@betterportal/auth-default 10.6.21 → 10.6.22

package/lib/plugins/service-betterportal-auth-default/index.d.ts

@@ -1,8 +1,12 @@
 import { type BSBServiceConstructor, type Observable } from "@bsb/base";
 import * as av from "anyvali";
 import { BPService, type BPServiceDefinition } from "@betterportal/plugin-bsb";
-import { type BpTokenIssuer, type JwtVerifier, type TenantAppValidation } from "@betterportal/framework";
-import { UserStore } from "../../userStore.js";
+import { type BpTokenIssuer, type JwtVerifier, type JwtClaims, type ElevationRequirement, type TenantAppValidation } from "@betterportal/framework";
+import type { BetterPortalEvent } from "@betterportal/framework/lib/runtime/h3.js";
+import { type Scope } from "../../storage.js";
+import { IdentityService, type IdentityPolicy } from "../../identity.js";
+import { Factors } from "../../factors.js";
+import { MailQueue } from "../../mail.js";
 declare const PluginConfigSchema: av.ObjectSchema<{
     host: av.StringSchema;
     port: av.IntSchema;
@@ -12,6 +16,10 @@ declare const PluginConfigSchema: av.ObjectSchema<{
     refreshTokenSeconds: av.IntSchema;
     keyStorePath: av.StringSchema;
     userStorePath: av.StringSchema;
+    mode: av.EnumSchema<readonly ["simple", "advanced"]>;
+    postgresUrl: av.StringSchema;
+    encryptionKey: av.StringSchema;
+    setupToken: av.StringSchema;
     betterportal: av.OptionalSchema<av.ObjectSchema<{
         bpConfigPath: av.OptionalSchema<av.StringSchema>;
         configApiToken: av.OptionalSchema<av.StringSchema>;
@@ -34,6 +42,10 @@ declare const Config: import("@bsb/base").BSBPluginConfigClass<av.ObjectSchema<{
     refreshTokenSeconds: av.IntSchema;
     keyStorePath: av.StringSchema;
     userStorePath: av.StringSchema;
+    mode: av.EnumSchema<readonly ["simple", "advanced"]>;
+    postgresUrl: av.StringSchema;
+    encryptionKey: av.StringSchema;
+    setupToken: av.StringSchema;
     betterportal: av.OptionalSchema<av.ObjectSchema<{
         bpConfigPath: av.OptionalSchema<av.StringSchema>;
         configApiToken: av.OptionalSchema<av.StringSchema>;
@@ -55,8 +67,15 @@ declare const EventSchemas: {
     readonly onBroadcast: {};
 };
 export interface AuthRuntime {
+    readonly clientAddress?: (event: BetterPortalEvent) => string | undefined;
     readonly tokenIssuer: BpTokenIssuer;
-    readonly userStore: UserStore;
+    readonly identity: IdentityService;
+    readonly factors: Factors;
+    readonly mail: MailQueue;
+    readonly policy: (scope: Scope) => Promise<IdentityPolicy>;
+    readonly isManagement: (scope: Scope) => boolean;
+    readonly verifySetup: (token: string) => boolean;
+    readonly configuration: (scope: Scope) => Record<string, unknown>;
     readonly accessTokenSeconds: number;
     readonly refreshTokenSeconds: number;
 }
@@ -70,6 +89,10 @@ export declare class Plugin extends BPService<InstanceType<typeof Config>, typeo
         refreshTokenSeconds: av.IntSchema;
         keyStorePath: av.StringSchema;
         userStorePath: av.StringSchema;
+        mode: av.EnumSchema<readonly ["simple", "advanced"]>;
+        postgresUrl: av.StringSchema;
+        encryptionKey: av.StringSchema;
+        setupToken: av.StringSchema;
         betterportal: av.OptionalSchema<av.ObjectSchema<{
             bpConfigPath: av.OptionalSchema<av.StringSchema>;
             configApiToken: av.OptionalSchema<av.StringSchema>;
@@ -91,7 +114,11 @@ export declare class Plugin extends BPService<InstanceType<typeof Config>, typeo
         readonly onBroadcast: {};
     };
     private keyPair;
-    private userStore;
+    private identity;
+    private factors;
+    private mail;
+    private setupSecret;
+    private mailTimer?;
     constructor(cfg: BSBServiceConstructor<InstanceType<typeof Config>, typeof EventSchemas>);
     protected definition(): BPServiceDefinition;
     init(obs: Observable): Promise<void>;
@@ -102,6 +129,16 @@ export declare class Plugin extends BPService<InstanceType<typeof Config>, typeo
      */
     protected getJwtVerifier(_tenantId: string, _appId: string): JwtVerifier | undefined;
     protected validateTenantApp(tenantId: string, appId: string): Promise<TenantAppValidation>;
+    dispose(): Promise<void>;
+    protected mutateServiceConfiguration<T>(tenantId: string, appId: string | undefined, values: Record<string, unknown>, write: () => T | Promise<T>): Promise<T>;
+    private isManagement;
+    private policy;
+    private mailConfiguration;
+    protected beginAuthElevation(claims: JwtClaims, requirement: ElevationRequirement, event: BetterPortalEvent, actionContext?: Record<string, string>): Promise<Record<string, unknown>>;
+    protected finishAuthElevation(claims: JwtClaims, body: Record<string, unknown>, _event: BetterPortalEvent): Promise<{
+        user: JwtClaims;
+        assurance: "confirmed" | "mfa";
+    }>;
     private tokenIssuer;
 }
 export type PluginFeature = Pick<Plugin, "runtime">;

package/lib/plugins/service-betterportal-auth-default/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/plugins/service-betterportal-auth-default/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,qBAAqB,EAG1B,KAAK,UAAU,EAChB,MAAM,WAAW,CAAC;AACnB,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAE9B,OAAO,EAEL,SAAS,EACT,KAAK,mBAAmB,EACzB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAIL,KAAK,aAAa,EAClB,KAAK,WAAW,EAEhB,KAAK,mBAAmB,EACzB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAE/C,QAAA,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;EAUtB,CAAC;AACH,MAAM,MAAM,gBAAgB,GAAG,EAAE,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAEnE,QAAA,MAAM,MAAM;;;;;;;;;;;;;;;;;;;;GASX,CAAC;AAEF,QAAA,MAAM,YAAY;;;;;;;CAOhB,CAAC;AAEH,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,WAAW,EAAE,aAAa,CAAC;IACpC,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;CACtC;AAED,qBAAa,MAAO,SAAQ,SAAS,CAAC,YAAY,CAAC,OAAO,MAAM,CAAC,EAAE,OAAO,YAAY,CAAC;IACrF,MAAM,CAAC,MAAM;;;;;;;;;;;;;;;;;;;;QAAU;IACvB,MAAM,CAAC,YAAY;;;;;;;MAAgB;IAEnC,OAAO,CAAC,OAAO,CAAc;IAC7B,OAAO,CAAC,SAAS,CAAa;gBAElB,GAAG,EAAE,qBAAqB,CAAC,YAAY,CAAC,OAAO,MAAM,CAAC,EAAE,OAAO,YAAY,CAAC;IAIxF,SAAS,CAAC,UAAU,IAAI,mBAAmB;IAWrC,IAAI,CAAC,GAAG,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;IAuB1C,IAAI,OAAO,IAAI,WAAW,CAOzB;IAED;;;OAGG;IACH,SAAS,CAAC,cAAc,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,WAAW,GAAG,SAAS;cAIpE,iBAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC;IAQhG,OAAO,CAAC,WAAW;CASpB;AAED,MAAM,MAAM,aAAa,GAAG,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;AAEpD,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/plugins/service-betterportal-auth-default/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,qBAAqB,EAG1B,KAAK,UAAU,EAChB,MAAM,WAAW,CAAC;AACnB,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAI9B,OAAO,EAEL,SAAS,EACT,KAAK,mBAAmB,EACzB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAKL,KAAK,aAAa,EAClB,KAAK,WAAW,EAEhB,KAAK,SAAS,EACd,KAAK,oBAAoB,EACzB,KAAK,mBAAmB,EACzB,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,2CAA2C,CAAC;AACnF,OAAO,EAAgC,KAAK,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAC5E,OAAO,EAAa,eAAe,EAA6B,KAAK,cAAc,EAAa,MAAM,mBAAmB,CAAC;AAC1H,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAC3C,OAAO,EAAE,SAAS,EAAsD,MAAM,eAAe,CAAC;AAK9F,QAAA,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;EActB,CAAC;AACH,MAAM,MAAM,gBAAgB,GAAG,EAAE,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAEnE,QAAA,MAAM,MAAM;;;;;;;;;;;;;;;;;;;;;;;;GASX,CAAC;AAEF,QAAA,MAAM,YAAY;;;;;;;CAOhB,CAAC;AAEH,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC,KAAK,EAAE,iBAAiB,KAAK,MAAM,GAAG,SAAS,CAAC;IAC1E,QAAQ,CAAC,WAAW,EAAE,aAAa,CAAC;IACpC,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAC;IACnC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,OAAO,CAAC,cAAc,CAAC,CAAC;IAC3D,QAAQ,CAAC,YAAY,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,OAAO,CAAC;IACjD,QAAQ,CAAC,WAAW,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC;IACjD,QAAQ,CAAC,aAAa,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClE,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;CACtC;AAED,qBAAa,MAAO,SAAQ,SAAS,CAAC,YAAY,CAAC,OAAO,MAAM,CAAC,EAAE,OAAO,YAAY,CAAC;IACrF,MAAM,CAAC,MAAM;;;;;;;;;;;;;;;;;;;;;;;;QAAU;IACvB,MAAM,CAAC,YAAY;;;;;;;MAAgB;IAEnC,OAAO,CAAC,OAAO,CAAc;IAC7B,OAAO,CAAC,QAAQ,CAAmB;IACnC,OAAO,CAAC,OAAO,CAAW;IAC1B,OAAO,CAAC,IAAI,CAAa;IACzB,OAAO,CAAC,WAAW,CAAM;IACzB,OAAO,CAAC,SAAS,CAAC,CAAiC;gBAEvC,GAAG,EAAE,qBAAqB,CAAC,YAAY,CAAC,OAAO,MAAM,CAAC,EAAE,OAAO,YAAY,CAAC;IAIxF,SAAS,CAAC,UAAU,IAAI,mBAAmB;IAYrC,IAAI,CAAC,GAAG,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;IA6C1C,IAAI,OAAO,IAAI,WAAW,CAczB;IAED;;;OAGG;IACH,SAAS,CAAC,cAAc,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,WAAW,GAAG,SAAS;cAIpE,iBAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC;IAS1F,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;cAMd,0BAA0B,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;IAiDpK,OAAO,CAAC,YAAY;YAKN,MAAM;IAcpB,OAAO,CAAC,iBAAiB;cAMT,kBAAkB,CAAC,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,oBAAoB,EAAE,KAAK,EAAE,iBAAiB,EAAE,aAAa,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;cAchL,mBAAmB,CAAC,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,EAAE,iBAAiB,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,SAAS,CAAC;QAAC,SAAS,EAAE,WAAW,GAAG,KAAK,CAAA;KAAE,CAAC;IAiB9K,OAAO,CAAC,WAAW;CASpB;AAED,MAAM,MAAM,aAAa,GAAG,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;AAEpD,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC"}

package/lib/plugins/service-betterportal-auth-default/index.js

@@ -1,9 +1,17 @@
 import { createConfigSchema, createEventSchemas } from "@bsb/base";
 import * as av from "anyvali";
+import { existsSync, readFileSync } from "node:fs";
+import { randomBytes, createHash } from "node:crypto";
 import { resolve } from "node:path";
 import { BetterPortalConfigSchema, BPService } from "@betterportal/plugin-bsb";
-import { createBpTokenIssuer, loadOrGenerateKeyPair, publicKeyToJwk } from "@betterportal/framework";
-import { UserStore } from "../../userStore.js";
+import { ServiceConfigWriteError, createBpTokenIssuer, loadOrGenerateKeyPair, publicKeyToJwk } from "@betterportal/framework";
+import { atomicWrite, openAuthStorage } from "../../storage.js";
+import { AuthError, IdentityService, SecretCipher, equalSecret } from "../../identity.js";
+import { Factors } from "../../factors.js";
+import { MailQueue, parseMailHeaders, validateMailUrl } from "../../mail.js";
+import { clientAddress } from "../../clientAddress.js";
+import { AuthConfigSchemas } from "../../config.js";
+import { parseSocialConnections } from "../../social.js";
 const PluginConfigSchema = av.object({
     host: av.string().minLength(1).default("0.0.0.0"),
     port: av.int().min(1).default(80),
@@ -13,11 +21,15 @@ const PluginConfigSchema = av.object({
     refreshTokenSeconds: av.int().min(1).default(60 * 60 * 24 * 7),
     keyStorePath: av.string().minLength(1).default("./.bp-auth-state/keys.json"),
     userStorePath: av.string().minLength(1).default("./.bp-auth-state/users.json"),
+    mode: av.enum_(["simple", "advanced"]).default("simple"),
+    postgresUrl: av.string().default(""),
+    encryptionKey: av.string().default(""),
+    setupToken: av.string().default(""),
     betterportal: BetterPortalConfigSchema
 });
 const Config = createConfigSchema({
     name: "service-betterportal-auth-default",
-    description: "Default BetterPortal v10 auth service: JWKS, login/logout/refresh, bcrypt user store",
+    description: "Default BetterPortal auth: app-scoped accounts, social sign-in, MFA and JWT sessions",
     tags: ["betterportal", "auth", "jwt", "jwks"],
     documentation: ["./README.md"],
     image: "./betterportal-logo.png"
@@ -34,7 +46,11 @@ export class Plugin extends BPService {
     static Config = Config;
     static EventSchemas = EventSchemas;
     keyPair;
-    userStore;
+    identity;
+    factors;
+    mail;
+    setupSecret = "";
+    mailTimer;
     constructor(cfg) {
         super({ ...cfg, eventSchemas: EventSchemas });
     }
@@ -43,18 +59,51 @@ export class Plugin extends BPService {
             manifest: {
                 pluginId: "org.betterportal.auth.default",
                 title: "BetterPortal Default Auth",
-                description: "JWT-issuing auth service (RS256 + JWKS + bcrypt user store).",
-                capabilities: ["auth"]
+                description: "JWT-issuing auth service with isolated account directories, MFA and JSON/PostgreSQL storage.",
+                capabilities: ["auth"],
+                configSchemas: AuthConfigSchemas
             }
         };
     }
     async init(obs) {
         const cfg = this.config;
+        if (cfg.mode === "advanced" && !cfg.setupToken)
+            throw new Error("Advanced auth requires a setupToken shared by all replicas");
+        if (cfg.mode === "advanced" && !existsSync(resolve(cfg.keyStorePath)))
+            throw new Error("Advanced auth requires provisioned signing keys shared by its replicas");
         this.keyPair = loadOrGenerateKeyPair(resolve(cfg.keyStorePath));
-        this.userStore = new UserStore(resolve(cfg.userStorePath));
         await super.init(obs);
+        const keyPath = `${resolve(cfg.userStorePath)}.crypto.json`;
+        const localKey = existsSync(keyPath) ? JSON.parse(readFileSync(keyPath, "utf8")).key : undefined;
+        if (cfg.mode === "advanced" && !cfg.encryptionKey)
+            throw new Error("Advanced auth requires a shared encryptionKey (base64, 32 bytes); use the existing crypto file key when migrating");
+        if (localKey && cfg.encryptionKey && localKey !== cfg.encryptionKey)
+            throw new Error("Encryption key differs from the Simple store key");
+        const encryptionKey = cfg.encryptionKey || localKey || randomBytes(32).toString("base64");
+        if (!localKey)
+            atomicWrite(keyPath, { key: encryptionKey });
+        const portal = this.getPortalConfig();
+        const appIds = {};
+        for (const app of portal?.apps ?? [])
+            (appIds[app.tenantId] ??= []).push(app.id);
+        const storage = await openAuthStorage({ mode: cfg.mode, path: cfg.userStorePath, connectionString: cfg.postgresUrl, installationId: createHash("sha256").update(cfg.issuer).digest("hex"), appIds });
+        this.identity = new IdentityService(storage, new SecretCipher(Buffer.from(encryptionKey, "base64")));
+        this.factors = new Factors(this.identity);
+        this.mail = new MailQueue(this.identity, scope => this.mailConfiguration(scope));
+        const setupPath = `${resolve(cfg.userStorePath)}.setup.json`;
+        if (cfg.setupToken)
+            this.setupSecret = cfg.setupToken;
+        else if (existsSync(setupPath))
+            this.setupSecret = JSON.parse(readFileSync(setupPath, "utf8")).token;
+        else {
+            this.setupSecret = randomBytes(32).toString("base64url");
+            atomicWrite(setupPath, { token: this.setupSecret });
+        }
+        this.mailTimer = setInterval(() => { void this.mail.drain().catch(() => obs.log.error("Auth mail delivery queue unavailable")); }, 15000);
+        this.mailTimer.unref();
         const jwk = publicKeyToJwk(this.keyPair.publicKeyPem, this.keyPair.kid);
         this.registerAsAuthProvider({
+            tokenIssuer: this.tokenIssuer(),
             issuer: cfg.issuer,
             audience: cfg.audience,
             jwksUri: `${cfg.issuer.replace(/\/+$/, "")}/.well-known/jwks.json`,
@@ -68,8 +117,15 @@ export class Plugin extends BPService {
     }
     get runtime() {
         return {
+            clientAddress: event => clientAddress(event, this.bp),
             tokenIssuer: this.tokenIssuer(),
-            userStore: this.userStore,
+            identity: this.identity,
+            factors: this.factors,
+            mail: this.mail,
+            policy: scope => this.policy(scope),
+            isManagement: scope => this.isManagement(scope),
+            verifySetup: token => !!this.setupSecret && equalSecret(this.setupSecret, token),
+            configuration: scope => this.effectiveServiceConfig(scope.tenantId, scope.appId),
             accessTokenSeconds: this.config.accessTokenSeconds,
             refreshTokenSeconds: this.config.refreshTokenSeconds
         };
@@ -82,13 +138,153 @@ export class Plugin extends BPService {
         return this.tokenIssuer().verifier("access");
     }
     async validateTenantApp(tenantId, appId) {
+        if (!this.identity)
+            return { allowed: false, reason: "Auth storage is initializing" };
         if (await this.validateConfigScope(tenantId, appId))
-            return { allowed: true };
+            return this.config.mode === "simple" ? super.validateTenantApp(tenantId, appId) : { allowed: true };
         return {
             allowed: false,
             reason: `Default auth service is not activated for tenant ${tenantId} app ${appId}.`
         };
     }
+    async dispose() {
+        if (this.mailTimer)
+            clearInterval(this.mailTimer);
+        await super.dispose();
+        if (this.identity)
+            await this.identity.storage.close();
+    }
+    async mutateServiceConfiguration(tenantId, appId, values, write) {
+        if (!this.identity)
+            throw new ServiceConfigWriteError("Auth storage is initializing.", 503);
+        return this.identity.storage.transaction({ tenantId, appId: "" }, async (tx) => {
+            if (Object.hasOwn(values, "mailUrl") && values.mailUrl !== undefined && values.mailUrl !== "") {
+                try {
+                    validateMailUrl(values.mailUrl);
+                }
+                catch (error) {
+                    if (!(error instanceof AuthError))
+                        throw error;
+                    throw new ServiceConfigWriteError(error.message, 400);
+                }
+            }
+            if (Object.hasOwn(values, "mailHeaders")) {
+                try {
+                    parseMailHeaders(values.mailHeaders);
+                }
+                catch (error) {
+                    if (!(error instanceof AuthError))
+                        throw error;
+                    throw new ServiceConfigWriteError(error.message, 400);
+                }
+            }
+            if (Object.hasOwn(values, "socialConnections")) {
+                try {
+                    parseSocialConnections(values.socialConnections);
+                }
+                catch (error) {
+                    if (!(error instanceof AuthError))
+                        throw error;
+                    throw new ServiceConfigWriteError(error.message, 400);
+                }
+            }
+            if (appId && values.defaultRoleIds !== undefined) {
+                let roles;
+                try {
+                    roles = typeof values.defaultRoleIds === "string" ? JSON.parse(values.defaultRoleIds) : values.defaultRoleIds;
+                }
+                catch {
+                    throw new ServiceConfigWriteError("Default roles must be a JSON array.");
+                }
+                const allowed = this.getPortalConfig()?.apps.find(app => app.tenantId === tenantId && app.id === appId)?.auth?.roles.map(role => role.id) ?? [];
+                if (!Array.isArray(roles) || roles.some(id => typeof id !== "string" || id === "*" || !allowed.includes(id)))
+                    throw new ServiceConfigWriteError("Default roles must reference existing app roles and cannot include root.");
+            }
+            if (values.requireMfa !== undefined && typeof values.requireMfa !== "boolean")
+                throw new ServiceConfigWriteError("Require MFA must be a boolean.");
+            if (values.registration !== undefined && !["public", "invite-only", "closed"].includes(String(values.registration)))
+                throw new ServiceConfigWriteError("Choose a supported registration policy.");
+            if (Object.hasOwn(values, "directoryAdminAppId")) {
+                if (appId)
+                    throw new ServiceConfigWriteError("Directory administration can only be configured at tenant scope.");
+                if (values.directoryAdminAppId && !this.getPortalConfig()?.apps.some(app => app.tenantId === tenantId && app.id === values.directoryAdminAppId))
+                    throw new ServiceConfigWriteError("Choose a directory administration app in this tenant.");
+            }
+            if (Object.hasOwn(values, "userIsolation")) {
+                if (appId)
+                    throw new ServiceConfigWriteError("User isolation can only be configured at tenant scope.");
+                const settings = await tx.get("tenant", tenantId, { tenantId, appId: "" });
+                const isolation = values.userIsolation ?? settings?.isolation ?? "app";
+                if (isolation !== "app" && isolation !== "tenant")
+                    throw new ServiceConfigWriteError("Choose app or tenant isolation.");
+                if (settings?.lockedAt && settings.isolation !== isolation)
+                    throw new ServiceConfigWriteError("User isolation is permanently locked because this tenant has accounts.");
+                await tx.put("tenant", { tenantId, appId: "" }, { ...settings, id: tenantId, isolation });
+            }
+            return write();
+        });
+    }
+    isManagement(scope) {
+        const management = this.getPortalConfig()?.configManagement;
+        return !!management && management.adminTenantId === scope.tenantId && management.managementAppId === scope.appId;
+    }
+    async policy(scope) {
+        const tenant = this.effectiveServiceConfig(scope.tenantId);
+        const config = this.effectiveServiceConfig(scope.tenantId, scope.appId);
+        const requested = tenant.userIsolation;
+        if (requested !== undefined && requested !== "app" && requested !== "tenant")
+            throw new AuthError("Invalid user isolation configuration.", 503);
+        const isolation = await this.identity.effectiveIsolation(scope.tenantId, requested);
+        const registration = config.registration ?? "invite-only";
+        if (registration !== "public" && registration !== "invite-only" && registration !== "closed")
+            throw new AuthError("Invalid registration configuration.", 503);
+        const defaults = typeof config.defaultRoleIds === "string" ? JSON.parse(config.defaultRoleIds) : config.defaultRoleIds ?? [];
+        if (!Array.isArray(defaults) || defaults.some(v => typeof v !== "string"))
+            throw new AuthError("Default roles must be a JSON array.", 503);
+        const roles = this.getPortalConfig()?.apps.find(a => a.id === scope.appId && a.tenantId === scope.tenantId)?.auth?.roles ?? [];
+        return { isolation, registration, defaultRoleIds: defaults, allowedRoleIds: roles.map(r => r.id), requireMfa: config.requireMfa === true, canManageDirectory: isolation === "app" || tenant.directoryAdminAppId === scope.appId || this.isManagement(scope) };
+    }
+    mailConfiguration(scope) {
+        const config = this.effectiveServiceConfig(scope.tenantId, scope.appId);
+        if (!config.mailUrl || !config.mailFrom || !["postal", "http"].includes(String(config.mailTransport)))
+            return undefined;
+        return { transport: config.mailTransport, url: String(config.mailUrl), from: String(config.mailFrom), apiKey: String(config.mailApiKey ?? ""), headers: parseMailHeaders(config.mailHeaders) };
+    }
+    async beginAuthElevation(claims, requirement, event, actionContext = {}) {
+        const scope = { tenantId: claims.tenantId, appId: claims.appId };
+        const policy = await this.policy(scope);
+        const user = await this.identity.findUser(scope, policy, claims.sub, true);
+        if (!user?.enabled)
+            throw new AuthError("Account unavailable.");
+        await this.identity.storage.transaction(scope, tx => this.identity.assertActiveSession(tx, scope, claims, user));
+        await this.identity.rateLimit(scope, "elevation", user.id, 20);
+        const hasFactors = await this.factors.hasFactors(user);
+        if (!hasFactors && requirement.minimum === "mfa")
+            throw new AuthError("Enroll an authentication factor in your account settings first.");
+        const prepared = hasFactors ? await this.factors.prepare(user, event.req.headers.get("origin") ?? event.url.origin) : undefined;
+        const challenge = await this.identity.challenge(scope, "elevation", { jti: claims.jti, version: user.refreshVersion, actionContext, factor: prepared?.private ?? null }, user.id, Math.min(300, claims.exp - Math.floor(Date.now() / 1000)));
+        return { challengeId: challenge.id, secret: challenge.secret, method: hasFactors ? "factor" : "confirm", ...prepared?.public };
+    }
+    async finishAuthElevation(claims, body, _event) {
+        const scope = { tenantId: claims.tenantId, appId: claims.appId };
+        const policy = await this.policy(scope);
+        return this.identity.consume(scope, "elevation", String(body.challengeId ?? ""), String(body.secret ?? ""), async (challenge, tx) => {
+            const dir = { tenantId: scope.tenantId, appId: policy.isolation === "app" ? scope.appId : "" };
+            const user = await tx.get("user", claims.sub, dir);
+            if (!user?.enabled || user.refreshVersion !== challenge.data.version || challenge.data.jti !== claims.jti || challenge.userId !== user.id)
+                throw new AuthError("Session changed; sign in again.");
+            await this.identity.assertActiveSession(tx, scope, claims, user);
+            if (challenge.data.factor && challenge.data.factor.origin !== (_event.req.headers.get("origin") ?? _event.url.origin))
+                throw new AuthError("Verification belongs to another origin.");
+            if (challenge.data.factor)
+                await this.factors.complete(tx, scope, user, challenge.data.factor, body);
+            else if (body.confirm !== true)
+                throw new AuthError("Confirmation required.");
+            const roles = await this.identity.roles(tx, scope, user, policy);
+            await this.identity.audit(tx, scope, user.id, "auth.elevated", { reportedAction: challenge.data.actionContext ?? {} });
+            return { user: { ...claims, roles }, assurance: challenge.data.factor ? "mfa" : "confirmed" };
+        });
+    }
     tokenIssuer() {
         return createBpTokenIssuer({
             keyPair: this.keyPair,

package/lib/plugins/service-betterportal-auth-default/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/plugins/service-betterportal-auth-default/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,kBAAkB,EAClB,kBAAkB,EAEnB,MAAM,WAAW,CAAC;AACnB,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EACL,wBAAwB,EACxB,SAAS,EAEV,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,mBAAmB,EACnB,qBAAqB,EACrB,cAAc,EAKf,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAE/C,MAAM,kBAAkB,GAAG,EAAE,CAAC,MAAM,CAAC;IACnC,IAAI,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC;IACjD,IAAI,EAAE,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACjC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC;IAChC,QAAQ,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC;IAClE,kBAAkB,EAAE,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,GAAG,EAAE,CAAC;IACpD,mBAAmB,EAAE,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;IAC9D,YAAY,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,4BAA4B,CAAC;IAC5E,aAAa,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,6BAA6B,CAAC;IAC9E,YAAY,EAAE,wBAAwB;CACvC,CAAC,CAAC;AAGH,MAAM,MAAM,GAAG,kBAAkB,CAC/B;IACE,IAAI,EAAE,mCAAmC;IACzC,WAAW,EAAE,sFAAsF;IACnG,IAAI,EAAE,CAAC,cAAc,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC;IAC7C,aAAa,EAAE,CAAC,aAAa,CAAC;IAC9B,KAAK,EAAE,yBAAyB;CACjC,EACD,kBAAkB,CACnB,CAAC;AAEF,MAAM,YAAY,GAAG,kBAAkB,CAAC;IACtC,UAAU,EAAE,EAAE;IACd,QAAQ,EAAE,EAAE;IACZ,oBAAoB,EAAE,EAAE;IACxB,kBAAkB,EAAE,EAAE;IACtB,aAAa,EAAE,EAAE;IACjB,WAAW,EAAE,EAAE;CAChB,CAAC,CAAC;AASH,MAAM,OAAO,MAAO,SAAQ,SAA2D;IACrF,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,MAAM,CAAC,YAAY,GAAG,YAAY,CAAC;IAE3B,OAAO,CAAc;IACrB,SAAS,CAAa;IAE9B,YAAY,GAA4E;QACtF,KAAK,CAAC,EAAE,GAAG,GAAG,EAAE,YAAY,EAAE,YAAY,EAAE,CAAC,CAAC;IAChD,CAAC;IAES,UAAU;QAClB,OAAO;YACL,QAAQ,EAAE;gBACR,QAAQ,EAAE,+BAA+B;gBACzC,KAAK,EAAE,2BAA2B;gBAClC,WAAW,EAAE,8DAA8D;gBAC3E,YAAY,EAAE,CAAC,MAAM,CAAC;aACvB;SACF,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,GAAe;QACxB,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC;QAExB,IAAI,CAAC,OAAO,GAAG,qBAAqB,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC;QAChE,IAAI,CAAC,SAAS,GAAG,IAAI,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC;QAE3D,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAEtB,MAAM,GAAG,GAAG,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACxE,IAAI,CAAC,sBAAsB,CAAC;YAC1B,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,QAAQ,EAAE,GAAG,CAAC,QAAQ;YACtB,OAAO,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,wBAAwB;YAClE,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE;SACtB,CAAC,CAAC;QAEH,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,yEAAyE,EAAE;YACtF,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,QAAQ,EAAE,GAAG,CAAC,QAAQ;YACtB,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG;SACtB,CAAC,CAAC;IACL,CAAC;IAED,IAAI,OAAO;QACT,OAAO;YACL,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE;YAC/B,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,kBAAkB,EAAE,IAAI,CAAC,MAAM,CAAC,kBAAkB;YAClD,mBAAmB,EAAE,IAAI,CAAC,MAAM,CAAC,mBAAmB;SACrD,CAAC;IACJ,CAAC;IAED;;;OAGG;IACO,cAAc,CAAC,SAAiB,EAAE,MAAc;QACxD,OAAO,IAAI,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC/C,CAAC;IAES,KAAK,CAAC,iBAAiB,CAAC,QAAgB,EAAE,KAAa;QAC/D,IAAI,MAAM,IAAI,CAAC,mBAAmB,CAAC,QAAQ,EAAE,KAAK,CAAC;YAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC9E,OAAO;YACL,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,oDAAoD,QAAQ,QAAQ,KAAK,GAAG;SACrF,CAAC;IACJ,CAAC;IAEO,WAAW;QACjB,OAAO,mBAAmB,CAAC;YACzB,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM;YAC1B,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;YAC9B,kBAAkB,EAAE,IAAI,CAAC,MAAM,CAAC,kBAAkB;YAClD,mBAAmB,EAAE,IAAI,CAAC,MAAM,CAAC,mBAAmB;SACrD,CAAC,CAAC;IACL,CAAC;;AAKH,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/plugins/service-betterportal-auth-default/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,kBAAkB,EAClB,kBAAkB,EAEnB,MAAM,WAAW,CAAC;AACnB,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EACL,wBAAwB,EACxB,SAAS,EAEV,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,uBAAuB,EACvB,mBAAmB,EACnB,qBAAqB,EACrB,cAAc,EAOf,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EAAE,WAAW,EAAE,eAAe,EAAc,MAAM,kBAAkB,CAAC;AAC5E,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,YAAY,EAAE,WAAW,EAAkC,MAAM,mBAAmB,CAAC;AAC1H,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAC3C,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,eAAe,EAAmB,MAAM,eAAe,CAAC;AAC9F,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACpD,OAAO,EAAE,sBAAsB,EAAE,MAAM,iBAAiB,CAAC;AAEzD,MAAM,kBAAkB,GAAG,EAAE,CAAC,MAAM,CAAC;IACnC,IAAI,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC;IACjD,IAAI,EAAE,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACjC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC;IAChC,QAAQ,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC;IAClE,kBAAkB,EAAE,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,GAAG,EAAE,CAAC;IACpD,mBAAmB,EAAE,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;IAC9D,YAAY,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,4BAA4B,CAAC;IAC5E,aAAa,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,6BAA6B,CAAC;IAC9E,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,QAAQ,EAAE,UAAU,CAAU,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;IACjE,WAAW,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;IACpC,aAAa,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;IACtC,UAAU,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;IACnC,YAAY,EAAE,wBAAwB;CACvC,CAAC,CAAC;AAGH,MAAM,MAAM,GAAG,kBAAkB,CAC/B;IACE,IAAI,EAAE,mCAAmC;IACzC,WAAW,EAAE,sFAAsF;IACnG,IAAI,EAAE,CAAC,cAAc,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC;IAC7C,aAAa,EAAE,CAAC,aAAa,CAAC;IAC9B,KAAK,EAAE,yBAAyB;CACjC,EACD,kBAAkB,CACnB,CAAC;AAEF,MAAM,YAAY,GAAG,kBAAkB,CAAC;IACtC,UAAU,EAAE,EAAE;IACd,QAAQ,EAAE,EAAE;IACZ,oBAAoB,EAAE,EAAE;IACxB,kBAAkB,EAAE,EAAE;IACtB,aAAa,EAAE,EAAE;IACjB,WAAW,EAAE,EAAE;CAChB,CAAC,CAAC;AAgBH,MAAM,OAAO,MAAO,SAAQ,SAA2D;IACrF,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,MAAM,CAAC,YAAY,GAAG,YAAY,CAAC;IAE3B,OAAO,CAAc;IACrB,QAAQ,CAAmB;IAC3B,OAAO,CAAW;IAClB,IAAI,CAAa;IACjB,WAAW,GAAG,EAAE,CAAC;IACjB,SAAS,CAAkC;IAEnD,YAAY,GAA4E;QACtF,KAAK,CAAC,EAAE,GAAG,GAAG,EAAE,YAAY,EAAE,YAAY,EAAE,CAAC,CAAC;IAChD,CAAC;IAES,UAAU;QAClB,OAAO;YACL,QAAQ,EAAE;gBACR,QAAQ,EAAE,+BAA+B;gBACzC,KAAK,EAAE,2BAA2B;gBAClC,WAAW,EAAE,8FAA8F;gBAC3G,YAAY,EAAE,CAAC,MAAM,CAAC;gBACtB,aAAa,EAAE,iBAAiB;aACjC;SACF,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,GAAe;QACxB,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC;QACxB,IAAI,GAAG,CAAC,IAAI,KAAK,UAAU,IAAI,CAAC,GAAG,CAAC,UAAU;YAAE,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;QAE9H,IAAI,GAAG,CAAC,IAAI,KAAK,UAAU,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,wEAAwE,CAAC,CAAC;QACjK,IAAI,CAAC,OAAO,GAAG,qBAAqB,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC;QAEhE,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAEtB,MAAM,OAAO,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,cAAc,CAAC;QAC5D,MAAM,QAAQ,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,GAAa,CAAC,CAAC,CAAC,SAAS,CAAC;QAC3G,IAAI,GAAG,CAAC,IAAI,KAAK,UAAU,IAAI,CAAC,GAAG,CAAC,aAAa;YAAE,MAAM,IAAI,KAAK,CAAC,mHAAmH,CAAC,CAAC;QACxL,IAAI,QAAQ,IAAI,GAAG,CAAC,aAAa,IAAI,QAAQ,KAAK,GAAG,CAAC,aAAa;YAAE,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;QACzI,MAAM,aAAa,GAAG,GAAG,CAAC,aAAa,IAAI,QAAQ,IAAI,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAC1F,IAAI,CAAC,QAAQ;YAAE,WAAW,CAAC,OAAO,EAAE,EAAE,GAAG,EAAE,aAAa,EAAE,CAAC,CAAC;QAC5D,MAAM,MAAM,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC;QACtC,MAAM,MAAM,GAA6B,EAAE,CAAC;QAC5C,KAAK,MAAM,GAAG,IAAI,MAAM,EAAE,IAAI,IAAI,EAAE;YAAE,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACjF,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,aAAa,EAAE,gBAAgB,EAAE,GAAG,CAAC,WAAW,EAAE,cAAc,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;QACrM,IAAI,CAAC,QAAQ,GAAG,IAAI,eAAe,CAAC,OAAO,EAAE,IAAI,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC;QACrG,IAAI,CAAC,OAAO,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC1C,IAAI,CAAC,IAAI,GAAG,IAAI,SAAS,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC,CAAC;QACjF,MAAM,SAAS,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,aAAa,CAAC;QAC7D,IAAI,GAAG,CAAC,UAAU;YAAE,IAAI,CAAC,WAAW,GAAG,GAAG,CAAC,UAAU,CAAC;aACjD,IAAI,UAAU,CAAC,SAAS,CAAC;YAAE,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC;aAChG,CAAC;YAAC,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;YAAC,WAAW,CAAC,SAAS,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;QAAC,CAAC;QACvH,IAAI,CAAC,SAAS,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,KAAK,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,sCAAsC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QAC1I,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC;QAEvB,MAAM,GAAG,GAAG,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACxE,IAAI,CAAC,sBAAsB,CAAC;YAC1B,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE;YAC/B,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,QAAQ,EAAE,GAAG,CAAC,QAAQ;YACtB,OAAO,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,wBAAwB;YAClE,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE;SACtB,CAAC,CAAC;QAEH,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,yEAAyE,EAAE;YACtF,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,QAAQ,EAAE,GAAG,CAAC,QAAQ;YACtB,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG;SACtB,CAAC,CAAC;IACL,CAAC;IAED,IAAI,OAAO;QACT,OAAO;YACL,aAAa,EAAE,KAAK,CAAC,EAAE,CAAC,aAAa,CAAC,KAAK,EAAE,IAAI,CAAC,EAAE,CAAC;YACrD,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE;YAC/B,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;YACnC,YAAY,EAAE,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC;YAC/C,WAAW,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,IAAI,WAAW,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,CAAC;YAChF,aAAa,EAAE,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,sBAAsB,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC;YAChF,kBAAkB,EAAE,IAAI,CAAC,MAAM,CAAC,kBAAkB;YAClD,mBAAmB,EAAE,IAAI,CAAC,MAAM,CAAC,mBAAmB;SACrD,CAAC;IACJ,CAAC;IAED;;;OAGG;IACO,cAAc,CAAC,SAAiB,EAAE,MAAc;QACxD,OAAO,IAAI,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC/C,CAAC;IAES,KAAK,CAAC,iBAAiB,CAAC,QAAgB,EAAE,KAAa;QAC/D,IAAI,CAAC,IAAI,CAAC,QAAQ;YAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,8BAA8B,EAAE,CAAC;QACtF,IAAI,MAAM,IAAI,CAAC,mBAAmB,CAAC,QAAQ,EAAE,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QACzJ,OAAO;YACL,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,oDAAoD,QAAQ,QAAQ,KAAK,GAAG;SACrF,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,OAAO;QACX,IAAI,IAAI,CAAC,SAAS;YAAE,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAClD,MAAM,KAAK,CAAC,OAAO,EAAE,CAAC;QACtB,IAAI,IAAI,CAAC,QAAQ;YAAE,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;IACzD,CAAC;IAES,KAAK,CAAC,0BAA0B,CAAI,QAAgB,EAAE,KAAyB,EAAE,MAA+B,EAAE,KAA2B;QACrJ,IAAI,CAAC,IAAI,CAAC,QAAQ;YAAE,MAAM,IAAI,uBAAuB,CAAC,+BAA+B,EAAE,GAAG,CAAC,CAAC;QAC5F,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,KAAK,EAAC,EAAE,EAAC,EAAE;YAC3E,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,IAAI,MAAM,CAAC,OAAO,KAAK,SAAS,IAAI,MAAM,CAAC,OAAO,KAAK,EAAE,EAAE,CAAC;gBAC9F,IAAI,CAAC;oBAAC,eAAe,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;gBAAC,CAAC;gBACxC,OAAO,KAAK,EAAE,CAAC;oBACb,IAAI,CAAC,CAAC,KAAK,YAAY,SAAS,CAAC;wBAAE,MAAM,KAAK,CAAC;oBAC/C,MAAM,IAAI,uBAAuB,CAAC,KAAK,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;gBACxD,CAAC;YACH,CAAC;YACD,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,EAAE,CAAC;gBACzC,IAAI,CAAC;oBAAC,gBAAgB,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;gBAAC,CAAC;gBAC7C,OAAO,KAAK,EAAE,CAAC;oBACb,IAAI,CAAC,CAAC,KAAK,YAAY,SAAS,CAAC;wBAAE,MAAM,KAAK,CAAC;oBAC/C,MAAM,IAAI,uBAAuB,CAAC,KAAK,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;gBACxD,CAAC;YACH,CAAC;YACD,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,EAAE,CAAC;gBAC/C,IAAI,CAAC;oBAAC,sBAAsB,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC;gBAAC,CAAC;gBACzD,OAAO,KAAK,EAAE,CAAC;oBACb,IAAI,CAAC,CAAC,KAAK,YAAY,SAAS,CAAC;wBAAE,MAAM,KAAK,CAAC;oBAC/C,MAAM,IAAI,uBAAuB,CAAC,KAAK,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;gBACxD,CAAC;YACH,CAAC;YACD,IAAI,KAAK,IAAI,MAAM,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;gBACjD,IAAI,KAAc,CAAC;gBACnB,IAAI,CAAC;oBAAC,KAAK,GAAG,OAAO,MAAM,CAAC,cAAc,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC;gBAAC,CAAC;gBACtH,MAAM,CAAC;oBAAC,MAAM,IAAI,uBAAuB,CAAC,qCAAqC,CAAC,CAAC;gBAAC,CAAC;gBACnF,MAAM,OAAO,GAAG,IAAI,CAAC,eAAe,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,EAAE,KAAK,KAAK,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC;gBAChJ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;oBAAE,MAAM,IAAI,uBAAuB,CAAC,0EAA0E,CAAC,CAAC;YAC9N,CAAC;YACD,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS,IAAI,OAAO,MAAM,CAAC,UAAU,KAAK,SAAS;gBAAE,MAAM,IAAI,uBAAuB,CAAC,gCAAgC,CAAC,CAAC;YACnJ,IAAI,MAAM,CAAC,YAAY,KAAK,SAAS,IAAI,CAAC,CAAC,QAAQ,EAAE,aAAa,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;gBAAE,MAAM,IAAI,uBAAuB,CAAC,yCAAyC,CAAC,CAAC;YAClM,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,qBAAqB,CAAC,EAAE,CAAC;gBACjD,IAAI,KAAK;oBAAE,MAAM,IAAI,uBAAuB,CAAC,kEAAkE,CAAC,CAAC;gBACjH,IAAI,MAAM,CAAC,mBAAmB,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,EAAE,KAAK,MAAM,CAAC,mBAAmB,CAAC;oBAAE,MAAM,IAAI,uBAAuB,CAAC,uDAAuD,CAAC,CAAC;YAC9O,CAAC;YACD,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,EAAE,CAAC;gBAC3C,IAAI,KAAK;oBAAE,MAAM,IAAI,uBAAuB,CAAC,wDAAwD,CAAC,CAAC;gBACvG,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,GAAG,CAAC,QAAQ,EAAE,QAAQ,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC;gBAC3E,MAAM,SAAS,GAAG,MAAM,CAAC,aAAa,IAAI,QAAQ,EAAE,SAAS,IAAI,KAAK,CAAC;gBACvE,IAAI,SAAS,KAAK,KAAK,IAAI,SAAS,KAAK,QAAQ;oBAAE,MAAM,IAAI,uBAAuB,CAAC,iCAAiC,CAAC,CAAC;gBACxH,IAAI,QAAQ,EAAE,QAAQ,IAAI,QAAQ,CAAC,SAAS,KAAK,SAAS;oBAAE,MAAM,IAAI,uBAAuB,CAAC,wEAAwE,CAAC,CAAC;gBACxK,MAAM,EAAE,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,GAAG,QAAQ,EAAE,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC;YAC5F,CAAC;YACD,OAAO,KAAK,EAAE,CAAC;QACjB,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,YAAY,CAAC,KAAY;QAC/B,MAAM,UAAU,GAAG,IAAI,CAAC,eAAe,EAAE,EAAE,gBAAgB,CAAC;QAC5D,OAAO,CAAC,CAAC,UAAU,IAAI,UAAU,CAAC,aAAa,KAAK,KAAK,CAAC,QAAQ,IAAI,UAAU,CAAC,eAAe,KAAK,KAAK,CAAC,KAAK,CAAC;IACnH,CAAC;IAEO,KAAK,CAAC,MAAM,CAAC,KAAY;QAC/B,MAAM,MAAM,GAAG,IAAI,CAAC,sBAAsB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAC3D,MAAM,MAAM,GAAG,IAAI,CAAC,sBAAsB,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;QACxE,MAAM,SAAS,GAAG,MAAM,CAAC,aAAa,CAAC;QACvC,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,KAAK,KAAK,IAAI,SAAS,KAAK,QAAQ;YAAE,MAAM,IAAI,SAAS,CAAC,uCAAuC,EAAE,GAAG,CAAC,CAAC;QAChJ,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,kBAAkB,CAAC,KAAK,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;QACpF,MAAM,YAAY,GAAG,MAAM,CAAC,YAAY,IAAI,aAAa,CAAC;QAC1D,IAAI,YAAY,KAAK,QAAQ,IAAI,YAAY,KAAK,aAAa,IAAI,YAAY,KAAK,QAAQ;YAAE,MAAM,IAAI,SAAS,CAAC,qCAAqC,EAAE,GAAG,CAAC,CAAC;QAC9J,MAAM,QAAQ,GAAG,OAAO,MAAM,CAAC,cAAc,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,cAAc,IAAI,EAAE,CAAC;QAC7H,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;YAAE,MAAM,IAAI,SAAS,CAAC,qCAAqC,EAAE,GAAG,CAAC,CAAC;QAC3I,MAAM,KAAK,GAAG,IAAI,CAAC,eAAe,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;QAC/H,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,cAAc,EAAE,QAAQ,EAAE,cAAc,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,KAAK,IAAI,EAAE,kBAAkB,EAAE,SAAS,KAAK,KAAK,IAAI,MAAM,CAAC,mBAAmB,KAAK,KAAK,CAAC,KAAK,IAAI,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;IAChQ,CAAC;IAEO,iBAAiB,CAAC,KAAY;QACpC,MAAM,MAAM,GAAG,IAAI,CAAC,sBAAsB,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;QACxE,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,CAAC,MAAM,CAAC,QAAQ,IAAI,CAAC,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;YAAE,OAAO,SAAS,CAAC;QACxH,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,aAAkC,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,UAAU,IAAI,EAAE,CAAC,EAAE,OAAO,EAAE,gBAAgB,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC;IACtN,CAAC;IAES,KAAK,CAAC,kBAAkB,CAAC,MAAiB,EAAE,WAAiC,EAAE,KAAwB,EAAE,gBAAwC,EAAE;QAC3J,MAAM,KAAK,GAAG,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;QACjE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACxC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAC3E,IAAI,CAAC,IAAI,EAAE,OAAO;YAAE,MAAM,IAAI,SAAS,CAAC,sBAAsB,CAAC,CAAC;QAChE,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC;QACjH,MAAM,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,KAAK,EAAE,WAAW,EAAE,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QAC/D,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QACvD,IAAI,CAAC,UAAU,IAAI,WAAW,CAAC,OAAO,KAAK,KAAK;YAAE,MAAM,IAAI,SAAS,CAAC,iEAAiE,CAAC,CAAC;QACzI,MAAM,QAAQ,GAAG,UAAU,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAChI,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,KAAK,EAAE,WAAW,EAAE,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,CAAC,cAAc,EAAE,aAAa,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,IAAI,IAAI,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QAC7O,OAAO,EAAE,WAAW,EAAE,SAAS,CAAC,EAAE,EAAE,MAAM,EAAE,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,EAAE,GAAG,QAAQ,EAAE,MAAM,EAAE,CAAC;IACjI,CAAC;IAES,KAAK,CAAC,mBAAmB,CAAC,MAAiB,EAAE,IAA6B,EAAE,MAAyB;QAC7G,MAAM,KAAK,GAAG,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;QACjE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACxC,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,WAAW,IAAI,EAAE,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE,EAAE,EAAE;YAClI,MAAM,GAAG,GAAG,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,SAAS,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;YAC/F,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,GAAG,CAAO,MAAM,EAAE,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YACzD,IAAI,CAAC,IAAI,EAAE,OAAO,IAAI,IAAI,CAAC,cAAc,KAAK,SAAS,CAAC,IAAI,CAAC,OAAO,IAAI,SAAS,CAAC,IAAI,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG,IAAI,SAAS,CAAC,MAAM,KAAK,IAAI,CAAC,EAAE;gBAAE,MAAM,IAAI,SAAS,CAAC,iCAAiC,CAAC,CAAC;YAClM,MAAM,IAAI,CAAC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;YACjE,IAAI,SAAS,CAAC,IAAI,CAAC,MAAM,IAAK,SAAS,CAAC,IAAI,CAAC,MAAkC,CAAC,MAAM,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC;gBAAE,MAAM,IAAI,SAAS,CAAC,yCAAyC,CAAC,CAAC;YACnN,IAAI,SAAS,CAAC,IAAI,CAAC,MAAM;gBAAE,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,CAAC,MAAiC,EAAE,IAAI,CAAC,CAAC;iBAC3H,IAAI,IAAI,CAAC,OAAO,KAAK,IAAI;gBAAE,MAAM,IAAI,SAAS,CAAC,wBAAwB,CAAC,CAAC;YAC9E,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;YACjE,MAAM,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,EAAE,eAAe,EAAE,EAAE,cAAc,EAAE,SAAS,CAAC,IAAI,CAAC,aAAa,IAAI,EAAE,EAAE,CAAC,CAAC;YACvH,OAAO,EAAE,IAAI,EAAE,EAAE,GAAG,MAAM,EAAE,KAAK,EAAE,EAAE,SAAS,EAAE,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;QAChG,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,WAAW;QACjB,OAAO,mBAAmB,CAAC;YACzB,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM;YAC1B,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;YAC9B,kBAAkB,EAAE,IAAI,CAAC,MAAM,CAAC,kBAAkB;YAClD,mBAAmB,EAAE,IAAI,CAAC,MAAM,CAAC,mBAAmB;SACrD,CAAC,CAAC;IACL,CAAC;;AAKH,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC"}

package/lib/plugins/service-betterportal-auth-default/loginFlow.d.ts

@@ -14,6 +14,9 @@ export declare const RequestSchema: av.ObjectSchema<{
     next: av.OptionalSchema<av.StringSchema>;
 }>;
 export declare const ResponseSchema: av.ObjectSchema<{
+    challenge: av.OptionalSchema<av.BaseSchema<unknown, import("@betterportal/framework").JsonObject>>;
+    accountUrl: av.OptionalSchema<av.StringSchema>;
+    socialUrl: av.OptionalSchema<av.StringSchema>;
     status: av.EnumSchema<readonly ["ok", "error"]>;
     message: av.OptionalSchema<av.StringSchema>;
     accessToken: av.OptionalSchema<av.StringSchema>;
@@ -48,6 +51,12 @@ export declare const dependencies: readonly [{
 }, {
     readonly operationId: "auth.register.view";
     readonly method: "GET";
+}, {
+    readonly operationId: "auth.account.view";
+    readonly method: "GET";
+}, {
+    readonly operationId: "auth.social.view";
+    readonly method: "GET";
 }];
 export declare const chrome: BetterPortalRouteChrome;
 export declare const auth: ApiAuthRequirement;
@@ -58,7 +67,10 @@ export declare const handleGet: import("@betterportal/framework").RouteHandler<R
 }, {
     "x-bp-refresh"?: string | undefined;
 }, Record<string, unknown>, {
-    status: "ok" | "error";
+    status: "error" | "ok";
+    challenge?: import("@betterportal/framework").JsonObject | undefined;
+    accountUrl?: string | undefined;
+    socialUrl?: string | undefined;
     message?: string | undefined;
     accessToken?: string | undefined;
     refreshToken?: string | undefined;
@@ -86,7 +98,10 @@ export declare const handlePost: import("@betterportal/framework").RouteHandler<
     password: string;
     next?: string | undefined;
 }, {
-    status: "ok" | "error";
+    status: "error" | "ok";
+    challenge?: import("@betterportal/framework").JsonObject | undefined;
+    accountUrl?: string | undefined;
+    socialUrl?: string | undefined;
     message?: string | undefined;
     accessToken?: string | undefined;
     refreshToken?: string | undefined;

package/lib/plugins/service-betterportal-auth-default/loginFlow.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"loginFlow.d.ts","sourceRoot":"","sources":["../../../src/plugins/service-betterportal-auth-default/loginFlow.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAEL,KAAK,kBAAkB,EACvB,KAAK,UAAU,EACf,KAAK,uBAAuB,EAC7B,MAAM,yBAAyB,CAAC;AAIjC,eAAO,MAAM,WAAW;;;EAGtB,CAAC;AAEH,eAAO,MAAM,aAAa;;EAA0D,CAAC;AAErF,eAAO,MAAM,aAAa;;;;EAIxB,CAAC;AAEH,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;EA2BzB,CAAC;AACH,MAAM,MAAM,YAAY,GAAG,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAExD,eAAO,MAAM,KAAK,UAAU,CAAC;AAC7B,eAAO,MAAM,WAAW,8DAA8D,CAAC;AACvF,eAAO,MAAM,IAAI,eAAe,CAAC;AACjC,eAAO,MAAM,YAAY;;;;;;;;;;;;EAKf,CAAC;AACX,eAAO,MAAM,MAAM,EAAE,uBAA8C,CAAC;AAEpE,eAAO,MAAM,IAAI,EAAE,kBAGlB,CAAC;AAEF,eAAO,MAAM,UAAU,EAAE,UAGxB,CAAC;AAEF,eAAO,MAAM,SAAS;;;;;;;;;;;;;;;;;;;;;;;;;EAqDrB,CAAC;AAEF,eAAO,MAAM,UAAU;;;;;;;;;;;;;;;;;;;;;;;;;;;EA8EtB,CAAC"}
+{"version":3,"file":"loginFlow.d.ts","sourceRoot":"","sources":["../../../src/plugins/service-betterportal-auth-default/loginFlow.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAGL,KAAK,kBAAkB,EACvB,KAAK,UAAU,EACf,KAAK,uBAAuB,EAC7B,MAAM,yBAAyB,CAAC;AAMjC,eAAO,MAAM,WAAW;;;EAGtB,CAAC;AAEH,eAAO,MAAM,aAAa;;EAA0D,CAAC;AAErF,eAAO,MAAM,aAAa;;;;EAIxB,CAAC;AAEH,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;EA8BzB,CAAC;AACH,MAAM,MAAM,YAAY,GAAG,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAExD,eAAO,MAAM,KAAK,UAAU,CAAC;AAC7B,eAAO,MAAM,WAAW,8DAA8D,CAAC;AACvF,eAAO,MAAM,IAAI,eAAe,CAAC;AACjC,eAAO,MAAM,YAAY;;;;;;;;;;;;;;;;;;EAOf,CAAC;AACX,eAAO,MAAM,MAAM,EAAE,uBAA8C,CAAC;AAEpE,eAAO,MAAM,IAAI,EAAE,kBAGlB,CAAC;AAEF,eAAO,MAAM,UAAU,EAAE,UAGxB,CAAC;AAEF,eAAO,MAAM,SAAS;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAuDrB,CAAC;AAEF,eAAO,MAAM,UAAU;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA2EtB,CAAC"}