@hed-hog/core 0.0.387 → 0.0.393

package/dist/pairing/pairing.service.js

@@ -0,0 +1,495 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+var PairingService_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PairingService = void 0;
+// `Prisma` vem de @hed-hog/api-prisma, não de '@prisma/client': o tsconfig do
+// monorepo mapeia '@prisma/client' para o client gerado (.prisma/client), que
+// não expõe o helper `Prisma.sql`. É a convenção do repo inteiro.
+const api_prisma_1 = require("@hed-hog/api-prisma");
+const common_1 = require("@nestjs/common");
+const schedule_1 = require("@nestjs/schedule");
+const crypto_1 = require("crypto");
+const auth_service_1 = require("../auth/auth.service");
+const security_service_1 = require("../security/security.service");
+/**
+ * Pareamento de aparelhos por QR code, nas duas direções.
+ *
+ * Modelado no `AuthorizeService`: token opaco de que só o hash é persistido, TTL
+ * curto, e toda transição de estado decidida pelo banco com
+ * `UPDATE ... WHERE ... IS NULL RETURNING`. Dois requests concorrentes — o caso
+ * de replay — só podem ter um vencedor, e quem decide é o Postgres.
+ *
+ * ## O que este serviço NÃO faz
+ *
+ * Ele nunca decifra `payload_enc`. Aquele blob é AES-256-GCM feito no cliente,
+ * com uma chave que jamais chega até aqui: na direção A ela sai do fragmento do
+ * QR (que o navegador não transmite), na direção B da chave privada efêmera que
+ * vive só na memória da aba. Chamar `security.decrypt` nele não daria erro de
+ * compilação — daria um cofre a menos de zero-knowledge. O spec cobre isso.
+ *
+ * ## Por que a direção A tem duas fases
+ *
+ * Se o navegador subisse o blob junto com o QR, quem fotografasse a tela nos 2
+ * minutos de validade levaria a sessão e as chaves. Com claim → confirm →
+ * redeem, o aparelho que reivindica não recebe nada; o blob só sobe depois que a
+ * pessoa aprovou, olhando o IP e o user-agent de quem pediu. Um QR
+ * fotografado vira um alerta recusável na tela da própria vítima.
+ */
+let PairingService = PairingService_1 = class PairingService {
+    constructor(prisma, security, auth) {
+        this.prisma = prisma;
+        this.security = security;
+        this.auth = auth;
+        this.logger = new common_1.Logger(PairingService_1.name);
+        /**
+         * Curto de propósito: o QR fica visível numa tela, e o único trabalho dele é
+         * sobreviver ao tempo de pegar o celular e apontar a câmera.
+         */
+        this.pairingTtlMs = 120000;
+    }
+    /* ------------------------------------------------------------------ */
+    /* Comum                                                               */
+    /* ------------------------------------------------------------------ */
+    invalid() {
+        return new common_1.BadRequestException(PairingService_1.GENERIC_ERROR);
+    }
+    async assertClient(clientId) {
+        const client = await this.prisma.oauth_app_client.findUnique({
+            where: { client_id: clientId },
+        });
+        if (!client || !client.enabled) {
+            throw new common_1.BadRequestException('Aplicativo desconhecido ou desabilitado.');
+        }
+        return client;
+    }
+    expiresAt() {
+        return new Date(Date.now() + this.pairingTtlMs);
+    }
+    parseId(id) {
+        try {
+            const parsed = BigInt(id);
+            // BigInt(0) e não 0n: o literal exige target ES2020, e as libraries
+            // compilam com es2017 no tsconfig.production.json — ver
+            // libraries/fiscal/src/document/fiscal-document.totals.ts.
+            if (parsed <= BigInt(0))
+                throw new Error('id inválido');
+            return parsed;
+        }
+        catch (_a) {
+            throw this.invalid();
+        }
+    }
+    /**
+     * Mesma tabela que `UserService.registerUserActivity` escreve. O insert é
+     * direto para não arrastar o UserModule inteiro — com todas as suas
+     * dependências — para dentro de um módulo de auth por causa de uma linha.
+     */
+    async logActivity(userId, action) {
+        if (!userId)
+            return;
+        await this.prisma.user_activity
+            .create({ data: { user_id: userId, action } })
+            .catch(() => null);
+    }
+    /**
+     * Comparação em tempo constante de duas strings base64. Usada na prova de
+     * posse da chave efêmera, que é pública mas cujo desencontro não deve vazar
+     * quantos bytes bateram.
+     */
+    safeEquals(a, b) {
+        const left = Buffer.from(a !== null && a !== void 0 ? a : '');
+        const right = Buffer.from(b !== null && b !== void 0 ? b : '');
+        if (left.length !== right.length)
+            return false;
+        try {
+            return (0, crypto_1.timingSafeEqual)(left, right);
+        }
+        catch (_a) {
+            return false;
+        }
+    }
+    /* ------------------------------------------------------------------ */
+    /* Direção A — navegador destravado → celular                          */
+    /* ------------------------------------------------------------------ */
+    /** Abre o pareamento. Chamado pelo navegador, que já está autenticado. */
+    async start(params) {
+        await this.assertClient(params.clientId);
+        const expiresAt = this.expiresAt();
+        const row = await this.prisma.device_pairing_request.create({
+            data: {
+                direction: PairingService_1.BROWSER_TO_DEVICE,
+                auth_hash: params.authTokenHash,
+                user_id: params.userId,
+                client_id: params.clientId,
+                issued_ip: params.ipAddress,
+                issued_user_agent: params.userAgent,
+                expires_at: expiresAt,
+            },
+        });
+        await this.logActivity(params.userId, 'device-pairing-started');
+        this.logger.debug(`[PairingService] pareamento aberto id=${row.id} userId=${params.userId}`);
+        return { id: String(row.id), expiresAt: expiresAt.toISOString() };
+    }
+    /** Estado para a tela do navegador, incluindo quem reivindicou. */
+    async status(userId, id) {
+        const row = await this.prisma.device_pairing_request.findFirst({
+            where: {
+                id: this.parseId(id),
+                user_id: userId,
+                direction: PairingService_1.BROWSER_TO_DEVICE,
+            },
+        });
+        if (!row)
+            throw this.invalid();
+        return {
+            status: this.deriveStatus(row),
+            claim: row.claimed_at
+                ? {
+                    ip: row.claim_ip,
+                    userAgent: row.claim_user_agent,
+                    at: row.claimed_at.toISOString(),
+                }
+                : null,
+            expiresAt: row.expires_at.toISOString(),
+        };
+    }
+    deriveStatus(row) {
+        if (row.cancelled_at)
+            return 'cancelled';
+        if (row.consumed_at)
+            return 'consumed';
+        if (row.expires_at.getTime() <= Date.now())
+            return 'expired';
+        if (row.confirmed_at)
+            return 'confirmed';
+        if (row.claimed_at)
+            return 'claimed';
+        return 'pending';
+    }
+    /**
+     * O aparelho que leu o QR se anuncia. Não recebe nada além de "aguarde": é
+     * este passo que transforma uma foto do QR num alerta na tela da vítima em vez
+     * de um comprometimento silencioso.
+     */
+    async claim(params) {
+        const authHash = this.security.hashSha256(params.authToken);
+        const rows = await this.prisma.$queryRaw(api_prisma_1.Prisma.sql `
+        UPDATE device_pairing_request
+        SET claimed_at = NOW(),
+            claim_ip = ${params.ipAddress},
+            claim_user_agent = ${params.userAgent}
+        WHERE auth_hash = ${authHash}
+          AND client_id = ${params.clientId}
+          AND direction = ${PairingService_1.BROWSER_TO_DEVICE}
+          AND expires_at > NOW()
+          AND claimed_at IS NULL
+          AND cancelled_at IS NULL
+          AND consumed_at IS NULL
+        RETURNING id, user_id, expires_at
+      `);
+        const row = rows[0];
+        if (!row) {
+            // Um segundo leitor do mesmo QR perde a corrida aqui, decidida pelo banco.
+            this.logger.warn('[PairingService] claim recusado (hash inválido ou já reivindicado)');
+            throw this.invalid();
+        }
+        await this.logActivity(row.user_id, 'device-pairing-claimed');
+        return {
+            status: 'claimed',
+            expiresAt: row.expires_at.toISOString(),
+        };
+    }
+    /** O navegador aprova o aparelho e só então entrega o blob cifrado. */
+    async confirm(params) {
+        const rows = await this.prisma.$queryRaw(api_prisma_1.Prisma.sql `
+        UPDATE device_pairing_request
+        SET confirmed_at = NOW(),
+            payload_enc = ${params.payloadEnc}
+        WHERE id = ${this.parseId(params.id)}
+          AND user_id = ${params.userId}
+          AND direction = ${PairingService_1.BROWSER_TO_DEVICE}
+          AND expires_at > NOW()
+          AND claimed_at IS NOT NULL
+          AND confirmed_at IS NULL
+          AND cancelled_at IS NULL
+          AND consumed_at IS NULL
+        RETURNING id
+      `);
+        if (!rows[0]) {
+            this.logger.warn(`[PairingService] confirm recusado id=${params.id} userId=${params.userId}`);
+            throw this.invalid();
+        }
+        await this.logActivity(params.userId, 'device-pairing-confirmed');
+        return { status: 'confirmed' };
+    }
+    /** "Rejeitar", fechar o diálogo, ou regerar o QR. */
+    async cancel(userId, id) {
+        await this.prisma.device_pairing_request.updateMany({
+            where: { id: this.parseId(id), user_id: userId, consumed_at: null },
+            data: { cancelled_at: new Date() },
+        });
+        await this.logActivity(userId, 'device-pairing-cancelled');
+        return { status: 'cancelled' };
+    }
+    /**
+     * O aparelho resgata. Antes de confirmado devolve `pending` SEM consumir — do
+     * contrário o primeiro poll queimaria o registro e a aprovação chegaria tarde
+     * demais.
+     */
+    async redeem(params) {
+        const authHash = this.security.hashSha256(params.authToken);
+        const pending = await this.prisma.device_pairing_request.findFirst({
+            where: {
+                auth_hash: authHash,
+                client_id: params.clientId,
+                direction: PairingService_1.BROWSER_TO_DEVICE,
+            },
+        });
+        if (!pending ||
+            pending.cancelled_at ||
+            pending.consumed_at ||
+            pending.expires_at.getTime() <= Date.now()) {
+            throw this.invalid();
+        }
+        if (!pending.confirmed_at) {
+            return { status: 'pending' };
+        }
+        const rows = await this.prisma.$queryRaw(api_prisma_1.Prisma.sql `
+        UPDATE device_pairing_request
+        SET consumed_at = NOW()
+        WHERE auth_hash = ${authHash}
+          AND client_id = ${params.clientId}
+          AND direction = ${PairingService_1.BROWSER_TO_DEVICE}
+          AND confirmed_at IS NOT NULL
+          AND consumed_at IS NULL
+          AND cancelled_at IS NULL
+          AND expires_at > NOW()
+        RETURNING user_id, payload_enc
+      `);
+        const row = rows[0];
+        if (!row) {
+            this.logger.warn('[PairingService] redeem após consumo ou expiração');
+            throw this.invalid();
+        }
+        const { accessToken, refreshToken } = await this.auth.getAuthenticationPayload(params.locale, row.user_id, params.ipAddress, params.userAgent);
+        await this.logActivity(row.user_id, 'device-pairing-consumed');
+        return {
+            status: 'confirmed',
+            accessToken,
+            refreshToken,
+            tokenType: 'Bearer',
+            // Informativo para o cliente agendar refresh; a verdade é o exp do JWT.
+            expiresIn: 3600,
+            // Devolvido intacto: este serviço não sabe (nem pode saber) o que há dentro.
+            payload: row.payload_enc,
+        };
+    }
+    /* ------------------------------------------------------------------ */
+    /* Direção B — celular destravado → navegador                          */
+    /* ------------------------------------------------------------------ */
+    /**
+     * O navegador que QUER acesso abre o pareamento. Público: o caso principal é
+     * um computador onde ninguém está logado. O registro nasce sem dono.
+     */
+    async startReverse(params) {
+        await this.assertClient(params.clientId);
+        const expiresAt = this.expiresAt();
+        const row = await this.prisma.device_pairing_request.create({
+            data: {
+                direction: PairingService_1.DEVICE_TO_BROWSER,
+                auth_hash: params.pollHash,
+                client_id: params.clientId,
+                eph_public_key: params.ephPublicKey,
+                want_session: params.wantSession,
+                issued_ip: params.ipAddress,
+                issued_user_agent: params.userAgent,
+                expires_at: expiresAt,
+            },
+        });
+        return { id: String(row.id), expiresAt: expiresAt.toISOString() };
+    }
+    /**
+     * Metadados do navegador que pediu, para o aparelho decidir se aprova.
+     *
+     * Exige a pública efêmera como prova de que quem pergunta leu mesmo o QR: o
+     * `id` é sequencial, e sem essa prova qualquer usuário autenticado poderia
+     * varrer os ids e descobrir de que IP alguém está tentando entrar.
+     */
+    async getReverseRequest(id, ephPublicKey) {
+        const row = await this.prisma.device_pairing_request.findFirst({
+            where: {
+                id: this.parseId(id),
+                direction: PairingService_1.DEVICE_TO_BROWSER,
+            },
+        });
+        if (!row ||
+            !row.eph_public_key ||
+            !this.safeEquals(row.eph_public_key, ephPublicKey) ||
+            row.cancelled_at ||
+            row.consumed_at ||
+            row.confirmed_at ||
+            row.expires_at.getTime() <= Date.now()) {
+            this.logger.warn(`[PairingService] inspeção recusada id=${id}`);
+            throw this.invalid();
+        }
+        // Registrar a leitura deixa o navegador mostrar "celular conectado,
+        // aguardando confirmação" em vez de um QR parado.
+        await this.prisma.device_pairing_request.updateMany({
+            where: { id: row.id, claimed_at: null },
+            data: { claimed_at: new Date() },
+        });
+        return {
+            issuedIp: row.issued_ip,
+            issuedUserAgent: row.issued_user_agent,
+            ephPublicKey: row.eph_public_key,
+            wantSession: row.want_session,
+            expiresAt: row.expires_at.toISOString(),
+        };
+    }
+    /** O aparelho autenticado aprova e entrega o blob cifrado para a efêmera. */
+    async approveReverse(params) {
+        const rows = await this.prisma.$queryRaw(api_prisma_1.Prisma.sql `
+        UPDATE device_pairing_request
+        SET confirmed_at = NOW(),
+            user_id = ${params.userId},
+            payload_enc = ${params.payloadEnc}
+        WHERE id = ${this.parseId(params.id)}
+          AND direction = ${PairingService_1.DEVICE_TO_BROWSER}
+          AND eph_public_key = ${params.ephPublicKey}
+          AND expires_at > NOW()
+          AND confirmed_at IS NULL
+          AND cancelled_at IS NULL
+          AND consumed_at IS NULL
+        RETURNING id
+      `);
+        if (!rows[0]) {
+            this.logger.warn(`[PairingService] aprovação recusada id=${params.id} userId=${params.userId}`);
+            throw this.invalid();
+        }
+        await this.logActivity(params.userId, 'device-pairing-approved');
+        return { status: 'confirmed' };
+    }
+    async rejectReverse(params) {
+        await this.prisma.device_pairing_request.updateMany({
+            where: {
+                id: this.parseId(params.id),
+                direction: PairingService_1.DEVICE_TO_BROWSER,
+                eph_public_key: params.ephPublicKey,
+                consumed_at: null,
+            },
+            data: { cancelled_at: new Date() },
+        });
+        await this.logActivity(params.userId, 'device-pairing-rejected');
+        return { status: 'cancelled' };
+    }
+    /**
+     * O navegador pergunta se já foi aprovado. Enquanto não, devolve `pending` sem
+     * consumir. A sessão, quando pedida, nasce com o IP e o user-agent do
+     * NAVEGADOR — é ele quem vai usá-la, não o celular que aprovou.
+     */
+    async pollReverse(params) {
+        var _a, _b;
+        const pollHash = this.security.hashSha256(params.pollToken);
+        const pending = await this.prisma.device_pairing_request.findFirst({
+            where: {
+                auth_hash: pollHash,
+                direction: PairingService_1.DEVICE_TO_BROWSER,
+            },
+        });
+        if (!pending ||
+            pending.cancelled_at ||
+            pending.consumed_at ||
+            pending.expires_at.getTime() <= Date.now()) {
+            throw this.invalid();
+        }
+        if (!pending.confirmed_at) {
+            return {
+                status: 'pending',
+                claimed: Boolean(pending.claimed_at),
+            };
+        }
+        const rows = await this.prisma.$queryRaw(api_prisma_1.Prisma.sql `
+        UPDATE device_pairing_request
+        SET consumed_at = NOW()
+        WHERE auth_hash = ${pollHash}
+          AND direction = ${PairingService_1.DEVICE_TO_BROWSER}
+          AND confirmed_at IS NOT NULL
+          AND consumed_at IS NULL
+          AND cancelled_at IS NULL
+          AND expires_at > NOW()
+        RETURNING user_id, payload_enc, want_session, issued_ip, issued_user_agent
+      `);
+        const row = rows[0];
+        if (!row) {
+            this.logger.warn('[PairingService] poll após consumo ou expiração');
+            throw this.invalid();
+        }
+        await this.logActivity(row.user_id, 'device-pairing-consumed');
+        if (!row.want_session) {
+            return { status: 'confirmed', payload: row.payload_enc };
+        }
+        const { accessToken, refreshToken, session } = await this.auth.getAuthenticationPayload(params.locale, row.user_id, (_a = row.issued_ip) !== null && _a !== void 0 ? _a : '', (_b = row.issued_user_agent) !== null && _b !== void 0 ? _b : '');
+        return {
+            status: 'confirmed',
+            payload: row.payload_enc,
+            accessToken,
+            refreshToken,
+            session,
+            tokenType: 'Bearer',
+            expiresIn: 3600,
+        };
+    }
+    /* ------------------------------------------------------------------ */
+    /* Limpeza                                                             */
+    /* ------------------------------------------------------------------ */
+    /**
+     * Os registros são minúsculos e de vida curta, mas nada os apagava — mesmo
+     * buraco que `oauth_authorization_code` tem. Sem isto, ciphertext aprovado e
+     * nunca resgatado ficaria no banco para sempre.
+     */
+    async purgeExpired() {
+        const { count } = await this.prisma.device_pairing_request.deleteMany({
+            where: { expires_at: { lt: new Date(Date.now() - 24 * 60 * 60 * 1000) } },
+        });
+        if (count > 0) {
+            this.logger.log(`[PairingService] ${count} pareamentos expirados removidos`);
+        }
+    }
+};
+exports.PairingService = PairingService;
+PairingService.BROWSER_TO_DEVICE = 'browser-to-device';
+PairingService.DEVICE_TO_BROWSER = 'device-to-browser';
+/**
+ * Uma mensagem só para "não existe", "expirou", "já foi usado" e "está no
+ * estado errado". Distinguir esses casos contaria a um atacante exatamente
+ * onde ele está no fluxo.
+ */
+PairingService.GENERIC_ERROR = 'Pareamento inválido, expirado ou já utilizado. Gere um novo QR code.';
+__decorate([
+    (0, schedule_1.Cron)(schedule_1.CronExpression.EVERY_DAY_AT_4AM),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", []),
+    __metadata("design:returntype", Promise)
+], PairingService.prototype, "purgeExpired", null);
+exports.PairingService = PairingService = PairingService_1 = __decorate([
+    (0, common_1.Injectable)(),
+    __param(0, (0, common_1.Inject)((0, common_1.forwardRef)(() => api_prisma_1.PrismaService))),
+    __param(1, (0, common_1.Inject)((0, common_1.forwardRef)(() => security_service_1.SecurityService))),
+    __param(2, (0, common_1.Inject)((0, common_1.forwardRef)(() => auth_service_1.AuthService))),
+    __metadata("design:paramtypes", [api_prisma_1.PrismaService,
+        security_service_1.SecurityService,
+        auth_service_1.AuthService])
+], PairingService);
+//# sourceMappingURL=pairing.service.js.map

package/dist/pairing/pairing.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pairing.service.js","sourceRoot":"","sources":["../../src/pairing/pairing.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,8EAA8E;AAC9E,8EAA8E;AAC9E,kEAAkE;AAClE,oDAA4D;AAC5D,2CAMwB;AACxB,+CAAwD;AACxD,mCAAyC;AACzC,uDAAmD;AACnD,mEAA+D;AAE/D;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEI,IAAM,cAAc,sBAApB,MAAM,cAAc;IAoBzB,YAEE,MAAsC,EAEtC,QAA0C,EAE1C,IAAkC;QAJjB,WAAM,GAAN,MAAM,CAAe;QAErB,aAAQ,GAAR,QAAQ,CAAiB;QAEzB,SAAI,GAAJ,IAAI,CAAa;QAzBnB,WAAM,GAAG,IAAI,eAAM,CAAC,gBAAc,CAAC,IAAI,CAAC,CAAC;QAE1D;;;WAGG;QACc,iBAAY,GAAG,MAAO,CAAC;IAoBrC,CAAC;IAEJ,wEAAwE;IACxE,yEAAyE;IACzE,wEAAwE;IAEhE,OAAO;QACb,OAAO,IAAI,4BAAmB,CAAC,gBAAc,CAAC,aAAa,CAAC,CAAC;IAC/D,CAAC;IAEO,KAAK,CAAC,YAAY,CAAC,QAAgB;QACzC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,UAAU,CAAC;YAC3D,KAAK,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE;SAC/B,CAAC,CAAC;QAEH,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YAC/B,MAAM,IAAI,4BAAmB,CAAC,0CAA0C,CAAC,CAAC;QAC5E,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,SAAS;QACf,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC;IAClD,CAAC;IAEO,OAAO,CAAC,EAAU;QACxB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC;YAC1B,oEAAoE;YACpE,wDAAwD;YACxD,2DAA2D;YAC3D,IAAI,MAAM,IAAI,MAAM,CAAC,CAAC,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,aAAa,CAAC,CAAC;YACxD,OAAO,MAAM,CAAC;QAChB,CAAC;QAAC,WAAM,CAAC;YACP,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;QACvB,CAAC;IACH,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,WAAW,CAAC,MAAqB,EAAE,MAAc;QAC7D,IAAI,CAAC,MAAM;YAAE,OAAO;QACpB,MAAM,IAAI,CAAC,MAAM,CAAC,aAAa;aAC5B,MAAM,CAAC,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,CAAC;aAC7C,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IACvB,CAAC;IAED;;;;OAIG;IACK,UAAU,CAAC,CAAS,EAAE,CAAS;QACrC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,aAAD,CAAC,cAAD,CAAC,GAAI,EAAE,CAAC,CAAC;QAClC,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,aAAD,CAAC,cAAD,CAAC,GAAI,EAAE,CAAC,CAAC;QACnC,IAAI,IAAI,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;QAC/C,IAAI,CAAC;YACH,OAAO,IAAA,wBAAe,EAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QACtC,CAAC;QAAC,WAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED,wEAAwE;IACxE,yEAAyE;IACzE,wEAAwE;IAExE,0EAA0E;IAC1E,KAAK,CAAC,KAAK,CAAC,MAMX;QACC,MAAM,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAEzC,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;QACnC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,sBAAsB,CAAC,MAAM,CAAC;YAC1D,IAAI,EAAE;gBACJ,SAAS,EAAE,gBAAc,CAAC,iBAAiB;gBAC3C,SAAS,EAAE,MAAM,CAAC,aAAa;gBAC/B,OAAO,EAAE,MAAM,CAAC,MAAM;gBACtB,SAAS,EAAE,MAAM,CAAC,QAAQ;gBAC1B,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,iBAAiB,EAAE,MAAM,CAAC,SAAS;gBACnC,UAAU,EAAE,SAAS;aACtB;SACF,CAAC,CAAC;QAEH,MAAM,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,MAAM,EAAE,wBAAwB,CAAC,CAAC;QAChE,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,yCAAyC,GAAG,CAAC,EAAE,WAAW,MAAM,CAAC,MAAM,EAAE,CAC1E,CAAC;QAEF,OAAO,EAAE,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,SAAS,EAAE,SAAS,CAAC,WAAW,EAAE,EAAE,CAAC;IACpE,CAAC;IAED,mEAAmE;IACnE,KAAK,CAAC,MAAM,CAAC,MAAc,EAAE,EAAU;QACrC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,sBAAsB,CAAC,SAAS,CAAC;YAC7D,KAAK,EAAE;gBACL,EAAE,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;gBACpB,OAAO,EAAE,MAAM;gBACf,SAAS,EAAE,gBAAc,CAAC,iBAAiB;aAC5C;SACF,CAAC,CAAC;QAEH,IAAI,CAAC,GAAG;YAAE,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;QAE/B,OAAO;YACL,MAAM,EAAE,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC;YAC9B,KAAK,EAAE,GAAG,CAAC,UAAU;gBACnB,CAAC,CAAC;oBACE,EAAE,EAAE,GAAG,CAAC,QAAQ;oBAChB,SAAS,EAAE,GAAG,CAAC,gBAAgB;oBAC/B,EAAE,EAAE,GAAG,CAAC,UAAU,CAAC,WAAW,EAAE;iBACjC;gBACH,CAAC,CAAC,IAAI;YACR,SAAS,EAAE,GAAG,CAAC,UAAU,CAAC,WAAW,EAAE;SACxC,CAAC;IACJ,CAAC;IAEO,YAAY,CAAC,GAMpB;QACC,IAAI,GAAG,CAAC,YAAY;YAAE,OAAO,WAAW,CAAC;QACzC,IAAI,GAAG,CAAC,WAAW;YAAE,OAAO,UAAU,CAAC;QACvC,IAAI,GAAG,CAAC,UAAU,CAAC,OAAO,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE;YAAE,OAAO,SAAS,CAAC;QAC7D,IAAI,GAAG,CAAC,YAAY;YAAE,OAAO,WAAW,CAAC;QACzC,IAAI,GAAG,CAAC,UAAU;YAAE,OAAO,SAAS,CAAC;QACrC,OAAO,SAAS,CAAC;IACnB,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,KAAK,CAAC,MAKX;QACC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAE5D,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,SAAS,CAGtC,mBAAM,CAAC,GAAG,CAAA;;;yBAGS,MAAM,CAAC,SAAS;iCACR,MAAM,CAAC,SAAS;4BACrB,QAAQ;4BACR,MAAM,CAAC,QAAQ;4BACf,gBAAc,CAAC,iBAAiB;;;;;;OAMrD,CACF,CAAC;QAEF,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACpB,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,2EAA2E;YAC3E,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,oEAAoE,CAAC,CAAC;YACvF,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;QACvB,CAAC;QAED,MAAM,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,OAAO,EAAE,wBAAwB,CAAC,CAAC;QAE9D,OAAO;YACL,MAAM,EAAE,SAAS;YACjB,SAAS,EAAE,GAAG,CAAC,UAAU,CAAC,WAAW,EAAE;SACxC,CAAC;IACJ,CAAC;IAED,uEAAuE;IACvE,KAAK,CAAC,OAAO,CAAC,MAA0D;QACtE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,SAAS,CACtC,mBAAM,CAAC,GAAG,CAAA;;;4BAGY,MAAM,CAAC,UAAU;qBACxB,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;0BAClB,MAAM,CAAC,MAAM;4BACX,gBAAc,CAAC,iBAAiB;;;;;;;OAOrD,CACF,CAAC;QAEF,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YACb,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,wCAAwC,MAAM,CAAC,EAAE,WAAW,MAAM,CAAC,MAAM,EAAE,CAC5E,CAAC;YACF,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;QACvB,CAAC;QAED,MAAM,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,MAAM,EAAE,0BAA0B,CAAC,CAAC;QAClE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IACjC,CAAC;IAED,qDAAqD;IACrD,KAAK,CAAC,MAAM,CAAC,MAAc,EAAE,EAAU;QACrC,MAAM,IAAI,CAAC,MAAM,CAAC,sBAAsB,CAAC,UAAU,CAAC;YAClD,KAAK,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE;YACnE,IAAI,EAAE,EAAE,YAAY,EAAE,IAAI,IAAI,EAAE,EAAE;SACnC,CAAC,CAAC;QAEH,MAAM,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,0BAA0B,CAAC,CAAC;QAC3D,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IACjC,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,MAAM,CAAC,MAMZ;QACC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAE5D,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,sBAAsB,CAAC,SAAS,CAAC;YACjE,KAAK,EAAE;gBACL,SAAS,EAAE,QAAQ;gBACnB,SAAS,EAAE,MAAM,CAAC,QAAQ;gBAC1B,SAAS,EAAE,gBAAc,CAAC,iBAAiB;aAC5C;SACF,CAAC,CAAC;QAEH,IACE,CAAC,OAAO;YACR,OAAO,CAAC,YAAY;YACpB,OAAO,CAAC,WAAW;YACnB,OAAO,CAAC,UAAU,CAAC,OAAO,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,EAC1C,CAAC;YACD,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;QACvB,CAAC;QAED,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC;YAC1B,OAAO,EAAE,MAAM,EAAE,SAAkB,EAAE,CAAC;QACxC,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,SAAS,CAGtC,mBAAM,CAAC,GAAG,CAAA;;;4BAGY,QAAQ;4BACR,MAAM,CAAC,QAAQ;4BACf,gBAAc,CAAC,iBAAiB;;;;;;OAMrD,CACF,CAAC;QAEF,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACpB,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,mDAAmD,CAAC,CAAC;YACtE,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;QACvB,CAAC;QAED,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,wBAAwB,CAC5E,MAAM,CAAC,MAAM,EACb,GAAG,CAAC,OAAO,EACX,MAAM,CAAC,SAAS,EAChB,MAAM,CAAC,SAAS,CACjB,CAAC;QAEF,MAAM,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,OAAO,EAAE,yBAAyB,CAAC,CAAC;QAE/D,OAAO;YACL,MAAM,EAAE,WAAoB;YAC5B,WAAW;YACX,YAAY;YACZ,SAAS,EAAE,QAAQ;YACnB,wEAAwE;YACxE,SAAS,EAAE,IAAI;YACf,6EAA6E;YAC7E,OAAO,EAAE,GAAG,CAAC,WAAW;SACzB,CAAC;IACJ,CAAC;IAED,wEAAwE;IACxE,yEAAyE;IACzE,wEAAwE;IAExE;;;OAGG;IACH,KAAK,CAAC,YAAY,CAAC,MAOlB;QACC,MAAM,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAEzC,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;QACnC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,sBAAsB,CAAC,MAAM,CAAC;YAC1D,IAAI,EAAE;gBACJ,SAAS,EAAE,gBAAc,CAAC,iBAAiB;gBAC3C,SAAS,EAAE,MAAM,CAAC,QAAQ;gBAC1B,SAAS,EAAE,MAAM,CAAC,QAAQ;gBAC1B,cAAc,EAAE,MAAM,CAAC,YAAY;gBACnC,YAAY,EAAE,MAAM,CAAC,WAAW;gBAChC,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,iBAAiB,EAAE,MAAM,CAAC,SAAS;gBACnC,UAAU,EAAE,SAAS;aACtB;SACF,CAAC,CAAC;QAEH,OAAO,EAAE,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,SAAS,EAAE,SAAS,CAAC,WAAW,EAAE,EAAE,CAAC;IACpE,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,iBAAiB,CAAC,EAAU,EAAE,YAAoB;QACtD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,sBAAsB,CAAC,SAAS,CAAC;YAC7D,KAAK,EAAE;gBACL,EAAE,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;gBACpB,SAAS,EAAE,gBAAc,CAAC,iBAAiB;aAC5C;SACF,CAAC,CAAC;QAEH,IACE,CAAC,GAAG;YACJ,CAAC,GAAG,CAAC,cAAc;YACnB,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,cAAc,EAAE,YAAY,CAAC;YAClD,GAAG,CAAC,YAAY;YAChB,GAAG,CAAC,WAAW;YACf,GAAG,CAAC,YAAY;YAChB,GAAG,CAAC,UAAU,CAAC,OAAO,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,EACtC,CAAC;YACD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,yCAAyC,EAAE,EAAE,CAAC,CAAC;YAChE,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;QACvB,CAAC;QAED,oEAAoE;QACpE,kDAAkD;QAClD,MAAM,IAAI,CAAC,MAAM,CAAC,sBAAsB,CAAC,UAAU,CAAC;YAClD,KAAK,EAAE,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE;YACvC,IAAI,EAAE,EAAE,UAAU,EAAE,IAAI,IAAI,EAAE,EAAE;SACjC,CAAC,CAAC;QAEH,OAAO;YACL,QAAQ,EAAE,GAAG,CAAC,SAAS;YACvB,eAAe,EAAE,GAAG,CAAC,iBAAiB;YACtC,YAAY,EAAE,GAAG,CAAC,cAAc;YAChC,WAAW,EAAE,GAAG,CAAC,YAAY;YAC7B,SAAS,EAAE,GAAG,CAAC,UAAU,CAAC,WAAW,EAAE;SACxC,CAAC;IACJ,CAAC;IAED,6EAA6E;IAC7E,KAAK,CAAC,cAAc,CAAC,MAKpB;QACC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,SAAS,CACtC,mBAAM,CAAC,GAAG,CAAA;;;wBAGQ,MAAM,CAAC,MAAM;4BACT,MAAM,CAAC,UAAU;qBACxB,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;4BAChB,gBAAc,CAAC,iBAAiB;iCAC3B,MAAM,CAAC,YAAY;;;;;;OAM7C,CACF,CAAC;QAEF,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YACb,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,0CAA0C,MAAM,CAAC,EAAE,WAAW,MAAM,CAAC,MAAM,EAAE,CAC9E,CAAC;YACF,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;QACvB,CAAC;QAED,MAAM,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,MAAM,EAAE,yBAAyB,CAAC,CAAC;QACjE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IACjC,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,MAInB;QACC,MAAM,IAAI,CAAC,MAAM,CAAC,sBAAsB,CAAC,UAAU,CAAC;YAClD,KAAK,EAAE;gBACL,EAAE,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC3B,SAAS,EAAE,gBAAc,CAAC,iBAAiB;gBAC3C,cAAc,EAAE,MAAM,CAAC,YAAY;gBACnC,WAAW,EAAE,IAAI;aAClB;YACD,IAAI,EAAE,EAAE,YAAY,EAAE,IAAI,IAAI,EAAE,EAAE;SACnC,CAAC,CAAC;QAEH,MAAM,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,MAAM,EAAE,yBAAyB,CAAC,CAAC;QACjE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IACjC,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,WAAW,CAAC,MAA6C;;QAC7D,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAE5D,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,sBAAsB,CAAC,SAAS,CAAC;YACjE,KAAK,EAAE;gBACL,SAAS,EAAE,QAAQ;gBACnB,SAAS,EAAE,gBAAc,CAAC,iBAAiB;aAC5C;SACF,CAAC,CAAC;QAEH,IACE,CAAC,OAAO;YACR,OAAO,CAAC,YAAY;YACpB,OAAO,CAAC,WAAW;YACnB,OAAO,CAAC,UAAU,CAAC,OAAO,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,EAC1C,CAAC;YACD,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;QACvB,CAAC;QAED,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC;YAC1B,OAAO;gBACL,MAAM,EAAE,SAAkB;gBAC1B,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC;aACrC,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,SAAS,CAStC,mBAAM,CAAC,GAAG,CAAA;;;4BAGY,QAAQ;4BACR,gBAAc,CAAC,iBAAiB;;;;;;OAMrD,CACF,CAAC;QAEF,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACpB,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,iDAAiD,CAAC,CAAC;YACpE,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;QACvB,CAAC;QAED,MAAM,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,OAAO,EAAE,yBAAyB,CAAC,CAAC;QAE/D,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,CAAC;YACtB,OAAO,EAAE,MAAM,EAAE,WAAoB,EAAE,OAAO,EAAE,GAAG,CAAC,WAAW,EAAE,CAAC;QACpE,CAAC;QAED,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,OAAO,EAAE,GAC1C,MAAM,IAAI,CAAC,IAAI,CAAC,wBAAwB,CACtC,MAAM,CAAC,MAAM,EACb,GAAG,CAAC,OAAO,EACX,MAAA,GAAG,CAAC,SAAS,mCAAI,EAAE,EACnB,MAAA,GAAG,CAAC,iBAAiB,mCAAI,EAAE,CAC5B,CAAC;QAEJ,OAAO;YACL,MAAM,EAAE,WAAoB;YAC5B,OAAO,EAAE,GAAG,CAAC,WAAW;YACxB,WAAW;YACX,YAAY;YACZ,OAAO;YACP,SAAS,EAAE,QAAQ;YACnB,SAAS,EAAE,IAAI;SAChB,CAAC;IACJ,CAAC;IAED,wEAAwE;IACxE,yEAAyE;IACzE,wEAAwE;IAExE;;;;OAIG;IAEG,AAAN,KAAK,CAAC,YAAY;QAChB,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,sBAAsB,CAAC,UAAU,CAAC;YACpE,KAAK,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,EAAE,EAAE;SAC1E,CAAC,CAAC;QAEH,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;YACd,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,oBAAoB,KAAK,kCAAkC,CAAC,CAAC;QAC/E,CAAC;IACH,CAAC;;AA3jBU,wCAAc;AAST,gCAAiB,GAAG,mBAAmB,AAAtB,CAAuB;AACxC,gCAAiB,GAAG,mBAAmB,AAAtB,CAAuB;AAExD;;;;GAIG;AACqB,4BAAa,GACnC,sEAAsE,AADnC,CACoC;AAiiBnE;IADL,IAAA,eAAI,EAAC,yBAAc,CAAC,gBAAgB,CAAC;;;;kDASrC;yBA3jBU,cAAc;IAD1B,IAAA,mBAAU,GAAE;IAsBR,WAAA,IAAA,eAAM,EAAC,IAAA,mBAAU,EAAC,GAAG,EAAE,CAAC,0BAAa,CAAC,CAAC,CAAA;IAEvC,WAAA,IAAA,eAAM,EAAC,IAAA,mBAAU,EAAC,GAAG,EAAE,CAAC,kCAAe,CAAC,CAAC,CAAA;IAEzC,WAAA,IAAA,eAAM,EAAC,IAAA,mBAAU,EAAC,GAAG,EAAE,CAAC,0BAAW,CAAC,CAAC,CAAA;qCAHb,0BAAa;QAEX,kCAAe;QAEnB,0BAAW;GA1BzB,cAAc,CA4jB1B"}

package/dist/pdf/pdf.service.d.ts

@@ -1,4 +1,5 @@
 import { ConfigService } from '@nestjs/config';
+import { BrandAssetService } from '../setting/brand-asset.service';
 import { SettingService } from '../setting/setting.service';
 import { PdfAreaType, PdfThemeConfig } from './interfaces/pdf-theme-config.interface';
 export interface PdfGenerateOptions {
@@ -18,20 +19,16 @@ export interface PdfGenerateOptions {
 }
 export declare class PdfService {
     private readonly settingService;
+    private readonly brandAsset;
     private readonly configService;
     private readonly logger;
-    constructor(settingService: SettingService, configService: ConfigService);
+    constructor(settingService: SettingService, brandAsset: BrandAssetService, configService: ConfigService);
     /**
      * Resolves the active PdfThemeConfig for the given area.
      * Reads admin-configured overrides from SettingService and falls back to
      * the hard-coded Design System v1.0 defaults.
      */
     loadThemeConfig(area?: PdfAreaType): Promise<PdfThemeConfig>;
-    /**
-     * Resolves a potentially relative URL (e.g. /logo.svg) to an absolute URL
-     * using the API base URL derived from environment variables.
-     */
-    private resolveUrl;
     /**
      * Renders an HTML string to a PDF buffer using Playwright/Chromium.
      *
@@ -39,6 +36,14 @@ export declare class PdfService {
      * CommonJS bundle output (same pattern as operations.service.ts).
      */
     generatePdfFromHtml(html: string, options?: PdfGenerateOptions): Promise<Buffer>;
+    /**
+     * Renders an HTML string to a PNG image buffer via a Playwright/Chromium
+     * screenshot. Shares the same layout contract as {@link generatePdfFromHtml}
+     * (the viewport matches `width`/`height`), so the image is a pixel-faithful
+     * preview of what the PDF would produce for the same HTML — used for
+     * certificate thumbnails on the web/app.
+     */
+    generateImageFromHtml(html: string, options?: PdfGenerateOptions): Promise<Buffer>;
     /**
      * Generates a PDF from a named template and structured data.
      * The theme is resolved automatically from `data.area` via SettingService.

package/dist/pdf/pdf.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pdf.service.d.ts","sourceRoot":"","sources":["../../src/pdf/pdf.service.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAE/C,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAC5D,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,yCAAyC,CAAC;AAQtF,MAAM,WAAW,kBAAkB;IACjC,MAAM,CAAC,EAAE,IAAI,GAAG,IAAI,GAAG,QAAQ,CAAC;IAChC,MAAM,CAAC,EAAE;QAAE,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAC1E,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,mGAAmG;IACnG,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,mGAAmG;IACnG,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAiBD,qBACa,UAAU;IAKnB,OAAO,CAAC,QAAQ,CAAC,cAAc;IAC/B,OAAO,CAAC,QAAQ,CAAC,aAAa;IALhC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA+B;gBAInC,cAAc,EAAE,cAAc,EAC9B,aAAa,EAAE,aAAa;IAK/C;;;;OAIG;IACG,eAAe,CAAC,IAAI,GAAE,WAA0B,GAAG,OAAO,CAAC,cAAc,CAAC;IA8DhF;;;OAGG;IACH,OAAO,CAAC,UAAU;IAqBlB;;;;;OAKG;IACG,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,GAAE,kBAAuB,GAAG,OAAO,CAAC,MAAM,CAAC;IAqF1F;;;OAGG;IACG,uBAAuB,CAC3B,YAAY,EAAE,MAAM,EACpB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,OAAO,CAAC,EAAE,kBAAkB,GAC3B,OAAO,CAAC,MAAM,CAAC;CAkBnB"}
+{"version":3,"file":"pdf.service.d.ts","sourceRoot":"","sources":["../../src/pdf/pdf.service.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAE/C,OAAO,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACnE,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAC5D,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,yCAAyC,CAAC;AAQtF,MAAM,WAAW,kBAAkB;IACjC,MAAM,CAAC,EAAE,IAAI,GAAG,IAAI,GAAG,QAAQ,CAAC;IAChC,MAAM,CAAC,EAAE;QAAE,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAC1E,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,mGAAmG;IACnG,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,mGAAmG;IACnG,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAiBD,qBACa,UAAU;IAKnB,OAAO,CAAC,QAAQ,CAAC,cAAc;IAE/B,OAAO,CAAC,QAAQ,CAAC,UAAU;IAC3B,OAAO,CAAC,QAAQ,CAAC,aAAa;IAPhC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA+B;gBAInC,cAAc,EAAE,cAAc,EAE9B,UAAU,EAAE,iBAAiB,EAC7B,aAAa,EAAE,aAAa;IAK/C;;;;OAIG;IACG,eAAe,CAAC,IAAI,GAAE,WAA0B,GAAG,OAAO,CAAC,cAAc,CAAC;IAkEhF;;;;;OAKG;IACG,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,GAAE,kBAAuB,GAAG,OAAO,CAAC,MAAM,CAAC;IAqF1F;;;;;;OAMG;IACG,qBAAqB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,GAAE,kBAAuB,GAAG,OAAO,CAAC,MAAM,CAAC;IAoE5F;;;OAGG;IACG,uBAAuB,CAC3B,YAAY,EAAE,MAAM,EACpB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,OAAO,CAAC,EAAE,kBAAkB,GAC3B,OAAO,CAAC,MAAM,CAAC;CAkBnB"}