npm - @nauth-toolkit/social-facebook - Versions diffs - 0.1.77 → 0.1.78 - Mend

@nauth-toolkit/social-facebook 0.1.77 → 0.1.78

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (10) hide show

package/dist/src/facebook-social-auth.service.d.ts +1 -1
package/dist/src/facebook-social-auth.service.d.ts.map +1 -1
package/dist/src/facebook-social-auth.service.js +89 -7
package/dist/src/facebook-social-auth.service.js.map +1 -1
package/dist/src/token-verifier.service.d.ts +43 -1
package/dist/src/token-verifier.service.d.ts.map +1 -1
package/dist/src/token-verifier.service.js +147 -1
package/dist/src/token-verifier.service.js.map +1 -1
package/dist/tsconfig.tsbuildinfo +1 -1
package/package.json +8 -3

package/dist/src/facebook-social-auth.service.d.ts CHANGED Viewed

@@ -66,6 +66,6 @@ export declare class FacebookSocialAuthService extends BaseSocialAuthProviderSer
      * @returns User profile from verified token
      * @protected
      */
-    protected verifyNativeToken(idToken: string, _accessToken?: string, profileData?: unknown): Promise<OAuthUserProfile>;
+    protected verifyNativeToken(idToken: string, accessToken?: string, profileData?: unknown): Promise<OAuthUserProfile>;
 }
 //# sourceMappingURL=facebook-social-auth.service.d.ts.map

package/dist/src/facebook-social-auth.service.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"facebook-social-auth.service.d.ts","sourceRoot":"","sources":["../../src/facebook-social-auth.service.ts"],"names":[],"mappings":"AACA,OAAO,EACL,WAAW,EACX,iBAAiB,EACjB,iBAAiB,EACjB,WAAW,EACX,WAAW,EACX,gBAAgB,EAGhB,wBAAwB,EACxB,0BAA0B,EAC1B,qBAAqB,EACrB,QAAQ,EACR,qBAAqB,EACtB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACL,6BAA6B,EAC7B,UAAU,EACV,cAAc,EACd,0BAA0B,EAC1B,gBAAgB,EAAE,sCAAsC;AACxD,oBAAoB,EACpB,mBAAmB,EACpB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;~~AAKrC~~;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,qBAAa,yBAA0B,SAAQ,6BAA8B,YAAW,0BAA0B;IAChH,QAAQ,CAAC,YAAY,cAAc;IACnC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAA6B;IACzD,OAAO,CAAC,QAAQ,CAAC,aAAa,CAA+B;gBAG3D,MAAM,EAAE,WAAW,EACnB,MAAM,EAAE,WAAW,EACnB,WAAW,EAAE,WAAW,EACxB,iBAAiB,EAAE,iBAAiB,EACpC,UAAU,EAAE,UAAU,EACtB,cAAc,EAAE,cAAc,EAC9B,eAAe,EAAE,0BAA0B,EAC3C,iBAAiB,EAAE,iBAAiB,EAEpC,UAAU,EAAE,qBAAqB,EACjC,cAAc,EAAE,UAAU,CAAC,QAAQ,CAAC,EAEpC,wBAAwB,CAAC,EAAE,wBAAwB,EAEnD,YAAY,CAAC,EAAE,gBAAgB,EAE/B,oBAAoB,CAAC,EAAE,oBAAoB,EAE3C,YAAY,CAAC,EAAE,mBAAmB,EAElC,aAAa,CAAC,EAAE,qBAAqB;IAoDvC;;;;;OAKG;IACG,UAAU,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAQjD;;;;;;;;;OASG;cACa,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAgBxF;;;;;;;;;;OAUG;cACa,iBAAiB,CAC/B,OAAO,EAAE,MAAM,EACf,~~YAAY~~,CAAC,EAAE,MAAM,~~EACrB~~,WAAW,CAAC,EAAE,OAAO,GACpB,OAAO,CAAC,gBAAgB,CAAC;~~CAsD7B~~"}
1	+ {"version":3,"file":"facebook-social-auth.service.d.ts","sourceRoot":"","sources":["../../src/facebook-social-auth.service.ts"],"names":[],"mappings":"AACA,OAAO,EACL,WAAW,EACX,iBAAiB,EACjB,iBAAiB,EACjB,WAAW,EACX,WAAW,EACX,gBAAgB,EAGhB,wBAAwB,EACxB,0BAA0B,EAC1B,qBAAqB,EACrB,QAAQ,EACR,qBAAqB,EACtB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACL,6BAA6B,EAC7B,UAAU,EACV,cAAc,EACd,0BAA0B,EAC1B,gBAAgB,EAAE,sCAAsC;AACxD,oBAAoB,EACpB,mBAAmB,EACpB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAmBrC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,qBAAa,yBAA0B,SAAQ,6BAA8B,YAAW,0BAA0B;IAChH,QAAQ,CAAC,YAAY,cAAc;IACnC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAA6B;IACzD,OAAO,CAAC,QAAQ,CAAC,aAAa,CAA+B;gBAG3D,MAAM,EAAE,WAAW,EACnB,MAAM,EAAE,WAAW,EACnB,WAAW,EAAE,WAAW,EACxB,iBAAiB,EAAE,iBAAiB,EACpC,UAAU,EAAE,UAAU,EACtB,cAAc,EAAE,cAAc,EAC9B,eAAe,EAAE,0BAA0B,EAC3C,iBAAiB,EAAE,iBAAiB,EAEpC,UAAU,EAAE,qBAAqB,EACjC,cAAc,EAAE,UAAU,CAAC,QAAQ,CAAC,EAEpC,wBAAwB,CAAC,EAAE,wBAAwB,EAEnD,YAAY,CAAC,EAAE,gBAAgB,EAE/B,oBAAoB,CAAC,EAAE,oBAAoB,EAE3C,YAAY,CAAC,EAAE,mBAAmB,EAElC,aAAa,CAAC,EAAE,qBAAqB;IAoDvC;;;;;OAKG;IACG,UAAU,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAQjD;;;;;;;;;OASG;cACa,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAgBxF;;;;;;;;;;OAUG;cACa,iBAAiB,CAC/B,OAAO,EAAE,MAAM,EACf,WAAW,CAAC,EAAE,MAAM,EACpB,WAAW,CAAC,EAAE,OAAO,GACpB,OAAO,CAAC,gBAAgB,CAAC;CAwJ7B"}

package/dist/src/facebook-social-auth.service.js CHANGED Viewed

@@ -7,6 +7,19 @@ const core_1 = require("@nauth-toolkit/core");
 const internal_1 = require("@nauth-toolkit/core/internal");
 const facebook_oauth_client_1 = require("./facebook-oauth.client");
 const token_verifier_service_1 = require("./token-verifier.service");
+/**
+ * Lightweight check for JWT format (header.payload.signature).
+ *
+ * Used to distinguish Facebook Limited Login ID tokens (JWT) from classic access tokens.
+ *
+ * @param token - Raw token string
+ * @returns True if token looks like a JWT
+ */
+function isJwt(token) {
+    // JWTs are 3 base64url segments separated by dots.
+    const parts = token.split('.');
+    return parts.length === 3 && parts.every((p) => p.length > 0);
+}
 /**
  * Facebook Social Authentication Service (Platform-Agnostic)
  *
@@ -130,27 +143,96 @@ class FacebookSocialAuthService extends internal_1.BaseSocialAuthProviderService
      * @returns User profile from verified token
      * @protected
      */
-    async verifyNativeToken(idToken, _accessToken, profileData) {
+    async verifyNativeToken(idToken, accessToken, profileData) {
+        // TEMP_DEBUG_REMOVE: Log incoming tokens
+        this.logger?.debug?.(`[TEMP_DEBUG_REMOVE] verifyNativeToken called - idToken length: ${idToken?.length || 0}, accessToken length: ${accessToken?.length || 0}, idToken preview: ${idToken?.substring(0, 50)}...`);
         if (!this.tokenVerifier) {
+            // TEMP_DEBUG_REMOVE
+            this.logger?.error?.('[TEMP_DEBUG_REMOVE] Token verifier is null');
             throw new core_1.NAuthException(core_1.AuthErrorCode.SOCIAL_CONFIG_MISSING, 'Facebook OAuth is not enabled');
         }
         const providerConfig = this.getProviderConfig();
         if (!providerConfig) {
+            // TEMP_DEBUG_REMOVE
+            this.logger?.error?.('[TEMP_DEBUG_REMOVE] Provider config is null');
             throw new core_1.NAuthException(core_1.AuthErrorCode.SOCIAL_CONFIG_MISSING, 'Facebook OAuth is not configured');
         }
         const appId = Array.isArray(providerConfig.clientId) ? providerConfig.clientId[0] : providerConfig.clientId || '';
         const appSecret = providerConfig.clientSecret || '';
+        // TEMP_DEBUG_REMOVE
+        this.logger?.debug?.(`[TEMP_DEBUG_REMOVE] Config loaded - appId: ${appId?.substring(0, 10)}..., appSecret present: ${!!appSecret}`);
         if (!this.tokenVerifier.verifyFacebookToken) {
+            // TEMP_DEBUG_REMOVE
+            this.logger?.error?.('[TEMP_DEBUG_REMOVE] verifyFacebookToken method not available');
             throw new core_1.NAuthException(core_1.AuthErrorCode.SOCIAL_CONFIG_MISSING, 'Facebook token verifier is not available');
         }
-        // For Facebook, the idToken parameter actually contains the access token
-        // Facebook native SDKs return access tokens, not ID tokens
-        const accessToken = idToken;
-        // Verify access token with Facebook's Graph API
-        const verified = (await this.tokenVerifier.verifyFacebookToken(accessToken, appId, appSecret));
-        this.logger?.debug?.(`Verified Facebook token for: ${verified.email || verified.id}`);
+        // ============================================================================
+        // Facebook Native Token Verification
+        // ============================================================================
+        // Facebook supports two native token shapes:
+        // - Classic login: access token (opaque string) -> verify via Graph API debug_token
+        // - Limited Login (iOS): ID token (JWT) -> verify via OIDC JWKS (RS256)
+        //
+        // NOTE: Base class passes dto.idToken as first arg; dto.accessToken as second arg.
+        // Consumers might send:
+        // - { accessToken } only (client SDK supports this) -> controller should map it into dto.idToken or dto.accessToken.
+        // - { idToken } (JWT) for Limited Login.
+        let verified;
+        const isJwtToken = isJwt(idToken);
+        const hasIdTokenVerifier = !!this.tokenVerifier.verifyFacebookIdToken;
+        // TEMP_DEBUG_REMOVE
+        this.logger?.debug?.(`[TEMP_DEBUG_REMOVE] Token type detection - isJwt: ${isJwtToken}, hasIdTokenVerifier: ${hasIdTokenVerifier}`);
+        if (isJwtToken && hasIdTokenVerifier) {
+            // Limited Login: verify ID token (JWT) via Facebook OIDC JWKS.
+            // TEMP_DEBUG_REMOVE
+            this.logger?.debug?.('[TEMP_DEBUG_REMOVE] Attempting JWT verification path');
+            try {
+                if (!this.tokenVerifier.verifyFacebookIdToken) {
+                    throw new core_1.NAuthException(core_1.AuthErrorCode.SOCIAL_CONFIG_MISSING, 'Facebook ID token verifier is not available');
+                }
+                const jwtProfile = (await this.tokenVerifier.verifyFacebookIdToken(idToken, appId));
+                // TEMP_DEBUG_REMOVE
+                this.logger?.debug?.(`[TEMP_DEBUG_REMOVE] JWT verification succeeded - sub: ${jwtProfile.sub}, email: ${jwtProfile.email || 'missing'}`);
+                verified = {
+                    id: jwtProfile.sub,
+                    email: jwtProfile.email,
+                    first_name: jwtProfile.given_name || (jwtProfile.name ? jwtProfile.name.split(' ')[0] : undefined),
+                    last_name: jwtProfile.family_name || undefined,
+                    picture: jwtProfile.picture ? { data: { url: jwtProfile.picture } } : undefined,
+                };
+                this.logger?.debug?.(`Verified Facebook ID token for: ${verified.email || verified.id}`);
+            }
+            catch (jwtError) {
+                // TEMP_DEBUG_REMOVE
+                this.logger?.error?.(`[TEMP_DEBUG_REMOVE] JWT verification failed: ${jwtError instanceof Error ? jwtError.message : String(jwtError)}`);
+                throw jwtError;
+            }
+        }
+        else {
+            // Classic login: verify access token via Graph API.
+            // Prefer explicit accessToken if provided, otherwise treat idToken as access token for backward compatibility.
+            const tokenToVerify = accessToken || idToken;
+            // TEMP_DEBUG_REMOVE
+            this.logger?.debug?.(`[TEMP_DEBUG_REMOVE] Attempting access token verification path - token length: ${tokenToVerify.length}, token preview: ${tokenToVerify.substring(0, 50)}...`);
+            try {
+                const verifiedAccess = (await this.tokenVerifier.verifyFacebookToken(tokenToVerify, appId, appSecret));
+                verified = verifiedAccess;
+                // TEMP_DEBUG_REMOVE
+                this.logger?.debug?.(`[TEMP_DEBUG_REMOVE] Access token verification succeeded - id: ${verified.id}, email: ${verified.email || 'missing'}`);
+                this.logger?.debug?.(`Verified Facebook access token for: ${verified.email || verified.id}`);
+            }
+            catch (accessError) {
+                // TEMP_DEBUG_REMOVE
+                this.logger?.error?.(`[TEMP_DEBUG_REMOVE] Access token verification failed: ${accessError instanceof Error ? accessError.message : String(accessError)}`);
+                throw accessError;
+            }
+        }
         // CRITICAL: Require email from all social providers for signup
+        // TEMP_DEBUG_REMOVE
+        this.logger?.debug?.(`[TEMP_DEBUG_REMOVE] Email validation check - verified.id: ${verified.id}, verified.email: ${verified.email || 'MISSING'}`);
         if (!verified.email) {
+            // TEMP_DEBUG_REMOVE
+            this.logger?.error?.('[TEMP_DEBUG_REMOVE] Email validation FAILED - email is missing from verified profile');
             throw new core_1.NAuthException(core_1.AuthErrorCode.SOCIAL_EMAIL_REQUIRED, 'Email is required from Facebook. Please grant email permissions.');
         }
         // Handle profile data from native SDK if available

package/dist/src/facebook-social-auth.service.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"facebook-social-auth.service.js","sourceRoot":"","sources":["../../src/facebook-social-auth.service.ts"],"names":[],"mappings":";;;AAAA,qBAAqB;AACrB,8CAc6B;AAC7B,sDAAsD;AACtD,2DAQsC;AAEtC,mEAA8D;AAC9D,qEAAgG;AAGhG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAa,yBAA0B,SAAQ,wCAA6B;IACjE,YAAY,GAAG,UAAU,CAAC;IAClB,WAAW,CAA6B;IACxC,aAAa,CAA+B;IAE7D,YACE,MAAmB,EACnB,MAAmB,EACnB,WAAwB,EACxB,iBAAoC,EACpC,UAAsB,EACtB,cAA8B,EAC9B,eAA2C,EAC3C,iBAAoC;IACpC,0CAA0C;IAC1C,UAAiC,EACjC,cAAoC;IACpC,yFAAyF;IACzF,wBAAmD;IACnD,2EAA2E;IAC3E,YAA+B;IAC/B,qFAAqF;IACrF,oBAA2C;IAC3C,+CAA+C;IAC/C,YAAkC;IAClC,mEAAmE;IACnE,aAAqC;QAErC,KAAK,CACH,MAAM,EACN,MAAM,EACN,WAAW,EACX,iBAAiB,EACjB,UAAU,EACV,cAAc,EACd,eAAe,EACf,iBAAiB,EACjB,UAAU,EACV,cAAc,EACd,wBAAwB,EACxB,YAAY,EACZ,oBAAoB,EACpB,YAAY,CACb,CAAC;QAEF,mCAAmC;QACnC,MAAM,cAAc,GAAG,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAChD,IAAI,CAAC,cAAc,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,CAAC;YAC/C,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;YACxB,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC;YAC1B,OAAO,CAAC,qCAAqC;QAC/C,CAAC;QAED,MAAM,WAAW,GAAG,KAAK,CAAC,OAAO,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,QAAQ,CAAC;QAClH,IAAI,CAAC,WAAW,IAAI,CAAC,cAAc,CAAC,YAAY,EAAE,CAAC;YACjD,6DAA6D;YAC7D,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;YACxB,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC;YAC1B,OAAO;QACT,CAAC;QAED,IAAI,CAAC,WAAW,GAAG,IAAI,2CAAmB,CAAC;YACzC,QAAQ,EAAE,WAAW;YACrB,YAAY,EAAE,cAAc,CAAC,YAAY;YACzC,WAAW,EAAE,cAAc,CAAC,WAAW,IAAI,EAAE;YAC7C,MAAM,EAAE,cAAc,CAAC,MAAM,IAAI,CAAC,OAAO,EAAE,gBAAgB,CAAC;SAC7D,CAAC,CAAC;QAEH,oDAAoD;QACpD,IAAI,CAAC,aAAa;YAChB,aAAa;gBACb,IAAI,6CAA4B,CAAC,MAAM,CAAC;gBACvC,IAAI,CAAC,MAAoD,CAAC,aAAa;gBACxE,IAAI,CAAC;QAEP,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC,uCAAuC,CAAC,CAAC;IAChE,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,UAAU,CAAC,KAAc;QAC7B,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YACtB,MAAM,IAAI,qBAAc,CAAC,oBAAa,CAAC,qBAAqB,EAAE,+BAA+B,CAAC,CAAC;QACjG,CAAC;QACD,MAAM,UAAU,GAAG,KAAK,IAAI,CAAC,MAAM,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC;QACzD,OAAO,IAAI,CAAC,WAAW,CAAC,mBAAmB,CAAC,UAAU,CAAC,CAAC;IAC1D,CAAC;IAED;;;;;;;;;OASG;IACO,KAAK,CAAC,eAAe,CAAC,IAAY,EAAE,MAAc;QAC1D,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YACtB,MAAM,IAAI,qBAAc,CAAC,oBAAa,CAAC,qBAAqB,EAAE,+BAA+B,CAAC,CAAC;QACjG,CAAC;QACD,MAAM,cAAc,GAAG,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAChD,IAAI,CAAC,cAAc,IAAI,CAAC,cAAc,CAAC,WAAW,EAAE,CAAC;YACnD,MAAM,IAAI,qBAAc,CAAC,oBAAa,CAAC,qBAAqB,EAAE,+CAA+C,CAAC,CAAC;QACjH,CAAC;QAED,iCAAiC;QACjC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,oBAAoB,CAAC,IAAI,EAAE,cAAc,CAAC,WAAW,CAAC,CAAC;QAE7F,iCAAiC;QACjC,OAAO,MAAM,IAAI,CAAC,WAAW,CAAC,cAAc,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IACnE,CAAC;IAED;;;;;;;;;;OAUG;IACO,KAAK,CAAC,iBAAiB,CAC/B,OAAe,EACf,~~YAAqB~~,~~EACrB~~,WAAqB;QAErB,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;YACxB,MAAM,IAAI,qBAAc,CAAC,oBAAa,CAAC,qBAAqB,EAAE,+BAA+B,CAAC,CAAC;QACjG,CAAC;QACD,MAAM,cAAc,GAAG,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAChD,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,MAAM,IAAI,qBAAc,CAAC,oBAAa,CAAC,qBAAqB,EAAE,kCAAkC,CAAC,CAAC;QACpG,CAAC;QAED,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,QAAQ,IAAI,EAAE,CAAC;QAClH,MAAM,SAAS,GAAG,cAAc,CAAC,YAAY,IAAI,EAAE,CAAC;QAEpD,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,mBAAmB,EAAE,CAAC;YAC5C,MAAM,IAAI,qBAAc,CAAC,oBAAa,CAAC,qBAAqB,EAAE,0CAA0C,CAAC,CAAC;QAC5G,CAAC;QAED,~~yEAAyE~~;~~QACzE~~,~~2DAA2D~~;~~QAC3D~~,MAAM,WAAW,GAAG,OAAO,CAAC;~~QAE5B~~,gDAAgD;~~QAChD~~,MAAM,QAAQ,GAAG,CAAC,MAAM,IAAI,CAAC,aAAa,CAAC,mBAAmB,~~CAC5D~~,~~WAAW~~,~~EACX~~,KAAK,EACL,SAAS,CACV,CAAiC,CAAC;~~QACnC~~,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC,~~gCAAgC~~,QAAQ,CAAC,KAAK,IAAI,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAC;~~QAEtF~~,+DAA+D;QAC/D,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;YACpB,MAAM,IAAI,qBAAc,CACtB,oBAAa,CAAC,qBAAqB,EACnC,kEAAkE,CACnE,CAAC;QACJ,CAAC;QAED,mDAAmD;QACnD,MAAM,gBAAgB,GAAG,WAAsF,CAAC;QAChH,OAAO;YACL,EAAE,EAAE,QAAQ,CAAC,EAAE;YACf,KAAK,EAAE,QAAQ,CAAC,KAAK,IAAI,EAAE;YAC3B,SAAS,EAAE,QAAQ,CAAC,UAAU,IAAI,gBAAgB,EAAE,SAAS,IAAI,IAAI;YACrE,QAAQ,EAAE,QAAQ,CAAC,SAAS,IAAI,gBAAgB,EAAE,QAAQ,IAAI,IAAI;YAClE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,IAAI,EAAE,GAAG,IAAI,gBAAgB,EAAE,OAAO,IAAI,IAAI;YACzE,QAAQ,EAAE,IAAI,EAAE,4CAA4C;YAC5D,GAAG,EAAE;gBACH,EAAE,EAAE,QAAQ,CAAC,EAAE;gBACf,KAAK,EAAE,QAAQ,CAAC,KAAK;gBACrB,UAAU,EAAE,QAAQ,CAAC,UAAU;gBAC/B,SAAS,EAAE,QAAQ,CAAC,SAAS;gBAC7B,OAAO,EAAE,QAAQ,CAAC,OAAO;aACY;SACxC,CAAC;IACJ,CAAC;CACF;~~AA3LD~~,~~8DA2LC~~"}
1	+ {"version":3,"file":"facebook-social-auth.service.js","sourceRoot":"","sources":["../../src/facebook-social-auth.service.ts"],"names":[],"mappings":";;;AAAA,qBAAqB;AACrB,8CAc6B;AAC7B,sDAAsD;AACtD,2DAQsC;AAEtC,mEAA8D;AAC9D,qEAAgG;AAGhG;;;;;;;GAOG;AACH,SAAS,KAAK,CAAC,KAAa;IAC1B,mDAAmD;IACnD,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AAChE,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAa,yBAA0B,SAAQ,wCAA6B;IACjE,YAAY,GAAG,UAAU,CAAC;IAClB,WAAW,CAA6B;IACxC,aAAa,CAA+B;IAE7D,YACE,MAAmB,EACnB,MAAmB,EACnB,WAAwB,EACxB,iBAAoC,EACpC,UAAsB,EACtB,cAA8B,EAC9B,eAA2C,EAC3C,iBAAoC;IACpC,0CAA0C;IAC1C,UAAiC,EACjC,cAAoC;IACpC,yFAAyF;IACzF,wBAAmD;IACnD,2EAA2E;IAC3E,YAA+B;IAC/B,qFAAqF;IACrF,oBAA2C;IAC3C,+CAA+C;IAC/C,YAAkC;IAClC,mEAAmE;IACnE,aAAqC;QAErC,KAAK,CACH,MAAM,EACN,MAAM,EACN,WAAW,EACX,iBAAiB,EACjB,UAAU,EACV,cAAc,EACd,eAAe,EACf,iBAAiB,EACjB,UAAU,EACV,cAAc,EACd,wBAAwB,EACxB,YAAY,EACZ,oBAAoB,EACpB,YAAY,CACb,CAAC;QAEF,mCAAmC;QACnC,MAAM,cAAc,GAAG,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAChD,IAAI,CAAC,cAAc,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,CAAC;YAC/C,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;YACxB,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC;YAC1B,OAAO,CAAC,qCAAqC;QAC/C,CAAC;QAED,MAAM,WAAW,GAAG,KAAK,CAAC,OAAO,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,QAAQ,CAAC;QAClH,IAAI,CAAC,WAAW,IAAI,CAAC,cAAc,CAAC,YAAY,EAAE,CAAC;YACjD,6DAA6D;YAC7D,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;YACxB,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC;YAC1B,OAAO;QACT,CAAC;QAED,IAAI,CAAC,WAAW,GAAG,IAAI,2CAAmB,CAAC;YACzC,QAAQ,EAAE,WAAW;YACrB,YAAY,EAAE,cAAc,CAAC,YAAY;YACzC,WAAW,EAAE,cAAc,CAAC,WAAW,IAAI,EAAE;YAC7C,MAAM,EAAE,cAAc,CAAC,MAAM,IAAI,CAAC,OAAO,EAAE,gBAAgB,CAAC;SAC7D,CAAC,CAAC;QAEH,oDAAoD;QACpD,IAAI,CAAC,aAAa;YAChB,aAAa;gBACb,IAAI,6CAA4B,CAAC,MAAM,CAAC;gBACvC,IAAI,CAAC,MAAoD,CAAC,aAAa;gBACxE,IAAI,CAAC;QAEP,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC,uCAAuC,CAAC,CAAC;IAChE,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,UAAU,CAAC,KAAc;QAC7B,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YACtB,MAAM,IAAI,qBAAc,CAAC,oBAAa,CAAC,qBAAqB,EAAE,+BAA+B,CAAC,CAAC;QACjG,CAAC;QACD,MAAM,UAAU,GAAG,KAAK,IAAI,CAAC,MAAM,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC;QACzD,OAAO,IAAI,CAAC,WAAW,CAAC,mBAAmB,CAAC,UAAU,CAAC,CAAC;IAC1D,CAAC;IAED;;;;;;;;;OASG;IACO,KAAK,CAAC,eAAe,CAAC,IAAY,EAAE,MAAc;QAC1D,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YACtB,MAAM,IAAI,qBAAc,CAAC,oBAAa,CAAC,qBAAqB,EAAE,+BAA+B,CAAC,CAAC;QACjG,CAAC;QACD,MAAM,cAAc,GAAG,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAChD,IAAI,CAAC,cAAc,IAAI,CAAC,cAAc,CAAC,WAAW,EAAE,CAAC;YACnD,MAAM,IAAI,qBAAc,CAAC,oBAAa,CAAC,qBAAqB,EAAE,+CAA+C,CAAC,CAAC;QACjH,CAAC;QAED,iCAAiC;QACjC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,oBAAoB,CAAC,IAAI,EAAE,cAAc,CAAC,WAAW,CAAC,CAAC;QAE7F,iCAAiC;QACjC,OAAO,MAAM,IAAI,CAAC,WAAW,CAAC,cAAc,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IACnE,CAAC;IAED;;;;;;;;;;OAUG;IACO,KAAK,CAAC,iBAAiB,CAC/B,OAAe,EACf,WAAoB,EACpB,WAAqB;QAErB,yCAAyC;QACzC,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,CAClB,kEAAkE,OAAO,EAAE,MAAM,IAAI,CAAC,yBAAyB,WAAW,EAAE,MAAM,IAAI,CAAC,sBAAsB,OAAO,EAAE,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAC5L,CAAC;QAEF,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;YACxB,oBAAoB;YACpB,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC,4CAA4C,CAAC,CAAC;YACnE,MAAM,IAAI,qBAAc,CAAC,oBAAa,CAAC,qBAAqB,EAAE,+BAA+B,CAAC,CAAC;QACjG,CAAC;QACD,MAAM,cAAc,GAAG,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAChD,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,oBAAoB;YACpB,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC,6CAA6C,CAAC,CAAC;YACpE,MAAM,IAAI,qBAAc,CAAC,oBAAa,CAAC,qBAAqB,EAAE,kCAAkC,CAAC,CAAC;QACpG,CAAC;QAED,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,QAAQ,IAAI,EAAE,CAAC;QAClH,MAAM,SAAS,GAAG,cAAc,CAAC,YAAY,IAAI,EAAE,CAAC;QAEpD,oBAAoB;QACpB,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,CAClB,8CAA8C,KAAK,EAAE,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,2BAA2B,CAAC,CAAC,SAAS,EAAE,CAC9G,CAAC;QAEF,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,mBAAmB,EAAE,CAAC;YAC5C,oBAAoB;YACpB,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC,8DAA8D,CAAC,CAAC;YACrF,MAAM,IAAI,qBAAc,CAAC,oBAAa,CAAC,qBAAqB,EAAE,0CAA0C,CAAC,CAAC;QAC5G,CAAC;QAED,+EAA+E;QAC/E,qCAAqC;QACrC,+EAA+E;QAC/E,6CAA6C;QAC7C,oFAAoF;QACpF,wEAAwE;QACxE,EAAE;QACF,mFAAmF;QACnF,wBAAwB;QACxB,qHAAqH;QACrH,yCAAyC;QACzC,IAAI,QAAsC,CAAC;QAE3C,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC;QAClC,MAAM,kBAAkB,GAAG,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,qBAAqB,CAAC;QACtE,oBAAoB;QACpB,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,CAClB,qDAAqD,UAAU,yBAAyB,kBAAkB,EAAE,CAC7G,CAAC;QAEF,IAAI,UAAU,IAAI,kBAAkB,EAAE,CAAC;YACrC,+DAA+D;YAC/D,oBAAoB;YACpB,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC,sDAAsD,CAAC,CAAC;YAC7E,IAAI,CAAC;gBACH,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,qBAAqB,EAAE,CAAC;oBAC9C,MAAM,IAAI,qBAAc,CAAC,oBAAa,CAAC,qBAAqB,EAAE,6CAA6C,CAAC,CAAC;gBAC/G,CAAC;gBACD,MAAM,UAAU,GAAG,CAAC,MAAM,IAAI,CAAC,aAAa,CAAC,qBAAqB,CAAC,OAAO,EAAE,KAAK,CAAC,CAOjF,CAAC;gBAEF,oBAAoB;gBACpB,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,CAClB,yDAAyD,UAAU,CAAC,GAAG,YAAY,UAAU,CAAC,KAAK,IAAI,SAAS,EAAE,CACnH,CAAC;gBAEF,QAAQ,GAAG;oBACT,EAAE,EAAE,UAAU,CAAC,GAAG;oBAClB,KAAK,EAAE,UAAU,CAAC,KAAK;oBACvB,UAAU,EAAE,UAAU,CAAC,UAAU,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;oBAClG,SAAS,EAAE,UAAU,CAAC,WAAW,IAAI,SAAS;oBAC9C,OAAO,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS;iBAChF,CAAC;gBACF,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC,mCAAmC,QAAQ,CAAC,KAAK,IAAI,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAC;YAC3F,CAAC;YAAC,OAAO,QAAQ,EAAE,CAAC;gBAClB,oBAAoB;gBACpB,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,CAClB,gDAAgD,QAAQ,YAAY,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAClH,CAAC;gBACF,MAAM,QAAQ,CAAC;YACjB,CAAC;QACH,CAAC;aAAM,CAAC;YACN,oDAAoD;YACpD,+GAA+G;YAC/G,MAAM,aAAa,GAAG,WAAW,IAAI,OAAO,CAAC;YAE7C,oBAAoB;YACpB,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,CAClB,iFAAiF,aAAa,CAAC,MAAM,oBAAoB,aAAa,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAC7J,CAAC;YAEF,IAAI,CAAC;gBACH,MAAM,cAAc,GAAG,CAAC,MAAM,IAAI,CAAC,aAAa,CAAC,mBAAmB,CAClE,aAAa,EACb,KAAK,EACL,SAAS,CACV,CAAiC,CAAC;gBACnC,QAAQ,GAAG,cAAc,CAAC;gBAC1B,oBAAoB;gBACpB,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,CAClB,iEAAiE,QAAQ,CAAC,EAAE,YAAY,QAAQ,CAAC,KAAK,IAAI,SAAS,EAAE,CACtH,CAAC;gBACF,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC,uCAAuC,QAAQ,CAAC,KAAK,IAAI,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAC;YAC/F,CAAC;YAAC,OAAO,WAAW,EAAE,CAAC;gBACrB,oBAAoB;gBACpB,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,CAClB,yDAAyD,WAAW,YAAY,KAAK,CAAC,CAAC,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CACpI,CAAC;gBACF,MAAM,WAAW,CAAC;YACpB,CAAC;QACH,CAAC;QAED,+DAA+D;QAC/D,oBAAoB;QACpB,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,CAClB,6DAA6D,QAAQ,CAAC,EAAE,qBAAqB,QAAQ,CAAC,KAAK,IAAI,SAAS,EAAE,CAC3H,CAAC;QACF,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;YACpB,oBAAoB;YACpB,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC,sFAAsF,CAAC,CAAC;YAC7G,MAAM,IAAI,qBAAc,CACtB,oBAAa,CAAC,qBAAqB,EACnC,kEAAkE,CACnE,CAAC;QACJ,CAAC;QAED,mDAAmD;QACnD,MAAM,gBAAgB,GAAG,WAAsF,CAAC;QAChH,OAAO;YACL,EAAE,EAAE,QAAQ,CAAC,EAAE;YACf,KAAK,EAAE,QAAQ,CAAC,KAAK,IAAI,EAAE;YAC3B,SAAS,EAAE,QAAQ,CAAC,UAAU,IAAI,gBAAgB,EAAE,SAAS,IAAI,IAAI;YACrE,QAAQ,EAAE,QAAQ,CAAC,SAAS,IAAI,gBAAgB,EAAE,QAAQ,IAAI,IAAI;YAClE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,IAAI,EAAE,GAAG,IAAI,gBAAgB,EAAE,OAAO,IAAI,IAAI;YACzE,QAAQ,EAAE,IAAI,EAAE,4CAA4C;YAC5D,GAAG,EAAE;gBACH,EAAE,EAAE,QAAQ,CAAC,EAAE;gBACf,KAAK,EAAE,QAAQ,CAAC,KAAK;gBACrB,UAAU,EAAE,QAAQ,CAAC,UAAU;gBAC/B,SAAS,EAAE,QAAQ,CAAC,SAAS;gBAC7B,OAAO,EAAE,QAAQ,CAAC,OAAO;aACY;SACxC,CAAC;IACJ,CAAC;CACF;AA7RD,8DA6RC"}

package/dist/src/token-verifier.service.d.ts CHANGED Viewed

@@ -1,13 +1,22 @@
 import { NAuthConfig, ITokenVerifierService } from '@nauth-toolkit/core';
 import { VerifiedFacebookTokenProfile } from './verified-token-profile.interface';
+/**
+ * jose module type (ESM-only dependency).
+ *
+ * IMPORTANT: `jose@6` is ESM-only. This package is compiled to CommonJS by default,
+ * so we load jose via dynamic import to avoid `ERR_REQUIRE_ESM` at runtime.
+ */
+type JoseModule = typeof import('jose');
 /**
  * Token Verifier Service for Facebook OAuth (Platform-Agnostic)
  *
  * Handles secure verification of Facebook access tokens via Graph API.
+ * Also supports verifying Facebook OIDC ID tokens (Limited Login) via JWKS.
  * Validates tokens by calling Facebook's debug_token endpoint.
  *
  * Security Features:
  * - Facebook: Validates access tokens via Facebook Graph API
+ * - Facebook (Limited Login): Validates ID tokens via OIDC JWKS (RS256)
  *
  * This is a plain TypeScript class with no framework dependencies.
  *
@@ -20,7 +29,12 @@ import { VerifiedFacebookTokenProfile } from './verified-token-profile.interface
  */
 export declare class TokenVerifierService implements ITokenVerifierService {
     private readonly logger;
-    constructor(config: NAuthConfig);
+    private facebookJWKS;
+    private readonly loadJose;
+    private joseModulePromise;
+    constructor(config: NAuthConfig, loadJose?: () => Promise<JoseModule>);
+    private getJose;
+    private getFacebookJWKS;
     /**
      * Verify Facebook access token via Graph API
      *
@@ -44,5 +58,33 @@ export declare class TokenVerifierService implements ITokenVerifierService {
      * ```
      */
     verifyFacebookToken(accessToken: string, appId: string, appSecret: string): Promise<VerifiedFacebookTokenProfile>;
+    /**
+     * Verify Facebook ID token (OIDC / Limited Login) with JWT signature validation
+     *
+     * Facebook Limited Login (primarily iOS) returns an ID token (JWT) that must be
+     * verified using Facebook's OIDC JWKS (RS256).
+     *
+     * ⚠️ WARNING: If the client uses `nonce`, the backend cannot validate it unless the
+     * client also sends the original nonce. This method still provides strong security by
+     * validating signature, issuer, audience, and expiry.
+     *
+     * @param idToken - Facebook ID token (JWT)
+     * @param appId - Facebook App ID for audience validation
+     * @returns Minimal verified profile payload (provider-specific)
+     * @throws {NAuthException} SOCIAL_TOKEN_INVALID when token is invalid
+     */
+    verifyFacebookIdToken(idToken: string, appId: string): Promise<{
+        sub: string;
+        email?: string;
+        name?: string;
+        given_name?: string;
+        family_name?: string;
+        picture?: string;
+    }>;
+    /**
+     * Clear cached clients and keys
+     */
+    clearCache(): void;
 }
+export {};
 //# sourceMappingURL=token-verifier.service.d.ts.map

package/dist/src/token-verifier.service.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"token-verifier.service.d.ts","sourceRoot":"","sources":["../../src/token-verifier.service.ts"],"names":[],"mappings":"~~AAAA~~,OAAO,EAAE,WAAW,EAA8C,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AACrH,OAAO,EAAE,4BAA4B,EAAE,MAAM,oCAAoC,CAAC;~~AAwBlF;;;;;;;;;;;;;;;;;GAiBG~~;AACH,qBAAa,oBAAqB,YAAW,qBAAqB;IAChE,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAc;~~gBAEzB~~,MAAM,EAAE,WAAW;~~IAI/B~~;;;;;;;;;;;;;;;;;;;;;OAqBG;IACG,mBAAmB,CACvB,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,MAAM,EACb,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,4BAA4B,CAAC;~~CA8DzC~~"}
1	+ {"version":3,"file":"token-verifier.service.d.ts","sourceRoot":"","sources":["../../src/token-verifier.service.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAA8C,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AACrH,OAAO,EAAE,4BAA4B,EAAE,MAAM,oCAAoC,CAAC;AAElF;;;;;GAKG;AACH,KAAK,UAAU,GAAG,cAAc,MAAM,CAAC,CAAC;AAwBxC;;;;;;;;;;;;;;;;;;;GAmBG;AACH,qBAAa,oBAAqB,YAAW,qBAAqB;IAChE,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAc;IACrC,OAAO,CAAC,YAAY,CAA6D;IACjF,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA4B;IACrD,OAAO,CAAC,iBAAiB,CAAoC;gBAEjD,MAAM,EAAE,WAAW,EAAE,QAAQ,CAAC,EAAE,MAAM,OAAO,CAAC,UAAU,CAAC;YAKvD,OAAO;YAOP,eAAe;IAS7B;;;;;;;;;;;;;;;;;;;;;OAqBG;IACG,mBAAmB,CACvB,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,MAAM,EACb,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,4BAA4B,CAAC;IAqHxC;;;;;;;;;;;;;;OAcG;IACG,qBAAqB,CACzB,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC;QACT,GAAG,EAAE,MAAM,CAAC;QACZ,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,OAAO,CAAC,EAAE,MAAM,CAAC;KAClB,CAAC;IAoEF;;OAEG;IACH,UAAU,IAAI,IAAI;CAInB"}

package/dist/src/token-verifier.service.js CHANGED Viewed

@@ -1,4 +1,37 @@
 "use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.TokenVerifierService = void 0;
 const core_1 = require("@nauth-toolkit/core");
@@ -6,10 +39,12 @@ const core_1 = require("@nauth-toolkit/core");
  * Token Verifier Service for Facebook OAuth (Platform-Agnostic)
  *
  * Handles secure verification of Facebook access tokens via Graph API.
+ * Also supports verifying Facebook OIDC ID tokens (Limited Login) via JWKS.
  * Validates tokens by calling Facebook's debug_token endpoint.
  *
  * Security Features:
  * - Facebook: Validates access tokens via Facebook Graph API
+ * - Facebook (Limited Login): Validates ID tokens via OIDC JWKS (RS256)
  *
  * This is a plain TypeScript class with no framework dependencies.
  *
@@ -22,8 +57,27 @@ const core_1 = require("@nauth-toolkit/core");
  */
 class TokenVerifierService {
     logger;
-    constructor(config) {
+    facebookJWKS = null;
+    loadJose;
+    joseModulePromise = null;
+    constructor(config, loadJose) {
         this.logger = config.logger;
+        this.loadJose = loadJose ?? (() => Promise.resolve().then(() => __importStar(require('jose'))));
+    }
+    async getJose() {
+        if (!this.joseModulePromise) {
+            this.joseModulePromise = this.loadJose();
+        }
+        return await this.joseModulePromise;
+    }
+    async getFacebookJWKS() {
+        if (this.facebookJWKS)
+            return this.facebookJWKS;
+        const jose = await this.getJose();
+        // Facebook OIDC JWKS (used by Limited Login / ID tokens).
+        // Source of truth: https://www.facebook.com/.well-known/openid-configuration
+        this.facebookJWKS = jose.createRemoteJWKSet(new URL('https://www.facebook.com/.well-known/oauth/openid/jwks/'));
+        return this.facebookJWKS;
     }
     /**
      * Verify Facebook access token via Graph API
@@ -49,29 +103,55 @@ class TokenVerifierService {
      */
     async verifyFacebookToken(accessToken, appId, appSecret) {
         try {
+            // TEMP_DEBUG_REMOVE
+            this.logger?.debug?.(`[TEMP_DEBUG_REMOVE] verifyFacebookToken called - token length: ${accessToken.length}, appId: ${appId?.substring(0, 10)}..., appSecret present: ${!!appSecret}`);
             this.logger?.debug?.('[TokenVerifier] Verifying Facebook token with Graph API');
             // Step 1: Verify token with debug_token endpoint
             const debugUrl = `https://graph.facebook.com/debug_token?input_token=${accessToken}&access_token=${appId}|${appSecret}`;
+            // TEMP_DEBUG_REMOVE
+            this.logger?.debug?.(`[TEMP_DEBUG_REMOVE] Calling debug_token endpoint: ${debugUrl.replace(accessToken, 'TOKEN_REDACTED')}`);
             const debugResponse = await fetch(debugUrl);
+            // TEMP_DEBUG_REMOVE
+            this.logger?.debug?.(`[TEMP_DEBUG_REMOVE] debug_token response status: ${debugResponse.status} ${debugResponse.statusText}`);
             if (!debugResponse.ok) {
+                // TEMP_DEBUG_REMOVE
+                const errorText = await debugResponse.text().catch(() => 'Unable to read error response');
+                this.logger?.error?.(`[TEMP_DEBUG_REMOVE] debug_token HTTP error - status: ${debugResponse.status}, body: ${errorText.substring(0, 200)}`);
                 throw new core_1.NAuthException(core_1.AuthErrorCode.SOCIAL_TOKEN_INVALID, 'Facebook token validation failed');
             }
             const debugData = (await debugResponse.json());
+            // TEMP_DEBUG_REMOVE
+            this.logger?.debug?.(`[TEMP_DEBUG_REMOVE] debug_token response data: ${JSON.stringify(debugData).substring(0, 300)}`);
             // Check if token is valid
             if (!debugData.data || !debugData.data.is_valid) {
+                // TEMP_DEBUG_REMOVE
+                this.logger?.error?.(`[TEMP_DEBUG_REMOVE] Token validation failed - is_valid: ${debugData.data?.is_valid}, data present: ${!!debugData.data}`);
                 throw new core_1.NAuthException(core_1.AuthErrorCode.SOCIAL_TOKEN_INVALID, 'Invalid Facebook access token');
             }
             // Check if token belongs to the correct app
+            // TEMP_DEBUG_REMOVE
+            this.logger?.debug?.(`[TEMP_DEBUG_REMOVE] App ID check - token app_id: ${debugData.data.app_id}, expected appId: ${appId}`);
             if (debugData.data.app_id !== appId) {
+                // TEMP_DEBUG_REMOVE
+                this.logger?.error?.(`[TEMP_DEBUG_REMOVE] App ID mismatch - token belongs to app: ${debugData.data.app_id}, expected: ${appId}`);
                 throw new core_1.NAuthException(core_1.AuthErrorCode.SOCIAL_TOKEN_INVALID, 'Token does not belong to this app');
             }
             // Step 2: Get user profile
             const profileUrl = `https://graph.facebook.com/me?fields=id,email,first_name,last_name,picture&access_token=${accessToken}`;
+            // TEMP_DEBUG_REMOVE
+            this.logger?.debug?.(`[TEMP_DEBUG_REMOVE] Calling /me endpoint: ${profileUrl.replace(accessToken, 'TOKEN_REDACTED')}`);
             const profileResponse = await fetch(profileUrl);
+            // TEMP_DEBUG_REMOVE
+            this.logger?.debug?.(`[TEMP_DEBUG_REMOVE] /me response status: ${profileResponse.status} ${profileResponse.statusText}`);
             if (!profileResponse.ok) {
+                // TEMP_DEBUG_REMOVE
+                const errorText = await profileResponse.text().catch(() => 'Unable to read error response');
+                this.logger?.error?.(`[TEMP_DEBUG_REMOVE] /me HTTP error - status: ${profileResponse.status}, body: ${errorText.substring(0, 200)}`);
                 throw new core_1.NAuthException(core_1.AuthErrorCode.SOCIAL_TOKEN_INVALID, 'Failed to fetch Facebook user profile');
             }
             const profile = (await profileResponse.json());
+            // TEMP_DEBUG_REMOVE
+            this.logger?.debug?.(`[TEMP_DEBUG_REMOVE] /me response data: ${JSON.stringify(profile).substring(0, 300)}`);
             this.logger?.log?.(`[TokenVerifier] Facebook token verified (secure): ${profile.email || profile.id}`);
             // Handle picture field - it can be a string or an object with data.url
             let picture;
@@ -93,10 +173,76 @@ class TokenVerifierService {
         }
         catch (error) {
             const errorMessage = error instanceof Error ? error.message : 'Unknown error';
+            // TEMP_DEBUG_REMOVE
+            this.logger?.error?.(`[TEMP_DEBUG_REMOVE] verifyFacebookToken catch block - error type: ${error?.constructor?.name}, message: ${errorMessage}, stack: ${error instanceof Error ? error.stack?.substring(0, 500) : 'N/A'}`);
             this.logger?.error?.(`[TokenVerifier] Facebook token verification FAILED: ${errorMessage}`);
             throw new core_1.NAuthException(core_1.AuthErrorCode.SOCIAL_TOKEN_INVALID, `Facebook token verification failed: ${errorMessage}`);
         }
     }
+    /**
+     * Verify Facebook ID token (OIDC / Limited Login) with JWT signature validation
+     *
+     * Facebook Limited Login (primarily iOS) returns an ID token (JWT) that must be
+     * verified using Facebook's OIDC JWKS (RS256).
+     *
+     * ⚠️ WARNING: If the client uses `nonce`, the backend cannot validate it unless the
+     * client also sends the original nonce. This method still provides strong security by
+     * validating signature, issuer, audience, and expiry.
+     *
+     * @param idToken - Facebook ID token (JWT)
+     * @param appId - Facebook App ID for audience validation
+     * @returns Minimal verified profile payload (provider-specific)
+     * @throws {NAuthException} SOCIAL_TOKEN_INVALID when token is invalid
+     */
+    async verifyFacebookIdToken(idToken, appId) {
+        try {
+            // TEMP_DEBUG_REMOVE
+            this.logger?.debug?.(`[TEMP_DEBUG_REMOVE] verifyFacebookIdToken called - token length: ${idToken.length}, appId: ${appId?.substring(0, 10)}..., token preview: ${idToken.substring(0, 50)}...`);
+            const jose = await this.getJose();
+            const jwks = await this.getFacebookJWKS();
+            this.logger?.debug?.('[TokenVerifier] Verifying Facebook ID token (OIDC / Limited Login)');
+            // TEMP_DEBUG_REMOVE
+            this.logger?.debug?.(`[TEMP_DEBUG_REMOVE] Calling jwtVerify with issuer: https://www.facebook.com, audience: ${appId}`);
+            const { payload } = await jose.jwtVerify(idToken, jwks, {
+                issuer: 'https://www.facebook.com',
+                audience: appId,
+                clockTolerance: 300, // 5 minutes leeway
+            });
+            // TEMP_DEBUG_REMOVE
+            this.logger?.debug?.(`[TEMP_DEBUG_REMOVE] jwtVerify succeeded - payload keys: ${Object.keys(payload).join(', ')}`);
+            const p = payload;
+            // TEMP_DEBUG_REMOVE
+            this.logger?.debug?.(`[TEMP_DEBUG_REMOVE] Payload extraction - sub: ${p.sub || 'MISSING'}, email: ${p.email || 'MISSING'}, name: ${p.name || 'MISSING'}`);
+            if (!p.sub) {
+                // TEMP_DEBUG_REMOVE
+                this.logger?.error?.('[TEMP_DEBUG_REMOVE] Missing sub claim in JWT payload');
+                throw new core_1.NAuthException(core_1.AuthErrorCode.SOCIAL_TOKEN_INVALID, 'Missing required fields in Facebook token (sub)');
+            }
+            this.logger?.log?.(`[TokenVerifier] Facebook ID token verified (secure): ${p.email || p.sub}`);
+            return {
+                sub: p.sub,
+                email: p.email,
+                name: p.name,
+                given_name: p.given_name,
+                family_name: p.family_name,
+                picture: p.picture,
+            };
+        }
+        catch (error) {
+            const errorMessage = error instanceof Error ? error.message : 'Unknown error';
+            // TEMP_DEBUG_REMOVE
+            this.logger?.error?.(`[TEMP_DEBUG_REMOVE] verifyFacebookIdToken catch block - error type: ${error?.constructor?.name}, message: ${errorMessage}, stack: ${error instanceof Error ? error.stack?.substring(0, 500) : 'N/A'}`);
+            this.logger?.error?.(`[TokenVerifier] Facebook ID token verification FAILED: ${errorMessage}`);
+            throw new core_1.NAuthException(core_1.AuthErrorCode.SOCIAL_TOKEN_INVALID, `Facebook ID token verification failed: ${errorMessage}`);
+        }
+    }
+    /**
+     * Clear cached clients and keys
+     */
+    clearCache() {
+        this.facebookJWKS = null;
+        this.joseModulePromise = null;
+    }
 }
 exports.TokenVerifierService = TokenVerifierService;
 //# sourceMappingURL=token-verifier.service.js.map

package/dist/src/token-verifier.service.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"token-verifier.service.js","sourceRoot":"","sources":["../../src/token-verifier.service.ts"],"names":[],"mappings":"~~;;;AAAA~~,8CAAqH;~~AAyBrH;;;;;;;;;;;;;;;;;GAiBG~~;AACH,MAAa,oBAAoB;IACd,MAAM,CAAc;~~IAErC~~,YAAY,MAAmB;~~QAC7B~~,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,MAAqB,CAAC;~~IAC7C~~,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,KAAK,CAAC,mBAAmB,CACvB,WAAmB,EACnB,KAAa,EACb,SAAiB;QAEjB,IAAI,CAAC;YACH,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC,yDAAyD,CAAC,CAAC;YAEhF,iDAAiD;YACjD,MAAM,QAAQ,GAAG,sDAAsD,WAAW,iBAAiB,KAAK,IAAI,SAAS,EAAE,CAAC;YACxH,MAAM,aAAa,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,CAAC;YAE5C,IAAI,CAAC,aAAa,CAAC,EAAE,EAAE,CAAC;gBACtB,MAAM,IAAI,qBAAc,CAAC,oBAAa,CAAC,oBAAoB,EAAE,kCAAkC,CAAC,CAAC;YACnG,CAAC;YAED,MAAM,SAAS,GAAG,CAAC,MAAM,aAAa,CAAC,IAAI,EAAE,CAA+B,CAAC;~~YAE7E~~,0BAA0B;YAC1B,IAAI,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;gBAChD,MAAM,IAAI,qBAAc,CAAC,oBAAa,CAAC,oBAAoB,EAAE,+BAA+B,CAAC,CAAC;YAChG,CAAC;YAED,4CAA4C;YAC5C,IAAI,SAAS,CAAC,IAAI,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;gBACpC,MAAM,IAAI,qBAAc,CAAC,oBAAa,CAAC,oBAAoB,EAAE,mCAAmC,CAAC,CAAC;YACpG,CAAC;YAED,2BAA2B;YAC3B,MAAM,UAAU,GAAG,2FAA2F,WAAW,EAAE,CAAC;YAC5H,MAAM,eAAe,GAAG,MAAM,KAAK,CAAC,UAAU,CAAC,CAAC;YAEhD,IAAI,CAAC,eAAe,CAAC,EAAE,EAAE,CAAC;gBACxB,MAAM,IAAI,qBAAc,CAAC,oBAAa,CAAC,oBAAoB,EAAE,uCAAuC,CAAC,CAAC;YACxG,CAAC;YAED,MAAM,OAAO,GAAG,CAAC,MAAM,eAAe,CAAC,IAAI,EAAE,CAAgC,CAAC;~~YAE9E~~,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,qDAAqD,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;YAEvG,uEAAuE;YACvE,IAAI,OAA8C,CAAC;YACnD,IAAI,OAAO,OAAO,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;gBACxC,gEAAgE;gBAChE,OAAO,GAAG,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;YAC/C,CAAC;iBAAM,IAAI,OAAO,CAAC,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;gBACtC,sDAAsD;gBACtD,OAAO,GAAG,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YACxD,CAAC;YAED,OAAO;gBACL,EAAE,EAAE,OAAO,CAAC,EAAE;gBACd,KAAK,EAAE,OAAO,CAAC,KAAK;gBACpB,UAAU,EAAE,OAAO,CAAC,UAAU;gBAC9B,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,OAAO;aACR,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,YAAY,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC;YAC9E,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC,uDAAuD,YAAY,EAAE,CAAC,CAAC;YAC5F,MAAM,IAAI,qBAAc,CACtB,oBAAa,CAAC,oBAAoB,EAClC,uCAAuC,YAAY,EAAE,CACtD,CAAC;QACJ,CAAC;IACH,CAAC;~~CACF~~;AA/FD,~~oDA+FC~~"}
1	+ {"version":3,"file":"token-verifier.service.js","sourceRoot":"","sources":["../../src/token-verifier.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AACA,8CAAqH;AAiCrH;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAa,oBAAoB;IACd,MAAM,CAAc;IAC7B,YAAY,GAAwD,IAAI,CAAC;IAChE,QAAQ,CAA4B;IAC7C,iBAAiB,GAA+B,IAAI,CAAC;IAE7D,YAAY,MAAmB,EAAE,QAAoC;QACnE,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,MAAqB,CAAC;QAC3C,IAAI,CAAC,QAAQ,GAAG,QAAQ,IAAI,CAAC,GAAG,EAAE,CAAC,kDAAO,MAAM,GAAwB,CAAC,CAAC;IAC5E,CAAC;IAEO,KAAK,CAAC,OAAO;QACnB,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,CAAC;YAC5B,IAAI,CAAC,iBAAiB,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;QAC3C,CAAC;QACD,OAAO,MAAM,IAAI,CAAC,iBAAiB,CAAC;IACtC,CAAC;IAEO,KAAK,CAAC,eAAe;QAC3B,IAAI,IAAI,CAAC,YAAY;YAAE,OAAO,IAAI,CAAC,YAAY,CAAC;QAChD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;QAClC,0DAA0D;QAC1D,6EAA6E;QAC7E,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,kBAAkB,CAAC,IAAI,GAAG,CAAC,yDAAyD,CAAC,CAAC,CAAC;QAChH,OAAO,IAAI,CAAC,YAAY,CAAC;IAC3B,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,KAAK,CAAC,mBAAmB,CACvB,WAAmB,EACnB,KAAa,EACb,SAAiB;QAEjB,IAAI,CAAC;YACH,oBAAoB;YACpB,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,CAClB,kEAAkE,WAAW,CAAC,MAAM,YAAY,KAAK,EAAE,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,2BAA2B,CAAC,CAAC,SAAS,EAAE,CAChK,CAAC;YACF,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC,yDAAyD,CAAC,CAAC;YAEhF,iDAAiD;YACjD,MAAM,QAAQ,GAAG,sDAAsD,WAAW,iBAAiB,KAAK,IAAI,SAAS,EAAE,CAAC;YACxH,oBAAoB;YACpB,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,CAClB,qDAAqD,QAAQ,CAAC,OAAO,CAAC,WAAW,EAAE,gBAAgB,CAAC,EAAE,CACvG,CAAC;YACF,MAAM,aAAa,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,CAAC;YAE5C,oBAAoB;YACpB,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,CAClB,oDAAoD,aAAa,CAAC,MAAM,IAAI,aAAa,CAAC,UAAU,EAAE,CACvG,CAAC;YAEF,IAAI,CAAC,aAAa,CAAC,EAAE,EAAE,CAAC;gBACtB,oBAAoB;gBACpB,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,+BAA+B,CAAC,CAAC;gBAC1F,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,CAClB,wDAAwD,aAAa,CAAC,MAAM,WAAW,SAAS,CAAC,SAAS,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CACrH,CAAC;gBACF,MAAM,IAAI,qBAAc,CAAC,oBAAa,CAAC,oBAAoB,EAAE,kCAAkC,CAAC,CAAC;YACnG,CAAC;YAED,MAAM,SAAS,GAAG,CAAC,MAAM,aAAa,CAAC,IAAI,EAAE,CAA+B,CAAC;YAC7E,oBAAoB;YACpB,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,CAClB,kDAAkD,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,SAAS,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAChG,CAAC;YAEF,0BAA0B;YAC1B,IAAI,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;gBAChD,oBAAoB;gBACpB,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,CAClB,2DAA2D,SAAS,CAAC,IAAI,EAAE,QAAQ,mBAAmB,CAAC,CAAC,SAAS,CAAC,IAAI,EAAE,CACzH,CAAC;gBACF,MAAM,IAAI,qBAAc,CAAC,oBAAa,CAAC,oBAAoB,EAAE,+BAA+B,CAAC,CAAC;YAChG,CAAC;YAED,4CAA4C;YAC5C,oBAAoB;YACpB,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,CAClB,oDAAoD,SAAS,CAAC,IAAI,CAAC,MAAM,qBAAqB,KAAK,EAAE,CACtG,CAAC;YACF,IAAI,SAAS,CAAC,IAAI,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;gBACpC,oBAAoB;gBACpB,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,CAClB,+DAA+D,SAAS,CAAC,IAAI,CAAC,MAAM,eAAe,KAAK,EAAE,CAC3G,CAAC;gBACF,MAAM,IAAI,qBAAc,CAAC,oBAAa,CAAC,oBAAoB,EAAE,mCAAmC,CAAC,CAAC;YACpG,CAAC;YAED,2BAA2B;YAC3B,MAAM,UAAU,GAAG,2FAA2F,WAAW,EAAE,CAAC;YAC5H,oBAAoB;YACpB,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,CAClB,6CAA6C,UAAU,CAAC,OAAO,CAAC,WAAW,EAAE,gBAAgB,CAAC,EAAE,CACjG,CAAC;YACF,MAAM,eAAe,GAAG,MAAM,KAAK,CAAC,UAAU,CAAC,CAAC;YAEhD,oBAAoB;YACpB,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,CAClB,4CAA4C,eAAe,CAAC,MAAM,IAAI,eAAe,CAAC,UAAU,EAAE,CACnG,CAAC;YAEF,IAAI,CAAC,eAAe,CAAC,EAAE,EAAE,CAAC;gBACxB,oBAAoB;gBACpB,MAAM,SAAS,GAAG,MAAM,eAAe,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,+BAA+B,CAAC,CAAC;gBAC5F,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,CAClB,gDAAgD,eAAe,CAAC,MAAM,WAAW,SAAS,CAAC,SAAS,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAC/G,CAAC;gBACF,MAAM,IAAI,qBAAc,CAAC,oBAAa,CAAC,oBAAoB,EAAE,uCAAuC,CAAC,CAAC;YACxG,CAAC;YAED,MAAM,OAAO,GAAG,CAAC,MAAM,eAAe,CAAC,IAAI,EAAE,CAAgC,CAAC;YAC9E,oBAAoB;YACpB,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC,0CAA0C,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;YAE5G,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,qDAAqD,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;YAEvG,uEAAuE;YACvE,IAAI,OAA8C,CAAC;YACnD,IAAI,OAAO,OAAO,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;gBACxC,gEAAgE;gBAChE,OAAO,GAAG,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;YAC/C,CAAC;iBAAM,IAAI,OAAO,CAAC,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;gBACtC,sDAAsD;gBACtD,OAAO,GAAG,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YACxD,CAAC;YAED,OAAO;gBACL,EAAE,EAAE,OAAO,CAAC,EAAE;gBACd,KAAK,EAAE,OAAO,CAAC,KAAK;gBACpB,UAAU,EAAE,OAAO,CAAC,UAAU;gBAC9B,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,OAAO;aACR,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,YAAY,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC;YAC9E,oBAAoB;YACpB,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,CAClB,qEAAqE,KAAK,EAAE,WAAW,EAAE,IAAI,cAAc,YAAY,YAAY,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,CACrM,CAAC;YACF,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC,uDAAuD,YAAY,EAAE,CAAC,CAAC;YAC5F,MAAM,IAAI,qBAAc,CACtB,oBAAa,CAAC,oBAAoB,EAClC,uCAAuC,YAAY,EAAE,CACtD,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;;;OAcG;IACH,KAAK,CAAC,qBAAqB,CACzB,OAAe,EACf,KAAa;QASb,IAAI,CAAC;YACH,oBAAoB;YACpB,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,CAClB,oEAAoE,OAAO,CAAC,MAAM,YAAY,KAAK,EAAE,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,uBAAuB,OAAO,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAC1K,CAAC;YACF,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;YAClC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,eAAe,EAAE,CAAC;YAC1C,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC,oEAAoE,CAAC,CAAC;YAE3F,oBAAoB;YACpB,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,CAClB,0FAA0F,KAAK,EAAE,CAClG,CAAC;YACF,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE;gBACtD,MAAM,EAAE,0BAA0B;gBAClC,QAAQ,EAAE,KAAK;gBACf,cAAc,EAAE,GAAG,EAAE,mBAAmB;aACzC,CAAC,CAAC;YAEH,oBAAoB;YACpB,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,CAClB,2DAA2D,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC7F,CAAC;YAEF,MAAM,CAAC,GAAG,OAOT,CAAC;YAEF,oBAAoB;YACpB,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,CAClB,iDAAiD,CAAC,CAAC,GAAG,IAAI,SAAS,YAAY,CAAC,CAAC,KAAK,IAAI,SAAS,WAAW,CAAC,CAAC,IAAI,IAAI,SAAS,EAAE,CACpI,CAAC;YAEF,IAAI,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;gBACX,oBAAoB;gBACpB,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC,sDAAsD,CAAC,CAAC;gBAC7E,MAAM,IAAI,qBAAc,CAAC,oBAAa,CAAC,oBAAoB,EAAE,iDAAiD,CAAC,CAAC;YAClH,CAAC;YAED,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,wDAAwD,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;YAC/F,OAAO;gBACL,GAAG,EAAE,CAAC,CAAC,GAAG;gBACV,KAAK,EAAE,CAAC,CAAC,KAAK;gBACd,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,UAAU,EAAE,CAAC,CAAC,UAAU;gBACxB,WAAW,EAAE,CAAC,CAAC,WAAW;gBAC1B,OAAO,EAAE,CAAC,CAAC,OAAO;aACnB,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,YAAY,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC;YAC9E,oBAAoB;YACpB,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,CAClB,uEAAuE,KAAK,EAAE,WAAW,EAAE,IAAI,cAAc,YAAY,YAAY,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,CACvM,CAAC;YACF,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC,0DAA0D,YAAY,EAAE,CAAC,CAAC;YAC/F,MAAM,IAAI,qBAAc,CACtB,oBAAa,CAAC,oBAAoB,EAClC,0CAA0C,YAAY,EAAE,CACzD,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;OAEG;IACH,UAAU;QACR,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC;QACzB,IAAI,CAAC,iBAAiB,GAAG,IAAI,CAAC;IAChC,CAAC;CACF;AA9QD,oDA8QC"}