@neohm/nestend 4.1.1 → 5.0.1

package/dist/auth/services/auth.service.js

@@ -11,11 +11,7 @@ var __metadata = (this && this.__metadata) || function (k, v) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.AuthService = void 0;
 const common_1 = require("@nestjs/common");
-const jwt_1 = require("@nestjs/jwt");
 const typeorm_1 = require("typeorm");
-const crypto_1 = require("crypto");
-const system_refresh_token_entity_1 = require("../entities/system.refresh.token.entity");
-const system_auth_session_entity_1 = require("../entities/system.auth.session.entity");
 const user_entity_1 = require("../entities/user.entity");
 const user_role_entity_1 = require("../entities/user.role.entity");
 const tenant_user_entity_1 = require("../entities/tenant.user.entity");
@@ -23,17 +19,20 @@ const tenant_entity_1 = require("../../tenant/entities/tenant.entity");
 const role_tier_enum_1 = require("../enums/role.tier.enum");
 const tenant_role_enum_1 = require("../enums/tenant.role.enum");
 const user_type_enum_1 = require("../enums/user.type.enum");
-const cache_service_1 = require("../../common/services/cache.service");
 const scope_service_1 = require("./scope.service");
+const token_service_1 = require("./token.service");
 const access_exception_1 = require("../../global/exceptions/access.exception");
 const auth_1 = require("../helpers/auth");
 const auth_utilities_1 = require("../utilities/auth.utilities");
+const auth_config_1 = require("../utilities/auth.config");
+const access_revocation_1 = require("../utilities/access.revocation");
+const auth_message_enum_1 = require("../enums/auth.message.enum");
 let AuthService = class AuthService {
-    constructor(jwtService, cacheService, dataSource, scopeService) {
-        this.jwtService = jwtService;
-        this.cacheService = cacheService;
+    constructor(tokenService, dataSource, scopeService, config) {
+        this.tokenService = tokenService;
         this.dataSource = dataSource;
         this.scopeService = scopeService;
+        this.config = config;
     }
     async validateRole(roleIdentifier) {
         const access = await this.resolveAccess(roleIdentifier);
@@ -47,7 +46,7 @@ let AuthService = class AuthService {
     async resolveAccess(roleIdentifier) {
         const user = auth_1.Auth.user();
         if (!user)
-            throw new access_exception_1.AccessException('Authentication required: no active session.');
+            throw new common_1.UnauthorizedException('Authentication required: no active session.');
         const roles = await this.tenantRoles(user.id, user.organization_id);
         const holdsRole = !roleIdentifier || this.satisfiesRole(roleIdentifier, roles);
         if (!holdsRole && !this.impersonationYieldsRole(user)) {
@@ -62,7 +61,11 @@ let AuthService = class AuthService {
         if (!tenantId)
             return [];
         const userRoles = await this.dataSource.getRepository(user_role_entity_1.UserRoleEntity).find({
-            where: { user_id: userId, tenant_id: tenantId },
+            where: {
+                user_id: userId,
+                tenant_id: tenantId,
+                role: { is_active: true },
+            },
             relations: { role: true },
         });
         return userRoles
@@ -114,7 +117,7 @@ let AuthService = class AuthService {
     async validateAccess(scopeIdentifier, roleIdentifier) {
         const user = auth_1.Auth.user();
         if (!user)
-            throw new access_exception_1.AccessException('Authentication required: no active session.');
+            throw new common_1.UnauthorizedException('Authentication required: no active session.');
         if (!user.organization_id)
             throw new access_exception_1.AccessException('This session is not working in an organization.');
         const scopes = await this.scopeService.tenantScopes(user.organization_id);
@@ -127,149 +130,95 @@ let AuthService = class AuthService {
             .getRepository(user_entity_1.UserEntity)
             .createQueryBuilder('user')
             .addSelect('user.password')
-            .where('lower(user.email) = lower(:email)', { email })
+            .where('lower(user.email) = lower(:email)', { email: email.trim() })
             .getOne();
         if (!user || !user.password) {
             await auth_utilities_1.AuthUtility.compareAgainstDummy(password);
-            throw new common_1.UnauthorizedException('Invalid email or password');
+            throw new common_1.UnauthorizedException(auth_message_enum_1.AuthMessage.INVALID_CREDENTIALS);
         }
         const matches = await auth_utilities_1.AuthUtility.comparePassword(password, user.password);
-        if (!matches) {
-            throw new common_1.UnauthorizedException('Invalid email or password');
-        }
-        if (!user.active) {
-            throw new common_1.UnauthorizedException('This account is inactive');
-        }
+        if (!matches || !user.active || this.oneTimePasswordExpired(user))
+            throw new common_1.UnauthorizedException(auth_message_enum_1.AuthMessage.INVALID_CREDENTIALS);
+        if (auth_utilities_1.AuthUtility.needsRehash(user.password))
+            await this.dataSource
+                .getRepository(user_entity_1.UserEntity)
+                .update({ id: user.id }, { password: await auth_utilities_1.AuthUtility.hashPassword(password) });
         delete user.password;
         return user;
     }
+    oneTimePasswordExpired(user) {
+        return (user.password_change_required &&
+            !!user.one_time_password_expires_at &&
+            user.one_time_password_expires_at.getTime() < Date.now());
+    }
     async issueTokens(user, context) {
-        const jti = (0, crypto_1.randomUUID)();
-        const accessExpiry = process.env.ACCESS_TOKEN_EXPIRY;
-        const refreshExpiry = process.env.REFRESH_TOKEN_EXPIRY;
-        const tenantId = context?.tenant_id ?? null;
-        const sessionIdentifier = this.hashToken(`${(0, crypto_1.randomUUID)()}:${user.id}`);
-        const sessionExpiresAt = new Date(Date.now() + auth_utilities_1.AuthUtility.parseExpiryMs(accessExpiry));
-        await this.sessionRepo.save(this.sessionRepo.create({
-            user_id: user.id,
-            is_admin: false,
-            tenant_id: tenantId,
-            session_identifier: sessionIdentifier,
-            expires_at: sessionExpiresAt,
-            invalidated_at: null,
-        }));
-        const accessToken = await this.jwtService.signAsync({
-            sub: user.id,
-            email: user.email,
-            jti,
-            sid: sessionIdentifier,
-            ...(tenantId ? { tid: tenantId } : {}),
-        }, {
-            secret: process.env.ACCESS_TOKEN_SECRET,
-            expiresIn: accessExpiry,
+        const issued = await this.tokenService.issue('user', user.id, {
+            context,
+            tenantId: context?.tenant_id ?? null,
         });
-        const refreshToken = await this.jwtService.signAsync({ sub: user.id, email: user.email, jti: (0, crypto_1.randomUUID)() }, {
-            secret: process.env.REFRESH_TOKEN_SECRET,
-            expiresIn: refreshExpiry,
+        return {
+            access_token: issued.access_token,
+            refresh_token: issued.refresh_token,
+        };
+    }
+    async issueAccessToken(user, context, ttlSeconds = this.config.impersonationTokenTtlSeconds) {
+        const issued = await this.tokenService.issue('user', user.id, {
+            context,
+            tenantId: context?.tenant_id ?? null,
+            withRefreshToken: false,
+            accessTtlSeconds: ttlSeconds,
         });
-        const tokenHash = this.hashToken(refreshToken);
-        const expiresAt = new Date(Date.now() + auth_utilities_1.AuthUtility.parseExpiryMs(refreshExpiry));
-        await this.refreshTokenRepo.save(this.refreshTokenRepo.create({
-            user_id: user.id,
-            is_admin: false,
-            tenant_id: tenantId,
-            token_hash: tokenHash,
-            expires_at: expiresAt,
-            revoked_at: null,
-            ip_address: context?.ip_address ?? null,
-            user_agent: context?.user_agent ?? null,
-        }));
-        return { access_token: accessToken, refresh_token: refreshToken };
+        return { access_token: issued.access_token, expires_at: issued.expires_at };
     }
     async refresh(rawRefreshToken, context) {
-        let payload;
-        try {
-            payload = await this.jwtService.verifyAsync(rawRefreshToken, {
-                secret: process.env.REFRESH_TOKEN_SECRET,
-            });
-        }
-        catch {
-            throw new common_1.UnauthorizedException('Invalid refresh token');
-        }
-        const tokenHash = this.hashToken(rawRefreshToken);
-        const stored = await this.refreshTokenRepo.findOne({
-            where: {
-                user_id: payload.sub,
-                token_hash: tokenHash,
-                revoked_at: (0, typeorm_1.IsNull)(),
-            },
-        });
-        if (!stored)
-            throw new common_1.UnauthorizedException('Refresh token not found or already revoked');
-        if (stored.expires_at < new Date())
-            throw new common_1.UnauthorizedException('Refresh token has expired');
-        stored.revoked_at = new Date();
-        await this.refreshTokenRepo.save(stored);
-        return this.issueTokens({ id: payload.sub, email: payload.email }, {
-            ...context,
-            tenant_id: await this.refreshedTenant(payload.sub, stored.tenant_id),
-        });
+        const issued = await this.tokenService.rotate('user', rawRefreshToken, { context }, async (consumed) => ({
+            tenantId: await this.refreshedTenant(consumed.user_id, consumed.tenant_id),
+        }));
+        return {
+            access_token: issued.access_token,
+            refresh_token: issued.refresh_token,
+        };
     }
     async refreshedTenant(userId, tenantId) {
         const user = await this.dataSource
             .getRepository(user_entity_1.UserEntity)
             .findOne({ where: { id: userId } });
-        if (!user?.active)
+        if (!user?.active || user.user_type === user_type_enum_1.UserType.SYSTEM_USER)
             throw new common_1.UnauthorizedException('This account is no longer active');
         if (!tenantId)
-            return undefined;
-        const tenantActive = await this.dataSource
+            return null;
+        const isMember = (await this.dataSource
             .getRepository(tenant_entity_1.TenantEntity)
-            .existsBy({ id: tenantId, is_active: true });
-        if (user.user_type === user_type_enum_1.UserType.SYSTEM_USER) {
-            if (!tenantActive || !user.has_global_access)
-                throw new common_1.UnauthorizedException('This organization can no longer be accessed');
-            return tenantId;
-        }
-        const isMember = tenantActive &&
+            .existsBy({ id: tenantId, is_active: true })) &&
             (await this.dataSource
                 .getRepository(tenant_user_entity_1.TenantUserEntity)
                 .existsBy({ user_id: userId, tenant_id: tenantId, is_active: true }));
-        return isMember ? tenantId : undefined;
+        return isMember ? tenantId : null;
     }
     async revokeAllForUser(userUuid) {
-        await this.refreshTokenRepo.update({ user_id: userUuid, revoked_at: (0, typeorm_1.IsNull)() }, { revoked_at: new Date() });
+        await this.dataSource.transaction((trx) => access_revocation_1.AccessRevocation.revokeAll(trx, userUuid, false));
     }
-    async revokeOne(rawRefreshToken) {
-        const tokenHash = this.hashToken(rawRefreshToken);
-        await this.refreshTokenRepo.update({ token_hash: tokenHash, revoked_at: (0, typeorm_1.IsNull)() }, { revoked_at: new Date() });
-    }
-    async revokeAccessToken(jti, ttlSeconds) {
-        await this.cacheService.setRaw(`blocklist:${jti}`, '1', ttlSeconds);
+    async revokeOne(rawRefreshToken, userUuid) {
+        return this.tokenService.revokeRefreshToken('user', rawRefreshToken, userUuid);
     }
     async logout(rawRefreshToken) {
-        await this.revokeOne(rawRefreshToken);
+        const userId = auth_1.Auth.user()?.id ??
+            (await this.tokenService.verify('refresh', 'user', rawRefreshToken))
+                ?.sub;
+        if (!userId)
+            return false;
         const sessionIdentifier = auth_1.Auth.session();
-        if (sessionIdentifier) {
-            await this.sessionRepo.update({ session_identifier: sessionIdentifier, is_admin: false }, { invalidated_at: new Date() });
-        }
-    }
-    hashToken(token) {
-        return (0, crypto_1.createHash)('sha256').update(token).digest('hex');
-    }
-    get refreshTokenRepo() {
-        return this.dataSource.getRepository(system_refresh_token_entity_1.SystemRefreshTokenEntity);
-    }
-    get sessionRepo() {
-        return this.dataSource.getRepository(system_auth_session_entity_1.SystemAuthSessionEntity);
+        if (sessionIdentifier)
+            await this.tokenService.invalidateSession('user', sessionIdentifier, userId);
+        return this.revokeOne(rawRefreshToken, userId);
     }
 };
 exports.AuthService = AuthService;
 exports.AuthService = AuthService = __decorate([
     (0, common_1.Injectable)(),
-    __metadata("design:paramtypes", [jwt_1.JwtService,
-        cache_service_1.CacheService,
+    __metadata("design:paramtypes", [token_service_1.TokenService,
         typeorm_1.DataSource,
-        scope_service_1.ScopeService])
+        scope_service_1.ScopeService,
+        auth_config_1.AuthConfig])
 ], AuthService);
 //# sourceMappingURL=auth.service.js.map

package/dist/auth/services/auth.service.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.service.js","sourceRoot":"","sources":["../../../src/auth/services/auth.service.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,2CAAmE;AACnE,qCAAyD;AACzD,qCAAyD;AACzD,mCAAgD;AAChD,yFAAmF;AACnF,uFAAiF;AACjF,yDAAqD;AACrD,mEAA8D;AAE9D,uEAAkE;AAClE,uEAAmE;AACnE,4DAAmD;AACnD,gEAAuD;AACvD,4DAAmD;AACnD,uEAAmE;AACnE,mDAA+C;AAC/C,+EAA2E;AAO3E,0CAAuC;AACvC,gEAA0D;AAGnD,IAAM,WAAW,GAAjB,MAAM,WAAW;IACtB,YACmB,UAAsB,EACtB,YAA0B,EAC1B,UAAsB,EACtB,YAA0B;QAH1B,eAAU,GAAV,UAAU,CAAY;QACtB,iBAAY,GAAZ,YAAY,CAAc;QAC1B,eAAU,GAAV,UAAU,CAAY;QACtB,iBAAY,GAAZ,YAAY,CAAc;IAC1C,CAAC;IAgBJ,KAAK,CAAC,YAAY,CAAC,cAAuB;QACxC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,cAAc,CAAC,CAAC;QACxD,IAAI,MAAM,CAAC,IAAI,CAAC,wBAAwB;YACtC,MAAM,IAAI,kCAAe,CACvB,kDAAkD,CACnD,CAAC;QACJ,OAAO,MAAM,CAAC;IAChB,CAAC;IAOD,KAAK,CAAC,gBAAgB;QACpB,OAAO,IAAI,CAAC,aAAa,EAAE,CAAC;IAC9B,CAAC;IAEO,KAAK,CAAC,aAAa,CACzB,cAAuB;QAEvB,MAAM,IAAI,GAAG,WAAI,CAAC,IAAI,EAA4B,CAAC;QACnD,IAAI,CAAC,IAAI;YACP,MAAM,IAAI,kCAAe,CAAC,6CAA6C,CAAC,CAAC;QAE3E,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;QAEpE,MAAM,SAAS,GACb,CAAC,cAAc,IAAI,IAAI,CAAC,aAAa,CAAC,cAAc,EAAE,KAAK,CAAC,CAAC;QAE/D,IAAI,CAAC,SAAS,IAAI,CAAC,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,EAAE,CAAC;YACtD,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC;gBAC7C,CAAC,CAAC,iBAAiB,cAAc,GAAG;gBACpC,CAAC,CAAC,QAAQ,cAAc,GAAG,CAAC;YAC9B,MAAM,IAAI,kCAAe,CAAC,wBAAwB,WAAW,QAAQ,CAAC,CAAC;QACzE,CAAC;QAED,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;IACzB,CAAC;IAMD,KAAK,CAAC,WAAW,CACf,MAAc,EACd,QAAmC;QAEnC,IAAI,CAAC,QAAQ;YAAE,OAAO,EAAE,CAAC;QAEzB,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,iCAAc,CAAC,CAAC,IAAI,CAAC;YACzE,KAAK,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE;YAC/C,SAAS,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE;SAC1B,CAAC,CAAC;QACH,OAAO,SAAS;aACb,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC;aAChC,MAAM,CAAC,CAAC,IAAI,EAAoC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAChE,CAAC;IAgBO,aAAa,CAAC,QAAgB,EAAE,KAAyB;QAC/D,IAAI,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QAE9C,MAAM,YAAY,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC3C,IAAI,CAAC,YAAY;YACf,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC;QAE5D,MAAM,cAAc,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAC/C,MAAM,YAAY,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QAE/C,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE;YACzB,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YAC9C,OAAO,CACL,CAAC,CAAC,QAAQ;gBACV,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,cAAc;gBACjD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,YAAY,CACtC,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC;IAGO,gBAAgB,CAAC,KAAyB;QAChD,OAAO,KAAK,CAAC,IAAI,CACf,CAAC,IAAI,EAAE,EAAE,CAAE,IAAI,CAAC,UAAyB,KAAK,6BAAU,CAAC,YAAY,CACtE,CAAC;IACJ,CAAC;IAGO,MAAM,CAAC,cAAsB;QACnC,MAAM,SAAS,GAAG,cAAc,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QAGlD,IAAI,SAAS,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QAE/B,MAAM,IAAI,GAAG,cAAc,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC;QACjD,OAAO,MAAM,CAAC,MAAM,CAAC,yBAAQ,CAAC,CAAC,QAAQ,CAAC,IAAgB,CAAC;YACvD,CAAC,CAAE,IAAiB;YACpB,CAAC,CAAC,IAAI,CAAC;IACX,CAAC;IAGO,QAAQ,CAAC,cAAsB;QACrC,OAAO,cAAc,CAAC,KAAK,CAAC,CAAC,EAAE,cAAc,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC;IAClE,CAAC;IAOO,MAAM,CAAC,IAAc;QAC3B,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,yBAAQ,CAAC,CAAC;QAC1C,OAAO,SAAS,CAAC,MAAM,GAAG,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACpD,CAAC;IAMO,uBAAuB,CAAC,IAAgB;QAC9C,OAAO,WAAI,CAAC,eAAe,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC;IAC5D,CAAC;IAMD,iBAAiB,CAAC,IAAgB;QAChC,IAAI,IAAI,CAAC,SAAS,KAAK,yBAAQ,CAAC,WAAW,EAAE,CAAC;YAC5C,MAAM,IAAI,kCAAe,CACvB,2DAA2D,CAC5D,CAAC;QACJ,CAAC;IACH,CAAC;IAeD,KAAK,CAAC,cAAc,CAClB,eAAuB,EACvB,cAAuB;QAEvB,MAAM,IAAI,GAAG,WAAI,CAAC,IAAI,EAA4B,CAAC;QACnD,IAAI,CAAC,IAAI;YACP,MAAM,IAAI,kCAAe,CAAC,6CAA6C,CAAC,CAAC;QAI3E,IAAI,CAAC,IAAI,CAAC,eAAe;YACvB,MAAM,IAAI,kCAAe,CACvB,iDAAiD,CAClD,CAAC;QAEJ,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,YAAY,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QAE1E,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,eAAe,CAAC;YACnC,MAAM,IAAI,kCAAe,CACvB,mDAAmD,CACpD,CAAC;QAEJ,OAAO,IAAI,CAAC,YAAY,CAAC,cAAc,CAAC,CAAC;IAC3C,CAAC;IAQD,KAAK,CAAC,mBAAmB,CACvB,KAAa,EACb,QAAgB;QAEhB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,UAAU;aAC/B,aAAa,CAAC,wBAAU,CAAC;aACzB,kBAAkB,CAAC,MAAM,CAAC;aAC1B,SAAS,CAAC,eAAe,CAAC;aAE1B,KAAK,CAAC,mCAAmC,EAAE,EAAE,KAAK,EAAE,CAAC;aACrD,MAAM,EAAE,CAAC;QAEZ,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC5B,MAAM,4BAAW,CAAC,mBAAmB,CAAC,QAAQ,CAAC,CAAC;YAChD,MAAM,IAAI,8BAAqB,CAAC,2BAA2B,CAAC,CAAC;QAC/D,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,4BAAW,CAAC,eAAe,CAAC,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC3E,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,8BAAqB,CAAC,2BAA2B,CAAC,CAAC;QAC/D,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YACjB,MAAM,IAAI,8BAAqB,CAAC,0BAA0B,CAAC,CAAC;QAC9D,CAAC;QAED,OAAQ,IAA8B,CAAC,QAAQ,CAAC;QAChD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,CAAC,WAAW,CACf,IAAqB,EACrB,OAA2B;QAE3B,MAAM,GAAG,GAAG,IAAA,mBAAU,GAAE,CAAC;QACzB,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC;QACrD,MAAM,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC;QACvD,MAAM,QAAQ,GAAG,OAAO,EAAE,SAAS,IAAI,IAAI,CAAC;QAG5C,MAAM,iBAAiB,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,IAAA,mBAAU,GAAE,IAAI,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;QACvE,MAAM,gBAAgB,GAAG,IAAI,IAAI,CAC/B,IAAI,CAAC,GAAG,EAAE,GAAG,4BAAW,CAAC,aAAa,CAAC,YAAY,CAAC,CACrD,CAAC;QACF,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,CACzB,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC;YACtB,OAAO,EAAE,IAAI,CAAC,EAAE;YAChB,QAAQ,EAAE,KAAK;YACf,SAAS,EAAE,QAAQ;YACnB,kBAAkB,EAAE,iBAAiB;YACrC,UAAU,EAAE,gBAAgB;YAC5B,cAAc,EAAE,IAAI;SACrB,CAAC,CACH,CAAC;QAEF,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,SAAS,CACjD;YACE,GAAG,EAAE,IAAI,CAAC,EAAE;YACZ,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,GAAG;YACH,GAAG,EAAE,iBAAiB;YACtB,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACvC,EACD;YACE,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,mBAAmB;YACvC,SAAS,EAAE,YAA2C;SACvD,CACF,CAAC;QAIF,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,SAAS,CAClD,EAAE,GAAG,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,GAAG,EAAE,IAAA,mBAAU,GAAE,EAAE,EACtD;YACE,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,oBAAoB;YACxC,SAAS,EAAE,aAA4C;SACxD,CACF,CAAC;QAEF,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;QAC/C,MAAM,SAAS,GAAG,IAAI,IAAI,CACxB,IAAI,CAAC,GAAG,EAAE,GAAG,4BAAW,CAAC,aAAa,CAAC,aAAa,CAAC,CACtD,CAAC;QAEF,MAAM,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAC9B,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC;YAC3B,OAAO,EAAE,IAAI,CAAC,EAAE;YAChB,QAAQ,EAAE,KAAK;YACf,SAAS,EAAE,QAAQ;YACnB,UAAU,EAAE,SAAS;YACrB,UAAU,EAAE,SAAS;YACrB,UAAU,EAAE,IAAI;YAChB,UAAU,EAAE,OAAO,EAAE,UAAU,IAAI,IAAI;YACvC,UAAU,EAAE,OAAO,EAAE,UAAU,IAAI,IAAI;SACxC,CAAC,CACH,CAAC;QAEF,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,aAAa,EAAE,YAAY,EAAE,CAAC;IACpE,CAAC;IAED,KAAK,CAAC,OAAO,CACX,eAAuB,EACvB,OAA2B;QAE3B,IAAI,OAAuC,CAAC;QAC5C,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,eAAe,EAAE;gBAC3D,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,oBAAoB;aACzC,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,8BAAqB,CAAC,uBAAuB,CAAC,CAAC;QAC3D,CAAC;QAED,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;QAClD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC;YACjD,KAAK,EAAE;gBACL,OAAO,EAAE,OAAO,CAAC,GAAG;gBACpB,UAAU,EAAE,SAAS;gBACrB,UAAU,EAAE,IAAA,gBAAM,GAAE;aACrB;SACF,CAAC,CAAC;QAEH,IAAI,CAAC,MAAM;YACT,MAAM,IAAI,8BAAqB,CAC7B,4CAA4C,CAC7C,CAAC;QACJ,IAAI,MAAM,CAAC,UAAU,GAAG,IAAI,IAAI,EAAE;YAChC,MAAM,IAAI,8BAAqB,CAAC,2BAA2B,CAAC,CAAC;QAE/D,MAAM,CAAC,UAAU,GAAG,IAAI,IAAI,EAAE,CAAC;QAC/B,MAAM,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAIzC,OAAO,IAAI,CAAC,WAAW,CACrB,EAAE,EAAE,EAAE,OAAO,CAAC,GAAG,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,EACzC;YACE,GAAG,OAAO;YACV,SAAS,EAAE,MAAM,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,SAAS,CAAC;SACrE,CACF,CAAC;IACJ,CAAC;IAQO,KAAK,CAAC,eAAe,CAC3B,MAAc,EACd,QAAuB;QAEvB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,UAAU;aAC/B,aAAa,CAAC,wBAAU,CAAC;aACzB,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;QACtC,IAAI,CAAC,IAAI,EAAE,MAAM;YACf,MAAM,IAAI,8BAAqB,CAAC,kCAAkC,CAAC,CAAC;QACtE,IAAI,CAAC,QAAQ;YAAE,OAAO,SAAS,CAAC;QAEhC,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,UAAU;aACvC,aAAa,CAAC,4BAAY,CAAC;aAC3B,QAAQ,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAE/C,IAAI,IAAI,CAAC,SAAS,KAAK,yBAAQ,CAAC,WAAW,EAAE,CAAC;YAC5C,IAAI,CAAC,YAAY,IAAI,CAAC,IAAI,CAAC,iBAAiB;gBAC1C,MAAM,IAAI,8BAAqB,CAC7B,6CAA6C,CAC9C,CAAC;YACJ,OAAO,QAAQ,CAAC;QAClB,CAAC;QAED,MAAM,QAAQ,GACZ,YAAY;YACZ,CAAC,MAAM,IAAI,CAAC,UAAU;iBACnB,aAAa,CAAC,qCAAgB,CAAC;iBAC/B,QAAQ,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QAC1E,OAAO,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;IACzC,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,QAAgB;QACrC,MAAM,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAChC,EAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,IAAA,gBAAM,GAAE,EAAE,EAC3C,EAAE,UAAU,EAAE,IAAI,IAAI,EAAE,EAAE,CAC3B,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,eAAuB;QACrC,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;QAClD,MAAM,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAChC,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,EAAE,IAAA,gBAAM,GAAE,EAAE,EAC/C,EAAE,UAAU,EAAE,IAAI,IAAI,EAAE,EAAE,CAC3B,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,GAAW,EAAE,UAAkB;QACrD,MAAM,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,aAAa,GAAG,EAAE,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC;IACtE,CAAC;IAGD,KAAK,CAAC,MAAM,CAAC,eAAuB;QAClC,MAAM,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;QAEtC,MAAM,iBAAiB,GAAG,WAAI,CAAC,OAAO,EAAE,CAAC;QACzC,IAAI,iBAAiB,EAAE,CAAC;YACtB,MAAM,IAAI,CAAC,WAAW,CAAC,MAAM,CAC3B,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,QAAQ,EAAE,KAAK,EAAE,EAC1D,EAAE,cAAc,EAAE,IAAI,IAAI,EAAE,EAAE,CAC/B,CAAC;QACJ,CAAC;IACH,CAAC;IAEO,SAAS,CAAC,KAAa;QAC7B,OAAO,IAAA,mBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC1D,CAAC;IAED,IAAY,gBAAgB;QAC1B,OAAO,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,sDAAwB,CAAC,CAAC;IACjE,CAAC;IAED,IAAY,WAAW;QACrB,OAAO,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,oDAAuB,CAAC,CAAC;IAChE,CAAC;CACF,CAAA;AAnbY,kCAAW;sBAAX,WAAW;IADvB,IAAA,mBAAU,GAAE;qCAGoB,gBAAU;QACR,4BAAY;QACd,oBAAU;QACR,4BAAY;GALlC,WAAW,CAmbvB"}
+{"version":3,"file":"auth.service.js","sourceRoot":"","sources":["../../../src/auth/services/auth.service.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,2CAAmE;AACnE,qCAAqC;AACrC,yDAAqD;AACrD,mEAA8D;AAE9D,uEAAkE;AAClE,uEAAmE;AACnE,4DAAmD;AACnD,gEAAuD;AACvD,4DAAmD;AACnD,mDAA+C;AAC/C,mDAA+C;AAC/C,+EAA2E;AAO3E,0CAAuC;AACvC,gEAA0D;AAC1D,0DAAsD;AACtD,sEAAkE;AAClE,kEAAyD;AAGlD,IAAM,WAAW,GAAjB,MAAM,WAAW;IACtB,YACmB,YAA0B,EAC1B,UAAsB,EACtB,YAA0B,EAC1B,MAAkB;QAHlB,iBAAY,GAAZ,YAAY,CAAc;QAC1B,eAAU,GAAV,UAAU,CAAY;QACtB,iBAAY,GAAZ,YAAY,CAAc;QAC1B,WAAM,GAAN,MAAM,CAAY;IAClC,CAAC;IAgBJ,KAAK,CAAC,YAAY,CAAC,cAAuB;QACxC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,cAAc,CAAC,CAAC;QACxD,IAAI,MAAM,CAAC,IAAI,CAAC,wBAAwB;YACtC,MAAM,IAAI,kCAAe,CACvB,kDAAkD,CACnD,CAAC;QACJ,OAAO,MAAM,CAAC;IAChB,CAAC;IAOD,KAAK,CAAC,gBAAgB;QACpB,OAAO,IAAI,CAAC,aAAa,EAAE,CAAC;IAC9B,CAAC;IAEO,KAAK,CAAC,aAAa,CACzB,cAAuB;QAEvB,MAAM,IAAI,GAAG,WAAI,CAAC,IAAI,EAA4B,CAAC;QACnD,IAAI,CAAC,IAAI;YACP,MAAM,IAAI,8BAAqB,CAC7B,6CAA6C,CAC9C,CAAC;QAEJ,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;QAEpE,MAAM,SAAS,GACb,CAAC,cAAc,IAAI,IAAI,CAAC,aAAa,CAAC,cAAc,EAAE,KAAK,CAAC,CAAC;QAE/D,IAAI,CAAC,SAAS,IAAI,CAAC,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,EAAE,CAAC;YACtD,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC;gBAC7C,CAAC,CAAC,iBAAiB,cAAc,GAAG;gBACpC,CAAC,CAAC,QAAQ,cAAc,GAAG,CAAC;YAC9B,MAAM,IAAI,kCAAe,CAAC,wBAAwB,WAAW,QAAQ,CAAC,CAAC;QACzE,CAAC;QAED,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;IACzB,CAAC;IAMD,KAAK,CAAC,WAAW,CACf,MAAc,EACd,QAAmC;QAEnC,IAAI,CAAC,QAAQ;YAAE,OAAO,EAAE,CAAC;QAGzB,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,iCAAc,CAAC,CAAC,IAAI,CAAC;YACzE,KAAK,EAAE;gBACL,OAAO,EAAE,MAAM;gBACf,SAAS,EAAE,QAAQ;gBACnB,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE;aAC1B;YACD,SAAS,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE;SAC1B,CAAC,CAAC;QACH,OAAO,SAAS;aACb,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC;aAChC,MAAM,CAAC,CAAC,IAAI,EAAoC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAChE,CAAC;IAgBO,aAAa,CAAC,QAAgB,EAAE,KAAyB;QAC/D,IAAI,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QAE9C,MAAM,YAAY,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC3C,IAAI,CAAC,YAAY;YACf,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC;QAE5D,MAAM,cAAc,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAC/C,MAAM,YAAY,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QAE/C,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE;YACzB,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YAC9C,OAAO,CACL,CAAC,CAAC,QAAQ;gBACV,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,cAAc;gBACjD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,YAAY,CACtC,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC;IAGO,gBAAgB,CAAC,KAAyB;QAChD,OAAO,KAAK,CAAC,IAAI,CACf,CAAC,IAAI,EAAE,EAAE,CAAE,IAAI,CAAC,UAAyB,KAAK,6BAAU,CAAC,YAAY,CACtE,CAAC;IACJ,CAAC;IAGO,MAAM,CAAC,cAAsB;QACnC,MAAM,SAAS,GAAG,cAAc,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QAGlD,IAAI,SAAS,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QAE/B,MAAM,IAAI,GAAG,cAAc,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC;QACjD,OAAO,MAAM,CAAC,MAAM,CAAC,yBAAQ,CAAC,CAAC,QAAQ,CAAC,IAAgB,CAAC;YACvD,CAAC,CAAE,IAAiB;YACpB,CAAC,CAAC,IAAI,CAAC;IACX,CAAC;IAGO,QAAQ,CAAC,cAAsB;QACrC,OAAO,cAAc,CAAC,KAAK,CAAC,CAAC,EAAE,cAAc,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC;IAClE,CAAC;IAOO,MAAM,CAAC,IAAc;QAC3B,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,yBAAQ,CAAC,CAAC;QAC1C,OAAO,SAAS,CAAC,MAAM,GAAG,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACpD,CAAC;IAMO,uBAAuB,CAAC,IAAgB;QAC9C,OAAO,WAAI,CAAC,eAAe,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC;IAC5D,CAAC;IAMD,iBAAiB,CAAC,IAAgB;QAChC,IAAI,IAAI,CAAC,SAAS,KAAK,yBAAQ,CAAC,WAAW,EAAE,CAAC;YAC5C,MAAM,IAAI,kCAAe,CACvB,2DAA2D,CAC5D,CAAC;QACJ,CAAC;IACH,CAAC;IAeD,KAAK,CAAC,cAAc,CAClB,eAAuB,EACvB,cAAuB;QAEvB,MAAM,IAAI,GAAG,WAAI,CAAC,IAAI,EAA4B,CAAC;QACnD,IAAI,CAAC,IAAI;YACP,MAAM,IAAI,8BAAqB,CAC7B,6CAA6C,CAC9C,CAAC;QAIJ,IAAI,CAAC,IAAI,CAAC,eAAe;YACvB,MAAM,IAAI,kCAAe,CACvB,iDAAiD,CAClD,CAAC;QAEJ,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,YAAY,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QAE1E,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,eAAe,CAAC;YACnC,MAAM,IAAI,kCAAe,CACvB,mDAAmD,CACpD,CAAC;QAEJ,OAAO,IAAI,CAAC,YAAY,CAAC,cAAc,CAAC,CAAC;IAC3C,CAAC;IAOD,KAAK,CAAC,mBAAmB,CACvB,KAAa,EACb,QAAgB;QAEhB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,UAAU;aAC/B,aAAa,CAAC,wBAAU,CAAC;aACzB,kBAAkB,CAAC,MAAM,CAAC;aAC1B,SAAS,CAAC,eAAe,CAAC;aAC1B,KAAK,CAAC,mCAAmC,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;aACnE,MAAM,EAAE,CAAC;QAEZ,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC5B,MAAM,4BAAW,CAAC,mBAAmB,CAAC,QAAQ,CAAC,CAAC;YAChD,MAAM,IAAI,8BAAqB,CAAC,+BAAW,CAAC,mBAAmB,CAAC,CAAC;QACnE,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,4BAAW,CAAC,eAAe,CAAC,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC3E,IAAI,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC;YAC/D,MAAM,IAAI,8BAAqB,CAAC,+BAAW,CAAC,mBAAmB,CAAC,CAAC;QAEnE,IAAI,4BAAW,CAAC,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC;YACxC,MAAM,IAAI,CAAC,UAAU;iBAClB,aAAa,CAAC,wBAAU,CAAC;iBACzB,MAAM,CACL,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,EACf,EAAE,QAAQ,EAAE,MAAM,4BAAW,CAAC,YAAY,CAAC,QAAQ,CAAC,EAAE,CACvD,CAAC;QAEN,OAAQ,IAA8B,CAAC,QAAQ,CAAC;QAChD,OAAO,IAAI,CAAC;IACd,CAAC;IAGO,sBAAsB,CAAC,IAAgB;QAC7C,OAAO,CACL,IAAI,CAAC,wBAAwB;YAC7B,CAAC,CAAC,IAAI,CAAC,4BAA4B;YACnC,IAAI,CAAC,4BAA4B,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CACzD,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,WAAW,CACf,IAAqB,EACrB,OAA2B;QAE3B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE;YAC5D,OAAO;YACP,QAAQ,EAAE,OAAO,EAAE,SAAS,IAAI,IAAI;SACrC,CAAC,CAAC;QACH,OAAO;YACL,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,aAAa,EAAE,MAAM,CAAC,aAAc;SACrC,CAAC;IACJ,CAAC;IAMD,KAAK,CAAC,gBAAgB,CACpB,IAAqB,EACrB,OAA2B,EAC3B,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,4BAA4B;QAErD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE;YAC5D,OAAO;YACP,QAAQ,EAAE,OAAO,EAAE,SAAS,IAAI,IAAI;YACpC,gBAAgB,EAAE,KAAK;YACvB,gBAAgB,EAAE,UAAU;SAC7B,CAAC,CAAC;QACH,OAAO,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC;IAC9E,CAAC;IAGD,KAAK,CAAC,OAAO,CACX,eAAuB,EACvB,OAA2B;QAE3B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,MAAM,CAC3C,MAAM,EACN,eAAe,EACf,EAAE,OAAO,EAAE,EACX,KAAK,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;YAEnB,QAAQ,EAAE,MAAM,IAAI,CAAC,eAAe,CAClC,QAAQ,CAAC,OAAO,EAChB,QAAQ,CAAC,SAAS,CACnB;SACF,CAAC,CACH,CAAC;QACF,OAAO;YACL,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,aAAa,EAAE,MAAM,CAAC,aAAc;SACrC,CAAC;IACJ,CAAC;IAOO,KAAK,CAAC,eAAe,CAC3B,MAAc,EACd,QAAuB;QAEvB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,UAAU;aAC/B,aAAa,CAAC,wBAAU,CAAC;aACzB,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;QACtC,IAAI,CAAC,IAAI,EAAE,MAAM,IAAI,IAAI,CAAC,SAAS,KAAK,yBAAQ,CAAC,WAAW;YAC1D,MAAM,IAAI,8BAAqB,CAAC,kCAAkC,CAAC,CAAC;QACtE,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC;QAE3B,MAAM,QAAQ,GACZ,CAAC,MAAM,IAAI,CAAC,UAAU;aACnB,aAAa,CAAC,4BAAY,CAAC;aAC3B,QAAQ,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAC/C,CAAC,MAAM,IAAI,CAAC,UAAU;iBACnB,aAAa,CAAC,qCAAgB,CAAC;iBAC/B,QAAQ,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QAC1E,OAAO,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;IACpC,CAAC;IAGD,KAAK,CAAC,gBAAgB,CAAC,QAAgB;QACrC,MAAM,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,GAAG,EAAE,EAAE,CACxC,oCAAgB,CAAC,SAAS,CAAC,GAAG,EAAE,QAAQ,EAAE,KAAK,CAAC,CACjD,CAAC;IACJ,CAAC;IAGD,KAAK,CAAC,SAAS,CAAC,eAAuB,EAAE,QAAgB;QACvD,OAAO,IAAI,CAAC,YAAY,CAAC,kBAAkB,CACzC,MAAM,EACN,eAAe,EACf,QAAQ,CACT,CAAC;IACJ,CAAC;IAOD,KAAK,CAAC,MAAM,CAAC,eAAuB;QAClC,MAAM,MAAM,GACT,WAAI,CAAC,IAAI,EAAE,EAAE,EAAyB;YACvC,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,eAAe,CAAC,CAAC;gBAClE,EAAE,GAAG,CAAC;QACV,IAAI,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;QAE1B,MAAM,iBAAiB,GAAG,WAAI,CAAC,OAAO,EAAE,CAAC;QACzC,IAAI,iBAAiB;YACnB,MAAM,IAAI,CAAC,YAAY,CAAC,iBAAiB,CACvC,MAAM,EACN,iBAAiB,EACjB,MAAM,CACP,CAAC;QACJ,OAAO,IAAI,CAAC,SAAS,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;IACjD,CAAC;CACF,CAAA;AA5XY,kCAAW;sBAAX,WAAW;IADvB,IAAA,mBAAU,GAAE;qCAGsB,4BAAY;QACd,oBAAU;QACR,4BAAY;QAClB,wBAAU;GAL1B,WAAW,CA4XvB"}

package/dist/auth/services/email.verification.service.d.ts

@@ -0,0 +1,16 @@
+import { DataSource } from 'typeorm';
+import { EncryptionService } from '../../common/services/encryption.service';
+import { EmailVerificationMailJob } from '../../notification/jobs/email.verification.mail.job';
+import { AuthConfig } from '../utilities/auth.config';
+export declare class EmailVerificationService {
+    private readonly dataSource;
+    private readonly encryptionService;
+    private readonly mailJob;
+    private readonly config;
+    private readonly logger;
+    constructor(dataSource: DataSource, encryptionService: EncryptionService, mailJob: EmailVerificationMailJob, config: AuthConfig);
+    request(userId: string): Promise<void>;
+    requestQuietly(userId: string): Promise<void>;
+    verify(rawToken: string): Promise<void>;
+}
+//# sourceMappingURL=email.verification.service.d.ts.map

package/dist/auth/services/email.verification.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"email.verification.service.d.ts","sourceRoot":"","sources":["../../../src/auth/services/email.verification.service.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,UAAU,EAAU,MAAM,SAAS,CAAC;AAC7C,OAAO,EAAE,iBAAiB,EAAE,MAAM,0CAA0C,CAAC;AAE7E,OAAO,EAAE,wBAAwB,EAAE,MAAM,qDAAqD,CAAC;AAI/F,OAAO,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AAStD,qBACa,wBAAwB;IAIjC,OAAO,CAAC,QAAQ,CAAC,UAAU;IAC3B,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IAClC,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,MAAM;IANzB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA6C;gBAGjD,UAAU,EAAE,UAAU,EACtB,iBAAiB,EAAE,iBAAiB,EACpC,OAAO,EAAE,wBAAwB,EACjC,MAAM,EAAE,UAAU;IAI/B,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAuCtC,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAW7C,MAAM,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAgC9C"}

package/dist/auth/services/email.verification.service.js

@@ -0,0 +1,97 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var EmailVerificationService_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.EmailVerificationService = void 0;
+const common_1 = require("@nestjs/common");
+const crypto_1 = require("crypto");
+const typeorm_1 = require("typeorm");
+const encryption_service_1 = require("../../common/services/encryption.service");
+const operation_exception_1 = require("../../global/exceptions/operation.exception");
+const email_verification_mail_job_1 = require("../../notification/jobs/email.verification.mail.job");
+const email_verification_token_entity_1 = require("../entities/email.verification.token.entity");
+const user_entity_1 = require("../entities/user.entity");
+const email_verification_default_enum_1 = require("../enums/email.verification.default.enum");
+const auth_config_1 = require("../utilities/auth.config");
+const token_service_1 = require("./token.service");
+const auth_message_enum_1 = require("../enums/auth.message.enum");
+let EmailVerificationService = EmailVerificationService_1 = class EmailVerificationService {
+    constructor(dataSource, encryptionService, mailJob, config) {
+        this.dataSource = dataSource;
+        this.encryptionService = encryptionService;
+        this.mailJob = mailJob;
+        this.config = config;
+        this.logger = new common_1.Logger(EmailVerificationService_1.name);
+    }
+    async request(userId) {
+        const user = await this.dataSource
+            .getRepository(user_entity_1.UserEntity)
+            .findOne({ where: { id: userId } });
+        if (!user || !user.active || user.email_verified_at)
+            return;
+        const rawToken = (0, crypto_1.randomBytes)(Number(email_verification_default_enum_1.EmailVerificationDefault.TOKEN_BYTES)).toString('base64url');
+        const expiresAt = new Date(Date.now() + this.config.emailVerificationTtlSeconds * 1000);
+        await this.dataSource.transaction(async (trx) => {
+            await trx.update(email_verification_token_entity_1.EmailVerificationTokenEntity, { user_id: user.id, used_at: (0, typeorm_1.IsNull)() }, { used_at: new Date() });
+            await trx.save(trx.create(email_verification_token_entity_1.EmailVerificationTokenEntity, {
+                user_id: user.id,
+                email: user.email.toLowerCase(),
+                token_hash: token_service_1.TokenService.hashToken(rawToken),
+                expires_at: expiresAt,
+            }));
+        });
+        await this.mailJob.dispatch({
+            user_id: user.id,
+            user_email: user.email,
+            full_name: user.full_name,
+            token_encrypted: this.encryptionService.encrypt(rawToken),
+            expires_at: expiresAt.toISOString(),
+        });
+    }
+    async requestQuietly(userId) {
+        try {
+            await this.request(userId);
+        }
+        catch (error) {
+            this.logger.error(`Could not send the verification mail for user ${userId}: ${error.message}`);
+        }
+    }
+    async verify(rawToken) {
+        await this.dataSource.transaction(async (trx) => {
+            const result = await trx
+                .createQueryBuilder()
+                .update(email_verification_token_entity_1.EmailVerificationTokenEntity)
+                .set({ used_at: () => 'now()' })
+                .where('token_hash = :tokenHash AND used_at IS NULL AND expires_at > now() AND deleted_at IS NULL', { tokenHash: token_service_1.TokenService.hashToken(rawToken) })
+                .returning(['user_id', 'email'])
+                .execute();
+            const token = result.raw?.[0];
+            if (!token)
+                throw new operation_exception_1.OperationException(auth_message_enum_1.AuthMessage.INVALID_VERIFICATION_TOKEN);
+            const user = await trx.findOne(user_entity_1.UserEntity, {
+                where: { id: token.user_id },
+            });
+            if (!user?.active || user.email.toLowerCase() !== token.email)
+                throw new operation_exception_1.OperationException(auth_message_enum_1.AuthMessage.INVALID_VERIFICATION_TOKEN);
+            if (!user.email_verified_at)
+                await trx.update(user_entity_1.UserEntity, { id: user.id }, { email_verified_at: new Date() });
+        });
+    }
+};
+exports.EmailVerificationService = EmailVerificationService;
+exports.EmailVerificationService = EmailVerificationService = EmailVerificationService_1 = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [typeorm_1.DataSource,
+        encryption_service_1.EncryptionService,
+        email_verification_mail_job_1.EmailVerificationMailJob,
+        auth_config_1.AuthConfig])
+], EmailVerificationService);
+//# sourceMappingURL=email.verification.service.js.map

package/dist/auth/services/email.verification.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"email.verification.service.js","sourceRoot":"","sources":["../../../src/auth/services/email.verification.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;AAAA,2CAAoD;AACpD,mCAAqC;AACrC,qCAA6C;AAC7C,iFAA6E;AAC7E,qFAAiF;AACjF,qGAA+F;AAC/F,iGAA2F;AAC3F,yDAAqD;AACrD,8FAAoF;AACpF,0DAAsD;AACtD,mDAA+C;AAC/C,kEAAyD;AAQlD,IAAM,wBAAwB,gCAA9B,MAAM,wBAAwB;IAGnC,YACmB,UAAsB,EACtB,iBAAoC,EACpC,OAAiC,EACjC,MAAkB;QAHlB,eAAU,GAAV,UAAU,CAAY;QACtB,sBAAiB,GAAjB,iBAAiB,CAAmB;QACpC,YAAO,GAAP,OAAO,CAA0B;QACjC,WAAM,GAAN,MAAM,CAAY;QANpB,WAAM,GAAG,IAAI,eAAM,CAAC,0BAAwB,CAAC,IAAI,CAAC,CAAC;IAOjE,CAAC;IAGJ,KAAK,CAAC,OAAO,CAAC,MAAc;QAC1B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,UAAU;aAC/B,aAAa,CAAC,wBAAU,CAAC;aACzB,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;QACtC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,iBAAiB;YAAE,OAAO;QAE5D,MAAM,QAAQ,GAAG,IAAA,oBAAW,EAC1B,MAAM,CAAC,0DAAwB,CAAC,WAAW,CAAC,CAC7C,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QACxB,MAAM,SAAS,GAAG,IAAI,IAAI,CACxB,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,2BAA2B,GAAG,IAAI,CAC5D,CAAC;QAEF,MAAM,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;YAC9C,MAAM,GAAG,CAAC,MAAM,CACd,8DAA4B,EAC5B,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,EAAE,OAAO,EAAE,IAAA,gBAAM,GAAE,EAAE,EACvC,EAAE,OAAO,EAAE,IAAI,IAAI,EAAE,EAAE,CACxB,CAAC;YACF,MAAM,GAAG,CAAC,IAAI,CACZ,GAAG,CAAC,MAAM,CAAC,8DAA4B,EAAE;gBACvC,OAAO,EAAE,IAAI,CAAC,EAAE;gBAChB,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE;gBAC/B,UAAU,EAAE,4BAAY,CAAC,SAAS,CAAC,QAAQ,CAAC;gBAC5C,UAAU,EAAE,SAAS;aACtB,CAAC,CACH,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC;YAC1B,OAAO,EAAE,IAAI,CAAC,EAAE;YAChB,UAAU,EAAE,IAAI,CAAC,KAAK;YACtB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,eAAe,EAAE,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,QAAQ,CAAC;YACzD,UAAU,EAAE,SAAS,CAAC,WAAW,EAAE;SACpC,CAAC,CAAC;IACL,CAAC;IAGD,KAAK,CAAC,cAAc,CAAC,MAAc;QACjC,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC7B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,iDAAiD,MAAM,KAAM,KAAe,CAAC,OAAO,EAAE,CACvF,CAAC;QACJ,CAAC;IACH,CAAC;IAGD,KAAK,CAAC,MAAM,CAAC,QAAgB;QAC3B,MAAM,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;YAC9C,MAAM,MAAM,GAAG,MAAM,GAAG;iBACrB,kBAAkB,EAAE;iBACpB,MAAM,CAAC,8DAA4B,CAAC;iBACpC,GAAG,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC;iBAC/B,KAAK,CACJ,2FAA2F,EAC3F,EAAE,SAAS,EAAE,4BAAY,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,CAChD;iBACA,SAAS,CAAC,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;iBAC/B,OAAO,EAAE,CAAC;YACb,MAAM,KAAK,GACT,MAAM,CAAC,GACR,EAAE,CAAC,CAAC,CAAC,CAAC;YACP,IAAI,CAAC,KAAK;gBACR,MAAM,IAAI,wCAAkB,CAAC,+BAAW,CAAC,0BAA0B,CAAC,CAAC;YAEvE,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,wBAAU,EAAE;gBACzC,KAAK,EAAE,EAAE,EAAE,EAAE,KAAK,CAAC,OAAO,EAAE;aAC7B,CAAC,CAAC;YACH,IAAI,CAAC,IAAI,EAAE,MAAM,IAAI,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,KAAK,CAAC,KAAK;gBAC3D,MAAM,IAAI,wCAAkB,CAAC,+BAAW,CAAC,0BAA0B,CAAC,CAAC;YAEvE,IAAI,CAAC,IAAI,CAAC,iBAAiB;gBACzB,MAAM,GAAG,CAAC,MAAM,CACd,wBAAU,EACV,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,EACf,EAAE,iBAAiB,EAAE,IAAI,IAAI,EAAE,EAAE,CAClC,CAAC;QACN,CAAC,CAAC,CAAC;IACL,CAAC;CACF,CAAA;AA7FY,4DAAwB;mCAAxB,wBAAwB;IADpC,IAAA,mBAAU,GAAE;qCAKoB,oBAAU;QACH,sCAAiB;QAC3B,sDAAwB;QACzB,wBAAU;GAP1B,wBAAwB,CA6FpC"}

package/dist/auth/services/google.auth.service.d.ts

@@ -4,5 +4,6 @@ export declare class GoogleAuthService {
     private readonly remoteRequestService;
     constructor(remoteRequestService: RemoteRequestService);
     verifyIdToken(idToken: string): Promise<GoogleTokenInfo>;
+    private static list;
 }
 //# sourceMappingURL=google.auth.service.d.ts.map

package/dist/auth/services/google.auth.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"google.auth.service.d.ts","sourceRoot":"","sources":["../../../src/auth/services/google.auth.service.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,oBAAoB,EAAE,MAAM,8CAA8C,CAAC;AAGpF,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAQ7D,qBACa,iBAAiB;IAChB,OAAO,CAAC,QAAQ,CAAC,oBAAoB;gBAApB,oBAAoB,EAAE,oBAAoB;IAEjE,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC;CAqC/D"}
+{"version":3,"file":"google.auth.service.d.ts","sourceRoot":"","sources":["../../../src/auth/services/google.auth.service.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,oBAAoB,EAAE,MAAM,8CAA8C,CAAC;AAGpF,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAQ7D,qBACa,iBAAiB;IAChB,OAAO,CAAC,QAAQ,CAAC,oBAAoB;gBAApB,oBAAoB,EAAE,oBAAoB;IAEjE,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC;IAqD9D,OAAO,CAAC,MAAM,CAAC,IAAI;CAMpB"}

package/dist/auth/services/google.auth.service.js

@@ -8,6 +8,7 @@ var __decorate = (this && this.__decorate) || function (decorators, target, key,
 var __metadata = (this && this.__metadata) || function (k, v) {
     if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
+var GoogleAuthService_1;
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.GoogleAuthService = void 0;
 const common_1 = require("@nestjs/common");
@@ -15,13 +16,13 @@ const api_request_type_enum_1 = require("../../common/enums/api.request.type.enu
 const remote_request_service_1 = require("../../common/services/remote.request.service");
 const operation_exception_1 = require("../../global/exceptions/operation.exception");
 const google_auth_default_enum_1 = require("../enums/google.auth.default.enum");
-let GoogleAuthService = class GoogleAuthService {
+let GoogleAuthService = GoogleAuthService_1 = class GoogleAuthService {
     constructor(remoteRequestService) {
         this.remoteRequestService = remoteRequestService;
     }
     async verifyIdToken(idToken) {
-        const clientId = process.env.GOOGLE_CLIENT_ID;
-        if (!clientId)
+        const clientIds = GoogleAuthService_1.list(process.env.GOOGLE_CLIENT_ID);
+        if (!clientIds.length)
             throw new operation_exception_1.OperationException('GOOGLE_CLIENT_ID is not set; Google SSO is not configured');
         let tokenInfo;
         try {
@@ -34,7 +35,7 @@ let GoogleAuthService = class GoogleAuthService {
         catch {
             throw new common_1.UnauthorizedException('Invalid or expired Google ID token');
         }
-        if (tokenInfo.aud !== clientId)
+        if (!clientIds.includes(tokenInfo.aud))
             throw new common_1.UnauthorizedException('Google ID token was issued for a different client');
         const validIssuers = [
             google_auth_default_enum_1.GoogleAuthDefault.ISSUER,
@@ -42,13 +43,25 @@ let GoogleAuthService = class GoogleAuthService {
         ];
         if (!validIssuers.includes(tokenInfo.iss))
             throw new common_1.UnauthorizedException('Google ID token has an unexpected issuer');
-        if (!tokenInfo.email || tokenInfo.email_verified !== 'true')
+        if (!tokenInfo.sub ||
+            !tokenInfo.email ||
+            tokenInfo.email_verified !== 'true')
             throw new common_1.UnauthorizedException('Google account email is not verified');
+        const allowedDomains = GoogleAuthService_1.list(process.env.GOOGLE_ALLOWED_HD).map((domain) => domain.toLowerCase());
+        if (allowedDomains.length &&
+            !allowedDomains.includes((tokenInfo.hd ?? '').toLowerCase()))
+            throw new common_1.UnauthorizedException('This Google account is not allowed to sign in');
         return tokenInfo;
     }
+    static list(value) {
+        return (value ?? '')
+            .split(',')
+            .map((entry) => entry.trim())
+            .filter(Boolean);
+    }
 };
 exports.GoogleAuthService = GoogleAuthService;
-exports.GoogleAuthService = GoogleAuthService = __decorate([
+exports.GoogleAuthService = GoogleAuthService = GoogleAuthService_1 = __decorate([
     (0, common_1.Injectable)(),
     __metadata("design:paramtypes", [remote_request_service_1.RemoteRequestService])
 ], GoogleAuthService);

package/dist/auth/services/google.auth.service.js.map

@@ -1 +1 @@
-{"version":3,"file":"google.auth.service.js","sourceRoot":"","sources":["../../../src/auth/services/google.auth.service.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,2CAAmE;AACnE,oFAA8E;AAC9E,yFAAoF;AACpF,qFAAiF;AACjF,gFAAsE;AAU/D,IAAM,iBAAiB,GAAvB,MAAM,iBAAiB;IAC5B,YAA6B,oBAA0C;QAA1C,yBAAoB,GAApB,oBAAoB,CAAsB;IAAG,CAAC;IAE3E,KAAK,CAAC,aAAa,CAAC,OAAe;QACjC,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC;QAC9C,IAAI,CAAC,QAAQ;YACX,MAAM,IAAI,wCAAkB,CAC1B,2DAA2D,CAC5D,CAAC;QAEJ,IAAI,SAA0B,CAAC;QAC/B,IAAI,CAAC;YACH,SAAS;gBACP,MAAM,IAAI,CAAC,oBAAoB,CAAC,cAAc,CAAkB;oBAC9D,GAAG,EAAE,GAAG,4CAAiB,CAAC,cAAc,aAAa,kBAAkB,CAAC,OAAO,CAAC,EAAE;oBAClF,WAAW,EAAE,0CAAkB,CAAC,GAAG;iBACpC,CAAC,CAAC;QACP,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,8BAAqB,CAAC,oCAAoC,CAAC,CAAC;QACxE,CAAC;QAED,IAAI,SAAS,CAAC,GAAG,KAAK,QAAQ;YAC5B,MAAM,IAAI,8BAAqB,CAC7B,mDAAmD,CACpD,CAAC;QAEJ,MAAM,YAAY,GAAa;YAC7B,4CAAiB,CAAC,MAAM;YACxB,4CAAiB,CAAC,gBAAgB;SACnC,CAAC;QACF,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,SAAS,CAAC,GAAG,CAAC;YACvC,MAAM,IAAI,8BAAqB,CAC7B,0CAA0C,CAC3C,CAAC;QAEJ,IAAI,CAAC,SAAS,CAAC,KAAK,IAAI,SAAS,CAAC,cAAc,KAAK,MAAM;YACzD,MAAM,IAAI,8BAAqB,CAAC,sCAAsC,CAAC,CAAC;QAE1E,OAAO,SAAS,CAAC;IACnB,CAAC;CACF,CAAA;AAxCY,8CAAiB;4BAAjB,iBAAiB;IAD7B,IAAA,mBAAU,GAAE;qCAEwC,6CAAoB;GAD5D,iBAAiB,CAwC7B"}
+{"version":3,"file":"google.auth.service.js","sourceRoot":"","sources":["../../../src/auth/services/google.auth.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;AAAA,2CAAmE;AACnE,oFAA8E;AAC9E,yFAAoF;AACpF,qFAAiF;AACjF,gFAAsE;AAU/D,IAAM,iBAAiB,yBAAvB,MAAM,iBAAiB;IAC5B,YAA6B,oBAA0C;QAA1C,yBAAoB,GAApB,oBAAoB,CAAsB;IAAG,CAAC;IAE3E,KAAK,CAAC,aAAa,CAAC,OAAe;QACjC,MAAM,SAAS,GAAG,mBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;QACvE,IAAI,CAAC,SAAS,CAAC,MAAM;YACnB,MAAM,IAAI,wCAAkB,CAC1B,2DAA2D,CAC5D,CAAC;QAEJ,IAAI,SAA0B,CAAC;QAC/B,IAAI,CAAC;YACH,SAAS;gBACP,MAAM,IAAI,CAAC,oBAAoB,CAAC,cAAc,CAAkB;oBAC9D,GAAG,EAAE,GAAG,4CAAiB,CAAC,cAAc,aAAa,kBAAkB,CAAC,OAAO,CAAC,EAAE;oBAClF,WAAW,EAAE,0CAAkB,CAAC,GAAG;iBACpC,CAAC,CAAC;QACP,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,8BAAqB,CAAC,oCAAoC,CAAC,CAAC;QACxE,CAAC;QAED,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,SAAS,CAAC,GAAG,CAAC;YACpC,MAAM,IAAI,8BAAqB,CAC7B,mDAAmD,CACpD,CAAC;QAEJ,MAAM,YAAY,GAAa;YAC7B,4CAAiB,CAAC,MAAM;YACxB,4CAAiB,CAAC,gBAAgB;SACnC,CAAC;QACF,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,SAAS,CAAC,GAAG,CAAC;YACvC,MAAM,IAAI,8BAAqB,CAC7B,0CAA0C,CAC3C,CAAC;QAEJ,IACE,CAAC,SAAS,CAAC,GAAG;YACd,CAAC,SAAS,CAAC,KAAK;YAChB,SAAS,CAAC,cAAc,KAAK,MAAM;YAEnC,MAAM,IAAI,8BAAqB,CAAC,sCAAsC,CAAC,CAAC;QAE1E,MAAM,cAAc,GAAG,mBAAiB,CAAC,IAAI,CAC3C,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAC9B,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC;QACxC,IACE,cAAc,CAAC,MAAM;YACrB,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;YAE5D,MAAM,IAAI,8BAAqB,CAC7B,+CAA+C,CAChD,CAAC;QAEJ,OAAO,SAAS,CAAC;IACnB,CAAC;IAEO,MAAM,CAAC,IAAI,CAAC,KAAyB;QAC3C,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC;aACjB,KAAK,CAAC,GAAG,CAAC;aACV,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;aAC5B,MAAM,CAAC,OAAO,CAAC,CAAC;IACrB,CAAC;CACF,CAAA;AA9DY,8CAAiB;4BAAjB,iBAAiB;IAD7B,IAAA,mBAAU,GAAE;qCAEwC,6CAAoB;GAD5D,iBAAiB,CA8D7B"}

package/dist/auth/services/impersonation.service.d.ts

@@ -3,14 +3,14 @@ import { AuditService } from '../../common/services/audit.service';
 import { TenantEntity } from '../../tenant/entities/tenant.entity';
 import { ImpersonationLoginDto } from '../dtos/impersonation.login.dto';
 import { UserEntity } from '../entities/user.entity';
-import { OrganizationSession, TokenIssueContext } from '../types/auth.types';
+import { ImpersonationSession, TokenIssueContext } from '../types/auth.types';
 import { AuthService } from './auth.service';
 export declare class ImpersonationService {
     private readonly authService;
     private readonly auditService;
     private readonly dataSource;
     constructor(authService: AuthService, auditService: AuditService, dataSource: DataSource);
-    login(dto: ImpersonationLoginDto, context?: TokenIssueContext): Promise<OrganizationSession>;
+    login(dto: ImpersonationLoginDto, context?: TokenIssueContext): Promise<ImpersonationSession>;
     accessibleTenants(): Promise<TenantEntity[]>;
     assertGlobalAccess(user: UserEntity): void;
     private requireTenant;

package/dist/auth/services/impersonation.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"impersonation.service.d.ts","sourceRoot":"","sources":["../../../src/auth/services/impersonation.service.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAc,MAAM,SAAS,CAAC;AAEjD,OAAO,EAAE,YAAY,EAAE,MAAM,qCAAqC,CAAC;AAEnE,OAAO,EAAE,YAAY,EAAE,MAAM,qCAAqC,CAAC;AACnE,OAAO,EAAE,qBAAqB,EAAE,MAAM,iCAAiC,CAAC;AACxE,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAErD,OAAO,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAC7E,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAS7C,qBACa,oBAAoB;IAE7B,OAAO,CAAC,QAAQ,CAAC,WAAW;IAC5B,OAAO,CAAC,QAAQ,CAAC,YAAY;IAC7B,OAAO,CAAC,QAAQ,CAAC,UAAU;gBAFV,WAAW,EAAE,WAAW,EACxB,YAAY,EAAE,YAAY,EAC1B,UAAU,EAAE,UAAU;IAGnC,KAAK,CACT,GAAG,EAAE,qBAAqB,EAC1B,OAAO,CAAC,EAAE,iBAAiB,GAC1B,OAAO,CAAC,mBAAmB,CAAC;IA2BzB,iBAAiB,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;IAclD,kBAAkB,CAAC,IAAI,EAAE,UAAU,GAAG,IAAI;YAW5B,aAAa;IAU3B,OAAO,KAAK,gBAAgB,GAE3B;IAED,OAAO,KAAK,cAAc,GAEzB;CACF"}
+{"version":3,"file":"impersonation.service.d.ts","sourceRoot":"","sources":["../../../src/auth/services/impersonation.service.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAc,MAAM,SAAS,CAAC;AAEjD,OAAO,EAAE,YAAY,EAAE,MAAM,qCAAqC,CAAC;AAEnE,OAAO,EAAE,YAAY,EAAE,MAAM,qCAAqC,CAAC;AACnE,OAAO,EAAE,qBAAqB,EAAE,MAAM,iCAAiC,CAAC;AACxE,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAErD,OAAO,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAC9E,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAQ7C,qBACa,oBAAoB;IAE7B,OAAO,CAAC,QAAQ,CAAC,WAAW;IAC5B,OAAO,CAAC,QAAQ,CAAC,YAAY;IAC7B,OAAO,CAAC,QAAQ,CAAC,UAAU;gBAFV,WAAW,EAAE,WAAW,EACxB,YAAY,EAAE,YAAY,EAC1B,UAAU,EAAE,UAAU;IAGnC,KAAK,CACT,GAAG,EAAE,qBAAqB,EAC1B,OAAO,CAAC,EAAE,iBAAiB,GAC1B,OAAO,CAAC,oBAAoB,CAAC;IAqC1B,iBAAiB,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;IAclD,kBAAkB,CAAC,IAAI,EAAE,UAAU,GAAG,IAAI;YAW5B,aAAa;IAU3B,OAAO,KAAK,gBAAgB,GAE3B;IAED,OAAO,KAAK,cAAc,GAEzB;CACF"}

package/dist/auth/services/impersonation.service.js

@@ -30,7 +30,7 @@ let ImpersonationService = class ImpersonationService {
         const user = await this.authService.validateCredentials(dto.email, dto.password);
         this.assertGlobalAccess(user);
         const tenant = await this.requireTenant(dto.tenant_id);
-        const tokens = await this.authService.issueTokens(user, {
+        const { access_token, expires_at } = await this.authService.issueAccessToken(user, {
             ...context,
             tenant_id: tenant.id,
         });
@@ -38,18 +38,27 @@ let ImpersonationService = class ImpersonationService {
             sourceType: entity_constants_1.baseEntityConstants.user,
             sourceId: user.id,
             action: audit_action_enum_1.AuditAction.IMPERSONATE,
-            newValue: { tenant_id: tenant.id, tenant_name: tenant.name },
+            newValue: {
+                tenant_id: tenant.id,
+                tenant_name: tenant.name,
+                expires_at: expires_at.toISOString(),
+            },
             createdBy: user.id,
             ipAddress: context?.ip_address,
             userId: user.id,
         });
-        return { ...tokens, tenant_id: tenant.id, tenant_name: tenant.name };
+        return {
+            access_token,
+            expires_at,
+            tenant_id: tenant.id,
+            tenant_name: tenant.name,
+        };
     }
     async accessibleTenants() {
         const { user } = await this.authService.validateRole();
         const row = await this.userRepository.findOne({ where: { id: user.id } });
         if (!row)
-            throw new access_exception_1.AccessException('Authentication required.');
+            throw new common_1.UnauthorizedException('Authentication required.');
         this.assertGlobalAccess(row);
         return this.tenantRepository.find({
             where: { is_active: true },

package/dist/auth/services/impersonation.service.js.map

@@ -1 +1 @@
-{"version":3,"file":"impersonation.service.js","sourceRoot":"","sources":["../../../src/auth/services/impersonation.service.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,2CAA4C;AAC5C,qCAAiD;AACjD,4EAAmE;AACnE,uEAAmE;AACnE,+EAA2E;AAC3E,uEAAmE;AAEnE,yDAAqD;AACrD,4DAAmD;AAEnD,iDAA6C;AAC7C,uEAAuE;AAShE,IAAM,oBAAoB,GAA1B,MAAM,oBAAoB;IAC/B,YACmB,WAAwB,EACxB,YAA0B,EAC1B,UAAsB;QAFtB,gBAAW,GAAX,WAAW,CAAa;QACxB,iBAAY,GAAZ,YAAY,CAAc;QAC1B,eAAU,GAAV,UAAU,CAAY;IACtC,CAAC;IAEJ,KAAK,CAAC,KAAK,CACT,GAA0B,EAC1B,OAA2B;QAE3B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,mBAAmB,CACrD,GAAG,CAAC,KAAK,EACT,GAAG,CAAC,QAAQ,CACb,CAAC;QACF,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC;QAE9B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACvD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,IAAI,EAAE;YACtD,GAAG,OAAO;YACV,SAAS,EAAE,MAAM,CAAC,EAAE;SACrB,CAAC,CAAC;QAEH,MAAM,IAAI,CAAC,YAAY,CAAC,YAAY,CAAC;YACnC,UAAU,EAAE,sCAAmB,CAAC,IAAI;YACpC,QAAQ,EAAE,IAAI,CAAC,EAAE;YACjB,MAAM,EAAE,+BAAW,CAAC,WAAW;YAC/B,QAAQ,EAAE,EAAE,SAAS,EAAE,MAAM,CAAC,EAAE,EAAE,WAAW,EAAE,MAAM,CAAC,IAAI,EAAE;YAC5D,SAAS,EAAE,IAAI,CAAC,EAAE;YAClB,SAAS,EAAE,OAAO,EAAE,UAAU;YAC9B,MAAM,EAAE,IAAI,CAAC,EAAE;SAChB,CAAC,CAAC;QAEH,OAAO,EAAE,GAAG,MAAM,EAAE,SAAS,EAAE,MAAM,CAAC,EAAE,EAAE,WAAW,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;IACvE,CAAC;IAGD,KAAK,CAAC,iBAAiB;QACrB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,YAAY,EAAE,CAAC;QAEvD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QAC1E,IAAI,CAAC,GAAG;YAAE,MAAM,IAAI,kCAAe,CAAC,0BAA0B,CAAC,CAAC;QAChE,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC;QAE7B,OAAO,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC;YAChC,KAAK,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE;YAC1B,KAAK,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE;SACvB,CAAC,CAAC;IACL,CAAC;IAGD,kBAAkB,CAAC,IAAgB;QACjC,IACE,IAAI,CAAC,SAAS,KAAK,yBAAQ,CAAC,WAAW;YACvC,IAAI,CAAC,eAAe;YACpB,CAAC,IAAI,CAAC,iBAAiB,EACvB,CAAC;YACD,MAAM,IAAI,kCAAe,CAAC,2CAA2C,CAAC,CAAC;QACzE,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,kCAAe,CAAC,2BAA2B,CAAC,CAAC;IAC3E,CAAC;IAEO,KAAK,CAAC,aAAa,CAAC,QAAgB;QAC1C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC;YACjD,KAAK,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE;SACzC,CAAC,CAAC;QACH,IAAI,CAAC,MAAM;YACT,MAAM,IAAI,kCAAe,CAAC,4CAA4C,CAAC,CAAC;QAE1E,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,IAAY,gBAAgB;QAC1B,OAAO,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,4BAAY,CAAC,CAAC;IACrD,CAAC;IAED,IAAY,cAAc;QACxB,OAAO,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,wBAAU,CAAC,CAAC;IACnD,CAAC;CACF,CAAA;AA/EY,oDAAoB;+BAApB,oBAAoB;IADhC,IAAA,mBAAU,GAAE;qCAGqB,0BAAW;QACV,4BAAY;QACd,oBAAU;GAJ9B,oBAAoB,CA+EhC"}
+{"version":3,"file":"impersonation.service.js","sourceRoot":"","sources":["../../../src/auth/services/impersonation.service.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,2CAAmE;AACnE,qCAAiD;AACjD,4EAAmE;AACnE,uEAAmE;AACnE,+EAA2E;AAC3E,uEAAmE;AAEnE,yDAAqD;AACrD,4DAAmD;AAEnD,iDAA6C;AAC7C,uEAAuE;AAQhE,IAAM,oBAAoB,GAA1B,MAAM,oBAAoB;IAC/B,YACmB,WAAwB,EACxB,YAA0B,EAC1B,UAAsB;QAFtB,gBAAW,GAAX,WAAW,CAAa;QACxB,iBAAY,GAAZ,YAAY,CAAc;QAC1B,eAAU,GAAV,UAAU,CAAY;IACtC,CAAC;IAEJ,KAAK,CAAC,KAAK,CACT,GAA0B,EAC1B,OAA2B;QAE3B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,mBAAmB,CACrD,GAAG,CAAC,KAAK,EACT,GAAG,CAAC,QAAQ,CACb,CAAC;QACF,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC;QAE9B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACvD,MAAM,EAAE,YAAY,EAAE,UAAU,EAAE,GAChC,MAAM,IAAI,CAAC,WAAW,CAAC,gBAAgB,CAAC,IAAI,EAAE;YAC5C,GAAG,OAAO;YACV,SAAS,EAAE,MAAM,CAAC,EAAE;SACrB,CAAC,CAAC;QAEL,MAAM,IAAI,CAAC,YAAY,CAAC,YAAY,CAAC;YACnC,UAAU,EAAE,sCAAmB,CAAC,IAAI;YACpC,QAAQ,EAAE,IAAI,CAAC,EAAE;YACjB,MAAM,EAAE,+BAAW,CAAC,WAAW;YAC/B,QAAQ,EAAE;gBACR,SAAS,EAAE,MAAM,CAAC,EAAE;gBACpB,WAAW,EAAE,MAAM,CAAC,IAAI;gBACxB,UAAU,EAAE,UAAU,CAAC,WAAW,EAAE;aACrC;YACD,SAAS,EAAE,IAAI,CAAC,EAAE;YAClB,SAAS,EAAE,OAAO,EAAE,UAAU;YAC9B,MAAM,EAAE,IAAI,CAAC,EAAE;SAChB,CAAC,CAAC;QAEH,OAAO;YACL,YAAY;YACZ,UAAU;YACV,SAAS,EAAE,MAAM,CAAC,EAAE;YACpB,WAAW,EAAE,MAAM,CAAC,IAAI;SACzB,CAAC;IACJ,CAAC;IAGD,KAAK,CAAC,iBAAiB;QACrB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,YAAY,EAAE,CAAC;QAEvD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QAC1E,IAAI,CAAC,GAAG;YAAE,MAAM,IAAI,8BAAqB,CAAC,0BAA0B,CAAC,CAAC;QACtE,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC;QAE7B,OAAO,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC;YAChC,KAAK,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE;YAC1B,KAAK,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE;SACvB,CAAC,CAAC;IACL,CAAC;IAGD,kBAAkB,CAAC,IAAgB;QACjC,IACE,IAAI,CAAC,SAAS,KAAK,yBAAQ,CAAC,WAAW;YACvC,IAAI,CAAC,eAAe;YACpB,CAAC,IAAI,CAAC,iBAAiB,EACvB,CAAC;YACD,MAAM,IAAI,kCAAe,CAAC,2CAA2C,CAAC,CAAC;QACzE,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,kCAAe,CAAC,2BAA2B,CAAC,CAAC;IAC3E,CAAC;IAEO,KAAK,CAAC,aAAa,CAAC,QAAgB;QAC1C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC;YACjD,KAAK,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE;SACzC,CAAC,CAAC;QACH,IAAI,CAAC,MAAM;YACT,MAAM,IAAI,kCAAe,CAAC,4CAA4C,CAAC,CAAC;QAE1E,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,IAAY,gBAAgB;QAC1B,OAAO,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,4BAAY,CAAC,CAAC;IACrD,CAAC;IAED,IAAY,cAAc;QACxB,OAAO,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,wBAAU,CAAC,CAAC;IACnD,CAAC;CACF,CAAA;AAzFY,oDAAoB;+BAApB,oBAAoB;IADhC,IAAA,mBAAU,GAAE;qCAGqB,0BAAW;QACV,4BAAY;QACd,oBAAU;GAJ9B,oBAAoB,CAyFhC"}