@baruk/core 0.3.0 → 0.4.2

package/dist/cjs/auth/password-reset.js

@@ -1,11 +1,29 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.requestPasswordReset = requestPasswordReset;
+exports.createActivationToken = createActivationToken;
+exports.isResetTokenValid = isResetTokenValid;
 exports.resetPassword = resetPassword;
 const shared_1 = require("@baruk/shared");
+const context_js_1 = require("../db/context.js");
+const audit_js_1 = require("../audit/audit.js");
 const password_js_1 = require("./password.js");
 const session_token_js_1 = require("./session-token.js");
-const RESET_TTL_MS = 60 * 60 * 1000; // 1h
+/**
+ * 24h para o link de recuperação.
+ *
+ * Era 1h. O trade-off é real — janela maior é janela maior se a caixa de e-mail
+ * for comprometida —, mas 1h não sobrevive ao uso: quem pede recuperação nem
+ * sempre está com o e-mail aberto, e a API hiberna, então a primeira tentativa
+ * do dia ainda gasta segundos no cold start. Link vencido faz o usuário pedir
+ * outro, e o custo de segurança disso é maior que o da janela: cada reenvio é
+ * mais um link vivo circulando por e-mail.
+ *
+ * O que limita o dano continua valendo: uso único, invalidação no consumo e
+ * revogação das sessões anteriores.
+ */
+const RESET_TTL_MS = 24 * 60 * 60 * 1000;
+const ACTIVATION_TTL_MS = 7 * 24 * 60 * 60 * 1000; // 7 dias — convite, e-mail pode demorar a ser aberto.
 const REAL_CLOCK = { now: () => Date.now() };
 /**
  * Solicita reset. Retorna o token EM CLARO (para compor o link do e-mail) e o
@@ -22,37 +40,149 @@ async function requestPasswordReset(db, email, clock = REAL_CLOCK) {
     const { token, tokenHash } = (0, session_token_js_1.generateSessionToken)();
     const now = clock.now();
     await db `
-    INSERT INTO password_reset (id, user_id, token_hash, expires_at)
-    VALUES (${(0, shared_1.uuidv7)()}, ${user.id}, ${tokenHash}, ${new Date(now + RESET_TTL_MS)})
+    INSERT INTO password_reset (id, user_id, token_hash, purpose, expires_at)
+    VALUES (${(0, shared_1.uuidv7)()}, ${user.id}, ${tokenHash}, 'reset', ${new Date(now + RESET_TTL_MS)})
   `;
+    await auditBestEffort(db, user.id, {
+        action: 'password_reset_requested',
+        resourceType: 'user',
+        resourceId: user.id,
+    });
     return { token, userId: user.id };
 }
+/**
+ * Emite o token de primeiro acesso para um usuário recém-convidado (chamado
+ * por `inviteUser`, já dentro do contexto do tenant que convidou). Mesmo
+ * mecanismo de `requestPasswordReset`, com `purpose='activation'` e TTL maior
+ * — e o `tenant_id` guardado no token, porque `resetPassword` roda sem sessão
+ * autenticada e precisa reabrir o contexto de RLS certo para ativar a
+ * membership.
+ */
+async function createActivationToken(db, input, clock = REAL_CLOCK) {
+    const { token, tokenHash } = (0, session_token_js_1.generateSessionToken)();
+    const now = clock.now();
+    // Reemitir invalida o convite anterior: um usuário tem no máximo um convite
+    // vivo por vez. Sem isto, cada reenvio deixava mais um token válido por 7
+    // dias — e um link que vazou (encaminhado, colado num chat, capturado numa
+    // screenshot) continuaria abrindo a conta mesmo depois de reemitido.
+    await db `
+    UPDATE password_reset SET used_at = now()
+     WHERE user_id = ${input.userId} AND purpose = 'activation' AND used_at IS NULL
+  `;
+    await db `
+    INSERT INTO password_reset (id, user_id, token_hash, purpose, tenant_id, expires_at)
+    VALUES (${(0, shared_1.uuidv7)()}, ${input.userId}, ${tokenHash}, 'activation', ${input.tenantId}, ${new Date(now + ACTIVATION_TTL_MS)})
+  `;
+    return { token };
+}
 /**
  * Redefine a senha usando um token válido (não usado, não expirado). Marca o
  * token como usado, limpa `must_change_password` e revoga sessões anteriores.
+ * Quando o token é de ativação (`purpose='activation'`), também ativa o
+ * usuário e a membership que o convite deixou em `invited`.
  */
+/**
+ * O token ainda vale? **Não consome.**
+ *
+ * Existe para a tela de ativação decidir o que mostrar antes de o usuário
+ * digitar. Sem isto, quem clicava num convite antigo preenchia senha, confirmava
+ * e só então descobria que o link não servia — e a tela seguia oferecendo o
+ * formulário como se a próxima tentativa pudesse dar certo.
+ *
+ * Devolve só um booleano. Não distingue inexistente de expirado de já usado:
+ * os três levam à mesma ação do usuário, e detalhar transformaria isto num
+ * oráculo para quem tenta adivinhar token.
+ */
+async function isResetTokenValid(db, token, clock = REAL_CLOCK) {
+    const rows = await db `
+    SELECT id FROM password_reset
+     WHERE token_hash = ${(0, session_token_js_1.hashToken)(token)}
+       AND used_at IS NULL
+       AND expires_at > ${new Date(clock.now())}
+     LIMIT 1
+  `;
+    return rows.length > 0;
+}
 async function resetPassword(db, token, newPassword, clock = REAL_CLOCK) {
     if (newPassword.length < 8)
         return false;
     const th = (0, session_token_js_1.hashToken)(token);
     const rows = await db `
-    SELECT id, user_id FROM password_reset
+    SELECT id, user_id, purpose, tenant_id FROM password_reset
     WHERE token_hash = ${th} AND used_at IS NULL AND expires_at > ${new Date(clock.now())}
   `;
     const reset = rows[0];
-    if (!reset)
+    if (!reset) {
+        // Token existe mas expirou/já foi usado (distinto de token nunca emitido,
+        // que não é auditável — não há usuário a quem atribuir a tentativa).
+        const stale = await db `
+      SELECT user_id FROM password_reset WHERE token_hash = ${th}
+    `;
+        if (stale[0]) {
+            await auditBestEffort(db, stale[0].user_id, {
+                action: 'password_reset_failed',
+                resourceType: 'user',
+                resourceId: stale[0].user_id,
+            });
+        }
         return false;
+    }
     await db.begin(async (tx) => {
-        await tx `
-      INSERT INTO user_credential (user_id, password_hash, must_change_password)
-      VALUES (${reset.user_id}, ${(0, password_js_1.hashPassword)(newPassword)}, false)
-      ON CONFLICT (user_id) DO UPDATE
-        SET password_hash = EXCLUDED.password_hash, must_change_password = false, updated_at = now()
-    `;
+        // Upsert via função SECURITY DEFINER (0024) — o papel de app só tem INSERT
+        // em user_credential (anti account-takeover, 0011); trocar uma senha já
+        // existente exige essa porta estreita e nomeada, nunca um UPDATE genérico.
+        await tx `SELECT set_user_password(${reset.user_id}, ${(0, password_js_1.hashPassword)(newPassword)}, false)`;
         await tx `UPDATE password_reset SET used_at = now() WHERE id = ${reset.id}`;
         // Revoga sessões anteriores (uso único de fato).
         await tx `UPDATE user_session SET revoked_at = now() WHERE user_id = ${reset.user_id} AND revoked_at IS NULL`;
+        if (reset.purpose === 'activation' && reset.tenant_id) {
+            await tx `UPDATE "user" SET status = 'active' WHERE id = ${reset.user_id} AND status = 'invited'`;
+            await tx `select set_config('app.current_tenant', ${reset.tenant_id}, true)`;
+            await tx `select set_config('app.current_user', ${reset.user_id}, true)`;
+            await tx `
+        UPDATE membership SET status = 'active', updated_at = now()
+        WHERE user_id = ${reset.user_id} AND tenant_id = ${reset.tenant_id} AND status = 'invited'
+      `;
+            await (0, audit_js_1.appendAudit)(tx, {
+                actorId: reset.user_id,
+                action: 'activation_completed',
+                resourceType: 'user',
+                resourceId: reset.user_id,
+            });
+        }
+        else {
+            await auditWithinResolvedTenant(tx, reset.user_id, {
+                action: 'password_reset_completed',
+                resourceType: 'user',
+                resourceId: reset.user_id,
+            });
+        }
     });
     return true;
 }
+/**
+ * Auditoria best-effort para ações globais (login ainda não escolheu tenant,
+ * ou nem há sessão). Só grava se o usuário tiver exatamente uma membership
+ * ativa resolvível — mesmo critério de auto-seleção usado em `login()`. Sem
+ * isso, a ação simplesmente não é auditada (não há tenant_id para a RLS de
+ * `audit_log` aceitar a linha) — comportamento documentado, não um bug.
+ */
+async function auditBestEffort(db, userId, entry) {
+    const memberships = await db `
+    SELECT tenant_id FROM membership WHERE user_id = ${userId} AND status = 'active' AND deleted_at IS NULL
+  `;
+    if (memberships.length !== 1)
+        return;
+    await (0, context_js_1.withContext)(db, { tenantId: memberships[0].tenant_id, userId }, (tx) => (0, audit_js_1.appendAudit)(tx, { ...entry, actorId: userId }));
+}
+async function auditWithinResolvedTenant(tx, userId, entry) {
+    const memberships = await tx `
+    SELECT tenant_id FROM membership WHERE user_id = ${userId} AND status = 'active' AND deleted_at IS NULL
+  `;
+    if (memberships.length !== 1)
+        return;
+    await tx `select set_config('app.current_tenant', ${memberships[0].tenant_id}, true)`;
+    await tx `select set_config('app.current_user', ${userId}, true)`;
+    await (0, audit_js_1.appendAudit)(tx, { ...entry, actorId: userId });
+}
 //# sourceMappingURL=password-reset.js.map

package/dist/cjs/auth/password-reset.js.map

@@ -1 +1 @@
-{"version":3,"file":"password-reset.js","sourceRoot":"","sources":["../../../src/auth/password-reset.ts"],"names":[],"mappings":";;AAiBA,oDAkBC;AAMD,sCA2BC;AApED,0CAAuC;AAEvC,+CAA6C;AAC7C,yDAAqE;AAErE,MAAM,YAAY,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,KAAK;AAK1C,MAAM,UAAU,GAAU,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;AAEpD;;;;GAIG;AACI,KAAK,UAAU,oBAAoB,CACxC,EAAM,EACN,KAAa,EACb,QAAe,UAAU;IAEzB,MAAM,KAAK,GAAG,MAAM,EAAE,CAAkC;kDACR,KAAK;GACpD,CAAC;IACF,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IACtB,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,UAAU;QAAE,OAAO,IAAI,CAAC;IAErD,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,IAAA,uCAAoB,GAAE,CAAC;IACpD,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,EAAE,CAAC;IACxB,MAAM,EAAE,CAAA;;cAEI,IAAA,eAAM,GAAE,KAAK,IAAI,CAAC,EAAE,KAAK,SAAS,KAAK,IAAI,IAAI,CAAC,GAAG,GAAG,YAAY,CAAC;GAC9E,CAAC;IACF,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC;AACpC,CAAC;AAED;;;GAGG;AACI,KAAK,UAAU,aAAa,CACjC,EAAM,EACN,KAAa,EACb,WAAmB,EACnB,QAAe,UAAU;IAEzB,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IACzC,MAAM,EAAE,GAAG,IAAA,4BAAS,EAAC,KAAK,CAAC,CAAC;IAC5B,MAAM,IAAI,GAAG,MAAM,EAAE,CAAmC;;yBAEjC,EAAE,yCAAyC,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;GACtF,CAAC;IACF,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACtB,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IAEzB,MAAM,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;QAC1B,MAAM,EAAE,CAAA;;gBAEI,KAAK,CAAC,OAAO,KAAK,IAAA,0BAAY,EAAC,WAAW,CAAC;;;KAGtD,CAAC;QACF,MAAM,EAAE,CAAA,wDAAwD,KAAK,CAAC,EAAE,EAAE,CAAC;QAC3E,iDAAiD;QACjD,MAAM,EAAE,CAAA,8DAA8D,KAAK,CAAC,OAAO,yBAAyB,CAAC;IAC/G,CAAC,CAAC,CAAC;IACH,OAAO,IAAI,CAAC;AACd,CAAC"}
+{"version":3,"file":"password-reset.js","sourceRoot":"","sources":["../../../src/auth/password-reset.ts"],"names":[],"mappings":";;AAiCA,oDAuBC;AAUD,sDAsBC;AAoBD,8CAaC;AAED,sCA+DC;AA1LD,0CAAuC;AAEvC,iDAA+C;AAC/C,gDAAgD;AAChD,+CAA6C;AAC7C,yDAAqE;AAErE;;;;;;;;;;;;GAYG;AACH,MAAM,YAAY,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AACzC,MAAM,iBAAiB,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,sDAAsD;AAKzG,MAAM,UAAU,GAAU,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;AAEpD;;;;GAIG;AACI,KAAK,UAAU,oBAAoB,CACxC,EAAM,EACN,KAAa,EACb,QAAe,UAAU;IAEzB,MAAM,KAAK,GAAG,MAAM,EAAE,CAAkC;kDACR,KAAK;GACpD,CAAC;IACF,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IACtB,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,UAAU;QAAE,OAAO,IAAI,CAAC;IAErD,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,IAAA,uCAAoB,GAAE,CAAC;IACpD,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,EAAE,CAAC;IACxB,MAAM,EAAE,CAAA;;cAEI,IAAA,eAAM,GAAE,KAAK,IAAI,CAAC,EAAE,KAAK,SAAS,cAAc,IAAI,IAAI,CAAC,GAAG,GAAG,YAAY,CAAC;GACvF,CAAC;IACF,MAAM,eAAe,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE;QACjC,MAAM,EAAE,0BAA0B;QAClC,YAAY,EAAE,MAAM;QACpB,UAAU,EAAE,IAAI,CAAC,EAAE;KACpB,CAAC,CAAC;IACH,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC;AACpC,CAAC;AAED;;;;;;;GAOG;AACI,KAAK,UAAU,qBAAqB,CACzC,EAAa,EACb,KAA2C,EAC3C,QAAe,UAAU;IAEzB,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,IAAA,uCAAoB,GAAE,CAAC;IACpD,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,EAAE,CAAC;IAExB,4EAA4E;IAC5E,0EAA0E;IAC1E,2EAA2E;IAC3E,qEAAqE;IACrE,MAAM,EAAE,CAAA;;uBAEa,KAAK,CAAC,MAAM;GAChC,CAAC;IAEF,MAAM,EAAE,CAAA;;cAEI,IAAA,eAAM,GAAE,KAAK,KAAK,CAAC,MAAM,KAAK,SAAS,mBAAmB,KAAK,CAAC,QAAQ,KAAK,IAAI,IAAI,CAAC,GAAG,GAAG,iBAAiB,CAAC;GACzH,CAAC;IACF,OAAO,EAAE,KAAK,EAAE,CAAC;AACnB,CAAC;AAED;;;;;GAKG;AACH;;;;;;;;;;;GAWG;AACI,KAAK,UAAU,iBAAiB,CACrC,EAAa,EACb,KAAa,EACb,QAAe,UAAU;IAEzB,MAAM,IAAI,GAAG,MAAM,EAAE,CAAkB;;0BAEf,IAAA,4BAAS,EAAC,KAAK,CAAC;;0BAEhB,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;;GAE5C,CAAC;IACF,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;AACzB,CAAC;AAEM,KAAK,UAAU,aAAa,CACjC,EAAM,EACN,KAAa,EACb,WAAmB,EACnB,QAAe,UAAU;IAEzB,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IACzC,MAAM,EAAE,GAAG,IAAA,4BAAS,EAAC,KAAK,CAAC,CAAC;IAC5B,MAAM,IAAI,GAAG,MAAM,EAAE,CAEpB;;yBAEsB,EAAE,yCAAyC,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;GACtF,CAAC;IACF,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACtB,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,0EAA0E;QAC1E,qEAAqE;QACrE,MAAM,KAAK,GAAG,MAAM,EAAE,CAAuB;8DACa,EAAE;KAC3D,CAAC;QACF,IAAI,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;YACb,MAAM,eAAe,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE;gBAC1C,MAAM,EAAE,uBAAuB;gBAC/B,YAAY,EAAE,MAAM;gBACpB,UAAU,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO;aAC7B,CAAC,CAAC;QACL,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;QAC1B,2EAA2E;QAC3E,wEAAwE;QACxE,2EAA2E;QAC3E,MAAM,EAAE,CAAA,4BAA4B,KAAK,CAAC,OAAO,KAAK,IAAA,0BAAY,EAAC,WAAW,CAAC,UAAU,CAAC;QAC1F,MAAM,EAAE,CAAA,wDAAwD,KAAK,CAAC,EAAE,EAAE,CAAC;QAC3E,iDAAiD;QACjD,MAAM,EAAE,CAAA,8DAA8D,KAAK,CAAC,OAAO,yBAAyB,CAAC;QAE7G,IAAI,KAAK,CAAC,OAAO,KAAK,YAAY,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;YACtD,MAAM,EAAE,CAAA,kDAAkD,KAAK,CAAC,OAAO,yBAAyB,CAAC;YACjG,MAAM,EAAE,CAAA,2CAA2C,KAAK,CAAC,SAAS,SAAS,CAAC;YAC5E,MAAM,EAAE,CAAA,yCAAyC,KAAK,CAAC,OAAO,SAAS,CAAC;YACxE,MAAM,EAAE,CAAA;;0BAEY,KAAK,CAAC,OAAO,oBAAoB,KAAK,CAAC,SAAS;OACnE,CAAC;YACF,MAAM,IAAA,sBAAW,EAAC,EAAE,EAAE;gBACpB,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,MAAM,EAAE,sBAAsB;gBAC9B,YAAY,EAAE,MAAM;gBACpB,UAAU,EAAE,KAAK,CAAC,OAAO;aAC1B,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,MAAM,yBAAyB,CAAC,EAAE,EAAE,KAAK,CAAC,OAAO,EAAE;gBACjD,MAAM,EAAE,0BAA0B;gBAClC,YAAY,EAAE,MAAM;gBACpB,UAAU,EAAE,KAAK,CAAC,OAAO;aAC1B,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC,CAAC;IACH,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,eAAe,CAC5B,EAAM,EACN,MAAc,EACd,KAAyD;IAEzD,MAAM,WAAW,GAAG,MAAM,EAAE,CAAyB;uDACA,MAAM;GAC1D,CAAC;IACF,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IACrC,MAAM,IAAA,wBAAW,EAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAC,CAAE,CAAC,SAAS,EAAE,MAAM,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,CAC5E,IAAA,sBAAW,EAAC,EAAE,EAAE,EAAE,GAAG,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAC/C,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,yBAAyB,CACtC,EAAM,EACN,MAAc,EACd,KAAyD;IAEzD,MAAM,WAAW,GAAG,MAAM,EAAE,CAAyB;uDACA,MAAM;GAC1D,CAAC;IACF,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IACrC,MAAM,EAAE,CAAA,2CAA2C,WAAW,CAAC,CAAC,CAAE,CAAC,SAAS,SAAS,CAAC;IACtF,MAAM,EAAE,CAAA,yCAAyC,MAAM,SAAS,CAAC;IACjE,MAAM,IAAA,sBAAW,EAAC,EAAE,EAAE,EAAE,GAAG,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;AACvD,CAAC"}

package/dist/cjs/auth/service.js

@@ -8,6 +8,7 @@ exports.authenticate = authenticate;
 exports.sessionMemberships = sessionMemberships;
 exports.sessionProducts = sessionProducts;
 exports.logout = logout;
+exports.changePassword = changePassword;
 const shared_1 = require("@baruk/shared");
 const context_js_1 = require("../db/context.js");
 const audit_js_1 = require("../audit/audit.js");
@@ -18,7 +19,23 @@ const password_js_1 = require("./password.js");
 const session_token_js_1 = require("./session-token.js");
 const SESSION_TTL_MS = 12 * 60 * 60 * 1000; // 12h
 const REAL_CLOCK = { now: () => Date.now() };
-/** Cria (ou atualiza) um usuário staff com senha local. Usado pelo seed. */
+/**
+ * Cria (ou atualiza) um usuário staff com senha local. Usado pelos seeds.
+ *
+ * **A senha de um usuário que já existe é preservada por padrão.** Um seed de
+ * inicialização é, por natureza, algo que pode rodar de novo — em um deploy, em
+ * uma reconstrução de ambiente, na mão de alguém investigando. Se ele redefinir
+ * a senha em silêncio, quem administra o ambiente perde o acesso sem receber
+ * erro nenhum, e a causa é invisível: o seed "funcionou".
+ *
+ * Foi exatamente essa a armadilha encontrada em 2026-08-12, quando o
+ * `SEED_ADMIN_PASSWORD` do serviço divergiu do valor guardado no cofre. Rodar
+ * `db:seed` com o ambiente errado teria trocado a senha do administrador sem
+ * um aviso sequer.
+ *
+ * Para redefinir deliberadamente, passe `overwritePassword: true` — o nome
+ * torna a intenção explícita em quem chama, que é onde ela deve estar.
+ */
 async function upsertUserWithPassword(db, input) {
     const rows = await db `
     INSERT INTO "user" (id, email, full_name, user_type, auth_provider)
@@ -28,16 +45,28 @@ async function upsertUserWithPassword(db, input) {
     RETURNING id
   `;
     const userId = rows[0].id;
-    await db `
-    INSERT INTO user_credential (user_id, password_hash)
-    VALUES (${userId}, ${(0, password_js_1.hashPassword)(input.password)})
-    ON CONFLICT (user_id) DO UPDATE SET password_hash = EXCLUDED.password_hash, updated_at = now()
-  `;
+    // `RETURNING` só devolve linha quando o INSERT ou o UPDATE de fato aconteceu:
+    // com `DO NOTHING` e credencial preexistente, o resultado é vazio. É assim que
+    // sabemos, sem uma consulta extra, se a senha foi gravada ou preservada.
+    const written = input.overwritePassword
+        ? await db `
+        INSERT INTO user_credential (user_id, password_hash)
+        VALUES (${userId}, ${(0, password_js_1.hashPassword)(input.password)})
+        ON CONFLICT (user_id) DO UPDATE SET password_hash = EXCLUDED.password_hash, updated_at = now()
+        RETURNING user_id
+      `
+        : await db `
+        INSERT INTO user_credential (user_id, password_hash)
+        VALUES (${userId}, ${(0, password_js_1.hashPassword)(input.password)})
+        ON CONFLICT (user_id) DO NOTHING
+        RETURNING user_id
+      `;
     return {
         id: userId,
         email: input.email,
         fullName: input.fullName,
         userType: input.userType ?? 'staff',
+        passwordWasSet: written.length > 0,
     };
 }
 /** Login com e-mail/senha. Emite sessão; auto-seleciona tenant se houver só um. */
@@ -51,11 +80,12 @@ async function login(db, input, clock = REAL_CLOCK) {
         throw new shared_1.UnauthorizedError('Credenciais inválidas');
     }
     const creds = await db `
-    SELECT password_hash FROM user_credential WHERE user_id = ${user.id}
+    SELECT password_hash, must_change_password FROM user_credential WHERE user_id = ${user.id}
   `;
     if (!creds[0] || !(0, password_js_1.verifyPassword)(input.password, creds[0].password_hash)) {
         throw new shared_1.UnauthorizedError('Credenciais inválidas');
     }
+    const mustChangePassword = creds[0].must_change_password;
     const { token, tokenHash } = (0, session_token_js_1.generateSessionToken)();
     const now = clock.now();
     const sessionId = (0, shared_1.uuidv7)();
@@ -83,6 +113,7 @@ async function login(db, input, clock = REAL_CLOCK) {
         user: { id: user.id, email: user.email, fullName: user.full_name, userType: user.user_type },
         memberships,
         activeTenantId,
+        mustChangePassword,
     };
 }
 /** Lista os tenants a que o usuário pertence (usa RLS self-clause de membership). */
@@ -129,6 +160,7 @@ async function selectTenant(db, input) {
             userType: session.user_type,
             tenantId: input.tenantId,
             permissions,
+            mustChangePassword: session.must_change_password,
         };
     });
 }
@@ -149,6 +181,7 @@ async function authenticate(db, token, clock = REAL_CLOCK) {
             userType: session.user_type,
             tenantId,
             permissions,
+            mustChangePassword: session.must_change_password,
         };
         if (session.user_type === 'client_portal') {
             ctx.clientId = await (0, repository_js_1.getPortalClientId)(tx, session.user_id);
@@ -158,9 +191,11 @@ async function authenticate(db, token, clock = REAL_CLOCK) {
 }
 async function resolveSessionRow(db, token, clock = REAL_CLOCK) {
     const rows = await db `
-    SELECT s.id, s.user_id, u.user_type, s.active_tenant_id
+    SELECT s.id, s.user_id, u.user_type, s.active_tenant_id,
+      coalesce(c.must_change_password, false) AS must_change_password
     FROM user_session s
     JOIN "user" u ON u.id = s.user_id
+    LEFT JOIN user_credential c ON c.user_id = u.id
     WHERE s.token_hash = ${(0, session_token_js_1.hashToken)(token)}
       AND s.revoked_at IS NULL
       AND s.expires_at > ${new Date(clock.now())}
@@ -183,7 +218,38 @@ async function sessionProducts(db, token) {
 }
 /** Revoga a sessão (logout). */
 async function logout(db, token) {
-    await db `UPDATE user_session SET revoked_at = now() WHERE token_hash = ${(0, session_token_js_1.hashToken)(token)}`;
+    await db `SELECT revoke_user_session(${(0, session_token_js_1.hashToken)(token)})`;
+}
+/**
+ * Troca de senha em sessão autenticada (exige a senha atual — distinto do
+ * fluxo de token de `resetPassword`). Cobre tanto a troca voluntária quanto a
+ * troca obrigatória de `must_change_password`; a sessão corrente permanece
+ * válida (não é o cenário de "conta pode estar comprometida" do reset).
+ */
+async function changePassword(db, auth, input) {
+    if (input.newPassword.length < 8) {
+        throw new shared_1.ValidationError('A nova senha deve ter ao menos 8 caracteres');
+    }
+    const creds = await db `
+    SELECT password_hash, must_change_password FROM user_credential WHERE user_id = ${auth.userId}
+  `;
+    if (!creds[0] || !(0, password_js_1.verifyPassword)(input.currentPassword, creds[0].password_hash)) {
+        throw new shared_1.UnauthorizedError('Senha atual incorreta');
+    }
+    const wasForced = creds[0].must_change_password;
+    await (0, context_js_1.withContext)(db, { tenantId: auth.tenantId, userId: auth.userId }, async (tx) => {
+        // Upsert via função SECURITY DEFINER (0024) — ver mesmo comentário em
+        // `resetPassword`: o papel de app não tem UPDATE em user_credential.
+        await tx `SELECT set_user_password(${auth.userId}, ${(0, password_js_1.hashPassword)(input.newPassword)}, false)`;
+        await (0, audit_js_1.appendAudit)(tx, {
+            actorId: auth.userId,
+            action: wasForced ? 'mandatory_password_change_completed' : 'password_changed',
+            resourceType: 'user',
+            resourceId: auth.userId,
+            ip: input.ip,
+            userAgent: input.userAgent,
+        });
+    });
 }
 async function auditWithinTenant(db, tenantId, actorId, entry) {
     await (0, context_js_1.withContext)(db, { tenantId, userId: actorId }, (tx) => (0, audit_js_1.appendAudit)(tx, entry));

package/dist/cjs/auth/service.js.map

@@ -1 +1 @@
-{"version":3,"file":"service.js","sourceRoot":"","sources":["../../../src/auth/service.ts"],"names":[],"mappings":";;AAmDA,wDAuBC;AAGD,sBAsDC;AAGD,0CAkBC;AAGD,oCA8BC;AAMD,oCAuBC;AA4BD,gDAGC;AAGD,0CASC;AAGD,wBAEC;AAtQD,0CAAyF;AAGzF,iDAA+C;AAC/C,gDAAgD;AAChD,uDAA2D;AAC3D,2DAA4D;AAC5D,6DAAoF;AACpF,+CAA6D;AAC7D,yDAAqE;AAErE,MAAM,cAAc,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,MAAM;AAqClD,MAAM,UAAU,GAAU,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;AAEpD,4EAA4E;AACrE,KAAK,UAAU,sBAAsB,CAC1C,EAAM,EACN,KAAiF;IAEjF,MAAM,IAAI,GAAG,MAAM,EAAE,CAAkB;;cAE3B,IAAA,eAAM,GAAE,KAAK,KAAK,CAAC,KAAK,KAAK,KAAK,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ,IAAI,OAAO;;;;GAIpF,CAAC;IACF,MAAM,MAAM,GAAG,IAAI,CAAC,CAAC,CAAE,CAAC,EAAE,CAAC;IAC3B,MAAM,EAAE,CAAA;;cAEI,MAAM,KAAK,IAAA,0BAAY,EAAC,KAAK,CAAC,QAAQ,CAAC;;GAElD,CAAC;IACF,OAAO;QACL,EAAE,EAAE,MAAM;QACV,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,OAAO;KACpC,CAAC;AACJ,CAAC;AAED,mFAAmF;AAC5E,KAAK,UAAU,KAAK,CACzB,EAAM,EACN,KAAyD,EACzD,QAAe,UAAU;IAEzB,MAAM,KAAK,GAAG,MAAM,EAAE,CAErB;;gCAE6B,KAAK,CAAC,KAAK;GACxC,CAAC;IACF,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IACtB,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QACtC,MAAM,IAAI,0BAAiB,CAAC,uBAAuB,CAAC,CAAC;IACvD,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,EAAE,CAA6B;gEACW,IAAI,CAAC,EAAE;GACpE,CAAC;IACF,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,IAAA,4BAAc,EAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,EAAE,CAAC;QACzE,MAAM,IAAI,0BAAiB,CAAC,uBAAuB,CAAC,CAAC;IACvD,CAAC;IAED,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,IAAA,uCAAoB,GAAE,CAAC;IACpD,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,EAAE,CAAC;IACxB,MAAM,SAAS,GAAG,IAAA,eAAM,GAAE,CAAC;IAC3B,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,GAAG,GAAG,cAAc,CAAC,CAAC;IAEjD,MAAM,EAAE,CAAA;;cAEI,SAAS,KAAK,IAAI,CAAC,EAAE,KAAK,SAAS,WAAW,SAAS;GAClE,CAAC;IACF,MAAM,EAAE,CAAA,qCAAqC,IAAI,IAAI,CAAC,GAAG,CAAC,eAAe,IAAI,CAAC,EAAE,EAAE,CAAC;IAEnF,MAAM,WAAW,GAAG,MAAM,eAAe,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;IAEvD,IAAI,cAAc,GAAkB,IAAI,CAAC;IACzC,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7B,cAAc,GAAG,WAAW,CAAC,CAAC,CAAE,CAAC,QAAQ,CAAC;QAC1C,MAAM,EAAE,CAAA,8CAA8C,cAAc,eAAe,SAAS,EAAE,CAAC;QAC/F,MAAM,iBAAiB,CAAC,EAAE,EAAE,cAAc,EAAE,IAAI,CAAC,EAAE,EAAE;YACnD,MAAM,EAAE,OAAO;YACf,YAAY,EAAE,cAAc;YAC5B,UAAU,EAAE,SAAS;YACrB,EAAE,EAAE,KAAK,CAAC,EAAE;YACZ,SAAS,EAAE,KAAK,CAAC,SAAS;SAC3B,CAAC,CAAC;IACL,CAAC;IAED,OAAO;QACL,KAAK;QACL,IAAI,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,QAAQ,EAAE,IAAI,CAAC,SAAS,EAAE,QAAQ,EAAE,IAAI,CAAC,SAAS,EAAE;QAC5F,WAAW;QACX,cAAc;KACf,CAAC;AACJ,CAAC;AAED,qFAAqF;AAC9E,KAAK,UAAU,eAAe,CAAC,EAAM,EAAE,MAAc;IAC1D,OAAO,IAAA,wBAAW,EAAC,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE;QAC9C,MAAM,IAAI,GAAG,MAAM,EAAE,CAEpB;;;;0BAIqB,MAAM;;KAE3B,CAAC;QACF,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACtB,QAAQ,EAAE,CAAC,CAAC,SAAS;YACrB,UAAU,EAAE,CAAC,CAAC,IAAI;YAClB,UAAU,EAAE,CAAC,CAAC,YAAY;YAC1B,MAAM,EAAE,CAAC,CAAC,MAAM;SACjB,CAAC,CAAC,CAAC;IACN,CAAC,CAAC,CAAC;AACL,CAAC;AAED,0EAA0E;AACnE,KAAK,UAAU,YAAY,CAChC,EAAM,EACN,KAAyD;IAEzD,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC,EAAE,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;IACzD,MAAM,WAAW,GAAG,MAAM,eAAe,CAAC,EAAE,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IAC/D,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ,CAAC,CAAC;IACvE,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,uBAAc,CAAC,oCAAoC,CAAC,CAAC;IACjE,CAAC;IACD,MAAM,EAAE,CAAA;iDACuC,KAAK,CAAC,QAAQ,eAAe,OAAO,CAAC,EAAE;GACrF,CAAC;IACF,OAAO,IAAA,wBAAW,EAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE;QACzF,MAAM,WAAW,GAAG,MAAM,IAAA,kCAAmB,EAAC,EAAE,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;QACnE,MAAM,IAAA,sBAAW,EAAC,EAAE,EAAE;YACpB,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,MAAM,EAAE,eAAe;YACvB,YAAY,EAAE,QAAQ;YACtB,UAAU,EAAE,KAAK,CAAC,QAAQ;YAC1B,EAAE,EAAE,KAAK,CAAC,EAAE;YACZ,SAAS,EAAE,KAAK,CAAC,SAAS;SAC3B,CAAC,CAAC;QACH,OAAO;YACL,MAAM,EAAE,OAAO,CAAC,OAAO;YACvB,QAAQ,EAAE,OAAO,CAAC,SAAS;YAC3B,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,WAAW;SACZ,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACI,KAAK,UAAU,YAAY,CAChC,EAAM,EACN,KAAa,EACb,QAAe,UAAU;IAEzB,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;IAC1D,IAAI,CAAC,OAAO,CAAC,gBAAgB,EAAE,CAAC;QAC9B,MAAM,IAAI,0BAAiB,CAAC,4CAA4C,CAAC,CAAC;IAC5E,CAAC;IACD,MAAM,QAAQ,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAC1C,OAAO,IAAA,wBAAW,EAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE;QACzE,MAAM,WAAW,GAAG,MAAM,IAAA,kCAAmB,EAAC,EAAE,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;QACnE,MAAM,GAAG,GAAgB;YACvB,MAAM,EAAE,OAAO,CAAC,OAAO;YACvB,QAAQ,EAAE,OAAO,CAAC,SAAS;YAC3B,QAAQ;YACR,WAAW;SACZ,CAAC;QACF,IAAI,OAAO,CAAC,SAAS,KAAK,eAAe,EAAE,CAAC;YAC1C,GAAG,CAAC,QAAQ,GAAG,MAAM,IAAA,iCAAiB,EAAC,EAAE,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;QAC9D,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC,CAAC,CAAC;AACL,CAAC;AASD,KAAK,UAAU,iBAAiB,CAC9B,EAAM,EACN,KAAa,EACb,QAAe,UAAU;IAEzB,MAAM,IAAI,GAAG,MAAM,EAAE,CAAc;;;;2BAIV,IAAA,4BAAS,EAAC,KAAK,CAAC;;2BAEhB,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;;GAE7C,CAAC;IACF,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,MAAM,IAAI,0BAAiB,CAAC,6BAA6B,CAAC,CAAC;IACzE,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC;AACjB,CAAC;AAED,oFAAoF;AAC7E,KAAK,UAAU,kBAAkB,CAAC,EAAM,EAAE,KAAa;IAC5D,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;IACnD,OAAO,eAAe,CAAC,EAAE,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;AAC9C,CAAC;AAED,wFAAwF;AACjF,KAAK,UAAU,eAAe,CACnC,EAAM,EACN,KAAa;IAEb,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;IACnD,MAAM,QAAQ,GAAG,MAAM,IAAA,wBAAW,EAAC,EAAE,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,CACzE,IAAA,mCAAmB,EAAC,EAAE,EAAE,OAAO,CAAC,OAAO,CAAC,CACzC,CAAC;IACF,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,SAAS,EAAE,QAAQ,EAAE,CAAC;AACnD,CAAC;AAED,gCAAgC;AACzB,KAAK,UAAU,MAAM,CAAC,EAAM,EAAE,KAAa;IAChD,MAAM,EAAE,CAAA,iEAAiE,IAAA,4BAAS,EAAC,KAAK,CAAC,EAAE,CAAC;AAC9F,CAAC;AAED,KAAK,UAAU,iBAAiB,CAC9B,EAAM,EACN,QAAgB,EAChB,OAAe,EACf,KAAwC;IAExC,MAAM,IAAA,wBAAW,EAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,IAAA,sBAAW,EAAC,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC;AACvF,CAAC"}
+{"version":3,"file":"service.js","sourceRoot":"","sources":["../../../src/auth/service.ts"],"names":[],"mappings":";;AA6EA,wDA4CC;AAGD,sBAwDC;AAGD,0CAkBC;AAGD,oCA+BC;AAMD,oCAwBC;AA+BD,gDAGC;AAGD,0CASC;AAGD,wBAEC;AAQD,wCA6BC;AAjWD,0CAMuB;AAGvB,iDAA+C;AAC/C,gDAAgD;AAChD,uDAA2D;AAC3D,2DAA4D;AAC5D,6DAAoF;AACpF,+CAA6D;AAC7D,yDAAqE;AAErE,MAAM,cAAc,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,MAAM;AAyClD,MAAM,UAAU,GAAU,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;AAEpD;;;;;;;;;;;;;;;;GAgBG;AACI,KAAK,UAAU,sBAAsB,CAC1C,EAAM,EACN,KAOC;IAED,MAAM,IAAI,GAAG,MAAM,EAAE,CAAkB;;cAE3B,IAAA,eAAM,GAAE,KAAK,KAAK,CAAC,KAAK,KAAK,KAAK,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ,IAAI,OAAO;;;;GAIpF,CAAC;IACF,MAAM,MAAM,GAAG,IAAI,CAAC,CAAC,CAAE,CAAC,EAAE,CAAC;IAE3B,8EAA8E;IAC9E,+EAA+E;IAC/E,yEAAyE;IACzE,MAAM,OAAO,GAAG,KAAK,CAAC,iBAAiB;QACrC,CAAC,CAAC,MAAM,EAAE,CAAuB;;kBAEnB,MAAM,KAAK,IAAA,0BAAY,EAAC,KAAK,CAAC,QAAQ,CAAC;;;OAGlD;QACH,CAAC,CAAC,MAAM,EAAE,CAAuB;;kBAEnB,MAAM,KAAK,IAAA,0BAAY,EAAC,KAAK,CAAC,QAAQ,CAAC;;;OAGlD,CAAC;IAEN,OAAO;QACL,EAAE,EAAE,MAAM;QACV,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,OAAO;QACnC,cAAc,EAAE,OAAO,CAAC,MAAM,GAAG,CAAC;KACnC,CAAC;AACJ,CAAC;AAED,mFAAmF;AAC5E,KAAK,UAAU,KAAK,CACzB,EAAM,EACN,KAAyD,EACzD,QAAe,UAAU;IAEzB,MAAM,KAAK,GAAG,MAAM,EAAE,CAErB;;gCAE6B,KAAK,CAAC,KAAK;GACxC,CAAC;IACF,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IACtB,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QACtC,MAAM,IAAI,0BAAiB,CAAC,uBAAuB,CAAC,CAAC;IACvD,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,EAAE,CAA4D;sFACE,IAAI,CAAC,EAAE;GAC1F,CAAC;IACF,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,IAAA,4BAAc,EAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,EAAE,CAAC;QACzE,MAAM,IAAI,0BAAiB,CAAC,uBAAuB,CAAC,CAAC;IACvD,CAAC;IACD,MAAM,kBAAkB,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,oBAAoB,CAAC;IAEzD,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,IAAA,uCAAoB,GAAE,CAAC;IACpD,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,EAAE,CAAC;IACxB,MAAM,SAAS,GAAG,IAAA,eAAM,GAAE,CAAC;IAC3B,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,GAAG,GAAG,cAAc,CAAC,CAAC;IAEjD,MAAM,EAAE,CAAA;;cAEI,SAAS,KAAK,IAAI,CAAC,EAAE,KAAK,SAAS,WAAW,SAAS;GAClE,CAAC;IACF,MAAM,EAAE,CAAA,qCAAqC,IAAI,IAAI,CAAC,GAAG,CAAC,eAAe,IAAI,CAAC,EAAE,EAAE,CAAC;IAEnF,MAAM,WAAW,GAAG,MAAM,eAAe,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;IAEvD,IAAI,cAAc,GAAkB,IAAI,CAAC;IACzC,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7B,cAAc,GAAG,WAAW,CAAC,CAAC,CAAE,CAAC,QAAQ,CAAC;QAC1C,MAAM,EAAE,CAAA,8CAA8C,cAAc,eAAe,SAAS,EAAE,CAAC;QAC/F,MAAM,iBAAiB,CAAC,EAAE,EAAE,cAAc,EAAE,IAAI,CAAC,EAAE,EAAE;YACnD,MAAM,EAAE,OAAO;YACf,YAAY,EAAE,cAAc;YAC5B,UAAU,EAAE,SAAS;YACrB,EAAE,EAAE,KAAK,CAAC,EAAE;YACZ,SAAS,EAAE,KAAK,CAAC,SAAS;SAC3B,CAAC,CAAC;IACL,CAAC;IAED,OAAO;QACL,KAAK;QACL,IAAI,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,QAAQ,EAAE,IAAI,CAAC,SAAS,EAAE,QAAQ,EAAE,IAAI,CAAC,SAAS,EAAE;QAC5F,WAAW;QACX,cAAc;QACd,kBAAkB;KACnB,CAAC;AACJ,CAAC;AAED,qFAAqF;AAC9E,KAAK,UAAU,eAAe,CAAC,EAAM,EAAE,MAAc;IAC1D,OAAO,IAAA,wBAAW,EAAC,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE;QAC9C,MAAM,IAAI,GAAG,MAAM,EAAE,CAEpB;;;;0BAIqB,MAAM;;KAE3B,CAAC;QACF,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACtB,QAAQ,EAAE,CAAC,CAAC,SAAS;YACrB,UAAU,EAAE,CAAC,CAAC,IAAI;YAClB,UAAU,EAAE,CAAC,CAAC,YAAY;YAC1B,MAAM,EAAE,CAAC,CAAC,MAAM;SACjB,CAAC,CAAC,CAAC;IACN,CAAC,CAAC,CAAC;AACL,CAAC;AAED,0EAA0E;AACnE,KAAK,UAAU,YAAY,CAChC,EAAM,EACN,KAAyD;IAEzD,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC,EAAE,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;IACzD,MAAM,WAAW,GAAG,MAAM,eAAe,CAAC,EAAE,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IAC/D,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ,CAAC,CAAC;IACvE,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,uBAAc,CAAC,oCAAoC,CAAC,CAAC;IACjE,CAAC;IACD,MAAM,EAAE,CAAA;iDACuC,KAAK,CAAC,QAAQ,eAAe,OAAO,CAAC,EAAE;GACrF,CAAC;IACF,OAAO,IAAA,wBAAW,EAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE;QACzF,MAAM,WAAW,GAAG,MAAM,IAAA,kCAAmB,EAAC,EAAE,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;QACnE,MAAM,IAAA,sBAAW,EAAC,EAAE,EAAE;YACpB,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,MAAM,EAAE,eAAe;YACvB,YAAY,EAAE,QAAQ;YACtB,UAAU,EAAE,KAAK,CAAC,QAAQ;YAC1B,EAAE,EAAE,KAAK,CAAC,EAAE;YACZ,SAAS,EAAE,KAAK,CAAC,SAAS;SAC3B,CAAC,CAAC;QACH,OAAO;YACL,MAAM,EAAE,OAAO,CAAC,OAAO;YACvB,QAAQ,EAAE,OAAO,CAAC,SAAS;YAC3B,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,WAAW;YACX,kBAAkB,EAAE,OAAO,CAAC,oBAAoB;SACjD,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACI,KAAK,UAAU,YAAY,CAChC,EAAM,EACN,KAAa,EACb,QAAe,UAAU;IAEzB,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;IAC1D,IAAI,CAAC,OAAO,CAAC,gBAAgB,EAAE,CAAC;QAC9B,MAAM,IAAI,0BAAiB,CAAC,4CAA4C,CAAC,CAAC;IAC5E,CAAC;IACD,MAAM,QAAQ,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAC1C,OAAO,IAAA,wBAAW,EAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE;QACzE,MAAM,WAAW,GAAG,MAAM,IAAA,kCAAmB,EAAC,EAAE,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;QACnE,MAAM,GAAG,GAAgB;YACvB,MAAM,EAAE,OAAO,CAAC,OAAO;YACvB,QAAQ,EAAE,OAAO,CAAC,SAAS;YAC3B,QAAQ;YACR,WAAW;YACX,kBAAkB,EAAE,OAAO,CAAC,oBAAoB;SACjD,CAAC;QACF,IAAI,OAAO,CAAC,SAAS,KAAK,eAAe,EAAE,CAAC;YAC1C,GAAG,CAAC,QAAQ,GAAG,MAAM,IAAA,iCAAiB,EAAC,EAAE,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;QAC9D,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC,CAAC,CAAC;AACL,CAAC;AAUD,KAAK,UAAU,iBAAiB,CAC9B,EAAM,EACN,KAAa,EACb,QAAe,UAAU;IAEzB,MAAM,IAAI,GAAG,MAAM,EAAE,CAAc;;;;;;2BAMV,IAAA,4BAAS,EAAC,KAAK,CAAC;;2BAEhB,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;;GAE7C,CAAC;IACF,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,MAAM,IAAI,0BAAiB,CAAC,6BAA6B,CAAC,CAAC;IACzE,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC;AACjB,CAAC;AAED,oFAAoF;AAC7E,KAAK,UAAU,kBAAkB,CAAC,EAAM,EAAE,KAAa;IAC5D,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;IACnD,OAAO,eAAe,CAAC,EAAE,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;AAC9C,CAAC;AAED,wFAAwF;AACjF,KAAK,UAAU,eAAe,CACnC,EAAM,EACN,KAAa;IAEb,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;IACnD,MAAM,QAAQ,GAAG,MAAM,IAAA,wBAAW,EAAC,EAAE,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,CACzE,IAAA,mCAAmB,EAAC,EAAE,EAAE,OAAO,CAAC,OAAO,CAAC,CACzC,CAAC;IACF,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,SAAS,EAAE,QAAQ,EAAE,CAAC;AACnD,CAAC;AAED,gCAAgC;AACzB,KAAK,UAAU,MAAM,CAAC,EAAM,EAAE,KAAa;IAChD,MAAM,EAAE,CAAA,8BAA8B,IAAA,4BAAS,EAAC,KAAK,CAAC,GAAG,CAAC;AAC5D,CAAC;AAED;;;;;GAKG;AACI,KAAK,UAAU,cAAc,CAClC,EAAM,EACN,IAA0C,EAC1C,KAAsE;IAEtE,IAAI,KAAK,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,wBAAe,CAAC,6CAA6C,CAAC,CAAC;IAC3E,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,EAAE,CAA4D;sFACE,IAAI,CAAC,MAAM;GAC9F,CAAC;IACF,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,IAAA,4BAAc,EAAC,KAAK,CAAC,eAAe,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,EAAE,CAAC;QAChF,MAAM,IAAI,0BAAiB,CAAC,uBAAuB,CAAC,CAAC;IACvD,CAAC;IACD,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,oBAAoB,CAAC;IAEhD,MAAM,IAAA,wBAAW,EAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE;QACnF,sEAAsE;QACtE,qEAAqE;QACrE,MAAM,EAAE,CAAA,4BAA4B,IAAI,CAAC,MAAM,KAAK,IAAA,0BAAY,EAAC,KAAK,CAAC,WAAW,CAAC,UAAU,CAAC;QAC9F,MAAM,IAAA,sBAAW,EAAC,EAAE,EAAE;YACpB,OAAO,EAAE,IAAI,CAAC,MAAM;YACpB,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC,qCAAqC,CAAC,CAAC,CAAC,kBAAkB;YAC9E,YAAY,EAAE,MAAM;YACpB,UAAU,EAAE,IAAI,CAAC,MAAM;YACvB,EAAE,EAAE,KAAK,CAAC,EAAE;YACZ,SAAS,EAAE,KAAK,CAAC,SAAS;SAC3B,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,iBAAiB,CAC9B,EAAM,EACN,QAAgB,EAChB,OAAe,EACf,KAAwC;IAExC,MAAM,IAAA,wBAAW,EAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,IAAA,sBAAW,EAAC,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC;AACvF,CAAC"}