@flytedesk/app-kit 3.2.2 → 4.0.0

package/dist/auth/testing/memory-store.d.ts

@@ -0,0 +1,44 @@
+import type { AuthStore, CreateIdpSessionInput, CreateRefreshTokenInput, IdpSessionLockedStore, IdpSessionRow, RefreshTokenRow, RevokeFamilyReason, UpdateIdpSessionInput } from "../types.js";
+/**
+ * An in-memory `AuthStore` that honestly implements every guarantee the contract asks of
+ * a real one (AK-23) — for tests of `@flytedesk/app-kit/auth` itself and of any
+ * consumer's routes. Not for production: nothing survives a restart and nothing is
+ * shared across processes.
+ *
+ * Atomicity comes from JavaScript's run-to-completion: `rotateRefreshToken` and
+ * `revokeFamily` each read, decide and write with no `await` in between, so two
+ * same-instant callers can never interleave inside either — which is also what
+ * serializes a rotation against a revocation of the same family here (a Postgres store
+ * needs a per-family lock for that; see `AuthStore.revokeFamily`). `withIdpSessionLock` is a per-session promise queue; the store
+ * it hands `fn` is this store itself, since there is no connection pool to starve.
+ */
+export declare class MemoryAuthStore implements AuthStore {
+    private readonly refreshTokens;
+    private readonly idpSessions;
+    private readonly lockTails;
+    /** Every `revokeFamily` call, in order — lets a test assert WHY a family was revoked
+     *  (or that none was) without reaching into the plugin. */
+    readonly revokeFamilyCalls: Array<{
+        familyId: string;
+        reason: RevokeFamilyReason;
+        revokedAt: Date;
+    }>;
+    createRefreshToken(row: CreateRefreshTokenInput): Promise<void>;
+    findRefreshTokenByHash(hash: string): Promise<RefreshTokenRow | null>;
+    rotateRefreshToken(presentedId: string, successor: CreateRefreshTokenInput, rotatedAt: Date): Promise<boolean>;
+    revokeFamily(familyId: string, reason: RevokeFamilyReason, revokedAt: Date): Promise<void>;
+    createIdpSession(row: CreateIdpSessionInput): Promise<{
+        id: string;
+    }>;
+    findIdpSession(id: string): Promise<IdpSessionRow | null>;
+    updateIdpSession(id: string, patch: UpdateIdpSessionInput): Promise<void>;
+    deleteIdpSession(id: string): Promise<void>;
+    withIdpSessionLock<T>(sessionId: string, fn: (locked: IdpSessionLockedStore) => Promise<T>): Promise<T>;
+    /** Sessions whose lock is currently held or queued for. */
+    heldLockCount(): number;
+    /** Ids of every IdP session currently stored, oldest first. */
+    idpSessionIds(): string[];
+    /** Ids of every refresh token whose `replacesId` is `id` — its rotation successors. */
+    successorsOf(id: string): string[];
+    private insert;
+}

package/dist/auth/testing/memory-store.js

@@ -0,0 +1,120 @@
+import { randomUUID } from "node:crypto";
+/**
+ * An in-memory `AuthStore` that honestly implements every guarantee the contract asks of
+ * a real one (AK-23) — for tests of `@flytedesk/app-kit/auth` itself and of any
+ * consumer's routes. Not for production: nothing survives a restart and nothing is
+ * shared across processes.
+ *
+ * Atomicity comes from JavaScript's run-to-completion: `rotateRefreshToken` and
+ * `revokeFamily` each read, decide and write with no `await` in between, so two
+ * same-instant callers can never interleave inside either — which is also what
+ * serializes a rotation against a revocation of the same family here (a Postgres store
+ * needs a per-family lock for that; see `AuthStore.revokeFamily`). `withIdpSessionLock` is a per-session promise queue; the store
+ * it hands `fn` is this store itself, since there is no connection pool to starve.
+ */
+export class MemoryAuthStore {
+    refreshTokens = new Map();
+    idpSessions = new Map();
+    lockTails = new Map();
+    /** Every `revokeFamily` call, in order — lets a test assert WHY a family was revoked
+     *  (or that none was) without reaching into the plugin. */
+    revokeFamilyCalls = [];
+    async createRefreshToken(row) {
+        this.insert(row, null);
+    }
+    async findRefreshTokenByHash(hash) {
+        for (const row of this.refreshTokens.values()) {
+            if (row.tokenHash === hash)
+                return toRow(row);
+        }
+        return null;
+    }
+    async rotateRefreshToken(presentedId, successor, rotatedAt) {
+        const presented = this.refreshTokens.get(presentedId);
+        if (!presented || presented.revocation)
+            return false;
+        presented.revocation = { at: rotatedAt, reason: "rotated" };
+        this.insert(successor, presentedId);
+        return true;
+    }
+    async revokeFamily(familyId, reason, revokedAt) {
+        this.revokeFamilyCalls.push({ familyId, reason, revokedAt });
+        const revocation = { at: revokedAt, reason: reason.type };
+        for (const row of this.refreshTokens.values()) {
+            if (row.familyId === familyId && !row.revocation)
+                row.revocation = { ...revocation };
+        }
+    }
+    async createIdpSession(row) {
+        const id = randomUUID();
+        this.idpSessions.set(id, { id, ...row });
+        return { id };
+    }
+    async findIdpSession(id) {
+        const row = this.idpSessions.get(id);
+        return row ? { ...row } : null;
+    }
+    async updateIdpSession(id, patch) {
+        const row = this.idpSessions.get(id);
+        if (row)
+            Object.assign(row, patch);
+    }
+    async deleteIdpSession(id) {
+        this.idpSessions.delete(id);
+    }
+    async withIdpSessionLock(sessionId, fn) {
+        const prior = this.lockTails.get(sessionId) ?? Promise.resolve();
+        // Chained after the prior holder whether it resolved or rejected, so one caller's
+        // failure can never wedge the queue for its siblings.
+        const run = () => fn(this);
+        const result = prior.then(run, run);
+        const tail = result.then(() => undefined, () => undefined);
+        this.lockTails.set(sessionId, tail);
+        // Released: forget the session unless another caller has queued behind this one, so
+        // a long-lived store does not keep one settled promise per session it ever locked.
+        void tail.then(() => {
+            if (this.lockTails.get(sessionId) === tail)
+                this.lockTails.delete(sessionId);
+        });
+        return result;
+    }
+    /** Sessions whose lock is currently held or queued for. */
+    heldLockCount() {
+        return this.lockTails.size;
+    }
+    /** Ids of every IdP session currently stored, oldest first. */
+    idpSessionIds() {
+        return [...this.idpSessions.keys()];
+    }
+    /** Ids of every refresh token whose `replacesId` is `id` — its rotation successors. */
+    successorsOf(id) {
+        return [...this.refreshTokens.values()].filter((row) => row.replacesId === id).map((row) => row.id);
+    }
+    insert(row, replacesId) {
+        this.refreshTokens.set(row.id, {
+            id: row.id,
+            familyId: row.familyId,
+            userId: row.userId,
+            idpSessionId: row.idpSessionId,
+            expiresAt: row.expiresAt,
+            ip: row.ip,
+            userAgent: row.userAgent,
+            tokenHash: row.tokenHash,
+            revocation: null,
+            replacesId,
+        });
+    }
+}
+function toRow(stored) {
+    return {
+        id: stored.id,
+        familyId: stored.familyId,
+        userId: stored.userId,
+        idpSessionId: stored.idpSessionId,
+        expiresAt: stored.expiresAt,
+        ip: stored.ip,
+        userAgent: stored.userAgent,
+        revocation: stored.revocation ? { ...stored.revocation } : null,
+    };
+}
+//# sourceMappingURL=memory-store.js.map

package/dist/auth/testing/memory-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"memory-store.js","sourceRoot":"","sources":["../../../src/auth/testing/memory-store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAmBzC;;;;;;;;;;;;GAYG;AACH,MAAM,OAAO,eAAe;IACT,aAAa,GAAG,IAAI,GAAG,EAA8B,CAAC;IACtD,WAAW,GAAG,IAAI,GAAG,EAAyB,CAAC;IAC/C,SAAS,GAAG,IAAI,GAAG,EAA4B,CAAC;IAEjE;+DAC2D;IAClD,iBAAiB,GAA6E,EAAE,CAAC;IAE1G,KAAK,CAAC,kBAAkB,CAAC,GAA4B;QACnD,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACzB,CAAC;IAED,KAAK,CAAC,sBAAsB,CAAC,IAAY;QACvC,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,EAAE,CAAC;YAC9C,IAAI,GAAG,CAAC,SAAS,KAAK,IAAI;gBAAE,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC;QAChD,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,CAAC,kBAAkB,CAAC,WAAmB,EAAE,SAAkC,EAAE,SAAe;QAC/F,MAAM,SAAS,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACtD,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC,UAAU;YAAE,OAAO,KAAK,CAAC;QACrD,SAAS,CAAC,UAAU,GAAG,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QAC5D,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;QACpC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,QAAgB,EAAE,MAA0B,EAAE,SAAe;QAC9E,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;QAC7D,MAAM,UAAU,GAA2B,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;QAClF,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,EAAE,CAAC;YAC9C,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,GAAG,CAAC,UAAU;gBAAE,GAAG,CAAC,UAAU,GAAG,EAAE,GAAG,UAAU,EAAE,CAAC;QACvF,CAAC;IACH,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,GAA0B;QAC/C,MAAM,EAAE,GAAG,UAAU,EAAE,CAAC;QACxB,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,GAAG,GAAG,EAAE,CAAC,CAAC;QACzC,OAAO,EAAE,EAAE,EAAE,CAAC;IAChB,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,EAAU;QAC7B,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACrC,OAAO,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACjC,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,EAAU,EAAE,KAA4B;QAC7D,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACrC,IAAI,GAAG;YAAE,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACrC,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,EAAU;QAC/B,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAC9B,CAAC;IAED,KAAK,CAAC,kBAAkB,CAAI,SAAiB,EAAE,EAAiD;QAC9F,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;QACjE,kFAAkF;QAClF,sDAAsD;QACtD,MAAM,GAAG,GAAG,GAAG,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;QAC3B,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACpC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CACtB,GAAG,EAAE,CAAC,SAAS,EACf,GAAG,EAAE,CAAC,SAAS,CAChB,CAAC;QACF,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QACpC,oFAAoF;QACpF,mFAAmF;QACnF,KAAK,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE;YAClB,IAAI,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK,IAAI;gBAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAC/E,CAAC,CAAC,CAAC;QACH,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,2DAA2D;IAC3D,aAAa;QACX,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;IAC7B,CAAC;IAED,+DAA+D;IAC/D,aAAa;QACX,OAAO,CAAC,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC;IACtC,CAAC;IAED,uFAAuF;IACvF,YAAY,CAAC,EAAU;QACrB,OAAO,CAAC,GAAG,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,UAAU,KAAK,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACtG,CAAC;IAEO,MAAM,CAAC,GAA4B,EAAE,UAAyB;QACpE,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE;YAC7B,EAAE,EAAE,GAAG,CAAC,EAAE;YACV,QAAQ,EAAE,GAAG,CAAC,QAAQ;YACtB,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,YAAY,EAAE,GAAG,CAAC,YAAY;YAC9B,SAAS,EAAE,GAAG,CAAC,SAAS;YACxB,EAAE,EAAE,GAAG,CAAC,EAAE;YACV,SAAS,EAAE,GAAG,CAAC,SAAS;YACxB,SAAS,EAAE,GAAG,CAAC,SAAS;YACxB,UAAU,EAAE,IAAI;YAChB,UAAU;SACX,CAAC,CAAC;IACL,CAAC;CACF;AAED,SAAS,KAAK,CAAC,MAA0B;IACvC,OAAO;QACL,EAAE,EAAE,MAAM,CAAC,EAAE;QACb,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,EAAE,EAAE,MAAM,CAAC,EAAE;QACb,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,UAAU,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,IAAI;KAChE,CAAC;AACJ,CAAC"}

package/dist/auth/tokens.d.ts

@@ -21,4 +21,28 @@ export declare function generateRefreshToken(): {
     token: string;
     hash: string;
 };
+/** The minimum `accessTokenSecret` length the plugin accepts, in bytes (UTF-8): 256 bits,
+ *  the HS256 key size and the HKDF input the successor key is derived from. */
+export declare const MIN_ACCESS_TOKEN_SECRET_BYTES = 32;
+/** The HMAC key `successorRefreshToken` uses, derived once from `accessTokenSecret` with
+ *  HKDF-SHA256 (RFC 5869). */
+export declare function refreshSuccessorKey(accessTokenSecret: string): Buffer;
+/**
+ * The refresh token that rotating the presented row issues (AK-23):
+ * `HMAC-SHA256(key, presentedId ‖ 0x00 ‖ presentedToken)`, with `key` from
+ * `refreshSuccessorKey`. Deterministic, so `POST {routePrefix}/refresh` can hand an
+ * in-grace second presentation of a just-rotated token the SAME successor its first
+ * presentation issued — a browser whose refresh response was lost (timed out, network
+ * drop) still holds the old cookie, and nothing else could give it the successor back.
+ *
+ * `presentedId` is the row id the plugin generated (`randomUUID()`) and only the store
+ * holds — it is never in a cookie. So the successor is NOT computable from a raw token
+ * plus the secret: an attacker holding an old raw token who later learns the secret
+ * still cannot compute the family's live token offline, and rotating the secret (plus
+ * revoking every family — see the README) evicts them.
+ */
+export declare function successorRefreshToken(key: Buffer, presentedId: string, presentedToken: string): {
+    token: string;
+    hash: string;
+};
 export declare function hashRefreshToken(token: string): string;

package/dist/auth/tokens.js

@@ -1,4 +1,4 @@
-import { randomBytes, createHash } from "node:crypto";
+import { randomBytes, createHash, createHmac, hkdfSync } from "node:crypto";
 import { SignJWT, jwtVerify } from "jose";
 /**
  * Bearer JWT this service issues to itself. Carries only `sub`/`sid` — never the
@@ -29,6 +29,36 @@ export function generateRefreshToken() {
     const token = randomBytes(48).toString("base64url");
     return { token, hash: hashRefreshToken(token) };
 }
+/** HKDF `info` for the successor key: domain separation from every other use of
+ *  `accessTokenSecret` (it also signs access tokens), versioned so the derivation can
+ *  change without ever colliding with this one. */
+const SUCCESSOR_KEY_INFO = "@flytedesk/app-kit/auth refresh-successor v1";
+/** The minimum `accessTokenSecret` length the plugin accepts, in bytes (UTF-8): 256 bits,
+ *  the HS256 key size and the HKDF input the successor key is derived from. */
+export const MIN_ACCESS_TOKEN_SECRET_BYTES = 32;
+/** The HMAC key `successorRefreshToken` uses, derived once from `accessTokenSecret` with
+ *  HKDF-SHA256 (RFC 5869). */
+export function refreshSuccessorKey(accessTokenSecret) {
+    return Buffer.from(hkdfSync("sha256", accessTokenSecret, Buffer.alloc(0), SUCCESSOR_KEY_INFO, 32));
+}
+/**
+ * The refresh token that rotating the presented row issues (AK-23):
+ * `HMAC-SHA256(key, presentedId ‖ 0x00 ‖ presentedToken)`, with `key` from
+ * `refreshSuccessorKey`. Deterministic, so `POST {routePrefix}/refresh` can hand an
+ * in-grace second presentation of a just-rotated token the SAME successor its first
+ * presentation issued — a browser whose refresh response was lost (timed out, network
+ * drop) still holds the old cookie, and nothing else could give it the successor back.
+ *
+ * `presentedId` is the row id the plugin generated (`randomUUID()`) and only the store
+ * holds — it is never in a cookie. So the successor is NOT computable from a raw token
+ * plus the secret: an attacker holding an old raw token who later learns the secret
+ * still cannot compute the family's live token offline, and rotating the secret (plus
+ * revoking every family — see the README) evicts them.
+ */
+export function successorRefreshToken(key, presentedId, presentedToken) {
+    const token = createHmac("sha256", key).update(presentedId).update("\0").update(presentedToken).digest("base64url");
+    return { token, hash: hashRefreshToken(token) };
+}
 export function hashRefreshToken(token) {
     return createHash("sha256").update(token).digest("hex");
 }

package/dist/auth/tokens.js.map

@@ -1 +1 @@
-{"version":3,"file":"tokens.js","sourceRoot":"","sources":["../../src/auth/tokens.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AAU1C;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,MAAc,EACd,UAAkB,EAClB,MAAc,EACd,SAAiB;IAEjB,MAAM,GAAG,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC7C,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,UAAU,GAAG,IAAI,CAAC,CAAC;IAC3D,MAAM,KAAK,GAAG,MAAM,IAAI,OAAO,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC;SAC7D,kBAAkB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;SACpC,WAAW,EAAE;SACb,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC;SACzD,IAAI,CAAC,GAAG,CAAC,CAAC;IACb,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;AAC9B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,MAAc,EAAE,KAAa;IACnE,MAAM,GAAG,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC7C,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,UAAU,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC3E,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;QACvE,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzE,CAAC;IACD,OAAO,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC;AAChD,CAAC;AAED;qEACqE;AACrE,MAAM,UAAU,oBAAoB;IAClC,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACpD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC;AAClD,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,KAAa;IAC5C,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC1D,CAAC"}
+{"version":3,"file":"tokens.js","sourceRoot":"","sources":["../../src/auth/tokens.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAC5E,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AAU1C;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,MAAc,EACd,UAAkB,EAClB,MAAc,EACd,SAAiB;IAEjB,MAAM,GAAG,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC7C,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,UAAU,GAAG,IAAI,CAAC,CAAC;IAC3D,MAAM,KAAK,GAAG,MAAM,IAAI,OAAO,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC;SAC7D,kBAAkB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;SACpC,WAAW,EAAE;SACb,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC;SACzD,IAAI,CAAC,GAAG,CAAC,CAAC;IACb,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;AAC9B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,MAAc,EAAE,KAAa;IACnE,MAAM,GAAG,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC7C,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,UAAU,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC3E,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;QACvE,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzE,CAAC;IACD,OAAO,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC;AAChD,CAAC;AAED;qEACqE;AACrE,MAAM,UAAU,oBAAoB;IAClC,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACpD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC;AAClD,CAAC;AAED;;mDAEmD;AACnD,MAAM,kBAAkB,GAAG,8CAA8C,CAAC;AAE1E;+EAC+E;AAC/E,MAAM,CAAC,MAAM,6BAA6B,GAAG,EAAE,CAAC;AAEhD;8BAC8B;AAC9B,MAAM,UAAU,mBAAmB,CAAC,iBAAyB;IAC3D,OAAO,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,iBAAiB,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,EAAE,CAAC,CAAC,CAAC;AACrG,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,qBAAqB,CACnC,GAAW,EACX,WAAmB,EACnB,cAAsB;IAEtB,MAAM,KAAK,GAAG,UAAU,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IACpH,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC;AAClD,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,KAAa;IAC5C,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC1D,CAAC"}