@oneuptime/common 12.0.32 → 12.0.34

package/build/dist/Server/Middleware/TelemetryIngest.js

@@ -8,13 +8,109 @@ var __metadata = (this && this.__metadata) || function (k, v) {
     if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
 import NotAuthenticatedException from "../../Types/Exception/NotAuthenticatedException";
+import NotAuthorizedException from "../../Types/Exception/NotAuthorizedException";
+import TooManyRequestsException from "../../Types/Exception/TooManyRequestsException";
+import { DEFAULT_BROWSER_KEY_REQUESTS_PER_MINUTE, } from "../../Types/Telemetry/TelemetryIngestionKeyPolicy";
+import TelemetryIngestionKeyType from "../../Types/Telemetry/TelemetryIngestionKeyType";
+import { BROWSER_ALLOWED_INGEST_SURFACES, getIngestSurfaceReadableName, } from "../../Types/Telemetry/TelemetryIngestSurface";
+import OriginAllowList from "../../Utils/Telemetry/OriginAllowList";
+import { headerValueToString, } from "../../Server/Utils/Express";
 import TelemetryIngestionKeyService from "../../Server/Services/TelemetryIngestionKeyService";
 import Response from "../Utils/Response";
 import logger, { getLogAttributesFromRequest } from "../Utils/Logger";
 import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
 import SpanUtil from "../Utils/Telemetry/SpanUtil";
-export default class TelemetryIngest {
+import TelemetryIngestionKeyRateLimiter, { TelemetryIngestionKeyLimitOutcome, } from "../Utils/Telemetry/TelemetryIngestionKeyRateLimiter";
+/*
+ * A Redis outage puts EVERY ingest request on the counter-unavailable path,
+ * so an unguarded log line there is one line per ingested request for as long
+ * as the outage lasts. The ingest path is the highest-volume surface in the
+ * product, so that buries the very incident it is reporting. Same throttle as
+ * PublicDashboardRateLimit and the limiter itself.
+ */
+const COUNTER_UNAVAILABLE_LOG_INTERVAL_MS = 60 * 1000;
+/*
+ * Readable name used when a legacy call site did not name its surface. See
+ * isAuthorizedServiceMiddleware for why such call sites are treated as
+ * server-only.
+ */
+const UNNAMED_SURFACE_READABLE_NAME = "this ingest endpoint";
+/*
+ * How many requests per minute this key may make, or null for "no limit".
+ *
+ * Exported so the branches can be pinned directly in tests without standing
+ * up an Express request, a Redis client and a mocked service just to observe
+ * an arithmetic decision.
+ *
+ * The asymmetry in the fallback is the whole backwards-compatibility story of
+ * this feature: an existing Server key has requestsPerMinuteLimit NULL and
+ * must keep behaving exactly as it did before this shipped, which means no
+ * limit and - see the call site - not even a Redis round trip. A Browser key
+ * with NULL falls back to the shipped default instead, because a public key
+ * with no ceiling is the thing we are trying to stop shipping: "the customer
+ * did not configure a limit" cannot be allowed to mean "unlimited" there.
+ */
+export const getEffectiveRequestsPerMinuteLimit = (policy) => {
+    /*
+     * An explicit limit wins for both key types, including a Server key: a
+     * customer who deliberately set a ceiling on a server key asked for one
+     * and should get it.
+     */
+    if (typeof policy.requestsPerMinuteLimit === "number" &&
+        Number.isFinite(policy.requestsPerMinuteLimit) &&
+        policy.requestsPerMinuteLimit > 0) {
+        return policy.requestsPerMinuteLimit;
+    }
+    if (policy.keyType === TelemetryIngestionKeyType.Browser) {
+        return DEFAULT_BROWSER_KEY_REQUESTS_PER_MINUTE;
+    }
+    return null;
+};
+class TelemetryIngest {
+    /*
+     * Build the ingest guard for one named surface.
+     *
+     * Every ingest route says which surface it is, and the guard answers
+     * "may this key write here?" against BROWSER_ALLOWED_INGEST_SURFACES. That
+     * is what stops a key scraped off a public page from being replayed into
+     * profile / syslog / Fluent / Pyroscope / source-map / Kubernetes-cost /
+     * change-event / security-event ingest, none of which any browser has
+     * business calling.
+     *
+     * This returns a thin closure around a single @CaptureSpan-decorated
+     * method rather than being decorated itself: a decorator on a factory would
+     * open a span when the route table is built at boot, once, and never again
+     * per request. Passing the surface as an argument keeps exactly one
+     * decorated frame, on the function that actually handles a request.
+     */
+    static forSurface(surface) {
+        return (req, res, next) => {
+            return TelemetryIngest.authorizeIngestRequest(surface, req, res, next);
+        };
+    }
+    /**
+     * Backwards-compatible alias for call sites that have not been moved to
+     * forSurface().
+     *
+     * It authorizes with NO named surface, which is treated as SERVER-ONLY: a
+     * Browser key is refused here. That direction is deliberate. Routes are
+     * being migrated to forSurface() one by one, and a route that is missed
+     * must fail CLOSED - a missed browser-capable route is a public credential
+     * reaching an endpoint nobody decided it should reach, whereas a missed
+     * server-only route is a customer seeing "use a server ingestion key" and
+     * filing a bug we can fix in a line. The default must never be the
+     * permissive one.
+     */
     static async isAuthorizedServiceMiddleware(req, res, next) {
+        return TelemetryIngest.authorizeIngestRequest(null, req, res, next);
+    }
+    /*
+     * The single decorated frame that does the work.
+     *
+     * `surface` is null only for the legacy alias above, and null means
+     * "server-only, unnamed".
+     */
+    static async authorizeIngestRequest(surface, req, res, next) {
         try {
             // check header.
             let oneuptimeToken = req.headers["x-oneuptime-token"];
@@ -37,8 +133,14 @@ export default class TelemetryIngest {
                  */
                 return Response.sendErrorResponse(req, res, new NotAuthenticatedException("Missing ingestion token. Send your OneUptime telemetry ingestion key in the x-oneuptime-token header."));
             }
-            const projectId = await TelemetryIngestionKeyService.getProjectIdFromSecretKey(oneuptimeToken.toString());
-            if (!projectId) {
+            /*
+             * One lookup resolves everything the guard needs. The policy is NOT a
+             * decision - a disabled or expired key still resolves - so that each
+             * refusal below can say precisely why, rather than every failure mode
+             * collapsing into an indistinguishable "invalid token".
+             */
+            const policy = await TelemetryIngestionKeyService.getPolicyFromSecretKey(oneuptimeToken.toString());
+            if (!policy) {
                 /*
                  * The token value itself is deliberately NOT logged: ingestion
                  * keys are secrets, and a mistyped-but-nearly-valid token in a
@@ -53,22 +155,238 @@ export default class TelemetryIngest {
                  */
                 return Response.sendErrorResponse(req, res, new NotAuthenticatedException("Invalid ingestion token. Send a valid OneUptime telemetry ingestion key in the x-oneuptime-token header."));
             }
-            req.projectId = projectId;
-            // Tag span with project context for telemetry ingestion observability
+            /*
+             * Kill switch, checked before anything else about the key, so that
+             * turning a leaked key off is the one action guaranteed to stop it
+             * regardless of which surface it is hitting or what its allowlist says.
+             *
+             * 403 rather than 401: the credential was recognised, it is simply not
+             * permitted to write. That distinction is what lets a customer tell
+             * "I pasted the wrong key" apart from "someone switched my key off",
+             * which are very different Tuesday afternoons.
+             */
+            if (policy.isEnabled === false) {
+                return Response.sendErrorResponse(req, res, new NotAuthorizedException("This telemetry ingestion key has been disabled."));
+            }
+            /*
+             * Expiry. 401 here rather than 403 for the same reason as the branches
+             * above: OTLP treats 401 as non-retryable, so a collector holding an
+             * expired key logs the failure once instead of retry-storming an
+             * endpoint that will never accept it again.
+             *
+             * The exact expiry timestamp is deliberately kept out of the response.
+             * The caller has failed to authenticate; the key's configuration is
+             * visible in the dashboard to the people actually entitled to it, and
+             * there is no reason to hand details of a project's credentials to
+             * whoever happens to be holding a dead one.
+             */
+            if (policy.expiresAt && policy.expiresAt.getTime() <= Date.now()) {
+                return Response.sendErrorResponse(req, res, new NotAuthenticatedException("This telemetry ingestion key expired."));
+            }
+            const isBrowserKey = policy.keyType === TelemetryIngestionKeyType.Browser;
+            if (isBrowserKey) {
+                /*
+                 * Surface allowlist. `surface === null` (the legacy alias) is not in
+                 * the set by construction, so an un-migrated route refuses browser
+                 * keys - see isAuthorizedServiceMiddleware for why that is the safe
+                 * direction.
+                 */
+                const isSurfaceAllowedForBrowserKey = surface !== null && BROWSER_ALLOWED_INGEST_SURFACES.has(surface);
+                if (!isSurfaceAllowedForBrowserKey) {
+                    const readableSurfaceName = surface
+                        ? getIngestSurfaceReadableName(surface)
+                        : UNNAMED_SURFACE_READABLE_NAME;
+                    return Response.sendErrorResponse(req, res, new NotAuthorizedException(`A browser ingestion key cannot be used for ${readableSurfaceName}. Use a server ingestion key.`));
+                }
+                const originRefusalMessage = TelemetryIngest.getOriginRefusalMessage(req, policy);
+                if (originRefusalMessage) {
+                    return Response.sendErrorResponse(req, res, new NotAuthorizedException(originRefusalMessage));
+                }
+            }
+            /*
+             * Rate limit.
+             *
+             * A null effective limit means "no limit", and it short-circuits BEFORE
+             * Redis is touched. That is why the limit is computed here rather than
+             * left to the limiter: the overwhelmingly common case is an existing
+             * Server key with no configured limit, and that path must pay literally
+             * nothing - no client lookup, no round trip, no added latency on every
+             * OTLP payload the product accepts. This feature is not allowed to make
+             * today's ingest slower.
+             */
+            const effectiveLimitPerMinute = getEffectiveRequestsPerMinuteLimit(policy);
+            if (effectiveLimitPerMinute !== null) {
+                const decision = await TelemetryIngestionKeyRateLimiter.consume({
+                    ingestionKeyId: policy.ingestionKeyId,
+                    limitPerMinute: effectiveLimitPerMinute,
+                });
+                if (decision.outcome === TelemetryIngestionKeyLimitOutcome.RateLimited) {
+                    if (decision.retryAfterSeconds) {
+                        TelemetryIngest.setRetryAfterHeader(res, decision.retryAfterSeconds);
+                    }
+                    /*
+                     * Log only the request that crossed the line. A rejected client
+                     * keeps knocking by definition, so logging every refusal turns an
+                     * ingest flood into a second flood in the log pipeline - which is
+                     * exactly what an operator does not need while trying to work out
+                     * WHICH key is being abused.
+                     */
+                    if (decision.isFirstRejectionInWindow) {
+                        logger.warn(`TelemetryIngest: ingestion key ${policy.ingestionKeyId.toString()} exceeded its limit of ${effectiveLimitPerMinute} requests per minute`);
+                    }
+                    return Response.sendErrorResponse(req, res, new TooManyRequestsException("Too many telemetry requests for this ingestion key. Please retry later."));
+                }
+                if (decision.outcome ===
+                    TelemetryIngestionKeyLimitOutcome.CounterUnavailable) {
+                    /*
+                     * FAIL OPEN. Redis is unreachable, so no ceiling can be honoured
+                     * either way, and we admit the request.
+                     *
+                     * This limit bounds ABUSE of a key that leaked; it is not a privacy
+                     * control and not a hard billing quota. Failing closed would stop
+                     * every paying customer's production telemetry for the length of a
+                     * Redis blip, and the gap is permanent because dropped spans are
+                     * never replayed - an infrastructure hiccup would become
+                     * customer-visible data loss, with the operator's incident
+                     * dashboards dark at exactly the wrong moment. Failing open hands
+                     * an attacker who already holds a scraped key an unbounded window
+                     * for the duration of the blip, while the origin allowlist, the
+                     * surface allowlist and the kill switch all still apply (they
+                     * resolve from Postgres, not Redis) and Redis being down is itself
+                     * alarmed on.
+                     *
+                     * SessionReplayRateLimiter makes the opposite call for the opposite
+                     * reason: a recording is a video of a real person, and accepting an
+                     * unbounded volume of that is not a recoverable mistake.
+                     */
+                    if (TelemetryIngest.shouldLogCounterUnavailable()) {
+                        logger.warn("TelemetryIngest: ingestion key rate limit counter unavailable, admitting telemetry unthrottled");
+                    }
+                }
+            }
+            req.projectId = policy.projectId;
+            req.ingestionKeyPolicy = policy;
+            /*
+             * Tag span with project context for telemetry ingestion observability.
+             * Key type and surface are here because they are the two dimensions
+             * this feature is judged on: "are browser keys actually being used, and
+             * where" is unanswerable without them, and they turn "refusal rate by
+             * key type" into a one-line query.
+             */
             SpanUtil.addAttributesToCurrentSpan({
-                projectId: projectId.toString(),
+                projectId: policy.projectId.toString(),
+                telemetryIngestionKeyType: policy.keyType,
+                telemetryIngestSurface: surface ? surface.toString() : "unspecified",
+            });
+            /*
+             * Fire and forget: lastUsedAt is bookkeeping for the dashboard, and the
+             * service already throttles the write and swallows its own errors.
+             * Awaiting it would put a database write on the hot path of every
+             * ingested payload for a column nobody reads in real time. The .catch
+             * is belt and braces so a rejection can never surface as an unhandled
+             * rejection.
+             */
+            TelemetryIngestionKeyService.markUsed(policy.ingestionKeyId).catch((err) => {
+                logger.warn(`TelemetryIngest: failed to record last used for ingestion key ${policy.ingestionKeyId.toString()}`);
+                logger.warn(err);
             });
             next();
         }
         catch (err) {
+            /*
+             * Record on THIS middleware's own @CaptureSpan span before handing the
+             * error to Express. The decorator sees a normal return (we call
+             * next(err) rather than rethrowing — Express 4 does not catch a
+             * rejection from an async middleware), so its recorder never runs and
+             * without this the error is invisible on the span it actually belongs
+             * to. Goes through SpanUtil so the event is typed by class name rather
+             * than by HTTP status, and so a rejected credential produces a `fault`
+             * event instead of an Issue.
+             */
+            SpanUtil.recordExceptionOnCurrentSpan(err);
             return next(err);
         }
     }
+    /*
+     * Origin enforcement for a Browser key. Returns the refusal message, or
+     * null when the request may proceed.
+     *
+     * NOTE THE DELIBERATE ASYMMETRY WITH SessionReplayGateCache: there an empty
+     * allowlist means "any origin", because session replay shipped that way and
+     * tightening it would break live installations. Here an empty allowlist
+     * REFUSES. A browser key is only safe to publish in a page because the
+     * allowlist exists - it is the one thing standing between "a credential
+     * anyone can read" and "a credential anyone can use" - so reading "no
+     * allowlist" as "any origin" would hand out precisely the unbounded public
+     * write key this whole feature exists to eliminate. Empty must fail closed.
+     *
+     * TelemetryIngestionKeyService refuses to create or update a Browser key
+     * with an empty allowlist, so for keys created after this ships the branch
+     * is unreachable; it is here for rows that predate it and for anything that
+     * writes the table without going through the service.
+     *
+     * AND BE HONEST ABOUT WHAT THIS BUYS: Origin is a browser-enforced header.
+     * A browser will not let page JavaScript forge it, which is what makes it
+     * meaningful against the actual threat here - someone lifting a key out of
+     * one site's page source and using it from another site. A non-browser
+     * client (curl, a script, a proxy) sets any Origin it likes, so this stops
+     * casual key reuse and nothing more. What actually contains a determined
+     * attacker is the rest of the set: the per-key rate limit bounds the
+     * volume, the pinned service.name stops forged data masquerading as backend
+     * telemetry, and the kill switch ends it outright.
+     */
+    static getOriginRefusalMessage(req, policy) {
+        const origin = headerValueToString(req.headers["origin"]);
+        if (!origin) {
+            /*
+             * Say the header is missing rather than echoing an empty string into
+             * the message - "Origin  is not allowed" reads like a bug and tells the
+             * customer nothing about what to fix.
+             */
+            return "This request did not send an Origin header, so it cannot be checked against the allowed origins of this browser ingestion key. Use a server ingestion key for requests that are not sent by a browser.";
+        }
+        if (policy.allowedOrigins.length === 0 ||
+            !OriginAllowList.matches(origin, policy.allowedOrigins)) {
+            /*
+             * The origin is echoed back on purpose. It is the caller's own value,
+             * never a secret, and it is the single most useful thing a customer can
+             * be told while debugging an allowlist - the usual cause is a scheme,
+             * port or trailing-slash mismatch that stays invisible until the two
+             * strings are put side by side.
+             */
+            return `Origin ${origin} is not allowed for this browser ingestion key.`;
+        }
+        return null;
+    }
+    static shouldLogCounterUnavailable() {
+        const now = Date.now();
+        if (now - TelemetryIngest.counterUnavailableLastLoggedAt <
+            COUNTER_UNAVAILABLE_LOG_INTERVAL_MS) {
+            return false;
+        }
+        TelemetryIngest.counterUnavailableLastLoggedAt = now;
+        return true;
+    }
+    /*
+     * Reached through a runtime check because the response object is not always
+     * a real Express response - unit tests hand this middleware a bare object -
+     * and a missing header on a 429 is a far better outcome than a TypeError
+     * that turns a deliberate refusal into a 500. Same helper as
+     * PublicDashboardRateLimit.
+     */
+    static setRetryAfterHeader(res, retryAfterSeconds) {
+        const setHeader = res["setHeader"];
+        if (typeof setHeader === "function") {
+            setHeader.call(res, "Retry-After", String(retryAfterSeconds));
+        }
+    }
 }
+TelemetryIngest.counterUnavailableLastLoggedAt = 0;
+export default TelemetryIngest;
 __decorate([
     CaptureSpan(),
     __metadata("design:type", Function),
-    __metadata("design:paramtypes", [Object, Object, Function]),
+    __metadata("design:paramtypes", [Object, Object, Object, Function]),
     __metadata("design:returntype", Promise)
-], TelemetryIngest, "isAuthorizedServiceMiddleware", null);
+], TelemetryIngest, "authorizeIngestRequest", null);
 //# sourceMappingURL=TelemetryIngest.js.map

package/build/dist/Server/Middleware/TelemetryIngest.js.map

@@ -1 +1 @@
-{"version":3,"file":"TelemetryIngest.js","sourceRoot":"","sources":["../../../../Server/Middleware/TelemetryIngest.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,yBAAyB,MAAM,iDAAiD,CAAC;AAQxF,OAAO,4BAA4B,MAAM,oDAAoD,CAAC;AAC9F,OAAO,QAAQ,MAAM,mBAAmB,CAAC;AACzC,OAAO,MAAM,EAAE,EAAE,2BAA2B,EAAE,MAAM,iBAAiB,CAAC;AACtE,OAAO,WAAW,MAAM,gCAAgC,CAAC;AACzD,OAAO,QAAQ,MAAM,6BAA6B,CAAC;AAOnD,MAAM,CAAC,OAAO,OAAO,eAAe;IAEd,AAAb,MAAM,CAAC,KAAK,CAAC,6BAA6B,CAC/C,GAAmB,EACnB,GAAoB,EACpB,IAAkB;QAElB,IAAI,CAAC;YACH,gBAAgB;YAEhB,IAAI,cAAc,GAAuB,GAAG,CAAC,OAAO,CAClD,mBAAmB,CACE,CAAC;YAExB,yEAAyE;YACzE,IAAI,CAAC,cAAc,EAAE,CAAC;gBACpB,cAAc,GAAG,GAAG,CAAC,OAAO,CAAC,2BAA2B,CAE3C,CAAC;YAChB,CAAC;YAED,yEAAyE;YACzE,IAAI,CAAC,cAAc,EAAE,CAAC;gBACpB,cAAc,GAAG,GAAG,CAAC,OAAO,CAAC,2BAA2B,CAE3C,CAAC;YAChB,CAAC;YAED,IAAI,CAAC,cAAc,EAAE,CAAC;gBACpB,MAAM,CAAC,KAAK,CACV,mCAAmC,EACnC,2BAA2B,CAAC,GAAU,CAAC,CACxC,CAAC;gBAEF;;;;;;mBAMG;gBACH,OAAO,QAAQ,CAAC,iBAAiB,CAC/B,GAAG,EACH,GAAG,EACH,IAAI,yBAAyB,CAC3B,uGAAuG,CACxG,CACF,CAAC;YACJ,CAAC;YAED,MAAM,SAAS,GACb,MAAM,4BAA4B,CAAC,yBAAyB,CAC1D,cAAc,CAAC,QAAQ,EAAE,CAC1B,CAAC;YAEJ,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf;;;;;mBAKG;gBACH,MAAM,CAAC,KAAK,CACV,wBAAwB,EACxB,2BAA2B,CAAC,GAAU,CAAC,CACxC,CAAC;gBAEF;;;;mBAIG;gBACH,OAAO,QAAQ,CAAC,iBAAiB,CAC/B,GAAG,EACH,GAAG,EACH,IAAI,yBAAyB,CAC3B,0GAA0G,CAC3G,CACF,CAAC;YACJ,CAAC;YAEA,GAAwB,CAAC,SAAS,GAAG,SAAS,CAAC;YAEhD,sEAAsE;YACtE,QAAQ,CAAC,0BAA0B,CAAC;gBAClC,SAAS,EAAE,SAAS,CAAC,QAAQ,EAAE;aAChC,CAAC,CAAC;YAEH,IAAI,EAAE,CAAC;QACT,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC;QACnB,CAAC;IACH,CAAC;CACF;AA3FqB;IADnB,WAAW,EAAE;;;;0DA2Fb"}
+{"version":3,"file":"TelemetryIngest.js","sourceRoot":"","sources":["../../../../Server/Middleware/TelemetryIngest.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,yBAAyB,MAAM,iDAAiD,CAAC;AACxF,OAAO,sBAAsB,MAAM,8CAA8C,CAAC;AAClF,OAAO,wBAAwB,MAAM,gDAAgD,CAAC;AAGtF,OAAoC,EAClC,uCAAuC,GACxC,MAAM,mDAAmD,CAAC;AAC3D,OAAO,yBAAyB,MAAM,iDAAiD,CAAC;AACxF,OAA+B,EAC7B,+BAA+B,EAC/B,4BAA4B,GAC7B,MAAM,8CAA8C,CAAC;AACtD,OAAO,eAAe,MAAM,uCAAuC,CAAC;AACpE,OAAO,EAIL,mBAAmB,GACpB,MAAM,4BAA4B,CAAC;AACpC,OAAO,4BAA4B,MAAM,oDAAoD,CAAC;AAC9F,OAAO,QAAQ,MAAM,mBAAmB,CAAC;AACzC,OAAO,MAAM,EAAE,EAAE,2BAA2B,EAAE,MAAM,iBAAiB,CAAC;AACtE,OAAO,WAAW,MAAM,gCAAgC,CAAC;AACzD,OAAO,QAAQ,MAAM,6BAA6B,CAAC;AACnD,OAAO,gCAAgC,EAAE,EAEvC,iCAAiC,GAClC,MAAM,qDAAqD,CAAC;AAgB7D;;;;;;GAMG;AACH,MAAM,mCAAmC,GAAW,EAAE,GAAG,IAAI,CAAC;AAE9D;;;;GAIG;AACH,MAAM,6BAA6B,GAAW,sBAAsB,CAAC;AAMrE;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,kCAAkC,GAC7C,CAAC,MAAmC,EAAiB,EAAE;IACrD;;;;OAIG;IACH,IACE,OAAO,MAAM,CAAC,sBAAsB,KAAK,QAAQ;QACjD,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,sBAAsB,CAAC;QAC9C,MAAM,CAAC,sBAAsB,GAAG,CAAC,EACjC,CAAC;QACD,OAAO,MAAM,CAAC,sBAAsB,CAAC;IACvC,CAAC;IAED,IAAI,MAAM,CAAC,OAAO,KAAK,yBAAyB,CAAC,OAAO,EAAE,CAAC;QACzD,OAAO,uCAAuC,CAAC;IACjD,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC,CAAC;AAQJ,MAAqB,eAAe;IAClC;;;;;;;;;;;;;;;OAeG;IACI,MAAM,CAAC,UAAU,CACtB,OAA+B;QAE/B,OAAO,CACL,GAAmB,EACnB,GAAoB,EACpB,IAAkB,EACH,EAAE;YACjB,OAAO,eAAe,CAAC,sBAAsB,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;QACzE,CAAC,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;;OAYG;IACI,MAAM,CAAC,KAAK,CAAC,6BAA6B,CAC/C,GAAmB,EACnB,GAAoB,EACpB,IAAkB;QAElB,OAAO,eAAe,CAAC,sBAAsB,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;IACtE,CAAC;IAED;;;;;OAKG;IAEkB,AAAb,MAAM,CAAC,KAAK,CAAC,sBAAsB,CACzC,OAAsC,EACtC,GAAmB,EACnB,GAAoB,EACpB,IAAkB;QAElB,IAAI,CAAC;YACH,gBAAgB;YAEhB,IAAI,cAAc,GAAuB,GAAG,CAAC,OAAO,CAClD,mBAAmB,CACE,CAAC;YAExB,yEAAyE;YACzE,IAAI,CAAC,cAAc,EAAE,CAAC;gBACpB,cAAc,GAAG,GAAG,CAAC,OAAO,CAAC,2BAA2B,CAE3C,CAAC;YAChB,CAAC;YAED,yEAAyE;YACzE,IAAI,CAAC,cAAc,EAAE,CAAC;gBACpB,cAAc,GAAG,GAAG,CAAC,OAAO,CAAC,2BAA2B,CAE3C,CAAC;YAChB,CAAC;YAED,IAAI,CAAC,cAAc,EAAE,CAAC;gBACpB,MAAM,CAAC,KAAK,CACV,mCAAmC,EACnC,2BAA2B,CAAC,GAAU,CAAC,CACxC,CAAC;gBAEF;;;;;;mBAMG;gBACH,OAAO,QAAQ,CAAC,iBAAiB,CAC/B,GAAG,EACH,GAAG,EACH,IAAI,yBAAyB,CAC3B,uGAAuG,CACxG,CACF,CAAC;YACJ,CAAC;YAED;;;;;eAKG;YACH,MAAM,MAAM,GACV,MAAM,4BAA4B,CAAC,sBAAsB,CACvD,cAAc,CAAC,QAAQ,EAAE,CAC1B,CAAC;YAEJ,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ;;;;;mBAKG;gBACH,MAAM,CAAC,KAAK,CACV,wBAAwB,EACxB,2BAA2B,CAAC,GAAU,CAAC,CACxC,CAAC;gBAEF;;;;mBAIG;gBACH,OAAO,QAAQ,CAAC,iBAAiB,CAC/B,GAAG,EACH,GAAG,EACH,IAAI,yBAAyB,CAC3B,0GAA0G,CAC3G,CACF,CAAC;YACJ,CAAC;YAED;;;;;;;;;eASG;YACH,IAAI,MAAM,CAAC,SAAS,KAAK,KAAK,EAAE,CAAC;gBAC/B,OAAO,QAAQ,CAAC,iBAAiB,CAC/B,GAAG,EACH,GAAG,EACH,IAAI,sBAAsB,CACxB,iDAAiD,CAClD,CACF,CAAC;YACJ,CAAC;YAED;;;;;;;;;;;eAWG;YACH,IAAI,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;gBACjE,OAAO,QAAQ,CAAC,iBAAiB,CAC/B,GAAG,EACH,GAAG,EACH,IAAI,yBAAyB,CAC3B,uCAAuC,CACxC,CACF,CAAC;YACJ,CAAC;YAED,MAAM,YAAY,GAChB,MAAM,CAAC,OAAO,KAAK,yBAAyB,CAAC,OAAO,CAAC;YAEvD,IAAI,YAAY,EAAE,CAAC;gBACjB;;;;;mBAKG;gBACH,MAAM,6BAA6B,GACjC,OAAO,KAAK,IAAI,IAAI,+BAA+B,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;gBAEnE,IAAI,CAAC,6BAA6B,EAAE,CAAC;oBACnC,MAAM,mBAAmB,GAAW,OAAO;wBACzC,CAAC,CAAC,4BAA4B,CAAC,OAAO,CAAC;wBACvC,CAAC,CAAC,6BAA6B,CAAC;oBAElC,OAAO,QAAQ,CAAC,iBAAiB,CAC/B,GAAG,EACH,GAAG,EACH,IAAI,sBAAsB,CACxB,8CAA8C,mBAAmB,+BAA+B,CACjG,CACF,CAAC;gBACJ,CAAC;gBAED,MAAM,oBAAoB,GACxB,eAAe,CAAC,uBAAuB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;gBAEvD,IAAI,oBAAoB,EAAE,CAAC;oBACzB,OAAO,QAAQ,CAAC,iBAAiB,CAC/B,GAAG,EACH,GAAG,EACH,IAAI,sBAAsB,CAAC,oBAAoB,CAAC,CACjD,CAAC;gBACJ,CAAC;YACH,CAAC;YAED;;;;;;;;;;eAUG;YACH,MAAM,uBAAuB,GAC3B,kCAAkC,CAAC,MAAM,CAAC,CAAC;YAE7C,IAAI,uBAAuB,KAAK,IAAI,EAAE,CAAC;gBACrC,MAAM,QAAQ,GACZ,MAAM,gCAAgC,CAAC,OAAO,CAAC;oBAC7C,cAAc,EAAE,MAAM,CAAC,cAAc;oBACrC,cAAc,EAAE,uBAAuB;iBACxC,CAAC,CAAC;gBAEL,IACE,QAAQ,CAAC,OAAO,KAAK,iCAAiC,CAAC,WAAW,EAClE,CAAC;oBACD,IAAI,QAAQ,CAAC,iBAAiB,EAAE,CAAC;wBAC/B,eAAe,CAAC,mBAAmB,CACjC,GAAG,EACH,QAAQ,CAAC,iBAAiB,CAC3B,CAAC;oBACJ,CAAC;oBAED;;;;;;uBAMG;oBACH,IAAI,QAAQ,CAAC,wBAAwB,EAAE,CAAC;wBACtC,MAAM,CAAC,IAAI,CACT,kCAAkC,MAAM,CAAC,cAAc,CAAC,QAAQ,EAAE,0BAA0B,uBAAuB,sBAAsB,CAC1I,CAAC;oBACJ,CAAC;oBAED,OAAO,QAAQ,CAAC,iBAAiB,CAC/B,GAAG,EACH,GAAG,EACH,IAAI,wBAAwB,CAC1B,yEAAyE,CAC1E,CACF,CAAC;gBACJ,CAAC;gBAED,IACE,QAAQ,CAAC,OAAO;oBAChB,iCAAiC,CAAC,kBAAkB,EACpD,CAAC;oBACD;;;;;;;;;;;;;;;;;;;;uBAoBG;oBACH,IAAI,eAAe,CAAC,2BAA2B,EAAE,EAAE,CAAC;wBAClD,MAAM,CAAC,IAAI,CACT,gGAAgG,CACjG,CAAC;oBACJ,CAAC;gBACH,CAAC;YACH,CAAC;YAEA,GAAwB,CAAC,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC;YACtD,GAAwB,CAAC,kBAAkB,GAAG,MAAM,CAAC;YAEtD;;;;;;eAMG;YACH,QAAQ,CAAC,0BAA0B,CAAC;gBAClC,SAAS,EAAE,MAAM,CAAC,SAAS,CAAC,QAAQ,EAAE;gBACtC,yBAAyB,EAAE,MAAM,CAAC,OAAO;gBACzC,sBAAsB,EAAE,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,aAAa;aACrE,CAAC,CAAC;YAEH;;;;;;;eAOG;YACH,4BAA4B,CAAC,QAAQ,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,KAAK,CAChE,CAAC,GAAY,EAAE,EAAE;gBACf,MAAM,CAAC,IAAI,CACT,iEAAiE,MAAM,CAAC,cAAc,CAAC,QAAQ,EAAE,EAAE,CACpG,CAAC;gBACF,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACnB,CAAC,CACF,CAAC;YAEF,IAAI,EAAE,CAAC;QACT,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb;;;;;;;;;eASG;YACH,QAAQ,CAAC,4BAA4B,CAAC,GAAG,CAAC,CAAC;YAC3C,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC;QACnB,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACK,MAAM,CAAC,uBAAuB,CACpC,GAAmB,EACnB,MAAmC;QAEnC,MAAM,MAAM,GAAuB,mBAAmB,CACpD,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CACtB,CAAC;QAEF,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ;;;;eAIG;YACH,OAAO,wMAAwM,CAAC;QAClN,CAAC;QAED,IACE,MAAM,CAAC,cAAc,CAAC,MAAM,KAAK,CAAC;YAClC,CAAC,eAAe,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,cAAc,CAAC,EACvD,CAAC;YACD;;;;;;eAMG;YACH,OAAO,UAAU,MAAM,iDAAiD,CAAC;QAC3E,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAIO,MAAM,CAAC,2BAA2B;QACxC,MAAM,GAAG,GAAW,IAAI,CAAC,GAAG,EAAE,CAAC;QAE/B,IACE,GAAG,GAAG,eAAe,CAAC,8BAA8B;YACpD,mCAAmC,EACnC,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC;QAED,eAAe,CAAC,8BAA8B,GAAG,GAAG,CAAC;QAErD,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;;OAMG;IACK,MAAM,CAAC,mBAAmB,CAChC,GAAoB,EACpB,iBAAyB;QAEzB,MAAM,SAAS,GAAa,GAA0C,CACpE,WAAW,CACZ,CAAC;QAEF,IAAI,OAAO,SAAS,KAAK,UAAU,EAAE,CAAC;YACnC,SAAmD,CAAC,IAAI,CACvD,GAAG,EACH,aAAa,EACb,MAAM,CAAC,iBAAiB,CAAC,CAC1B,CAAC;QACJ,CAAC;IACH,CAAC;;AAvCc,8CAA8B,GAAW,CAAC,CAAC;eAtavC,eAAe;AAyDb;IADpB,WAAW,EAAE;;;;mDA8Sb"}

package/build/dist/Server/Services/AIBillingService.js

@@ -17,15 +17,17 @@ import Email from "../../Types/Email";
 import ObjectID from "../../Types/ObjectID";
 import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
 import SlackUtil from "../Utils/Workspace/Slack/Slack";
+import { BillingFailureNoticeKind, shouldSendBillingFailureNotice, } from "../Utils/Billing/BillingFailureNoticeThrottle";
 import URL from "../../Types/API/URL";
 export class AIBillingService extends BaseService {
     constructor() {
         super();
     }
-    async rechargeBalance(projectId, amountInUSD) {
+    async rechargeBalance(projectId, amountInUSD, options) {
         if (!IsBillingEnabled) {
             throw new BadDataException("Billing is not enabled");
         }
+        const sendOwnerConfirmationEmail = (options === null || options === void 0 ? void 0 : options.sendOwnerConfirmationEmail) !== false;
         const project = await ProjectService.findOneById({
             id: projectId,
             select: {
@@ -47,9 +49,26 @@ export class AIBillingService extends BaseService {
         if (!project) {
             return 0;
         }
+        /*
+         * The no-payment-method branch below throws, and that throw lands in this
+         * method's own catch. Without this the FIRST no-payment-method failure
+         * sends two "ACTION REQUIRED" emails about the same fact, one from each
+         * place.
+         */
+        let ownersAlreadyToldAboutThisFailure = false;
         try {
             if (!(await BillingService.hasPaymentMethods(project.paymentProviderCustomerId))) {
-                if (!project.failedAiBalanceChargeNotificationSentToOwners) {
+                /*
+                 * The same 24h window as the catch below. The project boolean this
+                 * branch used to latch on is cleared only by a SUCCESSFUL recharge, so
+                 * a project that never manages one was told once and then never again.
+                 */
+                ownersAlreadyToldAboutThisFailure = true;
+                const shouldTellOwners = await shouldSendBillingFailureNotice({
+                    projectId: project.id,
+                    kind: BillingFailureNoticeKind.AiCreditRechargeFailed,
+                });
+                if (shouldTellOwners) {
                     await ProjectService.updateOneById({
                         data: {
                             failedAiBalanceChargeNotificationSentToOwners: true,
@@ -86,7 +105,18 @@ export class AIBillingService extends BaseService {
                     isRoot: true,
                 },
             });
-            await ProjectService.sendEmailToProjectOwners(project.id, "AI Balance Recharge Successful for project - " + (project.name || ""), `We have successfully recharged your AI balance for project - ${project.name || ""} by ${amountInUSD} USD. Your current balance is ${updatedAmount / 100} USD.`);
+            /*
+             * The confirmation is suppressed for AUTO-recharge only. It used to fire
+             * unconditionally, and AI auto-recharge runs from the balance check on
+             * every AI call, so a busy project mailed every owner once per recharge.
+             * Somebody who deliberately clicked "Recharge" still gets told, because
+             * Project.sendInvoicesByEmail defaults to false and nothing else
+             * reliably confirms the charge.
+             */
+            if (sendOwnerConfirmationEmail) {
+                await ProjectService.sendEmailToProjectOwners(project.id, "AI Balance Recharge Successful for project - " +
+                    (project.name || ""), `We have successfully recharged your AI balance for project - ${project.name || ""} by ${amountInUSD} USD. Your current balance is ${updatedAmount / 100} USD.`);
+            }
             // Send Slack notification for balance refill
             this.sendBalanceRefillSlackNotification({
                 project: project,
@@ -99,17 +129,35 @@ export class AIBillingService extends BaseService {
             return updatedAmount;
         }
         catch (err) {
-            await ProjectService.updateOneById({
-                data: {
-                    failedAiBalanceChargeNotificationSentToOwners: true,
-                },
-                id: project.id,
-                props: {
-                    isRoot: true,
-                },
-            });
-            await ProjectService.sendEmailToProjectOwners(project.id, "ACTION REQUIRED: AI Balance Recharge Failed for project - " +
-                (project.name || ""), `We have tried to recharge your AI balance for project - ${project.name || ""} and failed. Please make sure your payment method is up to date and has sufficient balance. You can add new payment methods in Project Settings.`);
+            /*
+             * This block used to write failedAiBalanceChargeNotificationSentToOwners
+             * and then send WITHOUT ever reading it, so a project with a declined
+             * card mailed every owner once per recharge attempt.
+             *
+             * A 24h window rather than that boolean, for the same reason as the
+             * SMS/call path: the boolean is only cleared by a SUCCESSFUL recharge,
+             * so latching on it would let "no card -> add a card -> the card is
+             * declined" end in permanent silence. See BillingFailureNoticeThrottle.
+             */
+            if (!ownersAlreadyToldAboutThisFailure) {
+                const shouldTellOwners = await shouldSendBillingFailureNotice({
+                    projectId: project.id,
+                    kind: BillingFailureNoticeKind.AiCreditRechargeFailed,
+                });
+                if (shouldTellOwners) {
+                    await ProjectService.updateOneById({
+                        data: {
+                            failedAiBalanceChargeNotificationSentToOwners: true,
+                        },
+                        id: project.id,
+                        props: {
+                            isRoot: true,
+                        },
+                    });
+                    await ProjectService.sendEmailToProjectOwners(project.id, "ACTION REQUIRED: AI Balance Recharge Failed for project - " +
+                        (project.name || ""), `We have tried to recharge your AI balance for project - ${project.name || ""} and failed. Please make sure your payment method is up to date and has sufficient balance. You can add new payment methods in Project Settings.`);
+                }
+            }
             logger.error(err);
             throw err;
         }
@@ -147,7 +195,13 @@ export class AIBillingService extends BaseService {
                 autoRechargeAiWhenCurrentBalanceFallsInUSD) {
                 if ((project.aiCurrentBalanceInUSDCents || 0) / 100 <
                     autoRechargeAiWhenCurrentBalanceFallsInUSD) {
-                    const updatedAmount = await this.rechargeBalance(projectId, autoAiRechargeByBalanceInUSD);
+                    const updatedAmount = await this.rechargeBalance(projectId, autoAiRechargeByBalanceInUSD, {
+                        /*
+                         * This runs from the balance check on every AI call, so a
+                         * success email here is one message to every owner per recharge.
+                         */
+                        sendOwnerConfirmationEmail: false,
+                    });
                     project.aiCurrentBalanceInUSDCents = updatedAmount;
                 }
             }
@@ -177,7 +231,7 @@ ${project.createdOwnerName && project.createdOwnerEmail ? `*Project Created By:*
 __decorate([
     CaptureSpan(),
     __metadata("design:type", Function),
-    __metadata("design:paramtypes", [ObjectID, Number]),
+    __metadata("design:paramtypes", [ObjectID, Number, Object]),
     __metadata("design:returntype", Promise)
 ], AIBillingService.prototype, "rechargeBalance", null);
 __decorate([

package/build/dist/Server/Services/AIBillingService.js.map

@@ -1 +1 @@
-{"version":3,"file":"AIBillingService.js","sourceRoot":"","sources":["../../../../Server/Services/AIBillingService.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EACL,gBAAgB,EAChB,4CAA4C,GAC7C,MAAM,sBAAsB,CAAC;AAC9B,OAAO,MAAM,MAAM,iBAAiB,CAAC;AACrC,OAAO,WAAW,MAAM,eAAe,CAAC;AACxC,OAAO,cAAc,MAAM,kBAAkB,CAAC;AAC9C,OAAO,cAAc,MAAM,kBAAkB,CAAC;AAC9C,OAAO,gBAAgB,MAAM,wCAAwC,CAAC;AACtE,OAAO,KAAK,MAAM,mBAAmB,CAAC;AACtC,OAAO,QAAQ,MAAM,sBAAsB,CAAC;AAE5C,OAAO,WAAW,MAAM,gCAAgC,CAAC;AACzD,OAAO,SAAS,MAAM,gCAAgC,CAAC;AACvD,OAAO,GAAG,MAAM,qBAAqB,CAAC;AAGtC,MAAM,OAAO,gBAAiB,SAAQ,WAAW;IAC/C;QACE,KAAK,EAAE,CAAC;IACV,CAAC;IAGY,AAAN,KAAK,CAAC,eAAe,CAC1B,SAAmB,EACnB,WAAmB;QAEnB,IAAI,CAAC,gBAAgB,EAAE,CAAC;YACtB,MAAM,IAAI,gBAAgB,CAAC,wBAAwB,CAAC,CAAC;QACvD,CAAC;QAED,MAAM,OAAO,GAAmB,MAAM,cAAc,CAAC,WAAW,CAAC;YAC/D,EAAE,EAAE,SAAS;YACb,MAAM,EAAE;gBACN,0BAA0B,EAAE,IAAI;gBAChC,2BAA2B,EAAE,IAAI;gBACjC,QAAQ,EAAE,IAAI;gBACd,4BAA4B,EAAE,IAAI;gBAClC,0CAA0C,EAAE,IAAI;gBAChD,yBAAyB,EAAE,IAAI;gBAC/B,IAAI,EAAE,IAAI;gBACV,6CAA6C,EAAE,IAAI;gBACnD,mBAAmB,EAAE,IAAI;gBACzB,sBAAsB,EAAE,IAAI;aAC7B;YACD,KAAK,EAAE;gBACL,MAAM,EAAE,IAAI;aACb;SACF,CAAC,CAAC;QAEH,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,CAAC,CAAC;QACX,CAAC;QAED,IAAI,CAAC;YACH,IACE,CAAC,CAAC,MAAM,cAAc,CAAC,iBAAiB,CACtC,OAAO,CAAC,yBAA0B,CACnC,CAAC,EACF,CAAC;gBACD,IAAI,CAAC,OAAO,CAAC,6CAA6C,EAAE,CAAC;oBAC3D,MAAM,cAAc,CAAC,aAAa,CAAC;wBACjC,IAAI,EAAE;4BACJ,6CAA6C,EAAE,IAAI;yBACpD;wBACD,EAAE,EAAE,OAAO,CAAC,EAAG;wBACf,KAAK,EAAE;4BACL,MAAM,EAAE,IAAI;yBACb;qBACF,CAAC,CAAC;oBACH,MAAM,cAAc,CAAC,wBAAwB,CAC3C,OAAO,CAAC,EAAG,EACX,4DAA4D;wBAC1D,CAAC,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC,EACtB,2DACE,OAAO,CAAC,IAAI,IAAI,EAClB,mHAAmH,CACpH,CAAC;gBACJ,CAAC;gBACD,MAAM,IAAI,gBAAgB,CACxB,wGAAwG,CACzG,CAAC;YACJ,CAAC;YAED,mBAAmB;YACnB,MAAM,aAAa,GAAW,IAAI,CAAC,KAAK,CACtC,CAAC,OAAO,CAAC,0BAA0B,IAAI,CAAC,CAAC,GAAG,WAAW,GAAG,GAAG,CAC9D,CAAC;YAEF,kEAAkE;YAClE,MAAM,cAAc,CAAC,gCAAgC,CACnD,OAAO,CAAC,yBAA0B,EAClC,qBAAqB,EACrB,WAAW,EACX;gBACE,kBAAkB,EAAE,OAAO,CAAC,mBAAmB,IAAI,KAAK;gBACxD,eAAe,EAAE,OAAO,CAAC,sBAAsB;oBAC7C,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,OAAO,CAAC,sBAAsB,CAAC;oBACjD,CAAC,CAAC,SAAS;gBACb,SAAS,EAAE,OAAO,CAAC,EAAE,IAAI,SAAS;aACnC,CACF,CAAC;YAEF,MAAM,cAAc,CAAC,aAAa,CAAC;gBACjC,IAAI,EAAE;oBACJ,0BAA0B,EAAE,aAAa;oBACzC,6CAA6C,EAAE,KAAK,EAAE,kBAAkB;oBACxE,oCAAoC,EAAE,KAAK,EAAE,kBAAkB;oBAC/D,oCAAoC,EAAE,KAAK;iBAC5C;gBACD,EAAE,EAAE,OAAO,CAAC,EAAG;gBACf,KAAK,EAAE;oBACL,MAAM,EAAE,IAAI;iBACb;aACF,CAAC,CAAC;YAEH,MAAM,cAAc,CAAC,wBAAwB,CAC3C,OAAO,CAAC,EAAG,EACX,+CAA+C,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC,EACtE,gEACE,OAAO,CAAC,IAAI,IAAI,EAClB,OAAO,WAAW,iCAChB,aAAa,GAAG,GAClB,OAAO,CACR,CAAC;YAEF,6CAA6C;YAC7C,IAAI,CAAC,kCAAkC,CAAC;gBACtC,OAAO,EAAE,OAAO;gBAChB,WAAW,EAAE,WAAW;gBACxB,mBAAmB,EAAE,aAAa,GAAG,GAAG;aACzC,CAAC,CAAC,KAAK,CAAC,CAAC,KAAgB,EAAE,EAAE;gBAC5B,MAAM,CAAC,KAAK,CACV,qDAAqD,GAAG,KAAK,CAC9D,CAAC;YACJ,CAAC,CAAC,CAAC;YAEH,OAAO,CAAC,0BAA0B,GAAG,aAAa,CAAC;YAEnD,OAAO,aAAa,CAAC;QACvB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,cAAc,CAAC,aAAa,CAAC;gBACjC,IAAI,EAAE;oBACJ,6CAA6C,EAAE,IAAI;iBACpD;gBACD,EAAE,EAAE,OAAO,CAAC,EAAG;gBACf,KAAK,EAAE;oBACL,MAAM,EAAE,IAAI;iBACb;aACF,CAAC,CAAC;YACH,MAAM,cAAc,CAAC,wBAAwB,CAC3C,OAAO,CAAC,EAAG,EACX,4DAA4D;gBAC1D,CAAC,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC,EACtB,2DACE,OAAO,CAAC,IAAI,IAAI,EAClB,kJAAkJ,CACnJ,CAAC;YACF,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAClB,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAGY,AAAN,KAAK,CAAC,sBAAsB,CACjC,SAAmB,EACnB,OAIC;QAED,IAAI,OAAO,GAAmB,IAAI,CAAC;QACnC,IAAI,SAAS,IAAI,gBAAgB,EAAE,CAAC;YAClC,yBAAyB;YAEzB,OAAO,GAAG,MAAM,cAAc,CAAC,WAAW,CAAC;gBACzC,EAAE,EAAE,SAAS;gBACb,MAAM,EAAE;oBACN,0BAA0B,EAAE,IAAI;oBAChC,2BAA2B,EAAE,IAAI;oBACjC,4BAA4B,EAAE,IAAI;oBAClC,0CAA0C,EAAE,IAAI;iBACjD;gBACD,KAAK,EAAE;oBACL,MAAM,EAAE,IAAI;iBACb;aACF,CAAC,CAAC;YAEH,MAAM,0CAA0C,GAC9C,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,0CAA0C;iBACnD,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,0CAA0C,CAAA;gBACnD,CAAC,CAAC;YACJ,MAAM,4BAA4B,GAChC,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,4BAA4B;iBACrC,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,4BAA4B,CAAA;gBACrC,CAAC,CAAC;YAEJ,MAAM,2BAA2B,GAAY,OAAO;gBAClD,CAAC,CAAC,OAAO,CAAC,2BAA2B;gBACrC,CAAC,CAAC,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,2BAA2B,KAAI,KAAK,CAAC;YAElD,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO,CAAC,CAAC;YACX,CAAC;YAED,IACE,2BAA2B;gBAC3B,4BAA4B;gBAC5B,0CAA0C,EAC1C,CAAC;gBACD,IACE,CAAC,OAAO,CAAC,0BAA0B,IAAI,CAAC,CAAC,GAAG,GAAG;oBAC/C,0CAA0C,EAC1C,CAAC;oBACD,MAAM,aAAa,GAAW,MAAM,IAAI,CAAC,eAAe,CACtD,SAAS,EACT,4BAA4B,CAC7B,CAAC;oBACF,OAAO,CAAC,0BAA0B,GAAG,aAAa,CAAC;gBACrD,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,0BAA0B,KAAI,CAAC,CAAC;IAClD,CAAC;IAGa,AAAN,KAAK,CAAC,kCAAkC,CAAC,IAIhD;;QACC,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,mBAAmB,EAAE,GAAG,IAAI,CAAC;QAE3D,IAAI,4CAA4C,EAAE,CAAC;YACjD,MAAM,YAAY,GAAW;kBACjB,CAAA,MAAA,OAAO,CAAC,IAAI,0CAAE,QAAQ,EAAE,KAAI,KAAK;gBACnC,CAAA,MAAA,OAAO,CAAC,EAAE,0CAAE,QAAQ,EAAE,KAAI,KAAK;oBAC3B,WAAW;sBACT,mBAAmB;;EAEvC,OAAO,CAAC,gBAAgB,IAAI,OAAO,CAAC,iBAAiB,CAAC,CAAC,CAAC,yBAAyB,OAAO,CAAC,gBAAgB,CAAC,QAAQ,EAAE,KAAK,OAAO,CAAC,iBAAiB,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;YAEpK,SAAS,CAAC,sCAAsC,CAAC;gBAC/C,GAAG,EAAE,GAAG,CAAC,UAAU,CAAC,4CAA4C,CAAC;gBACjE,IAAI,EAAE,YAAY;aACnB,CAAC,CAAC,KAAK,CAAC,CAAC,KAAgB,EAAE,EAAE;gBAC5B,MAAM,CAAC,KAAK,CACV,qDAAqD,GAAG,KAAK,CAC9D,CAAC;YACJ,CAAC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;CACF;AAvOc;IADZ,WAAW,EAAE;;qCAED,QAAQ;;uDAyIpB;AAGY;IADZ,WAAW,EAAE;;qCAED,QAAQ;;8DA4DpB;AAGa;IADb,WAAW,EAAE;;;;0EA0Bb;AAGH,eAAe,IAAI,gBAAgB,EAAE,CAAC"}
+{"version":3,"file":"AIBillingService.js","sourceRoot":"","sources":["../../../../Server/Services/AIBillingService.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EACL,gBAAgB,EAChB,4CAA4C,GAC7C,MAAM,sBAAsB,CAAC;AAC9B,OAAO,MAAM,MAAM,iBAAiB,CAAC;AACrC,OAAO,WAAW,MAAM,eAAe,CAAC;AACxC,OAAO,cAAc,MAAM,kBAAkB,CAAC;AAC9C,OAAO,cAAc,MAAM,kBAAkB,CAAC;AAC9C,OAAO,gBAAgB,MAAM,wCAAwC,CAAC;AACtE,OAAO,KAAK,MAAM,mBAAmB,CAAC;AACtC,OAAO,QAAQ,MAAM,sBAAsB,CAAC;AAE5C,OAAO,WAAW,MAAM,gCAAgC,CAAC;AACzD,OAAO,SAAS,MAAM,gCAAgC,CAAC;AACvD,OAAO,EACL,wBAAwB,EACxB,8BAA8B,GAC/B,MAAM,+CAA+C,CAAC;AACvD,OAAO,GAAG,MAAM,qBAAqB,CAAC;AAGtC,MAAM,OAAO,gBAAiB,SAAQ,WAAW;IAC/C;QACE,KAAK,EAAE,CAAC;IACV,CAAC;IAGY,AAAN,KAAK,CAAC,eAAe,CAC1B,SAAmB,EACnB,WAAmB,EACnB,OASC;QAED,IAAI,CAAC,gBAAgB,EAAE,CAAC;YACtB,MAAM,IAAI,gBAAgB,CAAC,wBAAwB,CAAC,CAAC;QACvD,CAAC;QAED,MAAM,0BAA0B,GAC9B,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,0BAA0B,MAAK,KAAK,CAAC;QAEhD,MAAM,OAAO,GAAmB,MAAM,cAAc,CAAC,WAAW,CAAC;YAC/D,EAAE,EAAE,SAAS;YACb,MAAM,EAAE;gBACN,0BAA0B,EAAE,IAAI;gBAChC,2BAA2B,EAAE,IAAI;gBACjC,QAAQ,EAAE,IAAI;gBACd,4BAA4B,EAAE,IAAI;gBAClC,0CAA0C,EAAE,IAAI;gBAChD,yBAAyB,EAAE,IAAI;gBAC/B,IAAI,EAAE,IAAI;gBACV,6CAA6C,EAAE,IAAI;gBACnD,mBAAmB,EAAE,IAAI;gBACzB,sBAAsB,EAAE,IAAI;aAC7B;YACD,KAAK,EAAE;gBACL,MAAM,EAAE,IAAI;aACb;SACF,CAAC,CAAC;QAEH,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,CAAC,CAAC;QACX,CAAC;QAED;;;;;WAKG;QACH,IAAI,iCAAiC,GAAY,KAAK,CAAC;QAEvD,IAAI,CAAC;YACH,IACE,CAAC,CAAC,MAAM,cAAc,CAAC,iBAAiB,CACtC,OAAO,CAAC,yBAA0B,CACnC,CAAC,EACF,CAAC;gBACD;;;;mBAIG;gBACH,iCAAiC,GAAG,IAAI,CAAC;gBAEzC,MAAM,gBAAgB,GAAY,MAAM,8BAA8B,CAAC;oBACrE,SAAS,EAAE,OAAO,CAAC,EAAG;oBACtB,IAAI,EAAE,wBAAwB,CAAC,sBAAsB;iBACtD,CAAC,CAAC;gBAEH,IAAI,gBAAgB,EAAE,CAAC;oBACrB,MAAM,cAAc,CAAC,aAAa,CAAC;wBACjC,IAAI,EAAE;4BACJ,6CAA6C,EAAE,IAAI;yBACpD;wBACD,EAAE,EAAE,OAAO,CAAC,EAAG;wBACf,KAAK,EAAE;4BACL,MAAM,EAAE,IAAI;yBACb;qBACF,CAAC,CAAC;oBACH,MAAM,cAAc,CAAC,wBAAwB,CAC3C,OAAO,CAAC,EAAG,EACX,4DAA4D;wBAC1D,CAAC,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC,EACtB,2DACE,OAAO,CAAC,IAAI,IAAI,EAClB,mHAAmH,CACpH,CAAC;gBACJ,CAAC;gBACD,MAAM,IAAI,gBAAgB,CACxB,wGAAwG,CACzG,CAAC;YACJ,CAAC;YAED,mBAAmB;YACnB,MAAM,aAAa,GAAW,IAAI,CAAC,KAAK,CACtC,CAAC,OAAO,CAAC,0BAA0B,IAAI,CAAC,CAAC,GAAG,WAAW,GAAG,GAAG,CAC9D,CAAC;YAEF,kEAAkE;YAClE,MAAM,cAAc,CAAC,gCAAgC,CACnD,OAAO,CAAC,yBAA0B,EAClC,qBAAqB,EACrB,WAAW,EACX;gBACE,kBAAkB,EAAE,OAAO,CAAC,mBAAmB,IAAI,KAAK;gBACxD,eAAe,EAAE,OAAO,CAAC,sBAAsB;oBAC7C,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,OAAO,CAAC,sBAAsB,CAAC;oBACjD,CAAC,CAAC,SAAS;gBACb,SAAS,EAAE,OAAO,CAAC,EAAE,IAAI,SAAS;aACnC,CACF,CAAC;YAEF,MAAM,cAAc,CAAC,aAAa,CAAC;gBACjC,IAAI,EAAE;oBACJ,0BAA0B,EAAE,aAAa;oBACzC,6CAA6C,EAAE,KAAK,EAAE,kBAAkB;oBACxE,oCAAoC,EAAE,KAAK,EAAE,kBAAkB;oBAC/D,oCAAoC,EAAE,KAAK;iBAC5C;gBACD,EAAE,EAAE,OAAO,CAAC,EAAG;gBACf,KAAK,EAAE;oBACL,MAAM,EAAE,IAAI;iBACb;aACF,CAAC,CAAC;YAEH;;;;;;;eAOG;YACH,IAAI,0BAA0B,EAAE,CAAC;gBAC/B,MAAM,cAAc,CAAC,wBAAwB,CAC3C,OAAO,CAAC,EAAG,EACX,+CAA+C;oBAC7C,CAAC,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC,EACtB,gEACE,OAAO,CAAC,IAAI,IAAI,EAClB,OAAO,WAAW,iCAChB,aAAa,GAAG,GAClB,OAAO,CACR,CAAC;YACJ,CAAC;YAED,6CAA6C;YAC7C,IAAI,CAAC,kCAAkC,CAAC;gBACtC,OAAO,EAAE,OAAO;gBAChB,WAAW,EAAE,WAAW;gBACxB,mBAAmB,EAAE,aAAa,GAAG,GAAG;aACzC,CAAC,CAAC,KAAK,CAAC,CAAC,KAAgB,EAAE,EAAE;gBAC5B,MAAM,CAAC,KAAK,CACV,qDAAqD,GAAG,KAAK,CAC9D,CAAC;YACJ,CAAC,CAAC,CAAC;YAEH,OAAO,CAAC,0BAA0B,GAAG,aAAa,CAAC;YAEnD,OAAO,aAAa,CAAC;QACvB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb;;;;;;;;;eASG;YACH,IAAI,CAAC,iCAAiC,EAAE,CAAC;gBACvC,MAAM,gBAAgB,GAAY,MAAM,8BAA8B,CAAC;oBACrE,SAAS,EAAE,OAAO,CAAC,EAAG;oBACtB,IAAI,EAAE,wBAAwB,CAAC,sBAAsB;iBACtD,CAAC,CAAC;gBAEH,IAAI,gBAAgB,EAAE,CAAC;oBACrB,MAAM,cAAc,CAAC,aAAa,CAAC;wBACjC,IAAI,EAAE;4BACJ,6CAA6C,EAAE,IAAI;yBACpD;wBACD,EAAE,EAAE,OAAO,CAAC,EAAG;wBACf,KAAK,EAAE;4BACL,MAAM,EAAE,IAAI;yBACb;qBACF,CAAC,CAAC;oBACH,MAAM,cAAc,CAAC,wBAAwB,CAC3C,OAAO,CAAC,EAAG,EACX,4DAA4D;wBAC1D,CAAC,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC,EACtB,2DACE,OAAO,CAAC,IAAI,IAAI,EAClB,kJAAkJ,CACnJ,CAAC;gBACJ,CAAC;YACH,CAAC;YACD,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAClB,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAGY,AAAN,KAAK,CAAC,sBAAsB,CACjC,SAAmB,EACnB,OAIC;QAED,IAAI,OAAO,GAAmB,IAAI,CAAC;QACnC,IAAI,SAAS,IAAI,gBAAgB,EAAE,CAAC;YAClC,yBAAyB;YAEzB,OAAO,GAAG,MAAM,cAAc,CAAC,WAAW,CAAC;gBACzC,EAAE,EAAE,SAAS;gBACb,MAAM,EAAE;oBACN,0BAA0B,EAAE,IAAI;oBAChC,2BAA2B,EAAE,IAAI;oBACjC,4BAA4B,EAAE,IAAI;oBAClC,0CAA0C,EAAE,IAAI;iBACjD;gBACD,KAAK,EAAE;oBACL,MAAM,EAAE,IAAI;iBACb;aACF,CAAC,CAAC;YAEH,MAAM,0CAA0C,GAC9C,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,0CAA0C;iBACnD,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,0CAA0C,CAAA;gBACnD,CAAC,CAAC;YACJ,MAAM,4BAA4B,GAChC,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,4BAA4B;iBACrC,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,4BAA4B,CAAA;gBACrC,CAAC,CAAC;YAEJ,MAAM,2BAA2B,GAAY,OAAO;gBAClD,CAAC,CAAC,OAAO,CAAC,2BAA2B;gBACrC,CAAC,CAAC,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,2BAA2B,KAAI,KAAK,CAAC;YAElD,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO,CAAC,CAAC;YACX,CAAC;YAED,IACE,2BAA2B;gBAC3B,4BAA4B;gBAC5B,0CAA0C,EAC1C,CAAC;gBACD,IACE,CAAC,OAAO,CAAC,0BAA0B,IAAI,CAAC,CAAC,GAAG,GAAG;oBAC/C,0CAA0C,EAC1C,CAAC;oBACD,MAAM,aAAa,GAAW,MAAM,IAAI,CAAC,eAAe,CACtD,SAAS,EACT,4BAA4B,EAC5B;wBACE;;;2BAGG;wBACH,0BAA0B,EAAE,KAAK;qBAClC,CACF,CAAC;oBACF,OAAO,CAAC,0BAA0B,GAAG,aAAa,CAAC;gBACrD,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,0BAA0B,KAAI,CAAC,CAAC;IAClD,CAAC;IAGa,AAAN,KAAK,CAAC,kCAAkC,CAAC,IAIhD;;QACC,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,mBAAmB,EAAE,GAAG,IAAI,CAAC;QAE3D,IAAI,4CAA4C,EAAE,CAAC;YACjD,MAAM,YAAY,GAAW;kBACjB,CAAA,MAAA,OAAO,CAAC,IAAI,0CAAE,QAAQ,EAAE,KAAI,KAAK;gBACnC,CAAA,MAAA,OAAO,CAAC,EAAE,0CAAE,QAAQ,EAAE,KAAI,KAAK;oBAC3B,WAAW;sBACT,mBAAmB;;EAEvC,OAAO,CAAC,gBAAgB,IAAI,OAAO,CAAC,iBAAiB,CAAC,CAAC,CAAC,yBAAyB,OAAO,CAAC,gBAAgB,CAAC,QAAQ,EAAE,KAAK,OAAO,CAAC,iBAAiB,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;YAEpK,SAAS,CAAC,sCAAsC,CAAC;gBAC/C,GAAG,EAAE,GAAG,CAAC,UAAU,CAAC,4CAA4C,CAAC;gBACjE,IAAI,EAAE,YAAY;aACnB,CAAC,CAAC,KAAK,CAAC,CAAC,KAAgB,EAAE,EAAE;gBAC5B,MAAM,CAAC,KAAK,CACV,qDAAqD,GAAG,KAAK,CAC9D,CAAC;YACJ,CAAC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;CACF;AA7Sc;IADZ,WAAW,EAAE;;qCAED,QAAQ;;uDAwMpB;AAGY;IADZ,WAAW,EAAE;;qCAED,QAAQ;;8DAmEpB;AAGa;IADb,WAAW,EAAE;;;;0EA0Bb;AAGH,eAAe,IAAI,gBAAgB,EAAE,CAAC"}

package/build/dist/Server/Services/AccessTokenService.js

@@ -120,6 +120,7 @@ export class AccessTokenService extends BaseService {
         const teamPermissions = await TeamPermissionService.findBy({
             query: {
                 teamId: QueryHelper.any(teamIds),
+                projectId: projectId,
             },
             select: {
                 permission: true,

package/build/dist/Server/Services/AccessTokenService.js.map

@@ -1 +1 @@
-{"version":3,"file":"AccessTokenService.js","sourceRoot":"","sources":["../../../../Server/Services/AccessTokenService.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,WAAW,MAAM,+BAA+B,CAAC;AACxD,OAAO,WAAW,MAAM,+BAA+B,CAAC;AACxD,OAAO,WAAW,MAAM,eAAe,CAAC;AACxC,OAAO,iBAAiB,MAAM,qBAAqB,CAAC;AACpD,OAAO,qBAAqB,MAAM,yBAAyB,CAAC;AAC5D,OAAO,SAAS,MAAM,+BAA+B,CAAC;AACtD,OAAO,QAAQ,MAAM,sBAAsB,CAAC;AAC5C,OAAO,UAIN,MAAM,wBAAwB,CAAC;AAIhC,OAAO,kBAAkB,MAAM,wCAAwC,CAAC;AACxE,OAAO,mBAAmB,MAAM,yCAAyC,CAAC;AAE1E,OAAO,WAAW,MAAM,gCAAgC,CAAC;AAEzD,MAAM,OAAO,kBAAmB,SAAQ,WAAW;IACjD;QACE,KAAK,EAAE,CAAC;IACV,CAAC;IAGY,AAAN,KAAK,CAAC,yBAAyB,CAAC,MAAgB;QACrD,MAAM,IAAI,CAAC,iCAAiC,CAAC,MAAM,CAAC,CAAC;QAErD,0CAA0C;QAC1C,IAAI,WAAW,GAAsB,MAAM,iBAAiB,CAAC,MAAM,CAAC;YAClE,KAAK,EAAE;gBACL,MAAM,EAAE,MAAM;gBACd,qBAAqB,EAAE,IAAI;aAC5B;YACD,MAAM,EAAE;gBACN,SAAS,EAAE,IAAI;aAChB;YACD,KAAK,EAAE,SAAS;YAChB,IAAI,EAAE,CAAC;YACP,KAAK,EAAE;gBACL,MAAM,EAAE,IAAI;aACb;SACF,CAAC,CAAC;QAEH,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,WAAW,GAAG,EAAE,CAAC;QACnB,CAAC;QAED,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC7B,OAAO;QACT,CAAC;QAED,MAAM,UAAU,GAAoB,WAAW,CAAC,GAAG,CACjD,CAAC,UAAsB,EAAE,EAAE;YACzB,OAAO,UAAU,CAAC,SAAU,CAAC;QAC/B,CAAC,CACF,CAAC;QAEF,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;YACnC,MAAM,IAAI,CAAC,iCAAiC,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QAClE,CAAC;IACH,CAAC;IAGY,AAAN,KAAK,CAAC,iCAAiC,CAC5C,MAAgB;QAEhB,0CAA0C;QAC1C,IAAI,WAAW,GAAsB,MAAM,iBAAiB,CAAC,MAAM,CAAC;YAClE,KAAK,EAAE;gBACL,MAAM,EAAE,MAAM;gBACd,qBAAqB,EAAE,IAAI;aAC5B;YACD,MAAM,EAAE;gBACN,SAAS,EAAE,IAAI;aAChB;YACD,KAAK,EAAE,SAAS;YAChB,IAAI,EAAE,CAAC;YACP,KAAK,EAAE;gBACL,MAAM,EAAE,IAAI;aACb;SACF,CAAC,CAAC;QAEH,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,WAAW,GAAG,EAAE,CAAC;QACnB,CAAC;QAED,MAAM,UAAU,GAAoB,WAAW,CAAC,GAAG,CACjD,CAAC,UAAsB,EAAE,EAAE;YACzB,OAAO,UAAU,CAAC,SAAU,CAAC;QAC/B,CAAC,CACF,CAAC;QAEF,MAAM,iBAAiB,GAA+B;YACpD,UAAU;YACV,iBAAiB,EAAE;gBACjB,UAAU,CAAC,MAAM;gBACjB,UAAU,CAAC,IAAI;gBACf,UAAU,CAAC,WAAW;aACvB;YACD,KAAK,EAAE,4BAA4B;SACpC,CAAC;QAEF,MAAM,WAAW,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,QAAQ,EAAE,EAAE,iBAAiB,CAAC,CAAC;QAExE,OAAO,iBAAiB,CAAC;IAC3B,CAAC;IAGY,AAAN,KAAK,CAAC,6BAA6B,CACxC,MAAgB;QAEhB,MAAM,IAAI,GACR,MAAM,kBAAkB,CAAC,sCAAsC,CAAC,MAAM,CAAC,CAAC;QAE1E,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,MAAM,IAAI,CAAC,iCAAiC,CAAC,MAAM,CAAC,CAAC;QAC9D,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAGY,AAAN,KAAK,CAAC,iCAAiC,CAC5C,MAAgB,EAChB,SAAmB;QAEnB,0CAA0C;QAC1C,MAAM,WAAW,GAAsB,MAAM,iBAAiB,CAAC,MAAM,CAAC;YACpE,KAAK,EAAE;gBACL,MAAM,EAAE,MAAM;gBACd,SAAS,EAAE,SAAS;gBACpB,qBAAqB,EAAE,IAAI;aAC5B;YACD,MAAM,EAAE;gBACN,MAAM,EAAE,IAAI;aACb;YACD,KAAK,EAAE,SAAS;YAChB,IAAI,EAAE,CAAC;YACP,KAAK,EAAE;gBACL,MAAM,EAAE,IAAI;aACb;SACF,CAAC,CAAC;QAEH,MAAM,OAAO,GAAoB,WAAW,CAAC,GAAG,CAC9C,CAAC,UAAsB,EAAE,EAAE;YACzB,OAAO,UAAU,CAAC,MAAO,CAAC;QAC5B,CAAC,CACF,CAAC;QAEF,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,wBAAwB;QACxB,MAAM,eAAe,GACnB,MAAM,qBAAqB,CAAC,MAAM,CAAC;YACjC,KAAK,EAAE;gBACL,MAAM,EAAE,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC;aACjC;YACD,MAAM,EAAE;gBACN,UAAU,EAAE,IAAI;gBAChB,MAAM,EAAE;oBACN,GAAG,EAAE,IAAI;iBACV;gBACD,iBAAiB,EAAE,IAAI;gBACvB,KAAK,EAAE,IAAI;aACZ;YACD,KAAK,EAAE,SAAS;YAChB,IAAI,EAAE,CAAC;YACP,KAAK,EAAE;gBACL,MAAM,EAAE,IAAI;aACb;SACF,CAAC,CAAC;QAEL,MAAM,eAAe,GAA0B,EAAE,CAAC;QAElD,KAAK,MAAM,cAAc,IAAI,eAAe,EAAE,CAAC;YAC7C,IAAI,CAAC,cAAc,CAAC,MAAM,EAAE,CAAC;gBAC3B,cAAc,CAAC,MAAM,GAAG,EAAE,CAAC;YAC7B,CAAC;YAED,eAAe,CAAC,IAAI,CAAC;gBACnB,UAAU,EAAE,cAAc,CAAC,UAAW;gBACtC,QAAQ,EAAE,cAAc,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAY,EAAE,EAAE;oBACnD,OAAO,KAAK,CAAC,EAAG,CAAC;gBACnB,CAAC,CAAC;gBACF,iBAAiB,EAAE,cAAc,CAAC,iBAAiB;gBACnD,KAAK,EAAE,cAAc,CAAC,KAAK;gBAC3B,KAAK,EAAE,gBAAgB;aACxB,CAAC,CAAC;QACL,CAAC;QAED,MAAM,iBAAiB,GACrB,kBAAkB,CAAC,oCAAoC,CAAC,SAAS,CAAC,CAAC;QAErE,iBAAiB,CAAC,WAAW;YAC3B,iBAAiB,CAAC,WAAW,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;QAExD;;;;;;;;WAQG;QACH,MAAM,UAAU,GACd,kBAAkB,CAAC,yBAAyB,CAAC,iBAAiB,CAAC,CAAC;QAElE,MAAM,WAAW,CAAC,OAAO,CACvB,mBAAmB,CAAC,iBAAiB,EACrC,kBAAkB,CAAC,6BAA6B,CAAC,MAAM,EAAE,SAAS,CAAC,EACnE,UAAU,CACX,CAAC;QAEF,OAAO,UAAU,CAAC;IACpB,CAAC;IAGY,AAAN,KAAK,CAAC,iDAAiD,CAAC,IAG9D;QACC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,IAAI,CAAC;QAEnC,OAAO;YACL,MAAM,EAAE,MAAM;YACd,0BAA0B,EACxB,CAAC,MAAM,IAAI,CAAC,6BAA6B,CAAC,MAAM,CAAC,CAAC,IAAI,SAAS;YACjE,0BAA0B,EAAE;gBAC1B,CAAC,SAAS,CAAC,QAAQ,EAAE,CAAC,EAAE,CAAC,MAAM,IAAI,CAAC,6BAA6B,CAC/D,MAAM,EACN,SAAS,CACV,CAAE;aACJ;YACD,QAAQ,EAAE,SAAS;SACpB,CAAC;IACJ,CAAC;IAGY,AAAN,KAAK,CAAC,6BAA6B,CACxC,MAAgB,EAChB,SAAmB;QAEnB,MAAM,IAAI,GACR,MAAM,kBAAkB,CAAC,sCAAsC,CAC7D,MAAM,EACN,SAAS,CACV,CAAC;QAEJ,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,MAAM,IAAI,CAAC,iCAAiC,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QACzE,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;CACF;AAzOc;IADZ,WAAW,EAAE;;qCACiC,QAAQ;;mEAoCtD;AAGY;IADZ,WAAW,EAAE;;qCAEJ,QAAQ;;2EAyCjB;AAGY;IADZ,WAAW,EAAE;;qCAEJ,QAAQ;;uEAUjB;AAGY;IADZ,WAAW,EAAE;;qCAEJ,QAAQ;QACL,QAAQ;;2EA6FpB;AAGY;IADZ,WAAW,EAAE;;;;2FAmBb;AAGY;IADZ,WAAW,EAAE;;qCAEJ,QAAQ;QACL,QAAQ;;uEAapB;AAGH,eAAe,IAAI,kBAAkB,EAAE,CAAC"}
+{"version":3,"file":"AccessTokenService.js","sourceRoot":"","sources":["../../../../Server/Services/AccessTokenService.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,WAAW,MAAM,+BAA+B,CAAC;AACxD,OAAO,WAAW,MAAM,+BAA+B,CAAC;AACxD,OAAO,WAAW,MAAM,eAAe,CAAC;AACxC,OAAO,iBAAiB,MAAM,qBAAqB,CAAC;AACpD,OAAO,qBAAqB,MAAM,yBAAyB,CAAC;AAC5D,OAAO,SAAS,MAAM,+BAA+B,CAAC;AACtD,OAAO,QAAQ,MAAM,sBAAsB,CAAC;AAC5C,OAAO,UAIN,MAAM,wBAAwB,CAAC;AAIhC,OAAO,kBAAkB,MAAM,wCAAwC,CAAC;AACxE,OAAO,mBAAmB,MAAM,yCAAyC,CAAC;AAE1E,OAAO,WAAW,MAAM,gCAAgC,CAAC;AAEzD,MAAM,OAAO,kBAAmB,SAAQ,WAAW;IACjD;QACE,KAAK,EAAE,CAAC;IACV,CAAC;IAGY,AAAN,KAAK,CAAC,yBAAyB,CAAC,MAAgB;QACrD,MAAM,IAAI,CAAC,iCAAiC,CAAC,MAAM,CAAC,CAAC;QAErD,0CAA0C;QAC1C,IAAI,WAAW,GAAsB,MAAM,iBAAiB,CAAC,MAAM,CAAC;YAClE,KAAK,EAAE;gBACL,MAAM,EAAE,MAAM;gBACd,qBAAqB,EAAE,IAAI;aAC5B;YACD,MAAM,EAAE;gBACN,SAAS,EAAE,IAAI;aAChB;YACD,KAAK,EAAE,SAAS;YAChB,IAAI,EAAE,CAAC;YACP,KAAK,EAAE;gBACL,MAAM,EAAE,IAAI;aACb;SACF,CAAC,CAAC;QAEH,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,WAAW,GAAG,EAAE,CAAC;QACnB,CAAC;QAED,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC7B,OAAO;QACT,CAAC;QAED,MAAM,UAAU,GAAoB,WAAW,CAAC,GAAG,CACjD,CAAC,UAAsB,EAAE,EAAE;YACzB,OAAO,UAAU,CAAC,SAAU,CAAC;QAC/B,CAAC,CACF,CAAC;QAEF,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;YACnC,MAAM,IAAI,CAAC,iCAAiC,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QAClE,CAAC;IACH,CAAC;IAGY,AAAN,KAAK,CAAC,iCAAiC,CAC5C,MAAgB;QAEhB,0CAA0C;QAC1C,IAAI,WAAW,GAAsB,MAAM,iBAAiB,CAAC,MAAM,CAAC;YAClE,KAAK,EAAE;gBACL,MAAM,EAAE,MAAM;gBACd,qBAAqB,EAAE,IAAI;aAC5B;YACD,MAAM,EAAE;gBACN,SAAS,EAAE,IAAI;aAChB;YACD,KAAK,EAAE,SAAS;YAChB,IAAI,EAAE,CAAC;YACP,KAAK,EAAE;gBACL,MAAM,EAAE,IAAI;aACb;SACF,CAAC,CAAC;QAEH,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,WAAW,GAAG,EAAE,CAAC;QACnB,CAAC;QAED,MAAM,UAAU,GAAoB,WAAW,CAAC,GAAG,CACjD,CAAC,UAAsB,EAAE,EAAE;YACzB,OAAO,UAAU,CAAC,SAAU,CAAC;QAC/B,CAAC,CACF,CAAC;QAEF,MAAM,iBAAiB,GAA+B;YACpD,UAAU;YACV,iBAAiB,EAAE;gBACjB,UAAU,CAAC,MAAM;gBACjB,UAAU,CAAC,IAAI;gBACf,UAAU,CAAC,WAAW;aACvB;YACD,KAAK,EAAE,4BAA4B;SACpC,CAAC;QAEF,MAAM,WAAW,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,QAAQ,EAAE,EAAE,iBAAiB,CAAC,CAAC;QAExE,OAAO,iBAAiB,CAAC;IAC3B,CAAC;IAGY,AAAN,KAAK,CAAC,6BAA6B,CACxC,MAAgB;QAEhB,MAAM,IAAI,GACR,MAAM,kBAAkB,CAAC,sCAAsC,CAAC,MAAM,CAAC,CAAC;QAE1E,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,MAAM,IAAI,CAAC,iCAAiC,CAAC,MAAM,CAAC,CAAC;QAC9D,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAGY,AAAN,KAAK,CAAC,iCAAiC,CAC5C,MAAgB,EAChB,SAAmB;QAEnB,0CAA0C;QAC1C,MAAM,WAAW,GAAsB,MAAM,iBAAiB,CAAC,MAAM,CAAC;YACpE,KAAK,EAAE;gBACL,MAAM,EAAE,MAAM;gBACd,SAAS,EAAE,SAAS;gBACpB,qBAAqB,EAAE,IAAI;aAC5B;YACD,MAAM,EAAE;gBACN,MAAM,EAAE,IAAI;aACb;YACD,KAAK,EAAE,SAAS;YAChB,IAAI,EAAE,CAAC;YACP,KAAK,EAAE;gBACL,MAAM,EAAE,IAAI;aACb;SACF,CAAC,CAAC;QAEH,MAAM,OAAO,GAAoB,WAAW,CAAC,GAAG,CAC9C,CAAC,UAAsB,EAAE,EAAE;YACzB,OAAO,UAAU,CAAC,MAAO,CAAC;QAC5B,CAAC,CACF,CAAC;QAEF,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,wBAAwB;QACxB,MAAM,eAAe,GACnB,MAAM,qBAAqB,CAAC,MAAM,CAAC;YACjC,KAAK,EAAE;gBACL,MAAM,EAAE,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC;gBAChC,SAAS,EAAE,SAAS;aACrB;YACD,MAAM,EAAE;gBACN,UAAU,EAAE,IAAI;gBAChB,MAAM,EAAE;oBACN,GAAG,EAAE,IAAI;iBACV;gBACD,iBAAiB,EAAE,IAAI;gBACvB,KAAK,EAAE,IAAI;aACZ;YACD,KAAK,EAAE,SAAS;YAChB,IAAI,EAAE,CAAC;YACP,KAAK,EAAE;gBACL,MAAM,EAAE,IAAI;aACb;SACF,CAAC,CAAC;QAEL,MAAM,eAAe,GAA0B,EAAE,CAAC;QAElD,KAAK,MAAM,cAAc,IAAI,eAAe,EAAE,CAAC;YAC7C,IAAI,CAAC,cAAc,CAAC,MAAM,EAAE,CAAC;gBAC3B,cAAc,CAAC,MAAM,GAAG,EAAE,CAAC;YAC7B,CAAC;YAED,eAAe,CAAC,IAAI,CAAC;gBACnB,UAAU,EAAE,cAAc,CAAC,UAAW;gBACtC,QAAQ,EAAE,cAAc,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAY,EAAE,EAAE;oBACnD,OAAO,KAAK,CAAC,EAAG,CAAC;gBACnB,CAAC,CAAC;gBACF,iBAAiB,EAAE,cAAc,CAAC,iBAAiB;gBACnD,KAAK,EAAE,cAAc,CAAC,KAAK;gBAC3B,KAAK,EAAE,gBAAgB;aACxB,CAAC,CAAC;QACL,CAAC;QAED,MAAM,iBAAiB,GACrB,kBAAkB,CAAC,oCAAoC,CAAC,SAAS,CAAC,CAAC;QAErE,iBAAiB,CAAC,WAAW;YAC3B,iBAAiB,CAAC,WAAW,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;QAExD;;;;;;;;WAQG;QACH,MAAM,UAAU,GACd,kBAAkB,CAAC,yBAAyB,CAAC,iBAAiB,CAAC,CAAC;QAElE,MAAM,WAAW,CAAC,OAAO,CACvB,mBAAmB,CAAC,iBAAiB,EACrC,kBAAkB,CAAC,6BAA6B,CAAC,MAAM,EAAE,SAAS,CAAC,EACnE,UAAU,CACX,CAAC;QAEF,OAAO,UAAU,CAAC;IACpB,CAAC;IAGY,AAAN,KAAK,CAAC,iDAAiD,CAAC,IAG9D;QACC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,IAAI,CAAC;QAEnC,OAAO;YACL,MAAM,EAAE,MAAM;YACd,0BAA0B,EACxB,CAAC,MAAM,IAAI,CAAC,6BAA6B,CAAC,MAAM,CAAC,CAAC,IAAI,SAAS;YACjE,0BAA0B,EAAE;gBAC1B,CAAC,SAAS,CAAC,QAAQ,EAAE,CAAC,EAAE,CAAC,MAAM,IAAI,CAAC,6BAA6B,CAC/D,MAAM,EACN,SAAS,CACV,CAAE;aACJ;YACD,QAAQ,EAAE,SAAS;SACpB,CAAC;IACJ,CAAC;IAGY,AAAN,KAAK,CAAC,6BAA6B,CACxC,MAAgB,EAChB,SAAmB;QAEnB,MAAM,IAAI,GACR,MAAM,kBAAkB,CAAC,sCAAsC,CAC7D,MAAM,EACN,SAAS,CACV,CAAC;QAEJ,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,MAAM,IAAI,CAAC,iCAAiC,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QACzE,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;CACF;AA1Oc;IADZ,WAAW,EAAE;;qCACiC,QAAQ;;mEAoCtD;AAGY;IADZ,WAAW,EAAE;;qCAEJ,QAAQ;;2EAyCjB;AAGY;IADZ,WAAW,EAAE;;qCAEJ,QAAQ;;uEAUjB;AAGY;IADZ,WAAW,EAAE;;qCAEJ,QAAQ;QACL,QAAQ;;2EA8FpB;AAGY;IADZ,WAAW,EAAE;;;;2FAmBb;AAGY;IADZ,WAAW,EAAE;;qCAEJ,QAAQ;QACL,QAAQ;;uEAapB;AAGH,eAAe,IAAI,kBAAkB,EAAE,CAAC"}