@arcblock/did-connect-service 4.1.12 → 4.1.14

package/dist/handlers/email-login-handler.js

@@ -2,7 +2,7 @@
  * EmailLoginHandler — email code + magic link login for Cloudflare Workers.
  *
  * Flow:
- *   1. POST /sendCode — generate 6-digit code, send via Resend, return { id }
+ *   1. POST /sendCode — generate 8-digit CSPRNG code, send via Resend, return { id }
  *   2. GET  /status   — poll whether code has been verified (for UX)
  *   3. POST /login    — verify code (or magic token JWT), derive DID, issue JWT
  *
@@ -17,11 +17,32 @@ import { ensureInstanceMembership } from "../identity/auto-membership.js";
 import { deriveDID } from "../identity/federation.js";
 import { fetchGravatarUrl } from "../identity/gravatar.js";
 import { signJWT, verifyJWT } from "../identity/jwt.js";
+import { issueSessionTokens } from "../identity/session-tokens.js";
 import { consoleLogger } from "../logger.js";
 import { downloadAndStoreAvatar } from "./avatar-handler.js";
 const PREFIX = "/.well-known/service/api/email";
 /** @deprecated Keep old prefix for backwards compatibility with existing clients. */
 const LEGACY_PREFIX = "/.well-known/service/api/user/email";
+/** Verification code length (digits). 8 digits = 10^8 keyspace, generated via CSPRNG. */
+const CODE_LENGTH = 8;
+/** Brute-force lockout on /login, independent of /sendCode's 1/minute rate limit.
+ *  Scoped per verify-code id (the specific pending login) and per IP (broader scan protection). */
+const LOGIN_MAX_ATTEMPTS_PER_ID = 5;
+const LOGIN_MAX_ATTEMPTS_PER_IP = 20;
+const LOGIN_LOCKOUT_TTL_SECONDS = 15 * 60;
+/** Generate a verification code using a CSPRNG (crypto.getRandomValues), not Math.random().
+ *  Uses rejection sampling (reject bytes >= 250) so each digit is uniform over 0-9. */
+function generateVerifyCode(length = CODE_LENGTH) {
+    const digits = [];
+    while (digits.length < length) {
+        const buf = crypto.getRandomValues(new Uint8Array(length - digits.length));
+        for (const b of buf) {
+            if (b < 250)
+                digits.push(b % 10);
+        }
+    }
+    return digits.join("");
+}
 export class EmailLoginHandler {
     options;
     logger;
@@ -102,8 +123,8 @@ export class EmailLoginHandler {
         if (await this.options.store.isVerifyCodeSent(email)) {
             return jsonResponse({ error: "Code already sent, please wait" }, 429);
         }
-        // Generate 6-digit code
-        const code = Array.from({ length: 6 }, () => Math.floor(Math.random() * 10)).join("");
+        // Generate code via CSPRNG (8 digits — see generateVerifyCode())
+        const code = generateVerifyCode();
         const id = await this.options.store.createVerifyCode(code, email, "login");
         // Generate magic link JWT (30 min)
         const origin = new URL(request.url).origin;
@@ -127,7 +148,10 @@ export class EmailLoginHandler {
             if (!res.ok) {
                 const text = await res.text();
                 this.logger.error({ message: "resend api rejected verification email", mod: "email", op: "sendCode", status: res.status, body: text.slice(0, 200), emailDomain: email.split("@").pop() });
-                return jsonResponse({ error: `Failed to send email: ${text}` }, 500);
+                // Never echo the upstream (Resend) response body to the unauthenticated
+                // caller — it can contain provider-internal details. Full text stays
+                // only in the truncated structured log above.
+                return jsonResponse({ error: "Failed to send email" }, 500);
             }
         }
         catch (err) {
@@ -166,24 +190,53 @@ export class EmailLoginHandler {
         catch {
             return jsonResponse({ error: "Invalid request body" }, 400);
         }
-        // Resolve the verification code
+        // Resolve the verification code, bound to the specific verify-code row id
+        // (returned by /sendCode). Binding to id prevents a guessed code from matching
+        // ANY live code in the table — it can only ever match the session it was issued for.
         let verifyCode;
+        let verifyId;
         if (body.magicToken) {
             const payload = await verifyJWT(body.magicToken, this.options.jwtSecret);
-            if (!payload || typeof payload.code !== "string") {
+            if (!payload || typeof payload.code !== "string" || typeof payload.id !== "number") {
                 return jsonResponse({ error: "Invalid or expired magic link" }, 400);
             }
             verifyCode = payload.code;
+            verifyId = payload.id;
         }
         else if (body.code) {
+            const idNum = typeof body.id === "number" ? body.id : Number(body.id);
+            if (!Number.isFinite(idNum) || !Number.isInteger(idNum)) {
+                return jsonResponse({ error: "Missing or invalid id" }, 400);
+            }
             verifyCode = body.code;
+            verifyId = idNum;
         }
         else {
             return jsonResponse({ error: "Missing code or magicToken" }, 400);
         }
-        // Consume verify code (single-use)
-        const record = await this.options.store.consumeVerifyCode(verifyCode);
+        // Brute-force lockout on /login itself — independent of /sendCode's 1/minute rate
+        // limit. Scoped per verify-code id (the specific pending login) and per IP.
+        const { store } = this.options;
+        const ip = request.headers.get("CF-Connecting-IP") ?? undefined;
+        const idAttemptsKey = `email-login:attempts:id:${verifyId}`;
+        const ipAttemptsKey = `email-login:attempts:ip:${ip ?? "unknown"}`;
+        const [idAttemptsRaw, ipAttemptsRaw] = await Promise.all([
+            store.cacheGet(idAttemptsKey),
+            store.cacheGet(ipAttemptsKey),
+        ]);
+        const idAttempts = idAttemptsRaw ? Number(idAttemptsRaw) : 0;
+        const ipAttempts = ipAttemptsRaw ? Number(ipAttemptsRaw) : 0;
+        if (idAttempts >= LOGIN_MAX_ATTEMPTS_PER_ID || ipAttempts >= LOGIN_MAX_ATTEMPTS_PER_IP) {
+            this.logger.warn({ message: "email login locked out after too many failed attempts", mod: "email", op: "login", idAttempts, ipAttempts });
+            return jsonResponse({ error: "Too many attempts, please try again later" }, 429);
+        }
+        // Consume verify code (single-use), bound to (code, id)
+        const record = await store.consumeVerifyCode(verifyCode, verifyId);
         if (!record) {
+            await Promise.all([
+                store.cachePut(idAttemptsKey, String(idAttempts + 1), LOGIN_LOCKOUT_TTL_SECONDS),
+                store.cachePut(ipAttemptsKey, String(ipAttempts + 1), LOGIN_LOCKOUT_TTL_SECONDS),
+            ]);
             return jsonResponse({ error: "Invalid or expired code" }, 400);
         }
         // Derive DID from email (delegates to master in federated mode)
@@ -195,11 +248,9 @@ export class EmailLoginHandler {
         const userDid = wallet.did;
         const userPk = wallet.pk;
         // Create or update user
-        const { store } = this.options;
         const existingUser = await store.getUserByDidOrConnectedAccount(userDid);
         const isNewUser = !existingUser;
         const primaryDid = existingUser?.did || userDid;
-        const ip = request.headers.get("CF-Connecting-IP") ?? undefined;
         const hostname = new URL(request.url).hostname;
         // Resolve invitation from cookie (set by invite page)
         let invitedRole;
@@ -304,12 +355,12 @@ export class EmailLoginHandler {
         };
         if (jwtUser?.fullName)
             jwtPayload.fullName = jwtUser.fullName;
-        const jwt = await signJWT(jwtPayload, this.options.jwtSecret, this.options.jwtExpiresIn);
+        const { sessionToken: jwt, refreshToken } = await issueSessionTokens(jwtPayload, primaryDid, { jwtSecret: this.options.jwtSecret, jwtExpiresIn: this.options.jwtExpiresIn }, store);
         let cookie = `${this.options.cookieName}=${jwt}; Path=/; Secure; SameSite=Lax; Max-Age=${this.options.jwtExpiresIn}`;
         const cookieDomain = typeof this.options.rpID === "string" ? this.options.rpID : undefined;
         if (cookieDomain?.includes("."))
             cookie += `; Domain=${cookieDomain}`;
-        return new Response(JSON.stringify({ ok: true, sessionToken: jwt, refreshToken: jwt, did: primaryDid }), {
+        return new Response(JSON.stringify({ ok: true, sessionToken: jwt, refreshToken, did: primaryDid }), {
             status: 200,
             headers: {
                 "Content-Type": "application/json",

package/dist/handlers/email-login-handler.js.map

@@ -1 +1 @@
-{"version":3,"file":"email-login-handler.js","sourceRoot":"","sources":["../../src/handlers/email-login-handler.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AACnE,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAEjD,OAAO,EAAE,wBAAwB,EAAE,MAAM,gCAAgC,CAAC;AAC1E,OAAO,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AACtD,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,EAAE,aAAa,EAAe,MAAM,cAAc,CAAC;AAE1D,OAAO,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAuB7D,MAAM,MAAM,GAAG,gCAAgC,CAAC;AAChD,qFAAqF;AACrF,MAAM,aAAa,GAAG,qCAAqC,CAAC;AAE5D,MAAM,OAAO,iBAAiB;IACpB,OAAO,CAA2B;IAClC,MAAM,CAAS;IAEvB,YAAY,OAAiC;QAC3C,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,aAAa,CAAC;IAChD,CAAC;IAED;kEAC8D;IAC9D,KAAK,CAAC,kBAAkB,CAAC,WAAoB;QAC3C,IAAI,IAAI,CAAC,OAAO,CAAC,YAAY,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;YACxD,OAAO,EAAE,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;QACxF,CAAC;QACD,0EAA0E;QAC1E,IAAI,GAAG,GAAG,WAAW,IAAI,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC;QAClD,IAAI,GAAG,IAAI,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC;YACnC,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,EAAE,oBAAoB,CAAC,CAAC;YAClF,IAAI,UAAU;gBAAE,GAAG,GAAG,UAAU,CAAC,CAAC,uBAAuB;QAC3D,CAAC;QACD,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC;QACtB,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;YACrE,IAAI,CAAC,GAAG;gBAAE,OAAO,IAAI,CAAC;YACtB,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAoD,CAAC;YAClF,IAAI,MAAM,CAAC,YAAY,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;gBAC9C,OAAO,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,SAAS,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC;YAC9E,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,2EAA2E;IAC3E,KAAK,CAAC,SAAS;QACb,OAAO,CAAC,MAAM,IAAI,CAAC,kBAAkB,EAAE,CAAC,KAAK,IAAI,CAAC;IACpD,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,OAAgB,EAAE,WAAoB;QAChD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC;QAC1B,MAAM,MAAM,GAAG,WAAW,IAAI,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC;QAEvD,mEAAmE;QACnE,KAAK,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,aAAa,CAAC,EAAE,CAAC;YAC1C,IAAI,IAAI,KAAK,GAAG,GAAG,WAAW,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBAC5D,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YACxC,CAAC;YACD,IAAI,IAAI,KAAK,GAAG,GAAG,SAAS,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;gBACzD,OAAO,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;YACnC,CAAC;YACD,IAAI,IAAI,KAAK,GAAG,GAAG,QAAQ,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBACzD,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YACrC,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,iEAAiE;IACzD,KAAK,CAAC,QAAQ,CAAC,OAAgB,EAAE,WAAoB;QAC3D,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,WAAW,CAAC,CAAC;QAC/D,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,0CAA0C,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,EAAE,UAAU,EAAE,WAAW,EAAE,CAAC,CAAC;YACrH,OAAO,YAAY,CAAC,EAAE,KAAK,EAAE,+BAA+B,EAAE,EAAE,GAAG,CAAC,CAAC;QACvE,CAAC;QAED,IAAI,IAAwB,CAAC;QAC7B,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC;QAC9B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,YAAY,CAAC,EAAE,KAAK,EAAE,sBAAsB,EAAE,EAAE,GAAG,CAAC,CAAC;QAC9D,CAAC;QAED,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,EAAE,WAAW,EAAE,CAAC,IAAI,EAAE,CAAC;QAC/C,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAC1B,OAAO,YAAY,CAAC,EAAE,KAAK,EAAE,uBAAuB,EAAE,EAAE,GAAG,CAAC,CAAC;QAC/D,CAAC;QAED,0CAA0C;QAC1C,IAAI,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC;YACrD,OAAO,YAAY,CAAC,EAAE,KAAK,EAAE,gCAAgC,EAAE,EAAE,GAAG,CAAC,CAAC;QACxE,CAAC;QAED,wBAAwB;QACxB,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACtF,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,gBAAgB,CAAC,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;QAE3E,mCAAmC;QACnC,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;QAC3C,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QAC7E,MAAM,SAAS,GAAG,GAAG,MAAM,yCAAyC,UAAU,EAAE,CAAC;QAEjF,sBAAsB;QACtB,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,+BAA+B,EAAE;gBACvD,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,aAAa,EAAE,UAAU,WAAW,CAAC,YAAY,EAAE;oBACnD,cAAc,EAAE,kBAAkB;iBACnC;gBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;oBACnB,IAAI,EAAE,WAAW,CAAC,SAAS;oBAC3B,EAAE,EAAE,KAAK;oBACT,OAAO,EAAE,iBAAiB;oBAC1B,IAAI,EAAE,qBAAqB,CAAC,IAAI,EAAE,SAAS,CAAC;iBAC7C,CAAC;aACH,CAAC,CAAC;YAEH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;gBACZ,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;gBAC9B,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,wCAAwC,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;gBAC1L,OAAO,YAAY,CAAC,EAAE,KAAK,EAAE,yBAAyB,IAAI,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC;YACvE,CAAC;QACH,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,mBAAmB,CAAC;YACzE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,iDAAiD,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,OAAO,EAAE,WAAW,EAAE,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YACnK,OAAO,YAAY,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,GAAG,CAAC,CAAC;QAC/C,CAAC;QAED,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC;QAClD,OAAO,YAAY,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;IAC9B,CAAC;IAED,gEAAgE;IACxD,KAAK,CAAC,WAAW,CAAC,OAAgB;QACxC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,MAAM,EAAE,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACtC,IAAI,CAAC,EAAE;YAAE,OAAO,YAAY,CAAC,EAAE,KAAK,EAAE,sBAAsB,EAAE,EAAE,GAAG,CAAC,CAAC;QACrE,uEAAuE;QACvE,sDAAsD;QACtD,OAAO,YAAY,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;IAC7C,CAAC;IAED,uEAAuE;IAC/D,KAAK,CAAC,KAAK,CAAC,OAAgB,EAAE,WAAoB;QACxD,kFAAkF;QAClF,mFAAmF;QACnF,wEAAwE;QACxE,iFAAiF;QACjF,iCAAiC;QACjC,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;QACxD,IAAI,CAAC,WAAW,EAAE,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC;YAC/C,OAAO,YAAY,CAAC,EAAE,KAAK,EAAE,qDAAqD,EAAE,EAAE,GAAG,CAAC,CAAC;QAC7F,CAAC;QAED,IAAI,IAA4C,CAAC;QACjD,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC;QAC9B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,YAAY,CAAC,EAAE,KAAK,EAAE,sBAAsB,EAAE,EAAE,GAAG,CAAC,CAAC;QAC9D,CAAC;QAED,gCAAgC;QAChC,IAAI,UAAkB,CAAC;QACvB,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACpB,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YACzE,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACjD,OAAO,YAAY,CAAC,EAAE,KAAK,EAAE,+BAA+B,EAAE,EAAE,GAAG,CAAC,CAAC;YACvE,CAAC;YACD,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;QAC5B,CAAC;aAAM,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACrB,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC;QACzB,CAAC;aAAM,CAAC;YACN,OAAO,YAAY,CAAC,EAAE,KAAK,EAAE,4BAA4B,EAAE,EAAE,GAAG,CAAC,CAAC;QACpE,CAAC;QAED,mCAAmC;QACnC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAC;QACtE,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,YAAY,CAAC,EAAE,KAAK,EAAE,yBAAyB,EAAE,EAAE,GAAG,CAAC,CAAC;QACjE,CAAC;QAED,gEAAgE;QAChE,MAAM,GAAG,GAAG,SAAS,MAAM,CAAC,OAAO,EAAE,CAAC;QACtC,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE;YAClC,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK;YACzB,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,UAAU;SACpC,CAAC,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC;QAC3B,MAAM,MAAM,GAAG,MAAM,CAAC,EAAE,CAAC;QAEzB,wBAAwB;QACxB,MAAM,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC;QAC/B,MAAM,YAAY,GAAG,MAAM,KAAK,CAAC,8BAA8B,CAAC,OAAO,CAAC,CAAC;QACzE,MAAM,SAAS,GAAG,CAAC,YAAY,CAAC;QAChC,MAAM,UAAU,GAAG,YAAY,EAAE,GAAG,IAAI,OAAO,CAAC;QAEhD,MAAM,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,IAAI,SAAS,CAAC;QAChE,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC;QAE/C,sDAAsD;QACtD,IAAI,WAA+B,CAAC;QACpC,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QACpD,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,sCAAsC,CAAC,CAAC;QACvE,MAAM,YAAY,GAAG,QAAQ,CAAC,CAAC,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC7E,IAAI,YAAY,EAAE,CAAC;YACjB,MAAM,UAAU,GAAG,MAAM,KAAK,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC;YAC3D,IAAI,UAAU,IAAI,UAAU,CAAC,MAAM,KAAK,QAAQ,IAAI,UAAU,CAAC,QAAQ,GAAG,UAAU,CAAC,OAAO,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,IAAI,IAAI,EAAE,EAAE,CAAC;gBAC5I,WAAW,GAAG,UAAU,CAAC,IAAI,CAAC;YAChC,CAAC;QACH,CAAC;QAED,IAAI,SAAS,EAAE,CAAC;YACd,+DAA+D;YAC/D,8CAA8C;YAC9C,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC,YAAY,EAAE,CAAC;YAC7C,IAAI,SAAS,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;gBAClC,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,kBAAkB,CAAC,WAAW,KAAK,UAAU,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;gBACpG,IAAI,CAAC,MAAM,EAAE,CAAC;oBACZ,MAAM,KAAK,CAAC,cAAc,CAAC;wBACzB,MAAM,EAAE,uBAAuB;wBAC/B,WAAW,EAAE,OAAO;wBACpB,QAAQ,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,qBAAqB,EAAE,MAAM,EAAE,QAAQ,EAAE;wBAChG,EAAE;wBACF,WAAW,EAAE,WAAW,KAAK,UAAU,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS;qBAClE,CAAC,CAAC;oBACH,OAAO,YAAY,CAAC,EAAE,KAAK,EAAE,qBAAqB,EAAE,IAAI,EAAE,qBAAqB,EAAE,EAAE,GAAG,CAAC,CAAC;gBAC1F,CAAC;YACH,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YACtD,MAAM,KAAK,CAAC,UAAU,CAAC;gBACrB,GAAG,EAAE,OAAO;gBACZ,EAAE,EAAE,MAAM;gBACV,QAAQ,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;gBACtC,KAAK,EAAE,MAAM,CAAC,OAAO;gBACrB,MAAM;gBACN,cAAc,EAAE,cAAc,CAAC,KAAK;gBACpC,aAAa,EAAE,CAAC;gBAChB,EAAE;gBACF,MAAM,EAAE,QAAQ;gBAChB,SAAS,EAAE,OAAO;aACnB,CAAC,CAAC;YAEH,IAAI,SAAS,KAAK,CAAC,EAAE,CAAC;gBACpB,MAAM,KAAK,CAAC,cAAc,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;YACzD,CAAC;YAED,2CAA2C;YAC3C,IAAI,MAAM,EAAE,UAAU,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;gBAClD,sBAAsB,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YAClF,CAAC;QACH,CAAC;aAAM,CAAC;YACN,MAAM,KAAK,CAAC,eAAe,CAAC,UAAU,EAAE,EAAE,EAAE,QAAQ,CAAC,CAAC;YACtD,2CAA2C;YAC3C,MAAM,KAAK,CAAC,iBAAiB,CAAC,UAAU,EAAE,EAAE,aAAa,EAAE,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC;QAC9E,CAAC;QAED,6DAA6D;QAC7D,MAAM,wBAAwB,CAAC,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC;QAE5E,2BAA2B;QAC3B,MAAM,KAAK,CAAC,sBAAsB,CAAC;YACjC,GAAG,EAAE,OAAO;YACZ,EAAE,EAAE,MAAM;YACV,OAAO,EAAE,UAAU;YACnB,QAAQ,EAAE,OAAO;YACjB,EAAE,EAAE,GAAG;YACP,KAAK,EAAE,UAAU;SAClB,CAAC,CAAC;QAEH,YAAY;QACZ,MAAM,KAAK,CAAC,cAAc,CAAC;YACzB,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,YAAY;YAClD,WAAW,EAAE,UAAU;YACvB,QAAQ,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE;YACjD,EAAE;YACF,WAAW;SACZ,CAAC,CAAC;QAEH,4CAA4C;QAC5C,MAAM,OAAO,GAAG,YAAY,IAAI,MAAM,KAAK,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;QAClE,IAAI,SAAS,GAAG,CAAC,OAAO,EAAE,IAAI,IAAI,OAAO,CAA+B,CAAC;QAEzE,uEAAuE;QACvE,IAAI,WAAW,EAAE,CAAC;YAChB,MAAM,UAAU,GAAG,MAAM,KAAK,CAAC,aAAa,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;YACtE,IAAI,UAAU,EAAE,IAAI,EAAE,CAAC;gBACrB,SAAS,GAAG,UAAU,CAAC,IAAkC,CAAC;YAC5D,CAAC;iBAAM,IAAI,SAAS,KAAK,OAAO,IAAI,SAAS,KAAK,OAAO,EAAE,CAAC;gBAC1D,SAAS,GAAG,OAAO,CAAC;YACtB,CAAC;QACH,CAAC;QAED,wCAAwC;QACxC,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,KAAK,EAAE,WAAW,EAAE,SAAS,CAAC,CAAC;QACrE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,oCAAoC,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,CAAC,CAAC;YACpJ,OAAO,YAAY,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,GAAG,CAAC,CAAC;QACnF,CAAC;QAED,MAAM,UAAU,GAA4B;YAC1C,IAAI,EAAE,MAAM;YACZ,GAAG,EAAE,UAAU;YACf,EAAE,EAAE,OAAO,EAAE,EAAE,IAAI,MAAM;YACzB,IAAI,EAAE,SAAS;YACf,QAAQ,EAAE,OAAO;YACjB,GAAG,EAAE,CAAC;YACN,QAAQ,EAAE,KAAK;SAChB,CAAC;QACF,IAAI,OAAO,EAAE,QAAQ;YAAE,UAAU,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;QAC9D,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QAEzF,IAAI,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,IAAI,GAAG,2CAA2C,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC;QACrH,MAAM,YAAY,GAAG,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;QAC3F,IAAI,YAAY,EAAE,QAAQ,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,YAAY,YAAY,EAAE,CAAC;QAEtE,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,EAAE,YAAY,EAAE,GAAG,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC,EAAE;YACvG,MAAM,EAAE,GAAG;YACX,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,YAAY,EAAE,MAAM;gBACpB,eAAe,EAAE,mBAAmB;aACrC;SACF,CAAC,CAAC;IACL,CAAC;CACF;AAED,SAAS,YAAY,CAAC,IAAa,EAAE,MAAM,GAAG,GAAG;IAC/C,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE;QACxC,MAAM;QACN,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,eAAe,EAAE,mBAAmB,EAAE;KACtF,CAAC,CAAC;AACL,CAAC;AAED,SAAS,qBAAqB,CAAC,IAAY,EAAE,SAAiB;IAC5D,OAAO;;;oJAG2I,IAAI;;gBAExI,SAAS;;eAEV,CAAC;AAChB,CAAC"}
+{"version":3,"file":"email-login-handler.js","sourceRoot":"","sources":["../../src/handlers/email-login-handler.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AACnE,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAEjD,OAAO,EAAE,wBAAwB,EAAE,MAAM,gCAAgC,CAAC;AAC1E,OAAO,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AACtD,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,EAAE,kBAAkB,EAAE,MAAM,+BAA+B,CAAC;AACnE,OAAO,EAAE,aAAa,EAAe,MAAM,cAAc,CAAC;AAE1D,OAAO,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAuB7D,MAAM,MAAM,GAAG,gCAAgC,CAAC;AAChD,qFAAqF;AACrF,MAAM,aAAa,GAAG,qCAAqC,CAAC;AAE5D,yFAAyF;AACzF,MAAM,WAAW,GAAG,CAAC,CAAC;AAEtB;mGACmG;AACnG,MAAM,yBAAyB,GAAG,CAAC,CAAC;AACpC,MAAM,yBAAyB,GAAG,EAAE,CAAC;AACrC,MAAM,yBAAyB,GAAG,EAAE,GAAG,EAAE,CAAC;AAE1C;uFACuF;AACvF,SAAS,kBAAkB,CAAC,SAAiB,WAAW;IACtD,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,OAAO,MAAM,CAAC,MAAM,GAAG,MAAM,EAAE,CAAC;QAC9B,MAAM,GAAG,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;QAC3E,KAAK,MAAM,CAAC,IAAI,GAAG,EAAE,CAAC;YACpB,IAAI,CAAC,GAAG,GAAG;gBAAE,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;QACnC,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACzB,CAAC;AAED,MAAM,OAAO,iBAAiB;IACpB,OAAO,CAA2B;IAClC,MAAM,CAAS;IAEvB,YAAY,OAAiC;QAC3C,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,aAAa,CAAC;IAChD,CAAC;IAED;kEAC8D;IAC9D,KAAK,CAAC,kBAAkB,CAAC,WAAoB;QAC3C,IAAI,IAAI,CAAC,OAAO,CAAC,YAAY,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;YACxD,OAAO,EAAE,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;QACxF,CAAC;QACD,0EAA0E;QAC1E,IAAI,GAAG,GAAG,WAAW,IAAI,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC;QAClD,IAAI,GAAG,IAAI,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC;YACnC,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,EAAE,oBAAoB,CAAC,CAAC;YAClF,IAAI,UAAU;gBAAE,GAAG,GAAG,UAAU,CAAC,CAAC,uBAAuB;QAC3D,CAAC;QACD,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC;QACtB,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;YACrE,IAAI,CAAC,GAAG;gBAAE,OAAO,IAAI,CAAC;YACtB,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAoD,CAAC;YAClF,IAAI,MAAM,CAAC,YAAY,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;gBAC9C,OAAO,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,SAAS,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC;YAC9E,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,2EAA2E;IAC3E,KAAK,CAAC,SAAS;QACb,OAAO,CAAC,MAAM,IAAI,CAAC,kBAAkB,EAAE,CAAC,KAAK,IAAI,CAAC;IACpD,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,OAAgB,EAAE,WAAoB;QAChD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC;QAC1B,MAAM,MAAM,GAAG,WAAW,IAAI,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC;QAEvD,mEAAmE;QACnE,KAAK,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,aAAa,CAAC,EAAE,CAAC;YAC1C,IAAI,IAAI,KAAK,GAAG,GAAG,WAAW,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBAC5D,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YACxC,CAAC;YACD,IAAI,IAAI,KAAK,GAAG,GAAG,SAAS,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;gBACzD,OAAO,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;YACnC,CAAC;YACD,IAAI,IAAI,KAAK,GAAG,GAAG,QAAQ,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBACzD,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YACrC,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,iEAAiE;IACzD,KAAK,CAAC,QAAQ,CAAC,OAAgB,EAAE,WAAoB;QAC3D,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,WAAW,CAAC,CAAC;QAC/D,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,0CAA0C,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,EAAE,UAAU,EAAE,WAAW,EAAE,CAAC,CAAC;YACrH,OAAO,YAAY,CAAC,EAAE,KAAK,EAAE,+BAA+B,EAAE,EAAE,GAAG,CAAC,CAAC;QACvE,CAAC;QAED,IAAI,IAAwB,CAAC;QAC7B,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC;QAC9B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,YAAY,CAAC,EAAE,KAAK,EAAE,sBAAsB,EAAE,EAAE,GAAG,CAAC,CAAC;QAC9D,CAAC;QAED,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,EAAE,WAAW,EAAE,CAAC,IAAI,EAAE,CAAC;QAC/C,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAC1B,OAAO,YAAY,CAAC,EAAE,KAAK,EAAE,uBAAuB,EAAE,EAAE,GAAG,CAAC,CAAC;QAC/D,CAAC;QAED,0CAA0C;QAC1C,IAAI,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC;YACrD,OAAO,YAAY,CAAC,EAAE,KAAK,EAAE,gCAAgC,EAAE,EAAE,GAAG,CAAC,CAAC;QACxE,CAAC;QAED,iEAAiE;QACjE,MAAM,IAAI,GAAG,kBAAkB,EAAE,CAAC;QAClC,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,gBAAgB,CAAC,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;QAE3E,mCAAmC;QACnC,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;QAC3C,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QAC7E,MAAM,SAAS,GAAG,GAAG,MAAM,yCAAyC,UAAU,EAAE,CAAC;QAEjF,sBAAsB;QACtB,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,+BAA+B,EAAE;gBACvD,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,aAAa,EAAE,UAAU,WAAW,CAAC,YAAY,EAAE;oBACnD,cAAc,EAAE,kBAAkB;iBACnC;gBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;oBACnB,IAAI,EAAE,WAAW,CAAC,SAAS;oBAC3B,EAAE,EAAE,KAAK;oBACT,OAAO,EAAE,iBAAiB;oBAC1B,IAAI,EAAE,qBAAqB,CAAC,IAAI,EAAE,SAAS,CAAC;iBAC7C,CAAC;aACH,CAAC,CAAC;YAEH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;gBACZ,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;gBAC9B,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,wCAAwC,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;gBAC1L,wEAAwE;gBACxE,qEAAqE;gBACrE,8CAA8C;gBAC9C,OAAO,YAAY,CAAC,EAAE,KAAK,EAAE,sBAAsB,EAAE,EAAE,GAAG,CAAC,CAAC;YAC9D,CAAC;QACH,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,mBAAmB,CAAC;YACzE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,iDAAiD,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,OAAO,EAAE,WAAW,EAAE,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YACnK,OAAO,YAAY,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,GAAG,CAAC,CAAC;QAC/C,CAAC;QAED,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC;QAClD,OAAO,YAAY,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;IAC9B,CAAC;IAED,gEAAgE;IACxD,KAAK,CAAC,WAAW,CAAC,OAAgB;QACxC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,MAAM,EAAE,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACtC,IAAI,CAAC,EAAE;YAAE,OAAO,YAAY,CAAC,EAAE,KAAK,EAAE,sBAAsB,EAAE,EAAE,GAAG,CAAC,CAAC;QACrE,uEAAuE;QACvE,sDAAsD;QACtD,OAAO,YAAY,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;IAC7C,CAAC;IAED,uEAAuE;IAC/D,KAAK,CAAC,KAAK,CAAC,OAAgB,EAAE,WAAoB;QACxD,kFAAkF;QAClF,mFAAmF;QACnF,wEAAwE;QACxE,iFAAiF;QACjF,iCAAiC;QACjC,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;QACxD,IAAI,CAAC,WAAW,EAAE,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC;YAC/C,OAAO,YAAY,CAAC,EAAE,KAAK,EAAE,qDAAqD,EAAE,EAAE,GAAG,CAAC,CAAC;QAC7F,CAAC;QAED,IAAI,IAAkE,CAAC;QACvE,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC;QAC9B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,YAAY,CAAC,EAAE,KAAK,EAAE,sBAAsB,EAAE,EAAE,GAAG,CAAC,CAAC;QAC9D,CAAC;QAED,0EAA0E;QAC1E,+EAA+E;QAC/E,qFAAqF;QACrF,IAAI,UAAkB,CAAC;QACvB,IAAI,QAAgB,CAAC;QACrB,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACpB,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YACzE,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,OAAO,CAAC,EAAE,KAAK,QAAQ,EAAE,CAAC;gBACnF,OAAO,YAAY,CAAC,EAAE,KAAK,EAAE,+BAA+B,EAAE,EAAE,GAAG,CAAC,CAAC;YACvE,CAAC;YACD,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;YAC1B,QAAQ,GAAG,OAAO,CAAC,EAAE,CAAC;QACxB,CAAC;aAAM,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACrB,MAAM,KAAK,GAAG,OAAO,IAAI,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACtE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;gBACxD,OAAO,YAAY,CAAC,EAAE,KAAK,EAAE,uBAAuB,EAAE,EAAE,GAAG,CAAC,CAAC;YAC/D,CAAC;YACD,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC;YACvB,QAAQ,GAAG,KAAK,CAAC;QACnB,CAAC;aAAM,CAAC;YACN,OAAO,YAAY,CAAC,EAAE,KAAK,EAAE,4BAA4B,EAAE,EAAE,GAAG,CAAC,CAAC;QACpE,CAAC;QAED,kFAAkF;QAClF,4EAA4E;QAC5E,MAAM,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC;QAC/B,MAAM,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,IAAI,SAAS,CAAC;QAChE,MAAM,aAAa,GAAG,2BAA2B,QAAQ,EAAE,CAAC;QAC5D,MAAM,aAAa,GAAG,2BAA2B,EAAE,IAAI,SAAS,EAAE,CAAC;QACnE,MAAM,CAAC,aAAa,EAAE,aAAa,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YACvD,KAAK,CAAC,QAAQ,CAAC,aAAa,CAAC;YAC7B,KAAK,CAAC,QAAQ,CAAC,aAAa,CAAC;SAC9B,CAAC,CAAC;QACH,MAAM,UAAU,GAAG,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7D,MAAM,UAAU,GAAG,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7D,IAAI,UAAU,IAAI,yBAAyB,IAAI,UAAU,IAAI,yBAAyB,EAAE,CAAC;YACvF,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,uDAAuD,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,CAAC,CAAC;YAC1I,OAAO,YAAY,CAAC,EAAE,KAAK,EAAE,2CAA2C,EAAE,EAAE,GAAG,CAAC,CAAC;QACnF,CAAC;QAED,wDAAwD;QACxD,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,iBAAiB,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;QACnE,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,OAAO,CAAC,GAAG,CAAC;gBAChB,KAAK,CAAC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC,UAAU,GAAG,CAAC,CAAC,EAAE,yBAAyB,CAAC;gBAChF,KAAK,CAAC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC,UAAU,GAAG,CAAC,CAAC,EAAE,yBAAyB,CAAC;aACjF,CAAC,CAAC;YACH,OAAO,YAAY,CAAC,EAAE,KAAK,EAAE,yBAAyB,EAAE,EAAE,GAAG,CAAC,CAAC;QACjE,CAAC;QAED,gEAAgE;QAChE,MAAM,GAAG,GAAG,SAAS,MAAM,CAAC,OAAO,EAAE,CAAC;QACtC,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE;YAClC,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK;YACzB,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,UAAU;SACpC,CAAC,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC;QAC3B,MAAM,MAAM,GAAG,MAAM,CAAC,EAAE,CAAC;QAEzB,wBAAwB;QACxB,MAAM,YAAY,GAAG,MAAM,KAAK,CAAC,8BAA8B,CAAC,OAAO,CAAC,CAAC;QACzE,MAAM,SAAS,GAAG,CAAC,YAAY,CAAC;QAChC,MAAM,UAAU,GAAG,YAAY,EAAE,GAAG,IAAI,OAAO,CAAC;QAEhD,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC;QAE/C,sDAAsD;QACtD,IAAI,WAA+B,CAAC;QACpC,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QACpD,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,sCAAsC,CAAC,CAAC;QACvE,MAAM,YAAY,GAAG,QAAQ,CAAC,CAAC,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC7E,IAAI,YAAY,EAAE,CAAC;YACjB,MAAM,UAAU,GAAG,MAAM,KAAK,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC;YAC3D,IAAI,UAAU,IAAI,UAAU,CAAC,MAAM,KAAK,QAAQ,IAAI,UAAU,CAAC,QAAQ,GAAG,UAAU,CAAC,OAAO,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,IAAI,IAAI,EAAE,EAAE,CAAC;gBAC5I,WAAW,GAAG,UAAU,CAAC,IAAI,CAAC;YAChC,CAAC;QACH,CAAC;QAED,IAAI,SAAS,EAAE,CAAC;YACd,+DAA+D;YAC/D,8CAA8C;YAC9C,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC,YAAY,EAAE,CAAC;YAC7C,IAAI,SAAS,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;gBAClC,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,kBAAkB,CAAC,WAAW,KAAK,UAAU,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;gBACpG,IAAI,CAAC,MAAM,EAAE,CAAC;oBACZ,MAAM,KAAK,CAAC,cAAc,CAAC;wBACzB,MAAM,EAAE,uBAAuB;wBAC/B,WAAW,EAAE,OAAO;wBACpB,QAAQ,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,qBAAqB,EAAE,MAAM,EAAE,QAAQ,EAAE;wBAChG,EAAE;wBACF,WAAW,EAAE,WAAW,KAAK,UAAU,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS;qBAClE,CAAC,CAAC;oBACH,OAAO,YAAY,CAAC,EAAE,KAAK,EAAE,qBAAqB,EAAE,IAAI,EAAE,qBAAqB,EAAE,EAAE,GAAG,CAAC,CAAC;gBAC1F,CAAC;YACH,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YACtD,MAAM,KAAK,CAAC,UAAU,CAAC;gBACrB,GAAG,EAAE,OAAO;gBACZ,EAAE,EAAE,MAAM;gBACV,QAAQ,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;gBACtC,KAAK,EAAE,MAAM,CAAC,OAAO;gBACrB,MAAM;gBACN,cAAc,EAAE,cAAc,CAAC,KAAK;gBACpC,aAAa,EAAE,CAAC;gBAChB,EAAE;gBACF,MAAM,EAAE,QAAQ;gBAChB,SAAS,EAAE,OAAO;aACnB,CAAC,CAAC;YAEH,IAAI,SAAS,KAAK,CAAC,EAAE,CAAC;gBACpB,MAAM,KAAK,CAAC,cAAc,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;YACzD,CAAC;YAED,2CAA2C;YAC3C,IAAI,MAAM,EAAE,UAAU,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;gBAClD,sBAAsB,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YAClF,CAAC;QACH,CAAC;aAAM,CAAC;YACN,MAAM,KAAK,CAAC,eAAe,CAAC,UAAU,EAAE,EAAE,EAAE,QAAQ,CAAC,CAAC;YACtD,2CAA2C;YAC3C,MAAM,KAAK,CAAC,iBAAiB,CAAC,UAAU,EAAE,EAAE,aAAa,EAAE,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC;QAC9E,CAAC;QAED,6DAA6D;QAC7D,MAAM,wBAAwB,CAAC,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC;QAE5E,2BAA2B;QAC3B,MAAM,KAAK,CAAC,sBAAsB,CAAC;YACjC,GAAG,EAAE,OAAO;YACZ,EAAE,EAAE,MAAM;YACV,OAAO,EAAE,UAAU;YACnB,QAAQ,EAAE,OAAO;YACjB,EAAE,EAAE,GAAG;YACP,KAAK,EAAE,UAAU;SAClB,CAAC,CAAC;QAEH,YAAY;QACZ,MAAM,KAAK,CAAC,cAAc,CAAC;YACzB,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,YAAY;YAClD,WAAW,EAAE,UAAU;YACvB,QAAQ,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE;YACjD,EAAE;YACF,WAAW;SACZ,CAAC,CAAC;QAEH,4CAA4C;QAC5C,MAAM,OAAO,GAAG,YAAY,IAAI,MAAM,KAAK,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;QAClE,IAAI,SAAS,GAAG,CAAC,OAAO,EAAE,IAAI,IAAI,OAAO,CAA+B,CAAC;QAEzE,uEAAuE;QACvE,IAAI,WAAW,EAAE,CAAC;YAChB,MAAM,UAAU,GAAG,MAAM,KAAK,CAAC,aAAa,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;YACtE,IAAI,UAAU,EAAE,IAAI,EAAE,CAAC;gBACrB,SAAS,GAAG,UAAU,CAAC,IAAkC,CAAC;YAC5D,CAAC;iBAAM,IAAI,SAAS,KAAK,OAAO,IAAI,SAAS,KAAK,OAAO,EAAE,CAAC;gBAC1D,SAAS,GAAG,OAAO,CAAC;YACtB,CAAC;QACH,CAAC;QAED,wCAAwC;QACxC,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,KAAK,EAAE,WAAW,EAAE,SAAS,CAAC,CAAC;QACrE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,oCAAoC,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,CAAC,CAAC;YACpJ,OAAO,YAAY,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,GAAG,CAAC,CAAC;QACnF,CAAC;QAED,MAAM,UAAU,GAA4B;YAC1C,IAAI,EAAE,MAAM;YACZ,GAAG,EAAE,UAAU;YACf,EAAE,EAAE,OAAO,EAAE,EAAE,IAAI,MAAM;YACzB,IAAI,EAAE,SAAS;YACf,QAAQ,EAAE,OAAO;YACjB,GAAG,EAAE,CAAC;YACN,QAAQ,EAAE,KAAK;SAChB,CAAC;QACF,IAAI,OAAO,EAAE,QAAQ;YAAE,UAAU,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;QAC9D,MAAM,EAAE,YAAY,EAAE,GAAG,EAAE,YAAY,EAAE,GAAG,MAAM,kBAAkB,CAClE,UAAU,EACV,UAAU,EACV,EAAE,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,EAC9E,KAAK,CACN,CAAC;QAEF,IAAI,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,IAAI,GAAG,2CAA2C,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC;QACrH,MAAM,YAAY,GAAG,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;QAC3F,IAAI,YAAY,EAAE,QAAQ,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,YAAY,YAAY,EAAE,CAAC;QAEtE,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,EAAE,YAAY,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC,EAAE;YAClG,MAAM,EAAE,GAAG;YACX,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,YAAY,EAAE,MAAM;gBACpB,eAAe,EAAE,mBAAmB;aACrC;SACF,CAAC,CAAC;IACL,CAAC;CACF;AAED,SAAS,YAAY,CAAC,IAAa,EAAE,MAAM,GAAG,GAAG;IAC/C,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE;QACxC,MAAM;QACN,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,eAAe,EAAE,mBAAmB,EAAE;KACtF,CAAC,CAAC;AACL,CAAC;AAED,SAAS,qBAAqB,CAAC,IAAY,EAAE,SAAiB;IAC5D,OAAO;;;oJAG2I,IAAI;;gBAExI,SAAS;;eAEV,CAAC;AAChB,CAAC"}

package/dist/handlers/federation-admin-handler.d.ts

@@ -33,6 +33,8 @@ export declare class FederationAdminHandler {
     private logger;
     constructor(options: FederationAdminHandlerOptions);
     fetch(request: Request, caller: CallerIdentity): Promise<Response | null>;
+    private persistMissingAppCredentials;
+    private deleteManagedAppCredentials;
     /**
      * Record a federation setting change as a federation.update audit log on the
      * current instance. Secrets (delegation JWT, app SK/PSK) must NEVER appear in

package/dist/handlers/federation-admin-handler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"federation-admin-handler.d.ts","sourceRoot":"","sources":["../../src/handlers/federation-admin-handler.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAKH,OAAO,EAAiB,KAAK,MAAM,EAAE,MAAM,cAAc,CAAC;AAC1D,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAC;AACpD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAYlD,MAAM,WAAW,6BAA6B;IAC5C,KAAK,EAAE,OAAO,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,qDAAqD;IACrD,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAuCD,qBAAa,sBAAsB;IACjC,OAAO,CAAC,KAAK,CAAU;IACvB,OAAO,CAAC,KAAK,CAAS;IACtB,OAAO,CAAC,MAAM,CAAC,CAAS;IACxB,OAAO,CAAC,WAAW,CAAS;IAC5B,OAAO,CAAC,MAAM,CAAS;gBAEX,OAAO,EAAE,6BAA6B;IAQ5C,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,cAAc,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;IA0E/E;;;;OAIG;YACW,oBAAoB;YAepB,aAAa;IAK3B,6FAA6F;YAC/E,sBAAsB;IAWpC,mFAAmF;IACnF,OAAO,CAAC,cAAc;YAaR,mBAAmB;IAsCjC;;;;OAIG;YACW,oBAAoB;YAyCpB,SAAS;YAIT,MAAM;IA+DpB;;OAEG;YACW,IAAI;IAiElB,4EAA4E;YAC9D,WAAW;IAgEzB,6CAA6C;YAC/B,UAAU;IAiCxB,2CAA2C;YAC7B,YAAY;YAsCZ,UAAU;IA8CxB,yEAAyE;YAC3D,UAAU;YA4CV,oBAAoB;YAsCpB,OAAO;YAoDP,KAAK;CAkCpB"}
+{"version":3,"file":"federation-admin-handler.d.ts","sourceRoot":"","sources":["../../src/handlers/federation-admin-handler.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAOH,OAAO,EAAiB,KAAK,MAAM,EAAE,MAAM,cAAc,CAAC;AAC1D,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAC;AACpD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAclD,MAAM,WAAW,6BAA6B;IAC5C,KAAK,EAAE,OAAO,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,qDAAqD;IACrD,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAuCD,qBAAa,sBAAsB;IACjC,OAAO,CAAC,KAAK,CAAU;IACvB,OAAO,CAAC,KAAK,CAAS;IACtB,OAAO,CAAC,MAAM,CAAC,CAAS;IACxB,OAAO,CAAC,WAAW,CAAS;IAC5B,OAAO,CAAC,MAAM,CAAS;gBAEX,OAAO,EAAE,6BAA6B;IAQ5C,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,cAAc,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;YA2EjE,4BAA4B;YAoC5B,2BAA2B;IAoBzC;;;;OAIG;YACW,oBAAoB;YAepB,aAAa;IAK3B,6FAA6F;YAC/E,sBAAsB;IAWpC,mFAAmF;IACnF,OAAO,CAAC,cAAc;YAaR,mBAAmB;IAsCjC;;;;OAIG;YACW,oBAAoB;YAyCpB,SAAS;YAIT,MAAM;IA8DpB;;OAEG;YACW,IAAI;IAkElB,4EAA4E;YAC9D,WAAW;IAiEzB,6CAA6C;YAC/B,UAAU;IAkCxB,2CAA2C;YAC7B,YAAY;YAuCZ,UAAU;IA+CxB,yEAAyE;YAC3D,UAAU;YA6CV,oBAAoB;YAuCpB,OAAO;YAsDP,KAAK;CAoCpB"}

package/dist/handlers/federation-admin-handler.js

@@ -15,11 +15,14 @@
  *   POST   /leave               — leave federation (member)
  */
 import { signV2 } from "@arcblock/jwt";
-import { invalidateFedConfigCache } from "../blocklet-service.js";
+import { invalidateConfigCache, invalidateFedConfigCache } from "../blocklet-service.js";
+import { handlerError } from "../handler-errors.js";
 import { DELEGATION_EXPIRY_SECONDS, normalizeSecretKey, resolveWalletIdentity } from "../identity/wallet-identity.js";
+import { detectLocale } from "../locale.js";
 import { consoleLogger } from "../logger.js";
 const FEDERATION_DELEGATION_CLAIMS = ["authPrincipal", "profile", "signature", "asset", "verifiableCredential"];
 const PREFIX = "/.well-known/service/api/team/admin/federation";
+const MANAGED_APP_CREDENTIALS_KEY = "federation:managedAppCredentials";
 /** Extract origin from any URL-like string. Handles paths, trailing slashes, bare domains. */
 function normalizeOrigin(input) {
     let s = input.trim();
@@ -57,10 +60,11 @@ export class FederationAdminHandler {
             return null;
         const rest = url.pathname.slice(PREFIX.length) || "/";
         const method = request.method;
+        const locale = detectLocale(request);
         // All federation operations require admin+
         const isAdmin = caller.role === "owner" || caller.role === "admin";
         if (!isAdmin) {
-            return jsonResponse({ error: "Admin access required" }, 403);
+            return jsonResponse({ error: handlerError("adminAccessRequired", locale) }, 403);
         }
         // Snapshot ip once; private methods read caller.ip via FederationCaller.
         const fedCaller = {
@@ -73,45 +77,95 @@ export class FederationAdminHandler {
         }
         if (rest === "/enable" && method === "POST") {
             const body = await request.json();
-            return this.enable(body, fedCaller);
+            return this.enable(body, fedCaller, locale);
         }
         if (rest === "/join" && method === "POST") {
             const body = await request.json();
-            return this.join(body, request, fedCaller);
+            return this.join(body, request, fedCaller, locale);
         }
         if (rest === "/toggle" && method === "PUT") {
             const body = await request.json();
-            return this.toggleSelf(body, fedCaller);
+            return this.toggleSelf(body, fedCaller, locale);
         }
         // Site-specific routes: /sites/:did, /sites/:did/approve, /sites/:did/toggle
         const approveMatch = rest.match(/^\/sites\/([^/]+)\/approve$/);
         if (approveMatch && method === "POST") {
-            return this.approveSite(decodeURIComponent(approveMatch[1]), fedCaller);
+            return this.approveSite(decodeURIComponent(approveMatch[1]), fedCaller, locale);
         }
         const siteToggleMatch = rest.match(/^\/sites\/([^/]+)\/toggle$/);
         if (siteToggleMatch && method === "PUT") {
             const body = await request.json();
-            return this.toggleMember(decodeURIComponent(siteToggleMatch[1]), body, fedCaller);
+            return this.toggleMember(decodeURIComponent(siteToggleMatch[1]), body, fedCaller, locale);
         }
         const siteMatch = rest.match(/^\/sites\/([^/]+)$/);
         if (siteMatch && method === "PUT") {
             const body = (await request.json());
-            return this.updateSite(decodeURIComponent(siteMatch[1]), body, fedCaller);
+            return this.updateSite(decodeURIComponent(siteMatch[1]), body, fedCaller, locale);
         }
         if (siteMatch && method === "DELETE") {
-            return this.removeSite(decodeURIComponent(siteMatch[1]), fedCaller);
+            return this.removeSite(decodeURIComponent(siteMatch[1]), fedCaller, locale);
         }
         if (rest === "/delegation" && method === "POST") {
-            return this.regenerateDelegation(fedCaller);
+            return this.regenerateDelegation(fedCaller, locale);
         }
         if (rest === "/disband" && method === "POST") {
-            return this.disband(fedCaller);
+            return this.disband(fedCaller, locale);
         }
         if (rest === "/leave" && method === "POST") {
-            return this.leave(fedCaller);
+            return this.leave(fedCaller, locale);
         }
         return null;
     }
+    async persistMissingAppCredentials(callerDid) {
+        const [existingSk, existingPsk] = await Promise.all([
+            this.store.getSetting(this.instanceDid, "app:sk"),
+            this.store.getSetting(this.instanceDid, "app:psk"),
+        ]);
+        // The host PSK may only be paired with the HOST SK. Writing it next to a
+        // tenant's OWN app:sk would re-point that tenant's DID-Connect issuer at the
+        // host's permanent identity — the same DID drift this method exists to
+        // prevent, just in the opposite direction (every wallet user of that tenant
+        // would get a new DID on next login). Same predicate resolveConfig() uses
+        // before falling back to the deployment PSK.
+        const skIsHostKey = !existingSk || normalizeSecretKey(existingSk) === normalizeSecretKey(this.appSk);
+        const managedKeys = [];
+        if (!existingSk)
+            managedKeys.push("app:sk");
+        if (this.appPsk && !existingPsk && skIsHostKey)
+            managedKeys.push("app:psk");
+        if (managedKeys.length === 0)
+            return;
+        // Record ownership before the writes so a later disband can safely remove
+        // only credentials created by federation, never pre-existing tenant keys.
+        await this.store.setSetting(this.instanceDid, MANAGED_APP_CREDENTIALS_KEY, JSON.stringify(managedKeys), callerDid);
+        if (managedKeys.includes("app:sk")) {
+            await this.store.setSetting(this.instanceDid, "app:sk", normalizeSecretKey(this.appSk), callerDid);
+        }
+        if (managedKeys.includes("app:psk") && this.appPsk) {
+            await this.store.setSetting(this.instanceDid, "app:psk", normalizeSecretKey(this.appPsk), callerDid);
+        }
+        invalidateConfigCache(this.instanceDid);
+    }
+    async deleteManagedAppCredentials(instanceDid) {
+        const raw = await this.store.getSetting(instanceDid, MANAGED_APP_CREDENTIALS_KEY);
+        if (!raw)
+            return;
+        let managedKeys = [];
+        try {
+            const parsed = JSON.parse(raw);
+            if (Array.isArray(parsed)) {
+                managedKeys = parsed.filter((key) => key === "app:sk" || key === "app:psk");
+            }
+        }
+        catch {
+            // An invalid ownership marker must never authorize secret deletion.
+        }
+        for (const key of managedKeys) {
+            await this.store.deleteSetting(instanceDid, key);
+        }
+        await this.store.deleteSetting(instanceDid, MANAGED_APP_CREDENTIALS_KEY);
+        invalidateConfigCache(instanceDid);
+    }
     /**
      * Record a federation setting change as a federation.update audit log on the
      * current instance. Secrets (delegation JWT, app SK/PSK) must NEVER appear in
@@ -238,11 +292,11 @@ export class FederationAdminHandler {
     async getStatus() {
         return jsonResponse(await this.buildStatusResponse());
     }
-    async enable(body, caller) {
+    async enable(body, caller, locale) {
         // Check if already in a federation
         const existingRole = await this.store.getSetting(this.instanceDid, "federation:role");
         if (existingRole) {
-            return jsonResponse({ error: "Already in a federation. Leave or disband first." }, 409);
+            return jsonResponse({ error: handlerError("alreadyInFederationLeaveOrDisband", locale) }, 409);
         }
         const masterUrl = body.url ? normalizeOrigin(body.url) : "";
         const name = body.name ?? "";
@@ -250,11 +304,9 @@ export class FederationAdminHandler {
         await this.store.setSetting(this.instanceDid, "federation:role", "master", caller.did);
         await this.store.setSetting(this.instanceDid, "federation:enabled", "true", caller.did);
         await this.store.setSetting(this.instanceDid, "federation:groupId", this.instanceDid, caller.did);
-        // Persist Master's SK to D1 so member sites can read it for DID derivation.
-        const existingSk = await this.store.getSetting(this.instanceDid, "app:sk");
-        if (!existingSk) {
-            await this.store.setSetting(this.instanceDid, "app:sk", normalizeSecretKey(this.appSk), caller.did);
-        }
+        // Persist the host SK/PSK pair so enabling federation cannot change the
+        // wallet-facing identity. Ownership is tracked for safe cleanup later.
+        await this.persistMissingAppCredentials(caller.did);
         const groupScope = `federation:group:${this.instanceDid}`;
         // Generate federation delegation
         const identity = resolveWalletIdentity(this.appSk, this.appPsk);
@@ -286,24 +338,24 @@ export class FederationAdminHandler {
     /**
      * Sub-site initiates join request. Finds master by URL, writes pending entry.
      */
-    async join(body, request, caller) {
+    async join(body, request, caller, locale) {
         if (!body.masterUrl) {
-            return jsonResponse({ error: "masterUrl is required" }, 400);
+            return jsonResponse({ error: handlerError("masterUrlRequired", locale) }, 400);
         }
         // Check if already in a federation
         const existingRole = await this.store.getSetting(this.instanceDid, "federation:role");
         if (existingRole) {
-            return jsonResponse({ error: "Already in a federation. Leave first." }, 409);
+            return jsonResponse({ error: handlerError("alreadyInFederationLeaveFirst", locale) }, 409);
         }
         // Find the master group by URL (handles member-URL transparent redirect)
         const group = await this.findMasterGroupByUrl(body.masterUrl);
         if (!group) {
-            return jsonResponse({ error: "Target site has not enabled federation" }, 400);
+            return jsonResponse({ error: handlerError("targetNotEnabledFederation", locale) }, 400);
         }
         // Check this site isn't already in the group
         const existingSite = await this.store.getSetting(group.groupScope, `site:${this.instanceDid}`);
         if (existingSite) {
-            return jsonResponse({ error: "Already in this federation group" }, 409);
+            return jsonResponse({ error: handlerError("alreadyInThisGroup", locale) }, 409);
         }
         // Derive sub-site's URL from request origin and name from D1 branding
         const siteUrl = new URL(request.url).origin;
@@ -336,22 +388,22 @@ export class FederationAdminHandler {
         return jsonResponse(await this.buildStatusResponse());
     }
     /** Master approves a pending member. Generates delegation and activates. */
-    async approveSite(did, caller) {
+    async approveSite(did, caller, locale) {
         const role = await this.store.getSetting(this.instanceDid, "federation:role");
         if (role !== "master") {
-            return jsonResponse({ error: "Only master can approve sites" }, 403);
+            return jsonResponse({ error: handlerError("onlyMasterCanApprove", locale) }, 403);
         }
         const groupScope = await this.getGroupScope();
         if (!groupScope) {
-            return jsonResponse({ error: "Federation not configured" }, 400);
+            return jsonResponse({ error: handlerError("federationNotConfigured", locale) }, 400);
         }
         const siteRaw = await this.store.getSetting(groupScope, `site:${did}`);
         if (!siteRaw) {
-            return jsonResponse({ error: "Site not found" }, 404);
+            return jsonResponse({ error: handlerError("siteNotFound", locale) }, 404);
         }
         const site = JSON.parse(siteRaw);
         if (site.status !== "pending") {
-            return jsonResponse({ error: "Site is not in pending state" }, 400);
+            return jsonResponse({ error: handlerError("siteNotPending", locale) }, 400);
         }
         // Generate per-member delegation
         const masterSk = await this.store.getSetting(this.instanceDid, "app:sk");
@@ -390,10 +442,10 @@ export class FederationAdminHandler {
         return jsonResponse(await this.buildStatusResponse());
     }
     /** Member self-toggles federation on/off. */
-    async toggleSelf(body, caller) {
+    async toggleSelf(body, caller, locale) {
         const role = await this.store.getSetting(this.instanceDid, "federation:role");
         if (role !== "member") {
-            return jsonResponse({ error: "Toggle is only available for member sites" }, 400);
+            return jsonResponse({ error: handlerError("toggleOnlyForMembers", locale) }, 400);
         }
         const enabledStr = body.enabled ? "true" : "false";
         await this.store.setSetting(this.instanceDid, "federation:enabled", enabledStr, caller.did);
@@ -416,19 +468,19 @@ export class FederationAdminHandler {
         return jsonResponse(await this.buildStatusResponse());
     }
     /** Master toggles a member site on/off. */
-    async toggleMember(did, body, caller) {
+    async toggleMember(did, body, caller, locale) {
         const role = await this.store.getSetting(this.instanceDid, "federation:role");
         if (role !== "master") {
-            return jsonResponse({ error: "Only master can toggle member sites" }, 403);
+            return jsonResponse({ error: handlerError("onlyMasterCanToggle", locale) }, 403);
         }
         // Verify the site exists and is approved
         const groupScope = await this.getGroupScope();
         if (!groupScope) {
-            return jsonResponse({ error: "Federation not configured" }, 400);
+            return jsonResponse({ error: handlerError("federationNotConfigured", locale) }, 400);
         }
         const siteRaw = await this.store.getSetting(groupScope, `site:${did}`);
         if (!siteRaw) {
-            return jsonResponse({ error: "Site not found" }, 404);
+            return jsonResponse({ error: handlerError("siteNotFound", locale) }, 404);
         }
         const enabledStr = body.enabled ? "true" : "false";
         await this.store.setSetting(did, "federation:enabled", enabledStr, caller.did);
@@ -444,18 +496,18 @@ export class FederationAdminHandler {
         });
         return jsonResponse(await this.buildStatusResponse());
     }
-    async updateSite(did, body, caller) {
+    async updateSite(did, body, caller, locale) {
         const role = await this.store.getSetting(this.instanceDid, "federation:role");
         if (role !== "master") {
-            return jsonResponse({ error: "Only master can update sites" }, 403);
+            return jsonResponse({ error: handlerError("onlyMasterCanUpdate", locale) }, 403);
         }
         const groupScope = await this.getGroupScope();
         if (!groupScope) {
-            return jsonResponse({ error: "Federation not configured" }, 400);
+            return jsonResponse({ error: handlerError("federationNotConfigured", locale) }, 400);
         }
         const existing = await this.store.getSetting(groupScope, `site:${did}`);
         if (!existing) {
-            return jsonResponse({ error: "Site not found" }, 404);
+            return jsonResponse({ error: handlerError("siteNotFound", locale) }, 404);
         }
         const site = JSON.parse(existing);
         const changes = {};
@@ -479,17 +531,17 @@ export class FederationAdminHandler {
         return jsonResponse(await this.buildStatusResponse());
     }
     /** Remove a site (master rejects pending or removes approved member). */
-    async removeSite(did, caller) {
+    async removeSite(did, caller, locale) {
         const role = await this.store.getSetting(this.instanceDid, "federation:role");
         if (role !== "master") {
-            return jsonResponse({ error: "Only master can remove sites" }, 403);
+            return jsonResponse({ error: handlerError("onlyMasterCanRemove", locale) }, 403);
         }
         if (did === this.instanceDid) {
-            return jsonResponse({ error: "Cannot remove master site. Use disband instead." }, 400);
+            return jsonResponse({ error: handlerError("cannotRemoveMaster", locale) }, 400);
         }
         const groupScope = await this.getGroupScope();
         if (!groupScope) {
-            return jsonResponse({ error: "Federation not configured" }, 400);
+            return jsonResponse({ error: handlerError("federationNotConfigured", locale) }, 400);
         }
         // Purge tickets
         const siteValue = await this.store.getSetting(groupScope, `site:${did}`);
@@ -512,14 +564,14 @@ export class FederationAdminHandler {
         invalidateFedConfigCache(did);
         return jsonResponse(await this.buildStatusResponse());
     }
-    async regenerateDelegation(caller) {
+    async regenerateDelegation(caller, locale) {
         const role = await this.store.getSetting(this.instanceDid, "federation:role");
         if (role !== "master") {
-            return jsonResponse({ error: "Only master can regenerate delegation" }, 403);
+            return jsonResponse({ error: handlerError("onlyMasterCanRegenerate", locale) }, 403);
         }
         const groupScope = await this.getGroupScope();
         if (!groupScope) {
-            return jsonResponse({ error: "Federation not configured" }, 400);
+            return jsonResponse({ error: handlerError("federationNotConfigured", locale) }, 400);
         }
         const identity = resolveWalletIdentity(this.appSk, this.appPsk);
         const signerAddress = identity.permanentWallet.address;
@@ -542,19 +594,20 @@ export class FederationAdminHandler {
         });
         return jsonResponse(await this.buildStatusResponse());
     }
-    async disband(caller) {
+    async disband(caller, locale) {
         const role = await this.store.getSetting(this.instanceDid, "federation:role");
         if (role !== "master") {
-            return jsonResponse({ error: "Only master can disband federation" }, 403);
+            return jsonResponse({ error: handlerError("onlyMasterCanDisband", locale) }, 403);
         }
         const groupScope = await this.getGroupScope();
         if (!groupScope) {
-            return jsonResponse({ error: "Federation not configured" }, 400);
+            return jsonResponse({ error: handlerError("federationNotConfigured", locale) }, 400);
         }
         const siteRows = await this.store.listSettingsByPrefix(groupScope, "site:");
         // Clean up instance-level settings for all sites
         for (const row of siteRows) {
             const siteDid = row.key.slice("site:".length);
+            await this.deleteManagedAppCredentials(siteDid);
             await this.store.deleteSetting(siteDid, "federation:role");
             await this.store.deleteSetting(siteDid, "federation:enabled");
             await this.store.deleteSetting(siteDid, "federation:groupId");
@@ -587,10 +640,10 @@ export class FederationAdminHandler {
         });
         return jsonResponse(await this.buildStatusResponse());
     }
-    async leave(caller) {
+    async leave(caller, locale) {
         const role = await this.store.getSetting(this.instanceDid, "federation:role");
         if (role !== "member") {
-            return jsonResponse({ error: "Only members can leave federation" }, 400);
+            return jsonResponse({ error: handlerError("onlyMembersCanLeave", locale) }, 400);
         }
         const groupScope = await this.getGroupScope();
         if (groupScope) {
@@ -607,6 +660,7 @@ export class FederationAdminHandler {
         await this.store.deleteSetting(this.instanceDid, "federation:role");
         await this.store.deleteSetting(this.instanceDid, "federation:enabled");
         await this.store.deleteSetting(this.instanceDid, "federation:groupId");
+        await this.deleteManagedAppCredentials(this.instanceDid);
         await this.writeFederationAudit(caller, {
             "federation:role": null,
             "federation:enabled": null,