@openora/core 0.4.0

package/dist/pam/identity/service/identity.service.js

@@ -0,0 +1,481 @@
+import { ORPCError } from '@orpc/server';
+import { createAuth, assertRateLimit, } from '@openora/core/server';
+import { parseCookies } from 'better-auth/cookies';
+import { eq, sql } from 'drizzle-orm';
+import { user, session, account, verification, twoFactor } from '../schema/index.js';
+import { assertSupportedLanguage } from '../../shared/language.js';
+function nodeHeadersToHeaders(nodeHeaders) {
+    const headers = new Headers();
+    for (const [key, value] of Object.entries(nodeHeaders)) {
+        if (value === undefined)
+            continue;
+        headers.set(key, Array.isArray(value) ? value.join(', ') : value);
+    }
+    return headers;
+}
+export function createAccountLockedError(lockoutUntil) {
+    return new ORPCError('UNAUTHORIZED', {
+        message: 'Account is temporarily locked. Please try again later.',
+        data: {
+            code: 'ACCOUNT_LOCKED',
+            lockoutUntil: lockoutUntil.toISOString(),
+        },
+    });
+}
+function toIso(value) {
+    return value instanceof Date ? value.toISOString() : value;
+}
+function toUser(u) {
+    const base = {
+        id: u.id,
+        email: u.email,
+        name: u.name,
+        emailVerified: u.emailVerified,
+        theme: u.theme ?? 'system',
+        language: u.language ?? 'en',
+        createdAt: toIso(u.createdAt),
+        updatedAt: toIso(u.updatedAt),
+    };
+    return u.image !== undefined ? { ...base, image: u.image } : base;
+}
+function forwardCookies(authResponse, resHeaders) {
+    const cookies = authResponse.headers.getSetCookie?.() ?? [];
+    for (const cookie of cookies) {
+        resHeaders.append('set-cookie', cookie);
+    }
+}
+function clientIp(headers) {
+    return headers.get('x-forwarded-for')?.split(',')[0]?.trim() || headers.get('x-real-ip') || null;
+}
+// Key on the `.two_factor` cookie VALUE, never the raw Cookie header: an attacker can
+// otherwise churn the rate-limit key each retry by appending unrelated cookie pairs.
+function twoFactorPendingCookieValue(headers) {
+    const cookieHeader = headers.get('cookie');
+    if (!cookieHeader)
+        return undefined;
+    for (const [name, value] of parseCookies(cookieHeader)) {
+        if (name.endsWith('.two_factor'))
+            return value;
+    }
+    return undefined;
+}
+const SUCCESS = { success: true };
+// better-auth calls use `asResponse: true`, which returns an error *Response*
+// (4xx/5xx) rather than throwing. Surface those as ORPCErrors so oRPC maps them
+// to the right HTTP status instead of the handler silently returning success.
+// Only reads the body on failure, so a subsequent res.json() on success is safe.
+async function ensureOk(res) {
+    if (res.ok)
+        return;
+    let message = `Request failed (${res.status})`;
+    try {
+        const parsed = JSON.parse(await res.text());
+        if (parsed.message)
+            message = parsed.message;
+    }
+    catch {
+        // non-JSON body - keep the default message
+    }
+    throw new ORPCError(res.status === 401 ? 'UNAUTHORIZED' : 'BAD_REQUEST', { message });
+}
+const DEFAULT_MAX_LOGIN_ATTEMPTS = 5;
+const DEFAULT_LOCKOUT_DURATION_MS = 15 * 60 * 1000;
+const MINUTE_MS = 60 * 1000;
+// Coarse abuse throttles keyed by the caller identifier the context provides (email/
+// token/session), NOT IP. The lockout above is a per-account credential-failure
+// counter; these bound raw request volume on each brute-force surface. An overlay
+// rebinds RATE_LIMITER to change the backend, not the policy - the numbers are here.
+// Credential-guessing keys fail closed when the limiter backend is down: an
+// unthrottled login/2fa/reset window is worse than a transient 429. The volume
+// throttles (register/resend/etc.) keep the default fail-open.
+const LOGIN_RATE_LIMIT = { limit: 10, windowMs: 5 * MINUTE_MS, onUnavailable: 'deny' };
+const REGISTER_RATE_LIMIT = { limit: 5, windowMs: 15 * MINUTE_MS };
+const PASSWORD_RESET_REQUEST_RATE_LIMIT = { limit: 3, windowMs: 15 * MINUTE_MS };
+const PASSWORD_RESET_RATE_LIMIT = {
+    limit: 5,
+    windowMs: 15 * MINUTE_MS,
+    onUnavailable: 'deny',
+};
+const VERIFY_2FA_RATE_LIMIT = { limit: 5, windowMs: 5 * MINUTE_MS, onUnavailable: 'deny' };
+const EMAIL_VERIFICATION_RATE_LIMIT = { limit: 3, windowMs: 15 * MINUTE_MS };
+const VERIFY_EMAIL_RATE_LIMIT = { limit: 5, windowMs: 15 * MINUTE_MS };
+const CHANGE_PASSWORD_RATE_LIMIT = { limit: 5, windowMs: 15 * MINUTE_MS };
+const TWO_FACTOR_PASSWORD_RATE_LIMIT = { limit: 5, windowMs: 5 * MINUTE_MS };
+// Mirrors better-auth session.expiresIn (server/auth/auth.ts); used only as a fallback
+// when the sign-in response omits an explicit session expiry.
+const SESSION_TTL_MS = 30 * 24 * 60 * 60 * 1000;
+function computeLockoutState({ attempts, maxAttempts, durationMs, nowMs, }) {
+    const isLocking = attempts >= maxAttempts;
+    return { isLocking, lockoutUntil: isLocking ? new Date(nowMs + durationMs) : null };
+}
+// A finite rgBlockedUntil in the past = a lapsed cooling-off; a null one = indefinite
+// (self-exclusion / permanent). Blocked only while set and not elapsed.
+function isRgBlocked(u) {
+    return u.rgBlocked && (u.rgBlockedUntil === null || u.rgBlockedUntil > new Date());
+}
+export class IdentityService {
+    auth;
+    drizzle;
+    events;
+    email;
+    options;
+    limiter;
+    platformConfig;
+    constructor({ drizzle, events, email, options, limiter, platformConfig }) {
+        this.drizzle = drizzle;
+        this.events = events;
+        this.email = email;
+        this.options = options;
+        this.limiter = limiter;
+        this.platformConfig = platformConfig;
+        this.auth = createAuth({
+            db: drizzle.db,
+            schema: { user, session, account, verification, twoFactor },
+            ...(email ? { sendEmail: (args) => email.send(args) } : {}),
+        });
+    }
+    get api() {
+        // Library boundary: the admin/organization plugin endpoints aren't on better-auth's
+        // base `api` type. Sanctioned cast, see conventions.
+        return this.auth.api;
+    }
+    async currentUserId(headers) {
+        const session = await this.auth.api.getSession({ headers });
+        return session?.user?.id ?? null;
+    }
+    async register(input, reqHeaders, resHeaders) {
+        await assertRateLimit(this.limiter, `register:${input.email.toLowerCase()}`, REGISTER_RATE_LIMIT);
+        const headers = nodeHeadersToHeaders(reqHeaders);
+        const authResponse = await this.auth.api.signUpEmail({
+            body: { email: input.email, password: input.password, name: input.name },
+            headers,
+            asResponse: true,
+        });
+        forwardCookies(authResponse, resHeaders);
+        const body = (await authResponse.json());
+        this.events.emit('identity.user.registered', { userId: body.user.id });
+        return { user: toUser(body.user) };
+    }
+    async login(input, reqHeaders, resHeaders) {
+        const headers = nodeHeadersToHeaders(reqHeaders);
+        const ip = clientIp(headers);
+        const userAgent = headers.get('user-agent') || null;
+        // better-auth lowercases emails on write, so the lockout lookup must match on the same form.
+        const email = input.email.toLowerCase();
+        await assertRateLimit(this.limiter, `login:${email}`, LOGIN_RATE_LIMIT);
+        const configLockoutEnabled = this.options?.lockout?.enabled ?? true;
+        // Read once for the lockout budget, the admin-bypass check, and the RG login gate
+        // (indexed email lookup). Read unconditionally - the RG gate runs even when lockout
+        // is disabled.
+        const [existingUserRow] = await this.drizzle.db
+            .select({
+            id: user.id,
+            failedLoginAttempts: user.failedLoginAttempts,
+            lockoutUntil: user.lockoutUntil,
+            role: user.role,
+            rgBlocked: user.rgBlocked,
+            rgBlockedUntil: user.rgBlockedUntil,
+        })
+            .from(user)
+            .where(eq(user.email, email))
+            .limit(1);
+        let existingUser = existingUserRow;
+        const isAdmin = existingUser?.role === 'admin';
+        const bypassForAdmins = this.options?.lockout?.bypassForAdmins ?? false;
+        const lockoutEnabled = configLockoutEnabled && !(isAdmin && bypassForAdmins);
+        if (lockoutEnabled && existingUser?.lockoutUntil) {
+            if (new Date(existingUser.lockoutUntil) > new Date()) {
+                throw createAccountLockedError(new Date(existingUser.lockoutUntil));
+            }
+            // Lock window elapsed: clear it so the next failure starts from a fresh budget
+            // instead of one more wrong password immediately re-locking the account.
+            await this.clearLockout(existingUser.id);
+            existingUser = { ...existingUser, failedLoginAttempts: 0, lockoutUntil: null };
+        }
+        try {
+            const authResponse = await this.auth.api.signInEmail({
+                body: { email, password: input.password, rememberMe: input.rememberMe },
+                headers,
+                asResponse: true,
+            });
+            await ensureOk(authResponse);
+            // RG login block, applied only AFTER credentials verify so a pre-auth probe can't
+            // distinguish a restricted account from a wrong password. Kill the session
+            // better-auth just issued and never forward its cookie. Cooling-off auto-expires
+            // here once rgBlockedUntil elapses (no unblock job).
+            if (existingUser && isRgBlocked(existingUser)) {
+                await this.drizzle.db
+                    .update(session)
+                    .set({ expiresAt: new Date() })
+                    .where(eq(session.userId, existingUser.id));
+                this.events.emit('rg.exclusion.login_blocked', { userId: existingUser.id, ip, userAgent });
+                throw new ORPCError('FORBIDDEN', {
+                    message: 'Account access is currently restricted (responsible gambling).',
+                });
+            }
+            forwardCookies(authResponse, resHeaders);
+            const body = (await authResponse.json());
+            if (body.twoFactorRedirect || !body.user || !body.token) {
+                return { twoFactorRedirect: true };
+            }
+            if (lockoutEnabled && existingUser) {
+                await this.clearLockout(existingUser.id);
+            }
+            this.events.emit('identity.user.login', { userId: body.user.id, ip, userAgent });
+            const expiresAt = body.session?.expiresAt
+                ? toIso(body.session.expiresAt)
+                : new Date(Date.now() + SESSION_TTL_MS).toISOString();
+            return {
+                user: toUser(body.user),
+                session: { token: body.token, expiresAt },
+            };
+        }
+        catch (error) {
+            // An RG block is not a credential failure - surface it as-is, without touching the
+            // lockout budget or emitting login.failed (the RG event was already emitted).
+            if (error instanceof ORPCError && error.code === 'FORBIDDEN')
+                throw error;
+            // Only a genuine credential rejection counts toward lockout - a transient DB/network
+            // error must never lock the account out.
+            const isCredentialFailure = error instanceof ORPCError && error.code === 'UNAUTHORIZED';
+            if (lockoutEnabled && existingUser && isCredentialFailure) {
+                const maxAttempts = this.options?.lockout?.maxAttempts ?? DEFAULT_MAX_LOGIN_ATTEMPTS;
+                const durationMs = this.options?.lockout?.durationMs ?? DEFAULT_LOCKOUT_DURATION_MS;
+                // Atomic increment: concurrent failures can't each read a stale count and slip past
+                // the threshold (the read-modify-write this replaces was bypassable under load).
+                const [row] = await this.drizzle.db
+                    .update(user)
+                    .set({ failedLoginAttempts: sql `${user.failedLoginAttempts} + 1` })
+                    .where(eq(user.id, existingUser.id))
+                    .returning({ failedLoginAttempts: user.failedLoginAttempts });
+                const newAttempts = row?.failedLoginAttempts ?? existingUser.failedLoginAttempts + 1;
+                const { isLocking, lockoutUntil } = computeLockoutState({
+                    attempts: newAttempts,
+                    maxAttempts,
+                    durationMs,
+                    nowMs: Date.now(),
+                });
+                if (isLocking && lockoutUntil) {
+                    await this.drizzle.db
+                        .update(user)
+                        .set({ lockoutUntil })
+                        .where(eq(user.id, existingUser.id));
+                    this.events.emit('identity.user.lockout.triggered', {
+                        userId: existingUser.id,
+                        email,
+                        lockoutUntil: lockoutUntil.toISOString(),
+                        ip,
+                        userAgent,
+                    });
+                    throw createAccountLockedError(lockoutUntil);
+                }
+            }
+            const reason = isCredentialFailure ? 'invalid_credentials' : 'error';
+            this.events.emit('identity.user.login.failed', { email, reason, ip, userAgent });
+            throw error;
+        }
+    }
+    clearLockout(userId) {
+        return this.drizzle.db
+            .update(user)
+            .set({ failedLoginAttempts: 0, lockoutUntil: null })
+            .where(eq(user.id, userId));
+    }
+    async unlockUser(userId, actorId) {
+        const [existingUser] = await this.drizzle.db
+            .select({
+            id: user.id,
+            email: user.email,
+            failedLoginAttempts: user.failedLoginAttempts,
+            lockoutUntil: user.lockoutUntil,
+        })
+            .from(user)
+            .where(eq(user.id, userId))
+            .limit(1);
+        if (!existingUser) {
+            throw new ORPCError('NOT_FOUND', { message: 'User not found' });
+        }
+        await this.clearLockout(userId);
+        this.events.emit('identity.user.unlocked', {
+            userId,
+            email: existingUser.email,
+            actorId,
+            previousFailedAttempts: existingUser.failedLoginAttempts,
+            previousLockoutUntil: existingUser.lockoutUntil
+                ? existingUser.lockoutUntil.toISOString()
+                : null,
+        });
+        return SUCCESS;
+    }
+    async logout(reqHeaders, resHeaders) {
+        const headers = nodeHeadersToHeaders(reqHeaders);
+        // Resolve the user BEFORE signOut so the audit log can attribute the logout.
+        const session = await this.auth.api.getSession({ headers });
+        const userId = session?.user?.id;
+        const authResponse = await this.auth.api.signOut({ headers, asResponse: true });
+        forwardCookies(authResponse, resHeaders);
+        if (userId)
+            this.events.emit('identity.user.logout', { userId });
+        return SUCCESS;
+    }
+    async me(reqHeaders) {
+        const headers = nodeHeadersToHeaders(reqHeaders);
+        const session = await this.auth.api.getSession({ headers });
+        if (!session?.user)
+            return null;
+        return toUser(session.user);
+    }
+    async enableTwoFactor(input, reqHeaders, resHeaders) {
+        const headers = nodeHeadersToHeaders(reqHeaders);
+        const userId = await this.currentUserId(headers);
+        await assertRateLimit(this.limiter, `enable2fa:${userId ?? 'anonymous'}`, TWO_FACTOR_PASSWORD_RATE_LIMIT);
+        const res = await this.api.enableTwoFactor({
+            body: { password: input.password },
+            headers,
+            asResponse: true,
+        });
+        await ensureOk(res);
+        forwardCookies(res, resHeaders);
+        const body = (await res.json());
+        return { totpUri: body.totpURI, backupCodes: body.backupCodes };
+    }
+    async verifyTwoFactor(input, reqHeaders, resHeaders) {
+        const headers = nodeHeadersToHeaders(reqHeaders);
+        const twoFactorKey = (await this.currentUserId(headers)) ?? twoFactorPendingCookieValue(headers) ?? 'anonymous';
+        await assertRateLimit(this.limiter, `verify2fa:${twoFactorKey}`, VERIFY_2FA_RATE_LIMIT);
+        const res = await this.api.verifyTOTP({
+            body: { code: input.code },
+            headers,
+            asResponse: true,
+        });
+        await ensureOk(res);
+        forwardCookies(res, resHeaders);
+        const userId = await this.currentUserId(headers);
+        if (userId)
+            this.events.emit('identity.2fa.enabled', { userId });
+        return SUCCESS;
+    }
+    async disableTwoFactor(input, reqHeaders, resHeaders) {
+        const headers = nodeHeadersToHeaders(reqHeaders);
+        const userId = await this.currentUserId(headers);
+        await assertRateLimit(this.limiter, `disable2fa:${userId ?? 'anonymous'}`, TWO_FACTOR_PASSWORD_RATE_LIMIT);
+        const res = await this.api.disableTwoFactor({
+            body: { password: input.password },
+            headers,
+            asResponse: true,
+        });
+        await ensureOk(res);
+        forwardCookies(res, resHeaders);
+        if (userId)
+            this.events.emit('identity.2fa.disabled', { userId });
+        return SUCCESS;
+    }
+    async requestPasswordReset(input) {
+        await assertRateLimit(this.limiter, `pwreset-req:${input.email.toLowerCase()}`, PASSWORD_RESET_REQUEST_RATE_LIMIT);
+        // Always returns success - never reveal whether the email exists. The reset
+        // email (if any) is delivered through the sendEmail hook -> notifications.
+        // Any underlying error is swallowed for the same anti-enumeration reason.
+        try {
+            await this.api.requestPasswordReset({
+                body: { email: input.email, redirectTo: '/reset-password' },
+                headers: new Headers(),
+                asResponse: true,
+            });
+        }
+        catch {
+            // intentionally ignored
+        }
+        return SUCCESS;
+    }
+    async resetPassword(input) {
+        // Key on the token - the only identifier the input carries - to bound retries
+        // against a single reset token.
+        await assertRateLimit(this.limiter, `pwreset:${input.token}`, PASSWORD_RESET_RATE_LIMIT);
+        const res = await this.api.resetPassword({
+            body: { newPassword: input.newPassword, token: input.token },
+            headers: new Headers(),
+            asResponse: true,
+        });
+        await ensureOk(res);
+        const body = (await res.json().catch(() => ({})));
+        if (body.user?.id) {
+            this.events.emit('identity.password.reset', { userId: body.user.id });
+            // Password reset clears any lockout - the user has proven identity via email/phone.
+            await this.clearLockout(body.user.id);
+        }
+        return SUCCESS;
+    }
+    async changePassword(input, reqHeaders, resHeaders) {
+        const headers = nodeHeadersToHeaders(reqHeaders);
+        const userId = await this.currentUserId(headers);
+        await assertRateLimit(this.limiter, `change-password:${userId ?? 'anonymous'}`, CHANGE_PASSWORD_RATE_LIMIT);
+        const res = await this.api.changePassword({
+            body: { currentPassword: input.currentPassword, newPassword: input.newPassword },
+            headers,
+            asResponse: true,
+        });
+        await ensureOk(res);
+        forwardCookies(res, resHeaders);
+        return SUCCESS;
+    }
+    async sendEmailVerification(reqHeaders) {
+        const headers = nodeHeadersToHeaders(reqHeaders);
+        const session = await this.auth.api.getSession({ headers });
+        const email = session?.user?.email;
+        if (email) {
+            await assertRateLimit(this.limiter, `email-verify:${email.toLowerCase()}`, EMAIL_VERIFICATION_RATE_LIMIT);
+            await this.api.sendVerificationEmail({ body: { email }, headers, asResponse: true });
+        }
+        return SUCCESS;
+    }
+    async verifyEmail(input, reqHeaders) {
+        const headers = nodeHeadersToHeaders(reqHeaders);
+        const userId = await this.currentUserId(headers);
+        await assertRateLimit(this.limiter, `verify-email:${userId ?? 'anonymous'}`, VERIFY_EMAIL_RATE_LIMIT);
+        const res = await this.api.verifyEmail({
+            query: { token: input.token },
+            headers,
+            asResponse: true,
+        });
+        await ensureOk(res);
+        if (userId)
+            this.events.emit('identity.email.verified', { userId });
+        return SUCCESS;
+    }
+    async changeEmail(input, reqHeaders, resHeaders) {
+        const headers = nodeHeadersToHeaders(reqHeaders);
+        const res = await this.api.changeEmail({
+            body: { newEmail: input.newEmail },
+            headers,
+            asResponse: true,
+        });
+        await ensureOk(res);
+        forwardCookies(res, resHeaders);
+        return SUCCESS;
+    }
+    async updateProfile(input, reqHeaders, resHeaders) {
+        if (input.language !== undefined)
+            assertSupportedLanguage(input.language, this.platformConfig);
+        const headers = nodeHeadersToHeaders(reqHeaders);
+        // better-auth's field parser and drizzle's mapUpdateSet both drop `undefined`
+        // values before the SQL SET clause, so omitted fields are safely no-ops here.
+        const { name, image, theme, language } = input;
+        const res = await this.api.updateUser({
+            body: { name, image, theme, language },
+            headers,
+            asResponse: true,
+        });
+        await ensureOk(res);
+        forwardCookies(res, resHeaders);
+        // updateUser returns { status } only - re-read from session to get the full user.
+        const session = await this.auth.api.getSession({ headers });
+        const current = session?.user;
+        if (current)
+            this.events.emit('identity.profile.updated', { userId: current.id });
+        if (!current) {
+            throw new Error('Profile update succeeded but session could not be re-read');
+        }
+        return { user: toUser(current) };
+    }
+}
+//# sourceMappingURL=identity.service.js.map

package/dist/pam/identity/service/identity.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity.service.js","sourceRoot":"","sources":["../../../../src/pam/identity/service/identity.service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EACL,UAAU,EAIV,eAAe,GAChB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAoBrF,OAAO,EAAE,uBAAuB,EAAE,MAAM,0BAA0B,CAAC;AAEnE,SAAS,oBAAoB,CAAC,WAAwB;IACpD,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;IAC9B,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;QACvD,IAAI,KAAK,KAAK,SAAS;YAAE,SAAS;QAClC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IACpE,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,YAAkB;IACzD,OAAO,IAAI,SAAS,CAAC,cAAc,EAAE;QACnC,OAAO,EAAE,wDAAwD;QACjE,IAAI,EAAE;YACJ,IAAI,EAAE,gBAAgB;YACtB,YAAY,EAAE,YAAY,CAAC,WAAW,EAAE;SACzC;KACF,CAAC,CAAC;AACL,CAAC;AAWD,SAAS,KAAK,CAAC,KAAoB;IACjC,OAAO,KAAK,YAAY,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;AAC7D,CAAC;AAED,SAAS,MAAM,CAAC,CAAiB;IAC/B,MAAM,IAAI,GAAG;QACX,EAAE,EAAE,CAAC,CAAC,EAAE;QACR,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,aAAa,EAAE,CAAC,CAAC,aAAa;QAC9B,KAAK,EAAE,CAAC,CAAC,KAAK,IAAI,QAAQ;QAC1B,QAAQ,EAAE,CAAC,CAAC,QAAQ,IAAI,IAAI;QAC5B,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;QAC7B,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;KAC9B,CAAC;IACF,OAAO,CAAC,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACpE,CAAC;AAED,SAAS,cAAc,CAAC,YAAiC,EAAE,UAAmB;IAC5E,MAAM,OAAO,GAAG,YAAY,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,CAAC;IAC5D,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,UAAU,CAAC,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;IAC1C,CAAC;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,OAAgB;IAChC,OAAO,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,IAAI,CAAC;AACnG,CAAC;AAED,sFAAsF;AACtF,qFAAqF;AACrF,SAAS,2BAA2B,CAAC,OAAgB;IACnD,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC3C,IAAI,CAAC,YAAY;QAAE,OAAO,SAAS,CAAC;IACpC,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,YAAY,CAAC,YAAY,CAAC,EAAE,CAAC;QACvD,IAAI,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC;YAAE,OAAO,KAAK,CAAC;IACjD,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AA0BD,MAAM,OAAO,GAAG,EAAE,OAAO,EAAE,IAAa,EAAE,CAAC;AAE3C,8EAA8E;AAC9E,gFAAgF;AAChF,8EAA8E;AAC9E,iFAAiF;AACjF,KAAK,UAAU,QAAQ,CAAC,GAAwB;IAC9C,IAAI,GAAG,CAAC,EAAE;QAAE,OAAO;IACnB,IAAI,OAAO,GAAG,mBAAmB,GAAG,CAAC,MAAM,GAAG,CAAC;IAC/C,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAyB,CAAC;QACpE,IAAI,MAAM,CAAC,OAAO;YAAE,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;IAC/C,CAAC;IAAC,MAAM,CAAC;QACP,2CAA2C;IAC7C,CAAC;IACD,MAAM,IAAI,SAAS,CAAC,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,aAAa,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;AACxF,CAAC;AAED,MAAM,0BAA0B,GAAG,CAAC,CAAC;AACrC,MAAM,2BAA2B,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAEnD,MAAM,SAAS,GAAG,EAAE,GAAG,IAAI,CAAC;AAC5B,qFAAqF;AACrF,gFAAgF;AAChF,kFAAkF;AAClF,qFAAqF;AACrF,4EAA4E;AAC5E,+EAA+E;AAC/E,+DAA+D;AAC/D,MAAM,gBAAgB,GAAG,EAAE,KAAK,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC,GAAG,SAAS,EAAE,aAAa,EAAE,MAAM,EAAW,CAAC;AAChG,MAAM,mBAAmB,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,GAAG,SAAS,EAAE,CAAC;AACnE,MAAM,iCAAiC,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,GAAG,SAAS,EAAE,CAAC;AACjF,MAAM,yBAAyB,GAAG;IAChC,KAAK,EAAE,CAAC;IACR,QAAQ,EAAE,EAAE,GAAG,SAAS;IACxB,aAAa,EAAE,MAAM;CACb,CAAC;AACX,MAAM,qBAAqB,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,GAAG,SAAS,EAAE,aAAa,EAAE,MAAM,EAAW,CAAC;AACpG,MAAM,6BAA6B,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,GAAG,SAAS,EAAE,CAAC;AAC7E,MAAM,uBAAuB,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,GAAG,SAAS,EAAE,CAAC;AACvE,MAAM,0BAA0B,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,GAAG,SAAS,EAAE,CAAC;AAC1E,MAAM,8BAA8B,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,GAAG,SAAS,EAAE,CAAC;AAC7E,uFAAuF;AACvF,8DAA8D;AAC9D,MAAM,cAAc,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAEhD,SAAS,mBAAmB,CAAC,EAC3B,QAAQ,EACR,WAAW,EACX,UAAU,EACV,KAAK,GAMN;IACC,MAAM,SAAS,GAAG,QAAQ,IAAI,WAAW,CAAC;IAC1C,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,SAAS,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;AACtF,CAAC;AAED,sFAAsF;AACtF,wEAAwE;AACxE,SAAS,WAAW,CAAC,CAAsD;IACzE,OAAO,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,CAAC,cAAc,KAAK,IAAI,IAAI,CAAC,CAAC,cAAc,GAAG,IAAI,IAAI,EAAE,CAAC,CAAC;AACrF,CAAC;AAWD,MAAM,OAAO,eAAe;IACT,IAAI,CAAgC;IACpC,OAAO,CAAiB;IACxB,MAAM,CAAW;IACjB,KAAK,CAAiB;IACtB,OAAO,CAA0B;IACjC,OAAO,CAAsB;IAC7B,cAAc,CAAkB;IAEjD,YAAY,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,cAAc,EAAuB;QAC3F,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QACnB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,cAAc,GAAG,cAAc,CAAC;QACrC,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC;YACrB,EAAE,EAAE,OAAO,CAAC,EAAE;YACd,MAAM,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE;YAC3D,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC5D,CAAC,CAAC;IACL,CAAC;IAED,IAAY,GAAG;QACb,oFAAoF;QACpF,qDAAqD;QACrD,OAAO,IAAI,CAAC,IAAI,CAAC,GAAiC,CAAC;IACrD,CAAC;IAEO,KAAK,CAAC,aAAa,CAAC,OAAgB;QAC1C,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;QAC5D,OAAO,OAAO,EAAE,IAAI,EAAE,EAAE,IAAI,IAAI,CAAC;IACnC,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,KAAoB,EAAE,UAAuB,EAAE,UAAmB;QAC/E,MAAM,eAAe,CACnB,IAAI,CAAC,OAAO,EACZ,YAAY,KAAK,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,EACvC,mBAAmB,CACpB,CAAC;QACF,MAAM,OAAO,GAAG,oBAAoB,CAAC,UAAU,CAAC,CAAC;QACjD,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC;YACnD,IAAI,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE;YACxE,OAAO;YACP,UAAU,EAAE,IAAI;SACjB,CAAC,CAAC;QACH,cAAc,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC;QACzC,MAAM,IAAI,GAAG,CAAC,MAAM,YAAY,CAAC,IAAI,EAAE,CAA6B,CAAC;QAErE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,0BAA0B,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;QACvE,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;IACrC,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,KAAiB,EAAE,UAAuB,EAAE,UAAmB;QACzE,MAAM,OAAO,GAAG,oBAAoB,CAAC,UAAU,CAAC,CAAC;QACjD,MAAM,EAAE,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC7B,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,IAAI,CAAC;QACpD,6FAA6F;QAC7F,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;QAExC,MAAM,eAAe,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,KAAK,EAAE,EAAE,gBAAgB,CAAC,CAAC;QAExE,MAAM,oBAAoB,GAAG,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,IAAI,IAAI,CAAC;QACpE,kFAAkF;QAClF,oFAAoF;QACpF,eAAe;QACf,MAAM,CAAC,eAAe,CAAC,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE;aAC5C,MAAM,CAAC;YACN,EAAE,EAAE,IAAI,CAAC,EAAE;YACX,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;YAC7C,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,cAAc,EAAE,IAAI,CAAC,cAAc;SACpC,CAAC;aACD,IAAI,CAAC,IAAI,CAAC;aACV,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;aAC5B,KAAK,CAAC,CAAC,CAAC,CAAC;QACZ,IAAI,YAAY,GAKA,eAAe,CAAC;QAEhC,MAAM,OAAO,GAAG,YAAY,EAAE,IAAI,KAAK,OAAO,CAAC;QAC/C,MAAM,eAAe,GAAG,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,eAAe,IAAI,KAAK,CAAC;QACxE,MAAM,cAAc,GAAG,oBAAoB,IAAI,CAAC,CAAC,OAAO,IAAI,eAAe,CAAC,CAAC;QAE7E,IAAI,cAAc,IAAI,YAAY,EAAE,YAAY,EAAE,CAAC;YACjD,IAAI,IAAI,IAAI,CAAC,YAAY,CAAC,YAAY,CAAC,GAAG,IAAI,IAAI,EAAE,EAAE,CAAC;gBACrD,MAAM,wBAAwB,CAAC,IAAI,IAAI,CAAC,YAAY,CAAC,YAAY,CAAC,CAAC,CAAC;YACtE,CAAC;YACD,+EAA+E;YAC/E,yEAAyE;YACzE,MAAM,IAAI,CAAC,YAAY,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;YACzC,YAAY,GAAG,EAAE,GAAG,YAAY,EAAE,mBAAmB,EAAE,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;QACjF,CAAC;QAED,IAAI,CAAC;YACH,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC;gBACnD,IAAI,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE;gBACvE,OAAO;gBACP,UAAU,EAAE,IAAI;aACjB,CAAC,CAAC;YACH,MAAM,QAAQ,CAAC,YAAY,CAAC,CAAC;YAE7B,kFAAkF;YAClF,2EAA2E;YAC3E,iFAAiF;YACjF,qDAAqD;YACrD,IAAI,YAAY,IAAI,WAAW,CAAC,YAAY,CAAC,EAAE,CAAC;gBAC9C,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE;qBAClB,MAAM,CAAC,OAAO,CAAC;qBACf,GAAG,CAAC,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC;qBAC9B,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,YAAY,CAAC,EAAE,CAAC,CAAC,CAAC;gBAC9C,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,4BAA4B,EAAE,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC;gBAC3F,MAAM,IAAI,SAAS,CAAC,WAAW,EAAE;oBAC/B,OAAO,EAAE,gEAAgE;iBAC1E,CAAC,CAAC;YACL,CAAC;YAED,cAAc,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC;YACzC,MAAM,IAAI,GAAG,CAAC,MAAM,YAAY,CAAC,IAAI,EAAE,CAKtC,CAAC;YAEF,IAAI,IAAI,CAAC,iBAAiB,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;gBACxD,OAAO,EAAE,iBAAiB,EAAE,IAAI,EAAE,CAAC;YACrC,CAAC;YAED,IAAI,cAAc,IAAI,YAAY,EAAE,CAAC;gBACnC,MAAM,IAAI,CAAC,YAAY,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;YAC3C,CAAC;YAED,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,qBAAqB,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC;YACjF,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,EAAE,SAAS;gBACvC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC;gBAC/B,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,cAAc,CAAC,CAAC,WAAW,EAAE,CAAC;YACxD,OAAO;gBACL,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC;gBACvB,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,SAAS,EAAE;aAC1C,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,mFAAmF;YACnF,8EAA8E;YAC9E,IAAI,KAAK,YAAY,SAAS,IAAI,KAAK,CAAC,IAAI,KAAK,WAAW;gBAAE,MAAM,KAAK,CAAC;YAC1E,qFAAqF;YACrF,yCAAyC;YACzC,MAAM,mBAAmB,GAAG,KAAK,YAAY,SAAS,IAAI,KAAK,CAAC,IAAI,KAAK,cAAc,CAAC;YAExF,IAAI,cAAc,IAAI,YAAY,IAAI,mBAAmB,EAAE,CAAC;gBAC1D,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,WAAW,IAAI,0BAA0B,CAAC;gBACrF,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,UAAU,IAAI,2BAA2B,CAAC;gBACpF,oFAAoF;gBACpF,iFAAiF;gBACjF,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE;qBAChC,MAAM,CAAC,IAAI,CAAC;qBACZ,GAAG,CAAC,EAAE,mBAAmB,EAAE,GAAG,CAAA,GAAG,IAAI,CAAC,mBAAmB,MAAM,EAAE,CAAC;qBAClE,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,YAAY,CAAC,EAAE,CAAC,CAAC;qBACnC,SAAS,CAAC,EAAE,mBAAmB,EAAE,IAAI,CAAC,mBAAmB,EAAE,CAAC,CAAC;gBAChE,MAAM,WAAW,GAAG,GAAG,EAAE,mBAAmB,IAAI,YAAY,CAAC,mBAAmB,GAAG,CAAC,CAAC;gBACrF,MAAM,EAAE,SAAS,EAAE,YAAY,EAAE,GAAG,mBAAmB,CAAC;oBACtD,QAAQ,EAAE,WAAW;oBACrB,WAAW;oBACX,UAAU;oBACV,KAAK,EAAE,IAAI,CAAC,GAAG,EAAE;iBAClB,CAAC,CAAC;gBAEH,IAAI,SAAS,IAAI,YAAY,EAAE,CAAC;oBAC9B,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE;yBAClB,MAAM,CAAC,IAAI,CAAC;yBACZ,GAAG,CAAC,EAAE,YAAY,EAAE,CAAC;yBACrB,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,YAAY,CAAC,EAAE,CAAC,CAAC,CAAC;oBAEvC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,iCAAiC,EAAE;wBAClD,MAAM,EAAE,YAAY,CAAC,EAAE;wBACvB,KAAK;wBACL,YAAY,EAAE,YAAY,CAAC,WAAW,EAAE;wBACxC,EAAE;wBACF,SAAS;qBACV,CAAC,CAAC;oBAEH,MAAM,wBAAwB,CAAC,YAAY,CAAC,CAAC;gBAC/C,CAAC;YACH,CAAC;YAED,MAAM,MAAM,GAAG,mBAAmB,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,OAAO,CAAC;YACrE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,4BAA4B,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC;YACjF,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAEO,YAAY,CAAC,MAAc;QACjC,OAAO,IAAI,CAAC,OAAO,CAAC,EAAE;aACnB,MAAM,CAAC,IAAI,CAAC;aACZ,GAAG,CAAC,EAAE,mBAAmB,EAAE,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;aACnD,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC;IAChC,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,MAAc,EAAE,OAAe;QAC9C,MAAM,CAAC,YAAY,CAAC,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE;aACzC,MAAM,CAAC;YACN,EAAE,EAAE,IAAI,CAAC,EAAE;YACX,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;YAC7C,YAAY,EAAE,IAAI,CAAC,YAAY;SAChC,CAAC;aACD,IAAI,CAAC,IAAI,CAAC;aACV,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;aAC1B,KAAK,CAAC,CAAC,CAAC,CAAC;QAEZ,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,MAAM,IAAI,SAAS,CAAC,WAAW,EAAE,EAAE,OAAO,EAAE,gBAAgB,EAAE,CAAC,CAAC;QAClE,CAAC;QAED,MAAM,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;QAEhC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,wBAAwB,EAAE;YACzC,MAAM;YACN,KAAK,EAAE,YAAY,CAAC,KAAK;YACzB,OAAO;YACP,sBAAsB,EAAE,YAAY,CAAC,mBAAmB;YACxD,oBAAoB,EAAE,YAAY,CAAC,YAAY;gBAC7C,CAAC,CAAC,YAAY,CAAC,YAAY,CAAC,WAAW,EAAE;gBACzC,CAAC,CAAC,IAAI;SACT,CAAC,CAAC;QAEH,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,UAAuB,EAAE,UAAmB;QACvD,MAAM,OAAO,GAAG,oBAAoB,CAAC,UAAU,CAAC,CAAC;QACjD,6EAA6E;QAC7E,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;QAC5D,MAAM,MAAM,GAAI,OAAO,EAAE,IAAmC,EAAE,EAAE,CAAC;QACjE,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;QAChF,cAAc,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC;QACzC,IAAI,MAAM;YAAE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,sBAAsB,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QACjE,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,EAAE,CAAC,UAAuB;QAC9B,MAAM,OAAO,GAAG,oBAAoB,CAAC,UAAU,CAAC,CAAC;QACjD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;QAC5D,IAAI,CAAC,OAAO,EAAE,IAAI;YAAE,OAAO,IAAI,CAAC;QAChC,OAAO,MAAM,CAAC,OAAO,CAAC,IAAsB,CAAC,CAAC;IAChD,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,KAAqB,EAAE,UAAuB,EAAE,UAAmB;QACvF,MAAM,OAAO,GAAG,oBAAoB,CAAC,UAAU,CAAC,CAAC;QACjD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;QACjD,MAAM,eAAe,CACnB,IAAI,CAAC,OAAO,EACZ,aAAa,MAAM,IAAI,WAAW,EAAE,EACpC,8BAA8B,CAC/B,CAAC;QACF,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,eAAe,CAAC;YACzC,IAAI,EAAE,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE;YAClC,OAAO;YACP,UAAU,EAAE,IAAI;SACjB,CAAC,CAAC;QACH,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC;QACpB,cAAc,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;QAChC,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA+C,CAAC;QAC9E,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC;IAClE,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,KAAqB,EAAE,UAAuB,EAAE,UAAmB;QACvF,MAAM,OAAO,GAAG,oBAAoB,CAAC,UAAU,CAAC,CAAC;QACjD,MAAM,YAAY,GAChB,CAAC,MAAM,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,IAAI,2BAA2B,CAAC,OAAO,CAAC,IAAI,WAAW,CAAC;QAC7F,MAAM,eAAe,CAAC,IAAI,CAAC,OAAO,EAAE,aAAa,YAAY,EAAE,EAAE,qBAAqB,CAAC,CAAC;QACxF,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC;YACpC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE;YAC1B,OAAO;YACP,UAAU,EAAE,IAAI;SACjB,CAAC,CAAC;QACH,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC;QACpB,cAAc,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;QAChC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;QACjD,IAAI,MAAM;YAAE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,sBAAsB,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QACjE,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,KAAsB,EAAE,UAAuB,EAAE,UAAmB;QACzF,MAAM,OAAO,GAAG,oBAAoB,CAAC,UAAU,CAAC,CAAC;QACjD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;QACjD,MAAM,eAAe,CACnB,IAAI,CAAC,OAAO,EACZ,cAAc,MAAM,IAAI,WAAW,EAAE,EACrC,8BAA8B,CAC/B,CAAC;QACF,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,gBAAgB,CAAC;YAC1C,IAAI,EAAE,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE;YAClC,OAAO;YACP,UAAU,EAAE,IAAI;SACjB,CAAC,CAAC;QACH,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC;QACpB,cAAc,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;QAChC,IAAI,MAAM;YAAE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,uBAAuB,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QAClE,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,oBAAoB,CAAC,KAAgC;QACzD,MAAM,eAAe,CACnB,IAAI,CAAC,OAAO,EACZ,eAAe,KAAK,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,EAC1C,iCAAiC,CAClC,CAAC;QACF,4EAA4E;QAC5E,2EAA2E;QAC3E,0EAA0E;QAC1E,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,GAAG,CAAC,oBAAoB,CAAC;gBAClC,IAAI,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,UAAU,EAAE,iBAAiB,EAAE;gBAC3D,OAAO,EAAE,IAAI,OAAO,EAAE;gBACtB,UAAU,EAAE,IAAI;aACjB,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,wBAAwB;QAC1B,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,KAAyB;QAC3C,8EAA8E;QAC9E,gCAAgC;QAChC,MAAM,eAAe,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,KAAK,CAAC,KAAK,EAAE,EAAE,yBAAyB,CAAC,CAAC;QACzF,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC;YACvC,IAAI,EAAE,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE;YAC5D,OAAO,EAAE,IAAI,OAAO,EAAE;YACtB,UAAU,EAAE,IAAI;SACjB,CAAC,CAAC;QACH,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC;QACpB,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAA8B,CAAC;QAC/E,IAAI,IAAI,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC;YAClB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,yBAAyB,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;YACtE,oFAAoF;YACpF,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACxC,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,KAA0B,EAAE,UAAuB,EAAE,UAAmB;QAC3F,MAAM,OAAO,GAAG,oBAAoB,CAAC,UAAU,CAAC,CAAC;QACjD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;QACjD,MAAM,eAAe,CACnB,IAAI,CAAC,OAAO,EACZ,mBAAmB,MAAM,IAAI,WAAW,EAAE,EAC1C,0BAA0B,CAC3B,CAAC;QACF,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,cAAc,CAAC;YACxC,IAAI,EAAE,EAAE,eAAe,EAAE,KAAK,CAAC,eAAe,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE;YAChF,OAAO;YACP,UAAU,EAAE,IAAI;SACjB,CAAC,CAAC;QACH,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC;QACpB,cAAc,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;QAChC,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,qBAAqB,CAAC,UAAuB;QACjD,MAAM,OAAO,GAAG,oBAAoB,CAAC,UAAU,CAAC,CAAC;QACjD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;QAC5D,MAAM,KAAK,GAAG,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC;QACnC,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,eAAe,CACnB,IAAI,CAAC,OAAO,EACZ,gBAAgB,KAAK,CAAC,WAAW,EAAE,EAAE,EACrC,6BAA6B,CAC9B,CAAC;YACF,MAAM,IAAI,CAAC,GAAG,CAAC,qBAAqB,CAAC,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;QACvF,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,KAAuB,EAAE,UAAuB;QAChE,MAAM,OAAO,GAAG,oBAAoB,CAAC,UAAU,CAAC,CAAC;QACjD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;QACjD,MAAM,eAAe,CACnB,IAAI,CAAC,OAAO,EACZ,gBAAgB,MAAM,IAAI,WAAW,EAAE,EACvC,uBAAuB,CACxB,CAAC;QACF,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC;YACrC,KAAK,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE;YAC7B,OAAO;YACP,UAAU,EAAE,IAAI;SACjB,CAAC,CAAC;QACH,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC;QACpB,IAAI,MAAM;YAAE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,yBAAyB,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QACpE,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,KAAuB,EAAE,UAAuB,EAAE,UAAmB;QACrF,MAAM,OAAO,GAAG,oBAAoB,CAAC,UAAU,CAAC,CAAC;QACjD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC;YACrC,IAAI,EAAE,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE;YAClC,OAAO;YACP,UAAU,EAAE,IAAI;SACjB,CAAC,CAAC;QACH,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC;QACpB,cAAc,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;QAChC,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,KAAyB,EAAE,UAAuB,EAAE,UAAmB;QACzF,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS;YAAE,uBAAuB,CAAC,KAAK,CAAC,QAAQ,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC;QAC/F,MAAM,OAAO,GAAG,oBAAoB,CAAC,UAAU,CAAC,CAAC;QACjD,8EAA8E;QAC9E,8EAA8E;QAC9E,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC;QAC/C,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC;YACpC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE;YACtC,OAAO;YACP,UAAU,EAAE,IAAI;SACjB,CAAC,CAAC;QACH,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC;QACpB,cAAc,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;QAChC,kFAAkF;QAClF,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;QAC5D,MAAM,OAAO,GAAG,OAAO,EAAE,IAAkC,CAAC;QAC5D,IAAI,OAAO;YAAE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,0BAA0B,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;QAClF,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAC;QAC/E,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;IACnC,CAAC;CACF"}

package/dist/pam/identity/service/login-enforcement.service.d.ts

@@ -0,0 +1,13 @@
+import { DrizzleService } from '@openora/core/server';
+import type { LoginEnforcementPort } from '@openora/core/contracts';
+import { SessionService } from './session.service.js';
+export declare class LoginEnforcementService implements LoginEnforcementPort {
+    private readonly drizzle;
+    private readonly sessions;
+    constructor(drizzle: DrizzleService, sessions: SessionService);
+    block(userId: string, opts: {
+        until: Date | null;
+    }): Promise<void>;
+    unblock(userId: string): Promise<void>;
+}
+//# sourceMappingURL=login-enforcement.service.d.ts.map

package/dist/pam/identity/service/login-enforcement.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"login-enforcement.service.d.ts","sourceRoot":"","sources":["../../../../src/pam/identity/service/login-enforcement.service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAEtD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AAEpE,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAKtD,qBAAa,uBAAwB,YAAW,oBAAoB;IAEhE,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,QAAQ;gBADR,OAAO,EAAE,cAAc,EACvB,QAAQ,EAAE,cAAc;IAGrC,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE;QAAE,KAAK,EAAE,IAAI,GAAG,IAAI,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAQlE,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAM7C"}

package/dist/pam/identity/service/login-enforcement.service.js

@@ -0,0 +1,27 @@
+import { eq } from 'drizzle-orm';
+import { user } from '../schema/index.js';
+// Identity-owned writer for the LOGIN_ENFORCEMENT port. `block` sets the RG columns
+// and revokes every active session (the session-termination requirement); `unblock`
+// clears them. Compliance drives this through the port - never the identity schema.
+export class LoginEnforcementService {
+    drizzle;
+    sessions;
+    constructor(drizzle, sessions) {
+        this.drizzle = drizzle;
+        this.sessions = sessions;
+    }
+    async block(userId, opts) {
+        await this.drizzle.db
+            .update(user)
+            .set({ rgBlocked: true, rgBlockedUntil: opts.until })
+            .where(eq(user.id, userId));
+        await this.sessions.revokeAllSessions(userId);
+    }
+    async unblock(userId) {
+        await this.drizzle.db
+            .update(user)
+            .set({ rgBlocked: false, rgBlockedUntil: null })
+            .where(eq(user.id, userId));
+    }
+}
+//# sourceMappingURL=login-enforcement.service.js.map

package/dist/pam/identity/service/login-enforcement.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"login-enforcement.service.js","sourceRoot":"","sources":["../../../../src/pam/identity/service/login-enforcement.service.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AAEjC,OAAO,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAC;AAG1C,oFAAoF;AACpF,oFAAoF;AACpF,oFAAoF;AACpF,MAAM,OAAO,uBAAuB;IAEf;IACA;IAFnB,YACmB,OAAuB,EACvB,QAAwB;QADxB,YAAO,GAAP,OAAO,CAAgB;QACvB,aAAQ,GAAR,QAAQ,CAAgB;IACxC,CAAC;IAEJ,KAAK,CAAC,KAAK,CAAC,MAAc,EAAE,IAA4B;QACtD,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE;aAClB,MAAM,CAAC,IAAI,CAAC;aACZ,GAAG,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;aACpD,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC;QAC9B,MAAM,IAAI,CAAC,QAAQ,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC;IAChD,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,MAAc;QAC1B,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE;aAClB,MAAM,CAAC,IAAI,CAAC;aACZ,GAAG,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC;aAC/C,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC;IAChC,CAAC;CACF"}

package/dist/pam/identity/service/session.service.d.ts

@@ -0,0 +1,29 @@
+import { type EventBus, DrizzleService } from '@openora/core/server';
+export type SessionServiceDeps = {
+    drizzle: DrizzleService;
+    events: EventBus;
+};
+export declare class SessionService {
+    private readonly drizzle;
+    private readonly events;
+    constructor({ drizzle, events }: SessionServiceDeps);
+    listSessions(userId: string, page: number, limit: number): Promise<{
+        items: {
+            id: string;
+            expiresAt: string;
+            createdAt: string;
+            ipAddress?: string | null | undefined;
+            userAgent?: string | null | undefined;
+        }[];
+        total: number;
+        page: number;
+        limit: number;
+    }>;
+    revokeSession(userId: string, id: string, actorId?: string): Promise<{
+        success: true;
+    }>;
+    revokeAllSessions(userId: string, actorId?: string): Promise<{
+        success: true;
+    }>;
+}
+//# sourceMappingURL=session.service.d.ts.map

package/dist/pam/identity/service/session.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session.service.d.ts","sourceRoot":"","sources":["../../../../src/pam/identity/service/session.service.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,KAAK,QAAQ,EAAE,cAAc,EAAgB,MAAM,sBAAsB,CAAC;AAKnF,MAAM,MAAM,kBAAkB,GAAG;IAC/B,OAAO,EAAE,cAAc,CAAC;IACxB,MAAM,EAAE,QAAQ,CAAC;CAClB,CAAC;AAEF,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAiB;IACzC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAW;gBAEtB,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,kBAAkB;IAK7C,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM;;;;;;;;;;;;IA+BxD,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM;;;IAmB1D,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM;;;CASzD"}