@astram/guard 0.1.1 → 0.3.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/auth/account.controller.d.ts +245 -0
- package/dist/auth/account.controller.d.ts.map +1 -0
- package/dist/auth/account.controller.js +673 -0
- package/dist/auth/account.controller.js.map +1 -0
- package/dist/auth/auth.controller.d.ts +316 -0
- package/dist/auth/auth.controller.d.ts.map +1 -0
- package/dist/auth/auth.controller.js +1091 -0
- package/dist/auth/auth.controller.js.map +1 -0
- package/dist/auth/auth.module.d.ts +202 -0
- package/dist/auth/auth.module.d.ts.map +1 -0
- package/dist/auth/auth.module.js +610 -0
- package/dist/auth/auth.module.js.map +1 -0
- package/dist/auth/connections.d.ts +61 -0
- package/dist/auth/connections.d.ts.map +1 -0
- package/dist/auth/connections.js +116 -0
- package/dist/auth/connections.js.map +1 -0
- package/dist/auth/dto.d.ts +154 -0
- package/dist/auth/dto.d.ts.map +1 -0
- package/dist/auth/dto.js +29 -0
- package/dist/auth/dto.js.map +1 -0
- package/dist/auth/pending-mfa-store.d.ts +72 -0
- package/dist/auth/pending-mfa-store.d.ts.map +1 -0
- package/dist/auth/pending-mfa-store.js +106 -0
- package/dist/auth/pending-mfa-store.js.map +1 -0
- package/dist/auth/persistence.module.d.ts +42 -0
- package/dist/auth/persistence.module.d.ts.map +1 -0
- package/dist/auth/persistence.module.js +94 -0
- package/dist/auth/persistence.module.js.map +1 -0
- package/dist/auth/ports/audit-sink.d.ts +47 -0
- package/dist/auth/ports/audit-sink.d.ts.map +1 -0
- package/dist/auth/ports/audit-sink.js +20 -0
- package/dist/auth/ports/audit-sink.js.map +1 -0
- package/dist/auth/ports/credential-writer.d.ts +23 -0
- package/dist/auth/ports/credential-writer.d.ts.map +1 -0
- package/dist/auth/ports/credential-writer.js +2 -0
- package/dist/auth/ports/credential-writer.js.map +1 -0
- package/dist/auth/ports/email-sender.d.ts +14 -0
- package/dist/auth/ports/email-sender.d.ts.map +1 -0
- package/dist/auth/ports/email-sender.js +2 -0
- package/dist/auth/ports/email-sender.js.map +1 -0
- package/dist/auth/ports/mfa-device-store.d.ts +45 -0
- package/dist/auth/ports/mfa-device-store.d.ts.map +1 -0
- package/dist/auth/ports/mfa-device-store.js +13 -0
- package/dist/auth/ports/mfa-device-store.js.map +1 -0
- package/dist/auth/ports/profile-writer.d.ts +12 -0
- package/dist/auth/ports/profile-writer.d.ts.map +1 -0
- package/dist/auth/ports/profile-writer.js +2 -0
- package/dist/auth/ports/profile-writer.js.map +1 -0
- package/dist/auth/ports/recovery-code-store.d.ts +10 -0
- package/dist/auth/ports/recovery-code-store.d.ts.map +1 -0
- package/dist/auth/ports/recovery-code-store.js +2 -0
- package/dist/auth/ports/recovery-code-store.js.map +1 -0
- package/dist/auth/ports/reset-token-store.d.ts +12 -0
- package/dist/auth/ports/reset-token-store.d.ts.map +1 -0
- package/dist/auth/ports/reset-token-store.js +2 -0
- package/dist/auth/ports/reset-token-store.js.map +1 -0
- package/dist/auth/ports/session-facts-projector.d.ts +44 -0
- package/dist/auth/ports/session-facts-projector.d.ts.map +1 -0
- package/dist/auth/ports/session-facts-projector.js +30 -0
- package/dist/auth/ports/session-facts-projector.js.map +1 -0
- package/dist/auth/ports/session-sweeper.d.ts +12 -0
- package/dist/auth/ports/session-sweeper.d.ts.map +1 -0
- package/dist/auth/ports/session-sweeper.js +2 -0
- package/dist/auth/ports/session-sweeper.js.map +1 -0
- package/dist/auth/profile-resolver.d.ts +73 -0
- package/dist/auth/profile-resolver.d.ts.map +1 -0
- package/dist/auth/profile-resolver.js +28 -0
- package/dist/auth/profile-resolver.js.map +1 -0
- package/dist/auth/rate-limit/attempt-limiter.d.ts +91 -0
- package/dist/auth/rate-limit/attempt-limiter.d.ts.map +1 -0
- package/dist/auth/rate-limit/attempt-limiter.js +133 -0
- package/dist/auth/rate-limit/attempt-limiter.js.map +1 -0
- package/dist/auth/tokens.d.ts +236 -0
- package/dist/auth/tokens.d.ts.map +1 -0
- package/dist/auth/tokens.js +254 -0
- package/dist/auth/tokens.js.map +1 -0
- package/dist/auth/totp-enrollment.d.ts +42 -0
- package/dist/auth/totp-enrollment.d.ts.map +1 -0
- package/dist/auth/totp-enrollment.js +96 -0
- package/dist/auth/totp-enrollment.js.map +1 -0
- package/dist/authentication/argon2id-password-hasher.js.map +1 -0
- package/dist/authentication/mariadb-credential-resolver.d.ts +110 -0
- package/dist/authentication/mariadb-credential-resolver.d.ts.map +1 -0
- package/dist/authentication/mariadb-credential-resolver.js +170 -0
- package/dist/authentication/mariadb-credential-resolver.js.map +1 -0
- package/dist/authz/cross-tenant-grant-writer.d.ts +259 -0
- package/dist/authz/cross-tenant-grant-writer.d.ts.map +1 -0
- package/dist/authz/cross-tenant-grant-writer.js +397 -0
- package/dist/authz/cross-tenant-grant-writer.js.map +1 -0
- package/dist/authz/manifest-operation-authority-adapter.d.ts +65 -0
- package/dist/authz/manifest-operation-authority-adapter.d.ts.map +1 -0
- package/dist/authz/manifest-operation-authority-adapter.js +108 -0
- package/dist/authz/manifest-operation-authority-adapter.js.map +1 -0
- package/dist/authz/mariadb-cross-tenant-grant-adapter.d.ts +90 -0
- package/dist/authz/mariadb-cross-tenant-grant-adapter.d.ts.map +1 -0
- package/dist/authz/mariadb-cross-tenant-grant-adapter.js +211 -0
- package/dist/authz/mariadb-cross-tenant-grant-adapter.js.map +1 -0
- package/dist/authz/mariadb-record-rule-adapter.d.ts +60 -0
- package/dist/authz/mariadb-record-rule-adapter.d.ts.map +1 -0
- package/dist/authz/mariadb-record-rule-adapter.js +154 -0
- package/dist/authz/mariadb-record-rule-adapter.js.map +1 -0
- package/dist/authz/mariadb-record-share-adapter.d.ts +75 -0
- package/dist/authz/mariadb-record-share-adapter.d.ts.map +1 -0
- package/dist/authz/mariadb-record-share-adapter.js +106 -0
- package/dist/authz/mariadb-record-share-adapter.js.map +1 -0
- package/dist/authz/record-share-cascade.d.ts +52 -0
- package/dist/authz/record-share-cascade.d.ts.map +1 -0
- package/dist/authz/record-share-cascade.js +49 -0
- package/dist/authz/record-share-cascade.js.map +1 -0
- package/dist/authz/record-share-writer.d.ts +175 -0
- package/dist/authz/record-share-writer.d.ts.map +1 -0
- package/dist/authz/record-share-writer.js +225 -0
- package/dist/authz/record-share-writer.js.map +1 -0
- package/dist/authz/wire-record-authorization.d.ts +66 -0
- package/dist/authz/wire-record-authorization.d.ts.map +1 -0
- package/dist/authz/wire-record-authorization.js +34 -0
- package/dist/authz/wire-record-authorization.js.map +1 -0
- package/dist/boot/boot-sequence.js.map +1 -0
- package/dist/boot/boot.module.js.map +1 -0
- package/dist/completeness/catalog-reconciler.d.ts +21 -0
- package/dist/completeness/catalog-reconciler.d.ts.map +1 -0
- package/dist/completeness/catalog-reconciler.js +74 -0
- package/dist/completeness/catalog-reconciler.js.map +1 -0
- package/dist/completeness/operation-inventory-scanner.d.ts +17 -0
- package/dist/completeness/operation-inventory-scanner.d.ts.map +1 -0
- package/dist/completeness/operation-inventory-scanner.js +79 -0
- package/dist/completeness/operation-inventory-scanner.js.map +1 -0
- package/dist/completeness/ports/catalog-store.d.ts +33 -0
- package/dist/completeness/ports/catalog-store.d.ts.map +1 -0
- package/dist/completeness/ports/catalog-store.js +2 -0
- package/dist/completeness/ports/catalog-store.js.map +1 -0
- package/dist/config/app-config.d.ts +134 -1
- package/dist/config/app-config.d.ts.map +1 -1
- package/dist/config/app-config.js +144 -2
- package/dist/config/app-config.js.map +1 -0
- package/dist/config/config.module.js.map +1 -0
- package/dist/enforcement/classification.decorator.d.ts +33 -14
- package/dist/enforcement/classification.decorator.d.ts.map +1 -1
- package/dist/enforcement/classification.decorator.js +34 -14
- package/dist/enforcement/classification.decorator.js.map +1 -0
- package/dist/enforcement/core-seam.js.map +1 -0
- package/dist/enforcement/enforcement.module.js.map +1 -0
- package/dist/enforcement/global-enforcement.guard.d.ts +29 -19
- package/dist/enforcement/global-enforcement.guard.d.ts.map +1 -1
- package/dist/enforcement/global-enforcement.guard.js +108 -25
- package/dist/enforcement/global-enforcement.guard.js.map +1 -0
- package/dist/enforcement/reenroll-allowlist.d.ts +49 -0
- package/dist/enforcement/reenroll-allowlist.d.ts.map +1 -0
- package/dist/enforcement/reenroll-allowlist.js +77 -0
- package/dist/enforcement/reenroll-allowlist.js.map +1 -0
- package/dist/index.d.ts +43 -3
- package/dist/index.d.ts.map +1 -1
- package/dist/index.js +198 -1
- package/dist/index.js.map +1 -0
- package/dist/module/shield-tokens.d.ts +15 -0
- package/dist/module/shield-tokens.d.ts.map +1 -0
- package/dist/module/shield-tokens.js +17 -0
- package/dist/module/shield-tokens.js.map +1 -0
- package/dist/module/shield.module.d.ts +203 -8
- package/dist/module/shield.module.d.ts.map +1 -1
- package/dist/module/shield.module.js +232 -14
- package/dist/module/shield.module.js.map +1 -0
- package/dist/request-auth/request-principal.d.ts +42 -0
- package/dist/request-auth/request-principal.d.ts.map +1 -0
- package/dist/request-auth/request-principal.js +87 -0
- package/dist/request-auth/request-principal.js.map +1 -0
- package/dist/request-auth/session-facts-als.d.ts +65 -0
- package/dist/request-auth/session-facts-als.d.ts.map +1 -0
- package/dist/request-auth/session-facts-als.js +57 -0
- package/dist/request-auth/session-facts-als.js.map +1 -0
- package/dist/request-auth/session-token-binder.d.ts +130 -0
- package/dist/request-auth/session-token-binder.d.ts.map +1 -0
- package/dist/request-auth/session-token-binder.js +277 -0
- package/dist/request-auth/session-token-binder.js.map +1 -0
- package/dist/request-auth/tokens.d.ts +14 -0
- package/dist/request-auth/tokens.d.ts.map +1 -0
- package/dist/request-auth/tokens.js +16 -0
- package/dist/request-auth/tokens.js.map +1 -0
- package/dist/session/crypto-adapters.js.map +1 -0
- package/dist/session/index.js.map +1 -0
- package/dist/session/mariadb-session-record-store.js.map +1 -0
- package/dist/session/redis-hot-session-store.js.map +1 -0
- package/package.json +2 -2
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"auth.controller.js","sourceRoot":"","sources":["../../src/auth/auth.controller.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkDG;;;;;;;;;;;;;;;AAEH,2CAWwB;AACxB,6CAAsD;AAYtD,2CAA0C;AAC1C,4FAAoE;AACpE,2CAkBqB;AAGrB,iEAAyD;AACzD,yDAAwE;AAExE,+EAA+E;AAC/E,2CAAsD;AAmBtD;;;;;GAKG;AACH,MAAM,uBAAuB,GAAG,4BAA4B,CAAC;AAE7D;;;;;GAKG;AACH,MAAM,oBAAoB,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,qBAA8B,EAAE,CAAC,CAAC;AAEtF,+EAA+E;AAC/E,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,4BAAqC,EAAE,CAAC,CAAC;AAEvF,iEAAiE;AACjE,MAAM,YAAY,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAEpC,iFAAiF;AACjF,MAAM,gBAAgB,GAAG,CAAC,CAAC;AAE3B;;;GAGG;AACH,SAAS,MAAM,CAAC,KAAa;IAC3B,OAAO,IAAA,wBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC1D,CAAC;AAED,qFAAqF;AACrF,SAAS,mBAAmB;IAC1B,MAAM,IAAI,sBAAa,CAAC,oBAAoB,EAAE,mBAAU,CAAC,YAAY,CAAC,CAAC;AACzE,CAAC;AAED,8EAA8E;AAC9E,SAAS,oBAAoB;IAC3B,MAAM,IAAI,sBAAa,CAAC,cAAc,EAAE,mBAAU,CAAC,mBAAmB,CAAC,CAAC;AAC1E,CAAC;AAED;;;;;GAKG;AACH,SAAS,eAAe;IACtB,MAAM,IAAI,sBAAa,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,EAAE,mBAAU,CAAC,iBAAiB,CAAC,CAAC;AACxF,CAAC;AAED;;;;;GAKG;AACH,SAAS,aAAa,CAAC,OAAgB;IACrC,OAAO;QACL,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,WAAW,EAAE,OAAO,CAAC,WAAW;KACjC,CAAC;AACJ,CAAC;AAED,mFAAmF;AACnF,SAAS,gBAAgB,CAAC,GAAyB;IACjD,OAAO;QACL,OAAO,EAAE,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC;QACnC,MAAM,EAAE;YACN,WAAW,EAAE,GAAG,CAAC,MAAM,CAAC,WAAW;YACnC,YAAY,EAAE,GAAG,CAAC,MAAM,CAAC,YAAY;SACtC;KACF,CAAC;AACJ,CAAC;AAED,+DAA+D;AAC/D,SAAS,kBAAkB,CAAC,QAAgB;IAC1C,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,EAAE,CAAC;AACvD,CAAC;AAED,4FAA4F;AAC5F,SAAS,cAAc,CAAC,IAAY;IAClC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC;AAC/C,CAAC;AAED;;;;;GAKG;AAEI,IAAM,cAAc,GAApB,MAAM,cAAc;IAGN;IAEA;IACA;IAOA;IAOA;IAOA;IAIA;IAIA;IAIA;IAIA;IAIA;IAKA;IAOA;IASA;IAIA;IAQA;IAKA;IAKA;IAOA;IASA;IAzGnB,YAEmB,aAA4B,EAE5B,gBAAkC,EAClC,UAA2B,EAO3B,WAAgC,EAOhC,eAAiC,EAOjC,kBAA8C,EAI9C,eAAwC,EAIxC,WAAgC,EAIhC,gBAA0C,EAI1C,cAAsC,EAItC,cAA+B,EAK/B,gBAAyB,EAOzB,aAAwC,EASxC,YAAoC,EAIpC,eAAuC,EAQvC,aAAqC,EAKrC,iBAAyC,EAKzC,YAAoC,EAOpC,SAA4B,EAS5B,qBAAoD;QAvGpD,kBAAa,GAAb,aAAa,CAAe;QAE5B,qBAAgB,GAAhB,gBAAgB,CAAkB;QAClC,eAAU,GAAV,UAAU,CAAiB;QAO3B,gBAAW,GAAX,WAAW,CAAqB;QAOhC,oBAAe,GAAf,eAAe,CAAkB;QAOjC,uBAAkB,GAAlB,kBAAkB,CAA4B;QAI9C,oBAAe,GAAf,eAAe,CAAyB;QAIxC,gBAAW,GAAX,WAAW,CAAqB;QAIhC,qBAAgB,GAAhB,gBAAgB,CAA0B;QAI1C,mBAAc,GAAd,cAAc,CAAwB;QAItC,mBAAc,GAAd,cAAc,CAAiB;QAK/B,qBAAgB,GAAhB,gBAAgB,CAAS;QAOzB,kBAAa,GAAb,aAAa,CAA2B;QASxC,iBAAY,GAAZ,YAAY,CAAwB;QAIpC,oBAAe,GAAf,eAAe,CAAwB;QAQvC,kBAAa,GAAb,aAAa,CAAwB;QAKrC,sBAAiB,GAAjB,iBAAiB,CAAwB;QAKzC,iBAAY,GAAZ,YAAY,CAAwB;QAOpC,cAAS,GAAT,SAAS,CAAmB;QAS5B,0BAAqB,GAArB,qBAAqB,CAA+B;IACpE,CAAC;IAEJ;;;;;OAKG;IACK,KAAK,CAAC,WAAW,CACvB,GAAyB,EACzB,SAAoB,EACpB,YAAY,GAAG,KAAK;QAEpB,IAAI,IAAI,CAAC,WAAW,KAAK,SAAS;YAAE,OAAO;QAC3C,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,WAAW,GAAG,GAAG,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;QAC5E,mFAAmF;QACnF,uFAAuF;QACvF,+EAA+E;QAC/E,oFAAoF;QACpF,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC;QACvD,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,CACzB,GAAG,CAAC,MAAM,CAAC,WAAW,EACtB;gBACE,EAAE,EAAE,SAAS,CAAC,EAAE;gBAChB,QAAQ,EAAE,SAAS,CAAC,QAAQ;gBAC5B,OAAO,EAAE,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC;gBAC/B,IAAI,EAAE,SAAS,CAAC,IAAI;gBACpB,MAAM,EAAE,SAAS,CAAC,MAAM,KAAK,IAAI;gBACjC,SAAS,EAAE,GAAG,CAAC,OAAO,CAAC,SAAS;gBAChC,0EAA0E;gBAC1E,6DAA6D;gBAC7D,YAAY;gBACZ,gEAAgE;gBAChE,8EAA8E;gBAC9E,wEAAwE;gBACxE,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACxC,EACD,KAAK,CACN,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,+EAA+E;YAC/E,qEAAqE;QACvE,CAAC;IACH,CAAC;IAED;;;;;;;OAOG;IACK,KAAK,CAAC,YAAY,CAAC,SAAoB;QAC7C,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,SAAS,CAAC,EAAE,EAAE,SAAS,CAAC,QAAQ,CAAC,CAAC;QAC3E,+EAA+E;QAC/E,gFAAgF;QAChF,mCAAmC;QACnC,OAAO,KAAK,IAAI,SAAS,CAAC;IAC5B,CAAC;IAED;;;;;;;;;;OAUG;IACK,KAAK,CAAC,eAAe,CAC3B,WAAmB,EACnB,QAAgB;QAEhB,MAAM,SAAS,GAAG,IAAI,CAAC,qBAAqB,CAAC;QAC7C,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,KAAK,IAAI;YAAE,OAAO,SAAS,CAAC;QACpE,IAAI,CAAC;YACH,OAAO,MAAM,SAAS,CAAC,OAAO,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;QACxD,CAAC;QAAC,MAAM,CAAC;YACP,+EAA+E;YAC/E,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;;;;;;;;OAUG;IACK,mBAAmB,CAAC,MAA+B;QACzD,MAAM,EAAE,GAAG,OAAO,MAAM,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1D,MAAM,QAAQ,GAAG,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5E,IAAI,CAAC,EAAE,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC;QAClC,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC;YAC3C,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;YAClE,CAAC,CAAC,EAAE,CAAC;QACP,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IAChE,CAAC;IAED;;;;OAIG;IAIG,AAAN,KAAK,CAAC,KAAK,CAAS,IAAkB;QACpC,MAAM,YAAY,GAAG,OAAO,IAAI,EAAE,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,CAAC;QACrF,MAAM,QAAQ,GAAG,OAAO,IAAI,EAAE,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;QAEzE,6EAA6E;QAC7E,+EAA+E;QAC/E,gFAAgF;QAChF,iFAAiF;QACjF,qEAAqE;QACrE,MAAM,QAAQ,GAAG,SAAS,YAAY,EAAE,CAAC;QACzC,IAAI,IAAI,CAAC,YAAY,IAAI,IAAI,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;YAC5E,iFAAiF;YACjF,gFAAgF;YAChF,0EAA0E;YAC1E,mFAAmF;YACnF,gDAAgD;YAChD,mBAAmB,EAAE,CAAC;QACxB,CAAC;QAED,MAAM,MAAM,GAAyB,MAAM,IAAI,CAAC,aAAa,CAAC,YAAY,CACxE,YAAY,EACZ,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC,CAC/B,CAAC;QAEF,IAAI,MAAM,CAAC,OAAO,KAAK,eAAe,EAAE,CAAC;YACvC,8EAA8E;YAC9E,MAAM,IAAI,CAAC,YAAY,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;YACzC,MAAM,SAAS,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;YAC3C,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC;YACpD,MAAM,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;YACvC,OAAO,gBAAgB,CAAC,GAAG,CAAC,CAAC;QAC/B,CAAC;QAED,IAAI,MAAM,CAAC,OAAO,KAAK,cAAc,EAAE,CAAC;YACtC,+EAA+E;YAC/E,8EAA8E;YAC9E,gFAAgF;YAChF,6EAA6E;YAC7E,yCAAyC;YACzC,MAAM,IAAI,CAAC,YAAY,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;YACzC,MAAM,cAAc,GAAG,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;YACrE,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC;QAC/C,CAAC;QAED,0EAA0E;QAC1E,+EAA+E;QAC/E,2BAA2B;QAC3B,IAAI,MAAM,CAAC,MAAM,KAAK,uBAAuB,EAAE,CAAC;YAC9C,8EAA8E;YAC9E,oEAAoE;YACpE,oBAAoB,EAAE,CAAC;QACzB,CAAC;QACD,oFAAoF;QACpF,mFAAmF;QACnF,oFAAoF;QACpF,gFAAgF;QAChF,qFAAqF;QACrF,+EAA+E;QAC/E,kFAAkF;QAClF,IAAI,IAAI,CAAC,YAAY,IAAI,IAAI,EAAE,CAAC;YAC9B,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;YAC9D,IAAI,KAAK,KAAK,IAAI,CAAC,YAAY,CAAC,WAAW,EAAE,CAAC;gBAC5C,IAAI,CAAC,mBAAmB,CAAC;oBACvB,MAAM,EAAE,mBAAmB;oBAC3B,YAAY;oBACZ,UAAU,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE;oBACpC,MAAM,EAAE,KAAK;iBACd,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QACD,mBAAmB,EAAE,CAAC;IACxB,CAAC;IAED;;;;;;;;;;;;;;;;;;OAkBG;IAIG,AAAN,KAAK,CAAC,EAAE,CAA2B,aAAsB;QACvD,8EAA8E;QAC9E,kFAAkF;QAClF,iFAAiF;QACjF,IAAI,IAAI,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;YACnC,yEAAyE;YACzE,MAAM,IAAI,sBAAa,CACrB,EAAE,KAAK,EAAE,cAAc,EAAE,EACzB,mBAAU,CAAC,YAAY,CACxB,CAAC;QACJ,CAAC;QACD,MAAM,SAAS,GAAG,MAAM,IAAA,8CAAuB,EAAC,aAAa,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;QACjF,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;YACvB,MAAM,IAAI,sBAAa,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,mBAAU,CAAC,YAAY,CAAC,CAAC;QAC9E,CAAC;QAED,8EAA8E;QAC9E,iFAAiF;QACjF,IAAI,IAAI,CAAC,eAAe,KAAK,SAAS,IAAI,IAAI,CAAC,eAAe,KAAK,IAAI,EAAE,CAAC;YACxE,MAAM,IAAI,sBAAa,CACrB,EAAE,KAAK,EAAE,qBAAqB,EAAE,EAChC,mBAAU,CAAC,eAAe,CAC3B,CAAC;QACJ,CAAC;QAED,IAAI,OAAkC,CAAC;QACvC,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAC1D,CAAC;QAAC,MAAM,CAAC;YACP,8EAA8E;YAC9E,+DAA+D;YAC/D,MAAM,IAAI,sBAAa,CACrB,EAAE,KAAK,EAAE,qBAAqB,EAAE,EAChC,mBAAU,CAAC,qBAAqB,CACjC,CAAC;QACJ,CAAC;QACD,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YACrB,+EAA+E;YAC/E,0DAA0D;YAC1D,MAAM,IAAI,sBAAa,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,EAAE,mBAAU,CAAC,SAAS,CAAC,CAAC;QAChF,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;;;;;;;;;;;;;;;;;;OAmBG;IAIG,AAAN,KAAK,CAAC,cAAc,CACV,IAA+B,EAIjC,EAAU;QAEhB,MAAM,IAAI,GAAG,OAAO,IAAI,EAAE,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7E,MAAM,QAAQ,GAAG,IAAI,CAAC,kBAAkB,CAAC;QACzC,MAAM,KAAK,GAAG,IAAI,CAAC,eAAe,CAAC;QACnC,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC;QAEhC,oFAAoF;QACpF,mFAAmF;QACnF,+EAA+E;QAC/E,kFAAkF;QAClF,iFAAiF;QACjF,oFAAoF;QACpF,qFAAqF;QACrF,mFAAmF;QACnF,+EAA+E;QAC/E,sFAAsF;QACtF,iFAAiF;QACjF,MAAM,KAAK,GAAG,aAAa,EAAE,IAAI,YAAY,EAAE,CAAC;QAChD,MAAM,OAAO,GAAG,UAAU,IAAI,EAAE,CAAC;QAEjC,kFAAkF;QAClF,mFAAmF;QACnF,MAAM,SAAS,GAAG,IAAI,CAAC,aAAa,IAAI,IAAI,IAAI,CAAC,MAAM,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;QACxF,qFAAqF;QACrF,qFAAqF;QACrF,MAAM,WAAW,GACf,IAAI,CAAC,iBAAiB,IAAI,IAAI,IAAI,IAAI,KAAK,EAAE,IAAI,CAAC,MAAM,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QAEjG,qFAAqF;QACrF,kFAAkF;QAClF,sFAAsF;QACtF,mFAAmF;QACnF,2EAA2E;QAC3E,oFAAoF;QACpF,iFAAiF;QACjF,6EAA6E;QAC7E,oFAAoF;QACpF,gFAAgF;QAChF,sFAAsF;QACtF,oFAAoF;QACpF,qFAAqF;QACrF,mFAAmF;QACnF,oFAAoF;QACpF,8EAA8E;QAC9E,KAAK,IAAI,CAAC,aAAa;YACrB,EAAE,aAAa,CAAC,KAAK,CAAC;aACrB,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE;YACd,IAAI,IAAI,CAAC,aAAa,IAAI,IAAI,IAAI,KAAK,KAAK,IAAI,CAAC,aAAa,CAAC,WAAW,EAAE,CAAC;gBAC3E,IAAI,CAAC,mBAAmB,CAAC;oBACvB,MAAM,EAAE,gCAAgC;oBACxC,YAAY,EAAE,IAAI,IAAI,IAAI;oBAC1B,UAAU,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE;oBACpC,MAAM,EAAE,KAAK;iBACd,CAAC,CAAC;YACL,CAAC;QACH,CAAC,CAAC;aACD,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACnB,mFAAmF;QACnF,oFAAoF;QACpF,mFAAmF;QACnF,mFAAmF;QACnF,gFAAgF;QAChF,6EAA6E;QAC7E,iFAAiF;QACjF,6BAA6B;QAC7B,IAAI,IAAI,KAAK,EAAE,EAAE,CAAC;YAChB,KAAK,IAAI,CAAC,iBAAiB;gBACzB,EAAE,aAAa,CAAC,OAAO,CAAC;iBACvB,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE;gBACd,IAAI,IAAI,CAAC,iBAAiB,IAAI,IAAI,IAAI,KAAK,KAAK,IAAI,CAAC,iBAAiB,CAAC,WAAW,EAAE,CAAC;oBACnF,IAAI,CAAC,mBAAmB,CAAC;wBACvB,MAAM,EAAE,qCAAqC;wBAC7C,YAAY,EAAE,IAAI;wBAClB,UAAU,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE;wBACpC,MAAM,EAAE,KAAK;qBACd,CAAC,CAAC;gBACL,CAAC;YACH,CAAC,CAAC;iBACD,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACrB,CAAC;QAED,4EAA4E;QAC5E,+EAA+E;QAC/E,iFAAiF;QACjF,IAAI,SAAS,IAAI,WAAW,IAAI,IAAI,IAAI,QAAQ,IAAI,KAAK,IAAI,MAAM,EAAE,CAAC;YACpE,uEAAuE;YACvE,wEAAwE;YACxE,+DAA+D;YAC/D,KAAK,IAAI,CAAC,gBAAgB,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE;gBACnE,+EAA+E;YACjF,CAAC,CAAC,CAAC;QACL,CAAC;QACD,sFAAsF;IACxF,CAAC;IAED;;;;;;OAMG;IACK,KAAK,CAAC,gBAAgB,CAC5B,IAAY,EACZ,QAA4B,EAC5B,KAAsB,EACtB,MAAmB;QAEnB,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC9C,IAAI,QAAQ,KAAK,IAAI;YAAE,OAAO,CAAC,gDAAgD;QAE/E,MAAM,MAAM,GAAG,QAAQ,CAAC,MAA8C,CAAC;QACvE,MAAM,WAAW,GAAG,OAAO,MAAM,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnE,IAAI,CAAC,WAAW;YAAE,OAAO;QACzB,MAAM,QAAQ,GAAG,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;QAE5E,+DAA+D;QAC/D,MAAM,QAAQ,GAAG,IAAA,yBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACjD,MAAM,KAAK,CAAC,KAAK,CAAC,WAAW,EAAE,MAAM,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,YAAY,CAAC,CAAC;QAE5E,kFAAkF;QAClF,oFAAoF;QACpF,IAAI,IAAI,CAAC,eAAe,KAAK,SAAS,IAAI,IAAI,CAAC,eAAe,KAAK,IAAI;YAAE,OAAO;QAChF,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC;YACjD,EAAE,EAAE,WAAW;YACf,QAAQ;YACR,OAAO,EAAE,EAAE;YACX,IAAI,EAAE,MAAM;YACZ,MAAM,EAAE,KAAK;SACd,CAAC,CAAC;QACH,IAAI,CAAC,OAAO,EAAE,KAAK;YAAE,OAAO;QAE5B,oEAAoE;QACpE,MAAM,IAAI,GAAG,IAAI,CAAC,gBAAgB,IAAI,sCAAsC,CAAC;QAC7E,MAAM,IAAI,GAAG,GAAG,IAAI,UAAU,QAAQ,EAAE,CAAC;QACzC,MAAM,MAAM,CAAC,IAAI,CAAC;YAChB,EAAE,EAAE,OAAO,CAAC,KAAK;YACjB,OAAO,EAAE,qBAAqB;YAC9B,IAAI,EAAE,wBAAwB,IAAI,EAAE;YACpC,IAAI,EAAE,oCAAoC,IAAI,KAAK,IAAI,UAAU;SAClE,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;;;;OAYG;IAIG,AAAN,KAAK,CAAC,aAAa,CACT,IAA8C,EAEhD,EAAU;QAEhB,MAAM,KAAK,GAAG,OAAO,IAAI,EAAE,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QAChE,MAAM,WAAW,GAAG,OAAO,IAAI,EAAE,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC;QAElF,mFAAmF;QACnF,oFAAoF;QACpF,oFAAoF;QACpF,qFAAqF;QACrF,mFAAmF;QACnF,iFAAiF;QACjF,kFAAkF;QAClF,qFAAqF;QACrF,MAAM,QAAQ,GAAG,YAAY,EAAE,IAAI,YAAY,EAAE,CAAC;QAClD,IAAI,IAAI,CAAC,YAAY,IAAI,IAAI,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;YAC5E,+EAA+E;YAC/E,iFAAiF;YACjF,kFAAkF;YAClF,kFAAkF;YAClF,eAAe,EAAE,CAAC;QACpB,CAAC;QAED,IAAI,WAAW,CAAC,MAAM,GAAG,gBAAgB,EAAE,CAAC;YAC1C,MAAM,IAAI,sBAAa,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,EAAE,mBAAU,CAAC,oBAAoB,CAAC,CAAC;QACvF,CAAC;QACD,2EAA2E;QAC3E,MAAM,KAAK,GAAG,IAAI,CAAC,eAAe,CAAC;QACnC,MAAM,MAAM,GAAG,IAAI,CAAC,gBAAgB,CAAC;QACrC,MAAM,MAAM,GAAG,IAAI,CAAC,cAAc,CAAC;QACnC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YAC7G,MAAM,IAAI,sBAAa,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,EAAE,mBAAU,CAAC,eAAe,CAAC,CAAC;QAClF,CAAC;QAED,+EAA+E;QAC/E,MAAM,WAAW,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QACvD,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;YACzB,iFAAiF;YACjF,mFAAmF;YACnF,mFAAmF;YACnF,qFAAqF;YACrF,mFAAmF;YACnF,qFAAqF;YACrF,4EAA4E;YAC5E,mFAAmF;YACnF,IAAI,IAAI,CAAC,YAAY,IAAI,IAAI,EAAE,CAAC;gBAC9B,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;gBAC9D,IAAI,KAAK,KAAK,IAAI,CAAC,YAAY,CAAC,WAAW,EAAE,CAAC;oBAC5C,IAAI,CAAC,mBAAmB,CAAC;wBACvB,MAAM,EAAE,4BAA4B;wBACpC,UAAU,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE;wBACpC,MAAM,EAAE,KAAK;qBACd,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YACD,MAAM,IAAI,sBAAa,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,EAAE,mBAAU,CAAC,WAAW,CAAC,CAAC;QAC9E,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAC/C,MAAM,MAAM,CAAC,WAAW,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;QAE/C,oFAAoF;QACpF,yDAAyD;QACzD,MAAM,IAAI,CAAC,YAAY,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;QAEzC,kFAAkF;QAClF,IAAI,IAAI,CAAC,cAAc,KAAK,SAAS,IAAI,IAAI,CAAC,cAAc,KAAK,IAAI,EAAE,CAAC;YACtE,MAAM,IAAI,CAAC,cAAc,CAAC,qBAAqB,CAAC,WAAW,CAAC,CAAC;QAC/D,CAAC;QACD,mFAAmF;QACnF,MAAM,KAAK,CAAC,yBAAyB,CAAC,WAAW,CAAC,CAAC;IACrD,CAAC;IAED;;;;;;;;;;;;;;;OAeG;IAIG,AAAN,KAAK,CAAC,GAAG,CAAS,IAAgB;QAChC,MAAM,cAAc,GAAG,OAAO,IAAI,EAAE,cAAc,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3F,MAAM,IAAI,GAAG,OAAO,IAAI,EAAE,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7D,MAAM,MAAM,GAAG,IAAI,EAAE,MAAM,CAAC;QAE5B,8EAA8E;QAC9E,+EAA+E;QAC/E,0EAA0E;QAC1E,yEAAyE;QACzE,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;QACxD,IAAI,OAAO,KAAK,IAAI;YAAE,mBAAmB,EAAE,CAAC;QAE5C,gFAAgF;QAChF,IAAI,MAAM,KAAK,eAAe,EAAE,CAAC;YAC/B,OAAO,IAAI,CAAC,uBAAuB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACrD,CAAC;QACD,8EAA8E;QAC9E,yCAAyC;QACzC,IAAI,MAAM,KAAK,MAAM;YAAE,mBAAmB,EAAE,CAAC;QAE7C,MAAM,MAAM,GAAyB,MAAM,IAAI,CAAC,aAAa,CAAC,YAAY,CACxE,OAAO,CAAC,YAAY,EACpB,CAAC,kBAAkB,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,cAAc,CAAC,IAAI,CAAC,CAAC,CAC7D,CAAC;QAEF,IAAI,MAAM,CAAC,OAAO,KAAK,eAAe,EAAE,CAAC;YACvC,MAAM,SAAS,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;YAC3C,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC;YACpD,MAAM,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;YACvC,OAAO,gBAAgB,CAAC,GAAG,CAAC,CAAC;QAC/B,CAAC;QAED,+EAA+E;QAC/E,4EAA4E;QAC5E,0EAA0E;QAC1E,IAAI,MAAM,CAAC,MAAM,KAAK,uBAAuB,EAAE,CAAC;YAC9C,oBAAoB,EAAE,CAAC;QACzB,CAAC;QACD,mBAAmB,EAAE,CAAC;IACxB,CAAC;IAED;;;;;;;;;;;;;;;OAeG;IACK,KAAK,CAAC,uBAAuB,CACnC,OAAmD,EACnD,IAAY;QAEZ,yEAAyE;QACzE,IAAI,IAAI,CAAC,kBAAkB,IAAI,IAAI,IAAI,IAAI,CAAC,aAAa,IAAI,IAAI,EAAE,CAAC;YAClE,mBAAmB,EAAE,CAAC;QACxB,CAAC;QACD,4EAA4E;QAC5E,+EAA+E;QAC/E,yDAAyD;QACzD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QAC/F,IAAI,QAAQ,IAAI,IAAI;YAAE,mBAAmB,EAAE,CAAC;QAC5C,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAiC,CAAC;QAC1D,MAAM,WAAW,GAAG,OAAO,MAAM,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnE,IAAI,CAAC,WAAW;YAAE,mBAAmB,EAAE,CAAC;QAExC,+EAA+E;QAC/E,gFAAgF;QAChF,gFAAgF;QAChF,mFAAmF;QACnF,4EAA4E;QAC5E,MAAM,WAAW,GAAG,YAAY,WAAW,EAAE,CAAC;QAC9C,IAAI,IAAI,CAAC,eAAe,IAAI,IAAI,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC;YACrF,mBAAmB,EAAE,CAAC;QACxB,CAAC;QAED,6EAA6E;QAC7E,2DAA2D;QAC3D,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC;QAClF,IAAI,CAAC,EAAE,EAAE,CAAC;YACR,6EAA6E;YAC7E,+EAA+E;YAC/E,sEAAsE;YACtE,oFAAoF;YACpF,mEAAmE;YACnE,gFAAgF;YAChF,kFAAkF;YAClF,mEAAmE;YACnE,IAAI,IAAI,CAAC,eAAe,IAAI,IAAI,EAAE,CAAC;gBACjC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,aAAa,CAAC,WAAW,CAAC,CAAC;gBACpE,IAAI,KAAK,KAAK,IAAI,CAAC,eAAe,CAAC,WAAW,EAAE,CAAC;oBAC/C,IAAI,CAAC,mBAAmB,CAAC;wBACvB,MAAM,EAAE,0BAA0B;wBAClC,OAAO,EAAE,WAAW;wBACpB,QAAQ,EAAE,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI;wBACtE,UAAU,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE;wBACpC,MAAM,EAAE,KAAK;qBACd,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YACD,mBAAmB,EAAE,CAAC;QACxB,CAAC;QAED,+EAA+E;QAC/E,MAAM,IAAI,CAAC,eAAe,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;QAE/C,gFAAgF;QAChF,mEAAmE;QACnE,MAAM,SAAS,GAAG,IAAI,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC;QACnD,IAAI,SAAS,KAAK,IAAI;YAAE,mBAAmB,EAAE,CAAC;QAE9C,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC;QACpD,iFAAiF;QACjF,mFAAmF;QACnF,gEAAgE;QAChE,MAAM,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;QAE7C,gFAAgF;QAChF,qFAAqF;QACrF,iFAAiF;QACjF,mFAAmF;QACnF,mFAAmF;QACnF,0EAA0E;QAC1E,IAAI,CAAC,mBAAmB,CAAC;YACvB,MAAM,EAAE,mBAAmB;YAC3B,OAAO,EAAE,SAAS,CAAC,EAAE;YACrB,QAAQ,EAAE,SAAS,CAAC,QAAQ;YAC5B,MAAM,EAAE,IAAI;SACb,CAAC,CAAC;QAEH,OAAO,EAAE,GAAG,gBAAgB,CAAC,GAAG,CAAC,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC;IAC7D,CAAC;IAED;;;;;;;;OAQG;IACK,kBAAkB,CAAC,WAAmB,EAAE,QAAgB;QAC9D,MAAM,QAAQ,GAAG,IAAI,CAAC,eAAe,CAAC;QACtC,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC;QAChC,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,IAAI,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YAC3F,OAAO,CAAC,8EAA8E;QACxF,CAAC;QACD,KAAK,CAAC,KAAK,IAAmB,EAAE;YAC9B,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC;gBACrC,EAAE,EAAE,WAAW;gBACf,QAAQ;gBACR,OAAO,EAAE,EAAE;gBACX,IAAI,EAAE,MAAM;gBACZ,MAAM,EAAE,KAAK;aACd,CAAC,CAAC;YACH,IAAI,CAAC,OAAO,EAAE,KAAK;gBAAE,OAAO,CAAC,sDAAsD;YACnF,MAAM,MAAM,CAAC,IAAI,CAAC;gBAChB,EAAE,EAAE,OAAO,CAAC,KAAK;gBACjB,OAAO,EAAE,qCAAqC;gBAC9C,IAAI,EACF,4DAA4D;oBAC5D,4EAA4E;oBAC5E,kFAAkF;gBACpF,IAAI,EACF,kEAAkE;oBAClE,oFAAoF;oBACpF,yEAAyE;oBACzE,2BAA2B;aAC9B,CAAC,CAAC;QACL,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE;YACd,iEAAiE;QACnE,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACK,mBAAmB,CAAC,MAO3B;QACC,mFAAmF;QACnF,mFAAmF;QACnF,kFAAkF;QAClF,2DAA2D;QAC3D,MAAM,UAAU,GAA4B;YAC1C,GAAG,CAAC,MAAM,CAAC,UAAU,IAAI,EAAE,CAAC;YAC5B,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACtE,CAAC;QACF,KAAK,IAAI,CAAC,SAAS;YACjB,EAAE,MAAM,CAAC;YACP,IAAI,EAAE,gBAAgB;YACtB,YAAY,EAAE,IAAI,CAAC,GAAG,EAAE;YACxB,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,EAAE;YAC7B,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACzD,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,UAAU;SACX,CAAC;aACD,KAAK,CAAC,GAAG,EAAE;YACV,8DAA8D;QAChE,CAAC,CAAC,CAAC;QAEL,mFAAmF;QACnF,oFAAoF;QACpF,gFAAgF;QAChF,oFAAoF;QACpF,kCAAkC;QAClC,IAAI,MAAM,CAAC,MAAM,KAAK,IAAI,IAAI,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;YAChE,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;QACzD,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;;OAaG;IACK,gBAAgB,CAAC,WAAmB,EAAE,QAAgB;QAC5D,IAAI,CAAC,kBAAkB,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;IACjD,CAAC;IAED;;;;;;OAMG;IAIG,AAAN,KAAK,CAAC,OAAO,CAAS,IAAoB;QACxC,MAAM,YAAY,GAAG,OAAO,IAAI,EAAE,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,CAAC;QACrF,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;YAC7D,0EAA0E;YAC1E,qEAAqE;YACrE,IAAI,IAAI,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;gBACnC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,WAAW,GAAG,GAAG,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;gBAC5E,mFAAmF;gBACnF,iFAAiF;gBACjF,iFAAiF;gBACjF,8EAA8E;gBAC9E,+EAA+E;gBAC/E,4EAA4E;gBAC5E,iEAAiE;gBACjE,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,eAAe,CAC3C,GAAG,CAAC,OAAO,CAAC,WAAW,EACvB,GAAG,CAAC,OAAO,CAAC,QAAQ,CACrB,CAAC;gBACF,MAAM,IAAI,CAAC,WAAW,CAAC,cAAc,CACnC,GAAG,CAAC,MAAM,CAAC,WAAW,EACtB,GAAG,CAAC,OAAO,CAAC,SAAS,EACrB,KAAK,EACL,UAAU,CACX,CAAC;YACJ,CAAC;YACD,OAAO,gBAAgB,CAAC,GAAG,CAAC,CAAC;QAC/B,CAAC;QAAC,MAAM,CAAC;YACP,2EAA2E;YAC3E,8EAA8E;YAC9E,uDAAuD;YACvD,mBAAmB,EAAE,CAAC;QACxB,CAAC;IACH,CAAC;IAED;;;;OAIG;IAIG,AAAN,KAAK,CAAC,MAAM,CAAS,IAAmB;QACtC,MAAM,SAAS,GAAG,OAAO,IAAI,EAAE,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5E,2EAA2E;QAC3E,6EAA6E;QAC7E,iEAAiE;QACjE,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YAC9C,0EAA0E;YAC1E,qEAAqE;YACrE,IAAI,IAAI,CAAC,WAAW,KAAK,SAAS;gBAAE,MAAM,IAAI,CAAC,WAAW,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC;QACtF,CAAC;QAAC,MAAM,CAAC;YACP,kEAAkE;QACpE,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACK,KAAK,CAAC,iBAAiB,CAAC,SAAoB;QAClD,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,gBAAgB,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;QAC1D,CAAC;QAAC,MAAM,CAAC;YACP,mBAAmB,EAAE,CAAC;QACxB,CAAC;IACH,CAAC;CACF,CAAA;AA/9BY,wCAAc;AA+NnB;IAHL,IAAA,oCAAM,GAAE;IACR,IAAA,aAAI,EAAC,OAAO,CAAC;IACb,IAAA,iBAAQ,EAAC,mBAAU,CAAC,EAAE,CAAC;IACX,WAAA,IAAA,aAAI,GAAE,CAAA;;;;2CAuElB;AAwBK;IAHL,IAAA,oCAAM,GAAE;IACR,IAAA,YAAG,EAAC,IAAI,CAAC;IACT,IAAA,iBAAQ,EAAC,mBAAU,CAAC,EAAE,CAAC;IACd,WAAA,IAAA,gBAAO,EAAC,eAAe,CAAC,CAAA;;;;wCA0CjC;AAyBK;IAHL,IAAA,oCAAM,GAAE;IACR,IAAA,aAAI,EAAC,iBAAiB,CAAC;IACvB,IAAA,iBAAQ,EAAC,mBAAU,CAAC,UAAU,CAAC;IAE7B,WAAA,IAAA,aAAI,GAAE,CAAA;IAIN,WAAA,IAAA,WAAE,GAAE,CAAA;;;;oDA8FN;AAkEK;IAHL,IAAA,oCAAM,GAAE;IACR,IAAA,aAAI,EAAC,gBAAgB,CAAC;IACtB,IAAA,iBAAQ,EAAC,mBAAU,CAAC,UAAU,CAAC;IAE7B,WAAA,IAAA,aAAI,GAAE,CAAA;IAEN,WAAA,IAAA,WAAE,GAAE,CAAA;;;;mDAsEN;AAqBK;IAHL,IAAA,oCAAM,GAAE;IACR,IAAA,aAAI,EAAC,KAAK,CAAC;IACX,IAAA,iBAAQ,EAAC,mBAAU,CAAC,EAAE,CAAC;IACb,WAAA,IAAA,aAAI,GAAE,CAAA;;;;yCAuChB;AA6OK;IAHL,IAAA,oCAAM,GAAE;IACR,IAAA,aAAI,EAAC,SAAS,CAAC;IACf,IAAA,iBAAQ,EAAC,mBAAU,CAAC,EAAE,CAAC;IACT,WAAA,IAAA,aAAI,GAAE,CAAA;;;;6CAiCpB;AAUK;IAHL,IAAA,oCAAM,GAAE;IACR,IAAA,aAAI,EAAC,QAAQ,CAAC;IACd,IAAA,iBAAQ,EAAC,mBAAU,CAAC,UAAU,CAAC;IAClB,WAAA,IAAA,aAAI,GAAE,CAAA;;;;4CAanB;yBAh9BU,cAAc;IAD1B,IAAA,mBAAU,EAAC,MAAM,CAAC;IAGd,WAAA,IAAA,eAAM,EAAC,gCAAoB,CAAC,CAAA;IAE5B,WAAA,IAAA,eAAM,EAAC,oCAAwB,CAAC,CAAA;IAOhC,WAAA,IAAA,iBAAQ,GAAE,CAAA;IACV,WAAA,IAAA,eAAM,EAAC,uCAA2B,CAAC,CAAA;IAMnC,WAAA,IAAA,iBAAQ,GAAE,CAAA;IACV,WAAA,IAAA,eAAM,EAAC,mCAAuB,CAAC,CAAA;IAM/B,WAAA,IAAA,iBAAQ,GAAE,CAAA;IACV,WAAA,IAAA,eAAM,EAAC,sCAA0B,CAAC,CAAA;IAGlC,WAAA,IAAA,iBAAQ,GAAE,CAAA;IACV,WAAA,IAAA,eAAM,EAAC,oCAAwB,CAAC,CAAA;IAGhC,WAAA,IAAA,iBAAQ,GAAE,CAAA;IACV,WAAA,IAAA,eAAM,EAAC,+BAAmB,CAAC,CAAA;IAG3B,WAAA,IAAA,iBAAQ,GAAE,CAAA;IACV,WAAA,IAAA,eAAM,EAAC,oCAAwB,CAAC,CAAA;IAGhC,WAAA,IAAA,iBAAQ,GAAE,CAAA;IACV,WAAA,IAAA,eAAM,EAAC,kCAAsB,CAAC,CAAA;IAG9B,YAAA,IAAA,iBAAQ,GAAE,CAAA;IACV,YAAA,IAAA,eAAM,EAAC,kCAAsB,CAAC,CAAA;IAI9B,YAAA,IAAA,iBAAQ,GAAE,CAAA;IACV,YAAA,IAAA,eAAM,EAAC,sCAA0B,CAAC,CAAA;IAMlC,YAAA,IAAA,iBAAQ,GAAE,CAAA;IACV,YAAA,IAAA,eAAM,EAAC,sCAA0B,CAAC,CAAA;IAQlC,YAAA,IAAA,iBAAQ,GAAE,CAAA;IACV,YAAA,IAAA,eAAM,EAAC,gCAAoB,CAAC,CAAA;IAG5B,YAAA,IAAA,iBAAQ,GAAE,CAAA;IACV,YAAA,IAAA,eAAM,EAAC,mCAAuB,CAAC,CAAA;IAO/B,YAAA,IAAA,iBAAQ,GAAE,CAAA;IACV,YAAA,IAAA,eAAM,EAAC,iCAAqB,CAAC,CAAA;IAI7B,YAAA,IAAA,iBAAQ,GAAE,CAAA;IACV,YAAA,IAAA,eAAM,EAAC,sCAA0B,CAAC,CAAA;IAIlC,YAAA,IAAA,iBAAQ,GAAE,CAAA;IACV,YAAA,IAAA,eAAM,EAAC,gCAAoB,CAAC,CAAA;IAM5B,YAAA,IAAA,iBAAQ,GAAE,CAAA;IACV,YAAA,IAAA,eAAM,EAAC,6BAAiB,CAAC,CAAA;IAQzB,YAAA,IAAA,iBAAQ,GAAE,CAAA;IACV,YAAA,IAAA,eAAM,EAAC,0CAA8B,CAAC,CAAA;qDAnGV,sCAAe;GANnC,cAAc,CA+9B1B;AAED;;;;;GAKG;AACH,SAAS,gBAAgB,CAAC,MAA4B;IACpD,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC;IACnC,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;QAClD,mBAAmB,EAAE,CAAC;IACxB,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC"}
|
|
@@ -0,0 +1,202 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* `AuthModule` — the Phase 0b **composition seam** that assembles the core auth
|
|
3
|
+
* engines from guard's adapters + the live connections, and exposes them under
|
|
4
|
+
* {@link SHIELD_AUTHENTICATOR} / {@link SHIELD_SESSION_AUTHORITY} for Team C's
|
|
5
|
+
* `/auth/*` controllers (spec §4).
|
|
6
|
+
*
|
|
7
|
+
* ─────────────────────────────────────────────────────────────────────────────
|
|
8
|
+
* Team B (connection + composition) OWNS this file. It wires the frozen tokens to
|
|
9
|
+
* the real engines:
|
|
10
|
+
*
|
|
11
|
+
* SHIELD_PASSWORD_HASHER → new Argon2idPasswordHasher() (the flagged fix —
|
|
12
|
+
* the authenticator factory injects it, so THIS module must provide it).
|
|
13
|
+
* SHIELD_CREDENTIAL_RESOLVER → new MariaDbCredentialResolver(pool) (Team A's
|
|
14
|
+
* class; its `resolve()` body is Team A's — until then it throws not-implemented,
|
|
15
|
+
* which the engine treats as fail-closed `authentication_unavailable`).
|
|
16
|
+
* SHIELD_SESSION_RECORD_STORE → new MariaDbSessionRecordStore(pool).
|
|
17
|
+
* SHIELD_HOT_SESSION_STORE → new RedisHotSessionStore(redis).
|
|
18
|
+
* SHIELD_TOKEN_GENERATOR → new CryptoTokenGenerator().
|
|
19
|
+
* SHIELD_CLOCK → new SystemClock().
|
|
20
|
+
* SHIELD_REFRESH_HASHER → new Sha256RefreshTokenHasher(
|
|
21
|
+
* assertRefreshHmacKey(config.refreshHmacKey)) ⛔ FAIL-CLOSED gate:
|
|
22
|
+
* `assertRefreshHmacKey` THROWS on a blank key, so auth can NEVER compose with
|
|
23
|
+
* an unkeyed refresh-token hasher. This is the boot-time fail-closed point for
|
|
24
|
+
* the required secret (loadAppConfig deliberately does NOT throw, so a
|
|
25
|
+
* non-auth scaffold still boots with no `.env` — see app-config.ts).
|
|
26
|
+
*
|
|
27
|
+
* SHIELD_SESSION_AUTHORITY → createSessionAuthority({ recordStore, hotStore,
|
|
28
|
+
* tokenGenerator, refreshHasher, clock, lifetimes: config.lifetimes }).
|
|
29
|
+
* `createSessionAuthority` validates lifetime bounds eagerly (throws LOUD on a
|
|
30
|
+
* nonsensical config — construction-time, correct).
|
|
31
|
+
*
|
|
32
|
+
* SHIELD_AUTHENTICATOR → createAuthenticator({ hasher, resolver,
|
|
33
|
+
* identityBroker: createIdentityBroker(), // default Internal, empty
|
|
34
|
+
* factorVerifiers: [ createTotpFactorVerifier({ hmacSha1 }) ] }). The TOTP
|
|
35
|
+
* verifier is wired so MFA works; `hmacSha1` is the {@link hmacSha1} node:crypto
|
|
36
|
+
* one-liner (guard owns node:crypto, core does not). `createIdentityBroker()`
|
|
37
|
+
* with no args registers the default Internal adapter with an EMPTY root
|
|
38
|
+
* allowlist (default-deny).
|
|
39
|
+
* ─────────────────────────────────────────────────────────────────────────────
|
|
40
|
+
*
|
|
41
|
+
* ⛔ OPT-IN (how the integration owner gates this — for the no-`.env` boot):
|
|
42
|
+
* AuthModule opens live connections (via PersistenceModule) and fires the
|
|
43
|
+
* fail-closed `assertRefreshHmacKey` gate the moment it composes. So it MUST be
|
|
44
|
+
* imported ONLY when a deployment wants auth. `ShieldModule.forRoot(options)`
|
|
45
|
+
* should conditionally add `AuthModule.forRoot()` to its `imports` gated behind an
|
|
46
|
+
* option (e.g. `ShieldModule.forRoot({ auth: true })`) or an env flag:
|
|
47
|
+
*
|
|
48
|
+
* imports: [
|
|
49
|
+
* EnforcementModule, BootModule,
|
|
50
|
+
* ...(options?.auth ? [AuthModule.forRoot()] : []), // ← opt-in
|
|
51
|
+
* ],
|
|
52
|
+
* exports: [APP_CONFIG, SHIELD_DECISION_AUTHORITY,
|
|
53
|
+
* ...(options?.auth ? [SHIELD_AUTHENTICATOR, SHIELD_SESSION_AUTHORITY] : [])],
|
|
54
|
+
*
|
|
55
|
+
* An enforcement-only app that does NOT opt in never imports AuthModule → never
|
|
56
|
+
* opens a pool/redis → never calls `assertRefreshHmacKey` → keeps the no-`.env`
|
|
57
|
+
* boot. An auth-enabled app fails LOUD at boot if `SHIELD_REFRESH_HMAC_KEY` is
|
|
58
|
+
* blank — auth can never compose unkeyed. `APP_CONFIG` is already `@Global` from
|
|
59
|
+
* `ShieldModule`, so AuthModule's config-injecting factories resolve. See DONE.md.
|
|
60
|
+
*
|
|
61
|
+
* ADR-0003: the core factories (`createAuthenticator`/`createSessionAuthority`/
|
|
62
|
+
* `createIdentityBroker`/`createTotpFactorVerifier`) are pure; the adapters + the
|
|
63
|
+
* node:crypto HMAC live in guard. Core stays zero-dep + unchanged.
|
|
64
|
+
*/
|
|
65
|
+
import { type DynamicModule } from '@nestjs/common';
|
|
66
|
+
import type { CredentialResolver, HmacSha1, FactorVerifier } from '@astram/core';
|
|
67
|
+
import type { SessionFactsProjector } from './ports/session-facts-projector.js';
|
|
68
|
+
import type { ProfileResolver } from './profile-resolver.js';
|
|
69
|
+
import type { CredentialWriter } from './ports/credential-writer.js';
|
|
70
|
+
import type { ResetTokenStore } from './ports/reset-token-store.js';
|
|
71
|
+
import type { EmailSender } from './ports/email-sender.js';
|
|
72
|
+
import type { RecoveryCodeStore } from './ports/recovery-code-store.js';
|
|
73
|
+
import type { ProfileWriter } from './ports/profile-writer.js';
|
|
74
|
+
import type { SessionSweeper } from './ports/session-sweeper.js';
|
|
75
|
+
import type { MfaDeviceStore } from './ports/mfa-device-store.js';
|
|
76
|
+
import type { AuditSink } from './ports/audit-sink.js';
|
|
77
|
+
/**
|
|
78
|
+
* The injected HMAC-SHA1 primitive the core TOTP verifier needs (Core is zero-dep
|
|
79
|
+
* + node-type-free, so it cannot import `node:crypto`). Guard owns node:crypto and
|
|
80
|
+
* supplies this one-liner: raw key bytes + message bytes → the 20-byte HMAC-SHA1
|
|
81
|
+
* digest. Never logs the key or message.
|
|
82
|
+
*/
|
|
83
|
+
export declare const hmacSha1: HmacSha1;
|
|
84
|
+
/**
|
|
85
|
+
* Resolve the login `totp` {@link FactorVerifier}: the consumer's `override` when
|
|
86
|
+
* supplied, else the framework's `defaultVerifier`. A pure, infra-free `??` — the
|
|
87
|
+
* ONE decision point of the Phase-2 verifier seam (override wins; absent → the
|
|
88
|
+
* default RFC-6238 single-secret verify, behavior unchanged).
|
|
89
|
+
*
|
|
90
|
+
* The default is passed IN (rather than built here) because the core factory
|
|
91
|
+
* `createTotpFactorVerifier` is loaded LAZILY via {@link loadCore} (the CJS↔ESM
|
|
92
|
+
* invariant, see the file header) — only reachable inside an async provider factory.
|
|
93
|
+
* So the authenticator's async `useFactory` awaits {@link loadCore}, builds the
|
|
94
|
+
* default, and hands it here alongside the injected override.
|
|
95
|
+
*/
|
|
96
|
+
export declare function resolveTotpVerifier(override: FactorVerifier | null | undefined, defaultVerifier: FactorVerifier): FactorVerifier;
|
|
97
|
+
/**
|
|
98
|
+
* Build the framework's DEFAULT single-secret TOTP {@link FactorVerifier}
|
|
99
|
+
* (`createTotpFactorVerifier({ hmacSha1 })`), loading the core factory lazily (the
|
|
100
|
+
* CJS↔ESM invariant, see the file header). Exported so a CONSUMER can obtain the
|
|
101
|
+
* framework's base per-secret verifier to WRAP (e.g. an OR-matching multi-device
|
|
102
|
+
* verifier delegates to it per device secret) WITHOUT importing `@astram/core`
|
|
103
|
+
* directly — which would become a runtime `require` on the ESM-only core in the
|
|
104
|
+
* consumer's built CJS dist. Async because of {@link loadCore}.
|
|
105
|
+
*/
|
|
106
|
+
export declare function makeDefaultTotpVerifier(): Promise<FactorVerifier>;
|
|
107
|
+
/**
|
|
108
|
+
* Options for {@link AuthModule.forRoot} — registration-time collaborators the
|
|
109
|
+
* consumer plugs through {@link ShieldModule.forRoot}.
|
|
110
|
+
*/
|
|
111
|
+
export interface AuthModuleOptions {
|
|
112
|
+
/**
|
|
113
|
+
* OPTIONAL custom credential resolver (the store login checks against). Omit →
|
|
114
|
+
* the framework's default {@link MariaDbCredentialResolver} (reads
|
|
115
|
+
* `shield_identity.identity_credential`). Supply a consumer implementation of the
|
|
116
|
+
* core `CredentialResolver` port to authenticate against your OWN user/identity
|
|
117
|
+
* schema. Only meaningful here (AuthModule is only imported under `auth: true`).
|
|
118
|
+
*/
|
|
119
|
+
readonly credentialResolver?: CredentialResolver;
|
|
120
|
+
/**
|
|
121
|
+
* OPTIONAL current-user profile resolver backing `GET /auth/me` (the
|
|
122
|
+
* {@link ProfileResolver} port). Omit → `/auth/me` returns an honest 501 (the
|
|
123
|
+
* framework is org-schema-agnostic; it cannot name the user/company/roles without
|
|
124
|
+
* the consumer's org tables). Supply an implementation to return the signed-in
|
|
125
|
+
* user's display profile (names, never UUIDs). Only meaningful under `auth: true`.
|
|
126
|
+
*/
|
|
127
|
+
readonly profileResolver?: ProfileResolver;
|
|
128
|
+
/**
|
|
129
|
+
* OPTIONAL account/credential-surface seams (forgot/reset, change-password, MFA
|
|
130
|
+
* enrollment, profile edit). Each is threaded through exactly like
|
|
131
|
+
* {@link profileResolver}: supplied → bound app-wide under its token; omitted →
|
|
132
|
+
* bound `null`, so the route that needs it returns an honest 501. Only meaningful
|
|
133
|
+
* under `auth: true`. See `./ports/*.ts` for each contract.
|
|
134
|
+
*/
|
|
135
|
+
readonly credentialWriter?: CredentialWriter;
|
|
136
|
+
readonly resetTokenStore?: ResetTokenStore;
|
|
137
|
+
readonly emailSender?: EmailSender;
|
|
138
|
+
readonly recoveryCodeStore?: RecoveryCodeStore;
|
|
139
|
+
readonly profileWriter?: ProfileWriter;
|
|
140
|
+
readonly sessionSweeper?: SessionSweeper;
|
|
141
|
+
/**
|
|
142
|
+
* OPTIONAL auth-surface audit sink (the {@link AuditSink} port) — persists the
|
|
143
|
+
* FIRST auth audit event (the recovery-code login, spec §6.2). Threaded exactly like
|
|
144
|
+
* the other seams: supplied → bound app-wide under its token; omitted → bound `null`,
|
|
145
|
+
* so the recovery branch's best-effort audit call is a no-op (login still works,
|
|
146
|
+
* un-audited). Only meaningful under `auth: true`.
|
|
147
|
+
*/
|
|
148
|
+
readonly auditSink?: AuditSink;
|
|
149
|
+
/**
|
|
150
|
+
* OPTIONAL multi-device MFA store (the {@link MfaDeviceStore} port) — persists the
|
|
151
|
+
* caller's N TOTP authenticator devices. Threaded exactly like the other seams:
|
|
152
|
+
* supplied → bound app-wide under its token; omitted → bound `null`, so the device
|
|
153
|
+
* routes return an honest 501. Only meaningful under `auth: true`.
|
|
154
|
+
*/
|
|
155
|
+
readonly mfaDeviceStore?: MfaDeviceStore;
|
|
156
|
+
/**
|
|
157
|
+
* OPTIONAL login `totp` {@link FactorVerifier} override (the Phase-2 multi-device
|
|
158
|
+
* seam). Supplied → REPLACES the framework's default single-secret
|
|
159
|
+
* `createTotpFactorVerifier({ hmacSha1 })` in the composed authenticator's
|
|
160
|
+
* `factorVerifiers`; omitted → the default (behavior unchanged). A consumer plugs
|
|
161
|
+
* an OR-matching verifier here so login matches ANY enrolled device (the resolver
|
|
162
|
+
* bundles the N device secrets into one required-factor). Only meaningful under
|
|
163
|
+
* `auth: true`.
|
|
164
|
+
*/
|
|
165
|
+
readonly totpVerifier?: FactorVerifier;
|
|
166
|
+
/**
|
|
167
|
+
* OPTIONAL root allowlist — the server-side, trusted set of canonical
|
|
168
|
+
* principal ids that ARE roots (passed to
|
|
169
|
+
* `createIdentityBroker({ internalRootIds })`). ROOT SAFETY: this is the
|
|
170
|
+
* ONLY way a login mints a root — the Internal adapter keys the trusted signal
|
|
171
|
+
* off THIS list, never off a claim (an attacker-controllable `isPlatformSuperuser`
|
|
172
|
+
* claim is ignored). Omit → `[]` → default-deny (nobody is a root, historical
|
|
173
|
+
* behavior unchanged). Only meaningful under `auth: true`.
|
|
174
|
+
*/
|
|
175
|
+
readonly rootIds?: readonly string[];
|
|
176
|
+
/**
|
|
177
|
+
* OPTIONAL eager session-facts projector (ADR-0011, the {@link SessionFactsProjector}
|
|
178
|
+
* port). Threaded exactly like the other seams: supplied → bound app-wide under
|
|
179
|
+
* {@link SHIELD_SESSION_FACTS_PROJECTOR}; omitted → bound `null`, so the auth controller
|
|
180
|
+
* omits `cachedFacts` and gate 5 DB-reloads every request (today's behavior). When
|
|
181
|
+
* supplied, login/refresh cache the principal's coarse grants on the session binding so
|
|
182
|
+
* gate 5 serves them from the request's `cachedFacts`. Only meaningful under `auth: true`.
|
|
183
|
+
*/
|
|
184
|
+
readonly sessionFactsProjector?: SessionFactsProjector;
|
|
185
|
+
}
|
|
186
|
+
/**
|
|
187
|
+
* The auth composition module. Imports {@link PersistenceModule} (the live
|
|
188
|
+
* connections) and provides the adapters + composed engines. Exports the two
|
|
189
|
+
* engines (Team C consumes them) and the resolver token. Opt-in: imported ONLY by
|
|
190
|
+
* an auth-enabled `ShieldModule.forRoot({ auth: true })` — see the file header +
|
|
191
|
+
* DONE.md for the exact gating the integration owner applies.
|
|
192
|
+
*/
|
|
193
|
+
export declare class AuthModule {
|
|
194
|
+
/**
|
|
195
|
+
* Compose the auth surface. `options.credentialResolver`, when supplied, REPLACES
|
|
196
|
+
* the default MariaDb store with the consumer's own (a value provider under
|
|
197
|
+
* {@link SHIELD_CREDENTIAL_RESOLVER}); omitted → the historical default binding,
|
|
198
|
+
* EXACTLY unchanged (zero behavior change for existing consumers).
|
|
199
|
+
*/
|
|
200
|
+
static forRoot(options?: AuthModuleOptions): DynamicModule;
|
|
201
|
+
}
|
|
202
|
+
//# sourceMappingURL=auth.module.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"auth.module.d.ts","sourceRoot":"","sources":["../../src/auth/auth.module.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+DG;AAEH,OAAO,EAAU,KAAK,aAAa,EAAiB,MAAM,gBAAgB,CAAC;AAa3E,OAAO,KAAK,EAGV,kBAAkB,EAOlB,QAAQ,EACR,cAAc,EACf,MAAM,cAAc,CAAC;AAkDtB,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,oCAAoC,CAAC;AAEhF,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACxE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAIvD;;;;;GAKG;AACH,eAAO,MAAM,QAAQ,EAAE,QACqE,CAAC;AAE7F;;;;;;;;;;;GAWG;AACH,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,cAAc,GAAG,IAAI,GAAG,SAAS,EAC3C,eAAe,EAAE,cAAc,GAC9B,cAAc,CAEhB;AAED;;;;;;;;GAQG;AACH,wBAAsB,uBAAuB,IAAI,OAAO,CAAC,cAAc,CAAC,CAGvE;AAyUD;;;GAGG;AACH,MAAM,WAAW,iBAAiB;IAChC;;;;;;OAMG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;IACjD;;;;;;OAMG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,eAAe,CAAC;IAC3C;;;;;;OAMG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IAC7C,QAAQ,CAAC,eAAe,CAAC,EAAE,eAAe,CAAC;IAC3C,QAAQ,CAAC,WAAW,CAAC,EAAE,WAAW,CAAC;IACnC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IAC/C,QAAQ,CAAC,aAAa,CAAC,EAAE,aAAa,CAAC;IACvC,QAAQ,CAAC,cAAc,CAAC,EAAE,cAAc,CAAC;IACzC;;;;;;OAMG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC;IAC/B;;;;;OAKG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,cAAc,CAAC;IACzC;;;;;;;;OAQG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,cAAc,CAAC;IACvC;;;;;;;;OAQG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC;;;;;;;OAOG;IACH,QAAQ,CAAC,qBAAqB,CAAC,EAAE,qBAAqB,CAAC;CACxD;AAgED;;;;;;GAMG;AACH,qBACa,UAAU;IACrB;;;;;OAKG;IACH,MAAM,CAAC,OAAO,CAAC,OAAO,GAAE,iBAAsB,GAAG,aAAa;CA6F/D"}
|