@solidxai/core 0.1.13-beta.2 → 0.1.13-beta.21

package/dist/services/mpin.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mpin.service.js","sourceRoot":"","sources":["../../src/services/mpin.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;AAAA,2CAMwB;AACxB,mCAAiD;AACjD,gEAA8D;AAC9D,oEAAkE;AAMlE,uGAAkG;AAClG,mEAAgE;AAEhE,qEAAiE;AACjE,uDAAmD;AACnD,uDAAmD;AACnD,mFAA6E;AAO7E,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC;IAC1B,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;IAC9E,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;IAC9D,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ;CACvE,CAAC,CAAC;AAGI,IAAM,WAAW,mBAAjB,MAAM,WAAW;IAGpB,YACqB,oBAAoD,EACpD,cAA8B,EAC9B,cAA8B,EAC9B,cAA8B,EAC9B,qBAA4C,EAC5C,0BAAsD;QALtD,yBAAoB,GAApB,oBAAoB,CAAgC;QACpD,mBAAc,GAAd,cAAc,CAAgB;QAC9B,mBAAc,GAAd,cAAc,CAAgB;QAC9B,mBAAc,GAAd,cAAc,CAAgB;QAC9B,0BAAqB,GAArB,qBAAqB,CAAuB;QAC5C,+BAA0B,GAA1B,0BAA0B,CAA4B;QAR1D,WAAM,GAAG,IAAI,eAAM,CAAC,aAAW,CAAC,IAAI,CAAC,CAAC;IASnD,CAAC;IAIL,KAAK,CAAC,SAAS,CAAC,UAA0B,EAAE,GAAiB;QACzD,IAAI,CAAC,aAAa,EAAE,CAAC;QACrB,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAKpC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,UAAU,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QAClF,IAAI,CAAC,IAAI,EAAE,CAAC;YACR,MAAM,IAAI,0BAAiB,CAAC,+BAAc,CAAC,cAAc,CAAC,CAAC;QAC/D,CAAC;QAOD,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;QAE5C,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,OAAO,CAAC;YACrD,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE;SAC7C,CAAC,CAAC;QAIH,MAAM,MAAM,GAAG,QAAQ,IAAI,IAAI,CAAC,oBAAoB,CAAC,MAAM,CAAC;YACxD,IAAI;YACJ,QAAQ;SACX,CAAC,CAAC;QAKH,MAAM,CAAC,aAAa,GAAG,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QAExE,MAAM,aAAa,GAAG,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAC/C,MAAM,CAAC,mBAAmB,GAAG,IAAI,CAAC,iBAAiB,CAAC,aAAa,CAAC,CAAC;QACnE,MAAM,CAAC,UAAU,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC7D,MAAM,CAAC,UAAU,GAAG,IAAI,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;QAC/C,MAAM,CAAC,iBAAiB,GAAG,IAAI,CAAC,cAAc,CAAC,cAAc,EAAE,CAAC;QAChE,MAAM,CAAC,UAAU,GAAG,GAAG,CAAC,UAAU,IAAI,IAAI,CAAC;QAC3C,MAAM,CAAC,QAAQ,GAAG,GAAG,CAAC,QAAQ,IAAI,IAAI,CAAC;QACvC,MAAM,CAAC,QAAQ,GAAG,IAAI,CAAC;QACvB,MAAM,CAAC,cAAc,GAAG,CAAC,CAAC;QAC1B,MAAM,CAAC,WAAW,GAAG,IAAI,CAAC;QAE1B,MAAM,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,EAAE,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;QACrD,MAAM,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAI7C,OAAO,EAAE,aAAa,EAAE,OAAO,EAAE,mCAAgB,CAAC,kBAAkB,EAAE,CAAC;IAC3E,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,UAA0B,EAAE,GAAkB;QAC3D,IAAI,CAAC,aAAa,EAAE,CAAC;QACrB,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAIvC,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,OAAO,CAAC;YACvD,KAAK,EAAE;gBACH,mBAAmB,EAAE,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,aAAa,CAAC;gBAC9D,IAAI,EAAE,EAAE,EAAE,EAAE,UAAU,CAAC,GAAG,EAAE;aAC/B;SACJ,CAAC,CAAC;QAEH,IAAI,CAAC,UAAU,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;YACtC,MAAM,IAAI,8BAAqB,CAAC,+BAAc,CAAC,YAAY,CAAC,CAAC;QACjE,CAAC;QACD,IAAI,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC;QAEjC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,OAAO,CAC7C,GAAG,CAAC,WAAW,EACf,UAAU,CAAC,UAAU,EACrB,UAAU,CAAC,iBAAiB,CAC/B,CAAC;QACF,IAAI,CAAC,OAAO,EAAE,CAAC;YACX,MAAM,MAAM,IAAI,CAAC,qBAAqB,CAAC,UAAU,CAAC,CAAC;QACvD,CAAC;QAID,MAAM,aAAa,GAAG,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAC/C,UAAU,CAAC,mBAAmB,GAAG,IAAI,CAAC,iBAAiB,CAAC,aAAa,CAAC,CAAC;QACvE,UAAU,CAAC,UAAU,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACpE,UAAU,CAAC,UAAU,GAAG,IAAI,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;QACnD,UAAU,CAAC,iBAAiB,GAAG,IAAI,CAAC,cAAc,CAAC,cAAc,EAAE,CAAC;QACpE,UAAU,CAAC,cAAc,GAAG,CAAC,CAAC;QAC9B,UAAU,CAAC,WAAW,GAAG,IAAI,CAAC;QAC9B,MAAM,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAEjD,OAAO,EAAE,aAAa,EAAE,OAAO,EAAE,mCAAgB,CAAC,oBAAoB,EAAE,CAAC;IAC7E,CAAC;IAID,KAAK,CAAC,aAAa,CAAC,GAAiB;QACjC,IAAI,CAAC,aAAa,EAAE,CAAC;QAIrB,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,OAAO,CAAC;YACvD,KAAK,EAAE,EAAE,mBAAmB,EAAE,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE;YACzE,SAAS,EAAE,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;SACvC,CAAC,CAAC;QAGH,IAAI,CAAC,UAAU,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;YAClC,MAAM,IAAI,8BAAqB,CAAC,+BAAc,CAAC,YAAY,CAAC,CAAC;QACjE,CAAC;QAUD,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;YACvB,MAAM,IAAI,8BAAqB,CAAC,+BAAc,CAAC,YAAY,CAAC,CAAC;QACjE,CAAC;QAID,IAAI,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC;QAEjC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,OAAO,CAC7C,GAAG,CAAC,IAAI,EACR,UAAU,CAAC,UAAU,EACrB,UAAU,CAAC,iBAAiB,CAC/B,CAAC;QAEF,IAAI,CAAC,OAAO,EAAE,CAAC;YACX,MAAM,MAAM,IAAI,CAAC,qBAAqB,CAAC,UAAU,CAAC,CAAC;QACvD,CAAC;QAED,UAAU,CAAC,cAAc,GAAG,CAAC,CAAC;QAC9B,UAAU,CAAC,WAAW,GAAG,IAAI,CAAC;QAC9B,UAAU,CAAC,UAAU,GAAG,IAAI,IAAI,EAAE,CAAC;QACnC,IAAI,IAAI,CAAC,cAAc,CAAC,WAAW,CAAC,UAAU,CAAC,UAAU,EAAE,UAAU,CAAC,iBAAiB,CAAC,EAAE,CAAC;YACvF,UAAU,CAAC,UAAU,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACjE,UAAU,CAAC,UAAU,GAAG,IAAI,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;YACnD,UAAU,CAAC,iBAAiB,GAAG,IAAI,CAAC,cAAc,CAAC,cAAc,EAAE,CAAC;QACxE,CAAC;QACD,MAAM,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAEjD,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC;QAC7B,MAAM,IAAI,CAAC,0BAA0B,CAAC,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QAK9D,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,cAAc,CAAC,IAAI,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC;QAE1F,OAAO;YACH,IAAI,EAAE;gBACF,EAAE,EAAE,IAAI,CAAC,EAAE;gBACX,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;gBAC7C,KAAK,EAAE,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC;aACrD;YACD,GAAG,MAAM;SACZ,CAAC;IACN,CAAC;IAID,KAAK,CAAC,WAAW,CAAC,UAA0B;QACxC,IAAI,CAAC,aAAa,EAAE,CAAC;QAErB,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC;YACrD,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,UAAU,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE;SAC1D,CAAC,CAAC;QAEH,OAAO,WAAW;aACb,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC;aAC/D,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC,CAAC;IAC5D,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,UAA0B,EAAE,EAAU;QACrD,IAAI,CAAC,aAAa,EAAE,CAAC;QAErB,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,OAAO,CAAC;YACvD,KAAK,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,UAAU,CAAC,GAAG,EAAE,EAAE;SAC9C,CAAC,CAAC;QACH,IAAI,CAAC,UAAU,EAAE,CAAC;YACd,MAAM,IAAI,0BAAiB,CAAC,+BAAc,CAAC,yBAAyB,CAAC,CAAC;QAC1E,CAAC;QAKD,UAAU,CAAC,QAAQ,GAAG,KAAK,CAAC;QAC5B,MAAM,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAEjD,OAAO,EAAE,OAAO,EAAE,mCAAgB,CAAC,mBAAmB,EAAE,CAAC;IAC7D,CAAC;IAUO,YAAY,CAAC,UAAgC;QACjD,OAAO;YACH,EAAE,EAAE,UAAU,CAAC,EAAE;YACjB,QAAQ,EAAE,UAAU,CAAC,QAAQ;YAC7B,UAAU,EAAE,UAAU,CAAC,UAAU;YACjC,QAAQ,EAAE,UAAU,CAAC,QAAQ;YAC7B,QAAQ,EAAE,UAAU,CAAC,QAAQ;YAC7B,cAAc,EAAE,UAAU,CAAC,cAAc;YACzC,WAAW,EAAE,UAAU,CAAC,WAAW;YACnC,UAAU,EAAE,UAAU,CAAC,UAAU;YACjC,SAAS,EAAE,UAAU,CAAC,SAAS;SAClC,CAAC;IACN,CAAC;IAEO,aAAa;QACjB,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,cAAc,CAAmB,aAAa,CAAC,EAAE,CAAC;YAEvE,MAAM,IAAI,0BAAiB,CAAC,+BAAc,CAAC,gBAAgB,CAAC,CAAC;QACjE,CAAC;IACL,CAAC;IAEO,eAAe,CAAC,UAAgC;QACpD,IAAI,UAAU,CAAC,WAAW,IAAI,UAAU,CAAC,WAAW,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YAC1E,MAAM,IAAI,8BAAqB,CAAC,+BAAc,CAAC,WAAW,CAAC,CAAC;QAChE,CAAC;IACL,CAAC;IAEO,oBAAoB,CAAC,IAAY;QACrC,MAAM,OAAO,GAAG,MAAM,CAClB,IAAI,CAAC,cAAc,CAAC,cAAc,CAAmB,WAAW,CAAC,IAAI,YAAY,CACpF,CAAC;QAMF,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,IAAI,CAAC;YACD,OAAO,GAAG,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7C,CAAC;QAAC,MAAM,CAAC;YACL,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,8BAA8B,OAAO,EAAE,CAAC,CAAC;YAC3D,MAAM,IAAI,4BAAmB,CAAC,+BAAc,CAAC,mBAAmB,CAAC,CAAC;QACtE,CAAC;QAED,IAAI,CAAC,OAAO,EAAE,CAAC;YACX,MAAM,IAAI,4BAAmB,CAAC,+BAAc,CAAC,mBAAmB,CAAC,CAAC;QACtE,CAAC;QAID,IAAI,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC;YAI3B,MAAM,IAAI,4BAAmB,CAAC,+BAAc,CAAC,oBAAoB,CAAC,CAAC;QACvE,CAAC;IACL,CAAC;IAEO,aAAa,CAAC,IAAY;QAC9B,IAAI,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACzB,OAAO,IAAI,CAAC;QAChB,CAAC;QACD,IAAI,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1B,OAAO,IAAI,CAAC;QAChB,CAAC;QACD,OAAO,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACnC,CAAC;IAEO,YAAY,CAAC,IAAY;QAC7B,IAAI,SAAS,GAAG,IAAI,CAAC;QACrB,IAAI,UAAU,GAAG,IAAI,CAAC;QACtB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACnC,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YACzD,IAAI,IAAI,KAAK,CAAC;gBAAE,SAAS,GAAG,KAAK,CAAC;YAClC,IAAI,IAAI,KAAK,CAAC,CAAC;gBAAE,UAAU,GAAG,KAAK,CAAC;QACxC,CAAC;QACD,OAAO,SAAS,IAAI,UAAU,CAAC;IACnC,CAAC;IAUO,KAAK,CAAC,qBAAqB,CAC/B,UAAgC;QAEhC,MAAM,aAAa,GAAG,MAAM,CACxB,IAAI,CAAC,cAAc,CAAC,cAAc,CAAmB,uBAAuB,CAAC,CAChF,CAAC;QACF,MAAM,mBAAmB,GAAG,MAAM,CAC9B,IAAI,CAAC,cAAc,CAAC,cAAc,CAAmB,4BAA4B,CAAC,CACrF,CAAC;QACF,MAAM,cAAc,GAAG,MAAM,CACzB,IAAI,CAAC,cAAc,CAAC,cAAc,CAAmB,qBAAqB,CAAC,CAC9E,CAAC;QAEF,UAAU,CAAC,cAAc,IAAI,CAAC,CAAC;QAC/B,IAAI,KAAK,GAAG,IAAI,8BAAqB,CAAC,+BAAc,CAAC,YAAY,CAAC,CAAC;QAEnE,IAAI,UAAU,CAAC,QAAQ,IAAI,mBAAmB,GAAG,CAAC,IAAI,UAAU,CAAC,cAAc,IAAI,mBAAmB,EAAE,CAAC;YACrG,UAAU,CAAC,QAAQ,GAAG,KAAK,CAAC;YAC5B,UAAU,CAAC,WAAW,GAAG,IAAI,CAAC;YAK9B,KAAK,GAAG,IAAI,8BAAqB,CAAC,+BAAc,CAAC,YAAY,CAAC,CAAC;QACnE,CAAC;aAAM,IAAI,UAAU,CAAC,QAAQ,IAAI,aAAa,GAAG,CAAC,IAAI,UAAU,CAAC,cAAc,GAAG,aAAa,KAAK,CAAC,EAAE,CAAC;YACrG,UAAU,CAAC,WAAW,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,cAAc,GAAG,IAAI,CAAC,CAAC;YACtE,KAAK,GAAG,IAAI,8BAAqB,CAAC,+BAAc,CAAC,WAAW,CAAC,CAAC;QAClE,CAAC;QAED,MAAM,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACjD,OAAO,KAAK,CAAC;IACjB,CAAC;IAQO,KAAK,CAAC,kBAAkB,CAAC,MAAc,EAAE,SAAkB;QAC/D,MAAM,GAAG,GAAG,MAAM,CACd,IAAI,CAAC,cAAc,CAAC,cAAc,CAAmB,uBAAuB,CAAC,CAChF,CAAC;QACF,IAAI,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC;YACnB,OAAO;QACX,CAAC;QAED,MAAM,MAAM,GAAG,CAAC,MAAM,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC;YACjD,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE;SAClD,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,EAAE,KAAK,SAAS,CAAC,CAAC;QAGxD,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,GAAG,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;QAC3C,IAAI,QAAQ,IAAI,CAAC,EAAE,CAAC;YAChB,OAAO;QACX,CAAC;QAKD,MAAM,MAAM,GAAG,MAAM;aAChB,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC;aAC/D,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;QAExB,KAAK,MAAM,UAAU,IAAI,MAAM,EAAE,CAAC;YAC9B,UAAU,CAAC,QAAQ,GAAG,KAAK,CAAC;QAChC,CAAC;QACD,MAAM,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC7C,IAAI,CAAC,MAAM,CAAC,GAAG,CACX,WAAW,MAAM,CAAC,MAAM,gCAAgC,MAAM,yBAAyB,GAAG,EAAE,CAC/F,CAAC;IACN,CAAC;IAEO,cAAc,CAAC,UAAgC;QACnD,OAAO,UAAU,CAAC,UAAU,EAAE,OAAO,EAAE,IAAI,UAAU,CAAC,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IACpF,CAAC;IAUO,kBAAkB,CAAC,QAAgB,EAAE,QAAgB;QACzD,MAAM,kBAAkB,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QACtF,OAAO,GAAG,kBAAkB,IAAI,QAAQ,EAAE,CAAC;IAC/C,CAAC;IAEO,iBAAiB;QACrB,OAAO,IAAA,oBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC3C,CAAC;IAKO,iBAAiB,CAAC,aAAqB;QAC3C,OAAO,IAAA,mBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACpE,CAAC;CACJ,CAAA;AA3ZY,kCAAW;sBAAX,WAAW;IADvB,IAAA,mBAAU,GAAE;qCAKkC,kEAA8B;QACpC,gCAAc;QACd,gCAAc;QACd,gCAAc;QACP,8CAAqB;QAChB,0DAA0B;GATlE,WAAW,CA2ZvB","sourcesContent":["import {\n    BadRequestException,\n    Injectable,\n    Logger,\n    NotFoundException,\n    UnauthorizedException,\n} from '@nestjs/common';\nimport { createHash, randomBytes } from 'crypto';\nimport { ERROR_MESSAGES } from 'src/constants/error-messages';\nimport { SUCCESS_MESSAGES } from 'src/constants/success-messages';\nimport { ChangeMpinDto } from 'src/dtos/change-mpin.dto';\nimport { MpinLoginDto } from 'src/dtos/mpin-login.dto';\nimport { SetupMpinDto } from 'src/dtos/setup-mpin.dto';\nimport { UserDeviceCredential } from 'src/entities/user-device-credential.entity';\nimport { ActiveUserData } from 'src/interfaces/active-user-data.interface';\nimport { UserDeviceCredentialRepository } from 'src/repository/user-device-credential.repository';\nimport { UserRepository } from 'src/repository/user.repository';\nimport type { SolidCoreSetting } from 'src/services/settings/default-settings-provider.service';\nimport { AuthenticationService } from './authentication.service';\nimport { HashingService } from './hashing.service';\nimport { SettingService } from './setting.service';\nimport { UserActivityHistoryService } from './user-activity-history.service';\n\n/**\n * The most-chosen PINs in published analyses of breached sets. `1234` alone\n * accounts for roughly a tenth of four-digit choices, so a list this short\n * removes a disproportionate share of guessable values.\n */\nconst MPIN_DENYLIST = new Set([\n    '0000', '1111', '2222', '3333', '4444', '5555', '6666', '7777', '8888', '9999',\n    '1234', '4321', '1212', '2001', '1004', '2000', '6969', '2580',\n    '000000', '111111', '123456', '654321', '121212', '112233', '123123',\n]);\n\n@Injectable()\nexport class MpinService {\n    private readonly logger = new Logger(MpinService.name);\n\n    constructor(\n        private readonly credentialRepository: UserDeviceCredentialRepository,\n        private readonly userRepository: UserRepository,\n        private readonly hashingService: HashingService,\n        private readonly settingService: SettingService,\n        private readonly authenticationService: AuthenticationService,\n        private readonly userActivityHistoryService: UserActivityHistoryService,\n    ) { }\n\n    // ---------------------------------------------------------------- setup\n\n    async setupMpin(activeUser: ActiveUserData, dto: SetupMpinDto) {\n        this.assertEnabled();\n        this.assertMpinAcceptable(dto.mpin);\n\n        // The account comes from the access token, never from the body - a\n        // client can only ever create a credential for the user it is signed\n        // in as.\n        const user = await this.userRepository.findOne({ where: { id: activeUser.sub } });\n        if (!user) {\n            throw new NotFoundException(ERROR_MESSAGES.USER_NOT_FOUND);\n        }\n\n        // Lower-cased because @IsUUID is case-insensitive: iOS renders a UUID\n        // uppercase (identifierForVendor.uuidString) while Android renders it\n        // lowercase, and both validate. Without normalising, the same physical\n        // device could present two spellings, miss this exact-match lookup and\n        // end up with two credential rows consuming two slots against the cap.\n        const deviceId = dto.deviceId.toLowerCase();\n\n        const existing = await this.credentialRepository.findOne({\n            where: { user: { id: user.id }, deviceId },\n        });\n\n        // Re-running setup on the same device rotates the credential rather\n        // than adding a second one.\n        const record = existing ?? this.credentialRepository.create({\n            user,\n            deviceId,\n        });\n\n        // Recomputed on every setup so a renamed user does not keep a stale\n        // key. It is an identifier for humans and tooling, never a lookup key,\n        // so drift here costs nothing operationally.\n        record.credentialKey = this.buildCredentialKey(user.username, deviceId);\n\n        const credentialRef = this.mintCredentialRef();\n        record.hashedCredentialRef = this.hashCredentialRef(credentialRef);\n        record.hashedMpin = await this.hashingService.hash(dto.mpin);\n        record.mpinScheme = this.hashingService.name();\n        record.mpinSchemeVersion = this.hashingService.currentVersion();\n        record.deviceName = dto.deviceName ?? null;\n        record.platform = dto.platform ?? null;\n        record.isActive = true;\n        record.failedAttempts = 0;\n        record.lockedUntil = null;\n\n        await this.evictOldestIfAtCap(user.id, existing?.id);\n        await this.credentialRepository.save(record);\n\n        // Returned once. Only its SHA-256 is stored, so it can never be\n        // re-issued - the client must persist it before reporting success.\n        return { credentialRef, message: SUCCESS_MESSAGES.MPIN_SETUP_SUCCESS };\n    }\n\n    async changeMpin(activeUser: ActiveUserData, dto: ChangeMpinDto) {\n        this.assertEnabled();\n        this.assertMpinAcceptable(dto.newMpin);\n\n        // Scoped to the caller, so holding someone else's handle is not enough\n        // to change their MPIN.\n        const credential = await this.credentialRepository.findOne({\n            where: {\n                hashedCredentialRef: this.hashCredentialRef(dto.credentialRef),\n                user: { id: activeUser.sub },\n            },\n        });\n\n        if (!credential || !credential.isActive) {\n            throw new UnauthorizedException(ERROR_MESSAGES.MPIN_INVALID);\n        }\n        this.assertNotLocked(credential);\n\n        const matches = await this.hashingService.compare(\n            dto.currentMpin,\n            credential.hashedMpin,\n            credential.mpinSchemeVersion,\n        );\n        if (!matches) {\n            throw await this.registerFailedAttempt(credential);\n        }\n\n        // Rotate the handle alongside the MPIN: a changed credential should\n        // invalidate anything captured previously.\n        const credentialRef = this.mintCredentialRef();\n        credential.hashedCredentialRef = this.hashCredentialRef(credentialRef);\n        credential.hashedMpin = await this.hashingService.hash(dto.newMpin);\n        credential.mpinScheme = this.hashingService.name();\n        credential.mpinSchemeVersion = this.hashingService.currentVersion();\n        credential.failedAttempts = 0;\n        credential.lockedUntil = null;\n        await this.credentialRepository.save(credential);\n\n        return { credentialRef, message: SUCCESS_MESSAGES.MPIN_CHANGED_SUCCESS };\n    }\n\n    // ---------------------------------------------------------------- login\n\n    async loginWithMpin(dto: MpinLoginDto) {\n        this.assertEnabled();\n\n        // A single indexed exact-match lookup. The row already names the user,\n        // so there is nothing to resolve and no identifier to enumerate with.\n        const credential = await this.credentialRepository.findOne({\n            where: { hashedCredentialRef: this.hashCredentialRef(dto.credentialRef) },\n            relations: { user: { roles: true } },\n        });\n\n        // An unknown handle is reported exactly as a wrong MPIN is.\n        if (!credential || !credential.user) {\n            throw new UnauthorizedException(ERROR_MESSAGES.MPIN_INVALID);\n        }\n\n        // A dead credential is reported as such regardless of what MPIN was\n        // supplied. Gating this on a correct MPIN would be marginally more\n        // conservative, but it protects almost nothing - \"this dead handle was\n        // once real\" grants no capability - and it costs an asymmetry that\n        // reads as a bug: the attempt that causes deactivation reports\n        // MPIN_REVOKED, while the very next identical attempt would report\n        // MPIN_INVALID. The enumeration resistance that matters comes from the\n        // handle being unguessable, not from this branch.\n        if (!credential.isActive) {\n            throw new UnauthorizedException(ERROR_MESSAGES.MPIN_REVOKED);\n        }\n\n        // Checked before the hash comparison, so attempts made during a lockout\n        // neither extend it nor cost a bcrypt call.\n        this.assertNotLocked(credential);\n\n        const matches = await this.hashingService.compare(\n            dto.mpin,\n            credential.hashedMpin,\n            credential.mpinSchemeVersion,\n        );\n\n        if (!matches) {\n            throw await this.registerFailedAttempt(credential);\n        }\n\n        credential.failedAttempts = 0;\n        credential.lockedUntil = null;\n        credential.lastUsedAt = new Date();\n        if (this.hashingService.needsRehash(credential.hashedMpin, credential.mpinSchemeVersion)) {\n            credential.hashedMpin = await this.hashingService.hash(dto.mpin);\n            credential.mpinScheme = this.hashingService.name();\n            credential.mpinSchemeVersion = this.hashingService.currentVersion();\n        }\n        await this.credentialRepository.save(credential);\n\n        const user = credential.user;\n        await this.userActivityHistoryService.logEvent('login', user);\n\n        // A fresh token pair - never a replay of a stored refresh token. This\n        // is what makes MPIN survive logout and refresh-token expiry. The\n        // stable deviceId keeps repeat logins in one session bucket.\n        const tokens = await this.authenticationService.generateTokens(user, credential.deviceId);\n\n        return {\n            user: {\n                id: user.id,\n                email: user.email,\n                mobile: user.mobile,\n                username: user.username,\n                forcePasswordChange: user.forcePasswordChange,\n                roles: (user.roles ?? []).map((role) => role.name),\n            },\n            ...tokens,\n        };\n    }\n\n    // ----------------------------------------------------- device management\n\n    async listDevices(activeUser: ActiveUserData) {\n        this.assertEnabled();\n\n        const credentials = await this.credentialRepository.find({\n            where: { user: { id: activeUser.sub }, isActive: true },\n        });\n\n        return credentials\n            .sort((a, b) => this.lastUsedMillis(b) - this.lastUsedMillis(a))\n            .map((credential) => this.toDeviceView(credential));\n    }\n\n    async revokeDevice(activeUser: ActiveUserData, id: number) {\n        this.assertEnabled();\n\n        const credential = await this.credentialRepository.findOne({\n            where: { id, user: { id: activeUser.sub } },\n        });\n        if (!credential) {\n            throw new NotFoundException(ERROR_MESSAGES.MPIN_CREDENTIAL_NOT_FOUND);\n        }\n\n        // Soft-delete. The row survives so a correct MPIN can be answered with\n        // MPIN_REVOKED rather than a baffling MPIN_INVALID; only active rows\n        // count towards the device cap.\n        credential.isActive = false;\n        await this.credentialRepository.save(credential);\n\n        return { message: SUCCESS_MESSAGES.MPIN_DEVICE_REVOKED };\n    }\n\n    // -------------------------------------------------------------- internals\n\n    /**\n     * Never exposes the stored hashes, independently of whatever serialiser\n     * configuration a consuming app runs. The entity also withholds them via\n     * @Exclude()/@Expose(), but building the response explicitly means a\n     * carelessly added decorator cannot leak a credential.\n     */\n    private toDeviceView(credential: UserDeviceCredential) {\n        return {\n            id: credential.id,\n            deviceId: credential.deviceId,\n            deviceName: credential.deviceName,\n            platform: credential.platform,\n            isActive: credential.isActive,\n            failedAttempts: credential.failedAttempts,\n            lockedUntil: credential.lockedUntil,\n            lastUsedAt: credential.lastUsedAt,\n            createdAt: credential.createdAt,\n        };\n    }\n\n    private assertEnabled(): void {\n        if (!this.settingService.getConfigValue<SolidCoreSetting>('mpinEnabled')) {\n            // 404 rather than 403: a disabled feature should look absent.\n            throw new NotFoundException(ERROR_MESSAGES.MPIN_NOT_ENABLED);\n        }\n    }\n\n    private assertNotLocked(credential: UserDeviceCredential): void {\n        if (credential.lockedUntil && credential.lockedUntil.getTime() > Date.now()) {\n            throw new UnauthorizedException(ERROR_MESSAGES.MPIN_LOCKED);\n        }\n    }\n\n    private assertMpinAcceptable(mpin: string): void {\n        const pattern = String(\n            this.settingService.getConfigValue<SolidCoreSetting>('mpinRegex') ?? '^\\\\d{4,6}$',\n        );\n\n        // Fails closed. `matches` starts false and a malformed pattern - the\n        // setting is admin-editable free text - becomes a rejection rather\n        // than a skipped check, so a typo cannot silently let users set an\n        // MPIN weaker than policy allows.\n        let matches = false;\n        try {\n            matches = new RegExp(pattern).test(mpin);\n        } catch {\n            this.logger.error(`Invalid mpinRegex setting: ${pattern}`);\n            throw new BadRequestException(ERROR_MESSAGES.MPIN_FORMAT_INVALID);\n        }\n\n        if (!matches) {\n            throw new BadRequestException(ERROR_MESSAGES.MPIN_FORMAT_INVALID);\n        }\n\n        // Predictability is semantics, not shape - a regex expressing \"not\n        // sequential\" would be unreadable and easy to get subtly wrong.\n        if (this.isPredictable(mpin)) {\n            // Safe to distinguish, and 400 rather than 401: this only ever\n            // happens on a bearer-authenticated route, so it is a validation\n            // failure rather than an authentication one.\n            throw new BadRequestException(ERROR_MESSAGES.MPIN_TOO_PREDICTABLE);\n        }\n    }\n\n    private isPredictable(mpin: string): boolean {\n        if (/^(\\d)\\1+$/.test(mpin)) {\n            return true;\n        }\n        if (this.isSequential(mpin)) {\n            return true;\n        }\n        return MPIN_DENYLIST.has(mpin);\n    }\n\n    private isSequential(mpin: string): boolean {\n        let ascending = true;\n        let descending = true;\n        for (let i = 1; i < mpin.length; i++) {\n            const step = mpin.charCodeAt(i) - mpin.charCodeAt(i - 1);\n            if (step !== 1) ascending = false;\n            if (step !== -1) descending = false;\n        }\n        return ascending || descending;\n    }\n\n    /**\n     * Records a failure and escalates. `failedAttempts` is cumulative and\n     * resets only on success - never when a lockout expires - which is what\n     * makes the second threshold detectable without a separate counter.\n     *\n     * Returns the exception for the caller to throw, so the save is always\n     * awaited before the response leaves.\n     */\n    private async registerFailedAttempt(\n        credential: UserDeviceCredential,\n    ): Promise<UnauthorizedException> {\n        const lockThreshold = Number(\n            this.settingService.getConfigValue<SolidCoreSetting>('mpinMaxFailedAttempts'),\n        );\n        const deactivateThreshold = Number(\n            this.settingService.getConfigValue<SolidCoreSetting>('mpinMaxTotalFailedAttempts'),\n        );\n        const lockoutSeconds = Number(\n            this.settingService.getConfigValue<SolidCoreSetting>('mpinLockoutDuration'),\n        );\n\n        credential.failedAttempts += 1;\n        let error = new UnauthorizedException(ERROR_MESSAGES.MPIN_INVALID);\n\n        if (credential.isActive && deactivateThreshold > 0 && credential.failedAttempts >= deactivateThreshold) {\n            credential.isActive = false;\n            credential.lockedUntil = null;\n            // This attempt caused the deactivation, so it is reported. The\n            // caller reached the limit on a handle they demonstrably hold and\n            // caused this state themselves, so nothing is disclosed - and\n            // without it they would keep retrying a permanently dead credential.\n            error = new UnauthorizedException(ERROR_MESSAGES.MPIN_REVOKED);\n        } else if (credential.isActive && lockThreshold > 0 && credential.failedAttempts % lockThreshold === 0) {\n            credential.lockedUntil = new Date(Date.now() + lockoutSeconds * 1000);\n            error = new UnauthorizedException(ERROR_MESSAGES.MPIN_LOCKED);\n        }\n\n        await this.credentialRepository.save(credential);\n        return error;\n    }\n\n    /**\n     * The cap evicts rather than rejects. A reinstall wipes the client's\n     * deviceId, so the app generates a new one and setup adds a row instead of\n     * replacing the old, orphaned one. Rejecting at the cap would mean a user\n     * who reinstalls a few times could never set MPIN up again.\n     */\n    private async evictOldestIfAtCap(userId: number, excludeId?: number): Promise<void> {\n        const cap = Number(\n            this.settingService.getConfigValue<SolidCoreSetting>('mpinMaxDevicesPerUser'),\n        );\n        if (!cap || cap <= 0) {\n            return;\n        }\n\n        const active = (await this.credentialRepository.find({\n            where: { user: { id: userId }, isActive: true },\n        })).filter((credential) => credential.id !== excludeId);\n\n        // One slot is about to be taken by the credential being written.\n        const overflow = active.length - (cap - 1);\n        if (overflow <= 0) {\n            return;\n        }\n\n        // Sorted in JS rather than SQL because a never-used credential has a\n        // null lastUsedAt, and Postgres sorts nulls last on ASC - which would\n        // treat the least-used rows as the most recently used.\n        const doomed = active\n            .sort((a, b) => this.lastUsedMillis(a) - this.lastUsedMillis(b))\n            .slice(0, overflow);\n\n        for (const credential of doomed) {\n            credential.isActive = false;\n        }\n        await this.credentialRepository.save(doomed);\n        this.logger.log(\n            `Evicted ${doomed.length} MPIN credential(s) for user ${userId} at the device cap of ${cap}`,\n        );\n    }\n\n    private lastUsedMillis(credential: UserDeviceCredential): number {\n        return credential.lastUsedAt?.getTime() ?? credential.createdAt?.getTime() ?? 0;\n    }\n\n    /**\n     * `<username>-<deviceId>`, the model's natural key.\n     *\n     * Not slugified: lodash `kebabCase` splits digit/letter boundaries, so it\n     * would shred a UUID into `3-f-7-b-8-a-10-...`. The username is lower-cased\n     * and stripped of whitespace, which is enough for a key that is only ever\n     * read, never parsed back into its parts.\n     */\n    private buildCredentialKey(username: string, deviceId: string): string {\n        const normalizedUsername = (username ?? '').trim().toLowerCase().replace(/\\s+/g, '-');\n        return `${normalizedUsername}-${deviceId}`;\n    }\n\n    private mintCredentialRef(): string {\n        return randomBytes(32).toString('hex');\n    }\n\n    // SHA-256, not bcrypt: 256 bits of randomness has nothing to brute-force,\n    // so a slow hash would only add latency to every login. Same reasoning as\n    // ApiKeyService.hash.\n    private hashCredentialRef(credentialRef: string): string {\n        return createHash('sha256').update(credentialRef).digest('hex');\n    }\n}\n"]}

package/dist/services/object.utils.d.ts

@@ -0,0 +1,2 @@
+export declare function normalizeObjectKeys(obj: any): any;
+//# sourceMappingURL=object.utils.d.ts.map

package/dist/services/object.utils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"object.utils.d.ts","sourceRoot":"","sources":["../../src/services/object.utils.ts"],"names":[],"mappings":"AAGA,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,GAAG,GAAG,GAAG,CAMjD"}

package/dist/services/object.utils.js

@@ -0,0 +1,11 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.normalizeObjectKeys = normalizeObjectKeys;
+function normalizeObjectKeys(obj) {
+    return Object.keys(obj).reduce((acc, key) => {
+        const newKey = key.replace(/^\[(.*)\]$/, '$1');
+        acc[newKey] = obj[key];
+        return acc;
+    }, {});
+}
+//# sourceMappingURL=object.utils.js.map

package/dist/services/object.utils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"object.utils.js","sourceRoot":"","sources":["../../src/services/object.utils.ts"],"names":[],"mappings":";;AAGA,kDAMC;AAND,SAAgB,mBAAmB,CAAC,GAAQ;IACxC,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QACxC,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC;QAC/C,GAAG,CAAC,MAAM,CAAC,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC;QACvB,OAAO,GAAG,CAAC;IACf,CAAC,EAAE,EAAE,CAAC,CAAC;AACX,CAAC","sourcesContent":["// Some filter/sort DTOs arrive with bracket-wrapped keys (e.g. \"[isPublished]\") from\n// query-string parsing. Both CrudHelperService and DraftPublishHelperService need to\n// strip that wrapping before reading keys, so it lives here as a shared utility.\nexport function normalizeObjectKeys(obj: any): any {\n    return Object.keys(obj).reduce((acc, key) => {\n        const newKey = key.replace(/^\\[(.*)\\]$/, '$1');\n        acc[newKey] = obj[key];\n        return acc;\n    }, {});\n}\n"]}

package/dist/services/refresh-token-ids-storage.service.d.ts

@@ -1,21 +1,40 @@
 import { Cache } from 'cache-manager';
 import { AuthenticationService } from './authentication.service';
+import { SettingService } from './setting.service';
 export declare class InvalidatedRefreshTokenError extends Error {
 }
 type RefreshTokenState = {
     currentRefreshToken: string;
     previousRefreshToken: string;
+    previousValidUntil?: number;
+};
+export type RefreshTokenClaims = {
+    deviceKey?: string;
+    epoch?: number;
+};
+export type RotatedRefreshToken = {
+    refreshToken: string;
+    deviceKey?: string;
 };
 export declare class RefreshTokenIdsStorageService {
     private cacheManager;
     private readonly authenticationService;
-    constructor(cacheManager: Cache, authenticationService: AuthenticationService);
-    insert(userId: number, refreshToken: string, previousRefreshToken?: string): Promise<void>;
-    validate(userId: number, refreshToken: string): Promise<boolean>;
-    invalidate(userId: number): Promise<void>;
-    validateAndRotate(user: any, refreshToken: string): Promise<string>;
+    private readonly settingService;
+    constructor(cacheManager: Cache, authenticationService: AuthenticationService, settingService: SettingService);
+    areConcurrentLoginsAllowed(): boolean;
+    insert(userId: number, refreshToken: string, previousRefreshToken?: string, deviceKey?: string): Promise<void>;
+    invalidate(userId: number, deviceKey?: string): Promise<void>;
+    invalidateAll(userId: number): Promise<void>;
+    getEpoch(userId: number): Promise<number | undefined>;
+    validateAndRotate(user: any, refreshToken: string, claims?: RefreshTokenClaims): Promise<RotatedRefreshToken>;
+    getCurrentRefreshTokenState(userId: number, deviceKey?: string): Promise<RefreshTokenState | undefined>;
     private getKey;
-    getCurrentRefreshTokenState(userId: number): Promise<RefreshTokenState | undefined>;
+    private getEpochKey;
+    private resolveNextDeviceKey;
+    private isEpochCurrent;
+    private getStateTtlMs;
+    private isRefreshTokenState;
+    private isWithinGraceWindow;
 }
 export {};
 //# sourceMappingURL=refresh-token-ids-storage.service.d.ts.map

package/dist/services/refresh-token-ids-storage.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"refresh-token-ids-storage.service.d.ts","sourceRoot":"","sources":["../../src/services/refresh-token-ids-storage.service.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AACtC,OAAO,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AAGjE,qBAAa,4BAA6B,SAAQ,KAAK;CAAI;AAE3D,KAAK,iBAAiB,GAAG;IACrB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,oBAAoB,EAAE,MAAM,CAAC;CAChC,CAAC;AAEF,qBAEa,6BAA6B;IAeX,OAAO,CAAC,YAAY;IAE3C,OAAO,CAAC,QAAQ,CAAC,qBAAqB;gBAFP,YAAY,EAAE,KAAK,EAEjC,qBAAqB,EAAE,qBAAqB;IAG3D,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,oBAAoB,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAQ1F,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAUhE,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIzC,iBAAiB,CAAC,IAAI,EAAE,GAAG,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAoEzE,OAAO,CAAC,MAAM;IAId,2BAA2B,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,GAAG,SAAS,CAAC;CAGtF"}
+{"version":3,"file":"refresh-token-ids-storage.service.d.ts","sourceRoot":"","sources":["../../src/services/refresh-token-ids-storage.service.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AAGtC,OAAO,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AACjE,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAGnD,qBAAa,4BAA6B,SAAQ,KAAK;CAAI;AAe3D,KAAK,iBAAiB,GAAG;IACrB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,oBAAoB,EAAE,MAAM,CAAC;IAM7B,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC/B,CAAC;AAQF,MAAM,MAAM,kBAAkB,GAAG;IAC7B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAAG;IAC9B,YAAY,EAAE,MAAM,CAAC;IAGrB,SAAS,CAAC,EAAE,MAAM,CAAC;CACtB,CAAC;AAEF,qBACa,6BAA6B;IAEX,OAAO,CAAC,YAAY;IAE3C,OAAO,CAAC,QAAQ,CAAC,qBAAqB;IACtC,OAAO,CAAC,QAAQ,CAAC,cAAc;gBAHA,YAAY,EAAE,KAAK,EAEjC,qBAAqB,EAAE,qBAAqB,EAC5C,cAAc,EAAE,cAAc;IAenD,0BAA0B,IAAI,OAAO;IAI/B,MAAM,CACR,MAAM,EAAE,MAAM,EACd,YAAY,EAAE,MAAM,EACpB,oBAAoB,CAAC,EAAE,MAAM,EAC7B,SAAS,CAAC,EAAE,MAAM,GACnB,OAAO,CAAC,IAAI,CAAC;IAeV,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAa7D,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAc5C,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;IAIrD,iBAAiB,CACnB,IAAI,EAAE,GAAG,EACT,YAAY,EAAE,MAAM,EACpB,MAAM,GAAE,kBAAuB,GAChC,OAAO,CAAC,mBAAmB,CAAC;IAwD/B,2BAA2B,CACvB,MAAM,EAAE,MAAM,EACd,SAAS,CAAC,EAAE,MAAM,GACnB,OAAO,CAAC,iBAAiB,GAAG,SAAS,CAAC;IAIzC,OAAO,CAAC,MAAM;IAMd,OAAO,CAAC,WAAW;IAYnB,OAAO,CAAC,oBAAoB;YAOd,cAAc;IAc5B,OAAO,CAAC,aAAa;IAOrB,OAAO,CAAC,mBAAmB;IAS3B,OAAO,CAAC,mBAAmB;CAoB9B"}

package/dist/services/refresh-token-ids-storage.service.js

@@ -15,69 +15,106 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.RefreshTokenIdsStorageService = exports.InvalidatedRefreshTokenError = void 0;
 const cache_manager_1 = require("@nestjs/cache-manager");
 const common_1 = require("@nestjs/common");
+const crypto_1 = require("crypto");
 const authentication_service_1 = require("./authentication.service");
+const setting_service_1 = require("./setting.service");
 class InvalidatedRefreshTokenError extends Error {
 }
 exports.InvalidatedRefreshTokenError = InvalidatedRefreshTokenError;
+const PREVIOUS_TOKEN_GRACE_MS = 60 * 1000;
+const STATE_TTL_BUFFER_SECONDS = 60;
 let RefreshTokenIdsStorageService = class RefreshTokenIdsStorageService {
-    constructor(cacheManager, authenticationService) {
+    constructor(cacheManager, authenticationService, settingService) {
         this.cacheManager = cacheManager;
         this.authenticationService = authenticationService;
+        this.settingService = settingService;
     }
-    async insert(userId, refreshToken, previousRefreshToken) {
+    areConcurrentLoginsAllowed() {
+        return !this.settingService.getConfigValue("preventConcurrentLogins");
+    }
+    async insert(userId, refreshToken, previousRefreshToken, deviceKey) {
         const refreshTokenState = {
             currentRefreshToken: refreshToken,
             previousRefreshToken: previousRefreshToken ?? "",
+            ...(previousRefreshToken
+                ? { previousValidUntil: Date.now() + PREVIOUS_TOKEN_GRACE_MS }
+                : {}),
         };
-        await this.cacheManager.set(this.getKey(userId), refreshTokenState);
+        await this.cacheManager.set(this.getKey(userId, deviceKey), refreshTokenState, this.getStateTtlMs());
     }
-    async validate(userId, refreshToken) {
-        const storedId = await this.cacheManager.get(this.getKey(userId));
-        if (storedId !== refreshToken) {
-            throw new InvalidatedRefreshTokenError();
-        }
-        return storedId === refreshToken;
+    async invalidate(userId, deviceKey) {
+        await this.cacheManager.del(this.getKey(userId, deviceKey));
     }
-    async invalidate(userId) {
+    async invalidateAll(userId) {
+        const currentEpoch = (await this.getEpoch(userId)) ?? 0;
+        await this.cacheManager.set(this.getEpochKey(userId), currentEpoch + 1, this.getStateTtlMs());
         await this.cacheManager.del(this.getKey(userId));
     }
-    async validateAndRotate(user, refreshToken) {
-        let valid = false;
-        const refreshTokenState = await this.cacheManager.get(this.getKey(user.id));
-        let newRefreshToken;
-        if (refreshTokenState &&
-            typeof refreshTokenState === 'object' &&
-            'currentRefreshToken' in refreshTokenState &&
-            'previousRefreshToken' in refreshTokenState) {
-            if (refreshTokenState.currentRefreshToken === refreshToken) {
-                valid = true;
-                newRefreshToken = await this.authenticationService.generateRefreshToken(user, refreshTokenState.currentRefreshToken);
-                setTimeout(async () => {
-                    const state = (await this.cacheManager.get(this.getKey(user.id)));
-                    if (state && state.currentRefreshToken === newRefreshToken) {
-                        await this.cacheManager.set(this.getKey(user.id), {
-                            currentRefreshToken: newRefreshToken,
-                            previousRefreshToken: "",
-                        });
-                    }
-                }, 1 * 60 * 1000);
+    async getEpoch(userId) {
+        return (await this.cacheManager.get(this.getEpochKey(userId))) ?? undefined;
+    }
+    async validateAndRotate(user, refreshToken, claims = {}) {
+        const { deviceKey, epoch } = claims;
+        const refreshTokenState = await this.cacheManager.get(this.getKey(user.id, deviceKey));
+        if (!this.isRefreshTokenState(refreshTokenState)) {
+            throw new InvalidatedRefreshTokenError();
+        }
+        if (deviceKey && !(await this.isEpochCurrent(user.id, epoch))) {
+            throw new InvalidatedRefreshTokenError();
+        }
+        if (refreshTokenState.currentRefreshToken === refreshToken) {
+            const nextDeviceKey = this.resolveNextDeviceKey(deviceKey);
+            const rotated = await this.authenticationService.generateRefreshToken(user, refreshToken, nextDeviceKey);
+            if (nextDeviceKey !== deviceKey) {
+                await this.cacheManager.del(this.getKey(user.id, deviceKey));
             }
-            else if (refreshTokenState.previousRefreshToken === refreshToken) {
-                valid = true;
-                const existingRefreshTokenState = (await this.cacheManager.get(this.getKey(user.id)));
-                newRefreshToken = existingRefreshTokenState?.currentRefreshToken;
+            return { refreshToken: rotated, deviceKey: nextDeviceKey };
+        }
+        if (refreshTokenState.previousRefreshToken && refreshTokenState.previousRefreshToken === refreshToken) {
+            if (!this.isWithinGraceWindow(refreshTokenState)) {
+                throw new InvalidatedRefreshTokenError();
             }
+            return { refreshToken: refreshTokenState.currentRefreshToken, deviceKey };
         }
-        if (!valid) {
-            throw new InvalidatedRefreshTokenError();
+        throw new InvalidatedRefreshTokenError();
+    }
+    getCurrentRefreshTokenState(userId, deviceKey) {
+        return this.cacheManager.get(this.getKey(userId, deviceKey));
+    }
+    getKey(userId, deviceKey) {
+        return deviceKey ? `user-${userId}-${deviceKey}` : `user-${userId}`;
+    }
+    getEpochKey(userId) {
+        return `user-epoch-${userId}`;
+    }
+    resolveNextDeviceKey(deviceKey) {
+        if (!this.areConcurrentLoginsAllowed()) {
+            return undefined;
         }
-        return newRefreshToken;
+        return deviceKey ?? (0, crypto_1.randomUUID)();
     }
-    getKey(userId) {
-        return `user-${userId}`;
+    async isEpochCurrent(userId, epoch) {
+        const storedEpoch = await this.getEpoch(userId);
+        if (storedEpoch === undefined) {
+            return true;
+        }
+        return epoch === storedEpoch;
+    }
+    getStateTtlMs() {
+        const refreshTokenTtlSeconds = Number(this.settingService.getConfigValue("refreshTokenTtl"));
+        return (refreshTokenTtlSeconds + STATE_TTL_BUFFER_SECONDS) * 1000;
     }
-    getCurrentRefreshTokenState(userId) {
-        return this.cacheManager.get(this.getKey(userId));
+    isRefreshTokenState(state) {
+        return (!!state &&
+            typeof state === 'object' &&
+            'currentRefreshToken' in state &&
+            'previousRefreshToken' in state);
+    }
+    isWithinGraceWindow(state) {
+        if (state.previousValidUntil === undefined) {
+            return true;
+        }
+        return Date.now() < state.previousValidUntil;
     }
 };
 exports.RefreshTokenIdsStorageService = RefreshTokenIdsStorageService;
@@ -85,6 +122,7 @@ exports.RefreshTokenIdsStorageService = RefreshTokenIdsStorageService = __decora
     (0, common_1.Injectable)(),
     __param(0, (0, common_1.Inject)(cache_manager_1.CACHE_MANAGER)),
     __param(1, (0, common_1.Inject)((0, common_1.forwardRef)(() => authentication_service_1.AuthenticationService))),
-    __metadata("design:paramtypes", [Object, authentication_service_1.AuthenticationService])
+    __metadata("design:paramtypes", [Object, authentication_service_1.AuthenticationService,
+        setting_service_1.SettingService])
 ], RefreshTokenIdsStorageService);
 //# sourceMappingURL=refresh-token-ids-storage.service.js.map

package/dist/services/refresh-token-ids-storage.service.js.map

@@ -1 +1 @@
-{"version":3,"file":"refresh-token-ids-storage.service.js","sourceRoot":"","sources":["../../src/services/refresh-token-ids-storage.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,yDAAsD;AACtD,2CAAgE;AAEhE,qEAAiE;AAGjE,MAAa,4BAA6B,SAAQ,KAAK;CAAI;AAA3D,oEAA2D;AASpD,IAAM,6BAA6B,GAAnC,MAAM,6BAA6B;IActC,YACmC,YAAmB,EAEjC,qBAA4C;QAF9B,iBAAY,GAAZ,YAAY,CAAO;QAEjC,0BAAqB,GAArB,qBAAqB,CAAuB;IAC7D,CAAC;IAEL,KAAK,CAAC,MAAM,CAAC,MAAc,EAAE,YAAoB,EAAE,oBAA6B;QAC5E,MAAM,iBAAiB,GAAsB;YACzC,mBAAmB,EAAE,YAAY;YACjC,oBAAoB,EAAE,oBAAoB,IAAI,EAAE;SACnD,CAAC;QACF,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,iBAAiB,CAAC,CAAC;IACxE,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,MAAc,EAAE,YAAoB;QAG/C,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;QAClE,IAAI,QAAQ,KAAK,YAAY,EAAE,CAAC;YAC5B,MAAM,IAAI,4BAA4B,EAAE,CAAC;QAC7C,CAAC;QACD,OAAO,QAAQ,KAAK,YAAY,CAAC;IACrC,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,MAAc;QAC3B,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;IACrD,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,IAAS,EAAE,YAAoB;QACnD,IAAI,KAAK,GAAG,KAAK,CAAC;QAIlB,MAAM,iBAAiB,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAkC,CAAC;QAc7G,IAAI,eAAmC,CAAC;QACxC,IACI,iBAAiB;YACjB,OAAO,iBAAiB,KAAK,QAAQ;YACrC,qBAAqB,IAAI,iBAAiB;YAC1C,sBAAsB,IAAI,iBAAiB,EAC7C,CAAC;YACC,IAAI,iBAAiB,CAAC,mBAAmB,KAAK,YAAY,EAAE,CAAC;gBAEzD,KAAK,GAAG,IAAI,CAAC;gBAEb,eAAe,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,oBAAoB,CAAC,IAAI,EAAE,iBAAiB,CAAC,mBAAmB,CAAC,CAAC;gBAUrH,UAAU,CAAC,KAAK,IAAI,EAAE;oBAClB,MAAM,KAAK,GAAG,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAQ,CAAC;oBACzE,IAAI,KAAK,IAAI,KAAK,CAAC,mBAAmB,KAAK,eAAe,EAAE,CAAC;wBACzD,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE;4BAC9C,mBAAmB,EAAE,eAAe;4BACpC,oBAAoB,EAAE,EAAE;yBAC3B,CAAC,CAAC;oBACP,CAAC;gBACL,CAAC,EAAE,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;YACtB,CAAC;iBAAM,IAAI,iBAAiB,CAAC,oBAAoB,KAAK,YAAY,EAAE,CAAC;gBAEjE,KAAK,GAAG,IAAI,CAAC;gBAGb,MAAM,yBAAyB,GAAG,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAkC,CAAC;gBACvH,eAAe,GAAG,yBAAyB,EAAE,mBAAmB,CAAC;YACrE,CAAC;QACL,CAAC;QAGD,IAAI,CAAC,KAAK,EAAE,CAAC;YACT,MAAM,IAAI,4BAA4B,EAAE,CAAC;QAC7C,CAAC;QAGD,OAAO,eAAe,CAAC;IAC3B,CAAC;IAEO,MAAM,CAAC,MAAc;QACzB,OAAO,QAAQ,MAAM,EAAE,CAAC;IAC5B,CAAC;IAED,2BAA2B,CAAC,MAAc;QACtC,OAAO,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;IACtD,CAAC;CACJ,CAAA;AArHY,sEAA6B;wCAA7B,6BAA6B;IAFzC,IAAA,mBAAU,GAAE;IAiBJ,WAAA,IAAA,eAAM,EAAC,6BAAa,CAAC,CAAA;IACrB,WAAA,IAAA,eAAM,EAAC,IAAA,mBAAU,EAAC,GAAG,EAAE,CAAC,8CAAqB,CAAC,CAAC,CAAA;6CACR,8CAAqB;GAjBxD,6BAA6B,CAqHzC","sourcesContent":["import { CACHE_MANAGER } from '@nestjs/cache-manager';\nimport { Inject, Injectable, forwardRef } from '@nestjs/common';\nimport { Cache } from 'cache-manager';\nimport { AuthenticationService } from './authentication.service';\n\n// TODO: Ideally this should be in a separate file - putting this here for brevity\nexport class InvalidatedRefreshTokenError extends Error { }\n\ntype RefreshTokenState = {\n    currentRefreshToken: string;\n    previousRefreshToken: string;\n};\n\n@Injectable()\n// export class RefreshTokenIdsStorageService implements OnApplicationBootstrap, OnApplicationShutdown {\nexport class RefreshTokenIdsStorageService {\n    // private redisClient: Redis;\n    // onApplicationBootstrap() {\n    //     // TODO: Ideally, we should move this to the dedicated \"RedisModule\" instead of initiating the connection here.\n    //     this.redisClient = new Redis({\n    //         // TODO: According to best practices, we should use the environment variables here instead.\n    //         host: 'localhost',\n    //         port: 6379,\n    //     });\n    // }\n    // onApplicationShutdown(signal?: string) {\n    //     return this.redisClient.quit();\n    // }\n\n    constructor(\n        @Inject(CACHE_MANAGER) private cacheManager: Cache,\n        @Inject(forwardRef(() => AuthenticationService))\n        private readonly authenticationService: AuthenticationService\n    ) { }\n\n    async insert(userId: number, refreshToken: string, previousRefreshToken?: string): Promise<void> {\n        const refreshTokenState: RefreshTokenState = {\n            currentRefreshToken: refreshToken,\n            previousRefreshToken: previousRefreshToken ?? \"\",\n        };\n        await this.cacheManager.set(this.getKey(userId), refreshTokenState);\n    }\n\n    async validate(userId: number, refreshToken: string): Promise<boolean> {\n        // TODO: Assume you get this shape out of the cache {\"currentRefreshToken\": \"\", \"previousRefreshToken\": \"\"}\n        // Then you will compare against the currentRefreshToken.\n        const storedId = await this.cacheManager.get(this.getKey(userId));\n        if (storedId !== refreshToken) {\n            throw new InvalidatedRefreshTokenError();\n        }\n        return storedId === refreshToken;\n    }\n\n    async invalidate(userId: number): Promise<void> {\n        await this.cacheManager.del(this.getKey(userId));\n    }\n\n    async validateAndRotate(user: any, refreshToken: string): Promise<string> {\n        let valid = false;\n\n        // TODO: Assume you get this shape out of the cache {\"currentRefreshToken\": \"\", \"previousRefreshToken\": \"\"}\n        // Then you will compare against the currentRefreshToken.\n        const refreshTokenState = await this.cacheManager.get(this.getKey(user.id)) as RefreshTokenState | undefined;\n\n        // Use the authentication service to generate a new refresh token, set it in the currentRefreshToken in scenario 1 and return.\n\n        // if UI.refresh_token is matching with Cache.currentRefreshToken\n        //   then invalidate (updated cache state, no need to delete anything), then generate new token and return.\n        //   also set a setTimeout to run after X minutes, this will simply update the RefreshTokenCacheState to this object {\"currentRefreshToken\": \"R2\",\"justInvalidatedRefreshToken\": \"\"}\n        // valid=true\n\n        //   - if UI.refresh_token is matching Cache.justInvalidatedRefreshToken        \n        //       then use the Cache.currentRefreshToken, generate new access token and return.\n        //       We do not modify the cache state at all.\n        // valid=true\n\n        let newRefreshToken: string | undefined;\n        if (\n            refreshTokenState &&\n            typeof refreshTokenState === 'object' &&\n            'currentRefreshToken' in refreshTokenState &&\n            'previousRefreshToken' in refreshTokenState\n        ) {\n            if (refreshTokenState.currentRefreshToken === refreshToken) {\n                // Scenario 1: Token matches currentRefreshToken\n                valid = true;\n                // Rotate tokens: move current to previous, set new current (simulate generation)\n                newRefreshToken = await this.authenticationService.generateRefreshToken(user, refreshTokenState.currentRefreshToken); // Replace with real token generation logic\n\n\n                //   updated cache state\n                // await this.cacheManager.set(this.getKey(user.id), {\n                //     currentRefreshToken: newRefreshToken,\n                //     previousRefreshToken: refreshTokenState.currentRefreshToken,\n                // });\n\n                // Optionally, set a timeout to clear previousRefreshToken after X minutes\n                setTimeout(async () => {\n                    const state = (await this.cacheManager.get(this.getKey(user.id))) as any;\n                    if (state && state.currentRefreshToken === newRefreshToken) {\n                        await this.cacheManager.set(this.getKey(user.id), {\n                            currentRefreshToken: newRefreshToken,\n                            previousRefreshToken: \"\",\n                        });\n                    }\n                }, 1 * 60 * 1000); // 5 minutes\n            } else if (refreshTokenState.previousRefreshToken === refreshToken) {\n                // Scenario 2: Token matches previousRefreshToken\n                valid = true;\n                // Do not modify cache\n                // Generate new refresh token based on currentRefreshToken\n                const existingRefreshTokenState = (await this.cacheManager.get(this.getKey(user.id))) as RefreshTokenState | undefined;\n                newRefreshToken = existingRefreshTokenState?.currentRefreshToken;\n            }\n        }\n\n\n        if (!valid) {\n            throw new InvalidatedRefreshTokenError();\n        }\n\n        // TODO: return the refresh token either currentRefreshToken\n        return newRefreshToken; // Fallback to the provided tokenId if no new token was generated\n    }\n\n    private getKey(userId: number): string {\n        return `user-${userId}`;\n    }\n\n    getCurrentRefreshTokenState(userId: number): Promise<RefreshTokenState | undefined> {\n        return this.cacheManager.get(this.getKey(userId));\n    }\n}\n"]}
+{"version":3,"file":"refresh-token-ids-storage.service.js","sourceRoot":"","sources":["../../src/services/refresh-token-ids-storage.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,yDAAsD;AACtD,2CAAgE;AAEhE,mCAAoC;AAEpC,qEAAiE;AACjE,uDAAmD;AAGnD,MAAa,4BAA6B,SAAQ,KAAK;CAAI;AAA3D,oEAA2D;AAO3D,MAAM,uBAAuB,GAAG,EAAE,GAAG,IAAI,CAAC;AAM1C,MAAM,wBAAwB,GAAG,EAAE,CAAC;AAgC7B,IAAM,6BAA6B,GAAnC,MAAM,6BAA6B;IACtC,YACmC,YAAmB,EAEjC,qBAA4C,EAC5C,cAA8B;QAHhB,iBAAY,GAAZ,YAAY,CAAO;QAEjC,0BAAqB,GAArB,qBAAqB,CAAuB;QAC5C,mBAAc,GAAd,cAAc,CAAgB;IAC/C,CAAC;IAcL,0BAA0B;QACtB,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,cAAc,CAAmB,yBAAyB,CAAC,CAAC;IAC5F,CAAC;IAED,KAAK,CAAC,MAAM,CACR,MAAc,EACd,YAAoB,EACpB,oBAA6B,EAC7B,SAAkB;QAElB,MAAM,iBAAiB,GAAsB;YACzC,mBAAmB,EAAE,YAAY;YACjC,oBAAoB,EAAE,oBAAoB,IAAI,EAAE;YAChD,GAAG,CAAC,oBAAoB;gBACpB,CAAC,CAAC,EAAE,kBAAkB,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,uBAAuB,EAAE;gBAC9D,CAAC,CAAC,EAAE,CAAC;SACZ,CAAC;QACF,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CACvB,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,EAC9B,iBAAiB,EACjB,IAAI,CAAC,aAAa,EAAE,CACvB,CAAC;IACN,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,MAAc,EAAE,SAAkB;QAC/C,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC;IAChE,CAAC;IAWD,KAAK,CAAC,aAAa,CAAC,MAAc;QAC9B,MAAM,YAAY,GAAG,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC;QACxD,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CACvB,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,EACxB,YAAY,GAAG,CAAC,EAGhB,IAAI,CAAC,aAAa,EAAE,CACvB,CAAC;QAGF,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;IACrD,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,MAAc;QACzB,OAAO,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAS,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,SAAS,CAAC;IACxF,CAAC;IAED,KAAK,CAAC,iBAAiB,CACnB,IAAS,EACT,YAAoB,EACpB,SAA6B,EAAE;QAE/B,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,MAAM,CAAC;QAMpC,MAAM,iBAAiB,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CACjD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,CAAC,CACD,CAAC;QAEnC,IAAI,CAAC,IAAI,CAAC,mBAAmB,CAAC,iBAAiB,CAAC,EAAE,CAAC;YAC/C,MAAM,IAAI,4BAA4B,EAAE,CAAC;QAC7C,CAAC;QAED,IAAI,SAAS,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;YAC5D,MAAM,IAAI,4BAA4B,EAAE,CAAC;QAC7C,CAAC;QAKD,IAAI,iBAAiB,CAAC,mBAAmB,KAAK,YAAY,EAAE,CAAC;YACzD,MAAM,aAAa,GAAG,IAAI,CAAC,oBAAoB,CAAC,SAAS,CAAC,CAAC;YAC3D,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,oBAAoB,CACjE,IAAI,EACJ,YAAY,EACZ,aAAa,CAChB,CAAC;YAEF,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;gBAM9B,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC,CAAC;YACjE,CAAC;YAED,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,CAAC;QAC/D,CAAC;QAMD,IAAI,iBAAiB,CAAC,oBAAoB,IAAI,iBAAiB,CAAC,oBAAoB,KAAK,YAAY,EAAE,CAAC;YACpG,IAAI,CAAC,IAAI,CAAC,mBAAmB,CAAC,iBAAiB,CAAC,EAAE,CAAC;gBAC/C,MAAM,IAAI,4BAA4B,EAAE,CAAC;YAC7C,CAAC;YACD,OAAO,EAAE,YAAY,EAAE,iBAAiB,CAAC,mBAAmB,EAAE,SAAS,EAAE,CAAC;QAC9E,CAAC;QAED,MAAM,IAAI,4BAA4B,EAAE,CAAC;IAC7C,CAAC;IAED,2BAA2B,CACvB,MAAc,EACd,SAAkB;QAElB,OAAO,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC;IACjE,CAAC;IAEO,MAAM,CAAC,MAAc,EAAE,SAAkB;QAC7C,OAAO,SAAS,CAAC,CAAC,CAAC,QAAQ,MAAM,IAAI,SAAS,EAAE,CAAC,CAAC,CAAC,QAAQ,MAAM,EAAE,CAAC;IACxE,CAAC;IAIO,WAAW,CAAC,MAAc;QAC9B,OAAO,cAAc,MAAM,EAAE,CAAC;IAClC,CAAC;IAUO,oBAAoB,CAAC,SAAkB;QAC3C,IAAI,CAAC,IAAI,CAAC,0BAA0B,EAAE,EAAE,CAAC;YACrC,OAAO,SAAS,CAAC;QACrB,CAAC;QACD,OAAO,SAAS,IAAI,IAAA,mBAAU,GAAE,CAAC;IACrC,CAAC;IAEO,KAAK,CAAC,cAAc,CAAC,MAAc,EAAE,KAAc;QACvD,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAIhD,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;YAC5B,OAAO,IAAI,CAAC;QAChB,CAAC;QACD,OAAO,KAAK,KAAK,WAAW,CAAC;IACjC,CAAC;IAKO,aAAa;QACjB,MAAM,sBAAsB,GAAG,MAAM,CACjC,IAAI,CAAC,cAAc,CAAC,cAAc,CAAmB,iBAAiB,CAAC,CAC1E,CAAC;QACF,OAAO,CAAC,sBAAsB,GAAG,wBAAwB,CAAC,GAAG,IAAI,CAAC;IACtE,CAAC;IAEO,mBAAmB,CAAC,KAAc;QACtC,OAAO,CACH,CAAC,CAAC,KAAK;YACP,OAAO,KAAK,KAAK,QAAQ;YACzB,qBAAqB,IAAI,KAAK;YAC9B,sBAAsB,IAAI,KAAK,CAClC,CAAC;IACN,CAAC;IAEO,mBAAmB,CAAC,KAAwB;QAehD,IAAI,KAAK,CAAC,kBAAkB,KAAK,SAAS,EAAE,CAAC;YACzC,OAAO,IAAI,CAAC;QAChB,CAAC;QACD,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,kBAAkB,CAAC;IACjD,CAAC;CACJ,CAAA;AAzNY,sEAA6B;wCAA7B,6BAA6B;IADzC,IAAA,mBAAU,GAAE;IAGJ,WAAA,IAAA,eAAM,EAAC,6BAAa,CAAC,CAAA;IACrB,WAAA,IAAA,eAAM,EAAC,IAAA,mBAAU,EAAC,GAAG,EAAE,CAAC,8CAAqB,CAAC,CAAC,CAAA;6CACR,8CAAqB;QAC5B,gCAAc;GAL1C,6BAA6B,CAyNzC","sourcesContent":["import { CACHE_MANAGER } from '@nestjs/cache-manager';\nimport { Inject, Injectable, forwardRef } from '@nestjs/common';\nimport { Cache } from 'cache-manager';\nimport { randomUUID } from 'crypto';\nimport type { SolidCoreSetting } from 'src/services/settings/default-settings-provider.service';\nimport { AuthenticationService } from './authentication.service';\nimport { SettingService } from './setting.service';\n\n// TODO: Ideally this should be in a separate file - putting this here for brevity\nexport class InvalidatedRefreshTokenError extends Error { }\n\n// How long a rotated-out refresh token stays acceptable. This window is the\n// point of keeping a previous token at all: concurrent requests from one user\n// must not break each other. core-ui's single-flight guard is module-level and\n// therefore per tab, so two tabs crossing the refresh threshold together will\n// both present the same token - the second one is served from here.\nconst PREVIOUS_TOKEN_GRACE_MS = 60 * 1000;\n\n// The cache entry must outlive the JWT it holds. If it expired first, refresh\n// would fail with ACCESS_DENIED (InvalidatedRefreshTokenError) rather than the\n// SESSION_EXPIRED that the token's own `exp` produces - the same event\n// reported two different ways.\nconst STATE_TTL_BUFFER_SECONDS = 60;\n\ntype RefreshTokenState = {\n    currentRefreshToken: string;\n    previousRefreshToken: string;\n    // Absolute epoch-ms deadline after which previousRefreshToken is refused.\n    // Stored rather than scheduled: an in-process timer is lost when the pod\n    // restarts, which used to leave the rotated-out token valid until the next\n    // rotation instead of for one minute. Optional because entries written\n    // before this field existed will not carry it.\n    previousValidUntil?: number;\n};\n\n/**\n * The bucket-identifying claims carried on a refresh token. Absent on tokens\n * issued before per-device sessions existed, and on tokens issued while\n * preventConcurrentLogins is on - which is exactly how the read path tells the\n * two schemes apart without consulting any setting.\n */\nexport type RefreshTokenClaims = {\n    deviceKey?: string;\n    epoch?: number;\n};\n\nexport type RotatedRefreshToken = {\n    refreshToken: string;\n    // The bucket the rotated token now lives in. Differs from the incoming\n    // deviceKey only when a pre-migration token was just moved into one.\n    deviceKey?: string;\n};\n\n@Injectable()\nexport class RefreshTokenIdsStorageService {\n    constructor(\n        @Inject(CACHE_MANAGER) private cacheManager: Cache,\n        @Inject(forwardRef(() => AuthenticationService))\n        private readonly authenticationService: AuthenticationService,\n        private readonly settingService: SettingService,\n    ) { }\n\n    /**\n     * The inverse of the `preventConcurrentLogins` setting, and the only place\n     * it is interpreted.\n     *\n     * That setting already promises, when off, that sessions may coexist;\n     * splitting the refresh-token keyspace per device is what finally delivers\n     * it. When it is on, its stated purpose is a single live session, so\n     * per-device keys would be meaningless and the original single slot is kept.\n     *\n     * This governs the WRITE path only. Reads always branch on the token's own\n     * claim, so toggling the setting never invalidates a live session.\n     */\n    areConcurrentLoginsAllowed(): boolean {\n        return !this.settingService.getConfigValue<SolidCoreSetting>(\"preventConcurrentLogins\");\n    }\n\n    async insert(\n        userId: number,\n        refreshToken: string,\n        previousRefreshToken?: string,\n        deviceKey?: string,\n    ): Promise<void> {\n        const refreshTokenState: RefreshTokenState = {\n            currentRefreshToken: refreshToken,\n            previousRefreshToken: previousRefreshToken ?? \"\",\n            ...(previousRefreshToken\n                ? { previousValidUntil: Date.now() + PREVIOUS_TOKEN_GRACE_MS }\n                : {}),\n        };\n        await this.cacheManager.set(\n            this.getKey(userId, deviceKey),\n            refreshTokenState,\n            this.getStateTtlMs(),\n        );\n    }\n\n    async invalidate(userId: number, deviceKey?: string): Promise<void> {\n        await this.cacheManager.del(this.getKey(userId, deviceKey));\n    }\n\n    /**\n     * Bulk invalidation - \"log out everywhere\", and the right hook for password\n     * change or forced deactivation.\n     *\n     * Per-device buckets cannot be enumerated through cache-manager, so this\n     * bumps a per-user epoch that every per-device token carries as a claim.\n     * One write invalidates every outstanding token without a scan and without\n     * the read-modify-write race an index of device keys would have.\n     */\n    async invalidateAll(userId: number): Promise<void> {\n        const currentEpoch = (await this.getEpoch(userId)) ?? 0;\n        await this.cacheManager.set(\n            this.getEpochKey(userId),\n            currentEpoch + 1,\n            // Outlives every bucket that could hold a pre-bump token: those were\n            // written earlier, so they expire no later than this key does.\n            this.getStateTtlMs(),\n        );\n        // Single-slot mode and pre-migration entries live under the bare key,\n        // which carries no epoch claim - delete it directly.\n        await this.cacheManager.del(this.getKey(userId));\n    }\n\n    async getEpoch(userId: number): Promise<number | undefined> {\n        return (await this.cacheManager.get<number>(this.getEpochKey(userId))) ?? undefined;\n    }\n\n    async validateAndRotate(\n        user: any,\n        refreshToken: string,\n        claims: RefreshTokenClaims = {},\n    ): Promise<RotatedRefreshToken> {\n        const { deviceKey, epoch } = claims;\n\n        // The read key comes from the token's own claim, never from a setting.\n        // A token issued under either scheme therefore stays valid when\n        // preventConcurrentLogins is toggled - in both directions - and a\n        // pre-migration token still finds the bare key it was written to.\n        const refreshTokenState = await this.cacheManager.get(\n            this.getKey(user.id, deviceKey),\n        ) as RefreshTokenState | undefined;\n\n        if (!this.isRefreshTokenState(refreshTokenState)) {\n            throw new InvalidatedRefreshTokenError();\n        }\n\n        if (deviceKey && !(await this.isEpochCurrent(user.id, epoch))) {\n            throw new InvalidatedRefreshTokenError();\n        }\n\n        // Scenario 1: the live token. Rotate it. generateRefreshToken calls\n        // insert(), which writes the new state and stamps the grace deadline\n        // onto the token being rotated out.\n        if (refreshTokenState.currentRefreshToken === refreshToken) {\n            const nextDeviceKey = this.resolveNextDeviceKey(deviceKey);\n            const rotated = await this.authenticationService.generateRefreshToken(\n                user,\n                refreshToken,\n                nextDeviceKey,\n            );\n\n            if (nextDeviceKey !== deviceKey) {\n                // The session changed buckets - either migrating out of the\n                // pre-deploy single slot, or collapsing back into it because\n                // preventConcurrentLogins was switched on. The new state is\n                // already written; drop the key it came from so nothing is\n                // left behind.\n                await this.cacheManager.del(this.getKey(user.id, deviceKey));\n            }\n\n            return { refreshToken: rotated, deviceKey: nextDeviceKey };\n        }\n\n        // Scenario 2: the token just rotated out. This is the concurrent-request\n        // case the previous slot exists for - a second in-flight request that\n        // was issued the old token before the first one rotated it. Hand back\n        // the live token so it succeeds, provided the grace window is still open.\n        if (refreshTokenState.previousRefreshToken && refreshTokenState.previousRefreshToken === refreshToken) {\n            if (!this.isWithinGraceWindow(refreshTokenState)) {\n                throw new InvalidatedRefreshTokenError();\n            }\n            return { refreshToken: refreshTokenState.currentRefreshToken, deviceKey };\n        }\n\n        throw new InvalidatedRefreshTokenError();\n    }\n\n    getCurrentRefreshTokenState(\n        userId: number,\n        deviceKey?: string,\n    ): Promise<RefreshTokenState | undefined> {\n        return this.cacheManager.get(this.getKey(userId, deviceKey));\n    }\n\n    private getKey(userId: number, deviceKey?: string): string {\n        return deviceKey ? `user-${userId}-${deviceKey}` : `user-${userId}`;\n    }\n\n    // Deliberately not `user-${userId}-epoch`, which a device key of the\n    // literal string \"epoch\" would collide with.\n    private getEpochKey(userId: number): string {\n        return `user-epoch-${userId}`;\n    }\n\n    /**\n     * Which bucket a rotated token should land in. The setting is consulted\n     * first so that turning preventConcurrentLogins ON collapses existing\n     * per-device sessions back into the single slot on their next refresh -\n     * where normal last-login-wins applies, which is what that setting means.\n     * Leaving them in their own buckets would keep concurrent sessions alive\n     * while the setting claimed to forbid them.\n     */\n    private resolveNextDeviceKey(deviceKey?: string): string | undefined {\n        if (!this.areConcurrentLoginsAllowed()) {\n            return undefined;\n        }\n        return deviceKey ?? randomUUID();\n    }\n\n    private async isEpochCurrent(userId: number, epoch?: number): Promise<boolean> {\n        const storedEpoch = await this.getEpoch(userId);\n        // Nothing has ever been bulk-invalidated for this user - or the cache\n        // was flushed, in which case every bucket is gone and the token is\n        // already dead by the read above. Either way, accept.\n        if (storedEpoch === undefined) {\n            return true;\n        }\n        return epoch === storedEpoch;\n    }\n\n    // cache-manager v5 expects milliseconds; refreshTokenTtl is configured in\n    // seconds. Without an explicit TTL these entries never expire - neither\n    // cache path supplies a default - and the keyspace grows without bound.\n    private getStateTtlMs(): number {\n        const refreshTokenTtlSeconds = Number(\n            this.settingService.getConfigValue<SolidCoreSetting>(\"refreshTokenTtl\"),\n        );\n        return (refreshTokenTtlSeconds + STATE_TTL_BUFFER_SECONDS) * 1000;\n    }\n\n    private isRefreshTokenState(state: unknown): state is RefreshTokenState {\n        return (\n            !!state &&\n            typeof state === 'object' &&\n            'currentRefreshToken' in state &&\n            'previousRefreshToken' in state\n        );\n    }\n\n    private isWithinGraceWindow(state: RefreshTokenState): boolean {\n        // TRANSITIONAL - safe to delete one refreshTokenTtl after this ships.\n        //\n        // Entries written before previousValidUntil existed carry no deadline\n        // to test. They are accepted so that the deploy rejects nobody: a tab\n        // that legitimately rotated moments earlier keeps working. The cost is\n        // that for such an entry the previous token stays acceptable until its\n        // own JWT `exp` rather than for 60s - which is exactly how the old code\n        // already behaved whenever its in-process timer was lost to a restart,\n        // so this is an unfixed pre-existing case, not a new one.\n        //\n        // It self-heals: the user's next rotation writes a new-format state\n        // with a deadline. Once every pre-deploy entry has rotated or expired\n        // (one refreshTokenTtl), this branch is unreachable - drop it, and the\n        // undefined case becomes a rejection.\n        if (state.previousValidUntil === undefined) {\n            return true;\n        }\n        return Date.now() < state.previousValidUntil;\n    }\n}\n"]}

package/dist/services/setting.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"setting.service.d.ts","sourceRoot":"","sources":["../../src/services/setting.service.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAGrC,OAAO,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAC/D,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AACxD,OAAO,EAAE,IAAI,EAAE,MAAM,0BAA0B,CAAC;AAChD,OAAO,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AACrE,OAAO,EAAgB,YAAY,EAA6B,mBAAmB,EAAE,MAAM,QAAQ,CAAC;AACpG,OAAO,EAAE,OAAO,EAAE,MAAM,4BAA4B,CAAC;AACrD,OAAO,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAClE,OAAO,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAC3D,OAAO,EAA0B,qBAAqB,EAAqB,OAAO,EAAsB,iBAAiB,EAAgB,MAAM,eAAe,CAAC;AAC/J,OAAO,EAAE,wBAAwB,EAAE,MAAM,2CAA2C,CAAC;AAMrF,qBACa,cAAc;IAcD,QAAQ,CAAC,WAAW,EAAE,YAAY;IACrB,QAAQ,CAAC,WAAW,EAAE,mBAAmB;IAC5E,QAAQ,CAAC,aAAa,EAAE,aAAa;IACrC,QAAQ,CAAC,IAAI,EAAE,iBAAiB;IAChC,QAAQ,CAAC,kBAAkB,EAAE,wBAAwB;IACrD,OAAO,CAAC,QAAQ,CAAC,qBAAqB;IACd,OAAO,CAAC,QAAQ,CAAC,cAAc;IAnBzD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAmC;IAE3D,OAAO,CAAC,QAAQ,CAA2B;IAC3C,OAAO,CAAC,aAAa,CAAwC;IAC7D,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAA2B;IAE7D,OAAO,CAAC,QAAQ,CAAC,eAAe,CAI7B;gBAG8B,WAAW,EAAE,YAAY,EACZ,WAAW,EAAE,mBAAmB,EACnE,aAAa,EAAE,aAAa,EAC5B,IAAI,EAAE,iBAAiB,EACvB,kBAAkB,EAAE,wBAAwB,EACpC,qBAAqB,EAAE,qBAAqB,EACpB,cAAc,EAAE,UAAU,CAAC,IAAI,CAAC;YAO7D,iBAAiB;YAKjB,2BAA2B;IAIzC,OAAO,CAAC,iBAAiB;IAiBzB,OAAO,CAAC,iBAAiB;IASzB,OAAO,CAAC,gBAAgB;IAoBxB,OAAO,CAAC,wBAAwB;IAchC,OAAO,CAAC,2BAA2B;IA+BnC,cAAc,IAAI,iBAAiB,EAAE;IAI/B,mBAAmB,IAAI,OAAO,CAAC,IAAI,CAAC;IA4B1C,OAAO,CAAC,sBAAsB;IAcxB,uCAAuC,IAAI,OAAO,CAAC,IAAI,CAAC;IA6FxD,kDAAkD,IAAI,OAAO,CAAC,qBAAqB,CAAC;IAoCpF,cAAc,CAAC,QAAQ,GAAE,gBAAgB,EAAO,EAAE,aAAa,GAAE,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAM,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;IA8H3H,cAAc,CAAC,CAAC,GAAG,KAAK,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC;IAoB1C,SAAS,CAAC,YAAY,EAAE,YAAY,EAAE,mBAAmB,GAAE,GAAQ,GAAG,OAAO,CAAC,GAAG,CAAC;CAuBzF"}
+{"version":3,"file":"setting.service.d.ts","sourceRoot":"","sources":["../../src/services/setting.service.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAGrC,OAAO,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAC/D,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AACxD,OAAO,EAAE,IAAI,EAAE,MAAM,0BAA0B,CAAC;AAChD,OAAO,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AACrE,OAAO,EAAgB,YAAY,EAA6B,mBAAmB,EAAE,MAAM,QAAQ,CAAC;AACpG,OAAO,EAAE,OAAO,EAAE,MAAM,4BAA4B,CAAC;AACrD,OAAO,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAClE,OAAO,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAC3D,OAAO,EAA0B,qBAAqB,EAAqB,OAAO,EAAsB,iBAAiB,EAAgB,MAAM,eAAe,CAAC;AAC/J,OAAO,EAAE,wBAAwB,EAAE,MAAM,2CAA2C,CAAC;AAQrF,qBACa,cAAc;IAcD,QAAQ,CAAC,WAAW,EAAE,YAAY;IACrB,QAAQ,CAAC,WAAW,EAAE,mBAAmB;IAC5E,QAAQ,CAAC,aAAa,EAAE,aAAa;IACrC,QAAQ,CAAC,IAAI,EAAE,iBAAiB;IAChC,QAAQ,CAAC,kBAAkB,EAAE,wBAAwB;IACrD,OAAO,CAAC,QAAQ,CAAC,qBAAqB;IACd,OAAO,CAAC,QAAQ,CAAC,cAAc;IAnBzD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAmC;IAE3D,OAAO,CAAC,QAAQ,CAA2B;IAC3C,OAAO,CAAC,aAAa,CAAwC;IAC7D,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAA2B;IAE7D,OAAO,CAAC,QAAQ,CAAC,eAAe,CAI7B;gBAG8B,WAAW,EAAE,YAAY,EACZ,WAAW,EAAE,mBAAmB,EACnE,aAAa,EAAE,aAAa,EAC5B,IAAI,EAAE,iBAAiB,EACvB,kBAAkB,EAAE,wBAAwB,EACpC,qBAAqB,EAAE,qBAAqB,EACpB,cAAc,EAAE,UAAU,CAAC,IAAI,CAAC;YAO7D,iBAAiB;YAKjB,2BAA2B;IAIzC,OAAO,CAAC,iBAAiB;IAiBzB,OAAO,CAAC,iBAAiB;IASzB,OAAO,CAAC,gBAAgB;IAoBxB,OAAO,CAAC,wBAAwB;IAchC,OAAO,CAAC,2BAA2B;IA+BnC,cAAc,IAAI,iBAAiB,EAAE;IAI/B,mBAAmB,IAAI,OAAO,CAAC,IAAI,CAAC;IA4B1C,OAAO,CAAC,sBAAsB;IAcxB,uCAAuC,IAAI,OAAO,CAAC,IAAI,CAAC;IA6FxD,kDAAkD,IAAI,OAAO,CAAC,qBAAqB,CAAC;IAoCpF,cAAc,CAAC,QAAQ,GAAE,gBAAgB,EAAO,EAAE,aAAa,GAAE,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAM,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;IAmI3H,cAAc,CAAC,CAAC,GAAG,KAAK,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC;IAoB1C,SAAS,CAAC,YAAY,EAAE,YAAY,EAAE,mBAAmB,GAAE,GAAQ,GAAG,OAAO,CAAC,GAAG,CAAC;CAuBzF"}

package/dist/services/setting.service.js

@@ -62,6 +62,8 @@ const interfaces_1 = require("../interfaces");
 const module_metadata_repository_1 = require("../repository/module-metadata.repository");
 const common_2 = require("@nestjs/common");
 const encryption_service_1 = require("./encryption.service");
+const media_storage_utils_1 = require("./media-storage.utils");
+const media_file_types_1 = require("../constants/media-file-types");
 let SettingService = SettingService_1 = class SettingService {
     constructor(fileService, pathBuilder, solidRegistry, repo, moduleMetadataRepo, requestContextService, userRepository) {
         this.fileService = fileService;
@@ -309,8 +311,11 @@ let SettingService = SettingService_1 = class SettingService {
         }
         if (uploadedFiles?.length) {
             for (const file of uploadedFiles) {
+                if ((0, media_file_types_1.isDangerousMediaFile)(file)) {
+                    throw new common_1.BadRequestException('Dangerous file types are not allowed for settings.');
+                }
                 const settingKey = file.fieldname;
-                const relativeFileName = `${file.filename}-${file.originalname}`;
+                const relativeFileName = `${file.filename}-${(0, media_storage_utils_1.sanitizeStoredMediaFileName)(file.originalname)}`;
                 const fileContent = await fsPromises.readFile(file.path);
                 const storagePath = this.pathBuilder.build(relativeFileName);
                 const fileUrl = await this.fileService.write(storagePath, fileContent, { contentType: file.mimetype });

package/dist/services/setting.service.js.map

@@ -1 +1 @@
-{"version":3,"file":"setting.service.js","sourceRoot":"","sources":["../../src/services/setting.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,2CAA6F;AAC7F,6CAAmD;AACnD,qCAAqC;AACrC,wDAA0C;AAC1C,gEAA8D;AAG9D,yDAAgD;AAChD,yEAAqE;AACrE,iCAAoG;AACpG,+DAAqD;AACrD,uEAAkE;AAClE,8DAA2D;AAC3D,8CAA+J;AAC/J,yFAAqF;AAErF,2CAAwC;AACxC,6DAAyD;AAIlD,IAAM,cAAc,sBAApB,MAAM,cAAc;IAazB,YACwB,WAAkC,EACrB,WAAyC,EACnE,aAA4B,EAC5B,IAAuB,EACvB,kBAA4C,EACpC,qBAA4C,EACrC,cAAiD;QAN1C,gBAAW,GAAX,WAAW,CAAc;QACZ,gBAAW,GAAX,WAAW,CAAqB;QACnE,kBAAa,GAAb,aAAa,CAAe;QAC5B,SAAI,GAAJ,IAAI,CAAmB;QACvB,uBAAkB,GAAlB,kBAAkB,CAA0B;QACpC,0BAAqB,GAArB,qBAAqB,CAAuB;QACpB,mBAAc,GAAd,cAAc,CAAkB;QAnB1D,YAAO,GAAG,IAAI,eAAM,CAAC,gBAAc,CAAC,IAAI,CAAC,CAAC;QAEnD,aAAQ,GAAwB,EAAE,CAAC;QACnC,kBAAa,GAAG,IAAI,GAAG,EAA6B,CAAC;QAG5C,oBAAe,GAAG,IAAI,GAAG,CAAC;YACzC,6BAA6B;YAC7B,yCAAyC;YACzC,6CAA6C;SAC9C,CAAC,CAAC;QAWD,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC;QAC9C,IAAI,CAAC,iBAAiB,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,sCAAiB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACvE,IAAI,CAAC,MAAM;YAAE,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,0EAA0E,CAAC,CAAC;IAC7G,CAAC;IAEO,KAAK,CAAC,iBAAiB;QAC7B,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC/D,OAAO,QAAQ,CAAC;IAClB,CAAC;IAEO,KAAK,CAAC,2BAA2B;QACvC,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAC;IAC3D,CAAC;IAEO,iBAAiB,CAAC,KAAa,EAAE,GAAW;QAClD,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC3B,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,KAAK,KAAK,MAAM,IAAI,KAAK,KAAK,OAAO,EAAE,CAAC;gBAC1C,OAAO,KAAK,KAAK,MAAM,CAAC;YAC1B,CAAC;YACD,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;gBACjD,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;YACvB,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC1D,OAAO,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;YACnD,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAEO,iBAAiB,CAAC,GAAW;QACnC,OAAO,GAAG;aACP,OAAO,CAAC,oBAAoB,EAAE,OAAO,CAAC;aACtC,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC;aACtB,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC;aACpB,IAAI,EAAE;aACN,OAAO,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC;IACtD,CAAC;IAEO,gBAAgB,CAAC,OAA0B;QACjD,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;YACxB,OAAO,OAAO,CAAC,WAAW,CAAC;QAC7B,CAAC;QAED,IAAI,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC;YAC5B,OAAO,iBAAiB,CAAC;QAC3B,CAAC;QAED,IAAI,OAAO,OAAO,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YACvC,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,IAAI,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;YACtC,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,OAAO,WAAW,CAAC;IACrB,CAAC;IAEO,wBAAwB,CAAC,OAA0B;QACzD,OAAO;YACL,GAAG,OAAO;YACV,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,GAAG,CAAC;YAC3D,WAAW,EAAE,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC;YAC3C,QAAQ,EAAE,OAAO,CAAC,KAAK,KAAK,yBAAY,CAAC,mBAAmB;SAC7D,CAAC;IACJ,CAAC;IAOO,2BAA2B;QAEjC,MAAM,oBAAoB,GAAG,IAAI,CAAC,aAAa,CAAC,oBAAoB,EAAE,CAAC;QACvE,MAAM,QAAQ,GAAwB,EAAE,CAAC;QACzC,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAiE,CAAC;QAC1F,KAAK,MAAM,OAAO,IAAI,oBAAoB,EAAE,CAAC;YAC3C,MAAM,QAAQ,GAAG,OAAO,CAAC,QAA6B,CAAC;YAEvD,KAAK,MAAM,OAAO,IAAI,QAAQ,CAAC,WAAW,EAAE,EAAE,CAAC;gBAC7C,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;gBAC3C,IAAI,QAAQ,EAAE,CAAC;oBACb,MAAM,IAAI,KAAK,CACb,mCAAmC,OAAO,CAAC,GAAG,IAAI;wBAClD,UAAU,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,mBAAmB,QAAQ,CAAC,YAAY,IAAI,SAAS,IAAI;wBACnG,WAAW,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,mBAAmB,OAAO,CAAC,IAAI,IAAI,SAAS,GAAG,CAClF,CAAC;gBACJ,CAAC;gBACD,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,YAAY,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;gBACnE,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACzB,CAAC;QACH,CAAC;QAED,OAAO,QAAQ,CAAA;IACjB,CAAC;IAQD,cAAc;QACZ,OAAO,IAAI,CAAC,QAAQ,CAAC;IACvB,CAAC;IAED,KAAK,CAAC,mBAAmB;QACvB,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,4BAA4B,CAAC,CAAC;QACjD,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACtD,MAAM,qBAAqB,GAAG,IAAI,CAAC,2BAA2B,EAAE,CAAC;QACjE,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC,cAAc,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;QAE3F,IAAI,CAAC,QAAQ,GAAG,qBAAqB,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE;YAClD,MAAM,aAAa,GAAG,mBAAmB,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YAC3D,MAAM,WAAW,GAAG,aAAa,EAAE,KAAK,CAAC;YACzC,IAAI,aAAa,EAAE,GAAG,IAAI,WAAW,KAAK,SAAS,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;gBAC5E,IAAI,QAAQ,GAAG,WAAW,CAAC;gBAC3B,IAAI,aAAa,CAAC,SAAS,IAAI,IAAI,CAAC,iBAAiB,EAAE,CAAC;oBACtD,IAAI,CAAC;wBACH,QAAQ,GAAG,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;oBACtD,CAAC;oBAAC,MAAM,CAAC;wBACP,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,8BAA8B,OAAO,CAAC,GAAG,qBAAqB,CAAC,CAAC;oBACpF,CAAC;gBACH,CAAC;gBACD,MAAM,WAAW,GAAG,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,QAAQ,EAAE,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;gBAClH,OAAO,EAAE,GAAG,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;YAC5C,CAAC;YACD,OAAO,OAAO,CAAC;QACjB,CAAC,CAAC,CAAC;QAGH,IAAI,CAAC,aAAa,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;IACrF,CAAC;IAEO,sBAAsB,CAAC,GAAW,EAAE,uBAAuC;QACjF,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAE5C,OAAO,OAAO,CAAC,CAAC,CAAC,uBAAuB,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IAC3E,CAAC;IAOD,KAAK,CAAC,uCAAuC;QAG3C,MAAM,kBAAkB,GAAG,IAAI,CAAC,2BAA2B,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,yBAAY,CAAC,mBAAmB,EAAE,yBAAY,CAAC,YAAY,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;QAG3J,MAAM,sBAAsB,GAAc,MAAM,IAAI,CAAC,2BAA2B,EAAE,CAAC;QAGnF,MAAM,2BAA2B,GAAG,IAAI,GAAG,CAAC,sBAAsB,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;QAC3G,MAAM,gBAAgB,GAAc,EAAE,CAAC;QACvC,MAAM,gBAAgB,GAAc,EAAE,CAAC;QACvC,MAAM,WAAW,GAAG,KAAK,CAAC,IAAI,CAC5B,IAAI,GAAG,CACL,kBAAkB;aACf,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC;aAClC,MAAM,CAAC,CAAC,UAAU,EAAwB,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAC9D,CACF,CAAC;QACF,MAAM,oBAAoB,GAAG,IAAI,GAAG,EAAsE,CAAC;QAE3G,MAAM,OAAO,CAAC,GAAG,CACf,WAAW,CAAC,GAAG,CAAC,KAAK,EAAE,UAAU,EAAE,EAAE;YACnC,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;YACrF,oBAAoB,CAAC,GAAG,CAAC,UAAU,EAAE,cAAc,CAAC,CAAC;QACvD,CAAC,CAAC,CACH,CAAC;QAEF,KAAK,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,IAAI,kBAAkB,EAAE,CAAC;YAC9E,MAAM,cAAc,GAAG,UAAU,CAAC,CAAC,CAAC,oBAAoB,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YAChF,IAAI,CAAC,2BAA2B,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC1C,MAAM,OAAO,GAAG,IAAI,wBAAO,EAAE,CAAC;gBAC9B,OAAO,CAAC,GAAG,GAAG,GAAG,CAAC;gBAClB,OAAO,CAAC,KAAK,GAAG,KAAK,CAAC;gBACtB,OAAO,CAAC,SAAS,GAAG,CAAC,CAAC,SAAS,CAAC;gBAChC,IAAI,cAAc;oBAChB,OAAO,CAAC,cAAc,GAAG,cAAc,CAAC;gBAE1C,IAAI,QAAuB,CAAC;gBAC5B,IAAI,OAAO,KAAK,KAAK,SAAS,EAAE,CAAC;oBAC/B,QAAQ,GAAG,KAAK,CAAC,QAAQ,EAAE,CAAC;gBAC9B,CAAC;qBAAM,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;oBAChC,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBAC7B,CAAC;qBAAM,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;oBACjD,QAAQ,GAAG,IAAI,CAAC;gBAClB,CAAC;qBAAM,CAAC;oBACN,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;gBAC3B,CAAC;gBAED,IAAI,SAAS,IAAI,IAAI,CAAC,iBAAiB,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;oBAC7D,QAAQ,GAAG,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;gBACtD,CAAC;gBACD,OAAO,CAAC,KAAK,GAAG,QAAQ,CAAC;gBAEzB,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACjC,CAAC;iBACI,CAAC;gBACJ,MAAM,OAAO,GAAG,2BAA2B,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;gBACrD,MAAM,wBAAwB,GAAG,OAAO,CAAC,cAAc,EAAE,EAAE,IAAI,IAAI,CAAC;gBACpE,MAAM,oBAAoB,GAAG,cAAc,EAAE,EAAE,IAAI,IAAI,CAAC;gBACxD,MAAM,YAAY,GAAG,OAAO,CAAC,KAAK,KAAK,KAAK,CAAC;gBAC7C,MAAM,gBAAgB,GAAG,OAAO,CAAC,SAAS,KAAK,CAAC,CAAC,SAAS,CAAC;gBAC3D,MAAM,aAAa,GAAG,CAAC,CAAC,cAAc,IAAI,wBAAwB,KAAK,oBAAoB,CAAC;gBAE5F,IAAI,CAAC,YAAY,IAAI,CAAC,gBAAgB,IAAI,CAAC,aAAa,EAAE,CAAC;oBACzD,SAAS;gBACX,CAAC;gBAED,OAAO,CAAC,KAAK,GAAG,KAAK,CAAC;gBACtB,OAAO,CAAC,SAAS,GAAG,CAAC,CAAC,SAAS,CAAC;gBAChC,IAAI,cAAc,EAAE,CAAC;oBACnB,OAAO,CAAC,cAAc,GAAG,cAAc,CAAC;gBAC1C,CAAC;gBACD,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACjC,CAAC;QACH,CAAC;QAED,IAAI,gBAAgB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAChC,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;QACzC,CAAC;QAED,IAAI,gBAAgB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAChC,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;QACzC,CAAC;IACH,CAAC;IASD,KAAK,CAAC,kDAAkD;QACtD,MAAM,UAAU,GAAG,IAAI,CAAC,qBAAqB,CAAC,aAAa,EAAE,CAAC;QAC9D,MAAM,0BAA0B,GAAG,CAAC,CAAC,UAAU,EAAE,WAAW,EAAE,QAAQ,CAAC,yBAAyB,CAAC,CAAC;QAElG,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ;aACvB,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,YAAY,CAAC;aACrC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,0BAA0B,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;aACvD,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,yBAAY,CAAC,mBAAmB,EAAE,yBAAY,CAAC,mBAAmB,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;aACjH,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,wBAAwB,CAAC,OAAO,CAAC,CAAC;aACxD,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;YACpB,MAAM,YAAY,GAAG,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;YACzE,IAAI,YAAY,KAAK,CAAC,EAAE,CAAC;gBACvB,OAAO,YAAY,CAAC;YACtB,CAAC;YAED,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,IAAI,MAAM,CAAC,gBAAgB,CAAC;YAC3D,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,IAAI,MAAM,CAAC,gBAAgB,CAAC;YAC7D,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAC3B,OAAO,QAAQ,GAAG,SAAS,CAAC;YAC9B,CAAC;YAED,OAAO,IAAI,CAAC,KAAM,CAAC,aAAa,CAAC,KAAK,CAAC,KAAM,CAAC,CAAC;QACjD,CAAC,CAAC,CAAC;QAEL,OAAO,EAAE,IAAI,EAAE,CAAC;IAClB,CAAC;IAWD,KAAK,CAAC,cAAc,CAAC,WAA+B,EAAE,EAAE,gBAA4C,EAAE;QACpG,MAAM,UAAU,GAAG,IAAI,CAAC,qBAAqB,CAAC,aAAa,EAAE,CAAC;QAC9D,MAAM,MAAM,GAAG,UAAU,EAAE,GAAG,CAAC;QAE/B,MAAM,cAAc,GAAG,IAAI,GAAG,EAAU,CAAC;QAEzC,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE;YACzB,IAAI,IAAI,CAAC,sBAAsB,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,yBAAY,CAAC,SAAS,EAAE,yBAAY,CAAC,mBAAmB,CAAC,CAAC,EAAE,CAAC;gBACzG,cAAc,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YAClC,CAAC;QACH,CAAC,CAAC,CAAC;QACH,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE;YAC3B,IAAI,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,yBAAY,CAAC,SAAS,EAAE,yBAAY,CAAC,mBAAmB,CAAC,CAAC,EAAE,CAAC;gBAC5G,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACrC,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,IAAI,cAAc,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;YAC5B,MAAM,IAAI,4BAAmB,CAAC,GAAG,+BAAc,CAAC,SAAS,cAAc,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;QACtI,CAAC;QAGD,MAAM,gBAAgB,GAAc,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAEnE,MAAM,gBAAgB,GAAc,EAAE,CAAC;QACvC,MAAM,gBAAgB,GAAc,EAAE,CAAC;QAEvC,IAAI,IAAI,GAAgB,IAAI,CAAC;QAC7B,MAAM,eAAe,GAAG,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC;QAClE,IAAI,eAAe,IAAI,MAAM,EAAE,CAAC;YAC9B,IAAI,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;QACtE,CAAC;QAGD,IAAI,aAAa,EAAE,MAAM,EAAE,CAAC;YAC1B,KAAK,MAAM,IAAI,IAAI,aAAa,EAAE,CAAC;gBACjC,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC;gBAClC,MAAM,gBAAgB,GAAG,GAAG,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;gBAIjE,MAAM,WAAW,GAAG,MAAM,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACzD,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;gBAC7D,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,WAAW,EAAE,WAAW,EAAE,EAAE,WAAW,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;gBAEvG,MAAM,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBAEnC,MAAM,UAAU,GAAG,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,KAAK,UAAU,CAAC,CAAC;gBAChE,MAAM,WAAW,GAAG,UAAU,EAAE,IAAI,IAAI,QAAQ,CAAC;gBAEjD,MAAM,eAAe,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,UAAU,CAAC,CAAC;gBACzE,IAAI,eAAe,EAAE,CAAC;oBACpB,eAAe,CAAC,KAAK,GAAG,OAAO,CAAC;oBAChC,eAAe,CAAC,IAAI,GAAG,WAAW,CAAC;oBACnC,gBAAgB,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;gBACzC,CAAC;qBAAM,CAAC;oBACN,MAAM,UAAU,GAAG,IAAI,wBAAO,EAAE,CAAC;oBACjC,UAAU,CAAC,GAAG,GAAG,UAAU,CAAC;oBAC5B,UAAU,CAAC,KAAK,GAAG,OAAO,CAAC;oBAC3B,UAAU,CAAC,IAAI,GAAG,WAAW,CAAC;oBAE9B,IAAI,WAAW,KAAK,MAAM,IAAI,IAAI,EAAE,CAAC;wBACnC,UAAU,CAAC,IAAI,GAAG,IAAI,CAAC;oBACzB,CAAC;oBAED,gBAAgB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;gBACpC,CAAC;YACH,CAAC;QACH,CAAC;QAGD,KAAK,MAAM,UAAU,IAAI,QAAQ,EAAE,CAAC;YAClC,IAAI,aAAa,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,SAAS,KAAK,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;gBACnE,SAAS;YACX,CAAC;YAED,MAAM,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC;YAC3B,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,CAAC;YAClC,IAAI,KAAK,GAAG,QAAQ,KAAK,IAAI,IAAI,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAElF,MAAM,WAAW,GAAG,UAAU,CAAC,IAAI,IAAI,QAAQ,CAAC;YAChD,MAAM,UAAU,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAC/C,MAAM,aAAa,GAAG,CAAC,CAAC,UAAU,EAAE,SAAS,IAAI,IAAI,CAAC,iBAAiB,KAAK,IAAI,IAAI,KAAK,KAAK,IAAI,CAAC;YAEnG,IAAI,aAAa,EAAE,CAAC;gBAClB,KAAK,GAAG,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YAChD,CAAC;YAED,MAAM,eAAe,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC;YAClE,IAAI,eAAe,EAAE,CAAC;gBACpB,eAAe,CAAC,KAAK,GAAG,KAAK,CAAC;gBAC9B,eAAe,CAAC,IAAI,GAAG,WAAW,CAAC;gBACnC,eAAe,CAAC,SAAS,GAAG,aAAa,CAAC;gBAC1C,gBAAgB,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;YACzC,CAAC;iBAAM,CAAC;gBACN,MAAM,UAAU,GAAG,IAAI,wBAAO,EAAE,CAAC;gBACjC,UAAU,CAAC,GAAG,GAAG,GAAG,CAAC;gBACrB,UAAU,CAAC,KAAK,GAAG,KAAK,CAAC;gBACzB,UAAU,CAAC,IAAI,GAAG,WAAW,CAAC;gBAC9B,UAAU,CAAC,SAAS,GAAG,aAAa,CAAC;gBAErC,IAAI,WAAW,KAAK,MAAM,IAAI,IAAI,EAAE,CAAC;oBACnC,UAAU,CAAC,IAAI,GAAG,IAAI,CAAC;gBACzB,CAAC;gBAED,gBAAgB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YACpC,CAAC;QACH,CAAC;QAED,IAAI,gBAAgB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAChC,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;QACzC,CAAC;QAED,IAAI,gBAAgB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAChC,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;QACzC,CAAC;QACD,MAAM,IAAI,CAAC,mBAAmB,EAAE,CAAC;QAEjC,OAAO,CAAC,GAAG,gBAAgB,EAAE,GAAG,gBAAgB,CAAC,CAAC;IACpD,CAAC;IAOD,cAAc,CAAY,UAAsB;QAC9C,MAAM,aAAa,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,UAAoB,CAAC,CAAC;QACnE,IAAI,aAAa,EAAE,CAAC;YAClB,OAAO,aAAa,CAAC,KAAK,CAAC;QAC7B,CAAC;QAED,OAAO,IAAI,CAAC;IAYd,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,YAA0B,EAAE,sBAA2B,EAAE;QAEvE,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,GAAG,YAAY,CAAC;QAEhD,MAAM,UAAU,GAAG,IAAI,CAAC,cAAc,CAAmB,YAAY,CAAC,CAAC;QACvE,IAAI,UAAU,KAAK,OAAO,IAAI,UAAU,KAAK,KAAK,EAAE,CAAC;YACnD,MAAM,IAAI,2BAAkB,CAAC,+BAAc,CAAC,SAAS,CAAC,CAAC;QACzD,CAAC;QAED,IAAI,mBAAmB,CAAC,UAAU,EAAE,CAAC;YACnC,MAAM,eAAe,GAAG,CAAC,6BAA6B,CAAC,CAAC;YACxD,MAAM,kBAAkB,GAAG,mBAAmB,CAAC,UAAU,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;YACtH,MAAM,aAAa,GAAG,kBAAkB,CAAC,MAAM,GAAG,CAAC,CAAC;YACpD,IAAI,CAAC,aAAa,EAAE,CAAC;gBACnB,MAAM,IAAI,4BAAmB,CAAC,+BAAc,CAAC,SAAS,CAAC,CAAC;YAC1D,CAAC;QACH,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,cAAc,CAAmB,WAAW,CAAC,CAAC;QAClE,MAAM,MAAM,GAAG,mBAAmB,CAAC,UAAU,CAAC,GAAG,CAAC;QAClD,MAAM,YAAY,GAAG,IAAI,CAAC,cAAc,CAAmB,cAAc,CAAC,CAAC;QAC3E,OAAO,EAAE,MAAM,EAAE,GAAG,YAAY,4CAA4C,MAAM,mBAAmB,MAAM,uBAAuB,UAAU,wBAAwB,UAAU,EAAE,EAAE,CAAC;IACrL,CAAC;CAEF,CAAA;AAvdY,wCAAc;yBAAd,cAAc;IAD1B,IAAA,mBAAU,GAAE;IAeR,WAAA,IAAA,eAAM,EAAC,mBAAY,CAAC,CAAA;IACpB,WAAA,IAAA,eAAM,EAAC,gCAAyB,CAAC,CAAA;IAKjC,WAAA,IAAA,0BAAgB,EAAC,kBAAI,CAAC,CAAA;qDAJC,8BAAa;QACtB,sCAAiB;QACH,qDAAwB;QACb,+CAAqB;QACJ,oBAAU;GApB1D,cAAc,CAud1B","sourcesContent":["import { BadRequestException, ForbiddenException, Inject, Injectable } from '@nestjs/common';\nimport { InjectRepository } from '@nestjs/typeorm';\nimport { Repository } from 'typeorm';\nimport * as fsPromises from 'fs/promises';\nimport { ERROR_MESSAGES } from 'src/constants/error-messages';\nimport { CreateSettingDto } from 'src/dtos/create-setting.dto';\nimport { GetMcpUrlDto } from 'src/dtos/get-mcp-url.dto';\nimport { User } from 'src/entities/user.entity';\nimport { SettingRepository } from '../repository/setting.repository';\nimport { FILE_SERVICE, IFileService, FILE_STORAGE_PATH_BUILDER, IStoragePathBuilder } from './file';\nimport { Setting } from '../entities/setting.entity';\nimport { RequestContextService } from './request-context.service';\nimport { SolidRegistry } from 'src/helpers/solid-registry';\nimport { AdminSettingDefinition, AdminSettingsResponse, ISettingsProvider, NoInfer, SettingControlType, SettingDefinition, SettingLevel } from '../interfaces';\nimport { ModuleMetadataRepository } from 'src/repository/module-metadata.repository';\nimport type { SolidCoreSetting } from './settings/default-settings-provider.service';\nimport { Logger } from '@nestjs/common';\nimport { EncryptionService } from './encryption.service';\n\n\n@Injectable()\nexport class SettingService {\n  private readonly _logger = new Logger(SettingService.name);\n\n  private settings: SettingDefinition[] = [];\n  private settingsByKey = new Map<string, SettingDefinition>();\n  private readonly encryptionService: EncryptionService | null;\n\n  private readonly arrayKeysToSkip = new Set([\n    'authenticationPasswordRegex',\n    'authenticationPasswordRegexErrorMessage',\n    'authenticationPasswordComplexityDescription',\n  ]);\n\n  constructor(\n    @Inject(FILE_SERVICE) readonly fileService: IFileService,\n    @Inject(FILE_STORAGE_PATH_BUILDER) readonly pathBuilder: IStoragePathBuilder,\n    readonly solidRegistry: SolidRegistry,\n    readonly repo: SettingRepository,\n    readonly moduleMetadataRepo: ModuleMetadataRepository,\n    private readonly requestContextService: RequestContextService,\n    @InjectRepository(User) private readonly userRepository: Repository<User>,\n  ) {\n    const encKey = process.env.APP_ENCRYPTION_KEY;\n    this.encryptionService = encKey ? new EncryptionService(encKey) : null;\n    if (!encKey) this._logger.warn('APP_ENCRYPTION_KEY is not set — encrypted settings will not be decrypted');\n  }\n\n  private async getSettingsFromDb(): Promise<Setting[]> {\n    const settings = await this.repo.find({ relations: ['user'] });\n    return settings;\n  }\n\n  private async getSettingsFromDbForSeeding(): Promise<Setting[]> {\n    return this.repo.find({ relations: ['moduleMetadata'] });\n  }\n\n  private parseSettingValue(value: string, key: string): any {\n    try {\n      return JSON.parse(value);\n    } catch {\n      if (value === 'true' || value === 'false') {\n        return value === 'true';\n      }\n      if (!isNaN(Number(value)) && value.trim() !== '') {\n        return Number(value);\n      }\n      if (!this.arrayKeysToSkip.has(key) && value.includes(',')) {\n        return value.split(',').map(item => item.trim());\n      }\n      return value;\n    }\n  }\n\n  private buildSettingLabel(key: string): string {\n    return key\n      .replace(/([a-z0-9])([A-Z])/g, '$1 $2')\n      .replace(/[-_]+/g, ' ')\n      .replace(/\\s+/g, ' ')\n      .trim()\n      .replace(/\\b\\w/g, (match) => match.toUpperCase());\n  }\n\n  private inferControlType(setting: SettingDefinition): SettingControlType {\n    if (setting.controlType) {\n      return setting.controlType;\n    }\n\n    if (setting.options?.length) {\n      return 'selectionStatic';\n    }\n\n    if (typeof setting.value === 'boolean') {\n      return 'boolean';\n    }\n\n    if (typeof setting.value === 'number') {\n      return 'numeric';\n    }\n\n    return 'shortText';\n  }\n\n  private toAdminSettingDefinition(setting: SettingDefinition): AdminSettingDefinition {\n    return {\n      ...setting,\n      label: setting.label ?? this.buildSettingLabel(setting.key),\n      controlType: this.inferControlType(setting),\n      editable: setting.level === SettingLevel.SystemAdminEditable,\n    };\n  }\n\n  /**\n   * Reads all registered providers and gathers settings from across the running platform.\n   * This is the superset of all possible settings. \n   * @returns \n   */\n  private getAllSettingsFromProviders(): SettingDefinition[] {\n    // get all settings from registry \n    const allSettingsProviders = this.solidRegistry.getSettingsProviders();\n    const settings: SettingDefinition[] = [];\n    const seenKeys = new Map<string, { setting: SettingDefinition; providerName?: string }>();\n    for (const wrapper of allSettingsProviders) {\n      const instance = wrapper.instance as ISettingsProvider;\n      // if (!instance?.getSettings) continue;\n      for (const setting of instance.getSettings()) {\n        const existing = seenKeys.get(setting.key);\n        if (existing) {\n          throw new Error(\n            `Duplicate setting key detected: ${setting.key}. ` +\n            `First: ${JSON.stringify(existing.setting)} from provider: ${existing.providerName ?? \"unknown\"}. ` +\n            `Second: ${JSON.stringify(setting)} from provider: ${wrapper.name ?? \"unknown\"}.`\n          );\n        }\n        seenKeys.set(setting.key, { setting, providerName: wrapper.name });\n        settings.push(setting);\n      }\n    }\n\n    return settings\n  }\n\n  /**\n   * public method that gets all settings in the system, this includes settings from solid-core and any consuming projects.\n   * this means that the settings returned are the ones provided by ISettingsProvider, merged with values if any from the database. \n   * \n   * @returns \n   */\n  getAllSettings(): SettingDefinition[] {\n    return this.settings;\n  }\n\n  async updateSettingsCache(): Promise<void> {\n    this._logger.debug(`updating settings cache...`);\n    const settingsFromDb = await this.getSettingsFromDb();\n    const settingsFromProviders = this.getAllSettingsFromProviders();\n    const settingsFromDbByKey = new Map(settingsFromDb.map(setting => [setting.key, setting]));\n\n    this.settings = settingsFromProviders.map(setting => {\n      const settingFromDb = settingsFromDbByKey.get(setting.key);\n      const valueFromDb = settingFromDb?.value;\n      if (settingFromDb?.key && valueFromDb !== undefined && valueFromDb !== null) {\n        let rawValue = valueFromDb;\n        if (settingFromDb.encrypted && this.encryptionService) {\n          try {\n            rawValue = this.encryptionService.decrypt(rawValue);\n          } catch {\n            this._logger.warn(`Failed to decrypt setting \"${setting.key}\" — using raw value`);\n          }\n        }\n        const parsedValue = typeof rawValue === 'string' ? this.parseSettingValue(rawValue, settingFromDb.key) : rawValue;\n        return { ...setting, value: parsedValue };\n      }\n      return setting;\n    });\n\n    // Also keep a key vs SettingDefinition map...\n    this.settingsByKey = new Map(this.settings.map(setting => [setting.key, setting]));\n  }\n\n  private isDisallowedSettingKey(key: string, settingLevelsToDisallow: SettingLevel[]): boolean {\n    if (!key) {\n      return false;\n    }\n    const setting = this.settingsByKey.get(key);\n    // return setting ? [SettingLevel.SystemEnv, SettingLevel.SystemAdminReadonly].includes(setting.level) : false;\n    return setting ? settingLevelsToDisallow.includes(setting.level) : false;\n  }\n\n  /**\n   * 1. \n   * This method will seed (insert only) settings that are introduced in code but do not already exist in the database. \n   * Also this method only deals with settings with level system-admin-editable & internal-user.\n   */\n  async seedSystemAdminEditableAndAboveSettings(): Promise<void> {\n    // Seed only settings with level system-admin-editable & internal-user, \n    // so basically settings which are either system-admin-editable and above.\n    const saEditableAndAbove = this.getAllSettingsFromProviders().filter(i => [SettingLevel.SystemAdminEditable, SettingLevel.InternalUser].includes(i.level));\n\n    // Get hold of the current values from the database.\n    const existingSettingsFromDb: Setting[] = await this.getSettingsFromDbForSeeding();\n\n    // const existingKeysFromDb = new Set(existingSettingsFromDb.map(s => s.key));\n    const existingSettingsFromDbByKey = new Map(existingSettingsFromDb.map(setting => [setting.key, setting]));\n    const settingsToCreate: Setting[] = [];\n    const settingsToUpdate: Setting[] = [];\n    const moduleNames = Array.from(\n      new Set(\n        saEditableAndAbove\n          .map(setting => setting.moduleName)\n          .filter((moduleName): moduleName is string => !!moduleName)\n      )\n    );\n    const moduleMetadataByName = new Map<string, Awaited<ReturnType<ModuleMetadataRepository['findOneBy']>>>();\n\n    await Promise.all(\n      moduleNames.map(async (moduleName) => {\n        const moduleMetadata = await this.moduleMetadataRepo.findOneBy({ name: moduleName });\n        moduleMetadataByName.set(moduleName, moduleMetadata);\n      })\n    );\n\n    for (const { key, value, level, moduleName, encrypted } of saEditableAndAbove) {\n      const moduleMetadata = moduleName ? moduleMetadataByName.get(moduleName) : null;\n      if (!existingSettingsFromDbByKey.has(key)) {\n        const setting = new Setting();\n        setting.key = key;\n        setting.level = level;\n        setting.encrypted = !!encrypted;\n        if (moduleMetadata)\n          setting.moduleMetadata = moduleMetadata;\n\n        let rawValue: string | null;\n        if (typeof value === 'boolean') {\n          rawValue = value.toString();\n        } else if (Array.isArray(value)) {\n          rawValue = value.join(',');\n        } else if (value === null || value === undefined) {\n          rawValue = null;\n        } else {\n          rawValue = String(value);\n        }\n\n        if (encrypted && this.encryptionService && rawValue !== null) {\n          rawValue = this.encryptionService.encrypt(rawValue);\n        }\n        setting.value = rawValue;\n\n        settingsToCreate.push(setting);\n      }\n      else {\n        const setting = existingSettingsFromDbByKey.get(key);\n        const existingModuleMetadataId = setting.moduleMetadata?.id ?? null;\n        const nextModuleMetadataId = moduleMetadata?.id ?? null;\n        const levelChanged = setting.level !== level;\n        const encryptedChanged = setting.encrypted !== !!encrypted;\n        const moduleChanged = !!moduleMetadata && existingModuleMetadataId !== nextModuleMetadataId;\n\n        if (!levelChanged && !encryptedChanged && !moduleChanged) {\n          continue;\n        }\n\n        setting.level = level;\n        setting.encrypted = !!encrypted;\n        if (moduleMetadata) {\n          setting.moduleMetadata = moduleMetadata;\n        }\n        settingsToUpdate.push(setting);\n      }\n    }\n\n    if (settingsToCreate.length > 0) {\n      await this.repo.save(settingsToCreate);\n    }\n\n    if (settingsToUpdate.length > 0) {\n      await this.repo.save(settingsToUpdate);\n    }\n  }\n\n  /**\n   * 2. \n   * Method used from the solid-core-ui to fetch available settings. \n   * Here we are returning settings other than system-env.\n   * \n   * @returns \n   */\n  async getNonEncryptedSystemAdminReadonlyAndAboveSettings(): Promise<AdminSettingsResponse> {\n    const activeUser = this.requestContextService.getActiveUser();\n    const hasViewEncryptedPermission = !!activeUser?.permissions?.includes('settings:view_encrypted');\n\n    const data = this.settings\n      .filter(i => i.level !== \"system-env\")\n      .filter(i => hasViewEncryptedPermission || !i.encrypted)\n      .filter((setting) => [SettingLevel.SystemAdminReadonly, SettingLevel.SystemAdminEditable].includes(setting.level))\n      .map((setting) => this.toAdminSettingDefinition(setting))\n      .sort((left, right) => {\n        const groupCompare = (left.group ?? '').localeCompare(right.group ?? '');\n        if (groupCompare !== 0) {\n          return groupCompare;\n        }\n\n        const leftSort = left.sortOrder ?? Number.MAX_SAFE_INTEGER;\n        const rightSort = right.sortOrder ?? Number.MAX_SAFE_INTEGER;\n        if (leftSort !== rightSort) {\n          return leftSort - rightSort;\n        }\n\n        return left.label!.localeCompare(right.label!);\n      });\n\n    return { data };\n  }\n\n  /**\n   * 3. \n   * This method updates settings from the admin user interface. \n   * Most likely settings with level system-admin-editable & internal-user are the ones that will get modified here. \n   * \n   * @param settings \n   * @param uploadedFiles \n   * @returns \n   */\n  async updateSettings(settings: CreateSettingDto[] = [], uploadedFiles: Array<Express.Multer.File> = []): Promise<Setting[]> {\n    const activeUser = this.requestContextService.getActiveUser();\n    const userId = activeUser?.sub;\n\n    const restrictedKeys = new Set<string>();\n\n    settings.forEach(setting => {\n      if (this.isDisallowedSettingKey(setting.key, [SettingLevel.SystemEnv, SettingLevel.SystemAdminReadonly])) {\n        restrictedKeys.add(setting.key);\n      }\n    });\n    uploadedFiles.forEach(file => {\n      if (this.isDisallowedSettingKey(file.fieldname, [SettingLevel.SystemEnv, SettingLevel.SystemAdminReadonly])) {\n        restrictedKeys.add(file.fieldname);\n      }\n    });\n\n    if (restrictedKeys.size > 0) {\n      throw new BadRequestException(`${ERROR_MESSAGES.FORBIDDEN}: Settings ${Array.from(restrictedKeys).join(', ')} cannot be modified.`);\n    }\n\n    // const existingSettings = await this.repo.find();\n    const existingSettings: Setting[] = await this.getSettingsFromDb();\n\n    const settingsToUpdate: Setting[] = [];\n    const settingsToCreate: Setting[] = [];\n\n    let user: User | null = null;\n    const hasUserSettings = settings.some(dto => dto.type === 'user');\n    if (hasUserSettings && userId) {\n      user = await this.userRepository.findOne({ where: { id: userId } });\n    }\n\n    // Handle uploaded files\n    if (uploadedFiles?.length) {\n      for (const file of uploadedFiles) {\n        const settingKey = file.fieldname;\n        const relativeFileName = `${file.filename}-${file.originalname}`;\n\n        // Read file from local disk (where Multer stores uploads) and write to storage\n        // The path builder constructs the provider-appropriate storage path\n        const fileContent = await fsPromises.readFile(file.path);\n        const storagePath = this.pathBuilder.build(relativeFileName);\n        const fileUrl = await this.fileService.write(storagePath, fileContent, { contentType: file.mimetype });\n        // Delete the temp file from local disk\n        await fsPromises.unlink(file.path);\n\n        const matchedDto = settings.find(dto => dto.key === settingKey);\n        const settingType = matchedDto?.type ?? 'system';\n\n        const existingSetting = existingSettings.find(s => s.key === settingKey);\n        if (existingSetting) {\n          existingSetting.value = fileUrl;\n          existingSetting.type = settingType;\n          settingsToUpdate.push(existingSetting);\n        } else {\n          const newSetting = new Setting();\n          newSetting.key = settingKey;\n          newSetting.value = fileUrl;\n          newSetting.type = settingType;\n\n          if (settingType === 'user' && user) {\n            newSetting.user = user;\n          }\n\n          settingsToCreate.push(newSetting);\n        }\n      }\n    }\n\n    // Handle non-file settings\n    for (const settingDto of settings) {\n      if (uploadedFiles?.some(file => file.fieldname === settingDto.key)) {\n        continue; // skip if already handled via file\n      }\n\n      const key = settingDto.key;\n      const rawValue = settingDto.value;\n      let value = rawValue === null || rawValue === undefined ? null : String(rawValue);\n\n      const settingType = settingDto.type ?? 'system';\n      const definition = this.settingsByKey.get(key);\n      const shouldEncrypt = !!definition?.encrypted && this.encryptionService !== null && value !== null;\n\n      if (shouldEncrypt) {\n        value = this.encryptionService.encrypt(value);\n      }\n\n      const existingSetting = existingSettings.find(s => s.key === key);\n      if (existingSetting) {\n        existingSetting.value = value;\n        existingSetting.type = settingType;\n        existingSetting.encrypted = shouldEncrypt;\n        settingsToUpdate.push(existingSetting);\n      } else {\n        const newSetting = new Setting();\n        newSetting.key = key;\n        newSetting.value = value;\n        newSetting.type = settingType;\n        newSetting.encrypted = shouldEncrypt;\n\n        if (settingType === 'user' && user) {\n          newSetting.user = user;\n        }\n\n        settingsToCreate.push(newSetting);\n      }\n    }\n\n    if (settingsToUpdate.length > 0) {\n      await this.repo.save(settingsToUpdate);\n    }\n\n    if (settingsToCreate.length > 0) {\n      await this.repo.save(settingsToCreate);\n    }\n    await this.updateSettingsCache();\n\n    return [...settingsToUpdate, ...settingsToCreate];\n  }\n\n  /**\n   * 4. \n   * @param settingKey \n   * @returns \n   */\n  getConfigValue<T = never>(settingKey: NoInfer<T>) {\n    const cachedSetting = this.settingsByKey.get(settingKey as string);\n    if (cachedSetting) {\n      return cachedSetting.value;\n    }\n\n    return null;\n\n    // const cachedSetting = this.settings.find(setting => setting.key === settingKey);\n    // if (cachedSetting) {\n    //   return cachedSetting.value;\n    // }\n\n    // // This is probably not needed at all, but leaving it here as a backup for scenarios like \n    // // if getConfigValue<SolidCoreSetting>() is called before onApplicationBootstrap() runs or if the cache refresh fails. \n    // const getAllSettings = this.getAllSettingsFromProviders();\n    // const settingValue = getAllSettings.find(i => (i.key == settingKey))\n    // return settingValue?.value;\n  }\n\n  async getMcpUrl(getMcpUrlDto: GetMcpUrlDto, solidRequestContext: any = {}): Promise<any> {\n\n    const { showHeader, inListView } = getMcpUrlDto;\n\n    const mcpEnabled = this.getConfigValue<SolidCoreSetting>('mcpEnabled');\n    if (mcpEnabled === 'false' || mcpEnabled === false) {\n      throw new ForbiddenException(ERROR_MESSAGES.FORBIDDEN);\n    }\n\n    if (solidRequestContext.activeUser) {\n      const permissionNames = [\"SettingController.getMcpUrl\"];\n      const matchingPermssions = solidRequestContext.activeUser.permissions.filter((p: any) => permissionNames.includes(p));\n      const hasPermission = matchingPermssions.length > 0;\n      if (!hasPermission) {\n        throw new BadRequestException(ERROR_MESSAGES.FORBIDDEN);\n      }\n    }\n    const apiKey = this.getConfigValue<SolidCoreSetting>('mcpApiKey');\n    const userId = solidRequestContext.activeUser.sub;\n    const mcpServerUrl = this.getConfigValue<SolidCoreSetting>('mcpServerUrl');\n    return { mcpUrl: `${mcpServerUrl}/static/frontend.html?solidx-mcp-api-key=${apiKey}&solidx-user-id=${userId}&solidx-show-header=${showHeader}&solidx-in-list-view=${inListView}` };\n  }\n\n}\n"]}
+{"version":3,"file":"setting.service.js","sourceRoot":"","sources":["../../src/services/setting.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,2CAA6F;AAC7F,6CAAmD;AACnD,qCAAqC;AACrC,wDAA0C;AAC1C,gEAA8D;AAG9D,yDAAgD;AAChD,yEAAqE;AACrE,iCAAoG;AACpG,+DAAqD;AACrD,uEAAkE;AAClE,8DAA2D;AAC3D,8CAA+J;AAC/J,yFAAqF;AAErF,2CAAwC;AACxC,6DAAyD;AACzD,+DAAoE;AACpE,oEAAsE;AAI/D,IAAM,cAAc,sBAApB,MAAM,cAAc;IAazB,YACwB,WAAkC,EACrB,WAAyC,EACnE,aAA4B,EAC5B,IAAuB,EACvB,kBAA4C,EACpC,qBAA4C,EACrC,cAAiD;QAN1C,gBAAW,GAAX,WAAW,CAAc;QACZ,gBAAW,GAAX,WAAW,CAAqB;QACnE,kBAAa,GAAb,aAAa,CAAe;QAC5B,SAAI,GAAJ,IAAI,CAAmB;QACvB,uBAAkB,GAAlB,kBAAkB,CAA0B;QACpC,0BAAqB,GAArB,qBAAqB,CAAuB;QACpB,mBAAc,GAAd,cAAc,CAAkB;QAnB1D,YAAO,GAAG,IAAI,eAAM,CAAC,gBAAc,CAAC,IAAI,CAAC,CAAC;QAEnD,aAAQ,GAAwB,EAAE,CAAC;QACnC,kBAAa,GAAG,IAAI,GAAG,EAA6B,CAAC;QAG5C,oBAAe,GAAG,IAAI,GAAG,CAAC;YACzC,6BAA6B;YAC7B,yCAAyC;YACzC,6CAA6C;SAC9C,CAAC,CAAC;QAWD,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC;QAC9C,IAAI,CAAC,iBAAiB,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,sCAAiB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACvE,IAAI,CAAC,MAAM;YAAE,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,0EAA0E,CAAC,CAAC;IAC7G,CAAC;IAEO,KAAK,CAAC,iBAAiB;QAC7B,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC/D,OAAO,QAAQ,CAAC;IAClB,CAAC;IAEO,KAAK,CAAC,2BAA2B;QACvC,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAC;IAC3D,CAAC;IAEO,iBAAiB,CAAC,KAAa,EAAE,GAAW;QAClD,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC3B,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,KAAK,KAAK,MAAM,IAAI,KAAK,KAAK,OAAO,EAAE,CAAC;gBAC1C,OAAO,KAAK,KAAK,MAAM,CAAC;YAC1B,CAAC;YACD,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;gBACjD,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;YACvB,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC1D,OAAO,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;YACnD,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAEO,iBAAiB,CAAC,GAAW;QACnC,OAAO,GAAG;aACP,OAAO,CAAC,oBAAoB,EAAE,OAAO,CAAC;aACtC,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC;aACtB,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC;aACpB,IAAI,EAAE;aACN,OAAO,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC;IACtD,CAAC;IAEO,gBAAgB,CAAC,OAA0B;QACjD,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;YACxB,OAAO,OAAO,CAAC,WAAW,CAAC;QAC7B,CAAC;QAED,IAAI,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC;YAC5B,OAAO,iBAAiB,CAAC;QAC3B,CAAC;QAED,IAAI,OAAO,OAAO,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YACvC,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,IAAI,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;YACtC,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,OAAO,WAAW,CAAC;IACrB,CAAC;IAEO,wBAAwB,CAAC,OAA0B;QACzD,OAAO;YACL,GAAG,OAAO;YACV,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,GAAG,CAAC;YAC3D,WAAW,EAAE,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC;YAC3C,QAAQ,EAAE,OAAO,CAAC,KAAK,KAAK,yBAAY,CAAC,mBAAmB;SAC7D,CAAC;IACJ,CAAC;IAOO,2BAA2B;QAEjC,MAAM,oBAAoB,GAAG,IAAI,CAAC,aAAa,CAAC,oBAAoB,EAAE,CAAC;QACvE,MAAM,QAAQ,GAAwB,EAAE,CAAC;QACzC,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAiE,CAAC;QAC1F,KAAK,MAAM,OAAO,IAAI,oBAAoB,EAAE,CAAC;YAC3C,MAAM,QAAQ,GAAG,OAAO,CAAC,QAA6B,CAAC;YAEvD,KAAK,MAAM,OAAO,IAAI,QAAQ,CAAC,WAAW,EAAE,EAAE,CAAC;gBAC7C,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;gBAC3C,IAAI,QAAQ,EAAE,CAAC;oBACb,MAAM,IAAI,KAAK,CACb,mCAAmC,OAAO,CAAC,GAAG,IAAI;wBAClD,UAAU,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,mBAAmB,QAAQ,CAAC,YAAY,IAAI,SAAS,IAAI;wBACnG,WAAW,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,mBAAmB,OAAO,CAAC,IAAI,IAAI,SAAS,GAAG,CAClF,CAAC;gBACJ,CAAC;gBACD,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,YAAY,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;gBACnE,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACzB,CAAC;QACH,CAAC;QAED,OAAO,QAAQ,CAAA;IACjB,CAAC;IAQD,cAAc;QACZ,OAAO,IAAI,CAAC,QAAQ,CAAC;IACvB,CAAC;IAED,KAAK,CAAC,mBAAmB;QACvB,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,4BAA4B,CAAC,CAAC;QACjD,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACtD,MAAM,qBAAqB,GAAG,IAAI,CAAC,2BAA2B,EAAE,CAAC;QACjE,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC,cAAc,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;QAE3F,IAAI,CAAC,QAAQ,GAAG,qBAAqB,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE;YAClD,MAAM,aAAa,GAAG,mBAAmB,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YAC3D,MAAM,WAAW,GAAG,aAAa,EAAE,KAAK,CAAC;YACzC,IAAI,aAAa,EAAE,GAAG,IAAI,WAAW,KAAK,SAAS,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;gBAC5E,IAAI,QAAQ,GAAG,WAAW,CAAC;gBAC3B,IAAI,aAAa,CAAC,SAAS,IAAI,IAAI,CAAC,iBAAiB,EAAE,CAAC;oBACtD,IAAI,CAAC;wBACH,QAAQ,GAAG,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;oBACtD,CAAC;oBAAC,MAAM,CAAC;wBACP,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,8BAA8B,OAAO,CAAC,GAAG,qBAAqB,CAAC,CAAC;oBACpF,CAAC;gBACH,CAAC;gBACD,MAAM,WAAW,GAAG,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,QAAQ,EAAE,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;gBAClH,OAAO,EAAE,GAAG,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;YAC5C,CAAC;YACD,OAAO,OAAO,CAAC;QACjB,CAAC,CAAC,CAAC;QAGH,IAAI,CAAC,aAAa,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;IACrF,CAAC;IAEO,sBAAsB,CAAC,GAAW,EAAE,uBAAuC;QACjF,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAE5C,OAAO,OAAO,CAAC,CAAC,CAAC,uBAAuB,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IAC3E,CAAC;IAOD,KAAK,CAAC,uCAAuC;QAG3C,MAAM,kBAAkB,GAAG,IAAI,CAAC,2BAA2B,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,yBAAY,CAAC,mBAAmB,EAAE,yBAAY,CAAC,YAAY,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;QAG3J,MAAM,sBAAsB,GAAc,MAAM,IAAI,CAAC,2BAA2B,EAAE,CAAC;QAGnF,MAAM,2BAA2B,GAAG,IAAI,GAAG,CAAC,sBAAsB,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;QAC3G,MAAM,gBAAgB,GAAc,EAAE,CAAC;QACvC,MAAM,gBAAgB,GAAc,EAAE,CAAC;QACvC,MAAM,WAAW,GAAG,KAAK,CAAC,IAAI,CAC5B,IAAI,GAAG,CACL,kBAAkB;aACf,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC;aAClC,MAAM,CAAC,CAAC,UAAU,EAAwB,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAC9D,CACF,CAAC;QACF,MAAM,oBAAoB,GAAG,IAAI,GAAG,EAAsE,CAAC;QAE3G,MAAM,OAAO,CAAC,GAAG,CACf,WAAW,CAAC,GAAG,CAAC,KAAK,EAAE,UAAU,EAAE,EAAE;YACnC,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;YACrF,oBAAoB,CAAC,GAAG,CAAC,UAAU,EAAE,cAAc,CAAC,CAAC;QACvD,CAAC,CAAC,CACH,CAAC;QAEF,KAAK,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,IAAI,kBAAkB,EAAE,CAAC;YAC9E,MAAM,cAAc,GAAG,UAAU,CAAC,CAAC,CAAC,oBAAoB,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YAChF,IAAI,CAAC,2BAA2B,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC1C,MAAM,OAAO,GAAG,IAAI,wBAAO,EAAE,CAAC;gBAC9B,OAAO,CAAC,GAAG,GAAG,GAAG,CAAC;gBAClB,OAAO,CAAC,KAAK,GAAG,KAAK,CAAC;gBACtB,OAAO,CAAC,SAAS,GAAG,CAAC,CAAC,SAAS,CAAC;gBAChC,IAAI,cAAc;oBAChB,OAAO,CAAC,cAAc,GAAG,cAAc,CAAC;gBAE1C,IAAI,QAAuB,CAAC;gBAC5B,IAAI,OAAO,KAAK,KAAK,SAAS,EAAE,CAAC;oBAC/B,QAAQ,GAAG,KAAK,CAAC,QAAQ,EAAE,CAAC;gBAC9B,CAAC;qBAAM,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;oBAChC,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBAC7B,CAAC;qBAAM,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;oBACjD,QAAQ,GAAG,IAAI,CAAC;gBAClB,CAAC;qBAAM,CAAC;oBACN,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;gBAC3B,CAAC;gBAED,IAAI,SAAS,IAAI,IAAI,CAAC,iBAAiB,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;oBAC7D,QAAQ,GAAG,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;gBACtD,CAAC;gBACD,OAAO,CAAC,KAAK,GAAG,QAAQ,CAAC;gBAEzB,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACjC,CAAC;iBACI,CAAC;gBACJ,MAAM,OAAO,GAAG,2BAA2B,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;gBACrD,MAAM,wBAAwB,GAAG,OAAO,CAAC,cAAc,EAAE,EAAE,IAAI,IAAI,CAAC;gBACpE,MAAM,oBAAoB,GAAG,cAAc,EAAE,EAAE,IAAI,IAAI,CAAC;gBACxD,MAAM,YAAY,GAAG,OAAO,CAAC,KAAK,KAAK,KAAK,CAAC;gBAC7C,MAAM,gBAAgB,GAAG,OAAO,CAAC,SAAS,KAAK,CAAC,CAAC,SAAS,CAAC;gBAC3D,MAAM,aAAa,GAAG,CAAC,CAAC,cAAc,IAAI,wBAAwB,KAAK,oBAAoB,CAAC;gBAE5F,IAAI,CAAC,YAAY,IAAI,CAAC,gBAAgB,IAAI,CAAC,aAAa,EAAE,CAAC;oBACzD,SAAS;gBACX,CAAC;gBAED,OAAO,CAAC,KAAK,GAAG,KAAK,CAAC;gBACtB,OAAO,CAAC,SAAS,GAAG,CAAC,CAAC,SAAS,CAAC;gBAChC,IAAI,cAAc,EAAE,CAAC;oBACnB,OAAO,CAAC,cAAc,GAAG,cAAc,CAAC;gBAC1C,CAAC;gBACD,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACjC,CAAC;QACH,CAAC;QAED,IAAI,gBAAgB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAChC,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;QACzC,CAAC;QAED,IAAI,gBAAgB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAChC,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;QACzC,CAAC;IACH,CAAC;IASD,KAAK,CAAC,kDAAkD;QACtD,MAAM,UAAU,GAAG,IAAI,CAAC,qBAAqB,CAAC,aAAa,EAAE,CAAC;QAC9D,MAAM,0BAA0B,GAAG,CAAC,CAAC,UAAU,EAAE,WAAW,EAAE,QAAQ,CAAC,yBAAyB,CAAC,CAAC;QAElG,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ;aACvB,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,YAAY,CAAC;aACrC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,0BAA0B,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;aACvD,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,yBAAY,CAAC,mBAAmB,EAAE,yBAAY,CAAC,mBAAmB,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;aACjH,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,wBAAwB,CAAC,OAAO,CAAC,CAAC;aACxD,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;YACpB,MAAM,YAAY,GAAG,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;YACzE,IAAI,YAAY,KAAK,CAAC,EAAE,CAAC;gBACvB,OAAO,YAAY,CAAC;YACtB,CAAC;YAED,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,IAAI,MAAM,CAAC,gBAAgB,CAAC;YAC3D,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,IAAI,MAAM,CAAC,gBAAgB,CAAC;YAC7D,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAC3B,OAAO,QAAQ,GAAG,SAAS,CAAC;YAC9B,CAAC;YAED,OAAO,IAAI,CAAC,KAAM,CAAC,aAAa,CAAC,KAAK,CAAC,KAAM,CAAC,CAAC;QACjD,CAAC,CAAC,CAAC;QAEL,OAAO,EAAE,IAAI,EAAE,CAAC;IAClB,CAAC;IAWD,KAAK,CAAC,cAAc,CAAC,WAA+B,EAAE,EAAE,gBAA4C,EAAE;QACpG,MAAM,UAAU,GAAG,IAAI,CAAC,qBAAqB,CAAC,aAAa,EAAE,CAAC;QAC9D,MAAM,MAAM,GAAG,UAAU,EAAE,GAAG,CAAC;QAE/B,MAAM,cAAc,GAAG,IAAI,GAAG,EAAU,CAAC;QAEzC,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE;YACzB,IAAI,IAAI,CAAC,sBAAsB,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,yBAAY,CAAC,SAAS,EAAE,yBAAY,CAAC,mBAAmB,CAAC,CAAC,EAAE,CAAC;gBACzG,cAAc,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YAClC,CAAC;QACH,CAAC,CAAC,CAAC;QACH,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE;YAC3B,IAAI,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,yBAAY,CAAC,SAAS,EAAE,yBAAY,CAAC,mBAAmB,CAAC,CAAC,EAAE,CAAC;gBAC5G,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACrC,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,IAAI,cAAc,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;YAC5B,MAAM,IAAI,4BAAmB,CAAC,GAAG,+BAAc,CAAC,SAAS,cAAc,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;QACtI,CAAC;QAGD,MAAM,gBAAgB,GAAc,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAEnE,MAAM,gBAAgB,GAAc,EAAE,CAAC;QACvC,MAAM,gBAAgB,GAAc,EAAE,CAAC;QAEvC,IAAI,IAAI,GAAgB,IAAI,CAAC;QAC7B,MAAM,eAAe,GAAG,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC;QAClE,IAAI,eAAe,IAAI,MAAM,EAAE,CAAC;YAC9B,IAAI,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;QACtE,CAAC;QAGD,IAAI,aAAa,EAAE,MAAM,EAAE,CAAC;YAC1B,KAAK,MAAM,IAAI,IAAI,aAAa,EAAE,CAAC;gBACjC,IAAI,IAAA,uCAAoB,EAAC,IAAI,CAAC,EAAE,CAAC;oBAC/B,MAAM,IAAI,4BAAmB,CAAC,oDAAoD,CAAC,CAAC;gBACtF,CAAC;gBAED,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC;gBAElC,MAAM,gBAAgB,GAAG,GAAG,IAAI,CAAC,QAAQ,IAAI,IAAA,iDAA2B,EAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;gBAI9F,MAAM,WAAW,GAAG,MAAM,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACzD,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;gBAC7D,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,WAAW,EAAE,WAAW,EAAE,EAAE,WAAW,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;gBAEvG,MAAM,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBAEnC,MAAM,UAAU,GAAG,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,KAAK,UAAU,CAAC,CAAC;gBAChE,MAAM,WAAW,GAAG,UAAU,EAAE,IAAI,IAAI,QAAQ,CAAC;gBAEjD,MAAM,eAAe,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,UAAU,CAAC,CAAC;gBACzE,IAAI,eAAe,EAAE,CAAC;oBACpB,eAAe,CAAC,KAAK,GAAG,OAAO,CAAC;oBAChC,eAAe,CAAC,IAAI,GAAG,WAAW,CAAC;oBACnC,gBAAgB,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;gBACzC,CAAC;qBAAM,CAAC;oBACN,MAAM,UAAU,GAAG,IAAI,wBAAO,EAAE,CAAC;oBACjC,UAAU,CAAC,GAAG,GAAG,UAAU,CAAC;oBAC5B,UAAU,CAAC,KAAK,GAAG,OAAO,CAAC;oBAC3B,UAAU,CAAC,IAAI,GAAG,WAAW,CAAC;oBAE9B,IAAI,WAAW,KAAK,MAAM,IAAI,IAAI,EAAE,CAAC;wBACnC,UAAU,CAAC,IAAI,GAAG,IAAI,CAAC;oBACzB,CAAC;oBAED,gBAAgB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;gBACpC,CAAC;YACH,CAAC;QACH,CAAC;QAGD,KAAK,MAAM,UAAU,IAAI,QAAQ,EAAE,CAAC;YAClC,IAAI,aAAa,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,SAAS,KAAK,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;gBACnE,SAAS;YACX,CAAC;YAED,MAAM,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC;YAC3B,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,CAAC;YAClC,IAAI,KAAK,GAAG,QAAQ,KAAK,IAAI,IAAI,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAElF,MAAM,WAAW,GAAG,UAAU,CAAC,IAAI,IAAI,QAAQ,CAAC;YAChD,MAAM,UAAU,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAC/C,MAAM,aAAa,GAAG,CAAC,CAAC,UAAU,EAAE,SAAS,IAAI,IAAI,CAAC,iBAAiB,KAAK,IAAI,IAAI,KAAK,KAAK,IAAI,CAAC;YAEnG,IAAI,aAAa,EAAE,CAAC;gBAClB,KAAK,GAAG,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YAChD,CAAC;YAED,MAAM,eAAe,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC;YAClE,IAAI,eAAe,EAAE,CAAC;gBACpB,eAAe,CAAC,KAAK,GAAG,KAAK,CAAC;gBAC9B,eAAe,CAAC,IAAI,GAAG,WAAW,CAAC;gBACnC,eAAe,CAAC,SAAS,GAAG,aAAa,CAAC;gBAC1C,gBAAgB,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;YACzC,CAAC;iBAAM,CAAC;gBACN,MAAM,UAAU,GAAG,IAAI,wBAAO,EAAE,CAAC;gBACjC,UAAU,CAAC,GAAG,GAAG,GAAG,CAAC;gBACrB,UAAU,CAAC,KAAK,GAAG,KAAK,CAAC;gBACzB,UAAU,CAAC,IAAI,GAAG,WAAW,CAAC;gBAC9B,UAAU,CAAC,SAAS,GAAG,aAAa,CAAC;gBAErC,IAAI,WAAW,KAAK,MAAM,IAAI,IAAI,EAAE,CAAC;oBACnC,UAAU,CAAC,IAAI,GAAG,IAAI,CAAC;gBACzB,CAAC;gBAED,gBAAgB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YACpC,CAAC;QACH,CAAC;QAED,IAAI,gBAAgB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAChC,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;QACzC,CAAC;QAED,IAAI,gBAAgB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAChC,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;QACzC,CAAC;QACD,MAAM,IAAI,CAAC,mBAAmB,EAAE,CAAC;QAEjC,OAAO,CAAC,GAAG,gBAAgB,EAAE,GAAG,gBAAgB,CAAC,CAAC;IACpD,CAAC;IAOD,cAAc,CAAY,UAAsB;QAC9C,MAAM,aAAa,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,UAAoB,CAAC,CAAC;QACnE,IAAI,aAAa,EAAE,CAAC;YAClB,OAAO,aAAa,CAAC,KAAK,CAAC;QAC7B,CAAC;QAED,OAAO,IAAI,CAAC;IAYd,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,YAA0B,EAAE,sBAA2B,EAAE;QAEvE,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,GAAG,YAAY,CAAC;QAEhD,MAAM,UAAU,GAAG,IAAI,CAAC,cAAc,CAAmB,YAAY,CAAC,CAAC;QACvE,IAAI,UAAU,KAAK,OAAO,IAAI,UAAU,KAAK,KAAK,EAAE,CAAC;YACnD,MAAM,IAAI,2BAAkB,CAAC,+BAAc,CAAC,SAAS,CAAC,CAAC;QACzD,CAAC;QAED,IAAI,mBAAmB,CAAC,UAAU,EAAE,CAAC;YACnC,MAAM,eAAe,GAAG,CAAC,6BAA6B,CAAC,CAAC;YACxD,MAAM,kBAAkB,GAAG,mBAAmB,CAAC,UAAU,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;YACtH,MAAM,aAAa,GAAG,kBAAkB,CAAC,MAAM,GAAG,CAAC,CAAC;YACpD,IAAI,CAAC,aAAa,EAAE,CAAC;gBACnB,MAAM,IAAI,4BAAmB,CAAC,+BAAc,CAAC,SAAS,CAAC,CAAC;YAC1D,CAAC;QACH,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,cAAc,CAAmB,WAAW,CAAC,CAAC;QAClE,MAAM,MAAM,GAAG,mBAAmB,CAAC,UAAU,CAAC,GAAG,CAAC;QAClD,MAAM,YAAY,GAAG,IAAI,CAAC,cAAc,CAAmB,cAAc,CAAC,CAAC;QAC3E,OAAO,EAAE,MAAM,EAAE,GAAG,YAAY,4CAA4C,MAAM,mBAAmB,MAAM,uBAAuB,UAAU,wBAAwB,UAAU,EAAE,EAAE,CAAC;IACrL,CAAC;CAEF,CAAA;AA5dY,wCAAc;yBAAd,cAAc;IAD1B,IAAA,mBAAU,GAAE;IAeR,WAAA,IAAA,eAAM,EAAC,mBAAY,CAAC,CAAA;IACpB,WAAA,IAAA,eAAM,EAAC,gCAAyB,CAAC,CAAA;IAKjC,WAAA,IAAA,0BAAgB,EAAC,kBAAI,CAAC,CAAA;qDAJC,8BAAa;QACtB,sCAAiB;QACH,qDAAwB;QACb,+CAAqB;QACJ,oBAAU;GApB1D,cAAc,CA4d1B","sourcesContent":["import { BadRequestException, ForbiddenException, Inject, Injectable } from '@nestjs/common';\nimport { InjectRepository } from '@nestjs/typeorm';\nimport { Repository } from 'typeorm';\nimport * as fsPromises from 'fs/promises';\nimport { ERROR_MESSAGES } from 'src/constants/error-messages';\nimport { CreateSettingDto } from 'src/dtos/create-setting.dto';\nimport { GetMcpUrlDto } from 'src/dtos/get-mcp-url.dto';\nimport { User } from 'src/entities/user.entity';\nimport { SettingRepository } from '../repository/setting.repository';\nimport { FILE_SERVICE, IFileService, FILE_STORAGE_PATH_BUILDER, IStoragePathBuilder } from './file';\nimport { Setting } from '../entities/setting.entity';\nimport { RequestContextService } from './request-context.service';\nimport { SolidRegistry } from 'src/helpers/solid-registry';\nimport { AdminSettingDefinition, AdminSettingsResponse, ISettingsProvider, NoInfer, SettingControlType, SettingDefinition, SettingLevel } from '../interfaces';\nimport { ModuleMetadataRepository } from 'src/repository/module-metadata.repository';\nimport type { SolidCoreSetting } from './settings/default-settings-provider.service';\nimport { Logger } from '@nestjs/common';\nimport { EncryptionService } from './encryption.service';\nimport { sanitizeStoredMediaFileName } from './media-storage.utils';\nimport { isDangerousMediaFile } from 'src/constants/media-file-types';\n\n\n@Injectable()\nexport class SettingService {\n  private readonly _logger = new Logger(SettingService.name);\n\n  private settings: SettingDefinition[] = [];\n  private settingsByKey = new Map<string, SettingDefinition>();\n  private readonly encryptionService: EncryptionService | null;\n\n  private readonly arrayKeysToSkip = new Set([\n    'authenticationPasswordRegex',\n    'authenticationPasswordRegexErrorMessage',\n    'authenticationPasswordComplexityDescription',\n  ]);\n\n  constructor(\n    @Inject(FILE_SERVICE) readonly fileService: IFileService,\n    @Inject(FILE_STORAGE_PATH_BUILDER) readonly pathBuilder: IStoragePathBuilder,\n    readonly solidRegistry: SolidRegistry,\n    readonly repo: SettingRepository,\n    readonly moduleMetadataRepo: ModuleMetadataRepository,\n    private readonly requestContextService: RequestContextService,\n    @InjectRepository(User) private readonly userRepository: Repository<User>,\n  ) {\n    const encKey = process.env.APP_ENCRYPTION_KEY;\n    this.encryptionService = encKey ? new EncryptionService(encKey) : null;\n    if (!encKey) this._logger.warn('APP_ENCRYPTION_KEY is not set — encrypted settings will not be decrypted');\n  }\n\n  private async getSettingsFromDb(): Promise<Setting[]> {\n    const settings = await this.repo.find({ relations: ['user'] });\n    return settings;\n  }\n\n  private async getSettingsFromDbForSeeding(): Promise<Setting[]> {\n    return this.repo.find({ relations: ['moduleMetadata'] });\n  }\n\n  private parseSettingValue(value: string, key: string): any {\n    try {\n      return JSON.parse(value);\n    } catch {\n      if (value === 'true' || value === 'false') {\n        return value === 'true';\n      }\n      if (!isNaN(Number(value)) && value.trim() !== '') {\n        return Number(value);\n      }\n      if (!this.arrayKeysToSkip.has(key) && value.includes(',')) {\n        return value.split(',').map(item => item.trim());\n      }\n      return value;\n    }\n  }\n\n  private buildSettingLabel(key: string): string {\n    return key\n      .replace(/([a-z0-9])([A-Z])/g, '$1 $2')\n      .replace(/[-_]+/g, ' ')\n      .replace(/\\s+/g, ' ')\n      .trim()\n      .replace(/\\b\\w/g, (match) => match.toUpperCase());\n  }\n\n  private inferControlType(setting: SettingDefinition): SettingControlType {\n    if (setting.controlType) {\n      return setting.controlType;\n    }\n\n    if (setting.options?.length) {\n      return 'selectionStatic';\n    }\n\n    if (typeof setting.value === 'boolean') {\n      return 'boolean';\n    }\n\n    if (typeof setting.value === 'number') {\n      return 'numeric';\n    }\n\n    return 'shortText';\n  }\n\n  private toAdminSettingDefinition(setting: SettingDefinition): AdminSettingDefinition {\n    return {\n      ...setting,\n      label: setting.label ?? this.buildSettingLabel(setting.key),\n      controlType: this.inferControlType(setting),\n      editable: setting.level === SettingLevel.SystemAdminEditable,\n    };\n  }\n\n  /**\n   * Reads all registered providers and gathers settings from across the running platform.\n   * This is the superset of all possible settings. \n   * @returns \n   */\n  private getAllSettingsFromProviders(): SettingDefinition[] {\n    // get all settings from registry \n    const allSettingsProviders = this.solidRegistry.getSettingsProviders();\n    const settings: SettingDefinition[] = [];\n    const seenKeys = new Map<string, { setting: SettingDefinition; providerName?: string }>();\n    for (const wrapper of allSettingsProviders) {\n      const instance = wrapper.instance as ISettingsProvider;\n      // if (!instance?.getSettings) continue;\n      for (const setting of instance.getSettings()) {\n        const existing = seenKeys.get(setting.key);\n        if (existing) {\n          throw new Error(\n            `Duplicate setting key detected: ${setting.key}. ` +\n            `First: ${JSON.stringify(existing.setting)} from provider: ${existing.providerName ?? \"unknown\"}. ` +\n            `Second: ${JSON.stringify(setting)} from provider: ${wrapper.name ?? \"unknown\"}.`\n          );\n        }\n        seenKeys.set(setting.key, { setting, providerName: wrapper.name });\n        settings.push(setting);\n      }\n    }\n\n    return settings\n  }\n\n  /**\n   * public method that gets all settings in the system, this includes settings from solid-core and any consuming projects.\n   * this means that the settings returned are the ones provided by ISettingsProvider, merged with values if any from the database. \n   * \n   * @returns \n   */\n  getAllSettings(): SettingDefinition[] {\n    return this.settings;\n  }\n\n  async updateSettingsCache(): Promise<void> {\n    this._logger.debug(`updating settings cache...`);\n    const settingsFromDb = await this.getSettingsFromDb();\n    const settingsFromProviders = this.getAllSettingsFromProviders();\n    const settingsFromDbByKey = new Map(settingsFromDb.map(setting => [setting.key, setting]));\n\n    this.settings = settingsFromProviders.map(setting => {\n      const settingFromDb = settingsFromDbByKey.get(setting.key);\n      const valueFromDb = settingFromDb?.value;\n      if (settingFromDb?.key && valueFromDb !== undefined && valueFromDb !== null) {\n        let rawValue = valueFromDb;\n        if (settingFromDb.encrypted && this.encryptionService) {\n          try {\n            rawValue = this.encryptionService.decrypt(rawValue);\n          } catch {\n            this._logger.warn(`Failed to decrypt setting \"${setting.key}\" — using raw value`);\n          }\n        }\n        const parsedValue = typeof rawValue === 'string' ? this.parseSettingValue(rawValue, settingFromDb.key) : rawValue;\n        return { ...setting, value: parsedValue };\n      }\n      return setting;\n    });\n\n    // Also keep a key vs SettingDefinition map...\n    this.settingsByKey = new Map(this.settings.map(setting => [setting.key, setting]));\n  }\n\n  private isDisallowedSettingKey(key: string, settingLevelsToDisallow: SettingLevel[]): boolean {\n    if (!key) {\n      return false;\n    }\n    const setting = this.settingsByKey.get(key);\n    // return setting ? [SettingLevel.SystemEnv, SettingLevel.SystemAdminReadonly].includes(setting.level) : false;\n    return setting ? settingLevelsToDisallow.includes(setting.level) : false;\n  }\n\n  /**\n   * 1. \n   * This method will seed (insert only) settings that are introduced in code but do not already exist in the database. \n   * Also this method only deals with settings with level system-admin-editable & internal-user.\n   */\n  async seedSystemAdminEditableAndAboveSettings(): Promise<void> {\n    // Seed only settings with level system-admin-editable & internal-user, \n    // so basically settings which are either system-admin-editable and above.\n    const saEditableAndAbove = this.getAllSettingsFromProviders().filter(i => [SettingLevel.SystemAdminEditable, SettingLevel.InternalUser].includes(i.level));\n\n    // Get hold of the current values from the database.\n    const existingSettingsFromDb: Setting[] = await this.getSettingsFromDbForSeeding();\n\n    // const existingKeysFromDb = new Set(existingSettingsFromDb.map(s => s.key));\n    const existingSettingsFromDbByKey = new Map(existingSettingsFromDb.map(setting => [setting.key, setting]));\n    const settingsToCreate: Setting[] = [];\n    const settingsToUpdate: Setting[] = [];\n    const moduleNames = Array.from(\n      new Set(\n        saEditableAndAbove\n          .map(setting => setting.moduleName)\n          .filter((moduleName): moduleName is string => !!moduleName)\n      )\n    );\n    const moduleMetadataByName = new Map<string, Awaited<ReturnType<ModuleMetadataRepository['findOneBy']>>>();\n\n    await Promise.all(\n      moduleNames.map(async (moduleName) => {\n        const moduleMetadata = await this.moduleMetadataRepo.findOneBy({ name: moduleName });\n        moduleMetadataByName.set(moduleName, moduleMetadata);\n      })\n    );\n\n    for (const { key, value, level, moduleName, encrypted } of saEditableAndAbove) {\n      const moduleMetadata = moduleName ? moduleMetadataByName.get(moduleName) : null;\n      if (!existingSettingsFromDbByKey.has(key)) {\n        const setting = new Setting();\n        setting.key = key;\n        setting.level = level;\n        setting.encrypted = !!encrypted;\n        if (moduleMetadata)\n          setting.moduleMetadata = moduleMetadata;\n\n        let rawValue: string | null;\n        if (typeof value === 'boolean') {\n          rawValue = value.toString();\n        } else if (Array.isArray(value)) {\n          rawValue = value.join(',');\n        } else if (value === null || value === undefined) {\n          rawValue = null;\n        } else {\n          rawValue = String(value);\n        }\n\n        if (encrypted && this.encryptionService && rawValue !== null) {\n          rawValue = this.encryptionService.encrypt(rawValue);\n        }\n        setting.value = rawValue;\n\n        settingsToCreate.push(setting);\n      }\n      else {\n        const setting = existingSettingsFromDbByKey.get(key);\n        const existingModuleMetadataId = setting.moduleMetadata?.id ?? null;\n        const nextModuleMetadataId = moduleMetadata?.id ?? null;\n        const levelChanged = setting.level !== level;\n        const encryptedChanged = setting.encrypted !== !!encrypted;\n        const moduleChanged = !!moduleMetadata && existingModuleMetadataId !== nextModuleMetadataId;\n\n        if (!levelChanged && !encryptedChanged && !moduleChanged) {\n          continue;\n        }\n\n        setting.level = level;\n        setting.encrypted = !!encrypted;\n        if (moduleMetadata) {\n          setting.moduleMetadata = moduleMetadata;\n        }\n        settingsToUpdate.push(setting);\n      }\n    }\n\n    if (settingsToCreate.length > 0) {\n      await this.repo.save(settingsToCreate);\n    }\n\n    if (settingsToUpdate.length > 0) {\n      await this.repo.save(settingsToUpdate);\n    }\n  }\n\n  /**\n   * 2. \n   * Method used from the solid-core-ui to fetch available settings. \n   * Here we are returning settings other than system-env.\n   * \n   * @returns \n   */\n  async getNonEncryptedSystemAdminReadonlyAndAboveSettings(): Promise<AdminSettingsResponse> {\n    const activeUser = this.requestContextService.getActiveUser();\n    const hasViewEncryptedPermission = !!activeUser?.permissions?.includes('settings:view_encrypted');\n\n    const data = this.settings\n      .filter(i => i.level !== \"system-env\")\n      .filter(i => hasViewEncryptedPermission || !i.encrypted)\n      .filter((setting) => [SettingLevel.SystemAdminReadonly, SettingLevel.SystemAdminEditable].includes(setting.level))\n      .map((setting) => this.toAdminSettingDefinition(setting))\n      .sort((left, right) => {\n        const groupCompare = (left.group ?? '').localeCompare(right.group ?? '');\n        if (groupCompare !== 0) {\n          return groupCompare;\n        }\n\n        const leftSort = left.sortOrder ?? Number.MAX_SAFE_INTEGER;\n        const rightSort = right.sortOrder ?? Number.MAX_SAFE_INTEGER;\n        if (leftSort !== rightSort) {\n          return leftSort - rightSort;\n        }\n\n        return left.label!.localeCompare(right.label!);\n      });\n\n    return { data };\n  }\n\n  /**\n   * 3. \n   * This method updates settings from the admin user interface. \n   * Most likely settings with level system-admin-editable & internal-user are the ones that will get modified here. \n   * \n   * @param settings \n   * @param uploadedFiles \n   * @returns \n   */\n  async updateSettings(settings: CreateSettingDto[] = [], uploadedFiles: Array<Express.Multer.File> = []): Promise<Setting[]> {\n    const activeUser = this.requestContextService.getActiveUser();\n    const userId = activeUser?.sub;\n\n    const restrictedKeys = new Set<string>();\n\n    settings.forEach(setting => {\n      if (this.isDisallowedSettingKey(setting.key, [SettingLevel.SystemEnv, SettingLevel.SystemAdminReadonly])) {\n        restrictedKeys.add(setting.key);\n      }\n    });\n    uploadedFiles.forEach(file => {\n      if (this.isDisallowedSettingKey(file.fieldname, [SettingLevel.SystemEnv, SettingLevel.SystemAdminReadonly])) {\n        restrictedKeys.add(file.fieldname);\n      }\n    });\n\n    if (restrictedKeys.size > 0) {\n      throw new BadRequestException(`${ERROR_MESSAGES.FORBIDDEN}: Settings ${Array.from(restrictedKeys).join(', ')} cannot be modified.`);\n    }\n\n    // const existingSettings = await this.repo.find();\n    const existingSettings: Setting[] = await this.getSettingsFromDb();\n\n    const settingsToUpdate: Setting[] = [];\n    const settingsToCreate: Setting[] = [];\n\n    let user: User | null = null;\n    const hasUserSettings = settings.some(dto => dto.type === 'user');\n    if (hasUserSettings && userId) {\n      user = await this.userRepository.findOne({ where: { id: userId } });\n    }\n\n    // Handle uploaded files\n    if (uploadedFiles?.length) {\n      for (const file of uploadedFiles) {\n        if (isDangerousMediaFile(file)) {\n          throw new BadRequestException('Dangerous file types are not allowed for settings.');\n        }\n\n        const settingKey = file.fieldname;\n        // originalname is attacker-controlled and feeds straight into a storage path.\n        const relativeFileName = `${file.filename}-${sanitizeStoredMediaFileName(file.originalname)}`;\n\n        // Read file from local disk (where Multer stores uploads) and write to storage\n        // The path builder constructs the provider-appropriate storage path\n        const fileContent = await fsPromises.readFile(file.path);\n        const storagePath = this.pathBuilder.build(relativeFileName);\n        const fileUrl = await this.fileService.write(storagePath, fileContent, { contentType: file.mimetype });\n        // Delete the temp file from local disk\n        await fsPromises.unlink(file.path);\n\n        const matchedDto = settings.find(dto => dto.key === settingKey);\n        const settingType = matchedDto?.type ?? 'system';\n\n        const existingSetting = existingSettings.find(s => s.key === settingKey);\n        if (existingSetting) {\n          existingSetting.value = fileUrl;\n          existingSetting.type = settingType;\n          settingsToUpdate.push(existingSetting);\n        } else {\n          const newSetting = new Setting();\n          newSetting.key = settingKey;\n          newSetting.value = fileUrl;\n          newSetting.type = settingType;\n\n          if (settingType === 'user' && user) {\n            newSetting.user = user;\n          }\n\n          settingsToCreate.push(newSetting);\n        }\n      }\n    }\n\n    // Handle non-file settings\n    for (const settingDto of settings) {\n      if (uploadedFiles?.some(file => file.fieldname === settingDto.key)) {\n        continue; // skip if already handled via file\n      }\n\n      const key = settingDto.key;\n      const rawValue = settingDto.value;\n      let value = rawValue === null || rawValue === undefined ? null : String(rawValue);\n\n      const settingType = settingDto.type ?? 'system';\n      const definition = this.settingsByKey.get(key);\n      const shouldEncrypt = !!definition?.encrypted && this.encryptionService !== null && value !== null;\n\n      if (shouldEncrypt) {\n        value = this.encryptionService.encrypt(value);\n      }\n\n      const existingSetting = existingSettings.find(s => s.key === key);\n      if (existingSetting) {\n        existingSetting.value = value;\n        existingSetting.type = settingType;\n        existingSetting.encrypted = shouldEncrypt;\n        settingsToUpdate.push(existingSetting);\n      } else {\n        const newSetting = new Setting();\n        newSetting.key = key;\n        newSetting.value = value;\n        newSetting.type = settingType;\n        newSetting.encrypted = shouldEncrypt;\n\n        if (settingType === 'user' && user) {\n          newSetting.user = user;\n        }\n\n        settingsToCreate.push(newSetting);\n      }\n    }\n\n    if (settingsToUpdate.length > 0) {\n      await this.repo.save(settingsToUpdate);\n    }\n\n    if (settingsToCreate.length > 0) {\n      await this.repo.save(settingsToCreate);\n    }\n    await this.updateSettingsCache();\n\n    return [...settingsToUpdate, ...settingsToCreate];\n  }\n\n  /**\n   * 4. \n   * @param settingKey \n   * @returns \n   */\n  getConfigValue<T = never>(settingKey: NoInfer<T>) {\n    const cachedSetting = this.settingsByKey.get(settingKey as string);\n    if (cachedSetting) {\n      return cachedSetting.value;\n    }\n\n    return null;\n\n    // const cachedSetting = this.settings.find(setting => setting.key === settingKey);\n    // if (cachedSetting) {\n    //   return cachedSetting.value;\n    // }\n\n    // // This is probably not needed at all, but leaving it here as a backup for scenarios like \n    // // if getConfigValue<SolidCoreSetting>() is called before onApplicationBootstrap() runs or if the cache refresh fails. \n    // const getAllSettings = this.getAllSettingsFromProviders();\n    // const settingValue = getAllSettings.find(i => (i.key == settingKey))\n    // return settingValue?.value;\n  }\n\n  async getMcpUrl(getMcpUrlDto: GetMcpUrlDto, solidRequestContext: any = {}): Promise<any> {\n\n    const { showHeader, inListView } = getMcpUrlDto;\n\n    const mcpEnabled = this.getConfigValue<SolidCoreSetting>('mcpEnabled');\n    if (mcpEnabled === 'false' || mcpEnabled === false) {\n      throw new ForbiddenException(ERROR_MESSAGES.FORBIDDEN);\n    }\n\n    if (solidRequestContext.activeUser) {\n      const permissionNames = [\"SettingController.getMcpUrl\"];\n      const matchingPermssions = solidRequestContext.activeUser.permissions.filter((p: any) => permissionNames.includes(p));\n      const hasPermission = matchingPermssions.length > 0;\n      if (!hasPermission) {\n        throw new BadRequestException(ERROR_MESSAGES.FORBIDDEN);\n      }\n    }\n    const apiKey = this.getConfigValue<SolidCoreSetting>('mcpApiKey');\n    const userId = solidRequestContext.activeUser.sub;\n    const mcpServerUrl = this.getConfigValue<SolidCoreSetting>('mcpServerUrl');\n    return { mcpUrl: `${mcpServerUrl}/static/frontend.html?solidx-mcp-api-key=${apiKey}&solidx-user-id=${userId}&solidx-show-header=${showHeader}&solidx-in-list-view=${inListView}` };\n  }\n\n}\n"]}