@betterportal/auth-default 10.6.21 → 10.6.23

package/lib/plugins/service-betterportal-auth-default/loginFlow.js

@@ -1,6 +1,8 @@
 import * as av from "anyvali";
-import { resolveAppAuthRedirect } from "@betterportal/framework";
+import { JsonObjectSchema, resolveAppAuthRedirect } from "@betterportal/framework";
 import { createHandler } from "./.bp-generated/route-runtime.js";
+import { getEventPeerIp } from "@betterportal/framework/lib/runtime/h3.js";
+import { AuthError, normalizeAccountIdentifier } from "../../identity.js";
 import { revokePresentedRefreshToken } from "./logoutFlow.js";
 export const QuerySchema = av.object({
     action: av.optional(av.string()).describe("Optional login route action, currently supports logout."),
@@ -13,6 +15,9 @@ export const RequestSchema = av.object({
     next: av.optional(av.string()).describe("The view path to soft-navigate to after a successful login.")
 });
 export const ResponseSchema = av.object({
+    challenge: av.optional(JsonObjectSchema),
+    accountUrl: av.optional(av.string()),
+    socialUrl: av.optional(av.string()),
     status: av.enum_(["ok", "error"]).describe("Login request outcome."),
     message: av.optional(av.string()).describe("Human-readable status or error message for the renderer."),
     accessToken: av.optional(av.string()).describe("Signed JWT access token returned on successful login."),
@@ -24,9 +29,9 @@ export const ResponseSchema = av.object({
         email: av.optional(av.string()).describe("User email address, when set."),
         name: av.optional(av.string()).describe("Display name, when set.")
     }).describe("Authenticated user summary.")),
-    // True while the auth service has zero users - the theme renderer redirects
+    // True while management bootstrap is incomplete - the theme renderer redirects
     // to the register view (first-admin setup) instead of showing the login form.
-    requiresFirstAdmin: av.optional(av.bool()).describe("True while the auth service has zero users; the theme renderer should redirect to first-admin registration instead of showing the login form."),
+    requiresFirstAdmin: av.optional(av.bool()).describe("True while management bootstrap is incomplete; the theme renderer should redirect to first-admin registration instead of showing the login form."),
     // Absolute URL of this auth service's register view (self-origin). Provided so
     // the theme renderer can load it in-shell without knowing the auth origin.
     firstAdminUrl: av.optional(av.string()).describe("Absolute self-origin URL of this auth service's register view so the theme can load it in-shell without knowing the auth origin."),
@@ -47,7 +52,9 @@ export const dependencies = [
     { operationId: "auth.login", method: "POST" },
     { operationId: "auth.logout.view", method: "GET" },
     { operationId: "auth.refresh", method: "POST" },
-    { operationId: "auth.register.view", method: "GET" }
+    { operationId: "auth.register.view", method: "GET" },
+    { operationId: "auth.account.view", method: "GET" },
+    { operationId: "auth.social.view", method: "GET" }
 ];
 export const chrome = { fullScreen: true };
 export const auth = {
@@ -60,7 +67,7 @@ export const cacheHints = {
 };
 export const handleGet = createHandler({ response: ResponseSchema, query: QuerySchema, headers: HeadersSchema }, async (ctx) => {
     const runtime = ctx.plugin.runtime;
-    const requiresFirstAdmin = runtime.userStore.hasNoUsers();
+    const requiresFirstAdmin = runtime.isManagement({ tenantId: ctx.tenant.id, appId: ctx.app.id }) && await runtime.identity.bootstrapAvailable({ tenantId: ctx.tenant.id, appId: ctx.app.id });
     if (ctx.query.action === "logout") {
         await revokePresentedRefreshToken(runtime, ctx.headers["x-bp-refresh"], ctx.tenant.id, ctx.app.id);
         const nextUrl = resolveAppAuthRedirect(ctx, "afterLogout");
@@ -76,7 +83,7 @@ export const handleGet = createHandler({ response: ResponseSchema, query: QueryS
         };
     }
     // Valid token already on the request - no point rendering a login form.
-    // First-admin setup still wins: a token can outlive a wiped user store.
+    // Management bootstrap still wins until its durable completion marker exists.
     if (ctx.user && !requiresFirstAdmin) {
         const next = resolveAppAuthRedirect(ctx, "afterLogin", ctx.query.next);
         return {
@@ -104,7 +111,9 @@ export const handleGet = createHandler({ response: ResponseSchema, query: QueryS
     return {
         status: "ok",
         message: "Submit username + password via POST to authenticate.",
+        socialUrl: ctx.routeUrl?.("social.index", { absolute: true }) ?? "/social",
         requiresFirstAdmin,
+        accountUrl: ctx.routeUrl?.("account.index", { absolute: true }) ?? "/account",
         ...(firstAdminUrl ? { firstAdminUrl } : {})
     };
 });
@@ -113,65 +122,77 @@ export const handlePost = createHandler({ response: ResponseSchema, request: Req
     const tenantId = ctx.tenant.id;
     const appId = ctx.app.id;
     const body = ctx.request;
-    const user = await runtime.userStore.authenticate(tenantId, appId, body.username, body.password);
-    if (!user) {
-        // Auth failures are 401, not 200-with-error-body.
-        ctx.setStatus?.(401);
+    const scope = { tenantId, appId };
+    const policy = await runtime.policy(scope);
+    try {
+        await runtime.identity.rateLimit(scope, "login-peer", runtime.clientAddress?.(ctx.rawEvent) ?? getEventPeerIp(ctx.rawEvent) ?? "unknown", 100, 600);
+        const directoryScope = { tenantId, appId: policy.isolation === "tenant" ? "" : appId };
+        await runtime.identity.rateLimit(directoryScope, "login", normalizeAccountIdentifier(body.username));
+        const user = await runtime.identity.authenticate(scope, policy, body.username, body.password);
+        if (!user) {
+            ctx.setStatus?.(401);
+            return { status: "error", message: "Invalid username or password." };
+        }
+        const roles = await runtime.identity.storage.transaction(scope, tx => runtime.identity.roles(tx, scope, user, policy));
+        const root = runtime.isManagement(scope) && roles.includes("*");
+        if (!user.emailVerified && !root && user.legacyUsernameLogin !== true) {
+            ctx.setStatus?.(403);
+            return { status: "error", message: "Verify your email address before signing in. Use account recovery to resend the verification email." };
+        }
+        const hasFactors = await runtime.factors.hasFactors(user);
+        if (hasFactors || policy.requireMfa || root) {
+            const event = ctx.rawEvent;
+            const prepared = await runtime.factors.prepare(user, event.req.headers.get("origin") ?? event.url.origin, !hasFactors);
+            const ticket = await runtime.identity.challenge(scope, "login", { version: user.refreshVersion, factor: prepared.private }, user.id);
+            return { status: "ok", accountUrl: ctx.routeUrl?.("account.index", { absolute: true }) ?? "/account", challenge: { ...ticket, ...prepared.public }, message: hasFactors ? "Verify your identity." : "Set up multi-factor authentication to finish signing in." };
+        }
+        const issued = await runtime.identity.issueSession(scope, policy, user, runtime.tokenIssuer, runtime.refreshTokenSeconds);
+        if (!issued.refreshToken) {
+            throw new Error("Auth token issuer did not return a refresh token");
+        }
+        // Login is rendered in the theme's auth-only page state. After credentials
+        // are stored, navigate the browser back to the tenant route so the normal
+        // shell is rendered from a clean page request.
+        const next = resolveAppAuthRedirect(ctx, "afterLogin", body.next || ctx.query.next);
+        ctx.responseHeaders?.set("HX-Redirect", next);
+        // Auth state changed - reload this service's fragments (nav profile etc.).
+        // Fragments listening on this key re-fetch; absent fragments ignore it.
+        if (ctx.serviceId) {
+            ctx.responseHeaders?.set("HX-Trigger", `bp:fragments:${ctx.serviceId}`);
+        }
+        // Expire the stored header with the ACCESS token, not the refresh token -
+        // otherwise the client replays a dead JWT for days. The refresh token is
+        // stored separately so the profile fragment can renew before expiry.
+        ctx.bpHeaders?.set('Authorization', `Bearer ${issued.accessToken}`, {
+            expiresInSeconds: issued.accessTokenExpiresInSeconds,
+            locked: true,
+            refreshPath: "/refresh",
+            refreshBeforeSeconds: 60
+        });
+        ctx.bpHeaders?.set('X-BP-Refresh', issued.refreshToken, {
+            expiresInSeconds: issued.refreshTokenExpiresInSeconds ?? runtime.refreshTokenSeconds,
+            locked: true,
+            scopeToOwner: true
+        });
         return {
-            status: "error",
-            message: "Invalid username or password."
+            status: "ok",
+            message: "logged in",
+            accessToken: issued.accessToken,
+            refreshToken: issued.refreshToken,
+            expiresInSeconds: issued.accessTokenExpiresInSeconds,
+            user: {
+                id: user.id,
+                username: user.username,
+                email: user.email,
+                name: user.name ?? user.username
+            }
         };
     }
-    const issued = runtime.tokenIssuer.issueTokenPair({
-        sub: user.id,
-        tenantId: user.tenantId,
-        appId,
-        authProvider: 'betterportal.default',
-        refreshContext: { version: user.refreshVersion },
-        roles: user.roles,
-        name: user.name ?? user.username,
-        email: user.email,
-        picture: user.picture
-    });
-    if (!issued.refreshToken) {
-        throw new Error("Auth token issuer did not return a refresh token");
-    }
-    // Login is rendered in the theme's auth-only page state. After credentials
-    // are stored, navigate the browser back to the tenant route so the normal
-    // shell is rendered from a clean page request.
-    const next = resolveAppAuthRedirect(ctx, "afterLogin", body.next || ctx.query.next);
-    ctx.responseHeaders?.set("HX-Redirect", next);
-    // Auth state changed - reload this service's fragments (nav profile etc.).
-    // Fragments listening on this key re-fetch; absent fragments ignore it.
-    if (ctx.serviceId) {
-        ctx.responseHeaders?.set("HX-Trigger", `bp:fragments:${ctx.serviceId}`);
+    catch (error) {
+        if (!(error instanceof AuthError))
+            throw error;
+        ctx.setStatus?.(error.status);
+        return { status: "error", message: error.message };
     }
-    // Expire the stored header with the ACCESS token, not the refresh token -
-    // otherwise the client replays a dead JWT for days. The refresh token is
-    // stored separately so the profile fragment can renew before expiry.
-    ctx.bpHeaders?.set('Authorization', `Bearer ${issued.accessToken}`, {
-        expiresInSeconds: issued.accessTokenExpiresInSeconds,
-        locked: true,
-        refreshPath: "/refresh",
-        refreshBeforeSeconds: 60
-    });
-    ctx.bpHeaders?.set('X-BP-Refresh', issued.refreshToken, {
-        expiresInSeconds: issued.refreshTokenExpiresInSeconds ?? runtime.refreshTokenSeconds,
-        locked: true,
-        scopeToOwner: true
-    });
-    return {
-        status: "ok",
-        message: "logged in",
-        accessToken: issued.accessToken,
-        refreshToken: issued.refreshToken,
-        expiresInSeconds: issued.accessTokenExpiresInSeconds,
-        user: {
-            id: user.id,
-            username: user.username,
-            email: user.email,
-            name: user.name ?? user.username
-        }
-    };
 });
 //# sourceMappingURL=loginFlow.js.map

package/lib/plugins/service-betterportal-auth-default/loginFlow.js.map

@@ -1 +1 @@
-{"version":3,"file":"loginFlow.js","sourceRoot":"","sources":["../../../src/plugins/service-betterportal-auth-default/loginFlow.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAE9B,OAAO,EACL,sBAAsB,EAIvB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,aAAa,EAAE,MAAM,kCAAkC,CAAC;AACjE,OAAO,EAAE,2BAA2B,EAAE,MAAM,iBAAiB,CAAC;AAE9D,MAAM,CAAC,MAAM,WAAW,GAAG,EAAE,CAAC,MAAM,CAAC;IACnC,MAAM,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC,yDAAyD,CAAC;IACpG,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC,4GAA4G,CAAC;CACtJ,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,aAAa,GAAG,EAAE,CAAC,MAAM,CAAC,EAAE,cAAc,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;AAErF,MAAM,CAAC,MAAM,aAAa,GAAG,EAAE,CAAC,MAAM,CAAC;IACrC,QAAQ,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,sCAAsC,CAAC;IACnF,QAAQ,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,sCAAsC,CAAC;IACnF,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC,6DAA6D,CAAC;CACvG,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,cAAc,GAAG,EAAE,CAAC,MAAM,CAAC;IACtC,MAAM,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,OAAO,CAAU,CAAC,CAAC,QAAQ,CAAC,wBAAwB,CAAC;IAC7E,OAAO,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC,0DAA0D,CAAC;IACtG,WAAW,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC,uDAAuD,CAAC;IACvG,YAAY,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC,wDAAwD,CAAC;IACzG,gBAAgB,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,mCAAmC,CAAC;IAC5F,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,MAAM,CAAC;QAC1B,EAAE,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,wBAAwB,CAAC;QAClD,QAAQ,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,mBAAmB,CAAC;QACnD,KAAK,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC,+BAA+B,CAAC;QACzE,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC,yBAAyB,CAAC;KACnE,CAAC,CAAC,QAAQ,CAAC,6BAA6B,CAAC,CAAC;IAC3C,4EAA4E;IAC5E,8EAA8E;IAC9E,kBAAkB,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,+IAA+I,CAAC;IACpM,+EAA+E;IAC/E,2EAA2E;IAC3E,aAAa,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC,kIAAkI,CAAC;IACpL,6EAA6E;IAC7E,gEAAgE;IAChE,eAAe,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,6IAA6I,CAAC;IAC/L,SAAS,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,oDAAoD,CAAC;IAChG,qEAAqE;IACrE,SAAS,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC,0DAA0D,CAAC;IACxG,6EAA6E;IAC7E,qDAAqD;IACrD,OAAO,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC,qGAAqG,CAAC;CAClJ,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,KAAK,GAAG,OAAO,CAAC;AAC7B,MAAM,CAAC,MAAM,WAAW,GAAG,2DAA2D,CAAC;AACvF,MAAM,CAAC,MAAM,IAAI,GAAG,YAAY,CAAC;AACjC,MAAM,CAAC,MAAM,YAAY,GAAG;IAC1B,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,EAAE;IAC7C,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,EAAE,KAAK,EAAE;IAClD,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,EAAE;IAC/C,EAAE,WAAW,EAAE,oBAAoB,EAAE,MAAM,EAAE,KAAK,EAAE;CAC5C,CAAC;AACX,MAAM,CAAC,MAAM,MAAM,GAA4B,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;AAEpE,MAAM,CAAC,MAAM,IAAI,GAAuB;IACtC,QAAQ,EAAE,KAAK;IACf,WAAW,EAAE,EAAE;CAChB,CAAC;AAEF,MAAM,CAAC,MAAM,UAAU,GAAe;IACpC,UAAU,EAAE,CAAC;IACb,MAAM,EAAE,EAAE;CACX,CAAC;AAEF,MAAM,CAAC,MAAM,SAAS,GAAG,aAAa,CACpC,EAAE,QAAQ,EAAE,cAAc,EAAE,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,aAAa,EAAE,EACxE,KAAK,EAAE,GAAG,EAAE,EAAE;IACZ,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC;IACnC,MAAM,kBAAkB,GAAG,OAAO,CAAC,SAAS,CAAC,UAAU,EAAE,CAAC;IAC1D,IAAK,GAAG,CAAC,KAAmC,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QACjE,MAAM,2BAA2B,CAAC,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACnG,MAAM,OAAO,GAAG,sBAAsB,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC;QAC3D,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,eAAe,CAAC,CAAC;QACvC,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,cAAc,CAAC,CAAC;QACtC,IAAI,GAAG,CAAC,SAAS;YAAE,GAAG,CAAC,eAAe,EAAE,GAAG,CAAC,YAAY,EAAE,gBAAgB,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC;QAC3F,OAAO;YACL,MAAM,EAAE,IAAa;YACrB,OAAO,EAAE,aAAa;YACtB,SAAS,EAAE,IAAI;YACf,OAAO;SACR,CAAC;IACJ,CAAC;IAED,wEAAwE;IACxE,wEAAwE;IACxE,IAAI,GAAG,CAAC,IAAI,IAAI,CAAC,kBAAkB,EAAE,CAAC;QACpC,MAAM,IAAI,GAAG,sBAAsB,CAAC,GAAG,EAAE,YAAY,EAAG,GAAG,CAAC,KAA2B,CAAC,IAAI,CAAC,CAAC;QAC9F,OAAO;YACL,MAAM,EAAE,IAAa;YACrB,OAAO,EAAE,oBAAoB;YAC7B,eAAe,EAAE,IAAI;YACrB,IAAI,EAAE;gBACJ,EAAE,EAAE,GAAG,CAAC,IAAI,CAAC,GAAG;gBAChB,QAAQ,EAAE,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,CAAC,KAAK,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG;gBACzD,KAAK,EAAE,GAAG,CAAC,IAAI,CAAC,KAAK;gBACrB,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,IAAI;aACpB;YACD,SAAS,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC,aAAa,EAAE,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,CAAC,IAAI,sBAAsB;YACnG,OAAO,EAAE,IAAI;SACd,CAAC;IACJ,CAAC;IAED,IAAI,aAAiC,CAAC;IACtC,IAAI,kBAAkB,EAAE,CAAC;QACvB,MAAM,IAAI,GAAI,GAAG,CAAC,KAA2B,CAAC,IAAI,CAAC;QACnD,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;QAC1C,aAAa,GAAG,GAAG,CAAC,QAAQ,EAAE,CAAC,gBAAgB,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;eACtE,GAAG,CAAC,QAAQ,EAAE,CAAC,gBAAgB,EAAE,EAAE,KAAK,EAAE,CAAC;eAC3C,SAAS,CAAC;IACjB,CAAC;IACD,OAAO;QACL,MAAM,EAAE,IAAa;QACrB,OAAO,EAAE,sDAAsD;QAC/D,kBAAkB;QAClB,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC5C,CAAC;AACJ,CAAC,CACF,CAAC;AAEF,MAAM,CAAC,MAAM,UAAU,GAAG,aAAa,CACrC,EAAE,QAAQ,EAAE,cAAc,EAAE,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,WAAW,EAAE,EACxE,KAAK,EAAE,GAAG,EAAE,EAAE;IACZ,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC;IACnC,MAAM,QAAQ,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;IAC/B,MAAM,KAAK,GAAG,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;IAEzB,MAAM,IAAI,GAAG,GAAG,CAAC,OAAsC,CAAC;IACxD,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,SAAS,CAAC,YAAY,CAC/C,QAAQ,EACR,KAAK,EACL,IAAI,CAAC,QAAQ,EACb,IAAI,CAAC,QAAQ,CACd,CAAC;IAEF,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,kDAAkD;QAClD,GAAG,CAAC,SAAS,EAAE,CAAC,GAAG,CAAC,CAAC;QACrB,OAAO;YACL,MAAM,EAAE,OAAgB;YACxB,OAAO,EAAE,+BAA+B;SACzC,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,cAAc,CAAC;QAChD,GAAG,EAAE,IAAI,CAAC,EAAE;QACZ,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,KAAK;QACL,YAAY,EAAE,sBAAsB;QACpC,cAAc,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,cAAc,EAAE;QAChD,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,QAAQ;QAChC,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,OAAO,EAAE,IAAI,CAAC,OAAO;KACtB,CAAC,CAAC;IACH,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACtE,CAAC;IAED,2EAA2E;IAC3E,0EAA0E;IAC1E,+CAA+C;IAC/C,MAAM,IAAI,GAAG,sBAAsB,CAAC,GAAG,EAAE,YAAY,EAAE,IAAI,CAAC,IAAI,IAAK,GAAG,CAAC,KAA2B,CAAC,IAAI,CAAC,CAAC;IAC3G,GAAG,CAAC,eAAe,EAAE,GAAG,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC;IAC9C,2EAA2E;IAC3E,wEAAwE;IACxE,IAAI,GAAG,CAAC,SAAS,EAAE,CAAC;QAClB,GAAG,CAAC,eAAe,EAAE,GAAG,CAAC,YAAY,EAAE,gBAAgB,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC;IAC1E,CAAC;IACD,0EAA0E;IAC1E,yEAAyE;IACzE,qEAAqE;IACrE,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,eAAe,EAAE,UAAU,MAAM,CAAC,WAAW,EAAE,EAAE;QAClE,gBAAgB,EAAE,MAAM,CAAC,2BAA2B;QACpD,MAAM,EAAE,IAAI;QACZ,WAAW,EAAE,UAAU;QACvB,oBAAoB,EAAE,EAAE;KACzB,CAAC,CAAC;IACH,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,cAAc,EAAE,MAAM,CAAC,YAAY,EAAE;QACtD,gBAAgB,EAAE,MAAM,CAAC,4BAA4B,IAAI,OAAO,CAAC,mBAAmB;QACpF,MAAM,EAAE,IAAI;QACZ,YAAY,EAAE,IAAI;KACnB,CAAC,CAAC;IAEH,OAAO;QACL,MAAM,EAAE,IAAa;QACrB,OAAO,EAAE,WAAW;QACpB,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,gBAAgB,EAAE,MAAM,CAAC,2BAA2B;QACpD,IAAI,EAAE;YACJ,EAAE,EAAE,IAAI,CAAC,EAAE;YACX,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,QAAQ;SACjC;KACF,CAAC;AACJ,CAAC,CACF,CAAC"}
+{"version":3,"file":"loginFlow.js","sourceRoot":"","sources":["../../../src/plugins/service-betterportal-auth-default/loginFlow.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAE9B,OAAO,EACL,gBAAgB,EAChB,sBAAsB,EAIvB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,aAAa,EAAE,MAAM,kCAAkC,CAAC;AACjE,OAAO,EAAE,cAAc,EAA0B,MAAM,2CAA2C,CAAC;AACnG,OAAO,EAAE,SAAS,EAAE,0BAA0B,EAAE,MAAM,mBAAmB,CAAC;AAC1E,OAAO,EAAE,2BAA2B,EAAE,MAAM,iBAAiB,CAAC;AAE9D,MAAM,CAAC,MAAM,WAAW,GAAG,EAAE,CAAC,MAAM,CAAC;IACnC,MAAM,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC,yDAAyD,CAAC;IACpG,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC,4GAA4G,CAAC;CACtJ,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,aAAa,GAAG,EAAE,CAAC,MAAM,CAAC,EAAE,cAAc,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;AAErF,MAAM,CAAC,MAAM,aAAa,GAAG,EAAE,CAAC,MAAM,CAAC;IACrC,QAAQ,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,sCAAsC,CAAC;IACnF,QAAQ,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,sCAAsC,CAAC;IACnF,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC,6DAA6D,CAAC;CACvG,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,cAAc,GAAG,EAAE,CAAC,MAAM,CAAC;IACtC,SAAS,EAAE,EAAE,CAAC,QAAQ,CAAC,gBAAgB,CAAC;IACxC,UAAU,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC;IACpC,SAAS,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC;IACnC,MAAM,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,OAAO,CAAU,CAAC,CAAC,QAAQ,CAAC,wBAAwB,CAAC;IAC7E,OAAO,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC,0DAA0D,CAAC;IACtG,WAAW,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC,uDAAuD,CAAC;IACvG,YAAY,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC,wDAAwD,CAAC;IACzG,gBAAgB,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,mCAAmC,CAAC;IAC5F,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,MAAM,CAAC;QAC1B,EAAE,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,wBAAwB,CAAC;QAClD,QAAQ,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,mBAAmB,CAAC;QACnD,KAAK,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC,+BAA+B,CAAC;QACzE,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC,yBAAyB,CAAC;KACnE,CAAC,CAAC,QAAQ,CAAC,6BAA6B,CAAC,CAAC;IAC3C,+EAA+E;IAC/E,8EAA8E;IAC9E,kBAAkB,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,kJAAkJ,CAAC;IACvM,+EAA+E;IAC/E,2EAA2E;IAC3E,aAAa,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC,kIAAkI,CAAC;IACpL,6EAA6E;IAC7E,gEAAgE;IAChE,eAAe,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,6IAA6I,CAAC;IAC/L,SAAS,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,oDAAoD,CAAC;IAChG,qEAAqE;IACrE,SAAS,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC,0DAA0D,CAAC;IACxG,6EAA6E;IAC7E,qDAAqD;IACrD,OAAO,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC,qGAAqG,CAAC;CAClJ,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,KAAK,GAAG,OAAO,CAAC;AAC7B,MAAM,CAAC,MAAM,WAAW,GAAG,2DAA2D,CAAC;AACvF,MAAM,CAAC,MAAM,IAAI,GAAG,YAAY,CAAC;AACjC,MAAM,CAAC,MAAM,YAAY,GAAG;IAC1B,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,EAAE;IAC7C,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,EAAE,KAAK,EAAE;IAClD,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,EAAE;IAC/C,EAAE,WAAW,EAAE,oBAAoB,EAAE,MAAM,EAAE,KAAK,EAAE;IACpD,EAAE,WAAW,EAAE,mBAAmB,EAAE,MAAM,EAAE,KAAK,EAAE;IACnD,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,EAAE,KAAK,EAAE;CAC1C,CAAC;AACX,MAAM,CAAC,MAAM,MAAM,GAA4B,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;AAEpE,MAAM,CAAC,MAAM,IAAI,GAAuB;IACtC,QAAQ,EAAE,KAAK;IACf,WAAW,EAAE,EAAE;CAChB,CAAC;AAEF,MAAM,CAAC,MAAM,UAAU,GAAe;IACpC,UAAU,EAAE,CAAC;IACb,MAAM,EAAE,EAAE;CACX,CAAC;AAEF,MAAM,CAAC,MAAM,SAAS,GAAG,aAAa,CACpC,EAAE,QAAQ,EAAE,cAAc,EAAE,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,aAAa,EAAE,EACxE,KAAK,EAAE,GAAG,EAAE,EAAE;IACZ,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC;IACnC,MAAM,kBAAkB,GAAG,OAAO,CAAC,YAAY,CAAC,EAAE,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,IAAI,MAAM,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC;IAC7L,IAAK,GAAG,CAAC,KAAmC,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QACjE,MAAM,2BAA2B,CAAC,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACnG,MAAM,OAAO,GAAG,sBAAsB,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC;QAC3D,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,eAAe,CAAC,CAAC;QACvC,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,cAAc,CAAC,CAAC;QACtC,IAAI,GAAG,CAAC,SAAS;YAAE,GAAG,CAAC,eAAe,EAAE,GAAG,CAAC,YAAY,EAAE,gBAAgB,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC;QAC3F,OAAO;YACL,MAAM,EAAE,IAAa;YACrB,OAAO,EAAE,aAAa;YACtB,SAAS,EAAE,IAAI;YACf,OAAO;SACR,CAAC;IACJ,CAAC;IAED,wEAAwE;IACxE,8EAA8E;IAC9E,IAAI,GAAG,CAAC,IAAI,IAAI,CAAC,kBAAkB,EAAE,CAAC;QACpC,MAAM,IAAI,GAAG,sBAAsB,CAAC,GAAG,EAAE,YAAY,EAAG,GAAG,CAAC,KAA2B,CAAC,IAAI,CAAC,CAAC;QAC9F,OAAO;YACL,MAAM,EAAE,IAAa;YACrB,OAAO,EAAE,oBAAoB;YAC7B,eAAe,EAAE,IAAI;YACrB,IAAI,EAAE;gBACJ,EAAE,EAAE,GAAG,CAAC,IAAI,CAAC,GAAG;gBAChB,QAAQ,EAAE,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,CAAC,KAAK,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG;gBACzD,KAAK,EAAE,GAAG,CAAC,IAAI,CAAC,KAAK;gBACrB,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,IAAI;aACpB;YACD,SAAS,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC,aAAa,EAAE,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,CAAC,IAAI,sBAAsB;YACnG,OAAO,EAAE,IAAI;SACd,CAAC;IACJ,CAAC;IAED,IAAI,aAAiC,CAAC;IACtC,IAAI,kBAAkB,EAAE,CAAC;QACvB,MAAM,IAAI,GAAI,GAAG,CAAC,KAA2B,CAAC,IAAI,CAAC;QACnD,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;QAC1C,aAAa,GAAG,GAAG,CAAC,QAAQ,EAAE,CAAC,gBAAgB,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;eACtE,GAAG,CAAC,QAAQ,EAAE,CAAC,gBAAgB,EAAE,EAAE,KAAK,EAAE,CAAC;eAC3C,SAAS,CAAC;IACjB,CAAC;IACD,OAAO;QACL,MAAM,EAAE,IAAa;QACrB,OAAO,EAAE,sDAAsD;QAC/D,SAAS,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC,cAAc,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,IAAI,SAAS;QAC1E,kBAAkB;QAClB,UAAU,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,IAAI,UAAU;QAC7E,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC5C,CAAC;AACJ,CAAC,CACF,CAAC;AAEF,MAAM,CAAC,MAAM,UAAU,GAAG,aAAa,CACrC,EAAE,QAAQ,EAAE,cAAc,EAAE,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,WAAW,EAAE,EACxE,KAAK,EAAE,GAAG,EAAE,EAAE;IACZ,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC;IACnC,MAAM,QAAQ,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;IAC/B,MAAM,KAAK,GAAG,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;IAEzB,MAAM,IAAI,GAAG,GAAG,CAAC,OAAsC,CAAC;IACxD,MAAM,KAAK,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IAClC,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC3C,IAAI,CAAC;QACL,MAAM,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,KAAK,EAAE,YAAY,EAAE,OAAO,CAAC,aAAa,EAAE,CAAC,GAAG,CAAC,QAA6B,CAAC,IAAI,cAAc,CAAC,GAAG,CAAC,QAA6B,CAAC,IAAI,SAAS,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;QAC9L,MAAM,cAAc,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC;QACvF,MAAM,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,cAAc,EAAE,OAAO,EAAE,0BAA0B,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;QACrG,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC9F,IAAI,CAAC,IAAI,EAAE,CAAC;YAAC,GAAG,CAAC,SAAS,EAAE,CAAC,GAAG,CAAC,CAAC;YAAC,OAAO,EAAE,MAAM,EAAE,OAAgB,EAAE,OAAO,EAAE,+BAA+B,EAAE,CAAC;QAAC,CAAC;QACnH,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE,CAAC,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;QACvH,MAAM,IAAI,GAAG,OAAO,CAAC,YAAY,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QAChE,IAAI,CAAC,IAAI,CAAC,aAAa,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,mBAAmB,KAAK,IAAI,EAAE,CAAC;YAAC,GAAG,CAAC,SAAS,EAAE,CAAC,GAAG,CAAC,CAAC;YAAC,OAAO,EAAE,MAAM,EAAE,OAAgB,EAAE,OAAO,EAAE,qGAAqG,EAAE,CAAC;QAAC,CAAC;QACrP,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QAC1D,IAAI,UAAU,IAAI,MAAM,CAAC,UAAU,IAAI,IAAI,EAAE,CAAC;YAC5C,MAAM,KAAK,GAAG,GAAG,CAAC,QAAsC,CAAC;YACzD,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,UAAU,CAAC,CAAC;YACvH,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,cAAc,EAAE,MAAM,EAAE,QAAQ,CAAC,OAAO,EAAE,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;YACrI,OAAO,EAAE,MAAM,EAAE,IAAa,EAAE,UAAU,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,IAAI,UAAU,EAAE,SAAS,EAAE,EAAE,GAAG,MAAM,EAAE,GAAG,QAAQ,CAAC,MAAM,EAAS,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,0DAA0D,EAAE,CAAC;QACnR,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,WAAW,EAAE,OAAO,CAAC,mBAAmB,CAAC,CAAC;QAC1H,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;QACtE,CAAC;QAED,2EAA2E;QAC3E,0EAA0E;QAC1E,+CAA+C;QAC/C,MAAM,IAAI,GAAG,sBAAsB,CAAC,GAAG,EAAE,YAAY,EAAE,IAAI,CAAC,IAAI,IAAK,GAAG,CAAC,KAA2B,CAAC,IAAI,CAAC,CAAC;QAC3G,GAAG,CAAC,eAAe,EAAE,GAAG,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC;QAC9C,2EAA2E;QAC3E,wEAAwE;QACxE,IAAI,GAAG,CAAC,SAAS,EAAE,CAAC;YAClB,GAAG,CAAC,eAAe,EAAE,GAAG,CAAC,YAAY,EAAE,gBAAgB,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC;QAC1E,CAAC;QACD,0EAA0E;QAC1E,yEAAyE;QACzE,qEAAqE;QACrE,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,eAAe,EAAE,UAAU,MAAM,CAAC,WAAW,EAAE,EAAE;YAClE,gBAAgB,EAAE,MAAM,CAAC,2BAA2B;YACpD,MAAM,EAAE,IAAI;YACZ,WAAW,EAAE,UAAU;YACvB,oBAAoB,EAAE,EAAE;SACzB,CAAC,CAAC;QACH,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,cAAc,EAAE,MAAM,CAAC,YAAY,EAAE;YACtD,gBAAgB,EAAE,MAAM,CAAC,4BAA4B,IAAI,OAAO,CAAC,mBAAmB;YACpF,MAAM,EAAE,IAAI;YACZ,YAAY,EAAE,IAAI;SACnB,CAAC,CAAC;QAEH,OAAO;YACL,MAAM,EAAE,IAAa;YACrB,OAAO,EAAE,WAAW;YACpB,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,gBAAgB,EAAE,MAAM,CAAC,2BAA2B;YACpD,IAAI,EAAE;gBACJ,EAAE,EAAE,IAAI,CAAC,EAAE;gBACX,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,QAAQ;aACjC;SACF,CAAC;IACF,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,CAAC,KAAK,YAAY,SAAS,CAAC;YAAE,MAAM,KAAK,CAAC;QAC/C,GAAG,CAAC,SAAS,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC9B,OAAO,EAAE,MAAM,EAAE,OAAgB,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;IAC9D,CAAC;AACH,CAAC,CACF,CAAC"}

package/lib/plugins/service-betterportal-auth-default/logoutFlow.js

@@ -59,6 +59,6 @@ export async function revokePresentedRefreshToken(runtime, token, tenantId, appI
     catch {
         return;
     } // Logout still clears invalid or expired credentials.
-    runtime.userStore.revokeRefreshToken(claims.jti, claims.exp);
+    await runtime.identity.revokeSession({ tenantId, appId }, claims);
 }
 //# sourceMappingURL=logoutFlow.js.map

package/lib/plugins/service-betterportal-auth-default/logoutFlow.js.map

@@ -1 +1 @@
-{"version":3,"file":"logoutFlow.js","sourceRoot":"","sources":["../../../src/plugins/service-betterportal-auth-default/logoutFlow.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAM9B,OAAO,EAAE,aAAa,EAAE,MAAM,kCAAkC,CAAC;AAGjE,MAAM,CAAC,MAAM,WAAW,GAAG,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;AACzC,MAAM,CAAC,MAAM,aAAa,GAAG,EAAE,CAAC,MAAM,CAAC,EAAE,cAAc,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;AACrF,MAAM,CAAC,MAAM,aAAa,GAAG,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;AAE3C,MAAM,CAAC,MAAM,cAAc,GAAG,EAAE,CAAC,MAAM,CAAC;IACtC,MAAM,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,IAAI,CAAU,CAAC,CAAC,QAAQ,CAAC,yBAAyB,CAAC;IACrE,OAAO,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,gDAAgD,CAAC;CAChF,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,KAAK,GAAG,QAAQ,CAAC;AAC9B,MAAM,CAAC,MAAM,WAAW,GAAG,iDAAiD,CAAC;AAC7E,MAAM,CAAC,MAAM,IAAI,GAAG,aAAa,CAAC;AAClC,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,EAAE,CAAU,CAAC;AAEtF,MAAM,CAAC,MAAM,IAAI,GAAuB;IACtC,QAAQ,EAAE,KAAK;IACf,WAAW,EAAE,EAAE;CAChB,CAAC;AAEF,MAAM,CAAC,MAAM,UAAU,GAAe;IACpC,UAAU,EAAE,CAAC;IACb,MAAM,EAAE,EAAE;CACX,CAAC;AAEF,MAAM,CAAC,MAAM,UAAU,GAAG,aAAa,CACrC,EAAE,QAAQ,EAAE,cAAc,EAAE,OAAO,EAAE,aAAa,EAAE,EACpD,KAAK,EAAE,GAAG,EAAE,EAAE;IACZ,MAAM,2BAA2B,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC9G,0EAA0E;IAC1E,yEAAyE;IACzE,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,eAAe,CAAC,CAAC;IACvC,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,cAAc,CAAC,CAAC;IACtC,GAAG,CAAC,eAAe,EAAE,GAAG,CACtB,aAAa,EACb,GAAG,CAAC,QAAQ,EAAE,CAAC,aAAa,EAAE,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,CAAC,IAAI,sBAAsB,CACzF,CAAC;IACF,2EAA2E;IAC3E,IAAI,GAAG,CAAC,SAAS,EAAE,CAAC;QAClB,GAAG,CAAC,eAAe,EAAE,GAAG,CAAC,YAAY,EAAE,gBAAgB,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC;IAC1E,CAAC;IACD,OAAO;QACL,MAAM,EAAE,IAAa;QACrB,OAAO,EAAE,kDAAkD;KAC5D,CAAC;AACJ,CAAC,CACF,CAAC;AAEF,MAAM,CAAC,MAAM,SAAS,GAAG,UAAU,CAAC;AAEpC;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,OAAoB,EAAE,KAAyB,EAAE,QAAgB,EAAE,KAAa;IAChI,IAAI,CAAC,KAAK;QAAE,OAAO;IACnB,IAAI,MAAM,CAAC;IACX,IAAI,CAAC;QAAC,MAAM,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,kBAAkB,CAAC,EAAE,YAAY,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;IAAC,CAAC;IACxG,MAAM,CAAC;QAAC,OAAO;IAAC,CAAC,CAAC,sDAAsD;IACxE,OAAO,CAAC,SAAS,CAAC,kBAAkB,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC;AAC/D,CAAC"}
+{"version":3,"file":"logoutFlow.js","sourceRoot":"","sources":["../../../src/plugins/service-betterportal-auth-default/logoutFlow.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAM9B,OAAO,EAAE,aAAa,EAAE,MAAM,kCAAkC,CAAC;AAGjE,MAAM,CAAC,MAAM,WAAW,GAAG,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;AACzC,MAAM,CAAC,MAAM,aAAa,GAAG,EAAE,CAAC,MAAM,CAAC,EAAE,cAAc,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;AACrF,MAAM,CAAC,MAAM,aAAa,GAAG,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;AAE3C,MAAM,CAAC,MAAM,cAAc,GAAG,EAAE,CAAC,MAAM,CAAC;IACtC,MAAM,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,IAAI,CAAU,CAAC,CAAC,QAAQ,CAAC,yBAAyB,CAAC;IACrE,OAAO,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,gDAAgD,CAAC;CAChF,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,KAAK,GAAG,QAAQ,CAAC;AAC9B,MAAM,CAAC,MAAM,WAAW,GAAG,iDAAiD,CAAC;AAC7E,MAAM,CAAC,MAAM,IAAI,GAAG,aAAa,CAAC;AAClC,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,EAAE,CAAU,CAAC;AAEtF,MAAM,CAAC,MAAM,IAAI,GAAuB;IACtC,QAAQ,EAAE,KAAK;IACf,WAAW,EAAE,EAAE;CAChB,CAAC;AAEF,MAAM,CAAC,MAAM,UAAU,GAAe;IACpC,UAAU,EAAE,CAAC;IACb,MAAM,EAAE,EAAE;CACX,CAAC;AAEF,MAAM,CAAC,MAAM,UAAU,GAAG,aAAa,CACrC,EAAE,QAAQ,EAAE,cAAc,EAAE,OAAO,EAAE,aAAa,EAAE,EACpD,KAAK,EAAE,GAAG,EAAE,EAAE;IACZ,MAAM,2BAA2B,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC9G,0EAA0E;IAC1E,yEAAyE;IACzE,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,eAAe,CAAC,CAAC;IACvC,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,cAAc,CAAC,CAAC;IACtC,GAAG,CAAC,eAAe,EAAE,GAAG,CACtB,aAAa,EACb,GAAG,CAAC,QAAQ,EAAE,CAAC,aAAa,EAAE,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,CAAC,IAAI,sBAAsB,CACzF,CAAC;IACF,2EAA2E;IAC3E,IAAI,GAAG,CAAC,SAAS,EAAE,CAAC;QAClB,GAAG,CAAC,eAAe,EAAE,GAAG,CAAC,YAAY,EAAE,gBAAgB,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC;IAC1E,CAAC;IACD,OAAO;QACL,MAAM,EAAE,IAAa;QACrB,OAAO,EAAE,kDAAkD;KAC5D,CAAC;AACJ,CAAC,CACF,CAAC;AAEF,MAAM,CAAC,MAAM,SAAS,GAAG,UAAU,CAAC;AAEpC;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,OAAoB,EAAE,KAAyB,EAAE,QAAgB,EAAE,KAAa;IAChI,IAAI,CAAC,KAAK;QAAE,OAAO;IACnB,IAAI,MAAM,CAAC;IACX,IAAI,CAAC;QAAC,MAAM,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,kBAAkB,CAAC,EAAE,YAAY,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;IAAC,CAAC;IACxG,MAAM,CAAC;QAAC,OAAO;IAAC,CAAC,CAAC,sDAAsD;IACxE,MAAM,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,MAAM,CAAC,CAAC;AACpE,CAAC"}

package/lib/plugins/service-betterportal-auth-default/registrationFlow.d.ts

@@ -6,6 +6,7 @@ export declare const QuerySchema: av.ObjectSchema<{
 }>;
 export declare const HeadersSchema: av.ObjectSchema<{}>;
 export declare const RequestSchema: av.ObjectSchema<{
+    setupToken: av.OptionalSchema<av.StringSchema>;
     username: av.StringSchema;
     password: av.StringSchema;
     email: av.OptionalSchema<av.StringSchema>;
@@ -39,7 +40,7 @@ export declare const cacheHints: CacheHints;
 export declare const handleGet: import("@betterportal/framework").RouteHandler<Record<string, string>, {
     next?: string | undefined;
 }, Record<string, string>, Record<string, unknown>, {
-    status: "ok" | "error";
+    status: "error" | "ok";
     message?: string | undefined;
     user?: {
         id: string;
@@ -56,10 +57,11 @@ export declare const handlePost: import("@betterportal/framework").RouteHandler<
 }, Record<string, string>, {
     username: string;
     password: string;
+    setupToken?: string | undefined;
     email?: string | undefined;
     name?: string | undefined;
 }, {
-    status: "ok" | "error";
+    status: "error" | "ok";
     message?: string | undefined;
     user?: {
         id: string;

package/lib/plugins/service-betterportal-auth-default/registrationFlow.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"registrationFlow.d.ts","sourceRoot":"","sources":["../../../src/plugins/service-betterportal-auth-default/registrationFlow.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EACL,KAAK,kBAAkB,EACvB,KAAK,UAAU,EACf,KAAK,uBAAuB,EAC7B,MAAM,yBAAyB,CAAC;AAGjC,eAAO,MAAM,WAAW;;EAEtB,CAAC;AACH,eAAO,MAAM,aAAa,qBAAgB,CAAC;AAE3C,eAAO,MAAM,aAAa;;;;;EAKxB,CAAC;AAEH,eAAO,MAAM,cAAc;;;;;;;;;;EAazB,CAAC;AACH,MAAM,MAAM,YAAY,GAAG,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAExD,eAAO,MAAM,KAAK,yBAAyB,CAAC;AAC5C,eAAO,MAAM,WAAW,wGAAwG,CAAC;AAEjI,eAAO,MAAM,IAAI,kBAAkB,CAAC;AACpC,eAAO,MAAM,YAAY;;;;;;EAGf,CAAC;AACX,eAAO,MAAM,MAAM,EAAE,uBAA8C,CAAC;AAEpE,eAAO,MAAM,IAAI,EAAE,kBAGlB,CAAC;AAEF,eAAO,MAAM,UAAU,EAAE,UAGxB,CAAC;AAEF,eAAO,MAAM,SAAS;;;;;;;;;;;;;;EAcrB,CAAC;AAEF,eAAO,MAAM,UAAU;;;;;;;;;;;;;;;;;;;EAkDtB,CAAC"}
+{"version":3,"file":"registrationFlow.d.ts","sourceRoot":"","sources":["../../../src/plugins/service-betterportal-auth-default/registrationFlow.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EACL,KAAK,kBAAkB,EACvB,KAAK,UAAU,EACf,KAAK,uBAAuB,EAC7B,MAAM,yBAAyB,CAAC;AAGjC,eAAO,MAAM,WAAW;;EAEtB,CAAC;AACH,eAAO,MAAM,aAAa,qBAAgB,CAAC;AAE3C,eAAO,MAAM,aAAa;;;;;;EAMxB,CAAC;AAEH,eAAO,MAAM,cAAc;;;;;;;;;;EAazB,CAAC;AACH,MAAM,MAAM,YAAY,GAAG,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAExD,eAAO,MAAM,KAAK,yBAAyB,CAAC;AAC5C,eAAO,MAAM,WAAW,wGAAwG,CAAC;AAEjI,eAAO,MAAM,IAAI,kBAAkB,CAAC;AACpC,eAAO,MAAM,YAAY;;;;;;EAGf,CAAC;AACX,eAAO,MAAM,MAAM,EAAE,uBAA8C,CAAC;AAEpE,eAAO,MAAM,IAAI,EAAE,kBAGlB,CAAC;AAEF,eAAO,MAAM,UAAU,EAAE,UAGxB,CAAC;AAEF,eAAO,MAAM,SAAS;;;;;;;;;;;;;;EAcrB,CAAC;AAEF,eAAO,MAAM,UAAU;;;;;;;;;;;;;;;;;;;;EA8CtB,CAAC"}

package/lib/plugins/service-betterportal-auth-default/registrationFlow.js

@@ -5,8 +5,9 @@ export const QuerySchema = av.object({
 });
 export const HeadersSchema = av.object({});
 export const RequestSchema = av.object({
-    username: av.string().minLength(1).describe("Username for the first admin account."),
-    password: av.string().minLength(8).describe("Password for the first admin account."),
+    setupToken: av.optional(av.string()),
+    username: av.string().minLength(1).describe("Username for the account."),
+    password: av.string().minLength(12).describe("Password for the first admin account."),
     email: av.optional(av.string()).describe("Email address for the first admin account."),
     name: av.optional(av.string()).describe("Display name for the first admin account.")
 });
@@ -18,10 +19,10 @@ export const ResponseSchema = av.object({
         username: av.string().describe("Created account username."),
         isFirstAdmin: av.bool().describe("True when this account is the deployment's first admin.")
     }).describe("Created first-admin user summary.")),
-    // GET state for the theme renderer: registrations are closed once any user
-    // exists; loginUrl (self-origin, absolute) is where the renderer sends the
+    // GET state for the theme renderer: registration closes after management
+    // bootstrap; loginUrl (self-origin, absolute) is where the renderer sends the
     // browser in that case - and after a successful first-admin creation.
-    registrationOpen: av.optional(av.bool()).describe("True while the auth service has zero users; once false, the renderer should send the browser to login."),
+    registrationOpen: av.optional(av.bool()).describe("True while management bootstrap is incomplete; once false, the renderer should send the browser to login."),
     loginUrl: av.optional(av.string()).describe("Absolute self-origin URL of this auth service's login view, used when registration is closed and after successful first-admin creation.")
 });
 export const title = "Register First Admin";
@@ -40,13 +41,13 @@ export const cacheHints = {
     ttlSeconds: 0,
     varyBy: []
 };
-export const handleGet = createHandler({ response: ResponseSchema, query: QuerySchema }, (ctx) => {
+export const handleGet = createHandler({ response: ResponseSchema, query: QuerySchema }, async (ctx) => {
     const runtime = ctx.plugin.runtime;
     const next = ctx.query.next;
     const query = next ? { next } : undefined;
     return {
         status: "ok",
-        registrationOpen: runtime.userStore.hasNoUsers(),
+        registrationOpen: runtime.isManagement({ tenantId: ctx.tenant.id, appId: ctx.app.id }) && await runtime.identity.bootstrapAvailable({ tenantId: ctx.tenant.id, appId: ctx.app.id }),
         loginUrl: ctx.routeUrl?.("login.index", { absolute: true, query })
             ?? ctx.routeUrl?.("login.index", { query })
             ?? undefined
@@ -56,8 +57,9 @@ export const handlePost = createHandler({ response: ResponseSchema, request: Req
     const runtime = ctx.plugin.runtime;
     const tenantId = ctx.tenant.id;
     const appId = ctx.app.id;
-    if (!runtime.userStore.hasNoUsers()) {
-        // Registration is closed once any user exists. Respond 404 so the route
+    const scope = { tenantId, appId };
+    if (!runtime.isManagement(scope) || !await runtime.identity.bootstrapAvailable(scope)) {
+        // Registration closes once management bootstrap completes. Respond 404 so the route
         // appears not to exist (no user-enumeration surface).
         ctx.setStatus?.(404);
         return {
@@ -67,14 +69,10 @@ export const handlePost = createHandler({ response: ResponseSchema, request: Req
     }
     const body = ctx.request;
     try {
-        const created = await runtime.userStore.createUser({
-            username: body.username,
-            password: body.password,
-            email: body.email,
-            name: body.name,
-            tenantId,
-            appRoles: { [appId]: ["*"] }
-        }, true);
+        await runtime.identity.rateLimit(scope, "bootstrap", "setup", 10);
+        if (!runtime.verifySetup(body.setupToken ?? ""))
+            throw new Error("Enter the deployment setup token.");
+        const created = await runtime.identity.createUser(scope, await runtime.policy(scope), { username: body.username, password: body.password, email: body.email, name: body.name }, ["*"], true);
         const next = ctx.query.next;
         const query = next ? { next } : undefined;
         return {

package/lib/plugins/service-betterportal-auth-default/registrationFlow.js.map

@@ -1 +1 @@
-{"version":3,"file":"registrationFlow.js","sourceRoot":"","sources":["../../../src/plugins/service-betterportal-auth-default/registrationFlow.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAO9B,OAAO,EAAE,aAAa,EAAE,MAAM,kCAAkC,CAAC;AAEjE,MAAM,CAAC,MAAM,WAAW,GAAG,EAAE,CAAC,MAAM,CAAC;IACnC,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC,wEAAwE,CAAC;CAClH,CAAC,CAAC;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;AAE3C,MAAM,CAAC,MAAM,aAAa,GAAG,EAAE,CAAC,MAAM,CAAC;IACrC,QAAQ,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,uCAAuC,CAAC;IACpF,QAAQ,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,uCAAuC,CAAC;IACpF,KAAK,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC,4CAA4C,CAAC;IACtF,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC,2CAA2C,CAAC;CACrF,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,cAAc,GAAG,EAAE,CAAC,MAAM,CAAC;IACtC,MAAM,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,OAAO,CAAU,CAAC,CAAC,QAAQ,CAAC,+BAA+B,CAAC;IACpF,OAAO,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC,0DAA0D,CAAC;IACtG,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,MAAM,CAAC;QAC1B,EAAE,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,wBAAwB,CAAC;QAClD,QAAQ,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,2BAA2B,CAAC;QAC3D,YAAY,EAAE,EAAE,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,yDAAyD,CAAC;KAC5F,CAAC,CAAC,QAAQ,CAAC,mCAAmC,CAAC,CAAC;IACjD,2EAA2E;IAC3E,2EAA2E;IAC3E,sEAAsE;IACtE,gBAAgB,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,wGAAwG,CAAC;IAC3J,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC,yIAAyI,CAAC;CACvL,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,KAAK,GAAG,sBAAsB,CAAC;AAC5C,MAAM,CAAC,MAAM,WAAW,GAAG,qGAAqG,CAAC;AAEjI,MAAM,CAAC,MAAM,IAAI,GAAG,eAAe,CAAC;AACpC,MAAM,CAAC,MAAM,YAAY,GAAG;IAC1B,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,EAAE;IAChD,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,EAAE,KAAK,EAAE;CACzC,CAAC;AACX,MAAM,CAAC,MAAM,MAAM,GAA4B,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;AAEpE,MAAM,CAAC,MAAM,IAAI,GAAuB;IACtC,QAAQ,EAAE,KAAK;IACf,WAAW,EAAE,EAAE;CAChB,CAAC;AAEF,MAAM,CAAC,MAAM,UAAU,GAAe;IACpC,UAAU,EAAE,CAAC;IACb,MAAM,EAAE,EAAE;CACX,CAAC;AAEF,MAAM,CAAC,MAAM,SAAS,GAAG,aAAa,CACpC,EAAE,QAAQ,EAAE,cAAc,EAAE,KAAK,EAAE,WAAW,EAAE,EAChD,CAAC,GAAG,EAAE,EAAE;IACN,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC;IACnC,MAAM,IAAI,GAAI,GAAG,CAAC,KAA2B,CAAC,IAAI,CAAC;IACnD,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IAC1C,OAAO;QACL,MAAM,EAAE,IAAa;QACrB,gBAAgB,EAAE,OAAO,CAAC,SAAS,CAAC,UAAU,EAAE;QAChD,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC,aAAa,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;eAC7D,GAAG,CAAC,QAAQ,EAAE,CAAC,aAAa,EAAE,EAAE,KAAK,EAAE,CAAC;eACxC,SAAS;KACf,CAAC;AACJ,CAAC,CACF,CAAC;AAEF,MAAM,CAAC,MAAM,UAAU,GAAG,aAAa,CACrC,EAAE,QAAQ,EAAE,cAAc,EAAE,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,WAAW,EAAE,EACxE,KAAK,EAAE,GAAG,EAAE,EAAE;IACZ,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC;IACnC,MAAM,QAAQ,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;IAC/B,MAAM,KAAK,GAAG,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;IAEzB,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,UAAU,EAAE,EAAE,CAAC;QACpC,wEAAwE;QACxE,sDAAsD;QACtD,GAAG,CAAC,SAAS,EAAE,CAAC,GAAG,CAAC,CAAC;QACrB,OAAO;YACL,MAAM,EAAE,OAAgB;YACxB,OAAO,EAAE,EAAE;SACZ,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,GAAG,CAAC,OAAsC,CAAC;IACxD,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,SAAS,CAAC,UAAU,CAAC;YACjD,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,QAAQ;YACR,QAAQ,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE;SAC7B,EAAE,IAAI,CAAC,CAAC;QACT,MAAM,IAAI,GAAI,GAAG,CAAC,KAA2B,CAAC,IAAI,CAAC;QACnD,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;QAC1C,OAAO;YACL,MAAM,EAAE,IAAa;YACrB,OAAO,EAAE,sBAAsB;YAC/B,IAAI,EAAE;gBACJ,EAAE,EAAE,OAAO,CAAC,EAAE;gBACd,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,YAAY,EAAE,IAAI;aACnB;YACD,qEAAqE;YACrE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC,aAAa,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;mBAC7D,GAAG,CAAC,QAAQ,EAAE,CAAC,aAAa,EAAE,EAAE,KAAK,EAAE,CAAC;mBACxC,SAAS;SACf,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,SAAS,EAAE,CAAC,GAAG,CAAC,CAAC;QACrB,OAAO;YACL,MAAM,EAAE,OAAgB;YACxB,OAAO,EAAG,GAAa,CAAC,OAAO;SAChC,CAAC;IACJ,CAAC;AACH,CAAC,CACF,CAAC"}
+{"version":3,"file":"registrationFlow.js","sourceRoot":"","sources":["../../../src/plugins/service-betterportal-auth-default/registrationFlow.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAO9B,OAAO,EAAE,aAAa,EAAE,MAAM,kCAAkC,CAAC;AAEjE,MAAM,CAAC,MAAM,WAAW,GAAG,EAAE,CAAC,MAAM,CAAC;IACnC,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC,wEAAwE,CAAC;CAClH,CAAC,CAAC;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;AAE3C,MAAM,CAAC,MAAM,aAAa,GAAG,EAAE,CAAC,MAAM,CAAC;IACrC,UAAU,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC;IACpC,QAAQ,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,2BAA2B,CAAC;IACxE,QAAQ,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,uCAAuC,CAAC;IACrF,KAAK,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC,4CAA4C,CAAC;IACtF,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC,2CAA2C,CAAC;CACrF,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,cAAc,GAAG,EAAE,CAAC,MAAM,CAAC;IACtC,MAAM,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,OAAO,CAAU,CAAC,CAAC,QAAQ,CAAC,+BAA+B,CAAC;IACpF,OAAO,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC,0DAA0D,CAAC;IACtG,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,MAAM,CAAC;QAC1B,EAAE,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,wBAAwB,CAAC;QAClD,QAAQ,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,2BAA2B,CAAC;QAC3D,YAAY,EAAE,EAAE,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,yDAAyD,CAAC;KAC5F,CAAC,CAAC,QAAQ,CAAC,mCAAmC,CAAC,CAAC;IACjD,yEAAyE;IACzE,8EAA8E;IAC9E,sEAAsE;IACtE,gBAAgB,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,2GAA2G,CAAC;IAC9J,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC,yIAAyI,CAAC;CACvL,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,KAAK,GAAG,sBAAsB,CAAC;AAC5C,MAAM,CAAC,MAAM,WAAW,GAAG,qGAAqG,CAAC;AAEjI,MAAM,CAAC,MAAM,IAAI,GAAG,eAAe,CAAC;AACpC,MAAM,CAAC,MAAM,YAAY,GAAG;IAC1B,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,EAAE;IAChD,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,EAAE,KAAK,EAAE;CACzC,CAAC;AACX,MAAM,CAAC,MAAM,MAAM,GAA4B,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;AAEpE,MAAM,CAAC,MAAM,IAAI,GAAuB;IACtC,QAAQ,EAAE,KAAK;IACf,WAAW,EAAE,EAAE;CAChB,CAAC;AAEF,MAAM,CAAC,MAAM,UAAU,GAAe;IACpC,UAAU,EAAE,CAAC;IACb,MAAM,EAAE,EAAE;CACX,CAAC;AAEF,MAAM,CAAC,MAAM,SAAS,GAAG,aAAa,CACpC,EAAE,QAAQ,EAAE,cAAc,EAAE,KAAK,EAAE,WAAW,EAAE,EAChD,KAAK,EAAE,GAAG,EAAE,EAAE;IACZ,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC;IACnC,MAAM,IAAI,GAAI,GAAG,CAAC,KAA2B,CAAC,IAAI,CAAC;IACnD,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IAC1C,OAAO;QACL,MAAM,EAAE,IAAa;QACrB,gBAAgB,EAAE,OAAO,CAAC,YAAY,CAAC,EAAE,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,IAAI,MAAM,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACnL,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC,aAAa,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;eAC7D,GAAG,CAAC,QAAQ,EAAE,CAAC,aAAa,EAAE,EAAE,KAAK,EAAE,CAAC;eACxC,SAAS;KACf,CAAC;AACJ,CAAC,CACF,CAAC;AAEF,MAAM,CAAC,MAAM,UAAU,GAAG,aAAa,CACrC,EAAE,QAAQ,EAAE,cAAc,EAAE,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,WAAW,EAAE,EACxE,KAAK,EAAE,GAAG,EAAE,EAAE;IACZ,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC;IACnC,MAAM,QAAQ,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;IAC/B,MAAM,KAAK,GAAG,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;IAEzB,MAAM,KAAK,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IAClC,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC;QACtF,oFAAoF;QACpF,sDAAsD;QACtD,GAAG,CAAC,SAAS,EAAE,CAAC,GAAG,CAAC,CAAC;QACrB,OAAO;YACL,MAAM,EAAE,OAAgB;YACxB,OAAO,EAAE,EAAE;SACZ,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,GAAG,CAAC,OAAsC,CAAC;IACxD,IAAI,CAAC;QACH,MAAM,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC;QAClE,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,UAAU,IAAI,EAAE,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;QACtG,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,KAAK,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC;QAC7L,MAAM,IAAI,GAAI,GAAG,CAAC,KAA2B,CAAC,IAAI,CAAC;QACnD,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;QAC1C,OAAO;YACL,MAAM,EAAE,IAAa;YACrB,OAAO,EAAE,sBAAsB;YAC/B,IAAI,EAAE;gBACJ,EAAE,EAAE,OAAO,CAAC,EAAE;gBACd,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,YAAY,EAAE,IAAI;aACnB;YACD,qEAAqE;YACrE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC,aAAa,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;mBAC7D,GAAG,CAAC,QAAQ,EAAE,CAAC,aAAa,EAAE,EAAE,KAAK,EAAE,CAAC;mBACxC,SAAS;SACf,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,SAAS,EAAE,CAAC,GAAG,CAAC,CAAC;QACrB,OAAO;YACL,MAAM,EAAE,OAAgB;YACxB,OAAO,EAAG,GAAa,CAAC,OAAO;SAChC,CAAC;IACJ,CAAC;AACH,CAAC,CACF,CAAC"}

package/lib/schemas/service-betterportal-auth-default.json

@@ -2,7 +2,7 @@
   "pluginId": "service-betterportal-auth-default",
   "pluginName": "service-betterportal-auth-default",
   "events": {},
-  "version": "10.6.21",
+  "version": "10.6.23",
   "configSchema": {
     "anyvaliVersion": "1.0",
     "schemaVersion": "1.1",
@@ -48,6 +48,26 @@
           "minLength": 1,
           "default": "./.bp-auth-state/users.json"
         },
+        "mode": {
+          "kind": "enum",
+          "values": [
+            "simple",
+            "advanced"
+          ],
+          "default": "simple"
+        },
+        "postgresUrl": {
+          "kind": "string",
+          "default": ""
+        },
+        "encryptionKey": {
+          "kind": "string",
+          "default": ""
+        },
+        "setupToken": {
+          "kind": "string",
+          "default": ""
+        },
         "betterportal": {
           "kind": "optional",
           "inner": {
@@ -127,7 +147,11 @@
         "accessTokenSeconds",
         "refreshTokenSeconds",
         "keyStorePath",
-        "userStorePath"
+        "userStorePath",
+        "mode",
+        "postgresUrl",
+        "encryptionKey",
+        "setupToken"
       ],
       "unknownKeys": "strip"
     },

package/lib/schemas/service-betterportal-auth-default.plugin.json

@@ -1,8 +1,8 @@
 {
   "id": "service-betterportal-auth-default",
   "name": "service-betterportal-auth-default",
-  "version": "10.6.21",
-  "description": "Default BetterPortal v10 auth service: JWKS, login/logout/refresh, bcrypt user store",
+  "version": "10.6.23",
+  "description": "Default BetterPortal auth: app-scoped accounts, social sign-in, MFA and JWT sessions",
   "category": "service",
   "tags": [
     "betterportal",
@@ -65,6 +65,26 @@
           "minLength": 1,
           "default": "./.bp-auth-state/users.json"
         },
+        "mode": {
+          "kind": "enum",
+          "values": [
+            "simple",
+            "advanced"
+          ],
+          "default": "simple"
+        },
+        "postgresUrl": {
+          "kind": "string",
+          "default": ""
+        },
+        "encryptionKey": {
+          "kind": "string",
+          "default": ""
+        },
+        "setupToken": {
+          "kind": "string",
+          "default": ""
+        },
         "betterportal": {
           "kind": "optional",
           "inner": {
@@ -144,7 +164,11 @@
         "accessTokenSeconds",
         "refreshTokenSeconds",
         "keyStorePath",
-        "userStorePath"
+        "userStorePath",
+        "mode",
+        "postgresUrl",
+        "encryptionKey",
+        "setupToken"
       ],
       "unknownKeys": "strip"
     },

package/lib/social.d.ts

@@ -0,0 +1,40 @@
+import { type RouteHandlerContext, type JsonObject } from "@betterportal/framework";
+import type { AuthRuntime } from "./plugins/service-betterportal-auth-default/index.js";
+type Context = RouteHandlerContext & {
+    plugin: {
+        runtime: AuthRuntime;
+    };
+};
+export interface SocialConnection {
+    id: string;
+    kind: "google" | "microsoft" | "github";
+    clientId: string;
+    clientSecret: string;
+    tenantId?: string;
+}
+export interface ExternalIdentity {
+    issuer: string;
+    subject: string;
+    email?: string;
+    emailVerified: boolean;
+    name?: string;
+}
+/** Enterprise adapters can implement the same normalized identity boundary later. */
+export interface IdentityProviderAdapter {
+    authorize(connection: SocialConnection, parameters: Record<string, string>): Promise<string>;
+    exchange(connection: SocialConnection, callback: URL, checks: {
+        verifier: string;
+        nonce: string;
+        state: string;
+        redirectUri: string;
+    }): Promise<ExternalIdentity>;
+}
+export declare function socialConnections(runtime: AuthRuntime, scope: {
+    tenantId: string;
+    appId: string;
+}): SocialConnection[];
+export declare function parseSocialConnections(configured: unknown): SocialConnection[];
+export declare const socialAdapter: IdentityProviderAdapter;
+export declare function socialPost(ctx: Context): Promise<JsonObject>;
+export {};
+//# sourceMappingURL=social.d.ts.map

package/lib/social.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"social.d.ts","sourceRoot":"","sources":["../src/social.ts"],"names":[],"mappings":"AAEA,OAAO,EAAoB,KAAK,mBAAmB,EAAE,KAAK,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAEtG,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,sDAAsD,CAAC;AAIxF,KAAK,OAAO,GAAG,mBAAmB,GAAG;IAAE,MAAM,EAAE;QAAE,OAAO,EAAE,WAAW,CAAA;KAAE,CAAA;CAAE,CAAC;AAC1E,MAAM,WAAW,gBAAgB;IAAG,EAAE,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,QAAQ,GAAG,WAAW,GAAG,QAAQ,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE;AAMpJ,MAAM,WAAW,gBAAgB;IAAG,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,OAAO,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE;AAC5H,qFAAqF;AACrF,MAAM,WAAW,uBAAuB;IACtC,SAAS,CAAC,UAAU,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC7F,QAAQ,CAAC,UAAU,EAAE,gBAAgB,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;CACnK;AACD,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG,gBAAgB,EAAE,CAEtH;AACD,wBAAgB,sBAAsB,CAAC,UAAU,EAAE,OAAO,GAAG,gBAAgB,EAAE,CAW9E;AAKD,eAAO,MAAM,aAAa,EAAE,uBA0B3B,CAAC;AACF,wBAAsB,UAAU,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAAC,UAAU,CAAC,CAiFlE"}