@hilbras/keystone 1.6.0 → 2.5.0

package/dist/services/domain/authentication.js

@@ -1,8 +1,10 @@
 import crypto from "node:crypto";
-import { eq, and, gt, isNull } from "drizzle-orm";
+import { eq } from "drizzle-orm";
 import { config, isZitadelConfigured } from "../../config.js";
 import { db } from "../../db/index.js";
 import { users, passwordResetTokens } from "../../db/schema.js";
+import { consumePasswordResetTokenRow } from "../singleUse.js";
+import { revokeAllUserCredentials } from "../sessionRevocation.js";
 import { createHumanUser, verifyPassword as verifyZitadelPassword } from "../zitadel.js";
 import { createTokenSet, rotateRefreshToken, revokeRefreshToken } from "../tokens.js";
 import { isPasswordBreached } from "../hibp.js";
@@ -13,19 +15,24 @@ import { hashPassword, verifyPassword } from "../secrets/index.js";
 export class AuthenticationDomainService {
     users;
     applications;
-    constructor(users, applications) {
+    organizations;
+    mfa;
+    constructor(users, applications, organizations, mfa) {
         this.users = users;
         this.applications = applications;
+        this.organizations = organizations;
+        this.mfa = mfa;
     }
-    async loadAppContext(clientId) {
+    async loadAppContext(userId, clientId) {
         if (!clientId)
             return {};
         const app = await this.applications.findByClientId(clientId);
         if (!app)
             return {};
+        const membership = await this.organizations.findMembership(app.orgId, userId);
         return {
-            app: { id: app.id, clientId: app.clientId, orgId: app.orgId },
-            org: { id: app.orgId },
+            app: { id: app.id, clientId: app.clientId, ...(membership ? { orgId: app.orgId } : {}) },
+            ...(membership ? { org: { id: app.orgId } } : {}),
         };
     }
     async register(input) {
@@ -76,11 +83,11 @@ export class AuthenticationDomainService {
                 // emailVerification module may not be available in all configurations
             }
         }
-        const context = await this.loadAppContext(input.clientId);
+        const context = await this.loadAppContext(user.id, input.clientId);
         const tokens = await createTokenSet(user, undefined, undefined, {
-            appId: context.app?.id,
+            appId: context.org ? context.app?.id : undefined,
             orgId: context.org?.id,
-            clientId: context.app?.clientId,
+            clientId: context.org ? context.app?.clientId : undefined,
         });
         await emit({
             type: "user_registered",
@@ -91,7 +98,7 @@ export class AuthenticationDomainService {
                 username: user.username,
                 email: user.email,
                 client_id: input.clientId,
-                appId: context.app?.id,
+                appId: context.org ? context.app?.id : undefined,
                 orgId: context.org?.id,
             },
         });
@@ -110,6 +117,14 @@ export class AuthenticationDomainService {
             }
             return err({ code: "INVALID_CREDENTIALS", message: "Invalid email or password.", statusCode: 401 });
         }
+        if (!user.isActive) {
+            await emit({ type: "user_login_failed", payload: { reason: "account_deactivated", userId: user.id } });
+            return err({ code: "ACCOUNT_DEACTIVATED", message: "This account is deactivated", statusCode: 403 });
+        }
+        if (user.accountReviewRequired) {
+            await emit({ type: "user_login_failed", payload: { reason: "account_review_required", userId: user.id } });
+            return err({ code: "ACCOUNT_REVIEW_REQUIRED", message: "This account is pending review.", statusCode: 403 });
+        }
         if (user.lockedUntil && user.lockedUntil > new Date()) {
             await emit({ type: "user_login_failed", payload: { reason: "account_locked", userId: user.id } });
             return err({ code: "ACCOUNT_LOCKED", message: "Account is temporarily locked due to too many failed attempts. Try again later.", statusCode: 403 });
@@ -136,27 +151,76 @@ export class AuthenticationDomainService {
             return err({ code: "INVALID_CREDENTIALS", message: "Invalid email or password.", statusCode: 401 });
         }
         await this.users.resetFailedLogins(user.id);
+        const context = await this.loadAppContext(user.id, input.clientId);
+        if (user.totpEnabled) {
+            // requires_mfa: no access token, no refresh token, no session row, and no
+            // `user_login` event. The only thing handed back is an opaque challenge.
+            const challenge = await this.mfa.createChallenge(user, input.flow ?? "login", input.clientId, {
+                ipAddress: input.ipAddress,
+                userAgent: input.userAgent,
+            });
+            return ok({ status: "requires_mfa", user, challenge, context });
+        }
         await this.users.updateLastSeen(user.id);
-        const context = await this.loadAppContext(input.clientId);
-        const tokens = await createTokenSet(user, undefined, undefined, {
-            appId: context.app?.id,
+        const tokens = await this.issueTokens(user, context, input.ipAddress, input.userAgent);
+        await emit({
+            type: "user_login",
+            payload: { provider: user.provider, userId: user.id, appId: context.org ? context.app?.id : undefined, orgId: context.org?.id },
+        });
+        return ok({ status: "authenticated", user, tokens, context });
+    }
+    async issueTokens(user, context, ipAddress, userAgent, mfaFactor) {
+        return createTokenSet(user, ipAddress, userAgent, {
+            appId: context.org ? context.app?.id : undefined,
             orgId: context.org?.id,
-            clientId: context.app?.clientId,
+            clientId: context.org ? context.app?.clientId : undefined,
+            ...(mfaFactor ? { mfaFactor } : {}),
         });
+    }
+    /**
+     * Second step of the login state machine: verify a factor against an
+     * outstanding challenge and only then issue tokens. Replaying the same
+     * challenge returns `MFA_CHALLENGE_REPLAYED` and issues nothing.
+     */
+    async completeMfa(challengeToken, code, factor, ipAddress, userAgent) {
+        const result = await this.mfa.verifyChallenge(challengeToken, code, factor, (id) => this.users.findById(id));
+        if (!result.success)
+            return result;
+        const { user, flow, clientId } = result.data;
+        const context = await this.loadAppContext(user.id, clientId);
+        let tokens;
+        try {
+            tokens = await this.issueTokens(user, context, ipAddress, userAgent, factor);
+        }
+        catch {
+            await emit({ type: "mfa_bypass_blocked", payload: { userId: user.id, flow } });
+            return err({
+                code: "MFA_REQUIRED",
+                message: "Multi-factor authentication could not be completed.",
+                statusCode: 401,
+            });
+        }
+        await this.users.updateLastSeen(user.id);
         await emit({
             type: "user_login",
-            payload: { provider: user.provider, userId: user.id, appId: context.app?.id, orgId: context.org?.id },
+            payload: {
+                provider: user.provider,
+                userId: user.id,
+                mfa: factor,
+                appId: context.org ? context.app?.id : undefined,
+                orgId: context.org?.id,
+            },
         });
-        return ok({ user, tokens, context });
+        return ok({ user, tokens, context, flow, factor, clientId });
     }
     async refresh(refreshToken, clientId) {
-        const tokens = await rotateRefreshToken(refreshToken, undefined, undefined);
+        const tokens = await rotateRefreshToken(refreshToken, undefined, undefined, clientId);
         if (!tokens) {
             await emit({ type: "token_refresh_failed", payload: { reason: "invalid_refresh_token" } });
             return err({ code: "INVALID_REFRESH_TOKEN", message: "Invalid or expired session.", statusCode: 401 });
         }
-        await emit({ type: "token_refresh", payload: {} });
-        return ok({ tokens, userId: undefined });
+        await emit({ type: "token_refresh", payload: { userId: tokens.userId } });
+        return ok({ tokens, userId: tokens.userId });
     }
     async logout(refreshToken) {
         if (refreshToken) {
@@ -166,7 +230,7 @@ export class AuthenticationDomainService {
     }
     async createPasswordResetToken(email) {
         const user = await this.users.findByEmail(email);
-        if (!user)
+        if (!user || !user.isActive)
             return ok(null);
         const token = crypto.randomBytes(48).toString("base64url");
         const tokenHash = crypto.createHash("sha256").update(token).digest("hex");
@@ -182,17 +246,24 @@ export class AuthenticationDomainService {
     async resetPasswordWithToken(token, newPassword) {
         const tokenHash = crypto.createHash("sha256").update(token).digest("hex");
         const now = new Date();
-        const [record] = await db
-            .select()
-            .from(passwordResetTokens)
-            .where(and(eq(passwordResetTokens.tokenHash, tokenHash), gt(passwordResetTokens.expiresAt, now), isNull(passwordResetTokens.usedAt)))
-            .limit(1);
-        if (!record) {
-            return err({ code: "INVALID_TOKEN", message: "Invalid or expired reset token.", statusCode: 400 });
-        }
-        const user = await this.users.findById(record.userId);
-        if (!user) {
-            return err({ code: "USER_NOT_FOUND", message: "User not found.", statusCode: 400 });
+        // Claim the token before doing any work. A conditional SELECT followed by an
+        // unconditional UPDATE would let parallel requests all pass the check and
+        // each write a different password, last writer winning — so the claim is
+        // the gate, and it happens first.
+        const claim = await consumePasswordResetTokenRow(tokenHash, now);
+        if (claim.outcome !== "consumed" || !claim.record) {
+            if (claim.reason === "replayed") {
+                await emit({ type: "password_reset_token_replayed", payload: {} });
+            }
+            return err({
+                code: "INVALID_TOKEN",
+                message: claim.reason === "expired" ? "This reset link has expired." : "Invalid or expired reset token.",
+                statusCode: 400,
+            });
+        }
+        const user = await this.users.findById(claim.record.userId);
+        if (!user?.isActive) {
+            return err({ code: "ACCOUNT_DEACTIVATED", message: "This account is deactivated.", statusCode: 403 });
         }
         if (config.HIBP_CHECK_ENABLED) {
             const breached = await isPasswordBreached(newPassword);
@@ -201,17 +272,25 @@ export class AuthenticationDomainService {
             }
         }
         const passwordHash = await hashPassword(newPassword);
-        await db.transaction(async (tx) => {
-            await tx
-                .update(passwordResetTokens)
-                .set({ usedAt: now })
-                .where(eq(passwordResetTokens.id, record.id));
-            await tx
-                .update(users)
-                .set({ passwordHash, updatedAt: now })
-                .where(eq(users.id, user.id));
+        await db
+            .update(users)
+            .set({ passwordHash, updatedAt: now })
+            .where(eq(users.id, user.id));
+        // A reset is the standard response to a suspected compromise, so it has to
+        // actually remove the intruder. Changing the password while leaving live
+        // sessions and refresh tokens would let whoever prompted the reset keep
+        // using the account. Also spends any other reset token issued alongside
+        // this one, so an intercepted earlier email cannot be completed later.
+        const revoked = await revokeAllUserCredentials(user.id);
+        await emit({
+            type: "password_reset_completed",
+            payload: {
+                userId: user.id,
+                revokedSessions: revoked.sessions,
+                revokedRefreshTokens: revoked.refreshTokens,
+                revokedRecoveryCredentials: revoked.recoveryCredentials,
+            },
         });
-        await emit({ type: "password_reset_completed", payload: { userId: user.id } });
         return ok(user);
     }
 }

package/dist/services/domain/authentication.js.map

@@ -1 +1 @@
-{"version":3,"file":"authentication.js","sourceRoot":"","sources":["../../../src/services/domain/authentication.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,EAAE,MAAM,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAC9D,OAAO,EAAE,EAAE,EAAE,MAAM,mBAAmB,CAAC;AACvC,OAAO,EAAE,KAAK,EAAE,mBAAmB,EAAa,MAAM,oBAAoB,CAAC;AAC3E,OAAO,EAAE,eAAe,EAAE,cAAc,IAAI,qBAAqB,EAAE,MAAM,eAAe,CAAC;AACzF,OAAO,EAAE,cAAc,EAAE,kBAAkB,EAAE,kBAAkB,EAAiB,MAAM,cAAc,CAAC;AACrG,OAAO,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAChD,OAAO,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AACjF,OAAO,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAExC,OAAO,EAAE,EAAE,EAAE,GAAG,EAAe,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AA4BnE,MAAM,OAAO,2BAA2B;IAEnB;IACA;IAFnB,YACmB,KAAqB,EACrB,YAAmC;QADnC,UAAK,GAAL,KAAK,CAAgB;QACrB,iBAAY,GAAZ,YAAY,CAAuB;IACnD,CAAC;IAEI,KAAK,CAAC,cAAc,CAAC,QAAiB;QAC5C,IAAI,CAAC,QAAQ;YAAE,OAAO,EAAE,CAAC;QACzB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;QAC7D,IAAI,CAAC,GAAG;YAAE,OAAO,EAAE,CAAC;QACpB,OAAO;YACL,GAAG,EAAE,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE;YAC7D,GAAG,EAAE,EAAE,EAAE,EAAE,GAAG,CAAC,KAAK,EAAE;SACvB,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,KAAoB;QACjC,IAAI,MAAM,CAAC,kBAAkB,EAAE,CAAC;YAC9B,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;YAC1D,IAAI,QAAQ,EAAE,CAAC;gBACb,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,8CAA8C,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;YACtH,CAAC;QACH,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC3D,IAAI,QAAQ,EAAE,CAAC;YACb,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,4CAA4C,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QAC/G,CAAC;QAED,MAAM,YAAY,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACxD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,oBAAoB,CACpD,KAAK,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,eAAe,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CACvG,CAAC;QAEF,IAAI,aAAiC,CAAC;QACtC,IAAI,mBAAmB,EAAE,EAAE,CAAC;YAC1B,IAAI,CAAC;gBACH,aAAa,GAAG,MAAM,eAAe,CAAC;oBACpC,QAAQ,EAAE,KAAK,CAAC,QAAQ;oBACxB,KAAK,EAAE,KAAK,CAAC,KAAK;oBAClB,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,QAAQ;oBAClC,QAAQ,EAAE,KAAK,CAAC,QAAQ;iBACzB,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,CAAC,IAAI,CAAC,wDAAwD,EAAE,GAAG,CAAC,CAAC;YAC9E,CAAC;QACH,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC;YACnC,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,QAAQ;YACR,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,QAAQ;YAClC,YAAY;YACZ,QAAQ,EAAE,UAAU;YACpB,aAAa,EAAE,CAAC,MAAM,CAAC,2BAA2B;YAClD,aAAa;YACb,QAAQ,EAAE,KAAK,CAAC,QAAQ;SACzB,CAAC,CAAC;QAEH,IAAI,MAAM,CAAC,2BAA2B,EAAE,CAAC;YACvC,IAAI,CAAC;gBACH,MAAM,EAAE,qBAAqB,EAAE,GAAG,MAAM,MAAM,CAAC,yBAAyB,CAAC,CAAC;gBAC1E,qBAAqB,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;oBACjD,OAAO,CAAC,KAAK,CAAC,2CAA2C,EAAE,GAAG,CAAC,CAAC;gBAClE,CAAC,CAAC,CAAC;YACL,CAAC;YAAC,MAAM,CAAC;gBACP,sEAAsE;YACxE,CAAC;QACH,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAC1D,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE;YAC9D,KAAK,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE;YACtB,KAAK,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE;YACtB,QAAQ,EAAE,OAAO,CAAC,GAAG,EAAE,QAAQ;SAChC,CAAC,CAAC;QAEH,MAAM,IAAI,CAAC;YACT,IAAI,EAAE,iBAAiB;YACvB,OAAO,EAAE;gBACP,QAAQ,EAAE,UAAU;gBACpB,aAAa;gBACb,MAAM,EAAE,IAAI,CAAC,EAAE;gBACf,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,SAAS,EAAE,KAAK,CAAC,QAAQ;gBACzB,KAAK,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE;gBACtB,KAAK,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE;aACvB;SACF,CAAC,CAAC;QAEH,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;IACvC,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,KAAiB;QAC3B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAEvD,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,IAAI,mBAAmB,EAAE,EAAE,CAAC;gBAC1B,MAAM,qBAAqB,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YAC3E,CAAC;YACD,MAAM,iBAAiB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YACrC,MAAM,IAAI,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,cAAc,EAAE,EAAE,CAAC,CAAC;YAC/E,IAAI,MAAM,oBAAoB,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC5C,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,mDAAmD,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;YAC3H,CAAC;YACD,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,qBAAqB,EAAE,OAAO,EAAE,4BAA4B,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QACtG,CAAC;QAED,IAAI,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,WAAW,GAAG,IAAI,IAAI,EAAE,EAAE,CAAC;YACtD,MAAM,IAAI,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;YAClG,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,iFAAiF,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QACtJ,CAAC;QAED,IAAI,KAAK,GAAG,KAAK,CAAC;QAClB,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACtB,KAAK,GAAG,MAAM,cAAc,CAAC,KAAK,CAAC,QAAQ,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;QAClE,CAAC;aAAM,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS,IAAI,mBAAmB,EAAE,EAAE,CAAC;YAChE,KAAK,GAAG,MAAM,qBAAqB,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;QACnE,CAAC;QAED,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAC5D,MAAM,IAAI,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;YAEpG,MAAM,QAAQ,GAAG,OAAO,EAAE,mBAAmB,IAAI,CAAC,CAAC;YACnD,IAAI,QAAQ,IAAI,MAAM,CAAC,yBAAyB,EAAE,CAAC;gBACjD,MAAM,WAAW,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,gCAAgC,GAAG,IAAI,CAAC,CAAC;gBAC1F,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,EAAE,WAAW,CAAC,CAAC;gBACnD,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,kEAAkE,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;YACvI,CAAC;YAED,IAAI,MAAM,oBAAoB,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;gBACxC,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,mDAAmD,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;YAC3H,CAAC;YACD,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,qBAAqB,EAAE,OAAO,EAAE,4BAA4B,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QACtG,CAAC;QAED,MAAM,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC5C,MAAM,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACzC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAC1D,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE;YAC9D,KAAK,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE;YACtB,KAAK,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE;YACtB,QAAQ,EAAE,OAAO,CAAC,GAAG,EAAE,QAAQ;SAChC,CAAC,CAAC;QAEH,MAAM,IAAI,CAAC;YACT,IAAI,EAAE,YAAY;YAClB,OAAO,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE,EAAE;SACtG,CAAC,CAAC;QAEH,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;IACvC,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,YAAoB,EAAE,QAAiB;QACnD,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,YAAY,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;QAC5E,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,CAAC,EAAE,IAAI,EAAE,sBAAsB,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,uBAAuB,EAAE,EAAE,CAAC,CAAC;YAC3F,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,uBAAuB,EAAE,OAAO,EAAE,6BAA6B,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QACzG,CAAC;QAED,MAAM,IAAI,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC;QACnD,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;IAC3C,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,YAAqB;QAChC,IAAI,YAAY,EAAE,CAAC;YACjB,MAAM,kBAAkB,CAAC,YAAY,CAAC,CAAC;QACzC,CAAC;QACD,OAAO,EAAE,CAAC,SAAS,CAAC,CAAC;IACvB,CAAC;IAED,KAAK,CAAC,wBAAwB,CAAC,KAAa;QAC1C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;QACjD,IAAI,CAAC,IAAI;YAAE,OAAO,EAAE,CAAC,IAAI,CAAC,CAAC;QAE3B,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QAC3D,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC1E,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,SAAS;QAElE,MAAM,EAAE,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC,MAAM,CAAC;YAC1C,MAAM,EAAE,IAAI,CAAC,EAAE;YACf,SAAS;YACT,SAAS;SACV,CAAC,CAAC;QAEH,MAAM,IAAI,CAAC,EAAE,IAAI,EAAE,0BAA0B,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QAC/E,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAC7B,CAAC;IAED,KAAK,CAAC,sBAAsB,CAAC,KAAa,EAAE,WAAmB;QAC7D,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC1E,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;QAEvB,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE;aACtB,MAAM,EAAE;aACR,IAAI,CAAC,mBAAmB,CAAC;aACzB,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,mBAAmB,CAAC,SAAS,EAAE,SAAS,CAAC,EAC5C,EAAE,CAAC,mBAAmB,CAAC,SAAS,EAAE,GAAG,CAAC,EACtC,MAAM,CAAC,mBAAmB,CAAC,MAAM,CAAC,CACnC,CACF;aACA,KAAK,CAAC,CAAC,CAAC,CAAC;QAEZ,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,iCAAiC,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QACrG,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACtD,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,iBAAiB,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QACtF,CAAC;QAED,IAAI,MAAM,CAAC,kBAAkB,EAAE,CAAC;YAC9B,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CAAC,WAAW,CAAC,CAAC;YACvD,IAAI,QAAQ,EAAE,CAAC;gBACb,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,8CAA8C,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;YACtH,CAAC;QACH,CAAC;QAED,MAAM,YAAY,GAAG,MAAM,YAAY,CAAC,WAAW,CAAC,CAAC;QACrD,MAAM,EAAE,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;YAChC,MAAM,EAAE;iBACL,MAAM,CAAC,mBAAmB,CAAC;iBAC3B,GAAG,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;iBACpB,KAAK,CAAC,EAAE,CAAC,mBAAmB,CAAC,EAAE,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;YAChD,MAAM,EAAE;iBACL,MAAM,CAAC,KAAK,CAAC;iBACb,GAAG,CAAC,EAAE,YAAY,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC;iBACrC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;QAClC,CAAC,CAAC,CAAC;QAEH,MAAM,IAAI,CAAC,EAAE,IAAI,EAAE,0BAA0B,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QAC/E,OAAO,EAAE,CAAC,IAAI,CAAC,CAAC;IAClB,CAAC;CACF"}
+{"version":3,"file":"authentication.js","sourceRoot":"","sources":["../../../src/services/domain/authentication.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,MAAM,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAC9D,OAAO,EAAE,EAAE,EAAE,MAAM,mBAAmB,CAAC;AACvC,OAAO,EAAE,KAAK,EAAE,mBAAmB,EAAa,MAAM,oBAAoB,CAAC;AAC3E,OAAO,EAAE,4BAA4B,EAAE,MAAM,iBAAiB,CAAC;AAC/D,OAAO,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAC;AACnE,OAAO,EAAE,eAAe,EAAE,cAAc,IAAI,qBAAqB,EAAE,MAAM,eAAe,CAAC;AACzF,OAAO,EAAE,cAAc,EAAE,kBAAkB,EAAE,kBAAkB,EAAoC,MAAM,cAAc,CAAC;AACxH,OAAO,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAChD,OAAO,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AACjF,OAAO,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAGxC,OAAO,EAAE,EAAE,EAAE,GAAG,EAAe,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAmDnE,MAAM,OAAO,2BAA2B;IAEnB,KAAK;IACL,YAAY;IACZ,aAAa;IACb,GAAG;IAJtB,YACmB,KAAqB,EACrB,YAAmC,EACnC,aAAqC,EACrC,GAAe;qBAHf,KAAK;4BACL,YAAY;6BACZ,aAAa;mBACb,GAAG;IACnB,CAAC;IAEI,KAAK,CAAC,cAAc,CAAC,MAAc,EAAE,QAAiB;QAC5D,IAAI,CAAC,QAAQ;YAAE,OAAO,EAAE,CAAC;QACzB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;QAC7D,IAAI,CAAC,GAAG;YAAE,OAAO,EAAE,CAAC;QAEpB,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,cAAc,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAC9E,OAAO;YACL,GAAG,EAAE,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;YACxF,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,GAAG,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAClD,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,KAAoB;QACjC,IAAI,MAAM,CAAC,kBAAkB,EAAE,CAAC;YAC9B,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;YAC1D,IAAI,QAAQ,EAAE,CAAC;gBACb,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,8CAA8C,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;YACtH,CAAC;QACH,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC3D,IAAI,QAAQ,EAAE,CAAC;YACb,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,4CAA4C,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QAC/G,CAAC;QAED,MAAM,YAAY,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACxD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,oBAAoB,CACpD,KAAK,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,eAAe,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CACvG,CAAC;QAEF,IAAI,aAAiC,CAAC;QACtC,IAAI,mBAAmB,EAAE,EAAE,CAAC;YAC1B,IAAI,CAAC;gBACH,aAAa,GAAG,MAAM,eAAe,CAAC;oBACpC,QAAQ,EAAE,KAAK,CAAC,QAAQ;oBACxB,KAAK,EAAE,KAAK,CAAC,KAAK;oBAClB,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,QAAQ;oBAClC,QAAQ,EAAE,KAAK,CAAC,QAAQ;iBACzB,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,CAAC,IAAI,CAAC,wDAAwD,EAAE,GAAG,CAAC,CAAC;YAC9E,CAAC;QACH,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC;YACnC,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,QAAQ;YACR,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,QAAQ;YAClC,YAAY;YACZ,QAAQ,EAAE,UAAU;YACpB,aAAa,EAAE,CAAC,MAAM,CAAC,2BAA2B;YAClD,aAAa;YACb,QAAQ,EAAE,KAAK,CAAC,QAAQ;SACzB,CAAC,CAAC;QAEH,IAAI,MAAM,CAAC,2BAA2B,EAAE,CAAC;YACvC,IAAI,CAAC;gBACH,MAAM,EAAE,qBAAqB,EAAE,GAAG,MAAM,MAAM,CAAC,yBAAyB,CAAC,CAAC;gBAC1E,qBAAqB,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;oBACjD,OAAO,CAAC,KAAK,CAAC,2CAA2C,EAAE,GAAG,CAAC,CAAC;gBAClE,CAAC,CAAC,CAAC;YACL,CAAC;YAAC,MAAM,CAAC;gBACP,sEAAsE;YACxE,CAAC;QACH,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;QACnE,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE;YAC9D,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS;YAChD,KAAK,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE;YACtB,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC,SAAS;SAC1D,CAAC,CAAC;QAEH,MAAM,IAAI,CAAC;YACT,IAAI,EAAE,iBAAiB;YACvB,OAAO,EAAE;gBACP,QAAQ,EAAE,UAAU;gBACpB,aAAa;gBACb,MAAM,EAAE,IAAI,CAAC,EAAE;gBACf,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,SAAS,EAAE,KAAK,CAAC,QAAQ;gBACzB,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS;gBAChD,KAAK,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE;aACvB;SACF,CAAC,CAAC;QAEH,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;IACvC,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,KAAiB;QAC3B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAEvD,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,IAAI,mBAAmB,EAAE,EAAE,CAAC;gBAC1B,MAAM,qBAAqB,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YAC3E,CAAC;YACD,MAAM,iBAAiB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YACrC,MAAM,IAAI,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,cAAc,EAAE,EAAE,CAAC,CAAC;YAC/E,IAAI,MAAM,oBAAoB,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC5C,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,mDAAmD,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;YAC3H,CAAC;YACD,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,qBAAqB,EAAE,OAAO,EAAE,4BAA4B,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QACtG,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACnB,MAAM,IAAI,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,qBAAqB,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;YACvG,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,qBAAqB,EAAE,OAAO,EAAE,6BAA6B,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QACvG,CAAC;QAED,IAAI,IAAI,CAAC,qBAAqB,EAAE,CAAC;YAC/B,MAAM,IAAI,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,yBAAyB,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;YAC3G,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,yBAAyB,EAAE,OAAO,EAAE,iCAAiC,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QAC/G,CAAC;QAED,IAAI,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,WAAW,GAAG,IAAI,IAAI,EAAE,EAAE,CAAC;YACtD,MAAM,IAAI,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;YAClG,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,iFAAiF,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QACtJ,CAAC;QAED,IAAI,KAAK,GAAG,KAAK,CAAC;QAClB,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACtB,KAAK,GAAG,MAAM,cAAc,CAAC,KAAK,CAAC,QAAQ,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;QAClE,CAAC;aAAM,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS,IAAI,mBAAmB,EAAE,EAAE,CAAC;YAChE,KAAK,GAAG,MAAM,qBAAqB,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;QACnE,CAAC;QAED,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAC5D,MAAM,IAAI,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;YAEpG,MAAM,QAAQ,GAAG,OAAO,EAAE,mBAAmB,IAAI,CAAC,CAAC;YACnD,IAAI,QAAQ,IAAI,MAAM,CAAC,yBAAyB,EAAE,CAAC;gBACjD,MAAM,WAAW,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,gCAAgC,GAAG,IAAI,CAAC,CAAC;gBAC1F,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,EAAE,WAAW,CAAC,CAAC;gBACnD,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,kEAAkE,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;YACvI,CAAC;YAED,IAAI,MAAM,oBAAoB,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;gBACxC,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,mDAAmD,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;YAC3H,CAAC;YACD,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,qBAAqB,EAAE,OAAO,EAAE,4BAA4B,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QACtG,CAAC;QAED,MAAM,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC5C,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;QAEnE,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACrB,0EAA0E;YAC1E,yEAAyE;YACzE,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,OAAO,EAAE,KAAK,CAAC,QAAQ,EAAE;gBAC5F,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,SAAS,EAAE,KAAK,CAAC,SAAS;aAC3B,CAAC,CAAC;YACH,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,cAAc,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC;QAClE,CAAC;QAED,MAAM,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACzC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;QAEvF,MAAM,IAAI,CAAC;YACT,IAAI,EAAE,YAAY;YAClB,OAAO,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,EAAE,KAAK,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE,EAAE;SAChI,CAAC,CAAC;QAEH,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,eAAe,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;IAChE,CAAC;IAEO,KAAK,CAAC,WAAW,CACvB,IAAU,EACV,OAAoB,EACpB,SAAkB,EAClB,SAAkB,EAClB,SAAwB;QAExB,OAAO,cAAc,CACnB,IAAI,EACJ,SAAS,EACT,SAAS,EACT;YACE,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS;YAChD,KAAK,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE;YACtB,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC,SAAS;YACzD,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACpC,CACF,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,WAAW,CACf,cAAsB,EACtB,IAAY,EACZ,MAAiB,EACjB,SAAkB,EAClB,SAAkB;QAElB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,eAAe,CAAC,cAAc,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;QAC7G,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,OAAO,MAAM,CAAC;QAEnC,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC;QAC7C,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;QAE7D,IAAI,MAAgB,CAAC;QACrB,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;QAC/E,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,CAAC,EAAE,IAAI,EAAE,oBAAoB,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;YAC/E,OAAO,GAAG,CAAC;gBACT,IAAI,EAAE,cAAc;gBACpB,OAAO,EAAE,qDAAqD;gBAC9D,UAAU,EAAE,GAAG;aAChB,CAAC,CAAC;QACL,CAAC;QAED,MAAM,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACzC,MAAM,IAAI,CAAC;YACT,IAAI,EAAE,YAAY;YAClB,OAAO,EAAE;gBACP,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,MAAM,EAAE,IAAI,CAAC,EAAE;gBACf,GAAG,EAAE,MAAM;gBACX,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS;gBAChD,KAAK,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE;aACvB;SACF,CAAC,CAAC;QAEH,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC/D,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,YAAoB,EAAE,QAAiB;QACnD,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,YAAY,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC;QACtF,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,CAAC,EAAE,IAAI,EAAE,sBAAsB,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,uBAAuB,EAAE,EAAE,CAAC,CAAC;YAC3F,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,uBAAuB,EAAE,OAAO,EAAE,6BAA6B,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QACzG,CAAC;QAED,MAAM,IAAI,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAC1E,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;IAC/C,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,YAAqB;QAChC,IAAI,YAAY,EAAE,CAAC;YACjB,MAAM,kBAAkB,CAAC,YAAY,CAAC,CAAC;QACzC,CAAC;QACD,OAAO,EAAE,CAAC,SAAS,CAAC,CAAC;IACvB,CAAC;IAED,KAAK,CAAC,wBAAwB,CAAC,KAAa;QAC1C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;QACjD,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ;YAAE,OAAO,EAAE,CAAC,IAAI,CAAC,CAAC;QAE7C,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QAC3D,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC1E,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,SAAS;QAElE,MAAM,EAAE,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC,MAAM,CAAC;YAC1C,MAAM,EAAE,IAAI,CAAC,EAAE;YACf,SAAS;YACT,SAAS;SACV,CAAC,CAAC;QAEH,MAAM,IAAI,CAAC,EAAE,IAAI,EAAE,0BAA0B,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QAC/E,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAC7B,CAAC;IAED,KAAK,CAAC,sBAAsB,CAAC,KAAa,EAAE,WAAmB;QAC7D,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC1E,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;QAEvB,6EAA6E;QAC7E,0EAA0E;QAC1E,yEAAyE;QACzE,kCAAkC;QAClC,MAAM,KAAK,GAAG,MAAM,4BAA4B,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;QACjE,IAAI,KAAK,CAAC,OAAO,KAAK,UAAU,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;YAClD,IAAI,KAAK,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;gBAChC,MAAM,IAAI,CAAC,EAAE,IAAI,EAAE,+BAA+B,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC;YACrE,CAAC;YACD,OAAO,GAAG,CAAC;gBACT,IAAI,EAAE,eAAe;gBACrB,OAAO,EAAE,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,8BAA8B,CAAC,CAAC,CAAC,iCAAiC;gBACxG,UAAU,EAAE,GAAG;aAChB,CAAC,CAAC;QACL,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC5D,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,CAAC;YACpB,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,qBAAqB,EAAE,OAAO,EAAE,8BAA8B,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QACxG,CAAC;QAED,IAAI,MAAM,CAAC,kBAAkB,EAAE,CAAC;YAC9B,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CAAC,WAAW,CAAC,CAAC;YACvD,IAAI,QAAQ,EAAE,CAAC;gBACb,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,8CAA8C,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;YACtH,CAAC;QACH,CAAC;QAED,MAAM,YAAY,GAAG,MAAM,YAAY,CAAC,WAAW,CAAC,CAAC;QACrD,MAAM,EAAE;aACL,MAAM,CAAC,KAAK,CAAC;aACb,GAAG,CAAC,EAAE,YAAY,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC;aACrC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;QAEhC,2EAA2E;QAC3E,yEAAyE;QACzE,wEAAwE;QACxE,wEAAwE;QACxE,uEAAuE;QACvE,MAAM,OAAO,GAAG,MAAM,wBAAwB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAExD,MAAM,IAAI,CAAC;YACT,IAAI,EAAE,0BAA0B;YAChC,OAAO,EAAE;gBACP,MAAM,EAAE,IAAI,CAAC,EAAE;gBACf,eAAe,EAAE,OAAO,CAAC,QAAQ;gBACjC,oBAAoB,EAAE,OAAO,CAAC,aAAa;gBAC3C,0BAA0B,EAAE,OAAO,CAAC,mBAAmB;aACxD;SACF,CAAC,CAAC;QACH,OAAO,EAAE,CAAC,IAAI,CAAC,CAAC;IAClB,CAAC;CACF"}

package/dist/services/domain/authorization.d.ts

@@ -6,7 +6,16 @@ export interface PermissionInput {
     action: string;
 }
 export { type PermissionInput as PermissionRequirement };
+export type PlatformRole = "owner" | "user";
 export type OrgRole = "owner" | "admin" | "member";
+export declare function isPlatformRole(role: string): role is PlatformRole;
+export declare function isOrganizationRole(role: string): role is OrgRole;
+/**
+ * Organization admins may manage members and other admins, but only an
+ * organization owner may grant or modify the owner role.
+ */
+export declare function canManageOrganizationRole(actorRole: OrgRole, targetRole: OrgRole, nextRole: OrgRole): boolean;
+export declare function canManagePlatformRole(actorRole: string, nextRole: PlatformRole): boolean;
 export declare class AuthorizationDomainService {
     private readonly organizations;
     private readonly permissions;
@@ -14,6 +23,8 @@ export declare class AuthorizationDomainService {
     requirePermission(role: string, resource: string, action: string): Promise<Result<void>>;
     hasPermission(role: string, resource: string, action: string): Promise<boolean>;
     hasAnyPermission(role: string, required: PermissionInput[]): Promise<boolean>;
+    requireOrganizationPermission(userId: string, orgId: string, allowedRoles: OrgRole[], resource: string, action: string): Promise<Result<OrgMembership>>;
+    hasOrganizationPermission(userId: string, orgId: string, resource: string, action: string): Promise<boolean>;
     requireOrgRole(userId: string, orgId: string, allowedRoles: OrgRole[]): Promise<Result<OrgMembership>>;
     isOrgMember(userId: string, orgId: string): Promise<OrgMembership | undefined>;
 }

package/dist/services/domain/authorization.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"authorization.d.ts","sourceRoot":"","sources":["../../../src/services/domain/authorization.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,KAAK,EAAE,sBAAsB,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AAChG,OAAO,EAAW,KAAK,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAE3D,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,OAAO,EAAE,KAAK,eAAe,IAAI,qBAAqB,EAAE,CAAC;AACzD,MAAM,MAAM,OAAO,GAAG,OAAO,GAAG,OAAO,GAAG,QAAQ,CAAC;AAEnD,qBAAa,0BAA0B;IAEnC,OAAO,CAAC,QAAQ,CAAC,aAAa;IAC9B,OAAO,CAAC,QAAQ,CAAC,WAAW;gBADX,aAAa,EAAE,sBAAsB,EACrC,WAAW,EAAE,oBAAoB;IAG9C,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAQxF,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAI/E,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,eAAe,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC;IAI7E,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;IAWtG,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,SAAS,CAAC;CAGrF"}
+{"version":3,"file":"authorization.d.ts","sourceRoot":"","sources":["../../../src/services/domain/authorization.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,KAAK,EAAE,sBAAsB,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AAChG,OAAO,EAAW,KAAK,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAE3D,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,OAAO,EAAE,KAAK,eAAe,IAAI,qBAAqB,EAAE,CAAC;AACzD,MAAM,MAAM,YAAY,GAAG,OAAO,GAAG,MAAM,CAAC;AAC5C,MAAM,MAAM,OAAO,GAAG,OAAO,GAAG,OAAO,GAAG,QAAQ,CAAC;AAEnD,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,IAAI,YAAY,CAEjE;AAED,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,IAAI,OAAO,CAEhE;AAED;;;GAGG;AACH,wBAAgB,yBAAyB,CACvC,SAAS,EAAE,OAAO,EAClB,UAAU,EAAE,OAAO,EACnB,QAAQ,EAAE,OAAO,GAChB,OAAO,CAIT;AAED,wBAAgB,qBAAqB,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,YAAY,GAAG,OAAO,CAExF;AAED,qBAAa,0BAA0B;IAEnC,OAAO,CAAC,QAAQ,CAAC,aAAa;IAC9B,OAAO,CAAC,QAAQ,CAAC,WAAW;IAF9B,YACmB,aAAa,EAAE,sBAAsB,EACrC,WAAW,EAAE,oBAAoB,EAChD;IAEE,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAM7F;IAEK,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAEpF;IAEK,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,eAAe,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAElF;IAEK,6BAA6B,CACjC,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,EACb,YAAY,EAAE,OAAO,EAAE,EACvB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAMhC;IAEK,yBAAyB,CAC7B,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,OAAO,CAAC,CAIlB;IAEK,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAS3G;IAEK,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,SAAS,CAAC,CAEnF;CACF"}

package/dist/services/domain/authorization.js

@@ -1,4 +1,24 @@
 import { ok, err } from "../../lib/result.js";
+export function isPlatformRole(role) {
+    return role === "owner" || role === "user";
+}
+export function isOrganizationRole(role) {
+    return role === "owner" || role === "admin" || role === "member";
+}
+/**
+ * Organization admins may manage members and other admins, but only an
+ * organization owner may grant or modify the owner role.
+ */
+export function canManageOrganizationRole(actorRole, targetRole, nextRole) {
+    if (actorRole === "owner")
+        return true;
+    if (actorRole !== "admin")
+        return false;
+    return targetRole !== "owner" && nextRole !== "owner";
+}
+export function canManagePlatformRole(actorRole, nextRole) {
+    return actorRole === "owner" && isPlatformRole(nextRole);
+}
 export class AuthorizationDomainService {
     organizations;
     permissions;
@@ -19,12 +39,27 @@ export class AuthorizationDomainService {
     async hasAnyPermission(role, required) {
         return this.permissions.hasAnyPermission(role, required);
     }
+    async requireOrganizationPermission(userId, orgId, allowedRoles, resource, action) {
+        const roleResult = await this.requireOrgRole(userId, orgId, allowedRoles);
+        if (!roleResult.success)
+            return roleResult;
+        const permissionResult = await this.requirePermission(roleResult.data.role, resource, action);
+        if (!permissionResult.success)
+            return permissionResult;
+        return roleResult;
+    }
+    async hasOrganizationPermission(userId, orgId, resource, action) {
+        const membership = await this.requireOrgRole(userId, orgId, ["owner", "admin", "member"]);
+        if (!membership.success)
+            return false;
+        return this.permissions.hasPermission(membership.data.role, resource, action);
+    }
     async requireOrgRole(userId, orgId, allowedRoles) {
         const membership = await this.organizations.findMembership(orgId, userId);
         if (!membership) {
             return err({ code: "NOT_MEMBER", message: "Not a member of this organization", statusCode: 403 });
         }
-        if (!allowedRoles.includes(membership.role)) {
+        if (!isOrganizationRole(membership.role) || !allowedRoles.includes(membership.role)) {
             return err({ code: "INSUFFICIENT_ROLE", message: "Insufficient organization permissions", statusCode: 403 });
         }
         return ok(membership);

package/dist/services/domain/authorization.js.map

@@ -1 +1 @@
-{"version":3,"file":"authorization.js","sourceRoot":"","sources":["../../../src/services/domain/authorization.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,EAAE,EAAE,GAAG,EAAe,MAAM,qBAAqB,CAAC;AAU3D,MAAM,OAAO,0BAA0B;IAElB;IACA;IAFnB,YACmB,aAAqC,EACrC,WAAiC;QADjC,kBAAa,GAAb,aAAa,CAAwB;QACrC,gBAAW,GAAX,WAAW,CAAsB;IACjD,CAAC;IAEJ,KAAK,CAAC,iBAAiB,CAAC,IAAY,EAAE,QAAgB,EAAE,MAAc;QACpE,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,aAAa,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;QAC7E,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,sBAAsB,QAAQ,IAAI,MAAM,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QAC1G,CAAC;QACD,OAAO,EAAE,CAAC,SAAS,CAAC,CAAC;IACvB,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,IAAY,EAAE,QAAgB,EAAE,MAAc;QAChE,OAAO,IAAI,CAAC,WAAW,CAAC,aAAa,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;IAChE,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,IAAY,EAAE,QAA2B;QAC9D,OAAO,IAAI,CAAC,WAAW,CAAC,gBAAgB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAC3D,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,MAAc,EAAE,KAAa,EAAE,YAAuB;QACzE,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,cAAc,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAC1E,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,mCAAmC,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QACpG,CAAC;QACD,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAe,CAAC,EAAE,CAAC;YACvD,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,uCAAuC,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QAC/G,CAAC;QACD,OAAO,EAAE,CAAC,UAAU,CAAC,CAAC;IACxB,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,MAAc,EAAE,KAAa;QAC7C,OAAO,IAAI,CAAC,aAAa,CAAC,cAAc,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAC1D,CAAC;CACF"}
+{"version":3,"file":"authorization.js","sourceRoot":"","sources":["../../../src/services/domain/authorization.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,EAAE,EAAE,GAAG,EAAe,MAAM,qBAAqB,CAAC;AAW3D,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,OAAO,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,MAAM,CAAC;AAC7C,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,IAAY;IAC7C,OAAO,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,QAAQ,CAAC;AACnE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,yBAAyB,CACvC,SAAkB,EAClB,UAAmB,EACnB,QAAiB;IAEjB,IAAI,SAAS,KAAK,OAAO;QAAE,OAAO,IAAI,CAAC;IACvC,IAAI,SAAS,KAAK,OAAO;QAAE,OAAO,KAAK,CAAC;IACxC,OAAO,UAAU,KAAK,OAAO,IAAI,QAAQ,KAAK,OAAO,CAAC;AACxD,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,SAAiB,EAAE,QAAsB;IAC7E,OAAO,SAAS,KAAK,OAAO,IAAI,cAAc,CAAC,QAAQ,CAAC,CAAC;AAC3D,CAAC;AAED,MAAM,OAAO,0BAA0B;IAElB,aAAa;IACb,WAAW;IAF9B,YACmB,aAAqC,EACrC,WAAiC;6BADjC,aAAa;2BACb,WAAW;IAC3B,CAAC;IAEJ,KAAK,CAAC,iBAAiB,CAAC,IAAY,EAAE,QAAgB,EAAE,MAAc;QACpE,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,aAAa,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;QAC7E,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,sBAAsB,QAAQ,IAAI,MAAM,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QAC1G,CAAC;QACD,OAAO,EAAE,CAAC,SAAS,CAAC,CAAC;IACvB,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,IAAY,EAAE,QAAgB,EAAE,MAAc;QAChE,OAAO,IAAI,CAAC,WAAW,CAAC,aAAa,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;IAChE,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,IAAY,EAAE,QAA2B;QAC9D,OAAO,IAAI,CAAC,WAAW,CAAC,gBAAgB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAC3D,CAAC;IAED,KAAK,CAAC,6BAA6B,CACjC,MAAc,EACd,KAAa,EACb,YAAuB,EACvB,QAAgB,EAChB,MAAc;QAEd,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,MAAM,EAAE,KAAK,EAAE,YAAY,CAAC,CAAC;QAC1E,IAAI,CAAC,UAAU,CAAC,OAAO;YAAE,OAAO,UAAU,CAAC;QAC3C,MAAM,gBAAgB,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;QAC9F,IAAI,CAAC,gBAAgB,CAAC,OAAO;YAAE,OAAO,gBAAgB,CAAC;QACvD,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,KAAK,CAAC,yBAAyB,CAC7B,MAAc,EACd,KAAa,EACb,QAAgB,EAChB,MAAc;QAEd,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;QAC1F,IAAI,CAAC,UAAU,CAAC,OAAO;YAAE,OAAO,KAAK,CAAC;QACtC,OAAO,IAAI,CAAC,WAAW,CAAC,aAAa,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;IAChF,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,MAAc,EAAE,KAAa,EAAE,YAAuB;QACzE,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,cAAc,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAC1E,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,mCAAmC,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QACpG,CAAC;QACD,IAAI,CAAC,kBAAkB,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACpF,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,uCAAuC,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QAC/G,CAAC;QACD,OAAO,EAAE,CAAC,UAAU,CAAC,CAAC;IACxB,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,MAAc,EAAE,KAAa;QAC7C,OAAO,IAAI,CAAC,aAAa,CAAC,cAAc,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAC1D,CAAC;CACF"}

package/dist/services/domain/identity.d.ts

@@ -1,11 +1,16 @@
 import type { User } from "../../db/schema.js";
-import type { UserRepository, IdentityRepository } from "../../repositories/types.js";
+import { type UserRepository, type IdentityRepository } from "../../repositories/types.js";
 import type { TokenSet } from "../tokens.js";
+import { type MfaAssertion } from "../tokens.js";
+import { type FederationApplicationContext } from "../federation.js";
 import { type Result } from "../../lib/result.js";
+import { type PlatformRole } from "./authorization.js";
+import type { EventContext } from "../events/types.js";
 export declare class IdentityDomainService {
     private readonly users;
     private readonly identities;
     constructor(users: UserRepository, identities: IdentityRepository);
+    private auditDenied;
     findUser(id: string): Promise<Result<User>>;
     findUserByEmail(email: string): Promise<Result<User>>;
     upsertInvitedUser(input: {
@@ -13,27 +18,34 @@ export declare class IdentityDomainService {
         name?: string;
         username?: string;
     }): Promise<Result<User>>;
-    updateUserProfile(userId: string, updates: Partial<{
+    updateUserProfile(actorId: string, userId: string, updates: Partial<{
         name: string;
         username: string;
-        role: string;
         emailVerified: boolean;
-    }>): Promise<Result<User>>;
-    deactivate(userId: string): Promise<Result<void>>;
-    listOrganizationUsers(orgId: string): Promise<User[]>;
+    }>, context?: EventContext): Promise<Result<User>>;
+    updatePlatformRole(actorId: string, targetUserId: string, role: PlatformRole, context?: EventContext): Promise<Result<User>>;
+    deactivate(actorId: string, targetUserId: string, context?: EventContext): Promise<Result<void>>;
+    reviewAccount(actorId: string, targetUserId: string, active: boolean, context?: EventContext): Promise<Result<User>>;
     touchLastSeen(userId: string): Promise<void>;
-    linkUserIdentity(userId: string, providerId: string, providerType: string, externalSub: string, email?: string): Promise<Result<void>>;
+    linkUserIdentity(actorId: string, userId: string, providerId: string, providerType: string, externalSub: string, email?: string): Promise<Result<void>>;
     getFederationAuthorizeUrl(provider: string, state: string, redirectUri: string): Promise<Result<{
         url: string;
     }>>;
-    completeFederationLogin(provider: string, code: string, redirectUri: string): Promise<Result<{
+    completeFederationLogin(provider: string, code: string, redirectUri: string, application?: FederationApplicationContext): Promise<Result<{
         user: User;
         tokens: {
             accessToken: string;
             refreshToken: string;
         };
     }>>;
-    issueLocalTokenSet(user: User, opts?: {
+    /**
+     * Issue a local token set on behalf of an already-verified factor.
+     *
+     * `mfaFactor` is required rather than optional: without it the token
+     * chokepoint rejects MFA-enabled users, and an omitted argument silently
+     * reintroduces the bypass this parameter exists to prevent.
+     */
+    issueLocalTokenSet(user: User, mfaFactor: MfaAssertion, opts?: {
         appId?: string;
         orgId?: string;
         clientId?: string;

package/dist/services/domain/identity.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"identity.d.ts","sourceRoot":"","sources":["../../../src/services/domain/identity.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,KAAK,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AACtF,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAI7C,OAAO,EAAW,KAAK,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAE3D,qBAAa,qBAAqB;IAE9B,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,UAAU;gBADV,KAAK,EAAE,cAAc,EACrB,UAAU,EAAE,kBAAkB;IAG3C,QAAQ,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAM3C,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAMrD,iBAAiB,CAAC,KAAK,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAmBpG,iBAAiB,CACrB,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,OAAO,CAAA;KAAE,CAAC,GACzF,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAMlB,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAKjD,qBAAqB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;IAIrD,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAI5C,gBAAgB,CACpB,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,MAAM,EAClB,YAAY,EAAE,MAAM,EACpB,WAAW,EAAE,MAAM,EACnB,KAAK,CAAC,EAAE,MAAM,GACb,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAKlB,yBAAyB,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAKjH,uBAAuB,CAC3B,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,MAAM,CAAC;QAAE,IAAI,EAAE,IAAI,CAAC;QAAC,MAAM,EAAE;YAAE,WAAW,EAAE,MAAM,CAAC;YAAC,YAAY,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE,CAAC,CAAC;IASnF,kBAAkB,CACtB,IAAI,EAAE,IAAI,EACV,IAAI,CAAC,EAAE;QACL,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,iBAAiB,CAAC,EAAE,MAAM,CAAC;KAC5B,GACA,OAAO,CAAC,QAAQ,CAAC;CAGrB"}
+{"version":3,"file":"identity.d.ts","sourceRoot":"","sources":["../../../src/services/domain/identity.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAA2B,KAAK,cAAc,EAAE,KAAK,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AACpH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EAAkB,KAAK,YAAY,EAAE,MAAM,cAAc,CAAC;AAEjE,OAAO,EAA4H,KAAK,4BAA4B,EAAE,MAAM,kBAAkB,CAAC;AAC/L,OAAO,EAAW,KAAK,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAyC,KAAK,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAC9F,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAEvD,qBAAa,qBAAqB;IAE9B,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,UAAU;IAF7B,YACmB,KAAK,EAAE,cAAc,EACrB,UAAU,EAAE,kBAAkB,EAC7C;YAEU,WAAW;IAanB,QAAQ,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAIhD;IAEK,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAI1D;IAEK,iBAAiB,CAAC,KAAK,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAiBzG;IAEK,iBAAiB,CACrB,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,OAAO,CAAA;KAAE,CAAC,EAC5E,OAAO,CAAC,EAAE,YAAY,GACrB,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAqBvB;IAEK,kBAAkB,CACtB,OAAO,EAAE,MAAM,EACf,YAAY,EAAE,MAAM,EACpB,IAAI,EAAE,YAAY,EAClB,OAAO,CAAC,EAAE,YAAY,GACrB,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CA4CvB;IAEK,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAkCrG;IAEK,aAAa,CACjB,OAAO,EAAE,MAAM,EACf,YAAY,EAAE,MAAM,EACpB,MAAM,EAAE,OAAO,EACf,OAAO,CAAC,EAAE,YAAY,GACrB,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAmDvB;IAEK,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAEjD;IAEK,gBAAgB,CACpB,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,MAAM,EAClB,YAAY,EAAE,MAAM,EACpB,WAAW,EAAE,MAAM,EACnB,KAAK,CAAC,EAAE,MAAM,GACb,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CASvB;IAEK,yBAAyB,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC,CAGtH;IAEK,uBAAuB,CAC3B,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,MAAM,EACnB,WAAW,CAAC,EAAE,4BAA4B,GACzC,OAAO,CAAC,MAAM,CAAC;QAAE,IAAI,EAAE,IAAI,CAAC;QAAC,MAAM,EAAE;YAAE,WAAW,EAAE,MAAM,CAAC;YAAC,YAAY,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE,CAAC,CAAC,CAOxF;IAED;;;;;;OAMG;IACG,kBAAkB,CACtB,IAAI,EAAE,IAAI,EACV,SAAS,EAAE,YAAY,EACvB,IAAI,CAAC,EAAE;QACL,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,iBAAiB,CAAC,EAAE,MAAM,CAAC;KAC5B,GACA,OAAO,CAAC,QAAQ,CAAC,CAQnB;CACF"}