@sudoplatform/sudo-user 11.0.0 → 12.0.0

package/lib/src/user/auth.d.ts

@@ -0,0 +1,64 @@
+import { Logger } from '@sudoplatform/sudo-common';
+import { AuthenticationStore } from '../core/auth-store';
+import { KeyManager } from '../core/key-manager';
+import { FederatedSignInConfig } from '../core/sdk-config';
+import { Subscriber } from '../core/subscriber';
+import { AuthenticationTokens } from './user-client-interface';
+export interface AuthenticationDetails {
+    authenticationTokens: AuthenticationTokens;
+    userId: string;
+}
+export interface AuthUI {
+    /**
+     * Presents the sign in UI for federated sign in using an external identity provider.
+     */
+    presentFederatedSignInUI(): void;
+    /**
+     * Processes tokens from federated sign in that are returned in exchange
+     * for the authorization code that is returned to the specified URL.
+     *
+     * @param url callback URL containing the authorization code.
+     * @return Successful authentication result AuthenticationTokens.
+     */
+    processFederatedSignInTokens(url: string): Promise<AuthenticationTokens>;
+    /**
+     * Resets any internal state.
+     */
+    reset(): void;
+    /**
+     * Presents the Cognito hosted UI signout endpoint.
+     * When the endpoint is invoked, the hosted web app's cookies
+     * will be invalidated, but the user is not logged out of Cognito.
+     */
+    presentSignOutUI(): void;
+}
+export declare const DefaultRefreshTokenLifetime = 60;
+export declare class CognitoAuthUI implements AuthUI, Subscriber {
+    private authenticationStore;
+    private federatedSignInConfig;
+    private keyManager;
+    private launchUriFn?;
+    private auth;
+    private tokensRefreshedPromise?;
+    private refreshTokenLifetime;
+    private logger;
+    constructor(authenticationStore: AuthenticationStore, federatedSignInConfig: FederatedSignInConfig, keyManager: KeyManager, logger: Logger, launchUriFn?: ((url: string) => void) | undefined);
+    private initCognitoAuthSDK;
+    presentFederatedSignInUI(): void;
+    processFederatedSignInTokens(url: string): Promise<AuthenticationTokens>;
+    /**
+     * This function is called when the authentication store notifies subscribers of an item update.
+     *
+     * @param itemName the name of the item being updated
+     */
+    update(itemName: string): void;
+    reset(): void;
+    presentSignOutUI(): void;
+    private storeRefreshTokenLifetime;
+    private getAuthTokens;
+    private getTokenExpiry;
+    /**
+     * Store the authentication tokens and user id of the signed in user in the key manager.
+     */
+    private storeTokensInKeyManager;
+}

package/lib/src/user/auth.js

@@ -0,0 +1,131 @@
+import { AuthenticationError } from '@sudoplatform/sudo-common';
+import { CognitoAuth } from 'amazon-cognito-auth-js';
+import { apiKeyNames } from '../core/api-key-names';
+import { createResolvablePromise, } from '../utils/resolvable-promise';
+import * as JWT from 'jsonwebtoken';
+import { userKeyNames } from './user-key-names';
+export const DefaultRefreshTokenLifetime = 60;
+export class CognitoAuthUI {
+    constructor(authenticationStore, federatedSignInConfig, keyManager, logger, launchUriFn) {
+        this.authenticationStore = authenticationStore;
+        this.federatedSignInConfig = federatedSignInConfig;
+        this.keyManager = keyManager;
+        this.launchUriFn = launchUriFn;
+        this.authenticationStore.subscribe(this);
+        this.auth = this.initCognitoAuthSDK();
+        const refreshTokenLifetime = this.federatedSignInConfig.refreshTokenLifetime;
+        this.refreshTokenLifetime =
+            refreshTokenLifetime ?? DefaultRefreshTokenLifetime;
+        this.logger = logger;
+    }
+    initCognitoAuthSDK() {
+        const cognitoAuthConfig = {
+            ClientId: this.federatedSignInConfig.appClientId,
+            AppWebDomain: this.federatedSignInConfig.webDomain,
+            IdentityProvider: this.federatedSignInConfig.identityProvider,
+            RedirectUriSignIn: this.federatedSignInConfig.signInRedirectUri,
+            RedirectUriSignOut: this.federatedSignInConfig.signOutRedirectUri,
+            TokenScopesArray: ['openid'],
+            Storage: this.authenticationStore,
+            LaunchUri: this.launchUriFn,
+        };
+        const auth = new CognitoAuth(cognitoAuthConfig);
+        auth.useCodeGrantFlow();
+        auth.userhandler = {
+            onSuccess: (result) => {
+                this.logger.info('Successfully signed in.', { result });
+            },
+            onFailure: (error) => {
+                this.logger.error(new AuthenticationError(error).message);
+            },
+        };
+        return auth;
+    }
+    presentFederatedSignInUI() {
+        this.auth.getSession();
+    }
+    async processFederatedSignInTokens(url) {
+        this.tokensRefreshedPromise =
+            createResolvablePromise();
+        this.auth.parseCognitoWebResponse(url);
+        const authDetails = await this.tokensRefreshedPromise;
+        await this.storeTokensInKeyManager(authDetails);
+        return authDetails.authenticationTokens;
+    }
+    /**
+     * This function is called when the authentication store notifies subscribers of an item update.
+     *
+     * @param itemName the name of the item being updated
+     */
+    update(itemName) {
+        if (itemName === 'idToken') {
+            const authTokens = this.getAuthTokens();
+            const userId = this.authenticationStore.getItem(apiKeyNames.userId);
+            if (authTokens && userId) {
+                this.tokensRefreshedPromise?.resolve({
+                    authenticationTokens: authTokens,
+                    userId,
+                });
+            }
+        }
+        this.logger.debug('Updated: ', { itemName });
+    }
+    reset() {
+        const cognitoAuthAny = this.auth;
+        cognitoAuthAny.clearCachedTokensScopes();
+        cognitoAuthAny.signInUserSession = null;
+        cognitoAuthAny.signInUserSession = cognitoAuthAny.getCachedSession();
+    }
+    presentSignOutUI() {
+        const signOutUrl = this.auth.getFQDNSignOut();
+        this.auth.launchUri(signOutUrl);
+    }
+    async storeRefreshTokenLifetime(refreshTokenLifetime) {
+        const tokenLifetime = refreshTokenLifetime * 24 * 60 * 60 * 1000 + new Date().getTime();
+        await this.keyManager.removeItem(apiKeyNames.refreshTokenExpiry);
+        await this.keyManager.addString(apiKeyNames.refreshTokenExpiry, tokenLifetime.toString());
+    }
+    getAuthTokens() {
+        const idToken = this.authenticationStore.getItem(apiKeyNames.idToken);
+        const accessToken = this.authenticationStore.getItem(apiKeyNames.accessToken);
+        const refreshToken = this.authenticationStore.getItem(apiKeyNames.refreshToken);
+        const tokenExpiry = this.getTokenExpiry();
+        if (idToken && accessToken && refreshToken && tokenExpiry) {
+            return {
+                idToken: idToken,
+                accessToken: accessToken,
+                refreshToken: refreshToken,
+                tokenExpiry: tokenExpiry.getTime(),
+            };
+        }
+        else {
+            return undefined;
+        }
+    }
+    getTokenExpiry() {
+        const expiry = this.authenticationStore.getItem(apiKeyNames.tokenExpiry);
+        return expiry ? new Date(Number(expiry) * 1000) : undefined;
+    }
+    /**
+     * Store the authentication tokens and user id of the signed in user in the key manager.
+     */
+    async storeTokensInKeyManager(authDetails) {
+        await this.keyManager.removeItem(userKeyNames.userId);
+        await this.keyManager.removeItem(apiKeyNames.idToken);
+        await this.keyManager.removeItem(apiKeyNames.accessToken);
+        await this.keyManager.removeItem(apiKeyNames.refreshToken);
+        await this.keyManager.removeItem(apiKeyNames.tokenExpiry);
+        const authTokens = authDetails.authenticationTokens;
+        await this.keyManager.addString(userKeyNames.userId, authDetails.userId);
+        await this.keyManager.addString(apiKeyNames.idToken, authTokens.idToken);
+        await this.keyManager.addString(apiKeyNames.accessToken, authTokens.accessToken);
+        await this.keyManager.addString(apiKeyNames.refreshToken, authTokens.refreshToken);
+        const decoded = JWT.decode(authTokens.idToken, { complete: true });
+        if (decoded) {
+            const tokenExpiry = decoded.payload['exp'];
+            await this.keyManager.addString(apiKeyNames.tokenExpiry, tokenExpiry);
+        }
+        await this.storeRefreshTokenLifetime(this.refreshTokenLifetime);
+    }
+}
+//# sourceMappingURL=auth.js.map

package/lib/src/user/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../../src/user/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAU,MAAM,2BAA2B,CAAA;AACvE,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAA;AACpD,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AAKnD,OAAO,EACL,uBAAuB,GAExB,MAAM,6BAA6B,CAAA;AAEpC,OAAO,KAAK,GAAG,MAAM,cAAc,CAAA;AACnC,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAA;AAgC/C,MAAM,CAAC,MAAM,2BAA2B,GAAG,EAAE,CAAA;AAE7C,MAAM,OAAO,aAAa;IAMxB,YACU,mBAAwC,EACxC,qBAA4C,EAC5C,UAAsB,EAC9B,MAAc,EACN,WAAmC;QAJnC,wBAAmB,GAAnB,mBAAmB,CAAqB;QACxC,0BAAqB,GAArB,qBAAqB,CAAuB;QAC5C,eAAU,GAAV,UAAU,CAAY;QAEtB,gBAAW,GAAX,WAAW,CAAwB;QAE3C,IAAI,CAAC,mBAAmB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;QACxC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,kBAAkB,EAAE,CAAA;QAErC,MAAM,oBAAoB,GAAG,IAAI,CAAC,qBAAqB,CAAC,oBAAoB,CAAA;QAC5E,IAAI,CAAC,oBAAoB;YACvB,oBAAoB,IAAI,2BAA2B,CAAA;QACrD,IAAI,CAAC,MAAM,GAAG,MAAM,CAAA;IACtB,CAAC;IAEO,kBAAkB;QACxB,MAAM,iBAAiB,GAAG;YACxB,QAAQ,EAAE,IAAI,CAAC,qBAAqB,CAAC,WAAW;YAChD,YAAY,EAAE,IAAI,CAAC,qBAAqB,CAAC,SAAS;YAClD,gBAAgB,EAAE,IAAI,CAAC,qBAAqB,CAAC,gBAAgB;YAC7D,iBAAiB,EAAE,IAAI,CAAC,qBAAqB,CAAC,iBAAiB;YAC/D,kBAAkB,EAAE,IAAI,CAAC,qBAAqB,CAAC,kBAAkB;YACjE,gBAAgB,EAAE,CAAC,QAAQ,CAAC;YAC5B,OAAO,EAAE,IAAI,CAAC,mBAAmB;YACjC,SAAS,EAAE,IAAI,CAAC,WAAW;SAC5B,CAAA;QAED,MAAM,IAAI,GAAG,IAAI,WAAW,CAAC,iBAAiB,CAAC,CAAA;QAC/C,IAAI,CAAC,gBAAgB,EAAE,CAAA;QAEvB,IAAI,CAAC,WAAW,GAAG;YACjB,SAAS,EAAE,CAAC,MAAM,EAAE,EAAE;gBACpB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,yBAAyB,EAAE,EAAE,MAAM,EAAE,CAAC,CAAA;YACzD,CAAC;YAED,SAAS,EAAE,CAAC,KAAK,EAAE,EAAE;gBACnB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,mBAAmB,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,CAAA;YAC3D,CAAC;SACF,CAAA;QACD,OAAO,IAAI,CAAA;IACb,CAAC;IAED,wBAAwB;QACtB,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAA;IACxB,CAAC;IAED,KAAK,CAAC,4BAA4B,CAChC,GAAW;QAEX,IAAI,CAAC,sBAAsB;YACzB,uBAAuB,EAAyB,CAAA;QAClD,IAAI,CAAC,IAAI,CAAC,uBAAuB,CAAC,GAAG,CAAC,CAAA;QACtC,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAA;QACrD,MAAM,IAAI,CAAC,uBAAuB,CAAC,WAAW,CAAC,CAAA;QAC/C,OAAO,WAAW,CAAC,oBAAoB,CAAA;IACzC,CAAC;IACD;;;;OAIG;IACH,MAAM,CAAC,QAAgB;QACrB,IAAI,QAAQ,KAAK,SAAS,EAAE;YAC1B,MAAM,UAAU,GAAG,IAAI,CAAC,aAAa,EAAE,CAAA;YACvC,MAAM,MAAM,GAAG,IAAI,CAAC,mBAAmB,CAAC,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,CAAA;YACnE,IAAI,UAAU,IAAI,MAAM,EAAE;gBACxB,IAAI,CAAC,sBAAsB,EAAE,OAAO,CAAC;oBACnC,oBAAoB,EAAE,UAAU;oBAChC,MAAM;iBACP,CAAC,CAAA;aACH;SACF;QACD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAA;IAC9C,CAAC;IAED,KAAK;QACH,MAAM,cAAc,GAAG,IAAI,CAAC,IAAW,CAAA;QACvC,cAAc,CAAC,uBAAuB,EAAE,CAAA;QACxC,cAAc,CAAC,iBAAiB,GAAG,IAAI,CAAA;QACvC,cAAc,CAAC,iBAAiB,GAAG,cAAc,CAAC,gBAAgB,EAAE,CAAA;IACtE,CAAC;IAED,gBAAgB;QACd,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,CAAA;QAC7C,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,CAAA;IACjC,CAAC;IAEO,KAAK,CAAC,yBAAyB,CACrC,oBAA4B;QAE5B,MAAM,aAAa,GACjB,oBAAoB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,IAAI,EAAE,CAAC,OAAO,EAAE,CAAA;QACnE,MAAM,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,WAAW,CAAC,kBAAkB,CAAC,CAAA;QAChE,MAAM,IAAI,CAAC,UAAU,CAAC,SAAS,CAC7B,WAAW,CAAC,kBAAkB,EAC9B,aAAa,CAAC,QAAQ,EAAE,CACzB,CAAA;IACH,CAAC;IAEO,aAAa;QACnB,MAAM,OAAO,GAAG,IAAI,CAAC,mBAAmB,CAAC,OAAO,CAAC,WAAW,CAAC,OAAO,CAAC,CAAA;QACrE,MAAM,WAAW,GAAG,IAAI,CAAC,mBAAmB,CAAC,OAAO,CAClD,WAAW,CAAC,WAAW,CACxB,CAAA;QACD,MAAM,YAAY,GAAG,IAAI,CAAC,mBAAmB,CAAC,OAAO,CACnD,WAAW,CAAC,YAAY,CACzB,CAAA;QACD,MAAM,WAAW,GAAG,IAAI,CAAC,cAAc,EAAE,CAAA;QAEzC,IAAI,OAAO,IAAI,WAAW,IAAI,YAAY,IAAI,WAAW,EAAE;YACzD,OAAO;gBACL,OAAO,EAAE,OAAO;gBAChB,WAAW,EAAE,WAAW;gBACxB,YAAY,EAAE,YAAY;gBAC1B,WAAW,EAAE,WAAW,CAAC,OAAO,EAAE;aACnC,CAAA;SACF;aAAM;YACL,OAAO,SAAS,CAAA;SACjB;IACH,CAAC;IAEO,cAAc;QACpB,MAAM,MAAM,GAAG,IAAI,CAAC,mBAAmB,CAAC,OAAO,CAAC,WAAW,CAAC,WAAW,CAAC,CAAA;QACxE,OAAO,MAAM,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;IAC7D,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,uBAAuB,CACnC,WAAkC;QAElC,MAAM,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,YAAY,CAAC,MAAM,CAAC,CAAA;QACrD,MAAM,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,WAAW,CAAC,OAAO,CAAC,CAAA;QACrD,MAAM,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,WAAW,CAAC,WAAW,CAAC,CAAA;QACzD,MAAM,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,WAAW,CAAC,YAAY,CAAC,CAAA;QAC1D,MAAM,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,WAAW,CAAC,WAAW,CAAC,CAAA;QAEzD,MAAM,UAAU,GAAG,WAAW,CAAC,oBAAoB,CAAA;QACnD,MAAM,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,YAAY,CAAC,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;QACxE,MAAM,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,WAAW,CAAC,OAAO,EAAE,UAAU,CAAC,OAAO,CAAC,CAAA;QACxE,MAAM,IAAI,CAAC,UAAU,CAAC,SAAS,CAC7B,WAAW,CAAC,WAAW,EACvB,UAAU,CAAC,WAAW,CACvB,CAAA;QACD,MAAM,IAAI,CAAC,UAAU,CAAC,SAAS,CAC7B,WAAW,CAAC,YAAY,EACxB,UAAU,CAAC,YAAY,CACxB,CAAA;QAED,MAAM,OAAO,GAAQ,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAA;QACvE,IAAI,OAAO,EAAE;YACX,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;YAC1C,MAAM,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,WAAW,CAAC,WAAW,EAAE,WAAW,CAAC,CAAA;SACtE;QACD,MAAM,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAA;IACjE,CAAC;CACF"}

package/lib/src/user/error.d.ts

@@ -0,0 +1,18 @@
+declare class UserError extends Error {
+    constructor(msg?: string);
+}
+/**
+ * Indicates the user associated with the client is already registered.
+ */
+export declare class AlreadyRegisteredError extends UserError {
+    constructor();
+}
+/**
+ * Indicates the configuration related to Identity Service is not found. This may indicate that Identity Service
+ * is not deployed into your runtime instance or the config file that
+ * you are using is invalid.
+ */
+export declare class IdentityServiceConfigNotFoundError extends UserError {
+    constructor();
+}
+export {};

package/lib/src/user/error.js

@@ -0,0 +1,28 @@
+class UserError extends Error {
+    constructor(msg) {
+        super(msg);
+        this.name = this.constructor.name;
+        if (Error.captureStackTrace) {
+            Error.captureStackTrace(this, this.constructor);
+        }
+    }
+}
+/**
+ * Indicates the user associated with the client is already registered.
+ */
+export class AlreadyRegisteredError extends UserError {
+    constructor() {
+        super('User is already registered.');
+    }
+}
+/**
+ * Indicates the configuration related to Identity Service is not found. This may indicate that Identity Service
+ * is not deployed into your runtime instance or the config file that
+ * you are using is invalid.
+ */
+export class IdentityServiceConfigNotFoundError extends UserError {
+    constructor() {
+        super('Identity service configuration not found.');
+    }
+}
+//# sourceMappingURL=error.js.map

package/lib/src/user/error.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"error.js","sourceRoot":"","sources":["../../../src/user/error.ts"],"names":[],"mappings":"AAAA,MAAM,SAAU,SAAQ,KAAK;IAC3B,YAAY,GAAY;QACtB,KAAK,CAAC,GAAG,CAAC,CAAA;QACV,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,CAAA;QACjC,IAAI,KAAK,CAAC,iBAAiB,EAAE;YAC3B,KAAK,CAAC,iBAAiB,CAAC,IAAI,EAAE,IAAI,CAAC,WAAW,CAAC,CAAA;SAChD;IACH,CAAC;CACF;AAED;;GAEG;AACH,MAAM,OAAO,sBAAuB,SAAQ,SAAS;IACnD;QACE,KAAK,CAAC,6BAA6B,CAAC,CAAA;IACtC,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,OAAO,kCAAmC,SAAQ,SAAS;IAC/D;QACE,KAAK,CAAC,2CAA2C,CAAC,CAAA;IACpD,CAAC;CACF"}

package/lib/src/user/identity-provider.d.ts

@@ -0,0 +1,73 @@
+import { Config } from '../core/sdk-config';
+import { AuthenticationTokens } from './user-client-interface';
+import { KeyManager } from '../core/key-manager';
+import { Logger } from '@sudoplatform/sudo-common';
+export interface IdentityProvider {
+    /**
+     * Signs out the user from all devices.
+     *
+     * @param accessToken access token used to authorize the request.
+     */
+    globalSignOut(accessToken: string): Promise<void>;
+    /**
+     * Registers a new user against the identity provider.
+     *
+     * @param uid user ID.
+     * @param validationData registration parameters.
+     * @return user ID
+     */
+    register(uid: string, validationData: {
+        Name: string;
+        Value: string;
+    }[]): Promise<string>;
+    /**
+     * Sign into the identity provider using a signing key.
+     *
+     * @param uid user ID.
+     * @param keyId signing key id.
+     * @return Successful authentication result AuthenticationTokens
+     */
+    signInWithKey(uid: string, keyId: string): Promise<AuthenticationTokens>;
+    /**
+     * Sign into the identity provider using a token issued by an external
+     * authentication provider.
+     *
+     * @param uid user ID.
+     * @param token authentication token.
+     * @param type token type.
+     * @return Successful authentication result AuthenticationTokens
+     */
+    signInWithToken(uid: string, token: string, type: string): Promise<AuthenticationTokens>;
+    /**
+     * Refresh the access and ID tokens using the refresh token.
+     *
+     * @param refreshToken refresh token used to refresh the access and ID tokens.
+     * @return Successful authentication result AuthenticationTokens containing refreshed tokens
+     */
+    refreshTokens(refreshToken: string): Promise<AuthenticationTokens>;
+    /**
+     * Signs out the user from this device.
+     *
+     * @param refreshToken refresh token to revoke to sign out this device.
+     */
+    signOut(refreshToken: string): Promise<void>;
+}
+export declare class CognitoUserPoolIdentityProvider implements IdentityProvider {
+    private keyManager;
+    private config;
+    private idpService;
+    private refreshTokenLifetime;
+    private logger;
+    constructor(keyManager: KeyManager, config: Config, logger: Logger);
+    private initCognitoIdpService;
+    globalSignOut(accessToken: string): Promise<void>;
+    register(uid: string, validationData: {
+        Name: string;
+        Value: string;
+    }[]): Promise<string>;
+    signInWithKey(userId: string, keyId: string): Promise<AuthenticationTokens>;
+    signInWithToken(userId: string, token: string, type: string): Promise<AuthenticationTokens>;
+    refreshTokens(refreshToken: string): Promise<AuthenticationTokens>;
+    signOut(refreshToken: string): Promise<void>;
+    private storeRefreshTokenLifetime;
+}

package/lib/src/user/identity-provider.js

@@ -0,0 +1,241 @@
+import { CognitoIdentityProviderClient, GlobalSignOutCommand, InitiateAuthCommand, RespondToAuthChallengeCommand, RevokeTokenCommand, SignUpCommand, } from '@aws-sdk/client-cognito-identity-provider';
+import { apiKeyNames } from '../core/api-key-names';
+import { v4 } from 'uuid';
+import { AuthenticationError, NotAuthorizedError, SignOutError, ServiceError, FatalError, UserNotConfirmedError, } from '@sudoplatform/sudo-common';
+import { AlreadyRegisteredError } from './error';
+export class CognitoUserPoolIdentityProvider {
+    constructor(keyManager, config, logger) {
+        this.keyManager = keyManager;
+        this.config = config;
+        this.idpService = this.initCognitoIdpService();
+        const refreshTokenLifetime = this.config.identityService.refreshTokenLifetime;
+        this.refreshTokenLifetime = refreshTokenLifetime ?? 60;
+        this.logger = logger;
+    }
+    initCognitoIdpService() {
+        const idpService = new CognitoIdentityProviderClient({
+            region: this.config.identityService.region,
+        });
+        return idpService;
+    }
+    async globalSignOut(accessToken) {
+        try {
+            const params = {
+                AccessToken: accessToken,
+            };
+            const globalSignOut = new GlobalSignOutCommand(params);
+            const response = await this.idpService.send(globalSignOut);
+            this.logger.info('User successfully signed out.', { response });
+        }
+        catch (err) {
+            const error = err;
+            throw new SignOutError(error.message);
+        }
+    }
+    async register(uid, validationData) {
+        try {
+            const signUp = new SignUpCommand({
+                ValidationData: validationData,
+                Username: uid,
+                Password: `@FF57&Z1)123!-${v4()}`,
+                ClientId: this.config.identityService.clientId,
+            });
+            const response = await this.idpService.send(signUp);
+            if (response.UserConfirmed) {
+                this.logger.info('User successfully signed up.', { uid });
+                return uid;
+            }
+            else {
+                throw new UserNotConfirmedError();
+            }
+        }
+        catch (err) {
+            const error = err;
+            const errorMsg = error.message;
+            if (errorMsg.includes('sudoplatform.ServiceError')) {
+                throw new ServiceError(errorMsg);
+            }
+            else if (errorMsg.includes('sudoplatform.identity.UserValidationFailed') ||
+                errorMsg.includes('sudoplatform.identity.TestRegCheckFailed')) {
+                throw new NotAuthorizedError(errorMsg);
+            }
+            else if (errorMsg.includes('sudoplatform.identity.AlreadyRegistered')) {
+                throw new AlreadyRegisteredError();
+            }
+            else {
+                throw new FatalError(errorMsg);
+            }
+        }
+    }
+    async signInWithKey(userId, keyId) {
+        try {
+            const initiateAuthCommand = new InitiateAuthCommand({
+                ClientId: this.config.identityService.clientId,
+                AuthFlow: 'CUSTOM_AUTH',
+                AuthParameters: {
+                    USERNAME: userId,
+                },
+            });
+            const initiateAuthResult = await this.idpService.send(initiateAuthCommand);
+            const challengeName = initiateAuthResult.ChallengeName;
+            const session = initiateAuthResult.Session;
+            const params = initiateAuthResult.ChallengeParameters;
+            if (params &&
+                params['nonce'] &&
+                params['audience'] &&
+                challengeName &&
+                session) {
+                const nonce = params['nonce'];
+                const audience = params['audience'];
+                const answer = await this.keyManager.signJWT(keyId, {
+                    jti: nonce,
+                    iss: userId,
+                    aud: audience,
+                    sub: userId,
+                    exp: Math.floor(+new Date() / 1000) + 300,
+                });
+                const respondToAuthChallenge = new RespondToAuthChallengeCommand({
+                    Session: session,
+                    ClientId: this.config.identityService.clientId,
+                    ChallengeName: challengeName,
+                    ChallengeResponses: {
+                        USERNAME: userId,
+                        ANSWER: answer,
+                    },
+                });
+                const respondToAuthChallengeResult = await this.idpService.send(respondToAuthChallenge);
+                const authResult = respondToAuthChallengeResult.AuthenticationResult;
+                const idToken = authResult?.IdToken;
+                const accessToken = authResult?.AccessToken;
+                const refreshToken = authResult?.RefreshToken;
+                const tokenExpiry = authResult?.ExpiresIn;
+                if (idToken && accessToken && refreshToken && tokenExpiry) {
+                    const authTokens = {
+                        idToken: idToken,
+                        accessToken: accessToken,
+                        refreshToken: refreshToken,
+                        tokenExpiry: tokenExpiry,
+                    };
+                    await this.storeRefreshTokenLifetime(this.refreshTokenLifetime);
+                    return authTokens;
+                }
+                else {
+                    throw new AuthenticationError('Authentication tokens not found.');
+                }
+            }
+            else {
+                throw new AuthenticationError('Invalid initiate auth result.');
+            }
+        }
+        catch (err) {
+            const error = err;
+            throw new AuthenticationError(error.message);
+        }
+    }
+    async signInWithToken(userId, token, type) {
+        try {
+            const initiateAuth = new InitiateAuthCommand({
+                ClientId: this.config.identityService.clientId,
+                AuthFlow: 'CUSTOM_AUTH',
+                AuthParameters: {
+                    USERNAME: userId,
+                },
+            });
+            const initiateAuthResult = await this.idpService.send(initiateAuth);
+            const challengeName = initiateAuthResult.ChallengeName;
+            const session = initiateAuthResult.Session;
+            if (challengeName && session) {
+                const respondToAuthChallenge = new RespondToAuthChallengeCommand({
+                    Session: session,
+                    ClientId: this.config.identityService.clientId,
+                    ChallengeName: challengeName,
+                    ChallengeResponses: {
+                        USERNAME: userId,
+                        ANSWER: token,
+                    },
+                    ClientMetadata: { challengeType: type },
+                });
+                const respondToAuthChallengeResult = await this.idpService.send(respondToAuthChallenge);
+                const authResult = respondToAuthChallengeResult.AuthenticationResult;
+                const idToken = authResult?.IdToken;
+                const accessToken = authResult?.AccessToken;
+                const refreshToken = authResult?.RefreshToken;
+                const tokenExpiry = authResult?.ExpiresIn;
+                if (idToken && accessToken && refreshToken && tokenExpiry) {
+                    const authTokens = {
+                        idToken: idToken,
+                        accessToken: accessToken,
+                        refreshToken: refreshToken,
+                        tokenExpiry: tokenExpiry,
+                    };
+                    await this.storeRefreshTokenLifetime(this.refreshTokenLifetime);
+                    return authTokens;
+                }
+                else {
+                    throw new AuthenticationError('Authentication tokens not found.');
+                }
+            }
+            else {
+                throw new AuthenticationError('Invalid initiate auth result.');
+            }
+        }
+        catch (err) {
+            const error = err;
+            throw new AuthenticationError(error.message);
+        }
+    }
+    async refreshTokens(refreshToken) {
+        try {
+            const initiateAuth = new InitiateAuthCommand({
+                ClientId: this.config.identityService.clientId,
+                AuthFlow: 'REFRESH_TOKEN_AUTH',
+                AuthParameters: {
+                    REFRESH_TOKEN: refreshToken,
+                },
+            });
+            const initiateAuthResult = await this.idpService.send(initiateAuth);
+            const idToken = initiateAuthResult.AuthenticationResult?.IdToken;
+            const accessToken = initiateAuthResult.AuthenticationResult?.AccessToken;
+            const tokenExpiry = initiateAuthResult.AuthenticationResult?.ExpiresIn;
+            if (idToken && accessToken && tokenExpiry) {
+                const authTokens = {
+                    idToken: idToken,
+                    accessToken: accessToken,
+                    refreshToken: refreshToken,
+                    tokenExpiry: tokenExpiry,
+                };
+                await this.storeRefreshTokenLifetime(this.refreshTokenLifetime);
+                return authTokens;
+            }
+            else {
+                throw new AuthenticationError('Authentication tokens not found.');
+            }
+        }
+        catch (err) {
+            const error = err;
+            throw new AuthenticationError(error.message);
+        }
+    }
+    async signOut(refreshToken) {
+        try {
+            const params = {
+                Token: refreshToken,
+                ClientId: this.config.identityService.clientId,
+            };
+            const revokeToken = new RevokeTokenCommand(params);
+            const response = await this.idpService.send(revokeToken);
+            this.logger.info('User successfully signed out.', { response });
+        }
+        catch (err) {
+            const error = err;
+            this.logger.error(error.message);
+            throw new SignOutError(error.message);
+        }
+    }
+    async storeRefreshTokenLifetime(refreshTokenLifetime) {
+        const tokenLifetime = refreshTokenLifetime * 24 * 60 * 60 * 1000 + new Date().getTime();
+        await this.keyManager.removeItem(apiKeyNames.refreshTokenExpiry);
+        await this.keyManager.addString(apiKeyNames.refreshTokenExpiry, tokenLifetime.toString());
+    }
+}
+//# sourceMappingURL=identity-provider.js.map

package/lib/src/user/identity-provider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity-provider.js","sourceRoot":"","sources":["../../../src/user/identity-provider.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,6BAA6B,EAC7B,oBAAoB,EACpB,mBAAmB,EACnB,6BAA6B,EAC7B,kBAAkB,EAClB,aAAa,GACd,MAAM,2CAA2C,CAAA;AAElD,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AAGnD,OAAO,EAAE,EAAE,EAAE,MAAM,MAAM,CAAA;AACzB,OAAO,EACL,mBAAmB,EACnB,kBAAkB,EAClB,YAAY,EACZ,YAAY,EACZ,UAAU,EACV,qBAAqB,GAEtB,MAAM,2BAA2B,CAAA;AAClC,OAAO,EAAE,sBAAsB,EAAE,MAAM,SAAS,CAAA;AA4DhD,MAAM,OAAO,+BAA+B;IAK1C,YACU,UAAsB,EACtB,MAAc,EACtB,MAAc;QAFN,eAAU,GAAV,UAAU,CAAY;QACtB,WAAM,GAAN,MAAM,CAAQ;QAGtB,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,qBAAqB,EAAE,CAAA;QAE9C,MAAM,oBAAoB,GACxB,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,oBAAoB,CAAA;QAClD,IAAI,CAAC,oBAAoB,GAAG,oBAAoB,IAAI,EAAE,CAAA;QACtD,IAAI,CAAC,MAAM,GAAG,MAAM,CAAA;IACtB,CAAC;IAEO,qBAAqB;QAC3B,MAAM,UAAU,GAAG,IAAI,6BAA6B,CAAC;YACnD,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,MAAM;SAC3C,CAAC,CAAA;QAEF,OAAO,UAAU,CAAA;IACnB,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,WAAmB;QACrC,IAAI;YACF,MAAM,MAAM,GAAG;gBACb,WAAW,EAAE,WAAW;aACzB,CAAA;YACD,MAAM,aAAa,GAAG,IAAI,oBAAoB,CAAC,MAAM,CAAC,CAAA;YACtD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,aAAa,CAAC,CAAA;YAC1D,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,+BAA+B,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAA;SAChE;QAAC,OAAO,GAAG,EAAE;YACZ,MAAM,KAAK,GAAG,GAAY,CAAA;YAC1B,MAAM,IAAI,YAAY,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;SACtC;IACH,CAAC;IAED,KAAK,CAAC,QAAQ,CACZ,GAAW,EACX,cAAiD;QAEjD,IAAI;YACF,MAAM,MAAM,GAAG,IAAI,aAAa,CAAC;gBAC/B,cAAc,EAAE,cAAc;gBAC9B,QAAQ,EAAE,GAAG;gBACb,QAAQ,EAAE,iBAAiB,EAAE,EAAE,EAAE;gBACjC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,QAAQ;aAC/C,CAAC,CAAA;YACF,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;YAEnD,IAAI,QAAQ,CAAC,aAAa,EAAE;gBAC1B,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,8BAA8B,EAAE,EAAE,GAAG,EAAE,CAAC,CAAA;gBACzD,OAAO,GAAG,CAAA;aACX;iBAAM;gBACL,MAAM,IAAI,qBAAqB,EAAE,CAAA;aAClC;SACF;QAAC,OAAO,GAAG,EAAE;YACZ,MAAM,KAAK,GAAG,GAAY,CAAA;YAC1B,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAA;YAC9B,IAAI,QAAQ,CAAC,QAAQ,CAAC,2BAA2B,CAAC,EAAE;gBAClD,MAAM,IAAI,YAAY,CAAC,QAAQ,CAAC,CAAA;aACjC;iBAAM,IACL,QAAQ,CAAC,QAAQ,CAAC,4CAA4C,CAAC;gBAC/D,QAAQ,CAAC,QAAQ,CAAC,0CAA0C,CAAC,EAC7D;gBACA,MAAM,IAAI,kBAAkB,CAAC,QAAQ,CAAC,CAAA;aACvC;iBAAM,IAAI,QAAQ,CAAC,QAAQ,CAAC,yCAAyC,CAAC,EAAE;gBACvE,MAAM,IAAI,sBAAsB,EAAE,CAAA;aACnC;iBAAM;gBACL,MAAM,IAAI,UAAU,CAAC,QAAQ,CAAC,CAAA;aAC/B;SACF;IACH,CAAC;IAED,KAAK,CAAC,aAAa,CACjB,MAAc,EACd,KAAa;QAEb,IAAI;YACF,MAAM,mBAAmB,GAAG,IAAI,mBAAmB,CAAC;gBAClD,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,QAAQ;gBAC9C,QAAQ,EAAE,aAAa;gBACvB,cAAc,EAAE;oBACd,QAAQ,EAAE,MAAM;iBACjB;aACF,CAAC,CAAA;YACF,MAAM,kBAAkB,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAA;YAE1E,MAAM,aAAa,GAAG,kBAAkB,CAAC,aAAa,CAAA;YACtD,MAAM,OAAO,GAAG,kBAAkB,CAAC,OAAO,CAAA;YAC1C,MAAM,MAAM,GAAG,kBAAkB,CAAC,mBAAmB,CAAA;YAErD,IACE,MAAM;gBACN,MAAM,CAAC,OAAO,CAAC;gBACf,MAAM,CAAC,UAAU,CAAC;gBAClB,aAAa;gBACb,OAAO,EACP;gBACA,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,CAAA;gBAC7B,MAAM,QAAQ,GAAG,MAAM,CAAC,UAAU,CAAC,CAAA;gBAEnC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,KAAK,EAAE;oBAClD,GAAG,EAAE,KAAK;oBACV,GAAG,EAAE,MAAM;oBACX,GAAG,EAAE,QAAQ;oBACb,GAAG,EAAE,MAAM;oBACX,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,IAAI,EAAE,GAAG,IAAI,CAAC,GAAG,GAAG;iBAC1C,CAAC,CAAA;gBAEF,MAAM,sBAAsB,GAAG,IAAI,6BAA6B,CAAC;oBAC/D,OAAO,EAAE,OAAO;oBAChB,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,QAAQ;oBAC9C,aAAa,EAAE,aAAa;oBAC5B,kBAAkB,EAAE;wBAClB,QAAQ,EAAE,MAAM;wBAChB,MAAM,EAAE,MAAM;qBACf;iBACF,CAAC,CAAA;gBACF,MAAM,4BAA4B,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,CAC7D,sBAAsB,CACvB,CAAA;gBAED,MAAM,UAAU,GAAG,4BAA4B,CAAC,oBAAoB,CAAA;gBACpE,MAAM,OAAO,GAAG,UAAU,EAAE,OAAO,CAAA;gBACnC,MAAM,WAAW,GAAG,UAAU,EAAE,WAAW,CAAA;gBAC3C,MAAM,YAAY,GAAG,UAAU,EAAE,YAAY,CAAA;gBAC7C,MAAM,WAAW,GAAG,UAAU,EAAE,SAAS,CAAA;gBAEzC,IAAI,OAAO,IAAI,WAAW,IAAI,YAAY,IAAI,WAAW,EAAE;oBACzD,MAAM,UAAU,GAAG;wBACjB,OAAO,EAAE,OAAO;wBAChB,WAAW,EAAE,WAAW;wBACxB,YAAY,EAAE,YAAY;wBAC1B,WAAW,EAAE,WAAW;qBACzB,CAAA;oBACD,MAAM,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAA;oBAC/D,OAAO,UAAU,CAAA;iBAClB;qBAAM;oBACL,MAAM,IAAI,mBAAmB,CAAC,kCAAkC,CAAC,CAAA;iBAClE;aACF;iBAAM;gBACL,MAAM,IAAI,mBAAmB,CAAC,+BAA+B,CAAC,CAAA;aAC/D;SACF;QAAC,OAAO,GAAG,EAAE;YACZ,MAAM,KAAK,GAAG,GAAY,CAAA;YAC1B,MAAM,IAAI,mBAAmB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;SAC7C;IACH,CAAC;IAED,KAAK,CAAC,eAAe,CACnB,MAAc,EACd,KAAa,EACb,IAAY;QAEZ,IAAI;YACF,MAAM,YAAY,GAAG,IAAI,mBAAmB,CAAC;gBAC3C,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,QAAQ;gBAC9C,QAAQ,EAAE,aAAa;gBACvB,cAAc,EAAE;oBACd,QAAQ,EAAE,MAAM;iBACjB;aACF,CAAC,CAAA;YACF,MAAM,kBAAkB,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,YAAY,CAAC,CAAA;YAEnE,MAAM,aAAa,GAAG,kBAAkB,CAAC,aAAa,CAAA;YACtD,MAAM,OAAO,GAAG,kBAAkB,CAAC,OAAO,CAAA;YAE1C,IAAI,aAAa,IAAI,OAAO,EAAE;gBAC5B,MAAM,sBAAsB,GAAG,IAAI,6BAA6B,CAAC;oBAC/D,OAAO,EAAE,OAAO;oBAChB,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,QAAQ;oBAC9C,aAAa,EAAE,aAAa;oBAC5B,kBAAkB,EAAE;wBAClB,QAAQ,EAAE,MAAM;wBAChB,MAAM,EAAE,KAAK;qBACd;oBACD,cAAc,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE;iBACxC,CAAC,CAAA;gBACF,MAAM,4BAA4B,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,CAC7D,sBAAsB,CACvB,CAAA;gBAED,MAAM,UAAU,GAAG,4BAA4B,CAAC,oBAAoB,CAAA;gBACpE,MAAM,OAAO,GAAG,UAAU,EAAE,OAAO,CAAA;gBACnC,MAAM,WAAW,GAAG,UAAU,EAAE,WAAW,CAAA;gBAC3C,MAAM,YAAY,GAAG,UAAU,EAAE,YAAY,CAAA;gBAC7C,MAAM,WAAW,GAAG,UAAU,EAAE,SAAS,CAAA;gBAEzC,IAAI,OAAO,IAAI,WAAW,IAAI,YAAY,IAAI,WAAW,EAAE;oBACzD,MAAM,UAAU,GAAG;wBACjB,OAAO,EAAE,OAAO;wBAChB,WAAW,EAAE,WAAW;wBACxB,YAAY,EAAE,YAAY;wBAC1B,WAAW,EAAE,WAAW;qBACzB,CAAA;oBACD,MAAM,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAA;oBAC/D,OAAO,UAAU,CAAA;iBAClB;qBAAM;oBACL,MAAM,IAAI,mBAAmB,CAAC,kCAAkC,CAAC,CAAA;iBAClE;aACF;iBAAM;gBACL,MAAM,IAAI,mBAAmB,CAAC,+BAA+B,CAAC,CAAA;aAC/D;SACF;QAAC,OAAO,GAAG,EAAE;YACZ,MAAM,KAAK,GAAG,GAAY,CAAA;YAC1B,MAAM,IAAI,mBAAmB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;SAC7C;IACH,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,YAAoB;QACtC,IAAI;YACF,MAAM,YAAY,GAAG,IAAI,mBAAmB,CAAC;gBAC3C,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,QAAQ;gBAC9C,QAAQ,EAAE,oBAAoB;gBAC9B,cAAc,EAAE;oBACd,aAAa,EAAE,YAAY;iBAC5B;aACF,CAAC,CAAA;YACF,MAAM,kBAAkB,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,YAAY,CAAC,CAAA;YAEnE,MAAM,OAAO,GAAG,kBAAkB,CAAC,oBAAoB,EAAE,OAAO,CAAA;YAChE,MAAM,WAAW,GAAG,kBAAkB,CAAC,oBAAoB,EAAE,WAAW,CAAA;YACxE,MAAM,WAAW,GAAG,kBAAkB,CAAC,oBAAoB,EAAE,SAAS,CAAA;YAEtE,IAAI,OAAO,IAAI,WAAW,IAAI,WAAW,EAAE;gBACzC,MAAM,UAAU,GAAG;oBACjB,OAAO,EAAE,OAAO;oBAChB,WAAW,EAAE,WAAW;oBACxB,YAAY,EAAE,YAAY;oBAC1B,WAAW,EAAE,WAAW;iBACzB,CAAA;gBACD,MAAM,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAA;gBAC/D,OAAO,UAAU,CAAA;aAClB;iBAAM;gBACL,MAAM,IAAI,mBAAmB,CAAC,kCAAkC,CAAC,CAAA;aAClE;SACF;QAAC,OAAO,GAAG,EAAE;YACZ,MAAM,KAAK,GAAG,GAAY,CAAA;YAC1B,MAAM,IAAI,mBAAmB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;SAC7C;IACH,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,YAAoB;QAChC,IAAI;YACF,MAAM,MAAM,GAAG;gBACb,KAAK,EAAE,YAAY;gBACnB,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,QAAQ;aAC/C,CAAA;YACD,MAAM,WAAW,GAAG,IAAI,kBAAkB,CAAC,MAAM,CAAC,CAAA;YAClD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;YACxD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,+BAA+B,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAA;SAChE;QAAC,OAAO,GAAG,EAAE;YACZ,MAAM,KAAK,GAAG,GAAY,CAAA;YAC1B,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;YAChC,MAAM,IAAI,YAAY,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;SACtC;IACH,CAAC;IAEO,KAAK,CAAC,yBAAyB,CACrC,oBAA4B;QAE5B,MAAM,aAAa,GACjB,oBAAoB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,IAAI,EAAE,CAAC,OAAO,EAAE,CAAA;QACnE,MAAM,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,WAAW,CAAC,kBAAkB,CAAC,CAAA;QAChE,MAAM,IAAI,CAAC,UAAU,CAAC,SAAS,CAC7B,WAAW,CAAC,kBAAkB,EAC9B,aAAa,CAAC,QAAQ,EAAE,CACzB,CAAA;IACH,CAAC;CACF"}