@hartl-services/medusa-base 2.6.0 → 2.7.0

package/.medusa/server/src/customer-auth/login-code-accounts.js

@@ -0,0 +1,146 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.hasCustomerAccountIdentity = exports.findCodeAccountAuthIdentityId = exports.findPasswordIdentities = exports.deleteUnconfirmedPasswordIdentities = exports.findEmailPasswordAccounts = exports.findOwnLoginIdentity = void 0;
+/** The address's own code-login identity (provider `email-otp`), or null. */
+const findOwnLoginIdentity = async (sql, entityId) => {
+    const result = await sql.raw(`SELECT pi.id AS provider_identity_id,
+            pi.auth_identity_id AS auth_identity_id,
+            NULLIF(ai.app_metadata->>'customer_id', '') AS customer_id
+     FROM provider_identity pi
+     JOIN auth_identity ai ON ai.id = pi.auth_identity_id AND ai.deleted_at IS NULL
+     WHERE pi.provider = 'email-otp'
+       AND pi.entity_id = ?
+       AND pi.deleted_at IS NULL`, [entityId]);
+    const row = result.rows[0];
+    return row
+        ? {
+            providerIdentityId: String(row.provider_identity_id),
+            authIdentityId: String(row.auth_identity_id),
+            customerId: typeof row.customer_id === "string" && row.customer_id
+                ? row.customer_id
+                : null,
+        }
+        : null;
+};
+exports.findOwnLoginIdentity = findOwnLoginIdentity;
+/**
+ * A verified Medusa auth verification of the provider identity `pi`'s very
+ * address (`entity_type` "email"): the one confirmation check of the linking
+ * rule and of the clean-up after a code login.
+ */
+const ADDRESS_CONFIRMED_SQL = `EXISTS (
+  SELECT 1 FROM auth_verification v
+  WHERE v.auth_identity_id = pi.auth_identity_id
+    AND v.entity_id = pi.entity_id
+    AND v.entity_type = 'email'
+    AND v.verified_at IS NOT NULL
+    AND v.deleted_at IS NULL
+)`;
+/**
+ * Customer accounts that registered with this address through `emailpass`.
+ * `emailpass` stores the address exactly as typed, so the match ignores
+ * letter case. Only identities whose auth identity carries a customer count
+ * (`app_metadata.customer_id`); `confirmed` is a verified Medusa auth
+ * verification of that very address. `customerEmailMatches` says the customer
+ * record itself (not deleted) has the same address, so a password identity
+ * pointing at a customer of another address is never linked.
+ */
+const findEmailPasswordAccounts = async (sql, normalizedEmail) => {
+    const result = await sql.raw(`SELECT pi.auth_identity_id AS auth_identity_id,
+            pi.entity_id AS entity_id,
+            ${ADDRESS_CONFIRMED_SQL} AS confirmed,
+            (c.id IS NOT NULL AND lower(c.email) = ?) AS customer_email_matches
+     FROM provider_identity pi
+     JOIN auth_identity ai ON ai.id = pi.auth_identity_id AND ai.deleted_at IS NULL
+     LEFT JOIN customer c
+       ON c.id = ai.app_metadata->>'customer_id' AND c.deleted_at IS NULL
+     WHERE pi.provider = 'emailpass'
+       AND lower(pi.entity_id) = ?
+       AND pi.entity_id ~ '^[\\x21-\\x7e]+$'
+       AND pi.deleted_at IS NULL
+       AND NULLIF(ai.app_metadata->>'customer_id', '') IS NOT NULL`, [normalizedEmail, normalizedEmail]);
+    return result.rows.map((row) => ({
+        authIdentityId: String(row.auth_identity_id),
+        entityId: String(row.entity_id),
+        confirmed: row.confirmed === true,
+        customerEmailMatches: row.customer_email_matches === true,
+    }));
+};
+exports.findEmailPasswordAccounts = findEmailPasswordAccounts;
+/**
+ * Deletes the `emailpass` identities of an auth identity whose address was
+ * never confirmed, for good (the unique index on `(entity_id, provider)` has no
+ * `deleted_at` filter, so a soft delete would block a new registration). A
+ * password somebody else may have planted for the address before the code
+ * login took over can then never be used. Returns how many were deleted.
+ */
+const deleteUnconfirmedPasswordIdentities = async (sql, authIdentityId) => {
+    const result = await sql.raw(`DELETE FROM provider_identity pi
+     WHERE pi.auth_identity_id = ?
+       AND pi.provider = 'emailpass'
+       AND NOT ${ADDRESS_CONFIRMED_SQL}
+     RETURNING pi.id`, [authIdentityId]);
+    return result.rows.length;
+};
+exports.deleteUnconfirmedPasswordIdentities = deleteUnconfirmedPasswordIdentities;
+/**
+ * Every `emailpass` identity of the address, letter case ignored (`emailpass`
+ * stores the address as typed), with or without a customer.
+ */
+const findPasswordIdentities = async (sql, normalizedEmail) => {
+    const result = await sql.raw(`SELECT pi.id AS provider_identity_id,
+            pi.auth_identity_id AS auth_identity_id,
+            pi.entity_id AS entity_id,
+            NULLIF(ai.app_metadata->>'customer_id', '') AS customer_id
+     FROM provider_identity pi
+     JOIN auth_identity ai ON ai.id = pi.auth_identity_id AND ai.deleted_at IS NULL
+     WHERE pi.provider = 'emailpass'
+       AND lower(pi.entity_id) = ?
+       AND pi.entity_id ~ '^[\\x21-\\x7e]+$'
+       AND pi.deleted_at IS NULL`, [normalizedEmail]);
+    return result.rows.map((row) => ({
+        providerIdentityId: String(row.provider_identity_id),
+        authIdentityId: String(row.auth_identity_id),
+        entityId: String(row.entity_id),
+        customerId: typeof row.customer_id === "string" && row.customer_id
+            ? row.customer_id
+            : null,
+    }));
+};
+exports.findPasswordIdentities = findPasswordIdentities;
+/**
+ * The auth identity of the address's code login (`email-otp`) when it carries a
+ * customer (not deleted) with that very address: the account the address was
+ * proven for. Null otherwise.
+ */
+const findCodeAccountAuthIdentityId = async (sql, normalizedEmail) => {
+    const result = await sql.raw(`SELECT pi.auth_identity_id AS auth_identity_id
+     FROM provider_identity pi
+     JOIN auth_identity ai ON ai.id = pi.auth_identity_id AND ai.deleted_at IS NULL
+     JOIN customer c
+       ON c.id = ai.app_metadata->>'customer_id' AND c.deleted_at IS NULL
+     WHERE pi.provider = 'email-otp'
+       AND pi.entity_id = ?
+       AND pi.deleted_at IS NULL
+       AND lower(c.email) = ?`, [normalizedEmail, normalizedEmail]);
+    const id = result.rows[0]?.auth_identity_id;
+    return typeof id === "string" && id ? id : null;
+};
+exports.findCodeAccountAuthIdentityId = findCodeAccountAuthIdentityId;
+/**
+ * Whether an identity of any provider for the address (letter case ignored)
+ * belongs to an auth identity that carries a customer.
+ */
+const hasCustomerAccountIdentity = async (sql, normalizedEmail) => {
+    const result = await sql.raw(`SELECT 1 AS found
+     FROM provider_identity pi
+     JOIN auth_identity ai ON ai.id = pi.auth_identity_id AND ai.deleted_at IS NULL
+     WHERE lower(pi.entity_id) = ?
+       AND pi.entity_id ~ '^[\\x21-\\x7e]+$'
+       AND pi.deleted_at IS NULL
+       AND NULLIF(ai.app_metadata->>'customer_id', '') IS NOT NULL
+     LIMIT 1`, [normalizedEmail]);
+    return result.rows.length > 0;
+};
+exports.hasCustomerAccountIdentity = hasCustomerAccountIdentity;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoibG9naW4tY29kZS1hY2NvdW50cy5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uLy4uLy4uL3NyYy9jdXN0b21lci1hdXRoL2xvZ2luLWNvZGUtYWNjb3VudHMudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7O0FBTUEsNkVBQTZFO0FBQ3RFLE1BQU0sb0JBQW9CLEdBQUcsS0FBSyxFQUN2QyxHQUFpQixFQUNqQixRQUFnQixFQUNrQixFQUFFO0lBQ3BDLE1BQU0sTUFBTSxHQUFHLE1BQU0sR0FBRyxDQUFDLEdBQUcsQ0FDMUI7Ozs7Ozs7aUNBTzZCLEVBQzdCLENBQUMsUUFBUSxDQUFDLENBQ1gsQ0FBQTtJQUNELE1BQU0sR0FBRyxHQUFHLE1BQU0sQ0FBQyxJQUFJLENBQUMsQ0FBQyxDQUFDLENBQUE7SUFDMUIsT0FBTyxHQUFHO1FBQ1IsQ0FBQyxDQUFDO1lBQ0Usa0JBQWtCLEVBQUUsTUFBTSxDQUFDLEdBQUcsQ0FBQyxvQkFBb0IsQ0FBQztZQUNwRCxjQUFjLEVBQUUsTUFBTSxDQUFDLEdBQUcsQ0FBQyxnQkFBZ0IsQ0FBQztZQUM1QyxVQUFVLEVBQ1IsT0FBTyxHQUFHLENBQUMsV0FBVyxLQUFLLFFBQVEsSUFBSSxHQUFHLENBQUMsV0FBVztnQkFDcEQsQ0FBQyxDQUFDLEdBQUcsQ0FBQyxXQUFXO2dCQUNqQixDQUFDLENBQUMsSUFBSTtTQUNYO1FBQ0gsQ0FBQyxDQUFDLElBQUksQ0FBQTtBQUNWLENBQUMsQ0FBQTtBQTFCWSxRQUFBLG9CQUFvQix3QkEwQmhDO0FBRUQ7Ozs7R0FJRztBQUNILE1BQU0scUJBQXFCLEdBQUc7Ozs7Ozs7RUFPNUIsQ0FBQTtBQUVGOzs7Ozs7OztHQVFHO0FBQ0ksTUFBTSx5QkFBeUIsR0FBRyxLQUFLLEVBQzVDLEdBQWlCLEVBQ2pCLGVBQXVCLEVBQ2MsRUFBRTtJQUN2QyxNQUFNLE1BQU0sR0FBRyxNQUFNLEdBQUcsQ0FBQyxHQUFHLENBQzFCOztjQUVVLHFCQUFxQjs7Ozs7Ozs7OzttRUFVZ0MsRUFDL0QsQ0FBQyxlQUFlLEVBQUUsZUFBZSxDQUFDLENBQ25DLENBQUE7SUFDRCxPQUFPLE1BQU0sQ0FBQyxJQUFJLENBQUMsR0FBRyxDQUFDLENBQUMsR0FBRyxFQUFFLEVBQUUsQ0FBQyxDQUFDO1FBQy9CLGNBQWMsRUFBRSxNQUFNLENBQUMsR0FBRyxDQUFDLGdCQUFnQixDQUFDO1FBQzVDLFFBQVEsRUFBRSxNQUFNLENBQUMsR0FBRyxDQUFDLFNBQVMsQ0FBQztRQUMvQixTQUFTLEVBQUUsR0FBRyxDQUFDLFNBQVMsS0FBSyxJQUFJO1FBQ2pDLG9CQUFvQixFQUFFLEdBQUcsQ0FBQyxzQkFBc0IsS0FBSyxJQUFJO0tBQzFELENBQUMsQ0FBQyxDQUFBO0FBQ0wsQ0FBQyxDQUFBO0FBMUJZLFFBQUEseUJBQXlCLDZCQTBCckM7QUFFRDs7Ozs7O0dBTUc7QUFDSSxNQUFNLG1DQUFtQyxHQUFHLEtBQUssRUFDdEQsR0FBaUIsRUFDakIsY0FBc0IsRUFDTCxFQUFFO0lBQ25CLE1BQU0sTUFBTSxHQUFHLE1BQU0sR0FBRyxDQUFDLEdBQUcsQ0FDMUI7OztpQkFHYSxxQkFBcUI7cUJBQ2pCLEVBQ2pCLENBQUMsY0FBYyxDQUFDLENBQ2pCLENBQUE7SUFDRCxPQUFPLE1BQU0sQ0FBQyxJQUFJLENBQUMsTUFBTSxDQUFBO0FBQzNCLENBQUMsQ0FBQTtBQWJZLFFBQUEsbUNBQW1DLHVDQWEvQztBQVlEOzs7R0FHRztBQUNJLE1BQU0sc0JBQXNCLEdBQUcsS0FBSyxFQUN6QyxHQUFpQixFQUNqQixlQUF1QixFQUNNLEVBQUU7SUFDL0IsTUFBTSxNQUFNLEdBQUcsTUFBTSxHQUFHLENBQUMsR0FBRyxDQUMxQjs7Ozs7Ozs7O2lDQVM2QixFQUM3QixDQUFDLGVBQWUsQ0FBQyxDQUNsQixDQUFBO0lBQ0QsT0FBTyxNQUFNLENBQUMsSUFBSSxDQUFDLEdBQUcsQ0FBQyxDQUFDLEdBQUcsRUFBRSxFQUFFLENBQUMsQ0FBQztRQUMvQixrQkFBa0IsRUFBRSxNQUFNLENBQUMsR0FBRyxDQUFDLG9CQUFvQixDQUFDO1FBQ3BELGNBQWMsRUFBRSxNQUFNLENBQUMsR0FBRyxDQUFDLGdCQUFnQixDQUFDO1FBQzVDLFFBQVEsRUFBRSxNQUFNLENBQUMsR0FBRyxDQUFDLFNBQVMsQ0FBQztRQUMvQixVQUFVLEVBQ1IsT0FBTyxHQUFHLENBQUMsV0FBVyxLQUFLLFFBQVEsSUFBSSxHQUFHLENBQUMsV0FBVztZQUNwRCxDQUFDLENBQUMsR0FBRyxDQUFDLFdBQVc7WUFDakIsQ0FBQyxDQUFDLElBQUk7S0FDWCxDQUFDLENBQUMsQ0FBQTtBQUNMLENBQUMsQ0FBQTtBQTFCWSxRQUFBLHNCQUFzQiwwQkEwQmxDO0FBRUQ7Ozs7R0FJRztBQUNJLE1BQU0sNkJBQTZCLEdBQUcsS0FBSyxFQUNoRCxHQUFpQixFQUNqQixlQUF1QixFQUNDLEVBQUU7SUFDMUIsTUFBTSxNQUFNLEdBQUcsTUFBTSxHQUFHLENBQUMsR0FBRyxDQUMxQjs7Ozs7Ozs7OEJBUTBCLEVBQzFCLENBQUMsZUFBZSxFQUFFLGVBQWUsQ0FBQyxDQUNuQyxDQUFBO0lBQ0QsTUFBTSxFQUFFLEdBQUcsTUFBTSxDQUFDLElBQUksQ0FBQyxDQUFDLENBQUMsRUFBRSxnQkFBZ0IsQ0FBQTtJQUMzQyxPQUFPLE9BQU8sRUFBRSxLQUFLLFFBQVEsSUFBSSxFQUFFLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQyxDQUFDLENBQUMsSUFBSSxDQUFBO0FBQ2pELENBQUMsQ0FBQTtBQWxCWSxRQUFBLDZCQUE2QixpQ0FrQnpDO0FBRUQ7OztHQUdHO0FBQ0ksTUFBTSwwQkFBMEIsR0FBRyxLQUFLLEVBQzdDLEdBQWlCLEVBQ2pCLGVBQXVCLEVBQ0wsRUFBRTtJQUNwQixNQUFNLE1BQU0sR0FBRyxNQUFNLEdBQUcsQ0FBQyxHQUFHLENBQzFCOzs7Ozs7O2FBT1MsRUFDVCxDQUFDLGVBQWUsQ0FBQyxDQUNsQixDQUFBO0lBQ0QsT0FBTyxNQUFNLENBQUMsSUFBSSxDQUFDLE1BQU0sR0FBRyxDQUFDLENBQUE7QUFDL0IsQ0FBQyxDQUFBO0FBaEJZLFFBQUEsMEJBQTBCLDhCQWdCdEMifQ==

package/.medusa/server/src/customer-auth/login-code-state.js

@@ -0,0 +1,139 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.consumeLoginCode = exports.countLoginCodeAttempt = exports.storeLoginCode = exports.LOGIN_CODE_RESEND_SLACK_SECONDS = void 0;
+const customer_auth_1 = require("@hartl-services/medusa-food-supplements-contracts/schemas/customer-auth");
+/**
+ * The code state lives in `provider_identity.provider_metadata` of the
+ * `email-otp` provider identity: `login_code` is `{ hash, expires_at,
+ * attempts, sent_at }`, `login_code_budget` is `{ window_start, issued }`
+ * (codes issued in the current 24 hour window; issuing a new code does not
+ * reset it, a successful login does). Every transition below is one SQL
+ * statement whose WHERE clause carries the rule, so concurrent requests cannot
+ * both pass it. Time is the database's `now()`, never the application's clock.
+ */
+/**
+ * The storefront starts its resend countdown when it receives the 202, which
+ * is before `sent_at` is written; the spacing check tolerates that head start.
+ */
+exports.LOGIN_CODE_RESEND_SLACK_SECONDS = 5;
+/** Length of the issuance window (fixed, counted from its first code). */
+const LOGIN_CODE_BUDGET_WINDOW_HOURS = 24;
+/** The budget window of the row is still running (`window_start` < 24 h ago). */
+const BUDGET_WINDOW_ACTIVE_SQL = `COALESCE(
+  jsonb_typeof(provider_metadata->'login_code_budget') = 'object'
+  AND (provider_metadata->'login_code_budget'->>'window_start')::timestamptz
+        > now() - make_interval(hours => ${LOGIN_CODE_BUDGET_WINDOW_HOURS}),
+  false
+)`;
+/**
+ * Stores a new code unless one was sent within the resend interval or the
+ * address already got `LOGIN_CODE_MAX_PER_DAY` codes in the running 24 hour
+ * window. Both rules are checked and the code and the budget are written by
+ * one conditional UPDATE. An expired window starts a new one with this code.
+ */
+const storeLoginCode = async (sql, providerIdentityId, hash) => {
+    const result = await sql.raw(`UPDATE provider_identity
+     SET provider_metadata = jsonb_set(
+           jsonb_set(
+             COALESCE(provider_metadata, '{}'::jsonb),
+             '{login_code}',
+             jsonb_build_object(
+               'hash', ?::text,
+               'expires_at', to_jsonb(now() + make_interval(mins => ?)),
+               'attempts', 0,
+               'sent_at', to_jsonb(now())
+             )
+           ),
+           '{login_code_budget}',
+           jsonb_build_object(
+             'window_start', CASE
+               WHEN ${BUDGET_WINDOW_ACTIVE_SQL}
+               THEN provider_metadata->'login_code_budget'->'window_start'
+               ELSE to_jsonb(now())
+             END,
+             'issued', CASE
+               WHEN ${BUDGET_WINDOW_ACTIVE_SQL}
+               THEN to_jsonb((provider_metadata->'login_code_budget'->>'issued')::int + 1)
+               ELSE to_jsonb(1)
+             END
+           )
+         ),
+         updated_at = now()
+     WHERE id = ?
+       AND provider = 'email-otp'
+       AND deleted_at IS NULL
+       AND (
+         jsonb_typeof(provider_metadata->'login_code') IS DISTINCT FROM 'object'
+         OR (provider_metadata->'login_code'->>'sent_at')::timestamptz
+              < now() - make_interval(secs => ?)
+       )
+       AND (
+         NOT ${BUDGET_WINDOW_ACTIVE_SQL}
+         OR (provider_metadata->'login_code_budget'->>'issued')::int < ?
+       )
+     RETURNING id`, [
+        hash,
+        customer_auth_1.LOGIN_CODE_TTL_MINUTES,
+        providerIdentityId,
+        customer_auth_1.LOGIN_CODE_RESEND_INTERVAL_SECONDS - exports.LOGIN_CODE_RESEND_SLACK_SECONDS,
+        customer_auth_1.LOGIN_CODE_MAX_PER_DAY,
+    ]);
+    if (result.rows.length === 1) {
+        return "stored";
+    }
+    // Only to tell the reason apart for the caller's log; the decision above
+    // was already made atomically.
+    const capped = await sql.raw(`SELECT id FROM provider_identity
+     WHERE id = ?
+       AND provider = 'email-otp'
+       AND deleted_at IS NULL
+       AND ${BUDGET_WINDOW_ACTIVE_SQL}
+       AND (provider_metadata->'login_code_budget'->>'issued')::int >= ?`, [providerIdentityId, customer_auth_1.LOGIN_CODE_MAX_PER_DAY]);
+    return capped.rows.length === 1 ? "capped" : "throttled";
+};
+exports.storeLoginCode = storeLoginCode;
+/**
+ * Counts one attempt against the address' live code and returns the stored
+ * hash; null when there is no code, it is expired or its attempts are used
+ * up. The count happens before the comparison, so parallel guesses share the
+ * limit instead of each seeing the same remaining budget.
+ */
+const countLoginCodeAttempt = async (sql, entityId) => {
+    const result = await sql.raw(`UPDATE provider_identity
+     SET provider_metadata = jsonb_set(
+           provider_metadata,
+           '{login_code,attempts}',
+           to_jsonb((provider_metadata->'login_code'->>'attempts')::int + 1)
+         ),
+         updated_at = now()
+     WHERE provider = 'email-otp'
+       AND entity_id = ?
+       AND deleted_at IS NULL
+       AND jsonb_typeof(provider_metadata->'login_code') = 'object'
+       AND (provider_metadata->'login_code'->>'attempts')::int < ?
+       AND (provider_metadata->'login_code'->>'expires_at')::timestamptz > now()
+     RETURNING provider_metadata->'login_code'->>'hash' AS hash`, [entityId, customer_auth_1.LOGIN_CODE_MAX_ATTEMPTS]);
+    const hash = result.rows[0]?.hash;
+    return typeof hash === "string" && hash ? hash : null;
+};
+exports.countLoginCodeAttempt = countLoginCodeAttempt;
+/**
+ * Uses the code up: removes it (and the issuance budget, a successful login
+ * proves the address' owner holds the mailbox) if it is still the one with
+ * `hash` and not expired. Exactly one of several parallel correct logins gets
+ * true.
+ */
+const consumeLoginCode = async (sql, entityId, hash) => {
+    const result = await sql.raw(`UPDATE provider_identity
+     SET provider_metadata = provider_metadata - 'login_code' - 'login_code_budget',
+         updated_at = now()
+     WHERE provider = 'email-otp'
+       AND entity_id = ?
+       AND deleted_at IS NULL
+       AND provider_metadata->'login_code'->>'hash' = ?
+       AND (provider_metadata->'login_code'->>'expires_at')::timestamptz > now()
+     RETURNING id`, [entityId, hash]);
+    return result.rows.length === 1;
+};
+exports.consumeLoginCode = consumeLoginCode;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoibG9naW4tY29kZS1zdGF0ZS5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uLy4uLy4uL3NyYy9jdXN0b21lci1hdXRoL2xvZ2luLWNvZGUtc3RhdGUudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7O0FBQUEsMkdBS2dGO0FBVWhGOzs7Ozs7OztHQVFHO0FBRUg7OztHQUdHO0FBQ1UsUUFBQSwrQkFBK0IsR0FBRyxDQUFDLENBQUE7QUFFaEQsMEVBQTBFO0FBQzFFLE1BQU0sOEJBQThCLEdBQUcsRUFBRSxDQUFBO0FBRXpDLGlGQUFpRjtBQUNqRixNQUFNLHdCQUF3QixHQUFHOzs7MkNBR1UsOEJBQThCOztFQUV2RSxDQUFBO0FBVUY7Ozs7O0dBS0c7QUFDSSxNQUFNLGNBQWMsR0FBRyxLQUFLLEVBQ2pDLEdBQWlCLEVBQ2pCLGtCQUEwQixFQUMxQixJQUFZLEVBQ21CLEVBQUU7SUFDakMsTUFBTSxNQUFNLEdBQUcsTUFBTSxHQUFHLENBQUMsR0FBRyxDQUMxQjs7Ozs7Ozs7Ozs7Ozs7O3NCQWVrQix3QkFBd0I7Ozs7O3NCQUt4Qix3QkFBd0I7Ozs7Ozs7Ozs7Ozs7Ozs7ZUFnQi9CLHdCQUF3Qjs7O2tCQUdyQixFQUNkO1FBQ0UsSUFBSTtRQUNKLHNDQUFzQjtRQUN0QixrQkFBa0I7UUFDbEIsa0RBQWtDLEdBQUcsdUNBQStCO1FBQ3BFLHNDQUFzQjtLQUN2QixDQUNGLENBQUE7SUFDRCxJQUFJLE1BQU0sQ0FBQyxJQUFJLENBQUMsTUFBTSxLQUFLLENBQUMsRUFBRSxDQUFDO1FBQzdCLE9BQU8sUUFBUSxDQUFBO0lBQ2pCLENBQUM7SUFDRCx5RUFBeUU7SUFDekUsK0JBQStCO0lBQy9CLE1BQU0sTUFBTSxHQUFHLE1BQU0sR0FBRyxDQUFDLEdBQUcsQ0FDMUI7Ozs7YUFJUyx3QkFBd0I7eUVBQ29DLEVBQ3JFLENBQUMsa0JBQWtCLEVBQUUsc0NBQXNCLENBQUMsQ0FDN0MsQ0FBQTtJQUNELE9BQU8sTUFBTSxDQUFDLElBQUksQ0FBQyxNQUFNLEtBQUssQ0FBQyxDQUFDLENBQUMsQ0FBQyxRQUFRLENBQUMsQ0FBQyxDQUFDLFdBQVcsQ0FBQTtBQUMxRCxDQUFDLENBQUE7QUFyRVksUUFBQSxjQUFjLGtCQXFFMUI7QUFFRDs7Ozs7R0FLRztBQUNJLE1BQU0scUJBQXFCLEdBQUcsS0FBSyxFQUN4QyxHQUFpQixFQUNqQixRQUFnQixFQUNRLEVBQUU7SUFDMUIsTUFBTSxNQUFNLEdBQUcsTUFBTSxHQUFHLENBQUMsR0FBRyxDQUMxQjs7Ozs7Ozs7Ozs7OztnRUFhNEQsRUFDNUQsQ0FBQyxRQUFRLEVBQUUsdUNBQXVCLENBQUMsQ0FDcEMsQ0FBQTtJQUNELE1BQU0sSUFBSSxHQUFHLE1BQU0sQ0FBQyxJQUFJLENBQUMsQ0FBQyxDQUFDLEVBQUUsSUFBSSxDQUFBO0lBQ2pDLE9BQU8sT0FBTyxJQUFJLEtBQUssUUFBUSxJQUFJLElBQUksQ0FBQyxDQUFDLENBQUMsSUFBSSxDQUFDLENBQUMsQ0FBQyxJQUFJLENBQUE7QUFDdkQsQ0FBQyxDQUFBO0FBdkJZLFFBQUEscUJBQXFCLHlCQXVCakM7QUFFRDs7Ozs7R0FLRztBQUNJLE1BQU0sZ0JBQWdCLEdBQUcsS0FBSyxFQUNuQyxHQUFpQixFQUNqQixRQUFnQixFQUNoQixJQUFZLEVBQ00sRUFBRTtJQUNwQixNQUFNLE1BQU0sR0FBRyxNQUFNLEdBQUcsQ0FBQyxHQUFHLENBQzFCOzs7Ozs7OztrQkFRYyxFQUNkLENBQUMsUUFBUSxFQUFFLElBQUksQ0FBQyxDQUNqQixDQUFBO0lBQ0QsT0FBTyxNQUFNLENBQUMsSUFBSSxDQUFDLE1BQU0sS0FBSyxDQUFDLENBQUE7QUFDakMsQ0FBQyxDQUFBO0FBbEJZLFFBQUEsZ0JBQWdCLG9CQWtCNUIifQ==

package/.medusa/server/src/customer-auth/plugin-features.js

@@ -0,0 +1,80 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.customerAuthPluginFeatures = void 0;
+const customer_auth_1 = require("@hartl-services/medusa-food-supplements-contracts/schemas/customer-auth");
+const descriptor_1 = require("../public/descriptor");
+const PASSWORD_RULES = "Passwort-Regeln";
+exports.customerAuthPluginFeatures = (0, descriptor_1.definePluginFeatures)({
+    plugin_key: customer_auth_1.CUSTOMER_AUTH_PLUGIN_KEY,
+    label: "Kunden-Login",
+    description: "Welche Anmeldemethoden Kunden im Shop nutzen können. Mindestens eine Methode muss eingeschaltet bleiben, sonst kann sich niemand mehr anmelden; Admin-Benutzer melden sich unabhängig davon mit E-Mail und Passwort an. Eine Änderung wirkt innerhalb von etwa 30 Sekunden im Backend, die Storefront übernimmt sie nach ihrem Zwischenspeicher (etwa eine Minute). Die Passwort-Regeln gelten nur für Kunden, solange „E-Mail + Passwort“ eingeschaltet ist; Admin-Benutzer behalten mindestens 15 Zeichen, die bei der ersten Anmeldung eines noch nicht angelegten Admin-Benutzers (Einladung) geprüft werden.",
+    summary: "Anmeldemethoden und Passwort-Regeln für Kunden.",
+    icon: "ShieldCheck",
+    switchable: false,
+    features_heading: "Anmeldemethoden",
+    features_note: "Wirkt nach ca. 30 Sekunden im Backend, in der Storefront nach ca. 1 Minute.",
+    all_off_warning: "Keine Methode eingeschaltet: Kunden können sich nicht mehr anmelden.",
+    require_enabled_feature: true,
+    features: [
+        {
+            key: customer_auth_1.CUSTOMER_AUTH_FEATURES.emailPassword,
+            label: "E-Mail + Passwort",
+            description: "Anmeldung, Registrierung und Passwort-Zurücksetzen. Aus: Das Backend lehnt diese Wege für Kunden ab; bestehende Konten melden sich dann nur noch mit den anderen eingeschalteten Methoden an.",
+            default_enabled: true,
+        },
+        {
+            key: customer_auth_1.CUSTOMER_AUTH_FEATURES.emailOtp,
+            label: "Anmeldecode per E-Mail",
+            description: "Kunden fordern einen sechsstelligen Code an, der 10 Minuten gültig ist, und melden sich damit an; für neue Adressen entsteht dabei ein Kundenkonto. Ein bestehendes Passwort-Konto derselben Adresse wird nur verknüpft, wenn die Passwort-Anmeldung aus ist oder die Adresse bestätigt wurde. Die Code-Mail geht unabhängig von den Schaltern des E-Mail-Plugins hinaus. Aus: Code-Anfrage und Code-Anmeldung sind nicht möglich.",
+            default_enabled: false,
+        },
+    ],
+    setting_groups: [
+        {
+            name: PASSWORD_RULES,
+            description: "Gelten nur für Kunden mit „E-Mail + Passwort“, bei Registrierung und Passwort-Zurücksetzen. Admin-Benutzer behalten mindestens 15 Zeichen.",
+            requires_feature: customer_auth_1.CUSTOMER_AUTH_FEATURES.emailPassword,
+        },
+    ],
+    settings: [
+        {
+            key: "password_min_length",
+            label: "Mindestlänge",
+            description: "Wie viele Zeichen ein Kundenpasswort mindestens haben muss (8 bis 128). NIST SP 800-63B Rev. 4, die US-Richtlinie für digitale Identität, empfiehlt mindestens 15 Zeichen, wenn das Passwort der einzige Faktor ist. Die Regeln gelten nur, solange „E-Mail + Passwort“ eingeschaltet ist, und nur für Kunden; Admin-Benutzer behalten mindestens 15 Zeichen. Bestehende Passwörter bleiben gültig, die Regeln greifen bei Registrierung und Passwort-Zurücksetzen. Grenze: Wer sich über den Admin-Weg registriert, kann 15 Zeichen ohne Zusammensetzungsregeln wählen, auch wenn der Shop mehr verlangt; das schwächt nur das eigene Passwort.",
+            hint: "8 bis 128 Zeichen. Empfohlen: mindestens 15 (NIST SP 800-63B).",
+            group: PASSWORD_RULES,
+            width: "half",
+            type: "number",
+            min: 8,
+            max: 128,
+            integer: true,
+            default: 15,
+        },
+        {
+            key: "password_require_mixed_case",
+            label: "Groß- und Kleinbuchstaben verlangen",
+            description: "Mindestens ein Groß- und ein Kleinbuchstabe.",
+            hint: "NIST rät von Zusammensetzungsregeln ab: Sie führen zu vorhersehbaren Passwörtern wie „Passwort1!“. Länge schützt besser.",
+            group: PASSWORD_RULES,
+            type: "boolean",
+            default: false,
+        },
+        {
+            key: "password_require_digit",
+            label: "Ziffer verlangen",
+            description: "Mindestens eine Ziffer.",
+            group: PASSWORD_RULES,
+            type: "boolean",
+            default: false,
+        },
+        {
+            key: "password_require_symbol",
+            label: "Sonderzeichen verlangen",
+            description: "Mindestens ein Sonderzeichen (kein Buchstabe, keine Ziffer, kein Leerzeichen).",
+            group: PASSWORD_RULES,
+            type: "boolean",
+            default: false,
+        },
+    ],
+});
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicGx1Z2luLWZlYXR1cmVzLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vLi4vLi4vc3JjL2N1c3RvbWVyLWF1dGgvcGx1Z2luLWZlYXR1cmVzLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7OztBQUFBLDJHQUdnRjtBQUVoRixxREFBMkQ7QUFFM0QsTUFBTSxjQUFjLEdBQUcsaUJBQWlCLENBQUE7QUFFM0IsUUFBQSwwQkFBMEIsR0FBRyxJQUFBLGlDQUFvQixFQUFDO0lBQzdELFVBQVUsRUFBRSx3Q0FBd0I7SUFDcEMsS0FBSyxFQUFFLGNBQWM7SUFDckIsV0FBVyxFQUNULG1sQkFBbWxCO0lBQ3JsQixPQUFPLEVBQUUsaURBQWlEO0lBQzFELElBQUksRUFBRSxhQUFhO0lBQ25CLFVBQVUsRUFBRSxLQUFLO0lBQ2pCLGdCQUFnQixFQUFFLGlCQUFpQjtJQUNuQyxhQUFhLEVBQ1gsNkVBQTZFO0lBQy9FLGVBQWUsRUFDYixzRUFBc0U7SUFDeEUsdUJBQXVCLEVBQUUsSUFBSTtJQUM3QixRQUFRLEVBQUU7UUFDUjtZQUNFLEdBQUcsRUFBRSxzQ0FBc0IsQ0FBQyxhQUFhO1lBQ3pDLEtBQUssRUFBRSxtQkFBbUI7WUFDMUIsV0FBVyxFQUNULCtMQUErTDtZQUNqTSxlQUFlLEVBQUUsSUFBSTtTQUN0QjtRQUNEO1lBQ0UsR0FBRyxFQUFFLHNDQUFzQixDQUFDLFFBQVE7WUFDcEMsS0FBSyxFQUFFLHdCQUF3QjtZQUMvQixXQUFXLEVBQ1Qsb2FBQW9hO1lBQ3RhLGVBQWUsRUFBRSxLQUFLO1NBQ3ZCO0tBQ0Y7SUFDRCxjQUFjLEVBQUU7UUFDZDtZQUNFLElBQUksRUFBRSxjQUFjO1lBQ3BCLFdBQVcsRUFDVCw0SUFBNEk7WUFDOUksZ0JBQWdCLEVBQUUsc0NBQXNCLENBQUMsYUFBYTtTQUN2RDtLQUNGO0lBQ0QsUUFBUSxFQUFFO1FBQ1I7WUFDRSxHQUFHLEVBQUUscUJBQXFCO1lBQzFCLEtBQUssRUFBRSxjQUFjO1lBQ3JCLFdBQVcsRUFDVCxrbkJBQWtuQjtZQUNwbkIsSUFBSSxFQUFFLGdFQUFnRTtZQUN0RSxLQUFLLEVBQUUsY0FBYztZQUNyQixLQUFLLEVBQUUsTUFBTTtZQUNiLElBQUksRUFBRSxRQUFRO1lBQ2QsR0FBRyxFQUFFLENBQUM7WUFDTixHQUFHLEVBQUUsR0FBRztZQUNSLE9BQU8sRUFBRSxJQUFJO1lBQ2IsT0FBTyxFQUFFLEVBQUU7U0FDWjtRQUNEO1lBQ0UsR0FBRyxFQUFFLDZCQUE2QjtZQUNsQyxLQUFLLEVBQUUscUNBQXFDO1lBQzVDLFdBQVcsRUFBRSw4Q0FBOEM7WUFDM0QsSUFBSSxFQUFFLDBIQUEwSDtZQUNoSSxLQUFLLEVBQUUsY0FBYztZQUNyQixJQUFJLEVBQUUsU0FBUztZQUNmLE9BQU8sRUFBRSxLQUFLO1NBQ2Y7UUFDRDtZQUNFLEdBQUcsRUFBRSx3QkFBd0I7WUFDN0IsS0FBSyxFQUFFLGtCQUFrQjtZQUN6QixXQUFXLEVBQUUseUJBQXlCO1lBQ3RDLEtBQUssRUFBRSxjQUFjO1lBQ3JCLElBQUksRUFBRSxTQUFTO1lBQ2YsT0FBTyxFQUFFLEtBQUs7U0FDZjtRQUNEO1lBQ0UsR0FBRyxFQUFFLHlCQUF5QjtZQUM5QixLQUFLLEVBQUUseUJBQXlCO1lBQ2hDLFdBQVcsRUFBRSxnRkFBZ0Y7WUFDN0YsS0FBSyxFQUFFLGNBQWM7WUFDckIsSUFBSSxFQUFFLFNBQVM7WUFDZixPQUFPLEVBQUUsS0FBSztTQUNmO0tBQ0Y7Q0FDRixDQUFDLENBQUEifQ==

package/.medusa/server/src/customer-auth/remove-provider-identity.js

@@ -0,0 +1,18 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.removeProviderIdentity = void 0;
+/**
+ * Deletes a provider identity for good and, when no provider identity is left
+ * on its auth identity, the auth identity too. The unique index on
+ * `(entity_id, provider)` has no `deleted_at` filter, so a soft delete would
+ * block the address for a new registration.
+ */
+const removeProviderIdentity = async (auth, identity) => {
+    await auth.deleteProviderIdentities([identity.providerIdentityId]);
+    const remaining = await auth.listProviderIdentities({ auth_identity_id: identity.authIdentityId }, { select: ["id"], take: 1 });
+    if (!remaining.length) {
+        await auth.deleteAuthIdentities([identity.authIdentityId]);
+    }
+};
+exports.removeProviderIdentity = removeProviderIdentity;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicmVtb3ZlLXByb3ZpZGVyLWlkZW50aXR5LmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vLi4vLi4vc3JjL2N1c3RvbWVyLWF1dGgvcmVtb3ZlLXByb3ZpZGVyLWlkZW50aXR5LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7OztBQUVBOzs7OztHQUtHO0FBQ0ksTUFBTSxzQkFBc0IsR0FBRyxLQUFLLEVBQ3pDLElBQXdCLEVBQ3hCLFFBQTBFLEVBQzNELEVBQUU7SUFDakIsTUFBTSxJQUFJLENBQUMsd0JBQXdCLENBQUMsQ0FBQyxRQUFRLENBQUMsa0JBQWtCLENBQUMsQ0FBQyxDQUFBO0lBQ2xFLE1BQU0sU0FBUyxHQUFHLE1BQU0sSUFBSSxDQUFDLHNCQUFzQixDQUNqRCxFQUFFLGdCQUFnQixFQUFFLFFBQVEsQ0FBQyxjQUFjLEVBQUUsRUFDN0MsRUFBRSxNQUFNLEVBQUUsQ0FBQyxJQUFJLENBQUMsRUFBRSxJQUFJLEVBQUUsQ0FBQyxFQUFFLENBQzVCLENBQUE7SUFDRCxJQUFJLENBQUMsU0FBUyxDQUFDLE1BQU0sRUFBRSxDQUFDO1FBQ3RCLE1BQU0sSUFBSSxDQUFDLG9CQUFvQixDQUFDLENBQUMsUUFBUSxDQUFDLGNBQWMsQ0FBQyxDQUFDLENBQUE7SUFDNUQsQ0FBQztBQUNILENBQUMsQ0FBQTtBQVpZLFFBQUEsc0JBQXNCLDBCQVlsQyJ9

package/.medusa/server/src/customer-auth/start-customer-auth-methods.js

@@ -0,0 +1,20 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.stopCustomerAuthMethods = exports.startCustomerAuthMethods = void 0;
+const utils_1 = require("@medusajs/framework/utils");
+const module_access_1 = require("../public/module-access");
+const customer_auth_methods_snapshot_1 = require("./customer-auth-methods-snapshot");
+const plugin_features_1 = require("./plugin-features");
+/**
+ * Hands the snapshot behind `authMethodsPerActor` its reader (the effective
+ * `customer_auth` switches) and loads it once. Called when the application
+ * has started, with the application container: the config getter that needs
+ * the switches has no container of its own.
+ */
+const startCustomerAuthMethods = (container) => (0, customer_auth_methods_snapshot_1.startCustomerAuthMethodsSnapshot)({
+    read: async () => (await (0, module_access_1.resolveBaseModule)(container).retrieveEffectiveFeatures(plugin_features_1.customerAuthPluginFeatures)).features,
+    warn: (message) => container.resolve(utils_1.ContainerRegistrationKeys.LOGGER).warn(message),
+});
+exports.startCustomerAuthMethods = startCustomerAuthMethods;
+exports.stopCustomerAuthMethods = customer_auth_methods_snapshot_1.stopCustomerAuthMethodsSnapshot;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic3RhcnQtY3VzdG9tZXItYXV0aC1tZXRob2RzLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vLi4vLi4vc3JjL2N1c3RvbWVyLWF1dGgvc3RhcnQtY3VzdG9tZXItYXV0aC1tZXRob2RzLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7OztBQUNBLHFEQUFxRTtBQUVyRSwyREFBMkQ7QUFFM0QscUZBR3lDO0FBQ3pDLHVEQUE4RDtBQVE5RDs7Ozs7R0FLRztBQUNJLE1BQU0sd0JBQXdCLEdBQUcsQ0FDdEMsU0FBMEIsRUFDWCxFQUFFLENBQ2pCLElBQUEsaUVBQWdDLEVBQUM7SUFDL0IsSUFBSSxFQUFFLEtBQUssSUFBSSxFQUFFLENBQ2YsQ0FDRSxNQUFNLElBQUEsaUNBQWlCLEVBQ3JCLFNBQVMsQ0FDVixDQUFDLHlCQUF5QixDQUFDLDRDQUEwQixDQUFDLENBQ3hELENBQUMsUUFBUTtJQUNaLElBQUksRUFBRSxDQUFDLE9BQU8sRUFBRSxFQUFFLENBQ2hCLFNBQVMsQ0FBQyxPQUFPLENBQVMsaUNBQXlCLENBQUMsTUFBTSxDQUFDLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQztDQUM1RSxDQUFDLENBQUE7QUFaUyxRQUFBLHdCQUF3Qiw0QkFZakM7QUFFUyxRQUFBLHVCQUF1QixHQUFHLGdFQUErQixDQUFBIn0=

package/.medusa/server/src/documents/plugin-features.js

@@ -6,6 +6,10 @@ exports.documentsPluginFeatures = (0, public_1.definePluginFeatures)({
     plugin_key: "documents",
     label: "Dokumente",
     description: "Rechnungen, Stornos und Packlisten zu Bestellungen. Ausgeschaltet sind alle Dokument-Routen in Admin und Storefront nicht erreichbar und es werden keine neuen Dokumente erstellt; bereits ausgestellte Dokumente bleiben gespeichert. Checkout, Fulfillment und Versand laufen unverändert weiter.",
+    summary: "Rechnungen, Stornos und Packlisten zu Bestellungen.",
+    icon: "DocumentText",
+    disable_hint: "Aus: Dokument-Routen sind nicht erreichbar, es entstehen keine neuen Dokumente. Bestehende bleiben gespeichert.",
+    disable_confirm: "Alle Dokument-Routen in Admin und Storefront sind dann nicht erreichbar, und es werden keine neuen Dokumente erstellt. Bereits ausgestellte Dokumente bleiben gespeichert. Checkout, Fulfillment und Versand laufen unverändert weiter.",
     features: [
         {
             key: "invoices",
@@ -16,7 +20,7 @@ exports.documentsPluginFeatures = (0, public_1.definePluginFeatures)({
         {
             key: "packing_lists",
             label: "Packlisten",
-            description: "Packlisten je Fulfillment inklusive Chargenrevisionen und Abruf im Admin.",
+            description: "Eine Packliste je Fulfillment, inklusive Chargenrevisionen und Abruf im Admin.",
             default_enabled: true,
         },
     ],
@@ -25,8 +29,10 @@ exports.documentsPluginFeatures = (0, public_1.definePluginFeatures)({
             key: "payment_terms",
             label: "Zahlungskonditionen",
             description: "Erscheint auf Rechnungen unter den Summen, z. B. „Der Betrag wurde bei der Bestellung per Kreditkarte bezahlt.“ Leer lassen, wenn nichts stehen soll. Gilt für neu erstellte und neu erzeugte Rechnungen.",
+            hint: "Erscheint auf Rechnungen unter den Summen.",
+            placeholder: "z. B. Der Betrag wurde bei der Bestellung per Kreditkarte bezahlt.",
             type: "string",
         },
     ],
 });
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicGx1Z2luLWZlYXR1cmVzLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vLi4vLi4vc3JjL2RvY3VtZW50cy9wbHVnaW4tZmVhdHVyZXMudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7O0FBQUEsc0NBQWdEO0FBRW5DLFFBQUEsdUJBQXVCLEdBQUcsSUFBQSw2QkFBb0IsRUFBQztJQUMxRCxVQUFVLEVBQUUsV0FBVztJQUN2QixLQUFLLEVBQUUsV0FBVztJQUNsQixXQUFXLEVBQ1QscVNBQXFTO0lBQ3ZTLFFBQVEsRUFBRTtRQUNSO1lBQ0UsR0FBRyxFQUFFLFVBQVU7WUFDZixLQUFLLEVBQUUsc0JBQXNCO1lBQzdCLFdBQVcsRUFDVCxzYkFBc2I7WUFDeGIsZUFBZSxFQUFFLElBQUk7U0FDdEI7UUFDRDtZQUNFLEdBQUcsRUFBRSxlQUFlO1lBQ3BCLEtBQUssRUFBRSxZQUFZO1lBQ25CLFdBQVcsRUFDVCwyRUFBMkU7WUFDN0UsZUFBZSxFQUFFLElBQUk7U0FDdEI7S0FDRjtJQUNELFFBQVEsRUFBRTtRQUNSO1lBQ0UsR0FBRyxFQUFFLGVBQWU7WUFDcEIsS0FBSyxFQUFFLHFCQUFxQjtZQUM1QixXQUFXLEVBQ1QsMk1BQTJNO1lBQzdNLElBQUksRUFBRSxRQUFRO1NBQ2Y7S0FDRjtDQUNGLENBQUMsQ0FBQSJ9
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicGx1Z2luLWZlYXR1cmVzLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vLi4vLi4vc3JjL2RvY3VtZW50cy9wbHVnaW4tZmVhdHVyZXMudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7O0FBQUEsc0NBQWdEO0FBRW5DLFFBQUEsdUJBQXVCLEdBQUcsSUFBQSw2QkFBb0IsRUFBQztJQUMxRCxVQUFVLEVBQUUsV0FBVztJQUN2QixLQUFLLEVBQUUsV0FBVztJQUNsQixXQUFXLEVBQ1QscVNBQXFTO0lBQ3ZTLE9BQU8sRUFBRSxxREFBcUQ7SUFDOUQsSUFBSSxFQUFFLGNBQWM7SUFDcEIsWUFBWSxFQUNWLGlIQUFpSDtJQUNuSCxlQUFlLEVBQ2IseU9BQXlPO0lBQzNPLFFBQVEsRUFBRTtRQUNSO1lBQ0UsR0FBRyxFQUFFLFVBQVU7WUFDZixLQUFLLEVBQUUsc0JBQXNCO1lBQzdCLFdBQVcsRUFDVCxzYkFBc2I7WUFDeGIsZUFBZSxFQUFFLElBQUk7U0FDdEI7UUFDRDtZQUNFLEdBQUcsRUFBRSxlQUFlO1lBQ3BCLEtBQUssRUFBRSxZQUFZO1lBQ25CLFdBQVcsRUFDVCxnRkFBZ0Y7WUFDbEYsZUFBZSxFQUFFLElBQUk7U0FDdEI7S0FDRjtJQUNELFFBQVEsRUFBRTtRQUNSO1lBQ0UsR0FBRyxFQUFFLGVBQWU7WUFDcEIsS0FBSyxFQUFFLHFCQUFxQjtZQUM1QixXQUFXLEVBQ1QsMk1BQTJNO1lBQzdNLElBQUksRUFBRSw0Q0FBNEM7WUFDbEQsV0FBVyxFQUFFLG9FQUFvRTtZQUNqRixJQUFJLEVBQUUsUUFBUTtTQUNmO0tBQ0Y7Q0FDRixDQUFDLENBQUEifQ==

package/.medusa/server/src/email/application/deliver-ephemeral-auth-mail.js

@@ -0,0 +1,186 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.deliverEphemeralAuthMail = void 0;
+const utils_1 = require("@medusajs/framework/utils");
+const failure_classification_1 = require("../domain/failure-classification");
+const load_email_shop_details_1 = require("../rendering/load-email-shop-details");
+const load_template_1 = require("../templates/load-template");
+const dispatch_email_message_1 = require("../../workflows/email/dispatch-email-message");
+const asNotificationRecord = (value) => {
+    if (!value || typeof value !== "object") {
+        return null;
+    }
+    const record = value;
+    if (typeof record.id !== "string" ||
+        !record.id.trim() ||
+        (record.status !== "failure" &&
+            record.status !== "pending" &&
+            record.status !== "success")) {
+        return null;
+    }
+    return { id: record.id, status: record.status };
+};
+const failClaim = async (email, claim, code, now, notificationId = null) => {
+    const completed = await email.markAttemptFailed({
+        attempt_id: claim.attempt.id,
+        attempt_token: claim.attempt_token,
+        failure_code: code,
+        finished_at: now,
+        notification_id: notificationId,
+    });
+    return {
+        kind: "done",
+        result: {
+            attempt_id: claim.attempt.id,
+            code,
+            message_id: completed.message.id,
+            status: "failed",
+        },
+    };
+};
+/**
+ * One delivery attempt of a claimed message whose content carries a secret
+ * that lives only in the caller's `render` closure (password reset link,
+ * account confirmation link, login code): renders it, renews the lease, hands
+ * the content to the notification module and records the outcome on the
+ * attempt. The message stores no template data of the secret, the notification
+ * record keeps only ids, and nothing here is logged.
+ *
+ * Customer mails only (`resource_type` "customer").
+ */
+const deliverEphemeralAuthMail = async ({ claim, container, email, expiresAt, getNow, kind, maxAttempts, render, retryDelayMs, triggerType, }) => {
+    // A stored template never fails the mail: it falls back to the default.
+    const [shop, template] = await Promise.all([
+        (0, load_email_shop_details_1.loadEmailShopDetails)(container),
+        (0, load_template_1.loadEmailTemplate)(container, email, kind),
+    ]);
+    let rendered;
+    try {
+        rendered = render({
+            configuration: email.getDispatchConfiguration(),
+            shop,
+            template,
+        });
+    }
+    catch {
+        return await failClaim(email, claim, "render_failed", getNow());
+    }
+    const beforeNotification = getNow();
+    if (expiresAt.getTime() <= beforeNotification.getTime()) {
+        return await failClaim(email, claim, "payload_expired", beforeNotification);
+    }
+    try {
+        await email.renewAttemptLease({
+            attempt_id: claim.attempt.id,
+            attempt_token: claim.attempt_token,
+            now: beforeNotification,
+        });
+    }
+    catch {
+        return { kind: "retry" };
+    }
+    const notifications = container.resolve(utils_1.Modules.NOTIFICATION);
+    const safeData = {
+        attempt_id: claim.attempt.id,
+        kind: claim.message.kind,
+        message_id: claim.message.id,
+    };
+    let creationError;
+    let created = null;
+    try {
+        created = asNotificationRecord(await notifications.createNotifications({
+            channel: "email",
+            content: {
+                html: rendered.html,
+                subject: rendered.subject,
+                text: rendered.text,
+            },
+            data: safeData,
+            idempotency_key: (0, failure_classification_1.emailAttemptNotificationKey)(claim.attempt.id),
+            ...(claim.previous_notification_id
+                ? { original_notification_id: claim.previous_notification_id }
+                : {}),
+            provider_data: safeData,
+            ...(claim.message.resource_id
+                ? { resource_id: claim.message.resource_id }
+                : {}),
+            resource_type: "customer",
+            template: claim.message.kind,
+            to: claim.message.recipient,
+            trigger_type: triggerType,
+        }));
+    }
+    catch (error) {
+        creationError = error;
+    }
+    let persisted = null;
+    let lookupFailed = false;
+    if (!created || creationError) {
+        try {
+            persisted = await (0, dispatch_email_message_1.findAttemptNotification)(container, claim.attempt.id);
+        }
+        catch {
+            lookupFailed = true;
+        }
+    }
+    const notification = created ?? persisted;
+    const finishedAt = getNow();
+    if (notification?.status === "success") {
+        const completed = await email.markAttemptSent({
+            attempt_id: claim.attempt.id,
+            attempt_token: claim.attempt_token,
+            finished_at: finishedAt,
+            notification_id: notification.id,
+        });
+        return {
+            kind: "done",
+            result: {
+                attempt_id: claim.attempt.id,
+                message_id: completed.message.id,
+                status: "sent",
+            },
+        };
+    }
+    const failure = creationError && notification?.status === "failure" && !lookupFailed
+        ? (0, failure_classification_1.classifyNotificationFailure)(creationError)
+        : { code: "outcome_unknown", outcome: "unknown" };
+    if (failure.outcome === "retryable") {
+        const nextAttemptAt = new Date(finishedAt.getTime() + retryDelayMs);
+        if (claim.attempt.attempt_number < maxAttempts &&
+            nextAttemptAt.getTime() < expiresAt.getTime()) {
+            await email.markAttemptRetryable({
+                attempt_id: claim.attempt.id,
+                attempt_token: claim.attempt_token,
+                failure_code: failure.code,
+                finished_at: finishedAt,
+                next_attempt_at: nextAttemptAt,
+                notification_id: notification?.id ?? null,
+            });
+            return { kind: "retry" };
+        }
+        return await failClaim(email, claim, expiresAt.getTime() <= nextAttemptAt.getTime()
+            ? "payload_expired"
+            : "retry_exhausted", finishedAt, notification?.id ?? null);
+    }
+    if (failure.outcome === "failed") {
+        return await failClaim(email, claim, failure.code, finishedAt, notification?.id ?? null);
+    }
+    const completed = await email.markAttemptUnknown({
+        attempt_id: claim.attempt.id,
+        attempt_token: claim.attempt_token,
+        failure_code: failure.code,
+        finished_at: finishedAt,
+        notification_id: notification?.id ?? null,
+    });
+    return {
+        kind: "done",
+        result: {
+            attempt_id: claim.attempt.id,
+            code: failure.code,
+            message_id: completed.message.id,
+            status: "unknown",
+        },
+    };
+};
+exports.deliverEphemeralAuthMail = deliverEphemeralAuthMail;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZGVsaXZlci1lcGhlbWVyYWwtYXV0aC1tYWlsLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vLi4vLi4vLi4vc3JjL2VtYWlsL2FwcGxpY2F0aW9uL2RlbGl2ZXItZXBoZW1lcmFsLWF1dGgtbWFpbC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7QUFJQSxxREFBb0Q7QUFFcEQsNkVBRzBDO0FBRzFDLGtGQUE0RTtBQUU1RSw4REFBK0Q7QUFPL0QseUZBQXVGO0FBK0N2RixNQUFNLG9CQUFvQixHQUFHLENBQUMsS0FBYyxFQUE2QixFQUFFO0lBQ3pFLElBQUksQ0FBQyxLQUFLLElBQUksT0FBTyxLQUFLLEtBQUssUUFBUSxFQUFFLENBQUM7UUFDeEMsT0FBTyxJQUFJLENBQUM7SUFDZCxDQUFDO0lBQ0QsTUFBTSxNQUFNLEdBQUcsS0FBZ0MsQ0FBQztJQUNoRCxJQUNFLE9BQU8sTUFBTSxDQUFDLEVBQUUsS0FBSyxRQUFRO1FBQzdCLENBQUMsTUFBTSxDQUFDLEVBQUUsQ0FBQyxJQUFJLEVBQUU7UUFDakIsQ0FBQyxNQUFNLENBQUMsTUFBTSxLQUFLLFNBQVM7WUFDMUIsTUFBTSxDQUFDLE1BQU0sS0FBSyxTQUFTO1lBQzNCLE1BQU0sQ0FBQyxNQUFNLEtBQUssU0FBUyxDQUFDLEVBQzlCLENBQUM7UUFDRCxPQUFPLElBQUksQ0FBQztJQUNkLENBQUM7SUFDRCxPQUFPLEVBQUUsRUFBRSxFQUFFLE1BQU0sQ0FBQyxFQUFFLEVBQUUsTUFBTSxFQUFFLE1BQU0sQ0FBQyxNQUFNLEVBQUUsQ0FBQztBQUNsRCxDQUFDLENBQUM7QUFFRixNQUFNLFNBQVMsR0FBRyxLQUFLLEVBQ3JCLEtBQXlCLEVBQ3pCLEtBQXdCLEVBQ3hCLElBQVksRUFDWixHQUFTLEVBQ1QsaUJBQWdDLElBQUksRUFDRCxFQUFFO0lBQ3JDLE1BQU0sU0FBUyxHQUFHLE1BQU0sS0FBSyxDQUFDLGlCQUFpQixDQUFDO1FBQzlDLFVBQVUsRUFBRSxLQUFLLENBQUMsT0FBTyxDQUFDLEVBQUU7UUFDNUIsYUFBYSxFQUFFLEtBQUssQ0FBQyxhQUFhO1FBQ2xDLFlBQVksRUFBRSxJQUFJO1FBQ2xCLFdBQVcsRUFBRSxHQUFHO1FBQ2hCLGVBQWUsRUFBRSxjQUFjO0tBQ2hDLENBQUMsQ0FBQztJQUNILE9BQU87UUFDTCxJQUFJLEVBQUUsTUFBTTtRQUNaLE1BQU0sRUFBRTtZQUNOLFVBQVUsRUFBRSxLQUFLLENBQUMsT0FBTyxDQUFDLEVBQUU7WUFDNUIsSUFBSTtZQUNKLFVBQVUsRUFBRSxTQUFTLENBQUMsT0FBTyxDQUFDLEVBQUU7WUFDaEMsTUFBTSxFQUFFLFFBQVE7U0FDakI7S0FDRixDQUFDO0FBQ0osQ0FBQyxDQUFDO0FBRUY7Ozs7Ozs7OztHQVNHO0FBQ0ksTUFBTSx3QkFBd0IsR0FBRyxLQUFLLEVBQUUsRUFDN0MsS0FBSyxFQUNMLFNBQVMsRUFDVCxLQUFLLEVBQ0wsU0FBUyxFQUNULE1BQU0sRUFDTixJQUFJLEVBQ0osV0FBVyxFQUNYLE1BQU0sRUFDTixZQUFZLEVBQ1osV0FBVyxHQUNjLEVBQXFDLEVBQUU7SUFDaEUsd0VBQXdFO0lBQ3hFLE1BQU0sQ0FBQyxJQUFJLEVBQUUsUUFBUSxDQUFDLEdBQUcsTUFBTSxPQUFPLENBQUMsR0FBRyxDQUFDO1FBQ3pDLElBQUEsOENBQW9CLEVBQUMsU0FBUyxDQUFDO1FBQy9CLElBQUEsaUNBQWlCLEVBQUMsU0FBUyxFQUFFLEtBQUssRUFBRSxJQUFJLENBQUM7S0FDMUMsQ0FBQyxDQUFDO0lBQ0gsSUFBSSxRQUF1QixDQUFDO0lBQzVCLElBQUksQ0FBQztRQUNILFFBQVEsR0FBRyxNQUFNLENBQUM7WUFDaEIsYUFBYSxFQUFFLEtBQUssQ0FBQyx3QkFBd0IsRUFBRTtZQUMvQyxJQUFJO1lBQ0osUUFBUTtTQUNULENBQUMsQ0FBQztJQUNMLENBQUM7SUFBQyxNQUFNLENBQUM7UUFDUCxPQUFPLE1BQU0sU0FBUyxDQUFDLEtBQUssRUFBRSxLQUFLLEVBQUUsZUFBZSxFQUFFLE1BQU0sRUFBRSxDQUFDLENBQUM7SUFDbEUsQ0FBQztJQUVELE1BQU0sa0JBQWtCLEdBQUcsTUFBTSxFQUFFLENBQUM7SUFDcEMsSUFBSSxTQUFTLENBQUMsT0FBTyxFQUFFLElBQUksa0JBQWtCLENBQUMsT0FBTyxFQUFFLEVBQUUsQ0FBQztRQUN4RCxPQUFPLE1BQU0sU0FBUyxDQUFDLEtBQUssRUFBRSxLQUFLLEVBQUUsaUJBQWlCLEVBQUUsa0JBQWtCLENBQUMsQ0FBQztJQUM5RSxDQUFDO0lBQ0QsSUFBSSxDQUFDO1FBQ0gsTUFBTSxLQUFLLENBQUMsaUJBQWlCLENBQUM7WUFDNUIsVUFBVSxFQUFFLEtBQUssQ0FBQyxPQUFPLENBQUMsRUFBRTtZQUM1QixhQUFhLEVBQUUsS0FBSyxDQUFDLGFBQWE7WUFDbEMsR0FBRyxFQUFFLGtCQUFrQjtTQUN4QixDQUFDLENBQUM7SUFDTCxDQUFDO0lBQUMsTUFBTSxDQUFDO1FBQ1AsT0FBTyxFQUFFLElBQUksRUFBRSxPQUFPLEVBQUUsQ0FBQztJQUMzQixDQUFDO0lBRUQsTUFBTSxhQUFhLEdBQUcsU0FBUyxDQUFDLE9BQU8sQ0FDckMsZUFBTyxDQUFDLFlBQVksQ0FDckIsQ0FBQztJQUNGLE1BQU0sUUFBUSxHQUFHO1FBQ2YsVUFBVSxFQUFFLEtBQUssQ0FBQyxPQUFPLENBQUMsRUFBRTtRQUM1QixJQUFJLEVBQUUsS0FBSyxDQUFDLE9BQU8sQ0FBQyxJQUFJO1FBQ3hCLFVBQVUsRUFBRSxLQUFLLENBQUMsT0FBTyxDQUFDLEVBQUU7S0FDN0IsQ0FBQztJQUNGLElBQUksYUFBc0IsQ0FBQztJQUMzQixJQUFJLE9BQU8sR0FBOEIsSUFBSSxDQUFDO0lBQzlDLElBQUksQ0FBQztRQUNILE9BQU8sR0FBRyxvQkFBb0IsQ0FDNUIsTUFBTSxhQUFhLENBQUMsbUJBQW1CLENBQUM7WUFDdEMsT0FBTyxFQUFFLE9BQU87WUFDaEIsT0FBTyxFQUFFO2dCQUNQLElBQUksRUFBRSxRQUFRLENBQUMsSUFBSTtnQkFDbkIsT0FBTyxFQUFFLFFBQVEsQ0FBQyxPQUFPO2dCQUN6QixJQUFJLEVBQUUsUUFBUSxDQUFDLElBQUk7YUFDcEI7WUFDRCxJQUFJLEVBQUUsUUFBUTtZQUNkLGVBQWUsRUFBRSxJQUFBLG9EQUEyQixFQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsRUFBRSxDQUFDO1lBQzlELEdBQUcsQ0FBQyxLQUFLLENBQUMsd0JBQXdCO2dCQUNoQyxDQUFDLENBQUMsRUFBRSx3QkFBd0IsRUFBRSxLQUFLLENBQUMsd0JBQXdCLEVBQUU7Z0JBQzlELENBQUMsQ0FBQyxFQUFFLENBQUM7WUFDUCxhQUFhLEVBQUUsUUFBUTtZQUN2QixHQUFHLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxXQUFXO2dCQUMzQixDQUFDLENBQUMsRUFBRSxXQUFXLEVBQUUsS0FBSyxDQUFDLE9BQU8sQ0FBQyxXQUFXLEVBQUU7Z0JBQzVDLENBQUMsQ0FBQyxFQUFFLENBQUM7WUFDUCxhQUFhLEVBQUUsVUFBVTtZQUN6QixRQUFRLEVBQUUsS0FBSyxDQUFDLE9BQU8sQ0FBQyxJQUFJO1lBQzVCLEVBQUUsRUFBRSxLQUFLLENBQUMsT0FBTyxDQUFDLFNBQVU7WUFDNUIsWUFBWSxFQUFFLFdBQVc7U0FDMUIsQ0FBQyxDQUNILENBQUM7SUFDSixDQUFDO0lBQUMsT0FBTyxLQUFLLEVBQUUsQ0FBQztRQUNmLGFBQWEsR0FBRyxLQUFLLENBQUM7SUFDeEIsQ0FBQztJQUVELElBQUksU0FBUyxHQUE4QixJQUFJLENBQUM7SUFDaEQsSUFBSSxZQUFZLEdBQUcsS0FBSyxDQUFDO0lBQ3pCLElBQUksQ0FBQyxPQUFPLElBQUksYUFBYSxFQUFFLENBQUM7UUFDOUIsSUFBSSxDQUFDO1lBQ0gsU0FBUyxHQUFHLE1BQU0sSUFBQSxnREFBdUIsRUFBQyxTQUFTLEVBQUUsS0FBSyxDQUFDLE9BQU8sQ0FBQyxFQUFFLENBQUMsQ0FBQztRQUN6RSxDQUFDO1FBQUMsTUFBTSxDQUFDO1lBQ1AsWUFBWSxHQUFHLElBQUksQ0FBQztRQUN0QixDQUFDO0lBQ0gsQ0FBQztJQUNELE1BQU0sWUFBWSxHQUFHLE9BQU8sSUFBSSxTQUFTLENBQUM7SUFDMUMsTUFBTSxVQUFVLEdBQUcsTUFBTSxFQUFFLENBQUM7SUFDNUIsSUFBSSxZQUFZLEVBQUUsTUFBTSxLQUFLLFNBQVMsRUFBRSxDQUFDO1FBQ3ZDLE1BQU0sU0FBUyxHQUFHLE1BQU0sS0FBSyxDQUFDLGVBQWUsQ0FBQztZQUM1QyxVQUFVLEVBQUUsS0FBSyxDQUFDLE9BQU8sQ0FBQyxFQUFFO1lBQzVCLGFBQWEsRUFBRSxLQUFLLENBQUMsYUFBYTtZQUNsQyxXQUFXLEVBQUUsVUFBVTtZQUN2QixlQUFlLEVBQUUsWUFBWSxDQUFDLEVBQUU7U0FDakMsQ0FBQyxDQUFDO1FBQ0gsT0FBTztZQUNMLElBQUksRUFBRSxNQUFNO1lBQ1osTUFBTSxFQUFFO2dCQUNOLFVBQVUsRUFBRSxLQUFLLENBQUMsT0FBTyxDQUFDLEVBQUU7Z0JBQzVCLFVBQVUsRUFBRSxTQUFTLENBQUMsT0FBTyxDQUFDLEVBQUU7Z0JBQ2hDLE1BQU0sRUFBRSxNQUFNO2FBQ2Y7U0FDRixDQUFDO0lBQ0osQ0FBQztJQUVELE1BQU0sT0FBTyxHQUNYLGFBQWEsSUFBSSxZQUFZLEVBQUUsTUFBTSxLQUFLLFNBQVMsSUFBSSxDQUFDLFlBQVk7UUFDbEUsQ0FBQyxDQUFDLElBQUEsb0RBQTJCLEVBQUMsYUFBYSxDQUFDO1FBQzVDLENBQUMsQ0FBRSxFQUFFLElBQUksRUFBRSxpQkFBaUIsRUFBRSxPQUFPLEVBQUUsU0FBUyxFQUFZLENBQUM7SUFDakUsSUFBSSxPQUFPLENBQUMsT0FBTyxLQUFLLFdBQVcsRUFBRSxDQUFDO1FBQ3BDLE1BQU0sYUFBYSxHQUFHLElBQUksSUFBSSxDQUFDLFVBQVUsQ0FBQyxPQUFPLEVBQUUsR0FBRyxZQUFZLENBQUMsQ0FBQztRQUNwRSxJQUNFLEtBQUssQ0FBQyxPQUFPLENBQUMsY0FBYyxHQUFHLFdBQVc7WUFDMUMsYUFBYSxDQUFDLE9BQU8sRUFBRSxHQUFHLFNBQVMsQ0FBQyxPQUFPLEVBQUUsRUFDN0MsQ0FBQztZQUNELE1BQU0sS0FBSyxDQUFDLG9CQUFvQixDQUFDO2dCQUMvQixVQUFVLEVBQUUsS0FBSyxDQUFDLE9BQU8sQ0FBQyxFQUFFO2dCQUM1QixhQUFhLEVBQUUsS0FBSyxDQUFDLGFBQWE7Z0JBQ2xDLFlBQVksRUFBRSxPQUFPLENBQUMsSUFBSTtnQkFDMUIsV0FBVyxFQUFFLFVBQVU7Z0JBQ3ZCLGVBQWUsRUFBRSxhQUFhO2dCQUM5QixlQUFlLEVBQUUsWUFBWSxFQUFFLEVBQUUsSUFBSSxJQUFJO2FBQzFDLENBQUMsQ0FBQztZQUNILE9BQU8sRUFBRSxJQUFJLEVBQUUsT0FBTyxFQUFFLENBQUM7UUFDM0IsQ0FBQztRQUNELE9BQU8sTUFBTSxTQUFTLENBQ3BCLEtBQUssRUFDTCxLQUFLLEVBQ0wsU0FBUyxDQUFDLE9BQU8sRUFBRSxJQUFJLGFBQWEsQ0FBQyxPQUFPLEVBQUU7WUFDNUMsQ0FBQyxDQUFDLGlCQUFpQjtZQUNuQixDQUFDLENBQUMsaUJBQWlCLEVBQ3JCLFVBQVUsRUFDVixZQUFZLEVBQUUsRUFBRSxJQUFJLElBQUksQ0FDekIsQ0FBQztJQUNKLENBQUM7SUFDRCxJQUFJLE9BQU8sQ0FBQyxPQUFPLEtBQUssUUFBUSxFQUFFLENBQUM7UUFDakMsT0FBTyxNQUFNLFNBQVMsQ0FDcEIsS0FBSyxFQUNMLEtBQUssRUFDTCxPQUFPLENBQUMsSUFBSSxFQUNaLFVBQVUsRUFDVixZQUFZLEVBQUUsRUFBRSxJQUFJLElBQUksQ0FDekIsQ0FBQztJQUNKLENBQUM7SUFDRCxNQUFNLFNBQVMsR0FBRyxNQUFNLEtBQUssQ0FBQyxrQkFBa0IsQ0FBQztRQUMvQyxVQUFVLEVBQUUsS0FBSyxDQUFDLE9BQU8sQ0FBQyxFQUFFO1FBQzVCLGFBQWEsRUFBRSxLQUFLLENBQUMsYUFBYTtRQUNsQyxZQUFZLEVBQUUsT0FBTyxDQUFDLElBQUk7UUFDMUIsV0FBVyxFQUFFLFVBQVU7UUFDdkIsZUFBZSxFQUFFLFlBQVksRUFBRSxFQUFFLElBQUksSUFBSTtLQUMxQyxDQUFDLENBQUM7SUFDSCxPQUFPO1FBQ0wsSUFBSSxFQUFFLE1BQU07UUFDWixNQUFNLEVBQUU7WUFDTixVQUFVLEVBQUUsS0FBSyxDQUFDLE9BQU8sQ0FBQyxFQUFFO1lBQzVCLElBQUksRUFBRSxPQUFPLENBQUMsSUFBSTtZQUNsQixVQUFVLEVBQUUsU0FBUyxDQUFDLE9BQU8sQ0FBQyxFQUFFO1lBQ2hDLE1BQU0sRUFBRSxTQUFTO1NBQ2xCO0tBQ0YsQ0FBQztBQUNKLENBQUMsQ0FBQztBQW5LVyxRQUFBLHdCQUF3Qiw0QkFtS25DIn0=