@rapidrest/auth 1.0.0-beta.1

package/dist/lib/routes/BaseAuthMFARoute.js

@@ -0,0 +1,310 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+///////////////////////////////////////////////////////////////////////////////
+// Copyright (C) 2026 Jean-Philippe Steinmetz
+///////////////////////////////////////////////////////////////////////////////
+import { JWTUtils, MessagingUtils, ObjectDecorators } from "@rapidrest/core";
+import { RouteDecorators, DocDecorators, RepoUtils, AuthMiddleware, ObjectFactory } from "@rapidrest/service-core";
+import { AliasType, AuthResult, SecretType } from "../models/types.js";
+import { MFAMethodType, MFAStrategy, MFAStrategyOptions } from "../auth/MFAStrategy.js";
+import { OTPContactType } from "../auth/types.js";
+import { importArgon2 } from "../auth/shared.js";
+import { UserUtils } from "./UserUtils.js";
+const { Config, Init, Inject } = ObjectDecorators;
+const { Summary, Description, Returns } = DocDecorators;
+const { Auth, Get, Post } = RouteDecorators;
+const AuthUser = RouteDecorators.User;
+/**
+ *
+ *
+ * @author Jean-Philippe Steinmetz
+ */
+export class BaseAuthMFARoute {
+    constructor() {
+        /** The name of the messaging template to use for sending notifications. */
+        this.template = "login-otp";
+    }
+    /**
+     * Called on server startup to initialize the route with any defaults.
+     */
+    async initialize() {
+        if (!this.authMiddleware) {
+            throw new Error("authMiddleware is not set.");
+        }
+        if (!this.objectFactory) {
+            throw new Error("objectFactory is not set.");
+        }
+        if (!this.aliasRepo && this.aliasClass) {
+            this.aliasRepo = await this.objectFactory.newInstance(RepoUtils, {
+                name: this.aliasClass.name,
+                args: [this.aliasClass],
+            });
+        }
+        if (!this.secretRepo && this.secretClass) {
+            this.secretRepo = await this.objectFactory.newInstance(RepoUtils, {
+                name: this.secretClass.name,
+                args: [this.secretClass],
+            });
+        }
+        if (!this.userRepo && this.userClass) {
+            this.userRepo = await this.objectFactory.newInstance(RepoUtils, {
+                name: this.userClass.name,
+                args: [this.userClass],
+            });
+        }
+        if (!this.userUtils && this.userClass && this.aliasClass) {
+            this.userUtils = await this.objectFactory.newInstance(UserUtils, {
+                name: "default",
+                args: [this.userClass, this.aliasClass],
+            });
+        }
+        const options = new MFAStrategyOptions();
+        options.getMethod = this.getMethod.bind(this);
+        options.getMethods = this.getMethods.bind(this);
+        options.getUser = this.getUser.bind(this);
+        options.notifyContact = this.notifyContact.bind(this);
+        options.verify = this.verify.bind(this);
+        const strategy = await this.objectFactory.newInstance(MFAStrategy, {
+            name: "default",
+            args: [options],
+        });
+        this.authMiddleware.register(strategy.name, strategy);
+    }
+    /**
+     * Authenticates the user using HTTP MFA and returns a JSON Web Token access token to be used with future API requests.
+     */
+    async authenticate(user) {
+        const token = await JWTUtils.createToken(this.jwtConfig, user);
+        return new AuthResult({
+            token,
+            user,
+        });
+    }
+    convertAliasToMethod(alias, obfuscate) {
+        switch (alias.type) {
+            case AliasType.EMAIL:
+                return {
+                    id: alias.uid,
+                    data: {
+                        contact: obfuscate ? this.obfuscateAlias(alias.alias, alias.type) : alias.alias,
+                        type: OTPContactType.EMAIL,
+                        verified: alias.verified,
+                    },
+                    type: MFAMethodType.OTP,
+                };
+            case AliasType.PHONE:
+                return {
+                    id: alias.uid,
+                    data: {
+                        contact: obfuscate ? this.obfuscateAlias(alias.alias, alias.type) : alias.alias,
+                        type: OTPContactType.SMS,
+                        verified: alias.verified,
+                    },
+                    type: MFAMethodType.OTP,
+                };
+        }
+        return undefined;
+    }
+    convertSecretToMethod(secret) {
+        switch (secret.type) {
+            case SecretType.FIDO2:
+                return {
+                    id: secret.uid,
+                    data: secret.data,
+                    type: MFAMethodType.FIDO2,
+                };
+            case SecretType.TOTP:
+                return {
+                    id: secret.uid,
+                    data: secret.data,
+                    type: MFAMethodType.TOTP,
+                };
+        }
+        return undefined;
+    }
+    /**
+     * Retrieves the user's secondary authentication method for a given id.
+     * @param id The unique id of the secondary auth method to retrieve.
+     */
+    async getMethod(id) {
+        if (!this.aliasRepo) {
+            throw new Error("aliasRepo is not set.");
+        }
+        if (!this.secretRepo) {
+            throw new Error("secretRepo is not set.");
+        }
+        // The 2fa auth method may be a secret or an alias (OTP). First look for a secret
+        // with the matching id. If not found, look for an alias.
+        const secret = await this.secretRepo.findOne(id, { ignoreACL: true });
+        if (secret) {
+            return this.convertSecretToMethod(secret);
+        }
+        // It's not a secret, let's try alias
+        const alias = await this.aliasRepo.findOne(id, { ignoreACL: true });
+        if (alias) {
+            return this.convertAliasToMethod(alias);
+        }
+        return undefined;
+    }
+    /**
+     * Retrieves the list of secondary authentication methods for the user with the given id. This list is sent to
+     * the user and so should be obfuscated where reasonable so as to limit discovery when a password has been
+     * compromised.
+     * @param uid The unique identifier of the user.
+     */
+    async getMethods(uid) {
+        if (!this.aliasRepo) {
+            throw new Error("aliasRepo is not set.");
+        }
+        if (!this.secretRepo) {
+            throw new Error("secretRepo is not set.");
+        }
+        if (!this.userRepo) {
+            throw new Error("userRepo is not set.");
+        }
+        const results = [];
+        // Search for secrets for the user and add each to our list of methods. Not all secrets
+        // will be added, only those that are valid for MFA.
+        const secrets = await this.secretRepo.find({ userUid: uid }, { ignoreACL: true });
+        for (const secret of secrets) {
+            const method = this.convertSecretToMethod(secret);
+            if (method) {
+                results.push(method);
+            }
+        }
+        // Now search for the user's aliases that serve as OTP contacts
+        const aliases = await this.aliasRepo.find({ userUid: uid }, {
+            ignoreACL: true,
+        });
+        // Filter aliases to only those that can be notified
+        aliases.filter((alias) => [AliasType.EMAIL, AliasType.PHONE].includes(alias.type));
+        // Now add all eligible aliases to our list of methods (e.g. email, phone).
+        for (const alias of aliases) {
+            const method = this.convertAliasToMethod(alias);
+            if (method) {
+                results.push(method);
+            }
+        }
+        return results;
+    }
+    /**
+     * Retrieves the user with the given unique id.
+     * @param uid The unique id of the user to retrieve.
+     * @returns The user if found, otherwise `undefined`.
+     */
+    async getUser(uid) {
+        if (!this.userUtils) {
+            throw new Error("userRepo is not set.");
+        }
+        return this.userUtils.lookup(uid);
+    }
+    async notifyContact(contact, totp) {
+        switch (contact.type) {
+            case OTPContactType.EMAIL:
+                void this.messagingUtils?.sendEmail(this.template, { totp }, {
+                    to: contact.contact,
+                });
+                break;
+            case OTPContactType.SMS:
+                void this.messagingUtils?.sendSMS(this.template, { totp }, {
+                    to: contact.contact,
+                });
+                break;
+        }
+    }
+    /**
+     * Obfuscates the given alias and returns the obfuscated value.
+     * @param contact The contact to obfuscate.
+     */
+    obfuscateAlias(alias, type) {
+        let result = alias;
+        switch (type) {
+            case AliasType.EMAIL:
+                result = result.replace(/^(.).*(.{2})(@)/, "$1***$2$3");
+                break;
+            case AliasType.NAME:
+                result = result.replace(/.(?=.{3})/g, "*");
+                break;
+            case AliasType.PHONE:
+                result = result.replace(/.(?=.{4})/g, "*");
+                break;
+        }
+        return result;
+    }
+    async verify(name, password) {
+        if (!this.secretRepo) {
+            throw new Error("Secret repository not set.");
+        }
+        if (!this.userUtils) {
+            throw new Error("User repository not set.");
+        }
+        const user = await this.userUtils.lookup(name);
+        if (!user) {
+            throw new Error("Invalid authorization request.");
+        }
+        let secrets = await this.secretRepo.find({
+            userUid: user.uid,
+            type: SecretType.PASSWORD,
+        }, {
+            ignoreACL: true,
+        });
+        // Try all known passwords until at least one succeeds
+        let success = false;
+        for (const secret of secrets) {
+            const argon = await importArgon2();
+            success = await argon.verify(secret.data, password);
+            if (success) {
+                break;
+            }
+        }
+        if (!success) {
+            throw new Error("Invalid authorization request.");
+        }
+        return user;
+    }
+}
+__decorate([
+    Inject(AuthMiddleware),
+    __metadata("design:type", AuthMiddleware)
+], BaseAuthMFARoute.prototype, "authMiddleware", void 0);
+__decorate([
+    Config("auth"),
+    __metadata("design:type", Object)
+], BaseAuthMFARoute.prototype, "jwtConfig", void 0);
+__decorate([
+    Inject(ObjectFactory),
+    __metadata("design:type", ObjectFactory)
+], BaseAuthMFARoute.prototype, "objectFactory", void 0);
+__decorate([
+    Inject(MessagingUtils),
+    __metadata("design:type", MessagingUtils)
+], BaseAuthMFARoute.prototype, "messagingUtils", void 0);
+__decorate([
+    Init,
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", []),
+    __metadata("design:returntype", Promise)
+], BaseAuthMFARoute.prototype, "initialize", null);
+__decorate([
+    Summary("Authenticate MFA"),
+    Description("Authenticates the user using HTTP MFA and returns a JSON Web Token access token to be used with future API requests."),
+    Returns([AuthResult, undefined]),
+    Auth(["mfa"]),
+    Get(),
+    Post(),
+    __param(0, AuthUser),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], BaseAuthMFARoute.prototype, "authenticate", null);
+//# sourceMappingURL=BaseAuthMFARoute.js.map

package/dist/lib/routes/BaseAuthMFARoute.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"BaseAuthMFARoute.js","sourceRoot":"","sources":["../../../src/routes/BaseAuthMFARoute.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,+EAA+E;AAC/E,6CAA6C;AAC7C,+EAA+E;AAC/E,OAAO,EAAW,QAAQ,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACtF,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,SAAS,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AACnH,OAAO,EAAS,SAAS,EAAE,UAAU,EAAU,UAAU,EAAQ,MAAM,oBAAoB,CAAC;AAC5F,OAAO,EAAa,aAAa,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AACnG,OAAO,EAAc,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAC9D,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjD,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAE3C,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,gBAAgB,CAAC;AAClD,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,GAAG,aAAa,CAAC;AACxD,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,eAAe,CAAC;AAC5C,MAAM,QAAQ,GAAG,eAAe,CAAC,IAAI,CAAC;AAEtC;;;;GAIG;AACH,MAAM,OAAgB,gBAAgB;IAAtC;QAqBI,2EAA2E;QACjE,aAAQ,GAAW,WAAW,CAAC;IA0S7C,CAAC;IApSG;;OAEG;IAEa,AAAN,KAAK,CAAC,UAAU;QACtB,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;QAClD,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;QACjD,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACrC,IAAI,CAAC,SAAS,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,WAAW,CAAC,SAAS,EAAE;gBAC7D,IAAI,EAAE,IAAI,CAAC,UAAU,CAAC,IAAI;gBAC1B,IAAI,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC;aAC1B,CAAC,CAAC;QACP,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACvC,IAAI,CAAC,UAAU,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,WAAW,CAAC,SAAS,EAAE;gBAC9D,IAAI,EAAE,IAAI,CAAC,WAAW,CAAC,IAAI;gBAC3B,IAAI,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC;aAC3B,CAAC,CAAC;QACP,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACnC,IAAI,CAAC,QAAQ,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,WAAW,CAAC,SAAS,EAAE;gBAC5D,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI;gBACzB,IAAI,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC;aACzB,CAAC,CAAC;QACP,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACvD,IAAI,CAAC,SAAS,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,WAAW,CAAC,SAAS,EAAE;gBAC7D,IAAI,EAAE,SAAS;gBACf,IAAI,EAAE,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,UAAU,CAAC;aAC1C,CAAC,CAAC;QACP,CAAC;QAED,MAAM,OAAO,GAAuB,IAAI,kBAAkB,EAAE,CAAC;QAC7D,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC9C,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAChD,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC1C,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACtD,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACxC,MAAM,QAAQ,GAAgB,MAAM,IAAI,CAAC,aAAa,CAAC,WAAW,CAAC,WAAW,EAAE;YAC5E,IAAI,EAAE,SAAS;YACf,IAAI,EAAE,CAAC,OAAO,CAAC;SAClB,CAAC,CAAC;QACH,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAC1D,CAAC;IAED;;OAEG;IASU,AAAN,KAAK,CAAC,YAAY,CAAW,IAAa;QAC7C,MAAM,KAAK,GAAW,MAAM,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QACvE,OAAO,IAAI,UAAU,CAAC;YAClB,KAAK;YACL,IAAI;SACP,CAAC,CAAC;IACP,CAAC;IAES,oBAAoB,CAAC,KAAY,EAAE,SAAmB;QAC5D,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;YACjB,KAAK,SAAS,CAAC,KAAK;gBAChB,OAAO;oBACH,EAAE,EAAE,KAAK,CAAC,GAAG;oBACb,IAAI,EAAE;wBACF,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK;wBAC/E,IAAI,EAAE,cAAc,CAAC,KAAK;wBAC1B,QAAQ,EAAE,KAAK,CAAC,QAAQ;qBAC3B;oBACD,IAAI,EAAE,aAAa,CAAC,GAAG;iBAC1B,CAAC;YACN,KAAK,SAAS,CAAC,KAAK;gBAChB,OAAO;oBACH,EAAE,EAAE,KAAK,CAAC,GAAG;oBACb,IAAI,EAAE;wBACF,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK;wBAC/E,IAAI,EAAE,cAAc,CAAC,GAAG;wBACxB,QAAQ,EAAE,KAAK,CAAC,QAAQ;qBAC3B;oBACD,IAAI,EAAE,aAAa,CAAC,GAAG;iBAC1B,CAAC;QACV,CAAC;QAED,OAAO,SAAS,CAAC;IACrB,CAAC;IAES,qBAAqB,CAAC,MAAS;QACrC,QAAQ,MAAM,CAAC,IAAI,EAAE,CAAC;YAClB,KAAK,UAAU,CAAC,KAAK;gBACjB,OAAO;oBACH,EAAE,EAAE,MAAM,CAAC,GAAG;oBACd,IAAI,EAAE,MAAM,CAAC,IAAI;oBACjB,IAAI,EAAE,aAAa,CAAC,KAAK;iBAC5B,CAAC;YACN,KAAK,UAAU,CAAC,IAAI;gBAChB,OAAO;oBACH,EAAE,EAAE,MAAM,CAAC,GAAG;oBACd,IAAI,EAAE,MAAM,CAAC,IAAI;oBACjB,IAAI,EAAE,aAAa,CAAC,IAAI;iBAC3B,CAAC;QACV,CAAC;QAED,OAAO,SAAS,CAAC;IACrB,CAAC;IAED;;;OAGG;IACO,KAAK,CAAC,SAAS,CAAC,EAAU;QAChC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;QAC7C,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;YACnB,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;QAC9C,CAAC;QAED,iFAAiF;QACjF,yDAAyD;QACzD,MAAM,MAAM,GAAkB,MAAM,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACrF,IAAI,MAAM,EAAE,CAAC;YACT,OAAO,IAAI,CAAC,qBAAqB,CAAC,MAAM,CAAC,CAAC;QAC9C,CAAC;QAED,qCAAqC;QACrC,MAAM,KAAK,GAAkB,MAAM,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACnF,IAAI,KAAK,EAAE,CAAC;YACR,OAAO,IAAI,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC;QAC5C,CAAC;QAED,OAAO,SAAS,CAAC;IACrB,CAAC;IAED;;;;;OAKG;IACO,KAAK,CAAC,UAAU,CAAC,GAAW;QAClC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;QAC7C,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;YACnB,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;QAC9C,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;QAC5C,CAAC;QAED,MAAM,OAAO,GAAgB,EAAE,CAAC;QAEhC,uFAAuF;QACvF,oDAAoD;QACpD,MAAM,OAAO,GAAQ,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACvF,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC3B,MAAM,MAAM,GAA0B,IAAI,CAAC,qBAAqB,CAAC,MAAM,CAAC,CAAC;YACzE,IAAI,MAAM,EAAE,CAAC;gBACT,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACzB,CAAC;QACL,CAAC;QAED,+DAA+D;QAC/D,MAAM,OAAO,GAAQ,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAC1C,EAAE,OAAO,EAAE,GAAG,EAAE,EAChB;YACI,SAAS,EAAE,IAAI;SAClB,CACJ,CAAC;QAEF,oDAAoD;QACpD,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,KAAK,EAAE,SAAS,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;QAEnF,2EAA2E;QAC3E,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC1B,MAAM,MAAM,GAA0B,IAAI,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC;YACvE,IAAI,MAAM,EAAE,CAAC;gBACT,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACzB,CAAC;QACL,CAAC;QAED,OAAO,OAAO,CAAC;IACnB,CAAC;IAED;;;;OAIG;IACO,KAAK,CAAC,OAAO,CAAC,GAAW;QAC/B,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;QAC5C,CAAC;QACD,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACtC,CAAC;IAES,KAAK,CAAC,aAAa,CAAC,OAAmB,EAAE,IAAY;QAC3D,QAAQ,OAAO,CAAC,IAAI,EAAE,CAAC;YACnB,KAAK,cAAc,CAAC,KAAK;gBACrB,KAAK,IAAI,CAAC,cAAc,EAAE,SAAS,CAC/B,IAAI,CAAC,QAAQ,EACb,EAAE,IAAI,EAAE,EACR;oBACI,EAAE,EAAE,OAAO,CAAC,OAAO;iBACtB,CACJ,CAAC;gBACF,MAAM;YACV,KAAK,cAAc,CAAC,GAAG;gBACnB,KAAK,IAAI,CAAC,cAAc,EAAE,OAAO,CAC7B,IAAI,CAAC,QAAQ,EACb,EAAE,IAAI,EAAE,EACR;oBACI,EAAE,EAAE,OAAO,CAAC,OAAO;iBACtB,CACJ,CAAC;gBACF,MAAM;QACd,CAAC;IACL,CAAC;IAED;;;OAGG;IACO,cAAc,CAAC,KAAa,EAAE,IAAe;QACnD,IAAI,MAAM,GAAW,KAAK,CAAC;QAE3B,QAAQ,IAAI,EAAE,CAAC;YACX,KAAK,SAAS,CAAC,KAAK;gBAChB,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,iBAAiB,EAAE,WAAW,CAAC,CAAC;gBACxD,MAAM;YACV,KAAK,SAAS,CAAC,IAAI;gBACf,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC;gBAC3C,MAAM;YACV,KAAK,SAAS,CAAC,KAAK;gBAChB,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC;gBAC3C,MAAM;QACd,CAAC;QAED,OAAO,MAAM,CAAC;IAClB,CAAC;IAES,KAAK,CAAC,MAAM,CAAC,IAAY,EAAE,QAAgB;QACjD,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;YACnB,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;QAClD,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;QAChD,CAAC;QAED,MAAM,IAAI,GAAkB,MAAM,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC9D,IAAI,CAAC,IAAI,EAAE,CAAC;YACR,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;QACtD,CAAC;QAED,IAAI,OAAO,GAAQ,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,CACzC;YACI,OAAO,EAAE,IAAI,CAAC,GAAG;YACjB,IAAI,EAAE,UAAU,CAAC,QAAQ;SAC5B,EACD;YACI,SAAS,EAAE,IAAI;SAClB,CACJ,CAAC;QAEF,sDAAsD;QACtD,IAAI,OAAO,GAAY,KAAK,CAAC;QAC7B,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC3B,MAAM,KAAK,GAAG,MAAM,YAAY,EAAE,CAAC;YACnC,OAAO,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;YACpD,IAAI,OAAO,EAAE,CAAC;gBACV,MAAM;YACV,CAAC;QACL,CAAC;QACD,IAAI,CAAC,OAAO,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;QACtD,CAAC;QAED,OAAO,IAAI,CAAC;IAChB,CAAC;CACJ;AAxTa;IADT,MAAM,CAAC,cAAc,CAAC;8BACI,cAAc;wDAAC;AAGhC;IADT,MAAM,CAAC,MAAM,CAAC;;mDACW;AAGhB;IADT,MAAM,CAAC,aAAa,CAAC;8BACI,aAAa;uDAAC;AAG9B;IADT,MAAM,CAAC,cAAc,CAAC;8BACI,cAAc;wDAAC;AAe1B;IADf,IAAI;;;;kDAgDJ;AAaY;IARZ,OAAO,CAAC,kBAAkB,CAAC;IAC3B,WAAW,CACR,sHAAsH,CACzH;IACA,OAAO,CAAC,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;IAChC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC;IACb,GAAG,EAAE;IACL,IAAI,EAAE;IACoB,WAAA,QAAQ,CAAA;;;;oDAMlC"}

package/dist/lib/routes/BaseAuthOIDCRoute.js

@@ -0,0 +1,231 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+///////////////////////////////////////////////////////////////////////////////
+// Copyright (C) 2026 Jean-Philippe Steinmetz
+///////////////////////////////////////////////////////////////////////////////
+import "reflect-metadata";
+import { JWTUtils, MessagingUtils, ObjectDecorators } from "@rapidrest/core";
+import { RouteDecorators, DocDecorators, RepoUtils, AuthMiddleware, ObjectFactory } from "@rapidrest/service-core";
+import { AliasType, AuthResult, ContactType } from "../models/types.js";
+import { OIDCStrategy, OIDCStrategyOptions } from "../auth/OIDCStrategy.js";
+import * as uuid from "uuid";
+import { UserUtils } from "./UserUtils.js";
+const { Config, Init, Inject } = ObjectDecorators;
+const { Summary, Description, Returns } = DocDecorators;
+const { Auth, Get, Post } = RouteDecorators;
+const AuthUser = RouteDecorators.User;
+/**
+ *
+ *
+ * @author Jean-Philippe Steinmetz
+ */
+export class BaseAuthOIDCRoute {
+    /**
+     * Called on server startup to initialize the route with any defaults.
+     */
+    async initialize() {
+        if (!this.authMiddleware) {
+            throw new Error("authMiddleware is not set.");
+        }
+        if (!this.objectFactory) {
+            throw new Error("objectFactory is not set.");
+        }
+        if (!this.aliasRepo && this.aliasClass) {
+            this.aliasRepo = await this.objectFactory.newInstance(RepoUtils, {
+                name: this.aliasClass.name,
+                args: [this.aliasClass],
+            });
+        }
+        if (!this.profileRepo && this.profileClass) {
+            this.profileRepo = await this.objectFactory.newInstance(RepoUtils, {
+                name: this.profileClass.name,
+                args: [this.profileClass],
+            });
+        }
+        if (!this.userRepo && this.userClass) {
+            this.userRepo = await this.objectFactory.newInstance(RepoUtils, {
+                name: this.userClass.name,
+                args: [this.userClass],
+            });
+        }
+        if (!this.userUtils && this.userClass && this.aliasClass) {
+            this.userUtils = await this.objectFactory.newInstance(UserUtils, {
+                name: "default",
+                args: [this.userClass, this.aliasClass],
+            });
+        }
+        const options = new OIDCStrategyOptions("oauth", this.providerConfig);
+        options.getUser = async (token, profile) => {
+            if (!this.aliasRepo) {
+                throw new Error("aliasRepo is not set.");
+            }
+            if (!this.profileRepo) {
+                throw new Error("profileRepo is not set.");
+            }
+            if (!this.userRepo) {
+                throw new Error("userRepo is not set.");
+            }
+            if (!this.userUtils) {
+                throw new Error("userUtils is not set.");
+            }
+            // The provider-scoped external id (`<provider>:<id>`) is the most reliable way to recognize
+            // a returning user across logins — unlike email, it doesn't depend on the provider actually
+            // returning a (verified) email address, it can't collide with another provider's namespace,
+            // and it can't change if the user updates their email with the provider.
+            const oauthAlias = `${profile.provider}:${profile.id}`;
+            let user = await this.userUtils.lookup(oauthAlias);
+            const foundByOAuthAlias = user !== undefined;
+            // Fall back to the (verified) email alias — this recognizes an account that either
+            // registered before this provider-id lookup existed, or was created via another method
+            // (e.g. password) and is now authenticating with this provider for the first time.
+            if (!user) {
+                user = await this.userUtils.lookup(profile.email ?? profile.id);
+            }
+            if (!user) {
+                // Create a new user for the given profile
+                const newUser = {
+                    uid: uuid.v4(),
+                    dateCreated: new Date(),
+                    dateModified: new Date(),
+                    version: 0,
+                    roles: [],
+                    scopes: [],
+                };
+                user = await this.userRepo.create(newUser, { ignoreACL: true });
+                // Now create a profile for the user
+                const newProfile = {
+                    avatar: profile.avatar ?? "",
+                    birthdate: profile.birthdate ? new Date(profile.birthdate) : undefined,
+                    contacts: [],
+                    givenName: profile.givenName ?? "",
+                    familyName: profile.familyName ?? "",
+                    preferences: {
+                        contact: [],
+                    },
+                    uid: user.uid,
+                    dateCreated: new Date(),
+                    dateModified: new Date(),
+                    version: 0,
+                };
+                if (profile.email) {
+                    newProfile.contacts.push({
+                        contact: profile.email,
+                        type: ContactType.EMAIL,
+                        verified: profile.email_verified ?? false,
+                    });
+                }
+                if (profile.email && profile.email_verified) {
+                    const newAlias = {
+                        alias: profile.email,
+                        type: AliasType.EMAIL,
+                        userUid: user.uid,
+                        verified: true,
+                        uid: uuid.v4(),
+                        dateCreated: new Date(),
+                        dateModified: new Date(),
+                        version: 0,
+                    };
+                    await this.aliasRepo.create(newAlias, { ignoreACL: true });
+                }
+                if (profile.phone) {
+                    newProfile.contacts.push({
+                        contact: profile.phone,
+                        type: ContactType.PHONE,
+                        verified: profile.phone_verified ?? false,
+                    });
+                }
+                if (profile.phone && profile.phone_verified) {
+                    const newAlias = {
+                        alias: profile.phone,
+                        type: AliasType.PHONE,
+                        userUid: user.uid,
+                        verified: true,
+                        uid: uuid.v4(),
+                        dateCreated: new Date(),
+                        dateModified: new Date(),
+                        version: 0,
+                    };
+                    await this.aliasRepo.create(newAlias, { ignoreACL: true });
+                }
+                await this.profileRepo.create(newProfile, { ignoreACL: true });
+            }
+            // Persist the provider-scoped alias so this user is recognized by it on future logins,
+            // regardless of how they were resolved above. Skipped when that's exactly how `user` was
+            // just found, since the alias is already there.
+            if (!foundByOAuthAlias) {
+                const newOAuthAlias = {
+                    alias: oauthAlias,
+                    type: AliasType.OAUTH,
+                    userUid: user.uid,
+                    verified: true,
+                    uid: uuid.v4(),
+                    dateCreated: new Date(),
+                    dateModified: new Date(),
+                    version: 0,
+                };
+                await this.aliasRepo.create(newOAuthAlias, { ignoreACL: true });
+            }
+            return user;
+        };
+        const strategy = await this.objectFactory.newInstance(OIDCStrategy, {
+            name: "default",
+            args: [options],
+        });
+        this.authMiddleware.register(strategy.name, strategy);
+    }
+    /**
+     * Authenticates the user using OIDC and returns a JSON Web Token access token to be used with future API requests.
+     */
+    async login(user) {
+        const token = await JWTUtils.createToken(this.jwtConfig, user);
+        return new AuthResult({
+            token,
+            user,
+        });
+    }
+}
+__decorate([
+    Inject(AuthMiddleware),
+    __metadata("design:type", AuthMiddleware)
+], BaseAuthOIDCRoute.prototype, "authMiddleware", void 0);
+__decorate([
+    Config("auth"),
+    __metadata("design:type", Object)
+], BaseAuthOIDCRoute.prototype, "jwtConfig", void 0);
+__decorate([
+    Inject(ObjectFactory),
+    __metadata("design:type", ObjectFactory)
+], BaseAuthOIDCRoute.prototype, "objectFactory", void 0);
+__decorate([
+    Inject(MessagingUtils),
+    __metadata("design:type", MessagingUtils)
+], BaseAuthOIDCRoute.prototype, "messagingUtils", void 0);
+__decorate([
+    Init,
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", []),
+    __metadata("design:returntype", Promise)
+], BaseAuthOIDCRoute.prototype, "initialize", null);
+__decorate([
+    Summary("Login OIDC"),
+    Description("Authenticates the user using OAuth 2.0 / OpenID Connect and returns a JSON Web Token access token to be used with future API requests."),
+    Returns([AuthResult, undefined]),
+    Auth(["oauth"]),
+    Get(),
+    Post(),
+    __param(0, AuthUser),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], BaseAuthOIDCRoute.prototype, "login", null);
+//# sourceMappingURL=BaseAuthOIDCRoute.js.map

package/dist/lib/routes/BaseAuthOIDCRoute.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"BaseAuthOIDCRoute.js","sourceRoot":"","sources":["../../../src/routes/BaseAuthOIDCRoute.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,+EAA+E;AAC/E,6CAA6C;AAC7C,+EAA+E;AAC/E,OAAO,kBAAkB,CAAC;AAC1B,OAAO,EAAW,QAAQ,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACtF,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,SAAS,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AACnH,OAAO,EAAS,SAAS,EAAE,UAAU,EAAE,WAAW,EAAiB,MAAM,oBAAoB,CAAC;AAC9F,OAAO,EAA6B,YAAY,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AACvG,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAE3C,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,gBAAgB,CAAC;AAClD,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,GAAG,aAAa,CAAC;AACxD,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,eAAe,CAAC;AAC5C,MAAM,QAAQ,GAAG,eAAe,CAAC,IAAI,CAAC;AAEtC;;;;GAIG;AACH,MAAM,OAAgB,iBAAiB;IA2BnC;;OAEG;IAEW,AAAN,KAAK,CAAC,UAAU;QACpB,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;QAClD,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;QACjD,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACrC,IAAI,CAAC,SAAS,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,WAAW,CAAC,SAAS,EAAE;gBAC7D,IAAI,EAAE,IAAI,CAAC,UAAU,CAAC,IAAI;gBAC1B,IAAI,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC;aAC1B,CAAC,CAAC;QACP,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACzC,IAAI,CAAC,WAAW,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,WAAW,CAAC,SAAS,EAAE;gBAC/D,IAAI,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI;gBAC5B,IAAI,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC;aAC5B,CAAC,CAAC;QACP,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACnC,IAAI,CAAC,QAAQ,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,WAAW,CAAC,SAAS,EAAE;gBAC5D,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI;gBACzB,IAAI,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC;aACzB,CAAC,CAAC;QACP,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACvD,IAAI,CAAC,SAAS,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,WAAW,CAAC,SAAS,EAAE;gBAC7D,IAAI,EAAE,SAAS;gBACf,IAAI,EAAE,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,UAAU,CAAC;aAC1C,CAAC,CAAC;QACP,CAAC;QAED,MAAM,OAAO,GAAwB,IAAI,mBAAmB,CAAC,OAAO,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC;QAC3F,OAAO,CAAC,OAAO,GAAG,KAAK,EAAE,KAAa,EAAE,OAAoB,EAAgC,EAAE;YAC1F,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;gBAClB,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;YAC7C,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;gBACpB,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;YAC/C,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACjB,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;YAC5C,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;gBAClB,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;YAC7C,CAAC;YAED,4FAA4F;YAC5F,4FAA4F;YAC5F,4FAA4F;YAC5F,yEAAyE;YACzE,MAAM,UAAU,GAAW,GAAG,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,EAAE,EAAE,CAAC;YAE/D,IAAI,IAAI,GAAkB,MAAM,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;YAClE,MAAM,iBAAiB,GAAY,IAAI,KAAK,SAAS,CAAC;YAEtD,mFAAmF;YACnF,uFAAuF;YACvF,mFAAmF;YACnF,IAAI,CAAC,IAAI,EAAE,CAAC;gBACR,IAAI,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,EAAE,CAAC,CAAC;YACpE,CAAC;YAED,IAAI,CAAC,IAAI,EAAE,CAAC;gBACR,0CAA0C;gBAC1C,MAAM,OAAO,GAAS;oBAClB,GAAG,EAAE,IAAI,CAAC,EAAE,EAAE;oBACd,WAAW,EAAE,IAAI,IAAI,EAAE;oBACvB,YAAY,EAAE,IAAI,IAAI,EAAE;oBACxB,OAAO,EAAE,CAAC;oBACV,KAAK,EAAE,EAAE;oBACT,MAAM,EAAE,EAAE;iBACb,CAAC;gBACF,IAAI,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAY,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;gBAErE,oCAAoC;gBACpC,MAAM,UAAU,GAAY;oBACxB,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,EAAE;oBAC5B,SAAS,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS;oBACtE,QAAQ,EAAE,EAAE;oBACZ,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,EAAE;oBAClC,UAAU,EAAE,OAAO,CAAC,UAAU,IAAI,EAAE;oBACpC,WAAW,EAAE;wBACT,OAAO,EAAE,EAAE;qBACd;oBACD,GAAG,EAAE,IAAI,CAAC,GAAG;oBACb,WAAW,EAAE,IAAI,IAAI,EAAE;oBACvB,YAAY,EAAE,IAAI,IAAI,EAAE;oBACxB,OAAO,EAAE,CAAC;iBACb,CAAC;gBACF,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;oBAChB,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC;wBACrB,OAAO,EAAE,OAAO,CAAC,KAAK;wBACtB,IAAI,EAAE,WAAW,CAAC,KAAK;wBACvB,QAAQ,EAAE,OAAO,CAAC,cAAc,IAAI,KAAK;qBAC5C,CAAC,CAAC;gBACP,CAAC;gBACD,IAAI,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC;oBAC1C,MAAM,QAAQ,GAAU;wBACpB,KAAK,EAAE,OAAO,CAAC,KAAK;wBACpB,IAAI,EAAE,SAAS,CAAC,KAAK;wBACrB,OAAO,EAAE,IAAI,CAAC,GAAG;wBACjB,QAAQ,EAAE,IAAI;wBACd,GAAG,EAAE,IAAI,CAAC,EAAE,EAAE;wBACd,WAAW,EAAE,IAAI,IAAI,EAAE;wBACvB,YAAY,EAAE,IAAI,IAAI,EAAE;wBACxB,OAAO,EAAE,CAAC;qBACb,CAAC;oBACF,MAAM,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,QAAa,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;gBACpE,CAAC;gBACD,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;oBAChB,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC;wBACrB,OAAO,EAAE,OAAO,CAAC,KAAK;wBACtB,IAAI,EAAE,WAAW,CAAC,KAAK;wBACvB,QAAQ,EAAE,OAAO,CAAC,cAAc,IAAI,KAAK;qBAC5C,CAAC,CAAC;gBACP,CAAC;gBACD,IAAI,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC;oBAC1C,MAAM,QAAQ,GAAU;wBACpB,KAAK,EAAE,OAAO,CAAC,KAAK;wBACpB,IAAI,EAAE,SAAS,CAAC,KAAK;wBACrB,OAAO,EAAE,IAAI,CAAC,GAAG;wBACjB,QAAQ,EAAE,IAAI;wBACd,GAAG,EAAE,IAAI,CAAC,EAAE,EAAE;wBACd,WAAW,EAAE,IAAI,IAAI,EAAE;wBACvB,YAAY,EAAE,IAAI,IAAI,EAAE;wBACxB,OAAO,EAAE,CAAC;qBACb,CAAC;oBACF,MAAM,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,QAAa,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;gBACpE,CAAC;gBACD,MAAM,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,UAAe,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YACxE,CAAC;YAED,uFAAuF;YACvF,yFAAyF;YACzF,gDAAgD;YAChD,IAAI,CAAC,iBAAiB,EAAE,CAAC;gBACrB,MAAM,aAAa,GAAU;oBACzB,KAAK,EAAE,UAAU;oBACjB,IAAI,EAAE,SAAS,CAAC,KAAK;oBACrB,OAAO,EAAE,IAAI,CAAC,GAAG;oBACjB,QAAQ,EAAE,IAAI;oBACd,GAAG,EAAE,IAAI,CAAC,EAAE,EAAE;oBACd,WAAW,EAAE,IAAI,IAAI,EAAE;oBACvB,YAAY,EAAE,IAAI,IAAI,EAAE;oBACxB,OAAO,EAAE,CAAC;iBACb,CAAC;gBACF,MAAM,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,aAAkB,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YACzE,CAAC;YAED,OAAO,IAAI,CAAC;QAChB,CAAC,CAAC;QACF,MAAM,QAAQ,GAAiB,MAAM,IAAI,CAAC,aAAa,CAAC,WAAW,CAAC,YAAY,EAAE;YAC9E,IAAI,EAAE,SAAS;YACf,IAAI,EAAE,CAAC,OAAO,CAAC;SAClB,CAAC,CAAC;QACH,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAC1D,CAAC;IAED;;OAEG;IASU,AAAN,KAAK,CAAC,KAAK,CAAW,IAAa;QACtC,MAAM,KAAK,GAAW,MAAM,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QACvE,OAAO,IAAI,UAAU,CAAC;YAClB,KAAK;YACL,IAAI;SACP,CAAC,CAAC;IACP,CAAC;CACJ;AA5Ma;IADT,MAAM,CAAC,cAAc,CAAC;8BACI,cAAc;yDAAC;AAGhC;IADT,MAAM,CAAC,MAAM,CAAC;;oDACW;AAGhB;IADT,MAAM,CAAC,aAAa,CAAC;8BACI,aAAa;wDAAC;AAG9B;IADT,MAAM,CAAC,cAAc,CAAC;8BACI,cAAc;yDAAC;AAc5B;IADb,IAAI;;;;mDAkKJ;AAaY;IARZ,OAAO,CAAC,YAAY,CAAC;IACrB,WAAW,CACR,wIAAwI,CAC3I;IACA,OAAO,CAAC,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;IAChC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC;IACf,GAAG,EAAE;IACL,IAAI,EAAE;IACa,WAAA,QAAQ,CAAA;;;;8CAM3B"}