@bevel-software/platform-core-backend 0.22.0 → 0.23.0

package/dist/modules/auth/auth.service.js

@@ -1,10 +1,21 @@
 import jwt from 'jsonwebtoken';
-import { eq } from 'drizzle-orm';
+import { and, eq, isNotNull, isNull } from 'drizzle-orm';
 import { users } from '../database/schema.js';
 import { canonicalEmail, hashEmail } from '../../shared/email-identity.js';
-import { AccountAdmissionRefusedError, admitEveryone, } from './account-admission.js';
+import { AccountAdmissionRefusedError, AccountChangeRefusedError, AccountDeactivatedError, AuthBackendError, admitEveryone, } from './account-admission.js';
 import { hashPassword, verifyPassword, timingSafeStringEqual, MIN_PASSWORD_LENGTH, } from './password-hash.js';
+import { RECOVERY_BOT_EMAIL } from '../workflow/recovery-bot.js';
+import { DIRECTORY_SYNC_BOT_EMAIL } from '../access/directory-sync-bot.js';
 const EMAIL_REGEX = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
+/**
+ * How long {@link AuthService.isActive} trusts what it last read. Every
+ * request carrying a credential asks, so the answer is kept briefly rather
+ * than read each time; switching an account off or on in THIS process
+ * forgets it at once, and another replica sees the change within this long.
+ */
+const ACTIVE_CACHE_MS = 30_000;
+/** The accounts core runs its own work as. Nobody signs in with them, and nobody switches them off. */
+const SYSTEM_ACCOUNT_EMAILS = [RECOVERY_BOT_EMAIL, DIRECTORY_SYNC_BOT_EMAIL];
 /**
  * What every caller is told when it tries to give the deployment admin a
  * stored password — the Account page's own change and an admin's "Set
@@ -70,8 +81,20 @@ export class AuthService {
         if (existing)
             return;
         const verdict = await this.admission.canProvision(normalizedEmail, reason);
-        if (!verdict.ok)
-            throw new AccountAdmissionRefusedError(verdict.message);
+        if (verdict.ok)
+            return;
+        // A first sign-in the port would rather keep than turn away: the person
+        // is put on file, switched off, for an admin to switch on — and is still
+        // refused now, with the port's words. Only for single sign-on, the one
+        // provisioning nobody asked for (see `AccountAdmissionVerdict`).
+        if (verdict.waitForAdmin && reason === 'sso') {
+            await this.db
+                .insert(users)
+                .values({ email: normalizedEmail, name: normalizedEmail.split('@')[0] || normalizedEmail, deactivatedAt: new Date() })
+                .onConflictDoNothing({ target: users.email });
+            throw new AccountAdmissionRefusedError(verdict.message, { waitingForAdmin: true });
+        }
+        throw new AccountAdmissionRefusedError(verdict.message);
     }
     /**
      * Password login. Two credential sources, in order:
@@ -134,6 +157,9 @@ export class AuthService {
                 await verifyPassword(provided, await decoyHash());
                 throw new Error('Invalid credentials');
             }
+            // Never refused for being switched off: the environment password is
+            // the deployment's way back in, and {@link deactivate} refuses this
+            // account for that reason.
             const defaultName = normalizedEmail.split('@')[0] || normalizedEmail;
             await this.assertAdmitted(normalizedEmail, 'bootstrap');
             const admin = await this.upsertUserByEmail(normalizedEmail, defaultName);
@@ -148,6 +174,10 @@ export class AuthService {
         if (!user?.passwordHash || !matches) {
             throw new Error('Invalid credentials');
         }
+        // Only now, with the password proven: telling a stranger that an address
+        // is switched off would tell them it has an account.
+        if (user.deactivatedAt)
+            throw new AccountDeactivatedError();
         return { token: this.signToken(user.id, user.email), user: this.toClientUser(user) };
     }
     /**
@@ -175,6 +205,8 @@ export class AuthService {
         await this.assertAdmitted(normalizedEmail, 'sso');
         const displayName = (name ?? '').trim() || normalizedEmail.split('@')[0] || normalizedEmail;
         const user = await this.upsertUserByEmail(normalizedEmail, displayName);
+        if (user.deactivatedAt)
+            throw new AccountDeactivatedError();
         return { token: this.signToken(user.id, user.email), user: this.toClientUser(user) };
     }
     /**
@@ -183,7 +215,13 @@ export class AuthService {
      * account (e.g. one that first arrived via SSO, or a reset for a locked-out
      * user) is deliberate admin behavior, not an error.
      *
-     * The deployment admin is the one target this refuses, for the reason
+     * WITHOUT a password the account is made for single sign-on: the person
+     * signs in through the deployment's provider and finds their account
+     * waiting, already holding its place (a seat, on a host that sells them).
+     * Password sign-in refuses it until a password is set. For an address that
+     * already has an account it changes nothing but an explicitly given name.
+     *
+     * WITH a password, the deployment admin is the one target this refuses, for the reason
      * {@link changePassword} refuses it: that account's password is the
      * environment's, so a stored hash would not replace it but ADD a second
      * credential — one that keeps signing in after `ADMIN_PASSWORD` is rotated,
@@ -196,6 +234,20 @@ export class AuthService {
         if (!EMAIL_REGEX.test(normalizedEmail)) {
             throw new Error('Invalid email');
         }
+        const suppliedName = (name ?? '').trim();
+        const displayName = suppliedName || normalizedEmail.split('@')[0] || normalizedEmail;
+        if (!password) {
+            await this.assertAdmitted(normalizedEmail, 'admin-create');
+            const [created] = await this.db
+                .insert(users)
+                .values({ email: normalizedEmail, name: displayName })
+                .onConflictDoUpdate({
+                target: users.email,
+                set: suppliedName ? { name: suppliedName, updatedAt: new Date() } : { updatedAt: new Date() },
+            })
+                .returning();
+            return this.toClientUser(created);
+        }
         // Before the policy check, so the refusal names the real reason rather
         // than sending the admin off to pick a longer password first.
         if (this.isEnvAdminEmail(normalizedEmail)) {
@@ -203,8 +255,6 @@ export class AuthService {
         }
         this.assertPasswordPolicy(password);
         await this.assertAdmitted(normalizedEmail, 'admin-create');
-        const suppliedName = (name ?? '').trim();
-        const displayName = suppliedName || normalizedEmail.split('@')[0] || normalizedEmail;
         const passwordHash = await hashPassword(password);
         // One atomic upsert. On conflict (re-provisioning an existing account) an
         // EXPLICITLY supplied name is persisted too; a blank name keeps the
@@ -317,6 +367,8 @@ export class AuthService {
             name: row.name,
             hasPassword: row.passwordHash != null,
             isEnvAdmin: this.reportsAsEnvAdmin(row.email),
+            deactivatedAt: row.deactivatedAt,
+            isSystem: SYSTEM_ACCOUNT_EMAILS.includes(row.email),
             createdAt: row.createdAt,
         }));
     }
@@ -343,6 +395,8 @@ export class AuthService {
         await this.assertAdmitted(normalizedEmail, 'embed');
         const displayName = (name ?? '').trim() || normalizedEmail.split('@')[0] || normalizedEmail;
         const user = await this.upsertUserByEmail(normalizedEmail, displayName);
+        if (user.deactivatedAt)
+            throw new AccountDeactivatedError();
         return { id: user.id, email: user.email, name: user.name };
     }
     async upsertUserByEmail(email, name) {
@@ -353,10 +407,125 @@ export class AuthService {
             .returning();
         return user;
     }
+    /**
+     * The signature and expiry of a session token, and nothing else — whether
+     * its account is still on is {@link resolveSession}'s question. Every
+     * place a session is ACCEPTED goes through that one.
+     */
     verifyToken(token) {
         const decoded = jwt.verify(token, this.config.jwtSecret);
         return { userId: decoded.userId, email: decoded.email };
     }
+    /**
+     * A session token that may still be used: signed by us, not expired, and
+     * its account still on. A token outlives a deactivation by up to seven
+     * days, so the signature alone no longer says the bearer may enter.
+     * Throws for an invalid token, {@link AccountDeactivatedError} for one
+     * whose account was switched off.
+     */
+    async resolveSession(token) {
+        const claim = this.verifyToken(token);
+        let active;
+        try {
+            active = await this.isActive(claim.userId);
+        }
+        catch (err) {
+            // The token is fine; the database is not. Said apart from a refusal, so
+            // an outage is a 500 and not a sign-out (see `AuthBackendError`).
+            throw new AuthBackendError(err);
+        }
+        if (!active)
+            throw new AccountDeactivatedError();
+        return claim;
+    }
+    activeCache = new Map();
+    /**
+     * Whether the account behind a credential is on: it exists and no admin
+     * switched it off. Asked for every credential presented that does not
+     * already read the account (a session token, an internal token), so it is
+     * cached for {@link ACTIVE_CACHE_MS}; switching an account off or on in
+     * this process forgets its entry at once.
+     *
+     * A missing row is not on either — an erased account's tokens die with it.
+     *
+     * The deployment admin's account is always on, whatever its row says: its
+     * environment password signs it in regardless (see `loginWithPassword`),
+     * and a session that sign-in mints must then be usable too, or the way
+     * back into a deployment would lead nowhere. {@link deactivate} refuses
+     * the account, but a host may write the column itself.
+     */
+    async isActive(userId) {
+        const now = Date.now();
+        const hit = this.activeCache.get(userId);
+        if (hit && now - hit.at < ACTIVE_CACHE_MS)
+            return hit.active;
+        const [row] = await this.db
+            .select({ email: users.email, deactivatedAt: users.deactivatedAt })
+            .from(users)
+            .where(eq(users.id, userId))
+            .limit(1);
+        const active = row !== undefined && (!row.deactivatedAt || this.isEnvAdminEmail(row.email ?? ''));
+        this.activeCache.set(userId, { active, at: now });
+        return active;
+    }
+    /**
+     * Switch an account off. Its row, history and place in roles and groups
+     * stay; every credential it holds stops being honoured (see
+     * {@link isActive}). Idempotent: an account already off keeps the moment
+     * it was first switched off.
+     *
+     * The deployment admin is refused: the environment password is the way
+     * back into a deployment whose every other admin is gone, and switching
+     * it off would close that door from inside. So are the machine accounts
+     * core runs its own work as. Refusing an admin's own account is the
+     * route's concern, since it knows who is asking.
+     *
+     * Returns false when there is no such account.
+     */
+    async deactivate(userId) {
+        const [row] = await this.db.select().from(users).where(eq(users.id, userId)).limit(1);
+        if (!row)
+            return false;
+        if (this.isEnvAdminEmail(row.email)) {
+            throw new AccountChangeRefusedError('The deployment admin cannot be switched off: its password in the environment is the way back in.');
+        }
+        if (SYSTEM_ACCOUNT_EMAILS.includes(row.email)) {
+            throw new AccountChangeRefusedError('This account belongs to the platform itself and cannot be switched off.');
+        }
+        await this.db
+            .update(users)
+            .set({ deactivatedAt: new Date(), updatedAt: new Date() })
+            .where(and(eq(users.id, userId), isNull(users.deactivatedAt)));
+        this.activeCache.delete(userId);
+        return true;
+    }
+    /**
+     * Switch a deactivated account back on, if the deployment has room for it:
+     * the admission port is asked, as for a new account, because an account
+     * that is on takes the same place. A refusal throws
+     * {@link AccountAdmissionRefusedError} with the port's words. An account
+     * already on is not asked about.
+     *
+     * Returns false when there is no such account.
+     */
+    async reactivate(userId) {
+        const [row] = await this.db.select().from(users).where(eq(users.id, userId)).limit(1);
+        if (!row)
+            return false;
+        if (!row.deactivatedAt)
+            return true;
+        if (this.admission !== admitEveryone) {
+            const verdict = await this.admission.canProvision(row.email, 'reactivate');
+            if (!verdict.ok)
+                throw new AccountAdmissionRefusedError(verdict.message);
+        }
+        await this.db
+            .update(users)
+            .set({ deactivatedAt: null, updatedAt: new Date() })
+            .where(and(eq(users.id, userId), isNotNull(users.deactivatedAt)));
+        this.activeCache.delete(userId);
+        return true;
+    }
     /**
      * Resolve a set of `authorId` hashes back to the app users that produced
      * them. Used by the PR list to display the human who triggered each PR

package/dist/modules/auth/auth.service.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.service.js","sourceRoot":"","sources":["../../../src/modules/auth/auth.service.ts"],"names":[],"mappings":"AAAA,OAAO,GAAG,MAAM,cAAc,CAAC;AAC/B,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AAEjC,OAAO,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAE9C,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,gCAAgC,CAAC;AAC3E,OAAO,EACL,4BAA4B,EAC5B,aAAa,GAGd,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,YAAY,EACZ,cAAc,EACd,qBAAqB,EACrB,mBAAmB,GACpB,MAAM,oBAAoB,CAAC;AAE5B,MAAM,WAAW,GAAG,4BAA4B,CAAC;AAEjD;;;;;GAKG;AACH,MAAM,0BAA0B,GAC9B,yFAAyF,CAAC;AAE5F;;;;;;GAMG;AACH,IAAI,gBAAgB,GAA2B,IAAI,CAAC;AACpD,SAAS,SAAS;IAChB,gBAAgB,KAAK,YAAY,CAAC,oCAAoC,CAAC,CAAC;IACxE,OAAO,gBAAgB,CAAC;AAC1B,CAAC;AAED;;;;;GAKG;AACH,SAAS,UAAU,CAAC,IAMnB;IACC,OAAO;QACL,EAAE,EAAE,IAAI,CAAC,EAAE;QACX,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,SAAS,EAAE,IAAI,CAAC,SAAS,IAAI,SAAS;QACtC,cAAc,EAAE,IAAI,CAAC,cAAc;KACpC,CAAC;AACJ,CAAC;AA0CD,MAAM,OAAO,WAAW;IAEH;IACA;IAKA;IAPnB,YACmB,EAAY,EACZ,MAAkB;IACnC;;;OAGG;IACc,YAA+B,aAAa;QAN5C,OAAE,GAAF,EAAE,CAAU;QACZ,WAAM,GAAN,MAAM,CAAY;QAKlB,cAAS,GAAT,SAAS,CAAmC;IAC5D,CAAC;IAEJ;;;;;OAKG;IACK,KAAK,CAAC,cAAc,CAAC,eAAuB,EAAE,MAA8B;QAClF,IAAI,IAAI,CAAC,SAAS,KAAK,aAAa;YAAE,OAAO;QAC7C,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,IAAI,CAAC,EAAE;aAC7B,MAAM,CAAC,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC;aACxB,IAAI,CAAC,KAAK,CAAC;aACX,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,eAAe,CAAC,CAAC;aACvC,KAAK,CAAC,CAAC,CAAC,CAAC;QACZ,IAAI,QAAQ;YAAE,OAAO;QACrB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;QAC3E,IAAI,CAAC,OAAO,CAAC,EAAE;YAAE,MAAM,IAAI,4BAA4B,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAC3E,CAAC;IAED;;;;;;;;;;;;;;;;;;;OAmBG;IACH,KAAK,CAAC,iBAAiB,CACrB,KAAa,EACb,QAAgB;QAEhB,MAAM,eAAe,GAAG,cAAc,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;QAEpD,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE,CAAC;YACvC,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;QACzC,CAAC;QAED,MAAM,QAAQ,GAAG,QAAQ,IAAI,EAAE,CAAC;QAEhC,0EAA0E;QAC1E,uEAAuE;QACvE,uEAAuE;QACvE,qEAAqE;QACrE,uEAAuE;QACvE,0EAA0E;QAC1E,iCAAiC;QACjC,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,IAAI,CAAC,EAAE;aACzB,MAAM,EAAE;aACR,IAAI,CAAC,KAAK,CAAC;aACX,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,eAAe,CAAC,CAAC;aACvC,KAAK,CAAC,CAAC,CAAC,CAAC;QAEZ,IAAI,IAAI,CAAC,eAAe,CAAC,eAAe,CAAC,EAAE,CAAC;YAC1C,oEAAoE;YACpE,sEAAsE;YACtE,wEAAwE;YACxE,wEAAwE;YACxE,uEAAuE;YACvE,qEAAqE;YACrE,6CAA6C;YAC7C,EAAE;YACF,wEAAwE;YACxE,sEAAsE;YACtE,uEAAuE;YACvE,uEAAuE;YACvE,mEAAmE;YACnE,oCAAoC;YACpC,IAAI,CAAC,qBAAqB,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,CAAC;gBAChE,sEAAsE;gBACtE,iEAAiE;gBACjE,sEAAsE;gBACtE,gBAAgB;gBAChB,MAAM,cAAc,CAAC,QAAQ,EAAE,MAAM,SAAS,EAAE,CAAC,CAAC;gBAClD,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;YACzC,CAAC;YACD,MAAM,WAAW,GAAG,eAAe,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,eAAe,CAAC;YACrE,MAAM,IAAI,CAAC,cAAc,CAAC,eAAe,EAAE,WAAW,CAAC,CAAC;YACxD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,eAAe,EAAE,WAAW,CAAC,CAAC;YACzE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1F,CAAC;QAED,0EAA0E;QAC1E,8DAA8D;QAC9D,kEAAkE;QAClE,wDAAwD;QACxD,MAAM,MAAM,GAAG,IAAI,EAAE,YAAY,IAAI,CAAC,MAAM,SAAS,EAAE,CAAC,CAAC;QACzD,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QACvD,IAAI,CAAC,IAAI,EAAE,YAAY,IAAI,CAAC,OAAO,EAAE,CAAC;YACpC,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;QACzC,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC;IACvF,CAAC;IAED;;;;;;;;;;;;;;OAcG;IACH,KAAK,CAAC,YAAY,CAChB,KAAa,EACb,IAAY,EACZ,OAAwB,EAAE;QAE1B,MAAM,eAAe,GAAG,cAAc,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;QACpD,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE,CAAC;YACvC,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;QACvD,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,kBAAkB;YAAE,IAAI,CAAC,mBAAmB,CAAC,eAAe,CAAC,CAAC;QACxE,MAAM,IAAI,CAAC,cAAc,CAAC,eAAe,EAAE,KAAK,CAAC,CAAC;QAClD,MAAM,WAAW,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,eAAe,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,eAAe,CAAC;QAC5F,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,eAAe,EAAE,WAAW,CAAC,CAAC;QACxE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC;IACvF,CAAC;IAED;;;;;;;;;;;;;OAaG;IACH,KAAK,CAAC,aAAa,CACjB,KAAa,EACb,IAAwB,EACxB,QAAgB;QAEhB,MAAM,eAAe,GAAG,cAAc,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;QACpD,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE,CAAC;YACvC,MAAM,IAAI,KAAK,CAAC,eAAe,CAAC,CAAC;QACnC,CAAC;QACD,uEAAuE;QACvE,8DAA8D;QAC9D,IAAI,IAAI,CAAC,eAAe,CAAC,eAAe,CAAC,EAAE,CAAC;YAC1C,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;QAC9C,CAAC;QACD,IAAI,CAAC,oBAAoB,CAAC,QAAQ,CAAC,CAAC;QACpC,MAAM,IAAI,CAAC,cAAc,CAAC,eAAe,EAAE,cAAc,CAAC,CAAC;QAC3D,MAAM,YAAY,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACzC,MAAM,WAAW,GAAG,YAAY,IAAI,eAAe,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,eAAe,CAAC;QACrF,MAAM,YAAY,GAAG,MAAM,YAAY,CAAC,QAAQ,CAAC,CAAC;QAClD,0EAA0E;QAC1E,oEAAoE;QACpE,sEAAsE;QACtE,mEAAmE;QACnE,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,IAAI,CAAC,EAAE;aACxB,MAAM,CAAC,KAAK,CAAC;aACb,MAAM,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,IAAI,EAAE,WAAW,EAAE,YAAY,EAAE,CAAC;aACnE,kBAAkB,CAAC;YAClB,MAAM,EAAE,KAAK,CAAC,KAAK;YACnB,GAAG,EAAE,YAAY;gBACf,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE;gBAC7D,CAAC,CAAC,EAAE,YAAY,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE;SAC5C,CAAC;aACD,SAAS,EAAE,CAAC;QACf,OAAO,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;IAChC,CAAC;IAED;;;;;;;;;;;;;OAaG;IACK,eAAe,CAAC,KAAa;QACnC,OAAO,CACL,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC;YACjC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC;YACpC,KAAK,KAAK,IAAI,CAAC,MAAM,CAAC,UAAU,CACjC,CAAC;IACJ,CAAC;IAED;;;;;;;OAOG;IACK,iBAAiB,CAAC,KAAa;QACrC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,oBAAoB,IAAI,IAAI,CAAC,IAAI,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;IACnF,CAAC;IAED;;;;;;;;OAQG;IACK,YAAY,CAAC,IAAsC;QACzD,OAAO,EAAE,GAAG,UAAU,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;IACjF,CAAC;IAED;;;;;;;;;;;;;;;;OAgBG;IACH,KAAK,CAAC,cAAc,CAClB,MAAc,EACd,eAAmC,EACnC,WAAmB;QAEnB,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACvF,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC;QAC7C,2EAA2E;QAC3E,yEAAyE;QACzE,IAAI,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YACrC,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;QAC9C,CAAC;QACD,IAAI,CAAC,oBAAoB,CAAC,WAAW,CAAC,CAAC;QACvC,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACtB,IAAI,CAAC,eAAe,IAAI,CAAC,CAAC,MAAM,cAAc,CAAC,eAAe,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,EAAE,CAAC;gBACpF,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;YACnD,CAAC;QACH,CAAC;QACD,MAAM,YAAY,GAAG,MAAM,YAAY,CAAC,WAAW,CAAC,CAAC;QACrD,MAAM,IAAI,CAAC,EAAE;aACV,MAAM,CAAC,KAAK,CAAC;aACb,GAAG,CAAC,EAAE,YAAY,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC;aAC5C,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC;IACjC,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,YAAY;QAUhB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACrE,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YACxB,EAAE,EAAE,GAAG,CAAC,EAAE;YACV,KAAK,EAAE,GAAG,CAAC,KAAK;YAChB,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,WAAW,EAAE,GAAG,CAAC,YAAY,IAAI,IAAI;YACrC,UAAU,EAAE,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,KAAK,CAAC;YAC7C,SAAS,EAAE,GAAG,CAAC,SAAS;SACzB,CAAC,CAAC,CAAC;IACN,CAAC;IAEO,oBAAoB,CAAC,QAAgB;QAC3C,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,MAAM,GAAG,mBAAmB,EAAE,CAAC;YAClD,MAAM,IAAI,KAAK,CAAC,6BAA6B,mBAAmB,aAAa,CAAC,CAAC;QACjF,CAAC;IACH,CAAC;IAEO,SAAS,CAAC,MAAc,EAAE,KAAa;QAC7C,OAAO,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACjF,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,kBAAkB,CACtB,KAAa,EACb,IAAa;QAEb,MAAM,eAAe,GAAG,cAAc,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;QACpD,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,eAAe,CAAC;YAAE,OAAO,IAAI,CAAC;QACpD,MAAM,IAAI,CAAC,cAAc,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC;QACpD,MAAM,WAAW,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,eAAe,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,eAAe,CAAC;QAC5F,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,eAAe,EAAE,WAAW,CAAC,CAAC;QACxE,OAAO,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;IAC7D,CAAC;IAEO,KAAK,CAAC,iBAAiB,CAAC,KAAa,EAAE,IAAY;QACzD,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,IAAI,CAAC,EAAE;aACzB,MAAM,CAAC,KAAK,CAAC;aACb,MAAM,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;aACvB,kBAAkB,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE,EAAE,CAAC;aAC3E,SAAS,EAAE,CAAC;QACf,OAAO,IAAI,CAAC;IACd,CAAC;IAED,WAAW,CAAC,KAAa;QACvB,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS,CAGtD,CAAC;QACF,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC;IAC1D,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,oBAAoB,CACxB,MAAmB;QAEnB,MAAM,MAAM,GAAG,IAAI,GAAG,EAAuD,CAAC;QAC9E,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC;YAAE,OAAO,MAAM,CAAC;QACrC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAChD,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,MAAM,CAAC,GAAG,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YAC/B,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;gBAAE,SAAS;YAC7B,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;QAClE,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,MAAc;QAC9B,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,IAAI,CAAC,EAAE;aACzB,MAAM,EAAE;aACR,IAAI,CAAC,KAAK,CAAC;aACX,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;aAC3B,KAAK,CAAC,CAAC,CAAC,CAAC;QAEZ,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC;QAEvB,OAAO,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;IACjC,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,cAAc,CAAC,KAAa;QAChC,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,IAAI,CAAC,EAAE;aACzB,MAAM,EAAE;aACR,IAAI,CAAC,KAAK,CAAC;aACX,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,cAAc,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC;aACnD,KAAK,CAAC,CAAC,CAAC,CAAC;QAEZ,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC;QAEvB,OAAO,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;IACjC,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,kBAAkB,CAAC,MAAc;QACrC,MAAM,IAAI,CAAC,EAAE;aACV,MAAM,CAAC,KAAK,CAAC;aACb,GAAG,CAAC,EAAE,cAAc,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC;aACpD,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC;IACjC,CAAC;IAED;;;;;;;;OAQG;IACH,oBAAoB,CAAC,KAAa;QAChC,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC;QAChD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACtC,MAAM,MAAM,GAAG,cAAc,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC/D,IAAI,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;QAC1B,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;IACvE,CAAC;IAED;;;;;;;;;;;;OAYG;IACK,mBAAmB,CAAC,eAAuB;QACjD,IAAI,CAAC,IAAI,CAAC,oBAAoB,CAAC,eAAe,CAAC,EAAE,CAAC;YAChD,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;QACjD,CAAC;IACH,CAAC;CAEF"}
+{"version":3,"file":"auth.service.js","sourceRoot":"","sources":["../../../src/modules/auth/auth.service.ts"],"names":[],"mappings":"AAAA,OAAO,GAAG,MAAM,cAAc,CAAC;AAC/B,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAEzD,OAAO,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAE9C,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,gCAAgC,CAAC;AAC3E,OAAO,EACL,4BAA4B,EAC5B,yBAAyB,EACzB,uBAAuB,EACvB,gBAAgB,EAChB,aAAa,GAGd,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,YAAY,EACZ,cAAc,EACd,qBAAqB,EACrB,mBAAmB,GACpB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AACjE,OAAO,EAAE,wBAAwB,EAAE,MAAM,iCAAiC,CAAC;AAE3E,MAAM,WAAW,GAAG,4BAA4B,CAAC;AAEjD;;;;;GAKG;AACH,MAAM,eAAe,GAAG,MAAM,CAAC;AAE/B,uGAAuG;AACvG,MAAM,qBAAqB,GAAsB,CAAC,kBAAkB,EAAE,wBAAwB,CAAC,CAAC;AAEhG;;;;;GAKG;AACH,MAAM,0BAA0B,GAC9B,yFAAyF,CAAC;AAE5F;;;;;;GAMG;AACH,IAAI,gBAAgB,GAA2B,IAAI,CAAC;AACpD,SAAS,SAAS;IAChB,gBAAgB,KAAK,YAAY,CAAC,oCAAoC,CAAC,CAAC;IACxE,OAAO,gBAAgB,CAAC;AAC1B,CAAC;AAED;;;;;GAKG;AACH,SAAS,UAAU,CAAC,IAMnB;IACC,OAAO;QACL,EAAE,EAAE,IAAI,CAAC,EAAE;QACX,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,SAAS,EAAE,IAAI,CAAC,SAAS,IAAI,SAAS;QACtC,cAAc,EAAE,IAAI,CAAC,cAAc;KACpC,CAAC;AACJ,CAAC;AA0CD,MAAM,OAAO,WAAW;IAEH;IACA;IAKA;IAPnB,YACmB,EAAY,EACZ,MAAkB;IACnC;;;OAGG;IACc,YAA+B,aAAa;QAN5C,OAAE,GAAF,EAAE,CAAU;QACZ,WAAM,GAAN,MAAM,CAAY;QAKlB,cAAS,GAAT,SAAS,CAAmC;IAC5D,CAAC;IAEJ;;;;;OAKG;IACK,KAAK,CAAC,cAAc,CAAC,eAAuB,EAAE,MAA8B;QAClF,IAAI,IAAI,CAAC,SAAS,KAAK,aAAa;YAAE,OAAO;QAC7C,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,IAAI,CAAC,EAAE;aAC7B,MAAM,CAAC,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC;aACxB,IAAI,CAAC,KAAK,CAAC;aACX,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,eAAe,CAAC,CAAC;aACvC,KAAK,CAAC,CAAC,CAAC,CAAC;QACZ,IAAI,QAAQ;YAAE,OAAO;QACrB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;QAC3E,IAAI,OAAO,CAAC,EAAE;YAAE,OAAO;QACvB,wEAAwE;QACxE,yEAAyE;QACzE,uEAAuE;QACvE,iEAAiE;QACjE,IAAI,OAAO,CAAC,YAAY,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;YAC7C,MAAM,IAAI,CAAC,EAAE;iBACV,MAAM,CAAC,KAAK,CAAC;iBACb,MAAM,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,IAAI,EAAE,eAAe,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,eAAe,EAAE,aAAa,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC;iBACrH,mBAAmB,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;YAChD,MAAM,IAAI,4BAA4B,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC,CAAC;QACrF,CAAC;QACD,MAAM,IAAI,4BAA4B,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAC1D,CAAC;IAED;;;;;;;;;;;;;;;;;;;OAmBG;IACH,KAAK,CAAC,iBAAiB,CACrB,KAAa,EACb,QAAgB;QAEhB,MAAM,eAAe,GAAG,cAAc,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;QAEpD,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE,CAAC;YACvC,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;QACzC,CAAC;QAED,MAAM,QAAQ,GAAG,QAAQ,IAAI,EAAE,CAAC;QAEhC,0EAA0E;QAC1E,uEAAuE;QACvE,uEAAuE;QACvE,qEAAqE;QACrE,uEAAuE;QACvE,0EAA0E;QAC1E,iCAAiC;QACjC,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,IAAI,CAAC,EAAE;aACzB,MAAM,EAAE;aACR,IAAI,CAAC,KAAK,CAAC;aACX,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,eAAe,CAAC,CAAC;aACvC,KAAK,CAAC,CAAC,CAAC,CAAC;QAEZ,IAAI,IAAI,CAAC,eAAe,CAAC,eAAe,CAAC,EAAE,CAAC;YAC1C,oEAAoE;YACpE,sEAAsE;YACtE,wEAAwE;YACxE,wEAAwE;YACxE,uEAAuE;YACvE,qEAAqE;YACrE,6CAA6C;YAC7C,EAAE;YACF,wEAAwE;YACxE,sEAAsE;YACtE,uEAAuE;YACvE,uEAAuE;YACvE,mEAAmE;YACnE,oCAAoC;YACpC,IAAI,CAAC,qBAAqB,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,CAAC;gBAChE,sEAAsE;gBACtE,iEAAiE;gBACjE,sEAAsE;gBACtE,gBAAgB;gBAChB,MAAM,cAAc,CAAC,QAAQ,EAAE,MAAM,SAAS,EAAE,CAAC,CAAC;gBAClD,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;YACzC,CAAC;YACD,oEAAoE;YACpE,oEAAoE;YACpE,2BAA2B;YAC3B,MAAM,WAAW,GAAG,eAAe,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,eAAe,CAAC;YACrE,MAAM,IAAI,CAAC,cAAc,CAAC,eAAe,EAAE,WAAW,CAAC,CAAC;YACxD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,eAAe,EAAE,WAAW,CAAC,CAAC;YACzE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1F,CAAC;QAED,0EAA0E;QAC1E,8DAA8D;QAC9D,kEAAkE;QAClE,wDAAwD;QACxD,MAAM,MAAM,GAAG,IAAI,EAAE,YAAY,IAAI,CAAC,MAAM,SAAS,EAAE,CAAC,CAAC;QACzD,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QACvD,IAAI,CAAC,IAAI,EAAE,YAAY,IAAI,CAAC,OAAO,EAAE,CAAC;YACpC,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;QACzC,CAAC;QACD,yEAAyE;QACzE,qDAAqD;QACrD,IAAI,IAAI,CAAC,aAAa;YAAE,MAAM,IAAI,uBAAuB,EAAE,CAAC;QAC5D,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC;IACvF,CAAC;IAED;;;;;;;;;;;;;;OAcG;IACH,KAAK,CAAC,YAAY,CAChB,KAAa,EACb,IAAY,EACZ,OAAwB,EAAE;QAE1B,MAAM,eAAe,GAAG,cAAc,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;QACpD,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE,CAAC;YACvC,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;QACvD,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,kBAAkB;YAAE,IAAI,CAAC,mBAAmB,CAAC,eAAe,CAAC,CAAC;QACxE,MAAM,IAAI,CAAC,cAAc,CAAC,eAAe,EAAE,KAAK,CAAC,CAAC;QAClD,MAAM,WAAW,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,eAAe,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,eAAe,CAAC;QAC5F,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,eAAe,EAAE,WAAW,CAAC,CAAC;QACxE,IAAI,IAAI,CAAC,aAAa;YAAE,MAAM,IAAI,uBAAuB,EAAE,CAAC;QAC5D,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC;IACvF,CAAC;IAED;;;;;;;;;;;;;;;;;;;OAmBG;IACH,KAAK,CAAC,aAAa,CACjB,KAAa,EACb,IAAwB,EACxB,QAAiB;QAEjB,MAAM,eAAe,GAAG,cAAc,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;QACpD,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE,CAAC;YACvC,MAAM,IAAI,KAAK,CAAC,eAAe,CAAC,CAAC;QACnC,CAAC;QACD,MAAM,YAAY,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACzC,MAAM,WAAW,GAAG,YAAY,IAAI,eAAe,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,eAAe,CAAC;QACrF,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,CAAC,cAAc,CAAC,eAAe,EAAE,cAAc,CAAC,CAAC;YAC3D,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,IAAI,CAAC,EAAE;iBAC5B,MAAM,CAAC,KAAK,CAAC;iBACb,MAAM,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;iBACrD,kBAAkB,CAAC;gBAClB,MAAM,EAAE,KAAK,CAAC,KAAK;gBACnB,GAAG,EAAE,YAAY,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE;aAC9F,CAAC;iBACD,SAAS,EAAE,CAAC;YACf,OAAO,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;QACpC,CAAC;QACD,uEAAuE;QACvE,8DAA8D;QAC9D,IAAI,IAAI,CAAC,eAAe,CAAC,eAAe,CAAC,EAAE,CAAC;YAC1C,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;QAC9C,CAAC;QACD,IAAI,CAAC,oBAAoB,CAAC,QAAQ,CAAC,CAAC;QACpC,MAAM,IAAI,CAAC,cAAc,CAAC,eAAe,EAAE,cAAc,CAAC,CAAC;QAC3D,MAAM,YAAY,GAAG,MAAM,YAAY,CAAC,QAAQ,CAAC,CAAC;QAClD,0EAA0E;QAC1E,oEAAoE;QACpE,sEAAsE;QACtE,mEAAmE;QACnE,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,IAAI,CAAC,EAAE;aACxB,MAAM,CAAC,KAAK,CAAC;aACb,MAAM,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,IAAI,EAAE,WAAW,EAAE,YAAY,EAAE,CAAC;aACnE,kBAAkB,CAAC;YAClB,MAAM,EAAE,KAAK,CAAC,KAAK;YACnB,GAAG,EAAE,YAAY;gBACf,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE;gBAC7D,CAAC,CAAC,EAAE,YAAY,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE;SAC5C,CAAC;aACD,SAAS,EAAE,CAAC;QACf,OAAO,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;IAChC,CAAC;IAED;;;;;;;;;;;;;OAaG;IACK,eAAe,CAAC,KAAa;QACnC,OAAO,CACL,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC;YACjC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC;YACpC,KAAK,KAAK,IAAI,CAAC,MAAM,CAAC,UAAU,CACjC,CAAC;IACJ,CAAC;IAED;;;;;;;OAOG;IACK,iBAAiB,CAAC,KAAa;QACrC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,oBAAoB,IAAI,IAAI,CAAC,IAAI,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;IACnF,CAAC;IAED;;;;;;;;OAQG;IACK,YAAY,CAAC,IAAsC;QACzD,OAAO,EAAE,GAAG,UAAU,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;IACjF,CAAC;IAED;;;;;;;;;;;;;;;;OAgBG;IACH,KAAK,CAAC,cAAc,CAClB,MAAc,EACd,eAAmC,EACnC,WAAmB;QAEnB,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACvF,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC;QAC7C,2EAA2E;QAC3E,yEAAyE;QACzE,IAAI,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YACrC,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;QAC9C,CAAC;QACD,IAAI,CAAC,oBAAoB,CAAC,WAAW,CAAC,CAAC;QACvC,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACtB,IAAI,CAAC,eAAe,IAAI,CAAC,CAAC,MAAM,cAAc,CAAC,eAAe,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,EAAE,CAAC;gBACpF,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;YACnD,CAAC;QACH,CAAC;QACD,MAAM,YAAY,GAAG,MAAM,YAAY,CAAC,WAAW,CAAC,CAAC;QACrD,MAAM,IAAI,CAAC,EAAE;aACV,MAAM,CAAC,KAAK,CAAC;aACb,GAAG,CAAC,EAAE,YAAY,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC;aAC5C,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC;IACjC,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,YAAY;QAchB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACrE,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YACxB,EAAE,EAAE,GAAG,CAAC,EAAE;YACV,KAAK,EAAE,GAAG,CAAC,KAAK;YAChB,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,WAAW,EAAE,GAAG,CAAC,YAAY,IAAI,IAAI;YACrC,UAAU,EAAE,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,KAAK,CAAC;YAC7C,aAAa,EAAE,GAAG,CAAC,aAAa;YAChC,QAAQ,EAAE,qBAAqB,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC;YACnD,SAAS,EAAE,GAAG,CAAC,SAAS;SACzB,CAAC,CAAC,CAAC;IACN,CAAC;IAEO,oBAAoB,CAAC,QAAgB;QAC3C,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,MAAM,GAAG,mBAAmB,EAAE,CAAC;YAClD,MAAM,IAAI,KAAK,CAAC,6BAA6B,mBAAmB,aAAa,CAAC,CAAC;QACjF,CAAC;IACH,CAAC;IAEO,SAAS,CAAC,MAAc,EAAE,KAAa;QAC7C,OAAO,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACjF,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,kBAAkB,CACtB,KAAa,EACb,IAAa;QAEb,MAAM,eAAe,GAAG,cAAc,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;QACpD,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,eAAe,CAAC;YAAE,OAAO,IAAI,CAAC;QACpD,MAAM,IAAI,CAAC,cAAc,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC;QACpD,MAAM,WAAW,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,eAAe,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,eAAe,CAAC;QAC5F,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,eAAe,EAAE,WAAW,CAAC,CAAC;QACxE,IAAI,IAAI,CAAC,aAAa;YAAE,MAAM,IAAI,uBAAuB,EAAE,CAAC;QAC5D,OAAO,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;IAC7D,CAAC;IAEO,KAAK,CAAC,iBAAiB,CAAC,KAAa,EAAE,IAAY;QACzD,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,IAAI,CAAC,EAAE;aACzB,MAAM,CAAC,KAAK,CAAC;aACb,MAAM,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;aACvB,kBAAkB,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE,EAAE,CAAC;aAC3E,SAAS,EAAE,CAAC;QACf,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;OAIG;IACH,WAAW,CAAC,KAAa;QACvB,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS,CAGtD,CAAC;QACF,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC;IAC1D,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,cAAc,CAAC,KAAa;QAChC,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;QACtC,IAAI,MAAe,CAAC;QACpB,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC7C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,wEAAwE;YACxE,kEAAkE;YAClE,MAAM,IAAI,gBAAgB,CAAC,GAAG,CAAC,CAAC;QAClC,CAAC;QACD,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,uBAAuB,EAAE,CAAC;QACjD,OAAO,KAAK,CAAC;IACf,CAAC;IAEgB,WAAW,GAAG,IAAI,GAAG,EAA2C,CAAC;IAElF;;;;;;;;;;;;;;OAcG;IACH,KAAK,CAAC,QAAQ,CAAC,MAAc;QAC3B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACzC,IAAI,GAAG,IAAI,GAAG,GAAG,GAAG,CAAC,EAAE,GAAG,eAAe;YAAE,OAAO,GAAG,CAAC,MAAM,CAAC;QAC7D,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,IAAI,CAAC,EAAE;aACxB,MAAM,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,aAAa,EAAE,KAAK,CAAC,aAAa,EAAE,CAAC;aAClE,IAAI,CAAC,KAAK,CAAC;aACX,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;aAC3B,KAAK,CAAC,CAAC,CAAC,CAAC;QACZ,MAAM,MAAM,GAAG,GAAG,KAAK,SAAS,IAAI,CAAC,CAAC,GAAG,CAAC,aAAa,IAAI,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC;QAClG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;QAClD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;;;;;;;;;;;OAaG;IACH,KAAK,CAAC,UAAU,CAAC,MAAc;QAC7B,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACtF,IAAI,CAAC,GAAG;YAAE,OAAO,KAAK,CAAC;QACvB,IAAI,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YACpC,MAAM,IAAI,yBAAyB,CAAC,kGAAkG,CAAC,CAAC;QAC1I,CAAC;QACD,IAAI,qBAAqB,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YAC9C,MAAM,IAAI,yBAAyB,CAAC,yEAAyE,CAAC,CAAC;QACjH,CAAC;QACD,MAAM,IAAI,CAAC,EAAE;aACV,MAAM,CAAC,KAAK,CAAC;aACb,GAAG,CAAC,EAAE,aAAa,EAAE,IAAI,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC;aACzD,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;QACjE,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAChC,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,UAAU,CAAC,MAAc;QAC7B,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACtF,IAAI,CAAC,GAAG;YAAE,OAAO,KAAK,CAAC;QACvB,IAAI,CAAC,GAAG,CAAC,aAAa;YAAE,OAAO,IAAI,CAAC;QACpC,IAAI,IAAI,CAAC,SAAS,KAAK,aAAa,EAAE,CAAC;YACrC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;YAC3E,IAAI,CAAC,OAAO,CAAC,EAAE;gBAAE,MAAM,IAAI,4BAA4B,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAC3E,CAAC;QACD,MAAM,IAAI,CAAC,EAAE;aACV,MAAM,CAAC,KAAK,CAAC;aACb,GAAG,CAAC,EAAE,aAAa,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC;aACnD,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC,EAAE,SAAS,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;QACpE,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAChC,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,oBAAoB,CACxB,MAAmB;QAEnB,MAAM,MAAM,GAAG,IAAI,GAAG,EAAuD,CAAC;QAC9E,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC;YAAE,OAAO,MAAM,CAAC;QACrC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAChD,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,MAAM,CAAC,GAAG,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YAC/B,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;gBAAE,SAAS;YAC7B,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;QAClE,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,MAAc;QAC9B,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,IAAI,CAAC,EAAE;aACzB,MAAM,EAAE;aACR,IAAI,CAAC,KAAK,CAAC;aACX,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;aAC3B,KAAK,CAAC,CAAC,CAAC,CAAC;QAEZ,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC;QAEvB,OAAO,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;IACjC,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,cAAc,CAAC,KAAa;QAChC,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,IAAI,CAAC,EAAE;aACzB,MAAM,EAAE;aACR,IAAI,CAAC,KAAK,CAAC;aACX,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,cAAc,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC;aACnD,KAAK,CAAC,CAAC,CAAC,CAAC;QAEZ,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC;QAEvB,OAAO,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;IACjC,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,kBAAkB,CAAC,MAAc;QACrC,MAAM,IAAI,CAAC,EAAE;aACV,MAAM,CAAC,KAAK,CAAC;aACb,GAAG,CAAC,EAAE,cAAc,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC;aACpD,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC;IACjC,CAAC;IAED;;;;;;;;OAQG;IACH,oBAAoB,CAAC,KAAa;QAChC,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC;QAChD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACtC,MAAM,MAAM,GAAG,cAAc,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC/D,IAAI,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;QAC1B,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;IACvE,CAAC;IAED;;;;;;;;;;;;OAYG;IACK,mBAAmB,CAAC,eAAuB;QACjD,IAAI,CAAC,IAAI,CAAC,oBAAoB,CAAC,eAAe,CAAC,EAAE,CAAC;YAChD,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;QACjD,CAAC;IACH,CAAC;CAEF"}

package/dist/modules/auth/oidc-auth-provider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oidc-auth-provider.d.ts","sourceRoot":"","sources":["../../../src/modules/auth/oidc-auth-provider.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,OAAO,MAAM,SAAS,CAAC;AACnC,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAG3D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAgBrD,wDAAwD;AACxD,MAAM,WAAW,YAAY;IAC3B,+EAA+E;IAC/E,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,+EAA+E;IAC/E,MAAM,EAAE,MAAM,CAAC;IACf,oDAAoD;IACpD,KAAK,EAAE,MAAM,CAAC;CACf;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE;IAAE,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAA;CAAE,GAAG,YAAY,GAAG,IAAI,CAehG;AAED,MAAM,WAAW,uBAAuB;IACtC;;;;;OAKG;IACH,QAAQ,IAAI,YAAY,GAAG,IAAI,CAAC;IAChC,gBAAgB,EAAE,MAAM,CAAC;IACzB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,yEAAyE;IACzE,YAAY,EAAE,OAAO,CAAC;IACtB,sDAAsD;IACtD,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB;;;;OAIG;IACH,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,YAAY,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3D;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,gBAAgB,EAAE,MAAM,GAAG,MAAM,CAEhE;AAoBD;;;;;;;;;;;;;;;;;;GAkBG;AACH,qBAAa,gBAAiB,YAAW,kBAAkB;IAY7C,OAAO,CAAC,QAAQ,CAAC,IAAI;IAXjC,QAAQ,CAAC,GAAG,UAAU;IACtB,QAAQ,CAAC,SAAS,0BAA0B;IAE5C,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAe;IACzC;;;;OAIG;IACH,OAAO,CAAC,SAAS,CAAmE;gBAEvD,IAAI,EAAE,uBAAuB;IAI1D,IAAI,KAAK,IAAI,MAAM,CAElB;IAED,SAAS,IAAI,OAAO;IAIpB;;;;OAIG;IACH,OAAO,CAAC,QAAQ;YAUF,cAAc;IAe5B,OAAO,CAAC,WAAW;IAInB,WAAW,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,WAAW,EAAE,WAAW,GAAG,IAAI;CAsJpE"}
+{"version":3,"file":"oidc-auth-provider.d.ts","sourceRoot":"","sources":["../../../src/modules/auth/oidc-auth-provider.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,OAAO,MAAM,SAAS,CAAC;AACnC,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAG3D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAgBrD,wDAAwD;AACxD,MAAM,WAAW,YAAY;IAC3B,+EAA+E;IAC/E,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,+EAA+E;IAC/E,MAAM,EAAE,MAAM,CAAC;IACf,oDAAoD;IACpD,KAAK,EAAE,MAAM,CAAC;CACf;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE;IAAE,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAA;CAAE,GAAG,YAAY,GAAG,IAAI,CAehG;AAED,MAAM,WAAW,uBAAuB;IACtC;;;;;OAKG;IACH,QAAQ,IAAI,YAAY,GAAG,IAAI,CAAC;IAChC,gBAAgB,EAAE,MAAM,CAAC;IACzB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,yEAAyE;IACzE,YAAY,EAAE,OAAO,CAAC;IACtB,sDAAsD;IACtD,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB;;;;OAIG;IACH,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,YAAY,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3D;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,gBAAgB,EAAE,MAAM,GAAG,MAAM,CAEhE;AAoBD;;;;;;;;;;;;;;;;;;GAkBG;AACH,qBAAa,gBAAiB,YAAW,kBAAkB;IAY7C,OAAO,CAAC,QAAQ,CAAC,IAAI;IAXjC,QAAQ,CAAC,GAAG,UAAU;IACtB,QAAQ,CAAC,SAAS,0BAA0B;IAE5C,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAe;IACzC;;;;OAIG;IACH,OAAO,CAAC,SAAS,CAAmE;gBAEvD,IAAI,EAAE,uBAAuB;IAI1D,IAAI,KAAK,IAAI,MAAM,CAElB;IAED,SAAS,IAAI,OAAO;IAIpB;;;;OAIG;IACH,OAAO,CAAC,QAAQ;YAUF,cAAc;IAe5B,OAAO,CAAC,WAAW;IAInB,WAAW,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,WAAW,EAAE,WAAW,GAAG,IAAI;CA2JpE"}

package/dist/modules/auth/oidc-auth-provider.js

@@ -3,7 +3,7 @@ import { logger } from '../../shared/logging.js';
 const log = logger('oidc');
 import { AUTH_COOKIE_MAX_AGE_S } from './auth.routes.js';
 import { AUTH_COOKIE_NAME } from './auth.middleware.js';
-import { AccountAdmissionRefusedError } from './account-admission.js';
+import { AccountAdmissionRefusedError, AccountDeactivatedError } from './account-admission.js';
 import { normalizeIssuerUrl } from '../settings/oidc-check.js';
 // Short-lived CSRF state + PKCE verifier for the OAuth round-trip: set before
 // redirecting to the provider, verified/consumed on callback.
@@ -264,7 +264,12 @@ export class OidcAuthProvider {
                 // screen can say so instead of "try again".
                 if (error instanceof AccountAdmissionRefusedError) {
                     log.warn('OIDC sign-in refused by the account admission port:', { detail: error.message });
-                    fail('admission');
+                    fail(error.waitingForAdmin ? 'waiting' : 'admission');
+                    return;
+                }
+                if (error instanceof AccountDeactivatedError) {
+                    log.warn('OIDC sign-in refused: the account is switched off');
+                    fail('deactivated');
                     return;
                 }
                 log.error('OIDC callback error:', { err: error });

package/dist/modules/auth/oidc-auth-provider.js.map

@@ -1 +1 @@
-{"version":3,"file":"oidc-auth-provider.js","sourceRoot":"","sources":["../../../src/modules/auth/oidc-auth-provider.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAEjD,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;AAG3B,OAAO,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AACzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAExD,OAAO,EAAE,4BAA4B,EAAE,MAAM,wBAAwB,CAAC;AACtE,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAE/D,8EAA8E;AAC9E,8DAA8D;AAC9D,MAAM,kBAAkB,GAAG,kBAAkB,CAAC;AAC9C,MAAM,qBAAqB,GAAG,EAAE,GAAG,EAAE,CAAC;AAqBtC;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,QAA0C;IACzE,4EAA4E;IAC5E,wEAAwE;IACxE,0DAA0D;IAC1D,MAAM,SAAS,GAAG,kBAAkB,CAAC,QAAQ,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC;IACxE,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;IAClD,MAAM,YAAY,GAAG,QAAQ,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAC1D,IAAI,CAAC,SAAS,IAAI,CAAC,QAAQ,IAAI,CAAC,YAAY;QAAE,OAAO,IAAI,CAAC;IAC1D,OAAO;QACL,SAAS;QACT,QAAQ;QACR,YAAY;QACZ,MAAM,EAAE,QAAQ,CAAC,OAAO,CAAC,YAAY,CAAC,IAAI,sBAAsB;QAChE,KAAK,EAAE,QAAQ,CAAC,OAAO,CAAC,mBAAmB,CAAC,IAAI,gBAAgB;KACjE,CAAC;AACJ,CAAC;AAwBD;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,gBAAwB;IACtD,OAAO,GAAG,gBAAgB,yBAAyB,CAAC;AACtD,CAAC;AAED,kGAAkG;AAClG,SAAS,UAAU,CAAC,GAAoB,EAAE,IAAY;IACpD,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC;IAClC,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACxC,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;QAC/B,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,IAAI,GAAG,CAAC;YAAE,SAAS;QAC9C,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAC7C,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QACxB,IAAI,CAAC;YACH,OAAO,kBAAkB,CAAC,KAAK,CAAC,CAAC;QACnC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,OAAO,gBAAgB;IAYE;IAXpB,GAAG,GAAG,MAAM,CAAC;IACb,SAAS,GAAG,sBAAsB,CAAC;IAE3B,SAAS,CAAe;IACzC;;;;OAIG;IACK,SAAS,GAA8D,IAAI,CAAC;IAEpF,YAA6B,IAA6B;QAA7B,SAAI,GAAJ,IAAI,CAAyB;QACxD,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC;IAC3C,CAAC;IAED,IAAI,KAAK;QACP,OAAO,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,KAAK,IAAI,EAAE,CAAC;IAC3C,CAAC;IAED,SAAS;QACP,OAAO,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,IAAI,CAAC;IACvC,CAAC;IAED;;;;OAIG;IACK,QAAQ,CAAC,SAAiB;QAChC,IAAI,IAAI,CAAC,SAAS,EAAE,SAAS,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC;QACvE,MAAM,KAAK,GAAG,EAAE,SAAS,EAAE,GAAG,EAAE,IAAI,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,CAAC;QACjE,IAAI,CAAC,SAAS,GAAG,KAAK,CAAC;QACvB,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE;YACnB,IAAI,IAAI,CAAC,SAAS,KAAK,KAAK;gBAAE,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC;QACtD,CAAC,CAAC,CAAC;QACH,OAAO,KAAK,CAAC,GAAG,CAAC;IACnB,CAAC;IAEO,KAAK,CAAC,cAAc,CAAC,SAAiB;QAC5C,MAAM,GAAG,GAAG,GAAG,SAAS,mCAAmC,CAAC;QAC5D,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QACtC,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,GAAG,CAAC,MAAM,IAAI,GAAG,EAAE,CAAC,CAAC;QAC5E,MAAM,GAAG,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA2B,CAAC;QACzD,IAAI,CAAC,GAAG,CAAC,sBAAsB,IAAI,CAAC,GAAG,CAAC,cAAc,IAAI,CAAC,GAAG,CAAC,iBAAiB,EAAE,CAAC;YACjF,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;QAC3E,CAAC;QACD,OAAO;YACL,sBAAsB,EAAE,GAAG,CAAC,sBAAsB;YAClD,cAAc,EAAE,GAAG,CAAC,cAAc;YAClC,iBAAiB,EAAE,GAAG,CAAC,iBAAiB;SACzC,CAAC;IACJ,CAAC;IAEO,WAAW;QACjB,OAAO,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IACrD,CAAC;IAED,WAAW,CAAC,MAAsB,EAAE,WAAwB;QAC1D,MAAM,EAAE,iBAAiB,EAAE,YAAY,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC;QAEtD,qEAAqE;QACrE,sEAAsE;QACtE,uEAAuE;QACvE,iEAAiE;QACjE,MAAM,CAAC,GAAG,CAAC,kBAAkB,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE;YACjD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YAClC,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,GAAG,CAAC,QAAQ,CAAC,GAAG,iBAAiB,0CAA0C,CAAC,CAAC;gBAC7E,OAAO;YACT,CAAC;YACD,IAAI,CAAC;gBACH,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;gBACtD,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;gBAC9C,MAAM,QAAQ,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;gBACvD,MAAM,SAAS,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;gBAC5E,GAAG,CAAC,MAAM,CAAC,kBAAkB,EAAE,GAAG,KAAK,IAAI,QAAQ,EAAE,EAAE;oBACrD,QAAQ,EAAE,IAAI;oBACd,QAAQ,EAAE,KAAK;oBACf,MAAM,EAAE,YAAY;oBACpB,MAAM,EAAE,qBAAqB,GAAG,IAAI;oBACpC,IAAI,EAAE,GAAG;iBACV,CAAC,CAAC;gBACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,sBAAsB,CAAC,CAAC;gBACtD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;gBAC9C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;gBACjD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;gBACzD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;gBAC3C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;gBACrC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,gBAAgB,EAAE,SAAS,CAAC,CAAC;gBAClD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAAC;gBACtD,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;YAC/B,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,GAAG,CAAC,KAAK,CAAC,mBAAmB,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC;gBAC/C,GAAG,CAAC,QAAQ,CAAC,GAAG,iBAAiB,iCAAiC,CAAC,CAAC;YACtE,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,wEAAwE;QACxE,2EAA2E;QAC3E,2EAA2E;QAC3E,MAAM,CAAC,GAAG,CAAC,qBAAqB,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;YACnD,MAAM,IAAI,GAAG,CAAC,MAAc,EAAE,EAAE,CAC9B,GAAG,CAAC,QAAQ,CAAC,GAAG,iBAAiB,6BAA6B,MAAM,EAAE,CAAC,CAAC;YAC1E,IAAI,CAAC;gBACH,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,GAAG,CAAC,KAA0C,CAAC;gBACvE,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAC;gBACnD,GAAG,CAAC,WAAW,CAAC,kBAAkB,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;gBACnD,MAAM,CAAC,aAAa,EAAE,QAAQ,CAAC,GAAG,MAAM,EAAE,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;gBAC3D,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,IAAI,CAAC,aAAa,IAAI,CAAC,QAAQ,IAAI,KAAK,KAAK,aAAa,EAAE,CAAC;oBAC9E,IAAI,CAAC,OAAO,CAAC,CAAC;oBACd,OAAO;gBACT,CAAC;gBAED,gEAAgE;gBAChE,oDAAoD;gBACpD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;gBAClC,IAAI,CAAC,IAAI,EAAE,CAAC;oBACV,IAAI,CAAC,gBAAgB,CAAC,CAAC;oBACvB,OAAO;gBACT,CAAC;gBACD,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;gBACtD,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CACvB,GAAG,kBAAkB,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,kBAAkB,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,EAC/E,MAAM,CACP,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;gBACrB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,cAAc,EAAE;oBAC9D,MAAM,EAAE,MAAM;oBACd,OAAO,EAAE;wBACP,cAAc,EAAE,mCAAmC;wBACnD,aAAa,EAAE,SAAS,KAAK,EAAE;qBAChC;oBACD,IAAI,EAAE,IAAI,eAAe,CAAC;wBACxB,UAAU,EAAE,oBAAoB;wBAChC,IAAI;wBACJ,YAAY,EAAE,IAAI,CAAC,WAAW,EAAE;wBAChC,aAAa,EAAE,QAAQ;qBACxB,CAAC,CAAC,QAAQ,EAAE;iBACd,CAAC,CAAC;gBACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;oBACjB,GAAG,CAAC,KAAK,CAAC,6BAA6B,EAAE;wBACvC,MAAM,EAAE,QAAQ,CAAC,MAAM;wBACvB,IAAI,EAAE,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC;qBAC5C,CAAC,CAAC;oBACH,IAAI,CAAC,MAAM,CAAC,CAAC;oBACb,OAAO;gBACT,CAAC;gBACD,MAAM,MAAM,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAA8B,CAAC;gBACpE,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC;oBACzB,IAAI,CAAC,MAAM,CAAC,CAAC;oBACb,OAAO;gBACT,CAAC;gBAED,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,iBAAiB,EAAE;oBAChE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,MAAM,CAAC,YAAY,EAAE,EAAE;iBAC5D,CAAC,CAAC;gBACH,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;oBAChB,GAAG,CAAC,KAAK,CAAC,uBAAuB,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;oBAC/D,IAAI,CAAC,MAAM,CAAC,CAAC;oBACb,OAAO;gBACT,CAAC;gBACD,MAAM,MAAM,GAAG,CAAC,MAAM,OAAO,CAAC,IAAI,EAAE,CAMnC,CAAC;gBACF,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;oBAClB,uEAAuE;oBACvE,GAAG,CAAC,KAAK,CAAC,uCAAuC,CAAC,CAAC;oBACnD,IAAI,CAAC,MAAM,CAAC,CAAC;oBACb,OAAO;gBACT,CAAC;gBACD,MAAM,IAAI,GACR,MAAM,CAAC,IAAI;oBACX,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE;oBACxE,MAAM,CAAC,kBAAkB;oBACzB,EAAE,CAAC;gBAEL,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,WAAW,CAAC,YAAY,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;gBACrE,IAAI,CAAC;oBACH,MAAM,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC,IAAI,CAAC,CAAC;gBACrC,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,GAAG,CAAC,KAAK,CAAC,6BAA6B,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC;gBAC3D,CAAC;gBACD,GAAG,CAAC,MAAM,CAAC,gBAAgB,EAAE,KAAK,EAAE;oBAClC,QAAQ,EAAE,IAAI;oBACd,QAAQ,EAAE,KAAK;oBACf,MAAM,EAAE,YAAY;oBACpB,MAAM,EAAE,qBAAqB,GAAG,IAAI;oBACpC,IAAI,EAAE,GAAG;iBACV,CAAC,CAAC;gBACH,GAAG,CAAC,QAAQ,CAAC,GAAG,iBAAiB,6BAA6B,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YAC7F,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,mEAAmE;gBACnE,kEAAkE;gBAClE,4CAA4C;gBAC5C,IAAI,KAAK,YAAY,4BAA4B,EAAE,CAAC;oBAClD,GAAG,CAAC,IAAI,CAAC,qDAAqD,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;oBAC3F,IAAI,CAAC,WAAW,CAAC,CAAC;oBAClB,OAAO;gBACT,CAAC;gBACD,GAAG,CAAC,KAAK,CAAC,sBAAsB,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC;gBAClD,IAAI,CAAC,MAAM,CAAC,CAAC;YACf,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;CACF"}
+{"version":3,"file":"oidc-auth-provider.js","sourceRoot":"","sources":["../../../src/modules/auth/oidc-auth-provider.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAEjD,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;AAG3B,OAAO,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AACzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAExD,OAAO,EAAE,4BAA4B,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AAC/F,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAE/D,8EAA8E;AAC9E,8DAA8D;AAC9D,MAAM,kBAAkB,GAAG,kBAAkB,CAAC;AAC9C,MAAM,qBAAqB,GAAG,EAAE,GAAG,EAAE,CAAC;AAqBtC;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,QAA0C;IACzE,4EAA4E;IAC5E,wEAAwE;IACxE,0DAA0D;IAC1D,MAAM,SAAS,GAAG,kBAAkB,CAAC,QAAQ,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC;IACxE,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;IAClD,MAAM,YAAY,GAAG,QAAQ,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAC1D,IAAI,CAAC,SAAS,IAAI,CAAC,QAAQ,IAAI,CAAC,YAAY;QAAE,OAAO,IAAI,CAAC;IAC1D,OAAO;QACL,SAAS;QACT,QAAQ;QACR,YAAY;QACZ,MAAM,EAAE,QAAQ,CAAC,OAAO,CAAC,YAAY,CAAC,IAAI,sBAAsB;QAChE,KAAK,EAAE,QAAQ,CAAC,OAAO,CAAC,mBAAmB,CAAC,IAAI,gBAAgB;KACjE,CAAC;AACJ,CAAC;AAwBD;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,gBAAwB;IACtD,OAAO,GAAG,gBAAgB,yBAAyB,CAAC;AACtD,CAAC;AAED,kGAAkG;AAClG,SAAS,UAAU,CAAC,GAAoB,EAAE,IAAY;IACpD,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC;IAClC,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACxC,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;QAC/B,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,IAAI,GAAG,CAAC;YAAE,SAAS;QAC9C,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAC7C,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QACxB,IAAI,CAAC;YACH,OAAO,kBAAkB,CAAC,KAAK,CAAC,CAAC;QACnC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,OAAO,gBAAgB;IAYE;IAXpB,GAAG,GAAG,MAAM,CAAC;IACb,SAAS,GAAG,sBAAsB,CAAC;IAE3B,SAAS,CAAe;IACzC;;;;OAIG;IACK,SAAS,GAA8D,IAAI,CAAC;IAEpF,YAA6B,IAA6B;QAA7B,SAAI,GAAJ,IAAI,CAAyB;QACxD,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC;IAC3C,CAAC;IAED,IAAI,KAAK;QACP,OAAO,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,KAAK,IAAI,EAAE,CAAC;IAC3C,CAAC;IAED,SAAS;QACP,OAAO,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,IAAI,CAAC;IACvC,CAAC;IAED;;;;OAIG;IACK,QAAQ,CAAC,SAAiB;QAChC,IAAI,IAAI,CAAC,SAAS,EAAE,SAAS,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC;QACvE,MAAM,KAAK,GAAG,EAAE,SAAS,EAAE,GAAG,EAAE,IAAI,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,CAAC;QACjE,IAAI,CAAC,SAAS,GAAG,KAAK,CAAC;QACvB,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE;YACnB,IAAI,IAAI,CAAC,SAAS,KAAK,KAAK;gBAAE,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC;QACtD,CAAC,CAAC,CAAC;QACH,OAAO,KAAK,CAAC,GAAG,CAAC;IACnB,CAAC;IAEO,KAAK,CAAC,cAAc,CAAC,SAAiB;QAC5C,MAAM,GAAG,GAAG,GAAG,SAAS,mCAAmC,CAAC;QAC5D,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QACtC,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,GAAG,CAAC,MAAM,IAAI,GAAG,EAAE,CAAC,CAAC;QAC5E,MAAM,GAAG,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA2B,CAAC;QACzD,IAAI,CAAC,GAAG,CAAC,sBAAsB,IAAI,CAAC,GAAG,CAAC,cAAc,IAAI,CAAC,GAAG,CAAC,iBAAiB,EAAE,CAAC;YACjF,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;QAC3E,CAAC;QACD,OAAO;YACL,sBAAsB,EAAE,GAAG,CAAC,sBAAsB;YAClD,cAAc,EAAE,GAAG,CAAC,cAAc;YAClC,iBAAiB,EAAE,GAAG,CAAC,iBAAiB;SACzC,CAAC;IACJ,CAAC;IAEO,WAAW;QACjB,OAAO,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IACrD,CAAC;IAED,WAAW,CAAC,MAAsB,EAAE,WAAwB;QAC1D,MAAM,EAAE,iBAAiB,EAAE,YAAY,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC;QAEtD,qEAAqE;QACrE,sEAAsE;QACtE,uEAAuE;QACvE,iEAAiE;QACjE,MAAM,CAAC,GAAG,CAAC,kBAAkB,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE;YACjD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YAClC,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,GAAG,CAAC,QAAQ,CAAC,GAAG,iBAAiB,0CAA0C,CAAC,CAAC;gBAC7E,OAAO;YACT,CAAC;YACD,IAAI,CAAC;gBACH,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;gBACtD,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;gBAC9C,MAAM,QAAQ,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;gBACvD,MAAM,SAAS,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;gBAC5E,GAAG,CAAC,MAAM,CAAC,kBAAkB,EAAE,GAAG,KAAK,IAAI,QAAQ,EAAE,EAAE;oBACrD,QAAQ,EAAE,IAAI;oBACd,QAAQ,EAAE,KAAK;oBACf,MAAM,EAAE,YAAY;oBACpB,MAAM,EAAE,qBAAqB,GAAG,IAAI;oBACpC,IAAI,EAAE,GAAG;iBACV,CAAC,CAAC;gBACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,sBAAsB,CAAC,CAAC;gBACtD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;gBAC9C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;gBACjD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;gBACzD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;gBAC3C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;gBACrC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,gBAAgB,EAAE,SAAS,CAAC,CAAC;gBAClD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAAC;gBACtD,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;YAC/B,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,GAAG,CAAC,KAAK,CAAC,mBAAmB,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC;gBAC/C,GAAG,CAAC,QAAQ,CAAC,GAAG,iBAAiB,iCAAiC,CAAC,CAAC;YACtE,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,wEAAwE;QACxE,2EAA2E;QAC3E,2EAA2E;QAC3E,MAAM,CAAC,GAAG,CAAC,qBAAqB,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;YACnD,MAAM,IAAI,GAAG,CAAC,MAAc,EAAE,EAAE,CAC9B,GAAG,CAAC,QAAQ,CAAC,GAAG,iBAAiB,6BAA6B,MAAM,EAAE,CAAC,CAAC;YAC1E,IAAI,CAAC;gBACH,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,GAAG,CAAC,KAA0C,CAAC;gBACvE,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAC;gBACnD,GAAG,CAAC,WAAW,CAAC,kBAAkB,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;gBACnD,MAAM,CAAC,aAAa,EAAE,QAAQ,CAAC,GAAG,MAAM,EAAE,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;gBAC3D,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,IAAI,CAAC,aAAa,IAAI,CAAC,QAAQ,IAAI,KAAK,KAAK,aAAa,EAAE,CAAC;oBAC9E,IAAI,CAAC,OAAO,CAAC,CAAC;oBACd,OAAO;gBACT,CAAC;gBAED,gEAAgE;gBAChE,oDAAoD;gBACpD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;gBAClC,IAAI,CAAC,IAAI,EAAE,CAAC;oBACV,IAAI,CAAC,gBAAgB,CAAC,CAAC;oBACvB,OAAO;gBACT,CAAC;gBACD,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;gBACtD,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CACvB,GAAG,kBAAkB,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,kBAAkB,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,EAC/E,MAAM,CACP,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;gBACrB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,cAAc,EAAE;oBAC9D,MAAM,EAAE,MAAM;oBACd,OAAO,EAAE;wBACP,cAAc,EAAE,mCAAmC;wBACnD,aAAa,EAAE,SAAS,KAAK,EAAE;qBAChC;oBACD,IAAI,EAAE,IAAI,eAAe,CAAC;wBACxB,UAAU,EAAE,oBAAoB;wBAChC,IAAI;wBACJ,YAAY,EAAE,IAAI,CAAC,WAAW,EAAE;wBAChC,aAAa,EAAE,QAAQ;qBACxB,CAAC,CAAC,QAAQ,EAAE;iBACd,CAAC,CAAC;gBACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;oBACjB,GAAG,CAAC,KAAK,CAAC,6BAA6B,EAAE;wBACvC,MAAM,EAAE,QAAQ,CAAC,MAAM;wBACvB,IAAI,EAAE,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC;qBAC5C,CAAC,CAAC;oBACH,IAAI,CAAC,MAAM,CAAC,CAAC;oBACb,OAAO;gBACT,CAAC;gBACD,MAAM,MAAM,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAA8B,CAAC;gBACpE,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC;oBACzB,IAAI,CAAC,MAAM,CAAC,CAAC;oBACb,OAAO;gBACT,CAAC;gBAED,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,iBAAiB,EAAE;oBAChE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,MAAM,CAAC,YAAY,EAAE,EAAE;iBAC5D,CAAC,CAAC;gBACH,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;oBAChB,GAAG,CAAC,KAAK,CAAC,uBAAuB,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;oBAC/D,IAAI,CAAC,MAAM,CAAC,CAAC;oBACb,OAAO;gBACT,CAAC;gBACD,MAAM,MAAM,GAAG,CAAC,MAAM,OAAO,CAAC,IAAI,EAAE,CAMnC,CAAC;gBACF,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;oBAClB,uEAAuE;oBACvE,GAAG,CAAC,KAAK,CAAC,uCAAuC,CAAC,CAAC;oBACnD,IAAI,CAAC,MAAM,CAAC,CAAC;oBACb,OAAO;gBACT,CAAC;gBACD,MAAM,IAAI,GACR,MAAM,CAAC,IAAI;oBACX,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE;oBACxE,MAAM,CAAC,kBAAkB;oBACzB,EAAE,CAAC;gBAEL,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,WAAW,CAAC,YAAY,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;gBACrE,IAAI,CAAC;oBACH,MAAM,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC,IAAI,CAAC,CAAC;gBACrC,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,GAAG,CAAC,KAAK,CAAC,6BAA6B,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC;gBAC3D,CAAC;gBACD,GAAG,CAAC,MAAM,CAAC,gBAAgB,EAAE,KAAK,EAAE;oBAClC,QAAQ,EAAE,IAAI;oBACd,QAAQ,EAAE,KAAK;oBACf,MAAM,EAAE,YAAY;oBACpB,MAAM,EAAE,qBAAqB,GAAG,IAAI;oBACpC,IAAI,EAAE,GAAG;iBACV,CAAC,CAAC;gBACH,GAAG,CAAC,QAAQ,CAAC,GAAG,iBAAiB,6BAA6B,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YAC7F,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,mEAAmE;gBACnE,kEAAkE;gBAClE,4CAA4C;gBAC5C,IAAI,KAAK,YAAY,4BAA4B,EAAE,CAAC;oBAClD,GAAG,CAAC,IAAI,CAAC,qDAAqD,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;oBAC3F,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;oBACtD,OAAO;gBACT,CAAC;gBACD,IAAI,KAAK,YAAY,uBAAuB,EAAE,CAAC;oBAC7C,GAAG,CAAC,IAAI,CAAC,mDAAmD,CAAC,CAAC;oBAC9D,IAAI,CAAC,aAAa,CAAC,CAAC;oBACpB,OAAO;gBACT,CAAC;gBACD,GAAG,CAAC,KAAK,CAAC,sBAAsB,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC;gBAClD,IAAI,CAAC,MAAM,CAAC,CAAC;YACf,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;CACF"}

package/dist/modules/database/core-schema.d.ts

@@ -104,6 +104,23 @@ export declare const users: import("drizzle-orm/pg-core").PgTableWithColumns<{
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
+        deactivatedAt: import("drizzle-orm/pg-core").PgColumn<{
+            name: "deactivated_at";
+            tableName: "users";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
         createdAt: import("drizzle-orm/pg-core").PgColumn<{
             name: "created_at";
             tableName: "users";
@@ -995,6 +1012,23 @@ export declare const changeRequests: import("drizzle-orm/pg-core").PgTableWithCo
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
+        closedReason: import("drizzle-orm/pg-core").PgColumn<{
+            name: "closed_reason";
+            tableName: "change_requests";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
     };
     dialect: "pg";
 }>;
@@ -1794,30 +1828,6 @@ export declare const secrets: import("drizzle-orm/pg-core").PgTableWithColumns<{
     };
     dialect: "pg";
 }>;
-/**
- * Ontology-session boundary — the per-session log of which named ontologies a
- * run has TOUCHED (one row per `(session_id, ontology)`). Each agent operation
- * that resolves to a named ontology records a row here (idempotent on the PK).
- *
- * The rule the gate enforces from this set:
- *   - READS are always allowed; they just record the ontology they touched.
- *   - WRITES are allowed only while the session's touched set is a SINGLE named
- *     ontology equal to the write target. Once a session has touched two or
- *     more ontologies (e.g. by reading across them), every write is blocked —
- *     "read across ontologies → you can't write anymore at all."
- *
- * Postgres is the durable source of truth so the boundary holds across a
- * backend restart (an in-memory set would reset and silently un-poison a run).
- * A write-through in-process cache fronts this table for the chatty read path;
- * a cache miss falls back here.
- *
- *   - PK is `(session_id, ontology)` — a set, idempotent on repeat touches.
- *   - `ontology` is the resolved ontology id (e.g. `KnowledgeBase/Product`).
- *     Neutral touches don't record, so they never write a row.
- *   - `touched_at` drives the abandoned-run `sweepOlderThan` backstop; the
- *     primary reclamation is an explicit delete of all of a session's rows at
- *     run end.
- */
 /**
  * OAuth clients dynamically registered by MCP clients (RFC 7591 DCR). When an
  * MCP client (claude.ai, Claude Code) connects to `/api/mcp` without a
@@ -2796,6 +2806,13 @@ export declare const agentEvents: import("drizzle-orm/pg-core").PgTableWithColum
     };
     dialect: "pg";
 }>;
+/**
+ * UNUSED IN THIS RELEASE. It backed the per-session boundary that a deployment
+ * now owns for itself, behind the agent read/write hooks; nothing in this
+ * package reads or writes it any more. The definition stays for ONE release so
+ * that no deployment runs a version in which neither side has the table, and
+ * the NEXT release drops it (see `TODOS.md`). Do not build on it.
+ */
 export declare const sessionOntologyTouches: import("drizzle-orm/pg-core").PgTableWithColumns<{
     name: "session_ontology_touches";
     schema: undefined;

package/dist/modules/database/core-schema.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"core-schema.d.ts","sourceRoot":"","sources":["../../../src/modules/database/core-schema.ts"],"names":[],"mappings":"AAeA,eAAO,MAAM,KAAK;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA0BhB,CAAC;AAEH;;;;;;;;;;GAUG;AACH,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAczB,CAAC;AAEJ;;;;;;GAMG;AACH,eAAO,MAAM,UAAU;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAapB,CAAC;AAEJ;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,UAAU;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAepB,CAAC;AAEJ;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAqCxB,CAAC;AAEJ;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAmCzB,CAAC;AAEJ;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,SAAS;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAwBnB,CAAC;AAEJ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAkCxB,CAAC;AAEJ;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,eAAO,MAAM,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAoBjB,CAAC;AAEJ;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EASvB,CAAC;AAEH;;;;;;;;GAQG;AACH,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAexB,CAAC;AAEJ;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAiB1B,CAAC;AAEJ;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAkBrB,CAAC;AAEJ;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA4BrB,CAAC;AAEJ,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAUhC,CAAC;AAEJ;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAgB7B,CAAC;AAEH;;;;;;;GAOG;AACH,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAoB/B,CAAC;AAEH;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAQ5B,CAAC;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA8D5B,CAAC"}
+{"version":3,"file":"core-schema.d.ts","sourceRoot":"","sources":["../../../src/modules/database/core-schema.ts"],"names":[],"mappings":"AAeA,eAAO,MAAM,KAAK;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAuChB,CAAC;AAEH;;;;;;;;;;GAUG;AACH,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAczB,CAAC;AAEJ;;;;;;GAMG;AACH,eAAO,MAAM,UAAU;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAapB,CAAC;AAEJ;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,UAAU;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAepB,CAAC;AAEJ;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAiDxB,CAAC;AAEJ;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAmCzB,CAAC;AAEJ;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,SAAS;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAwBnB,CAAC;AAEJ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAkCxB,CAAC;AAEJ;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,eAAO,MAAM,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAoBjB,CAAC;AAEJ;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EASvB,CAAC;AAEH;;;;;;;;GAQG;AACH,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAexB,CAAC;AAEJ;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAiB1B,CAAC;AAEJ;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAkBrB,CAAC;AAEJ;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA4BrB,CAAC;AAEJ;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAUhC,CAAC;AAEJ;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAgB7B,CAAC;AAEH;;;;;;;GAOG;AACH,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAoB/B,CAAC;AAEH;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAQ5B,CAAC;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA8D5B,CAAC"}

package/dist/modules/database/core-schema.js

@@ -1,8 +1,8 @@
 /**
  * CORE platform tables — the git-backed workspace/workflow, auth, access,
- * change requests, locks, the pending-commits queue, the ontology-session
- * touched-set, connection keys, MCP OAuth, and the Secrets Vault. A core-only
- * deployment migrates and runs on exactly these tables.
+ * change requests, locks, the pending-commits queue, connection keys, MCP
+ * OAuth, and the Secrets Vault. A core-only deployment migrates and runs on
+ * exactly these tables.
  *
  * Enterprise-only tables (chat, routines, watchlist, connectors, LLM config,
  * SharePoint/Atlassian links, feedback, upload, kb-revalidation) live in
@@ -36,6 +36,19 @@ export const users = pgTable('users', {
      * backfill would need, and being shown the setup once costs a click.
      */
     onboardingDone: boolean('onboarding_done').default(false).notNull(),
+    /**
+     * When an admin switched this account off; NULL while it is on. A
+     * deactivated account keeps its row, its history and its place in roles
+     * and groups, but nothing it holds is honoured: it cannot sign in, and its
+     * session, connection keys, agent tokens and internal tokens are refused
+     * the next time they are presented (see `AuthService.isActive`). Turning it
+     * back on restores all of them as they were.
+     *
+     * The off switch a host that sells seats needs — a seat is an account that
+     * is on — and the one an admin uses for someone who left without erasing
+     * what they did.
+     */
+    deactivatedAt: timestamp('deactivated_at'),
     createdAt: timestamp('created_at').defaultNow().notNull(),
     updatedAt: timestamp('updated_at').defaultNow().notNull(),
 });
@@ -155,6 +168,18 @@ export const changeRequests = pgTable('change_requests', {
     createdAt: timestamp('created_at').defaultNow().notNull(),
     updatedAt: timestamp('updated_at'),
     closedAt: timestamp('closed_at'),
+    /**
+     * Why a closed request was closed, when something other than a person
+     * closed it. Today the one value is 'repository-replaced': the admin
+     * pointed the deployment at a different knowledge-base repository and chose
+     * to close the requests rather than keep them. Null for every request
+     * closed the ordinary way — by its author, or by the deleted-branch sweep —
+     * so the column reads as "nobody recorded a reason", not as a default.
+     *
+     * The row is never deleted: a replaced repository loses the branches, not
+     * the record of what people asked for.
+     */
+    closedReason: text('closed_reason'),
 }, (t) => ({
     numberUnq: uniqueIndex('change_requests_number_unq').on(t.number),
     // Enforce the "A→B blocks A→B while open" uniqueness rule at the DB level —
@@ -366,30 +391,6 @@ export const secrets = pgTable('secrets', {
     // One shared (admin) row per key: enforce uniqueness only across NULL-user rows.
     sharedKeyUnq: uniqueIndex('secrets_shared_key_unq').on(t.key).where(sql `${t.userId} is null`),
 }));
-/**
- * Ontology-session boundary — the per-session log of which named ontologies a
- * run has TOUCHED (one row per `(session_id, ontology)`). Each agent operation
- * that resolves to a named ontology records a row here (idempotent on the PK).
- *
- * The rule the gate enforces from this set:
- *   - READS are always allowed; they just record the ontology they touched.
- *   - WRITES are allowed only while the session's touched set is a SINGLE named
- *     ontology equal to the write target. Once a session has touched two or
- *     more ontologies (e.g. by reading across them), every write is blocked —
- *     "read across ontologies → you can't write anymore at all."
- *
- * Postgres is the durable source of truth so the boundary holds across a
- * backend restart (an in-memory set would reset and silently un-poison a run).
- * A write-through in-process cache fronts this table for the chatty read path;
- * a cache miss falls back here.
- *
- *   - PK is `(session_id, ontology)` — a set, idempotent on repeat touches.
- *   - `ontology` is the resolved ontology id (e.g. `KnowledgeBase/Product`).
- *     Neutral touches don't record, so they never write a row.
- *   - `touched_at` drives the abandoned-run `sweepOlderThan` backstop; the
- *     primary reclamation is an explicit delete of all of a session's rows at
- *     run end.
- */
 /**
  * OAuth clients dynamically registered by MCP clients (RFC 7591 DCR). When an
  * MCP client (claude.ai, Claude Code) connects to `/api/mcp` without a
@@ -551,6 +552,13 @@ export const agentEvents = pgTable('agent_events', {
     outcomeCheck: check('agent_events_outcome', sql `${t.outcome} IN ('ok', 'error', 'denied')`),
     principalCheck: check('agent_events_principal', sql `(${t.keyId} IS NULL) <> (${t.connectionId} IS NULL)`),
 }));
+/**
+ * UNUSED IN THIS RELEASE. It backed the per-session boundary that a deployment
+ * now owns for itself, behind the agent read/write hooks; nothing in this
+ * package reads or writes it any more. The definition stays for ONE release so
+ * that no deployment runs a version in which neither side has the table, and
+ * the NEXT release drops it (see `TODOS.md`). Do not build on it.
+ */
 export const sessionOntologyTouches = pgTable('session_ontology_touches', {
     sessionId: text('session_id').notNull(),
     ontology: text('ontology').notNull(),