@coderoftime/fints 0.1.0 → 0.3.0

package/dist/session/dialog-runner.js

@@ -2,7 +2,17 @@ import { FinTsBankError, FinTsProtocolError, parseBankData } from '../core/error
 import { continuations, FeedbackCodes, hasCode } from '../core/feedback.js';
 /** Most pages the client fetches for one query, far more than banks send. */
 const maxPages = 1000;
-/** Most data one query may hold, summed over its pages: the transport bounds a single response only. */
+/**
+ * Most further pages of one query that may ask for an approval, as its first page may: enough for a bank that asks anew
+ * for each page of a query of four pages, while the user approves four times per query at most, and loses the pages
+ * approved so far with any approval they cancel.
+ */
+const maxPageApprovals = 3;
+/**
+ * Most data one query may hold, summed over its pages as `IncomingMessage3.size` measures it: the transport and the
+ * parser bound a single response only. The statements and transactions read from them have a budget of their own
+ * (`RecordBudget`).
+ */
 const maxQueryMebibytes = 128;
 /**
  * Keeps one dialog open for all calls and runs the queries in it.
@@ -13,13 +23,9 @@ const maxQueryMebibytes = 128;
  */
 export class DialogRunner {
     setup;
-    responses;
-    prompts;
     dialog;
-    constructor(setup, responses, prompts) {
+    constructor(setup) {
         this.setup = setup;
-        this.responses = responses;
-        this.prompts = prompts;
     }
     /** The open dialog, or a new one once the setup is complete and the user has passed strong authentication. */
     async open() {
@@ -34,7 +40,7 @@ export class DialogRunner {
     async login() {
         const dialog = await this.setup.newDialog();
         try {
-            await this.responses.startDialog(dialog, () => dialog.start());
+            await dialog.login();
             return dialog;
         }
         catch (error) {
@@ -61,31 +67,43 @@ export class DialogRunner {
         const pages = await this.fetchPages(dialog, query.order);
         return parseBankData(() => query.read(pages));
     }
-    /** Sends `order` in `dialog` and completes its approval. */
-    async run(dialog, order) {
-        this.prompts.checkOpen();
+    /** Sends `order` in `dialog` and completes its approval, which `admitApproval` may refuse (`SignedDialog.send`). */
+    async run(dialog, order, admitApproval) {
         try {
-            return await this.responses.complete(dialog, await dialog.send(order));
+            return await dialog.send(order, admitApproval);
         }
         catch (error) {
             // The bank rejected the order and the dialog stays usable, or the bank ended the dialog or rejected the PIN and
-            // the dialog is discarded already. A cancelled or failed approval, or a broken connection, leaves the dialog in an
-            // unknown state.
+            // the dialog is discarded already. A cancelled, failed or refused approval, or a broken connection, leaves the
+            // dialog in an unknown state.
             if (!(error instanceof FinTsBankError))
                 await this.end();
             throw error;
         }
     }
-    /** Sends the order built by `order` until the bank has delivered all pages (Formals B.6.3, "Aufsetzpunkt"). */
+    /**
+     * Sends the order built by `order` until the bank has delivered all pages (Formals B.6.3, "Aufsetzpunkt"), and
+     * completes the approval each asks for, that of `maxPageApprovals` further pages at most.
+     */
     async fetchPages(dialog, order) {
         const pages = [];
         const seen = new Set();
         let size = 0;
+        let pageApprovals = 0;
+        const admitPageApproval = () => {
+            if (pageApprovals === maxPageApprovals) {
+                throw new FinTsProtocolError(`The bank asks for an approval of more than ${maxPageApprovals} further pages of one query; ask for a shorter period`);
+            }
+            pageApprovals++;
+        };
         let continuation;
         for (;;) {
-            const page = await this.run(dialog, order(continuation));
+            const page = await this.run(dialog, order(continuation), continuation === undefined ? undefined : admitPageApproval);
             pages.push(page);
             size += page.size;
+            if (size > maxQueryMebibytes * 1024 * 1024) {
+                throw new FinTsProtocolError(`The bank sends more than ${maxQueryMebibytes} MiB for one query; ask for a shorter period`);
+            }
             const positions = [...continuations(page.feedback)];
             // A message carries one order, so the bank names one position at most.
             if (positions.length > 1)
@@ -98,14 +116,11 @@ export class DialogRunner {
                 }
                 return pages;
             }
-            // A repeated position or endless pages would keep the client busy forever, and unbounded pages exhaust memory.
+            // A repeated position or endless pages would keep the client busy forever.
             if (seen.has(continuation) || pages.length === maxPages) {
                 throw new FinTsProtocolError('The bank does not stop sending pages');
             }
             seen.add(continuation);
-            if (size > maxQueryMebibytes * 1024 * 1024) {
-                throw new FinTsProtocolError(`The bank sends more than ${maxQueryMebibytes} MiB for one query; ask for a shorter period`);
-            }
         }
     }
 }

package/dist/session/dialog-runner.js.map

@@ -1 +1 @@
-{"version":3,"file":"dialog-runner.js","sourceRoot":"","sources":["../../src/session/dialog-runner.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AACtF,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAM5E,6EAA6E;AAC7E,MAAM,QAAQ,GAAG,IAAI,CAAC;AAEtB,wGAAwG;AACxG,MAAM,iBAAiB,GAAG,GAAG,CAAC;AAE9B;;;;;;GAMG;AACH,MAAM,OAAO,YAAY;IAIJ;IACA;IACA;IALX,MAAM,CAAmC;IAEjD,YACmB,KAAyB,EACzB,SAA6B,EAC7B,OAAoB;QAFpB,UAAK,GAAL,KAAK,CAAoB;QACzB,cAAS,GAAT,SAAS,CAAoB;QAC7B,YAAO,GAAP,OAAO,CAAa;IACpC,CAAC;IAEJ,8GAA8G;IAC9G,KAAK,CAAC,IAAI;QACR,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC;QAC5B,IAAI,OAAO,EAAE,QAAQ,KAAK,IAAI;YAAE,OAAO,OAAO,CAAC;QAC/C,IAAI,CAAC,MAAM,GAAG,SAAS,CAAC;QACxB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;QAC7D,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,KAAK,CAAC,KAAK;QACjB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC;QAC5C,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;YAC/D,OAAO,MAAM,CAAC;QAChB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,+GAA+G;YAC/G,4DAA4D;YAC5D,MAAM,MAAM,CAAC,GAAG,EAAE,CAAC;YACnB,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED,6CAA6C;IAC7C,KAAK,CAAC,GAAG;QACP,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC3B,IAAI,CAAC,MAAM,GAAG,SAAS,CAAC;QACxB,MAAM,MAAM,EAAE,GAAG,EAAE,CAAC;IACtB,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,KAAK,CAAI,KAA2B;QACxC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QACjC,MAAM,KAAK,GAAG,KAAK,EAAE,CAAC;QACtB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;QACzD,OAAO,aAAa,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;IAChD,CAAC;IAED,4DAA4D;IACpD,KAAK,CAAC,GAAG,CAAC,MAA4B,EAAE,KAAQ;QACtD,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;QACzB,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QACzE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,gHAAgH;YAChH,mHAAmH;YACnH,iBAAiB;YACjB,IAAI,CAAC,CAAC,KAAK,YAAY,cAAc,CAAC;gBAAE,MAAM,IAAI,CAAC,GAAG,EAAE,CAAC;YACzD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED,+GAA+G;IACvG,KAAK,CAAC,UAAU,CAAC,MAA4B,EAAE,KAA8C;QACnG,MAAM,KAAK,GAAQ,EAAE,CAAC;QACtB,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;QAC/B,IAAI,IAAI,GAAG,CAAC,CAAC;QACb,IAAI,YAAgC,CAAC;QACrC,SAAS,CAAC;YACR,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC;YACzD,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACjB,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC;YAClB,MAAM,SAAS,GAAG,CAAC,GAAG,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;YACpD,uEAAuE;YACvE,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC;gBAAE,MAAM,IAAI,kBAAkB,CAAC,iDAAiD,CAAC,CAAC;YAC1G,YAAY,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;YAC5B,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;gBAC/B,oFAAoF;gBACpF,IAAI,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,aAAa,CAAC,QAAQ,CAAC,EAAE,CAAC;oBACnD,MAAM,IAAI,kBAAkB,CAAC,8DAA8D,CAAC,CAAC;gBAC/F,CAAC;gBACD,OAAO,KAAK,CAAC;YACf,CAAC;YACD,+GAA+G;YAC/G,IAAI,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;gBACxD,MAAM,IAAI,kBAAkB,CAAC,sCAAsC,CAAC,CAAC;YACvE,CAAC;YACD,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;YACvB,IAAI,IAAI,GAAG,iBAAiB,GAAG,IAAI,GAAG,IAAI,EAAE,CAAC;gBAC3C,MAAM,IAAI,kBAAkB,CAC1B,4BAA4B,iBAAiB,8CAA8C,CAC5F,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;CACF"}
+{"version":3,"file":"dialog-runner.js","sourceRoot":"","sources":["../../src/session/dialog-runner.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AACtF,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAO5E,6EAA6E;AAC7E,MAAM,QAAQ,GAAG,IAAI,CAAC;AAEtB;;;;GAIG;AACH,MAAM,gBAAgB,GAAG,CAAC,CAAC;AAE3B;;;;GAIG;AACH,MAAM,iBAAiB,GAAG,GAAG,CAAC;AAE9B;;;;;;GAMG;AACH,MAAM,OAAO,YAAY;IAGM;IAFrB,MAAM,CAA2B;IAEzC,YAA6B,KAAmB;QAAnB,UAAK,GAAL,KAAK,CAAc;IAAG,CAAC;IAEpD,8GAA8G;IAC9G,KAAK,CAAC,IAAI;QACR,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC;QAC5B,IAAI,OAAO,EAAE,QAAQ,KAAK,IAAI;YAAE,OAAO,OAAO,CAAC;QAC/C,IAAI,CAAC,MAAM,GAAG,SAAS,CAAC;QACxB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;QAC7D,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,KAAK,CAAC,KAAK;QACjB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC;QAC5C,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;YACrB,OAAO,MAAM,CAAC;QAChB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,+GAA+G;YAC/G,4DAA4D;YAC5D,MAAM,MAAM,CAAC,GAAG,EAAE,CAAC;YACnB,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED,6CAA6C;IAC7C,KAAK,CAAC,GAAG;QACP,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC3B,IAAI,CAAC,MAAM,GAAG,SAAS,CAAC;QACxB,MAAM,MAAM,EAAE,GAAG,EAAE,CAAC;IACtB,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,KAAK,CAAI,KAAqB;QAClC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QACjC,MAAM,KAAK,GAAG,KAAK,EAAE,CAAC;QACtB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;QACzD,OAAO,aAAa,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;IAChD,CAAC;IAED,oHAAoH;IAC5G,KAAK,CAAC,GAAG,CACf,MAAoB,EACpB,KAAkB,EAClB,aAAuC;QAEvC,IAAI,CAAC;YACH,OAAO,MAAM,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC;QACjD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,gHAAgH;YAChH,+GAA+G;YAC/G,8BAA8B;YAC9B,IAAI,CAAC,CAAC,KAAK,YAAY,cAAc,CAAC;gBAAE,MAAM,IAAI,CAAC,GAAG,EAAE,CAAC;YACzD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,UAAU,CACtB,MAAoB,EACpB,KAAwD;QAExD,MAAM,KAAK,GAAuB,EAAE,CAAC;QACrC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;QAC/B,IAAI,IAAI,GAAG,CAAC,CAAC;QACb,IAAI,aAAa,GAAG,CAAC,CAAC;QACtB,MAAM,iBAAiB,GAAG,GAAS,EAAE;YACnC,IAAI,aAAa,KAAK,gBAAgB,EAAE,CAAC;gBACvC,MAAM,IAAI,kBAAkB,CAC1B,8CAA8C,gBAAgB,uDAAuD,CACtH,CAAC;YACJ,CAAC;YACD,aAAa,EAAE,CAAC;QAClB,CAAC,CAAC;QACF,IAAI,YAAgC,CAAC;QACrC,SAAS,CAAC;YACR,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,GAAG,CACzB,MAAM,EACN,KAAK,CAAC,YAAY,CAAC,EACnB,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,iBAAiB,CAC3D,CAAC;YACF,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACjB,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC;YAClB,IAAI,IAAI,GAAG,iBAAiB,GAAG,IAAI,GAAG,IAAI,EAAE,CAAC;gBAC3C,MAAM,IAAI,kBAAkB,CAC1B,4BAA4B,iBAAiB,8CAA8C,CAC5F,CAAC;YACJ,CAAC;YACD,MAAM,SAAS,GAAG,CAAC,GAAG,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;YACpD,uEAAuE;YACvE,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC;gBAAE,MAAM,IAAI,kBAAkB,CAAC,iDAAiD,CAAC,CAAC;YAC1G,YAAY,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;YAC5B,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;gBAC/B,oFAAoF;gBACpF,IAAI,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,aAAa,CAAC,QAAQ,CAAC,EAAE,CAAC;oBACnD,MAAM,IAAI,kBAAkB,CAAC,8DAA8D,CAAC,CAAC;gBAC/F,CAAC;gBACD,OAAO,KAAK,CAAC;YACf,CAAC;YACD,2EAA2E;YAC3E,IAAI,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;gBACxD,MAAM,IAAI,kBAAkB,CAAC,sCAAsC,CAAC,CAAC;YACvE,CAAC;YACD,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QACzB,CAAC;IACH,CAAC;CACF"}

package/dist/session/login-guard.d.ts

@@ -1,73 +1,78 @@
-import { FinTsBankError } from '../core/errors.js';
+import { FinTsLoginRefusedError, type FinTsBankError } from '../core/errors.js';
+import { type FinTsFeedback } from '../core/feedback.js';
 import type { TanMethod } from '../tan/tan-models.js';
+import type { PinGuard } from '../v3/protocol.js';
 /**
  * The kind of request a bank response answers, which decides what its errors mean for the login (`LoginGuard.judge`)
  * and whether they can reject a TAN:
- * - `login`: the login that opens a dialog;
- * - `loginWithOrder`: a login that carries an order in the same message, whose errors may concern the order alone;
+ * - `login`: the login that opens a dialog, which carries no order;
  * - `order`: an order in a dialog the bank has opened;
  * - `approval`: a message that completes an approval, the TAN or the question whether the user approved in the app.
  */
-export type RequestKind = 'login' | 'loginWithOrder' | 'order' | 'approval';
+export type RequestKind = 'login' | 'order' | 'approval';
 /**
  * A reason for a refused login that the session can take care of by itself, after which it logs in once more: the user
  * may not use the TAN method the login was signed with, or the bank no longer accepts the customer system ID.
  */
 export type RefusalReason = 'tanMethodNotAllowed' | 'systemIdRejected';
+/** What the saved state keeps of the guard: the return codes of the bank's refusal, and `unreadLogins`. */
+export interface LoginGuardState {
+    readonly refusal: readonly FinTsFeedback[] | undefined;
+    readonly unreadLogins: number;
+}
 /**
- * Keeps a retrying app from locking the user's access: once the bank has refused a login, the client does not send the
- * PIN again.
- *
- * Banks lock the access after a few failed attempts, and a return code does not always tell whether the PIN was the
- * reason. So `judge` counts as a refused login:
- * - a rejected PIN, wherever the bank reports it;
- * - any other error in the answer to a login, unless the login carries an order and the bank keeps the dialog open:
- *   then the error concerns the order.
- *
- * Errors in the answer to an order or an approval are no refusal, such as a wrong TAN at login: the bank checks the PIN
- * before it asks for the approval. New login data (return code 3072) end the old ones for good (`refuse`).
+ * Holds the PIN and hands it out only while no login is refused (`pin`), so that a retrying app cannot lock the user's
+ * access. `FinTsLoginRefusedError` tells which logins count as refused; `judge` decides it for each answer.
  *
- * The guard fails closed: a refusal counts from the moment `judge` sees it, and only `pardon` lifts it, once the
- * session has taken care of a `RefusalReason` the refusal names (`remediableReasons`). The protocol calls `check`
- * before every message it signs with the PIN.
+ * A refusal counts at once and fails closed: only `remedied` lifts it, within the call that met it (`runCall`), once
+ * the session has taken care of a reason it names, or has failed the call trying, each reason once per call, so that a
+ * call sends at most three logins the bank refuses. A refusal that outlasts the call is final, and the guard forgets
+ * the PIN; only a PIN the user enters anew lifts it (`replacePin`), unless it brings new login data.
  */
-export declare class LoginGuard {
-    private refusal;
-    /** The TAN method of the refused login; `undefined` without a refusal, and for new login data. */
-    private refusedMethodValue;
-    /** Throws the bank's refusal of an earlier login, so that the PIN is not sent again. */
+export declare class LoginGuard implements PinGuard {
+    #private;
+    private refusalValue;
+    /** The TAN method of the login `refusalValue` refused, which a restored refusal does not tell. */
+    private refusedMethod;
+    /** Logins sent since the bank last took the PIN whose answer the client has not read. */
+    private unreadLogins;
+    /** The refusal of `maxUnreadLogins` unread logins, kept so that `check` throws the same error each time. */
+    private unreadLoginsRefusal;
+    /** The reasons `remedied` has lifted a refusal for in the running call. */
+    private readonly pardonedReasons;
+    constructor(pin: string);
+    /** The PIN to sign a message with; throws the refusal instead (`check`), and `FinTsStateError` once closed. */
+    get pin(): string;
+    /** Throws the refusal, if there is one. */
     check(): void;
-    /** Whether the guard holds a refusal. */
-    get hasRefusal(): boolean;
-    /** The TAN method the refused login was signed with; `undefined` where the guard holds no refusal of a login. */
-    get refusedMethod(): TanMethod | undefined;
+    /** The bank's refusal, else that of `maxUnreadLogins` unread logins; `undefined` while there is none. */
+    get refusal(): FinTsLoginRefusedError | undefined;
+    /** Counts a login signed with the PIN as unread until `judge` reads its answer. */
+    loginSent(): void;
     /**
-     * Whether `error`, raised for the answer to a request of `kind` in a dialog signed with `method`, refuses the login;
-     * records it if it does.
-     *
-     * `dialogOpen` tells whether the bank keeps the dialog open after its answer.
+     * Judges `error`, if the answer to a request of `kind` in a dialog signed with `method` has one: returns the refusal
+     * of the login it amounts to, and records it unless the guard holds one already. Any error refuses a login; after the
+     * login only one that refuses it itself, a rejected PIN or new login data, since the bank checked the PIN before.
      */
-    judge(error: FinTsBankError, kind: RequestKind, dialogOpen: boolean, method: TanMethod): boolean;
-    /** Records `error` as the reason the client logs in no more, unless it holds a refusal already. */
-    refuse(error: FinTsBankError): void;
+    judge(error: FinTsBankError | undefined, kind: RequestKind, method: TanMethod): FinTsLoginRefusedError | undefined;
+    /** Runs `call`, one call of the client; a refusal that outlasts it is final, and the next call remedies anew. */
+    runCall<T>(call: () => Promise<T>): Promise<T>;
     /**
-     * Runs `lookup`, which only completes data, such as the SEPA account list; `undefined` where the bank rejects it, so
-     * that the caller carries on without it.
-     *
-     * A refused login is thrown, and so is a wrong TAN, which the user must hear of. An aborted dialog counts as a
-     * rejection: banks end the dialog along with many.
+     * Runs `attempt`, which may log in, and runs it once more each time `remedy` takes care of a reason the refusal it
+     * failed with names; `remedy` gets the reason and the TAN method of the refused login, and returns whether it could.
      */
-    tryLookUp<T>(lookup: () => Promise<T>): Promise<T | undefined>;
+    remedied<T>(attempt: () => Promise<T>, remedy: (reason: RefusalReason, rejected: TanMethod) => Promise<boolean>): Promise<T>;
     /**
-     * The reasons the session can take care of in `error`: 3920 without the TAN method of the refused login, 9075 after
-     * the one-step method, and 9391. Empty if `error` is not the refusal the guard holds, rejects the PIN, or brings new
-     * login data.
-     *
-     * Only the return codes of the refusal itself count: TAN methods listed earlier say nothing about this login.
+     * Signs with `pin` from now on, a PIN the user has entered anew and the protocol can send, and lifts the refusal.
+     * Throws the refusal instead where it brings new login data, which end the old ones for good.
      */
-    remediableReasons(error: FinTsBankError): RefusalReason[];
-    /** Lifts `refusal` once the session has taken care of its reason, so that the next login may send the PIN. */
-    pardon(refusal: FinTsBankError): void;
-    private isRefusal;
+    replacePin(pin: string): void;
+    /** Forgets the PIN; the client calls it once it is closed. */
+    close(): void;
+    saveState(): LoginGuardState;
+    /** Restores what `saveState` returned; a restored refusal is final, also one without return codes. */
+    restoreState(saved: LoginGuardState): void;
+    private liftRefusal;
+    private forgetPinIfRefused;
 }
 //# sourceMappingURL=login-guard.d.ts.map

package/dist/session/login-guard.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"login-guard.d.ts","sourceRoot":"","sources":["../../src/session/login-guard.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAA4D,MAAM,mBAAmB,CAAC;AAE7G,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAEtD;;;;;;;GAOG;AACH,MAAM,MAAM,WAAW,GAAG,OAAO,GAAG,gBAAgB,GAAG,OAAO,GAAG,UAAU,CAAC;AAE5E;;;GAGG;AACH,MAAM,MAAM,aAAa,GAAG,qBAAqB,GAAG,kBAAkB,CAAC;AAEvE;;;;;;;;;;;;;;;;GAgBG;AACH,qBAAa,UAAU;IACrB,OAAO,CAAC,OAAO,CAA6B;IAE5C,kGAAkG;IAClG,OAAO,CAAC,kBAAkB,CAAwB;IAElD,wFAAwF;IACxF,KAAK,IAAI,IAAI;IAIb,yCAAyC;IACzC,IAAI,UAAU,IAAI,OAAO,CAExB;IAED,iHAAiH;IACjH,IAAI,aAAa,IAAI,SAAS,GAAG,SAAS,CAEzC;IAED;;;;;OAKG;IACH,KAAK,CAAC,KAAK,EAAE,cAAc,EAAE,IAAI,EAAE,WAAW,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,GAAG,OAAO;IAShG,mGAAmG;IACnG,MAAM,CAAC,KAAK,EAAE,cAAc,GAAG,IAAI;IAInC;;;;;;OAMG;IACG,SAAS,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,GAAG,SAAS,CAAC;IASpE;;;;;;OAMG;IACH,iBAAiB,CAAC,KAAK,EAAE,cAAc,GAAG,aAAa,EAAE;IAuBzD,8GAA8G;IAC9G,MAAM,CAAC,OAAO,EAAE,cAAc,GAAG,IAAI;IAMrC,OAAO,CAAC,SAAS;CAGlB"}
+{"version":3,"file":"login-guard.d.ts","sourceRoot":"","sources":["../../src/session/login-guard.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,sBAAsB,EAGtB,KAAK,cAAc,EACpB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAA+C,KAAK,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACtG,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAElD;;;;;;GAMG;AACH,MAAM,MAAM,WAAW,GAAG,OAAO,GAAG,OAAO,GAAG,UAAU,CAAC;AAEzD;;;GAGG;AACH,MAAM,MAAM,aAAa,GAAG,qBAAqB,GAAG,kBAAkB,CAAC;AAEvE,2GAA2G;AAC3G,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,OAAO,EAAE,SAAS,aAAa,EAAE,GAAG,SAAS,CAAC;IACvD,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B;AAQD;;;;;;;;GAQG;AACH,qBAAa,UAAW,YAAW,QAAQ;;IAIzC,OAAO,CAAC,YAAY,CAAqC;IAEzD,kGAAkG;IAClG,OAAO,CAAC,aAAa,CAAwB;IAE7C,yFAAyF;IACzF,OAAO,CAAC,YAAY,CAAK;IAEzB,4GAA4G;IAC5G,OAAO,CAAC,mBAAmB,CAAqC;IAEhE,2EAA2E;IAC3E,OAAO,CAAC,QAAQ,CAAC,eAAe,CAA4B;gBAEhD,GAAG,EAAE,MAAM;IAIvB,+GAA+G;IAC/G,IAAI,GAAG,IAAI,MAAM,CAIhB;IAED,2CAA2C;IAC3C,KAAK,IAAI,IAAI;IAKb,yGAAyG;IACzG,IAAI,OAAO,IAAI,sBAAsB,GAAG,SAAS,CAQhD;IAED,mFAAmF;IACnF,SAAS,IAAI,IAAI;IAIjB;;;;OAIG;IACH,KAAK,CAAC,KAAK,EAAE,cAAc,GAAG,SAAS,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,SAAS,GAAG,sBAAsB,GAAG,SAAS;IAYlH,iHAAiH;IAC3G,OAAO,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;IASpD;;;OAGG;IACG,QAAQ,CAAC,CAAC,EACd,OAAO,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,EACzB,MAAM,EAAE,CAAC,MAAM,EAAE,aAAa,EAAE,QAAQ,EAAE,SAAS,KAAK,OAAO,CAAC,OAAO,CAAC,GACvE,OAAO,CAAC,CAAC,CAAC;IA2Bb;;;OAGG;IACH,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI;IAQ7B,8DAA8D;IAC9D,KAAK,IAAI,IAAI;IAIb,SAAS,IAAI,eAAe;IAI5B,sGAAsG;IACtG,YAAY,CAAC,KAAK,EAAE,eAAe,GAAG,IAAI;IAW1C,OAAO,CAAC,WAAW;IAKnB,OAAO,CAAC,kBAAkB;CAG3B"}

package/dist/session/login-guard.js

@@ -1,109 +1,196 @@
-import { FinTsBankError, FinTsLoginDataChangedError, FinTsPinError, FinTsTanError } from '../core/errors.js';
+import { clientClosedError, FinTsLoginDataChangedError, FinTsLoginRefusedError, FinTsPinError, loginRefusalFor, } from '../core/errors.js';
 import { allowedTanMethodsIn, FeedbackCodes, hasCode } from '../core/feedback.js';
 /**
- * Keeps a retrying app from locking the user's access: once the bank has refused a login, the client does not send the
- * PIN again.
- *
- * Banks lock the access after a few failed attempts, and a return code does not always tell whether the PIN was the
- * reason. So `judge` counts as a refused login:
- * - a rejected PIN, wherever the bank reports it;
- * - any other error in the answer to a login, unless the login carries an order and the bank keeps the dialog open:
- *   then the error concerns the order.
- *
- * Errors in the answer to an order or an approval are no refusal, such as a wrong TAN at login: the bank checks the PIN
- * before it asks for the approval. New login data (return code 3072) end the old ones for good (`refuse`).
+ * Logins in a row whose answer the client could not read, after which it sends the PIN no more: one may be a glitch of
+ * the connection, but with two the client would not learn of a wrong PIN before the bank locks the access.
+ */
+const maxUnreadLogins = 2;
+/**
+ * Holds the PIN and hands it out only while no login is refused (`pin`), so that a retrying app cannot lock the user's
+ * access. `FinTsLoginRefusedError` tells which logins count as refused; `judge` decides it for each answer.
  *
- * The guard fails closed: a refusal counts from the moment `judge` sees it, and only `pardon` lifts it, once the
- * session has taken care of a `RefusalReason` the refusal names (`remediableReasons`). The protocol calls `check`
- * before every message it signs with the PIN.
+ * A refusal counts at once and fails closed: only `remedied` lifts it, within the call that met it (`runCall`), once
+ * the session has taken care of a reason it names, or has failed the call trying, each reason once per call, so that a
+ * call sends at most three logins the bank refuses. A refusal that outlasts the call is final, and the guard forgets
+ * the PIN; only a PIN the user enters anew lifts it (`replacePin`), unless it brings new login data.
  */
 export class LoginGuard {
-    refusal;
-    /** The TAN method of the refused login; `undefined` without a refusal, and for new login data. */
-    refusedMethodValue;
-    /** Throws the bank's refusal of an earlier login, so that the PIN is not sent again. */
+    // ECMAScript private, so that neither `util.inspect` nor `JSON.stringify` of the client reaches it.
+    #pin;
+    refusalValue;
+    /** The TAN method of the login `refusalValue` refused, which a restored refusal does not tell. */
+    refusedMethod;
+    /** Logins sent since the bank last took the PIN whose answer the client has not read. */
+    unreadLogins = 0;
+    /** The refusal of `maxUnreadLogins` unread logins, kept so that `check` throws the same error each time. */
+    unreadLoginsRefusal;
+    /** The reasons `remedied` has lifted a refusal for in the running call. */
+    pardonedReasons = new Set();
+    constructor(pin) {
+        this.#pin = pin;
+    }
+    /** The PIN to sign a message with; throws the refusal instead (`check`), and `FinTsStateError` once closed. */
+    get pin() {
+        this.check();
+        if (this.#pin === undefined)
+            throw clientClosedError();
+        return this.#pin;
+    }
+    /** Throws the refusal, if there is one. */
     check() {
-        if (this.refusal !== undefined)
-            throw this.refusal;
+        const refusal = this.refusal;
+        if (refusal !== undefined)
+            throw refusal;
     }
-    /** Whether the guard holds a refusal. */
-    get hasRefusal() {
-        return this.refusal !== undefined;
+    /** The bank's refusal, else that of `maxUnreadLogins` unread logins; `undefined` while there is none. */
+    get refusal() {
+        if (this.refusalValue !== undefined || this.unreadLogins < maxUnreadLogins)
+            return this.refusalValue;
+        this.unreadLoginsRefusal ??= new FinTsLoginRefusedError([], `The answers to the last ${maxUnreadLogins} logins were lost or unreadable, and the bank may have counted them ` +
+            'as failed attempts');
+        return this.unreadLoginsRefusal;
     }
-    /** The TAN method the refused login was signed with; `undefined` where the guard holds no refusal of a login. */
-    get refusedMethod() {
-        return this.refusedMethodValue;
+    /** Counts a login signed with the PIN as unread until `judge` reads its answer. */
+    loginSent() {
+        this.unreadLogins++;
     }
     /**
-     * Whether `error`, raised for the answer to a request of `kind` in a dialog signed with `method`, refuses the login;
-     * records it if it does.
-     *
-     * `dialogOpen` tells whether the bank keeps the dialog open after its answer.
+     * Judges `error`, if the answer to a request of `kind` in a dialog signed with `method` has one: returns the refusal
+     * of the login it amounts to, and records it unless the guard holds one already. Any error refuses a login; after the
+     * login only one that refuses it itself, a rejected PIN or new login data, since the bank checked the PIN before.
      */
-    judge(error, kind, dialogOpen, method) {
-        const refused = error instanceof FinTsPinError || kind === 'login' || (kind === 'loginWithOrder' && !dialogOpen);
-        if (refused && this.refusal === undefined) {
-            this.refusal = error;
-            this.refusedMethodValue = method;
+    judge(error, kind, method) {
+        const refused = error instanceof FinTsLoginRefusedError || (error !== undefined && kind === 'login');
+        if (kind === 'login')
+            this.unreadLogins = refused ? Math.max(0, this.unreadLogins - 1) : 0;
+        if (!refused)
+            return undefined;
+        const refusal = loginRefusalFor(error.feedback);
+        if (this.refusalValue === undefined) {
+            this.refusalValue = refusal;
+            this.refusedMethod = method;
         }
-        return refused;
+        return refusal;
     }
-    /** Records `error` as the reason the client logs in no more, unless it holds a refusal already. */
-    refuse(error) {
-        this.refusal ??= error;
-    }
-    /**
-     * Runs `lookup`, which only completes data, such as the SEPA account list; `undefined` where the bank rejects it, so
-     * that the caller carries on without it.
-     *
-     * A refused login is thrown, and so is a wrong TAN, which the user must hear of. An aborted dialog counts as a
-     * rejection: banks end the dialog along with many.
-     */
-    async tryLookUp(lookup) {
+    /** Runs `call`, one call of the client; a refusal that outlasts it is final, and the next call remedies anew. */
+    async runCall(call) {
         try {
-            return await lookup();
+            return await call();
         }
-        catch (error) {
-            if (!(error instanceof FinTsBankError) || this.isRefusal(error) || error instanceof FinTsTanError)
-                throw error;
-            return undefined;
+        finally {
+            this.pardonedReasons.clear();
+            this.forgetPinIfRefused();
         }
     }
     /**
-     * The reasons the session can take care of in `error`: 3920 without the TAN method of the refused login, 9075 after
-     * the one-step method, and 9391. Empty if `error` is not the refusal the guard holds, rejects the PIN, or brings new
-     * login data.
-     *
-     * Only the return codes of the refusal itself count: TAN methods listed earlier say nothing about this login.
+     * Runs `attempt`, which may log in, and runs it once more each time `remedy` takes care of a reason the refusal it
+     * failed with names; `remedy` gets the reason and the TAN method of the refused login, and returns whether it could.
      */
-    remediableReasons(error) {
-        const method = this.refusedMethodValue;
-        if (!this.isRefusal(error) ||
-            method === undefined ||
-            error instanceof FinTsPinError ||
-            error instanceof FinTsLoginDataChangedError) {
-            return [];
+    async remedied(attempt, remedy) {
+        // A refusal of an earlier call stops the attempt before it sends the PIN; there is nothing to remedy.
+        if (this.refusal !== undefined)
+            return attempt();
+        for (;;) {
+            try {
+                return await attempt();
+            }
+            catch (error) {
+                const refusal = this.refusalValue;
+                const rejected = this.refusedMethod;
+                // Only the bank's refusal the guard holds names reasons; any other error, a second refusal too, fails the call.
+                if (refusal === undefined || error !== refusal || rejected === undefined)
+                    throw error;
+                const reason = remediableReasons(refusal, rejected).find((r) => !this.pardonedReasons.has(r));
+                if (reason === undefined)
+                    throw error;
+                this.pardonedReasons.add(reason);
+                // The refusal named a reason the session takes care of, not the PIN, so it does not outlast a remedy that fails,
+                // such as a TAN method prompt the app ends: the call fails with the remedy's own error. On a closed client the
+                // next attempt fails before it sends anything.
+                const remedied = await remedy(reason, rejected).catch((remedyError) => {
+                    this.liftRefusal();
+                    throw remedyError;
+                });
+                if (!remedied)
+                    throw error;
+                this.liftRefusal();
+            }
         }
-        const feedback = error.feedback;
-        const allowed = allowedTanMethodsIn(feedback);
-        const reasons = [];
-        if ((allowed.length > 0 && !allowed.includes(method.securityFunction)) ||
-            (method.isOneStep && hasCode(feedback, FeedbackCodes.scaRequired))) {
-            reasons.push('tanMethodNotAllowed');
+    }
+    /**
+     * Signs with `pin` from now on, a PIN the user has entered anew and the protocol can send, and lifts the refusal.
+     * Throws the refusal instead where it brings new login data, which end the old ones for good.
+     */
+    replacePin(pin) {
+        if (this.refusalValue instanceof FinTsLoginDataChangedError)
+            throw this.refusalValue;
+        this.#pin = pin;
+        this.liftRefusal();
+        this.unreadLogins = 0;
+        this.unreadLoginsRefusal = undefined;
+    }
+    /** Forgets the PIN; the client calls it once it is closed. */
+    close() {
+        this.#pin = undefined;
+    }
+    saveState() {
+        return { refusal: this.refusalValue?.feedback, unreadLogins: this.unreadLogins };
+    }
+    /** Restores what `saveState` returned; a restored refusal is final, also one without return codes. */
+    restoreState(saved) {
+        if (saved.refusal !== undefined) {
+            this.refusalValue =
+                saved.refusal.length > 0
+                    ? loginRefusalFor(saved.refusal)
+                    : new FinTsLoginRefusedError([], 'A login was refused, and the saved state no longer tells why');
         }
-        if (hasCode(feedback, FeedbackCodes.newSystemIdRequired))
-            reasons.push('systemIdRejected');
-        return reasons;
+        this.unreadLogins = Math.max(0, saved.unreadLogins);
+        this.forgetPinIfRefused();
     }
-    /** Lifts `refusal` once the session has taken care of its reason, so that the next login may send the PIN. */
-    pardon(refusal) {
-        if (!this.isRefusal(refusal))
-            return;
-        this.refusal = undefined;
-        this.refusedMethodValue = undefined;
+    liftRefusal() {
+        this.refusalValue = undefined;
+        this.refusedMethod = undefined;
     }
-    isRefusal(error) {
-        return error === this.refusal;
+    forgetPinIfRefused() {
+        if (this.refusal !== undefined)
+            this.#pin = undefined;
     }
 }
+/**
+ * The reasons `refusal`, of a login signed with `method`, names that the session can take care of: a TAN method the
+ * refusal names as not allowed (`refusesMethod`), and 9391. None for a rejected PIN or new login data.
+ */
+function remediableReasons(refusal, method) {
+    if (refusal instanceof FinTsPinError || refusal instanceof FinTsLoginDataChangedError)
+        return [];
+    const reasons = [];
+    if (refusesMethod(refusal.feedback, method))
+        reasons.push('tanMethodNotAllowed');
+    if (hasCode(refusal.feedback, FeedbackCodes.newSystemIdRequired))
+        reasons.push('systemIdRejected');
+    return reasons;
+}
+/**
+ * Error codes that cannot be about the PIN: 9050 (the message contains errors) and 9800, which only say that the
+ * message failed, and 9955 (the one-step method is not allowed).
+ */
+const errorsNotAboutThePin = new Set(['9050', FeedbackCodes.dialogAborted, '9955']);
+/**
+ * Whether `feedback`, which refuses a login signed with `method`, names the method as the reason: a 3920 that lists the
+ * methods the user may use without it, or 9075 after the one-step method.
+ *
+ * Only the return codes of the refusal itself count: TAN methods listed earlier say nothing about this login. Banks
+ * list two-step methods only, so a 3920 always leaves the one-step method out, also where the login succeeds. After
+ * the one-step method a 3920 counts only where the bank names no other error than one not about the PIN: any other,
+ * such as "Anmeldung fehlgeschlagen", may be about it. PIN/TAN B.8.2 has the bank answer a one-step dialog of a user
+ * bound to two-step methods with 9955 and 3920.
+ */
+function refusesMethod(feedback, method) {
+    if (method.isOneStep && hasCode(feedback, FeedbackCodes.scaRequired))
+        return true;
+    const allowed = allowedTanMethodsIn(feedback);
+    if (allowed.length === 0 || allowed.includes(method.securityFunction))
+        return false;
+    return !method.isOneStep || feedback.every((f) => !f.isError || errorsNotAboutThePin.has(f.code));
+}
 //# sourceMappingURL=login-guard.js.map

package/dist/session/login-guard.js.map

@@ -1 +1 @@
-{"version":3,"file":"login-guard.js","sourceRoot":"","sources":["../../src/session/login-guard.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,0BAA0B,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAC7G,OAAO,EAAE,mBAAmB,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAmBlF;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,OAAO,UAAU;IACb,OAAO,CAA6B;IAE5C,kGAAkG;IAC1F,kBAAkB,CAAwB;IAElD,wFAAwF;IACxF,KAAK;QACH,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS;YAAE,MAAM,IAAI,CAAC,OAAO,CAAC;IACrD,CAAC;IAED,yCAAyC;IACzC,IAAI,UAAU;QACZ,OAAO,IAAI,CAAC,OAAO,KAAK,SAAS,CAAC;IACpC,CAAC;IAED,iHAAiH;IACjH,IAAI,aAAa;QACf,OAAO,IAAI,CAAC,kBAAkB,CAAC;IACjC,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,KAAqB,EAAE,IAAiB,EAAE,UAAmB,EAAE,MAAiB;QACpF,MAAM,OAAO,GAAG,KAAK,YAAY,aAAa,IAAI,IAAI,KAAK,OAAO,IAAI,CAAC,IAAI,KAAK,gBAAgB,IAAI,CAAC,UAAU,CAAC,CAAC;QACjH,IAAI,OAAO,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1C,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC;YACrB,IAAI,CAAC,kBAAkB,GAAG,MAAM,CAAC;QACnC,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,mGAAmG;IACnG,MAAM,CAAC,KAAqB;QAC1B,IAAI,CAAC,OAAO,KAAK,KAAK,CAAC;IACzB,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,SAAS,CAAI,MAAwB;QACzC,IAAI,CAAC;YACH,OAAO,MAAM,MAAM,EAAE,CAAC;QACxB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,CAAC,KAAK,YAAY,cAAc,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,YAAY,aAAa;gBAAE,MAAM,KAAK,CAAC;YAC/G,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACH,iBAAiB,CAAC,KAAqB;QACrC,MAAM,MAAM,GAAG,IAAI,CAAC,kBAAkB,CAAC;QACvC,IACE,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;YACtB,MAAM,KAAK,SAAS;YACpB,KAAK,YAAY,aAAa;YAC9B,KAAK,YAAY,0BAA0B,EAC3C,CAAC;YACD,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC;QAChC,MAAM,OAAO,GAAG,mBAAmB,CAAC,QAAQ,CAAC,CAAC;QAC9C,MAAM,OAAO,GAAoB,EAAE,CAAC;QACpC,IACE,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;YAClE,CAAC,MAAM,CAAC,SAAS,IAAI,OAAO,CAAC,QAAQ,EAAE,aAAa,CAAC,WAAW,CAAC,CAAC,EAClE,CAAC;YACD,OAAO,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;QACtC,CAAC;QACD,IAAI,OAAO,CAAC,QAAQ,EAAE,aAAa,CAAC,mBAAmB,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;QAC3F,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,8GAA8G;IAC9G,MAAM,CAAC,OAAuB;QAC5B,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;YAAE,OAAO;QACrC,IAAI,CAAC,OAAO,GAAG,SAAS,CAAC;QACzB,IAAI,CAAC,kBAAkB,GAAG,SAAS,CAAC;IACtC,CAAC;IAEO,SAAS,CAAC,KAAc;QAC9B,OAAO,KAAK,KAAK,IAAI,CAAC,OAAO,CAAC;IAChC,CAAC;CACF"}
+{"version":3,"file":"login-guard.js","sourceRoot":"","sources":["../../src/session/login-guard.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,iBAAiB,EACjB,0BAA0B,EAC1B,sBAAsB,EACtB,aAAa,EACb,eAAe,GAEhB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,mBAAmB,EAAE,aAAa,EAAE,OAAO,EAAsB,MAAM,qBAAqB,CAAC;AAyBtG;;;GAGG;AACH,MAAM,eAAe,GAAG,CAAC,CAAC;AAE1B;;;;;;;;GAQG;AACH,MAAM,OAAO,UAAU;IACrB,oGAAoG;IACpG,IAAI,CAAqB;IAEjB,YAAY,CAAqC;IAEzD,kGAAkG;IAC1F,aAAa,CAAwB;IAE7C,yFAAyF;IACjF,YAAY,GAAG,CAAC,CAAC;IAEzB,4GAA4G;IACpG,mBAAmB,CAAqC;IAEhE,2EAA2E;IAC1D,eAAe,GAAG,IAAI,GAAG,EAAiB,CAAC;IAE5D,YAAY,GAAW;QACrB,IAAI,CAAC,IAAI,GAAG,GAAG,CAAC;IAClB,CAAC;IAED,+GAA+G;IAC/G,IAAI,GAAG;QACL,IAAI,CAAC,KAAK,EAAE,CAAC;QACb,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS;YAAE,MAAM,iBAAiB,EAAE,CAAC;QACvD,OAAO,IAAI,CAAC,IAAI,CAAC;IACnB,CAAC;IAED,2CAA2C;IAC3C,KAAK;QACH,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;QAC7B,IAAI,OAAO,KAAK,SAAS;YAAE,MAAM,OAAO,CAAC;IAC3C,CAAC;IAED,yGAAyG;IACzG,IAAI,OAAO;QACT,IAAI,IAAI,CAAC,YAAY,KAAK,SAAS,IAAI,IAAI,CAAC,YAAY,GAAG,eAAe;YAAE,OAAO,IAAI,CAAC,YAAY,CAAC;QACrG,IAAI,CAAC,mBAAmB,KAAK,IAAI,sBAAsB,CACrD,EAAE,EACF,2BAA2B,eAAe,sEAAsE;YAC9G,oBAAoB,CACvB,CAAC;QACF,OAAO,IAAI,CAAC,mBAAmB,CAAC;IAClC,CAAC;IAED,mFAAmF;IACnF,SAAS;QACP,IAAI,CAAC,YAAY,EAAE,CAAC;IACtB,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,KAAiC,EAAE,IAAiB,EAAE,MAAiB;QAC3E,MAAM,OAAO,GAAG,KAAK,YAAY,sBAAsB,IAAI,CAAC,KAAK,KAAK,SAAS,IAAI,IAAI,KAAK,OAAO,CAAC,CAAC;QACrG,IAAI,IAAI,KAAK,OAAO;YAAE,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,YAAY,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3F,IAAI,CAAC,OAAO;YAAE,OAAO,SAAS,CAAC;QAC/B,MAAM,OAAO,GAAG,eAAe,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAChD,IAAI,IAAI,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;YACpC,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC;YAC5B,IAAI,CAAC,aAAa,GAAG,MAAM,CAAC;QAC9B,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,iHAAiH;IACjH,KAAK,CAAC,OAAO,CAAI,IAAsB;QACrC,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,EAAE,CAAC;QACtB,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,CAAC;YAC7B,IAAI,CAAC,kBAAkB,EAAE,CAAC;QAC5B,CAAC;IACH,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,QAAQ,CACZ,OAAyB,EACzB,MAAwE;QAExE,sGAAsG;QACtG,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS;YAAE,OAAO,OAAO,EAAE,CAAC;QACjD,SAAS,CAAC;YACR,IAAI,CAAC;gBACH,OAAO,MAAM,OAAO,EAAE,CAAC;YACzB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,CAAC;gBAClC,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,CAAC;gBACpC,gHAAgH;gBAChH,IAAI,OAAO,KAAK,SAAS,IAAI,KAAK,KAAK,OAAO,IAAI,QAAQ,KAAK,SAAS;oBAAE,MAAM,KAAK,CAAC;gBACtF,MAAM,MAAM,GAAG,iBAAiB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC9F,IAAI,MAAM,KAAK,SAAS;oBAAE,MAAM,KAAK,CAAC;gBACtC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;gBACjC,iHAAiH;gBACjH,+GAA+G;gBAC/G,+CAA+C;gBAC/C,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,KAAK,CAAC,CAAC,WAAoB,EAAE,EAAE;oBAC7E,IAAI,CAAC,WAAW,EAAE,CAAC;oBACnB,MAAM,WAAW,CAAC;gBACpB,CAAC,CAAC,CAAC;gBACH,IAAI,CAAC,QAAQ;oBAAE,MAAM,KAAK,CAAC;gBAC3B,IAAI,CAAC,WAAW,EAAE,CAAC;YACrB,CAAC;QACH,CAAC;IACH,CAAC;IAED;;;OAGG;IACH,UAAU,CAAC,GAAW;QACpB,IAAI,IAAI,CAAC,YAAY,YAAY,0BAA0B;YAAE,MAAM,IAAI,CAAC,YAAY,CAAC;QACrF,IAAI,CAAC,IAAI,GAAG,GAAG,CAAC;QAChB,IAAI,CAAC,WAAW,EAAE,CAAC;QACnB,IAAI,CAAC,YAAY,GAAG,CAAC,CAAC;QACtB,IAAI,CAAC,mBAAmB,GAAG,SAAS,CAAC;IACvC,CAAC;IAED,8DAA8D;IAC9D,KAAK;QACH,IAAI,CAAC,IAAI,GAAG,SAAS,CAAC;IACxB,CAAC;IAED,SAAS;QACP,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,YAAY,EAAE,QAAQ,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC;IACnF,CAAC;IAED,sGAAsG;IACtG,YAAY,CAAC,KAAsB;QACjC,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;YAChC,IAAI,CAAC,YAAY;gBACf,KAAK,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC;oBACtB,CAAC,CAAC,eAAe,CAAC,KAAK,CAAC,OAAO,CAAC;oBAChC,CAAC,CAAC,IAAI,sBAAsB,CAAC,EAAE,EAAE,8DAA8D,CAAC,CAAC;QACvG,CAAC;QACD,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;QACpD,IAAI,CAAC,kBAAkB,EAAE,CAAC;IAC5B,CAAC;IAEO,WAAW;QACjB,IAAI,CAAC,YAAY,GAAG,SAAS,CAAC;QAC9B,IAAI,CAAC,aAAa,GAAG,SAAS,CAAC;IACjC,CAAC;IAEO,kBAAkB;QACxB,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS;YAAE,IAAI,CAAC,IAAI,GAAG,SAAS,CAAC;IACxD,CAAC;CACF;AAED;;;GAGG;AACH,SAAS,iBAAiB,CAAC,OAA+B,EAAE,MAAiB;IAC3E,IAAI,OAAO,YAAY,aAAa,IAAI,OAAO,YAAY,0BAA0B;QAAE,OAAO,EAAE,CAAC;IACjG,MAAM,OAAO,GAAoB,EAAE,CAAC;IACpC,IAAI,aAAa,CAAC,OAAO,CAAC,QAAQ,EAAE,MAAM,CAAC;QAAE,OAAO,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;IACjF,IAAI,OAAO,CAAC,OAAO,CAAC,QAAQ,EAAE,aAAa,CAAC,mBAAmB,CAAC;QAAE,OAAO,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;IACnG,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;GAGG;AACH,MAAM,oBAAoB,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,aAAa,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC,CAAC;AAEpF;;;;;;;;;GASG;AACH,SAAS,aAAa,CAAC,QAAkC,EAAE,MAAiB;IAC1E,IAAI,MAAM,CAAC,SAAS,IAAI,OAAO,CAAC,QAAQ,EAAE,aAAa,CAAC,WAAW,CAAC;QAAE,OAAO,IAAI,CAAC;IAClF,MAAM,OAAO,GAAG,mBAAmB,CAAC,QAAQ,CAAC,CAAC;IAC9C,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,gBAAgB,CAAC;QAAE,OAAO,KAAK,CAAC;IACpF,OAAO,CAAC,MAAM,CAAC,SAAS,IAAI,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,IAAI,oBAAoB,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;AACpG,CAAC"}