@portaidentity/server 1.7.3 → 1.9.0

package/dist/routes/two-factor.js

@@ -21,10 +21,12 @@ import { generateCsrfToken, verifyCsrfToken, setCsrfCookie, getCsrfFromCookie, }
 import { checkRateLimit, buildRateLimitKey } from '../auth/rate-limiter.js';
 import { resolveLocale, getTranslationFunction } from '../auth/i18n.js';
 import { renderPage } from '../auth/template-engine.js';
+import { resolveEffectiveBranding } from '../auth/effective-branding.js';
 import { sendOtpCodeEmail } from '../auth/email-service.js';
 import { recordLogin } from '../users/service.js';
 import { findUserById } from '../users/repository.js';
 import { verifyOtp, verifyTotp, verifyRecoveryCode as verifyRecoveryCodeService, sendOtpCode, setupTotp, getPendingTotpSetupInfo, setupEmailOtp, confirmTotpSetup, } from '../two-factor/service.js';
+import { UnsupportedTotpConfigurationError } from '../two-factor/errors.js';
 import { writeAuditLog } from '../lib/audit-log.js';
 import { logger } from '../lib/logger.js';
 import { resolveOrganizationForInteraction } from './interactions.js';
@@ -38,21 +40,6 @@ const RESEND_RATE_LIMIT = { max: 3, windowSeconds: 300 };
 // ---------------------------------------------------------------------------
 // Helpers
 // ---------------------------------------------------------------------------
-/**
- * Build branding context from organization data.
- *
- * @param org - Organization with branding fields
- * @returns Branding context for templates
- */
-function buildBrandingFromOrg(org) {
-    return {
-        logoUrl: org.brandingLogoUrl,
-        faviconUrl: org.brandingFaviconUrl,
-        primaryColor: org.brandingPrimaryColor ?? '#3B82F6',
-        companyName: org.brandingCompanyName ?? org.name,
-        customCss: org.brandingCustomCss,
-    };
-}
 /**
  * Build a base template context for 2FA pages.
  *
@@ -60,11 +47,11 @@ function buildBrandingFromOrg(org) {
  * @param locale - Resolved locale
  * @param csrfToken - CSRF token for form protection
  * @param orgSlug - Organization slug
- * @returns Base template context
+ * @returns Base template context.
  */
-function buildBaseContext(ctx, locale, csrfToken, orgSlug) {
+async function buildBaseContext(ctx, locale, csrfToken, orgSlug) {
     return {
-        branding: buildBrandingFromOrg(ctx.state.organization),
+        branding: await resolveEffectiveBranding(ctx.state.organization),
         locale,
         csrfToken,
         orgSlug,
@@ -79,6 +66,7 @@ function buildBaseContext(ctx, locale, csrfToken, orgSlug) {
  * @param statusCode - HTTP status (default: 200)
  */
 async function renderAndRespond(ctx, pageName, context, statusCode = 200) {
+    ctx.state.brandingImageSources = context.branding.imageSources;
     const html = await renderPage(pageName, context);
     ctx.status = statusCode;
     ctx.type = 'text/html';
@@ -182,7 +170,7 @@ async function showTwoFactor(ctx, provider) {
         const csrfToken = generateCsrfToken();
         setCsrfCookie(ctx, csrfToken);
         const context = {
-            ...buildBaseContext(ctx, locale, csrfToken, org.slug),
+            ...(await buildBaseContext(ctx, locale, csrfToken, org.slug)),
             t,
             interaction: {
                 uid: interaction.uid,
@@ -216,7 +204,10 @@ async function showTwoFactor(ctx, provider) {
 async function verifyTwoFactor(ctx, provider) {
     const body = ctx.request.body;
     const code = (body.code ?? '').trim();
-    const codeType = body.codeType ?? 'otp'; // 'otp', 'totp', or 'recovery'
+    const submittedCodeType = body.codeType;
+    const codeType = submittedCodeType === 'totp' || submittedCodeType === 'recovery' || submittedCodeType === 'otp'
+        ? submittedCodeType
+        : 'otp';
     const submittedCsrf = body._csrf ?? '';
     const storedCsrf = getCsrfFromCookie(ctx) ?? '';
     try {
@@ -273,7 +264,12 @@ async function verifyTwoFactor(ctx, provider) {
                 verified = await verifyOtp(pending.pendingAccountId, code);
             }
         }
-        catch {
+        catch (error) {
+            if (error instanceof UnsupportedTotpConfigurationError) {
+                logUnsupportedTotpConfiguration();
+                await renderTwoFactorWithError(ctx, interaction.uid, pending, locale, t, t('errors.two_factor_unavailable'), 503);
+                return;
+            }
             // Verification service threw an error (invalid code, expired, exhausted, etc.)
             logger.debug({ event: 'two-factor-code-rejected', codeType }, 'Two-factor code rejected');
             verified = false;
@@ -351,13 +347,7 @@ async function resendOtpCode(ctx, provider) {
                 email: pending.email,
                 givenName: user?.givenName,
                 familyName: user?.familyName,
-            }, {
-                id: org.id,
-                slug: org.slug,
-                brandingLogoUrl: org.brandingLogoUrl,
-                brandingPrimaryColor: org.brandingPrimaryColor,
-                brandingCompanyName: org.brandingCompanyName,
-            }, otpCode, 10, locale);
+            }, org, otpCode, 10, locale);
         }
         catch {
             logger.warn({ event: 'two-factor-otp-resend-failed' }, 'OTP resend failed');
@@ -423,7 +413,7 @@ async function showTwoFactorSetup(ctx, provider) {
         // Check for error indicator from failed verification redirect
         const errorParam = ctx.query.error ?? '';
         const context = {
-            ...buildBaseContext(ctx, locale, csrfToken, org.slug),
+            ...(await buildBaseContext(ctx, locale, csrfToken, org.slug)),
             t,
             interaction: {
                 uid: interaction.uid,
@@ -501,13 +491,7 @@ async function processTwoFactorSetup(ctx, provider) {
                     email: pending.email,
                     givenName: user?.givenName,
                     familyName: user?.familyName,
-                }, {
-                    id: org.id,
-                    slug: org.slug,
-                    brandingLogoUrl: org.brandingLogoUrl,
-                    brandingPrimaryColor: org.brandingPrimaryColor,
-                    brandingCompanyName: org.brandingCompanyName,
-                }, otpCode, 10, locale);
+                }, org, otpCode, 10, locale);
             }
             catch {
                 logger.warn({ event: 'two-factor-setup-otp-failed' }, 'Setup OTP delivery failed');
@@ -519,12 +503,42 @@ async function processTwoFactorSetup(ctx, provider) {
             ctx.redirect(`/interaction/${interaction.uid}/two-factor`);
             return;
         }
+        // TOTP confirmation uses the same attempt budget as normal 2FA verification.
+        // Email setup returns above because it does not verify a user-entered code.
+        const rateLimitKey = buildRateLimitKey('2fa_verify', org.id, pending.pendingAccountId);
+        const rateLimitResult = await checkRateLimit(rateLimitKey, VERIFY_RATE_LIMIT);
+        if (!rateLimitResult.allowed) {
+            ctx.set('Retry-After', String(rateLimitResult.retryAfter));
+            writeAuditLog({
+                organizationId: org.id,
+                userId: pending.pendingAccountId,
+                eventType: 'rate_limit.2fa_verify',
+                eventCategory: 'security',
+                description: 'TOTP setup verification rate limit exceeded',
+                ipAddress: ctx.ip,
+            });
+            const t = getTranslationFunction(locale, org.slug);
+            await renderTotpSetupWithError(ctx, interaction.uid, pending, locale, t, t('errors.rate_limit_exceeded'), 429);
+            return;
+        }
         // TOTP setup confirmation — verify the code from authenticator app
         if (!code) {
             ctx.redirect(`/interaction/${interaction.uid}/two-factor/setup`);
             return;
         }
-        const confirmed = await confirmTotpSetup(pending.pendingAccountId, code);
+        let confirmed;
+        try {
+            confirmed = await confirmTotpSetup(pending.pendingAccountId, code);
+        }
+        catch (error) {
+            if (error instanceof UnsupportedTotpConfigurationError) {
+                logUnsupportedTotpConfiguration();
+                const t = getTranslationFunction(locale, org.slug);
+                await renderTotpSetupWithError(ctx, interaction.uid, pending, locale, t, t('errors.two_factor_unavailable'), 503);
+                return;
+            }
+            throw error;
+        }
         if (!confirmed) {
             writeAuditLog({
                 organizationId: org.id,
@@ -558,6 +572,45 @@ async function processTwoFactorSetup(ctx, provider) {
         ctx.body = 'Interaction expired';
     }
 }
+/** Record the fixed diagnostic for unsupported persisted TOTP parameters. */
+function logUnsupportedTotpConfiguration() {
+    logger.error({ event: 'totp-configuration-unsupported' }, 'TOTP configuration is unsupported');
+}
+/**
+ * Render pending TOTP enrollment data with an error without creating new secrets.
+ *
+ * @param ctx - Koa context
+ * @param uid - Interaction UID
+ * @param pending - Pending two-factor state
+ * @param locale - Resolved locale
+ * @param t - Translation function
+ * @param errorMessage - Error to display
+ * @param statusCode - HTTP response status
+ * @throws Error when the pending enrollment record no longer exists
+ */
+async function renderTotpSetupWithError(ctx, uid, pending, locale, t, errorMessage, statusCode) {
+    const setup = await getPendingTotpSetupInfo(pending.pendingAccountId, pending.email, ctx.state.organization.slug);
+    if (!setup) {
+        throw new Error('Pending TOTP setup is unavailable');
+    }
+    const csrfToken = generateCsrfToken();
+    setCsrfCookie(ctx, csrfToken);
+    const context = {
+        ...(await buildBaseContext(ctx, locale, csrfToken, ctx.state.organization.slug)),
+        t,
+        interaction: {
+            uid,
+            prompt: 'two-factor-setup',
+            params: {},
+            client: { clientName: '' },
+        },
+        method: 'totp',
+        qrCodeDataUri: setup.qrCodeDataUri,
+        totpSecret: setup.totpSecret,
+        flash: { error: errorMessage },
+    };
+    await renderAndRespond(ctx, 'two-factor-setup', context, statusCode);
+}
 // ---------------------------------------------------------------------------
 // Helper: render 2FA verify page with error
 // ---------------------------------------------------------------------------
@@ -576,7 +629,7 @@ async function renderTwoFactorWithError(ctx, uid, pending, locale, t, errorMessa
     const csrfToken = generateCsrfToken();
     setCsrfCookie(ctx, csrfToken);
     const context = {
-        ...buildBaseContext(ctx, locale, csrfToken, ctx.state.organization.slug),
+        ...(await buildBaseContext(ctx, locale, csrfToken, ctx.state.organization.slug)),
         t,
         interaction: {
             uid,

package/dist/routes/two-factor.js.map

@@ -1 +1 @@
-{"version":3,"file":"two-factor.js","sourceRoot":"","sources":["../../src/routes/two-factor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,MAAM,MAAM,aAAa,CAAC;AAGjC,OAAO,EACL,iBAAiB,EACjB,eAAe,EACf,aAAa,EACb,iBAAiB,GAClB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAwB,MAAM,yBAAyB,CAAC;AAClG,OAAO,EAAE,aAAa,EAAE,sBAAsB,EAAE,MAAM,iBAAiB,CAAC;AACxE,OAAO,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAC;AAExD,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAC5D,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AACtD,OAAO,EACL,SAAS,EACT,UAAU,EACV,kBAAkB,IAAI,yBAAyB,EAC/C,WAAW,EACX,SAAS,EACT,uBAAuB,EACvB,aAAa,EACb,gBAAgB,GACjB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAE1C,OAAO,EAAE,iCAAiC,EAAE,MAAM,mBAAmB,CAAC;AAqBtE,8EAA8E;AAC9E,YAAY;AACZ,8EAA8E;AAE9E,mEAAmE;AACnE,MAAM,iBAAiB,GAAoB,EAAE,GAAG,EAAE,CAAC,EAAE,aAAa,EAAE,GAAG,EAAE,CAAC;AAE1E,oDAAoD;AACpD,MAAM,iBAAiB,GAAoB,EAAE,GAAG,EAAE,CAAC,EAAE,aAAa,EAAE,GAAG,EAAE,CAAC;AAE1E,8EAA8E;AAC9E,UAAU;AACV,8EAA8E;AAE9E;;;;;GAKG;AACH,SAAS,oBAAoB,CAAC,GAAiB;IAC7C,OAAO;QACL,OAAO,EAAE,GAAG,CAAC,eAAe;QAC5B,UAAU,EAAE,GAAG,CAAC,kBAAkB;QAClC,YAAY,EAAE,GAAG,CAAC,oBAAoB,IAAI,SAAS;QACnD,WAAW,EAAE,GAAG,CAAC,mBAAmB,IAAI,GAAG,CAAC,IAAI;QAChD,SAAS,EAAE,GAAG,CAAC,iBAAiB;KACjC,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,gBAAgB,CACvB,GAAqB,EACrB,MAAc,EACd,SAAiB,EACjB,OAAe;IAEf,OAAO;QACL,QAAQ,EAAE,oBAAoB,CAAC,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC;QACtD,MAAM;QACN,SAAS;QACT,OAAO;KACR,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,KAAK,UAAU,gBAAgB,CAC7B,GAAY,EACZ,QAAgB,EAChB,OAAwB,EACxB,UAAU,GAAG,GAAG;IAEhB,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IACjD,GAAG,CAAC,MAAM,GAAG,UAAU,CAAC;IACxB,GAAG,CAAC,IAAI,GAAG,WAAW,CAAC;IACvB,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC;AAClB,CAAC;AAED;;;;;;GAMG;AACH,SAAS,SAAS,CAAC,KAAa;IAC9B,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACzC,IAAI,CAAC,KAAK,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IACxC,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC;QAAE,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,OAAO,MAAM,EAAE,CAAC;IACzD,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,MAAM,EAAE,CAAC;AAC9D,CAAC;AAED;;;;;;GAMG;AACH,SAAS,mBAAmB,CAAC,WAE5B;IACC,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,CAAC;IAClC,IAAI,CAAC,MAAM,EAAE,SAAS;QAAE,OAAO,IAAI,CAAC;IACpC,MAAM,EAAE,GAAG,MAAM,CAAC,SAA6B,CAAC;IAChD,IAAI,CAAC,EAAE,CAAC,gBAAgB,IAAI,CAAC,EAAE,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACjE,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,8EAA8E;AAC9E,iBAAiB;AACjB,8EAA8E;AAE9E;;;;;;;;GAQG;AACH,MAAM,UAAU,qBAAqB,CAAC,QAAkB;IACtD,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC,CAAC;IAEtD,gEAAgE;IAChE,MAAM,CAAC,GAAG,CAAC,kBAAkB,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QAC3C,MAAM,aAAa,CAAC,GAAuB,EAAE,QAAQ,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;IAEH,sDAAsD;IACtD,MAAM,CAAC,IAAI,CAAC,kBAAkB,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QAC5C,MAAM,eAAe,CAAC,GAAuB,EAAE,QAAQ,CAAC,CAAC;IAC3D,CAAC,CAAC,CAAC;IAEH,6DAA6D;IAC7D,MAAM,CAAC,IAAI,CAAC,yBAAyB,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QACnD,MAAM,aAAa,CAAC,GAAuB,EAAE,QAAQ,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;IAEH,+DAA+D;IAC/D,MAAM,CAAC,GAAG,CAAC,wBAAwB,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QACjD,MAAM,kBAAkB,CAAC,GAAuB,EAAE,QAAQ,CAAC,CAAC;IAC9D,CAAC,CAAC,CAAC;IAEH,8DAA8D;IAC9D,MAAM,CAAC,IAAI,CAAC,wBAAwB,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QAClD,MAAM,qBAAqB,CAAC,GAAuB,EAAE,QAAQ,CAAC,CAAC;IACjE,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,8EAA8E;AAC9E,iBAAiB;AACjB,8EAA8E;AAE9E;;;;;;;;GAQG;AACH,KAAK,UAAU,aAAa,CAAC,GAAqB,EAAE,QAAkB;IACpE,IAAI,CAAC;QACH,MAAM,WAAW,GAAG,MAAM,QAAQ,CAAC,kBAAkB,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;QAExE,yDAAyD;QACzD,8DAA8D;QAC9D,8DAA8D;QAC9D,MAAM,iCAAiC,CACrC,GAAG,EACH,WAAW,CAAC,MAAM,CAAC,SAAmB,EACtC,WAAW,CAAC,GAAG,CAChB,CAAC;QAEF,MAAM,OAAO,GAAG,mBAAmB,CAAC,WAAW,CAAC,CAAC;QAEjD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,0CAA0C;YAC1C,GAAG,CAAC,QAAQ,CAAC,gBAAgB,WAAW,CAAC,GAAG,EAAE,CAAC,CAAC;YAChD,OAAO;QACT,CAAC;QAED,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC;QACnC,MAAM,MAAM,GAAG,MAAM,aAAa,CAChC,SAAS,EACT,GAAG,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,SAAS,EACvC,GAAG,CAAC,aAAa,CAClB,CAAC;QACF,MAAM,CAAC,GAAG,sBAAsB,CAAC,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;QACnD,MAAM,SAAS,GAAG,iBAAiB,EAAE,CAAC;QACtC,aAAa,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QAE9B,MAAM,OAAO,GAAoB;YAC/B,GAAG,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,CAAC,IAAI,CAAC;YACrD,CAAC;YACD,WAAW,EAAE;gBACX,GAAG,EAAE,WAAW,CAAC,GAAG;gBACpB,MAAM,EAAE,YAAY;gBACpB,MAAM,EAAE,EAA6B;gBACrC,MAAM,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE;aAC3B;YACD,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,WAAW,EAAE,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC;YACrC,UAAU,EAAE,OAAO,CAAC,MAAM,KAAK,OAAO;YACtC,gBAAgB,EAAE,IAAI;SACvB,CAAC;QAEF,MAAM,gBAAgB,CAAC,GAAG,EAAE,mBAAmB,EAAE,OAAO,CAAC,CAAC;IAC5D,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,wBAAwB,EAAE,EAAE,kCAAkC,CAAC,CAAC;QACtF,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;QACjB,GAAG,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACnC,CAAC;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,KAAK,UAAU,eAAe,CAAC,GAAqB,EAAE,QAAkB;IACtE,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,IAA8B,CAAC;IACxD,MAAM,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACtC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,KAAK,CAAC,CAAC,+BAA+B;IACxE,MAAM,aAAa,GAAG,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;IACvC,MAAM,UAAU,GAAG,iBAAiB,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;IAEhD,IAAI,CAAC;QACH,MAAM,WAAW,GAAG,MAAM,QAAQ,CAAC,kBAAkB,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;QAExE,yDAAyD;QACzD,8DAA8D;QAC9D,MAAM,iCAAiC,CACrC,GAAG,EACH,WAAW,CAAC,MAAM,CAAC,SAAmB,EACtC,WAAW,CAAC,GAAG,CAChB,CAAC;QACF,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC;QAEnC,MAAM,OAAO,GAAG,mBAAmB,CAAC,WAAW,CAAC,CAAC;QAEjD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,GAAG,CAAC,QAAQ,CAAC,gBAAgB,WAAW,CAAC,GAAG,EAAE,CAAC,CAAC;YAChD,OAAO;QACT,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,aAAa,CAChC,SAAS,EACT,GAAG,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,SAAS,EACvC,GAAG,CAAC,aAAa,CAClB,CAAC;QACF,MAAM,CAAC,GAAG,sBAAsB,CAAC,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;QAEnD,2CAA2C;QAC3C,IAAI,CAAC,eAAe,CAAC,UAAU,EAAE,aAAa,CAAC,EAAE,CAAC;YAChD,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,0BAA0B,EAAE,EAAE,mCAAmC,CAAC,CAAC;YACxF,MAAM,wBAAwB,CAC5B,GAAG,EACH,WAAW,CAAC,GAAG,EACf,OAAO,EACP,MAAM,EACN,CAAC,EACD,CAAC,CAAC,qBAAqB,CAAC,CACzB,CAAC;YACF,OAAO;QACT,CAAC;QAED,yCAAyC;QACzC,MAAM,YAAY,GAAG,iBAAiB,CAAC,YAAY,EAAE,GAAG,CAAC,EAAE,EAAE,OAAO,CAAC,gBAAgB,CAAC,CAAC;QACvF,MAAM,eAAe,GAAG,MAAM,cAAc,CAAC,YAAY,EAAE,iBAAiB,CAAC,CAAC;QAE9E,IAAI,CAAC,eAAe,CAAC,OAAO,EAAE,CAAC;YAC7B,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,MAAM,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC,CAAC;YAC3D,aAAa,CAAC;gBACZ,cAAc,EAAE,GAAG,CAAC,EAAE;gBACtB,MAAM,EAAE,OAAO,CAAC,gBAAgB;gBAChC,SAAS,EAAE,uBAAuB;gBAClC,aAAa,EAAE,UAAU;gBACzB,WAAW,EAAE,sCAAsC;gBACnD,SAAS,EAAE,GAAG,CAAC,EAAE;aAClB,CAAC,CAAC;YACH,MAAM,wBAAwB,CAC5B,GAAG,EACH,WAAW,CAAC,GAAG,EACf,OAAO,EACP,MAAM,EACN,CAAC,EACD,CAAC,CAAC,4BAA4B,CAAC,EAC/B,GAAG,CACJ,CAAC;YACF,OAAO;QACT,CAAC;QAED,6BAA6B;QAC7B,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,wBAAwB,CAC5B,GAAG,EACH,WAAW,CAAC,GAAG,EACf,OAAO,EACP,MAAM,EACN,CAAC,EACD,CAAC,CAAC,gCAAgC,CAAC,CACpC,CAAC;YACF,OAAO;QACT,CAAC;QAED,0CAA0C;QAC1C,IAAI,QAAQ,GAAG,KAAK,CAAC;QACrB,IAAI,CAAC;YACH,IAAI,QAAQ,KAAK,UAAU,EAAE,CAAC;gBAC5B,QAAQ,GAAG,MAAM,yBAAyB,CAAC,OAAO,CAAC,gBAAgB,EAAE,IAAI,CAAC,CAAC;YAC7E,CAAC;iBAAM,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBACrC,QAAQ,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,gBAAgB,EAAE,IAAI,CAAC,CAAC;YAC9D,CAAC;iBAAM,CAAC;gBACN,YAAY;gBACZ,QAAQ,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,gBAAgB,EAAE,IAAI,CAAC,CAAC;YAC7D,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,+EAA+E;YAC/E,MAAM,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,0BAA0B,EAAE,QAAQ,EAAE,EAAE,0BAA0B,CAAC,CAAC;YAC1F,QAAQ,GAAG,KAAK,CAAC;QACnB,CAAC;QAED,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,aAAa,CAAC;gBACZ,cAAc,EAAE,GAAG,CAAC,EAAE;gBACtB,MAAM,EAAE,OAAO,CAAC,gBAAgB;gBAChC,SAAS,EAAE,mBAAmB;gBAC9B,aAAa,EAAE,UAAU;gBACzB,WAAW,EAAE,4BAA4B,QAAQ,GAAG;gBACpD,SAAS,EAAE,GAAG,CAAC,EAAE;aAClB,CAAC,CAAC;YACH,MAAM,wBAAwB,CAC5B,GAAG,EACH,WAAW,CAAC,GAAG,EACf,OAAO,EACP,MAAM,EACN,CAAC,EACD,CAAC,CAAC,+BAA+B,CAAC,CACnC,CAAC;YACF,OAAO;QACT,CAAC;QAED,6CAA6C;QAC7C,MAAM,WAAW,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;QAE5C,aAAa,CAAC;YACZ,cAAc,EAAE,GAAG,CAAC,EAAE;YACtB,MAAM,EAAE,OAAO,CAAC,gBAAgB;YAChC,SAAS,EAAE,oBAAoB;YAC/B,aAAa,EAAE,gBAAgB;YAC/B,WAAW,EAAE,gCAAgC,QAAQ,GAAG;YACxD,SAAS,EAAE,GAAG,CAAC,EAAE;SAClB,CAAC,CAAC;QAEH,qDAAqD;QACrD,MAAM,QAAQ,CAAC,mBAAmB,CAChC,GAAG,CAAC,GAAG,EACP,GAAG,CAAC,GAAG,EACP;YACE,KAAK,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,gBAAgB,EAAE;SAC/C,EACD,EAAE,uBAAuB,EAAE,KAAK,EAAE,CACnC,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,gCAAgC,EAAE,EAAE,gCAAgC,CAAC,CAAC;QAC5F,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;QACjB,GAAG,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACnC,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,KAAK,UAAU,aAAa,CAAC,GAAqB,EAAE,QAAkB;IACpE,IAAI,CAAC;QACH,MAAM,WAAW,GAAG,MAAM,QAAQ,CAAC,kBAAkB,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;QAExE,yDAAyD;QACzD,8DAA8D;QAC9D,MAAM,iCAAiC,CACrC,GAAG,EACH,WAAW,CAAC,MAAM,CAAC,SAAmB,EACtC,WAAW,CAAC,GAAG,CAChB,CAAC;QACF,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC;QAEnC,MAAM,OAAO,GAAG,mBAAmB,CAAC,WAAW,CAAC,CAAC;QAEjD,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;YAC3C,GAAG,CAAC,QAAQ,CAAC,gBAAgB,WAAW,CAAC,GAAG,aAAa,CAAC,CAAC;YAC3D,OAAO;QACT,CAAC;QAED,8BAA8B;QAC9B,MAAM,YAAY,GAAG,iBAAiB,CAAC,YAAY,EAAE,GAAG,CAAC,EAAE,EAAE,OAAO,CAAC,gBAAgB,CAAC,CAAC;QACvF,MAAM,eAAe,GAAG,MAAM,cAAc,CAAC,YAAY,EAAE,iBAAiB,CAAC,CAAC;QAE9E,IAAI,CAAC,eAAe,CAAC,OAAO,EAAE,CAAC;YAC7B,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,MAAM,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC,CAAC;YAC3D,8DAA8D;YAC9D,GAAG,CAAC,QAAQ,CAAC,gBAAgB,WAAW,CAAC,GAAG,aAAa,CAAC,CAAC;YAC3D,OAAO;QACT,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,aAAa,CAChC,SAAS,EACT,GAAG,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,SAAS,EACvC,GAAG,CAAC,aAAa,CAClB,CAAC;QAEF,iCAAiC;QACjC,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,gBAAgB,EAAE,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;YACnF,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;YAC1D,gBAAgB,CACd;gBACE,EAAE,EAAE,OAAO,CAAC,gBAAgB;gBAC5B,KAAK,EAAE,OAAO,CAAC,KAAK;gBACpB,SAAS,EAAE,IAAI,EAAE,SAAS;gBAC1B,UAAU,EAAE,IAAI,EAAE,UAAU;aAC7B,EACD;gBACE,EAAE,EAAE,GAAG,CAAC,EAAE;gBACV,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,eAAe,EAAE,GAAG,CAAC,eAAe;gBACpC,oBAAoB,EAAE,GAAG,CAAC,oBAAoB;gBAC9C,mBAAmB,EAAE,GAAG,CAAC,mBAAmB;aAC7C,EACD,OAAO,EACP,EAAE,EACF,MAAM,CACP,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,8BAA8B,EAAE,EAAE,mBAAmB,CAAC,CAAC;QAC9E,CAAC;QAED,aAAa,CAAC;YACZ,cAAc,EAAE,GAAG,CAAC,EAAE;YACtB,MAAM,EAAE,OAAO,CAAC,gBAAgB;YAChC,SAAS,EAAE,gBAAgB;YAC3B,aAAa,EAAE,gBAAgB;YAC/B,WAAW,EAAE,iBAAiB;YAC9B,SAAS,EAAE,GAAG,CAAC,EAAE;SAClB,CAAC,CAAC;QAEH,GAAG,CAAC,QAAQ,CAAC,gBAAgB,WAAW,CAAC,GAAG,aAAa,CAAC,CAAC;IAC7D,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,0BAA0B,EAAE,EAAE,0BAA0B,CAAC,CAAC;QAChF,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;QACjB,GAAG,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACnC,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,KAAK,UAAU,kBAAkB,CAAC,GAAqB,EAAE,QAAkB;IACzE,IAAI,CAAC;QACH,MAAM,WAAW,GAAG,MAAM,QAAQ,CAAC,kBAAkB,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;QAExE,yDAAyD;QACzD,8DAA8D;QAC9D,MAAM,iCAAiC,CACrC,GAAG,EACH,WAAW,CAAC,MAAM,CAAC,SAAmB,EACtC,WAAW,CAAC,GAAG,CAChB,CAAC;QAEF,MAAM,OAAO,GAAG,mBAAmB,CAAC,WAAW,CAAC,CAAC;QAEjD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,GAAG,CAAC,QAAQ,CAAC,gBAAgB,WAAW,CAAC,GAAG,EAAE,CAAC,CAAC;YAChD,OAAO;QACT,CAAC;QAED,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC;QACnC,MAAM,MAAM,GAAG,MAAM,aAAa,CAChC,SAAS,EACT,GAAG,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,SAAS,EACvC,GAAG,CAAC,aAAa,CAClB,CAAC;QACF,MAAM,CAAC,GAAG,sBAAsB,CAAC,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;QACnD,MAAM,SAAS,GAAG,iBAAiB,EAAE,CAAC;QACtC,aAAa,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QAE9B,yFAAyF;QACzF,MAAM,aAAa,GAAG,MAAM,uBAAuB,CACjD,OAAO,CAAC,gBAAgB,EACxB,OAAO,CAAC,KAAK,EACb,GAAG,CAAC,IAAI,CACT,CAAC;QAEF,IAAI,aAAqB,CAAC;QAC1B,IAAI,UAAkB,CAAC;QACvB,IAAI,aAAmC,CAAC;QAExC,IAAI,aAAa,EAAE,CAAC;YAClB,6DAA6D;YAC7D,aAAa,GAAG,aAAa,CAAC,aAAa,CAAC;YAC5C,UAAU,GAAG,aAAa,CAAC,OAAO,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC/E,CAAC;aAAM,CAAC;YACN,0CAA0C;YAC1C,MAAM,WAAW,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,gBAAgB,EAAE,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;YACvF,aAAa,GAAG,WAAW,CAAC,aAAc,CAAC;YAC3C,UAAU,GAAG,WAAW,CAAC,OAAO,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAC3E,aAAa,GAAG,WAAW,CAAC,aAAa,CAAC;QAC5C,CAAC;QAED,8DAA8D;QAC9D,MAAM,UAAU,GAAI,GAAG,CAAC,KAAK,CAAC,KAAgB,IAAI,EAAE,CAAC;QAErD,MAAM,OAAO,GAAoB;YAC/B,GAAG,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,CAAC,IAAI,CAAC;YACrD,CAAC;YACD,WAAW,EAAE;gBACX,GAAG,EAAE,WAAW,CAAC,GAAG;gBACpB,MAAM,EAAE,kBAAkB;gBAC1B,MAAM,EAAE,EAA6B;gBACrC,MAAM,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE;aAC3B;YACD,MAAM,EAAE,MAAM;YACd,aAAa;YACb,UAAU;YACV,aAAa;YACb,KAAK,EACH,UAAU,KAAK,cAAc,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,+BAA+B,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS;SAC5F,CAAC;QAEF,MAAM,gBAAgB,CAAC,GAAG,EAAE,kBAAkB,EAAE,OAAO,CAAC,CAAC;IAC3D,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,8BAA8B,EAAE,EAAE,8BAA8B,CAAC,CAAC;QACxF,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;QACjB,GAAG,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACnC,CAAC;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,KAAK,UAAU,qBAAqB,CAAC,GAAqB,EAAE,QAAkB;IAC5E,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,IAA8B,CAAC;IACxD,MAAM,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACtC,MAAM,aAAa,GAAG,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;IACvC,MAAM,UAAU,GAAG,iBAAiB,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;IAChD,oEAAoE;IACpE,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,IAAI,MAAM,CAAC;IAE/C,IAAI,CAAC;QACH,MAAM,WAAW,GAAG,MAAM,QAAQ,CAAC,kBAAkB,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;QAExE,yDAAyD;QACzD,8DAA8D;QAC9D,MAAM,iCAAiC,CACrC,GAAG,EACH,WAAW,CAAC,MAAM,CAAC,SAAmB,EACtC,WAAW,CAAC,GAAG,CAChB,CAAC;QACF,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC;QAEnC,MAAM,OAAO,GAAG,mBAAmB,CAAC,WAAW,CAAC,CAAC;QAEjD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,GAAG,CAAC,QAAQ,CAAC,gBAAgB,WAAW,CAAC,GAAG,EAAE,CAAC,CAAC;YAChD,OAAO;QACT,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,aAAa,CAChC,SAAS,EACT,GAAG,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,SAAS,EACvC,GAAG,CAAC,aAAa,CAClB,CAAC;QAEF,oBAAoB;QACpB,IAAI,CAAC,eAAe,CAAC,UAAU,EAAE,aAAa,CAAC,EAAE,CAAC;YAChD,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gCAAgC,EAAE,EAAE,8BAA8B,CAAC,CAAC;YACzF,sCAAsC;YACtC,GAAG,CAAC,QAAQ,CAAC,gBAAgB,WAAW,CAAC,GAAG,mBAAmB,CAAC,CAAC;YACjE,OAAO;QACT,CAAC;QAED,IAAI,WAAW,KAAK,OAAO,EAAE,CAAC;YAC5B,iEAAiE;YACjE,MAAM,aAAa,CAAC,OAAO,CAAC,gBAAgB,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;YAEtD,aAAa,CAAC;gBACZ,cAAc,EAAE,GAAG,CAAC,EAAE;gBACtB,MAAM,EAAE,OAAO,CAAC,gBAAgB;gBAChC,SAAS,EAAE,0BAA0B;gBACrC,aAAa,EAAE,gBAAgB;gBAC/B,WAAW,EAAE,4CAA4C;gBACzD,SAAS,EAAE,GAAG,CAAC,EAAE;aAClB,CAAC,CAAC;YAEH,sDAAsD;YACtD,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,gBAAgB,EAAE,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;gBACnF,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;gBAC1D,gBAAgB,CACd;oBACE,EAAE,EAAE,OAAO,CAAC,gBAAgB;oBAC5B,KAAK,EAAE,OAAO,CAAC,KAAK;oBACpB,SAAS,EAAE,IAAI,EAAE,SAAS;oBAC1B,UAAU,EAAE,IAAI,EAAE,UAAU;iBAC7B,EACD;oBACE,EAAE,EAAE,GAAG,CAAC,EAAE;oBACV,IAAI,EAAE,GAAG,CAAC,IAAI;oBACd,eAAe,EAAE,GAAG,CAAC,eAAe;oBACpC,oBAAoB,EAAE,GAAG,CAAC,oBAAoB;oBAC9C,mBAAmB,EAAE,GAAG,CAAC,mBAAmB;iBAC7C,EACD,OAAO,EACP,EAAE,EACF,MAAM,CACP,CAAC;YACJ,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,6BAA6B,EAAE,EAAE,2BAA2B,CAAC,CAAC;YACrF,CAAC;YAED,iDAAiD;YACjD,MAAM,QAAQ,CAAC,iBAAiB,CAC9B,GAAG,CAAC,GAAG,EACP,GAAG,CAAC,GAAG,EACP;gBACE,SAAS,EAAE,EAAE,GAAG,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE;aAC3C,EACD,EAAE,uBAAuB,EAAE,IAAI,EAAE,CAClC,CAAC;YAEF,GAAG,CAAC,QAAQ,CAAC,gBAAgB,WAAW,CAAC,GAAG,aAAa,CAAC,CAAC;YAC3D,OAAO;QACT,CAAC;QAED,mEAAmE;QACnE,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,GAAG,CAAC,QAAQ,CAAC,gBAAgB,WAAW,CAAC,GAAG,mBAAmB,CAAC,CAAC;YACjE,OAAO;QACT,CAAC;QAED,MAAM,SAAS,GAAG,MAAM,gBAAgB,CAAC,OAAO,CAAC,gBAAgB,EAAE,IAAI,CAAC,CAAC;QAEzE,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,aAAa,CAAC;gBACZ,cAAc,EAAE,GAAG,CAAC,EAAE;gBACtB,MAAM,EAAE,OAAO,CAAC,gBAAgB;gBAChC,SAAS,EAAE,uBAAuB;gBAClC,aAAa,EAAE,UAAU;gBACzB,WAAW,EAAE,+CAA+C;gBAC5D,SAAS,EAAE,GAAG,CAAC,EAAE;aAClB,CAAC,CAAC;YACH,8CAA8C;YAC9C,GAAG,CAAC,QAAQ,CAAC,gBAAgB,WAAW,CAAC,GAAG,sCAAsC,CAAC,CAAC;YACpF,OAAO;QACT,CAAC;QAED,wCAAwC;QACxC,MAAM,WAAW,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;QAE5C,aAAa,CAAC;YACZ,cAAc,EAAE,GAAG,CAAC,EAAE;YACtB,MAAM,EAAE,OAAO,CAAC,gBAAgB;YAChC,SAAS,EAAE,yBAAyB;YACpC,aAAa,EAAE,gBAAgB;YAC/B,WAAW,EAAE,oCAAoC;YACjD,SAAS,EAAE,GAAG,CAAC,EAAE;SAClB,CAAC,CAAC;QAEH,MAAM,QAAQ,CAAC,mBAAmB,CAChC,GAAG,CAAC,GAAG,EACP,GAAG,CAAC,GAAG,EACP;YACE,KAAK,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,gBAAgB,EAAE;SAC/C,EACD,EAAE,uBAAuB,EAAE,KAAK,EAAE,CACnC,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,yBAAyB,EAAE,EAAE,yBAAyB,CAAC,CAAC;QAC9E,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;QACjB,GAAG,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACnC,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,4CAA4C;AAC5C,8EAA8E;AAE9E;;;;;;;;;;GAUG;AACH,KAAK,UAAU,wBAAwB,CACrC,GAAqB,EACrB,GAAW,EACX,OAAyB,EACzB,MAAc,EACd,CAA6D,EAC7D,YAAoB,EACpB,UAAU,GAAG,GAAG;IAEhB,MAAM,SAAS,GAAG,iBAAiB,EAAE,CAAC;IACtC,aAAa,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IAE9B,MAAM,OAAO,GAAoB;QAC/B,GAAG,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC;QACxE,CAAC;QACD,WAAW,EAAE;YACX,GAAG;YACH,MAAM,EAAE,YAAY;YACpB,MAAM,EAAE,EAA6B;YACrC,MAAM,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE;SAC3B;QACD,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,WAAW,EAAE,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC;QACrC,UAAU,EAAE,OAAO,CAAC,MAAM,KAAK,OAAO;QACtC,gBAAgB,EAAE,IAAI;QACtB,KAAK,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE;KAC/B,CAAC;IAEF,MAAM,gBAAgB,CAAC,GAAG,EAAE,mBAAmB,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC;AACxE,CAAC"}
+{"version":3,"file":"two-factor.js","sourceRoot":"","sources":["../../src/routes/two-factor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,MAAM,MAAM,aAAa,CAAC;AAGjC,OAAO,EACL,iBAAiB,EACjB,eAAe,EACf,aAAa,EACb,iBAAiB,GAClB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAwB,MAAM,yBAAyB,CAAC;AAClG,OAAO,EAAE,aAAa,EAAE,sBAAsB,EAAE,MAAM,iBAAiB,CAAC;AACxE,OAAO,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAC;AAExD,OAAO,EAAE,wBAAwB,EAAE,MAAM,+BAA+B,CAAC;AACzE,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAC5D,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AACtD,OAAO,EACL,SAAS,EACT,UAAU,EACV,kBAAkB,IAAI,yBAAyB,EAC/C,WAAW,EACX,SAAS,EACT,uBAAuB,EACvB,aAAa,EACb,gBAAgB,GACjB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,iCAAiC,EAAE,MAAM,yBAAyB,CAAC;AAC5E,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAE1C,OAAO,EAAE,iCAAiC,EAAE,MAAM,mBAAmB,CAAC;AAqBtE,8EAA8E;AAC9E,YAAY;AACZ,8EAA8E;AAE9E,mEAAmE;AACnE,MAAM,iBAAiB,GAAoB,EAAE,GAAG,EAAE,CAAC,EAAE,aAAa,EAAE,GAAG,EAAE,CAAC;AAE1E,oDAAoD;AACpD,MAAM,iBAAiB,GAAoB,EAAE,GAAG,EAAE,CAAC,EAAE,aAAa,EAAE,GAAG,EAAE,CAAC;AAE1E,8EAA8E;AAC9E,UAAU;AACV,8EAA8E;AAE9E;;;;;;;;GAQG;AACH,KAAK,UAAU,gBAAgB,CAC7B,GAAqB,EACrB,MAAc,EACd,SAAiB,EACjB,OAAe;IAEf,OAAO;QACL,QAAQ,EAAE,MAAM,wBAAwB,CAAC,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC;QAChE,MAAM;QACN,SAAS;QACT,OAAO;KACR,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,KAAK,UAAU,gBAAgB,CAC7B,GAAY,EACZ,QAAgB,EAChB,OAAwB,EACxB,UAAU,GAAG,GAAG;IAEhB,GAAG,CAAC,KAAK,CAAC,oBAAoB,GAAG,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC;IAC/D,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IACjD,GAAG,CAAC,MAAM,GAAG,UAAU,CAAC;IACxB,GAAG,CAAC,IAAI,GAAG,WAAW,CAAC;IACvB,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC;AAClB,CAAC;AAED;;;;;;GAMG;AACH,SAAS,SAAS,CAAC,KAAa;IAC9B,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACzC,IAAI,CAAC,KAAK,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IACxC,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC;QAAE,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,OAAO,MAAM,EAAE,CAAC;IACzD,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,MAAM,EAAE,CAAC;AAC9D,CAAC;AAED;;;;;;GAMG;AACH,SAAS,mBAAmB,CAAC,WAE5B;IACC,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,CAAC;IAClC,IAAI,CAAC,MAAM,EAAE,SAAS;QAAE,OAAO,IAAI,CAAC;IACpC,MAAM,EAAE,GAAG,MAAM,CAAC,SAA6B,CAAC;IAChD,IAAI,CAAC,EAAE,CAAC,gBAAgB,IAAI,CAAC,EAAE,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACjE,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,8EAA8E;AAC9E,iBAAiB;AACjB,8EAA8E;AAE9E;;;;;;;;GAQG;AACH,MAAM,UAAU,qBAAqB,CAAC,QAAkB;IACtD,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC,CAAC;IAEtD,gEAAgE;IAChE,MAAM,CAAC,GAAG,CAAC,kBAAkB,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QAC3C,MAAM,aAAa,CAAC,GAAuB,EAAE,QAAQ,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;IAEH,sDAAsD;IACtD,MAAM,CAAC,IAAI,CAAC,kBAAkB,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QAC5C,MAAM,eAAe,CAAC,GAAuB,EAAE,QAAQ,CAAC,CAAC;IAC3D,CAAC,CAAC,CAAC;IAEH,6DAA6D;IAC7D,MAAM,CAAC,IAAI,CAAC,yBAAyB,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QACnD,MAAM,aAAa,CAAC,GAAuB,EAAE,QAAQ,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;IAEH,+DAA+D;IAC/D,MAAM,CAAC,GAAG,CAAC,wBAAwB,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QACjD,MAAM,kBAAkB,CAAC,GAAuB,EAAE,QAAQ,CAAC,CAAC;IAC9D,CAAC,CAAC,CAAC;IAEH,8DAA8D;IAC9D,MAAM,CAAC,IAAI,CAAC,wBAAwB,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QAClD,MAAM,qBAAqB,CAAC,GAAuB,EAAE,QAAQ,CAAC,CAAC;IACjE,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,8EAA8E;AAC9E,iBAAiB;AACjB,8EAA8E;AAE9E;;;;;;;;GAQG;AACH,KAAK,UAAU,aAAa,CAAC,GAAqB,EAAE,QAAkB;IACpE,IAAI,CAAC;QACH,MAAM,WAAW,GAAG,MAAM,QAAQ,CAAC,kBAAkB,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;QAExE,yDAAyD;QACzD,8DAA8D;QAC9D,8DAA8D;QAC9D,MAAM,iCAAiC,CACrC,GAAG,EACH,WAAW,CAAC,MAAM,CAAC,SAAmB,EACtC,WAAW,CAAC,GAAG,CAChB,CAAC;QAEF,MAAM,OAAO,GAAG,mBAAmB,CAAC,WAAW,CAAC,CAAC;QAEjD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,0CAA0C;YAC1C,GAAG,CAAC,QAAQ,CAAC,gBAAgB,WAAW,CAAC,GAAG,EAAE,CAAC,CAAC;YAChD,OAAO;QACT,CAAC;QAED,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC;QACnC,MAAM,MAAM,GAAG,MAAM,aAAa,CAChC,SAAS,EACT,GAAG,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,SAAS,EACvC,GAAG,CAAC,aAAa,CAClB,CAAC;QACF,MAAM,CAAC,GAAG,sBAAsB,CAAC,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;QACnD,MAAM,SAAS,GAAG,iBAAiB,EAAE,CAAC;QACtC,aAAa,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QAE9B,MAAM,OAAO,GAAoB;YAC/B,GAAG,CAAC,MAAM,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;YAC7D,CAAC;YACD,WAAW,EAAE;gBACX,GAAG,EAAE,WAAW,CAAC,GAAG;gBACpB,MAAM,EAAE,YAAY;gBACpB,MAAM,EAAE,EAA6B;gBACrC,MAAM,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE;aAC3B;YACD,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,WAAW,EAAE,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC;YACrC,UAAU,EAAE,OAAO,CAAC,MAAM,KAAK,OAAO;YACtC,gBAAgB,EAAE,IAAI;SACvB,CAAC;QAEF,MAAM,gBAAgB,CAAC,GAAG,EAAE,mBAAmB,EAAE,OAAO,CAAC,CAAC;IAC5D,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,wBAAwB,EAAE,EAAE,kCAAkC,CAAC,CAAC;QACtF,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;QACjB,GAAG,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACnC,CAAC;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,KAAK,UAAU,eAAe,CAAC,GAAqB,EAAE,QAAkB;IACtE,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,IAA8B,CAAC;IACxD,MAAM,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACtC,MAAM,iBAAiB,GAAG,IAAI,CAAC,QAAQ,CAAC;IACxC,MAAM,QAAQ,GACZ,iBAAiB,KAAK,MAAM,IAAI,iBAAiB,KAAK,UAAU,IAAI,iBAAiB,KAAK,KAAK;QAC7F,CAAC,CAAC,iBAAiB;QACnB,CAAC,CAAC,KAAK,CAAC;IACZ,MAAM,aAAa,GAAG,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;IACvC,MAAM,UAAU,GAAG,iBAAiB,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;IAEhD,IAAI,CAAC;QACH,MAAM,WAAW,GAAG,MAAM,QAAQ,CAAC,kBAAkB,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;QAExE,yDAAyD;QACzD,8DAA8D;QAC9D,MAAM,iCAAiC,CACrC,GAAG,EACH,WAAW,CAAC,MAAM,CAAC,SAAmB,EACtC,WAAW,CAAC,GAAG,CAChB,CAAC;QACF,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC;QAEnC,MAAM,OAAO,GAAG,mBAAmB,CAAC,WAAW,CAAC,CAAC;QAEjD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,GAAG,CAAC,QAAQ,CAAC,gBAAgB,WAAW,CAAC,GAAG,EAAE,CAAC,CAAC;YAChD,OAAO;QACT,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,aAAa,CAChC,SAAS,EACT,GAAG,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,SAAS,EACvC,GAAG,CAAC,aAAa,CAClB,CAAC;QACF,MAAM,CAAC,GAAG,sBAAsB,CAAC,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;QAEnD,2CAA2C;QAC3C,IAAI,CAAC,eAAe,CAAC,UAAU,EAAE,aAAa,CAAC,EAAE,CAAC;YAChD,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,0BAA0B,EAAE,EAAE,mCAAmC,CAAC,CAAC;YACxF,MAAM,wBAAwB,CAC5B,GAAG,EACH,WAAW,CAAC,GAAG,EACf,OAAO,EACP,MAAM,EACN,CAAC,EACD,CAAC,CAAC,qBAAqB,CAAC,CACzB,CAAC;YACF,OAAO;QACT,CAAC;QAED,yCAAyC;QACzC,MAAM,YAAY,GAAG,iBAAiB,CAAC,YAAY,EAAE,GAAG,CAAC,EAAE,EAAE,OAAO,CAAC,gBAAgB,CAAC,CAAC;QACvF,MAAM,eAAe,GAAG,MAAM,cAAc,CAAC,YAAY,EAAE,iBAAiB,CAAC,CAAC;QAE9E,IAAI,CAAC,eAAe,CAAC,OAAO,EAAE,CAAC;YAC7B,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,MAAM,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC,CAAC;YAC3D,aAAa,CAAC;gBACZ,cAAc,EAAE,GAAG,CAAC,EAAE;gBACtB,MAAM,EAAE,OAAO,CAAC,gBAAgB;gBAChC,SAAS,EAAE,uBAAuB;gBAClC,aAAa,EAAE,UAAU;gBACzB,WAAW,EAAE,sCAAsC;gBACnD,SAAS,EAAE,GAAG,CAAC,EAAE;aAClB,CAAC,CAAC;YACH,MAAM,wBAAwB,CAC5B,GAAG,EACH,WAAW,CAAC,GAAG,EACf,OAAO,EACP,MAAM,EACN,CAAC,EACD,CAAC,CAAC,4BAA4B,CAAC,EAC/B,GAAG,CACJ,CAAC;YACF,OAAO;QACT,CAAC;QAED,6BAA6B;QAC7B,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,wBAAwB,CAC5B,GAAG,EACH,WAAW,CAAC,GAAG,EACf,OAAO,EACP,MAAM,EACN,CAAC,EACD,CAAC,CAAC,gCAAgC,CAAC,CACpC,CAAC;YACF,OAAO;QACT,CAAC;QAED,0CAA0C;QAC1C,IAAI,QAAQ,GAAG,KAAK,CAAC;QACrB,IAAI,CAAC;YACH,IAAI,QAAQ,KAAK,UAAU,EAAE,CAAC;gBAC5B,QAAQ,GAAG,MAAM,yBAAyB,CAAC,OAAO,CAAC,gBAAgB,EAAE,IAAI,CAAC,CAAC;YAC7E,CAAC;iBAAM,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBACrC,QAAQ,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,gBAAgB,EAAE,IAAI,CAAC,CAAC;YAC9D,CAAC;iBAAM,CAAC;gBACN,YAAY;gBACZ,QAAQ,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,gBAAgB,EAAE,IAAI,CAAC,CAAC;YAC7D,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,iCAAiC,EAAE,CAAC;gBACvD,+BAA+B,EAAE,CAAC;gBAClC,MAAM,wBAAwB,CAC5B,GAAG,EACH,WAAW,CAAC,GAAG,EACf,OAAO,EACP,MAAM,EACN,CAAC,EACD,CAAC,CAAC,+BAA+B,CAAC,EAClC,GAAG,CACJ,CAAC;gBACF,OAAO;YACT,CAAC;YAED,+EAA+E;YAC/E,MAAM,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,0BAA0B,EAAE,QAAQ,EAAE,EAAE,0BAA0B,CAAC,CAAC;YAC1F,QAAQ,GAAG,KAAK,CAAC;QACnB,CAAC;QAED,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,aAAa,CAAC;gBACZ,cAAc,EAAE,GAAG,CAAC,EAAE;gBACtB,MAAM,EAAE,OAAO,CAAC,gBAAgB;gBAChC,SAAS,EAAE,mBAAmB;gBAC9B,aAAa,EAAE,UAAU;gBACzB,WAAW,EAAE,4BAA4B,QAAQ,GAAG;gBACpD,SAAS,EAAE,GAAG,CAAC,EAAE;aAClB,CAAC,CAAC;YACH,MAAM,wBAAwB,CAC5B,GAAG,EACH,WAAW,CAAC,GAAG,EACf,OAAO,EACP,MAAM,EACN,CAAC,EACD,CAAC,CAAC,+BAA+B,CAAC,CACnC,CAAC;YACF,OAAO;QACT,CAAC;QAED,6CAA6C;QAC7C,MAAM,WAAW,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;QAE5C,aAAa,CAAC;YACZ,cAAc,EAAE,GAAG,CAAC,EAAE;YACtB,MAAM,EAAE,OAAO,CAAC,gBAAgB;YAChC,SAAS,EAAE,oBAAoB;YAC/B,aAAa,EAAE,gBAAgB;YAC/B,WAAW,EAAE,gCAAgC,QAAQ,GAAG;YACxD,SAAS,EAAE,GAAG,CAAC,EAAE;SAClB,CAAC,CAAC;QAEH,qDAAqD;QACrD,MAAM,QAAQ,CAAC,mBAAmB,CAChC,GAAG,CAAC,GAAG,EACP,GAAG,CAAC,GAAG,EACP;YACE,KAAK,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,gBAAgB,EAAE;SAC/C,EACD,EAAE,uBAAuB,EAAE,KAAK,EAAE,CACnC,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,gCAAgC,EAAE,EAAE,gCAAgC,CAAC,CAAC;QAC5F,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;QACjB,GAAG,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACnC,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,KAAK,UAAU,aAAa,CAAC,GAAqB,EAAE,QAAkB;IACpE,IAAI,CAAC;QACH,MAAM,WAAW,GAAG,MAAM,QAAQ,CAAC,kBAAkB,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;QAExE,yDAAyD;QACzD,8DAA8D;QAC9D,MAAM,iCAAiC,CACrC,GAAG,EACH,WAAW,CAAC,MAAM,CAAC,SAAmB,EACtC,WAAW,CAAC,GAAG,CAChB,CAAC;QACF,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC;QAEnC,MAAM,OAAO,GAAG,mBAAmB,CAAC,WAAW,CAAC,CAAC;QAEjD,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;YAC3C,GAAG,CAAC,QAAQ,CAAC,gBAAgB,WAAW,CAAC,GAAG,aAAa,CAAC,CAAC;YAC3D,OAAO;QACT,CAAC;QAED,8BAA8B;QAC9B,MAAM,YAAY,GAAG,iBAAiB,CAAC,YAAY,EAAE,GAAG,CAAC,EAAE,EAAE,OAAO,CAAC,gBAAgB,CAAC,CAAC;QACvF,MAAM,eAAe,GAAG,MAAM,cAAc,CAAC,YAAY,EAAE,iBAAiB,CAAC,CAAC;QAE9E,IAAI,CAAC,eAAe,CAAC,OAAO,EAAE,CAAC;YAC7B,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,MAAM,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC,CAAC;YAC3D,8DAA8D;YAC9D,GAAG,CAAC,QAAQ,CAAC,gBAAgB,WAAW,CAAC,GAAG,aAAa,CAAC,CAAC;YAC3D,OAAO;QACT,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,aAAa,CAChC,SAAS,EACT,GAAG,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,SAAS,EACvC,GAAG,CAAC,aAAa,CAClB,CAAC;QAEF,iCAAiC;QACjC,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,gBAAgB,EAAE,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;YACnF,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;YAC1D,gBAAgB,CACd;gBACE,EAAE,EAAE,OAAO,CAAC,gBAAgB;gBAC5B,KAAK,EAAE,OAAO,CAAC,KAAK;gBACpB,SAAS,EAAE,IAAI,EAAE,SAAS;gBAC1B,UAAU,EAAE,IAAI,EAAE,UAAU;aAC7B,EACD,GAAG,EACH,OAAO,EACP,EAAE,EACF,MAAM,CACP,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,8BAA8B,EAAE,EAAE,mBAAmB,CAAC,CAAC;QAC9E,CAAC;QAED,aAAa,CAAC;YACZ,cAAc,EAAE,GAAG,CAAC,EAAE;YACtB,MAAM,EAAE,OAAO,CAAC,gBAAgB;YAChC,SAAS,EAAE,gBAAgB;YAC3B,aAAa,EAAE,gBAAgB;YAC/B,WAAW,EAAE,iBAAiB;YAC9B,SAAS,EAAE,GAAG,CAAC,EAAE;SAClB,CAAC,CAAC;QAEH,GAAG,CAAC,QAAQ,CAAC,gBAAgB,WAAW,CAAC,GAAG,aAAa,CAAC,CAAC;IAC7D,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,0BAA0B,EAAE,EAAE,0BAA0B,CAAC,CAAC;QAChF,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;QACjB,GAAG,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACnC,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,KAAK,UAAU,kBAAkB,CAAC,GAAqB,EAAE,QAAkB;IACzE,IAAI,CAAC;QACH,MAAM,WAAW,GAAG,MAAM,QAAQ,CAAC,kBAAkB,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;QAExE,yDAAyD;QACzD,8DAA8D;QAC9D,MAAM,iCAAiC,CACrC,GAAG,EACH,WAAW,CAAC,MAAM,CAAC,SAAmB,EACtC,WAAW,CAAC,GAAG,CAChB,CAAC;QAEF,MAAM,OAAO,GAAG,mBAAmB,CAAC,WAAW,CAAC,CAAC;QAEjD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,GAAG,CAAC,QAAQ,CAAC,gBAAgB,WAAW,CAAC,GAAG,EAAE,CAAC,CAAC;YAChD,OAAO;QACT,CAAC;QAED,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC;QACnC,MAAM,MAAM,GAAG,MAAM,aAAa,CAChC,SAAS,EACT,GAAG,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,SAAS,EACvC,GAAG,CAAC,aAAa,CAClB,CAAC;QACF,MAAM,CAAC,GAAG,sBAAsB,CAAC,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;QACnD,MAAM,SAAS,GAAG,iBAAiB,EAAE,CAAC;QACtC,aAAa,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QAE9B,yFAAyF;QACzF,MAAM,aAAa,GAAG,MAAM,uBAAuB,CACjD,OAAO,CAAC,gBAAgB,EACxB,OAAO,CAAC,KAAK,EACb,GAAG,CAAC,IAAI,CACT,CAAC;QAEF,IAAI,aAAqB,CAAC;QAC1B,IAAI,UAAkB,CAAC;QACvB,IAAI,aAAmC,CAAC;QAExC,IAAI,aAAa,EAAE,CAAC;YAClB,6DAA6D;YAC7D,aAAa,GAAG,aAAa,CAAC,aAAa,CAAC;YAC5C,UAAU,GAAG,aAAa,CAAC,OAAO,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC/E,CAAC;aAAM,CAAC;YACN,0CAA0C;YAC1C,MAAM,WAAW,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,gBAAgB,EAAE,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;YACvF,aAAa,GAAG,WAAW,CAAC,aAAc,CAAC;YAC3C,UAAU,GAAG,WAAW,CAAC,OAAO,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAC3E,aAAa,GAAG,WAAW,CAAC,aAAa,CAAC;QAC5C,CAAC;QAED,8DAA8D;QAC9D,MAAM,UAAU,GAAI,GAAG,CAAC,KAAK,CAAC,KAAgB,IAAI,EAAE,CAAC;QAErD,MAAM,OAAO,GAAoB;YAC/B,GAAG,CAAC,MAAM,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;YAC7D,CAAC;YACD,WAAW,EAAE;gBACX,GAAG,EAAE,WAAW,CAAC,GAAG;gBACpB,MAAM,EAAE,kBAAkB;gBAC1B,MAAM,EAAE,EAA6B;gBACrC,MAAM,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE;aAC3B;YACD,MAAM,EAAE,MAAM;YACd,aAAa;YACb,UAAU;YACV,aAAa;YACb,KAAK,EACH,UAAU,KAAK,cAAc,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,+BAA+B,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS;SAC5F,CAAC;QAEF,MAAM,gBAAgB,CAAC,GAAG,EAAE,kBAAkB,EAAE,OAAO,CAAC,CAAC;IAC3D,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,8BAA8B,EAAE,EAAE,8BAA8B,CAAC,CAAC;QACxF,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;QACjB,GAAG,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACnC,CAAC;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,KAAK,UAAU,qBAAqB,CAAC,GAAqB,EAAE,QAAkB;IAC5E,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,IAA8B,CAAC;IACxD,MAAM,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACtC,MAAM,aAAa,GAAG,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;IACvC,MAAM,UAAU,GAAG,iBAAiB,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;IAChD,oEAAoE;IACpE,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,IAAI,MAAM,CAAC;IAE/C,IAAI,CAAC;QACH,MAAM,WAAW,GAAG,MAAM,QAAQ,CAAC,kBAAkB,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;QAExE,yDAAyD;QACzD,8DAA8D;QAC9D,MAAM,iCAAiC,CACrC,GAAG,EACH,WAAW,CAAC,MAAM,CAAC,SAAmB,EACtC,WAAW,CAAC,GAAG,CAChB,CAAC;QACF,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC;QAEnC,MAAM,OAAO,GAAG,mBAAmB,CAAC,WAAW,CAAC,CAAC;QAEjD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,GAAG,CAAC,QAAQ,CAAC,gBAAgB,WAAW,CAAC,GAAG,EAAE,CAAC,CAAC;YAChD,OAAO;QACT,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,aAAa,CAChC,SAAS,EACT,GAAG,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,SAAS,EACvC,GAAG,CAAC,aAAa,CAClB,CAAC;QAEF,oBAAoB;QACpB,IAAI,CAAC,eAAe,CAAC,UAAU,EAAE,aAAa,CAAC,EAAE,CAAC;YAChD,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gCAAgC,EAAE,EAAE,8BAA8B,CAAC,CAAC;YACzF,sCAAsC;YACtC,GAAG,CAAC,QAAQ,CAAC,gBAAgB,WAAW,CAAC,GAAG,mBAAmB,CAAC,CAAC;YACjE,OAAO;QACT,CAAC;QAED,IAAI,WAAW,KAAK,OAAO,EAAE,CAAC;YAC5B,iEAAiE;YACjE,MAAM,aAAa,CAAC,OAAO,CAAC,gBAAgB,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;YAEtD,aAAa,CAAC;gBACZ,cAAc,EAAE,GAAG,CAAC,EAAE;gBACtB,MAAM,EAAE,OAAO,CAAC,gBAAgB;gBAChC,SAAS,EAAE,0BAA0B;gBACrC,aAAa,EAAE,gBAAgB;gBAC/B,WAAW,EAAE,4CAA4C;gBACzD,SAAS,EAAE,GAAG,CAAC,EAAE;aAClB,CAAC,CAAC;YAEH,sDAAsD;YACtD,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,gBAAgB,EAAE,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;gBACnF,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;gBAC1D,gBAAgB,CACd;oBACE,EAAE,EAAE,OAAO,CAAC,gBAAgB;oBAC5B,KAAK,EAAE,OAAO,CAAC,KAAK;oBACpB,SAAS,EAAE,IAAI,EAAE,SAAS;oBAC1B,UAAU,EAAE,IAAI,EAAE,UAAU;iBAC7B,EACD,GAAG,EACH,OAAO,EACP,EAAE,EACF,MAAM,CACP,CAAC;YACJ,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,6BAA6B,EAAE,EAAE,2BAA2B,CAAC,CAAC;YACrF,CAAC;YAED,iDAAiD;YACjD,MAAM,QAAQ,CAAC,iBAAiB,CAC9B,GAAG,CAAC,GAAG,EACP,GAAG,CAAC,GAAG,EACP;gBACE,SAAS,EAAE,EAAE,GAAG,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE;aAC3C,EACD,EAAE,uBAAuB,EAAE,IAAI,EAAE,CAClC,CAAC;YAEF,GAAG,CAAC,QAAQ,CAAC,gBAAgB,WAAW,CAAC,GAAG,aAAa,CAAC,CAAC;YAC3D,OAAO;QACT,CAAC;QAED,6EAA6E;QAC7E,4EAA4E;QAC5E,MAAM,YAAY,GAAG,iBAAiB,CAAC,YAAY,EAAE,GAAG,CAAC,EAAE,EAAE,OAAO,CAAC,gBAAgB,CAAC,CAAC;QACvF,MAAM,eAAe,GAAG,MAAM,cAAc,CAAC,YAAY,EAAE,iBAAiB,CAAC,CAAC;QAE9E,IAAI,CAAC,eAAe,CAAC,OAAO,EAAE,CAAC;YAC7B,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,MAAM,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC,CAAC;YAC3D,aAAa,CAAC;gBACZ,cAAc,EAAE,GAAG,CAAC,EAAE;gBACtB,MAAM,EAAE,OAAO,CAAC,gBAAgB;gBAChC,SAAS,EAAE,uBAAuB;gBAClC,aAAa,EAAE,UAAU;gBACzB,WAAW,EAAE,6CAA6C;gBAC1D,SAAS,EAAE,GAAG,CAAC,EAAE;aAClB,CAAC,CAAC;YACH,MAAM,CAAC,GAAG,sBAAsB,CAAC,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;YACnD,MAAM,wBAAwB,CAC5B,GAAG,EACH,WAAW,CAAC,GAAG,EACf,OAAO,EACP,MAAM,EACN,CAAC,EACD,CAAC,CAAC,4BAA4B,CAAC,EAC/B,GAAG,CACJ,CAAC;YACF,OAAO;QACT,CAAC;QAED,mEAAmE;QACnE,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,GAAG,CAAC,QAAQ,CAAC,gBAAgB,WAAW,CAAC,GAAG,mBAAmB,CAAC,CAAC;YACjE,OAAO;QACT,CAAC;QAED,IAAI,SAAkB,CAAC;QACvB,IAAI,CAAC;YACH,SAAS,GAAG,MAAM,gBAAgB,CAAC,OAAO,CAAC,gBAAgB,EAAE,IAAI,CAAC,CAAC;QACrE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,iCAAiC,EAAE,CAAC;gBACvD,+BAA+B,EAAE,CAAC;gBAClC,MAAM,CAAC,GAAG,sBAAsB,CAAC,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;gBACnD,MAAM,wBAAwB,CAC5B,GAAG,EACH,WAAW,CAAC,GAAG,EACf,OAAO,EACP,MAAM,EACN,CAAC,EACD,CAAC,CAAC,+BAA+B,CAAC,EAClC,GAAG,CACJ,CAAC;gBACF,OAAO;YACT,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;QAED,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,aAAa,CAAC;gBACZ,cAAc,EAAE,GAAG,CAAC,EAAE;gBACtB,MAAM,EAAE,OAAO,CAAC,gBAAgB;gBAChC,SAAS,EAAE,uBAAuB;gBAClC,aAAa,EAAE,UAAU;gBACzB,WAAW,EAAE,+CAA+C;gBAC5D,SAAS,EAAE,GAAG,CAAC,EAAE;aAClB,CAAC,CAAC;YACH,8CAA8C;YAC9C,GAAG,CAAC,QAAQ,CAAC,gBAAgB,WAAW,CAAC,GAAG,sCAAsC,CAAC,CAAC;YACpF,OAAO;QACT,CAAC;QAED,wCAAwC;QACxC,MAAM,WAAW,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;QAE5C,aAAa,CAAC;YACZ,cAAc,EAAE,GAAG,CAAC,EAAE;YACtB,MAAM,EAAE,OAAO,CAAC,gBAAgB;YAChC,SAAS,EAAE,yBAAyB;YACpC,aAAa,EAAE,gBAAgB;YAC/B,WAAW,EAAE,oCAAoC;YACjD,SAAS,EAAE,GAAG,CAAC,EAAE;SAClB,CAAC,CAAC;QAEH,MAAM,QAAQ,CAAC,mBAAmB,CAChC,GAAG,CAAC,GAAG,EACP,GAAG,CAAC,GAAG,EACP;YACE,KAAK,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,gBAAgB,EAAE;SAC/C,EACD,EAAE,uBAAuB,EAAE,KAAK,EAAE,CACnC,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,yBAAyB,EAAE,EAAE,yBAAyB,CAAC,CAAC;QAC9E,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;QACjB,GAAG,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACnC,CAAC;AACH,CAAC;AAED,6EAA6E;AAC7E,SAAS,+BAA+B;IACtC,MAAM,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,gCAAgC,EAAE,EAAE,mCAAmC,CAAC,CAAC;AACjG,CAAC;AAED;;;;;;;;;;;GAWG;AACH,KAAK,UAAU,wBAAwB,CACrC,GAAqB,EACrB,GAAW,EACX,OAAyB,EACzB,MAAc,EACd,CAA6D,EAC7D,YAAoB,EACpB,UAAkB;IAElB,MAAM,KAAK,GAAG,MAAM,uBAAuB,CACzC,OAAO,CAAC,gBAAgB,EACxB,OAAO,CAAC,KAAK,EACb,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAC5B,CAAC;IACF,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IACvD,CAAC;IAED,MAAM,SAAS,GAAG,iBAAiB,EAAE,CAAC;IACtC,aAAa,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IAC9B,MAAM,OAAO,GAAoB;QAC/B,GAAG,CAAC,MAAM,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;QAChF,CAAC;QACD,WAAW,EAAE;YACX,GAAG;YACH,MAAM,EAAE,kBAAkB;YAC1B,MAAM,EAAE,EAA6B;YACrC,MAAM,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE;SAC3B;QACD,MAAM,EAAE,MAAM;QACd,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,KAAK,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE;KAC/B,CAAC;IAEF,MAAM,gBAAgB,CAAC,GAAG,EAAE,kBAAkB,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC;AACvE,CAAC;AAED,8EAA8E;AAC9E,4CAA4C;AAC5C,8EAA8E;AAE9E;;;;;;;;;;GAUG;AACH,KAAK,UAAU,wBAAwB,CACrC,GAAqB,EACrB,GAAW,EACX,OAAyB,EACzB,MAAc,EACd,CAA6D,EAC7D,YAAoB,EACpB,UAAU,GAAG,GAAG;IAEhB,MAAM,SAAS,GAAG,iBAAiB,EAAE,CAAC;IACtC,aAAa,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IAE9B,MAAM,OAAO,GAAoB;QAC/B,GAAG,CAAC,MAAM,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;QAChF,CAAC;QACD,WAAW,EAAE;YACX,GAAG;YACH,MAAM,EAAE,YAAY;YACpB,MAAM,EAAE,EAA6B;YACrC,MAAM,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE;SAC3B;QACD,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,WAAW,EAAE,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC;QACrC,UAAU,EAAE,OAAO,CAAC,MAAM,KAAK,OAAO;QACtC,gBAAgB,EAAE,IAAI;QACtB,KAAK,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE;KAC/B,CAAC;IAEF,MAAM,gBAAgB,CAAC,GAAG,EAAE,mBAAmB,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC;AACxE,CAAC"}

package/dist/routes/user-roles.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"user-roles.d.ts","sourceRoot":"","sources":["../../src/routes/user-roles.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,MAAM,MAAM,aAAa,CAAC;AAiDjC;;;;;;;;;;GAUG;AACH,wBAAgB,oBAAoB,IAAI,MAAM,CA+E7C"}
+{"version":3,"file":"user-roles.d.ts","sourceRoot":"","sources":["../../src/routes/user-roles.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,MAAM,MAAM,aAAa,CAAC;AA0FjC;;;;;;;;;;GAUG;AACH,wBAAgB,oBAAoB,IAAI,MAAM,CAuG7C"}

package/dist/routes/user-roles.js

@@ -22,10 +22,13 @@ import { z } from 'zod';
 import { requireAdminAuth } from '../middleware/admin-auth.js';
 import { requirePermission } from '../middleware/require-permission.js';
 import { requireUserOrganization } from '../middleware/require-user-organization.js';
-import { ADMIN_PERMISSIONS } from '../lib/admin-permissions.js';
-import { guardSuperAdmin } from '../lib/super-admin-protection.js';
+import { ADMIN_PERMISSIONS, getPermissionsForAdminRole } from '../lib/admin-permissions.js';
+import { getApplicationBySlug } from '../applications/service.js';
+import * as roleService from '../rbac/role-service.js';
 import * as userRoleService from '../rbac/user-role-service.js';
-import { RoleNotFoundError, RbacValidationError } from '../rbac/errors.js';
+import { RoleDelegationError, RoleNotFoundError, RbacValidationError } from '../rbac/errors.js';
+import { UserNotFoundError, UserValidationError } from '../users/errors.js';
+const ADMIN_APPLICATION_SLUG = 'porta-admin';
 // ---------------------------------------------------------------------------
 // Validation schemas
 // ---------------------------------------------------------------------------
@@ -44,6 +47,15 @@ function handleError(ctx, err) {
     if (err instanceof RoleNotFoundError) {
         ctx.throw(404, 'Role not found');
     }
+    if (err instanceof UserNotFoundError) {
+        ctx.throw(404, 'User not found');
+    }
+    if (err instanceof RoleDelegationError) {
+        ctx.throw(403, 'Role assignment is not permitted');
+    }
+    if (err instanceof UserValidationError) {
+        ctx.throw(409, 'At least one active super administrator is required');
+    }
     if (err instanceof RbacValidationError) {
         ctx.throw(400, 'Role assignment request is invalid');
     }
@@ -54,6 +66,30 @@ function handleError(ctx, err) {
     }
     throw err;
 }
+/**
+ * Reject an assignment that exceeds the authenticated actor's static Admin capabilities.
+ *
+ * This route check provides an early sanitized response. The service repeats the decision from
+ * locked database state so direct callers and concurrent changes cannot bypass it.
+ */
+async function requireDelegableRoles(applicationRoleIds, actorPermissions) {
+    const adminApplication = await getApplicationBySlug(ADMIN_APPLICATION_SLUG);
+    if (!adminApplication)
+        return;
+    const actorCapabilities = new Set(actorPermissions);
+    for (const roleId of applicationRoleIds) {
+        const role = await roleService.findRoleById(adminApplication.id, roleId);
+        // A null result means this is not a canonical Admin role. The service still locks and validates
+        // every requested role globally before assignment, including ordinary application roles.
+        if (!role)
+            continue;
+        if (role.applicationId !== adminApplication.id)
+            continue;
+        if (getPermissionsForAdminRole(role.slug).some((capability) => !actorCapabilities.has(capability))) {
+            throw new RoleDelegationError();
+        }
+    }
+}
 // ---------------------------------------------------------------------------
 // Router factory
 // ---------------------------------------------------------------------------
@@ -77,7 +113,7 @@ export function createUserRoleRouter() {
     // -------------------------------------------------------------------------
     router.get('/', requirePermission(ADMIN_PERMISSIONS.ROLE_READ), requireUserOrganization(), async (ctx) => {
         try {
-            const roles = await userRoleService.getUserRoles(ctx.params.userId);
+            const roles = await userRoleService.getUserRoles(ctx.params.orgId, ctx.params.userId);
             ctx.body = { data: roles };
         }
         catch (err) {
@@ -90,7 +126,13 @@ export function createUserRoleRouter() {
     router.put('/', requirePermission(ADMIN_PERMISSIONS.ROLE_ASSIGN), requireUserOrganization(), async (ctx) => {
         try {
             const body = roleIdsSchema.parse(ctx.request.body);
-            await userRoleService.assignRolesToUser(ctx.params.userId, body.roleIds);
+            const actor = ctx.state.adminUser;
+            if (!actor) {
+                ctx.throw(401, 'Authentication required');
+                return;
+            }
+            await requireDelegableRoles(body.roleIds, actor.permissions);
+            await userRoleService.assignRolesToUser(ctx.params.orgId, ctx.params.userId, body.roleIds, actor.id);
             ctx.status = 204;
         }
         catch (err) {
@@ -103,9 +145,14 @@ export function createUserRoleRouter() {
     router.delete('/', requirePermission(ADMIN_PERMISSIONS.ROLE_ASSIGN), requireUserOrganization(), async (ctx) => {
         try {
             const body = roleIdsSchema.parse(ctx.request.body);
-            await guardSuperAdmin(ctx.params.userId, 'remove-super-admin-role');
-            await userRoleService.removeRolesFromUser(ctx.params.userId, body.roleIds);
-            ctx.status = 204;
+            const actor = ctx.state.adminUser;
+            if (!actor) {
+                ctx.throw(401, 'Authentication required');
+                return;
+            }
+            const result = await userRoleService.removeRolesFromUser(ctx.params.orgId, ctx.params.userId, body.roleIds, actor.id);
+            ctx.status = 200;
+            ctx.body = { data: result };
         }
         catch (err) {
             handleError(ctx, err);
@@ -117,7 +164,7 @@ export function createUserRoleRouter() {
     // -------------------------------------------------------------------------
     router.get('/permissions', requirePermission(ADMIN_PERMISSIONS.ROLE_READ), requireUserOrganization(), async (ctx) => {
         try {
-            const permissions = await userRoleService.getUserPermissions(ctx.params.userId);
+            const permissions = await userRoleService.getUserPermissions(ctx.params.orgId, ctx.params.userId);
             ctx.body = { data: permissions };
         }
         catch (err) {

package/dist/routes/user-roles.js.map

@@ -1 +1 @@
-{"version":3,"file":"user-roles.js","sourceRoot":"","sources":["../../src/routes/user-roles.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAC/D,OAAO,EAAE,iBAAiB,EAAE,MAAM,qCAAqC,CAAC;AACxE,OAAO,EAAE,uBAAuB,EAAE,MAAM,4CAA4C,CAAC;AACrF,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAChE,OAAO,EAAE,eAAe,EAAE,MAAM,kCAAkC,CAAC;AACnE,OAAO,KAAK,eAAe,MAAM,8BAA8B,CAAC;AAChE,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAE3E,8EAA8E;AAC9E,qBAAqB;AACrB,8EAA8E;AAE9E,2DAA2D;AAC3D,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7B,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;CAC3C,CAAC,CAAC;AAEH,8EAA8E;AAC9E,uBAAuB;AACvB,8EAA8E;AAE9E;;;GAGG;AACH,SAAS,WAAW,CAClB,GAAqF,EACrF,GAAY;IAEZ,IAAI,GAAG,YAAY,iBAAiB,EAAE,CAAC;QACrC,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC;IACnC,CAAC;IACD,IAAI,GAAG,YAAY,mBAAmB,EAAE,CAAC;QACvC,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,oCAAoC,CAAC,CAAC;IACvD,CAAC;IACD,IAAI,GAAG,YAAY,CAAC,CAAC,QAAQ,EAAE,CAAC;QAC9B,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;QACjB,GAAG,CAAC,IAAI,GAAG,EAAE,KAAK,EAAE,oCAAoC,EAAE,CAAC;QAC3D,OAAO,SAAkB,CAAC;IAC5B,CAAC;IACD,MAAM,GAAG,CAAC;AACZ,CAAC;AAED,8EAA8E;AAC9E,iBAAiB;AACjB,8EAA8E;AAE9E;;;;;;;;;;GAUG;AACH,MAAM,UAAU,oBAAoB;IAClC,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,EAAE,MAAM,EAAE,qDAAqD,EAAE,CAAC,CAAC;IAE7F,0CAA0C;IAC1C,MAAM,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC,CAAC;IAE/B,4EAA4E;IAC5E,8BAA8B;IAC9B,4EAA4E;IAC5E,MAAM,CAAC,GAAG,CACR,GAAG,EACH,iBAAiB,CAAC,iBAAiB,CAAC,SAAS,CAAC,EAC9C,uBAAuB,EAAE,EACzB,KAAK,EAAE,GAAG,EAAE,EAAE;QACZ,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YACpE,GAAG,CAAC,IAAI,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;QAC7B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACxB,CAAC;IACH,CAAC,CACF,CAAC;IAEF,4EAA4E;IAC5E,+BAA+B;IAC/B,4EAA4E;IAC5E,MAAM,CAAC,GAAG,CACR,GAAG,EACH,iBAAiB,CAAC,iBAAiB,CAAC,WAAW,CAAC,EAChD,uBAAuB,EAAE,EACzB,KAAK,EAAE,GAAG,EAAE,EAAE;QACZ,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YACnD,MAAM,eAAe,CAAC,iBAAiB,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;YACzE,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;QACnB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACxB,CAAC;IACH,CAAC,CACF,CAAC;IAEF,4EAA4E;IAC5E,oCAAoC;IACpC,4EAA4E;IAC5E,MAAM,CAAC,MAAM,CACX,GAAG,EACH,iBAAiB,CAAC,iBAAiB,CAAC,WAAW,CAAC,EAChD,uBAAuB,EAAE,EACzB,KAAK,EAAE,GAAG,EAAE,EAAE;QACZ,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YACnD,MAAM,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,yBAAyB,CAAC,CAAC;YACpE,MAAM,eAAe,CAAC,mBAAmB,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;YAC3E,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;QACnB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACxB,CAAC;IACH,CAAC,CACF,CAAC;IAEF,4EAA4E;IAC5E,wDAAwD;IACxD,oEAAoE;IACpE,4EAA4E;IAC5E,MAAM,CAAC,GAAG,CACR,cAAc,EACd,iBAAiB,CAAC,iBAAiB,CAAC,SAAS,CAAC,EAC9C,uBAAuB,EAAE,EACzB,KAAK,EAAE,GAAG,EAAE,EAAE;QACZ,IAAI,CAAC;YACH,MAAM,WAAW,GAAG,MAAM,eAAe,CAAC,kBAAkB,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAChF,GAAG,CAAC,IAAI,GAAG,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;QACnC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACxB,CAAC;IACH,CAAC,CACF,CAAC;IAEF,OAAO,MAAM,CAAC;AAChB,CAAC"}
+{"version":3,"file":"user-roles.js","sourceRoot":"","sources":["../../src/routes/user-roles.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAC/D,OAAO,EAAE,iBAAiB,EAAE,MAAM,qCAAqC,CAAC;AACxE,OAAO,EAAE,uBAAuB,EAAE,MAAM,4CAA4C,CAAC;AACrF,OAAO,EAAE,iBAAiB,EAAE,0BAA0B,EAAE,MAAM,6BAA6B,CAAC;AAC5F,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAClE,OAAO,KAAK,WAAW,MAAM,yBAAyB,CAAC;AACvD,OAAO,KAAK,eAAe,MAAM,8BAA8B,CAAC;AAChE,OAAO,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAChG,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAE5E,MAAM,sBAAsB,GAAG,aAAa,CAAC;AAE7C,8EAA8E;AAC9E,qBAAqB;AACrB,8EAA8E;AAE9E,2DAA2D;AAC3D,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7B,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;CAC3C,CAAC,CAAC;AAEH,8EAA8E;AAC9E,uBAAuB;AACvB,8EAA8E;AAE9E;;;GAGG;AACH,SAAS,WAAW,CAClB,GAAqF,EACrF,GAAY;IAEZ,IAAI,GAAG,YAAY,iBAAiB,EAAE,CAAC;QACrC,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC;IACnC,CAAC;IACD,IAAI,GAAG,YAAY,iBAAiB,EAAE,CAAC;QACrC,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC;IACnC,CAAC;IACD,IAAI,GAAG,YAAY,mBAAmB,EAAE,CAAC;QACvC,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,kCAAkC,CAAC,CAAC;IACrD,CAAC;IACD,IAAI,GAAG,YAAY,mBAAmB,EAAE,CAAC;QACvC,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,qDAAqD,CAAC,CAAC;IACxE,CAAC;IACD,IAAI,GAAG,YAAY,mBAAmB,EAAE,CAAC;QACvC,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,oCAAoC,CAAC,CAAC;IACvD,CAAC;IACD,IAAI,GAAG,YAAY,CAAC,CAAC,QAAQ,EAAE,CAAC;QAC9B,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;QACjB,GAAG,CAAC,IAAI,GAAG,EAAE,KAAK,EAAE,oCAAoC,EAAE,CAAC;QAC3D,OAAO,SAAkB,CAAC;IAC5B,CAAC;IACD,MAAM,GAAG,CAAC;AACZ,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,qBAAqB,CAClC,kBAAqC,EACrC,gBAAmC;IAEnC,MAAM,gBAAgB,GAAG,MAAM,oBAAoB,CAAC,sBAAsB,CAAC,CAAC;IAC5E,IAAI,CAAC,gBAAgB;QAAE,OAAO;IAC9B,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,gBAAgB,CAAC,CAAC;IAEpD,KAAK,MAAM,MAAM,IAAI,kBAAkB,EAAE,CAAC;QACxC,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,YAAY,CAAC,gBAAgB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QACzE,gGAAgG;QAChG,yFAAyF;QACzF,IAAI,CAAC,IAAI;YAAE,SAAS;QACpB,IAAI,IAAI,CAAC,aAAa,KAAK,gBAAgB,CAAC,EAAE;YAAE,SAAS;QACzD,IACE,0BAA0B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,iBAAiB,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,EAC9F,CAAC;YACD,MAAM,IAAI,mBAAmB,EAAE,CAAC;QAClC,CAAC;IACH,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,iBAAiB;AACjB,8EAA8E;AAE9E;;;;;;;;;;GAUG;AACH,MAAM,UAAU,oBAAoB;IAClC,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,EAAE,MAAM,EAAE,qDAAqD,EAAE,CAAC,CAAC;IAE7F,0CAA0C;IAC1C,MAAM,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC,CAAC;IAE/B,4EAA4E;IAC5E,8BAA8B;IAC9B,4EAA4E;IAC5E,MAAM,CAAC,GAAG,CACR,GAAG,EACH,iBAAiB,CAAC,iBAAiB,CAAC,SAAS,CAAC,EAC9C,uBAAuB,EAAE,EACzB,KAAK,EAAE,GAAG,EAAE,EAAE;QACZ,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YACtF,GAAG,CAAC,IAAI,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;QAC7B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACxB,CAAC;IACH,CAAC,CACF,CAAC;IAEF,4EAA4E;IAC5E,+BAA+B;IAC/B,4EAA4E;IAC5E,MAAM,CAAC,GAAG,CACR,GAAG,EACH,iBAAiB,CAAC,iBAAiB,CAAC,WAAW,CAAC,EAChD,uBAAuB,EAAE,EACzB,KAAK,EAAE,GAAG,EAAE,EAAE;QACZ,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YACnD,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC;YAClC,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,yBAAyB,CAAC,CAAC;gBAC1C,OAAO;YACT,CAAC;YACD,MAAM,qBAAqB,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;YAC7D,MAAM,eAAe,CAAC,iBAAiB,CACrC,GAAG,CAAC,MAAM,CAAC,KAAK,EAChB,GAAG,CAAC,MAAM,CAAC,MAAM,EACjB,IAAI,CAAC,OAAO,EACZ,KAAK,CAAC,EAAE,CACT,CAAC;YACF,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;QACnB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACxB,CAAC;IACH,CAAC,CACF,CAAC;IAEF,4EAA4E;IAC5E,oCAAoC;IACpC,4EAA4E;IAC5E,MAAM,CAAC,MAAM,CACX,GAAG,EACH,iBAAiB,CAAC,iBAAiB,CAAC,WAAW,CAAC,EAChD,uBAAuB,EAAE,EACzB,KAAK,EAAE,GAAG,EAAE,EAAE;QACZ,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YACnD,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC;YAClC,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,yBAAyB,CAAC,CAAC;gBAC1C,OAAO;YACT,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,mBAAmB,CACtD,GAAG,CAAC,MAAM,CAAC,KAAK,EAChB,GAAG,CAAC,MAAM,CAAC,MAAM,EACjB,IAAI,CAAC,OAAO,EACZ,KAAK,CAAC,EAAE,CACT,CAAC;YACF,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;YACjB,GAAG,CAAC,IAAI,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;QAC9B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACxB,CAAC;IACH,CAAC,CACF,CAAC;IAEF,4EAA4E;IAC5E,wDAAwD;IACxD,oEAAoE;IACpE,4EAA4E;IAC5E,MAAM,CAAC,GAAG,CACR,cAAc,EACd,iBAAiB,CAAC,iBAAiB,CAAC,SAAS,CAAC,EAC9C,uBAAuB,EAAE,EACzB,KAAK,EAAE,GAAG,EAAE,EAAE;QACZ,IAAI,CAAC;YACH,MAAM,WAAW,GAAG,MAAM,eAAe,CAAC,kBAAkB,CAC1D,GAAG,CAAC,MAAM,CAAC,KAAK,EAChB,GAAG,CAAC,MAAM,CAAC,MAAM,CAClB,CAAC;YACF,GAAG,CAAC,IAAI,GAAG,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;QACnC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACxB,CAAC;IACH,CAAC,CACF,CAAC;IAEF,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/routes/users.d.ts

@@ -12,16 +12,12 @@
  *   GET    /:userId              — Get user by ID
  *   PUT    /:userId              — Update user profile
  *   POST   /:userId/deactivate   — Deactivate (active → inactive)
- *   POST   /:userId/reactivate   — Reactivate (inactive → active)
- *   POST   /:userId/suspend      — Suspend (active → suspended)
- *   POST   /:userId/unsuspend    — Unsuspend (suspended → active)
- *   POST   /:userId/lock         — Lock (active → locked)
- *   POST   /:userId/unlock       — Unlock (locked → active)
+ *   POST   /:userId/activate     — Activate (inactive → active)
  *   POST   /:userId/password     — Set/change password
  *   DELETE /:userId/password     — Clear password (passwordless)
  *   POST   /:userId/verify-email — Mark email as verified
  *   GET    /:userId/export       — GDPR data export (Article 20)
- *   POST   /:userId/purge        — GDPR data purge (Article 17)
+ *   DELETE /:userId              — Delete user
  *
  * Error mapping:
  *   UserNotFoundError → 404
@@ -35,8 +31,8 @@ import Router from '@koa/router';
  *
  * All routes require admin authorization with granular permissions.
  * Users are always scoped to an organization via the :orgId URL parameter.
- * Destructive operations on the super-admin user are blocked by
- * guardSuperAdmin() checks.
+ * Operations that cannot preserve bootstrap-administrator availability are rejected at their
+ * owning service or repository boundary.
  *
  * Prefix: /api/admin/organizations/:orgId/users
  *

package/dist/routes/users.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"users.d.ts","sourceRoot":"","sources":["../../src/routes/users.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,MAAM,MAAM,aAAa,CAAC;AAmKjC;;;;;;;;;;;GAWG;AACH,wBAAgB,gBAAgB,IAAI,MAAM,CAgiBzC;AA4HD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,0BAA0B,IAAI,MAAM,CAoLnD"}
+{"version":3,"file":"users.d.ts","sourceRoot":"","sources":["../../src/routes/users.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,MAAM,MAAM,aAAa,CAAC;AA0KjC;;;;;;;;;;;GAWG;AACH,wBAAgB,gBAAgB,IAAI,MAAM,CAkbzC;AAoHD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,0BAA0B,IAAI,MAAM,CAkHnD"}