@carlonicora/nestjs-neo4jsonapi 1.39.0 → 1.40.0

package/dist/foundations/two-factor/services/totp.service.d.ts

@@ -0,0 +1,132 @@
+import { JsonApiService } from "../../../core/jsonapi/services/jsonapi.service";
+import { TotpAuthenticatorRepository } from "../repositories/totp-authenticator.repository";
+import { TotpEncryptionService } from "./totp-encryption.service";
+export interface TotpSetupResponse {
+    authenticatorId: string;
+    secret: string;
+    qrCodeUri: string;
+    qrCodeDataUrl: string;
+}
+export interface TotpAuthenticatorInfo {
+    id: string;
+    name: string;
+    verified: boolean;
+    lastUsedAt?: Date;
+    createdAt: Date;
+}
+/**
+ * TOTP Service
+ *
+ * Manages TOTP (Time-based One-Time Password) authenticators for two-factor authentication.
+ * Provides secret generation, QR code creation, code verification, and authenticator management.
+ */
+export declare class TotpService {
+    private readonly jsonApiService;
+    private readonly totpAuthenticatorRepository;
+    private readonly totpEncryptionService;
+    private readonly logger;
+    private readonly issuer;
+    private readonly algorithm;
+    private readonly digits;
+    private readonly period;
+    constructor(jsonApiService: JsonApiService, totpAuthenticatorRepository: TotpAuthenticatorRepository, totpEncryptionService: TotpEncryptionService);
+    /**
+     * Generate a new TOTP secret and return setup information.
+     *
+     * @param params.userId - The user's ID
+     * @param params.name - A friendly name for this authenticator (e.g., "Google Authenticator")
+     * @param params.accountName - The account name to display in authenticator apps (typically email)
+     * @returns JSON:API response with setup info (QR code, secret)
+     */
+    generateSecret(params: {
+        userId: string;
+        name: string;
+        accountName: string;
+    }): Promise<any>;
+    /**
+     * Generate QR code URI for an existing authenticator.
+     * Only works for unverified authenticators.
+     *
+     * @param params.authenticatorId - The authenticator ID
+     * @param params.accountName - The account name for the QR code
+     * @returns QR code URI and data URL
+     */
+    generateQRCodeUri(params: {
+        authenticatorId: string;
+        accountName: string;
+    }): Promise<{
+        qrCodeUri: string;
+        qrCodeDataUrl: string;
+    }>;
+    /**
+     * Verify a TOTP code against an authenticator.
+     *
+     * @param params.authenticatorId - The authenticator ID
+     * @param params.code - The 6-digit TOTP code
+     * @returns true if the code is valid
+     */
+    verifyCode(params: {
+        authenticatorId: string;
+        code: string;
+    }): Promise<boolean>;
+    /**
+     * Verify a TOTP code for any verified authenticator belonging to a user.
+     *
+     * @param params.userId - The user's ID
+     * @param params.code - The 6-digit TOTP code
+     * @returns The authenticator ID if verification succeeds, null otherwise
+     */
+    verifyCodeForUser(params: {
+        userId: string;
+        code: string;
+    }): Promise<string | null>;
+    /**
+     * Add (verify) an authenticator by validating a TOTP code.
+     * This marks the authenticator as verified and ready for use.
+     *
+     * @param params.authenticatorId - The authenticator ID from generateSecret
+     * @param params.code - The 6-digit TOTP code from the authenticator app
+     * @returns JSON:API response with verified authenticator, or null if verification failed
+     */
+    addAuthenticator(params: {
+        authenticatorId: string;
+        code: string;
+    }): Promise<any>;
+    /**
+     * Remove an authenticator.
+     *
+     * @param params.authenticatorId - The authenticator ID to remove
+     */
+    removeAuthenticator(params: {
+        authenticatorId: string;
+    }): Promise<void>;
+    /**
+     * List all authenticators for a user.
+     *
+     * @param params.userId - The user's ID
+     * @param params.verifiedOnly - If true, only return verified authenticators
+     * @returns JSON:API response with list of authenticators
+     */
+    listAuthenticators(params: {
+        userId: string;
+        verifiedOnly?: boolean;
+    }): Promise<any>;
+    /**
+     * Check if a user has any verified TOTP authenticators.
+     *
+     * @param params.userId - The user's ID
+     * @returns true if the user has at least one verified authenticator
+     */
+    hasVerifiedAuthenticator(params: {
+        userId: string;
+    }): Promise<boolean>;
+    /**
+     * Delete an unverified authenticator (cleanup for abandoned setup).
+     *
+     * @param params.authenticatorId - The authenticator ID
+     */
+    deleteUnverifiedAuthenticator(params: {
+        authenticatorId: string;
+    }): Promise<void>;
+}
+//# sourceMappingURL=totp.service.d.ts.map

package/dist/foundations/two-factor/services/totp.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"totp.service.d.ts","sourceRoot":"","sources":["../../../../src/foundations/two-factor/services/totp.service.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,cAAc,EAAE,MAAM,gDAAgD,CAAC;AAGhF,OAAO,EAAE,2BAA2B,EAAE,MAAM,+CAA+C,CAAC;AAC5F,OAAO,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAElE,MAAM,WAAW,iBAAiB;IAChC,eAAe,EAAE,MAAM,CAAC;IACxB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,qBAAqB;IACpC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,OAAO,CAAC;IAClB,UAAU,CAAC,EAAE,IAAI,CAAC;IAClB,SAAS,EAAE,IAAI,CAAC;CACjB;AAED;;;;;GAKG;AACH,qBACa,WAAW;IAQpB,OAAO,CAAC,QAAQ,CAAC,cAAc;IAC/B,OAAO,CAAC,QAAQ,CAAC,2BAA2B;IAC5C,OAAO,CAAC,QAAQ,CAAC,qBAAqB;IATxC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAwC;IAC/D,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAY;IACnC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAU;IACpC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAK;IAC5B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAM;gBAGV,cAAc,EAAE,cAAc,EAC9B,2BAA2B,EAAE,2BAA2B,EACxD,qBAAqB,EAAE,qBAAqB;IAG/D;;;;;;;OAOG;IACG,cAAc,CAAC,MAAM,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,GAAG,CAAC;IAyCjG;;;;;;;OAOG;IACG,iBAAiB,CAAC,MAAM,EAAE;QAC9B,eAAe,EAAE,MAAM,CAAC;QACxB,WAAW,EAAE,MAAM,CAAC;KACrB,GAAG,OAAO,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,MAAM,CAAA;KAAE,CAAC;IAgCzD;;;;;;OAMG;IACG,UAAU,CAAC,MAAM,EAAE;QAAE,eAAe,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,OAAO,CAAC;IAoCrF;;;;;;OAMG;IACG,iBAAiB,CAAC,MAAM,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAuCzF;;;;;;;OAOG;IACG,gBAAgB,CAAC,MAAM,EAAE;QAAE,eAAe,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,GAAG,CAAC;IAgCvF;;;;OAIG;IACG,mBAAmB,CAAC,MAAM,EAAE;QAAE,eAAe,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAc7E;;;;;;OAMG;IACG,kBAAkB,CAAC,MAAM,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,YAAY,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,GAAG,CAAC;IAQ1F;;;;;OAKG;IACG,wBAAwB,CAAC,MAAM,EAAE;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,OAAO,CAAC;IAO5E;;;;OAIG;IACG,6BAA6B,CAAC,MAAM,EAAE;QAAE,eAAe,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;CAiBxF"}

package/dist/foundations/two-factor/services/totp.service.js

@@ -0,0 +1,324 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var TotpService_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TotpService = void 0;
+const common_1 = require("@nestjs/common");
+const crypto = __importStar(require("crypto"));
+const OTPAuth = __importStar(require("otpauth"));
+const QRCode = __importStar(require("qrcode"));
+const jsonapi_service_1 = require("../../../core/jsonapi/services/jsonapi.service");
+const totp_authenticator_1 = require("../entities/totp-authenticator");
+const totp_setup_1 = require("../entities/totp-setup");
+const totp_authenticator_repository_1 = require("../repositories/totp-authenticator.repository");
+const totp_encryption_service_1 = require("./totp-encryption.service");
+/**
+ * TOTP Service
+ *
+ * Manages TOTP (Time-based One-Time Password) authenticators for two-factor authentication.
+ * Provides secret generation, QR code creation, code verification, and authenticator management.
+ */
+let TotpService = TotpService_1 = class TotpService {
+    constructor(jsonApiService, totpAuthenticatorRepository, totpEncryptionService) {
+        this.jsonApiService = jsonApiService;
+        this.totpAuthenticatorRepository = totpAuthenticatorRepository;
+        this.totpEncryptionService = totpEncryptionService;
+        this.logger = new common_1.Logger(TotpService_1.name);
+        this.issuer = "Only35";
+        this.algorithm = "SHA1";
+        this.digits = 6;
+        this.period = 30; // seconds
+    }
+    /**
+     * Generate a new TOTP secret and return setup information.
+     *
+     * @param params.userId - The user's ID
+     * @param params.name - A friendly name for this authenticator (e.g., "Google Authenticator")
+     * @param params.accountName - The account name to display in authenticator apps (typically email)
+     * @returns JSON:API response with setup info (QR code, secret)
+     */
+    async generateSecret(params) {
+        // Generate a new TOTP secret
+        const secret = new OTPAuth.Secret({ size: 20 });
+        // Create TOTP instance for URI generation
+        const totp = new OTPAuth.TOTP({
+            issuer: this.issuer,
+            label: params.accountName,
+            algorithm: this.algorithm,
+            digits: this.digits,
+            period: this.period,
+            secret: secret,
+        });
+        // Get the otpauth:// URI for QR code
+        const qrCodeUri = totp.toString();
+        // Generate QR code as data URL
+        const qrCodeDataUrl = await QRCode.toDataURL(qrCodeUri);
+        // Encrypt the secret before storing
+        const encryptedSecret = this.totpEncryptionService.encrypt(secret.base32);
+        // Create the authenticator in pending (unverified) state
+        const authenticatorId = crypto.randomUUID();
+        await this.totpAuthenticatorRepository.createForUser({
+            authenticatorId,
+            userId: params.userId,
+            name: params.name,
+            secret: encryptedSecret,
+            verified: false,
+        });
+        return this.jsonApiService.buildSingle(totp_setup_1.TotpSetupDescriptor.model, {
+            id: authenticatorId,
+            secret: secret.base32,
+            qrCodeUri,
+            qrCodeDataUrl,
+        });
+    }
+    /**
+     * Generate QR code URI for an existing authenticator.
+     * Only works for unverified authenticators.
+     *
+     * @param params.authenticatorId - The authenticator ID
+     * @param params.accountName - The account name for the QR code
+     * @returns QR code URI and data URL
+     */
+    async generateQRCodeUri(params) {
+        const authenticator = await this.totpAuthenticatorRepository.findByIdWithSecret({
+            authenticatorId: params.authenticatorId,
+        });
+        if (!authenticator) {
+            throw new common_1.NotFoundException("Authenticator not found");
+        }
+        if (authenticator.verified) {
+            throw new common_1.BadRequestException("Cannot regenerate QR code for verified authenticator");
+        }
+        // Decrypt the secret
+        const decryptedSecret = this.totpEncryptionService.decrypt(authenticator.secret);
+        // Create TOTP instance for URI generation
+        const totp = new OTPAuth.TOTP({
+            issuer: this.issuer,
+            label: params.accountName,
+            algorithm: this.algorithm,
+            digits: this.digits,
+            period: this.period,
+            secret: OTPAuth.Secret.fromBase32(decryptedSecret),
+        });
+        const qrCodeUri = totp.toString();
+        const qrCodeDataUrl = await QRCode.toDataURL(qrCodeUri);
+        return { qrCodeUri, qrCodeDataUrl };
+    }
+    /**
+     * Verify a TOTP code against an authenticator.
+     *
+     * @param params.authenticatorId - The authenticator ID
+     * @param params.code - The 6-digit TOTP code
+     * @returns true if the code is valid
+     */
+    async verifyCode(params) {
+        const authenticator = await this.totpAuthenticatorRepository.findByIdWithSecret({
+            authenticatorId: params.authenticatorId,
+        });
+        if (!authenticator) {
+            throw new common_1.NotFoundException("Authenticator not found");
+        }
+        // Decrypt the secret
+        const decryptedSecret = this.totpEncryptionService.decrypt(authenticator.secret);
+        // Create TOTP instance
+        const totp = new OTPAuth.TOTP({
+            issuer: this.issuer,
+            algorithm: this.algorithm,
+            digits: this.digits,
+            period: this.period,
+            secret: OTPAuth.Secret.fromBase32(decryptedSecret),
+        });
+        // Validate with 1 period window (allows for time drift)
+        const delta = totp.validate({ token: params.code, window: 1 });
+        if (delta !== null) {
+            // Update last used time
+            await this.totpAuthenticatorRepository.updateAuthenticator({
+                authenticatorId: params.authenticatorId,
+                lastUsedAt: new Date(),
+            });
+            return true;
+        }
+        return false;
+    }
+    /**
+     * Verify a TOTP code for any verified authenticator belonging to a user.
+     *
+     * @param params.userId - The user's ID
+     * @param params.code - The 6-digit TOTP code
+     * @returns The authenticator ID if verification succeeds, null otherwise
+     */
+    async verifyCodeForUser(params) {
+        const authenticators = await this.totpAuthenticatorRepository.findAllByUserIdWithSecrets({
+            userId: params.userId,
+        });
+        for (const authenticator of authenticators) {
+            // Skip unverified authenticators
+            if (!authenticator.verified) {
+                continue;
+            }
+            // Decrypt the secret
+            const decryptedSecret = this.totpEncryptionService.decrypt(authenticator.secret);
+            // Create TOTP instance
+            const totp = new OTPAuth.TOTP({
+                issuer: this.issuer,
+                algorithm: this.algorithm,
+                digits: this.digits,
+                period: this.period,
+                secret: OTPAuth.Secret.fromBase32(decryptedSecret),
+            });
+            // Validate with 1 period window
+            const delta = totp.validate({ token: params.code, window: 1 });
+            if (delta !== null) {
+                // Update last used time
+                await this.totpAuthenticatorRepository.updateAuthenticator({
+                    authenticatorId: authenticator.id,
+                    lastUsedAt: new Date(),
+                });
+                return authenticator.id;
+            }
+        }
+        return null;
+    }
+    /**
+     * Add (verify) an authenticator by validating a TOTP code.
+     * This marks the authenticator as verified and ready for use.
+     *
+     * @param params.authenticatorId - The authenticator ID from generateSecret
+     * @param params.code - The 6-digit TOTP code from the authenticator app
+     * @returns JSON:API response with verified authenticator, or null if verification failed
+     */
+    async addAuthenticator(params) {
+        const authenticator = await this.totpAuthenticatorRepository.findByIdWithSecret({
+            authenticatorId: params.authenticatorId,
+        });
+        if (!authenticator) {
+            throw new common_1.NotFoundException("Authenticator not found");
+        }
+        if (authenticator.verified) {
+            throw new common_1.BadRequestException("Authenticator is already verified");
+        }
+        // Verify the code
+        const isValid = await this.verifyCode({
+            authenticatorId: params.authenticatorId,
+            code: params.code,
+        });
+        if (!isValid) {
+            return null;
+        }
+        // Mark as verified and get updated authenticator
+        const verifiedAuthenticator = await this.totpAuthenticatorRepository.updateAuthenticator({
+            authenticatorId: params.authenticatorId,
+            verified: true,
+        });
+        return this.jsonApiService.buildSingle(totp_authenticator_1.TotpAuthenticatorDescriptor.model, verifiedAuthenticator);
+    }
+    /**
+     * Remove an authenticator.
+     *
+     * @param params.authenticatorId - The authenticator ID to remove
+     */
+    async removeAuthenticator(params) {
+        const authenticator = await this.totpAuthenticatorRepository.findByIdForUser({
+            authenticatorId: params.authenticatorId,
+        });
+        if (!authenticator) {
+            throw new common_1.NotFoundException("Authenticator not found");
+        }
+        await this.totpAuthenticatorRepository.deleteAuthenticator({
+            authenticatorId: params.authenticatorId,
+        });
+    }
+    /**
+     * List all authenticators for a user.
+     *
+     * @param params.userId - The user's ID
+     * @param params.verifiedOnly - If true, only return verified authenticators
+     * @returns JSON:API response with list of authenticators
+     */
+    async listAuthenticators(params) {
+        const authenticators = params.verifiedOnly
+            ? await this.totpAuthenticatorRepository.findVerifiedByUserId({ userId: params.userId })
+            : await this.totpAuthenticatorRepository.findAllByUserIdWithSecrets({ userId: params.userId });
+        return this.jsonApiService.buildList(totp_authenticator_1.TotpAuthenticatorDescriptor.model, authenticators);
+    }
+    /**
+     * Check if a user has any verified TOTP authenticators.
+     *
+     * @param params.userId - The user's ID
+     * @returns true if the user has at least one verified authenticator
+     */
+    async hasVerifiedAuthenticator(params) {
+        const count = await this.totpAuthenticatorRepository.countVerifiedByUserId({
+            userId: params.userId,
+        });
+        return count > 0;
+    }
+    /**
+     * Delete an unverified authenticator (cleanup for abandoned setup).
+     *
+     * @param params.authenticatorId - The authenticator ID
+     */
+    async deleteUnverifiedAuthenticator(params) {
+        const authenticator = await this.totpAuthenticatorRepository.findByIdForUser({
+            authenticatorId: params.authenticatorId,
+        });
+        if (!authenticator) {
+            throw new common_1.NotFoundException("Authenticator not found");
+        }
+        if (authenticator.verified) {
+            throw new common_1.BadRequestException("Cannot delete a verified authenticator using this method");
+        }
+        await this.totpAuthenticatorRepository.deleteAuthenticator({
+            authenticatorId: params.authenticatorId,
+        });
+    }
+};
+exports.TotpService = TotpService;
+exports.TotpService = TotpService = TotpService_1 = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [jsonapi_service_1.JsonApiService,
+        totp_authenticator_repository_1.TotpAuthenticatorRepository,
+        totp_encryption_service_1.TotpEncryptionService])
+], TotpService);
+//# sourceMappingURL=totp.service.js.map

package/dist/foundations/two-factor/services/totp.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"totp.service.js","sourceRoot":"","sources":["../../../../src/foundations/two-factor/services/totp.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,2CAA4F;AAC5F,+CAAiC;AACjC,iDAAmC;AACnC,+CAAiC;AACjC,oFAAgF;AAChF,uEAA6E;AAC7E,uDAA6D;AAC7D,iGAA4F;AAC5F,uEAAkE;AAiBlE;;;;;GAKG;AAEI,IAAM,WAAW,mBAAjB,MAAM,WAAW;IAOtB,YACmB,cAA8B,EAC9B,2BAAwD,EACxD,qBAA4C;QAF5C,mBAAc,GAAd,cAAc,CAAgB;QAC9B,gCAA2B,GAA3B,2BAA2B,CAA6B;QACxD,0BAAqB,GAArB,qBAAqB,CAAuB;QAT9C,WAAM,GAAW,IAAI,eAAM,CAAC,aAAW,CAAC,IAAI,CAAC,CAAC;QAC9C,WAAM,GAAG,QAAQ,CAAC;QAClB,cAAS,GAAG,MAAM,CAAC;QACnB,WAAM,GAAG,CAAC,CAAC;QACX,WAAM,GAAG,EAAE,CAAC,CAAC,UAAU;IAMrC,CAAC;IAEJ;;;;;;;OAOG;IACH,KAAK,CAAC,cAAc,CAAC,MAA6D;QAChF,6BAA6B;QAC7B,MAAM,MAAM,GAAG,IAAI,OAAO,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;QAEhD,0CAA0C;QAC1C,MAAM,IAAI,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC;YAC5B,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,KAAK,EAAE,MAAM,CAAC,WAAW;YACzB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,MAAM,EAAE,MAAM;SACf,CAAC,CAAC;QAEH,qCAAqC;QACrC,MAAM,SAAS,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;QAElC,+BAA+B;QAC/B,MAAM,aAAa,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;QAExD,oCAAoC;QACpC,MAAM,eAAe,GAAG,IAAI,CAAC,qBAAqB,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAE1E,yDAAyD;QACzD,MAAM,eAAe,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;QAC5C,MAAM,IAAI,CAAC,2BAA2B,CAAC,aAAa,CAAC;YACnD,eAAe;YACf,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,MAAM,EAAE,eAAe;YACvB,QAAQ,EAAE,KAAK;SAChB,CAAC,CAAC;QAEH,OAAO,IAAI,CAAC,cAAc,CAAC,WAAW,CAAC,gCAAmB,CAAC,KAAK,EAAE;YAChE,EAAE,EAAE,eAAe;YACnB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,SAAS;YACT,aAAa;SACd,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,iBAAiB,CAAC,MAGvB;QACC,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,2BAA2B,CAAC,kBAAkB,CAAC;YAC9E,eAAe,EAAE,MAAM,CAAC,eAAe;SACxC,CAAC,CAAC;QAEH,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,MAAM,IAAI,0BAAiB,CAAC,yBAAyB,CAAC,CAAC;QACzD,CAAC;QAED,IAAI,aAAa,CAAC,QAAQ,EAAE,CAAC;YAC3B,MAAM,IAAI,4BAAmB,CAAC,sDAAsD,CAAC,CAAC;QACxF,CAAC;QAED,qBAAqB;QACrB,MAAM,eAAe,GAAG,IAAI,CAAC,qBAAqB,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;QAEjF,0CAA0C;QAC1C,MAAM,IAAI,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC;YAC5B,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,KAAK,EAAE,MAAM,CAAC,WAAW;YACzB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,eAAe,CAAC;SACnD,CAAC,CAAC;QAEH,MAAM,SAAS,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;QAClC,MAAM,aAAa,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;QAExD,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,CAAC;IACtC,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,UAAU,CAAC,MAAiD;QAChE,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,2BAA2B,CAAC,kBAAkB,CAAC;YAC9E,eAAe,EAAE,MAAM,CAAC,eAAe;SACxC,CAAC,CAAC;QAEH,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,MAAM,IAAI,0BAAiB,CAAC,yBAAyB,CAAC,CAAC;QACzD,CAAC;QAED,qBAAqB;QACrB,MAAM,eAAe,GAAG,IAAI,CAAC,qBAAqB,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;QAEjF,uBAAuB;QACvB,MAAM,IAAI,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC;YAC5B,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,eAAe,CAAC;SACnD,CAAC,CAAC;QAEH,wDAAwD;QACxD,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;QAE/D,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YACnB,wBAAwB;YACxB,MAAM,IAAI,CAAC,2BAA2B,CAAC,mBAAmB,CAAC;gBACzD,eAAe,EAAE,MAAM,CAAC,eAAe;gBACvC,UAAU,EAAE,IAAI,IAAI,EAAE;aACvB,CAAC,CAAC;YACH,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,iBAAiB,CAAC,MAAwC;QAC9D,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,2BAA2B,CAAC,0BAA0B,CAAC;YACvF,MAAM,EAAE,MAAM,CAAC,MAAM;SACtB,CAAC,CAAC;QAEH,KAAK,MAAM,aAAa,IAAI,cAAc,EAAE,CAAC;YAC3C,iCAAiC;YACjC,IAAI,CAAC,aAAa,CAAC,QAAQ,EAAE,CAAC;gBAC5B,SAAS;YACX,CAAC;YAED,qBAAqB;YACrB,MAAM,eAAe,GAAG,IAAI,CAAC,qBAAqB,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;YAEjF,uBAAuB;YACvB,MAAM,IAAI,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC;gBAC5B,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,eAAe,CAAC;aACnD,CAAC,CAAC;YAEH,gCAAgC;YAChC,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;YAE/D,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;gBACnB,wBAAwB;gBACxB,MAAM,IAAI,CAAC,2BAA2B,CAAC,mBAAmB,CAAC;oBACzD,eAAe,EAAE,aAAa,CAAC,EAAE;oBACjC,UAAU,EAAE,IAAI,IAAI,EAAE;iBACvB,CAAC,CAAC;gBACH,OAAO,aAAa,CAAC,EAAE,CAAC;YAC1B,CAAC;QACH,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,gBAAgB,CAAC,MAAiD;QACtE,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,2BAA2B,CAAC,kBAAkB,CAAC;YAC9E,eAAe,EAAE,MAAM,CAAC,eAAe;SACxC,CAAC,CAAC;QAEH,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,MAAM,IAAI,0BAAiB,CAAC,yBAAyB,CAAC,CAAC;QACzD,CAAC;QAED,IAAI,aAAa,CAAC,QAAQ,EAAE,CAAC;YAC3B,MAAM,IAAI,4BAAmB,CAAC,mCAAmC,CAAC,CAAC;QACrE,CAAC;QAED,kBAAkB;QAClB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC;YACpC,eAAe,EAAE,MAAM,CAAC,eAAe;YACvC,IAAI,EAAE,MAAM,CAAC,IAAI;SAClB,CAAC,CAAC;QAEH,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,IAAI,CAAC;QACd,CAAC;QAED,iDAAiD;QACjD,MAAM,qBAAqB,GAAG,MAAM,IAAI,CAAC,2BAA2B,CAAC,mBAAmB,CAAC;YACvF,eAAe,EAAE,MAAM,CAAC,eAAe;YACvC,QAAQ,EAAE,IAAI;SACf,CAAC,CAAC;QAEH,OAAO,IAAI,CAAC,cAAc,CAAC,WAAW,CAAC,gDAA2B,CAAC,KAAK,EAAE,qBAAqB,CAAC,CAAC;IACnG,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,mBAAmB,CAAC,MAAmC;QAC3D,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,2BAA2B,CAAC,eAAe,CAAC;YAC3E,eAAe,EAAE,MAAM,CAAC,eAAe;SACxC,CAAC,CAAC;QAEH,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,MAAM,IAAI,0BAAiB,CAAC,yBAAyB,CAAC,CAAC;QACzD,CAAC;QAED,MAAM,IAAI,CAAC,2BAA2B,CAAC,mBAAmB,CAAC;YACzD,eAAe,EAAE,MAAM,CAAC,eAAe;SACxC,CAAC,CAAC;IACL,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,kBAAkB,CAAC,MAAkD;QACzE,MAAM,cAAc,GAAG,MAAM,CAAC,YAAY;YACxC,CAAC,CAAC,MAAM,IAAI,CAAC,2BAA2B,CAAC,oBAAoB,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;YACxF,CAAC,CAAC,MAAM,IAAI,CAAC,2BAA2B,CAAC,0BAA0B,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;QAEjG,OAAO,IAAI,CAAC,cAAc,CAAC,SAAS,CAAC,gDAA2B,CAAC,KAAK,EAAE,cAAc,CAAC,CAAC;IAC1F,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,wBAAwB,CAAC,MAA0B;QACvD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,2BAA2B,CAAC,qBAAqB,CAAC;YACzE,MAAM,EAAE,MAAM,CAAC,MAAM;SACtB,CAAC,CAAC;QACH,OAAO,KAAK,GAAG,CAAC,CAAC;IACnB,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,6BAA6B,CAAC,MAAmC;QACrE,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,2BAA2B,CAAC,eAAe,CAAC;YAC3E,eAAe,EAAE,MAAM,CAAC,eAAe;SACxC,CAAC,CAAC;QAEH,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,MAAM,IAAI,0BAAiB,CAAC,yBAAyB,CAAC,CAAC;QACzD,CAAC;QAED,IAAI,aAAa,CAAC,QAAQ,EAAE,CAAC;YAC3B,MAAM,IAAI,4BAAmB,CAAC,0DAA0D,CAAC,CAAC;QAC5F,CAAC;QAED,MAAM,IAAI,CAAC,2BAA2B,CAAC,mBAAmB,CAAC;YACzD,eAAe,EAAE,MAAM,CAAC,eAAe;SACxC,CAAC,CAAC;IACL,CAAC;CACF,CAAA;AA/SY,kCAAW;sBAAX,WAAW;IADvB,IAAA,mBAAU,GAAE;qCASwB,gCAAc;QACD,2DAA2B;QACjC,+CAAqB;GAVpD,WAAW,CA+SvB"}

package/dist/foundations/two-factor/services/two-factor.service.d.ts

@@ -0,0 +1,165 @@
+import { JsonApiService } from "../../../core/jsonapi/services/jsonapi.service";
+import { PendingTwoFactor } from "../entities/pending-two-factor";
+import { TwoFactorConfig } from "../entities/two-factor-config";
+import { PendingTwoFactorRepository } from "../repositories/pending-two-factor.repository";
+import { TwoFactorConfigRepository } from "../repositories/two-factor-config.repository";
+import { BackupCodeService } from "./backup-code.service";
+import { PasskeyService } from "./passkey.service";
+import { TotpService } from "./totp.service";
+export type TwoFactorMethod = "totp" | "passkey" | "backup";
+export interface TwoFactorStatus {
+    isEnabled: boolean;
+    preferredMethod: TwoFactorMethod;
+    methods: {
+        totp: boolean;
+        passkey: boolean;
+        backup: boolean;
+    };
+    backupCodesCount: number;
+}
+export interface PendingSession {
+    pendingId: string;
+    expiration: Date;
+}
+export interface VerificationResult {
+    success: boolean;
+    userId?: string;
+}
+/**
+ * Two-Factor Orchestration Service
+ *
+ * Coordinates all 2FA functionality including status management, method verification,
+ * and pending session handling. This service is the main entry point for 2FA operations
+ * and delegates to specialized services (TOTP, Passkey, BackupCode) for specific tasks.
+ */
+export declare class TwoFactorService {
+    private readonly jsonApiService;
+    private readonly twoFactorConfigRepository;
+    private readonly pendingTwoFactorRepository;
+    private readonly totpService;
+    private readonly passkeyService;
+    private readonly backupCodeService;
+    private readonly pendingTtlSeconds;
+    private readonly maxTotpAttempts;
+    private readonly maxPasskeyAttempts;
+    private readonly maxBackupAttempts;
+    constructor(jsonApiService: JsonApiService, twoFactorConfigRepository: TwoFactorConfigRepository, pendingTwoFactorRepository: PendingTwoFactorRepository, totpService: TotpService, passkeyService: PasskeyService, backupCodeService: BackupCodeService);
+    /**
+     * Get the 2FA configuration for a user.
+     *
+     * @param userId - The user's ID
+     * @returns The user's TwoFactorConfig, or null if not configured
+     */
+    getConfig(userId: string): Promise<TwoFactorConfig | null>;
+    /**
+     * Get the full 2FA status for a user including available methods.
+     *
+     * @param userId - The user's ID
+     * @returns JSON:API response with 2FA status
+     */
+    getStatus(userId: string): Promise<any>;
+    /**
+     * Enable 2FA for a user.
+     * Requires at least one 2FA method to be configured.
+     *
+     * @param userId - The user's ID
+     * @param preferredMethod - The preferred 2FA method (default: 'totp')
+     * @throws BadRequestException if no 2FA methods are configured
+     * @returns JSON:API response with the 2FA config
+     */
+    enable(userId: string, preferredMethod?: TwoFactorMethod): Promise<any>;
+    /**
+     * Disable 2FA for a user.
+     *
+     * @param userId - The user's ID
+     */
+    disable(userId: string): Promise<TwoFactorConfig | null>;
+    /**
+     * Set the preferred 2FA method for a user.
+     *
+     * @param userId - The user's ID
+     * @param method - The preferred method
+     * @throws BadRequestException if the method is not available
+     */
+    setPreferredMethod(userId: string, method: TwoFactorMethod): Promise<TwoFactorConfig>;
+    /**
+     * Create a pending 2FA session after successful password validation.
+     * This is called by the auth service when a user with 2FA enabled logs in.
+     *
+     * @param userId - The user's ID
+     * @returns The pending session info
+     */
+    createPendingSession(userId: string): Promise<PendingSession>;
+    /**
+     * Get available 2FA methods for a user during login.
+     *
+     * @param userId - The user's ID
+     * @returns Array of available method names
+     */
+    getAvailableMethods(userId: string): Promise<TwoFactorMethod[]>;
+    /**
+     * Verify a TOTP code for 2FA login.
+     *
+     * @param pendingId - The pending session ID from createPendingSession
+     * @param code - The 6-digit TOTP code
+     * @returns JSON:API response with verification result
+     */
+    verifyTotp(pendingId: string, code: string): Promise<any>;
+    /**
+     * Verify a passkey for 2FA login.
+     *
+     * @param pendingId - The pending session ID
+     * @param response - The WebAuthn authentication response
+     * @returns JSON:API response with verification result
+     */
+    verifyPasskey(pendingId: string, response: Parameters<typeof PasskeyService.prototype.verifyAuthentication>[0]["response"]): Promise<any>;
+    /**
+     * Verify a backup code for 2FA login.
+     *
+     * @param pendingId - The pending session ID
+     * @param code - The backup code
+     * @returns JSON:API response with verification result
+     */
+    verifyBackupCode(pendingId: string, code: string): Promise<any>;
+    /**
+     * Get pending session info by ID.
+     *
+     * @param pendingId - The pending session ID
+     * @returns The pending session data if found
+     */
+    getPendingSession(pendingId: string): Promise<{
+        pending: PendingTwoFactor;
+        userId: string;
+    } | null>;
+    /**
+     * Delete a pending session.
+     *
+     * @param pendingId - The pending session ID
+     */
+    deletePendingSession(pendingId: string): Promise<void>;
+    /**
+     * Update backup codes count in the config.
+     * Called after generating or using backup codes.
+     *
+     * @param userId - The user's ID
+     */
+    updateBackupCodesCount(userId: string): Promise<void>;
+    /**
+     * Check if 2FA should be automatically disabled due to no methods remaining.
+     * Called when removing the last TOTP authenticator or passkey.
+     *
+     * @param userId - The user's ID
+     * @returns true if 2FA was disabled
+     */
+    checkAndDisableIfNoMethods(userId: string): Promise<boolean>;
+    /**
+     * Validate a pending session and return its data.
+     *
+     * @param pendingId - The pending session ID
+     * @param expectedType - The expected challenge type
+     * @throws NotFoundException if session not found
+     * @throws BadRequestException if session expired or wrong type
+     */
+    private validateAndGetPending;
+}
+//# sourceMappingURL=two-factor.service.d.ts.map

package/dist/foundations/two-factor/services/two-factor.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"two-factor.service.d.ts","sourceRoot":"","sources":["../../../../src/foundations/two-factor/services/two-factor.service.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,cAAc,EAAE,MAAM,gDAAgD,CAAC;AAChF,OAAO,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AAClE,OAAO,EAAE,eAAe,EAA6B,MAAM,+BAA+B,CAAC;AAG3F,OAAO,EAAE,0BAA0B,EAAE,MAAM,+CAA+C,CAAC;AAC3F,OAAO,EAAE,yBAAyB,EAAE,MAAM,8CAA8C,CAAC;AACzF,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC1D,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAE7C,MAAM,MAAM,eAAe,GAAG,MAAM,GAAG,SAAS,GAAG,QAAQ,CAAC;AAE5D,MAAM,WAAW,eAAe;IAC9B,SAAS,EAAE,OAAO,CAAC;IACnB,eAAe,EAAE,eAAe,CAAC;IACjC,OAAO,EAAE;QACP,IAAI,EAAE,OAAO,CAAC;QACd,OAAO,EAAE,OAAO,CAAC;QACjB,MAAM,EAAE,OAAO,CAAC;KACjB,CAAC;IACF,gBAAgB,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,cAAc;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,IAAI,CAAC;CAClB;AAED,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;GAMG;AACH,qBACa,gBAAgB;IAOzB,OAAO,CAAC,QAAQ,CAAC,cAAc;IAC/B,OAAO,CAAC,QAAQ,CAAC,yBAAyB;IAC1C,OAAO,CAAC,QAAQ,CAAC,0BAA0B;IAC3C,OAAO,CAAC,QAAQ,CAAC,WAAW;IAC5B,OAAO,CAAC,QAAQ,CAAC,cAAc;IAC/B,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IAXpC,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAS;IAC3C,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAK;IACrC,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAK;IACxC,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAK;gBAGpB,cAAc,EAAE,cAAc,EAC9B,yBAAyB,EAAE,yBAAyB,EACpD,0BAA0B,EAAE,0BAA0B,EACtD,WAAW,EAAE,WAAW,EACxB,cAAc,EAAE,cAAc,EAC9B,iBAAiB,EAAE,iBAAiB;IAKvD;;;;;OAKG;IACG,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC;IAKhE;;;;;OAKG;IACG,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC;IAyB7C;;;;;;;;OAQG;IACG,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,eAAe,GAAE,eAAwB,GAAG,OAAO,CAAC,GAAG,CAAC;IAwCrF;;;;OAIG;IACG,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC;IAa9D;;;;;;OAMG;IACG,kBAAkB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,eAAe,GAAG,OAAO,CAAC,eAAe,CAAC;IA+B3F;;;;;;OAMG;IACG,oBAAoB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC;IAsBnE;;;;;OAKG;IACG,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC;IAgBrE;;;;;;OAMG;IACG,UAAU,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC;IAiC/D;;;;;;OAMG;IACG,aAAa,CACjB,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,UAAU,CAAC,OAAO,cAAc,CAAC,SAAS,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GACxF,OAAO,CAAC,GAAG,CAAC;IAkDf;;;;;;OAMG;IACG,gBAAgB,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC;IAwCrE;;;;;OAKG;IACG,iBAAiB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,gBAAgB,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IAIzG;;;;OAIG;IACG,oBAAoB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAI5D;;;;;OAKG;IACG,sBAAsB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAY3D;;;;;;OAMG;IACG,0BAA0B,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAiBlE;;;;;;;OAOG;YACW,qBAAqB;CAyBpC"}