@igoruehara/canvas-flow 0.1.0

package/server/auth/auth-organization-schema.js

@@ -0,0 +1,62 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CanvasFlowOrganizationEntity = exports.OrganizationEntitySchema = void 0;
+const mongoose_1 = require("@nestjs/mongoose");
+const mongoose = require("mongoose");
+const mongoose_2 = require("mongoose");
+const auth_constants_model_1 = require("./auth-constants-model");
+exports.OrganizationEntitySchema = new mongoose.Schema({
+    organizationId: { type: String, required: true, unique: true, index: true },
+    name: { type: String, required: true },
+    slug: { type: String, required: true, lowercase: true, trim: true },
+    active: { type: Boolean, default: true, index: true },
+    ownerUserId: { type: String },
+    createdByEmail: { type: String, lowercase: true, trim: true },
+}, {
+    collection: auth_constants_model_1.ORGANIZATION_COLLECTION_NAME,
+    timestamps: true,
+});
+exports.OrganizationEntitySchema.index({ slug: 1 }, { unique: true });
+let CanvasFlowOrganizationEntity = class CanvasFlowOrganizationEntity extends mongoose_2.Document {
+};
+exports.CanvasFlowOrganizationEntity = CanvasFlowOrganizationEntity;
+__decorate([
+    (0, mongoose_1.Prop)({ required: true }),
+    __metadata("design:type", String)
+], CanvasFlowOrganizationEntity.prototype, "organizationId", void 0);
+__decorate([
+    (0, mongoose_1.Prop)({ required: true }),
+    __metadata("design:type", String)
+], CanvasFlowOrganizationEntity.prototype, "name", void 0);
+__decorate([
+    (0, mongoose_1.Prop)({ required: true }),
+    __metadata("design:type", String)
+], CanvasFlowOrganizationEntity.prototype, "slug", void 0);
+__decorate([
+    (0, mongoose_1.Prop)({ default: true }),
+    __metadata("design:type", Boolean)
+], CanvasFlowOrganizationEntity.prototype, "active", void 0);
+__decorate([
+    (0, mongoose_1.Prop)(),
+    __metadata("design:type", String)
+], CanvasFlowOrganizationEntity.prototype, "ownerUserId", void 0);
+__decorate([
+    (0, mongoose_1.Prop)(),
+    __metadata("design:type", String)
+], CanvasFlowOrganizationEntity.prototype, "createdByEmail", void 0);
+exports.CanvasFlowOrganizationEntity = CanvasFlowOrganizationEntity = __decorate([
+    (0, mongoose_1.Schema)({
+        collection: auth_constants_model_1.ORGANIZATION_COLLECTION_NAME,
+        timestamps: true,
+    })
+], CanvasFlowOrganizationEntity);
+//# sourceMappingURL=auth-organization-schema.js.map

package/server/auth/auth-organization-schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-organization-schema.js","sourceRoot":"","sources":["../../src/auth/auth-organization-schema.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,+CAAgD;AAChD,qCAAqC;AACrC,uCAAoC;AACpC,iEAAsE;AAEzD,QAAA,wBAAwB,GAAG,IAAI,QAAQ,CAAC,MAAM,CACzD;IACE,cAAc,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE;IAC3E,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE;IACtC,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE;IACnE,MAAM,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE;IACrD,WAAW,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE;IAC7B,cAAc,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE;CAC9D,EACD;IACE,UAAU,EAAE,mDAA4B;IACxC,UAAU,EAAE,IAAI;CACjB,CACF,CAAC;AAEF,gCAAwB,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;AAMvD,IAAM,4BAA4B,GAAlC,MAAM,4BAA6B,SAAQ,mBAAQ;CAqBzD,CAAA;AArBY,oEAA4B;AAEvC;IADC,IAAA,eAAI,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;oEACF;AAGvB;IADC,IAAA,eAAI,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;0DACZ;AAGb;IADC,IAAA,eAAI,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;0DACZ;AAGb;IADC,IAAA,eAAI,EAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;;4DACR;AAGhB;IADC,IAAA,eAAI,GAAE;;iEACc;AAGrB;IADC,IAAA,eAAI,GAAE;;oEACiB;uCAjBb,4BAA4B;IAJxC,IAAA,iBAAM,EAAC;QACN,UAAU,EAAE,mDAA4B;QACxC,UAAU,EAAE,IAAI;KACjB,CAAC;GACW,4BAA4B,CAqBxC"}

package/server/auth/auth-schema.d.ts

@@ -0,0 +1,56 @@
+import * as mongoose from 'mongoose';
+import { Document } from 'mongoose';
+export declare const EntitySchema: mongoose.Schema<any, mongoose.Model<any, any, any, any, any, any>, {}, {}, {}, {}, {
+    collection: string;
+    timestamps: true;
+}, {
+    organizationId: string;
+    name: string;
+    active: boolean;
+    organizationName: string;
+    organizationSlug: string;
+    email: string;
+    passwordHash: string;
+    role: "owner" | "admin" | "member";
+    lastLoginAt?: NativeDate;
+} & mongoose.DefaultTimestampProps, mongoose.Document<unknown, {}, mongoose.FlatRecord<{
+    organizationId: string;
+    name: string;
+    active: boolean;
+    organizationName: string;
+    organizationSlug: string;
+    email: string;
+    passwordHash: string;
+    role: "owner" | "admin" | "member";
+    lastLoginAt?: NativeDate;
+} & mongoose.DefaultTimestampProps>, {}, mongoose.MergeType<mongoose.DefaultSchemaOptions, {
+    collection: string;
+    timestamps: true;
+}>> & mongoose.FlatRecord<{
+    organizationId: string;
+    name: string;
+    active: boolean;
+    organizationName: string;
+    organizationSlug: string;
+    email: string;
+    passwordHash: string;
+    role: "owner" | "admin" | "member";
+    lastLoginAt?: NativeDate;
+} & mongoose.DefaultTimestampProps> & {
+    _id: mongoose.Types.ObjectId;
+} & {
+    __v: number;
+}>;
+export declare class CanvasFlowUserEntity extends Document {
+    organizationId: string;
+    organizationName: string;
+    organizationSlug: string;
+    email: string;
+    name: string;
+    passwordHash: string;
+    role: 'owner' | 'admin' | 'member';
+    active: boolean;
+    lastLoginAt?: Date;
+    createdAt: Date;
+    updatedAt: Date;
+}

package/server/auth/auth-schema.js

@@ -0,0 +1,77 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CanvasFlowUserEntity = exports.EntitySchema = void 0;
+const mongoose_1 = require("@nestjs/mongoose");
+const mongoose = require("mongoose");
+const mongoose_2 = require("mongoose");
+const auth_constants_model_1 = require("./auth-constants-model");
+exports.EntitySchema = new mongoose.Schema({
+    organizationId: { type: String, required: true, index: true },
+    organizationName: { type: String, required: true },
+    organizationSlug: { type: String, required: true, index: true },
+    email: { type: String, required: true, lowercase: true, trim: true },
+    name: { type: String, required: true },
+    passwordHash: { type: String, required: true, select: false },
+    role: { type: String, enum: ['owner', 'admin', 'member'], default: 'member' },
+    active: { type: Boolean, default: true, index: true },
+    lastLoginAt: Date,
+}, {
+    collection: auth_constants_model_1.COLLECTION_NAME,
+    timestamps: true,
+});
+exports.EntitySchema.index({ organizationSlug: 1, email: 1 }, { unique: true });
+let CanvasFlowUserEntity = class CanvasFlowUserEntity extends mongoose_2.Document {
+};
+exports.CanvasFlowUserEntity = CanvasFlowUserEntity;
+__decorate([
+    (0, mongoose_1.Prop)({ required: true }),
+    __metadata("design:type", String)
+], CanvasFlowUserEntity.prototype, "organizationId", void 0);
+__decorate([
+    (0, mongoose_1.Prop)({ required: true }),
+    __metadata("design:type", String)
+], CanvasFlowUserEntity.prototype, "organizationName", void 0);
+__decorate([
+    (0, mongoose_1.Prop)({ required: true }),
+    __metadata("design:type", String)
+], CanvasFlowUserEntity.prototype, "organizationSlug", void 0);
+__decorate([
+    (0, mongoose_1.Prop)({ required: true }),
+    __metadata("design:type", String)
+], CanvasFlowUserEntity.prototype, "email", void 0);
+__decorate([
+    (0, mongoose_1.Prop)({ required: true }),
+    __metadata("design:type", String)
+], CanvasFlowUserEntity.prototype, "name", void 0);
+__decorate([
+    (0, mongoose_1.Prop)({ required: true, select: false }),
+    __metadata("design:type", String)
+], CanvasFlowUserEntity.prototype, "passwordHash", void 0);
+__decorate([
+    (0, mongoose_1.Prop)({ default: 'member' }),
+    __metadata("design:type", String)
+], CanvasFlowUserEntity.prototype, "role", void 0);
+__decorate([
+    (0, mongoose_1.Prop)({ default: true }),
+    __metadata("design:type", Boolean)
+], CanvasFlowUserEntity.prototype, "active", void 0);
+__decorate([
+    (0, mongoose_1.Prop)(),
+    __metadata("design:type", Date)
+], CanvasFlowUserEntity.prototype, "lastLoginAt", void 0);
+exports.CanvasFlowUserEntity = CanvasFlowUserEntity = __decorate([
+    (0, mongoose_1.Schema)({
+        collection: auth_constants_model_1.COLLECTION_NAME,
+        timestamps: true,
+    })
+], CanvasFlowUserEntity);
+//# sourceMappingURL=auth-schema.js.map

package/server/auth/auth-schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-schema.js","sourceRoot":"","sources":["../../src/auth/auth-schema.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,+CAAgD;AAChD,qCAAqC;AACrC,uCAAoC;AACpC,iEAAyD;AAE5C,QAAA,YAAY,GAAG,IAAI,QAAQ,CAAC,MAAM,CAC7C;IACE,cAAc,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE;IAC7D,gBAAgB,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE;IAClD,gBAAgB,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE;IAC/D,KAAK,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE;IACpE,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE;IACtC,YAAY,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE;IAC7D,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE;IAC7E,MAAM,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE;IACrD,WAAW,EAAE,IAAI;CAClB,EACD;IACE,UAAU,EAAE,sCAAe;IAC3B,UAAU,EAAE,IAAI;CACjB,CACF,CAAC;AAEF,oBAAY,CAAC,KAAK,CAAC,EAAE,gBAAgB,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;AAMjE,IAAM,oBAAoB,GAA1B,MAAM,oBAAqB,SAAQ,mBAAQ;CA8BjD,CAAA;AA9BY,oDAAoB;AAE/B;IADC,IAAA,eAAI,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;4DACF;AAGvB;IADC,IAAA,eAAI,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;8DACA;AAGzB;IADC,IAAA,eAAI,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;8DACA;AAGzB;IADC,IAAA,eAAI,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;mDACX;AAGd;IADC,IAAA,eAAI,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;kDACZ;AAGb;IADC,IAAA,eAAI,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;;0DACnB;AAGrB;IADC,IAAA,eAAI,EAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;;kDACO;AAGnC;IADC,IAAA,eAAI,EAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;;oDACR;AAGhB;IADC,IAAA,eAAI,GAAE;8BACO,IAAI;yDAAC;+BA1BR,oBAAoB;IAJhC,IAAA,iBAAM,EAAC;QACN,UAAU,EAAE,sCAAe;QAC3B,UAAU,EAAE,IAAI;KACjB,CAAC;GACW,oBAAoB,CA8BhC"}

package/server/auth/auth-service.d.ts

@@ -0,0 +1,64 @@
+import { OnModuleInit } from '@nestjs/common';
+import { ConfigService } from '@nestjs/config';
+import { Model } from 'mongoose';
+import { CanvasFlowOrganizationEntity } from './auth-organization-schema';
+import { CanvasFlowUserEntity } from './auth-schema';
+export interface CanvasFlowAuthUser {
+    id: string;
+    organizationId: string;
+    organizationName: string;
+    organizationSlug: string;
+    email: string;
+    name: string;
+    role: 'owner' | 'admin' | 'member';
+}
+export declare class AuthService implements OnModuleInit {
+    private model;
+    private organizationModel;
+    private readonly configService;
+    private readonly loginAttempts;
+    constructor(model: Model<CanvasFlowUserEntity>, organizationModel: Model<CanvasFlowOrganizationEntity>, configService: ConfigService);
+    onModuleInit(): void;
+    isLoginRequired(): boolean;
+    private slugify;
+    private hashPassword;
+    private verifyPassword;
+    private tokenSecret;
+    private base64url;
+    private signToken;
+    private verifyToken;
+    private toSafeUser;
+    private extractToken;
+    private isDuplicateKeyError;
+    private loginThrottleWindowMs;
+    private loginThrottleMaxAttempts;
+    private loginThrottleKey;
+    private pruneLoginAttempts;
+    private assertLoginAllowed;
+    private registerLoginFailure;
+    private clearLoginFailures;
+    private organizationSlugExists;
+    private ensureOrganizationForUser;
+    getConfig(): Promise<{
+        loginRequired: boolean;
+        hasUsers: boolean;
+    }>;
+    private createOwnerSession;
+    bootstrap(body: any): Promise<{
+        token: string;
+        user: CanvasFlowAuthUser;
+    }>;
+    createOrganization(body: any): Promise<{
+        token: string;
+        user: CanvasFlowAuthUser;
+    }>;
+    login(body: any): Promise<{
+        token: string;
+        user: CanvasFlowAuthUser;
+    }>;
+    private createSession;
+    resolveUserFromToken(token: string): Promise<CanvasFlowAuthUser | null>;
+    resolveUserFromHeaders(authorization?: string, headerToken?: string, xApiKey?: string): Promise<CanvasFlowAuthUser>;
+    assertUiAuth(authorization?: string, headerToken?: string, xApiKey?: string): Promise<CanvasFlowAuthUser>;
+    createUser(body: any, actor: CanvasFlowAuthUser): Promise<CanvasFlowAuthUser>;
+}

package/server/auth/auth-service.js

@@ -0,0 +1,343 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AuthService = void 0;
+const common_1 = require("@nestjs/common");
+const config_1 = require("@nestjs/config");
+const crypto_1 = require("crypto");
+const mongoose_1 = require("mongoose");
+const auth_constants_model_1 = require("./auth-constants-model");
+let AuthService = class AuthService {
+    constructor(model, organizationModel, configService) {
+        this.model = model;
+        this.organizationModel = organizationModel;
+        this.configService = configService;
+        this.loginAttempts = new Map();
+    }
+    onModuleInit() {
+        void this.organizationModel.createIndexes().catch(() => undefined);
+    }
+    isLoginRequired() {
+        return ['true', '1', 'yes', 'sim'].includes(String(this.configService.get('CANVAS_FLOW_LOGIN') || '').toLowerCase());
+    }
+    slugify(value) {
+        return String(value || 'org')
+            .normalize('NFD')
+            .replace(/[\u0300-\u036f]/g, '')
+            .toLowerCase()
+            .replace(/[^a-z0-9]+/g, '-')
+            .replace(/^-+|-+$/g, '')
+            .slice(0, 60) || 'org';
+    }
+    hashPassword(password) {
+        const salt = (0, crypto_1.randomBytes)(16).toString('hex');
+        const hash = (0, crypto_1.scryptSync)(password, salt, 64).toString('hex');
+        return `scrypt:${salt}:${hash}`;
+    }
+    verifyPassword(password, stored) {
+        const [, salt, expected] = String(stored || '').split(':');
+        if (!salt || !expected)
+            return false;
+        const actual = (0, crypto_1.scryptSync)(password, salt, 64);
+        const expectedBuffer = Buffer.from(expected, 'hex');
+        return actual.length === expectedBuffer.length && (0, crypto_1.timingSafeEqual)(actual, expectedBuffer);
+    }
+    tokenSecret() {
+        return (this.configService.get('CANVAS_FLOW_JWT_SECRET') ||
+            this.configService.get('CANVAS_FLOW_API_TOKEN') ||
+            'canvas-flow-dev-secret');
+    }
+    base64url(value) {
+        return Buffer.from(value).toString('base64url');
+    }
+    signToken(payload) {
+        const header = this.base64url(JSON.stringify({ alg: 'HS256', typ: 'JWT' }));
+        const body = this.base64url(JSON.stringify(payload));
+        const signature = (0, crypto_1.createHmac)('sha256', this.tokenSecret()).update(`${header}.${body}`).digest('base64url');
+        return `${header}.${body}.${signature}`;
+    }
+    verifyToken(token) {
+        const parts = String(token || '').split('.');
+        if (parts.length !== 3)
+            return null;
+        const [header, body, signature] = parts;
+        const expected = (0, crypto_1.createHmac)('sha256', this.tokenSecret()).update(`${header}.${body}`).digest('base64url');
+        const expectedBuffer = Buffer.from(expected);
+        const signatureBuffer = Buffer.from(signature);
+        if (expectedBuffer.length !== signatureBuffer.length || !(0, crypto_1.timingSafeEqual)(expectedBuffer, signatureBuffer))
+            return null;
+        const payload = JSON.parse(Buffer.from(body, 'base64url').toString('utf-8'));
+        if (payload.exp && Number(payload.exp) < Math.floor(Date.now() / 1000))
+            return null;
+        return payload;
+    }
+    toSafeUser(row) {
+        return {
+            id: String(row?._id || row?.id || ''),
+            organizationId: String(row?.organizationId || ''),
+            organizationName: String(row?.organizationName || ''),
+            organizationSlug: String(row?.organizationSlug || ''),
+            email: String(row?.email || ''),
+            name: String(row?.name || ''),
+            role: row?.role || 'member',
+        };
+    }
+    extractToken(authorization, headerToken, xApiKey) {
+        const auth = String(authorization || '').trim();
+        const bearerMatch = auth.match(/^Bearer\s+(.+)$/i);
+        return String(bearerMatch?.[1] || headerToken || xApiKey || '').trim();
+    }
+    isDuplicateKeyError(err) {
+        return Number(err?.code) === 11000 || String(err?.message || '').includes('E11000');
+    }
+    loginThrottleWindowMs() {
+        return Math.max(Number(this.configService.get('CANVAS_FLOW_LOGIN_THROTTLE_WINDOW_MS') || 10 * 60 * 1000), 60 * 1000);
+    }
+    loginThrottleMaxAttempts() {
+        return Math.max(Number(this.configService.get('CANVAS_FLOW_LOGIN_MAX_ATTEMPTS') || 8), 3);
+    }
+    loginThrottleKey(email, organizationSlug) {
+        return `${organizationSlug || '-'}:${email || '-'}`;
+    }
+    pruneLoginAttempts(now = Date.now()) {
+        for (const [key, attempt] of this.loginAttempts.entries()) {
+            if (attempt.resetAt <= now)
+                this.loginAttempts.delete(key);
+        }
+    }
+    assertLoginAllowed(email, organizationSlug) {
+        const now = Date.now();
+        this.pruneLoginAttempts(now);
+        const attempt = this.loginAttempts.get(this.loginThrottleKey(email, organizationSlug));
+        if (!attempt || attempt.count < this.loginThrottleMaxAttempts())
+            return;
+        throw new common_1.HttpException('Muitas tentativas de login. Aguarde alguns minutos e tente novamente.', common_1.HttpStatus.TOO_MANY_REQUESTS);
+    }
+    registerLoginFailure(email, organizationSlug) {
+        const now = Date.now();
+        const key = this.loginThrottleKey(email, organizationSlug);
+        const current = this.loginAttempts.get(key);
+        if (!current || current.resetAt <= now) {
+            this.loginAttempts.set(key, { count: 1, resetAt: now + this.loginThrottleWindowMs() });
+            return;
+        }
+        this.loginAttempts.set(key, { ...current, count: current.count + 1 });
+    }
+    clearLoginFailures(email, organizationSlug) {
+        this.loginAttempts.delete(this.loginThrottleKey(email, organizationSlug));
+    }
+    async organizationSlugExists(organizationSlug) {
+        const organizationExists = await this.organizationModel.exists({ slug: organizationSlug }).exec();
+        if (organizationExists)
+            return true;
+        const legacyUserWithSlug = await this.model.exists({ organizationSlug }).exec();
+        return Boolean(legacyUserWithSlug);
+    }
+    async ensureOrganizationForUser(user) {
+        const organizationId = String(user?.organizationId || '');
+        const organizationSlug = String(user?.organizationSlug || '');
+        if (!organizationId || !organizationSlug)
+            return;
+        const insert = {
+            organizationId,
+            name: String(user?.organizationName || organizationSlug),
+            slug: organizationSlug,
+            active: true,
+            createdByEmail: String(user?.email || '').toLowerCase(),
+        };
+        if (user?.role === 'owner')
+            insert.ownerUserId = String(user?._id || user?.id || '');
+        try {
+            await this.organizationModel.updateOne({ slug: organizationSlug }, { $setOnInsert: insert }, { upsert: true }).exec();
+        }
+        catch (err) {
+            if (!this.isDuplicateKeyError(err))
+                throw err;
+        }
+    }
+    async getConfig() {
+        const usersCount = await this.model.countDocuments({ active: true }).exec().catch(() => 0);
+        return {
+            loginRequired: this.isLoginRequired(),
+            hasUsers: usersCount > 0,
+        };
+    }
+    async createOwnerSession(body) {
+        const organizationName = String(body?.organizationName || 'Organizacao').trim();
+        const organizationSlug = this.slugify(body?.organizationSlug || organizationName);
+        const email = String(body?.email || '').trim().toLowerCase();
+        const password = String(body?.password || '');
+        const name = String(body?.name || email).trim();
+        if (!organizationName || !email || !password || password.length < 8) {
+            throw new common_1.HttpException('Informe organizacao, email e senha com pelo menos 8 caracteres.', common_1.HttpStatus.BAD_REQUEST);
+        }
+        if (await this.organizationSlugExists(organizationSlug)) {
+            throw new common_1.HttpException('Esta organizacao ja existe. Escolha outro identificador.', common_1.HttpStatus.CONFLICT);
+        }
+        let organization = null;
+        let userCreated = false;
+        try {
+            organization = await new this.organizationModel({
+                organizationId: (0, crypto_1.randomBytes)(12).toString('hex'),
+                name: organizationName,
+                slug: organizationSlug,
+                active: true,
+                createdByEmail: email,
+            }).save();
+            const user = await new this.model({
+                organizationId: organization.organizationId,
+                organizationName: organization.name,
+                organizationSlug: organization.slug,
+                email,
+                name,
+                role: 'owner',
+                passwordHash: this.hashPassword(password),
+                active: true,
+            }).save();
+            userCreated = true;
+            await this.organizationModel.updateOne({ _id: organization._id }, { $set: { ownerUserId: String(user._id) } }).exec().catch(() => undefined);
+            return this.createSession(this.toSafeUser(user.toObject()));
+        }
+        catch (err) {
+            if (organization && !userCreated) {
+                await this.organizationModel.deleteOne({ _id: organization._id }).exec().catch(() => undefined);
+            }
+            if (this.isDuplicateKeyError(err)) {
+                throw new common_1.HttpException('Esta organizacao ja existe. Escolha outro identificador.', common_1.HttpStatus.CONFLICT);
+            }
+            throw err;
+        }
+    }
+    async bootstrap(body) {
+        const usersCount = await this.model.countDocuments({}).exec();
+        if (usersCount > 0) {
+            throw new common_1.HttpException('Login ja foi inicializado.', common_1.HttpStatus.CONFLICT);
+        }
+        return await this.createOwnerSession(body);
+    }
+    async createOrganization(body) {
+        return await this.createOwnerSession(body);
+    }
+    async login(body) {
+        const email = String(body?.email || '').trim().toLowerCase();
+        const password = String(body?.password || '');
+        const rawOrganizationSlug = String(body?.organizationSlug || '').trim();
+        const organizationSlug = rawOrganizationSlug ? this.slugify(rawOrganizationSlug) : '';
+        this.assertLoginAllowed(email, organizationSlug);
+        const query = { email, active: true };
+        if (organizationSlug) {
+            const organization = await this.organizationModel.findOne({ slug: organizationSlug }).lean().exec().catch(() => null);
+            if (organization && organization.active === false) {
+                this.registerLoginFailure(email, organizationSlug);
+                throw new common_1.UnauthorizedException('Email, organizacao ou senha invalidos.');
+            }
+            if (organization?.organizationId) {
+                query.organizationId = organization.organizationId;
+            }
+            else {
+                query.organizationSlug = organizationSlug;
+            }
+        }
+        const candidates = organizationSlug
+            ? await this.model.find(query).select('+passwordHash').limit(1).lean().exec()
+            : await this.model.find(query).select('+passwordHash').limit(2).lean().exec();
+        if (!organizationSlug && candidates.length > 1) {
+            throw new common_1.HttpException('Informe o identificador da organizacao para continuar.', common_1.HttpStatus.BAD_REQUEST);
+        }
+        const user = candidates[0];
+        if (!user || !this.verifyPassword(password, user.passwordHash)) {
+            this.registerLoginFailure(email, organizationSlug);
+            throw new common_1.UnauthorizedException('Email, organizacao ou senha invalidos.');
+        }
+        await this.ensureOrganizationForUser(user);
+        await this.model.updateOne({ _id: user._id }, { $set: { lastLoginAt: new Date() } }).exec();
+        this.clearLoginFailures(email, organizationSlug);
+        return this.createSession(this.toSafeUser(user));
+    }
+    createSession(user) {
+        const ttlHours = Math.max(Number(this.configService.get('CANVAS_FLOW_LOGIN_TTL_HOURS') || 24), 1);
+        const token = this.signToken({
+            sub: user.id,
+            org: user.organizationId,
+            role: user.role,
+            exp: Math.floor(Date.now() / 1000) + ttlHours * 3600,
+        });
+        return { token, user };
+    }
+    async resolveUserFromToken(token) {
+        const payload = this.verifyToken(token);
+        if (!payload?.sub)
+            return null;
+        const user = await this.model.findOne({ _id: payload.sub, active: true }).lean().exec();
+        if (!user)
+            return null;
+        if (payload.org && String(payload.org) !== String(user.organizationId))
+            return null;
+        const organization = await this.organizationModel
+            .findOne({ organizationId: user.organizationId })
+            .lean()
+            .exec()
+            .catch(() => null);
+        if (organization && organization.active === false)
+            return null;
+        return this.toSafeUser(user);
+    }
+    async resolveUserFromHeaders(authorization, headerToken, xApiKey) {
+        const token = this.extractToken(authorization, headerToken, xApiKey);
+        if (!token)
+            return null;
+        return await this.resolveUserFromToken(token);
+    }
+    async assertUiAuth(authorization, headerToken, xApiKey) {
+        if (!this.isLoginRequired())
+            return null;
+        const user = await this.resolveUserFromHeaders(authorization, headerToken, xApiKey);
+        if (!user)
+            throw new common_1.UnauthorizedException('Login obrigatorio.');
+        return user;
+    }
+    async createUser(body, actor) {
+        if (!['owner', 'admin'].includes(actor.role)) {
+            throw new common_1.UnauthorizedException('Apenas admins podem criar usuarios.');
+        }
+        const email = String(body?.email || '').trim().toLowerCase();
+        const password = String(body?.password || '');
+        const name = String(body?.name || email).trim();
+        if (!email || !password || password.length < 8) {
+            throw new common_1.HttpException('Informe email e senha com pelo menos 8 caracteres.', common_1.HttpStatus.BAD_REQUEST);
+        }
+        await this.ensureOrganizationForUser(actor);
+        const saved = await new this.model({
+            organizationId: actor.organizationId,
+            organizationName: actor.organizationName,
+            organizationSlug: actor.organizationSlug,
+            email,
+            name,
+            role: body?.role === 'admin' ? 'admin' : 'member',
+            passwordHash: this.hashPassword(password),
+            active: true,
+        }).save();
+        return this.toSafeUser(saved.toObject());
+    }
+};
+exports.AuthService = AuthService;
+exports.AuthService = AuthService = __decorate([
+    (0, common_1.Injectable)(),
+    __param(0, (0, common_1.Inject)(auth_constants_model_1.MODEL_NAME)),
+    __param(1, (0, common_1.Inject)(auth_constants_model_1.ORGANIZATION_MODEL_NAME)),
+    __metadata("design:paramtypes", [mongoose_1.Model,
+        mongoose_1.Model,
+        config_1.ConfigService])
+], AuthService);
+//# sourceMappingURL=auth-service.js.map

package/server/auth/auth-service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-service.js","sourceRoot":"","sources":["../../src/auth/auth-service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,2CAAoH;AACpH,2CAA+C;AAC/C,mCAA8E;AAC9E,uCAAiC;AACjC,iEAA6E;AAetE,IAAM,WAAW,GAAjB,MAAM,WAAW;IAGtB,YACsB,KAA0C,EAC7B,iBAA8D,EAC9E,aAA4B;QAFjB,UAAK,GAAL,KAAK,CAA6B;QACrB,sBAAiB,GAAjB,iBAAiB,CAAqC;QAC9E,kBAAa,GAAb,aAAa,CAAe;QAL9B,kBAAa,GAAG,IAAI,GAAG,EAA8C,CAAC;IAMpF,CAAC;IAEJ,YAAY;QACV,KAAK,IAAI,CAAC,iBAAiB,CAAC,aAAa,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IACrE,CAAC;IAED,eAAe;QACb,OAAO,CAAC,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,GAAG,CAAS,mBAAmB,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;IAC/H,CAAC;IAEO,OAAO,CAAC,KAAa;QAC3B,OAAO,MAAM,CAAC,KAAK,IAAI,KAAK,CAAC;aAC1B,SAAS,CAAC,KAAK,CAAC;aAChB,OAAO,CAAC,kBAAkB,EAAE,EAAE,CAAC;aAC/B,WAAW,EAAE;aACb,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC;aAC3B,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC;aACvB,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,KAAK,CAAC;IAC3B,CAAC;IAEO,YAAY,CAAC,QAAgB;QACnC,MAAM,IAAI,GAAG,IAAA,oBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC7C,MAAM,IAAI,GAAG,IAAA,mBAAU,EAAC,QAAQ,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC5D,OAAO,UAAU,IAAI,IAAI,IAAI,EAAE,CAAC;IAClC,CAAC;IAEO,cAAc,CAAC,QAAgB,EAAE,MAAc;QACrD,MAAM,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,GAAG,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC3D,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ;YAAE,OAAO,KAAK,CAAC;QACrC,MAAM,MAAM,GAAG,IAAA,mBAAU,EAAC,QAAQ,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;QAC9C,MAAM,cAAc,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QACpD,OAAO,MAAM,CAAC,MAAM,KAAK,cAAc,CAAC,MAAM,IAAI,IAAA,wBAAe,EAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IAC5F,CAAC;IAEO,WAAW;QACjB,OAAO,CACL,IAAI,CAAC,aAAa,CAAC,GAAG,CAAS,wBAAwB,CAAC;YACxD,IAAI,CAAC,aAAa,CAAC,GAAG,CAAS,uBAAuB,CAAC;YACvD,wBAAwB,CACzB,CAAC;IACJ,CAAC;IAEO,SAAS,CAAC,KAAsB;QACtC,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAClD,CAAC;IAEO,SAAS,CAAC,OAA4B;QAC5C,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;QAC5E,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;QACrD,MAAM,SAAS,GAAG,IAAA,mBAAU,EAAC,QAAQ,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,GAAG,MAAM,IAAI,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QAC3G,OAAO,GAAG,MAAM,IAAI,IAAI,IAAI,SAAS,EAAE,CAAC;IAC1C,CAAC;IAEO,WAAW,CAAC,KAAa;QAC/B,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC7C,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACpC,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE,SAAS,CAAC,GAAG,KAAK,CAAC;QACxC,MAAM,QAAQ,GAAG,IAAA,mBAAU,EAAC,QAAQ,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,GAAG,MAAM,IAAI,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QAC1G,MAAM,cAAc,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC7C,MAAM,eAAe,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC/C,IAAI,cAAc,CAAC,MAAM,KAAK,eAAe,CAAC,MAAM,IAAI,CAAC,IAAA,wBAAe,EAAC,cAAc,EAAE,eAAe,CAAC;YAAE,OAAO,IAAI,CAAC;QACvH,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;QAC7E,IAAI,OAAO,CAAC,GAAG,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QACpF,OAAO,OAAO,CAAC;IACjB,CAAC;IAEO,UAAU,CAAC,GAAQ;QACzB,OAAO;YACL,EAAE,EAAE,MAAM,CAAC,GAAG,EAAE,GAAG,IAAI,GAAG,EAAE,EAAE,IAAI,EAAE,CAAC;YACrC,cAAc,EAAE,MAAM,CAAC,GAAG,EAAE,cAAc,IAAI,EAAE,CAAC;YACjD,gBAAgB,EAAE,MAAM,CAAC,GAAG,EAAE,gBAAgB,IAAI,EAAE,CAAC;YACrD,gBAAgB,EAAE,MAAM,CAAC,GAAG,EAAE,gBAAgB,IAAI,EAAE,CAAC;YACrD,KAAK,EAAE,MAAM,CAAC,GAAG,EAAE,KAAK,IAAI,EAAE,CAAC;YAC/B,IAAI,EAAE,MAAM,CAAC,GAAG,EAAE,IAAI,IAAI,EAAE,CAAC;YAC7B,IAAI,EAAE,GAAG,EAAE,IAAI,IAAI,QAAQ;SAC5B,CAAC;IACJ,CAAC;IAEO,YAAY,CAAC,aAAsB,EAAE,WAAoB,EAAE,OAAgB;QACjF,MAAM,IAAI,GAAG,MAAM,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAChD,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;QACnD,OAAO,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI,WAAW,IAAI,OAAO,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACzE,CAAC;IAEO,mBAAmB,CAAC,GAAQ;QAClC,OAAO,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,KAAK,KAAK,IAAI,MAAM,CAAC,GAAG,EAAE,OAAO,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACtF,CAAC;IAEO,qBAAqB;QAC3B,OAAO,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,GAAG,CAAS,sCAAsC,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,EAAE,EAAE,GAAG,IAAI,CAAC,CAAC;IAC/H,CAAC;IAEO,wBAAwB;QAC9B,OAAO,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,GAAG,CAAS,gCAAgC,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACpG,CAAC;IAEO,gBAAgB,CAAC,KAAa,EAAE,gBAAwB;QAC9D,OAAO,GAAG,gBAAgB,IAAI,GAAG,IAAI,KAAK,IAAI,GAAG,EAAE,CAAC;IACtD,CAAC;IAEO,kBAAkB,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;QACzC,KAAK,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,EAAE,CAAC;YAC1D,IAAI,OAAO,CAAC,OAAO,IAAI,GAAG;gBAAE,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7D,CAAC;IACH,CAAC;IAEO,kBAAkB,CAAC,KAAa,EAAE,gBAAwB;QAChE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC;QAC7B,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,gBAAgB,CAAC,KAAK,EAAE,gBAAgB,CAAC,CAAC,CAAC;QACvF,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC,wBAAwB,EAAE;YAAE,OAAO;QAExE,MAAM,IAAI,sBAAa,CAAC,uEAAuE,EAAE,mBAAU,CAAC,iBAAiB,CAAC,CAAC;IACjI,CAAC;IAEO,oBAAoB,CAAC,KAAa,EAAE,gBAAwB;QAClE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,GAAG,GAAG,IAAI,CAAC,gBAAgB,CAAC,KAAK,EAAE,gBAAgB,CAAC,CAAC;QAC3D,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC5C,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,OAAO,IAAI,GAAG,EAAE,CAAC;YACvC,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,GAAG,GAAG,IAAI,CAAC,qBAAqB,EAAE,EAAE,CAAC,CAAC;YACvF,OAAO;QACT,CAAC;QACD,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,GAAG,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,GAAG,CAAC,EAAE,CAAC,CAAC;IACxE,CAAC;IAEO,kBAAkB,CAAC,KAAa,EAAE,gBAAwB;QAChE,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,KAAK,EAAE,gBAAgB,CAAC,CAAC,CAAC;IAC5E,CAAC;IAEO,KAAK,CAAC,sBAAsB,CAAC,gBAAwB;QAC3D,MAAM,kBAAkB,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAClG,IAAI,kBAAkB;YAAE,OAAO,IAAI,CAAC;QACpC,MAAM,kBAAkB,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAChF,OAAO,OAAO,CAAC,kBAAkB,CAAC,CAAC;IACrC,CAAC;IAEO,KAAK,CAAC,yBAAyB,CAAC,IAAS;QAC/C,MAAM,cAAc,GAAG,MAAM,CAAC,IAAI,EAAE,cAAc,IAAI,EAAE,CAAC,CAAC;QAC1D,MAAM,gBAAgB,GAAG,MAAM,CAAC,IAAI,EAAE,gBAAgB,IAAI,EAAE,CAAC,CAAC;QAC9D,IAAI,CAAC,cAAc,IAAI,CAAC,gBAAgB;YAAE,OAAO;QAEjD,MAAM,MAAM,GAAwB;YAClC,cAAc;YACd,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,gBAAgB,IAAI,gBAAgB,CAAC;YACxD,IAAI,EAAE,gBAAgB;YACtB,MAAM,EAAE,IAAI;YACZ,cAAc,EAAE,MAAM,CAAC,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE;SACxD,CAAC;QACF,IAAI,IAAI,EAAE,IAAI,KAAK,OAAO;YAAE,MAAM,CAAC,WAAW,GAAG,MAAM,CAAC,IAAI,EAAE,GAAG,IAAI,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAErF,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,iBAAiB,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,EAAE,EAAE,YAAY,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACxH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC;gBAAE,MAAM,GAAG,CAAC;QAChD,CAAC;IACH,CAAC;IAED,KAAK,CAAC,SAAS;QACb,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;QAC3F,OAAO;YACL,aAAa,EAAE,IAAI,CAAC,eAAe,EAAE;YACrC,QAAQ,EAAE,UAAU,GAAG,CAAC;SACzB,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,kBAAkB,CAAC,IAAS;QACxC,MAAM,gBAAgB,GAAG,MAAM,CAAC,IAAI,EAAE,gBAAgB,IAAI,aAAa,CAAC,CAAC,IAAI,EAAE,CAAC;QAChF,MAAM,gBAAgB,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,gBAAgB,IAAI,gBAAgB,CAAC,CAAC;QAClF,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAC7D,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,EAAE,QAAQ,IAAI,EAAE,CAAC,CAAC;QAC9C,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,EAAE,IAAI,IAAI,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;QAChD,IAAI,CAAC,gBAAgB,IAAI,CAAC,KAAK,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACpE,MAAM,IAAI,sBAAa,CAAC,iEAAiE,EAAE,mBAAU,CAAC,WAAW,CAAC,CAAC;QACrH,CAAC;QAED,IAAI,MAAM,IAAI,CAAC,sBAAsB,CAAC,gBAAgB,CAAC,EAAE,CAAC;YACxD,MAAM,IAAI,sBAAa,CAAC,0DAA0D,EAAE,mBAAU,CAAC,QAAQ,CAAC,CAAC;QAC3G,CAAC;QAED,IAAI,YAAY,GAAwC,IAAI,CAAC;QAC7D,IAAI,WAAW,GAAG,KAAK,CAAC;QACxB,IAAI,CAAC;YACH,YAAY,GAAG,MAAM,IAAI,IAAI,CAAC,iBAAiB,CAAC;gBAC9C,cAAc,EAAE,IAAA,oBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;gBAC/C,IAAI,EAAE,gBAAgB;gBACtB,IAAI,EAAE,gBAAgB;gBACtB,MAAM,EAAE,IAAI;gBACZ,cAAc,EAAE,KAAK;aACtB,CAAC,CAAC,IAAI,EAAE,CAAC;YAEV,MAAM,IAAI,GAAG,MAAM,IAAI,IAAI,CAAC,KAAK,CAAC;gBAChC,cAAc,EAAE,YAAY,CAAC,cAAc;gBAC3C,gBAAgB,EAAE,YAAY,CAAC,IAAI;gBACnC,gBAAgB,EAAE,YAAY,CAAC,IAAI;gBACnC,KAAK;gBACL,IAAI;gBACJ,IAAI,EAAE,OAAO;gBACb,YAAY,EAAE,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC;gBACzC,MAAM,EAAE,IAAI;aACb,CAAC,CAAC,IAAI,EAAE,CAAC;YACV,WAAW,GAAG,IAAI,CAAC;YAEnB,MAAM,IAAI,CAAC,iBAAiB,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,YAAY,CAAC,GAAG,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YAC7I,OAAO,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;QAC9D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,YAAY,IAAI,CAAC,WAAW,EAAE,CAAC;gBACjC,MAAM,IAAI,CAAC,iBAAiB,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,YAAY,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YAClG,CAAC;YACD,IAAI,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,EAAE,CAAC;gBAClC,MAAM,IAAI,sBAAa,CAAC,0DAA0D,EAAE,mBAAU,CAAC,QAAQ,CAAC,CAAC;YAC3G,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,IAAS;QACvB,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAC9D,IAAI,UAAU,GAAG,CAAC,EAAE,CAAC;YACnB,MAAM,IAAI,sBAAa,CAAC,4BAA4B,EAAE,mBAAU,CAAC,QAAQ,CAAC,CAAC;QAC7E,CAAC;QAED,OAAO,MAAM,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC;IAC7C,CAAC;IAED,KAAK,CAAC,kBAAkB,CAAC,IAAS;QAChC,OAAO,MAAM,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC;IAC7C,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,IAAS;QACnB,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAC7D,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,EAAE,QAAQ,IAAI,EAAE,CAAC,CAAC;QAC9C,MAAM,mBAAmB,GAAG,MAAM,CAAC,IAAI,EAAE,gBAAgB,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACxE,MAAM,gBAAgB,GAAG,mBAAmB,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACtF,IAAI,CAAC,kBAAkB,CAAC,KAAK,EAAE,gBAAgB,CAAC,CAAC;QAEjD,MAAM,KAAK,GAAwB,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;QAC3D,IAAI,gBAAgB,EAAE,CAAC;YACrB,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;YACtH,IAAI,YAAY,IAAI,YAAY,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;gBAClD,IAAI,CAAC,oBAAoB,CAAC,KAAK,EAAE,gBAAgB,CAAC,CAAC;gBACnD,MAAM,IAAI,8BAAqB,CAAC,wCAAwC,CAAC,CAAC;YAC5E,CAAC;YACD,IAAI,YAAY,EAAE,cAAc,EAAE,CAAC;gBACjC,KAAK,CAAC,cAAc,GAAG,YAAY,CAAC,cAAc,CAAC;YACrD,CAAC;iBAAM,CAAC;gBACN,KAAK,CAAC,gBAAgB,GAAG,gBAAgB,CAAC;YAC5C,CAAC;QACH,CAAC;QAED,MAAM,UAAU,GAAG,gBAAgB;YACjC,CAAC,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE;YAC7E,CAAC,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC;QAChF,IAAI,CAAC,gBAAgB,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC/C,MAAM,IAAI,sBAAa,CAAC,wDAAwD,EAAE,mBAAU,CAAC,WAAW,CAAC,CAAC;QAC5G,CAAC;QAED,MAAM,IAAI,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;QAC3B,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,QAAQ,EAAE,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;YAC/D,IAAI,CAAC,oBAAoB,CAAC,KAAK,EAAE,gBAAgB,CAAC,CAAC;YACnD,MAAM,IAAI,8BAAqB,CAAC,wCAAwC,CAAC,CAAC;QAC5E,CAAC;QAED,MAAM,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,CAAC;QAC3C,MAAM,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,WAAW,EAAE,IAAI,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAC5F,IAAI,CAAC,kBAAkB,CAAC,KAAK,EAAE,gBAAgB,CAAC,CAAC;QACjD,OAAO,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;IACnD,CAAC;IAEO,aAAa,CAAC,IAAwB;QAC5C,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,GAAG,CAAS,6BAA6B,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;QAC1G,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC;YAC3B,GAAG,EAAE,IAAI,CAAC,EAAE;YACZ,GAAG,EAAE,IAAI,CAAC,cAAc;YACxB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,QAAQ,GAAG,IAAI;SACrD,CAAC,CAAC;QACH,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IACzB,CAAC;IAED,KAAK,CAAC,oBAAoB,CAAC,KAAa;QACtC,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;QACxC,IAAI,CAAC,OAAO,EAAE,GAAG;YAAE,OAAO,IAAI,CAAC;QAC/B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC;QACxF,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC;QACvB,IAAI,OAAO,CAAC,GAAG,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC;YAAE,OAAO,IAAI,CAAC;QAEpF,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,iBAAiB;aAC9C,OAAO,CAAC,EAAE,cAAc,EAAE,IAAI,CAAC,cAAc,EAAE,CAAC;aAChD,IAAI,EAAE;aACN,IAAI,EAAE;aACN,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QACrB,IAAI,YAAY,IAAI,YAAY,CAAC,MAAM,KAAK,KAAK;YAAE,OAAO,IAAI,CAAC;QAE/D,OAAO,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;IAC/B,CAAC;IAED,KAAK,CAAC,sBAAsB,CAAC,aAAsB,EAAE,WAAoB,EAAE,OAAgB;QACzF,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,CAAC,aAAa,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC;QACrE,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QACxB,OAAO,MAAM,IAAI,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC;IAChD,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,aAAsB,EAAE,WAAoB,EAAE,OAAgB;QAC/E,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE;YAAE,OAAO,IAAI,CAAC;QACzC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,aAAa,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC;QACpF,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,8BAAqB,CAAC,oBAAoB,CAAC,CAAC;QACjE,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,IAAS,EAAE,KAAyB;QACnD,IAAI,CAAC,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7C,MAAM,IAAI,8BAAqB,CAAC,qCAAqC,CAAC,CAAC;QACzE,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAC7D,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,EAAE,QAAQ,IAAI,EAAE,CAAC,CAAC;QAC9C,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,EAAE,IAAI,IAAI,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;QAChD,IAAI,CAAC,KAAK,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC/C,MAAM,IAAI,sBAAa,CAAC,oDAAoD,EAAE,mBAAU,CAAC,WAAW,CAAC,CAAC;QACxG,CAAC;QAED,MAAM,IAAI,CAAC,yBAAyB,CAAC,KAAK,CAAC,CAAC;QAC5C,MAAM,KAAK,GAAG,MAAM,IAAI,IAAI,CAAC,KAAK,CAAC;YACjC,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;YACxC,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;YACxC,KAAK;YACL,IAAI;YACJ,IAAI,EAAE,IAAI,EAAE,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ;YACjD,YAAY,EAAE,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC;YACzC,MAAM,EAAE,IAAI;SACb,CAAC,CAAC,IAAI,EAAE,CAAC;QAEV,OAAO,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC3C,CAAC;CACF,CAAA;AAvVY,kCAAW;sBAAX,WAAW;IADvB,IAAA,mBAAU,GAAE;IAKR,WAAA,IAAA,eAAM,EAAC,iCAAU,CAAC,CAAA;IAClB,WAAA,IAAA,eAAM,EAAC,8CAAuB,CAAC,CAAA;qCADG,gBAAK;QACoB,gBAAK;QACjC,sBAAa;GANpC,WAAW,CAuVvB"}