@dax-crafta/auth 2.1.6 → 2.1.8

package/src/middlewares/auth.middleware.js

@@ -2,6 +2,8 @@
 const rateLimit = require('express-rate-limit');
 const jwt = require('jsonwebtoken');
 
+const ApiError = require('../utils/api-error');
+
 const createAuthMiddleware = (config) => {
   const noOpLimiter = (_req, _res, next) => next();
   const rateLimitEnabled = config?.features?.rateLimit !== false;
@@ -46,55 +48,98 @@ const createAuthMiddleware = (config) => {
     message: { success: false, error: 'Too many refresh attempts' }
   }) : noOpLimiter;
 
+  // Register limiter
+  const registerLimiter = rateLimitEnabled ? rateLimit({
+    windowMs: 15 * 60 * 1000,
+    max: config?.limits?.registerMax || 20,
+    message: { success: false, error: 'Too many registration attempts, please try later' },
+    standardHeaders: true,
+    legacyHeaders: false
+  }) : noOpLimiter;
+
   // Expose function to choose limiter per-route
   const limiterFor = (routeName) => {
-    switch (routeName) {
-      case 'login': return loginLimiter;
-      case '2fa': return twoFALimiter;
-      case 'forgotPassword': return forgotPasswordLimiter;
-      case 'refreshToken': return refreshLimiter;
-      case 'refresh': return refreshLimiter;
-      default: return genericLimiter;
+    const routeLimits = {
+      login: loginLimiter,
+      '2fa': twoFALimiter,
+      forgotPassword: forgotPasswordLimiter,
+      refreshToken: refreshLimiter,
+      refresh: refreshLimiter,
+      register: registerLimiter
+    };
+
+    if (config.limits && config.limits[routeName]) {
+      return rateLimit({
+        windowMs: 15 * 60 * 1000,
+        max: config.limits[routeName],
+        standardHeaders: true,
+        legacyHeaders: false
+      });
     }
+
+    return routeLimits[routeName] || genericLimiter;
   };
 
 
   const extractToken = (req) => {
-    const authHeader = req.headers.authorization;
-    if (authHeader && authHeader.startsWith('Bearer ')) {
+    const headers = req.headers || {};
+    let authHeader = headers.authorization;
+    // Guard: duplicate headers arrive as arrays — take first string element
+    if (Array.isArray(authHeader)) {
+      authHeader = authHeader.find(h => typeof h === 'string') || null;
+    }
+    if (typeof authHeader === 'string' && authHeader.startsWith('Bearer ')) {
       return authHeader.split(' ')[1];
     }
 
-    if (req.headers['x-access-token']) {
-      return req.headers['x-access-token'];
+    let xAccess = headers['x-access-token'];
+    if (Array.isArray(xAccess)) {
+      xAccess = xAccess.find(h => typeof h === 'string') || null;
+    }
+    if (typeof xAccess === 'string') {
+      return xAccess;
     }
 
     return null;
   };
 
-  const verifyToken = (req, res, next) => {
+  const verifyToken = async (req, res, next) => {
     const token = extractToken(req);
     if (!token) {
-      return res.status(401).json({ success: false, error: 'No token provided' });
+      return next(ApiError.unauthorized('No token provided'));
     }
 
     try {
       const decoded = jwt.verify(token, config.env.JWT_SECRET);
+
+      // Validate session version and IP binding if sessionService is available
+      if (req.app && req.app.sessionService) {
+        const User = require('../models/user');
+        const user = await User.findById(decoded.id);
+        if (!user) {
+          return next(ApiError.unauthorized('User not found'));
+        }
+        req.app.sessionService.validateSession(decoded, user, req.ip);
+      }
+
       // keep minimal user data on req.user
       req.user = { id: decoded.id, role: decoded.role, email: decoded.email };
       next();
     } catch (err) {
-      return res.status(401).json({ success: false, error: 'Invalid or expired token' });
+      if (err.name === 'TokenExpiredError') {
+        return next(ApiError.expiredToken());
+      }
+      return next(ApiError.invalidToken());
     }
   };
 
   const checkRole = (roles = []) => {
     return (req, res, next) => {
       if (!req.user) {
-        return res.status(401).json({ success: false, error: 'Unauthorized' });
+        return next(ApiError.unauthorized());
       }
       if (!roles.includes(req.user.role)) {
-        return res.status(403).json({ success: false, error: 'Insufficient permissions' });
+        return next(ApiError.forbidden());
       }
       next();
     };
@@ -105,13 +150,13 @@ const createAuthMiddleware = (config) => {
     return async (req, res, next) => {
       try {
         const targetId = typeof getTargetUserId === 'function' ? getTargetUserId(req) : req.params.id;
-        if (!req.user) return res.status(401).json({ success: false, error: 'Unauthorized' });
+        if (!req.user) return next(ApiError.unauthorized());
         if (req.user.role === 'admin' || String(req.user.id) === String(targetId)) {
           return next();
         }
-        return res.status(403).json({ success: false, error: 'Insufficient permissions to modify this resource' });
+        return next(ApiError.forbidden('Insufficient permissions to modify this resource'));
       } catch (err) {
-        return res.status(500).json({ success: false, error: 'Server error' });
+        return next(ApiError.internal('Server error'));
       }
     };
   };

package/src/middlewares/cors.middleware.js

@@ -0,0 +1,73 @@
+// packages/auth/src/middlewares/cors.middleware.js
+/**
+ * CORS middleware — explicit origin whitelist instead of the default
+ * "reflect any origin" behaviour, which is a security risk for auth APIs.
+ *
+ * If `config.cors` is omitted, we default to a safe deny-everything policy
+ * for auth routes (they should be consumed by a trusted frontend).
+ */
+const ApiError = require('../utils/api-error');
+
+const DEFAULT_CORS = {
+  origin: '*',
+  credentials: true,
+  methods: ['GET', 'POST', 'PUT', 'DELETE', 'OPTIONS'],
+  allowedHeaders: ['Content-Type', 'Authorization', 'X-Requested-With', 'X-CSRF-Token'],
+  maxAge: 86400
+};
+
+function normalizeOrigin(origin) {
+  if (!origin) return null;
+  try {
+    const u = new URL(origin);
+    return `${u.protocol}//${u.host}`;
+  } catch {
+    return origin;
+  }
+}
+
+function corsMiddleware(config = {}) {
+  const cors = { ...DEFAULT_CORS, ...(config.cors || {}) };
+
+  // Build the set of allowed origins once.
+  const allowed = Array.isArray(cors.origin)
+    ? cors.origin.map(normalizeOrigin)
+    : cors.origin === '*'
+      ? null // null means "reflect any" (explicit opt-in)
+      : [normalizeOrigin(cors.origin)];
+
+  return (req, res, next) => {
+    const requestOrigin = req.headers.origin;
+
+    // Always set safe headers for preflight.
+    if (req.method === 'OPTIONS') {
+      res.setHeader('Access-Control-Allow-Methods', cors.methods.join(','));
+      res.setHeader('Access-Control-Allow-Headers', cors.allowedHeaders.join(','));
+      res.setHeader('Access-Control-Max-Age', String(cors.maxAge));
+      if (cors.credentials) res.setHeader('Access-Control-Allow-Credentials', 'true');
+      if (allowed === null) {
+        if (requestOrigin) res.setHeader('Access-Control-Allow-Origin', requestOrigin);
+      } else if (allowed.includes(normalizeOrigin(requestOrigin))) {
+        res.setHeader('Access-Control-Allow-Origin', requestOrigin);
+      }
+      return res.status(204).end();
+    }
+
+    // Actual request.
+    if (allowed === null) {
+      // Reflect any — only safe when the app explicitly opts in.
+      if (requestOrigin) res.setHeader('Access-Control-Allow-Origin', requestOrigin);
+    } else if (requestOrigin && allowed.includes(normalizeOrigin(requestOrigin))) {
+      res.setHeader('Access-Control-Allow-Origin', requestOrigin);
+      res.setHeader('Access-Control-Allow-Credentials', String(cors.credentials));
+    } else if (requestOrigin) {
+      // Origin not in whitelist — block it.
+      return next(ApiError.forbidden('Origin not allowed by CORS policy'));
+    }
+
+    if (cors.credentials) res.setHeader('Access-Control-Allow-Credentials', 'true');
+    next();
+  };
+}
+
+module.exports = corsMiddleware;

package/src/middlewares/validation.middleware.js

@@ -43,8 +43,9 @@ const profileUpdateValidator = [
   body().custom((value, { req }) => {
     // prevent sensitive fields in payload
     const forbidden = ['password', 'role', 'refreshTokens', 'isVerified', 'verificationToken', 'twoFactorSecret', '_id'];
+    const body = req.body || {};
     for (const f of forbidden) {
-      if (req.body.hasOwnProperty(f)) {
+      if (Object.prototype.hasOwnProperty.call(body, f)) {
         throw new Error(`Cannot update field: ${f}`);
       }
     }

package/src/models/user.js

@@ -3,6 +3,7 @@ const mongoose = require('mongoose');
 const bcrypt = require('bcryptjs');
 const validator = require('validator');
 const crypto = require('crypto');
+const ApiError = require('../utils/api-error');
 
 
 const SALT_ROUNDS = Number(process.env.SALT_ROUNDS) || 12;
@@ -47,10 +48,13 @@ const userSchema = new mongoose.Schema({
     sessionId: String,
     userAgent: String,
     ip: String,
-    createdAt: { type: Date, default: Date.now }
+    createdAt: { type: Date, default: Date.now },
+    lastActiveAt: { type: Date, default: Date.now }
   }],
   isVerified: { type: Boolean, default: false },
   verificationToken: { type: String, select: false },
+  magicLinkToken: { type: String, select: false },
+  magicLinkExpires: { type: Date, select: false },
   passwordResetToken: { type: String, select: false },
   passwordResetExpires: { type: Date, select: false },
   loginAttempts: { type: Number, default: 0 },
@@ -58,11 +62,13 @@ const userSchema = new mongoose.Schema({
   twoFactorSecret: { type: String, select: false },
   twoFactorEnabled: { type: Boolean, default: false },
   refreshTokens: { type: [refreshTokenSchema], default: [] },
+  sessionVersion: { type: Number, default: 0 },
   customFields: { type: mongoose.Schema.Types.Mixed }
 }, { timestamps: true });
 
 // Indexes
 userSchema.index({ email: 1 }, { unique: true });
+userSchema.index({ magicLinkToken: 1 });
 userSchema.index({ 'refreshTokens.expires': 1 }); // helps queries that prune expired refresh tokens
 userSchema.index({ lockUntil: 1 });
 
@@ -90,9 +96,13 @@ userSchema.methods.comparePassword = async function (candidate) {
 };
 
 userSchema.methods.recordPasswordHistory = async function (previousPasswordHash) {
+  if (typeof previousPasswordHash !== 'string' || previousPasswordHash.length === 0) {
+    throw ApiError.internal('recordPasswordHistory requires previousPasswordHash');
+  }
+
   this.passwordHistory = this.passwordHistory || [];
   this.passwordHistory.push({
-    hash: previousPasswordHash || this.password,
+    hash: previousPasswordHash,
     changedAt: new Date()
   });
 
@@ -100,8 +110,6 @@ userSchema.methods.recordPasswordHistory = async function (previousPasswordHash)
   if (this.passwordHistory.length > 5) {
     this.passwordHistory.shift();
   }
-
-  await this.save();
 };
 
 userSchema.methods.setBackupCodes = async function (codes) {
@@ -109,7 +117,6 @@ userSchema.methods.setBackupCodes = async function (codes) {
     hash: c.hash,
     used: false
   }));
-  await this.save();
 };
 
 
@@ -124,20 +131,17 @@ userSchema.methods.addRefreshToken = async function (tokenString, expiresAt) {
     token: tokenString,
     expires: expiresAt
   });
-  await this.save();
   return tokenString;
 };
 
 // Revoke a specific refresh token (by token string)
 userSchema.methods.revokeRefreshToken = async function (tokenString) {
   this.refreshTokens = (this.refreshTokens || []).filter(t => t.token !== tokenString);
-  await this.save();
 };
 
 // Revoke all refresh tokens (e.g., on password reset)
 userSchema.methods.revokeAllRefreshTokens = async function () {
   this.refreshTokens = [];
-  await this.save();
 };
 
 // Remove expired refresh tokens (useful to call periodically or on sensitive flows)
@@ -166,17 +170,14 @@ userSchema.methods.addSession = async function (info) {
     userAgent: info.userAgent,
     ip: info.ip
   });
-  await this.save();
 };
 
 userSchema.methods.revokeSession = async function (sessionId) {
   this.sessions = this.sessions.filter(s => s.sessionId !== sessionId);
-  await this.save();
 };
 
 userSchema.methods.revokeAllSessions = async function () {
   this.sessions = [];
-  await this.save();
 };
 
 
@@ -195,7 +196,6 @@ userSchema.methods.verifyBackupCode = async function (rawCode, mfaService) {
   this.backupCodes = this.backupCodes.map((c) =>
     c.hash === match.hash ? { ...c.toObject?.() ?? c, used: true } : c
   );
-  await this.save();
   return true;
 };
 

package/src/services/audit.service.js

@@ -50,6 +50,72 @@ class AuditService {
       timestamp: { $gte: since }
     });
   }
+
+  /**
+   * Returns login attempt analytics including success rate, top failure reasons,
+   * and time-based patterns (hourly breakdown).
+   * @param {Object} filters - Optional filters like startDate, endDate, userId
+   */
+  async getLoginAttemptAnalytics(filters = {}) {
+    const query = { action: 'login' };
+    if (filters.userId) {
+      query.userId = filters.userId;
+    }
+    if (filters.startDate || filters.endDate) {
+      query.timestamp = {};
+      if (filters.startDate) query.timestamp.$gte = new Date(filters.startDate);
+      if (filters.endDate) query.timestamp.$lte = new Date(filters.endDate);
+    }
+
+    const totalAttempts = await AuditLog.countDocuments(query);
+    const successfulAttempts = await AuditLog.countDocuments({ ...query, status: 'success' });
+    const failedAttempts = await AuditLog.countDocuments({ ...query, status: 'failure' });
+
+    const successRate = totalAttempts > 0
+      ? Number(((successfulAttempts / totalAttempts) * 100).toFixed(2))
+      : 0;
+
+    // Top failure reasons from details.error
+    const topFailures = await AuditLog.aggregate([
+      { $match: { ...query, status: 'failure' } },
+      { $group: { _id: { $ifNull: ['$details.error', 'Unknown reason'] }, count: { $sum: 1 } } },
+      { $sort: { count: -1 } },
+      { $limit: 5 },
+      { $project: { reason: '$_id', count: 1, _id: 0 } }
+    ]);
+
+    // Time-based patterns: hourly distribution (0-23)
+    const timeBasedPatterns = await AuditLog.aggregate([
+      { $match: query },
+      {
+        $group: {
+          _id: { $hour: '$timestamp' },
+          total: { $sum: 1 },
+          success: { $sum: { $cond: [{ $eq: ['$status', 'success'] }, 1, 0] } },
+          failure: { $sum: { $cond: [{ $eq: ['$status', 'failure'] }, 1, 0] } }
+        }
+      },
+      { $sort: { _id: 1 } },
+      {
+        $project: {
+          hour: '$_id',
+          total: 1,
+          success: 1,
+          failure: 1,
+          _id: 0
+        }
+      }
+    ]);
+
+    return {
+      totalAttempts,
+      successfulAttempts,
+      failedAttempts,
+      successRate: `${successRate}%`,
+      topFailures,
+      timeBasedPatterns
+    };
+  }
 }
 
 module.exports = AuditService;

package/src/services/auth.service.js

@@ -47,12 +47,12 @@ class AuthService {
   --------------------------------------------- */
   async verifyEmail(token) {
     if (!token) {
-      throw new ApiError('Verification token is required', 400);
+      throw ApiError.badRequest('Verification token is required');
     }
 
     const user = await User.findOne({ verificationToken: token }).select('+verificationToken');
     if (!user) {
-      throw new ApiError('Invalid or expired verification token', 400);
+      throw ApiError.badRequest('Invalid or expired verification token');
     }
 
     user.isVerified = true;
@@ -71,17 +71,17 @@ class AuthService {
   /* ---------------------------------------------
         LOGIN USER (WITH ATOMIC LOCKOUT)
   --------------------------------------------- */
-  async login(email, password, deviceInfo) {
+  async login(email, password, deviceInfo = {}) {
     const user = await User.findOne({ email });
 
     if (!user) {
-      throw new ApiError('Invalid credentials', 401);
+      throw ApiError.invalidCredentials();
     }
 
     // If locked, do NOT allow login
     const securityAttemptsEnabled = this.config?.features?.securityAttempts !== false;
     if (securityAttemptsEnabled && user.isLocked()) {
-      throw new ApiError('Account locked. Try again later.', 403);
+      throw ApiError.accountLocked();
     }
 
     const isValid = await user.comparePassword(password);
@@ -89,7 +89,7 @@ class AuthService {
       if (securityAttemptsEnabled) {
         await this.incrementLoginAttempts(user);
       }
-      throw new ApiError('Invalid credentials', 401);
+      throw ApiError.invalidCredentials();
     }
 
     // RESET LOCKOUT automatically on correct login
@@ -110,6 +110,9 @@ class AuthService {
       await this.emailService.sendLoginAlert(user, deviceInfo);
     }
 
+    // Regenerate session ID on login if configured
+    await this.regenerateSessionIdOnLogin(user);
+
     const tokens = await this.generateTokens(user);
     return { ...tokens, user };
   }
@@ -120,9 +123,9 @@ class AuthService {
   async verify2FA(userId, code) {
     const user = await User.findById(userId).select('+twoFactorSecret');
 
-    if (!user) throw new ApiError('User not found', 404);
+    if (!user) throw ApiError.notFound('User not found');
     if (!user.twoFactorEnabled)
-      throw new ApiError('2FA is not enabled for this user', 400);
+      throw ApiError.badRequest('2FA is not enabled for this user');
 
     const ok = authenticator.verify({
       token: code,
@@ -132,7 +135,7 @@ class AuthService {
     // fallback: backup codes
     if (!ok) {
       const backupOK = await user.verifyBackupCode(code, this.config.mfaService);
-      if (!backupOK) throw new ApiError('Invalid 2FA code', 401);
+      if (!backupOK) throw ApiError.twoFactorFailed();
     }
 
 
@@ -147,10 +150,11 @@ class AuthService {
     // find only valid (non-expired) tokens
     const user = await User.findByRefreshToken(refreshToken);
 
-    if (!user) throw new ApiError('Invalid or expired refresh token', 401);
+    if (!user) throw ApiError.invalidToken();
 
     // Refresh token rotation (best practice)
-    await user.revokeRefreshToken(refreshToken);
+    user.revokeRefreshToken(refreshToken);
+    await user.save();
 
     const tokens = await this.generateTokens(user);
     await this.logAudit({
@@ -191,24 +195,20 @@ class AuthService {
       passwordResetExpires: { $gt: Date.now() }
     });
 
-    if (!user) throw new ApiError('Invalid or expired reset token', 400);
-
-    // check password history
-    const reused = await Promise.all(
-      (user.passwordHistory || []).map(async (old) =>
-        bcrypt.compare(newPassword, old.hash)
-      )
-    );
+    if (!user) throw ApiError.badRequest('Invalid or expired reset token');
 
-    if (reused.includes(true)) {
-      throw new ApiError('Cannot reuse previous passwords', 400);
+    // check password history (sequential, short-circuits on first match)
+    for (const old of (user.passwordHistory || [])) {
+      if (await bcrypt.compare(newPassword, old.hash)) {
+        throw ApiError.passwordReuse('Cannot reuse previous passwords');
+      }
     }
 
     const previousPasswordHash = user.password;
     user.password = newPassword;
 
     await user.recordPasswordHistory(previousPasswordHash);
-    await user.revokeAllRefreshTokens(); // session invalidate
+    user.revokeAllRefreshTokens(); // session invalidate
     user.passwordResetToken = undefined;
     user.passwordResetExpires = undefined;
     await this.logAudit({
@@ -217,7 +217,6 @@ class AuthService {
       status: 'success'
     });
 
-
     await user.save();
     return user;
   }
@@ -227,11 +226,12 @@ class AuthService {
   --------------------------------------------- */
   async generateBackupCodes(userId, mfaService) {
     const user = await User.findById(userId);
-    if (!user) throw new ApiError("User not found", 404);
+    if (!user) throw ApiError.notFound();
 
     const codes = mfaService.generateBackupCodes();
 
     await user.setBackupCodes(codes.map(c => ({ hash: c.hash })));
+    await user.save();
 
     await this.logAudit({
       userId,
@@ -249,7 +249,7 @@ class AuthService {
   --------------------------------------------- */
   async updateProfile(userId, updates) {
     const user = await User.findById(userId);
-    if (!user) throw new ApiError('User not found', 404);
+    if (!user) throw ApiError.notFound();
 
     await user.safeUpdate(updates);
     await this.logAudit({
@@ -269,7 +269,8 @@ class AuthService {
       {
         id: user._id,
         email: user.email,
-        role: user.role
+        role: user.role,
+        sessionVersion: user.sessionVersion || 0
       },
       this.config.env.JWT_SECRET,
       { expiresIn: this.config.accessTokenExpiry || '1h' }
@@ -280,7 +281,8 @@ class AuthService {
       Date.now() +
       (this.config.refreshTokenDays || 7) * 24 * 60 * 60 * 1000;
 
-    await user.addRefreshToken(refreshToken, expiresAt);
+    user.addRefreshToken(refreshToken, expiresAt);
+    await user.save();
 
     // prune expired refresh tokens in background
     await user.pruneExpiredRefreshTokens();
@@ -307,31 +309,44 @@ class AuthService {
     const now = Date.now();
     const lockUntil = now + 60 * 60 * 1000;
 
-    user.loginAttempts = (user.loginAttempts || 0) + 1;
+    // Perform atomic increment in DB to prevent concurrent race conditions
+    const updatedUser = await User.findOneAndUpdate(
+      { _id: user._id },
+      { $inc: { loginAttempts: 1 } },
+      { new: true }
+    );
 
-    if (user.loginAttempts >= MAX) {
-      user.lockUntil = lockUntil;
-      await user.save();
-      await this.emailService.sendAccountLockEmail(user);
+    if (updatedUser && updatedUser.loginAttempts >= MAX) {
+      updatedUser.lockUntil = lockUntil;
+      await updatedUser.save();
+      await this.emailService.sendAccountLockEmail(updatedUser);
       await this.logAudit({
-        userId: user._id,
+        userId: updatedUser._id,
         action: 'account_locked',
         status: 'success'
       });
-      return;
     }
 
-    await user.save();
+    // Sync local user instance state
+    user.loginAttempts = updatedUser ? updatedUser.loginAttempts : (user.loginAttempts + 1);
+    if (user.loginAttempts >= MAX) {
+      user.lockUntil = lockUntil;
+    }
   }
 
   /* ---------------------------------------------
         LOGOUT
   --------------------------------------------- */
-  async logout(userId, sessionId) {
+  async logout(userId, sessionId, refreshToken = null) {
     const user = await User.findById(userId);
-    if (!user) throw new ApiError("User not found", 404);
+    if (!user) throw ApiError.notFound();
 
     await user.revokeSession(sessionId);
+    // Also revoke the refresh token so it cannot be reused
+    if (refreshToken) {
+      await user.revokeRefreshToken(refreshToken);
+    }
+    await user.save();
 
     await this.logAudit({
       userId,
@@ -344,12 +359,12 @@ class AuthService {
 
   async handleSocialLogin(provider, profile) {
     if (!profile) {
-      throw new ApiError('Social profile is required', 400);
+      throw ApiError.badRequest('Social profile is required');
     }
 
     const primaryEmail = profile.emails?.[0]?.value;
     if (!primaryEmail) {
-      throw new ApiError('Social provider did not return an email', 400);
+      throw ApiError.badRequest('Social provider did not return an email');
     }
 
     let user = await User.findOne({ email: primaryEmail });
@@ -366,19 +381,33 @@ class AuthService {
         }
       });
       await user.save();
-    } else if (profile.displayName) {
+    } else {
       user.customFields = {
         ...(user.customFields || {}),
         socialProvider: provider,
-        socialId: profile.id,
-        name: profile.displayName
+        socialId: profile.id
       };
+      if (profile.displayName) {
+        user.customFields.name = profile.displayName;
+      }
       await user.save();
     }
 
     return user;
   }
 
+  /* ---------------------------------------------
+        REGENERATE SESSION ID ON LOGIN
+  --------------------------------------------- */
+  async regenerateSessionIdOnLogin(user) {
+    // Opt-in only — bumping sessionVersion on every login invalidates all
+    // existing sessions, which breaks normal multi-session usage.
+    if (this.config?.session?.regenerateSessionIdOnLogin === true) {
+      user.sessionVersion = (user.sessionVersion || 0) + 1;
+      await user.save();
+    }
+  }
+
 
 
   /* ---------------------------------------------