@portaidentity/server 1.7.0

package/dist/routes/two-factor.js

@@ -0,0 +1,595 @@
+/**
+ * Two-factor authentication route handlers.
+ *
+ * Handles the 2FA challenge during OIDC login interactions:
+ *   GET  /interaction/:uid/two-factor         → showTwoFactor (render verification page)
+ *   POST /interaction/:uid/two-factor         → verifyTwoFactor (verify code + finish login)
+ *   POST /interaction/:uid/two-factor/resend  → resendOtpCode (rate-limited OTP resend)
+ *   GET  /interaction/:uid/two-factor/setup   → showTwoFactorSetup (TOTP enrollment)
+ *   POST /interaction/:uid/two-factor/setup   → processTwoFactorSetup (confirm enrollment)
+ *
+ * Security features:
+ *   - CSRF protection on all POST endpoints
+ *   - Rate limiting on verification and resend
+ *   - Recovery code fallback support
+ *   - Audit logging for all 2FA events
+ *
+ * @module routes/two-factor
+ */
+import Router from '@koa/router';
+import { generateCsrfToken, verifyCsrfToken, setCsrfCookie, getCsrfFromCookie, } from '../auth/csrf.js';
+import { checkRateLimit, buildRateLimitKey } from '../auth/rate-limiter.js';
+import { resolveLocale, getTranslationFunction } from '../auth/i18n.js';
+import { renderPage } from '../auth/template-engine.js';
+import { sendOtpCodeEmail } from '../auth/email-service.js';
+import { recordLogin } from '../users/service.js';
+import { findUserById } from '../users/repository.js';
+import { verifyOtp, verifyTotp, verifyRecoveryCode as verifyRecoveryCodeService, sendOtpCode, setupTotp, getPendingTotpSetupInfo, setupEmailOtp, confirmTotpSetup, } from '../two-factor/service.js';
+import { writeAuditLog } from '../lib/audit-log.js';
+import { logger } from '../lib/logger.js';
+import { resolveOrganizationForInteraction } from './interactions.js';
+// ---------------------------------------------------------------------------
+// Constants
+// ---------------------------------------------------------------------------
+/** Rate limit config for 2FA verification attempts: 5 per 5 min */
+const VERIFY_RATE_LIMIT = { max: 5, windowSeconds: 300 };
+/** Rate limit config for OTP resend: 3 per 5 min */
+const RESEND_RATE_LIMIT = { max: 3, windowSeconds: 300 };
+// ---------------------------------------------------------------------------
+// Helpers
+// ---------------------------------------------------------------------------
+/**
+ * Build branding context from organization data.
+ *
+ * @param org - Organization with branding fields
+ * @returns Branding context for templates
+ */
+function buildBrandingFromOrg(org) {
+    return {
+        logoUrl: org.brandingLogoUrl,
+        faviconUrl: org.brandingFaviconUrl,
+        primaryColor: org.brandingPrimaryColor ?? '#3B82F6',
+        companyName: org.brandingCompanyName ?? org.name,
+        customCss: org.brandingCustomCss,
+    };
+}
+/**
+ * Build a base template context for 2FA pages.
+ *
+ * @param ctx - Koa context with organization state
+ * @param locale - Resolved locale
+ * @param csrfToken - CSRF token for form protection
+ * @param orgSlug - Organization slug
+ * @returns Base template context
+ */
+function buildBaseContext(ctx, locale, csrfToken, orgSlug) {
+    return {
+        branding: buildBrandingFromOrg(ctx.state.organization),
+        locale,
+        csrfToken,
+        orgSlug,
+    };
+}
+/**
+ * Render a page template and send as response.
+ *
+ * @param ctx - Koa context
+ * @param pageName - Template name
+ * @param context - Template context
+ * @param statusCode - HTTP status (default: 200)
+ */
+async function renderAndRespond(ctx, pageName, context, statusCode = 200) {
+    const html = await renderPage(pageName, context);
+    ctx.status = statusCode;
+    ctx.type = 'text/html';
+    ctx.body = html;
+}
+/**
+ * Mask an email address for display (e.g., "u***r@test.com").
+ * Shows first char, last char before @, and full domain.
+ *
+ * @param email - Full email address
+ * @returns Masked email string
+ */
+function maskEmail(email) {
+    const [local, domain] = email.split('@');
+    if (!local || !domain)
+        return '***@***';
+    if (local.length <= 2)
+        return `${local[0]}***@${domain}`;
+    return `${local[0]}***${local[local.length - 1]}@${domain}`;
+}
+/**
+ * Extract the pending 2FA state from an interaction result.
+ * Returns null if no pending 2FA exists (interaction expired or invalid).
+ *
+ * @param interaction - OIDC interaction details
+ * @returns Pending 2FA state, or null
+ */
+function getPendingTwoFactor(interaction) {
+    const result = interaction.result;
+    if (!result?.twoFactor)
+        return null;
+    const tf = result.twoFactor;
+    if (!tf.pendingAccountId || !tf.method || !tf.email)
+        return null;
+    return tf;
+}
+// ---------------------------------------------------------------------------
+// Router factory
+// ---------------------------------------------------------------------------
+/**
+ * Create the two-factor authentication router.
+ *
+ * Mounts 2FA verification, resend, and setup routes under /interaction/:uid/two-factor.
+ * Requires a Provider instance to read/write interaction state.
+ *
+ * @param provider - node-oidc-provider instance
+ * @returns Koa router with 2FA routes
+ */
+export function createTwoFactorRouter(provider) {
+    const router = new Router({ prefix: '/interaction' });
+    // GET /interaction/:uid/two-factor — Show 2FA verification page
+    router.get('/:uid/two-factor', async (ctx) => {
+        await showTwoFactor(ctx, provider);
+    });
+    // POST /interaction/:uid/two-factor — Verify 2FA code
+    router.post('/:uid/two-factor', async (ctx) => {
+        await verifyTwoFactor(ctx, provider);
+    });
+    // POST /interaction/:uid/two-factor/resend — Resend OTP code
+    router.post('/:uid/two-factor/resend', async (ctx) => {
+        await resendOtpCode(ctx, provider);
+    });
+    // GET /interaction/:uid/two-factor/setup — Show 2FA setup page
+    router.get('/:uid/two-factor/setup', async (ctx) => {
+        await showTwoFactorSetup(ctx, provider);
+    });
+    // POST /interaction/:uid/two-factor/setup — Process 2FA setup
+    router.post('/:uid/two-factor/setup', async (ctx) => {
+        await processTwoFactorSetup(ctx, provider);
+    });
+    return router;
+}
+// ---------------------------------------------------------------------------
+// Route handlers
+// ---------------------------------------------------------------------------
+/**
+ * Show the 2FA verification page.
+ *
+ * Reads the pending 2FA state from the interaction session.
+ * Renders the two-factor-verify page with method info and masked email.
+ *
+ * @param ctx - Koa context
+ * @param provider - OIDC provider instance
+ */
+async function showTwoFactor(ctx, provider) {
+    try {
+        const interaction = await provider.interactionDetails(ctx.req, ctx.res);
+        // Resolve organization from the interaction's client_id.
+        // 2FA routes don't go through the tenant resolver middleware,
+        // so we resolve the org from the client → organization chain.
+        await resolveOrganizationForInteraction(ctx, interaction.params.client_id, interaction.uid);
+        const pending = getPendingTwoFactor(interaction);
+        if (!pending) {
+            // No pending 2FA — redirect back to login
+            ctx.redirect(`/interaction/${interaction.uid}`);
+            return;
+        }
+        const org = ctx.state.organization;
+        const locale = await resolveLocale(undefined, ctx.get('Accept-Language') || undefined, org.defaultLocale);
+        const t = getTranslationFunction(locale, org.slug);
+        const csrfToken = generateCsrfToken();
+        setCsrfCookie(ctx, csrfToken);
+        const context = {
+            ...buildBaseContext(ctx, locale, csrfToken, org.slug),
+            t,
+            interaction: {
+                uid: interaction.uid,
+                prompt: 'two-factor',
+                params: {},
+                client: { clientName: '' },
+            },
+            method: pending.method,
+            maskedEmail: maskEmail(pending.email),
+            showResend: pending.method === 'email',
+            showRecoveryLink: true,
+        };
+        await renderAndRespond(ctx, 'two-factor-verify', context);
+    }
+    catch {
+        logger.error({ event: 'two-factor-page-failed' }, 'Two-factor page rendering failed');
+        ctx.status = 400;
+        ctx.body = 'Interaction expired';
+    }
+}
+/**
+ * Verify a 2FA code submission.
+ *
+ * Supports OTP (email), TOTP (authenticator), and recovery codes.
+ * On success: records login and finishes the OIDC interaction.
+ * On failure: re-renders the verification page with an error.
+ *
+ * @param ctx - Koa context
+ * @param provider - OIDC provider instance
+ */
+async function verifyTwoFactor(ctx, provider) {
+    const body = ctx.request.body;
+    const code = (body.code ?? '').trim();
+    const codeType = body.codeType ?? 'otp'; // 'otp', 'totp', or 'recovery'
+    const submittedCsrf = body._csrf ?? '';
+    const storedCsrf = getCsrfFromCookie(ctx) ?? '';
+    try {
+        const interaction = await provider.interactionDetails(ctx.req, ctx.res);
+        // Resolve organization from the interaction's client_id.
+        // 2FA routes don't go through the tenant resolver middleware.
+        await resolveOrganizationForInteraction(ctx, interaction.params.client_id, interaction.uid);
+        const org = ctx.state.organization;
+        const pending = getPendingTwoFactor(interaction);
+        if (!pending) {
+            ctx.redirect(`/interaction/${interaction.uid}`);
+            return;
+        }
+        const locale = await resolveLocale(undefined, ctx.get('Accept-Language') || undefined, org.defaultLocale);
+        const t = getTranslationFunction(locale, org.slug);
+        // Verify CSRF token (cookie vs form field)
+        if (!verifyCsrfToken(storedCsrf, submittedCsrf)) {
+            logger.warn({ event: 'two-factor-csrf-rejected' }, 'Two-factor CSRF validation failed');
+            await renderTwoFactorWithError(ctx, interaction.uid, pending, locale, t, t('errors.csrf_invalid'));
+            return;
+        }
+        // Rate limit check — prevent brute force
+        const rateLimitKey = buildRateLimitKey('2fa_verify', org.id, pending.pendingAccountId);
+        const rateLimitResult = await checkRateLimit(rateLimitKey, VERIFY_RATE_LIMIT);
+        if (!rateLimitResult.allowed) {
+            ctx.set('Retry-After', String(rateLimitResult.retryAfter));
+            writeAuditLog({
+                organizationId: org.id,
+                userId: pending.pendingAccountId,
+                eventType: 'rate_limit.2fa_verify',
+                eventCategory: 'security',
+                description: '2FA verification rate limit exceeded',
+                ipAddress: ctx.ip,
+            });
+            await renderTwoFactorWithError(ctx, interaction.uid, pending, locale, t, t('errors.rate_limit_exceeded'), 429);
+            return;
+        }
+        // Validate code is not empty
+        if (!code) {
+            await renderTwoFactorWithError(ctx, interaction.uid, pending, locale, t, t('two-factor.error_code_required'));
+            return;
+        }
+        // Attempt verification based on code type
+        let verified = false;
+        try {
+            if (codeType === 'recovery') {
+                verified = await verifyRecoveryCodeService(pending.pendingAccountId, code);
+            }
+            else if (pending.method === 'totp') {
+                verified = await verifyTotp(pending.pendingAccountId, code);
+            }
+            else {
+                // Email OTP
+                verified = await verifyOtp(pending.pendingAccountId, code);
+            }
+        }
+        catch {
+            // Verification service threw an error (invalid code, expired, exhausted, etc.)
+            logger.debug({ event: 'two-factor-code-rejected', codeType }, 'Two-factor code rejected');
+            verified = false;
+        }
+        if (!verified) {
+            writeAuditLog({
+                organizationId: org.id,
+                userId: pending.pendingAccountId,
+                eventType: '2fa.verify.failed',
+                eventCategory: 'security',
+                description: `2FA verification failed (${codeType})`,
+                ipAddress: ctx.ip,
+            });
+            await renderTwoFactorWithError(ctx, interaction.uid, pending, locale, t, t('two-factor.error_invalid_code'));
+            return;
+        }
+        // 2FA verified successfully — complete login
+        await recordLogin(pending.pendingAccountId);
+        writeAuditLog({
+            organizationId: org.id,
+            userId: pending.pendingAccountId,
+            eventType: '2fa.verify.success',
+            eventCategory: 'authentication',
+            description: `2FA verification successful (${codeType})`,
+            ipAddress: ctx.ip,
+        });
+        // Finish the OIDC interaction with the verified user
+        await provider.interactionFinished(ctx.req, ctx.res, {
+            login: { accountId: pending.pendingAccountId },
+        }, { mergeWithLastSubmission: false });
+    }
+    catch {
+        logger.error({ event: 'two-factor-verification-failed' }, 'Two-factor verification failed');
+        ctx.status = 400;
+        ctx.body = 'Interaction expired';
+    }
+}
+/**
+ * Resend an OTP code via email (rate-limited).
+ *
+ * Only available for the 'email' 2FA method. Generates a new code
+ * and sends it, then redirects back to the verification page.
+ *
+ * @param ctx - Koa context
+ * @param provider - OIDC provider instance
+ */
+async function resendOtpCode(ctx, provider) {
+    try {
+        const interaction = await provider.interactionDetails(ctx.req, ctx.res);
+        // Resolve organization from the interaction's client_id.
+        // 2FA routes don't go through the tenant resolver middleware.
+        await resolveOrganizationForInteraction(ctx, interaction.params.client_id, interaction.uid);
+        const org = ctx.state.organization;
+        const pending = getPendingTwoFactor(interaction);
+        if (!pending || pending.method !== 'email') {
+            ctx.redirect(`/interaction/${interaction.uid}/two-factor`);
+            return;
+        }
+        // Rate limit check for resend
+        const rateLimitKey = buildRateLimitKey('2fa_resend', org.id, pending.pendingAccountId);
+        const rateLimitResult = await checkRateLimit(rateLimitKey, RESEND_RATE_LIMIT);
+        if (!rateLimitResult.allowed) {
+            ctx.set('Retry-After', String(rateLimitResult.retryAfter));
+            // Redirect back — the page will show the rate limit naturally
+            ctx.redirect(`/interaction/${interaction.uid}/two-factor`);
+            return;
+        }
+        const locale = await resolveLocale(undefined, ctx.get('Accept-Language') || undefined, org.defaultLocale);
+        // Generate and send new OTP code
+        try {
+            const otpCode = await sendOtpCode(pending.pendingAccountId, pending.email, org.id);
+            const user = await findUserById(pending.pendingAccountId);
+            sendOtpCodeEmail({
+                id: pending.pendingAccountId,
+                email: pending.email,
+                givenName: user?.givenName,
+                familyName: user?.familyName,
+            }, {
+                id: org.id,
+                slug: org.slug,
+                brandingLogoUrl: org.brandingLogoUrl,
+                brandingPrimaryColor: org.brandingPrimaryColor,
+                brandingCompanyName: org.brandingCompanyName,
+            }, otpCode, 10, locale);
+        }
+        catch {
+            logger.warn({ event: 'two-factor-otp-resend-failed' }, 'OTP resend failed');
+        }
+        writeAuditLog({
+            organizationId: org.id,
+            userId: pending.pendingAccountId,
+            eventType: '2fa.otp.resent',
+            eventCategory: 'authentication',
+            description: 'OTP code resent',
+            ipAddress: ctx.ip,
+        });
+        ctx.redirect(`/interaction/${interaction.uid}/two-factor`);
+    }
+    catch {
+        logger.error({ event: 'two-factor-resend-failed' }, 'Two-factor resend failed');
+        ctx.status = 400;
+        ctx.body = 'Interaction expired';
+    }
+}
+/**
+ * Show the 2FA setup page (for users who need to enroll).
+ *
+ * When an org requires 2FA but the user hasn't enrolled, this page
+ * shows the TOTP QR code or email OTP setup option.
+ *
+ * @param ctx - Koa context
+ * @param provider - OIDC provider instance
+ */
+async function showTwoFactorSetup(ctx, provider) {
+    try {
+        const interaction = await provider.interactionDetails(ctx.req, ctx.res);
+        // Resolve organization from the interaction's client_id.
+        // 2FA routes don't go through the tenant resolver middleware.
+        await resolveOrganizationForInteraction(ctx, interaction.params.client_id, interaction.uid);
+        const pending = getPendingTwoFactor(interaction);
+        if (!pending) {
+            ctx.redirect(`/interaction/${interaction.uid}`);
+            return;
+        }
+        const org = ctx.state.organization;
+        const locale = await resolveLocale(undefined, ctx.get('Accept-Language') || undefined, org.defaultLocale);
+        const t = getTranslationFunction(locale, org.slug);
+        const csrfToken = generateCsrfToken();
+        setCsrfCookie(ctx, csrfToken);
+        // Check for existing pending TOTP setup (avoids regenerating on page reload/error retry)
+        const existingSetup = await getPendingTotpSetupInfo(pending.pendingAccountId, pending.email, org.slug);
+        let qrCodeDataUri;
+        let totpSecret;
+        let recoveryCodes;
+        if (existingSetup) {
+            // Reuse existing pending setup — don't regenerate the secret
+            qrCodeDataUri = existingSetup.qrCodeDataUri;
+            totpSecret = existingSetup.totpUri?.split('secret=')[1]?.split('&')[0] ?? '';
+        }
+        else {
+            // No pending setup — generate a fresh one
+            const setupResult = await setupTotp(pending.pendingAccountId, pending.email, org.slug);
+            qrCodeDataUri = setupResult.qrCodeDataUri;
+            totpSecret = setupResult.totpUri?.split('secret=')[1]?.split('&')[0] ?? '';
+            recoveryCodes = setupResult.recoveryCodes;
+        }
+        // Check for error indicator from failed verification redirect
+        const errorParam = ctx.query.error ?? '';
+        const context = {
+            ...buildBaseContext(ctx, locale, csrfToken, org.slug),
+            t,
+            interaction: {
+                uid: interaction.uid,
+                prompt: 'two-factor-setup',
+                params: {},
+                client: { clientName: '' },
+            },
+            method: 'totp',
+            qrCodeDataUri,
+            totpSecret,
+            recoveryCodes,
+            flash: errorParam === 'invalid_code' ? { error: t('two-factor.error_invalid_code') } : undefined,
+        };
+        await renderAndRespond(ctx, 'two-factor-setup', context);
+    }
+    catch {
+        logger.error({ event: 'two-factor-setup-page-failed' }, 'Two-factor setup page failed');
+        ctx.status = 400;
+        ctx.body = 'Interaction expired';
+    }
+}
+/**
+ * Process 2FA setup confirmation.
+ *
+ * Verifies the user's first TOTP code to confirm enrollment.
+ * On success: enables 2FA and completes the login.
+ * On failure: re-renders the setup page with an error.
+ *
+ * @param ctx - Koa context
+ * @param provider - OIDC provider instance
+ */
+async function processTwoFactorSetup(ctx, provider) {
+    const body = ctx.request.body;
+    const code = (body.code ?? '').trim();
+    const submittedCsrf = body._csrf ?? '';
+    const storedCsrf = getCsrfFromCookie(ctx) ?? '';
+    // setupMethod determines whether to use TOTP or email OTP for setup
+    const setupMethod = body.setupMethod ?? 'totp';
+    try {
+        const interaction = await provider.interactionDetails(ctx.req, ctx.res);
+        // Resolve organization from the interaction's client_id.
+        // 2FA routes don't go through the tenant resolver middleware.
+        await resolveOrganizationForInteraction(ctx, interaction.params.client_id, interaction.uid);
+        const org = ctx.state.organization;
+        const pending = getPendingTwoFactor(interaction);
+        if (!pending) {
+            ctx.redirect(`/interaction/${interaction.uid}`);
+            return;
+        }
+        const locale = await resolveLocale(undefined, ctx.get('Accept-Language') || undefined, org.defaultLocale);
+        // Verify CSRF token
+        if (!verifyCsrfToken(storedCsrf, submittedCsrf)) {
+            logger.warn({ event: 'two-factor-setup-csrf-rejected' }, 'Two-factor setup CSRF failed');
+            // Redirect back to setup to try again
+            ctx.redirect(`/interaction/${interaction.uid}/two-factor/setup`);
+            return;
+        }
+        if (setupMethod === 'email') {
+            // Email OTP setup — just enable it (no confirmation code needed)
+            await setupEmailOtp(pending.pendingAccountId, org.id);
+            writeAuditLog({
+                organizationId: org.id,
+                userId: pending.pendingAccountId,
+                eventType: '2fa.setup.email.complete',
+                eventCategory: 'authentication',
+                description: '2FA email OTP setup completed during login',
+                ipAddress: ctx.ip,
+            });
+            // Now send the first OTP and redirect to verification
+            try {
+                const otpCode = await sendOtpCode(pending.pendingAccountId, pending.email, org.id);
+                const user = await findUserById(pending.pendingAccountId);
+                sendOtpCodeEmail({
+                    id: pending.pendingAccountId,
+                    email: pending.email,
+                    givenName: user?.givenName,
+                    familyName: user?.familyName,
+                }, {
+                    id: org.id,
+                    slug: org.slug,
+                    brandingLogoUrl: org.brandingLogoUrl,
+                    brandingPrimaryColor: org.brandingPrimaryColor,
+                    brandingCompanyName: org.brandingCompanyName,
+                }, otpCode, 10, locale);
+            }
+            catch {
+                logger.warn({ event: 'two-factor-setup-otp-failed' }, 'Setup OTP delivery failed');
+            }
+            // Update the interaction pending method to email
+            await provider.interactionResult(ctx.req, ctx.res, {
+                twoFactor: { ...pending, method: 'email' },
+            }, { mergeWithLastSubmission: true });
+            ctx.redirect(`/interaction/${interaction.uid}/two-factor`);
+            return;
+        }
+        // TOTP setup confirmation — verify the code from authenticator app
+        if (!code) {
+            ctx.redirect(`/interaction/${interaction.uid}/two-factor/setup`);
+            return;
+        }
+        const confirmed = await confirmTotpSetup(pending.pendingAccountId, code);
+        if (!confirmed) {
+            writeAuditLog({
+                organizationId: org.id,
+                userId: pending.pendingAccountId,
+                eventType: '2fa.setup.totp.failed',
+                eventCategory: 'security',
+                description: 'TOTP setup confirmation failed — invalid code',
+                ipAddress: ctx.ip,
+            });
+            // Redirect back to setup with error indicator
+            ctx.redirect(`/interaction/${interaction.uid}/two-factor/setup?error=invalid_code`);
+            return;
+        }
+        // TOTP setup confirmed — complete login
+        await recordLogin(pending.pendingAccountId);
+        writeAuditLog({
+            organizationId: org.id,
+            userId: pending.pendingAccountId,
+            eventType: '2fa.setup.totp.complete',
+            eventCategory: 'authentication',
+            description: '2FA TOTP setup and login completed',
+            ipAddress: ctx.ip,
+        });
+        await provider.interactionFinished(ctx.req, ctx.res, {
+            login: { accountId: pending.pendingAccountId },
+        }, { mergeWithLastSubmission: false });
+    }
+    catch {
+        logger.error({ event: 'two-factor-setup-failed' }, 'Two-factor setup failed');
+        ctx.status = 400;
+        ctx.body = 'Interaction expired';
+    }
+}
+// ---------------------------------------------------------------------------
+// Helper: render 2FA verify page with error
+// ---------------------------------------------------------------------------
+/**
+ * Render the 2FA verification page with an error flash message.
+ *
+ * @param ctx - Koa context
+ * @param uid - Interaction UID
+ * @param pending - Pending 2FA state
+ * @param locale - Resolved locale
+ * @param t - Translation function
+ * @param errorMessage - Error to display
+ * @param statusCode - HTTP status (default: 200)
+ */
+async function renderTwoFactorWithError(ctx, uid, pending, locale, t, errorMessage, statusCode = 200) {
+    const csrfToken = generateCsrfToken();
+    setCsrfCookie(ctx, csrfToken);
+    const context = {
+        ...buildBaseContext(ctx, locale, csrfToken, ctx.state.organization.slug),
+        t,
+        interaction: {
+            uid,
+            prompt: 'two-factor',
+            params: {},
+            client: { clientName: '' },
+        },
+        method: pending.method,
+        maskedEmail: maskEmail(pending.email),
+        showResend: pending.method === 'email',
+        showRecoveryLink: true,
+        flash: { error: errorMessage },
+    };
+    await renderAndRespond(ctx, 'two-factor-verify', context, statusCode);
+}
+//# sourceMappingURL=two-factor.js.map

package/dist/routes/two-factor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"two-factor.js","sourceRoot":"","sources":["../../src/routes/two-factor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,MAAM,MAAM,aAAa,CAAC;AAGjC,OAAO,EACL,iBAAiB,EACjB,eAAe,EACf,aAAa,EACb,iBAAiB,GAClB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAwB,MAAM,yBAAyB,CAAC;AAClG,OAAO,EAAE,aAAa,EAAE,sBAAsB,EAAE,MAAM,iBAAiB,CAAC;AACxE,OAAO,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAC;AAExD,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAC5D,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AACtD,OAAO,EACL,SAAS,EACT,UAAU,EACV,kBAAkB,IAAI,yBAAyB,EAC/C,WAAW,EACX,SAAS,EACT,uBAAuB,EACvB,aAAa,EACb,gBAAgB,GACjB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAE1C,OAAO,EAAE,iCAAiC,EAAE,MAAM,mBAAmB,CAAC;AAqBtE,8EAA8E;AAC9E,YAAY;AACZ,8EAA8E;AAE9E,mEAAmE;AACnE,MAAM,iBAAiB,GAAoB,EAAE,GAAG,EAAE,CAAC,EAAE,aAAa,EAAE,GAAG,EAAE,CAAC;AAE1E,oDAAoD;AACpD,MAAM,iBAAiB,GAAoB,EAAE,GAAG,EAAE,CAAC,EAAE,aAAa,EAAE,GAAG,EAAE,CAAC;AAE1E,8EAA8E;AAC9E,UAAU;AACV,8EAA8E;AAE9E;;;;;GAKG;AACH,SAAS,oBAAoB,CAAC,GAAiB;IAC7C,OAAO;QACL,OAAO,EAAE,GAAG,CAAC,eAAe;QAC5B,UAAU,EAAE,GAAG,CAAC,kBAAkB;QAClC,YAAY,EAAE,GAAG,CAAC,oBAAoB,IAAI,SAAS;QACnD,WAAW,EAAE,GAAG,CAAC,mBAAmB,IAAI,GAAG,CAAC,IAAI;QAChD,SAAS,EAAE,GAAG,CAAC,iBAAiB;KACjC,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,gBAAgB,CACvB,GAAqB,EACrB,MAAc,EACd,SAAiB,EACjB,OAAe;IAEf,OAAO;QACL,QAAQ,EAAE,oBAAoB,CAAC,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC;QACtD,MAAM;QACN,SAAS;QACT,OAAO;KACR,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,KAAK,UAAU,gBAAgB,CAC7B,GAAY,EACZ,QAAgB,EAChB,OAAwB,EACxB,UAAU,GAAG,GAAG;IAEhB,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IACjD,GAAG,CAAC,MAAM,GAAG,UAAU,CAAC;IACxB,GAAG,CAAC,IAAI,GAAG,WAAW,CAAC;IACvB,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC;AAClB,CAAC;AAED;;;;;;GAMG;AACH,SAAS,SAAS,CAAC,KAAa;IAC9B,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACzC,IAAI,CAAC,KAAK,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IACxC,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC;QAAE,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,OAAO,MAAM,EAAE,CAAC;IACzD,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,MAAM,EAAE,CAAC;AAC9D,CAAC;AAED;;;;;;GAMG;AACH,SAAS,mBAAmB,CAAC,WAE5B;IACC,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,CAAC;IAClC,IAAI,CAAC,MAAM,EAAE,SAAS;QAAE,OAAO,IAAI,CAAC;IACpC,MAAM,EAAE,GAAG,MAAM,CAAC,SAA6B,CAAC;IAChD,IAAI,CAAC,EAAE,CAAC,gBAAgB,IAAI,CAAC,EAAE,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACjE,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,8EAA8E;AAC9E,iBAAiB;AACjB,8EAA8E;AAE9E;;;;;;;;GAQG;AACH,MAAM,UAAU,qBAAqB,CAAC,QAAkB;IACtD,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC,CAAC;IAEtD,gEAAgE;IAChE,MAAM,CAAC,GAAG,CAAC,kBAAkB,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QAC3C,MAAM,aAAa,CAAC,GAAuB,EAAE,QAAQ,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;IAEH,sDAAsD;IACtD,MAAM,CAAC,IAAI,CAAC,kBAAkB,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QAC5C,MAAM,eAAe,CAAC,GAAuB,EAAE,QAAQ,CAAC,CAAC;IAC3D,CAAC,CAAC,CAAC;IAEH,6DAA6D;IAC7D,MAAM,CAAC,IAAI,CAAC,yBAAyB,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QACnD,MAAM,aAAa,CAAC,GAAuB,EAAE,QAAQ,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;IAEH,+DAA+D;IAC/D,MAAM,CAAC,GAAG,CAAC,wBAAwB,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QACjD,MAAM,kBAAkB,CAAC,GAAuB,EAAE,QAAQ,CAAC,CAAC;IAC9D,CAAC,CAAC,CAAC;IAEH,8DAA8D;IAC9D,MAAM,CAAC,IAAI,CAAC,wBAAwB,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QAClD,MAAM,qBAAqB,CAAC,GAAuB,EAAE,QAAQ,CAAC,CAAC;IACjE,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,8EAA8E;AAC9E,iBAAiB;AACjB,8EAA8E;AAE9E;;;;;;;;GAQG;AACH,KAAK,UAAU,aAAa,CAAC,GAAqB,EAAE,QAAkB;IACpE,IAAI,CAAC;QACH,MAAM,WAAW,GAAG,MAAM,QAAQ,CAAC,kBAAkB,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;QAExE,yDAAyD;QACzD,8DAA8D;QAC9D,8DAA8D;QAC9D,MAAM,iCAAiC,CACrC,GAAG,EACH,WAAW,CAAC,MAAM,CAAC,SAAmB,EACtC,WAAW,CAAC,GAAG,CAChB,CAAC;QAEF,MAAM,OAAO,GAAG,mBAAmB,CAAC,WAAW,CAAC,CAAC;QAEjD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,0CAA0C;YAC1C,GAAG,CAAC,QAAQ,CAAC,gBAAgB,WAAW,CAAC,GAAG,EAAE,CAAC,CAAC;YAChD,OAAO;QACT,CAAC;QAED,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC;QACnC,MAAM,MAAM,GAAG,MAAM,aAAa,CAChC,SAAS,EACT,GAAG,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,SAAS,EACvC,GAAG,CAAC,aAAa,CAClB,CAAC;QACF,MAAM,CAAC,GAAG,sBAAsB,CAAC,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;QACnD,MAAM,SAAS,GAAG,iBAAiB,EAAE,CAAC;QACtC,aAAa,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QAE9B,MAAM,OAAO,GAAoB;YAC/B,GAAG,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,CAAC,IAAI,CAAC;YACrD,CAAC;YACD,WAAW,EAAE;gBACX,GAAG,EAAE,WAAW,CAAC,GAAG;gBACpB,MAAM,EAAE,YAAY;gBACpB,MAAM,EAAE,EAA6B;gBACrC,MAAM,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE;aAC3B;YACD,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,WAAW,EAAE,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC;YACrC,UAAU,EAAE,OAAO,CAAC,MAAM,KAAK,OAAO;YACtC,gBAAgB,EAAE,IAAI;SACvB,CAAC;QAEF,MAAM,gBAAgB,CAAC,GAAG,EAAE,mBAAmB,EAAE,OAAO,CAAC,CAAC;IAC5D,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,wBAAwB,EAAE,EAAE,kCAAkC,CAAC,CAAC;QACtF,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;QACjB,GAAG,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACnC,CAAC;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,KAAK,UAAU,eAAe,CAAC,GAAqB,EAAE,QAAkB;IACtE,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,IAA8B,CAAC;IACxD,MAAM,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACtC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,KAAK,CAAC,CAAC,+BAA+B;IACxE,MAAM,aAAa,GAAG,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;IACvC,MAAM,UAAU,GAAG,iBAAiB,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;IAEhD,IAAI,CAAC;QACH,MAAM,WAAW,GAAG,MAAM,QAAQ,CAAC,kBAAkB,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;QAExE,yDAAyD;QACzD,8DAA8D;QAC9D,MAAM,iCAAiC,CACrC,GAAG,EACH,WAAW,CAAC,MAAM,CAAC,SAAmB,EACtC,WAAW,CAAC,GAAG,CAChB,CAAC;QACF,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC;QAEnC,MAAM,OAAO,GAAG,mBAAmB,CAAC,WAAW,CAAC,CAAC;QAEjD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,GAAG,CAAC,QAAQ,CAAC,gBAAgB,WAAW,CAAC,GAAG,EAAE,CAAC,CAAC;YAChD,OAAO;QACT,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,aAAa,CAChC,SAAS,EACT,GAAG,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,SAAS,EACvC,GAAG,CAAC,aAAa,CAClB,CAAC;QACF,MAAM,CAAC,GAAG,sBAAsB,CAAC,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;QAEnD,2CAA2C;QAC3C,IAAI,CAAC,eAAe,CAAC,UAAU,EAAE,aAAa,CAAC,EAAE,CAAC;YAChD,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,0BAA0B,EAAE,EAAE,mCAAmC,CAAC,CAAC;YACxF,MAAM,wBAAwB,CAC5B,GAAG,EACH,WAAW,CAAC,GAAG,EACf,OAAO,EACP,MAAM,EACN,CAAC,EACD,CAAC,CAAC,qBAAqB,CAAC,CACzB,CAAC;YACF,OAAO;QACT,CAAC;QAED,yCAAyC;QACzC,MAAM,YAAY,GAAG,iBAAiB,CAAC,YAAY,EAAE,GAAG,CAAC,EAAE,EAAE,OAAO,CAAC,gBAAgB,CAAC,CAAC;QACvF,MAAM,eAAe,GAAG,MAAM,cAAc,CAAC,YAAY,EAAE,iBAAiB,CAAC,CAAC;QAE9E,IAAI,CAAC,eAAe,CAAC,OAAO,EAAE,CAAC;YAC7B,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,MAAM,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC,CAAC;YAC3D,aAAa,CAAC;gBACZ,cAAc,EAAE,GAAG,CAAC,EAAE;gBACtB,MAAM,EAAE,OAAO,CAAC,gBAAgB;gBAChC,SAAS,EAAE,uBAAuB;gBAClC,aAAa,EAAE,UAAU;gBACzB,WAAW,EAAE,sCAAsC;gBACnD,SAAS,EAAE,GAAG,CAAC,EAAE;aAClB,CAAC,CAAC;YACH,MAAM,wBAAwB,CAC5B,GAAG,EACH,WAAW,CAAC,GAAG,EACf,OAAO,EACP,MAAM,EACN,CAAC,EACD,CAAC,CAAC,4BAA4B,CAAC,EAC/B,GAAG,CACJ,CAAC;YACF,OAAO;QACT,CAAC;QAED,6BAA6B;QAC7B,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,wBAAwB,CAC5B,GAAG,EACH,WAAW,CAAC,GAAG,EACf,OAAO,EACP,MAAM,EACN,CAAC,EACD,CAAC,CAAC,gCAAgC,CAAC,CACpC,CAAC;YACF,OAAO;QACT,CAAC;QAED,0CAA0C;QAC1C,IAAI,QAAQ,GAAG,KAAK,CAAC;QACrB,IAAI,CAAC;YACH,IAAI,QAAQ,KAAK,UAAU,EAAE,CAAC;gBAC5B,QAAQ,GAAG,MAAM,yBAAyB,CAAC,OAAO,CAAC,gBAAgB,EAAE,IAAI,CAAC,CAAC;YAC7E,CAAC;iBAAM,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBACrC,QAAQ,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,gBAAgB,EAAE,IAAI,CAAC,CAAC;YAC9D,CAAC;iBAAM,CAAC;gBACN,YAAY;gBACZ,QAAQ,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,gBAAgB,EAAE,IAAI,CAAC,CAAC;YAC7D,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,+EAA+E;YAC/E,MAAM,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,0BAA0B,EAAE,QAAQ,EAAE,EAAE,0BAA0B,CAAC,CAAC;YAC1F,QAAQ,GAAG,KAAK,CAAC;QACnB,CAAC;QAED,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,aAAa,CAAC;gBACZ,cAAc,EAAE,GAAG,CAAC,EAAE;gBACtB,MAAM,EAAE,OAAO,CAAC,gBAAgB;gBAChC,SAAS,EAAE,mBAAmB;gBAC9B,aAAa,EAAE,UAAU;gBACzB,WAAW,EAAE,4BAA4B,QAAQ,GAAG;gBACpD,SAAS,EAAE,GAAG,CAAC,EAAE;aAClB,CAAC,CAAC;YACH,MAAM,wBAAwB,CAC5B,GAAG,EACH,WAAW,CAAC,GAAG,EACf,OAAO,EACP,MAAM,EACN,CAAC,EACD,CAAC,CAAC,+BAA+B,CAAC,CACnC,CAAC;YACF,OAAO;QACT,CAAC;QAED,6CAA6C;QAC7C,MAAM,WAAW,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;QAE5C,aAAa,CAAC;YACZ,cAAc,EAAE,GAAG,CAAC,EAAE;YACtB,MAAM,EAAE,OAAO,CAAC,gBAAgB;YAChC,SAAS,EAAE,oBAAoB;YAC/B,aAAa,EAAE,gBAAgB;YAC/B,WAAW,EAAE,gCAAgC,QAAQ,GAAG;YACxD,SAAS,EAAE,GAAG,CAAC,EAAE;SAClB,CAAC,CAAC;QAEH,qDAAqD;QACrD,MAAM,QAAQ,CAAC,mBAAmB,CAChC,GAAG,CAAC,GAAG,EACP,GAAG,CAAC,GAAG,EACP;YACE,KAAK,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,gBAAgB,EAAE;SAC/C,EACD,EAAE,uBAAuB,EAAE,KAAK,EAAE,CACnC,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,gCAAgC,EAAE,EAAE,gCAAgC,CAAC,CAAC;QAC5F,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;QACjB,GAAG,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACnC,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,KAAK,UAAU,aAAa,CAAC,GAAqB,EAAE,QAAkB;IACpE,IAAI,CAAC;QACH,MAAM,WAAW,GAAG,MAAM,QAAQ,CAAC,kBAAkB,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;QAExE,yDAAyD;QACzD,8DAA8D;QAC9D,MAAM,iCAAiC,CACrC,GAAG,EACH,WAAW,CAAC,MAAM,CAAC,SAAmB,EACtC,WAAW,CAAC,GAAG,CAChB,CAAC;QACF,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC;QAEnC,MAAM,OAAO,GAAG,mBAAmB,CAAC,WAAW,CAAC,CAAC;QAEjD,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;YAC3C,GAAG,CAAC,QAAQ,CAAC,gBAAgB,WAAW,CAAC,GAAG,aAAa,CAAC,CAAC;YAC3D,OAAO;QACT,CAAC;QAED,8BAA8B;QAC9B,MAAM,YAAY,GAAG,iBAAiB,CAAC,YAAY,EAAE,GAAG,CAAC,EAAE,EAAE,OAAO,CAAC,gBAAgB,CAAC,CAAC;QACvF,MAAM,eAAe,GAAG,MAAM,cAAc,CAAC,YAAY,EAAE,iBAAiB,CAAC,CAAC;QAE9E,IAAI,CAAC,eAAe,CAAC,OAAO,EAAE,CAAC;YAC7B,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,MAAM,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC,CAAC;YAC3D,8DAA8D;YAC9D,GAAG,CAAC,QAAQ,CAAC,gBAAgB,WAAW,CAAC,GAAG,aAAa,CAAC,CAAC;YAC3D,OAAO;QACT,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,aAAa,CAChC,SAAS,EACT,GAAG,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,SAAS,EACvC,GAAG,CAAC,aAAa,CAClB,CAAC;QAEF,iCAAiC;QACjC,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,gBAAgB,EAAE,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;YACnF,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;YAC1D,gBAAgB,CACd;gBACE,EAAE,EAAE,OAAO,CAAC,gBAAgB;gBAC5B,KAAK,EAAE,OAAO,CAAC,KAAK;gBACpB,SAAS,EAAE,IAAI,EAAE,SAAS;gBAC1B,UAAU,EAAE,IAAI,EAAE,UAAU;aAC7B,EACD;gBACE,EAAE,EAAE,GAAG,CAAC,EAAE;gBACV,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,eAAe,EAAE,GAAG,CAAC,eAAe;gBACpC,oBAAoB,EAAE,GAAG,CAAC,oBAAoB;gBAC9C,mBAAmB,EAAE,GAAG,CAAC,mBAAmB;aAC7C,EACD,OAAO,EACP,EAAE,EACF,MAAM,CACP,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,8BAA8B,EAAE,EAAE,mBAAmB,CAAC,CAAC;QAC9E,CAAC;QAED,aAAa,CAAC;YACZ,cAAc,EAAE,GAAG,CAAC,EAAE;YACtB,MAAM,EAAE,OAAO,CAAC,gBAAgB;YAChC,SAAS,EAAE,gBAAgB;YAC3B,aAAa,EAAE,gBAAgB;YAC/B,WAAW,EAAE,iBAAiB;YAC9B,SAAS,EAAE,GAAG,CAAC,EAAE;SAClB,CAAC,CAAC;QAEH,GAAG,CAAC,QAAQ,CAAC,gBAAgB,WAAW,CAAC,GAAG,aAAa,CAAC,CAAC;IAC7D,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,0BAA0B,EAAE,EAAE,0BAA0B,CAAC,CAAC;QAChF,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;QACjB,GAAG,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACnC,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,KAAK,UAAU,kBAAkB,CAAC,GAAqB,EAAE,QAAkB;IACzE,IAAI,CAAC;QACH,MAAM,WAAW,GAAG,MAAM,QAAQ,CAAC,kBAAkB,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;QAExE,yDAAyD;QACzD,8DAA8D;QAC9D,MAAM,iCAAiC,CACrC,GAAG,EACH,WAAW,CAAC,MAAM,CAAC,SAAmB,EACtC,WAAW,CAAC,GAAG,CAChB,CAAC;QAEF,MAAM,OAAO,GAAG,mBAAmB,CAAC,WAAW,CAAC,CAAC;QAEjD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,GAAG,CAAC,QAAQ,CAAC,gBAAgB,WAAW,CAAC,GAAG,EAAE,CAAC,CAAC;YAChD,OAAO;QACT,CAAC;QAED,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC;QACnC,MAAM,MAAM,GAAG,MAAM,aAAa,CAChC,SAAS,EACT,GAAG,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,SAAS,EACvC,GAAG,CAAC,aAAa,CAClB,CAAC;QACF,MAAM,CAAC,GAAG,sBAAsB,CAAC,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;QACnD,MAAM,SAAS,GAAG,iBAAiB,EAAE,CAAC;QACtC,aAAa,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QAE9B,yFAAyF;QACzF,MAAM,aAAa,GAAG,MAAM,uBAAuB,CACjD,OAAO,CAAC,gBAAgB,EACxB,OAAO,CAAC,KAAK,EACb,GAAG,CAAC,IAAI,CACT,CAAC;QAEF,IAAI,aAAqB,CAAC;QAC1B,IAAI,UAAkB,CAAC;QACvB,IAAI,aAAmC,CAAC;QAExC,IAAI,aAAa,EAAE,CAAC;YAClB,6DAA6D;YAC7D,aAAa,GAAG,aAAa,CAAC,aAAa,CAAC;YAC5C,UAAU,GAAG,aAAa,CAAC,OAAO,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC/E,CAAC;aAAM,CAAC;YACN,0CAA0C;YAC1C,MAAM,WAAW,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,gBAAgB,EAAE,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;YACvF,aAAa,GAAG,WAAW,CAAC,aAAc,CAAC;YAC3C,UAAU,GAAG,WAAW,CAAC,OAAO,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAC3E,aAAa,GAAG,WAAW,CAAC,aAAa,CAAC;QAC5C,CAAC;QAED,8DAA8D;QAC9D,MAAM,UAAU,GAAI,GAAG,CAAC,KAAK,CAAC,KAAgB,IAAI,EAAE,CAAC;QAErD,MAAM,OAAO,GAAoB;YAC/B,GAAG,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,CAAC,IAAI,CAAC;YACrD,CAAC;YACD,WAAW,EAAE;gBACX,GAAG,EAAE,WAAW,CAAC,GAAG;gBACpB,MAAM,EAAE,kBAAkB;gBAC1B,MAAM,EAAE,EAA6B;gBACrC,MAAM,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE;aAC3B;YACD,MAAM,EAAE,MAAM;YACd,aAAa;YACb,UAAU;YACV,aAAa;YACb,KAAK,EACH,UAAU,KAAK,cAAc,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,+BAA+B,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS;SAC5F,CAAC;QAEF,MAAM,gBAAgB,CAAC,GAAG,EAAE,kBAAkB,EAAE,OAAO,CAAC,CAAC;IAC3D,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,8BAA8B,EAAE,EAAE,8BAA8B,CAAC,CAAC;QACxF,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;QACjB,GAAG,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACnC,CAAC;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,KAAK,UAAU,qBAAqB,CAAC,GAAqB,EAAE,QAAkB;IAC5E,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,IAA8B,CAAC;IACxD,MAAM,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACtC,MAAM,aAAa,GAAG,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;IACvC,MAAM,UAAU,GAAG,iBAAiB,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;IAChD,oEAAoE;IACpE,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,IAAI,MAAM,CAAC;IAE/C,IAAI,CAAC;QACH,MAAM,WAAW,GAAG,MAAM,QAAQ,CAAC,kBAAkB,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;QAExE,yDAAyD;QACzD,8DAA8D;QAC9D,MAAM,iCAAiC,CACrC,GAAG,EACH,WAAW,CAAC,MAAM,CAAC,SAAmB,EACtC,WAAW,CAAC,GAAG,CAChB,CAAC;QACF,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC;QAEnC,MAAM,OAAO,GAAG,mBAAmB,CAAC,WAAW,CAAC,CAAC;QAEjD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,GAAG,CAAC,QAAQ,CAAC,gBAAgB,WAAW,CAAC,GAAG,EAAE,CAAC,CAAC;YAChD,OAAO;QACT,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,aAAa,CAChC,SAAS,EACT,GAAG,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,SAAS,EACvC,GAAG,CAAC,aAAa,CAClB,CAAC;QAEF,oBAAoB;QACpB,IAAI,CAAC,eAAe,CAAC,UAAU,EAAE,aAAa,CAAC,EAAE,CAAC;YAChD,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gCAAgC,EAAE,EAAE,8BAA8B,CAAC,CAAC;YACzF,sCAAsC;YACtC,GAAG,CAAC,QAAQ,CAAC,gBAAgB,WAAW,CAAC,GAAG,mBAAmB,CAAC,CAAC;YACjE,OAAO;QACT,CAAC;QAED,IAAI,WAAW,KAAK,OAAO,EAAE,CAAC;YAC5B,iEAAiE;YACjE,MAAM,aAAa,CAAC,OAAO,CAAC,gBAAgB,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;YAEtD,aAAa,CAAC;gBACZ,cAAc,EAAE,GAAG,CAAC,EAAE;gBACtB,MAAM,EAAE,OAAO,CAAC,gBAAgB;gBAChC,SAAS,EAAE,0BAA0B;gBACrC,aAAa,EAAE,gBAAgB;gBAC/B,WAAW,EAAE,4CAA4C;gBACzD,SAAS,EAAE,GAAG,CAAC,EAAE;aAClB,CAAC,CAAC;YAEH,sDAAsD;YACtD,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,gBAAgB,EAAE,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;gBACnF,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;gBAC1D,gBAAgB,CACd;oBACE,EAAE,EAAE,OAAO,CAAC,gBAAgB;oBAC5B,KAAK,EAAE,OAAO,CAAC,KAAK;oBACpB,SAAS,EAAE,IAAI,EAAE,SAAS;oBAC1B,UAAU,EAAE,IAAI,EAAE,UAAU;iBAC7B,EACD;oBACE,EAAE,EAAE,GAAG,CAAC,EAAE;oBACV,IAAI,EAAE,GAAG,CAAC,IAAI;oBACd,eAAe,EAAE,GAAG,CAAC,eAAe;oBACpC,oBAAoB,EAAE,GAAG,CAAC,oBAAoB;oBAC9C,mBAAmB,EAAE,GAAG,CAAC,mBAAmB;iBAC7C,EACD,OAAO,EACP,EAAE,EACF,MAAM,CACP,CAAC;YACJ,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,6BAA6B,EAAE,EAAE,2BAA2B,CAAC,CAAC;YACrF,CAAC;YAED,iDAAiD;YACjD,MAAM,QAAQ,CAAC,iBAAiB,CAC9B,GAAG,CAAC,GAAG,EACP,GAAG,CAAC,GAAG,EACP;gBACE,SAAS,EAAE,EAAE,GAAG,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE;aAC3C,EACD,EAAE,uBAAuB,EAAE,IAAI,EAAE,CAClC,CAAC;YAEF,GAAG,CAAC,QAAQ,CAAC,gBAAgB,WAAW,CAAC,GAAG,aAAa,CAAC,CAAC;YAC3D,OAAO;QACT,CAAC;QAED,mEAAmE;QACnE,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,GAAG,CAAC,QAAQ,CAAC,gBAAgB,WAAW,CAAC,GAAG,mBAAmB,CAAC,CAAC;YACjE,OAAO;QACT,CAAC;QAED,MAAM,SAAS,GAAG,MAAM,gBAAgB,CAAC,OAAO,CAAC,gBAAgB,EAAE,IAAI,CAAC,CAAC;QAEzE,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,aAAa,CAAC;gBACZ,cAAc,EAAE,GAAG,CAAC,EAAE;gBACtB,MAAM,EAAE,OAAO,CAAC,gBAAgB;gBAChC,SAAS,EAAE,uBAAuB;gBAClC,aAAa,EAAE,UAAU;gBACzB,WAAW,EAAE,+CAA+C;gBAC5D,SAAS,EAAE,GAAG,CAAC,EAAE;aAClB,CAAC,CAAC;YACH,8CAA8C;YAC9C,GAAG,CAAC,QAAQ,CAAC,gBAAgB,WAAW,CAAC,GAAG,sCAAsC,CAAC,CAAC;YACpF,OAAO;QACT,CAAC;QAED,wCAAwC;QACxC,MAAM,WAAW,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;QAE5C,aAAa,CAAC;YACZ,cAAc,EAAE,GAAG,CAAC,EAAE;YACtB,MAAM,EAAE,OAAO,CAAC,gBAAgB;YAChC,SAAS,EAAE,yBAAyB;YACpC,aAAa,EAAE,gBAAgB;YAC/B,WAAW,EAAE,oCAAoC;YACjD,SAAS,EAAE,GAAG,CAAC,EAAE;SAClB,CAAC,CAAC;QAEH,MAAM,QAAQ,CAAC,mBAAmB,CAChC,GAAG,CAAC,GAAG,EACP,GAAG,CAAC,GAAG,EACP;YACE,KAAK,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,gBAAgB,EAAE;SAC/C,EACD,EAAE,uBAAuB,EAAE,KAAK,EAAE,CACnC,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,yBAAyB,EAAE,EAAE,yBAAyB,CAAC,CAAC;QAC9E,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;QACjB,GAAG,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACnC,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,4CAA4C;AAC5C,8EAA8E;AAE9E;;;;;;;;;;GAUG;AACH,KAAK,UAAU,wBAAwB,CACrC,GAAqB,EACrB,GAAW,EACX,OAAyB,EACzB,MAAc,EACd,CAA6D,EAC7D,YAAoB,EACpB,UAAU,GAAG,GAAG;IAEhB,MAAM,SAAS,GAAG,iBAAiB,EAAE,CAAC;IACtC,aAAa,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IAE9B,MAAM,OAAO,GAAoB;QAC/B,GAAG,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC;QACxE,CAAC;QACD,WAAW,EAAE;YACX,GAAG;YACH,MAAM,EAAE,YAAY;YACpB,MAAM,EAAE,EAA6B;YACrC,MAAM,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE;SAC3B;QACD,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,WAAW,EAAE,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC;QACrC,UAAU,EAAE,OAAO,CAAC,MAAM,KAAK,OAAO;QACtC,gBAAgB,EAAE,IAAI;QACtB,KAAK,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE;KAC/B,CAAC;IAEF,MAAM,gBAAgB,CAAC,GAAG,EAAE,mBAAmB,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC;AACxE,CAAC"}

package/dist/routes/user-roles.d.ts

@@ -0,0 +1,33 @@
+/**
+ * User-role assignment API routes.
+ *
+ * All routes are under `/api/admin/organizations/:orgId/users/:userId/roles`
+ * and require admin authorization with granular permissions. Provides
+ * endpoints for managing role assignments on a per-user basis and
+ * resolving effective permissions.
+ *
+ * Route structure:
+ *   GET    /              — List roles for a user
+ *   PUT    /              — Assign roles to a user
+ *   DELETE /              — Remove roles from a user
+ *   GET    /permissions   — List resolved permissions for a user
+ *
+ * Error mapping:
+ *   RoleNotFoundError → 404
+ *   RbacValidationError → 400
+ *   ZodError → 400 with validation details
+ */
+import Router from '@koa/router';
+/**
+ * Create the user-role assignment router.
+ *
+ * All routes require admin authorization with granular permissions.
+ * User-role assignments are scoped to a user within an organization
+ * via :orgId and :userId URL parameters.
+ *
+ * Prefix: /api/admin/organizations/:orgId/users/:userId/roles
+ *
+ * @returns Configured Koa Router
+ */
+export declare function createUserRoleRouter(): Router;
+//# sourceMappingURL=user-roles.d.ts.map

package/dist/routes/user-roles.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"user-roles.d.ts","sourceRoot":"","sources":["../../src/routes/user-roles.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,MAAM,MAAM,aAAa,CAAC;AAiDjC;;;;;;;;;;GAUG;AACH,wBAAgB,oBAAoB,IAAI,MAAM,CA+E7C"}