@spinajs/rbac 2.0.481 → 2.0.484

package/lib/mjs/ownership.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ownership.js","sourceRoot":"","sources":["../../src/ownership.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,sBAAsB,EAAE,OAAO,EAAgF,MAAM,cAAc,CAAC;AAItK;;;;;;;;GAQG;AAEH,SAAS,cAAc,CAAC,KAAc;IACpC,MAAM,UAAU,GAAG,sBAAsB,CAAC,KAAY,CAAyB,CAAC;IAEhF,IAAI,CAAC,UAAU,IAAI,CAAC,UAAU,CAAC,UAAU,EAAE,CAAC;QAC1C,MAAM,IAAI,GAAG,UAAU,EAAE,IAAI,IAAK,KAAa,EAAE,IAAI,CAAC;QACtD,MAAM,IAAI,YAAY,CAAC,SAAS,IAAI,kEAAkE,CAAC,CAAC;IAC1G,CAAC;IAED,OAAO,UAAU,CAAC;AACpB,CAAC;AAED;;GAEG;AACF,SAAqD,CAAC,eAAe,GAAG,UAEvE,KAAqF,EACrF,IAAU;IAEV,MAAM,UAAU,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IACxC,OAAQ,KAAa,CAAC,KAAK,CAAC,UAAU,CAAC,UAAU,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;AAC3E,CAAC,CAAC;AAEF;;;;GAIG;AACF,SAAoD,CAAC,cAAc,GAAG,KAAK,WAE1E,iBAAmD,EACnD,IAAU;IAEV,MAAM,UAAU,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IAExC,IAAI,iBAAiB,YAAY,SAAS,EAAE,CAAC;QAC3C,OAAQ,iBAAyB,CAAC,UAAU,CAAC,UAAU,CAAC,KAAK,IAAI,CAAC,eAAe,CAAC;IACpF,CAAC;IAED,0FAA0F;IAC1F,wFAAwF;IACxF,0FAA0F;IAC1F,MAAM,KAAK,GAAI,IAAY,CAAC,KAAK,EAAE,CAAC;IACpC,OAAO,CAAC,KAAK,EAAE,UAAU,EAAE,iBAAiB,CAAC,CAAC;IAE9C,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,UAAU,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC,KAAK,EAAE,CAAC;IAErF,OAAO,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,CAAC;AAC/C,CAAC,CAAC"}

package/lib/mjs/session-codec.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Serializes a session `Data` map to a JSON string, preserving `Map` / `Set` /
+ * `DateTime` values.
+ *
+ * @param data - the session data map
+ */
+export declare function encodeSessionData(data: Map<string, unknown>): string;
+/**
+ * Restores a session `Data` map from a JSON string produced by
+ * {@link encodeSessionData}.
+ *
+ * @param json - the serialized session data
+ */
+export declare function decodeSessionData(json: string): Map<string, unknown>;
+//# sourceMappingURL=session-codec.d.ts.map

package/lib/mjs/session-codec.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-codec.d.ts","sourceRoot":"","sources":["../../src/session-codec.ts"],"names":[],"mappings":"AAwCA;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAEpE;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAGpE"}

package/lib/mjs/session-codec.js

@@ -0,0 +1,55 @@
+import { DateTime } from 'luxon';
+import { replacer as baseReplacer, reviver as baseReviver } from '@spinajs/util';
+/**
+ * Shared session-data serialization codec (fixes B5 — symmetric write/read).
+ *
+ * Persistent session stores (db / dynamodb / redis) use this pair so the
+ * `replacer` used on write and the `reviver` used on read are symmetric and
+ * structural types survive the round-trip:
+ *  - `Map` / `Set` via the shared @spinajs/util replacer/reviver,
+ *  - luxon `DateTime` via a tagged wrapper.
+ *
+ * The in-memory store keeps live objects and does not use this codec.
+ */
+const DATETIME_TAG = 'DateTime';
+/**
+ * `JSON.stringify` replacer. Must read the RAW value from the holder (`this`)
+ * because luxon's `DateTime.prototype.toJSON` would otherwise stringify the
+ * DateTime to an ISO string before we can tag it.
+ */
+function sessionReplacer(key, value) {
+    const raw = this[key];
+    if (raw instanceof DateTime) {
+        return { dataType: DATETIME_TAG, value: raw.toISO() };
+    }
+    return baseReplacer(key, value);
+}
+/**
+ * `JSON.parse` reviver paired with {@link sessionReplacer}.
+ */
+function sessionReviver(key, value) {
+    if (value && typeof value === 'object' && value.dataType === DATETIME_TAG) {
+        return DateTime.fromISO(value.value);
+    }
+    return baseReviver(key, value);
+}
+/**
+ * Serializes a session `Data` map to a JSON string, preserving `Map` / `Set` /
+ * `DateTime` values.
+ *
+ * @param data - the session data map
+ */
+export function encodeSessionData(data) {
+    return JSON.stringify({ dataType: 'Map', value: Array.from(data.entries()) }, sessionReplacer);
+}
+/**
+ * Restores a session `Data` map from a JSON string produced by
+ * {@link encodeSessionData}.
+ *
+ * @param json - the serialized session data
+ */
+export function decodeSessionData(json) {
+    const parsed = JSON.parse(json, sessionReviver);
+    return parsed instanceof Map ? parsed : new Map();
+}
+//# sourceMappingURL=session-codec.js.map

package/lib/mjs/session-codec.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-codec.js","sourceRoot":"","sources":["../../src/session-codec.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AACjC,OAAO,EAAE,QAAQ,IAAI,YAAY,EAAE,OAAO,IAAI,WAAW,EAAmB,MAAM,eAAe,CAAC;AAElG;;;;;;;;;;GAUG;AAEH,MAAM,YAAY,GAAG,UAAU,CAAC;AAEhC;;;;GAIG;AACH,SAAS,eAAe,CAAgC,GAAW,EAAE,KAAc;IACjF,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;IACtB,IAAI,GAAG,YAAY,QAAQ,EAAE,CAAC;QAC5B,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,EAAE,CAAC;IACxD,CAAC;IACD,OAAO,YAAY,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;AAClC,CAAC;AAED;;GAEG;AACH,SAAS,cAAc,CAAC,GAAW,EAAE,KAAgC;IACnE,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAK,KAAyB,CAAC,QAAQ,KAAK,YAAY,EAAE,CAAC;QAC/F,OAAO,QAAQ,CAAC,OAAO,CAAE,KAAyB,CAAC,KAAe,CAAC,CAAC;IACtE,CAAC;IACD,OAAO,WAAW,CAAC,GAAG,EAAE,KAAwB,CAAC,CAAC;AACpD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAA0B;IAC1D,OAAO,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,EAAE,EAAE,eAAe,CAAC,CAAC;AACjG,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;IAChD,OAAO,MAAM,YAAY,GAAG,CAAC,CAAC,CAAE,MAA+B,CAAC,CAAC,CAAC,IAAI,GAAG,EAAmB,CAAC;AAC/F,CAAC"}

package/lib/mjs/session-expiration.d.ts

@@ -0,0 +1,40 @@
+import { DateTime } from 'luxon';
+import { ISession, SessionExpirationProvider } from './interfaces.js';
+/**
+ * Absolute expiration: the session dies at a fixed instant from creation and is
+ * never extended. `touch` is therefore a no-op (renew returns the current
+ * Expiration unchanged).
+ *
+ * Settings: `rbac.session.expiration.ttl` (minutes).
+ */
+export declare class AbsoluteExpiration extends SessionExpirationProvider {
+    protected Ttl: number;
+    initial(session: ISession): DateTime | undefined;
+    renew(session: ISession): DateTime | undefined;
+}
+/**
+ * Sliding expiration: every renewal pushes the expiration to `now + ttl`, with
+ * no upper bound. Activity keeps the session alive indefinitely.
+ *
+ * Settings: `rbac.session.expiration.ttl` (minutes).
+ */
+export declare class SlidingExpiration extends SessionExpirationProvider {
+    protected Ttl: number;
+    initial(_session: ISession): DateTime | undefined;
+    renew(_session: ISession): DateTime | undefined;
+}
+/**
+ * Sliding expiration with an absolute cap: renewal pushes the expiration to
+ * `now + ttl` but never past `Creation + maxLifetime`. Combines idle timeout
+ * with a hard session lifetime ceiling.
+ *
+ * Settings: `rbac.session.expiration.ttl` and
+ * `rbac.session.expiration.maxLifetime` (both minutes).
+ */
+export declare class SlidingCappedExpiration extends SessionExpirationProvider {
+    protected Ttl: number;
+    protected MaxLifetime: number;
+    initial(_session: ISession): DateTime | undefined;
+    renew(session: ISession): DateTime | undefined;
+}
+//# sourceMappingURL=session-expiration.d.ts.map

package/lib/mjs/session-expiration.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-expiration.d.ts","sourceRoot":"","sources":["../../src/session-expiration.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AAGjC,OAAO,EAAE,QAAQ,EAAE,yBAAyB,EAAE,MAAM,iBAAiB,CAAC;AAEtE;;;;;;GAMG;AACH,qBACa,kBAAmB,SAAQ,yBAAyB;IAE/D,SAAS,CAAC,GAAG,EAAG,MAAM,CAAC;IAEhB,OAAO,CAAC,OAAO,EAAE,QAAQ,GAAG,QAAQ,GAAG,SAAS;IAIhD,KAAK,CAAC,OAAO,EAAE,QAAQ,GAAG,QAAQ,GAAG,SAAS;CAItD;AAED;;;;;GAKG;AACH,qBACa,iBAAkB,SAAQ,yBAAyB;IAE9D,SAAS,CAAC,GAAG,EAAG,MAAM,CAAC;IAEhB,OAAO,CAAC,QAAQ,EAAE,QAAQ,GAAG,QAAQ,GAAG,SAAS;IAIjD,KAAK,CAAC,QAAQ,EAAE,QAAQ,GAAG,QAAQ,GAAG,SAAS;CAGvD;AAED;;;;;;;GAOG;AACH,qBACa,uBAAwB,SAAQ,yBAAyB;IAEpE,SAAS,CAAC,GAAG,EAAG,MAAM,CAAC;IAGvB,SAAS,CAAC,WAAW,EAAG,MAAM,CAAC;IAExB,OAAO,CAAC,QAAQ,EAAE,QAAQ,GAAG,QAAQ,GAAG,SAAS;IAIjD,KAAK,CAAC,OAAO,EAAE,QAAQ,GAAG,QAAQ,GAAG,SAAS;CAKtD"}

package/lib/mjs/session-expiration.js

@@ -0,0 +1,90 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+import { DateTime } from 'luxon';
+import { Injectable } from '@spinajs/di';
+import { Config } from '@spinajs/configuration';
+import { SessionExpirationProvider } from './interfaces.js';
+/**
+ * Absolute expiration: the session dies at a fixed instant from creation and is
+ * never extended. `touch` is therefore a no-op (renew returns the current
+ * Expiration unchanged).
+ *
+ * Settings: `rbac.session.expiration.ttl` (minutes).
+ */
+let AbsoluteExpiration = class AbsoluteExpiration extends SessionExpirationProvider {
+    initial(session) {
+        return session.Creation.plus({ minutes: this.Ttl });
+    }
+    renew(session) {
+        // no slide — keep whatever absolute instant was set at creation
+        return session.Expiration;
+    }
+};
+__decorate([
+    Config('rbac.session.expiration.ttl', { defaultValue: 120 }),
+    __metadata("design:type", Number)
+], AbsoluteExpiration.prototype, "Ttl", void 0);
+AbsoluteExpiration = __decorate([
+    Injectable(SessionExpirationProvider)
+], AbsoluteExpiration);
+export { AbsoluteExpiration };
+/**
+ * Sliding expiration: every renewal pushes the expiration to `now + ttl`, with
+ * no upper bound. Activity keeps the session alive indefinitely.
+ *
+ * Settings: `rbac.session.expiration.ttl` (minutes).
+ */
+let SlidingExpiration = class SlidingExpiration extends SessionExpirationProvider {
+    initial(_session) {
+        return DateTime.now().plus({ minutes: this.Ttl });
+    }
+    renew(_session) {
+        return DateTime.now().plus({ minutes: this.Ttl });
+    }
+};
+__decorate([
+    Config('rbac.session.expiration.ttl', { defaultValue: 120 }),
+    __metadata("design:type", Number)
+], SlidingExpiration.prototype, "Ttl", void 0);
+SlidingExpiration = __decorate([
+    Injectable(SessionExpirationProvider)
+], SlidingExpiration);
+export { SlidingExpiration };
+/**
+ * Sliding expiration with an absolute cap: renewal pushes the expiration to
+ * `now + ttl` but never past `Creation + maxLifetime`. Combines idle timeout
+ * with a hard session lifetime ceiling.
+ *
+ * Settings: `rbac.session.expiration.ttl` and
+ * `rbac.session.expiration.maxLifetime` (both minutes).
+ */
+let SlidingCappedExpiration = class SlidingCappedExpiration extends SessionExpirationProvider {
+    initial(_session) {
+        return DateTime.now().plus({ minutes: this.Ttl });
+    }
+    renew(session) {
+        const slide = DateTime.now().plus({ minutes: this.Ttl });
+        const cap = session.Creation.plus({ minutes: this.MaxLifetime });
+        return slide < cap ? slide : cap;
+    }
+};
+__decorate([
+    Config('rbac.session.expiration.ttl', { defaultValue: 120 }),
+    __metadata("design:type", Number)
+], SlidingCappedExpiration.prototype, "Ttl", void 0);
+__decorate([
+    Config('rbac.session.expiration.maxLifetime', { defaultValue: 1440 }),
+    __metadata("design:type", Number)
+], SlidingCappedExpiration.prototype, "MaxLifetime", void 0);
+SlidingCappedExpiration = __decorate([
+    Injectable(SessionExpirationProvider)
+], SlidingCappedExpiration);
+export { SlidingCappedExpiration };
+//# sourceMappingURL=session-expiration.js.map

package/lib/mjs/session-expiration.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-expiration.js","sourceRoot":"","sources":["../../src/session-expiration.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AACjC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAChD,OAAO,EAAY,yBAAyB,EAAE,MAAM,iBAAiB,CAAC;AAEtE;;;;;;GAMG;AAEI,IAAM,kBAAkB,GAAxB,MAAM,kBAAmB,SAAQ,yBAAyB;IAIxD,OAAO,CAAC,OAAiB;QAC9B,OAAO,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IACtD,CAAC;IAEM,KAAK,CAAC,OAAiB;QAC5B,gEAAgE;QAChE,OAAO,OAAO,CAAC,UAAU,CAAC;IAC5B,CAAC;CACF,CAAA;AAVW;IADT,MAAM,CAAC,6BAA6B,EAAE,EAAE,YAAY,EAAE,GAAG,EAAE,CAAC;;+CACtC;AAFZ,kBAAkB;IAD9B,UAAU,CAAC,yBAAyB,CAAC;GACzB,kBAAkB,CAY9B;;AAED;;;;;GAKG;AAEI,IAAM,iBAAiB,GAAvB,MAAM,iBAAkB,SAAQ,yBAAyB;IAIvD,OAAO,CAAC,QAAkB;QAC/B,OAAO,QAAQ,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IACpD,CAAC;IAEM,KAAK,CAAC,QAAkB;QAC7B,OAAO,QAAQ,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IACpD,CAAC;CACF,CAAA;AATW;IADT,MAAM,CAAC,6BAA6B,EAAE,EAAE,YAAY,EAAE,GAAG,EAAE,CAAC;;8CACtC;AAFZ,iBAAiB;IAD7B,UAAU,CAAC,yBAAyB,CAAC;GACzB,iBAAiB,CAW7B;;AAED;;;;;;;GAOG;AAEI,IAAM,uBAAuB,GAA7B,MAAM,uBAAwB,SAAQ,yBAAyB;IAO7D,OAAO,CAAC,QAAkB;QAC/B,OAAO,QAAQ,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IACpD,CAAC;IAEM,KAAK,CAAC,OAAiB;QAC5B,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QACzD,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;QACjE,OAAO,KAAK,GAAG,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC;IACnC,CAAC;CACF,CAAA;AAdW;IADT,MAAM,CAAC,6BAA6B,EAAE,EAAE,YAAY,EAAE,GAAG,EAAE,CAAC;;oDACtC;AAGb;IADT,MAAM,CAAC,qCAAqC,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;;4DACvC;AALpB,uBAAuB;IADnC,UAAU,CAAC,yBAAyB,CAAC;GACzB,uBAAuB,CAgBnC"}

package/lib/mjs/session.d.ts

@@ -1,40 +1,60 @@
 import { DateTime } from 'luxon';
 import { SessionProvider, ISession } from './interfaces.js';
-import { User } from './models/User.js';
 /**
  * Session base class
  */
 export declare class UserSession implements ISession {
-    protected SessionExpirationTime: number;
     SessionId: string;
     /**
-     * Expiration time for session, if null it does not expire
+     * User id that owns this session. Single source of truth for ownership.
      */
-    Expiration: DateTime | undefined;
-    Data: Map<string, unknown>;
+    UserId: number;
     Creation: DateTime;
     /**
-     * User id that owns this session
+     * Expiration time for session, if undefined it does not expire.
+     * Set by the SessionProvider through the configured expiration strategy.
      */
-    UserId: number;
+    Expiration: DateTime | undefined;
+    Data: Map<string, unknown>;
     constructor(session?: Partial<ISession>);
-    /**
-     * Extends lifetime of session
-     *
-     * @param seconds - hom mutch to extend
-     */
-    extend(seconds?: number): void;
 }
 /**
- * Simple session storage in memory, for testing or rapid prototyping
+ * Derives the `ssid` cookie `maxAge` (milliseconds) from a session's real
+ * `Expiration` (fixes B1 — the cookie previously always died at
+ * `expiration * 1000` ms i.e. ~2 minutes). Returns `undefined` for a
+ * never-expiring session (a session cookie), and never a negative value.
+ *
+ * @param session - the session whose expiry drives the cookie lifetime
+ */
+export declare function sessionCookieMaxAge(session: ISession): number | undefined;
+/**
+ * Session-fixation protection helper. Mints a NEW session id, copies the
+ * ownership identity and data across, deletes the old id and persists the new
+ * one. Apply on privilege elevation (login already mints a fresh session, but
+ * 2FA-authorize and role-switch elevate an existing one).
+ *
+ * The returned session carries a new `SessionId` so the caller can reset the
+ * `ssid` cookie. `Expiration` is left unset so `save` schedules a fresh one via
+ * the configured strategy (`Creation` is preserved, so a capped lifetime window
+ * is not extended).
+ *
+ * @param provider - the active session store
+ * @param session - the session to regenerate
+ */
+export declare function regenerateSession(provider: SessionProvider, session: ISession): Promise<ISession>;
+/**
+ * Simple session storage in memory, for testing or rapid prototyping.
+ * Keeps live session objects (no serialization).
  */
 export declare class MemorySessionStore extends SessionProvider<ISession> {
     protected Sessions: Map<string, ISession>;
-    truncate(): Promise<void>;
-    touch(session: ISession): Promise<void>;
     restore(sessionId: string): Promise<ISession | null>;
+    save(session: ISession): Promise<void>;
+    touch(session: ISession): Promise<boolean>;
     delete(sessionId: string): Promise<void>;
-    save(idOrSession: ISession | string, data?: object): Promise<void>;
-    logsOut(user: User): Promise<void>;
+    deleteByUser(userId: number): Promise<void>;
+    listByUser(userId: number): Promise<ISession[]>;
+    truncate(): Promise<void>;
+    private expirationEquals;
 }
 //# sourceMappingURL=session.d.ts.map

package/lib/mjs/session.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../../src/session.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AACjC,OAAO,EAAE,eAAe,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAK5D,OAAO,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAExC;;GAEG;AACH,qBACa,WAAY,YAAW,QAAQ;IAE1C,SAAS,CAAC,qBAAqB,EAAE,MAAM,CAAC;IAEjC,SAAS,EAAE,MAAM,CAAY;IAEpC;;OAEG;IACI,UAAU,EAAE,QAAQ,GAAG,SAAS,CAAa;IAE7C,IAAI,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAa;IAEvC,QAAQ,EAAE,QAAQ,CAAkB;IAE3C;;OAEG;IACI,MAAM,EAAE,MAAM,CAAC;gBAEV,OAAO,CAAC,EAAE,OAAO,CAAC,QAAQ,CAAC;IAMvC;;;;OAIG;IACI,MAAM,CAAC,OAAO,CAAC,EAAE,MAAM;CAG/B;AAED;;GAEG;AACH,qBACa,kBAAmB,SAAQ,eAAe,CAAC,QAAQ,CAAC;IAE/D,SAAS,CAAC,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,CAA+B;IAE3D,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC;IAIzB,KAAK,CAAC,OAAO,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;IAIvC,OAAO,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;IAYpD,MAAM,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAMxC,IAAI,CAAC,WAAW,EAAE,QAAQ,GAAG,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAYxE,OAAO,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;CAgB1C"}
+{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../../src/session.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AACjC,OAAO,EAAE,eAAe,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAI5D;;GAEG;AACH,qBACa,WAAY,YAAW,QAAQ;IACnC,SAAS,EAAE,MAAM,CAAY;IAEpC;;OAEG;IACI,MAAM,EAAE,MAAM,CAAC;IAEf,QAAQ,EAAE,QAAQ,CAAkB;IAE3C;;;OAGG;IACI,UAAU,EAAE,QAAQ,GAAG,SAAS,CAAa;IAE7C,IAAI,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAa;gBAElC,OAAO,CAAC,EAAE,OAAO,CAAC,QAAQ,CAAC;CAKxC;AAED;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,QAAQ,GAAG,MAAM,GAAG,SAAS,CAKzE;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,iBAAiB,CAAC,QAAQ,EAAE,eAAe,EAAE,OAAO,EAAE,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,CAWvG;AAED;;;GAGG;AACH,qBACa,kBAAmB,SAAQ,eAAe,CAAC,QAAQ,CAAC;IAC/D,SAAS,CAAC,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,CAA+B;IAE3D,OAAO,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;IAepD,IAAI,CAAC,OAAO,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;IAWtC,KAAK,CAAC,OAAO,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;IAc1C,MAAM,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIxC,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAQ3C,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC;IAU/C,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC;IAItC,OAAO,CAAC,gBAAgB;CAMzB"}

package/lib/mjs/session.js

@@ -10,94 +10,136 @@ var __metadata = (this && this.__metadata) || function (k, v) {
 import { DateTime } from 'luxon';
 import { SessionProvider } from './interfaces.js';
 import { Injectable, NewInstance } from '@spinajs/di';
-import { Config } from '@spinajs/configuration';
 import { v4 as uuidv4 } from 'uuid';
-import _ from 'lodash';
 /**
  * Session base class
  */
 let UserSession = class UserSession {
     constructor(session) {
         this.SessionId = uuidv4();
+        this.Creation = DateTime.now();
         /**
-         * Expiration time for session, if null it does not expire
+         * Expiration time for session, if undefined it does not expire.
+         * Set by the SessionProvider through the configured expiration strategy.
          */
         this.Expiration = undefined;
         this.Data = new Map();
-        this.Creation = DateTime.now();
         if (session) {
             Object.assign(this, session);
         }
     }
-    /**
-     * Extends lifetime of session
-     *
-     * @param seconds - hom mutch to extend
-     */
-    extend(seconds) {
-        this.Expiration = DateTime.now().plus({ seconds: seconds ? seconds : this.SessionExpirationTime });
-    }
 };
-__decorate([
-    Config('rbac.session.expiration'),
-    __metadata("design:type", Number)
-], UserSession.prototype, "SessionExpirationTime", void 0);
 UserSession = __decorate([
     NewInstance(),
     __metadata("design:paramtypes", [Object])
 ], UserSession);
 export { UserSession };
 /**
- * Simple session storage in memory, for testing or rapid prototyping
+ * Derives the `ssid` cookie `maxAge` (milliseconds) from a session's real
+ * `Expiration` (fixes B1 — the cookie previously always died at
+ * `expiration * 1000` ms i.e. ~2 minutes). Returns `undefined` for a
+ * never-expiring session (a session cookie), and never a negative value.
+ *
+ * @param session - the session whose expiry drives the cookie lifetime
+ */
+export function sessionCookieMaxAge(session) {
+    if (!session.Expiration) {
+        return undefined;
+    }
+    return Math.max(0, Math.floor(session.Expiration.diff(DateTime.now()).milliseconds));
+}
+/**
+ * Session-fixation protection helper. Mints a NEW session id, copies the
+ * ownership identity and data across, deletes the old id and persists the new
+ * one. Apply on privilege elevation (login already mints a fresh session, but
+ * 2FA-authorize and role-switch elevate an existing one).
+ *
+ * The returned session carries a new `SessionId` so the caller can reset the
+ * `ssid` cookie. `Expiration` is left unset so `save` schedules a fresh one via
+ * the configured strategy (`Creation` is preserved, so a capped lifetime window
+ * is not extended).
+ *
+ * @param provider - the active session store
+ * @param session - the session to regenerate
+ */
+export async function regenerateSession(provider, session) {
+    const regenerated = new UserSession({
+        UserId: session.UserId,
+        Creation: session.Creation,
+        Data: new Map(session.Data),
+    });
+    await provider.delete(session.SessionId);
+    await provider.save(regenerated);
+    return regenerated;
+}
+/**
+ * Simple session storage in memory, for testing or rapid prototyping.
+ * Keeps live session objects (no serialization).
  */
 let MemorySessionStore = class MemorySessionStore extends SessionProvider {
     constructor() {
         super(...arguments);
         this.Sessions = new Map();
     }
-    async truncate() {
-        this.Sessions = new Map();
-    }
-    async touch(session) {
-        return this.save(session);
-    }
     async restore(sessionId) {
-        if (this.Sessions.has(sessionId)) {
-            const session = this.Sessions.get(sessionId);
-            if (!session.Expiration || session.Expiration > DateTime.now()) {
-                return session;
-            }
+        const session = this.Sessions.get(sessionId);
+        if (!session) {
             return null;
         }
-        return null;
-    }
-    async delete(sessionId) {
-        if (this.Sessions.has(sessionId)) {
+        // an expired row is treated as absent (and evicted)
+        if (this.isExpired(session)) {
             this.Sessions.delete(sessionId);
+            return null;
         }
+        return session;
     }
-    async save(idOrSession, data) {
-        if (_.isString(idOrSession)) {
-            const s = this.Sessions.get(idOrSession);
-            for (const key in data) {
-                s.Data.set(key, data[key]);
-            }
+    async save(session) {
+        // A brand-new session without a scheduled expiration gets its initial
+        // expiration from the strategy. An already-scheduled expiration is
+        // persisted verbatim (fixes B3 — never recompute on every save).
+        if (session.Expiration === undefined) {
+            this.applyInitialExpiration(session);
         }
-        else {
-            this.Sessions.set(idOrSession.SessionId, idOrSession);
+        this.Sessions.set(session.SessionId, session);
+    }
+    async touch(session) {
+        const current = session.Expiration;
+        const renewed = this.Expiration.renew(session);
+        // no change (e.g. AbsoluteExpiration) — skip the write, report false
+        if (this.expirationEquals(current, renewed)) {
+            return false;
         }
+        session.Expiration = renewed;
+        this.Sessions.set(session.SessionId, session);
+        return true;
+    }
+    async delete(sessionId) {
+        this.Sessions.delete(sessionId);
     }
-    logsOut(user) {
-        const sessionsToDelete = [];
+    async deleteByUser(userId) {
         for (const [key, session] of this.Sessions.entries()) {
-            if (session.UserId === user.Id) {
-                sessionsToDelete.push(key);
+            if (session.UserId === userId) {
+                this.Sessions.delete(key);
             }
         }
-        for (const sessionId of sessionsToDelete) {
-            this.Sessions.delete(sessionId);
+    }
+    async listByUser(userId) {
+        const result = [];
+        for (const session of this.Sessions.values()) {
+            if (session.UserId === userId && !this.isExpired(session)) {
+                result.push(session);
+            }
+        }
+        return result;
+    }
+    async truncate() {
+        this.Sessions = new Map();
+    }
+    expirationEquals(a, b) {
+        if (a === undefined || b === undefined) {
+            return a === b;
         }
-        return Promise.resolve();
+        return a.toMillis() === b.toMillis();
     }
 };
 MemorySessionStore = __decorate([

package/lib/mjs/session.js.map

@@ -1 +1 @@
-{"version":3,"file":"session.js","sourceRoot":"","sources":["../../src/session.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AACjC,OAAO,EAAE,eAAe,EAAY,MAAM,iBAAiB,CAAC;AAC5D,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAChD,OAAO,EAAE,EAAE,IAAI,MAAM,EAAE,MAAM,MAAM,CAAC;AACpC,OAAO,CAAC,MAAM,QAAQ,CAAC;AAGvB;;GAEG;AAEI,IAAM,WAAW,GAAjB,MAAM,WAAW;IAoBtB,YAAY,OAA2B;QAhBhC,cAAS,GAAW,MAAM,EAAE,CAAC;QAEpC;;WAEG;QACI,eAAU,GAAyB,SAAS,CAAC;QAE7C,SAAI,GAAyB,IAAI,GAAG,EAAE,CAAC;QAEvC,aAAQ,GAAa,QAAQ,CAAC,GAAG,EAAE,CAAC;QAQzC,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC;IAED;;;;OAIG;IACI,MAAM,CAAC,OAAgB;QAC5B,IAAI,CAAC,UAAU,GAAG,QAAQ,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,qBAAqB,EAAE,CAAC,CAAC;IACrG,CAAC;CACF,CAAA;AAhCW;IADT,MAAM,CAAC,yBAAyB,CAAC;;0DACM;AAF7B,WAAW;IADvB,WAAW,EAAE;;GACD,WAAW,CAkCvB;;AAED;;GAEG;AAEI,IAAM,kBAAkB,GAAxB,MAAM,kBAAmB,SAAQ,eAAyB;IAA1D;;QAEK,aAAQ,GAA0B,IAAI,GAAG,EAAoB,CAAC;IAwD1E,CAAC;IAtDQ,KAAK,CAAC,QAAQ;QACnB,IAAI,CAAC,QAAQ,GAAG,IAAI,GAAG,EAAoB,CAAC;IAC9C,CAAC;IAEM,KAAK,CAAC,KAAK,CAAC,OAAiB;QAClC,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC5B,CAAC;IAEM,KAAK,CAAC,OAAO,CAAC,SAAiB;QACpC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;YACjC,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAE,CAAC;YAC9C,IAAI,CAAC,OAAO,CAAC,UAAU,IAAI,OAAO,CAAC,UAAU,GAAG,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC;gBAC/D,OAAO,OAAO,CAAC;YACjB,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAEM,KAAK,CAAC,MAAM,CAAC,SAAiB;QACnC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;YACjC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAClC,CAAC;IACH,CAAC;IAEM,KAAK,CAAC,IAAI,CAAC,WAA8B,EAAE,IAAa;QAC7D,IAAI,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;YAC5B,MAAM,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAE,CAAC;YAE1C,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;gBACvB,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAG,IAAY,CAAC,GAAG,CAAC,CAAC,CAAC;YACtC,CAAC;QACH,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;QACxD,CAAC;IACH,CAAC;IAEM,OAAO,CAAC,IAAU;QAEvB,MAAM,gBAAgB,GAAa,EAAE,CAAC;QAEtC,KAAK,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAC;YACrD,IAAI,OAAO,CAAC,MAAM,KAAK,IAAI,CAAC,EAAE,EAAE,CAAC;gBAC/B,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAC7B,CAAC;QACH,CAAC;QAED,KAAK,MAAM,SAAS,IAAI,gBAAgB,EAAE,CAAC;YACzC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAClC,CAAC;QAED,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;IAC3B,CAAC;CACF,CAAA;AA1DY,kBAAkB;IAD9B,UAAU,CAAC,eAAe,CAAC;GACf,kBAAkB,CA0D9B"}
+{"version":3,"file":"session.js","sourceRoot":"","sources":["../../src/session.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AACjC,OAAO,EAAE,eAAe,EAAY,MAAM,iBAAiB,CAAC;AAC5D,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,EAAE,IAAI,MAAM,EAAE,MAAM,MAAM,CAAC;AAEpC;;GAEG;AAEI,IAAM,WAAW,GAAjB,MAAM,WAAW;IAkBtB,YAAY,OAA2B;QAjBhC,cAAS,GAAW,MAAM,EAAE,CAAC;QAO7B,aAAQ,GAAa,QAAQ,CAAC,GAAG,EAAE,CAAC;QAE3C;;;WAGG;QACI,eAAU,GAAyB,SAAS,CAAC;QAE7C,SAAI,GAAyB,IAAI,GAAG,EAAE,CAAC;QAG5C,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC;CACF,CAAA;AAvBY,WAAW;IADvB,WAAW,EAAE;;GACD,WAAW,CAuBvB;;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,mBAAmB,CAAC,OAAiB;IACnD,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC;QACxB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC;AACvF,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,QAAyB,EAAE,OAAiB;IAClF,MAAM,WAAW,GAAG,IAAI,WAAW,CAAC;QAClC,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,IAAI,EAAE,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC;KAC5B,CAAC,CAAC;IAEH,MAAM,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACzC,MAAM,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAEjC,OAAO,WAAW,CAAC;AACrB,CAAC;AAED;;;GAGG;AAEI,IAAM,kBAAkB,GAAxB,MAAM,kBAAmB,SAAQ,eAAyB;IAA1D;;QACK,aAAQ,GAA0B,IAAI,GAAG,EAAoB,CAAC;IA0E1E,CAAC;IAxEQ,KAAK,CAAC,OAAO,CAAC,SAAiB;QACpC,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC7C,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,IAAI,CAAC;QACd,CAAC;QAED,oDAAoD;QACpD,IAAI,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC;YAC5B,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YAChC,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;IAEM,KAAK,CAAC,IAAI,CAAC,OAAiB;QACjC,sEAAsE;QACtE,mEAAmE;QACnE,iEAAiE;QACjE,IAAI,OAAO,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;YACrC,IAAI,CAAC,sBAAsB,CAAC,OAAO,CAAC,CAAC;QACvC,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IAChD,CAAC;IAEM,KAAK,CAAC,KAAK,CAAC,OAAiB;QAClC,MAAM,OAAO,GAAG,OAAO,CAAC,UAAU,CAAC;QACnC,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAE/C,qEAAqE;QACrE,IAAI,IAAI,CAAC,gBAAgB,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,CAAC;YAC5C,OAAO,KAAK,CAAC;QACf,CAAC;QAED,OAAO,CAAC,UAAU,GAAG,OAAO,CAAC;QAC7B,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QAC9C,OAAO,IAAI,CAAC;IACd,CAAC;IAEM,KAAK,CAAC,MAAM,CAAC,SAAiB;QACnC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAClC,CAAC;IAEM,KAAK,CAAC,YAAY,CAAC,MAAc;QACtC,KAAK,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAC;YACrD,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBAC9B,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC5B,CAAC;QACH,CAAC;IACH,CAAC;IAEM,KAAK,CAAC,UAAU,CAAC,MAAc;QACpC,MAAM,MAAM,GAAe,EAAE,CAAC;QAC9B,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;YAC7C,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC1D,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACvB,CAAC;QACH,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAEM,KAAK,CAAC,QAAQ;QACnB,IAAI,CAAC,QAAQ,GAAG,IAAI,GAAG,EAAoB,CAAC;IAC9C,CAAC;IAEO,gBAAgB,CAAC,CAAuB,EAAE,CAAuB;QACvE,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,SAAS,EAAE,CAAC;YACvC,OAAO,CAAC,KAAK,CAAC,CAAC;QACjB,CAAC;QACD,OAAO,CAAC,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,QAAQ,EAAE,CAAC;IACvC,CAAC;CACF,CAAA;AA3EY,kBAAkB;IAD9B,UAAU,CAAC,eAAe,CAAC;GACf,kBAAkB,CA2E9B"}