@marinoscar/platform-api 0.0.0-stage → 0.1.0-next.4

package/dist/identity/auth/principal.factory.js

@@ -0,0 +1,247 @@
+"use strict";
+// =============================================================================
+// PrincipalFactory: effective roles and permissions (issue #723, PP-6.3)
+// =============================================================================
+//
+// RBAC is split into SYSTEM roles (held in `user_roles`; they operate the
+// deployment) and ORG roles (held on a membership, `memberships.role_id`; they
+// operate one organization). A user's effective access is
+//
+//   permissions = (grants of every system role)
+//               ∪ (grants of the role on the CURRENT-ORG membership)
+//   roles       = system role names + the current org role name
+//
+// This file is the ONE place that rule is written. The guards (through
+// `toRequestUser`), `/api/auth/me` (`AuthService.getCurrentUser`) and the users
+// list all read it, so they cannot disagree.
+//
+// "Current org" (#724): the ACTIVE ORG the credential is bound to, when the
+// caller knows it (`PrincipalSource.activeOrgId`):
+//   - a string: that org's membership, if it is active (the access token's
+//     `org` claim, a PAT's or device session's `orgId`);
+//   - `null`: no org at all (a node credential is system-scoped).
+// When it is not known (`undefined`: a graph loaded outside a request), the
+// sign-in rule picks it, the same rule `AuthService` uses to choose the org
+// a new access token is issued for:
+//   - single mode: the default organization's membership;
+//   - multi mode: the active membership with the latest `lastActiveAt`
+//     (ties: the oldest membership).
+// A suspended membership contributes nothing; no membership contributes
+// nothing.
+//
+// Loading: every credential path (JWT, PAT, node) loads the user with
+// `PRINCIPAL_USER_INCLUDE`, one shared constant, so the three cannot drift
+// into loading different graphs. The JWT path keeps that graph in the
+// principal cache (#683); the factory derives from it on every request, so a
+// cached entry and a fresh read give the same answer.
+//
+// Compatibility: grants of ANY role in `user_roles` count, whatever its scope.
+// After migration 0024 that table holds system roles only, but a row an older
+// writer left behind keeps working rather than silently stopping.
+// =============================================================================
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.principalFactory = exports.PrincipalFactory = exports.PRINCIPAL_USER_INCLUDE = void 0;
+exports.selectCurrentMembership = selectCurrentMembership;
+exports.resolveEffectiveAccess = resolveEffectiveAccess;
+exports.toPrincipal = toPrincipal;
+const common_1 = require("@nestjs/common");
+const index_1 = require("../../core/index");
+const tenancy_mode_1 = require("./tenancy-mode");
+/** The role graph a principal needs: the role and the names of its permissions. */
+const PRINCIPAL_ROLE_INCLUDE = {
+    rolePermissions: { include: { permission: true } },
+};
+/**
+ * What every credential path loads with the user: system roles with their
+ * permissions, and every membership with its organization's default flag and
+ * its org role's permissions. Shared by `AuthService.validateJwtPayload`,
+ * `PatService.resolveToken` and `NodeCredentialService.validateToken`; one
+ * extra join per authenticated request, absorbed by the principal cache on
+ * the JWT path.
+ *
+ * @internal
+ */
+exports.PRINCIPAL_USER_INCLUDE = {
+    userRoles: { include: { role: { include: PRINCIPAL_ROLE_INCLUDE } } },
+    memberships: {
+        include: {
+            org: { select: { id: true, isDefault: true } },
+            role: { include: PRINCIPAL_ROLE_INCLUDE },
+        },
+    },
+};
+/** Most recent `lastActiveAt` first (never-used last), then the oldest membership. */
+function byRecency(a, b) {
+    const at = a.lastActiveAt?.getTime() ?? Number.NEGATIVE_INFINITY;
+    const bt = b.lastActiveAt?.getTime() ?? Number.NEGATIVE_INFINITY;
+    if (at !== bt)
+        return bt - at;
+    return (a.createdAt?.getTime() ?? 0) - (b.createdAt?.getTime() ?? 0);
+}
+/**
+ * The membership whose role counts: see the file header for the rule.
+ *
+ * @param activeOrgId - the org the credential is bound to: a string selects
+ *   that org's membership, `null` selects none (system-scoped), `undefined`
+ *   applies the sign-in rule for `mode`.
+ * @returns the membership, or `null` when there is none or it is suspended.
+ *
+ * @internal
+ */
+function selectCurrentMembership(memberships, mode, activeOrgId) {
+    if (activeOrgId === null)
+        return null;
+    if (!memberships || memberships.length === 0)
+        return null;
+    if (activeOrgId !== undefined) {
+        const membership = memberships.find((candidate) => candidate.orgId === activeOrgId);
+        return membership && membership.status === 'active' ? membership : null;
+    }
+    if (mode === 'single') {
+        const membership = memberships.find((candidate) => candidate.org?.isDefault === true);
+        return membership && membership.status === 'active' ? membership : null;
+    }
+    const active = memberships.filter((candidate) => candidate.status === 'active');
+    return [...active].sort(byRecency)[0] ?? null;
+}
+/**
+ * The effective roles and permissions of a loaded user. Pure.
+ *
+ * @param user - loaded with {@link PRINCIPAL_USER_INCLUDE} (or a narrower graph).
+ * @param mode - the deployment's tenancy mode.
+ *
+ * @internal
+ */
+function resolveEffectiveAccess(user, mode) {
+    const systemRoles = user.userRoles.map((userRole) => userRole.role.name);
+    const membership = selectCurrentMembership(user.memberships, mode, user.activeOrgId);
+    const orgRole = membership?.role.name ?? null;
+    const permissions = new Set();
+    for (const userRole of user.userRoles) {
+        for (const grant of userRole.role.rolePermissions ?? [])
+            permissions.add(grant.permission.name);
+    }
+    for (const grant of membership?.role.rolePermissions ?? [])
+        permissions.add(grant.permission.name);
+    const roles = [...new Set(orgRole ? [...systemRoles, orgRole] : systemRoles)];
+    return { systemRoles, membership, orgRole, roles, permissions: [...permissions] };
+}
+/**
+ * Builds effective access and `Principal` values (the #687 contract) from a
+ * loaded user. Stateless; the tenancy mode is read per call. Injectable for
+ * services, and available as {@link principalFactory} for the pure call sites
+ * (`toRequestUser` in the guards).
+ *
+ * @internal
+ */
+let PrincipalFactory = class PrincipalFactory {
+    /** The tenancy mode the current-org rule uses (recorded by `TenancyService` at startup). */
+    mode() {
+        return (0, tenancy_mode_1.currentTenancyMode)();
+    }
+    /** Effective roles and permissions; see {@link resolveEffectiveAccess}. */
+    access(user) {
+        return resolveEffectiveAccess(user, this.mode());
+    }
+    /**
+     * A `UserPrincipal` for a human caller (#724). `activeOrgId` is the org the
+     * credential is bound to (or, for a graph without one, the sign-in rule's
+     * pick); `roles` carries the system role names plus that org's role name;
+     * `memberships` every membership, suspended ones included, with its org
+     * role and status; `groups` is empty until groups exist (PP-7).
+     */
+    forUser(user, credential) {
+        const access = this.access(user);
+        const activeOrgId = typeof user.activeOrgId === 'string' ? user.activeOrgId : access.membership?.orgId;
+        return {
+            kind: 'user',
+            userId: user.id,
+            email: user.email,
+            credential,
+            roles: access.roles,
+            permissions: access.permissions,
+            ...(activeOrgId ? { activeOrgId } : {}),
+            ...(user.memberships ? { memberships: listMemberships(user.memberships) } : {}),
+            groups: [],
+        };
+    }
+    /**
+     * A `NodePrincipal`: system-scoped (ADR 0001, #724). No active
+     * organization, so only the owning user's SYSTEM grants count; no org role
+     * contributes, whatever `user.activeOrgId` says.
+     */
+    forNode(user, nodeId) {
+        const access = this.access({ ...user, activeOrgId: null });
+        return {
+            kind: 'node',
+            userId: user.id,
+            email: user.email,
+            credential: 'node',
+            roles: access.roles,
+            permissions: access.permissions,
+            ...(nodeId ? { nodeId } : {}),
+        };
+    }
+};
+exports.PrincipalFactory = PrincipalFactory;
+exports.PrincipalFactory = PrincipalFactory = __decorate([
+    (0, common_1.Injectable)()
+], PrincipalFactory);
+function listMemberships(memberships) {
+    return memberships.map((membership) => ({
+        orgId: membership.orgId,
+        role: membership.role.name,
+        status: membership.status,
+    }));
+}
+/**
+ * The shared, stateless instance for call sites without dependency injection.
+ *
+ * @internal
+ */
+exports.principalFactory = new PrincipalFactory();
+/**
+ * The runtime mapper ADR 0001 specifies (#724): the request's `Principal`
+ * from the loaded user graph and the credential kind `JwtAuthGuard` admitted
+ * it with. A node credential yields a system-scoped `NodePrincipal` (no
+ * `activeOrgId`); every other kind a `UserPrincipal` bound to
+ * `user.activeOrgId`.
+ *
+ * DEFAULT DENY (PP-14.14). The credential kind must be registered
+ * (`registerCredentialKind`) and map to the `user` principal kind (or be the
+ * platform's own `node`); anything else is refused with a 401 and the reason
+ * is not echoed. A custom credential kind therefore never becomes a
+ * `NodePrincipal`, and an unregistered one never becomes any principal.
+ *
+ * @throws UnauthorizedException for an unregistered credential kind, or one
+ *   whose principal kind has no factory here (an app builds that principal itself).
+ *
+ * @internal
+ */
+function toPrincipal(user, credential, nodeId) {
+    let principalKind;
+    try {
+        principalKind = (0, index_1.requireCredentialKind)(credential).principalKind;
+    }
+    catch (error) {
+        if (error instanceof index_1.UnknownCredentialKindError)
+            throw new common_1.UnauthorizedException('Unrecognised credential');
+        throw error;
+    }
+    if (credential === 'node')
+        return exports.principalFactory.forNode(user, nodeId);
+    if (principalKind === 'user') {
+        // A registered app kind (`api-key`) lands here with its own id; the
+        // `UserPrincipal.credential` type names the platform's three, which is the
+        // documented limit of the typed shape (the registry is the run-time truth).
+        return exports.principalFactory.forUser(user, credential);
+    }
+    throw new common_1.UnauthorizedException('Unrecognised credential');
+}
+//# sourceMappingURL=principal.factory.js.map

package/dist/identity/auth/principal.factory.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"principal.factory.js","sourceRoot":"","sources":["../../../src/identity/auth/principal.factory.ts"],"names":[],"mappings":";AAAA,gFAAgF;AAChF,yEAAyE;AACzE,gFAAgF;AAChF,EAAE;AACF,0EAA0E;AAC1E,+EAA+E;AAC/E,0DAA0D;AAC1D,EAAE;AACF,gDAAgD;AAChD,qEAAqE;AACrE,gEAAgE;AAChE,EAAE;AACF,uEAAuE;AACvE,gFAAgF;AAChF,6CAA6C;AAC7C,EAAE;AACF,4EAA4E;AAC5E,mDAAmD;AACnD,2EAA2E;AAC3E,yDAAyD;AACzD,kEAAkE;AAClE,4EAA4E;AAC5E,4EAA4E;AAC5E,oCAAoC;AACpC,0DAA0D;AAC1D,uEAAuE;AACvE,qCAAqC;AACrC,wEAAwE;AACxE,WAAW;AACX,EAAE;AACF,sEAAsE;AACtE,2EAA2E;AAC3E,sEAAsE;AACtE,6EAA6E;AAC7E,sDAAsD;AACtD,EAAE;AACF,+EAA+E;AAC/E,8EAA8E;AAC9E,kEAAkE;AAClE,gFAAgF;;;;;;;;;AAqHhF,0DAiBC;AAUD,wDAcC;AAqGD,kCAoBC;AArRD,2CAAmE;AACnE,4CAAqF;AAWrF,iDAAoD;AAEpD,mFAAmF;AACnF,MAAM,sBAAsB,GAAG;IAC7B,eAAe,EAAE,EAAE,OAAO,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,EAAE;CAC1C,CAAC;AAEX;;;;;;;;;GASG;AACU,QAAA,sBAAsB,GAAG;IACpC,SAAS,EAAE,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,sBAAsB,EAAE,EAAE,EAAE;IACrE,WAAW,EAAE;QACX,OAAO,EAAE;YACP,GAAG,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE;YAC9C,IAAI,EAAE,EAAE,OAAO,EAAE,sBAAsB,EAAE;SAC1C;KACF;CACO,CAAC;AA4DX,sFAAsF;AACtF,SAAS,SAAS,CAAC,CAAsB,EAAE,CAAsB;IAC/D,MAAM,EAAE,GAAG,CAAC,CAAC,YAAY,EAAE,OAAO,EAAE,IAAI,MAAM,CAAC,iBAAiB,CAAC;IACjE,MAAM,EAAE,GAAG,CAAC,CAAC,YAAY,EAAE,OAAO,EAAE,IAAI,MAAM,CAAC,iBAAiB,CAAC;IACjE,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,EAAE,GAAG,EAAE,CAAC;IAC9B,OAAO,CAAC,CAAC,CAAC,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC;AACvE,CAAC;AAED;;;;;;;;;GASG;AACH,SAAgB,uBAAuB,CACrC,WAA2D,EAC3D,IAAiB,EACjB,WAA2B;IAE3B,IAAI,WAAW,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACtC,IAAI,CAAC,WAAW,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1D,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;QAC9B,MAAM,UAAU,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,KAAK,KAAK,WAAW,CAAC,CAAC;QACpF,OAAO,UAAU,IAAI,UAAU,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC;IAC1E,CAAC;IACD,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtB,MAAM,UAAU,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,SAAS,KAAK,IAAI,CAAC,CAAC;QACtF,OAAO,UAAU,IAAI,UAAU,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC;IAC1E,CAAC;IACD,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC;IAChF,OAAO,CAAC,GAAG,MAAM,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;AAChD,CAAC;AAED;;;;;;;GAOG;AACH,SAAgB,sBAAsB,CAAC,IAAqB,EAAE,IAAiB;IAC7E,MAAM,WAAW,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACzE,MAAM,UAAU,GAAG,uBAAuB,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;IACrF,MAAM,OAAO,GAAG,UAAU,EAAE,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC;IAE9C,MAAM,WAAW,GAAG,IAAI,GAAG,EAAU,CAAC;IACtC,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;QACtC,KAAK,MAAM,KAAK,IAAI,QAAQ,CAAC,IAAI,CAAC,eAAe,IAAI,EAAE;YAAE,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;IAClG,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,UAAU,EAAE,IAAI,CAAC,eAAe,IAAI,EAAE;QAAE,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;IAEnG,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC;IAE9E,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,GAAG,WAAW,CAAC,EAAE,CAAC;AACpF,CAAC;AAED;;;;;;;GAOG;AAEI,IAAM,gBAAgB,GAAtB,MAAM,gBAAgB;IAC3B,4FAA4F;IAC5F,IAAI;QACF,OAAO,IAAA,iCAAkB,GAAE,CAAC;IAC9B,CAAC;IAED,2EAA2E;IAC3E,MAAM,CAAC,IAAqB;QAC1B,OAAO,sBAAsB,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IACnD,CAAC;IAED;;;;;;OAMG;IACH,OAAO,CACL,IAAqD,EACrD,UAAkD;QAElD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACjC,MAAM,WAAW,GACf,OAAO,IAAI,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,EAAE,KAAK,CAAC;QACrF,OAAO;YACL,IAAI,EAAE,MAAM;YACZ,MAAM,EAAE,IAAI,CAAC,EAAE;YACf,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,UAAU;YACV,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACvC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,eAAe,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/E,MAAM,EAAE,EAAE;SACX,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACH,OAAO,CAAC,IAAqD,EAAE,MAAe;QAC5E,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,EAAE,GAAG,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3D,OAAO;YACL,IAAI,EAAE,MAAM;YACZ,MAAM,EAAE,IAAI,CAAC,EAAE;YACf,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,UAAU,EAAE,MAAM;YAClB,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC9B,CAAC;IACJ,CAAC;CACF,CAAA;AAvDY,4CAAgB;2BAAhB,gBAAgB;IAD5B,IAAA,mBAAU,GAAE;GACA,gBAAgB,CAuD5B;AAED,SAAS,eAAe,CAAC,WAA+C;IACtE,OAAO,WAAW,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;QACtC,KAAK,EAAE,UAAU,CAAC,KAAK;QACvB,IAAI,EAAE,UAAU,CAAC,IAAI,CAAC,IAAI;QAC1B,MAAM,EAAE,UAAU,CAAC,MAAM;KAC1B,CAAC,CAAC,CAAC;AACN,CAAC;AAED;;;;GAIG;AACU,QAAA,gBAAgB,GAAG,IAAI,gBAAgB,EAAE,CAAC;AAEvD;;;;;;;;;;;;;;;;;GAiBG;AACH,SAAgB,WAAW,CACzB,IAAqD,EACrD,UAA0B,EAC1B,MAAe;IAEf,IAAI,aAAqB,CAAC;IAC1B,IAAI,CAAC;QACH,aAAa,GAAG,IAAA,6BAAqB,EAAC,UAAU,CAAC,CAAC,aAAa,CAAC;IAClE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,kCAA0B;YAAE,MAAM,IAAI,8BAAqB,CAAC,yBAAyB,CAAC,CAAC;QAC5G,MAAM,KAAK,CAAC;IACd,CAAC;IACD,IAAI,UAAU,KAAK,MAAM;QAAE,OAAO,wBAAgB,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACzE,IAAI,aAAa,KAAK,MAAM,EAAE,CAAC;QAC7B,oEAAoE;QACpE,2EAA2E;QAC3E,4EAA4E;QAC5E,OAAO,wBAAgB,CAAC,OAAO,CAAC,IAAI,EAAE,UAAoD,CAAC,CAAC;IAC9F,CAAC;IACD,MAAM,IAAI,8BAAqB,CAAC,yBAAyB,CAAC,CAAC;AAC7D,CAAC"}

package/dist/identity/auth/providers/auth-provider.registry.d.ts

@@ -0,0 +1,217 @@
+import type { CanActivate, Type } from '@nestjs/common';
+import type { ConfigService } from '@nestjs/config';
+import type { Strategy as PassportStrategyInstance } from 'passport';
+import { type Registry } from '../../../core/index';
+import type { ExternalProfile } from '../external-profile';
+/**
+ * How a provider signs a person in.
+ *
+ * - `redirect` (default): the slice mounts the sign-in and callback routes.
+ * - `custom`: the provider owns its flow; the slice mounts nothing and the
+ *   login page asks the web provider look (`registerAuthProvider` of
+ *   `@marinoscar/platform-web/identity/headless`) to start it.
+ *
+ * @stability experimental
+ */
+export type AuthProviderMode = 'redirect' | 'custom';
+/**
+ * Where a provider reads the secrets it was configured with: the deployment's
+ * encrypted credential store, seen through the one method identity needs.
+ * `CredentialsService` of `@marinoscar/platform-api/credentials` satisfies it.
+ *
+ * @stability experimental
+ */
+export interface AuthProviderCredentials {
+    /**
+     * The plaintext secret at `(purpose, name)`, or `null` when none is stored.
+     * Call it at the moment of use and let the value go out of scope; never log
+     * it and never cache it.
+     *
+     * @param purpose - the credential purpose, `auth_<id>` by convention ({@link authCredentialPurpose}).
+     * @param name - the secret's name within the purpose (`client_secret`).
+     */
+    getSecret(purpose: string, name: string): Promise<string | null>;
+}
+/**
+ * What a provider's `isEnabled` and `createStrategy` receive.
+ *
+ * @stability experimental
+ */
+export interface AuthProviderContext {
+    /** The app's configuration (deployment defaults, for example Google's `GOOGLE_*`). */
+    readonly config: ConfigService;
+    /**
+     * The credential store; resolves every secret to `null` when the app bound no
+     * `IDENTITY_AUTH_CREDENTIALS`, so a credentials-backed provider is then simply off.
+     */
+    readonly credentials: AuthProviderCredentials;
+}
+/**
+ * The Passport strategy instance a provider builds: anything with
+ * `authenticate(req, options?)` (a `passport-oauth2`, `passport-openid` or
+ * custom strategy).
+ *
+ * @stability experimental
+ */
+export type AuthProviderStrategy = PassportStrategyInstance;
+/**
+ * One sign-in provider.
+ *
+ * @example
+ * ```ts
+ * registerAuthProvider({
+ *   id: 'github',
+ *   label: 'GitHub',
+ *   async isEnabled(_config, { credentials }) {
+ *     return Boolean(await credentials.getSecret(authCredentialPurpose('github'), 'client_secret'));
+ *   },
+ *   async createStrategy({ config, credentials }) {
+ *     const secret = await credentials.getSecret(authCredentialPurpose('github'), 'client_secret');
+ *     return new GithubStrategy({
+ *       clientID: config.get('github.clientId'), clientSecret: secret!, callbackURL,
+ *       // `state: true` alone throws here (no session plugin): bring a store.
+ *       store: createCookieStateStore({ secret: config.get('jwt.secret')! }),
+ *     }, verify);
+ *   },
+ *   mapProfile: (raw) => toExternalProfile('github', raw),
+ *   egressHosts: ['github.com', 'api.github.com'],
+ *   doctorRemedy: 'Store the GitHub OAuth app secret under the credential purpose auth_github.',
+ * });
+ * ```
+ *
+ * @extensionPoint registry
+ * @stability experimental
+ */
+export interface AuthProviderDefinition {
+    /** The provider id, as `GET /api/auth/providers` lists it (`google`). Lower-case; also the route segment and `UserIdentity.provider`. */
+    readonly id: string;
+    /** A human name for the Doctor and the egress view (`GitHub`). Default the id. */
+    readonly label?: string;
+    /**
+     * How the provider signs a person in. Default `redirect`.
+     *
+     * @defaultValue `'redirect'`
+     */
+    readonly mode?: AuthProviderMode;
+    /** The Passport strategy CLASS; provided by `IdentityModule.forRoot()` (Google). Alternative to {@link createStrategy}. */
+    readonly strategy?: Type<unknown>;
+    /** The guard CLASS its sign-in routes use (`GoogleOAuthGuard`). Required with {@link strategy}. */
+    readonly guard?: Type<CanActivate>;
+    /**
+     * Builds the Passport strategy for ONE sign-in request, reading its secrets
+     * through `ctx.credentials`. Called on every `GET /api/auth/:id` and
+     * `/callback`; the result is registered with Passport under
+     * `authProviderStrategyName(id)`.
+     *
+     * LOGIN CSRF IS YOURS TO PREVENT. The slice adds no `state` and no PKCE. For a
+     * `passport-oauth2` strategy, `state: true` or `pkce: true` WITHOUT a `store`
+     * uses the session store and throws "requires session support" on every
+     * sign-in, because this Fastify app registers no session plugin. Pass your own
+     * `store` instead: {@link createCookieStateStore} is a signed, short-lived
+     * HttpOnly cookie store that works here.
+     *
+     * @param ctx - configuration and the credential store.
+     */
+    createStrategy?(ctx: AuthProviderContext): AuthProviderStrategy | Promise<AuthProviderStrategy>;
+    /**
+     * Whether the provider is configured, read on every `GET /api/auth/providers`
+     * and before every sign-in request. May be asynchronous (a credential lookup).
+     * A throw counts as "not enabled".
+     *
+     * `config` stays the first argument so a registration written before
+     * `AuthProviderContext` existed (`isEnabled: (config) => ...`) is unchanged.
+     *
+     * @param config - the app's configuration.
+     * @param ctx - configuration and the credential store.
+     */
+    isEnabled(config: ConfigService, ctx: AuthProviderContext): boolean | Promise<boolean>;
+    /**
+     * Maps what the strategy's verify callback returned (`req.user`) to the
+     * provider-neutral profile. Required for the generic callback route; the
+     * returned `provider` is ignored (the definition's `id` is used). Must not
+     * throw for a missing optional field. Never log `raw`.
+     *
+     * @param raw - the strategy's result.
+     */
+    mapProfile?(raw: unknown): ExternalProfile;
+    /**
+     * Whether this provider is TRUSTED TO VOUCH FOR THE EMAIL ADDRESS. It gates
+     * two things, both keyed by the address:
+     *
+     * - linking: a verified address may link this provider's identity to an
+     *   EXISTING user with the same address (otherwise that sign-in is refused,
+     *   `access_denied`, rather than silently merged);
+     * - the `INITIAL_ADMIN_EMAIL` bootstrap: only a trusted provider may use that
+     *   address to bypass the allowlist and become the first administrator. Any
+     *   other provider is allowlist-only and is never made an administrator.
+     *
+     * Set `true` ONLY for a provider whose verified-email claim an attacker
+     * cannot choose (Google). Never for a multi-tenant issuer where a tenant
+     * admin or user sets the address (Entra's `email` claim, a shared OIDC issuer).
+     *
+     * @defaultValue `false`
+     */
+    readonly linkExistingByEmail?: boolean;
+    /** Hosts the provider needs (sign-in, token exchange, profile), for the egress inventory. */
+    readonly egressHosts?: readonly string[];
+    /** One sentence telling an operator how to configure the provider; the Doctor shows it while the provider is off. */
+    readonly doctorRemedy?: string;
+}
+/**
+ * The registration shape before `AuthProviderDefinition` was widened; the same
+ * type. Kept so existing `registerAuthProvider({ id, strategy, guard, isEnabled })`
+ * calls and imports compile unchanged.
+ *
+ * @stability experimental
+ */
+export type AuthProviderRegistration = AuthProviderDefinition;
+/**
+ * The name a `createStrategy` provider's strategy is registered under in
+ * Passport (`auth-provider:<id>`), so no provider id can collide with another
+ * strategy's name.
+ *
+ * @param providerId - the provider id.
+ * @returns the Passport strategy name.
+ *
+ * @stability experimental
+ */
+export declare function authProviderStrategyName(providerId: string): string;
+/**
+ * The credential purpose a provider's secrets use by convention (`auth_<id>`).
+ * The provider's owner registers it with `registerCredentialPurpose` (tier
+ * `system`); identity does not register it, because the credentials slice is
+ * optional for an app.
+ *
+ * @param providerId - the provider id.
+ * @returns `auth_<id>`.
+ *
+ * @stability experimental
+ */
+export declare function authCredentialPurpose(providerId: string): string;
+/**
+ * Every registered sign-in provider, in registration order.
+ *
+ * @stability experimental
+ */
+export declare const authProviderRegistry: Registry<AuthProviderDefinition>;
+/**
+ * Registers a sign-in provider. Call it at module load, before
+ * `IdentityModule.forRoot()`; a duplicate id throws.
+ *
+ * @param provider - the provider.
+ *
+ * @example
+ * ```ts
+ * registerAuthProvider({
+ *   id: 'github',
+ *   strategy: GithubStrategy,
+ *   guard: GithubOAuthGuard,
+ *   isEnabled: (config) => Boolean(config.get('github.clientId')),
+ * });
+ * ```
+ *
+ * @extensionPoint registry
+ * @stability experimental
+ */
+export declare function registerAuthProvider(provider: AuthProviderDefinition): void;
+//# sourceMappingURL=auth-provider.registry.d.ts.map

package/dist/identity/auth/providers/auth-provider.registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-provider.registry.d.ts","sourceRoot":"","sources":["../../../../src/identity/auth/providers/auth-provider.registry.ts"],"names":[],"mappings":"AAoCA,OAAO,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,gBAAgB,CAAC;AACxD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AACpD,OAAO,KAAK,EAAE,QAAQ,IAAI,wBAAwB,EAAE,MAAM,UAAU,CAAC;AAErE,OAAO,EAAkB,KAAK,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AACpE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAE3D;;;;;;;;;GASG;AACH,MAAM,MAAM,gBAAgB,GAAG,UAAU,GAAG,QAAQ,CAAC;AAErD;;;;;;GAMG;AACH,MAAM,WAAW,uBAAuB;IACtC;;;;;;;OAOG;IACH,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;CAClE;AAED;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IAClC,sFAAsF;IACtF,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;IAC/B;;;OAGG;IACH,QAAQ,CAAC,WAAW,EAAE,uBAAuB,CAAC;CAC/C;AAED;;;;;;GAMG;AACH,MAAM,MAAM,oBAAoB,GAAG,wBAAwB,CAAC;AAE5D;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,WAAW,sBAAsB;IACrC,yIAAyI;IACzI,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,kFAAkF;IAClF,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB;;;;OAIG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,gBAAgB,CAAC;IACjC,2HAA2H;IAC3H,QAAQ,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IAClC,mGAAmG;IACnG,QAAQ,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;IACnC;;;;;;;;;;;;;;OAcG;IACH,cAAc,CAAC,CAAC,GAAG,EAAE,mBAAmB,GAAG,oBAAoB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAC;IAChG;;;;;;;;;;OAUG;IACH,SAAS,CAAC,MAAM,EAAE,aAAa,EAAE,GAAG,EAAE,mBAAmB,GAAG,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACvF;;;;;;;OAOG;IACH,UAAU,CAAC,CAAC,GAAG,EAAE,OAAO,GAAG,eAAe,CAAC;IAC3C;;;;;;;;;;;;;;;;OAgBG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,OAAO,CAAC;IACvC,6FAA6F;IAC7F,QAAQ,CAAC,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACzC,qHAAqH;IACrH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;CAChC;AAED;;;;;;GAMG;AACH,MAAM,MAAM,wBAAwB,GAAG,sBAAsB,CAAC;AAS9D;;;;;;;;;GASG;AACH,wBAAgB,wBAAwB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAEnE;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,qBAAqB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAEhE;AAED;;;;GAIG;AACH,eAAO,MAAM,oBAAoB,EAAE,QAAQ,CAAC,sBAAsB,CA6BhE,CAAC;AAEH;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,sBAAsB,GAAG,IAAI,CAE3E"}

package/dist/identity/auth/providers/auth-provider.registry.js

@@ -0,0 +1,136 @@
+"use strict";
+// =============================================================================
+// The sign-in provider registry (issue #727, PP-6.6; completed by PP-14.9)
+// =============================================================================
+//
+// Rung 2 of the extension contract. Google is the first registered provider
+// (./google.provider.ts, registered when this slice loads). An app adds one
+// with `registerAuthProvider(...)` BEFORE `IdentityModule.forRoot()` runs, and
+// the registration is enough to complete a sign-in:
+//
+//   - `GET /api/auth/providers` lists, in registration order, every provider
+//     whose `isEnabled` says it is configured (it may be asynchronous and read
+//     the credential store);
+//   - for a `redirect` provider the slice mounts `GET /api/auth/:id` (starts
+//     the sign-in) and `GET /api/auth/:id/callback` (maps the strategy's raw
+//     profile with `mapProfile`, calls `AuthService.completeExternalLogin`,
+//     sets the refresh cookie and redirects, exactly as Google's callback);
+//   - a `custom` provider (a popup, a native SDK, a SAML POST) mounts no
+//     routes: the app's own controller maps its profile, calls
+//     `AuthService.completeExternalLogin` and answers with
+//     `respondToSignIn` / `setRefreshTokenCookie` from this slice;
+//   - the Doctor's `auth.providers` check and the egress inventory read the
+//     definition (`label`, `egressHosts`, `doctorRemedy`).
+//
+// TWO WAYS TO SUPPLY THE PASSPORT STRATEGY
+//
+//   - `strategy` + `guard` (classes): provided by `IdentityModule.forRoot()` and
+//     constructed by Nest at boot with injected configuration. Google uses this
+//     and is unchanged.
+//   - `createStrategy(ctx)`: built lazily, on each sign-in request, so a secret
+//     an administrator stores or rotates at run time is picked up without a
+//     restart. Secrets come from `ctx.credentials` (purpose `auth_<id>`), never
+//     from an environment variable.
+//
+// Frozen when the application has bootstrapped (`RegistryFreezeService`).
+// =============================================================================
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.authProviderRegistry = void 0;
+exports.authProviderStrategyName = authProviderStrategyName;
+exports.authCredentialPurpose = authCredentialPurpose;
+exports.registerAuthProvider = registerAuthProvider;
+const index_1 = require("../../../core/index");
+/**
+ * Passport strategy names that already exist in the process (the JWT strategy
+ * `JwtAuthGuard` authenticates with, Passport's built-in `session`). A provider
+ * may not take one as its id: Passport's registry is process-global.
+ */
+const RESERVED_PROVIDER_IDS = new Set(['jwt', 'session']);
+/**
+ * The name a `createStrategy` provider's strategy is registered under in
+ * Passport (`auth-provider:<id>`), so no provider id can collide with another
+ * strategy's name.
+ *
+ * @param providerId - the provider id.
+ * @returns the Passport strategy name.
+ *
+ * @stability experimental
+ */
+function authProviderStrategyName(providerId) {
+    return `auth-provider:${providerId}`;
+}
+/**
+ * The credential purpose a provider's secrets use by convention (`auth_<id>`).
+ * The provider's owner registers it with `registerCredentialPurpose` (tier
+ * `system`); identity does not register it, because the credentials slice is
+ * optional for an app.
+ *
+ * @param providerId - the provider id.
+ * @returns `auth_<id>`.
+ *
+ * @stability experimental
+ */
+function authCredentialPurpose(providerId) {
+    return `auth_${providerId}`;
+}
+/**
+ * Every registered sign-in provider, in registration order.
+ *
+ * @stability experimental
+ */
+exports.authProviderRegistry = (0, index_1.defineRegistry)({
+    name: 'identity.auth-providers',
+    idOf: (provider) => provider.id,
+    idPattern: /^[a-z][a-z0-9-]{0,31}$/,
+    validate: (provider) => {
+        if (RESERVED_PROVIDER_IDS.has(provider.id)) {
+            throw new Error(`auth provider "${provider.id}": the id is reserved (it names an existing Passport strategy)`);
+        }
+        if (typeof provider.isEnabled !== 'function')
+            throw new Error(`auth provider "${provider.id}": isEnabled must be a function`);
+        if (provider.mode !== undefined && provider.mode !== 'redirect' && provider.mode !== 'custom') {
+            throw new Error(`auth provider "${provider.id}": mode must be "redirect" or "custom"`);
+        }
+        if (provider.mapProfile !== undefined && typeof provider.mapProfile !== 'function') {
+            throw new Error(`auth provider "${provider.id}": mapProfile must be a function`);
+        }
+        if (provider.egressHosts !== undefined && !Array.isArray(provider.egressHosts)) {
+            throw new Error(`auth provider "${provider.id}": egressHosts must be an array of host names`);
+        }
+        if ((provider.mode ?? 'redirect') === 'custom')
+            return;
+        const classBased = provider.strategy !== undefined || provider.guard !== undefined;
+        if (classBased) {
+            if (typeof provider.strategy !== 'function')
+                throw new Error(`auth provider "${provider.id}": strategy must be a class`);
+            if (typeof provider.guard !== 'function')
+                throw new Error(`auth provider "${provider.id}": guard must be a class`);
+        }
+        else if (typeof provider.createStrategy !== 'function') {
+            throw new Error(`auth provider "${provider.id}": a redirect provider needs a strategy class with a guard class, or createStrategy`);
+        }
+    },
+});
+/**
+ * Registers a sign-in provider. Call it at module load, before
+ * `IdentityModule.forRoot()`; a duplicate id throws.
+ *
+ * @param provider - the provider.
+ *
+ * @example
+ * ```ts
+ * registerAuthProvider({
+ *   id: 'github',
+ *   strategy: GithubStrategy,
+ *   guard: GithubOAuthGuard,
+ *   isEnabled: (config) => Boolean(config.get('github.clientId')),
+ * });
+ * ```
+ *
+ * @extensionPoint registry
+ * @stability experimental
+ */
+function registerAuthProvider(provider) {
+    exports.authProviderRegistry.register(provider);
+}
+//# sourceMappingURL=auth-provider.registry.js.map

package/dist/identity/auth/providers/auth-provider.registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-provider.registry.js","sourceRoot":"","sources":["../../../../src/identity/auth/providers/auth-provider.registry.ts"],"names":[],"mappings":";AAAA,gFAAgF;AAChF,2EAA2E;AAC3E,gFAAgF;AAChF,EAAE;AACF,4EAA4E;AAC5E,4EAA4E;AAC5E,+EAA+E;AAC/E,oDAAoD;AACpD,EAAE;AACF,6EAA6E;AAC7E,+EAA+E;AAC/E,6BAA6B;AAC7B,6EAA6E;AAC7E,6EAA6E;AAC7E,4EAA4E;AAC5E,4EAA4E;AAC5E,yEAAyE;AACzE,+DAA+D;AAC/D,2DAA2D;AAC3D,mEAAmE;AACnE,4EAA4E;AAC5E,2DAA2D;AAC3D,EAAE;AACF,2CAA2C;AAC3C,EAAE;AACF,iFAAiF;AACjF,gFAAgF;AAChF,wBAAwB;AACxB,gFAAgF;AAChF,4EAA4E;AAC5E,gFAAgF;AAChF,oCAAoC;AACpC,EAAE;AACF,0EAA0E;AAC1E,gFAAgF;;;AAkMhF,4DAEC;AAaD,sDAEC;AAyDD,oDAEC;AAxQD,+CAAoE;AA2KpE;;;;GAIG;AACH,MAAM,qBAAqB,GAAwB,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC;AAE/E;;;;;;;;;GASG;AACH,SAAgB,wBAAwB,CAAC,UAAkB;IACzD,OAAO,iBAAiB,UAAU,EAAE,CAAC;AACvC,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAgB,qBAAqB,CAAC,UAAkB;IACtD,OAAO,QAAQ,UAAU,EAAE,CAAC;AAC9B,CAAC;AAED;;;;GAIG;AACU,QAAA,oBAAoB,GAAqC,IAAA,sBAAc,EAAyB;IAC3G,IAAI,EAAE,yBAAyB;IAC/B,IAAI,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE;IAC/B,SAAS,EAAE,wBAAwB;IACnC,QAAQ,EAAE,CAAC,QAAQ,EAAE,EAAE;QACrB,IAAI,qBAAqB,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC;YAC3C,MAAM,IAAI,KAAK,CAAC,kBAAkB,QAAQ,CAAC,EAAE,gEAAgE,CAAC,CAAC;QACjH,CAAC;QACD,IAAI,OAAO,QAAQ,CAAC,SAAS,KAAK,UAAU;YAAE,MAAM,IAAI,KAAK,CAAC,kBAAkB,QAAQ,CAAC,EAAE,iCAAiC,CAAC,CAAC;QAC9H,IAAI,QAAQ,CAAC,IAAI,KAAK,SAAS,IAAI,QAAQ,CAAC,IAAI,KAAK,UAAU,IAAI,QAAQ,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC9F,MAAM,IAAI,KAAK,CAAC,kBAAkB,QAAQ,CAAC,EAAE,wCAAwC,CAAC,CAAC;QACzF,CAAC;QACD,IAAI,QAAQ,CAAC,UAAU,KAAK,SAAS,IAAI,OAAO,QAAQ,CAAC,UAAU,KAAK,UAAU,EAAE,CAAC;YACnF,MAAM,IAAI,KAAK,CAAC,kBAAkB,QAAQ,CAAC,EAAE,kCAAkC,CAAC,CAAC;QACnF,CAAC;QACD,IAAI,QAAQ,CAAC,WAAW,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;YAC/E,MAAM,IAAI,KAAK,CAAC,kBAAkB,QAAQ,CAAC,EAAE,+CAA+C,CAAC,CAAC;QAChG,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,IAAI,IAAI,UAAU,CAAC,KAAK,QAAQ;YAAE,OAAO;QACvD,MAAM,UAAU,GAAG,QAAQ,CAAC,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,KAAK,KAAK,SAAS,CAAC;QACnF,IAAI,UAAU,EAAE,CAAC;YACf,IAAI,OAAO,QAAQ,CAAC,QAAQ,KAAK,UAAU;gBAAE,MAAM,IAAI,KAAK,CAAC,kBAAkB,QAAQ,CAAC,EAAE,6BAA6B,CAAC,CAAC;YACzH,IAAI,OAAO,QAAQ,CAAC,KAAK,KAAK,UAAU;gBAAE,MAAM,IAAI,KAAK,CAAC,kBAAkB,QAAQ,CAAC,EAAE,0BAA0B,CAAC,CAAC;QACrH,CAAC;aAAM,IAAI,OAAO,QAAQ,CAAC,cAAc,KAAK,UAAU,EAAE,CAAC;YACzD,MAAM,IAAI,KAAK,CACb,kBAAkB,QAAQ,CAAC,EAAE,qFAAqF,CACnH,CAAC;QACJ,CAAC;IACH,CAAC;CACF,CAAC,CAAC;AAEH;;;;;;;;;;;;;;;;;;GAkBG;AACH,SAAgB,oBAAoB,CAAC,QAAgC;IACnE,4BAAoB,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AAC1C,CAAC"}