@hed-hog/core 0.0.387 → 0.0.393

package/dist/middlewares/locale-injection.middleware.js

@@ -7,13 +7,29 @@ var __decorate = (this && this.__decorate) || function (decorators, target, key,
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.LocaleInjectionMiddleware = void 0;
+const api_locale_1 = require("@hed-hog/api-locale");
 const common_1 = require("@nestjs/common");
-const locale_context_1 = require("../utils/locale-context");
+/**
+ * Rede de seguranca do contexto de locale.
+ *
+ * Quem resolve o idioma e o `LocaleMiddleware` do `api-locale`, que ja abre o
+ * `AsyncLocalStorage` para o resto da cadeia. Este middleware so entra em acao
+ * quando aquele nao rodou (app que nao registrou o `LocaleModule`, ou uma
+ * ordem de middleware que o coloque depois), para que
+ * `getLocaleFromContext()` nunca leia um store vazio.
+ *
+ * Nao reinterpreta o header: sem a tabela `locale` a mao, validar aqui de novo
+ * era justamente como as duas camadas divergiam.
+ */
 let LocaleInjectionMiddleware = class LocaleInjectionMiddleware {
     use(req, res, next) {
-        const acceptLanguage = req.headers['accept-language'] || 'en';
-        const locale = acceptLanguage.split(',')[0].split('-')[0];
-        locale_context_1.localeStorage.run({ locale }, () => {
+        if (api_locale_1.localeStorage.getStore()) {
+            return next();
+        }
+        api_locale_1.localeStorage.run({
+            locale: req['locale'] || 'en',
+            detected: Boolean(req['localeDetected']),
+        }, () => {
             next();
         });
     }

package/dist/middlewares/locale-injection.middleware.js.map

@@ -1 +1 @@
-{"version":3,"file":"locale-injection.middleware.js","sourceRoot":"","sources":["../../src/middlewares/locale-injection.middleware.ts"],"names":[],"mappings":";;;;;;;;;AAAA,2CAA4D;AAE5D,4DAAwD;AAGjD,IAAM,yBAAyB,GAA/B,MAAM,yBAAyB;IACpC,GAAG,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB;QACjD,MAAM,cAAc,GAAG,GAAG,CAAC,OAAO,CAAC,iBAAiB,CAAC,IAAI,IAAI,CAAC;QAC9D,MAAM,MAAM,GAAG,cAAc,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAE1D,8BAAa,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE;YACjC,IAAI,EAAE,CAAC;QACT,CAAC,CAAC,CAAC;IACL,CAAC;CACF,CAAA;AATY,8DAAyB;oCAAzB,yBAAyB;IADrC,IAAA,mBAAU,GAAE;GACA,yBAAyB,CASrC"}
+{"version":3,"file":"locale-injection.middleware.js","sourceRoot":"","sources":["../../src/middlewares/locale-injection.middleware.ts"],"names":[],"mappings":";;;;;;;;;AAAA,oDAAoD;AACpD,2CAA4D;AAG5D;;;;;;;;;;;GAWG;AAEI,IAAM,yBAAyB,GAA/B,MAAM,yBAAyB;IACpC,GAAG,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB;QACjD,IAAI,0BAAa,CAAC,QAAQ,EAAE,EAAE,CAAC;YAC7B,OAAO,IAAI,EAAE,CAAC;QAChB,CAAC;QAED,0BAAa,CAAC,GAAG,CACf;YACE,MAAM,EAAE,GAAG,CAAC,QAAQ,CAAC,IAAI,IAAI;YAC7B,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;SACzC,EACD,GAAG,EAAE;YACH,IAAI,EAAE,CAAC;QACT,CAAC,CACF,CAAC;IACJ,CAAC;CACF,CAAA;AAhBY,8DAAyB;oCAAzB,yBAAyB;IADrC,IAAA,mBAAU,GAAE;GACA,yBAAyB,CAgBrC"}

package/dist/notification/notification.controller.d.ts

@@ -34,9 +34,11 @@ export declare class NotificationController {
         user_id: number;
         created_at: Date;
         updated_at: Date;
+        status: import("@prisma/client").$Enums.notification_status_enum;
+        started_at: Date | null;
+        finished_at: Date | null;
         type: import("@prisma/client").$Enums.notification_type_enum;
         body: string | null;
-        status: import("@prisma/client").$Enums.notification_status_enum;
         icon: string | null;
         title: string;
         progress: number | null;
@@ -44,8 +46,6 @@ export declare class NotificationController {
         action_data: import("@prisma/client/runtime/library").JsonValue | null;
         action_url: string | null;
         auto_remove: boolean;
-        started_at: Date | null;
-        finished_at: Date | null;
     }>;
     updateProgress({ id: userId }: {
         id: any;
@@ -54,9 +54,11 @@ export declare class NotificationController {
         user_id: number;
         created_at: Date;
         updated_at: Date;
+        status: import("@prisma/client").$Enums.notification_status_enum;
+        started_at: Date | null;
+        finished_at: Date | null;
         type: import("@prisma/client").$Enums.notification_type_enum;
         body: string | null;
-        status: import("@prisma/client").$Enums.notification_status_enum;
         icon: string | null;
         title: string;
         progress: number | null;
@@ -64,8 +66,6 @@ export declare class NotificationController {
         action_data: import("@prisma/client/runtime/library").JsonValue | null;
         action_url: string | null;
         auto_remove: boolean;
-        started_at: Date | null;
-        finished_at: Date | null;
     }>;
     deleteAll({ id }: {
         id: any;
@@ -77,9 +77,11 @@ export declare class NotificationController {
         user_id: number;
         created_at: Date;
         updated_at: Date;
+        status: import("@prisma/client").$Enums.notification_status_enum;
+        started_at: Date | null;
+        finished_at: Date | null;
         type: import("@prisma/client").$Enums.notification_type_enum;
         body: string | null;
-        status: import("@prisma/client").$Enums.notification_status_enum;
         icon: string | null;
         title: string;
         progress: number | null;
@@ -87,17 +89,17 @@ export declare class NotificationController {
         action_data: import("@prisma/client/runtime/library").JsonValue | null;
         action_url: string | null;
         auto_remove: boolean;
-        started_at: Date | null;
-        finished_at: Date | null;
     }>;
     create(data: CreateNotificationDto): Promise<{
         id: number;
         user_id: number;
         created_at: Date;
         updated_at: Date;
+        status: import("@prisma/client").$Enums.notification_status_enum;
+        started_at: Date | null;
+        finished_at: Date | null;
         type: import("@prisma/client").$Enums.notification_type_enum;
         body: string | null;
-        status: import("@prisma/client").$Enums.notification_status_enum;
         icon: string | null;
         title: string;
         progress: number | null;
@@ -105,8 +107,6 @@ export declare class NotificationController {
         action_data: import("@prisma/client/runtime/library").JsonValue | null;
         action_url: string | null;
         auto_remove: boolean;
-        started_at: Date | null;
-        finished_at: Date | null;
     }>;
 }
 //# sourceMappingURL=notification.controller.d.ts.map

package/dist/notification/notification.service.d.ts

@@ -36,9 +36,11 @@ export declare class NotificationService implements OnModuleInit, OnModuleDestro
         user_id: number;
         created_at: Date;
         updated_at: Date;
+        status: import("@prisma/client").$Enums.notification_status_enum;
+        started_at: Date | null;
+        finished_at: Date | null;
         type: import("@prisma/client").$Enums.notification_type_enum;
         body: string | null;
-        status: import("@prisma/client").$Enums.notification_status_enum;
         icon: string | null;
         title: string;
         progress: number | null;
@@ -46,8 +48,6 @@ export declare class NotificationService implements OnModuleInit, OnModuleDestro
         action_data: import("@prisma/client/runtime/library").JsonValue | null;
         action_url: string | null;
         auto_remove: boolean;
-        started_at: Date | null;
-        finished_at: Date | null;
     }>;
     markAllRead(userId: number): Promise<import("@prisma/client").Prisma.BatchPayload>;
     delete(userId: number, id: number): Promise<{
@@ -55,9 +55,11 @@ export declare class NotificationService implements OnModuleInit, OnModuleDestro
         user_id: number;
         created_at: Date;
         updated_at: Date;
+        status: import("@prisma/client").$Enums.notification_status_enum;
+        started_at: Date | null;
+        finished_at: Date | null;
         type: import("@prisma/client").$Enums.notification_type_enum;
         body: string | null;
-        status: import("@prisma/client").$Enums.notification_status_enum;
         icon: string | null;
         title: string;
         progress: number | null;
@@ -65,8 +67,6 @@ export declare class NotificationService implements OnModuleInit, OnModuleDestro
         action_data: import("@prisma/client/runtime/library").JsonValue | null;
         action_url: string | null;
         auto_remove: boolean;
-        started_at: Date | null;
-        finished_at: Date | null;
     }>;
     deleteAll(userId: number): Promise<import("@prisma/client").Prisma.BatchPayload>;
     create(data: CreateNotificationDto): Promise<{
@@ -74,9 +74,11 @@ export declare class NotificationService implements OnModuleInit, OnModuleDestro
         user_id: number;
         created_at: Date;
         updated_at: Date;
+        status: import("@prisma/client").$Enums.notification_status_enum;
+        started_at: Date | null;
+        finished_at: Date | null;
         type: import("@prisma/client").$Enums.notification_type_enum;
         body: string | null;
-        status: import("@prisma/client").$Enums.notification_status_enum;
         icon: string | null;
         title: string;
         progress: number | null;
@@ -84,17 +86,17 @@ export declare class NotificationService implements OnModuleInit, OnModuleDestro
         action_data: import("@prisma/client/runtime/library").JsonValue | null;
         action_url: string | null;
         auto_remove: boolean;
-        started_at: Date | null;
-        finished_at: Date | null;
     }>;
     updateProgress(userId: number, id: number, dto: UpdateProgressDto): Promise<{
         id: number;
         user_id: number;
         created_at: Date;
         updated_at: Date;
+        status: import("@prisma/client").$Enums.notification_status_enum;
+        started_at: Date | null;
+        finished_at: Date | null;
         type: import("@prisma/client").$Enums.notification_type_enum;
         body: string | null;
-        status: import("@prisma/client").$Enums.notification_status_enum;
         icon: string | null;
         title: string;
         progress: number | null;
@@ -102,8 +104,6 @@ export declare class NotificationService implements OnModuleInit, OnModuleDestro
         action_data: import("@prisma/client/runtime/library").JsonValue | null;
         action_url: string | null;
         auto_remove: boolean;
-        started_at: Date | null;
-        finished_at: Date | null;
     }>;
     stream(userId: number, req: Request, res: Response): void;
     clearOldNotifications(retentionDays: number, batchLimit: number): Promise<number>;

package/dist/oauth/oauth-token-broker.service.d.ts

@@ -0,0 +1,72 @@
+import { PrismaService } from '@hed-hog/api-prisma';
+import { HttpService } from '@nestjs/axios';
+import { SecurityService } from '../security/security.service';
+import { SettingService } from '../setting/setting.service';
+/**
+ * Reasons a brokered access token could not be produced. Consumers (e.g. the
+ * `microsoft` library) map these to HTTP responses so the UI can react — most
+ * importantly, `not_connected`/`refresh_revoked` should prompt the user to
+ * (re)connect their account, and `missing_scope` to re-consent.
+ */
+export type OAuthTokenBrokerReason = 'not_connected' | 'refresh_revoked' | 'missing_scope' | 'provider_not_configured' | 'upstream_failure';
+export declare class OAuthTokenBrokerError extends Error {
+    readonly reason: OAuthTokenBrokerReason;
+    readonly provider: string;
+    readonly cause?: unknown;
+    constructor(reason: OAuthTokenBrokerReason, message: string, provider: string, cause?: unknown);
+}
+export interface BrokeredAccessToken {
+    accessToken: string;
+    /** Absolute expiry of the access token. */
+    expiresAt: Date;
+    /** Scopes granted to the stored refresh token (best-effort, from `user_account.scopes`). */
+    scopes: string[];
+}
+/**
+ * Exchanges a user's stored (encrypted) OAuth **refresh token** for a fresh
+ * **access token**, so the backend can call provider APIs (Microsoft Graph,
+ * Google, ...) on that user's behalf — the "delegated" access mode.
+ *
+ * The refresh token is written by {@link OAuthService} during login/connect
+ * (encrypted with {@link SecurityService.encrypt} and stored as bytes in
+ * `user_account.refresh_token`); this service reads it back, decrypts it, runs
+ * a `grant_type=refresh_token` exchange, persists the rotated refresh token,
+ * and caches the access token in memory until shortly before it expires.
+ *
+ * It intentionally reuses the SAME `integration_profile` credentials already
+ * configured for OAuth login — no new provider, table, or setting is introduced.
+ */
+export declare class OAuthTokenBrokerService {
+    private readonly http;
+    private readonly setting;
+    private readonly prisma;
+    private readonly security;
+    private readonly logger;
+    /** access-token cache keyed by `${provider}:${userId}`. */
+    private readonly cache;
+    /** Refresh a bit early so an in-flight request never rides an about-to-expire token. */
+    private static readonly EXPIRY_SKEW_MS;
+    constructor(http: HttpService, setting: SettingService, prisma: PrismaService, security: SecurityService);
+    /** Normalizes a provider to the enum form stored in `user_account.provider`. */
+    private toAccountProvider;
+    /** Setting slug that points at the integration profile for this provider. */
+    private profileSettingSlug;
+    private resolveProviderConfig;
+    private loadUserAccount;
+    private parseScopes;
+    /** Scopes granted to the stored refresh token, from `user_account.scopes`. */
+    getGrantedScopes(userId: number, provider: string): Promise<string[]>;
+    /** Whether the user has this provider connected with a usable refresh token. */
+    isConnected(userId: number, provider: string): Promise<boolean>;
+    private cacheKey;
+    /**
+     * Returns a fresh access token for the user, refreshing (and rotating the
+     * stored refresh token) when the cache is cold or about to expire.
+     *
+     * @throws {OAuthTokenBrokerError} with a typed `reason` on any failure.
+     */
+    getAccessToken(userId: number, provider: string): Promise<BrokeredAccessToken>;
+    /** Drops any cached access token for a user/provider (e.g. after disconnect). */
+    invalidate(userId: number, provider: string): void;
+}
+//# sourceMappingURL=oauth-token-broker.service.d.ts.map

package/dist/oauth/oauth-token-broker.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-token-broker.service.d.ts","sourceRoot":"","sources":["../../src/oauth/oauth-token-broker.service.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,aAAa,EAEd,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAI5C,OAAO,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AAC/D,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAE5D;;;;;GAKG;AACH,MAAM,MAAM,sBAAsB,GAC9B,eAAe,GACf,iBAAiB,GACjB,eAAe,GACf,yBAAyB,GACzB,kBAAkB,CAAC;AAEvB,qBAAa,qBAAsB,SAAQ,KAAK;IAE5C,QAAQ,CAAC,MAAM,EAAE,sBAAsB;IAEvC,QAAQ,CAAC,QAAQ,EAAE,MAAM;IACzB,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO;gBAHf,MAAM,EAAE,sBAAsB,EACvC,OAAO,EAAE,MAAM,EACN,QAAQ,EAAE,MAAM,EAChB,KAAK,CAAC,EAAE,OAAO;CAK3B;AAED,MAAM,WAAW,mBAAmB;IAClC,WAAW,EAAE,MAAM,CAAC;IACpB,2CAA2C;IAC3C,SAAS,EAAE,IAAI,CAAC;IAChB,4FAA4F;IAC5F,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAcD;;;;;;;;;;;;;GAaG;AACH,qBACa,uBAAuB;IAUhC,OAAO,CAAC,QAAQ,CAAC,IAAI;IAErB,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,QAAQ;IAb3B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA4C;IAEnE,2DAA2D;IAC3D,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAiC;IAEvD,wFAAwF;IACxF,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAa;gBAGhC,IAAI,EAAE,WAAW,EAEjB,OAAO,EAAE,cAAc,EACvB,MAAM,EAAE,aAAa,EACrB,QAAQ,EAAE,eAAe;IAG5C,gFAAgF;IAChF,OAAO,CAAC,iBAAiB;IAQzB,6EAA6E;IAC7E,OAAO,CAAC,kBAAkB;YAaZ,qBAAqB;YA4DrB,eAAe;IAyB7B,OAAO,CAAC,WAAW;IAOnB,8EAA8E;IACxE,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAQ3E,gFAAgF;IAC1E,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAQrE,OAAO,CAAC,QAAQ;IAIhB;;;;;OAKG;IACG,cAAc,CAClB,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,mBAAmB,CAAC;IA4H/B,iFAAiF;IACjF,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,IAAI;CAGnD"}

package/dist/oauth/oauth-token-broker.service.js

@@ -0,0 +1,258 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+var OAuthTokenBrokerService_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OAuthTokenBrokerService = exports.OAuthTokenBrokerError = void 0;
+const api_prisma_1 = require("@hed-hog/api-prisma");
+const axios_1 = require("@nestjs/axios");
+const common_1 = require("@nestjs/common");
+const rxjs_1 = require("rxjs");
+const integration_profile_utils_1 = require("../integration-profile/integration-profile.utils");
+const security_service_1 = require("../security/security.service");
+const setting_service_1 = require("../setting/setting.service");
+class OAuthTokenBrokerError extends Error {
+    constructor(reason, message, provider, cause) {
+        super(message);
+        this.reason = reason;
+        this.provider = provider;
+        this.cause = cause;
+        this.name = 'OAuthTokenBrokerError';
+    }
+}
+exports.OAuthTokenBrokerError = OAuthTokenBrokerError;
+/**
+ * Exchanges a user's stored (encrypted) OAuth **refresh token** for a fresh
+ * **access token**, so the backend can call provider APIs (Microsoft Graph,
+ * Google, ...) on that user's behalf — the "delegated" access mode.
+ *
+ * The refresh token is written by {@link OAuthService} during login/connect
+ * (encrypted with {@link SecurityService.encrypt} and stored as bytes in
+ * `user_account.refresh_token`); this service reads it back, decrypts it, runs
+ * a `grant_type=refresh_token` exchange, persists the rotated refresh token,
+ * and caches the access token in memory until shortly before it expires.
+ *
+ * It intentionally reuses the SAME `integration_profile` credentials already
+ * configured for OAuth login — no new provider, table, or setting is introduced.
+ */
+let OAuthTokenBrokerService = OAuthTokenBrokerService_1 = class OAuthTokenBrokerService {
+    constructor(http, setting, prisma, security) {
+        this.http = http;
+        this.setting = setting;
+        this.prisma = prisma;
+        this.security = security;
+        this.logger = new common_1.Logger(OAuthTokenBrokerService_1.name);
+        /** access-token cache keyed by `${provider}:${userId}`. */
+        this.cache = new Map();
+    }
+    /** Normalizes a provider to the enum form stored in `user_account.provider`. */
+    toAccountProvider(provider) {
+        return String(provider)
+            .toLowerCase()
+            .replace(/-/g, '_');
+    }
+    /** Setting slug that points at the integration profile for this provider. */
+    profileSettingSlug(provider) {
+        switch (String(provider).toLowerCase().replace(/_/g, '-')) {
+            case 'microsoft-entra-id':
+                return 'oauth-microsoft-entra-id-profile-id';
+            case 'microsoft':
+                return 'oauth-microsoft-profile-id';
+            case 'google':
+                return 'oauth-google-profile-id';
+            default:
+                return null;
+        }
+    }
+    async resolveProviderConfig(provider) {
+        var _a;
+        const settingSlug = this.profileSettingSlug(provider);
+        if (!settingSlug) {
+            throw new OAuthTokenBrokerError('provider_not_configured', `Token broker does not support provider "${provider}".`, provider);
+        }
+        const settings = await this.setting.getSettingValues([settingSlug]);
+        const profileSlug = String((_a = settings[settingSlug]) !== null && _a !== void 0 ? _a : '').trim();
+        if (!profileSlug) {
+            throw new OAuthTokenBrokerError('provider_not_configured', `OAuth profile for "${provider}" is not configured.`, provider);
+        }
+        const profile = await this.prisma.integration_profile.findUnique({
+            where: { slug: profileSlug },
+            include: { integration_provider: { select: { slug: true } } },
+        });
+        if (!profile) {
+            throw new OAuthTokenBrokerError('provider_not_configured', `OAuth profile "${profileSlug}" for "${provider}" was not found.`, provider);
+        }
+        const { clientId, clientSecret, tenantId } = (0, integration_profile_utils_1.buildOAuthConfigFromIntegration)(profile.integration_provider.slug, profile.config);
+        const normalized = String(provider).toLowerCase().replace(/_/g, '-');
+        let tokenUrl;
+        if (normalized === 'microsoft-entra-id') {
+            if (!tenantId) {
+                throw new OAuthTokenBrokerError('provider_not_configured', 'Microsoft Entra ID OAuth profile is missing tenant_id.', provider);
+            }
+            tokenUrl = `https://login.microsoftonline.com/${tenantId}/oauth2/v2.0/token`;
+        }
+        else if (normalized === 'microsoft') {
+            tokenUrl = 'https://login.microsoftonline.com/common/oauth2/v2.0/token';
+        }
+        else {
+            // google
+            tokenUrl = 'https://oauth2.googleapis.com/token';
+        }
+        return { tokenUrl, clientId, clientSecret };
+    }
+    async loadUserAccount(userId, provider) {
+        const account = await this.prisma.user_account.findFirst({
+            where: {
+                user_id: userId,
+                provider: this.toAccountProvider(provider),
+            },
+            select: {
+                id: true,
+                refresh_token: true,
+                scopes: true,
+                token_expires_at: true,
+            },
+        });
+        if (!account || !account.refresh_token) {
+            throw new OAuthTokenBrokerError('not_connected', `User ${userId} has no connected "${provider}" account.`, provider);
+        }
+        return account;
+    }
+    parseScopes(scopes) {
+        return String(scopes !== null && scopes !== void 0 ? scopes : '')
+            .split(/[\s,]+/)
+            .map((scope) => scope.trim())
+            .filter(Boolean);
+    }
+    /** Scopes granted to the stored refresh token, from `user_account.scopes`. */
+    async getGrantedScopes(userId, provider) {
+        const account = await this.prisma.user_account.findFirst({
+            where: { user_id: userId, provider: this.toAccountProvider(provider) },
+            select: { scopes: true },
+        });
+        return this.parseScopes(account === null || account === void 0 ? void 0 : account.scopes);
+    }
+    /** Whether the user has this provider connected with a usable refresh token. */
+    async isConnected(userId, provider) {
+        const account = await this.prisma.user_account.findFirst({
+            where: { user_id: userId, provider: this.toAccountProvider(provider) },
+            select: { refresh_token: true },
+        });
+        return Boolean(account === null || account === void 0 ? void 0 : account.refresh_token);
+    }
+    cacheKey(userId, provider) {
+        return `${String(provider).toLowerCase()}:${userId}`;
+    }
+    /**
+     * Returns a fresh access token for the user, refreshing (and rotating the
+     * stored refresh token) when the cache is cold or about to expire.
+     *
+     * @throws {OAuthTokenBrokerError} with a typed `reason` on any failure.
+     */
+    async getAccessToken(userId, provider) {
+        var _a, _b, _c;
+        const key = this.cacheKey(userId, provider);
+        const cached = this.cache.get(key);
+        if (cached &&
+            cached.expiresAt.getTime() - Date.now() > OAuthTokenBrokerService_1.EXPIRY_SKEW_MS) {
+            return Object.assign({}, cached);
+        }
+        const [config, account] = await Promise.all([
+            this.resolveProviderConfig(provider),
+            this.loadUserAccount(userId, provider),
+        ]);
+        let decryptedRefreshToken;
+        try {
+            decryptedRefreshToken = this.security.decrypt(account.refresh_token.toString());
+        }
+        catch (error) {
+            throw new OAuthTokenBrokerError('refresh_revoked', `Failed to decrypt stored refresh token for "${provider}".`, provider, error);
+        }
+        const grantedScopes = this.parseScopes(account.scopes);
+        const scopeParam = grantedScopes.includes('offline_access')
+            ? grantedScopes
+            : [...grantedScopes, 'offline_access'];
+        const body = new URLSearchParams({
+            client_id: config.clientId,
+            client_secret: config.clientSecret,
+            grant_type: 'refresh_token',
+            refresh_token: decryptedRefreshToken,
+        });
+        if (scopeParam.length > 1) {
+            body.set('scope', scopeParam.join(' '));
+        }
+        let token;
+        try {
+            const response = await (0, rxjs_1.lastValueFrom)(this.http.post(config.tokenUrl, body.toString(), {
+                headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+            }));
+            token = response.data;
+        }
+        catch (error) {
+            const providerError = (_b = (_a = error === null || error === void 0 ? void 0 : error.response) === null || _a === void 0 ? void 0 : _a.data) === null || _b === void 0 ? void 0 : _b.error;
+            if (providerError === 'invalid_grant') {
+                // Refresh token revoked/expired — the user must reconnect.
+                this.cache.delete(key);
+                throw new OAuthTokenBrokerError('refresh_revoked', `Refresh token for "${provider}" is no longer valid. Reconnect the account.`, provider, error);
+            }
+            this.logger.warn(`Token refresh failed: provider=${provider} userId=${userId} error=${(_c = providerError !== null && providerError !== void 0 ? providerError : error === null || error === void 0 ? void 0 : error.message) !== null && _c !== void 0 ? _c : 'unknown'}`);
+            throw new OAuthTokenBrokerError('upstream_failure', `Unable to refresh "${provider}" access token.`, provider, error);
+        }
+        if (!(token === null || token === void 0 ? void 0 : token.access_token)) {
+            throw new OAuthTokenBrokerError('upstream_failure', `Provider "${provider}" returned no access token.`, provider);
+        }
+        const expiresAt = new Date(Date.now() + (token.expires_in ? token.expires_in * 1000 : 3600 * 1000));
+        const resolvedScopes = token.scope
+            ? this.parseScopes(token.scope)
+            : grantedScopes;
+        // Persist the rotated refresh token so the next call starts from the newest
+        // one (Microsoft rotates refresh tokens on every exchange).
+        if (token.refresh_token && token.refresh_token !== decryptedRefreshToken) {
+            try {
+                const encrypted = this.security.encrypt(token.refresh_token);
+                await this.prisma.user_account.update({
+                    where: { id: account.id },
+                    data: Object.assign({ refresh_token: Buffer.from(encrypted), token_expires_at: expiresAt }, (token.scope ? { scopes: resolvedScopes.join(',') } : {})),
+                });
+            }
+            catch (error) {
+                // A persistence failure must not fail the request — the access token is
+                // already valid; log and continue (next refresh reuses the old token).
+                this.logger.warn(`Failed to persist rotated refresh token: provider=${provider} userId=${userId} error=${error instanceof Error ? error.message : 'unknown'}`);
+            }
+        }
+        const entry = {
+            accessToken: token.access_token,
+            expiresAt,
+            scopes: resolvedScopes,
+        };
+        this.cache.set(key, entry);
+        return Object.assign({}, entry);
+    }
+    /** Drops any cached access token for a user/provider (e.g. after disconnect). */
+    invalidate(userId, provider) {
+        this.cache.delete(this.cacheKey(userId, provider));
+    }
+};
+exports.OAuthTokenBrokerService = OAuthTokenBrokerService;
+/** Refresh a bit early so an in-flight request never rides an about-to-expire token. */
+OAuthTokenBrokerService.EXPIRY_SKEW_MS = 60 * 1000;
+exports.OAuthTokenBrokerService = OAuthTokenBrokerService = OAuthTokenBrokerService_1 = __decorate([
+    (0, common_1.Injectable)(),
+    __param(1, (0, common_1.Inject)((0, common_1.forwardRef)(() => setting_service_1.SettingService))),
+    __metadata("design:paramtypes", [axios_1.HttpService,
+        setting_service_1.SettingService,
+        api_prisma_1.PrismaService,
+        security_service_1.SecurityService])
+], OAuthTokenBrokerService);
+//# sourceMappingURL=oauth-token-broker.service.js.map

package/dist/oauth/oauth-token-broker.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-token-broker.service.js","sourceRoot":"","sources":["../../src/oauth/oauth-token-broker.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,oDAG6B;AAC7B,yCAA4C;AAC5C,2CAAwE;AACxE,+BAAqC;AACrC,gGAAmG;AACnG,mEAA+D;AAC/D,gEAA4D;AAe5D,MAAa,qBAAsB,SAAQ,KAAK;IAC9C,YACW,MAA8B,EACvC,OAAe,EACN,QAAgB,EAChB,KAAe;QAExB,KAAK,CAAC,OAAO,CAAC,CAAC;QALN,WAAM,GAAN,MAAM,CAAwB;QAE9B,aAAQ,GAAR,QAAQ,CAAQ;QAChB,UAAK,GAAL,KAAK,CAAU;QAGxB,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;IACtC,CAAC;CACF;AAVD,sDAUC;AAsBD;;;;;;;;;;;;;GAaG;AAEI,IAAM,uBAAuB,+BAA7B,MAAM,uBAAuB;IASlC,YACmB,IAAiB,EAElC,OAAwC,EACvB,MAAqB,EACrB,QAAyB;QAJzB,SAAI,GAAJ,IAAI,CAAa;QAEjB,YAAO,GAAP,OAAO,CAAgB;QACvB,WAAM,GAAN,MAAM,CAAe;QACrB,aAAQ,GAAR,QAAQ,CAAiB;QAb3B,WAAM,GAAG,IAAI,eAAM,CAAC,yBAAuB,CAAC,IAAI,CAAC,CAAC;QAEnE,2DAA2D;QAC1C,UAAK,GAAG,IAAI,GAAG,EAAsB,CAAC;IAWpD,CAAC;IAEJ,gFAAgF;IACxE,iBAAiB,CACvB,QAAgB;QAEhB,OAAO,MAAM,CAAC,QAAQ,CAAC;aACpB,WAAW,EAAE;aACb,OAAO,CAAC,IAAI,EAAE,GAAG,CAA0C,CAAC;IACjE,CAAC;IAED,6EAA6E;IACrE,kBAAkB,CAAC,QAAgB;QACzC,QAAQ,MAAM,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC;YAC1D,KAAK,oBAAoB;gBACvB,OAAO,qCAAqC,CAAC;YAC/C,KAAK,WAAW;gBACd,OAAO,4BAA4B,CAAC;YACtC,KAAK,QAAQ;gBACX,OAAO,yBAAyB,CAAC;YACnC;gBACE,OAAO,IAAI,CAAC;QAChB,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,qBAAqB,CACjC,QAAgB;;QAEhB,MAAM,WAAW,GAAG,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC;QACtD,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,IAAI,qBAAqB,CAC7B,yBAAyB,EACzB,2CAA2C,QAAQ,IAAI,EACvD,QAAQ,CACT,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC;QACpE,MAAM,WAAW,GAAG,MAAM,CAAC,MAAA,QAAQ,CAAC,WAAW,CAAC,mCAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAC/D,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,IAAI,qBAAqB,CAC7B,yBAAyB,EACzB,sBAAsB,QAAQ,sBAAsB,EACpD,QAAQ,CACT,CAAC;QACJ,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,UAAU,CAAC;YAC/D,KAAK,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE;YAC5B,OAAO,EAAE,EAAE,oBAAoB,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE;SAC9D,CAAC,CAAC;QACH,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,qBAAqB,CAC7B,yBAAyB,EACzB,kBAAkB,WAAW,UAAU,QAAQ,kBAAkB,EACjE,QAAQ,CACT,CAAC;QACJ,CAAC;QAED,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,QAAQ,EAAE,GAAG,IAAA,2DAA+B,EAC1E,OAAO,CAAC,oBAAoB,CAAC,IAAI,EACjC,OAAO,CAAC,MAAM,CACf,CAAC;QAEF,MAAM,UAAU,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QACrE,IAAI,QAAgB,CAAC;QACrB,IAAI,UAAU,KAAK,oBAAoB,EAAE,CAAC;YACxC,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,MAAM,IAAI,qBAAqB,CAC7B,yBAAyB,EACzB,wDAAwD,EACxD,QAAQ,CACT,CAAC;YACJ,CAAC;YACD,QAAQ,GAAG,qCAAqC,QAAQ,oBAAoB,CAAC;QAC/E,CAAC;aAAM,IAAI,UAAU,KAAK,WAAW,EAAE,CAAC;YACtC,QAAQ,GAAG,4DAA4D,CAAC;QAC1E,CAAC;aAAM,CAAC;YACN,SAAS;YACT,QAAQ,GAAG,qCAAqC,CAAC;QACnD,CAAC;QAED,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC;IAC9C,CAAC;IAEO,KAAK,CAAC,eAAe,CAAC,MAAc,EAAE,QAAgB;QAC5D,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,SAAS,CAAC;YACvD,KAAK,EAAE;gBACL,OAAO,EAAE,MAAM;gBACf,QAAQ,EAAE,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC;aAC3C;YACD,MAAM,EAAE;gBACN,EAAE,EAAE,IAAI;gBACR,aAAa,EAAE,IAAI;gBACnB,MAAM,EAAE,IAAI;gBACZ,gBAAgB,EAAE,IAAI;aACvB;SACF,CAAC,CAAC;QAEH,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC;YACvC,MAAM,IAAI,qBAAqB,CAC7B,eAAe,EACf,QAAQ,MAAM,sBAAsB,QAAQ,YAAY,EACxD,QAAQ,CACT,CAAC;QACJ,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;IAEO,WAAW,CAAC,MAAsB;QACxC,OAAO,MAAM,CAAC,MAAM,aAAN,MAAM,cAAN,MAAM,GAAI,EAAE,CAAC;aACxB,KAAK,CAAC,QAAQ,CAAC;aACf,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;aAC5B,MAAM,CAAC,OAAO,CAAC,CAAC;IACrB,CAAC;IAED,8EAA8E;IAC9E,KAAK,CAAC,gBAAgB,CAAC,MAAc,EAAE,QAAgB;QACrD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,SAAS,CAAC;YACvD,KAAK,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,EAAE;YACtE,MAAM,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE;SACzB,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,WAAW,CAAC,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,MAAM,CAAC,CAAC;IAC3C,CAAC;IAED,gFAAgF;IAChF,KAAK,CAAC,WAAW,CAAC,MAAc,EAAE,QAAgB;QAChD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,SAAS,CAAC;YACvD,KAAK,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,EAAE;YACtE,MAAM,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE;SAChC,CAAC,CAAC;QACH,OAAO,OAAO,CAAC,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,aAAa,CAAC,CAAC;IACzC,CAAC;IAEO,QAAQ,CAAC,MAAc,EAAE,QAAgB;QAC/C,OAAO,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,IAAI,MAAM,EAAE,CAAC;IACvD,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,cAAc,CAClB,MAAc,EACd,QAAgB;;QAEhB,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QAC5C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACnC,IACE,MAAM;YACN,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,yBAAuB,CAAC,cAAc,EAChF,CAAC;YACD,yBAAY,MAAM,EAAG;QACvB,CAAC;QAED,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YAC1C,IAAI,CAAC,qBAAqB,CAAC,QAAQ,CAAC;YACpC,IAAI,CAAC,eAAe,CAAC,MAAM,EAAE,QAAQ,CAAC;SACvC,CAAC,CAAC;QAEH,IAAI,qBAA6B,CAAC;QAClC,IAAI,CAAC;YACH,qBAAqB,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC,QAAQ,EAAE,CAAC,CAAC;QAClF,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,qBAAqB,CAC7B,iBAAiB,EACjB,+CAA+C,QAAQ,IAAI,EAC3D,QAAQ,EACR,KAAK,CACN,CAAC;QACJ,CAAC;QAED,MAAM,aAAa,GAAG,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACvD,MAAM,UAAU,GAAG,aAAa,CAAC,QAAQ,CAAC,gBAAgB,CAAC;YACzD,CAAC,CAAC,aAAa;YACf,CAAC,CAAC,CAAC,GAAG,aAAa,EAAE,gBAAgB,CAAC,CAAC;QAEzC,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;YAC/B,SAAS,EAAE,MAAM,CAAC,QAAQ;YAC1B,aAAa,EAAE,MAAM,CAAC,YAAY;YAClC,UAAU,EAAE,eAAe;YAC3B,aAAa,EAAE,qBAAqB;SACrC,CAAC,CAAC;QACH,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC1B,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QAC1C,CAAC;QAED,IAAI,KAKH,CAAC;QACF,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,IAAA,oBAAa,EAClC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,EAAE;gBAC/C,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;aACjE,CAAC,CACH,CAAC;YACF,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC;QACxB,CAAC;QAAC,OAAO,KAAU,EAAE,CAAC;YACpB,MAAM,aAAa,GAAG,MAAA,MAAA,KAAK,aAAL,KAAK,uBAAL,KAAK,CAAE,QAAQ,0CAAE,IAAI,0CAAE,KAAK,CAAC;YACnD,IAAI,aAAa,KAAK,eAAe,EAAE,CAAC;gBACtC,2DAA2D;gBAC3D,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBACvB,MAAM,IAAI,qBAAqB,CAC7B,iBAAiB,EACjB,sBAAsB,QAAQ,8CAA8C,EAC5E,QAAQ,EACR,KAAK,CACN,CAAC;YACJ,CAAC;YACD,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,kCAAkC,QAAQ,WAAW,MAAM,UAAU,MAAA,aAAa,aAAb,aAAa,cAAb,aAAa,GAAI,KAAK,aAAL,KAAK,uBAAL,KAAK,CAAE,OAAO,mCAAI,SAAS,EAAE,CACpH,CAAC;YACF,MAAM,IAAI,qBAAqB,CAC7B,kBAAkB,EAClB,sBAAsB,QAAQ,iBAAiB,EAC/C,QAAQ,EACR,KAAK,CACN,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,CAAA,KAAK,aAAL,KAAK,uBAAL,KAAK,CAAE,YAAY,CAAA,EAAE,CAAC;YACzB,MAAM,IAAI,qBAAqB,CAC7B,kBAAkB,EAClB,aAAa,QAAQ,6BAA6B,EAClD,QAAQ,CACT,CAAC;QACJ,CAAC;QAED,MAAM,SAAS,GAAG,IAAI,IAAI,CACxB,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,IAAI,CAAC,CACxE,CAAC;QACF,MAAM,cAAc,GAAG,KAAK,CAAC,KAAK;YAChC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,KAAK,CAAC;YAC/B,CAAC,CAAC,aAAa,CAAC;QAElB,4EAA4E;QAC5E,4DAA4D;QAC5D,IAAI,KAAK,CAAC,aAAa,IAAI,KAAK,CAAC,aAAa,KAAK,qBAAqB,EAAE,CAAC;YACzE,IAAI,CAAC;gBACH,MAAM,SAAS,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;gBAC7D,MAAM,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC;oBACpC,KAAK,EAAE,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE;oBACzB,IAAI,kBACF,aAAa,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,EACrC,gBAAgB,EAAE,SAAS,IACxB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAC7D;iBACF,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,wEAAwE;gBACxE,uEAAuE;gBACvE,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,qDAAqD,QAAQ,WAAW,MAAM,UAAU,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,EAAE,CAC7I,CAAC;YACJ,CAAC;QACH,CAAC;QAED,MAAM,KAAK,GAAe;YACxB,WAAW,EAAE,KAAK,CAAC,YAAY;YAC/B,SAAS;YACT,MAAM,EAAE,cAAc;SACvB,CAAC;QACF,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC3B,yBAAY,KAAK,EAAG;IACtB,CAAC;IAED,iFAAiF;IACjF,UAAU,CAAC,MAAc,EAAE,QAAgB;QACzC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;IACrD,CAAC;;AAlSU,0DAAuB;AAMlC,wFAAwF;AAChE,sCAAc,GAAG,EAAE,GAAG,IAAI,AAAZ,CAAa;kCAPxC,uBAAuB;IADnC,IAAA,mBAAU,GAAE;IAYR,WAAA,IAAA,eAAM,EAAC,IAAA,mBAAU,EAAC,GAAG,EAAE,CAAC,gCAAc,CAAC,CAAC,CAAA;qCADlB,mBAAW;QAER,gCAAc;QACf,0BAAa;QACX,kCAAe;GAdjC,uBAAuB,CAmSnC"}

package/dist/oauth/oauth.module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oauth.module.d.ts","sourceRoot":"","sources":["../../src/oauth/oauth.module.ts"],"names":[],"mappings":"AAsBA,qBA2Ba,WAAW;CAAG"}
+{"version":3,"file":"oauth.module.d.ts","sourceRoot":"","sources":["../../src/oauth/oauth.module.ts"],"names":[],"mappings":"AAuBA,qBA4Ba,WAAW;CAAG"}

package/dist/oauth/oauth.module.js

@@ -19,6 +19,7 @@ const security_module_1 = require("../security/security.module");
 const token_module_1 = require("../token/token.module");
 const user_module_1 = require("../user/user.module");
 const oauth_callback_coordinator_service_1 = require("./oauth-callback-coordinator.service");
+const oauth_token_broker_service_1 = require("./oauth-token-broker.service");
 const oauth_controller_1 = require("./oauth.controller");
 const oauth_service_1 = require("./oauth.service");
 const apple_provider_1 = require("./providers/apple.provider");
@@ -48,6 +49,7 @@ exports.OAuthModule = OAuthModule = __decorate([
         controllers: [oauth_controller_1.OAuthController],
         providers: [
             oauth_callback_coordinator_service_1.OAuthCallbackCoordinatorService,
+            oauth_token_broker_service_1.OAuthTokenBrokerService,
             oauth_service_1.OAuthService,
             google_provider_1.GoogleProvider,
             facebook_provider_1.FacebookProvider,
@@ -57,7 +59,7 @@ exports.OAuthModule = OAuthModule = __decorate([
             apple_provider_1.AppleProvider,
             linkedin_provider_1.LinkedinProvider,
         ],
-        exports: [oauth_service_1.OAuthService],
+        exports: [oauth_service_1.OAuthService, oauth_token_broker_service_1.OAuthTokenBrokerService],
     })
 ], OAuthModule);
 //# sourceMappingURL=oauth.module.js.map

package/dist/oauth/oauth.module.js.map

@@ -1 +1 @@
-{"version":3,"file":"oauth.module.js","sourceRoot":"","sources":["../../src/oauth/oauth.module.ts"],"names":[],"mappings":";;;;;;;;;AAAA,gDAAiE;AACjE,oDAAmD;AACnD,yCAA2C;AAC3C,2CAAoD;AACpD,2CAA8C;AAC9C,qDAAiD;AACjD,qDAAiD;AACjD,qDAAiD;AACjD,iEAA6D;AAC7D,wDAAoD;AACpD,qDAAiD;AACjD,6FAAuF;AACvF,yDAAqD;AACrD,mDAA+C;AAC/C,+DAA2D;AAC3D,qEAAiE;AACjE,iEAA6D;AAC7D,iEAA6D;AAC7D,qEAAiE;AACjE,yFAAmF;AACnF,uEAAmE;AA6B5D,IAAM,WAAW,GAAjB,MAAM,WAAW;CAAG,CAAA;AAAd,kCAAW;sBAAX,WAAW;IA3BvB,IAAA,eAAM,EAAC;QACN,OAAO,EAAE;YACP,IAAA,mBAAU,EAAC,GAAG,EAAE,CAAC,kBAAU,CAAC;YAC5B,IAAA,mBAAU,EAAC,GAAG,EAAE,CAAC,yBAAY,CAAC;YAC9B,IAAA,mBAAU,EAAC,GAAG,EAAE,CAAC,qBAAc,CAAC;YAChC,IAAA,mBAAU,EAAC,GAAG,EAAE,CAAC,qBAAY,CAAC;YAC9B,IAAA,mBAAU,EAAC,GAAG,EAAE,CAAC,wBAAU,CAAC;YAC5B,IAAA,mBAAU,EAAC,GAAG,EAAE,CAAC,wBAAU,CAAC;YAC5B,IAAA,mBAAU,EAAC,GAAG,EAAE,CAAC,gCAAc,CAAC;YAChC,IAAA,mBAAU,EAAC,GAAG,EAAE,CAAC,0BAAW,CAAC;YAC7B,IAAA,mBAAU,EAAC,GAAG,EAAE,CAAC,wBAAU,CAAC;YAC5B,IAAA,mBAAU,EAAC,GAAG,EAAE,CAAC,wBAAU,CAAC;SAC7B;QACD,WAAW,EAAE,CAAC,kCAAe,CAAC;QAC9B,SAAS,EAAE;YACT,oEAA+B;YAC/B,4BAAY;YACZ,gCAAc;YACd,oCAAgB;YAChB,gCAAc;YACd,sCAAiB;YACjB,sDAAwB;YACxB,8BAAa;YACb,oCAAgB;SACjB;QACD,OAAO,EAAE,CAAC,4BAAY,CAAC;KACxB,CAAC;GACW,WAAW,CAAG"}
+{"version":3,"file":"oauth.module.js","sourceRoot":"","sources":["../../src/oauth/oauth.module.ts"],"names":[],"mappings":";;;;;;;;;AAAA,gDAAiE;AACjE,oDAAmD;AACnD,yCAA2C;AAC3C,2CAAoD;AACpD,2CAA8C;AAC9C,qDAAiD;AACjD,qDAAiD;AACjD,qDAAiD;AACjD,iEAA6D;AAC7D,wDAAoD;AACpD,qDAAiD;AACjD,6FAAuF;AACvF,6EAAuE;AACvE,yDAAqD;AACrD,mDAA+C;AAC/C,+DAA2D;AAC3D,qEAAiE;AACjE,iEAA6D;AAC7D,iEAA6D;AAC7D,qEAAiE;AACjE,yFAAmF;AACnF,uEAAmE;AA8B5D,IAAM,WAAW,GAAjB,MAAM,WAAW;CAAG,CAAA;AAAd,kCAAW;sBAAX,WAAW;IA5BvB,IAAA,eAAM,EAAC;QACN,OAAO,EAAE;YACP,IAAA,mBAAU,EAAC,GAAG,EAAE,CAAC,kBAAU,CAAC;YAC5B,IAAA,mBAAU,EAAC,GAAG,EAAE,CAAC,yBAAY,CAAC;YAC9B,IAAA,mBAAU,EAAC,GAAG,EAAE,CAAC,qBAAc,CAAC;YAChC,IAAA,mBAAU,EAAC,GAAG,EAAE,CAAC,qBAAY,CAAC;YAC9B,IAAA,mBAAU,EAAC,GAAG,EAAE,CAAC,wBAAU,CAAC;YAC5B,IAAA,mBAAU,EAAC,GAAG,EAAE,CAAC,wBAAU,CAAC;YAC5B,IAAA,mBAAU,EAAC,GAAG,EAAE,CAAC,gCAAc,CAAC;YAChC,IAAA,mBAAU,EAAC,GAAG,EAAE,CAAC,0BAAW,CAAC;YAC7B,IAAA,mBAAU,EAAC,GAAG,EAAE,CAAC,wBAAU,CAAC;YAC5B,IAAA,mBAAU,EAAC,GAAG,EAAE,CAAC,wBAAU,CAAC;SAC7B;QACD,WAAW,EAAE,CAAC,kCAAe,CAAC;QAC9B,SAAS,EAAE;YACT,oEAA+B;YAC/B,oDAAuB;YACvB,4BAAY;YACZ,gCAAc;YACd,oCAAgB;YAChB,gCAAc;YACd,sCAAiB;YACjB,sDAAwB;YACxB,8BAAa;YACb,oCAAgB;SACjB;QACD,OAAO,EAAE,CAAC,4BAAY,EAAE,oDAAuB,CAAC;KACjD,CAAC;GACW,WAAW,CAAG"}

package/dist/oauth/oauth.service.d.ts

@@ -31,6 +31,8 @@ type HandleCallbackProps = {
     requestOrigin?: string;
     /** Referer header, used as a fallback when the Origin header is absent. */
     requestReferer?: string;
+    /** App key that initiated the flow (decoded from the signed web state), used for per-app email branding. */
+    app?: string;
 };
 export declare class OAuthService {
     private readonly callbackCoordinator;

package/dist/oauth/oauth.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oauth.service.d.ts","sourceRoot":"","sources":["../../src/oauth/oauth.service.ts"],"names":[],"mappings":"AACA,OAAO,EAAU,aAAa,EAAE,qCAAqC,EAAE,MAAM,qBAAqB,CAAC;AAWnG,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AAC/D,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAC5D,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAEtD,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAEnD,OAAO,EAAE,+BAA+B,EAAE,MAAM,sCAAsC,CAAC;AAMvF,OAAO,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAC3D,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AACjE,OAAO,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAC7D,OAAO,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAC7D,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AACjE,OAAO,EAAE,wBAAwB,EAAE,MAAM,yCAAyC,CAAC;AACnF,OAAO,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AAEnE,KAAK,mBAAmB,GAAG;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,GAAG,EAAE,QAAQ,CAAC;IACd,QAAQ,EAAE,qCAAqC,CAAC;IAChD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,OAAO,GAAG,UAAU,GAAG,SAAS,GAAG,YAAY,CAAC;IACtD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,yBAAyB,CAAC,EAAE,OAAO,CAAC;IACpC,uFAAuF;IACvF,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,2EAA2E;IAC3E,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB,CAAC;AAEF,qBACa,YAAY;IAerB,OAAO,CAAC,QAAQ,CAAC,mBAAmB;IAEpC,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAExB,OAAO,CAAC,QAAQ,CAAC,IAAI;IAxBvB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAiC;IACxD,OAAO,CAAC,SAAS,CAAyC;IAC1D,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAkB;IACxD,kFAAkF;IAClF,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAU;gBAGlD,MAAM,EAAE,cAAc,EACtB,QAAQ,EAAE,gBAAgB,EAC1B,SAAS,EAAE,iBAAiB,EAC5B,MAAM,EAAE,cAAc,EACtB,gBAAgB,EAAE,wBAAwB,EAC1C,KAAK,EAAE,aAAa,EACpB,QAAQ,EAAE,gBAAgB,EACT,mBAAmB,EAAE,+BAA+B,EAEpD,IAAI,EAAE,WAAW,EACjB,IAAI,EAAE,WAAW,EACjB,IAAI,EAAE,WAAW,EACjB,QAAQ,EAAE,eAAe,EACzB,MAAM,EAAE,aAAa,EACrB,KAAK,EAAE,YAAY,EACnB,OAAO,EAAE,cAAc,EAEvB,IAAI,EAAE,WAAW;IAW9B,UAAU,CACd,QAAQ,EAAE,qCAAqC,EAC/C,YAAY,EAAE,MAAM,EACpB,IAAI,CAAC,EAAE,OAAO,GAAG,UAAU,GAAG,SAAS,EACvC,GAAG,CAAC,EAAE,MAAM;IASR,gBAAgB,CACpB,QAAQ,EAAE,qCAAqC,EAC/C,WAAW,EAAE,MAAM;IAuBrB;;;;;;;;;OASG;IACG,aAAa,CACjB,QAAQ,EAAE,qCAAqC,EAC/C,IAAI,EAAE,OAAO,GAAG,UAAU,GAAG,SAAS,EACtC,WAAW,CAAC,EAAE,MAAM;IAkBtB;;;;;OAKG;IACG,iBAAiB,CACrB,KAAK,CAAC,EAAE,MAAM,GACb,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,IAAI,EAAE,OAAO,GAAG,UAAU,GAAG,SAAS,CAAA;KAAE,GAAG,IAAI,CAAC;IAQpF,OAAO,CAAC,cAAc;IAKtB,OAAO,CAAC,aAAa;IAKrB,6EAA6E;IAC7E,OAAO,CAAC,aAAa;IA4BrB,oFAAoF;YACtE,gBAAgB;IAW9B,OAAO,CAAC,eAAe;IAWjB,cAAc,CAAC,EACnB,GAAG,EACH,MAAM,EACN,SAAS,EACT,SAAS,EACT,QAAQ,EACR,IAAI,EACJ,IAAI,EACJ,MAAM,EACN,KAAK,EACL,WAAW,EACX,KAAK,EACL,yBAAyB,EACzB,aAAa,EACb,cAAc,GACf,EAAE,mBAAmB;;;IAkItB,OAAO,CAAC,WAAW;IAOnB,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,oBAAoB,CAS1C;IAEF,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,sBAAsB,CAS5C;IAEI,iBAAiB,CAAC,QAAQ,EAAE,qCAAqC,GAAG,OAAO,CAAC,OAAO,CAAC;YAO5E,iBAAiB;IAQ/B,OAAO,CAAC,gBAAgB;IAQxB,OAAO,CAAC,kBAAkB;YAUZ,gBAAgB;YAiChB,kBAAkB;YA+ClB,uBAAuB;IAgCrC,oGAAoG;IACpG,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAiB;IAElD;;;;;;OAMG;IACG,mBAAmB,CAAC,EACxB,QAAQ,EACR,IAAI,EACJ,KAAK,EACL,IAAI,EACJ,SAAS,GACV,EAAE;QACD,QAAQ,EAAE,qCAAqC,CAAC;QAChD,IAAI,EAAE,MAAM,CAAC;QACb,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,IAAI,EAAE,OAAO,GAAG,UAAU,GAAG,SAAS,CAAC;QACvC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;KAC1B,GAAG,OAAO,CAAC,MAAM,CAAC;IA0CnB;;;;OAIG;IACG,YAAY,CAAC,EACjB,GAAG,EACH,GAAG,EACH,QAAQ,EACR,MAAM,EACN,SAAS,EACT,SAAS,EACT,MAAM,EACN,aAAa,EACb,cAAc,GACf,EAAE;QACD,GAAG,EAAE,QAAQ,CAAC;QACd,GAAG,EAAE,MAAM,CAAC;QACZ,QAAQ,EAAE,qCAAqC,CAAC;QAChD,MAAM,EAAE,MAAM,CAAC;QACf,SAAS,EAAE,MAAM,CAAC;QAClB,SAAS,EAAE,MAAM,CAAC;QAClB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,cAAc,CAAC,EAAE,MAAM,CAAC;KACzB;;;;;;;YAuFa,gBAAgB;IAyB9B,OAAO,CAAC,kBAAkB;IAY1B,OAAO,CAAC,oBAAoB;IAQ5B,OAAO,CAAC,gBAAgB;YAkEV,WAAW;YAsDX,cAAc;YA0Fd,aAAa;YAoEb,gBAAgB;YAuBhB,6BAA6B;CA+B5C"}
+{"version":3,"file":"oauth.service.d.ts","sourceRoot":"","sources":["../../src/oauth/oauth.service.ts"],"names":[],"mappings":"AACA,OAAO,EAAU,aAAa,EAAE,qCAAqC,EAAE,MAAM,qBAAqB,CAAC;AAWnG,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AAC/D,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAC5D,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAEtD,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAEnD,OAAO,EAAE,+BAA+B,EAAE,MAAM,sCAAsC,CAAC;AAMvF,OAAO,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAC3D,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AACjE,OAAO,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAC7D,OAAO,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAC7D,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AACjE,OAAO,EAAE,wBAAwB,EAAE,MAAM,yCAAyC,CAAC;AACnF,OAAO,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AAEnE,KAAK,mBAAmB,GAAG;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,GAAG,EAAE,QAAQ,CAAC;IACd,QAAQ,EAAE,qCAAqC,CAAC;IAChD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,OAAO,GAAG,UAAU,GAAG,SAAS,GAAG,YAAY,CAAC;IACtD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,yBAAyB,CAAC,EAAE,OAAO,CAAC;IACpC,uFAAuF;IACvF,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,2EAA2E;IAC3E,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,4GAA4G;IAC5G,GAAG,CAAC,EAAE,MAAM,CAAC;CACd,CAAC;AAEF,qBACa,YAAY;IAerB,OAAO,CAAC,QAAQ,CAAC,mBAAmB;IAEpC,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAExB,OAAO,CAAC,QAAQ,CAAC,IAAI;IAxBvB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAiC;IACxD,OAAO,CAAC,SAAS,CAAyC;IAC1D,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAkB;IACxD,kFAAkF;IAClF,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAU;gBAGlD,MAAM,EAAE,cAAc,EACtB,QAAQ,EAAE,gBAAgB,EAC1B,SAAS,EAAE,iBAAiB,EAC5B,MAAM,EAAE,cAAc,EACtB,gBAAgB,EAAE,wBAAwB,EAC1C,KAAK,EAAE,aAAa,EACpB,QAAQ,EAAE,gBAAgB,EACT,mBAAmB,EAAE,+BAA+B,EAEpD,IAAI,EAAE,WAAW,EACjB,IAAI,EAAE,WAAW,EACjB,IAAI,EAAE,WAAW,EACjB,QAAQ,EAAE,eAAe,EACzB,MAAM,EAAE,aAAa,EACrB,KAAK,EAAE,YAAY,EACnB,OAAO,EAAE,cAAc,EAEvB,IAAI,EAAE,WAAW;IAW9B,UAAU,CACd,QAAQ,EAAE,qCAAqC,EAC/C,YAAY,EAAE,MAAM,EACpB,IAAI,CAAC,EAAE,OAAO,GAAG,UAAU,GAAG,SAAS,EACvC,GAAG,CAAC,EAAE,MAAM;IASR,gBAAgB,CACpB,QAAQ,EAAE,qCAAqC,EAC/C,WAAW,EAAE,MAAM;IAuBrB;;;;;;;;;OASG;IACG,aAAa,CACjB,QAAQ,EAAE,qCAAqC,EAC/C,IAAI,EAAE,OAAO,GAAG,UAAU,GAAG,SAAS,EACtC,WAAW,CAAC,EAAE,MAAM;IAkBtB;;;;;OAKG;IACG,iBAAiB,CACrB,KAAK,CAAC,EAAE,MAAM,GACb,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,IAAI,EAAE,OAAO,GAAG,UAAU,GAAG,SAAS,CAAA;KAAE,GAAG,IAAI,CAAC;IAQpF,OAAO,CAAC,cAAc;IAKtB,OAAO,CAAC,aAAa;IAKrB,6EAA6E;IAC7E,OAAO,CAAC,aAAa;IA4BrB,oFAAoF;YACtE,gBAAgB;IAW9B,OAAO,CAAC,eAAe;IAWjB,cAAc,CAAC,EACnB,GAAG,EACH,MAAM,EACN,SAAS,EACT,SAAS,EACT,QAAQ,EACR,IAAI,EACJ,IAAI,EACJ,MAAM,EACN,KAAK,EACL,WAAW,EACX,KAAK,EACL,yBAAyB,EACzB,aAAa,EACb,cAAc,GACf,EAAE,mBAAmB;;;IAoItB,OAAO,CAAC,WAAW;IAOnB,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,oBAAoB,CAS1C;IAEF,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,sBAAsB,CAS5C;IAEI,iBAAiB,CAAC,QAAQ,EAAE,qCAAqC,GAAG,OAAO,CAAC,OAAO,CAAC;YAO5E,iBAAiB;IAQ/B,OAAO,CAAC,gBAAgB;IAQxB,OAAO,CAAC,kBAAkB;YAUZ,gBAAgB;YAiChB,kBAAkB;YA+ClB,uBAAuB;IAgCrC,oGAAoG;IACpG,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAiB;IAElD;;;;;;OAMG;IACG,mBAAmB,CAAC,EACxB,QAAQ,EACR,IAAI,EACJ,KAAK,EACL,IAAI,EACJ,SAAS,GACV,EAAE;QACD,QAAQ,EAAE,qCAAqC,CAAC;QAChD,IAAI,EAAE,MAAM,CAAC;QACb,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,IAAI,EAAE,OAAO,GAAG,UAAU,GAAG,SAAS,CAAC;QACvC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;KAC1B,GAAG,OAAO,CAAC,MAAM,CAAC;IA0CnB;;;;OAIG;IACG,YAAY,CAAC,EACjB,GAAG,EACH,GAAG,EACH,QAAQ,EACR,MAAM,EACN,SAAS,EACT,SAAS,EACT,MAAM,EACN,aAAa,EACb,cAAc,GACf,EAAE;QACD,GAAG,EAAE,QAAQ,CAAC;QACd,GAAG,EAAE,MAAM,CAAC;QACZ,QAAQ,EAAE,qCAAqC,CAAC;QAChD,MAAM,EAAE,MAAM,CAAC;QACf,SAAS,EAAE,MAAM,CAAC;QAClB,SAAS,EAAE,MAAM,CAAC;QAClB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,cAAc,CAAC,EAAE,MAAM,CAAC;KACzB;;;;;;;YAuFa,gBAAgB;IA0B9B,OAAO,CAAC,kBAAkB;IAY1B,OAAO,CAAC,oBAAoB;IAQ5B,OAAO,CAAC,gBAAgB;YAkEV,WAAW;YAsDX,cAAc;YA2Fd,aAAa;YAoEb,gBAAgB;YAuBhB,6BAA6B;CA+B5C"}