auth/verify-email.d.ts

@@ -0,0 +1,2 @@
+import type { User, UserModel } from "@antelopejs/interface-dms/auth/db";
+export declare function verifyEmail(userModel: UserModel, user: User, body: unknown): Promise<void>;

package/dist/routes/auth/verify-email.js

@@ -0,0 +1,21 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.verifyEmail = verifyEmail;
+const interface_api_util_1 = require("@antelopejs/interface-api-util");
+const config_1 = require("../../config");
+const auth_schema_1 = require("../../validation/auth.schema");
+async function verifyEmail(userModel, user, body) {
+    const config = (0, config_1.getAuthConfig)();
+    const { token } = (0, interface_api_util_1.assertValidation)(body, (v) => auth_schema_1.authSchema.verifyEmail.parse(v));
+    (0, interface_api_util_1.assert)(config.mustValidateEmail, 400, "error.email_validation_disabled");
+    (0, interface_api_util_1.assert)(!user.isValidated, 400, "error.email_already_validated");
+    (0, interface_api_util_1.assert)(user.validationToken === token.toUpperCase(), 400, "error.invalid_token");
+    (0, interface_api_util_1.assert)(user.validationRequestedAt &&
+        Date.now() - user.validationRequestedAt.getTime() <
+            config.emailValidationTokenLifetime, 400, "error.token_expired");
+    user.isValidated = true;
+    user.validationToken = null;
+    user.validationRequestedAt = null;
+    await userModel.update(user);
+}
+//# sourceMappingURL=verify-email.js.map

package/dist/routes/auth/verify-email.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify-email.js","sourceRoot":"","sources":["../../../src/routes/auth/verify-email.ts"],"names":[],"mappings":";;AAKA,kCA+BC;AApCD,uEAA0E;AAE1E,yCAA6C;AAC7C,8DAA0D;AAEnD,KAAK,UAAU,WAAW,CAC/B,SAAoB,EACpB,IAAU,EACV,IAAa;IAEb,MAAM,MAAM,GAAG,IAAA,sBAAa,GAAE,CAAC;IAC/B,MAAM,EAAE,KAAK,EAAE,GAAG,IAAA,qCAAgB,EAAC,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAC7C,wBAAU,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,CAChC,CAAC;IAEF,IAAA,2BAAM,EAAC,MAAM,CAAC,iBAAiB,EAAE,GAAG,EAAE,iCAAiC,CAAC,CAAC;IAEzE,IAAA,2BAAM,EAAC,CAAC,IAAI,CAAC,WAAW,EAAE,GAAG,EAAE,+BAA+B,CAAC,CAAC;IAChE,IAAA,2BAAM,EACJ,IAAI,CAAC,eAAe,KAAK,KAAK,CAAC,WAAW,EAAE,EAC5C,GAAG,EACH,qBAAqB,CACtB,CAAC;IACF,IAAA,2BAAM,EACJ,IAAI,CAAC,qBAAqB;QACxB,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,qBAAqB,CAAC,OAAO,EAAE;YAC/C,MAAM,CAAC,4BAA4B,EACvC,GAAG,EACH,qBAAqB,CACtB,CAAC;IAEF,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;IACxB,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC;IAC5B,IAAI,CAAC,qBAAqB,GAAG,IAAI,CAAC;IAElC,MAAM,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;AAC/B,CAAC"}