@rapidraptor/auth-server 0.2.5 → 1.0.2

package/dist/session/sessionService.d.ts

@@ -9,8 +9,9 @@ export declare class TokenRevokedError extends Error {
     constructor();
 }
 /**
- * Main session management service
- * Orchestrates cache and Firestore with cache-first strategy
+ * Main session management service. Sessions are stored in Firestore as user_sessions/{sessionId}
+ * (sessionId is a UUID). Lookup is by userId (from JWT sub); cache is keyed by userId.
+ * Uses cache-first strategy with Firestore fallback.
  */
 export declare class SessionService {
     private cache;
@@ -21,6 +22,13 @@ export declare class SessionService {
     private logoutsCollectionName;
     private logoutTtlMs;
     constructor(cache: SessionCache, firestoreSync: FirestoreSync, firestore: Firestore, inactivityTimeout: number, collectionName?: string, logoutsCollectionName?: string, logoutTtlMs?: number);
+    /**
+     * Find active session for user.
+     * Sessions are stored as user_sessions/{sessionId}; we query by userId (from JWT sub) since
+     * sessionId is not sent by the client. orderBy lastActivityAt desc ensures a deterministic
+     * result when multiple active sessions exist for the same user (e.g. race or bug).
+     */
+    private findActiveSessionByUserId;
     /**
      * Validate session and return detailed status (cache-first lookup with Firestore fallback)
      * Returns explicit status instead of boolean to avoid requiring additional calls
@@ -33,64 +41,67 @@ export declare class SessionService {
      */
     isSessionValid(userId: string): Promise<boolean>;
     /**
-     * Check if session exists in Firestore (regardless of expiration)
-     * Also verifies data integrity (userId in document matches document ID)
+     * Check if a session document exists in Firestore for this user (regardless of expiration).
+     * Uses a query by userId since documents are keyed by sessionId.
      */
     sessionExists(userId: string): Promise<boolean>;
     /**
-     * Ensure session exists (idempotent - creates if doesn't exist)
-     * Returns true if session was created, false if it already existed and is valid
-     * Handles data integrity issues by overwriting with a new session
+     * Ensure a session exists for the user (idempotent). Creates a new session only when none
+     * exists or there is a data integrity issue. Returns true if a session was created, false if
+     * one already existed and is valid.
      *
-     * @param userId - The user ID
-     * @param tokenIssuedAt - Optional JWT token issued-at timestamp for revocation check
-     * @throws TokenRevokedError if token was issued before logout (when tokenIssuedAt is provided)
-     * @throws Error if session is expired (user must logout and login again)
+     * @param userId - User ID (from JWT sub)
+     * @param tokenIssuedAt - Optional JWT iat; if provided, we reject tokens issued before logout
+     * @throws TokenRevokedError if token was issued before logout
+     * @throws Error if session is expired (user must logout and log in again; we do not auto-recreate)
      */
     ensureSession(userId: string, tokenIssuedAt?: Date): Promise<boolean>;
     /**
-     * Create new session
+     * Create a new session. Session ID is an independent UUID (not derived from userId), so each
+     * login gets a distinct session and logout/re-login works correctly.
      */
     createSession(userId: string): Promise<void>;
     /**
-     * Update last activity timestamp
-     * Cache is updated immediately for fast reads, but Firestore write is throttled
+     * Update last activity timestamp and extend expiration. Cache is updated immediately for
+     * fast reads; Firestore write is queued and throttled (see FirestoreSync).
      */
     updateLastActivity(userId: string): Promise<void>;
     /**
-     * Clear session (logout)
-     * Also stores logout timestamp to prevent re-authentication with JWTs issued before logout
+     * Clear session (logout). Removes all session documents for this user and records the logout
+     * so tokens issued before this time can be rejected (see wasTokenIssuedBeforeLogout).
      */
     clearSession(userId: string): Promise<void>;
     /**
-     * Check if JWT token was issued before logout
-     * Returns true if token was issued before logout timestamp
+     * Check if the JWT was issued before the user's last logout.
+     * Logout records are stored at user_logouts/{userId} (one per user). We use this to reject
+     * tokens that were issued before logout, since JWTs cannot be revoked directly.
+     * Returns true if token was issued before logout (token should be rejected).
      */
     wasTokenIssuedBeforeLogout(userId: string, tokenIssuedAt: Date): Promise<boolean>;
     /**
-     * Warmup cache from Firestore
-     * Loads all active sessions into cache on startup
-     * Also cleans up expired sessions (lazy deletion)
+     * Warmup cache from Firestore on startup. Loads all non-expired sessions into the in-memory
+     * cache (keyed by userId). Document IDs in user_sessions are sessionIds; we cache by userId
+     * for lookup. Also performs lazy deletion of expired session documents.
      */
     warmupCache(): Promise<void>;
     /**
-     * Parse Firestore document data into SessionInfo
+     * Parse Firestore session document (timestamp fields may be Firestore Timestamp or Date) into SessionInfo.
      */
     private parseFirestoreDocument;
     /**
-     * Convert SessionInfo to Firestore document format
+     * Convert SessionInfo to Firestore document format for user_sessions collection.
      */
     private toFirestoreDocument;
     /**
-     * Convert Firestore Timestamp to JavaScript Date
+     * Normalize Firestore Timestamp or Date to JavaScript Date.
      */
     private toDate;
     /**
-     * Parse Firestore logout document data
+     * Parse Firestore logout document (user_logouts collection) into typed fields.
      */
     private parseLogoutDocument;
     /**
-     * Convert logout info to Firestore document format
+     * Convert logout info to Firestore document format for user_logouts collection.
      */
     private toLogoutDocument;
 }

package/dist/session/sessionService.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sessionService.d.ts","sourceRoot":"","sources":["../../src/session/sessionService.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAa,MAAM,0BAA0B,CAAC;AACrE,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjD,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAOnD,OAAO,EAAE,uBAAuB,EAAE,MAAM,0BAA0B,CAAC;AAGnE;;GAEG;AACH,qBAAa,iBAAkB,SAAQ,KAAK;;CAK3C;AAED;;;GAGG;AACH,qBAAa,cAAc;IACzB,OAAO,CAAC,KAAK,CAAe;IAC5B,OAAO,CAAC,aAAa,CAAgB;IACrC,OAAO,CAAC,SAAS,CAAY;IAC7B,OAAO,CAAC,iBAAiB,CAAS;IAClC,OAAO,CAAC,cAAc,CAAS;IAC/B,OAAO,CAAC,qBAAqB,CAAS;IACtC,OAAO,CAAC,WAAW,CAAS;gBAG1B,KAAK,EAAE,YAAY,EACnB,aAAa,EAAE,aAAa,EAC5B,SAAS,EAAE,SAAS,EACpB,iBAAiB,EAAE,MAAM,EACzB,cAAc,GAAE,MAAoD,EACpE,qBAAqB,GAAE,MAAmD,EAC1E,WAAW,GAAE,MAA+B;IAW9C;;;;OAIG;IACG,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,CAAC;IA6CvE;;;OAGG;IACG,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAKtD;;;OAGG;IACG,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAarD;;;;;;;;;OASG;IACG,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,aAAa,CAAC,EAAE,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC;IA4B3E;;OAEG;IACG,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAmBlD;;;OAGG;IACG,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IA0BvD;;;OAGG;IACG,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAwBjD;;;OAGG;IACG,0BAA0B,CAAC,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC;IAqBvF;;;;OAIG;IACG,WAAW,IAAI,OAAO,CAAC,IAAI,CAAC;IAqDlC;;OAEG;IACH,OAAO,CAAC,sBAAsB;IAS9B;;OAEG;IACH,OAAO,CAAC,mBAAmB;IAS3B;;OAEG;IACH,OAAO,CAAC,MAAM;IAOd;;OAEG;IACH,OAAO,CAAC,mBAAmB;IAY3B;;OAEG;IACH,OAAO,CAAC,gBAAgB;CAWzB"}
+{"version":3,"file":"sessionService.d.ts","sourceRoot":"","sources":["../../src/session/sessionService.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,SAAS,EAAa,MAAM,0BAA0B,CAAC;AACrE,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjD,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAOnD,OAAO,EAAE,uBAAuB,EAAE,MAAM,0BAA0B,CAAC;AAGnE;;GAEG;AACH,qBAAa,iBAAkB,SAAQ,KAAK;;CAK3C;AAED;;;;GAIG;AACH,qBAAa,cAAc;IACzB,OAAO,CAAC,KAAK,CAAe;IAC5B,OAAO,CAAC,aAAa,CAAgB;IACrC,OAAO,CAAC,SAAS,CAAY;IAC7B,OAAO,CAAC,iBAAiB,CAAS;IAClC,OAAO,CAAC,cAAc,CAAS;IAC/B,OAAO,CAAC,qBAAqB,CAAS;IACtC,OAAO,CAAC,WAAW,CAAS;gBAG1B,KAAK,EAAE,YAAY,EACnB,aAAa,EAAE,aAAa,EAC5B,SAAS,EAAE,SAAS,EACpB,iBAAiB,EAAE,MAAM,EACzB,cAAc,GAAE,MAAoD,EACpE,qBAAqB,GAAE,MAAmD,EAC1E,WAAW,GAAE,MAA+B;IAW9C;;;;;OAKG;YACW,yBAAyB;IAgBvC;;;;OAIG;IACG,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,CAAC;IAuCvE;;;OAGG;IACG,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAKtD;;;OAGG;IACG,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAcrD;;;;;;;;;OASG;IACG,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,aAAa,CAAC,EAAE,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC;IAuB3E;;;OAGG;IACG,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAoBlD;;;OAGG;IACG,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAsBvD;;;OAGG;IACG,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IA0BjD;;;;;OAKG;IACG,0BAA0B,CAAC,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC;IAiBvF;;;;OAIG;IACG,WAAW,IAAI,OAAO,CAAC,IAAI,CAAC;IAgDlC;;OAEG;IACH,OAAO,CAAC,sBAAsB;IAU9B;;OAEG;IACH,OAAO,CAAC,mBAAmB;IAU3B;;OAEG;IACH,OAAO,CAAC,MAAM;IAOd;;OAEG;IACH,OAAO,CAAC,mBAAmB;IAY3B;;OAEG;IACH,OAAO,CAAC,gBAAgB;CAWzB"}

package/dist/session/sessionService.js

@@ -1,3 +1,4 @@
+import { randomUUID } from 'crypto';
 import { SessionValidationStatus } from '@rapidraptor/auth-shared';
 import { DEFAULTS } from '@rapidraptor/auth-shared';
 /**
@@ -10,8 +11,9 @@ export class TokenRevokedError extends Error {
     }
 }
 /**
- * Main session management service
- * Orchestrates cache and Firestore with cache-first strategy
+ * Main session management service. Sessions are stored in Firestore as user_sessions/{sessionId}
+ * (sessionId is a UUID). Lookup is by userId (from JWT sub); cache is keyed by userId.
+ * Uses cache-first strategy with Firestore fallback.
  */
 export class SessionService {
     cache;
@@ -30,44 +32,59 @@ export class SessionService {
         this.logoutsCollectionName = logoutsCollectionName;
         this.logoutTtlMs = logoutTtlMs;
     }
+    /**
+     * Find active session for user.
+     * Sessions are stored as user_sessions/{sessionId}; we query by userId (from JWT sub) since
+     * sessionId is not sent by the client. orderBy lastActivityAt desc ensures a deterministic
+     * result when multiple active sessions exist for the same user (e.g. race or bug).
+     */
+    async findActiveSessionByUserId(userId) {
+        const snapshot = await this.firestore
+            .collection(this.collectionName)
+            .where('userId', '==', userId)
+            .where('expiresAt', '>', new Date())
+            .orderBy('lastActivityAt', 'desc')
+            .limit(1)
+            .get();
+        if (snapshot.empty) {
+            return null;
+        }
+        const data = snapshot.docs[0].data();
+        return this.parseFirestoreDocument(data);
+    }
     /**
      * Validate session and return detailed status (cache-first lookup with Firestore fallback)
      * Returns explicit status instead of boolean to avoid requiring additional calls
      * to determine why a session is invalid
      */
     async validateSession(userId) {
-        // Check cache first
+        // Cache is keyed by userId (one session per user in cache)
         const cachedSession = this.cache.get(userId);
         // Step 1: Check for userId mismatch (data integrity issue)
         if (cachedSession && cachedSession.userId !== userId) {
-            // Data integrity issue - invalidate cache entry
             this.cache.clear(userId);
             return SessionValidationStatus.DATA_INTEGRITY_ERROR;
         }
-        // Step 2: Check if cached session is valid
+        // Step 2: Check if cached session is valid and not expired
         if (cachedSession && !this.cache.isExpired(userId)) {
-            // Cached session is valid and userId matches
             return SessionValidationStatus.VALID;
         }
-        // Cache miss or expired - check Firestore
-        const docRef = this.firestore.collection(this.collectionName).doc(userId);
-        const doc = await docRef.get();
-        if (!doc.exists) {
+        // Step 2b: Cached session exists but is expired — return EXPIRED so caller can require re-login
+        if (cachedSession && this.cache.isExpired(userId)) {
+            return SessionValidationStatus.EXPIRED;
+        }
+        // Step 3: Cache miss — query Firestore by userId (sessions live under user_sessions/{sessionId})
+        const session = await this.findActiveSessionByUserId(userId);
+        if (!session) {
             return SessionValidationStatus.NOT_FOUND;
         }
-        // Parse Firestore document
-        const data = doc.data();
-        const session = this.parseFirestoreDocument(data);
-        // Verify session userId matches requested userId (data integrity check)
         if (session.userId !== userId) {
-            // Data integrity issue - session document userId doesn't match document ID
             return SessionValidationStatus.DATA_INTEGRITY_ERROR;
         }
-        // Check expiration
         if (new Date() > session.expiresAt) {
             return SessionValidationStatus.EXPIRED;
         }
-        // Update cache
+        // Repopulate cache for future requests
         this.cache.set(userId, session);
         return SessionValidationStatus.VALID;
     }
@@ -80,161 +97,154 @@ export class SessionService {
         return status === SessionValidationStatus.VALID;
     }
     /**
-     * Check if session exists in Firestore (regardless of expiration)
-     * Also verifies data integrity (userId in document matches document ID)
+     * Check if a session document exists in Firestore for this user (regardless of expiration).
+     * Uses a query by userId since documents are keyed by sessionId.
      */
     async sessionExists(userId) {
-        const docRef = this.firestore.collection(this.collectionName).doc(userId);
-        const doc = await docRef.get();
-        if (!doc.exists) {
+        const snapshot = await this.firestore
+            .collection(this.collectionName)
+            .where('userId', '==', userId)
+            .limit(1)
+            .get();
+        if (snapshot.empty) {
             return false;
         }
-        // Verify session userId matches requested userId (data integrity check)
-        const data = doc.data();
+        const data = snapshot.docs[0].data();
         return data.userId === userId;
     }
     /**
-     * Ensure session exists (idempotent - creates if doesn't exist)
-     * Returns true if session was created, false if it already existed and is valid
-     * Handles data integrity issues by overwriting with a new session
+     * Ensure a session exists for the user (idempotent). Creates a new session only when none
+     * exists or there is a data integrity issue. Returns true if a session was created, false if
+     * one already existed and is valid.
      *
-     * @param userId - The user ID
-     * @param tokenIssuedAt - Optional JWT token issued-at timestamp for revocation check
-     * @throws TokenRevokedError if token was issued before logout (when tokenIssuedAt is provided)
-     * @throws Error if session is expired (user must logout and login again)
+     * @param userId - User ID (from JWT sub)
+     * @param tokenIssuedAt - Optional JWT iat; if provided, we reject tokens issued before logout
+     * @throws TokenRevokedError if token was issued before logout
+     * @throws Error if session is expired (user must logout and log in again; we do not auto-recreate)
      */
     async ensureSession(userId, tokenIssuedAt) {
-        // Check if token was issued before logout (if tokenIssuedAt provided)
         if (tokenIssuedAt) {
             const wasIssuedBeforeLogout = await this.wasTokenIssuedBeforeLogout(userId, tokenIssuedAt);
             if (wasIssuedBeforeLogout) {
                 throw new TokenRevokedError();
             }
         }
-        // Check session validation status
         const status = await this.validateSession(userId);
         if (status === SessionValidationStatus.VALID) {
-            return false; // Session already existed and is valid
+            return false;
         }
-        // If session is expired, don't recreate it - user must logout and relogin
         if (status === SessionValidationStatus.EXPIRED) {
             throw new Error('Session has expired. Please logout and login again.');
         }
-        // Session doesn't exist (NOT_FOUND) or has data integrity issues - create/overwrite it
-        // Note: For DATA_INTEGRITY_ERROR, we recreate the session to fix the corruption
-        // createSession is idempotent (uses set() which overwrites)
+        // NOT_FOUND or DATA_INTEGRITY_ERROR: create a new session (new sessionId)
         await this.createSession(userId);
-        return true; // Session was created
+        return true;
     }
     /**
-     * Create new session
+     * Create a new session. Session ID is an independent UUID (not derived from userId), so each
+     * login gets a distinct session and logout/re-login works correctly.
      */
     async createSession(userId) {
+        const sessionId = randomUUID();
         const now = new Date();
         const expiresAt = new Date(now.getTime() + this.inactivityTimeout);
         const session = {
+            sessionId,
             userId,
             createdAt: now,
             lastActivityAt: now,
             expiresAt,
         };
-        // Update cache immediately
+        // Cache is keyed by userId for lookup; document in Firestore is keyed by sessionId
         this.cache.set(userId, session);
-        // Write to Firestore immediately (no throttle on creation)
-        const docRef = this.firestore.collection(this.collectionName).doc(userId);
+        const docRef = this.firestore.collection(this.collectionName).doc(sessionId);
         await docRef.set(this.toFirestoreDocument(session));
     }
     /**
-     * Update last activity timestamp
-     * Cache is updated immediately for fast reads, but Firestore write is throttled
+     * Update last activity timestamp and extend expiration. Cache is updated immediately for
+     * fast reads; Firestore write is queued and throttled (see FirestoreSync).
      */
     async updateLastActivity(userId) {
-        // Load and validate session (handles cache + Firestore fallback)
-        const isValid = await this.isSessionValid(userId);
-        if (!isValid) {
-            return; // Session doesn't exist or is expired
+        const status = await this.validateSession(userId);
+        if (status !== SessionValidationStatus.VALID) {
+            return; // Session doesn't exist or is expired; nothing to update
         }
-        // Session is guaranteed to be in cache and valid at this point
         const session = this.cache.get(userId);
         if (!session) {
-            // Should not happen, but handle gracefully
             return;
         }
-        // Update cache immediately (fast path)
         const updatedSession = {
             ...session,
             lastActivityAt: new Date(),
             expiresAt: new Date(Date.now() + this.inactivityTimeout),
         };
         this.cache.set(userId, updatedSession);
-        // Queue Firestore write (throttled - may not write immediately)
+        // Firestore write uses session.sessionId as document ID; throttled per user
         this.firestoreSync.queueWrite(userId, updatedSession);
     }
     /**
-     * Clear session (logout)
-     * Also stores logout timestamp to prevent re-authentication with JWTs issued before logout
+     * Clear session (logout). Removes all session documents for this user and records the logout
+     * so tokens issued before this time can be rejected (see wasTokenIssuedBeforeLogout).
      */
     async clearSession(userId) {
-        // Clear cache
         this.cache.clear(userId);
-        // Store logout timestamp to prevent re-authentication with old JWTs
-        // This addresses the JWT limitation: JWTs cannot be revoked, but we can track
-        // when a user logged out and reject tokens issued before that time
         const now = new Date();
         const expiresAt = new Date(now.getTime() + this.logoutTtlMs);
+        // Logout record is keyed by userId (per-user, not per-session); used for token revocation check
         const logoutRef = this.firestore.collection(this.logoutsCollectionName).doc(userId);
         await logoutRef.set(this.toLogoutDocument({
             userId,
             loggedOutAt: now,
             expiresAt,
         }));
-        // Delete session document from Firestore
-        const docRef = this.firestore.collection(this.collectionName).doc(userId);
-        await docRef.delete();
+        // Sessions are stored as user_sessions/{sessionId}; query by userId and delete each document
+        const snapshot = await this.firestore
+            .collection(this.collectionName)
+            .where('userId', '==', userId)
+            .get();
+        for (const doc of snapshot.docs) {
+            await doc.ref.delete();
+        }
     }
     /**
-     * Check if JWT token was issued before logout
-     * Returns true if token was issued before logout timestamp
+     * Check if the JWT was issued before the user's last logout.
+     * Logout records are stored at user_logouts/{userId} (one per user). We use this to reject
+     * tokens that were issued before logout, since JWTs cannot be revoked directly.
+     * Returns true if token was issued before logout (token should be rejected).
      */
     async wasTokenIssuedBeforeLogout(userId, tokenIssuedAt) {
-        // Check logout timestamp
         const logoutRef = this.firestore.collection(this.logoutsCollectionName).doc(userId);
         const doc = await logoutRef.get();
         if (!doc.exists) {
-            return false; // No logout recorded - token is valid
+            return false; // No logout recorded — token is acceptable
         }
         const data = doc.data();
         if (!data) {
             return false;
         }
-        // Parse logout document
         const logoutInfo = this.parseLogoutDocument(data);
-        // Check if token was issued BEFORE logout
         return tokenIssuedAt < logoutInfo.loggedOutAt;
     }
     /**
-     * Warmup cache from Firestore
-     * Loads all active sessions into cache on startup
-     * Also cleans up expired sessions (lazy deletion)
+     * Warmup cache from Firestore on startup. Loads all non-expired sessions into the in-memory
+     * cache (keyed by userId). Document IDs in user_sessions are sessionIds; we cache by userId
+     * for lookup. Also performs lazy deletion of expired session documents.
      */
     async warmupCache() {
         const collection = this.firestore.collection(this.collectionName);
         const now = new Date();
-        // Query active sessions
         const snapshot = await collection.where('expiresAt', '>', now).get();
-        // Load into cache
         for (const doc of snapshot.docs) {
             const data = doc.data();
-            // SECURITY: Verify session userId matches document ID (data integrity check)
-            // Skip sessions with mismatched userId (data corruption)
-            if (data.userId !== doc.id) {
-                console.warn(`Skipping session with mismatched userId: document ID=${doc.id}, data.userId=${data.userId}`);
+            // Document ID must match sessionId in payload (data integrity)
+            if (data.sessionId !== doc.id) {
+                console.warn(`Skipping session with mismatched sessionId: document ID=${doc.id}, data.sessionId=${data.sessionId}`);
                 continue;
             }
             const session = this.parseFirestoreDocument(data);
             this.cache.set(session.userId, session);
         }
-        // Cleanup expired sessions (lazy deletion)
+        // Lazy cleanup: delete expired session documents in batches
         const expiredSnapshot = await collection.where('expiresAt', '<=', now).get();
         if (expiredSnapshot.empty) {
             return; // No expired sessions to clean up
@@ -257,10 +267,11 @@ export class SessionService {
         }
     }
     /**
-     * Parse Firestore document data into SessionInfo
+     * Parse Firestore session document (timestamp fields may be Firestore Timestamp or Date) into SessionInfo.
      */
     parseFirestoreDocument(data) {
         return {
+            sessionId: data.sessionId,
             userId: data.userId,
             createdAt: this.toDate(data.createdAt),
             lastActivityAt: this.toDate(data.lastActivityAt),
@@ -268,10 +279,11 @@ export class SessionService {
         };
     }
     /**
-     * Convert SessionInfo to Firestore document format
+     * Convert SessionInfo to Firestore document format for user_sessions collection.
      */
     toFirestoreDocument(session) {
         return {
+            sessionId: session.sessionId,
             userId: session.userId,
             createdAt: session.createdAt,
             lastActivityAt: session.lastActivityAt,
@@ -279,7 +291,7 @@ export class SessionService {
         };
     }
     /**
-     * Convert Firestore Timestamp to JavaScript Date
+     * Normalize Firestore Timestamp or Date to JavaScript Date.
      */
     toDate(timestamp) {
         if (timestamp instanceof Date) {
@@ -288,7 +300,7 @@ export class SessionService {
         return timestamp.toDate();
     }
     /**
-     * Parse Firestore logout document data
+     * Parse Firestore logout document (user_logouts collection) into typed fields.
      */
     parseLogoutDocument(data) {
         return {
@@ -298,7 +310,7 @@ export class SessionService {
         };
     }
     /**
-     * Convert logout info to Firestore document format
+     * Convert logout info to Firestore document format for user_logouts collection.
      */
     toLogoutDocument(logoutInfo) {
         return {

package/dist/session/sessionService.js.map

@@ -1 +1 @@
-{"version":3,"file":"sessionService.js","sourceRoot":"","sources":["../../src/session/sessionService.ts"],"names":[],"mappings":"AASA,OAAO,EAAE,uBAAuB,EAAE,MAAM,0BAA0B,CAAC;AACnE,OAAO,EAAE,QAAQ,EAAE,MAAM,0BAA0B,CAAC;AAEpD;;GAEG;AACH,MAAM,OAAO,iBAAkB,SAAQ,KAAK;IAC1C;QACE,KAAK,CAAC,gCAAgC,CAAC,CAAC;QACxC,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;IAClC,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,cAAc;IACjB,KAAK,CAAe;IACpB,aAAa,CAAgB;IAC7B,SAAS,CAAY;IACrB,iBAAiB,CAAS;IAC1B,cAAc,CAAS;IACvB,qBAAqB,CAAS;IAC9B,WAAW,CAAS;IAE5B,YACE,KAAmB,EACnB,aAA4B,EAC5B,SAAoB,EACpB,iBAAyB,EACzB,iBAAyB,QAAQ,CAAC,kCAAkC,EACpE,wBAAgC,QAAQ,CAAC,iCAAiC,EAC1E,cAAsB,QAAQ,CAAC,aAAa;QAE5C,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QACnB,IAAI,CAAC,aAAa,GAAG,aAAa,CAAC;QACnC,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QAC3B,IAAI,CAAC,iBAAiB,GAAG,iBAAiB,CAAC;QAC3C,IAAI,CAAC,cAAc,GAAG,cAAc,CAAC;QACrC,IAAI,CAAC,qBAAqB,GAAG,qBAAqB,CAAC;QACnD,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;IACjC,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,eAAe,CAAC,MAAc;QAClC,oBAAoB;QACpB,MAAM,aAAa,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAE7C,2DAA2D;QAC3D,IAAI,aAAa,IAAI,aAAa,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YACrD,gDAAgD;YAChD,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YACzB,OAAO,uBAAuB,CAAC,oBAAoB,CAAC;QACtD,CAAC;QAED,2CAA2C;QAC3C,IAAI,aAAa,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC;YACnD,6CAA6C;YAC7C,OAAO,uBAAuB,CAAC,KAAK,CAAC;QACvC,CAAC;QAED,0CAA0C;QAC1C,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC1E,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,GAAG,EAAE,CAAC;QAE/B,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC;YAChB,OAAO,uBAAuB,CAAC,SAAS,CAAC;QAC3C,CAAC;QAED,2BAA2B;QAC3B,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,EAA8B,CAAC;QACpD,MAAM,OAAO,GAAG,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,CAAC;QAElD,wEAAwE;QACxE,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC9B,2EAA2E;YAC3E,OAAO,uBAAuB,CAAC,oBAAoB,CAAC;QACtD,CAAC;QAED,mBAAmB;QACnB,IAAI,IAAI,IAAI,EAAE,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC;YACnC,OAAO,uBAAuB,CAAC,OAAO,CAAC;QACzC,CAAC;QAED,eAAe;QACf,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAChC,OAAO,uBAAuB,CAAC,KAAK,CAAC;IACvC,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,cAAc,CAAC,MAAc;QACjC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;QAClD,OAAO,MAAM,KAAK,uBAAuB,CAAC,KAAK,CAAC;IAClD,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,aAAa,CAAC,MAAc;QAChC,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC1E,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,GAAG,EAAE,CAAC;QAE/B,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC;YAChB,OAAO,KAAK,CAAC;QACf,CAAC;QAED,wEAAwE;QACxE,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,EAA8B,CAAC;QACpD,OAAO,IAAI,CAAC,MAAM,KAAK,MAAM,CAAC;IAChC,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,aAAa,CAAC,MAAc,EAAE,aAAoB;QACtD,sEAAsE;QACtE,IAAI,aAAa,EAAE,CAAC;YAClB,MAAM,qBAAqB,GAAG,MAAM,IAAI,CAAC,0BAA0B,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;YAC3F,IAAI,qBAAqB,EAAE,CAAC;gBAC1B,MAAM,IAAI,iBAAiB,EAAE,CAAC;YAChC,CAAC;QACH,CAAC;QAED,kCAAkC;QAClC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;QAElD,IAAI,MAAM,KAAK,uBAAuB,CAAC,KAAK,EAAE,CAAC;YAC7C,OAAO,KAAK,CAAC,CAAC,uCAAuC;QACvD,CAAC;QAED,0EAA0E;QAC1E,IAAI,MAAM,KAAK,uBAAuB,CAAC,OAAO,EAAE,CAAC;YAC/C,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;QACzE,CAAC;QAED,uFAAuF;QACvF,gFAAgF;QAChF,4DAA4D;QAC5D,MAAM,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;QACjC,OAAO,IAAI,CAAC,CAAC,sBAAsB;IACrC,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,aAAa,CAAC,MAAc;QAChC,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,iBAAiB,CAAC,CAAC;QAEnE,MAAM,OAAO,GAAgB;YAC3B,MAAM;YACN,SAAS,EAAE,GAAG;YACd,cAAc,EAAE,GAAG;YACnB,SAAS;SACV,CAAC;QAEF,2BAA2B;QAC3B,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAEhC,2DAA2D;QAC3D,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC1E,MAAM,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC,CAAC;IACtD,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,kBAAkB,CAAC,MAAc;QACrC,iEAAiE;QACjE,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;QAClD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,CAAC,sCAAsC;QAChD,CAAC;QAED,+DAA+D;QAC/D,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACvC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,2CAA2C;YAC3C,OAAO;QACT,CAAC;QAED,uCAAuC;QACvC,MAAM,cAAc,GAAgB;YAClC,GAAG,OAAO;YACV,cAAc,EAAE,IAAI,IAAI,EAAE;YAC1B,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,iBAAiB,CAAC;SACzD,CAAC;QACF,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;QAEvC,gEAAgE;QAChE,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IACxD,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,YAAY,CAAC,MAAc;QAC/B,cAAc;QACd,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAEzB,oEAAoE;QACpE,8EAA8E;QAC9E,mEAAmE;QACnE,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC;QAE7D,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACpF,MAAM,SAAS,CAAC,GAAG,CACjB,IAAI,CAAC,gBAAgB,CAAC;YACpB,MAAM;YACN,WAAW,EAAE,GAAG;YAChB,SAAS;SACV,CAAC,CACH,CAAC;QAEF,yCAAyC;QACzC,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC1E,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC;IACxB,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,0BAA0B,CAAC,MAAc,EAAE,aAAmB;QAClE,yBAAyB;QACzB,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACpF,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,CAAC;QAElC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC;YAChB,OAAO,KAAK,CAAC,CAAC,sCAAsC;QACtD,CAAC;QAED,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,EAA6B,CAAC;QACnD,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,KAAK,CAAC;QACf,CAAC;QAED,wBAAwB;QACxB,MAAM,UAAU,GAAG,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC;QAElD,0CAA0C;QAC1C,OAAO,aAAa,GAAG,UAAU,CAAC,WAAW,CAAC;IAChD,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,WAAW;QACf,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAClE,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;QAEvB,wBAAwB;QACxB,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,KAAK,CAAC,WAAW,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;QAErE,kBAAkB;QAClB,KAAK,MAAM,GAAG,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC;YAChC,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,EAA8B,CAAC;YAEpD,6EAA6E;YAC7E,yDAAyD;YACzD,IAAI,IAAI,CAAC,MAAM,KAAK,GAAG,CAAC,EAAE,EAAE,CAAC;gBAC3B,OAAO,CAAC,IAAI,CACV,wDAAwD,GAAG,CAAC,EAAE,iBAAiB,IAAI,CAAC,MAAM,EAAE,CAC7F,CAAC;gBACF,SAAS;YACX,CAAC;YAED,MAAM,OAAO,GAAG,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,CAAC;YAClD,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAC1C,CAAC;QAED,2CAA2C;QAC3C,MAAM,eAAe,GAAG,MAAM,UAAU,CAAC,KAAK,CAAC,WAAW,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;QAE7E,IAAI,eAAe,CAAC,KAAK,EAAE,CAAC;YAC1B,OAAO,CAAC,kCAAkC;QAC5C,CAAC;QAED,oEAAoE;QACpE,MAAM,SAAS,GAAG,GAAG,CAAC;QACtB,MAAM,WAAW,GAAG,eAAe,CAAC,IAAI,CAAC;QACzC,IAAI,YAAY,GAAG,CAAC,CAAC;QAErB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,WAAW,CAAC,MAAM,EAAE,CAAC,IAAI,SAAS,EAAE,CAAC;YACvD,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC;YACrC,MAAM,SAAS,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,SAAS,CAAC,CAAC;YAEtD,KAAK,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;gBAC5B,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;gBACtB,YAAY,EAAE,CAAC;YACjB,CAAC;YAED,MAAM,KAAK,CAAC,MAAM,EAAE,CAAC;QACvB,CAAC;QAED,IAAI,YAAY,GAAG,CAAC,EAAE,CAAC;YACrB,OAAO,CAAC,IAAI,CAAC,cAAc,YAAY,yCAAyC,CAAC,CAAC;QACpF,CAAC;IACH,CAAC;IAED;;OAEG;IACK,sBAAsB,CAAC,IAA8B;QAC3D,OAAO;YACL,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC;YACtC,cAAc,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC;YAChD,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC;SACvC,CAAC;IACJ,CAAC;IAED;;OAEG;IACK,mBAAmB,CAAC,OAAoB;QAC9C,OAAO;YACL,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,cAAc,EAAE,OAAO,CAAC,cAAc;YACtC,SAAS,EAAE,OAAO,CAAC,SAAS;SAC7B,CAAC;IACJ,CAAC;IAED;;OAEG;IACK,MAAM,CAAC,SAAgD;QAC7D,IAAI,SAAS,YAAY,IAAI,EAAE,CAAC;YAC9B,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,OAAO,SAAS,CAAC,MAAM,EAAE,CAAC;IAC5B,CAAC;IAED;;OAEG;IACK,mBAAmB,CAAC,IAA6B;QAKvD,OAAO;YACL,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC;YAC1C,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC;SACvC,CAAC;IACJ,CAAC;IAED;;OAEG;IACK,gBAAgB,CAAC,UAIxB;QACC,OAAO;YACL,MAAM,EAAE,UAAU,CAAC,MAAM;YACzB,WAAW,EAAE,UAAU,CAAC,WAAW;YACnC,SAAS,EAAE,UAAU,CAAC,SAAS;SAChC,CAAC;IACJ,CAAC;CACF"}
+{"version":3,"file":"sessionService.js","sourceRoot":"","sources":["../../src/session/sessionService.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AAUpC,OAAO,EAAE,uBAAuB,EAAE,MAAM,0BAA0B,CAAC;AACnE,OAAO,EAAE,QAAQ,EAAE,MAAM,0BAA0B,CAAC;AAEpD;;GAEG;AACH,MAAM,OAAO,iBAAkB,SAAQ,KAAK;IAC1C;QACE,KAAK,CAAC,gCAAgC,CAAC,CAAC;QACxC,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;IAClC,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,OAAO,cAAc;IACjB,KAAK,CAAe;IACpB,aAAa,CAAgB;IAC7B,SAAS,CAAY;IACrB,iBAAiB,CAAS;IAC1B,cAAc,CAAS;IACvB,qBAAqB,CAAS;IAC9B,WAAW,CAAS;IAE5B,YACE,KAAmB,EACnB,aAA4B,EAC5B,SAAoB,EACpB,iBAAyB,EACzB,iBAAyB,QAAQ,CAAC,kCAAkC,EACpE,wBAAgC,QAAQ,CAAC,iCAAiC,EAC1E,cAAsB,QAAQ,CAAC,aAAa;QAE5C,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QACnB,IAAI,CAAC,aAAa,GAAG,aAAa,CAAC;QACnC,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QAC3B,IAAI,CAAC,iBAAiB,GAAG,iBAAiB,CAAC;QAC3C,IAAI,CAAC,cAAc,GAAG,cAAc,CAAC;QACrC,IAAI,CAAC,qBAAqB,GAAG,qBAAqB,CAAC;QACnD,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;IACjC,CAAC;IAED;;;;;OAKG;IACK,KAAK,CAAC,yBAAyB,CAAC,MAAc;QACpD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS;aAClC,UAAU,CAAC,IAAI,CAAC,cAAc,CAAC;aAC/B,KAAK,CAAC,QAAQ,EAAE,IAAI,EAAE,MAAM,CAAC;aAC7B,KAAK,CAAC,WAAW,EAAE,GAAG,EAAE,IAAI,IAAI,EAAE,CAAC;aACnC,OAAO,CAAC,gBAAgB,EAAE,MAAM,CAAC;aACjC,KAAK,CAAC,CAAC,CAAC;aACR,GAAG,EAAE,CAAC;QAET,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;YACnB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,EAA8B,CAAC;QACjE,OAAO,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,CAAC;IAC3C,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,eAAe,CAAC,MAAc;QAClC,2DAA2D;QAC3D,MAAM,aAAa,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAE7C,2DAA2D;QAC3D,IAAI,aAAa,IAAI,aAAa,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YACrD,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YACzB,OAAO,uBAAuB,CAAC,oBAAoB,CAAC;QACtD,CAAC;QAED,2DAA2D;QAC3D,IAAI,aAAa,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC;YACnD,OAAO,uBAAuB,CAAC,KAAK,CAAC;QACvC,CAAC;QAED,gGAAgG;QAChG,IAAI,aAAa,IAAI,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC;YAClD,OAAO,uBAAuB,CAAC,OAAO,CAAC;QACzC,CAAC;QAED,iGAAiG;QACjG,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,yBAAyB,CAAC,MAAM,CAAC,CAAC;QAC7D,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,uBAAuB,CAAC,SAAS,CAAC;QAC3C,CAAC;QAED,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC9B,OAAO,uBAAuB,CAAC,oBAAoB,CAAC;QACtD,CAAC;QAED,IAAI,IAAI,IAAI,EAAE,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC;YACnC,OAAO,uBAAuB,CAAC,OAAO,CAAC;QACzC,CAAC;QAED,uCAAuC;QACvC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAChC,OAAO,uBAAuB,CAAC,KAAK,CAAC;IACvC,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,cAAc,CAAC,MAAc;QACjC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;QAClD,OAAO,MAAM,KAAK,uBAAuB,CAAC,KAAK,CAAC;IAClD,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,aAAa,CAAC,MAAc;QAChC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS;aAClC,UAAU,CAAC,IAAI,CAAC,cAAc,CAAC;aAC/B,KAAK,CAAC,QAAQ,EAAE,IAAI,EAAE,MAAM,CAAC;aAC7B,KAAK,CAAC,CAAC,CAAC;aACR,GAAG,EAAE,CAAC;QAET,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;YACnB,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,EAA8B,CAAC;QACjE,OAAO,IAAI,CAAC,MAAM,KAAK,MAAM,CAAC;IAChC,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,aAAa,CAAC,MAAc,EAAE,aAAoB;QACtD,IAAI,aAAa,EAAE,CAAC;YAClB,MAAM,qBAAqB,GAAG,MAAM,IAAI,CAAC,0BAA0B,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;YAC3F,IAAI,qBAAqB,EAAE,CAAC;gBAC1B,MAAM,IAAI,iBAAiB,EAAE,CAAC;YAChC,CAAC;QACH,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;QAElD,IAAI,MAAM,KAAK,uBAAuB,CAAC,KAAK,EAAE,CAAC;YAC7C,OAAO,KAAK,CAAC;QACf,CAAC;QAED,IAAI,MAAM,KAAK,uBAAuB,CAAC,OAAO,EAAE,CAAC;YAC/C,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;QACzE,CAAC;QAED,0EAA0E;QAC1E,MAAM,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;QACjC,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,aAAa,CAAC,MAAc;QAChC,MAAM,SAAS,GAAG,UAAU,EAAE,CAAC;QAC/B,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,iBAAiB,CAAC,CAAC;QAEnE,MAAM,OAAO,GAAgB;YAC3B,SAAS;YACT,MAAM;YACN,SAAS,EAAE,GAAG;YACd,cAAc,EAAE,GAAG;YACnB,SAAS;SACV,CAAC;QAEF,mFAAmF;QACnF,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAEhC,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC7E,MAAM,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC,CAAC;IACtD,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,kBAAkB,CAAC,MAAc;QACrC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;QAClD,IAAI,MAAM,KAAK,uBAAuB,CAAC,KAAK,EAAE,CAAC;YAC7C,OAAO,CAAC,yDAAyD;QACnE,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACvC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO;QACT,CAAC;QAED,MAAM,cAAc,GAAgB;YAClC,GAAG,OAAO;YACV,cAAc,EAAE,IAAI,IAAI,EAAE;YAC1B,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,iBAAiB,CAAC;SACzD,CAAC;QACF,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;QAEvC,4EAA4E;QAC5E,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IACxD,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,YAAY,CAAC,MAAc;QAC/B,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAEzB,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC;QAE7D,gGAAgG;QAChG,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACpF,MAAM,SAAS,CAAC,GAAG,CACjB,IAAI,CAAC,gBAAgB,CAAC;YACpB,MAAM;YACN,WAAW,EAAE,GAAG;YAChB,SAAS;SACV,CAAC,CACH,CAAC;QAEF,6FAA6F;QAC7F,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS;aAClC,UAAU,CAAC,IAAI,CAAC,cAAc,CAAC;aAC/B,KAAK,CAAC,QAAQ,EAAE,IAAI,EAAE,MAAM,CAAC;aAC7B,GAAG,EAAE,CAAC;QACT,KAAK,MAAM,GAAG,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC;YAChC,MAAM,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC;QACzB,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,0BAA0B,CAAC,MAAc,EAAE,aAAmB;QAClE,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACpF,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,CAAC;QAElC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC;YAChB,OAAO,KAAK,CAAC,CAAC,2CAA2C;QAC3D,CAAC;QAED,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,EAA6B,CAAC;QACnD,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,UAAU,GAAG,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC;QAClD,OAAO,aAAa,GAAG,UAAU,CAAC,WAAW,CAAC;IAChD,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,WAAW;QACf,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAClE,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;QAEvB,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,KAAK,CAAC,WAAW,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;QAErE,KAAK,MAAM,GAAG,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC;YAChC,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,EAA8B,CAAC;YACpD,+DAA+D;YAC/D,IAAI,IAAI,CAAC,SAAS,KAAK,GAAG,CAAC,EAAE,EAAE,CAAC;gBAC9B,OAAO,CAAC,IAAI,CACV,2DAA2D,GAAG,CAAC,EAAE,oBAAoB,IAAI,CAAC,SAAS,EAAE,CACtG,CAAC;gBACF,SAAS;YACX,CAAC;YACD,MAAM,OAAO,GAAG,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,CAAC;YAClD,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAC1C,CAAC;QAED,4DAA4D;QAC5D,MAAM,eAAe,GAAG,MAAM,UAAU,CAAC,KAAK,CAAC,WAAW,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;QAE7E,IAAI,eAAe,CAAC,KAAK,EAAE,CAAC;YAC1B,OAAO,CAAC,kCAAkC;QAC5C,CAAC;QAED,oEAAoE;QACpE,MAAM,SAAS,GAAG,GAAG,CAAC;QACtB,MAAM,WAAW,GAAG,eAAe,CAAC,IAAI,CAAC;QACzC,IAAI,YAAY,GAAG,CAAC,CAAC;QAErB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,WAAW,CAAC,MAAM,EAAE,CAAC,IAAI,SAAS,EAAE,CAAC;YACvD,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC;YACrC,MAAM,SAAS,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,SAAS,CAAC,CAAC;YAEtD,KAAK,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;gBAC5B,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;gBACtB,YAAY,EAAE,CAAC;YACjB,CAAC;YAED,MAAM,KAAK,CAAC,MAAM,EAAE,CAAC;QACvB,CAAC;QAED,IAAI,YAAY,GAAG,CAAC,EAAE,CAAC;YACrB,OAAO,CAAC,IAAI,CAAC,cAAc,YAAY,yCAAyC,CAAC,CAAC;QACpF,CAAC;IACH,CAAC;IAED;;OAEG;IACK,sBAAsB,CAAC,IAA8B;QAC3D,OAAO;YACL,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC;YACtC,cAAc,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC;YAChD,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC;SACvC,CAAC;IACJ,CAAC;IAED;;OAEG;IACK,mBAAmB,CAAC,OAAoB;QAC9C,OAAO;YACL,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,cAAc,EAAE,OAAO,CAAC,cAAc;YACtC,SAAS,EAAE,OAAO,CAAC,SAAS;SAC7B,CAAC;IACJ,CAAC;IAED;;OAEG;IACK,MAAM,CAAC,SAAgD;QAC7D,IAAI,SAAS,YAAY,IAAI,EAAE,CAAC;YAC9B,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,OAAO,SAAS,CAAC,MAAM,EAAE,CAAC;IAC5B,CAAC;IAED;;OAEG;IACK,mBAAmB,CAAC,IAA6B;QAKvD,OAAO;YACL,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC;YAC1C,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC;SACvC,CAAC;IACJ,CAAC;IAED;;OAEG;IACK,gBAAgB,CAAC,UAIxB;QACC,OAAO;YACL,MAAM,EAAE,UAAU,CAAC,MAAM;YACzB,WAAW,EAAE,UAAU,CAAC,WAAW;YACnC,SAAS,EAAE,UAAU,CAAC,SAAS;SAChC,CAAC;IACJ,CAAC;CACF"}