@carlonicora/nestjs-neo4jsonapi 1.39.0 → 1.40.0

package/dist/foundations/two-factor/services/passkey.service.js

@@ -0,0 +1,400 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PasskeyService = void 0;
+const common_1 = require("@nestjs/common");
+const server_1 = require("@simplewebauthn/server");
+const crypto = __importStar(require("crypto"));
+const base_config_1 = require("../../../config/base.config");
+const jsonapi_service_1 = require("../../../core/jsonapi/services/jsonapi.service");
+const passkey_1 = require("../entities/passkey");
+const passkey_authentication_options_1 = require("../entities/passkey-authentication-options");
+const passkey_registration_options_1 = require("../entities/passkey-registration-options");
+const passkey_repository_1 = require("../repositories/passkey.repository");
+const pending_two_factor_repository_1 = require("../repositories/pending-two-factor.repository");
+/**
+ * Passkey Service
+ *
+ * Manages WebAuthn passkey registration and authentication for two-factor authentication.
+ * Provides passkey enrollment, verification, and management capabilities.
+ */
+let PasskeyService = class PasskeyService {
+    constructor(jsonApiService, passkeyRepository, pendingTwoFactorRepository) {
+        this.jsonApiService = jsonApiService;
+        this.passkeyRepository = passkeyRepository;
+        this.pendingTwoFactorRepository = pendingTwoFactorRepository;
+        this.challengeTtlSeconds = 300; // 5 minutes
+    }
+    /**
+     * Get WebAuthn Relying Party configuration from environment.
+     */
+    getRpConfig() {
+        return {
+            rpId: base_config_1.baseConfig.twoFactor.webauthnRpId,
+            rpName: base_config_1.baseConfig.twoFactor.webauthnRpName,
+            origin: base_config_1.baseConfig.twoFactor.webauthnOrigin,
+        };
+    }
+    /**
+     * Generate registration options for creating a new passkey.
+     *
+     * @param params.userId - The user's ID
+     * @param params.userName - The user's email or username
+     * @param params.userDisplayName - The user's display name
+     * @returns JSON:API response with registration options
+     */
+    async generateRegistrationOptions(params) {
+        const { rpId, rpName } = this.getRpConfig();
+        // Get existing passkeys to exclude them from registration
+        const existingPasskeys = await this.passkeyRepository.findAllByUserIdWithCredentials({
+            userId: params.userId,
+        });
+        const excludeCredentials = existingPasskeys.map((passkey) => ({
+            id: passkey.credentialId,
+            type: "public-key",
+            transports: this.parseTransports(passkey.transports),
+        }));
+        const options = await (0, server_1.generateRegistrationOptions)({
+            rpName,
+            rpID: rpId,
+            userName: params.userName,
+            userDisplayName: params.userDisplayName,
+            // Use base64url-encoded user ID for WebAuthn
+            userID: new TextEncoder().encode(params.userId),
+            attestationType: "none", // We don't need attestation for 2FA
+            excludeCredentials,
+            authenticatorSelection: {
+                residentKey: "preferred",
+                userVerification: "preferred",
+                // Allow both platform (Touch ID, Windows Hello) and cross-platform (USB keys)
+                authenticatorAttachment: undefined,
+            },
+            timeout: 60000, // 60 seconds
+        });
+        // Store the challenge for verification
+        const pendingId = crypto.randomUUID();
+        const expiration = new Date(Date.now() + this.challengeTtlSeconds * 1000);
+        await this.pendingTwoFactorRepository.createForUser({
+            pendingId,
+            userId: params.userId,
+            challenge: options.challenge,
+            challengeType: "passkey-registration",
+            expiration,
+        });
+        return this.jsonApiService.buildSingle(passkey_registration_options_1.PasskeyRegistrationOptionsDescriptor.model, {
+            id: pendingId,
+            pendingId,
+            options,
+        });
+    }
+    /**
+     * Verify a passkey registration response and create the passkey.
+     *
+     * @param params.pendingId - The pending challenge ID from generateRegistrationOptions
+     * @param params.name - A friendly name for this passkey
+     * @param params.response - The WebAuthn credential response from the client
+     * @returns JSON:API response with the created passkey
+     */
+    async verifyRegistration(params) {
+        const { rpId, origin } = this.getRpConfig();
+        // Get the pending challenge
+        const pendingData = await this.pendingTwoFactorRepository.findByIdWithUser({
+            pendingId: params.pendingId,
+        });
+        if (!pendingData) {
+            throw new common_1.NotFoundException("Registration challenge not found or expired");
+        }
+        const { pending, userId } = pendingData;
+        // Validate challenge type
+        if (pending.challengeType !== "passkey-registration") {
+            throw new common_1.BadRequestException("Invalid challenge type");
+        }
+        // Check expiration
+        if (new Date() > pending.expiration) {
+            await this.pendingTwoFactorRepository.deletePending({ pendingId: params.pendingId });
+            throw new common_1.BadRequestException("Registration challenge has expired");
+        }
+        // Verify the registration response
+        let verification;
+        try {
+            verification = await (0, server_1.verifyRegistrationResponse)({
+                response: params.response,
+                expectedChallenge: pending.challenge,
+                expectedOrigin: origin,
+                expectedRPID: rpId,
+                requireUserVerification: false, // Allow UV to be optional for broader device support
+            });
+        }
+        catch (error) {
+            throw new common_1.BadRequestException(`Registration verification failed: ${error.message}`);
+        }
+        if (!verification.verified || !verification.registrationInfo) {
+            throw new common_1.BadRequestException("Registration verification failed");
+        }
+        const { credential, credentialBackedUp } = verification.registrationInfo;
+        // Create the passkey in the database
+        const passkeyId = crypto.randomUUID();
+        const passkey = await this.passkeyRepository.createForUser({
+            passkeyId,
+            userId,
+            name: params.name,
+            credentialId: this.uint8ArrayToBase64Url(credential.id),
+            publicKey: this.uint8ArrayToBase64Url(credential.publicKey),
+            counter: credential.counter,
+            transports: params.response.response.transports || [],
+            backedUp: credentialBackedUp,
+        });
+        // Delete the pending challenge
+        await this.pendingTwoFactorRepository.deletePending({ pendingId: params.pendingId });
+        return this.jsonApiService.buildSingle(passkey_1.PasskeyDescriptor.model, passkey);
+    }
+    /**
+     * Generate authentication options for passkey sign-in.
+     *
+     * @param params.userId - The user's ID
+     * @returns JSON:API response with authentication options
+     */
+    async generateAuthenticationOptions(params) {
+        const { rpId } = this.getRpConfig();
+        // Get user's passkeys
+        const passkeys = await this.passkeyRepository.findAllByUserIdWithCredentials({
+            userId: params.userId,
+        });
+        if (passkeys.length === 0) {
+            throw new common_1.BadRequestException("User has no registered passkeys");
+        }
+        const allowCredentials = passkeys.map((passkey) => ({
+            id: passkey.credentialId,
+            type: "public-key",
+            transports: this.parseTransports(passkey.transports),
+        }));
+        const options = await (0, server_1.generateAuthenticationOptions)({
+            rpID: rpId,
+            allowCredentials,
+            userVerification: "preferred",
+            timeout: 60000,
+        });
+        // Store the challenge for verification
+        const pendingId = crypto.randomUUID();
+        const expiration = new Date(Date.now() + this.challengeTtlSeconds * 1000);
+        await this.pendingTwoFactorRepository.createForUser({
+            pendingId,
+            userId: params.userId,
+            challenge: options.challenge,
+            challengeType: "passkey-authentication",
+            expiration,
+        });
+        return this.jsonApiService.buildSingle(passkey_authentication_options_1.PasskeyAuthenticationOptionsDescriptor.model, {
+            id: pendingId,
+            pendingId,
+            options,
+        });
+    }
+    /**
+     * Verify a passkey authentication response.
+     *
+     * @param params.pendingId - The pending challenge ID from generateAuthenticationOptions
+     * @param params.response - The WebAuthn assertion response from the client
+     * @returns The passkey ID if verification succeeds
+     */
+    async verifyAuthentication(params) {
+        const { rpId, origin } = this.getRpConfig();
+        // Get the pending challenge
+        const pendingData = await this.pendingTwoFactorRepository.findByIdWithUser({
+            pendingId: params.pendingId,
+        });
+        if (!pendingData) {
+            throw new common_1.NotFoundException("Authentication challenge not found or expired");
+        }
+        const { pending, userId: _userId } = pendingData;
+        // Validate challenge type
+        if (pending.challengeType !== "passkey-authentication") {
+            throw new common_1.BadRequestException("Invalid challenge type");
+        }
+        // Check expiration
+        if (new Date() > pending.expiration) {
+            await this.pendingTwoFactorRepository.deletePending({ pendingId: params.pendingId });
+            throw new common_1.BadRequestException("Authentication challenge has expired");
+        }
+        // Find the passkey by credential ID
+        const passkey = await this.passkeyRepository.findByCredentialId({
+            credentialId: params.response.id,
+        });
+        if (!passkey) {
+            throw new common_1.BadRequestException("Passkey not found");
+        }
+        // Verify the authentication response
+        let verification;
+        try {
+            verification = await (0, server_1.verifyAuthenticationResponse)({
+                response: params.response,
+                expectedChallenge: pending.challenge,
+                expectedOrigin: origin,
+                expectedRPID: rpId,
+                credential: {
+                    // id is a Base64URL string
+                    id: passkey.credentialId,
+                    // publicKey is a Uint8Array
+                    publicKey: this.base64UrlToUint8Array(passkey.publicKey),
+                    counter: passkey.counter,
+                    transports: this.parseTransports(passkey.transports),
+                },
+                requireUserVerification: false,
+            });
+        }
+        catch (error) {
+            throw new common_1.BadRequestException(`Authentication verification failed: ${error.message}`);
+        }
+        if (!verification.verified) {
+            throw new common_1.BadRequestException("Authentication verification failed");
+        }
+        // Update the passkey counter and last used time
+        await this.passkeyRepository.updatePasskey({
+            passkeyId: passkey.id,
+            counter: verification.authenticationInfo.newCounter,
+            lastUsedAt: new Date(),
+        });
+        // Delete the pending challenge
+        await this.pendingTwoFactorRepository.deletePending({ pendingId: params.pendingId });
+        return passkey.id;
+    }
+    /**
+     * List all passkeys for a user.
+     *
+     * @param params.userId - The user's ID
+     * @returns JSON:API response with list of passkeys
+     */
+    async listPasskeys(params) {
+        const passkeys = await this.passkeyRepository.findByUserId({
+            userId: params.userId,
+        });
+        return this.jsonApiService.buildList(passkey_1.PasskeyDescriptor.model, passkeys);
+    }
+    /**
+     * Remove a passkey.
+     *
+     * @param params.passkeyId - The passkey ID to remove
+     */
+    async removePasskey(params) {
+        const passkey = await this.passkeyRepository.findByIdForUser({
+            passkeyId: params.passkeyId,
+        });
+        if (!passkey) {
+            throw new common_1.NotFoundException("Passkey not found");
+        }
+        await this.passkeyRepository.deletePasskey({
+            passkeyId: params.passkeyId,
+        });
+    }
+    /**
+     * Rename a passkey.
+     *
+     * @param params.passkeyId - The passkey ID to rename
+     * @param params.name - The new name for the passkey
+     */
+    async renamePasskey(params) {
+        const passkey = await this.passkeyRepository.findByIdForUser({
+            passkeyId: params.passkeyId,
+        });
+        if (!passkey) {
+            throw new common_1.NotFoundException("Passkey not found");
+        }
+        if (!params.name || params.name.trim().length === 0) {
+            throw new common_1.BadRequestException("Passkey name cannot be empty");
+        }
+        await this.passkeyRepository.updatePasskey({
+            passkeyId: params.passkeyId,
+            name: params.name.trim(),
+        });
+    }
+    /**
+     * Check if a user has any registered passkeys.
+     *
+     * @param params.userId - The user's ID
+     * @returns true if the user has at least one passkey
+     */
+    async hasPasskeys(params) {
+        const count = await this.passkeyRepository.countByUserId({
+            userId: params.userId,
+        });
+        return count > 0;
+    }
+    /**
+     * Parse transports JSON string into array.
+     */
+    parseTransports(transportsJson) {
+        try {
+            return JSON.parse(transportsJson);
+        }
+        catch {
+            return [];
+        }
+    }
+    /**
+     * Convert Uint8Array to base64url string.
+     */
+    uint8ArrayToBase64Url(array) {
+        return Buffer.from(array).toString("base64url");
+    }
+    /**
+     * Convert base64url string to Uint8Array.
+     * The type assertion ensures compatibility with @simplewebauthn's expected types.
+     */
+    base64UrlToUint8Array(base64url) {
+        const buffer = Buffer.from(base64url, "base64url");
+        // Create a proper ArrayBuffer-backed Uint8Array for WebAuthn compatibility
+        const arrayBuffer = new ArrayBuffer(buffer.length);
+        const uint8Array = new Uint8Array(arrayBuffer);
+        buffer.copy(uint8Array);
+        return uint8Array;
+    }
+};
+exports.PasskeyService = PasskeyService;
+exports.PasskeyService = PasskeyService = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [jsonapi_service_1.JsonApiService,
+        passkey_repository_1.PasskeyRepository,
+        pending_two_factor_repository_1.PendingTwoFactorRepository])
+], PasskeyService);
+//# sourceMappingURL=passkey.service.js.map

package/dist/foundations/two-factor/services/passkey.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"passkey.service.js","sourceRoot":"","sources":["../../../../src/foundations/two-factor/services/passkey.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,2CAAoF;AACpF,mDAWgC;AAChC,+CAAiC;AACjC,6DAAyD;AACzD,oFAAgF;AAChF,iDAAwD;AACxD,+FAAoG;AACpG,2FAAgG;AAChG,2EAAuE;AACvE,iGAA2F;AAoB3F;;;;;GAKG;AAEI,IAAM,cAAc,GAApB,MAAM,cAAc;IAGzB,YACmB,cAA8B,EAC9B,iBAAoC,EACpC,0BAAsD;QAFtD,mBAAc,GAAd,cAAc,CAAgB;QAC9B,sBAAiB,GAAjB,iBAAiB,CAAmB;QACpC,+BAA0B,GAA1B,0BAA0B,CAA4B;QALxD,wBAAmB,GAAG,GAAG,CAAC,CAAC,YAAY;IAMrD,CAAC;IAEJ;;OAEG;IACK,WAAW;QACjB,OAAO;YACL,IAAI,EAAE,wBAAU,CAAC,SAAS,CAAC,YAAY;YACvC,MAAM,EAAE,wBAAU,CAAC,SAAS,CAAC,cAAc;YAC3C,MAAM,EAAE,wBAAU,CAAC,SAAS,CAAC,cAAc;SAC5C,CAAC;IACJ,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,2BAA2B,CAAC,MAIjC;QACC,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QAE5C,0DAA0D;QAC1D,MAAM,gBAAgB,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,8BAA8B,CAAC;YACnF,MAAM,EAAE,MAAM,CAAC,MAAM;SACtB,CAAC,CAAC;QAEH,MAAM,kBAAkB,GAAwC,gBAAgB,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;YACjG,EAAE,EAAE,OAAO,CAAC,YAAY;YACxB,IAAI,EAAE,YAAqB;YAC3B,UAAU,EAAE,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,UAAU,CAAC;SACrD,CAAC,CAAC,CAAC;QAEJ,MAAM,OAAO,GAAG,MAAM,IAAA,oCAA2B,EAAC;YAChD,MAAM;YACN,IAAI,EAAE,IAAI;YACV,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,eAAe,EAAE,MAAM,CAAC,eAAe;YACvC,6CAA6C;YAC7C,MAAM,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC;YAC/C,eAAe,EAAE,MAAM,EAAE,oCAAoC;YAC7D,kBAAkB;YAClB,sBAAsB,EAAE;gBACtB,WAAW,EAAE,WAAW;gBACxB,gBAAgB,EAAE,WAAW;gBAC7B,8EAA8E;gBAC9E,uBAAuB,EAAE,SAAS;aACnC;YACD,OAAO,EAAE,KAAK,EAAE,aAAa;SAC9B,CAAC,CAAC;QAEH,uCAAuC;QACvC,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;QACtC,MAAM,UAAU,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,mBAAmB,GAAG,IAAI,CAAC,CAAC;QAE1E,MAAM,IAAI,CAAC,0BAA0B,CAAC,aAAa,CAAC;YAClD,SAAS;YACT,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,aAAa,EAAE,sBAAsB;YACrC,UAAU;SACX,CAAC,CAAC;QAEH,OAAO,IAAI,CAAC,cAAc,CAAC,WAAW,CAAC,mEAAoC,CAAC,KAAK,EAAE;YACjF,EAAE,EAAE,SAAS;YACb,SAAS;YACT,OAAO;SACR,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,kBAAkB,CAAC,MAIxB;QACC,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QAE5C,4BAA4B;QAC5B,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,0BAA0B,CAAC,gBAAgB,CAAC;YACzE,SAAS,EAAE,MAAM,CAAC,SAAS;SAC5B,CAAC,CAAC;QAEH,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,IAAI,0BAAiB,CAAC,6CAA6C,CAAC,CAAC;QAC7E,CAAC;QAED,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,WAAW,CAAC;QAExC,0BAA0B;QAC1B,IAAI,OAAO,CAAC,aAAa,KAAK,sBAAsB,EAAE,CAAC;YACrD,MAAM,IAAI,4BAAmB,CAAC,wBAAwB,CAAC,CAAC;QAC1D,CAAC;QAED,mBAAmB;QACnB,IAAI,IAAI,IAAI,EAAE,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC;YACpC,MAAM,IAAI,CAAC,0BAA0B,CAAC,aAAa,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC;YACrF,MAAM,IAAI,4BAAmB,CAAC,oCAAoC,CAAC,CAAC;QACtE,CAAC;QAED,mCAAmC;QACnC,IAAI,YAAY,CAAC;QACjB,IAAI,CAAC;YACH,YAAY,GAAG,MAAM,IAAA,mCAA0B,EAAC;gBAC9C,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,iBAAiB,EAAE,OAAO,CAAC,SAAS;gBACpC,cAAc,EAAE,MAAM;gBACtB,YAAY,EAAE,IAAI;gBAClB,uBAAuB,EAAE,KAAK,EAAE,qDAAqD;aACtF,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,4BAAmB,CAAC,qCAAsC,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;QACjG,CAAC;QAED,IAAI,CAAC,YAAY,CAAC,QAAQ,IAAI,CAAC,YAAY,CAAC,gBAAgB,EAAE,CAAC;YAC7D,MAAM,IAAI,4BAAmB,CAAC,kCAAkC,CAAC,CAAC;QACpE,CAAC;QAED,MAAM,EAAE,UAAU,EAAE,kBAAkB,EAAE,GAAG,YAAY,CAAC,gBAAgB,CAAC;QAEzE,qCAAqC;QACrC,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;QAEtC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,aAAa,CAAC;YACzD,SAAS;YACT,MAAM;YACN,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,YAAY,EAAE,IAAI,CAAC,qBAAqB,CAAC,UAAU,CAAC,EAAE,CAAC;YACvD,SAAS,EAAE,IAAI,CAAC,qBAAqB,CAAC,UAAU,CAAC,SAAS,CAAC;YAC3D,OAAO,EAAE,UAAU,CAAC,OAAO;YAC3B,UAAU,EAAE,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,UAAU,IAAI,EAAE;YACrD,QAAQ,EAAE,kBAAkB;SAC7B,CAAC,CAAC;QAEH,+BAA+B;QAC/B,MAAM,IAAI,CAAC,0BAA0B,CAAC,aAAa,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC;QAErF,OAAO,IAAI,CAAC,cAAc,CAAC,WAAW,CAAC,2BAAiB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAC3E,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,6BAA6B,CAAC,MAA0B;QAC5D,MAAM,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QAEpC,sBAAsB;QACtB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,8BAA8B,CAAC;YAC3E,MAAM,EAAE,MAAM,CAAC,MAAM;SACtB,CAAC,CAAC;QAEH,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,4BAAmB,CAAC,iCAAiC,CAAC,CAAC;QACnE,CAAC;QAED,MAAM,gBAAgB,GAAwC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;YACvF,EAAE,EAAE,OAAO,CAAC,YAAY;YACxB,IAAI,EAAE,YAAqB;YAC3B,UAAU,EAAE,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,UAAU,CAAC;SACrD,CAAC,CAAC,CAAC;QAEJ,MAAM,OAAO,GAAG,MAAM,IAAA,sCAA6B,EAAC;YAClD,IAAI,EAAE,IAAI;YACV,gBAAgB;YAChB,gBAAgB,EAAE,WAAW;YAC7B,OAAO,EAAE,KAAK;SACf,CAAC,CAAC;QAEH,uCAAuC;QACvC,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;QACtC,MAAM,UAAU,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,mBAAmB,GAAG,IAAI,CAAC,CAAC;QAE1E,MAAM,IAAI,CAAC,0BAA0B,CAAC,aAAa,CAAC;YAClD,SAAS;YACT,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,aAAa,EAAE,wBAAwB;YACvC,UAAU;SACX,CAAC,CAAC;QAEH,OAAO,IAAI,CAAC,cAAc,CAAC,WAAW,CAAC,uEAAsC,CAAC,KAAK,EAAE;YACnF,EAAE,EAAE,SAAS;YACb,SAAS;YACT,OAAO;SACR,CAAC,CAAC;IACL,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,oBAAoB,CAAC,MAAmE;QAC5F,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QAE5C,4BAA4B;QAC5B,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,0BAA0B,CAAC,gBAAgB,CAAC;YACzE,SAAS,EAAE,MAAM,CAAC,SAAS;SAC5B,CAAC,CAAC;QAEH,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,IAAI,0BAAiB,CAAC,+CAA+C,CAAC,CAAC;QAC/E,CAAC;QAED,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,WAAW,CAAC;QAEjD,0BAA0B;QAC1B,IAAI,OAAO,CAAC,aAAa,KAAK,wBAAwB,EAAE,CAAC;YACvD,MAAM,IAAI,4BAAmB,CAAC,wBAAwB,CAAC,CAAC;QAC1D,CAAC;QAED,mBAAmB;QACnB,IAAI,IAAI,IAAI,EAAE,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC;YACpC,MAAM,IAAI,CAAC,0BAA0B,CAAC,aAAa,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC;YACrF,MAAM,IAAI,4BAAmB,CAAC,sCAAsC,CAAC,CAAC;QACxE,CAAC;QAED,oCAAoC;QACpC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,kBAAkB,CAAC;YAC9D,YAAY,EAAE,MAAM,CAAC,QAAQ,CAAC,EAAE;SACjC,CAAC,CAAC;QAEH,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,4BAAmB,CAAC,mBAAmB,CAAC,CAAC;QACrD,CAAC;QAED,qCAAqC;QACrC,IAAI,YAAY,CAAC;QACjB,IAAI,CAAC;YACH,YAAY,GAAG,MAAM,IAAA,qCAA4B,EAAC;gBAChD,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,iBAAiB,EAAE,OAAO,CAAC,SAAS;gBACpC,cAAc,EAAE,MAAM;gBACtB,YAAY,EAAE,IAAI;gBAClB,UAAU,EAAE;oBACV,2BAA2B;oBAC3B,EAAE,EAAE,OAAO,CAAC,YAAY;oBACxB,4BAA4B;oBAC5B,SAAS,EAAE,IAAI,CAAC,qBAAqB,CAAC,OAAO,CAAC,SAAS,CAAC;oBACxD,OAAO,EAAE,OAAO,CAAC,OAAO;oBACxB,UAAU,EAAE,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,UAAU,CAAC;iBACrD;gBACD,uBAAuB,EAAE,KAAK;aAC/B,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,4BAAmB,CAAC,uCAAwC,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;QACnG,CAAC;QAED,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,CAAC;YAC3B,MAAM,IAAI,4BAAmB,CAAC,oCAAoC,CAAC,CAAC;QACtE,CAAC;QAED,gDAAgD;QAChD,MAAM,IAAI,CAAC,iBAAiB,CAAC,aAAa,CAAC;YACzC,SAAS,EAAE,OAAO,CAAC,EAAE;YACrB,OAAO,EAAE,YAAY,CAAC,kBAAkB,CAAC,UAAU;YACnD,UAAU,EAAE,IAAI,IAAI,EAAE;SACvB,CAAC,CAAC;QAEH,+BAA+B;QAC/B,MAAM,IAAI,CAAC,0BAA0B,CAAC,aAAa,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC;QAErF,OAAO,OAAO,CAAC,EAAE,CAAC;IACpB,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,YAAY,CAAC,MAA0B;QAC3C,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,YAAY,CAAC;YACzD,MAAM,EAAE,MAAM,CAAC,MAAM;SACtB,CAAC,CAAC;QAEH,OAAO,IAAI,CAAC,cAAc,CAAC,SAAS,CAAC,2BAAiB,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IAC1E,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,aAAa,CAAC,MAA6B;QAC/C,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,eAAe,CAAC;YAC3D,SAAS,EAAE,MAAM,CAAC,SAAS;SAC5B,CAAC,CAAC;QAEH,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,0BAAiB,CAAC,mBAAmB,CAAC,CAAC;QACnD,CAAC;QAED,MAAM,IAAI,CAAC,iBAAiB,CAAC,aAAa,CAAC;YACzC,SAAS,EAAE,MAAM,CAAC,SAAS;SAC5B,CAAC,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,aAAa,CAAC,MAA2C;QAC7D,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,eAAe,CAAC;YAC3D,SAAS,EAAE,MAAM,CAAC,SAAS;SAC5B,CAAC,CAAC;QAEH,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,0BAAiB,CAAC,mBAAmB,CAAC,CAAC;QACnD,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACpD,MAAM,IAAI,4BAAmB,CAAC,8BAA8B,CAAC,CAAC;QAChE,CAAC;QAED,MAAM,IAAI,CAAC,iBAAiB,CAAC,aAAa,CAAC;YACzC,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE;SACzB,CAAC,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,WAAW,CAAC,MAA0B;QAC1C,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,aAAa,CAAC;YACvD,MAAM,EAAE,MAAM,CAAC,MAAM;SACtB,CAAC,CAAC;QACH,OAAO,KAAK,GAAG,CAAC,CAAC;IACnB,CAAC;IAED;;OAEG;IACK,eAAe,CAAC,cAAsB;QAC5C,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,KAAK,CAAC,cAAc,CAAmC,CAAC;QACtE,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IAED;;OAEG;IACK,qBAAqB,CAAC,KAAiB;QAC7C,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAClD,CAAC;IAED;;;OAGG;IACK,qBAAqB,CAAC,SAAiB;QAC7C,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;QACnD,2EAA2E;QAC3E,MAAM,WAAW,GAAG,IAAI,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACnD,MAAM,UAAU,GAAG,IAAI,UAAU,CAAC,WAAW,CAAC,CAAC;QAC/C,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACxB,OAAO,UAAU,CAAC;IACpB,CAAC;CACF,CAAA;AAvYY,wCAAc;yBAAd,cAAc;IAD1B,IAAA,mBAAU,GAAE;qCAKwB,gCAAc;QACX,sCAAiB;QACR,0DAA0B;GAN9D,cAAc,CAuY1B"}

package/dist/foundations/two-factor/services/totp-encryption.service.d.ts

@@ -0,0 +1,42 @@
+/**
+ * TOTP Encryption Service
+ *
+ * Provides AES-256-GCM encryption/decryption for TOTP secrets.
+ * Secrets are encrypted before storage in Neo4j and decrypted for TOTP validation.
+ *
+ * Format: IV (12 bytes) + AuthTag (16 bytes) + Ciphertext (base64 encoded)
+ */
+export declare class TotpEncryptionService {
+    private readonly algorithm;
+    private readonly ivLength;
+    private readonly authTagLength;
+    /**
+     * Get the encryption key from config.
+     * The key must be exactly 32 bytes (256 bits) for AES-256.
+     */
+    private getKey;
+    /**
+     * Encrypt a TOTP secret using AES-256-GCM.
+     *
+     * @param plaintext - The TOTP secret to encrypt (typically base32-encoded)
+     * @returns The encrypted secret as a base64-encoded string containing IV, auth tag, and ciphertext
+     */
+    encrypt(plaintext: string): string;
+    /**
+     * Decrypt a TOTP secret encrypted with AES-256-GCM.
+     *
+     * @param ciphertext - The base64-encoded encrypted secret (IV + AuthTag + Ciphertext)
+     * @returns The decrypted TOTP secret
+     * @throws Error if decryption fails (invalid key, corrupted data, or tampered data)
+     */
+    decrypt(ciphertext: string): string;
+    /**
+     * Verify that the encryption system is properly configured.
+     * Performs a round-trip encryption/decryption test.
+     *
+     * @returns true if encryption is working correctly
+     * @throws Error if encryption is not properly configured
+     */
+    verify(): boolean;
+}
+//# sourceMappingURL=totp-encryption.service.d.ts.map

package/dist/foundations/two-factor/services/totp-encryption.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"totp-encryption.service.d.ts","sourceRoot":"","sources":["../../../../src/foundations/two-factor/services/totp-encryption.service.ts"],"names":[],"mappings":"AAIA;;;;;;;GAOG;AACH,qBACa,qBAAqB;IAChC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAiB;IAC3C,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAM;IAC/B,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAM;IAEpC;;;OAGG;IACH,OAAO,CAAC,MAAM;IAwBd;;;;;OAKG;IACH,OAAO,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM;IAelC;;;;;;OAMG;IACH,OAAO,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM;IAiBnC;;;;;;OAMG;IACH,MAAM,IAAI,OAAO;CAMlB"}

package/dist/foundations/two-factor/services/totp-encryption.service.js

@@ -0,0 +1,136 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TotpEncryptionService = void 0;
+const common_1 = require("@nestjs/common");
+const crypto = __importStar(require("crypto"));
+const base_config_1 = require("../../../config/base.config");
+/**
+ * TOTP Encryption Service
+ *
+ * Provides AES-256-GCM encryption/decryption for TOTP secrets.
+ * Secrets are encrypted before storage in Neo4j and decrypted for TOTP validation.
+ *
+ * Format: IV (12 bytes) + AuthTag (16 bytes) + Ciphertext (base64 encoded)
+ */
+let TotpEncryptionService = class TotpEncryptionService {
+    constructor() {
+        this.algorithm = "aes-256-gcm";
+        this.ivLength = 12; // 96 bits for GCM
+        this.authTagLength = 16; // 128 bits
+    }
+    /**
+     * Get the encryption key from config.
+     * The key must be exactly 32 bytes (256 bits) for AES-256.
+     */
+    getKey() {
+        const keyString = base_config_1.baseConfig.twoFactor.totpEncryptionKey;
+        if (!keyString) {
+            throw new Error("TOTP_ENCRYPTION_KEY environment variable is not set");
+        }
+        // If the key is hex-encoded (64 chars = 32 bytes), decode it
+        if (keyString.length === 64 && /^[0-9a-fA-F]+$/.test(keyString)) {
+            return Buffer.from(keyString, "hex");
+        }
+        // If the key is base64-encoded
+        if (keyString.length === 44 && keyString.endsWith("=")) {
+            const decoded = Buffer.from(keyString, "base64");
+            if (decoded.length === 32) {
+                return decoded;
+            }
+        }
+        // Otherwise, derive a 32-byte key using SHA-256
+        return crypto.createHash("sha256").update(keyString).digest();
+    }
+    /**
+     * Encrypt a TOTP secret using AES-256-GCM.
+     *
+     * @param plaintext - The TOTP secret to encrypt (typically base32-encoded)
+     * @returns The encrypted secret as a base64-encoded string containing IV, auth tag, and ciphertext
+     */
+    encrypt(plaintext) {
+        const key = this.getKey();
+        const iv = crypto.randomBytes(this.ivLength);
+        const cipher = crypto.createCipheriv(this.algorithm, key, iv);
+        const encrypted = Buffer.concat([cipher.update(plaintext, "utf8"), cipher.final()]);
+        const authTag = cipher.getAuthTag();
+        // Combine IV + AuthTag + Ciphertext
+        const combined = Buffer.concat([iv, authTag, encrypted]);
+        return combined.toString("base64");
+    }
+    /**
+     * Decrypt a TOTP secret encrypted with AES-256-GCM.
+     *
+     * @param ciphertext - The base64-encoded encrypted secret (IV + AuthTag + Ciphertext)
+     * @returns The decrypted TOTP secret
+     * @throws Error if decryption fails (invalid key, corrupted data, or tampered data)
+     */
+    decrypt(ciphertext) {
+        const key = this.getKey();
+        const combined = Buffer.from(ciphertext, "base64");
+        // Extract IV, AuthTag, and encrypted data
+        const iv = combined.subarray(0, this.ivLength);
+        const authTag = combined.subarray(this.ivLength, this.ivLength + this.authTagLength);
+        const encrypted = combined.subarray(this.ivLength + this.authTagLength);
+        const decipher = crypto.createDecipheriv(this.algorithm, key, iv);
+        decipher.setAuthTag(authTag);
+        const decrypted = Buffer.concat([decipher.update(encrypted), decipher.final()]);
+        return decrypted.toString("utf8");
+    }
+    /**
+     * Verify that the encryption system is properly configured.
+     * Performs a round-trip encryption/decryption test.
+     *
+     * @returns true if encryption is working correctly
+     * @throws Error if encryption is not properly configured
+     */
+    verify() {
+        const testData = "test-secret-" + crypto.randomBytes(8).toString("hex");
+        const encrypted = this.encrypt(testData);
+        const decrypted = this.decrypt(encrypted);
+        return decrypted === testData;
+    }
+};
+exports.TotpEncryptionService = TotpEncryptionService;
+exports.TotpEncryptionService = TotpEncryptionService = __decorate([
+    (0, common_1.Injectable)()
+], TotpEncryptionService);
+//# sourceMappingURL=totp-encryption.service.js.map

package/dist/foundations/two-factor/services/totp-encryption.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"totp-encryption.service.js","sourceRoot":"","sources":["../../../../src/foundations/two-factor/services/totp-encryption.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,2CAA4C;AAC5C,+CAAiC;AACjC,6DAAyD;AAEzD;;;;;;;GAOG;AAEI,IAAM,qBAAqB,GAA3B,MAAM,qBAAqB;IAA3B;QACY,cAAS,GAAG,aAAa,CAAC;QAC1B,aAAQ,GAAG,EAAE,CAAC,CAAC,kBAAkB;QACjC,kBAAa,GAAG,EAAE,CAAC,CAAC,WAAW;IAwFlD,CAAC;IAtFC;;;OAGG;IACK,MAAM;QACZ,MAAM,SAAS,GAAG,wBAAU,CAAC,SAAS,CAAC,iBAAiB,CAAC;QAEzD,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;QACzE,CAAC;QAED,6DAA6D;QAC7D,IAAI,SAAS,CAAC,MAAM,KAAK,EAAE,IAAI,gBAAgB,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;YAChE,OAAO,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;QACvC,CAAC;QAED,+BAA+B;QAC/B,IAAI,SAAS,CAAC,MAAM,KAAK,EAAE,IAAI,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACvD,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;YACjD,IAAI,OAAO,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;gBAC1B,OAAO,OAAO,CAAC;YACjB,CAAC;QACH,CAAC;QAED,gDAAgD;QAChD,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,MAAM,EAAE,CAAC;IAChE,CAAC;IAED;;;;;OAKG;IACH,OAAO,CAAC,SAAiB;QACvB,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QAC1B,MAAM,EAAE,GAAG,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC7C,MAAM,MAAM,GAAG,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;QAE9D,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QAEpF,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;QAEpC,oCAAoC;QACpC,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC;QAEzD,OAAO,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACrC,CAAC;IAED;;;;;;OAMG;IACH,OAAO,CAAC,UAAkB;QACxB,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QAC1B,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;QAEnD,0CAA0C;QAC1C,MAAM,EAAE,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC/C,MAAM,OAAO,GAAG,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,aAAa,CAAC,CAAC;QACrF,MAAM,SAAS,GAAG,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,aAAa,CAAC,CAAC;QAExE,MAAM,QAAQ,GAAG,MAAM,CAAC,gBAAgB,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;QAClE,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;QAE7B,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QAEhF,OAAO,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACpC,CAAC;IAED;;;;;;OAMG;IACH,MAAM;QACJ,MAAM,QAAQ,GAAG,cAAc,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACxE,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QACzC,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAC1C,OAAO,SAAS,KAAK,QAAQ,CAAC;IAChC,CAAC;CACF,CAAA;AA3FY,sDAAqB;gCAArB,qBAAqB;IADjC,IAAA,mBAAU,GAAE;GACA,qBAAqB,CA2FjC"}