@lenne.tech/nest-server 11.41.2 → 11.41.4

package/dist/core/modules/api-token/core-api-token.service.js

@@ -0,0 +1,550 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+var CoreApiTokenService_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CoreApiTokenService = void 0;
+const node_crypto_1 = require("node:crypto");
+const common_1 = require("@nestjs/common");
+const mongoose_1 = require("@nestjs/mongoose");
+const mongoose_2 = require("mongoose");
+const role_enum_1 = require("../../common/enums/role.enum");
+const config_service_1 = require("../../common/services/config.service");
+const core_redis_service_1 = require("../../common/services/core-redis.service");
+const rate_limit_store_1 = require("../../common/services/rate-limit-store");
+const error_codes_1 = require("../error-code/error-codes");
+const core_tenant_helpers_1 = require("../tenant/core-tenant.helpers");
+const core_tenant_service_1 = require("../tenant/core-tenant.service");
+const core_api_token_constants_1 = require("./core-api-token.constants");
+const core_api_token_helpers_1 = require("./core-api-token.helpers");
+const core_api_token_registry_1 = require("./core-api-token.registry");
+const PROTECTED_FIELDS = new Set([
+    '_id',
+    '__v',
+    'createdAt',
+    'createdBy',
+    'id',
+    'kind',
+    'lastUsedAt',
+    'publicId',
+    'revokedAt',
+    'secretHash',
+    'signingKeyEncrypted',
+    'tenant',
+    'updatedAt',
+    'updatedBy',
+    'user',
+]);
+const USER_SECRET_PROJECTION = {
+    password: 0,
+    passwordResetToken: 0,
+    passwordResetTokenExpiresAt: 0,
+    refreshTokens: 0,
+    tempTokens: 0,
+    verificationToken: 0,
+};
+let CoreApiTokenService = class CoreApiTokenService {
+    static { CoreApiTokenService_1 = this; }
+    apiTokenModel;
+    connection;
+    tenantService;
+    redisService;
+    logger = new common_1.Logger(CoreApiTokenService_1.name);
+    lastUsedWrites = new Map();
+    rateLimitStore;
+    warnedAboutDevelopmentKey = false;
+    disposeRevoker;
+    static LAST_USED_INTERVAL_MS = 60_000;
+    static LAST_USED_MAX_ENTRIES = 5000;
+    constructor(apiTokenModel, connection, tenantService, redisService) {
+        this.apiTokenModel = apiTokenModel;
+        this.connection = connection;
+        this.tenantService = tenantService;
+        this.redisService = redisService;
+    }
+    onModuleInit() {
+        (0, core_api_token_helpers_1.assertApiTokenConfigIsUsable)();
+        this.disposeRevoker = (0, core_api_token_registry_1.setApiTokenRevoker)((identity) => this.revokeAllForOwner(identity));
+        const config = (0, core_api_token_helpers_1.getApiTokenConfig)();
+        if (config.enabled && config.scopes.length === 0) {
+            this.logger.warn('apiTokens is enabled but apiTokens.scopes is empty: no token can be created and no route can be opened ' +
+                'to one. Declare the scopes your routes use, e.g. scopes: ["read", "upload"].');
+        }
+    }
+    onModuleDestroy() {
+        this.disposeRevoker?.();
+    }
+    async authenticate(credential) {
+        const config = (0, core_api_token_helpers_1.getApiTokenConfig)();
+        if (!config.enabled) {
+            return null;
+        }
+        if (credential.kind === 'token') {
+            const parsed = (0, core_api_token_helpers_1.parseApiToken)(credential.value, config.prefix);
+            if (!parsed) {
+                return null;
+            }
+            const token = await this.findUsableToken(parsed.publicId, config);
+            if (!token || !(0, core_api_token_helpers_1.safeEqualHex)((0, core_api_token_helpers_1.hashApiTokenSecret)(parsed.secret), token.secretHash)) {
+                return null;
+            }
+            return this.buildRequestUser(token);
+        }
+        const decoded = (0, core_api_token_helpers_1.decodeApiTokenAssertion)(credential.value, config.prefix);
+        if (!decoded || (0, core_api_token_helpers_1.checkApiTokenAssertionTiming)(decoded.payload, config.maxAssertionLifetimeSeconds) !== 'ok') {
+            return null;
+        }
+        const token = await this.findUsableToken(decoded.payload.tid, config);
+        if (!token?.signingKeyEncrypted) {
+            return null;
+        }
+        let signingKey;
+        try {
+            signingKey = this.decryptSigningKey(token.signingKeyEncrypted);
+        }
+        catch {
+            return null;
+        }
+        if (!(0, core_api_token_helpers_1.verifyApiTokenAssertionSignature)(decoded.payloadSegment, decoded.signature, signingKey)) {
+            return null;
+        }
+        return this.buildRequestUser(token, {
+            claims: decoded.payload.claims,
+            expiresAt: new Date(decoded.payload.exp * 1000),
+            nonce: decoded.payload.nonce,
+            subject: decoded.payload.sub,
+        });
+    }
+    async consumeRateLimit(tokenId) {
+        const { rateLimit } = (0, core_api_token_helpers_1.getApiTokenConfig)();
+        if (!rateLimit) {
+            return undefined;
+        }
+        const { count, resetIn } = await this.getRateLimitStore().hit(tokenId, rateLimit.windowSeconds);
+        return count > rateLimit.max ? { retryAfter: Math.max(1, Math.ceil(resetIn)) } : undefined;
+    }
+    touchLastUsed(tokenId) {
+        const now = Date.now();
+        const last = this.lastUsedWrites.get(tokenId);
+        if (last !== undefined && now - last < CoreApiTokenService_1.LAST_USED_INTERVAL_MS) {
+            return;
+        }
+        if (this.lastUsedWrites.size >= CoreApiTokenService_1.LAST_USED_MAX_ENTRIES) {
+            this.lastUsedWrites.clear();
+        }
+        this.lastUsedWrites.set(tokenId, now);
+        this.apiTokenModel
+            .updateOne({ _id: tokenId }, { $set: { lastUsedAt: new Date(now) } }, { timestamps: false })
+            .exec()
+            .catch((error) => this.logger.debug(`lastUsedAt update failed: ${error.message}`));
+    }
+    async findUsableToken(publicId, config) {
+        const token = (await this.apiTokenModel
+            .findOne({ publicId })
+            .select('+secretHash +signingKeyEncrypted')
+            .lean()
+            .exec());
+        if (!token || token.revokedAt || (token.expiresAt && new Date(token.expiresAt).getTime() <= Date.now())) {
+            return null;
+        }
+        if (token.kind === core_api_token_constants_1.ApiTokenKind.TENANT ? !config.tenantTokens || !token.tenant : !config.userTokens || !token.user) {
+            return null;
+        }
+        return { ...token, id: token._id.toString() };
+    }
+    async buildRequestUser(token, assertion) {
+        const context = {
+            assertion,
+            maxTenantRole: token.maxTenantRole || undefined,
+            name: token.name,
+            publicId: token.publicId,
+            scopes: token.scopes ?? [],
+            tenantId: token.tenant || undefined,
+            tokenId: token.id,
+            userId: token.user || undefined,
+        };
+        if (token.kind === core_api_token_constants_1.ApiTokenKind.TENANT) {
+            return (0, core_api_token_helpers_1.createTenantApiTokenPrincipal)({ ...context, tenantId: token.tenant });
+        }
+        const user = await this.loadTokenUser(token.user);
+        return user ? (0, core_api_token_helpers_1.attachApiTokenContext)(user, { ...context, kind: core_api_token_constants_1.ApiTokenKind.USER }) : null;
+    }
+    async loadTokenUser(userId) {
+        if (!this.connection || !userId || !mongoose_2.Types.ObjectId.isValid(userId)) {
+            return null;
+        }
+        const doc = await this.connection
+            .collection('users')
+            .findOne({ _id: new mongoose_2.Types.ObjectId(userId) }, { projection: USER_SECRET_PROJECTION });
+        if (!doc) {
+            return null;
+        }
+        const roles = (Array.isArray(doc.roles) ? doc.roles : []).filter((role) => typeof role === 'string' && (0, core_tenant_helpers_1.resolveGlobalAndTenantRoles)([role]).global.length === 0);
+        return {
+            ...doc,
+            hasRole: (required) => (Array.isArray(required) ? required : [required]).some((role) => roles.includes(role)),
+            id: doc._id.toString(),
+            roles,
+        };
+    }
+    getRateLimitStore() {
+        if (!this.rateLimitStore) {
+            this.rateLimitStore = this.redisService?.enabled
+                ? new rate_limit_store_1.RedisRateLimitStore(this.redisService, 'api-token')
+                : new rate_limit_store_1.InMemoryRateLimitStore(10_000);
+        }
+        return this.rateLimitStore;
+    }
+    async createUserToken(input, currentUser) {
+        const config = this.requireKind(core_api_token_constants_1.ApiTokenKind.USER);
+        this.assertPerson(currentUser);
+        const scopes = this.validateScopes(input?.scopes ?? config.scopes, config);
+        const tenantId = await this.validateUserTokenTenant(input?.tenantId, currentUser, config);
+        const maxTenantRole = this.validateMaxTenantRole(input?.maxTenantRole, config);
+        return this.issue({
+            ...this.projectFields(input),
+            description: this.validateDescription(input?.description),
+            expiresAt: this.validateExpiry(input?.expiresAt),
+            kind: core_api_token_constants_1.ApiTokenKind.USER,
+            maxTenantRole,
+            name: this.validateName(input?.name),
+            scopes,
+            tenant: tenantId,
+            user: String(currentUser.id),
+        }, currentUser);
+    }
+    async findUserTokens(currentUser) {
+        this.requireKind(core_api_token_constants_1.ApiTokenKind.USER);
+        this.assertPerson(currentUser);
+        return this.list({ kind: core_api_token_constants_1.ApiTokenKind.USER, user: String(currentUser.id) });
+    }
+    async updateUserToken(tokenId, input, currentUser) {
+        const config = this.requireKind(core_api_token_constants_1.ApiTokenKind.USER);
+        this.assertPerson(currentUser);
+        const filter = this.userTokenFilter(tokenId, currentUser);
+        const $set = this.commonUpdate(input, config);
+        if (input?.tenantId !== undefined) {
+            $set.tenant = await this.validateUserTokenTenant(input.tenantId, currentUser, config);
+        }
+        if (input?.maxTenantRole !== undefined) {
+            $set.maxTenantRole = this.validateMaxTenantRole(input.maxTenantRole, config);
+        }
+        return this.applyUpdate(filter, $set, currentUser);
+    }
+    async revokeUserToken(tokenId, currentUser) {
+        this.requireKind(core_api_token_constants_1.ApiTokenKind.USER);
+        this.assertPerson(currentUser);
+        return this.applyRevoke(this.userTokenFilter(tokenId, currentUser), currentUser);
+    }
+    async deleteUserToken(tokenId, currentUser) {
+        this.requireKind(core_api_token_constants_1.ApiTokenKind.USER);
+        this.assertPerson(currentUser);
+        return this.applyDelete(this.userTokenFilter(tokenId, currentUser));
+    }
+    async revokeAllForUser(userId) {
+        const result = await this.apiTokenModel
+            .updateMany({ kind: core_api_token_constants_1.ApiTokenKind.USER, revokedAt: null, user: String(userId) }, { $set: { revokedAt: new Date() } })
+            .exec();
+        return result.modifiedCount ?? 0;
+    }
+    async revokeAllForOwner(identity) {
+        let userId = identity?.userId;
+        if (!userId && this.connection && (identity?.email || identity?.iamId)) {
+            const or = [];
+            if (identity.email)
+                or.push({ email: identity.email });
+            if (identity.iamId)
+                or.push({ iamId: identity.iamId });
+            const doc = await this.connection.collection('users').findOne({ $or: or }, { projection: { _id: 1 } });
+            userId = doc?._id?.toString();
+        }
+        return userId ? this.revokeAllForUser(userId) : 0;
+    }
+    async deleteAllForUser(userId) {
+        const result = await this.apiTokenModel.deleteMany({ kind: core_api_token_constants_1.ApiTokenKind.USER, user: String(userId) }).exec();
+        return result.deletedCount ?? 0;
+    }
+    async createTenantToken(tenantId, input, currentUser) {
+        const config = this.requireKind(core_api_token_constants_1.ApiTokenKind.TENANT);
+        await this.assertCanManageTenant(tenantId, currentUser, config);
+        if (!input?.scopes?.length) {
+            throw new common_1.BadRequestException('A tenant token needs at least one scope');
+        }
+        return this.issue({
+            ...this.projectFields(input),
+            description: this.validateDescription(input.description),
+            expiresAt: this.validateExpiry(input.expiresAt),
+            kind: core_api_token_constants_1.ApiTokenKind.TENANT,
+            name: this.validateName(input.name),
+            scopes: this.validateScopes(input.scopes, config),
+            tenant: tenantId,
+        }, currentUser);
+    }
+    async findTenantTokens(tenantId, currentUser) {
+        const config = this.requireKind(core_api_token_constants_1.ApiTokenKind.TENANT);
+        await this.assertCanManageTenant(tenantId, currentUser, config);
+        return this.list({ kind: core_api_token_constants_1.ApiTokenKind.TENANT, tenant: tenantId });
+    }
+    async updateTenantToken(tenantId, tokenId, input, currentUser) {
+        const config = this.requireKind(core_api_token_constants_1.ApiTokenKind.TENANT);
+        await this.assertCanManageTenant(tenantId, currentUser, config);
+        if (input?.tenantId !== undefined || input?.maxTenantRole !== undefined) {
+            throw new common_1.BadRequestException('tenantId and maxTenantRole apply to user tokens only');
+        }
+        const $set = this.commonUpdate(input, config);
+        if (Array.isArray($set.scopes) && !$set.scopes.length) {
+            throw new common_1.BadRequestException('A tenant token needs at least one scope');
+        }
+        return this.applyUpdate(this.tenantTokenFilter(tenantId, tokenId), $set, currentUser);
+    }
+    async revokeTenantToken(tenantId, tokenId, currentUser) {
+        const config = this.requireKind(core_api_token_constants_1.ApiTokenKind.TENANT);
+        await this.assertCanManageTenant(tenantId, currentUser, config);
+        return this.applyRevoke(this.tenantTokenFilter(tenantId, tokenId), currentUser);
+    }
+    async deleteTenantToken(tenantId, tokenId, currentUser) {
+        const config = this.requireKind(core_api_token_constants_1.ApiTokenKind.TENANT);
+        await this.assertCanManageTenant(tenantId, currentUser, config);
+        return this.applyDelete(this.tenantTokenFilter(tenantId, tokenId));
+    }
+    async deleteAllForTenant(tenantId) {
+        if (!tenantId?.trim()) {
+            throw new common_1.BadRequestException('tenantId must not be empty');
+        }
+        const result = await this.apiTokenModel.deleteMany({ tenant: tenantId }).exec();
+        return result.deletedCount ?? 0;
+    }
+    async assertCanManageTenant(tenantId, currentUser, config = (0, core_api_token_helpers_1.getApiTokenConfig)()) {
+        if (!tenantId?.trim()) {
+            throw new common_1.BadRequestException('tenantId must not be empty');
+        }
+        this.assertPerson(currentUser);
+        const adminBypass = config_service_1.ConfigService.configFastButReadOnly?.multiTenancy?.adminBypass !== false;
+        if (adminBypass && Array.isArray(currentUser.roles) && currentUser.roles.includes(role_enum_1.RoleEnum.ADMIN)) {
+            return;
+        }
+        const membership = await this.tenantService?.getActiveMembership(tenantId, String(currentUser.id));
+        if (!membership || !(0, core_tenant_helpers_1.checkRoleAccess)([(0, core_api_token_helpers_1.getApiTokenManageRole)(config)], undefined, membership.role)) {
+            throw new common_1.ForbiddenException(error_codes_1.ErrorCode.ACCESS_DENIED);
+        }
+    }
+    encryptSigningKey(plain) {
+        const iv = (0, node_crypto_1.randomBytes)(12);
+        const cipher = (0, node_crypto_1.createCipheriv)('aes-256-gcm', this.getEncryptionKey(), iv);
+        const encrypted = Buffer.concat([cipher.update(plain, 'utf8'), cipher.final()]);
+        return [iv.toString('base64'), cipher.getAuthTag().toString('base64'), encrypted.toString('base64')].join('.');
+    }
+    decryptSigningKey(stored) {
+        const [ivB64, tagB64, dataB64] = (stored ?? '').split('.');
+        try {
+            const decipher = (0, node_crypto_1.createDecipheriv)('aes-256-gcm', this.getEncryptionKey(), Buffer.from(ivB64, 'base64'));
+            decipher.setAuthTag(Buffer.from(tagB64, 'base64'));
+            return Buffer.concat([decipher.update(Buffer.from(dataB64, 'base64')), decipher.final()]).toString('utf8');
+        }
+        catch (error) {
+            this.logger.error('Signing key decryption failed — apiTokens.encryptionKey changed or value corrupted');
+            throw new Error('Signing key decryption failed', { cause: error });
+        }
+    }
+    getEncryptionKey() {
+        const secret = (0, core_api_token_helpers_1.resolveApiTokenEncryptionKey)();
+        if (!secret) {
+            if (!this.warnedAboutDevelopmentKey) {
+                this.warnedAboutDevelopmentKey = true;
+                this.logger.warn('No apiTokens.encryptionKey / SECRETS_ENCRYPTION_KEY set — signing keys are encrypted with an insecure ' +
+                    'development default. Never run this in production (the boot refuses it there).');
+            }
+            return (0, node_crypto_1.createHash)('sha256').update('lt-nest-server-api-token-dev-only-insecure-default').digest();
+        }
+        return (0, node_crypto_1.createHash)('sha256').update(secret, 'utf8').digest();
+    }
+    requireKind(kind) {
+        const config = (0, core_api_token_helpers_1.getApiTokenConfig)();
+        if (kind === core_api_token_constants_1.ApiTokenKind.USER ? !config.userTokens : !config.tenantTokens) {
+            throw new common_1.BadRequestException(kind === core_api_token_constants_1.ApiTokenKind.USER
+                ? 'User tokens are not enabled (apiTokens.userTokens)'
+                : 'Tenant tokens are not enabled (apiTokens.tenantTokens, requires multiTenancy)');
+        }
+        return config;
+    }
+    assertPerson(currentUser) {
+        if (!currentUser?.id) {
+            throw new common_1.UnauthorizedException(error_codes_1.ErrorCode.UNAUTHORIZED);
+        }
+        if ((0, core_api_token_helpers_1.getApiTokenContext)(currentUser)) {
+            throw new common_1.ForbiddenException(error_codes_1.ErrorCode.ACCESS_DENIED);
+        }
+    }
+    async issue(document, currentUser) {
+        const config = (0, core_api_token_helpers_1.getApiTokenConfig)();
+        const { publicId, secret, token } = (0, core_api_token_helpers_1.generateApiToken)(config.prefix);
+        const signingKey = (0, core_api_token_helpers_1.generateApiTokenSigningKey)();
+        const created = await this.apiTokenModel.create({
+            ...document,
+            createdBy: String(currentUser.id),
+            publicId,
+            revokedAt: null,
+            secretHash: (0, core_api_token_helpers_1.hashApiTokenSecret)(secret),
+            signingKeyEncrypted: this.encryptSigningKey(signingKey),
+            updatedBy: String(currentUser.id),
+        });
+        return { apiToken: this.toInfo(created.toObject()), signingKey, token };
+    }
+    async list(filter) {
+        const tokens = await this.apiTokenModel.find(filter).sort({ createdAt: -1 }).lean().exec();
+        return tokens.map((token) => this.toInfo(token));
+    }
+    async applyUpdate(filter, $set, currentUser) {
+        const updated = await this.apiTokenModel
+            .findOneAndUpdate(filter, { $set: { ...$set, updatedBy: String(currentUser.id) } }, { returnDocument: 'after' })
+            .lean()
+            .exec();
+        if (!updated) {
+            throw new common_1.NotFoundException('API token not found');
+        }
+        return this.toInfo(updated);
+    }
+    async applyRevoke(filter, currentUser) {
+        const revoked = await this.apiTokenModel
+            .findOneAndUpdate({ ...filter, revokedAt: null }, { $set: { revokedAt: new Date(), updatedBy: String(currentUser.id) } }, { returnDocument: 'after' })
+            .lean()
+            .exec();
+        if (revoked) {
+            return this.toInfo(revoked);
+        }
+        const existing = await this.apiTokenModel.findOne(filter).lean().exec();
+        if (!existing) {
+            throw new common_1.NotFoundException('API token not found');
+        }
+        return this.toInfo(existing);
+    }
+    async applyDelete(filter) {
+        const deleted = await this.apiTokenModel.findOneAndDelete(filter).lean().exec();
+        if (!deleted) {
+            throw new common_1.NotFoundException('API token not found');
+        }
+        return this.toInfo(deleted);
+    }
+    userTokenFilter(tokenId, currentUser) {
+        return { _id: this.objectId(tokenId), kind: core_api_token_constants_1.ApiTokenKind.USER, user: String(currentUser.id) };
+    }
+    tenantTokenFilter(tenantId, tokenId) {
+        return { _id: this.objectId(tokenId), kind: core_api_token_constants_1.ApiTokenKind.TENANT, tenant: tenantId };
+    }
+    objectId(tokenId) {
+        if (typeof tokenId !== 'string' || !/^[0-9a-f]{24}$/i.test(tokenId)) {
+            throw new common_1.NotFoundException('API token not found');
+        }
+        return new mongoose_2.Types.ObjectId(tokenId);
+    }
+    commonUpdate(input, config) {
+        const $set = { ...this.projectFields(input) };
+        if (input?.name !== undefined)
+            $set.name = this.validateName(input.name);
+        if (input?.description !== undefined)
+            $set.description = this.validateDescription(input.description);
+        if (input?.scopes !== undefined)
+            $set.scopes = this.validateScopes(input.scopes, config);
+        if (input?.expiresAt !== undefined)
+            $set.expiresAt = this.validateExpiry(input.expiresAt);
+        return $set;
+    }
+    projectFields(input) {
+        const handled = new Set(['description', 'expiresAt', 'maxTenantRole', 'name', 'scopes', 'tenantId']);
+        return Object.fromEntries(Object.entries(input ?? {}).filter(([key]) => {
+            const segments = key.split('.');
+            return (!PROTECTED_FIELDS.has(segments[0]) &&
+                !handled.has(segments[0]) &&
+                !segments.some((segment) => segment.startsWith('$')));
+        }));
+    }
+    validateName(name) {
+        if (typeof name !== 'string' || !name.trim() || name.trim().length > 200) {
+            throw new common_1.BadRequestException('name must be 1-200 characters');
+        }
+        return name.trim();
+    }
+    validateDescription(description) {
+        if (description === undefined || description === null || description === '') {
+            return null;
+        }
+        if (typeof description !== 'string' || description.length > 1000) {
+            throw new common_1.BadRequestException('description must be a string of at most 1000 characters');
+        }
+        return description;
+    }
+    validateExpiry(expiresAt) {
+        if (expiresAt === undefined || expiresAt === null || expiresAt === '') {
+            return null;
+        }
+        const date = expiresAt instanceof Date ? expiresAt : new Date(expiresAt);
+        if (Number.isNaN(date.getTime()) || date.getTime() <= Date.now()) {
+            throw new common_1.BadRequestException('expiresAt must be a valid date in the future');
+        }
+        return date;
+    }
+    validateScopes(scopes, config) {
+        if (!Array.isArray(scopes) || scopes.some((scope) => typeof scope !== 'string')) {
+            throw new common_1.BadRequestException('scopes must be an array of strings');
+        }
+        const unique = [...new Set(scopes)];
+        if (!unique.length) {
+            throw new common_1.BadRequestException('A token needs at least one scope');
+        }
+        const unknown = unique.filter((scope) => !config.scopes.includes(scope));
+        if (unknown.length) {
+            throw new common_1.BadRequestException(`Unknown scope(s) [${unknown.join(', ')}]; allowed: [${config.scopes.join(', ')}] (apiTokens.scopes)`);
+        }
+        return unique;
+    }
+    async validateUserTokenTenant(tenantId, currentUser, config) {
+        if (tenantId === undefined || tenantId === null || tenantId === '') {
+            return null;
+        }
+        if (!config.multiTenancy || typeof tenantId !== 'string') {
+            throw new common_1.BadRequestException('tenantId requires multiTenancy and must be a string');
+        }
+        const membership = await this.tenantService?.getActiveMembership(tenantId, String(currentUser.id));
+        if (!membership) {
+            throw new common_1.ForbiddenException(error_codes_1.ErrorCode.ACCESS_DENIED);
+        }
+        return tenantId;
+    }
+    validateMaxTenantRole(role, config) {
+        if (role === undefined || role === null || role === '') {
+            return null;
+        }
+        if (!config.multiTenancy || typeof role !== 'string' || !(role in (0, core_tenant_helpers_1.getRoleHierarchy)())) {
+            throw new common_1.BadRequestException(`maxTenantRole must be a role of multiTenancy.roleHierarchy: [${Object.keys((0, core_tenant_helpers_1.getRoleHierarchy)()).join(', ')}]`);
+        }
+        return role;
+    }
+    toInfo(document) {
+        const { __v, _id, secretHash: _secretHash, signingKeyEncrypted: _signingKeyEncrypted, ...rest } = document ?? {};
+        return { ...rest, id: (_id ?? rest.id)?.toString() };
+    }
+};
+exports.CoreApiTokenService = CoreApiTokenService;
+exports.CoreApiTokenService = CoreApiTokenService = CoreApiTokenService_1 = __decorate([
+    (0, common_1.Injectable)(),
+    __param(0, (0, mongoose_1.InjectModel)(core_api_token_constants_1.API_TOKEN_MODEL_TOKEN)),
+    __param(1, (0, common_1.Optional)()),
+    __param(1, (0, mongoose_1.InjectConnection)()),
+    __param(2, (0, common_1.Optional)()),
+    __param(3, (0, common_1.Optional)()),
+    __metadata("design:paramtypes", [mongoose_2.Model,
+        mongoose_2.Connection,
+        core_tenant_service_1.CoreTenantService,
+        core_redis_service_1.CoreRedisService])
+], CoreApiTokenService);
+//# sourceMappingURL=core-api-token.service.js.map

package/dist/core/modules/api-token/core-api-token.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"core-api-token.service.js","sourceRoot":"","sources":["../../../../src/core/modules/api-token/core-api-token.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,6CAAwF;AAExF,2CAUwB;AACxB,+CAAiE;AACjE,uCAAoD;AAEpD,4DAAwD;AACxD,yEAAqE;AACrE,iFAA4E;AAC5E,6EAAqH;AACrH,2DAAsD;AACtD,uEAA+G;AAC/G,uEAAkE;AAClE,yEAAiF;AACjF,qEAmBkC;AAElC,uEAAsF;AAGtF,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC;IAC/B,KAAK;IACL,KAAK;IACL,WAAW;IACX,WAAW;IACX,IAAI;IACJ,MAAM;IACN,YAAY;IACZ,UAAU;IACV,WAAW;IACX,YAAY;IACZ,qBAAqB;IACrB,QAAQ;IACR,WAAW;IACX,WAAW;IACX,MAAM;CACP,CAAC,CAAC;AAGH,MAAM,sBAAsB,GAAG;IAC7B,QAAQ,EAAE,CAAC;IACX,kBAAkB,EAAE,CAAC;IACrB,2BAA2B,EAAE,CAAC;IAC9B,aAAa,EAAE,CAAC;IAChB,UAAU,EAAE,CAAC;IACb,iBAAiB,EAAE,CAAC;CACrB,CAAC;AAsEK,IAAM,mBAAmB,GAAzB,MAAM,mBAAmB;;IAe2B;IACJ;IACpB;IACA;IAjBd,MAAM,GAAG,IAAI,eAAM,CAAC,qBAAmB,CAAC,IAAI,CAAC,CAAC;IAG9C,cAAc,GAAG,IAAI,GAAG,EAAkB,CAAC;IACpD,cAAc,CAAkB;IAClC,yBAAyB,GAAG,KAAK,CAAC;IAClC,cAAc,CAAc;IAG1B,MAAM,CAAU,qBAAqB,GAAG,MAAM,CAAC;IAE/C,MAAM,CAAU,qBAAqB,GAAG,IAAI,CAAC;IAEvD,YACyD,aAAuC,EAC3C,UAAuB,EAC3C,aAAiC,EACjC,YAA+B;QAHP,kBAAa,GAAb,aAAa,CAA0B;QAC3C,eAAU,GAAV,UAAU,CAAa;QAC3C,kBAAa,GAAb,aAAa,CAAoB;QACjC,iBAAY,GAAZ,YAAY,CAAmB;IAC7D,CAAC;IAEJ,YAAY;QACV,IAAA,qDAA4B,GAAE,CAAC;QAG/B,IAAI,CAAC,cAAc,GAAG,IAAA,4CAAkB,EAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC,CAAC;QACzF,MAAM,MAAM,GAAG,IAAA,0CAAiB,GAAE,CAAC;QACnC,IAAI,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACjD,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,yGAAyG;gBACvG,8EAA8E,CACjF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,eAAe;QACb,IAAI,CAAC,cAAc,EAAE,EAAE,CAAC;IAC1B,CAAC;IAeD,KAAK,CAAC,YAAY,CAAC,UAA+B;QAChD,MAAM,MAAM,GAAG,IAAA,0CAAiB,GAAE,CAAC;QACnC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,UAAU,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YAChC,MAAM,MAAM,GAAG,IAAA,sCAAa,EAAC,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;YAC9D,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,OAAO,IAAI,CAAC;YACd,CAAC;YACD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;YAClE,IAAI,CAAC,KAAK,IAAI,CAAC,IAAA,qCAAY,EAAC,IAAA,2CAAkB,EAAC,MAAM,CAAC,MAAM,CAAC,EAAE,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC;gBACjF,OAAO,IAAI,CAAC;YACd,CAAC;YACD,OAAO,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC;QACtC,CAAC;QAED,MAAM,OAAO,GAAG,IAAA,gDAAuB,EAAC,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;QACzE,IAAI,CAAC,OAAO,IAAI,IAAA,qDAA4B,EAAC,OAAO,CAAC,OAAO,EAAE,MAAM,CAAC,2BAA2B,CAAC,KAAK,IAAI,EAAE,CAAC;YAC3G,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QACtE,IAAI,CAAC,KAAK,EAAE,mBAAmB,EAAE,CAAC;YAChC,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,UAAkB,CAAC;QACvB,IAAI,CAAC;YACH,UAAU,GAAG,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC;QACjE,CAAC;QAAC,MAAM,CAAC;YAEP,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,CAAC,IAAA,yDAAgC,EAAC,OAAO,CAAC,cAAc,EAAE,OAAO,CAAC,SAAS,EAAE,UAAU,CAAC,EAAE,CAAC;YAC7F,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,IAAI,CAAC,gBAAgB,CAAC,KAAK,EAAE;YAClC,MAAM,EAAE,OAAO,CAAC,OAAO,CAAC,MAAM;YAC9B,SAAS,EAAE,IAAI,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC;YAC/C,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,KAAK;YAC5B,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG;SAC7B,CAAC,CAAC;IACL,CAAC;IAMD,KAAK,CAAC,gBAAgB,CAAC,OAAe;QACpC,MAAM,EAAE,SAAS,EAAE,GAAG,IAAA,0CAAiB,GAAE,CAAC;QAC1C,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC,GAAG,CAAC,OAAO,EAAE,SAAS,CAAC,aAAa,CAAC,CAAC;QAChG,OAAO,KAAK,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IAC7F,CAAC;IAGD,aAAa,CAAC,OAAe;QAC3B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,IAAI,GAAG,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC9C,IAAI,IAAI,KAAK,SAAS,IAAI,GAAG,GAAG,IAAI,GAAG,qBAAmB,CAAC,qBAAqB,EAAE,CAAC;YACjF,OAAO;QACT,CAAC;QACD,IAAI,IAAI,CAAC,cAAc,CAAC,IAAI,IAAI,qBAAmB,CAAC,qBAAqB,EAAE,CAAC;YAC1E,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,CAAC;QAC9B,CAAC;QACD,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QACtC,IAAI,CAAC,aAAa;aACf,SAAS,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,UAAU,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;aAC3F,IAAI,EAAE;aACN,KAAK,CAAC,CAAC,KAAY,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,6BAA6B,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;IAC9F,CAAC;IAGS,KAAK,CAAC,eAAe,CAC7B,QAAgB,EAChB,MAA+B;QAE/B,MAAM,KAAK,GAAG,CAAC,MAAM,IAAI,CAAC,aAAa;aACpC,OAAO,CAAC,EAAE,QAAQ,EAAE,CAAC;aACrB,MAAM,CAAC,kCAAkC,CAAC;aAC1C,IAAI,EAAE;aACN,IAAI,EAAE,CAAyD,CAAC;QACnE,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,SAAS,IAAI,CAAC,KAAK,CAAC,SAAS,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC;YACxG,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IACE,KAAK,CAAC,IAAI,KAAK,uCAAY,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,YAAY,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,IAAI,CAAC,KAAK,CAAC,IAAI,EAC9G,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,EAAE,GAAG,KAAK,EAAE,EAAE,EAAE,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAuB,CAAC;IACrE,CAAC;IAGS,KAAK,CAAC,gBAAgB,CAC9B,KAAwB,EACxB,SAAyC;QAEzC,MAAM,OAAO,GAAmC;YAC9C,SAAS;YACT,aAAa,EAAE,KAAK,CAAC,aAAa,IAAI,SAAS;YAC/C,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,EAAE;YAC1B,QAAQ,EAAE,KAAK,CAAC,MAAM,IAAI,SAAS;YACnC,OAAO,EAAE,KAAK,CAAC,EAAE;YACjB,MAAM,EAAE,KAAK,CAAC,IAAI,IAAI,SAAS;SAChC,CAAC;QAEF,IAAI,KAAK,CAAC,IAAI,KAAK,uCAAY,CAAC,MAAM,EAAE,CAAC;YACvC,OAAO,IAAA,sDAA6B,EAAC,EAAE,GAAG,OAAO,EAAE,QAAQ,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;QAC/E,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAClD,OAAO,IAAI,CAAC,CAAC,CAAC,IAAA,8CAAqB,EAAC,IAAI,EAAE,EAAE,GAAG,OAAO,EAAE,IAAI,EAAE,uCAAY,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC5F,CAAC;IAWS,KAAK,CAAC,aAAa,CAAC,MAAc;QAC1C,IAAI,CAAC,IAAI,CAAC,UAAU,IAAI,CAAC,MAAM,IAAI,CAAC,gBAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YACnE,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,UAAU;aAC9B,UAAU,CAAC,OAAO,CAAC;aACnB,OAAO,CAAC,EAAE,GAAG,EAAE,IAAI,gBAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,UAAU,EAAE,sBAAsB,EAAE,CAAC,CAAC;QACxF,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,KAAK,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,CAC9D,CAAC,IAAa,EAAkB,EAAE,CAChC,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAA,iDAA2B,EAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,CACtF,CAAC;QACF,OAAO;YACL,GAAG,GAAG;YACN,OAAO,EAAE,CAAC,QAA2B,EAAW,EAAE,CAChD,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YACxF,EAAE,EAAE,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE;YACtB,KAAK;SACN,CAAC;IACJ,CAAC;IAES,iBAAiB;QACzB,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;YACzB,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC,YAAY,EAAE,OAAO;gBAC9C,CAAC,CAAC,IAAI,sCAAmB,CAAC,IAAI,CAAC,YAAY,EAAE,WAAW,CAAC;gBACzD,CAAC,CAAC,IAAI,yCAAsB,CAAC,MAAM,CAAC,CAAC;QACzC,CAAC;QACD,OAAO,IAAI,CAAC,cAAc,CAAC;IAC7B,CAAC;IAOD,KAAK,CAAC,eAAe,CAAC,KAA+B,EAAE,WAAgB;QACrE,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,uCAAY,CAAC,IAAI,CAAC,CAAC;QACnD,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC;QAE/B,MAAM,MAAM,GAAG,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,MAAM,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAC3E,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,KAAK,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,CAAC,CAAC;QAC1F,MAAM,aAAa,GAAG,IAAI,CAAC,qBAAqB,CAAC,KAAK,EAAE,aAAa,EAAE,MAAM,CAAC,CAAC;QAE/E,OAAO,IAAI,CAAC,KAAK,CACf;YACE,GAAG,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC;YAC5B,WAAW,EAAE,IAAI,CAAC,mBAAmB,CAAC,KAAK,EAAE,WAAW,CAAC;YACzD,SAAS,EAAE,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,SAAS,CAAC;YAChD,IAAI,EAAE,uCAAY,CAAC,IAAI;YACvB,aAAa;YACb,IAAI,EAAE,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,IAAI,CAAC;YACpC,MAAM;YACN,MAAM,EAAE,QAAQ;YAChB,IAAI,EAAE,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC;SAC7B,EACD,WAAW,CACZ,CAAC;IACJ,CAAC;IAGD,KAAK,CAAC,cAAc,CAAC,WAAgB;QACnC,IAAI,CAAC,WAAW,CAAC,uCAAY,CAAC,IAAI,CAAC,CAAC;QACpC,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC;QAC/B,OAAO,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,uCAAY,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IAC9E,CAAC;IAGD,KAAK,CAAC,eAAe,CAAC,OAAe,EAAE,KAA2B,EAAE,WAAgB;QAClF,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,uCAAY,CAAC,IAAI,CAAC,CAAC;QACnD,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC;QAC/B,MAAM,MAAM,GAAG,IAAI,CAAC,eAAe,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;QAC1D,MAAM,IAAI,GAA4B,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QACvE,IAAI,KAAK,EAAE,QAAQ,KAAK,SAAS,EAAE,CAAC;YAClC,IAAI,CAAC,MAAM,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,KAAK,CAAC,QAAQ,EAAE,WAAW,EAAE,MAAM,CAAC,CAAC;QACxF,CAAC;QACD,IAAI,KAAK,EAAE,aAAa,KAAK,SAAS,EAAE,CAAC;YACvC,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,qBAAqB,CAAC,KAAK,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;QAC/E,CAAC;QACD,OAAO,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,IAAI,EAAE,WAAW,CAAC,CAAC;IACrD,CAAC;IAGD,KAAK,CAAC,eAAe,CAAC,OAAe,EAAE,WAAgB;QACrD,IAAI,CAAC,WAAW,CAAC,uCAAY,CAAC,IAAI,CAAC,CAAC;QACpC,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC;QAC/B,OAAO,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,eAAe,CAAC,OAAO,EAAE,WAAW,CAAC,EAAE,WAAW,CAAC,CAAC;IACnF,CAAC;IAGD,KAAK,CAAC,eAAe,CAAC,OAAe,EAAE,WAAgB;QACrD,IAAI,CAAC,WAAW,CAAC,uCAAY,CAAC,IAAI,CAAC,CAAC;QACpC,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC;QAC/B,OAAO,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,eAAe,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,CAAC;IACtE,CAAC;IAMD,KAAK,CAAC,gBAAgB,CAAC,MAAc;QACnC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa;aACpC,UAAU,CACT,EAAE,IAAI,EAAE,uCAAY,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,EAClE,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE,EAAE,CACpC;aACA,IAAI,EAAE,CAAC;QACV,OAAO,MAAM,CAAC,aAAa,IAAI,CAAC,CAAC;IACnC,CAAC;IAOD,KAAK,CAAC,iBAAiB,CAAC,QAA+B;QACrD,IAAI,MAAM,GAAG,QAAQ,EAAE,MAAM,CAAC;QAC9B,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,UAAU,IAAI,CAAC,QAAQ,EAAE,KAAK,IAAI,QAAQ,EAAE,KAAK,CAAC,EAAE,CAAC;YACvE,MAAM,EAAE,GAA6B,EAAE,CAAC;YACxC,IAAI,QAAQ,CAAC,KAAK;gBAAE,EAAE,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC;YACvD,IAAI,QAAQ,CAAC,KAAK;gBAAE,EAAE,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC;YACvD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;YACvG,MAAM,GAAG,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC;QAChC,CAAC;QACD,OAAO,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACpD,CAAC;IAGD,KAAK,CAAC,gBAAgB,CAAC,MAAc;QACnC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,EAAE,IAAI,EAAE,uCAAY,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAC7G,OAAO,MAAM,CAAC,YAAY,IAAI,CAAC,CAAC;IAClC,CAAC;IAOD,KAAK,CAAC,iBAAiB,CACrB,QAAgB,EAChB,KAAiC,EACjC,WAAgB;QAEhB,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,uCAAY,CAAC,MAAM,CAAC,CAAC;QACrD,MAAM,IAAI,CAAC,qBAAqB,CAAC,QAAQ,EAAE,WAAW,EAAE,MAAM,CAAC,CAAC;QAChE,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;YAC3B,MAAM,IAAI,4BAAmB,CAAC,yCAAyC,CAAC,CAAC;QAC3E,CAAC;QAED,OAAO,IAAI,CAAC,KAAK,CACf;YACE,GAAG,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC;YAC5B,WAAW,EAAE,IAAI,CAAC,mBAAmB,CAAC,KAAK,CAAC,WAAW,CAAC;YACxD,SAAS,EAAE,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,SAAS,CAAC;YAC/C,IAAI,EAAE,uCAAY,CAAC,MAAM;YACzB,IAAI,EAAE,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC;YACnC,MAAM,EAAE,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC;YACjD,MAAM,EAAE,QAAQ;SACjB,EACD,WAAW,CACZ,CAAC;IACJ,CAAC;IAGD,KAAK,CAAC,gBAAgB,CAAC,QAAgB,EAAE,WAAgB;QACvD,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,uCAAY,CAAC,MAAM,CAAC,CAAC;QACrD,MAAM,IAAI,CAAC,qBAAqB,CAAC,QAAQ,EAAE,WAAW,EAAE,MAAM,CAAC,CAAC;QAChE,OAAO,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,uCAAY,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;IACpE,CAAC;IAGD,KAAK,CAAC,iBAAiB,CACrB,QAAgB,EAChB,OAAe,EACf,KAA2B,EAC3B,WAAgB;QAEhB,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,uCAAY,CAAC,MAAM,CAAC,CAAC;QACrD,MAAM,IAAI,CAAC,qBAAqB,CAAC,QAAQ,EAAE,WAAW,EAAE,MAAM,CAAC,CAAC;QAChE,IAAI,KAAK,EAAE,QAAQ,KAAK,SAAS,IAAI,KAAK,EAAE,aAAa,KAAK,SAAS,EAAE,CAAC;YACxE,MAAM,IAAI,4BAAmB,CAAC,sDAAsD,CAAC,CAAC;QACxF,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAC9C,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;YACtD,MAAM,IAAI,4BAAmB,CAAC,yCAAyC,CAAC,CAAC;QAC3E,CAAC;QACD,OAAO,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,iBAAiB,CAAC,QAAQ,EAAE,OAAO,CAAC,EAAE,IAAI,EAAE,WAAW,CAAC,CAAC;IACxF,CAAC;IAGD,KAAK,CAAC,iBAAiB,CAAC,QAAgB,EAAE,OAAe,EAAE,WAAgB;QACzE,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,uCAAY,CAAC,MAAM,CAAC,CAAC;QACrD,MAAM,IAAI,CAAC,qBAAqB,CAAC,QAAQ,EAAE,WAAW,EAAE,MAAM,CAAC,CAAC;QAChE,OAAO,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,iBAAiB,CAAC,QAAQ,EAAE,OAAO,CAAC,EAAE,WAAW,CAAC,CAAC;IAClF,CAAC;IAGD,KAAK,CAAC,iBAAiB,CAAC,QAAgB,EAAE,OAAe,EAAE,WAAgB;QACzE,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,uCAAY,CAAC,MAAM,CAAC,CAAC;QACrD,MAAM,IAAI,CAAC,qBAAqB,CAAC,QAAQ,EAAE,WAAW,EAAE,MAAM,CAAC,CAAC;QAChE,OAAO,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,iBAAiB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;IACrE,CAAC;IAOD,KAAK,CAAC,kBAAkB,CAAC,QAAgB;QACvC,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,EAAE,CAAC;YACtB,MAAM,IAAI,4BAAmB,CAAC,4BAA4B,CAAC,CAAC;QAC9D,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAChF,OAAO,MAAM,CAAC,YAAY,IAAI,CAAC,CAAC;IAClC,CAAC;IAMD,KAAK,CAAC,qBAAqB,CAAC,QAAgB,EAAE,WAAgB,EAAE,MAAM,GAAG,IAAA,0CAAiB,GAAE;QAC1F,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,EAAE,CAAC;YACtB,MAAM,IAAI,4BAAmB,CAAC,4BAA4B,CAAC,CAAC;QAC9D,CAAC;QACD,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC;QAE/B,MAAM,WAAW,GAAG,8BAAa,CAAC,qBAAqB,EAAE,YAAY,EAAE,WAAW,KAAK,KAAK,CAAC;QAC7F,IAAI,WAAW,IAAI,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,KAAK,CAAC,IAAI,WAAW,CAAC,KAAK,CAAC,QAAQ,CAAC,oBAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YAClG,OAAO;QACT,CAAC;QAED,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,aAAa,EAAE,mBAAmB,CAAC,QAAQ,EAAE,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC;QACnG,IAAI,CAAC,UAAU,IAAI,CAAC,IAAA,qCAAe,EAAC,CAAC,IAAA,8CAAqB,EAAC,MAAM,CAAC,CAAC,EAAE,SAAS,EAAE,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACjG,MAAM,IAAI,2BAAkB,CAAC,uBAAS,CAAC,aAAa,CAAC,CAAC;QACxD,CAAC;IACH,CAAC;IAOS,iBAAiB,CAAC,KAAa;QACvC,MAAM,EAAE,GAAG,IAAA,yBAAW,EAAC,EAAE,CAAC,CAAC;QAC3B,MAAM,MAAM,GAAG,IAAA,4BAAc,EAAC,aAAa,EAAE,IAAI,CAAC,gBAAgB,EAAE,EAAE,EAAE,CAAC,CAAC;QAC1E,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QAChF,OAAO,CAAC,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACjH,CAAC;IAGS,iBAAiB,CAAC,MAAc;QACxC,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC3D,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,IAAA,8BAAgB,EAAC,aAAa,EAAE,IAAI,CAAC,gBAAgB,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC;YACxG,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;YACnD,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC7G,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,oFAAoF,CAAC,CAAC;YACxG,MAAM,IAAI,KAAK,CAAC,+BAA+B,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QACrE,CAAC;IACH,CAAC;IAGS,gBAAgB;QACxB,MAAM,MAAM,GAAG,IAAA,qDAA4B,GAAE,CAAC;QAC9C,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,IAAI,CAAC,IAAI,CAAC,yBAAyB,EAAE,CAAC;gBACpC,IAAI,CAAC,yBAAyB,GAAG,IAAI,CAAC;gBACtC,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,wGAAwG;oBACtG,gFAAgF,CACnF,CAAC;YACJ,CAAC;YACD,OAAO,IAAA,wBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,oDAAoD,CAAC,CAAC,MAAM,EAAE,CAAC;QACpG,CAAC;QACD,OAAO,IAAA,wBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC;IAC9D,CAAC;IAMS,WAAW,CAAC,IAAkB;QACtC,MAAM,MAAM,GAAG,IAAA,0CAAiB,GAAE,CAAC;QACnC,IAAI,IAAI,KAAK,uCAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC;YAC3E,MAAM,IAAI,4BAAmB,CAC3B,IAAI,KAAK,uCAAY,CAAC,IAAI;gBACxB,CAAC,CAAC,oDAAoD;gBACtD,CAAC,CAAC,+EAA+E,CACpF,CAAC;QACJ,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAGS,YAAY,CAAC,WAAgB;QACrC,IAAI,CAAC,WAAW,EAAE,EAAE,EAAE,CAAC;YACrB,MAAM,IAAI,8BAAqB,CAAC,uBAAS,CAAC,YAAY,CAAC,CAAC;QAC1D,CAAC;QACD,IAAI,IAAA,2CAAkB,EAAC,WAAW,CAAC,EAAE,CAAC;YACpC,MAAM,IAAI,2BAAkB,CAAC,uBAAS,CAAC,aAAa,CAAC,CAAC;QACxD,CAAC;IACH,CAAC;IAES,KAAK,CAAC,KAAK,CAAC,QAAiC,EAAE,WAAgB;QACvE,MAAM,MAAM,GAAG,IAAA,0CAAiB,GAAE,CAAC;QACnC,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,IAAA,yCAAgB,EAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACpE,MAAM,UAAU,GAAG,IAAA,mDAA0B,GAAE,CAAC;QAChD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC;YAC9C,GAAG,QAAQ;YACX,SAAS,EAAE,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC;YACjC,QAAQ;YACR,SAAS,EAAE,IAAI;YACf,UAAU,EAAE,IAAA,2CAAkB,EAAC,MAAM,CAAC;YACtC,mBAAmB,EAAE,IAAI,CAAC,iBAAiB,CAAC,UAAU,CAAC;YACvD,SAAS,EAAE,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC;SAClC,CAAC,CAAC;QACH,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;IAC1E,CAAC;IAES,KAAK,CAAC,IAAI,CAAC,MAA+B;QAClD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC;QAC3F,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IACnD,CAAC;IAES,KAAK,CAAC,WAAW,CACzB,MAA+B,EAC/B,IAA6B,EAC7B,WAAgB;QAEhB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,aAAa;aACrC,gBAAgB,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,EAAE,GAAG,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,cAAc,EAAE,OAAO,EAAE,CAAC;aAC/G,IAAI,EAAE;aACN,IAAI,EAAE,CAAC;QACV,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,0BAAiB,CAAC,qBAAqB,CAAC,CAAC;QACrD,CAAC;QACD,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC9B,CAAC;IAES,KAAK,CAAC,WAAW,CAAC,MAA+B,EAAE,WAAgB;QAC3E,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,aAAa;aACrC,gBAAgB,CACf,EAAE,GAAG,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,EAC9B,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE,SAAS,EAAE,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,EAAE,EAAE,EACtE,EAAE,cAAc,EAAE,OAAO,EAAE,CAC5B;aACA,IAAI,EAAE;aACN,IAAI,EAAE,CAAC;QACV,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAC9B,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC;QACxE,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,0BAAiB,CAAC,qBAAqB,CAAC,CAAC;QACrD,CAAC;QACD,OAAO,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC/B,CAAC;IAES,KAAK,CAAC,WAAW,CAAC,MAA+B;QACzD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC;QAChF,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,0BAAiB,CAAC,qBAAqB,CAAC,CAAC;QACrD,CAAC;QACD,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC9B,CAAC;IAES,eAAe,CAAC,OAAe,EAAE,WAAgB;QACzD,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,uCAAY,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,EAAE,CAAC;IAChG,CAAC;IAES,iBAAiB,CAAC,QAAgB,EAAE,OAAe;QAC3D,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,uCAAY,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;IACtF,CAAC;IAGS,QAAQ,CAAC,OAAe;QAChC,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YACpE,MAAM,IAAI,0BAAiB,CAAC,qBAAqB,CAAC,CAAC;QACrD,CAAC;QACD,OAAO,IAAI,gBAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IACrC,CAAC;IAES,YAAY,CAAC,KAA2B,EAAE,MAA+B;QACjF,MAAM,IAAI,GAA4B,EAAE,GAAG,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;QACvE,IAAI,KAAK,EAAE,IAAI,KAAK,SAAS;YAAE,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACzE,IAAI,KAAK,EAAE,WAAW,KAAK,SAAS;YAAE,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,mBAAmB,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QACrG,IAAI,KAAK,EAAE,MAAM,KAAK,SAAS;YAAE,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACzF,IAAI,KAAK,EAAE,SAAS,KAAK,SAAS;YAAE,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAC1F,OAAO,IAAI,CAAC;IACd,CAAC;IAQS,aAAa,CAAC,KAA0C;QAChE,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,CAAC,aAAa,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC;QACrG,OAAO,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE;YAC3C,MAAM,QAAQ,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAChC,OAAO,CACL,CAAC,gBAAgB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;gBAClC,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;gBACzB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CACrD,CAAC;QACJ,CAAC,CAAC,CACH,CAAC;IACJ,CAAC;IAES,YAAY,CAAC,IAAa;QAClC,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;YACzE,MAAM,IAAI,4BAAmB,CAAC,+BAA+B,CAAC,CAAC;QACjE,CAAC;QACD,OAAO,IAAI,CAAC,IAAI,EAAE,CAAC;IACrB,CAAC;IAES,mBAAmB,CAAC,WAAoB;QAChD,IAAI,WAAW,KAAK,SAAS,IAAI,WAAW,KAAK,IAAI,IAAI,WAAW,KAAK,EAAE,EAAE,CAAC;YAC5E,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,OAAO,WAAW,KAAK,QAAQ,IAAI,WAAW,CAAC,MAAM,GAAG,IAAI,EAAE,CAAC;YACjE,MAAM,IAAI,4BAAmB,CAAC,yDAAyD,CAAC,CAAC;QAC3F,CAAC;QACD,OAAO,WAAW,CAAC;IACrB,CAAC;IAES,cAAc,CAAC,SAAkB;QACzC,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,KAAK,IAAI,IAAI,SAAS,KAAK,EAAE,EAAE,CAAC;YACtE,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,IAAI,GAAG,SAAS,YAAY,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,SAAmB,CAAC,CAAC;QACnF,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YACjE,MAAM,IAAI,4BAAmB,CAAC,8CAA8C,CAAC,CAAC;QAChF,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAES,cAAc,CAAC,MAAe,EAAE,MAA+B;QACvE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,EAAE,CAAC;YAChF,MAAM,IAAI,4BAAmB,CAAC,oCAAoC,CAAC,CAAC;QACtE,CAAC;QACD,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,MAAkB,CAAC,CAAC,CAAC;QAChD,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;YACnB,MAAM,IAAI,4BAAmB,CAAC,kCAAkC,CAAC,CAAC;QACpE,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;QACzE,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YACnB,MAAM,IAAI,4BAAmB,CAC3B,qBAAqB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,sBAAsB,CACtG,CAAC;QACJ,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAGS,KAAK,CAAC,uBAAuB,CACrC,QAAiB,EACjB,WAAgB,EAChB,MAA+B;QAE/B,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,IAAI,IAAI,QAAQ,KAAK,EAAE,EAAE,CAAC;YACnE,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,YAAY,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;YACzD,MAAM,IAAI,4BAAmB,CAAC,qDAAqD,CAAC,CAAC;QACvF,CAAC;QACD,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,aAAa,EAAE,mBAAmB,CAAC,QAAQ,EAAE,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC;QACnG,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,IAAI,2BAAkB,CAAC,uBAAS,CAAC,aAAa,CAAC,CAAC;QACxD,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAGS,qBAAqB,CAAC,IAAa,EAAE,MAA+B;QAC5E,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,EAAE,EAAE,CAAC;YACvD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,YAAY,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,IAAI,IAAA,sCAAgB,GAAE,CAAC,EAAE,CAAC;YACtF,MAAM,IAAI,4BAAmB,CAC3B,gEAAgE,MAAM,CAAC,IAAI,CAAC,IAAA,sCAAgB,GAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAC9G,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAGS,MAAM,CAAC,QAA6B;QAC5C,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,UAAU,EAAE,WAAW,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,GAAG,IAAI,EAAE,GAAG,QAAQ,IAAI,EAAE,CAAC;QACjH,OAAO,EAAE,GAAG,IAAI,EAAE,EAAE,EAAE,CAAC,GAAG,IAAI,IAAI,CAAC,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAkB,CAAC;IACvE,CAAC;;AApqBU,kDAAmB;8BAAnB,mBAAmB;IAD/B,IAAA,mBAAU,GAAE;IAgBR,WAAA,IAAA,sBAAW,EAAC,gDAAqB,CAAC,CAAA;IAClC,WAAA,IAAA,iBAAQ,GAAE,CAAA;IAAE,WAAA,IAAA,2BAAgB,GAAE,CAAA;IAC9B,WAAA,IAAA,iBAAQ,GAAE,CAAA;IACV,WAAA,IAAA,iBAAQ,GAAE,CAAA;qCAH2D,gBAAK;QACX,qBAAU;QAC3B,uCAAiB;QAClB,qCAAgB;GAlBrD,mBAAmB,CAqqB/B"}

package/dist/core/modules/auth/guards/roles.guard.js

@@ -20,6 +20,8 @@ const graphql_1 = require("@nestjs/graphql");
 const execution_context_request_helper_1 = require("../../../common/helpers/execution-context-request.helper");
 const rxjs_1 = require("rxjs");
 const role_enum_1 = require("../../../common/enums/role.enum");
+const core_api_token_constants_1 = require("../../api-token/core-api-token.constants");
+const core_api_token_helpers_1 = require("../../api-token/core-api-token.helpers");
 const better_auth_token_service_1 = require("../../better-auth/better-auth-token.service");
 const core_better_auth_service_1 = require("../../better-auth/core-better-auth.service");
 const error_code_1 = require("../../error-code");
@@ -84,6 +86,20 @@ let RolesGuard = RolesGuard_1 = class RolesGuard extends (0, auth_guard_1.AuthGu
         if (roles && roles.includes(role_enum_1.RoleEnum.S_NO_ONE)) {
             throw new common_1.ForbiddenException(error_code_1.ErrorCode.ACCESS_DENIED);
         }
+        const apiTokenKind = (0, core_api_token_helpers_1.enforceApiTokenRoute)({
+            controllerClass: context.getClass(),
+            handler: context.getHandler(),
+            request: this.getRequest(context),
+        });
+        if (apiTokenKind === core_api_token_constants_1.ApiTokenKind.TENANT) {
+            return true;
+        }
+        if (apiTokenKind === core_api_token_constants_1.ApiTokenKind.USER) {
+            if (roles.some((value) => !!value) && !roles.includes(role_enum_1.RoleEnum.S_EVERYONE)) {
+                this.handleRequest(null, this.getRequest(context).user, null, context);
+            }
+            return true;
+        }
         if (!roles || !roles.some((value) => !!value) || roles.includes(role_enum_1.RoleEnum.S_EVERYONE)) {
             await this.tryIdentifyOptionalUser(context);
             return true;
@@ -184,7 +200,7 @@ let RolesGuard = RolesGuard_1 = class RolesGuard extends (0, auth_guard_1.AuthGu
             if ((user && roles.includes(role_enum_1.RoleEnum.S_USER)) || roles.includes(role_enum_1.RoleEnum.S_EVERYONE)) {
                 return user;
             }
-            if (user && (0, core_tenant_helpers_1.isMultiTenancyActive)() && roles.some((r) => !(0, core_tenant_helpers_1.isSystemRole)(r))) {
+            if (user && (0, core_tenant_helpers_1.delegatesRolesToTenantGuard)() && roles.some((r) => !(0, core_tenant_helpers_1.isSystemRole)(r))) {
                 return user;
             }
             if (!user) {