@openora/core 0.4.1-canary.13 → 0.4.1-canary.130

package/dist/pam/identity/service/device-fingerprint.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"device-fingerprint.service.d.ts","sourceRoot":"","sources":["../../../../src/pam/identity/service/device-fingerprint.service.ts"],"names":[],"mappings":"AAEA,MAAM,MAAM,cAAc,GAAG,KAAK,GAAG,SAAS,GAAG,KAAK,CAAC;AAEvD,MAAM,MAAM,iBAAiB,GAAG;IAC9B,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,EAAE,EAAE,MAAM,GAAG,IAAI,CAAC;CACnB,CAAC;AAOF,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,CAS/E;AAED,wBAAgB,UAAU,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,CAEvE;AAED,wBAAgB,YAAY,CAC1B,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAC/B,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAC/B,OAAO,CAET;AAyBD;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,iBAAiB,CAWtF;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,EACnC,MAAM,EACN,SAAS,EACT,SAAS,EACT,cAAc,EACd,cAAc,GACf,EAAE;IACD,MAAM,EAAE,cAAc,CAAC;IACvB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAChC,GAAG,OAAO,CAWV;AAED,wBAAgB,mBAAmB,CAAC,iBAAiB,EAAE,MAAM,EAAE,GAAG,OAAa,GAAG,IAAI,CAErF"}

package/dist/pam/identity/service/device-fingerprint.service.js

@@ -0,0 +1,79 @@
+import { createHash } from 'node:crypto';
+const UNKNOWN_DEVICE_LABEL = 'Unknown device';
+// Browsers ship a new build every few weeks and every one of them changes the
+// User-Agent. Comparing raw strings would revoke every Backoffice session on each
+// auto-update, so the fingerprint keeps only the major version of each token.
+export function normalizeUserAgent(userAgent) {
+    if (!userAgent) {
+        return '';
+    }
+    return userAgent
+        .toLowerCase()
+        .replace(/(\d+)(?:\.\d+)+/g, '$1')
+        .replace(/\s+/g, ' ')
+        .trim();
+}
+export function deviceHash(userAgent) {
+    return createHash('sha256').update(normalizeUserAgent(userAgent)).digest('hex');
+}
+export function isSameDevice(left, right) {
+    return normalizeUserAgent(left) === normalizeUserAgent(right);
+}
+const BROWSER_PATTERNS = [
+    [/edg[ea]?\//i, 'Edge'],
+    [/opr\/|opera/i, 'Opera'],
+    [/chrome\/|crios\//i, 'Chrome'],
+    [/firefox\/|fxios\//i, 'Firefox'],
+    [/safari\//i, 'Safari'],
+];
+const OS_PATTERNS = [
+    [/windows nt/i, 'Windows'],
+    [/iphone|ipad|ipod/i, 'iOS'],
+    [/mac os x|macintosh/i, 'macOS'],
+    [/android/i, 'Android'],
+    [/linux/i, 'Linux'],
+];
+function matchFirst(userAgent, patterns) {
+    return patterns.find(([pattern]) => pattern.test(userAgent))?.[1] ?? null;
+}
+/**
+ * Turns a raw User-Agent into the browser/OS pair the session list shows. Deliberately
+ * a handful of patterns rather than a UA-parsing dependency: the value is a display
+ * label, and a wrong guess costs a cosmetic string, never an access decision.
+ */
+export function describeDevice(userAgent) {
+    if (!userAgent) {
+        return { label: UNKNOWN_DEVICE_LABEL, browser: null, os: null };
+    }
+    const browser = matchFirst(userAgent, BROWSER_PATTERNS);
+    const os = matchFirst(userAgent, OS_PATTERNS);
+    if (!browser && !os) {
+        return { label: UNKNOWN_DEVICE_LABEL, browser: null, os: null };
+    }
+    const label = [browser, os].filter((part) => part !== null).join(' on ');
+    return { label, browser, os };
+}
+/**
+ * Whether a mid-session IP change is suspicious enough to end the session.
+ *
+ * `country` needs both countries resolved - an unbound or failing geo-ip lookup
+ * yields nulls, and an unresolved lookup must never end a session on its own.
+ * `any` is the strictest setting and will log users out across NAT and mobile
+ * network hops, which is why it is not the default.
+ */
+export function isSuspiciousIpChange({ policy, sessionIp, requestIp, sessionCountry, requestCountry, }) {
+    if (policy === 'off' || !sessionIp || !requestIp || sessionIp === requestIp) {
+        return false;
+    }
+    if (policy === 'any') {
+        return true;
+    }
+    if (!sessionCountry || !requestCountry) {
+        return false;
+    }
+    return sessionCountry.toUpperCase() !== requestCountry.toUpperCase();
+}
+export function trustedDeviceExpiry(trustedDeviceDays, now = new Date()) {
+    return new Date(now.getTime() + trustedDeviceDays * 24 * 60 * 60 * 1000);
+}
+//# sourceMappingURL=device-fingerprint.service.js.map

package/dist/pam/identity/service/device-fingerprint.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"device-fingerprint.service.js","sourceRoot":"","sources":["../../../../src/pam/identity/service/device-fingerprint.service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAUzC,MAAM,oBAAoB,GAAG,gBAAgB,CAAC;AAE9C,8EAA8E;AAC9E,kFAAkF;AAClF,8EAA8E;AAC9E,MAAM,UAAU,kBAAkB,CAAC,SAAoC;IACrE,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,OAAO,SAAS;SACb,WAAW,EAAE;SACb,OAAO,CAAC,kBAAkB,EAAE,IAAI,CAAC;SACjC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC;SACpB,IAAI,EAAE,CAAC;AACZ,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,SAAoC;IAC7D,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,kBAAkB,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAClF,CAAC;AAED,MAAM,UAAU,YAAY,CAC1B,IAA+B,EAC/B,KAAgC;IAEhC,OAAO,kBAAkB,CAAC,IAAI,CAAC,KAAK,kBAAkB,CAAC,KAAK,CAAC,CAAC;AAChE,CAAC;AAED,MAAM,gBAAgB,GAA6C;IACjE,CAAC,aAAa,EAAE,MAAM,CAAC;IACvB,CAAC,cAAc,EAAE,OAAO,CAAC;IACzB,CAAC,mBAAmB,EAAE,QAAQ,CAAC;IAC/B,CAAC,oBAAoB,EAAE,SAAS,CAAC;IACjC,CAAC,WAAW,EAAE,QAAQ,CAAC;CACxB,CAAC;AAEF,MAAM,WAAW,GAA6C;IAC5D,CAAC,aAAa,EAAE,SAAS,CAAC;IAC1B,CAAC,mBAAmB,EAAE,KAAK,CAAC;IAC5B,CAAC,qBAAqB,EAAE,OAAO,CAAC;IAChC,CAAC,UAAU,EAAE,SAAS,CAAC;IACvB,CAAC,QAAQ,EAAE,OAAO,CAAC;CACpB,CAAC;AAEF,SAAS,UAAU,CACjB,SAAiB,EACjB,QAAkD;IAElD,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;AAC5E,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,SAAoC;IACjE,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,OAAO,EAAE,KAAK,EAAE,oBAAoB,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IAClE,CAAC;IACD,MAAM,OAAO,GAAG,UAAU,CAAC,SAAS,EAAE,gBAAgB,CAAC,CAAC;IACxD,MAAM,EAAE,GAAG,UAAU,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;IAC9C,IAAI,CAAC,OAAO,IAAI,CAAC,EAAE,EAAE,CAAC;QACpB,OAAO,EAAE,KAAK,EAAE,oBAAoB,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IAClE,CAAC;IACD,MAAM,KAAK,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACzE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;AAChC,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,oBAAoB,CAAC,EACnC,MAAM,EACN,SAAS,EACT,SAAS,EACT,cAAc,EACd,cAAc,GAOf;IACC,IAAI,MAAM,KAAK,KAAK,IAAI,CAAC,SAAS,IAAI,CAAC,SAAS,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5E,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;QACrB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC,cAAc,IAAI,CAAC,cAAc,EAAE,CAAC;QACvC,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,cAAc,CAAC,WAAW,EAAE,KAAK,cAAc,CAAC,WAAW,EAAE,CAAC;AACvE,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,iBAAyB,EAAE,GAAG,GAAG,IAAI,IAAI,EAAE;IAC7E,OAAO,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,iBAAiB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;AAC3E,CAAC"}

package/dist/pam/identity/service/identity.service.d.ts

@@ -1,18 +1,29 @@
-import { ORPCError } from '@orpc/server';
 import { type EventBus, type NodeHeaders, DrizzleService } from '@openora/core/server';
-import type { RateLimiterAdapter, SendEmailPort, LoginInput, RegisterInput, Enable2faInput, Verify2faInput, Disable2faInput, RequestPasswordResetInput, ResetPasswordInput, VerifyEmailInput, UpdateProfileInput, User, ChangePasswordInput, ChangeEmailInput, IdentityServiceOptions, PlatformConfig } from '@openora/core/contracts';
-export declare function createAccountLockedError(lockoutUntil: Date): ORPCError<"UNAUTHORIZED", {
-    code: string;
-    lockoutUntil: string;
-}>;
-export declare const UserNotFoundError: new (id: string) => Error;
+import type { SessionService } from './session.service.js';
+import type { TrustedDeviceService } from './trusted-device.service.js';
+import type { TwoFactorLockoutService } from './two-factor-lockout.service.js';
+import type { CacheAdapter, RateLimiterAdapter, RateLimitKey, MailDispatchPort, LoginInput, RegisterInput, Enable2faInput, Verify2faInput, Disable2faInput, RegenerateBackupCodesInput, TrustCurrentDeviceInput, RequestPasswordResetInput, VerifyPasswordResetOtpInput, ResetPasswordInput, ResendEmailVerificationInput, VerifyEmailInput, UpdateProfileInput, User, IdentityReader, ChangePasswordInput, ChangeEmailInput, IdentityServiceOptions, PlatformConfig, ClientMeta, GeoCheckCommands, PlayerProvisioning, SecurityControls, SetLoginWithdrawalAlertsInput } from '@openora/core/contracts';
+export declare const UserNotFoundError: new (id: string) => Error & {
+    data?: Record<string, string>;
+};
+export declare const UsernameConflictError: new () => Error & {
+    data?: Record<string, string>;
+};
+export declare const SESSION_DURATION_IN_SECONDS: number;
 export type IdentityServiceDeps = {
     drizzle: DrizzleService;
     events: EventBus;
-    email?: SendEmailPort;
+    identityReader: IdentityReader;
+    mailDispatch?: MailDispatchPort;
     options?: IdentityServiceOptions;
-    limiter?: RateLimiterAdapter;
+    limiter?: RateLimiterAdapter<RateLimitKey>;
     platformConfig?: PlatformConfig;
+    geoCheck?: GeoCheckCommands;
+    playerProvisioning?: PlayerProvisioning;
+    cache?: CacheAdapter;
+    trustedDevices?: TrustedDeviceService;
+    twoFactorLockout?: TwoFactorLockoutService;
+    sessions?: SessionService;
 };
 /**
  * Thin wrapper over the shared better-auth instance (register/login/2FA/
@@ -27,34 +38,44 @@ export declare class IdentityService {
     private readonly auth;
     private readonly drizzle;
     private readonly events;
-    private readonly email?;
+    private readonly identityReader;
+    private readonly mailDispatch?;
     private readonly options?;
     private readonly limiter?;
     private readonly platformConfig?;
-    constructor({ drizzle, events, email, options, limiter, platformConfig }: IdentityServiceDeps);
+    private readonly playerProvisioning?;
+    private readonly geoCheck?;
+    private readonly cache?;
+    private readonly existingAccountSignUps;
+    private readonly trustedDevices?;
+    private readonly twoFactorLockout?;
+    private readonly sessions?;
+    constructor({ drizzle, events, identityReader, mailDispatch, options, limiter, platformConfig, geoCheck, playerProvisioning, cache, trustedDevices, twoFactorLockout, sessions, }: IdentityServiceDeps);
+    private findUserByEmail;
     private get api();
+    private forwardCookies;
     private currentUserId;
-    register(input: RegisterInput, reqHeaders: NodeHeaders, resHeaders: Headers): Promise<{
-        user: {
-            id: string;
-            email: string;
-            name: string;
-            emailVerified: boolean;
-            theme: "light" | "dark" | "system";
-            language: string;
-            createdAt: string;
-            updatedAt: string;
-        } | {
-            image: string | null;
-            id: string;
-            email: string;
-            name: string;
-            emailVerified: boolean;
-            theme: "light" | "dark" | "system";
-            language: string;
-            createdAt: string;
-            updatedAt: string;
-        };
+    private securityControlsFor;
+    private assertAccountNotBlocked;
+    /**
+     * Emitted on every registration attempt that produced no account. The audit trail is
+     * the one place that records what actually happened - the HTTP response deliberately
+     * does not, because a truthful answer on a known address is an enumeration oracle.
+     */
+    private emitRegistrationFailed;
+    register(input: RegisterInput, reqHeaders: NodeHeaders): Promise<{
+        status: "check-email";
+    }>;
+    private findUserIdByUsername;
+    private findUserIdByEmail;
+    /**
+     * Better Auth commits the user inside its own transaction before returning, so a
+     * failure here would otherwise leave an account with no consent record. The user is
+     * deleted instead (sessions and accounts cascade), making registration all-or-nothing.
+     */
+    private recordRegistrationConsent;
+    usernameAvailable(username: string, reqHeaders: NodeHeaders): Promise<{
+        available: boolean;
     }>;
     /**
      * Credentials are verified FIRST; the RG login block is checked only AFTER
@@ -72,14 +93,17 @@ export declare class IdentityService {
         twoFactorRedirect: boolean;
         user?: undefined;
         session?: undefined;
+        security?: undefined;
     } | {
         user: {
             id: string;
             email: string;
             name: string;
+            username: string;
             emailVerified: boolean;
             theme: "light" | "dark" | "system";
             language: string;
+            twoFactorEnabled: boolean;
             createdAt: string;
             updatedAt: string;
         } | {
@@ -87,9 +111,11 @@ export declare class IdentityService {
             id: string;
             email: string;
             name: string;
+            username: string;
             emailVerified: boolean;
             theme: "light" | "dark" | "system";
             language: string;
+            twoFactorEnabled: boolean;
             createdAt: string;
             updatedAt: string;
         };
@@ -97,10 +123,22 @@ export declare class IdentityService {
             token: string;
             expiresAt: string;
         };
+        security: {
+            attemptsRemaining: number;
+            lockoutUntil: string | null;
+        };
         twoFactorRedirect?: undefined;
     }>;
     private clearLockout;
-    unlockUser(userId: User['id'], actorId: User['id']): Promise<{
+    private resetLockoutTier;
+    private loginShadowGet;
+    private loginShadowSet;
+    private adminPasswordResetMarkerKey;
+    private isAdminPasswordReset;
+    adminRequestPasswordReset(userId: User['id'], actorId: User['id'], meta?: ClientMeta): Promise<{
+        success: true;
+    }>;
+    unlockUser(userId: User['id'], actorId: User['id'], meta?: ClientMeta): Promise<{
         success: true;
     }>;
     logout(reqHeaders: NodeHeaders, resHeaders: Headers): Promise<{
@@ -110,9 +148,11 @@ export declare class IdentityService {
         id: string;
         email: string;
         name: string;
+        username: string;
         emailVerified: boolean;
         theme: "light" | "dark" | "system";
         language: string;
+        twoFactorEnabled: boolean;
         createdAt: string;
         updatedAt: string;
     } | null>;
@@ -123,23 +163,93 @@ export declare class IdentityService {
     verifyTwoFactor(input: Verify2faInput, reqHeaders: NodeHeaders, resHeaders: Headers): Promise<{
         success: true;
     }>;
+    /**
+     * Grants this browser its trust window without a sign-out. better-auth issues the
+     * trust cookie only on the sign-in leg of a challenge, so the grant has to replay
+     * that leg: the account proves its password and a fresh second factor, and the
+     * cookies better-auth returns are the ones the browser keeps.
+     */
+    trustCurrentDevice(input: TrustCurrentDeviceInput, reqHeaders: NodeHeaders, resHeaders: Headers): Promise<{
+        success: true;
+    }>;
+    /**
+     * A step-up gate for the self-service routes that change standing 2FA state: the
+     * caller has to clear a live authenticator code, not just the account password.
+     * Routed through TwoFactorLockoutService so a hijacked session plus a reused
+     * password cannot grind the second factor here the way the password-only paths let it.
+     */
+    private assertFreshSecondFactor;
+    regenerateBackupCodes(input: RegenerateBackupCodesInput, reqHeaders: NodeHeaders, resHeaders: Headers): Promise<{
+        backupCodes: string[];
+    }>;
     disableTwoFactor(input: Disable2faInput, reqHeaders: NodeHeaders, resHeaders: Headers): Promise<{
         success: true;
     }>;
     requestPasswordReset(input: RequestPasswordResetInput): Promise<{
         success: true;
     }>;
+    verifyPasswordResetOtp(input: VerifyPasswordResetOtpInput): Promise<{
+        success: true;
+    }>;
     resetPassword(input: ResetPasswordInput): Promise<{
         success: true;
     }>;
     changePassword(input: ChangePasswordInput, reqHeaders: NodeHeaders, resHeaders: Headers): Promise<{
         success: true;
     }>;
-    sendEmailVerification(reqHeaders: NodeHeaders): Promise<{
+    getSecurityControls(reqHeaders: NodeHeaders): Promise<SecurityControls>;
+    setLoginWithdrawalAlerts(input: SetLoginWithdrawalAlertsInput, reqHeaders: NodeHeaders): Promise<SecurityControls>;
+    /**
+     * Resends the registration code. Unauthenticated by design - the player has no session
+     * until the code is verified - so it answers SUCCESS for every address and only mails a
+     * code to an account that exists and is still unverified. Verified accounts are skipped
+     * deliberately: `verifyEmail` signs the code's bearer in, so resending to a verified
+     * address would turn this into passwordless sign-in for anyone who can read that inbox.
+     */
+    sendEmailVerification(input: ResendEmailVerificationInput, reqHeaders: NodeHeaders): Promise<{
         success: true;
     }>;
-    verifyEmail(input: VerifyEmailInput, reqHeaders: NodeHeaders): Promise<{
-        success: true;
+    /**
+     * Consumes the 6-digit code mailed by `register()` and signs the player in -
+     * better-auth's `autoSignInAfterVerification` mints the session here rather than at
+     * sign-up, which is what lets sign-up stay sessionless and therefore keep its
+     * duplicate-email response indistinguishable. Same post-credential gates as `login`:
+     * a code is proof of address ownership, not a bypass for an RG or backoffice block.
+     */
+    verifyEmail(input: VerifyEmailInput, reqHeaders: NodeHeaders, resHeaders: Headers): Promise<{
+        twoFactorRedirect: true;
+        user?: undefined;
+        session?: undefined;
+    } | {
+        user: {
+            id: string;
+            email: string;
+            name: string;
+            username: string;
+            emailVerified: boolean;
+            theme: "light" | "dark" | "system";
+            language: string;
+            twoFactorEnabled: boolean;
+            createdAt: string;
+            updatedAt: string;
+        } | {
+            image: string | null;
+            id: string;
+            email: string;
+            name: string;
+            username: string;
+            emailVerified: boolean;
+            theme: "light" | "dark" | "system";
+            language: string;
+            twoFactorEnabled: boolean;
+            createdAt: string;
+            updatedAt: string;
+        };
+        session: {
+            token: string;
+            expiresAt: string;
+        };
+        twoFactorRedirect?: undefined;
     }>;
     changeEmail(input: ChangeEmailInput, reqHeaders: NodeHeaders, resHeaders: Headers): Promise<{
         success: true;
@@ -149,9 +259,11 @@ export declare class IdentityService {
             id: string;
             email: string;
             name: string;
+            username: string;
             emailVerified: boolean;
             theme: "light" | "dark" | "system";
             language: string;
+            twoFactorEnabled: boolean;
             createdAt: string;
             updatedAt: string;
         } | {
@@ -159,9 +271,11 @@ export declare class IdentityService {
             id: string;
             email: string;
             name: string;
+            username: string;
             emailVerified: boolean;
             theme: "light" | "dark" | "system";
             language: string;
+            twoFactorEnabled: boolean;
             createdAt: string;
             updatedAt: string;
         };

package/dist/pam/identity/service/identity.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"identity.service.d.ts","sourceRoot":"","sources":["../../../../src/pam/identity/service/identity.service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EAEL,KAAK,QAAQ,EACb,KAAK,WAAW,EAChB,cAAc,EAIf,MAAM,sBAAsB,CAAC;AAI9B,OAAO,KAAK,EACV,kBAAkB,EAClB,aAAa,EACb,UAAU,EACV,aAAa,EACb,cAAc,EACd,cAAc,EACd,eAAe,EACf,yBAAyB,EACzB,kBAAkB,EAClB,gBAAgB,EAChB,kBAAkB,EAElB,IAAI,EACJ,mBAAmB,EACnB,gBAAgB,EAChB,sBAAsB,EACtB,cAAc,EACf,MAAM,yBAAyB,CAAC;AAcjC,wBAAgB,wBAAwB,CAAC,YAAY,EAAE,IAAI;;;GAQ1D;AAiFD,eAAO,MAAM,iBAAiB,2BAA4B,CAAC;AAuE3D,MAAM,MAAM,mBAAmB,GAAG;IAChC,OAAO,EAAE,cAAc,CAAC;IACxB,MAAM,EAAE,QAAQ,CAAC;IACjB,KAAK,CAAC,EAAE,aAAa,CAAC;IACtB,OAAO,CAAC,EAAE,sBAAsB,CAAC;IACjC,OAAO,CAAC,EAAE,kBAAkB,CAAC;IAC7B,cAAc,CAAC,EAAE,cAAc,CAAC;CACjC,CAAC;AAEF;;;;;;;;GAQG;AACH,qBAAa,eAAe;IAC1B,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAgC;IACrD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAiB;IACzC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAW;IAClC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAgB;IACvC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAyB;IAClD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAqB;IAC9C,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAiB;gBAErC,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,EAAE,mBAAmB;IAc7F,OAAO,KAAK,GAAG,GAId;YAEa,aAAa;IAKrB,QAAQ,CAAC,KAAK,EAAE,aAAa,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,OAAO;;;;;;;;;;;;;;;;;;;;;;IAmBjF;;;;;;;;;;;OAWG;IACG,KAAK,CAAC,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAiJ3E,OAAO,CAAC,YAAY;IAOd,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC;;;IA8BlD,MAAM,CAAC,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,OAAO;;;IAanD,EAAE,CAAC,UAAU,EAAE,WAAW;;;;;;;;;;IAS1B,eAAe,CAAC,KAAK,EAAE,cAAc,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,OAAO;;;;IAmBnF,eAAe,CAAC,KAAK,EAAE,cAAc,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,OAAO;;;IAmBnF,gBAAgB,CAAC,KAAK,EAAE,eAAe,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,OAAO;;;IAqBrF,oBAAoB,CAAC,KAAK,EAAE,yBAAyB;;;IAqBrD,aAAa,CAAC,KAAK,EAAE,kBAAkB;;;IAmBvC,cAAc,CAAC,KAAK,EAAE,mBAAmB,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,OAAO;;;IAkBvF,qBAAqB,CAAC,UAAU,EAAE,WAAW;;;IAe7C,WAAW,CAAC,KAAK,EAAE,gBAAgB,EAAE,UAAU,EAAE,WAAW;;;IAoB5D,WAAW,CAAC,KAAK,EAAE,gBAAgB,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,OAAO;;;IAYjF,aAAa,CAAC,KAAK,EAAE,kBAAkB,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,OAAO;;;;;;;;;;;;;;;;;;;;;;CA0B5F"}
+{"version":3,"file":"identity.service.d.ts","sourceRoot":"","sources":["../../../../src/pam/identity/service/identity.service.ts"],"names":[],"mappings":"AAEA,OAAO,EAEL,KAAK,QAAQ,EACb,KAAK,WAAW,EAChB,cAAc,EAQf,MAAM,sBAAsB,CAAC;AAM9B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AACxE,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAC/E,OAAO,KAAK,EACV,YAAY,EACZ,kBAAkB,EAClB,YAAY,EACZ,gBAAgB,EAChB,UAAU,EACV,aAAa,EACb,cAAc,EACd,cAAc,EACd,eAAe,EACf,0BAA0B,EAC1B,uBAAuB,EACvB,yBAAyB,EACzB,2BAA2B,EAC3B,kBAAkB,EAClB,4BAA4B,EAC5B,gBAAgB,EAChB,kBAAkB,EAElB,IAAI,EACJ,cAAc,EACd,mBAAmB,EACnB,gBAAgB,EAChB,sBAAsB,EACtB,cAAc,EACd,UAAU,EAEV,gBAAgB,EAChB,kBAAkB,EAClB,gBAAgB,EAChB,6BAA6B,EAC9B,MAAM,yBAAyB,CAAC;AAyJjC,eAAO,MAAM,iBAAiB;QAvM5B,CAAA;CAuMwD,CAAC;AAC3D,eAAO,MAAM,qBAAqB;QAxMhC,CAAA;CAwM8F,CAAC;AA+CjG,eAAO,MAAM,2BAA2B,QAAoB,CAAC;AAkF7D,MAAM,MAAM,mBAAmB,GAAG;IAChC,OAAO,EAAE,cAAc,CAAC;IACxB,MAAM,EAAE,QAAQ,CAAC;IACjB,cAAc,EAAE,cAAc,CAAC;IAC/B,YAAY,CAAC,EAAE,gBAAgB,CAAC;IAChC,OAAO,CAAC,EAAE,sBAAsB,CAAC;IACjC,OAAO,CAAC,EAAE,kBAAkB,CAAC,YAAY,CAAC,CAAC;IAC3C,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC,QAAQ,CAAC,EAAE,gBAAgB,CAAC;IAC5B,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;IACxC,KAAK,CAAC,EAAE,YAAY,CAAC;IACrB,cAAc,CAAC,EAAE,oBAAoB,CAAC;IACtC,gBAAgB,CAAC,EAAE,uBAAuB,CAAC;IAG3C,QAAQ,CAAC,EAAE,cAAc,CAAC;CAC3B,CAAC;AAEF;;;;;;;;GAQG;AACH,qBAAa,eAAe;IAC1B,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAgC;IACrD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAiB;IACzC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAW;IAClC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAiB;IAChD,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAmB;IACjD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAyB;IAClD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAmC;IAC5D,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAiB;IACjD,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAqB;IACzD,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAmB;IAC7C,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAe;IAMtC,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAqB;IAC5D,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAuB;IACvD,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAA0B;IAC5D,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAiB;gBAE/B,EACV,OAAO,EACP,MAAM,EACN,cAAc,EACd,YAAY,EACZ,OAAO,EACP,OAAO,EACP,cAAc,EACd,QAAQ,EACR,kBAAkB,EAClB,KAAK,EACL,cAAc,EACd,gBAAgB,EAChB,QAAQ,GACT,EAAE,mBAAmB;YAgER,eAAe;IAS7B,OAAO,KAAK,GAAG,GAId;IAED,OAAO,CAAC,cAAc;YAOR,aAAa;YAKb,mBAAmB;IASjC,OAAO,CAAC,uBAAuB;IAU/B;;;;OAIG;IACH,OAAO,CAAC,sBAAsB;IAcxB,QAAQ,CAAC,KAAK,EAAE,aAAa,EAAE,UAAU,EAAE,WAAW;;;YAiH9C,oBAAoB;YASpB,iBAAiB;IAS/B;;;;OAIG;YACW,yBAAyB;IAoCjC,iBAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,WAAW;;;IAUjE;;;;;;;;;;;OAWG;IACG,KAAK,CAAC,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAgV3E,OAAO,CAAC,YAAY;IAOpB,OAAO,CAAC,gBAAgB;YAaV,cAAc;YAYd,cAAc;IAW5B,OAAO,CAAC,2BAA2B;YAIrB,oBAAoB;IAiB5B,yBAAyB,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,EAAE,UAAU;;;IAuCpF,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,EAAE,UAAU;;;IAiCrE,MAAM,CAAC,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,OAAO;;;IAmBnD,EAAE,CAAC,UAAU,EAAE,WAAW;;;;;;;;;;;;IAS1B,eAAe,CAAC,KAAK,EAAE,cAAc,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,OAAO;;;;IAmBnF,eAAe,CAAC,KAAK,EAAE,cAAc,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,OAAO;;;IAyEzF;;;;;OAKG;IACG,kBAAkB,CACtB,KAAK,EAAE,uBAAuB,EAC9B,UAAU,EAAE,WAAW,EACvB,UAAU,EAAE,OAAO;;;IA4ErB;;;;;OAKG;YACW,uBAAuB;IAmB/B,qBAAqB,CACzB,KAAK,EAAE,0BAA0B,EACjC,UAAU,EAAE,WAAW,EACvB,UAAU,EAAE,OAAO;;;IAqCf,gBAAgB,CAAC,KAAK,EAAE,eAAe,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,OAAO;;;IAqCrF,oBAAoB,CAAC,KAAK,EAAE,yBAAyB;;;IAsBrD,sBAAsB,CAAC,KAAK,EAAE,2BAA2B;;;IAgBzD,aAAa,CAAC,KAAK,EAAE,kBAAkB;;;IAqBvC,cAAc,CAAC,KAAK,EAAE,mBAAmB,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,OAAO;;;IAwBvF,mBAAmB,CAAC,UAAU,EAAE,WAAW,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAQvE,wBAAwB,CAC5B,KAAK,EAAE,6BAA6B,EACpC,UAAU,EAAE,WAAW,GACtB,OAAO,CAAC,gBAAgB,CAAC;IAmD5B;;;;;;OAMG;IACG,qBAAqB,CAAC,KAAK,EAAE,4BAA4B,EAAE,UAAU,EAAE,WAAW;;;IAsBxF;;;;;;OAMG;IACG,WAAW,CAAC,KAAK,EAAE,gBAAgB,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAwFjF,WAAW,CAAC,KAAK,EAAE,gBAAgB,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,OAAO;;;IA4CjF,aAAa,CAAC,KAAK,EAAE,kBAAkB,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;CAgC5F"}