@bevel-software/platform-core-backend 0.14.0 → 0.19.0

package/dist/modules/auth/auth.routes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.routes.d.ts","sourceRoot":"","sources":["../../../src/modules/auth/auth.routes.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAIrD;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,QAAmB,CAAC;AAEtD;;;;;;;;;GASG;AACH,MAAM,WAAW,kBAAkB;IACjC,gEAAgE;IAChE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,0DAA0D;IAC1D,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,oFAAoF;IACpF,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,iFAAiF;IACjF,WAAW,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,WAAW,EAAE,WAAW,GAAG,IAAI,CAAC;CACrE;AAED,wBAAgB,gBAAgB,CAC9B,WAAW,EAAE,WAAW,EACxB,cAAc,EAAE,OAAO,CAAC,cAAc,EACtC,SAAS,GAAE,kBAAkB,EAAO,EACpC,oBAAoB,UAAO,GAC1B,OAAO,CAAC,MAAM,CAoKhB"}
+{"version":3,"file":"auth.routes.d.ts","sourceRoot":"","sources":["../../../src/modules/auth/auth.routes.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,MAAM,SAAS,CAAC;AAI9B,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAKrD;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,QAAmB,CAAC;AAEtD;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,kBAAkB;IACjC,gEAAgE;IAChE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,0DAA0D;IAC1D,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,oFAAoF;IACpF,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B;;;OAGG;IACH,SAAS,CAAC,IAAI,OAAO,CAAC;IACtB,iFAAiF;IACjF,WAAW,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,WAAW,EAAE,WAAW,GAAG,IAAI,CAAC;CACrE;AAED,wBAAgB,gBAAgB,CAC9B,WAAW,EAAE,WAAW,EACxB,cAAc,EAAE,OAAO,CAAC,cAAc,EACtC,SAAS,GAAE,kBAAkB,EAAO,EACpC,oBAAoB,UAAO,GAC1B,OAAO,CAAC,MAAM,CAsKhB"}

package/dist/modules/auth/auth.routes.js

@@ -1,6 +1,9 @@
 import express from 'express';
+import { logger } from '../../shared/logging.js';
+const log = logger('auth');
 import { AUTH_COOKIE_NAME } from './auth.middleware.js'; // also imports Express Request augmentation
 import { FixedWindowRateLimiter } from './rate-limit.js';
+import { canonicalEmail } from '../../shared/email-identity.js';
 /**
  * Max age of the JWT cookie (seconds). Matches the JWT's own `expiresIn:
  * '7d'` so the cookie expires when the token does — browsers stop
@@ -45,7 +48,7 @@ export function createAuthRoutes(authService, authMiddleware, providers = [], pa
             res.status(429).json({ error: 'Too many attempts. Try again later.' });
             return;
         }
-        const pairKey = `${ip}|${email.trim().toLowerCase()}`;
+        const pairKey = `${ip}|${canonicalEmail(email)}`;
         if (!loginPairLimiter.consume(pairKey)) {
             res.status(429).json({ error: 'Too many attempts. Try again later.' });
             return;
@@ -72,7 +75,7 @@ export function createAuthRoutes(authService, authMiddleware, providers = [], pa
         }
         catch (error) {
             const msg = error instanceof Error ? error.message : 'Unknown error';
-            console.error('Login error:', msg);
+            log.error('Login error:', { detail: msg });
             res.status(401).json({ error: 'Authentication failed' });
         }
     });
@@ -82,7 +85,9 @@ export function createAuthRoutes(authService, authMiddleware, providers = [], pa
     router.get('/auth/providers', (_req, res) => {
         res.json({
             password: passwordLoginEnabled,
-            sso: providers.map((p) => ({ key: p.key, label: p.label, startPath: p.startPath })),
+            sso: providers
+                .filter((p) => p.isEnabled?.() ?? true)
+                .map((p) => ({ key: p.key, label: p.label, startPath: p.startPath })),
         });
     });
     for (const provider of providers)
@@ -145,7 +150,7 @@ export function createAuthRoutes(authService, authMiddleware, providers = [], pa
             // A raw driver message here would hand an unauthenticated-adjacent
             // caller the schema, the host, or the connection string.
             const msg = error instanceof Error ? error.message : 'Unknown error';
-            console.error('Onboarding-done error:', msg);
+            log.error('Onboarding-done error:', { detail: msg });
             res.status(500).json({ error: 'Could not save that' });
         }
     });

package/dist/modules/auth/auth.routes.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.routes.js","sourceRoot":"","sources":["../../../src/modules/auth/auth.routes.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,MAAM,SAAS,CAAC;AAE9B,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC,CAAC,4CAA4C;AACrG,OAAO,EAAE,sBAAsB,EAAE,MAAM,iBAAiB,CAAC;AAEzD;;;;;GAKG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;AAuBtD,MAAM,UAAU,gBAAgB,CAC9B,WAAwB,EACxB,cAAsC,EACtC,YAAkC,EAAE,EACpC,oBAAoB,GAAG,IAAI;IAE3B,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAEhC,uEAAuE;IACvE,qEAAqE;IACrE,2EAA2E;IAC3E,sEAAsE;IACtE,uBAAuB;IACvB,2EAA2E;IAC3E,qDAAqD;IACrD,MAAM,gBAAgB,GAAG,IAAI,sBAAsB,CAAC,EAAE,EAAE,EAAE,GAAG,MAAM,CAAC,CAAC;IACrE,MAAM,cAAc,GAAG,IAAI,sBAAsB,CAAC,EAAE,EAAE,EAAE,GAAG,MAAM,CAAC,CAAC;IACnE,MAAM,qBAAqB,GAAG,IAAI,sBAAsB,CAAC,EAAE,EAAE,EAAE,GAAG,MAAM,CAAC,CAAC;IAC1E,MAAM,QAAQ,GAAG,CAAC,GAAoB,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,IAAI,GAAG,CAAC,MAAM,CAAC,aAAa,IAAI,SAAS,CAAC;IAE3F,uEAAuE;IACvE,oEAAoE;IACpE,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAC5C,IAAI,CAAC,oBAAoB,EAAE,CAAC;YAC1B,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,4BAA4B,EAAE,CAAC,CAAC;YAC9D,OAAO;QACT,CAAC;QACD,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,GAAG,CAAC,IAA6C,CAAC;QAC9E,IAAI,CAAC,KAAK,IAAI,CAAC,QAAQ,EAAE,CAAC;YACxB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iCAAiC,EAAE,CAAC,CAAC;YACnE,OAAO;QACT,CAAC;QACD,MAAM,EAAE,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;QACzB,2EAA2E;QAC3E,4EAA4E;QAC5E,yEAAyE;QACzE,2EAA2E;QAC3E,uEAAuE;QACvE,2EAA2E;QAC3E,oEAAoE;QACpE,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,CAAC;YAChC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,qCAAqC,EAAE,CAAC,CAAC;YACvE,OAAO;QACT,CAAC;QACD,MAAM,OAAO,GAAG,GAAG,EAAE,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;QACtD,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YACvC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,qCAAqC,EAAE,CAAC,CAAC;YACvE,OAAO;QACT,CAAC;QAED,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,iBAAiB,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;YACpE,iEAAiE;YACjE,qEAAqE;YACrE,wCAAwC;YACxC,gBAAgB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAChC,kEAAkE;YAClE,+DAA+D;YAC/D,gEAAgE;YAChE,gEAAgE;YAChE,+CAA+C;YAC/C,GAAG,CAAC,MAAM,CAAC,gBAAgB,EAAE,MAAM,CAAC,KAAK,EAAE;gBACzC,QAAQ,EAAE,IAAI;gBACd,QAAQ,EAAE,KAAK;gBACf,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY;gBAC7C,MAAM,EAAE,qBAAqB,GAAG,IAAI;gBACpC,IAAI,EAAE,GAAG;aACV,CAAC,CAAC;YACH,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACnB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,GAAG,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC;YACrE,OAAO,CAAC,KAAK,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC;YACnC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,6EAA6E;IAC7E,0EAA0E;IAC1E,4DAA4D;IAC5D,MAAM,CAAC,GAAG,CAAC,iBAAiB,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QAC1C,GAAG,CAAC,IAAI,CAAC;YACP,QAAQ,EAAE,oBAAoB;YAC9B,GAAG,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC;SACpF,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,KAAK,MAAM,QAAQ,IAAI,SAAS;QAAE,QAAQ,CAAC,WAAW,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IAE5E,0EAA0E;IAC1E,2EAA2E;IAC3E,wBAAwB;IACxB,MAAM,CAAC,IAAI,CAAC,uBAAuB,EAAE,cAAc,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACtE,MAAM,EAAE,eAAe,EAAE,WAAW,EAAE,GAAG,GAAG,CAAC,IAG5C,CAAC;QACF,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC,CAAC;YAC3D,OAAO;QACT,CAAC;QACD,IAAI,CAAC,qBAAqB,CAAC,OAAO,CAAC,GAAG,CAAC,MAAO,CAAC,EAAE,CAAC;YAChD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,qCAAqC,EAAE,CAAC,CAAC;YACvE,OAAO;QACT,CAAC;QACD,IAAI,CAAC;YACH,MAAM,WAAW,CAAC,cAAc,CAAC,GAAG,CAAC,MAAO,EAAE,eAAe,EAAE,WAAW,CAAC,CAAC;YAC5E,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QACzB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,GAAG,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC;YACrE,wEAAwE;YACxE,4DAA4D;YAC5D,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;QACvC,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,mEAAmE;IACnE,qEAAqE;IACrE,qEAAqE;IACrE,MAAM,CAAC,IAAI,CAAC,uBAAuB,EAAE,cAAc,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACtE,IAAI,CAAC;YACH,wEAAwE;YACxE,oEAAoE;YACpE,iBAAiB;YACjB,EAAE;YACF,yEAAyE;YACzE,wEAAwE;YACxE,gEAAgE;YAChE,oEAAoE;YACpE,yEAAyE;YACzE,8CAA8C;YAC9C,EAAE;YACF,yEAAyE;YACzE,0EAA0E;YAC1E,yEAAyE;YACzE,oEAAoE;YACpE,yCAAyC;YACzC,MAAM,OAAO,GAAI,GAAG,CAAC,IAAyC,EAAE,MAAM,CAAC;YACvE,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,GAAG,CAAC,MAAM,EAAE,CAAC;gBAC1D,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iCAAiC,EAAE,CAAC,CAAC;gBACnE,OAAO;YACT,CAAC;YACD,MAAM,WAAW,CAAC,kBAAkB,CAAC,GAAG,CAAC,MAAO,CAAC,CAAC;YAClD,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QACzB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,uEAAuE;YACvE,mEAAmE;YACnE,yDAAyD;YACzD,MAAM,GAAG,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC;YACrE,OAAO,CAAC,KAAK,CAAC,wBAAwB,EAAE,GAAG,CAAC,CAAC;YAC7C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,qBAAqB,EAAE,CAAC,CAAC;QACzD,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,uEAAuE;IACvE,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE,cAAc,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACxD,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,WAAW,CAAC,GAAG,CAAC,MAAO,CAAC,CAAC;YACxD,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;gBAClD,OAAO;YACT,CAAC;YACD,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,GAAG,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC;YACrE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;QACvC,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC"}
+{"version":3,"file":"auth.routes.js","sourceRoot":"","sources":["../../../src/modules/auth/auth.routes.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,MAAM,SAAS,CAAC;AAC9B,OAAO,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAEjD,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;AAE3B,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC,CAAC,4CAA4C;AACrG,OAAO,EAAE,sBAAsB,EAAE,MAAM,iBAAiB,CAAC;AACzD,OAAO,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AAEhE;;;;;GAKG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;AA8BtD,MAAM,UAAU,gBAAgB,CAC9B,WAAwB,EACxB,cAAsC,EACtC,YAAkC,EAAE,EACpC,oBAAoB,GAAG,IAAI;IAE3B,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAEhC,uEAAuE;IACvE,qEAAqE;IACrE,2EAA2E;IAC3E,sEAAsE;IACtE,uBAAuB;IACvB,2EAA2E;IAC3E,qDAAqD;IACrD,MAAM,gBAAgB,GAAG,IAAI,sBAAsB,CAAC,EAAE,EAAE,EAAE,GAAG,MAAM,CAAC,CAAC;IACrE,MAAM,cAAc,GAAG,IAAI,sBAAsB,CAAC,EAAE,EAAE,EAAE,GAAG,MAAM,CAAC,CAAC;IACnE,MAAM,qBAAqB,GAAG,IAAI,sBAAsB,CAAC,EAAE,EAAE,EAAE,GAAG,MAAM,CAAC,CAAC;IAC1E,MAAM,QAAQ,GAAG,CAAC,GAAoB,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,IAAI,GAAG,CAAC,MAAM,CAAC,aAAa,IAAI,SAAS,CAAC;IAE3F,uEAAuE;IACvE,oEAAoE;IACpE,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAC5C,IAAI,CAAC,oBAAoB,EAAE,CAAC;YAC1B,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,4BAA4B,EAAE,CAAC,CAAC;YAC9D,OAAO;QACT,CAAC;QACD,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,GAAG,CAAC,IAA6C,CAAC;QAC9E,IAAI,CAAC,KAAK,IAAI,CAAC,QAAQ,EAAE,CAAC;YACxB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iCAAiC,EAAE,CAAC,CAAC;YACnE,OAAO;QACT,CAAC;QACD,MAAM,EAAE,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;QACzB,2EAA2E;QAC3E,4EAA4E;QAC5E,yEAAyE;QACzE,2EAA2E;QAC3E,uEAAuE;QACvE,2EAA2E;QAC3E,oEAAoE;QACpE,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,CAAC;YAChC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,qCAAqC,EAAE,CAAC,CAAC;YACvE,OAAO;QACT,CAAC;QACD,MAAM,OAAO,GAAG,GAAG,EAAE,IAAI,cAAc,CAAC,KAAK,CAAC,EAAE,CAAC;QACjD,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YACvC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,qCAAqC,EAAE,CAAC,CAAC;YACvE,OAAO;QACT,CAAC;QAED,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,iBAAiB,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;YACpE,iEAAiE;YACjE,qEAAqE;YACrE,wCAAwC;YACxC,gBAAgB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAChC,kEAAkE;YAClE,+DAA+D;YAC/D,gEAAgE;YAChE,gEAAgE;YAChE,+CAA+C;YAC/C,GAAG,CAAC,MAAM,CAAC,gBAAgB,EAAE,MAAM,CAAC,KAAK,EAAE;gBACzC,QAAQ,EAAE,IAAI;gBACd,QAAQ,EAAE,KAAK;gBACf,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY;gBAC7C,MAAM,EAAE,qBAAqB,GAAG,IAAI;gBACpC,IAAI,EAAE,GAAG;aACV,CAAC,CAAC;YACH,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACnB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,GAAG,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC;YACrE,GAAG,CAAC,KAAK,CAAC,cAAc,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;YAC3C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,6EAA6E;IAC7E,0EAA0E;IAC1E,4DAA4D;IAC5D,MAAM,CAAC,GAAG,CAAC,iBAAiB,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QAC1C,GAAG,CAAC,IAAI,CAAC;YACP,QAAQ,EAAE,oBAAoB;YAC9B,GAAG,EAAE,SAAS;iBACX,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,EAAE,EAAE,IAAI,IAAI,CAAC;iBACtC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC;SACxE,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,KAAK,MAAM,QAAQ,IAAI,SAAS;QAAE,QAAQ,CAAC,WAAW,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IAE5E,0EAA0E;IAC1E,2EAA2E;IAC3E,wBAAwB;IACxB,MAAM,CAAC,IAAI,CAAC,uBAAuB,EAAE,cAAc,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACtE,MAAM,EAAE,eAAe,EAAE,WAAW,EAAE,GAAG,GAAG,CAAC,IAG5C,CAAC;QACF,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC,CAAC;YAC3D,OAAO;QACT,CAAC;QACD,IAAI,CAAC,qBAAqB,CAAC,OAAO,CAAC,GAAG,CAAC,MAAO,CAAC,EAAE,CAAC;YAChD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,qCAAqC,EAAE,CAAC,CAAC;YACvE,OAAO;QACT,CAAC;QACD,IAAI,CAAC;YACH,MAAM,WAAW,CAAC,cAAc,CAAC,GAAG,CAAC,MAAO,EAAE,eAAe,EAAE,WAAW,CAAC,CAAC;YAC5E,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QACzB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,GAAG,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC;YACrE,wEAAwE;YACxE,4DAA4D;YAC5D,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;QACvC,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,mEAAmE;IACnE,qEAAqE;IACrE,qEAAqE;IACrE,MAAM,CAAC,IAAI,CAAC,uBAAuB,EAAE,cAAc,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACtE,IAAI,CAAC;YACH,wEAAwE;YACxE,oEAAoE;YACpE,iBAAiB;YACjB,EAAE;YACF,yEAAyE;YACzE,wEAAwE;YACxE,gEAAgE;YAChE,oEAAoE;YACpE,yEAAyE;YACzE,8CAA8C;YAC9C,EAAE;YACF,yEAAyE;YACzE,0EAA0E;YAC1E,yEAAyE;YACzE,oEAAoE;YACpE,yCAAyC;YACzC,MAAM,OAAO,GAAI,GAAG,CAAC,IAAyC,EAAE,MAAM,CAAC;YACvE,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,GAAG,CAAC,MAAM,EAAE,CAAC;gBAC1D,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iCAAiC,EAAE,CAAC,CAAC;gBACnE,OAAO;YACT,CAAC;YACD,MAAM,WAAW,CAAC,kBAAkB,CAAC,GAAG,CAAC,MAAO,CAAC,CAAC;YAClD,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QACzB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,uEAAuE;YACvE,mEAAmE;YACnE,yDAAyD;YACzD,MAAM,GAAG,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC;YACrE,GAAG,CAAC,KAAK,CAAC,wBAAwB,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;YACrD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,qBAAqB,EAAE,CAAC,CAAC;QACzD,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,uEAAuE;IACvE,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE,cAAc,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACxD,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,WAAW,CAAC,GAAG,CAAC,MAAO,CAAC,CAAC;YACxD,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;gBAClD,OAAO;YACT,CAAC;YACD,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,GAAG,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC;YACrE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;QACvC,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/modules/auth/auth.service.d.ts

@@ -12,6 +12,14 @@ export interface AuthConfig {
     adminEmail: string;
     adminPassword: string;
     allowedEmailDomains: string[];
+    /**
+     * Whether password sign-in is offered at all (`LOGIN_PASSWORD`, default
+     * true). With it off, `ADMIN_PASSWORD` is a credential nothing accepts, so
+     * the deployment admin is not reported as one whose password lives in the
+     * environment — the Account page would otherwise send them to a login
+     * method the deployment has switched off.
+     */
+    loginPasswordEnabled?: boolean;
 }
 export declare class AuthService {
     private readonly db;
@@ -25,10 +33,15 @@ export declare class AuthService {
      *     variable disables it immediately. Lets a fresh deployment sign in
      *     before any account exists.
      *  2. A per-user account: the `users` row's scrypt `password_hash`
-     *     (created by an admin from Roles & Members, or set by the user on
+     *     (created by an admin from App roles, or set by the user on
      *     their Account page). Accounts that only ever signed in via SSO have
      *     no hash and are refused here.
      *
+     * The two are alternatives, not a fallback chain: source 1 never falls
+     * through to source 2, so the deployment admin is refused outright when the
+     * environment password is wrong — see the guard below for why a hash on
+     * that row must not become a second way in.
+     *
      * A generic "Invalid credentials" error for every failure mode — never
      * reveal whether the email exists or has a password.
      */
@@ -48,25 +61,85 @@ export declare class AuthService {
         user: AuthUser;
     }>;
     /**
-     * Admin-driven account provisioning (Roles & Members → Accounts). Upserts
+     * Admin-driven account provisioning (App roles → Accounts). Upserts
      * the user by email and sets their password — re-provisioning an existing
      * account (e.g. one that first arrived via SSO, or a reset for a locked-out
      * user) is deliberate admin behavior, not an error.
+     *
+     * The deployment admin is the one target this refuses, for the reason
+     * {@link changePassword} refuses it: that account's password is the
+     * environment's, so a stored hash would not replace it but ADD a second
+     * credential — one that keeps signing in after `ADMIN_PASSWORD` is rotated,
+     * and that the deployment owner never chose. The refusal belongs here and
+     * not only on the page, because this is the route any other admin reaches
+     * with an arbitrary email.
      */
     createAccount(email: string, name: string | undefined, password: string): Promise<AuthUser>;
+    /**
+     * Is `email` the deployment admin — the account whose password is set in
+     * the deployment environment (`ADMIN_EMAIL` while `ADMIN_PASSWORD` is set)
+     * rather than stored on its row? The single definition behind
+     * {@link loginWithPassword} (which accepts only the environment password
+     * for it), {@link changePassword} and {@link createAccount} (which both
+     * refuse to store a hash for it), so those three can never disagree about
+     * who the deployment admin is. `email` must already be canonical.
+     *
+     * Independent of whether password sign-in is switched on: the refusals
+     * hold while it is off too, or a hash could be stored for that address in
+     * the meantime — a credential the row is never meant to carry. What a
+     * client is TOLD does follow the switch: {@link reportsAsEnvAdmin}.
+     */
+    private isEnvAdminEmail;
+    /**
+     * Whether a client is told `email` is the deployment admin — behind
+     * {@link toClientUser} and {@link listAccounts}. The identity is
+     * {@link isEnvAdminEmail}; the switch is password sign-in: with
+     * `LOGIN_PASSWORD=false`, `ADMIN_PASSWORD` is a credential nothing accepts,
+     * and reporting the account as the environment's admin would send its
+     * owner to a login method the deployment does not offer.
+     */
+    private reportsAsEnvAdmin;
+    /**
+     * {@link toAuthUser} plus the one fact that is not on the row: whether this
+     * is the deployment admin. Computed from the configuration on each read
+     * rather than stored, so unsetting `ADMIN_PASSWORD` turns the flag off at
+     * once and the account goes back to being an ordinary one — the same
+     * reasoning that keeps the credential itself out of the database. Every
+     * path that hands a user to a client goes through here, so the Account page
+     * sees the same answer whether it came from a fresh login or `/auth/me`.
+     */
+    private toClientUser;
     /**
      * Self-service password change (the Account page). The current password is
      * required whenever one is set; an SSO-only account (no hash yet) may set
-     * its first password without one. The env bootstrap-admin credential is not
-     * affected — it lives in the environment, not in this row.
+     * its first password without one.
+     *
+     * The deployment admin is refused outright. Its password lives in the
+     * environment, so a stored hash would not replace it: both credentials
+     * would then sign in, the planted one would survive rotating
+     * `ADMIN_PASSWORD`, and every later change typing the environment password
+     * as the current one would be refused against that stray hash. Worse, the
+     * account starts with no hash, so without this guard the "SSO-only first
+     * password" path below accepts a WRONG current password — any holder of the
+     * session could plant a lasting credential without knowing one. The
+     * environment password is the platform's rescue path into a deployment and
+     * is changed there, which is what the Account page says in place of the
+     * form.
      */
     changePassword(userId: string, currentPassword: string | undefined, newPassword: string): Promise<void>;
-    /** Accounts overview for the admin management screen (never exposes hashes). */
+    /**
+     * Accounts overview for the admin management screen (never exposes hashes).
+     * The two password facts are independent: `hasPassword` is a stored hash;
+     * `isEnvAdmin` is the env bootstrap credential (`ADMIN_EMAIL` while
+     * `ADMIN_PASSWORD` is set), which signs in whether or not a hash exists —
+     * the same condition {@link loginWithPassword} checks first.
+     */
     listAccounts(): Promise<Array<{
         id: string;
         email: string;
         name: string;
         hasPassword: boolean;
+        isEnvAdmin: boolean;
         createdAt: Date;
     }>>;
     private assertPasswordPolicy;
@@ -105,6 +178,17 @@ export declare class AuthService {
         name: string;
     }>>;
     getUserById(userId: string): Promise<AuthUser | null>;
+    /**
+     * The account at this ADDRESS, or null when none answers to it.
+     *
+     * By address rather than by id because some work outlives the session that
+     * asked for it: a recorded plugin join request carries the requester's
+     * email — the same key its branch is cut from — and the sweep that resumes
+     * it after a restart has no session and no id to resolve the author from.
+     * Canonicalised on the way in, like every other lookup here, so the stored
+     * spelling of an address is never what decides whether it is found.
+     */
+    getUserByEmail(email: string): Promise<AuthUser | null>;
     /**
      * Conclude the connect-your-agent onboarding for `userId`. Idempotent by
      * construction (an UPDATE to the value it already has), so the welcome

package/dist/modules/auth/auth.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.service.d.ts","sourceRoot":"","sources":["../../../src/modules/auth/auth.service.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,2BAA2B,CAAC;AAG1D,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iCAAiC,CAAC;AA8ChE;;;;;;GAMG;AACH,MAAM,WAAW,UAAU;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;IACtB,mBAAmB,EAAE,MAAM,EAAE,CAAC;CAC/B;AAED,qBAAa,WAAW;IAEpB,OAAO,CAAC,QAAQ,CAAC,EAAE;IACnB,OAAO,CAAC,QAAQ,CAAC,MAAM;gBADN,EAAE,EAAE,QAAQ,EACZ,MAAM,EAAE,UAAU;IAGrC;;;;;;;;;;;;;;OAcG;IACG,iBAAiB,CACrB,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,QAAQ,CAAA;KAAE,CAAC;IAqC7C;;;;;;OAMG;IACG,YAAY,CAChB,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,MAAM,GACX,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,QAAQ,CAAA;KAAE,CAAC;IAW7C;;;;;OAKG;IACG,aAAa,CACjB,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,QAAQ,CAAC;IA0BpB;;;;;OAKG;IACG,cAAc,CAClB,MAAM,EAAE,MAAM,EACd,eAAe,EAAE,MAAM,GAAG,SAAS,EACnC,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,IAAI,CAAC;IAgBhB,gFAAgF;IAC1E,YAAY,IAAI,OAAO,CAC3B,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,OAAO,CAAC;QAAC,SAAS,EAAE,IAAI,CAAA;KAAE,CAAC,CAC1F;IAWD,OAAO,CAAC,oBAAoB;IAM5B,OAAO,CAAC,SAAS;IAIjB;;;;;;;OAOG;IACG,kBAAkB,CACtB,KAAK,EAAE,MAAM,EACb,IAAI,CAAC,EAAE,MAAM,GACZ,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;YAQhD,iBAAiB;IAS/B,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE;IAQ7D;;;;;;;;;OASG;IACG,oBAAoB,CACxB,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,GAClB,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAY9D,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;IAY3D;;;;;;OAMG;IACG,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAOvD;;;;;;;;OAQG;IACH,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;IAQ5C;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,mBAAmB;CAM5B"}
+{"version":3,"file":"auth.service.d.ts","sourceRoot":"","sources":["../../../src/modules/auth/auth.service.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,2BAA2B,CAAC;AAG1D,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iCAAiC,CAAC;AAuDhE;;;;;;GAMG;AACH,MAAM,WAAW,UAAU;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;IACtB,mBAAmB,EAAE,MAAM,EAAE,CAAC;IAC9B;;;;;;OAMG;IACH,oBAAoB,CAAC,EAAE,OAAO,CAAC;CAChC;AAED,qBAAa,WAAW;IAEpB,OAAO,CAAC,QAAQ,CAAC,EAAE;IACnB,OAAO,CAAC,QAAQ,CAAC,MAAM;gBADN,EAAE,EAAE,QAAQ,EACZ,MAAM,EAAE,UAAU;IAGrC;;;;;;;;;;;;;;;;;;;OAmBG;IACG,iBAAiB,CACrB,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,QAAQ,CAAA;KAAE,CAAC;IA8D7C;;;;;;OAMG;IACG,YAAY,CAChB,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,MAAM,GACX,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,QAAQ,CAAA;KAAE,CAAC;IAW7C;;;;;;;;;;;;;OAaG;IACG,aAAa,CACjB,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,QAAQ,CAAC;IA+BpB;;;;;;;;;;;;;OAaG;IACH,OAAO,CAAC,eAAe;IAQvB;;;;;;;OAOG;IACH,OAAO,CAAC,iBAAiB;IAIzB;;;;;;;;OAQG;IACH,OAAO,CAAC,YAAY;IAIpB;;;;;;;;;;;;;;;;OAgBG;IACG,cAAc,CAClB,MAAM,EAAE,MAAM,EACd,eAAe,EAAE,MAAM,GAAG,SAAS,EACnC,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,IAAI,CAAC;IAqBhB;;;;;;OAMG;IACG,YAAY,IAAI,OAAO,CAC3B,KAAK,CAAC;QACJ,EAAE,EAAE,MAAM,CAAC;QACX,KAAK,EAAE,MAAM,CAAC;QACd,IAAI,EAAE,MAAM,CAAC;QACb,WAAW,EAAE,OAAO,CAAC;QACrB,UAAU,EAAE,OAAO,CAAC;QACpB,SAAS,EAAE,IAAI,CAAC;KACjB,CAAC,CACH;IAYD,OAAO,CAAC,oBAAoB;IAM5B,OAAO,CAAC,SAAS;IAIjB;;;;;;;OAOG;IACG,kBAAkB,CACtB,KAAK,EAAE,MAAM,EACb,IAAI,CAAC,EAAE,MAAM,GACZ,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;YAQhD,iBAAiB;IAS/B,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE;IAQ7D;;;;;;;;;OASG;IACG,oBAAoB,CACxB,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,GAClB,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAY9D,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;IAY3D;;;;;;;;;OASG;IACG,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;IAY7D;;;;;;OAMG;IACG,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAOvD;;;;;;;;OAQG;IACH,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;IAQ5C;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,mBAAmB;CAM5B"}

package/dist/modules/auth/auth.service.js

@@ -1,9 +1,16 @@
 import jwt from 'jsonwebtoken';
 import { eq } from 'drizzle-orm';
 import { users } from '../database/schema.js';
-import { hashEmail } from '../../shared/hash-email.js';
+import { canonicalEmail, hashEmail } from '../../shared/email-identity.js';
 import { hashPassword, verifyPassword, timingSafeStringEqual, MIN_PASSWORD_LENGTH, } from './password-hash.js';
 const EMAIL_REGEX = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
+/**
+ * What every caller is told when it tries to give the deployment admin a
+ * stored password — the Account page's own change and an admin's "Set
+ * password" on the User Accounts page alike. One sentence in one place, so the
+ * two surfaces cannot end up explaining the same rule differently.
+ */
+const ENV_ADMIN_PASSWORD_REFUSAL = "This account's password is set in the deployment environment and cannot be changed here";
 /**
  * Decoy hash verified when the email is unknown or has no password set, so
  * those paths cost the same scrypt work as a real wrong-password attempt —
@@ -46,33 +53,63 @@ export class AuthService {
      *     variable disables it immediately. Lets a fresh deployment sign in
      *     before any account exists.
      *  2. A per-user account: the `users` row's scrypt `password_hash`
-     *     (created by an admin from Roles & Members, or set by the user on
+     *     (created by an admin from App roles, or set by the user on
      *     their Account page). Accounts that only ever signed in via SSO have
      *     no hash and are refused here.
      *
+     * The two are alternatives, not a fallback chain: source 1 never falls
+     * through to source 2, so the deployment admin is refused outright when the
+     * environment password is wrong — see the guard below for why a hash on
+     * that row must not become a second way in.
+     *
      * A generic "Invalid credentials" error for every failure mode — never
      * reveal whether the email exists or has a password.
      */
     async loginWithPassword(email, password) {
-        const normalizedEmail = (email ?? '').trim().toLowerCase();
+        const normalizedEmail = canonicalEmail(email ?? '');
         if (!EMAIL_REGEX.test(normalizedEmail)) {
             throw new Error('Invalid credentials');
         }
         const provided = password ?? '';
-        const isEnvAdmin = this.config.adminEmail.length > 0 &&
-            this.config.adminPassword.length > 0 &&
-            normalizedEmail === this.config.adminEmail &&
-            timingSafeStringEqual(provided, this.config.adminPassword);
-        if (isEnvAdmin) {
-            const defaultName = normalizedEmail.split('@')[0] || normalizedEmail;
-            const user = await this.upsertUserByEmail(normalizedEmail, defaultName);
-            return { token: this.signToken(user.id, user.email), user: toAuthUser(user) };
-        }
+        // Looked up for EVERY email, including the deployment admin's, whose hash
+        // is then ignored below. Skipping the query for that one address would
+        // make its wrong-password response measurably cheaper than every other
+        // address's — one round trip short — and repeated timings would then
+        // disclose which email the deployment configured as `ADMIN_EMAIL`. The
+        // decoy hash already buys that uniformity for the scrypt half; this keeps
+        // the database half uniform too.
         const [user] = await this.db
             .select()
             .from(users)
             .where(eq(users.email, normalizedEmail))
             .limit(1);
+        if (this.isEnvAdminEmail(normalizedEmail)) {
+            // While `ADMIN_PASSWORD` is set, the environment's password is this
+            // account's ONLY credential — the row was read above, but its hash is
+            // never consulted for this address. A hash can still be sitting on that
+            // row (planted before this rule existed, or left by an ordinary account
+            // that only later became `ADMIN_EMAIL`), and accepting it would defeat
+            // the point of refusing to write new ones: rotating `ADMIN_PASSWORD`
+            // would leave the old credential signing in.
+            //
+            // Refused rather than deleted, deliberately. The rule is reversible the
+            // same way every other env-admin fact is — unset `ADMIN_PASSWORD` and
+            // the identity goes back to being an ordinary account, stored password
+            // included, exactly as `isEnvAdmin` stops being reported — and a login
+            // path that destroys credentials would be a far worse thing to get
+            // wrong than one that ignores them.
+            if (!timingSafeStringEqual(provided, this.config.adminPassword)) {
+                // One scrypt verification here too — against the decoy, never against
+                // `user`'s hash — so that together with the lookup above a wrong
+                // password for this address costs what a wrong password for any other
+                // address does.
+                await verifyPassword(provided, await decoyHash());
+                throw new Error('Invalid credentials');
+            }
+            const defaultName = normalizedEmail.split('@')[0] || normalizedEmail;
+            const admin = await this.upsertUserByEmail(normalizedEmail, defaultName);
+            return { token: this.signToken(admin.id, admin.email), user: this.toClientUser(admin) };
+        }
         // Always run one scrypt verification — against the stored hash when there
         // is one, against the decoy otherwise — so unknown emails and
         // password-less (SSO-only) accounts take the same time as a wrong
@@ -82,7 +119,7 @@ export class AuthService {
         if (!user?.passwordHash || !matches) {
             throw new Error('Invalid credentials');
         }
-        return { token: this.signToken(user.id, user.email), user: toAuthUser(user) };
+        return { token: this.signToken(user.id, user.email), user: this.toClientUser(user) };
     }
     /**
      * Establish a session for a user whose identity an SSO provider (the
@@ -92,26 +129,39 @@ export class AuthService {
      * in via SSO (same email) keeps the same account/id.
      */
     async loginWithSso(email, name) {
-        const normalizedEmail = (email ?? '').trim().toLowerCase();
+        const normalizedEmail = canonicalEmail(email ?? '');
         if (!EMAIL_REGEX.test(normalizedEmail)) {
             throw new Error('Sign-in returned an invalid email');
         }
         this.assertAllowedDomain(normalizedEmail);
         const displayName = (name ?? '').trim() || normalizedEmail.split('@')[0] || normalizedEmail;
         const user = await this.upsertUserByEmail(normalizedEmail, displayName);
-        return { token: this.signToken(user.id, user.email), user: toAuthUser(user) };
+        return { token: this.signToken(user.id, user.email), user: this.toClientUser(user) };
     }
     /**
-     * Admin-driven account provisioning (Roles & Members → Accounts). Upserts
+     * Admin-driven account provisioning (App roles → Accounts). Upserts
      * the user by email and sets their password — re-provisioning an existing
      * account (e.g. one that first arrived via SSO, or a reset for a locked-out
      * user) is deliberate admin behavior, not an error.
+     *
+     * The deployment admin is the one target this refuses, for the reason
+     * {@link changePassword} refuses it: that account's password is the
+     * environment's, so a stored hash would not replace it but ADD a second
+     * credential — one that keeps signing in after `ADMIN_PASSWORD` is rotated,
+     * and that the deployment owner never chose. The refusal belongs here and
+     * not only on the page, because this is the route any other admin reaches
+     * with an arbitrary email.
      */
     async createAccount(email, name, password) {
-        const normalizedEmail = (email ?? '').trim().toLowerCase();
+        const normalizedEmail = canonicalEmail(email ?? '');
         if (!EMAIL_REGEX.test(normalizedEmail)) {
             throw new Error('Invalid email');
         }
+        // Before the policy check, so the refusal names the real reason rather
+        // than sending the admin off to pick a longer password first.
+        if (this.isEnvAdminEmail(normalizedEmail)) {
+            throw new Error(ENV_ADMIN_PASSWORD_REFUSAL);
+        }
         this.assertPasswordPolicy(password);
         const suppliedName = (name ?? '').trim();
         const displayName = suppliedName || normalizedEmail.split('@')[0] || normalizedEmail;
@@ -130,19 +180,77 @@ export class AuthService {
                 : { passwordHash, updatedAt: new Date() },
         })
             .returning();
-        return toAuthUser(row);
+        return this.toClientUser(row);
+    }
+    /**
+     * Is `email` the deployment admin — the account whose password is set in
+     * the deployment environment (`ADMIN_EMAIL` while `ADMIN_PASSWORD` is set)
+     * rather than stored on its row? The single definition behind
+     * {@link loginWithPassword} (which accepts only the environment password
+     * for it), {@link changePassword} and {@link createAccount} (which both
+     * refuse to store a hash for it), so those three can never disagree about
+     * who the deployment admin is. `email` must already be canonical.
+     *
+     * Independent of whether password sign-in is switched on: the refusals
+     * hold while it is off too, or a hash could be stored for that address in
+     * the meantime — a credential the row is never meant to carry. What a
+     * client is TOLD does follow the switch: {@link reportsAsEnvAdmin}.
+     */
+    isEnvAdminEmail(email) {
+        return (this.config.adminEmail.length > 0 &&
+            this.config.adminPassword.length > 0 &&
+            email === this.config.adminEmail);
+    }
+    /**
+     * Whether a client is told `email` is the deployment admin — behind
+     * {@link toClientUser} and {@link listAccounts}. The identity is
+     * {@link isEnvAdminEmail}; the switch is password sign-in: with
+     * `LOGIN_PASSWORD=false`, `ADMIN_PASSWORD` is a credential nothing accepts,
+     * and reporting the account as the environment's admin would send its
+     * owner to a login method the deployment does not offer.
+     */
+    reportsAsEnvAdmin(email) {
+        return (this.config.loginPasswordEnabled ?? true) && this.isEnvAdminEmail(email);
+    }
+    /**
+     * {@link toAuthUser} plus the one fact that is not on the row: whether this
+     * is the deployment admin. Computed from the configuration on each read
+     * rather than stored, so unsetting `ADMIN_PASSWORD` turns the flag off at
+     * once and the account goes back to being an ordinary one — the same
+     * reasoning that keeps the credential itself out of the database. Every
+     * path that hands a user to a client goes through here, so the Account page
+     * sees the same answer whether it came from a fresh login or `/auth/me`.
+     */
+    toClientUser(user) {
+        return { ...toAuthUser(user), isEnvAdmin: this.reportsAsEnvAdmin(user.email) };
     }
     /**
      * Self-service password change (the Account page). The current password is
      * required whenever one is set; an SSO-only account (no hash yet) may set
-     * its first password without one. The env bootstrap-admin credential is not
-     * affected — it lives in the environment, not in this row.
+     * its first password without one.
+     *
+     * The deployment admin is refused outright. Its password lives in the
+     * environment, so a stored hash would not replace it: both credentials
+     * would then sign in, the planted one would survive rotating
+     * `ADMIN_PASSWORD`, and every later change typing the environment password
+     * as the current one would be refused against that stray hash. Worse, the
+     * account starts with no hash, so without this guard the "SSO-only first
+     * password" path below accepts a WRONG current password — any holder of the
+     * session could plant a lasting credential without knowing one. The
+     * environment password is the platform's rescue path into a deployment and
+     * is changed there, which is what the Account page says in place of the
+     * form.
      */
     async changePassword(userId, currentPassword, newPassword) {
-        this.assertPasswordPolicy(newPassword);
         const [user] = await this.db.select().from(users).where(eq(users.id, userId)).limit(1);
         if (!user)
             throw new Error('User not found');
+        // Before the policy check, so the deployment admin is told the real reason
+        // rather than being sent to fix a password that would be refused anyway.
+        if (this.isEnvAdminEmail(user.email)) {
+            throw new Error(ENV_ADMIN_PASSWORD_REFUSAL);
+        }
+        this.assertPasswordPolicy(newPassword);
         if (user.passwordHash) {
             if (!currentPassword || !(await verifyPassword(currentPassword, user.passwordHash))) {
                 throw new Error('Current password is incorrect');
@@ -154,7 +262,13 @@ export class AuthService {
             .set({ passwordHash, updatedAt: new Date() })
             .where(eq(users.id, userId));
     }
-    /** Accounts overview for the admin management screen (never exposes hashes). */
+    /**
+     * Accounts overview for the admin management screen (never exposes hashes).
+     * The two password facts are independent: `hasPassword` is a stored hash;
+     * `isEnvAdmin` is the env bootstrap credential (`ADMIN_EMAIL` while
+     * `ADMIN_PASSWORD` is set), which signs in whether or not a hash exists —
+     * the same condition {@link loginWithPassword} checks first.
+     */
     async listAccounts() {
         const rows = await this.db.select().from(users).orderBy(users.email);
         return rows.map((row) => ({
@@ -162,6 +276,7 @@ export class AuthService {
             email: row.email,
             name: row.name,
             hasPassword: row.passwordHash != null,
+            isEnvAdmin: this.reportsAsEnvAdmin(row.email),
             createdAt: row.createdAt,
         }));
     }
@@ -182,7 +297,7 @@ export class AuthService {
      * same account/id. Returns `null` for a malformed email.
      */
     async getOrCreateByEmail(email, name) {
-        const normalizedEmail = (email ?? '').trim().toLowerCase();
+        const normalizedEmail = canonicalEmail(email ?? '');
         if (!EMAIL_REGEX.test(normalizedEmail))
             return null;
         const displayName = (name ?? '').trim() || normalizedEmail.split('@')[0] || normalizedEmail;
@@ -232,7 +347,27 @@ export class AuthService {
             .limit(1);
         if (!user)
             return null;
-        return toAuthUser(user);
+        return this.toClientUser(user);
+    }
+    /**
+     * The account at this ADDRESS, or null when none answers to it.
+     *
+     * By address rather than by id because some work outlives the session that
+     * asked for it: a recorded plugin join request carries the requester's
+     * email — the same key its branch is cut from — and the sweep that resumes
+     * it after a restart has no session and no id to resolve the author from.
+     * Canonicalised on the way in, like every other lookup here, so the stored
+     * spelling of an address is never what decides whether it is found.
+     */
+    async getUserByEmail(email) {
+        const [user] = await this.db
+            .select()
+            .from(users)
+            .where(eq(users.email, canonicalEmail(email ?? '')))
+            .limit(1);
+        if (!user)
+            return null;
+        return this.toClientUser(user);
     }
     /**
      * Conclude the connect-your-agent onboarding for `userId`. Idempotent by
@@ -260,7 +395,7 @@ export class AuthService {
         const allowed = this.config.allowedEmailDomains;
         if (allowed.length === 0)
             return true;
-        const domain = (email ?? '').trim().toLowerCase().split('@')[1] ?? '';
+        const domain = canonicalEmail(email ?? '').split('@')[1] ?? '';
         if (!domain)
             return false;
         return allowed.some((d) => domain === d || domain.endsWith(`.${d}`));

package/dist/modules/auth/auth.service.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.service.js","sourceRoot":"","sources":["../../../src/modules/auth/auth.service.ts"],"names":[],"mappings":"AAAA,OAAO,GAAG,MAAM,cAAc,CAAC;AAC/B,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AAGjC,OAAO,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAE9C,OAAO,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAC;AACvD,OAAO,EACL,YAAY,EACZ,cAAc,EACd,qBAAqB,EACrB,mBAAmB,GACpB,MAAM,oBAAoB,CAAC;AAE5B,MAAM,WAAW,GAAG,4BAA4B,CAAC;AAEjD;;;;;;GAMG;AACH,IAAI,gBAAgB,GAA2B,IAAI,CAAC;AACpD,SAAS,SAAS;IAChB,gBAAgB,KAAK,YAAY,CAAC,oCAAoC,CAAC,CAAC;IACxE,OAAO,gBAAgB,CAAC;AAC1B,CAAC;AAED;;;;;GAKG;AACH,SAAS,UAAU,CAAC,IAMnB;IACC,OAAO;QACL,EAAE,EAAE,IAAI,CAAC,EAAE;QACX,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,SAAS,EAAE,IAAI,CAAC,SAAS,IAAI,SAAS;QACtC,cAAc,EAAE,IAAI,CAAC,cAAc;KACpC,CAAC;AACJ,CAAC;AAgBD,MAAM,OAAO,WAAW;IAEH;IACA;IAFnB,YACmB,EAAY,EACZ,MAAkB;QADlB,OAAE,GAAF,EAAE,CAAU;QACZ,WAAM,GAAN,MAAM,CAAY;IAClC,CAAC;IAEJ;;;;;;;;;;;;;;OAcG;IACH,KAAK,CAAC,iBAAiB,CACrB,KAAa,EACb,QAAgB;QAEhB,MAAM,eAAe,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAE3D,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE,CAAC;YACvC,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;QACzC,CAAC;QAED,MAAM,QAAQ,GAAG,QAAQ,IAAI,EAAE,CAAC;QAChC,MAAM,UAAU,GACd,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC;YACjC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC;YACpC,eAAe,KAAK,IAAI,CAAC,MAAM,CAAC,UAAU;YAC1C,qBAAqB,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;QAE7D,IAAI,UAAU,EAAE,CAAC;YACf,MAAM,WAAW,GAAG,eAAe,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,eAAe,CAAC;YACrE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,eAAe,EAAE,WAAW,CAAC,CAAC;YACxE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QAChF,CAAC;QAED,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,IAAI,CAAC,EAAE;aACzB,MAAM,EAAE;aACR,IAAI,CAAC,KAAK,CAAC;aACX,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,eAAe,CAAC,CAAC;aACvC,KAAK,CAAC,CAAC,CAAC,CAAC;QACZ,0EAA0E;QAC1E,8DAA8D;QAC9D,kEAAkE;QAClE,wDAAwD;QACxD,MAAM,MAAM,GAAG,IAAI,EAAE,YAAY,IAAI,CAAC,MAAM,SAAS,EAAE,CAAC,CAAC;QACzD,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QACvD,IAAI,CAAC,IAAI,EAAE,YAAY,IAAI,CAAC,OAAO,EAAE,CAAC;YACpC,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;QACzC,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;IAChF,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,YAAY,CAChB,KAAa,EACb,IAAY;QAEZ,MAAM,eAAe,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAC3D,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE,CAAC;YACvC,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;QACvD,CAAC;QACD,IAAI,CAAC,mBAAmB,CAAC,eAAe,CAAC,CAAC;QAC1C,MAAM,WAAW,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,eAAe,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,eAAe,CAAC;QAC5F,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,eAAe,EAAE,WAAW,CAAC,CAAC;QACxE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;IAChF,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,aAAa,CACjB,KAAa,EACb,IAAwB,EACxB,QAAgB;QAEhB,MAAM,eAAe,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAC3D,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE,CAAC;YACvC,MAAM,IAAI,KAAK,CAAC,eAAe,CAAC,CAAC;QACnC,CAAC;QACD,IAAI,CAAC,oBAAoB,CAAC,QAAQ,CAAC,CAAC;QACpC,MAAM,YAAY,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACzC,MAAM,WAAW,GAAG,YAAY,IAAI,eAAe,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,eAAe,CAAC;QACrF,MAAM,YAAY,GAAG,MAAM,YAAY,CAAC,QAAQ,CAAC,CAAC;QAClD,0EAA0E;QAC1E,oEAAoE;QACpE,sEAAsE;QACtE,mEAAmE;QACnE,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,IAAI,CAAC,EAAE;aACxB,MAAM,CAAC,KAAK,CAAC;aACb,MAAM,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,IAAI,EAAE,WAAW,EAAE,YAAY,EAAE,CAAC;aACnE,kBAAkB,CAAC;YAClB,MAAM,EAAE,KAAK,CAAC,KAAK;YACnB,GAAG,EAAE,YAAY;gBACf,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE;gBAC7D,CAAC,CAAC,EAAE,YAAY,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE;SAC5C,CAAC;aACD,SAAS,EAAE,CAAC;QACf,OAAO,UAAU,CAAC,GAAG,CAAC,CAAC;IACzB,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,cAAc,CAClB,MAAc,EACd,eAAmC,EACnC,WAAmB;QAEnB,IAAI,CAAC,oBAAoB,CAAC,WAAW,CAAC,CAAC;QACvC,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACvF,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC;QAC7C,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACtB,IAAI,CAAC,eAAe,IAAI,CAAC,CAAC,MAAM,cAAc,CAAC,eAAe,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,EAAE,CAAC;gBACpF,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;YACnD,CAAC;QACH,CAAC;QACD,MAAM,YAAY,GAAG,MAAM,YAAY,CAAC,WAAW,CAAC,CAAC;QACrD,MAAM,IAAI,CAAC,EAAE;aACV,MAAM,CAAC,KAAK,CAAC;aACb,GAAG,CAAC,EAAE,YAAY,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC;aAC5C,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC;IACjC,CAAC;IAED,gFAAgF;IAChF,KAAK,CAAC,YAAY;QAGhB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACrE,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YACxB,EAAE,EAAE,GAAG,CAAC,EAAE;YACV,KAAK,EAAE,GAAG,CAAC,KAAK;YAChB,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,WAAW,EAAE,GAAG,CAAC,YAAY,IAAI,IAAI;YACrC,SAAS,EAAE,GAAG,CAAC,SAAS;SACzB,CAAC,CAAC,CAAC;IACN,CAAC;IAEO,oBAAoB,CAAC,QAAgB;QAC3C,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,MAAM,GAAG,mBAAmB,EAAE,CAAC;YAClD,MAAM,IAAI,KAAK,CAAC,6BAA6B,mBAAmB,aAAa,CAAC,CAAC;QACjF,CAAC;IACH,CAAC;IAEO,SAAS,CAAC,MAAc,EAAE,KAAa;QAC7C,OAAO,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACjF,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,kBAAkB,CACtB,KAAa,EACb,IAAa;QAEb,MAAM,eAAe,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAC3D,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,eAAe,CAAC;YAAE,OAAO,IAAI,CAAC;QACpD,MAAM,WAAW,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,eAAe,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,eAAe,CAAC;QAC5F,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,eAAe,EAAE,WAAW,CAAC,CAAC;QACxE,OAAO,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;IAC7D,CAAC;IAEO,KAAK,CAAC,iBAAiB,CAAC,KAAa,EAAE,IAAY;QACzD,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,IAAI,CAAC,EAAE;aACzB,MAAM,CAAC,KAAK,CAAC;aACb,MAAM,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;aACvB,kBAAkB,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE,EAAE,CAAC;aAC3E,SAAS,EAAE,CAAC;QACf,OAAO,IAAI,CAAC;IACd,CAAC;IAED,WAAW,CAAC,KAAa;QACvB,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS,CAGtD,CAAC;QACF,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC;IAC1D,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,oBAAoB,CACxB,MAAmB;QAEnB,MAAM,MAAM,GAAG,IAAI,GAAG,EAAuD,CAAC;QAC9E,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC;YAAE,OAAO,MAAM,CAAC;QACrC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAChD,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,MAAM,CAAC,GAAG,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YAC/B,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;gBAAE,SAAS;YAC7B,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;QAClE,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,MAAc;QAC9B,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,IAAI,CAAC,EAAE;aACzB,MAAM,EAAE;aACR,IAAI,CAAC,KAAK,CAAC;aACX,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;aAC3B,KAAK,CAAC,CAAC,CAAC,CAAC;QAEZ,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC;QAEvB,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,kBAAkB,CAAC,MAAc;QACrC,MAAM,IAAI,CAAC,EAAE;aACV,MAAM,CAAC,KAAK,CAAC;aACb,GAAG,CAAC,EAAE,cAAc,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC;aACpD,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC;IACjC,CAAC;IAED;;;;;;;;OAQG;IACH,oBAAoB,CAAC,KAAa;QAChC,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC;QAChD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACtC,MAAM,MAAM,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACtE,IAAI,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;QAC1B,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;IACvE,CAAC;IAED;;;;;;;;;;;;OAYG;IACK,mBAAmB,CAAC,eAAuB;QACjD,IAAI,CAAC,IAAI,CAAC,oBAAoB,CAAC,eAAe,CAAC,EAAE,CAAC;YAChD,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;QACjD,CAAC;IACH,CAAC;CAEF"}
+{"version":3,"file":"auth.service.js","sourceRoot":"","sources":["../../../src/modules/auth/auth.service.ts"],"names":[],"mappings":"AAAA,OAAO,GAAG,MAAM,cAAc,CAAC;AAC/B,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AAGjC,OAAO,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAE9C,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,gCAAgC,CAAC;AAC3E,OAAO,EACL,YAAY,EACZ,cAAc,EACd,qBAAqB,EACrB,mBAAmB,GACpB,MAAM,oBAAoB,CAAC;AAE5B,MAAM,WAAW,GAAG,4BAA4B,CAAC;AAEjD;;;;;GAKG;AACH,MAAM,0BAA0B,GAC9B,yFAAyF,CAAC;AAE5F;;;;;;GAMG;AACH,IAAI,gBAAgB,GAA2B,IAAI,CAAC;AACpD,SAAS,SAAS;IAChB,gBAAgB,KAAK,YAAY,CAAC,oCAAoC,CAAC,CAAC;IACxE,OAAO,gBAAgB,CAAC;AAC1B,CAAC;AAED;;;;;GAKG;AACH,SAAS,UAAU,CAAC,IAMnB;IACC,OAAO;QACL,EAAE,EAAE,IAAI,CAAC,EAAE;QACX,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,SAAS,EAAE,IAAI,CAAC,SAAS,IAAI,SAAS;QACtC,cAAc,EAAE,IAAI,CAAC,cAAc;KACpC,CAAC;AACJ,CAAC;AAwBD,MAAM,OAAO,WAAW;IAEH;IACA;IAFnB,YACmB,EAAY,EACZ,MAAkB;QADlB,OAAE,GAAF,EAAE,CAAU;QACZ,WAAM,GAAN,MAAM,CAAY;IAClC,CAAC;IAEJ;;;;;;;;;;;;;;;;;;;OAmBG;IACH,KAAK,CAAC,iBAAiB,CACrB,KAAa,EACb,QAAgB;QAEhB,MAAM,eAAe,GAAG,cAAc,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;QAEpD,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE,CAAC;YACvC,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;QACzC,CAAC;QAED,MAAM,QAAQ,GAAG,QAAQ,IAAI,EAAE,CAAC;QAEhC,0EAA0E;QAC1E,uEAAuE;QACvE,uEAAuE;QACvE,qEAAqE;QACrE,uEAAuE;QACvE,0EAA0E;QAC1E,iCAAiC;QACjC,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,IAAI,CAAC,EAAE;aACzB,MAAM,EAAE;aACR,IAAI,CAAC,KAAK,CAAC;aACX,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,eAAe,CAAC,CAAC;aACvC,KAAK,CAAC,CAAC,CAAC,CAAC;QAEZ,IAAI,IAAI,CAAC,eAAe,CAAC,eAAe,CAAC,EAAE,CAAC;YAC1C,oEAAoE;YACpE,sEAAsE;YACtE,wEAAwE;YACxE,wEAAwE;YACxE,uEAAuE;YACvE,qEAAqE;YACrE,6CAA6C;YAC7C,EAAE;YACF,wEAAwE;YACxE,sEAAsE;YACtE,uEAAuE;YACvE,uEAAuE;YACvE,mEAAmE;YACnE,oCAAoC;YACpC,IAAI,CAAC,qBAAqB,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,CAAC;gBAChE,sEAAsE;gBACtE,iEAAiE;gBACjE,sEAAsE;gBACtE,gBAAgB;gBAChB,MAAM,cAAc,CAAC,QAAQ,EAAE,MAAM,SAAS,EAAE,CAAC,CAAC;gBAClD,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;YACzC,CAAC;YACD,MAAM,WAAW,GAAG,eAAe,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,eAAe,CAAC;YACrE,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,eAAe,EAAE,WAAW,CAAC,CAAC;YACzE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1F,CAAC;QAED,0EAA0E;QAC1E,8DAA8D;QAC9D,kEAAkE;QAClE,wDAAwD;QACxD,MAAM,MAAM,GAAG,IAAI,EAAE,YAAY,IAAI,CAAC,MAAM,SAAS,EAAE,CAAC,CAAC;QACzD,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QACvD,IAAI,CAAC,IAAI,EAAE,YAAY,IAAI,CAAC,OAAO,EAAE,CAAC;YACpC,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;QACzC,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC;IACvF,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,YAAY,CAChB,KAAa,EACb,IAAY;QAEZ,MAAM,eAAe,GAAG,cAAc,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;QACpD,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE,CAAC;YACvC,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;QACvD,CAAC;QACD,IAAI,CAAC,mBAAmB,CAAC,eAAe,CAAC,CAAC;QAC1C,MAAM,WAAW,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,eAAe,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,eAAe,CAAC;QAC5F,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,eAAe,EAAE,WAAW,CAAC,CAAC;QACxE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC;IACvF,CAAC;IAED;;;;;;;;;;;;;OAaG;IACH,KAAK,CAAC,aAAa,CACjB,KAAa,EACb,IAAwB,EACxB,QAAgB;QAEhB,MAAM,eAAe,GAAG,cAAc,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;QACpD,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE,CAAC;YACvC,MAAM,IAAI,KAAK,CAAC,eAAe,CAAC,CAAC;QACnC,CAAC;QACD,uEAAuE;QACvE,8DAA8D;QAC9D,IAAI,IAAI,CAAC,eAAe,CAAC,eAAe,CAAC,EAAE,CAAC;YAC1C,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;QAC9C,CAAC;QACD,IAAI,CAAC,oBAAoB,CAAC,QAAQ,CAAC,CAAC;QACpC,MAAM,YAAY,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACzC,MAAM,WAAW,GAAG,YAAY,IAAI,eAAe,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,eAAe,CAAC;QACrF,MAAM,YAAY,GAAG,MAAM,YAAY,CAAC,QAAQ,CAAC,CAAC;QAClD,0EAA0E;QAC1E,oEAAoE;QACpE,sEAAsE;QACtE,mEAAmE;QACnE,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,IAAI,CAAC,EAAE;aACxB,MAAM,CAAC,KAAK,CAAC;aACb,MAAM,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,IAAI,EAAE,WAAW,EAAE,YAAY,EAAE,CAAC;aACnE,kBAAkB,CAAC;YAClB,MAAM,EAAE,KAAK,CAAC,KAAK;YACnB,GAAG,EAAE,YAAY;gBACf,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE;gBAC7D,CAAC,CAAC,EAAE,YAAY,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE;SAC5C,CAAC;aACD,SAAS,EAAE,CAAC;QACf,OAAO,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;IAChC,CAAC;IAED;;;;;;;;;;;;;OAaG;IACK,eAAe,CAAC,KAAa;QACnC,OAAO,CACL,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC;YACjC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC;YACpC,KAAK,KAAK,IAAI,CAAC,MAAM,CAAC,UAAU,CACjC,CAAC;IACJ,CAAC;IAED;;;;;;;OAOG;IACK,iBAAiB,CAAC,KAAa;QACrC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,oBAAoB,IAAI,IAAI,CAAC,IAAI,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;IACnF,CAAC;IAED;;;;;;;;OAQG;IACK,YAAY,CAAC,IAAsC;QACzD,OAAO,EAAE,GAAG,UAAU,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;IACjF,CAAC;IAED;;;;;;;;;;;;;;;;OAgBG;IACH,KAAK,CAAC,cAAc,CAClB,MAAc,EACd,eAAmC,EACnC,WAAmB;QAEnB,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACvF,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC;QAC7C,2EAA2E;QAC3E,yEAAyE;QACzE,IAAI,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YACrC,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;QAC9C,CAAC;QACD,IAAI,CAAC,oBAAoB,CAAC,WAAW,CAAC,CAAC;QACvC,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACtB,IAAI,CAAC,eAAe,IAAI,CAAC,CAAC,MAAM,cAAc,CAAC,eAAe,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,EAAE,CAAC;gBACpF,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;YACnD,CAAC;QACH,CAAC;QACD,MAAM,YAAY,GAAG,MAAM,YAAY,CAAC,WAAW,CAAC,CAAC;QACrD,MAAM,IAAI,CAAC,EAAE;aACV,MAAM,CAAC,KAAK,CAAC;aACb,GAAG,CAAC,EAAE,YAAY,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC;aAC5C,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC;IACjC,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,YAAY;QAUhB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACrE,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YACxB,EAAE,EAAE,GAAG,CAAC,EAAE;YACV,KAAK,EAAE,GAAG,CAAC,KAAK;YAChB,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,WAAW,EAAE,GAAG,CAAC,YAAY,IAAI,IAAI;YACrC,UAAU,EAAE,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,KAAK,CAAC;YAC7C,SAAS,EAAE,GAAG,CAAC,SAAS;SACzB,CAAC,CAAC,CAAC;IACN,CAAC;IAEO,oBAAoB,CAAC,QAAgB;QAC3C,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,MAAM,GAAG,mBAAmB,EAAE,CAAC;YAClD,MAAM,IAAI,KAAK,CAAC,6BAA6B,mBAAmB,aAAa,CAAC,CAAC;QACjF,CAAC;IACH,CAAC;IAEO,SAAS,CAAC,MAAc,EAAE,KAAa;QAC7C,OAAO,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACjF,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,kBAAkB,CACtB,KAAa,EACb,IAAa;QAEb,MAAM,eAAe,GAAG,cAAc,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;QACpD,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,eAAe,CAAC;YAAE,OAAO,IAAI,CAAC;QACpD,MAAM,WAAW,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,eAAe,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,eAAe,CAAC;QAC5F,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,eAAe,EAAE,WAAW,CAAC,CAAC;QACxE,OAAO,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;IAC7D,CAAC;IAEO,KAAK,CAAC,iBAAiB,CAAC,KAAa,EAAE,IAAY;QACzD,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,IAAI,CAAC,EAAE;aACzB,MAAM,CAAC,KAAK,CAAC;aACb,MAAM,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;aACvB,kBAAkB,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE,EAAE,CAAC;aAC3E,SAAS,EAAE,CAAC;QACf,OAAO,IAAI,CAAC;IACd,CAAC;IAED,WAAW,CAAC,KAAa;QACvB,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS,CAGtD,CAAC;QACF,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC;IAC1D,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,oBAAoB,CACxB,MAAmB;QAEnB,MAAM,MAAM,GAAG,IAAI,GAAG,EAAuD,CAAC;QAC9E,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC;YAAE,OAAO,MAAM,CAAC;QACrC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAChD,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,MAAM,CAAC,GAAG,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YAC/B,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;gBAAE,SAAS;YAC7B,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;QAClE,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,MAAc;QAC9B,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,IAAI,CAAC,EAAE;aACzB,MAAM,EAAE;aACR,IAAI,CAAC,KAAK,CAAC;aACX,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;aAC3B,KAAK,CAAC,CAAC,CAAC,CAAC;QAEZ,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC;QAEvB,OAAO,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;IACjC,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,cAAc,CAAC,KAAa;QAChC,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,IAAI,CAAC,EAAE;aACzB,MAAM,EAAE;aACR,IAAI,CAAC,KAAK,CAAC;aACX,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,cAAc,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC;aACnD,KAAK,CAAC,CAAC,CAAC,CAAC;QAEZ,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC;QAEvB,OAAO,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;IACjC,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,kBAAkB,CAAC,MAAc;QACrC,MAAM,IAAI,CAAC,EAAE;aACV,MAAM,CAAC,KAAK,CAAC;aACb,GAAG,CAAC,EAAE,cAAc,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC;aACpD,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC;IACjC,CAAC;IAED;;;;;;;;OAQG;IACH,oBAAoB,CAAC,KAAa;QAChC,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC;QAChD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACtC,MAAM,MAAM,GAAG,cAAc,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC/D,IAAI,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;QAC1B,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;IACvE,CAAC;IAED;;;;;;;;;;;;OAYG;IACK,mBAAmB,CAAC,eAAuB;QACjD,IAAI,CAAC,IAAI,CAAC,oBAAoB,CAAC,eAAe,CAAC,EAAE,CAAC;YAChD,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;QACjD,CAAC;IACH,CAAC;CAEF"}