@sync-in/server 1.10.1 → 2.0.0

package/server/authentication/services/auth-methods/auth-method-ldap.service.spec.js

@@ -1,534 +0,0 @@
-/*
- * Copyright (C) 2012-2025 Johan Legrand <johan.legrand@sync-in.com>
- * This file is part of Sync-in | The open source file sync and share solution
- * See the LICENSE file for licensing details
- */ "use strict";
-Object.defineProperty(exports, "__esModule", {
-    value: true
-});
-const _testing = require("@nestjs/testing");
-const _ldapts = require("ldapts");
-const _appconstants = require("../../../app.constants");
-const _adminusersmanagerservice = require("../../../applications/users/services/admin-users-manager.service");
-const _usersmanagerservice = require("../../../applications/users/services/users-manager.service");
-const _functions = /*#__PURE__*/ _interop_require_wildcard(require("../../../common/functions"));
-const _configenvironment = require("../../../configuration/config.environment");
-const _authldap = require("../../constants/auth-ldap");
-const _authmethodldapservice = require("./auth-method-ldap.service");
-function _getRequireWildcardCache(nodeInterop) {
-    if (typeof WeakMap !== "function") return null;
-    var cacheBabelInterop = new WeakMap();
-    var cacheNodeInterop = new WeakMap();
-    return (_getRequireWildcardCache = function(nodeInterop) {
-        return nodeInterop ? cacheNodeInterop : cacheBabelInterop;
-    })(nodeInterop);
-}
-function _interop_require_wildcard(obj, nodeInterop) {
-    if (!nodeInterop && obj && obj.__esModule) {
-        return obj;
-    }
-    if (obj === null || typeof obj !== "object" && typeof obj !== "function") {
-        return {
-            default: obj
-        };
-    }
-    var cache = _getRequireWildcardCache(nodeInterop);
-    if (cache && cache.has(obj)) {
-        return cache.get(obj);
-    }
-    var newObj = {
-        __proto__: null
-    };
-    var hasPropertyDescriptor = Object.defineProperty && Object.getOwnPropertyDescriptor;
-    for(var key in obj){
-        if (key !== "default" && Object.prototype.hasOwnProperty.call(obj, key)) {
-            var desc = hasPropertyDescriptor ? Object.getOwnPropertyDescriptor(obj, key) : null;
-            if (desc && (desc.get || desc.set)) {
-                Object.defineProperty(newObj, key, desc);
-            } else {
-                newObj[key] = obj[key];
-            }
-        }
-    }
-    newObj.default = obj;
-    if (cache) {
-        cache.set(obj, newObj);
-    }
-    return newObj;
-}
-// Mock ldapts Client to simulate LDAP behaviors
-jest.mock('ldapts', ()=>{
-    const actual = jest.requireActual('ldapts');
-    const mockClientInstance = {
-        bind: jest.fn(),
-        search: jest.fn(),
-        unbind: jest.fn()
-    };
-    const Client = jest.fn().mockImplementation(()=>mockClientInstance);
-    // Conserver tous les autres exports réels (dont EqualityFilter, AndFilter, InvalidCredentialsError, etc.)
-    return {
-        ...actual,
-        Client
-    };
-});
-// --- Test helpers (DRY) ---
-// Reusable LDAP mocks
-const mockBindResolve = (ldapClient)=>{
-    ldapClient.bind.mockResolvedValue(undefined);
-    ldapClient.unbind.mockResolvedValue(undefined);
-};
-const mockBindRejectInvalid = (ldapClient, InvalidCredentialsErrorCtor, message = 'invalid')=>{
-    ldapClient.bind.mockRejectedValue(new InvalidCredentialsErrorCtor(message));
-    ldapClient.unbind.mockResolvedValue(undefined);
-};
-const mockSearchEntries = (ldapClient, entries)=>{
-    ldapClient.search.mockResolvedValue({
-        searchEntries: entries
-    });
-};
-const mockSearchReject = (ldapClient, err)=>{
-    ldapClient.search.mockRejectedValue(err);
-};
-// User factory
-const buildUser = (overrides = {})=>({
-        id: 0,
-        login: 'john',
-        email: 'old@example.org',
-        password: 'hashed',
-        isGuest: false,
-        isActive: true,
-        makePaths: jest.fn().mockResolvedValue(undefined),
-        setFullName: jest.fn(),
-        ...overrides
-    });
-// --------------------------
-describe(_authmethodldapservice.AuthMethodLdapService.name, ()=>{
-    let authMethodLdapService;
-    let usersManager;
-    let adminUsersManager;
-    const ldapClient = {
-        bind: jest.fn(),
-        search: jest.fn(),
-        unbind: jest.fn()
-    };
-    _ldapts.Client.mockImplementation(()=>ldapClient);
-    // Local helpers (need access to authMethodLdapService and ldapClient in this scope)
-    const setupLdapSuccess = (entries)=>{
-        mockBindResolve(ldapClient);
-        mockSearchEntries(ldapClient, entries);
-    };
-    const spyLoggerError = ()=>jest.spyOn(authMethodLdapService['logger'], 'error').mockImplementation(()=>undefined);
-    beforeAll(async ()=>{
-        _configenvironment.configuration.auth.ldap = {
-            servers: [
-                'ldap://localhost:389'
-            ],
-            attributes: {
-                login: _authldap.LDAP_LOGIN_ATTR.UID,
-                email: 'mail'
-            },
-            baseDN: 'ou=people,dc=example,dc=org',
-            filter: ''
-        };
-        const module = await _testing.Test.createTestingModule({
-            providers: [
-                _authmethodldapservice.AuthMethodLdapService,
-                {
-                    provide: _usersmanagerservice.UsersManager,
-                    useValue: {
-                        findUser: jest.fn(),
-                        logUser: jest.fn(),
-                        updateAccesses: jest.fn().mockResolvedValue(undefined),
-                        validateAppPassword: jest.fn(),
-                        fromUserId: jest.fn()
-                    }
-                },
-                {
-                    provide: _adminusersmanagerservice.AdminUsersManager,
-                    useValue: {
-                        createUserOrGuest: jest.fn(),
-                        updateUserOrGuest: jest.fn()
-                    }
-                }
-            ]
-        }).compile();
-        module.useLogger([
-            'fatal'
-        ]);
-        authMethodLdapService = module.get(_authmethodldapservice.AuthMethodLdapService);
-        adminUsersManager = module.get(_adminusersmanagerservice.AdminUsersManager);
-        usersManager = module.get(_usersmanagerservice.UsersManager);
-    });
-    it('should be defined', ()=>{
-        expect(authMethodLdapService).toBeDefined();
-        expect(usersManager).toBeDefined();
-        expect(adminUsersManager).toBeDefined();
-        expect(ldapClient).toBeDefined();
-    });
-    it('should authenticate a guest user via database and bypass LDAP', async ()=>{
-        // Arrange
-        const guestUser = {
-            id: 1,
-            login: 'guest1',
-            isGuest: true,
-            isActive: true
-        };
-        usersManager.findUser.mockResolvedValue(guestUser);
-        const dbAuthResult = {
-            ...guestUser,
-            token: 'jwt'
-        };
-        usersManager.logUser.mockResolvedValue(dbAuthResult);
-        const res = await authMethodLdapService.validateUser('guest1', 'pass', '127.0.0.1');
-        expect(res).toEqual(dbAuthResult);
-        expect(usersManager.logUser).toHaveBeenCalledWith(guestUser, 'pass', '127.0.0.1');
-        expect(_ldapts.Client).not.toHaveBeenCalled(); // client should not be constructed
-    });
-    it('should throw FORBIDDEN for locked account and resolve null for LDAP login mismatch', async ()=>{
-        // Phase 1: locked account
-        usersManager.findUser.mockResolvedValue({
-            login: 'john',
-            isGuest: false,
-            isActive: false
-        });
-        const loggerErrorSpy1 = jest.spyOn(authMethodLdapService['logger'], 'error').mockImplementation(()=>undefined);
-        await expect(authMethodLdapService.validateUser('john', 'pwd')).rejects.toThrow(/account locked/i);
-        expect(loggerErrorSpy1).toHaveBeenCalled();
-        // Phase 2: mismatch between requested login and LDAP returned login -> service renvoie null
-        const existingUser = buildUser({
-            id: 8
-        });
-        usersManager.findUser.mockResolvedValue(existingUser);
-        mockBindResolve(ldapClient);
-        mockSearchEntries(ldapClient, [
-            {
-                uid: 'jane',
-                cn: 'john',
-                mail: 'jane@example.org'
-            }
-        ]);
-        await expect(authMethodLdapService.validateUser('john', 'pwd')).rejects.toThrow(/account matching error/i);
-    });
-    it('should handle invalid LDAP credentials for both existing and unknown users', async ()=>{
-        // Phase 1: existing user -> updateAccesses invoked with success=false and logger.error intercepted
-        const existingUser = buildUser({
-            id: 1
-        });
-        usersManager.findUser.mockResolvedValue(existingUser);
-        // Make LDAP bind throw InvalidCredentialsError
-        mockBindRejectInvalid(ldapClient, _ldapts.InvalidCredentialsError, 'invalid credentials');
-        // Force updateAccesses to reject to hit the catch and logger.error
-        const loggerErrorSpy = jest.spyOn(authMethodLdapService['logger'], 'error').mockImplementation(()=>undefined);
-        usersManager.updateAccesses.mockRejectedValueOnce(new Error('updateAccesses boom'));
-        const res1 = await authMethodLdapService.validateUser('john', 'badpwd', '10.0.0.1');
-        expect(res1).toBeNull();
-        expect(usersManager.updateAccesses).toHaveBeenCalledWith(existingUser, '10.0.0.1', false);
-        expect(loggerErrorSpy).toHaveBeenCalled();
-        // Phase 2: unknown user → no access update
-        usersManager.updateAccesses.mockClear();
-        usersManager.findUser.mockResolvedValue(null);
-        ldapClient.bind.mockRejectedValue(new _ldapts.InvalidCredentialsError('invalid'));
-        ldapClient.unbind.mockResolvedValue(undefined);
-        const res2 = await authMethodLdapService.validateUser('jane', 'badpwd');
-        expect(res2).toBeNull();
-        expect(usersManager.updateAccesses).not.toHaveBeenCalled();
-    });
-    it('should handle LDAP new-user flow: missing fields, creation success, and multi-email selection', async ()=>{
-        // Phase 1: incomplete LDAP entry -> null + error log, no creation
-        usersManager.findUser.mockResolvedValue(null);
-        mockBindResolve(ldapClient);
-        // Simulate an entry with missing mail
-        mockSearchEntries(ldapClient, [
-            {
-                uid: 'jane',
-                cn: 'Jane Doe',
-                mail: undefined
-            }
-        ]);
-        const loggerErrorSpy = jest.spyOn(authMethodLdapService['logger'], 'error').mockImplementation(()=>undefined);
-        const resA = await authMethodLdapService.validateUser('jane', 'pwd');
-        expect(resA).toBeNull();
-        expect(adminUsersManager.createUserOrGuest).not.toHaveBeenCalled();
-        expect(loggerErrorSpy).toHaveBeenCalled();
-        // Phase 2: create a new user (success, single email)
-        // Stub directement checkAuth pour retourner une entrée LDAP valide
-        const checkAuthSpy = jest.spyOn(authMethodLdapService, 'checkAuth');
-        checkAuthSpy.mockResolvedValueOnce({
-            uid: 'john',
-            cn: 'John Doe',
-            mail: 'john@example.org'
-        });
-        adminUsersManager.createUserOrGuest.mockClear();
-        usersManager.findUser.mockResolvedValue(null);
-        const createdUser = {
-            id: 2,
-            login: 'john',
-            isGuest: false,
-            isActive: true,
-            makePaths: jest.fn()
-        };
-        adminUsersManager.createUserOrGuest.mockResolvedValue(createdUser);
-        // If the service reloads the user via fromUserId after creation
-        usersManager.fromUserId.mockResolvedValue(createdUser);
-        // Cover the success-flow catch branch
-        const loggerErrorSpy2 = spyLoggerError();
-        usersManager.updateAccesses.mockRejectedValueOnce(new Error('updateAccesses success flow boom'));
-        const resB = await authMethodLdapService.validateUser('john', 'pwd', '192.168.1.10');
-        expect(adminUsersManager.createUserOrGuest).toHaveBeenCalledWith({
-            login: 'john',
-            email: 'john@example.org',
-            password: 'pwd',
-            firstName: 'John',
-            lastName: 'Doe',
-            role: 1
-        }, expect.anything() // USER_ROLE.USER
-        );
-        expect(resB).toBe(createdUser);
-        expect(usersManager.updateAccesses).toHaveBeenCalledWith(createdUser, '192.168.1.10', true);
-        expect(loggerErrorSpy2).toHaveBeenCalled();
-        // Phase 3: multiple emails -> keep the first
-        adminUsersManager.createUserOrGuest.mockClear();
-        usersManager.findUser.mockResolvedValue(null);
-        setupLdapSuccess([
-            {
-                uid: 'multi',
-                cn: 'Multi Mail',
-                mail: [
-                    'first@example.org',
-                    'second@example.org'
-                ]
-            }
-        ]);
-        const createdUser2 = {
-            id: 9,
-            login: 'multi',
-            makePaths: jest.fn()
-        };
-        adminUsersManager.createUserOrGuest.mockResolvedValue(createdUser2);
-        usersManager.fromUserId.mockResolvedValue(createdUser2);
-        const resC = await authMethodLdapService.validateUser('multi', 'pwd');
-        expect(adminUsersManager.createUserOrGuest).toHaveBeenCalledWith(expect.objectContaining({
-            email: 'first@example.org'
-        }), expect.anything());
-        expect(resC).toBe(createdUser2);
-    });
-    it('should update existing user profile when LDAP identity changed (except password assigned back)', async ()=>{
-        // Arrange: existing user with different profile and an old password
-        const existingUser = buildUser({
-            id: 5
-        });
-        usersManager.findUser.mockResolvedValue(existingUser);
-        // LDAP succeeds and returns different email and same uid
-        setupLdapSuccess([
-            {
-                uid: 'john',
-                cn: 'John Doe',
-                mail: 'john@example.org'
-            }
-        ]);
-        // Admin manager successfully updates a user
-        adminUsersManager.updateUserOrGuest.mockResolvedValue(undefined);
-        // Ensure password is considered changed so the update payload includes it,
-        // which then triggers the deletion and local assignment branches after update
-        const compareSpy = jest.spyOn(_functions, 'comparePassword').mockResolvedValue(false);
-        const res = await authMethodLdapService.validateUser('john', 'new-plain-password', '127.0.0.2');
-        expect(adminUsersManager.updateUserOrGuest).toHaveBeenCalledWith(5, expect.objectContaining({
-            email: 'john@example.org',
-            firstName: 'John',
-            lastName: 'Doe'
-        }));
-        // Password should not be assigned back onto the user object (it is deleted before Object.assign)
-        expect(existingUser.password).toBe('hashed');
-        // Other fields should be updated locally
-        expect(existingUser.email).toBe('john@example.org');
-        expect(existingUser).toMatchObject({
-            firstName: 'John',
-            lastName: 'Doe'
-        });
-        // Accesses updated as success
-        expect(usersManager.updateAccesses).toHaveBeenCalledWith(existingUser, '127.0.0.2', true);
-        // Returned user is the same instance
-        expect(res).toBe(existingUser);
-        // Second run: password unchanged (comparePassword => true) to cover the null branch for password
-        adminUsersManager.updateUserOrGuest.mockClear();
-        usersManager.updateAccesses.mockClear();
-        // Force another non-password change so an update occurs
-        existingUser.email = 'old@example.org';
-        compareSpy.mockResolvedValue(true);
-        const res2 = await authMethodLdapService.validateUser('john', 'same-plain-password', '127.0.0.3');
-        // Update should be called without password, only with changed fields
-        expect(adminUsersManager.updateUserOrGuest).toHaveBeenCalled();
-        const updateArgs = adminUsersManager.updateUserOrGuest.mock.calls[0];
-        expect(updateArgs[0]).toBe(5);
-        expect(updateArgs[1]).toEqual(expect.objectContaining({
-            email: 'john@example.org'
-        }));
-        expect(updateArgs[1]).toEqual(expect.not.objectContaining({
-            password: expect.anything()
-        }));
-        // Password remains unchanged locally
-        expect(existingUser.password).toBe('hashed');
-        // Accesses updated as success
-        expect(usersManager.updateAccesses).toHaveBeenCalledWith(existingUser, '127.0.0.3', true);
-        // Returned user is the same instance
-        expect(res2).toBe(existingUser);
-        // Third run: no changes at all (identityHasChanged is empty) to cover the else branch
-        adminUsersManager.updateUserOrGuest.mockClear();
-        usersManager.updateAccesses.mockClear();
-        compareSpy.mockResolvedValue(true);
-        // Local user already matches LDAP identity; call again
-        const res3 = await authMethodLdapService.validateUser('john', 'same-plain-password', '127.0.0.4');
-        // No update should be triggered
-        expect(adminUsersManager.updateUserOrGuest).not.toHaveBeenCalled();
-        // Access should still be updated as success
-        expect(usersManager.updateAccesses).toHaveBeenCalledWith(existingUser, '127.0.0.4', true);
-        // Returned user is the same instance
-        expect(res3).toBe(existingUser);
-    });
-    it('should log failed access when LDAP search returns no entry or throws after bind', async ()=>{
-        // Phase 1: no entry found after a successful bind -> failed access
-        const existingUser = {
-            id: 7,
-            login: 'ghost',
-            isGuest: false,
-            isActive: true
-        };
-        usersManager.findUser.mockResolvedValue(existingUser);
-        setupLdapSuccess([]);
-        const resA = await authMethodLdapService.validateUser('ghost', 'pwd', '10.10.0.1');
-        expect(resA).toBeNull();
-        expect(usersManager.updateAccesses).toHaveBeenCalledWith(existingUser, '10.10.0.1', false);
-        // Phase 2: exception during search after a bind -> failed access
-        jest.clearAllMocks();
-        const existingUser2 = {
-            id: 10,
-            login: 'john',
-            isGuest: false,
-            isActive: true
-        };
-        usersManager.findUser.mockResolvedValue(existingUser2);
-        mockBindResolve(ldapClient);
-        mockSearchReject(ldapClient, new Error('search failed'));
-        const resB = await authMethodLdapService.validateUser('john', 'pwd', '1.1.1.1');
-        expect(resB).toBeNull();
-        expect(usersManager.updateAccesses).toHaveBeenCalledWith(existingUser2, '1.1.1.1', false);
-    });
-    it('should allow app password when LDAP fails and scope is provided', async ()=>{
-        const existingUser = buildUser({
-            id: 42
-        });
-        usersManager.findUser.mockResolvedValue(existingUser);
-        // LDAP invalid credentials
-        mockBindRejectInvalid(ldapClient, _ldapts.InvalidCredentialsError, 'invalid credentials');
-        // App password success
-        usersManager.validateAppPassword.mockResolvedValue(true);
-        const res = await authMethodLdapService.validateUser('john', 'app-password', '10.0.0.2', 'webdav');
-        expect(res).toBe(existingUser);
-        expect(usersManager.validateAppPassword).toHaveBeenCalledWith(existingUser, 'app-password', '10.0.0.2', 'webdav');
-        expect(usersManager.updateAccesses).toHaveBeenCalledWith(existingUser, '10.0.0.2', true);
-    });
-    it('should throw 500 when LDAP connection error occurs during bind', async ()=>{
-        // Arrange: no existing user to reach checkAuth flow
-        usersManager.findUser.mockResolvedValue(null);
-        const err1 = new Error('socket hang up');
-        const err2 = Object.assign(new Error('connect ECONNREFUSED'), {
-            code: Array.from(_appconstants.CONNECT_ERROR_CODE)[0]
-        });
-        ldapClient.bind.mockRejectedValue({
-            errors: [
-                err1,
-                err2
-            ]
-        });
-        ldapClient.unbind.mockResolvedValue(undefined);
-        // First scenario: recognized connection error -> throws 500
-        await expect(authMethodLdapService.validateUser('john', 'pwd')).rejects.toThrow(/authentication service/i);
-        // Second scenario: generic error (no code, not InvalidCredentialsError) -> resolves to null and no access update
-        ldapClient.bind.mockReset();
-        ldapClient.unbind.mockReset();
-        usersManager.updateAccesses.mockClear();
-        usersManager.findUser.mockResolvedValue(null);
-        ldapClient.bind.mockRejectedValue(new Error('unexpected failure'));
-        ldapClient.unbind.mockResolvedValue(undefined);
-        const res = await authMethodLdapService.validateUser('john', 'pwd');
-        expect(res).toBeNull();
-        expect(usersManager.updateAccesses).not.toHaveBeenCalled();
-    });
-    it('should log update failure when updating existing user', async ()=>{
-        // Arrange: existing user with changed identity
-        const existingUser = buildUser({
-            id: 11,
-            email: 'old@ex.org'
-        });
-        usersManager.findUser.mockResolvedValue(existingUser);
-        // Ensure LDAP loginAttribute matches uid for this test (a previous test sets it to 'cn')
-        setupLdapSuccess([
-            {
-                uid: 'john',
-                cn: 'John Doe',
-                mail: 'john@example.org'
-            }
-        ]);
-        adminUsersManager.updateUserOrGuest.mockRejectedValue(new Error('db error'));
-        // Force identity to be considered changed only for this test
-        jest.spyOn(_functions, 'comparePassword').mockResolvedValue(false);
-        jest.spyOn(_functions, 'splitFullName').mockReturnValue({
-            firstName: 'John',
-            lastName: 'Doe'
-        });
-        const res = await authMethodLdapService.validateUser('john', 'pwd');
-        expect(adminUsersManager.updateUserOrGuest).toHaveBeenCalled();
-        // Local fields unchanged since update failed
-        expect(existingUser.email).toBe('old@ex.org');
-        expect(res).toBe(existingUser);
-    });
-    it('should skip non-matching LDAP entries then update user with changed password without reassigning it', async ()=>{
-        // Phase A: LDAP returns an entry but loginAttribute value does not match -> checkAccess returns false (covers return after loop)
-        const userA = {
-            id: 20,
-            login: 'john',
-            isGuest: false,
-            isActive: true
-        };
-        usersManager.findUser.mockResolvedValue(userA);
-        ldapClient.bind.mockResolvedValue(undefined);
-        // Phase B: Matching entry + password considered changed -> updateUserOrGuest called, password not reassigned locally
-        jest.clearAllMocks();
-        const userB = buildUser({
-            id: 21,
-            email: 'old@ex.org'
-        });
-        usersManager.findUser.mockResolvedValue(userB);
-        setupLdapSuccess([
-            {
-                uid: 'john',
-                cn: 'John Doe',
-                mail: 'john@example.org'
-            }
-        ]);
-        adminUsersManager.updateUserOrGuest.mockResolvedValue(undefined);
-        // Force password to be considered changed to execute deletion + Object.assign branch
-        jest.spyOn(_functions, 'comparePassword').mockResolvedValue(false);
-        jest.spyOn(_functions, 'splitFullName').mockReturnValue({
-            firstName: 'John',
-            lastName: 'Doe'
-        });
-        const resB = await authMethodLdapService.validateUser('john', 'newpwd', '4.4.4.4');
-        // Line 132: updateUserOrGuest call
-        expect(adminUsersManager.updateUserOrGuest).toHaveBeenCalledWith(21, expect.objectContaining({
-            email: 'john@example.org',
-            firstName: 'John',
-            lastName: 'Doe'
-        }));
-        // Lines 139-142: password removed from local assign, other fields assigned
-        expect(userB.password).toBe('hashed');
-        expect(userB.email).toBe('john@example.org');
-        expect(userB).toMatchObject({
-            firstName: 'John',
-            lastName: 'Doe'
-        });
-        expect(resB).toBe(userB);
-    });
-});
-
-//# sourceMappingURL=auth-method-ldap.service.spec.js.map

package/server/authentication/services/auth-methods/auth-method-ldap.service.spec.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../../../../../backend/src/authentication/services/auth-methods/auth-method-ldap.service.spec.ts"],"sourcesContent":["/*\n * Copyright (C) 2012-2025 Johan Legrand <johan.legrand@sync-in.com>\n * This file is part of Sync-in | The open source file sync and share solution\n * See the LICENSE file for licensing details\n */\n\nimport { Test, TestingModule } from '@nestjs/testing'\nimport { Mocked } from 'jest-mock'\nimport { Client, InvalidCredentialsError } from 'ldapts'\nimport { CONNECT_ERROR_CODE } from '../../../app.constants'\nimport { UserModel } from '../../../applications/users/models/user.model'\nimport { AdminUsersManager } from '../../../applications/users/services/admin-users-manager.service'\nimport { UsersManager } from '../../../applications/users/services/users-manager.service'\nimport * as commonFunctions from '../../../common/functions'\nimport { configuration } from '../../../configuration/config.environment'\nimport { LDAP_LOGIN_ATTR } from '../../constants/auth-ldap'\nimport { AuthMethodLdapService } from './auth-method-ldap.service'\n\n// Mock ldapts Client to simulate LDAP behaviors\njest.mock('ldapts', () => {\n  const actual = jest.requireActual('ldapts')\n  const mockClientInstance = {\n    bind: jest.fn(),\n    search: jest.fn(),\n    unbind: jest.fn()\n  }\n  const Client = jest.fn().mockImplementation(() => mockClientInstance)\n  // Conserver tous les autres exports réels (dont EqualityFilter, AndFilter, InvalidCredentialsError, etc.)\n  return { ...actual, Client }\n})\n\n// --- Test helpers (DRY) ---\n// Reusable LDAP mocks\nconst mockBindResolve = (ldapClient: any) => {\n  ldapClient.bind.mockResolvedValue(undefined)\n  ldapClient.unbind.mockResolvedValue(undefined)\n}\nconst mockBindRejectInvalid = (ldapClient: any, InvalidCredentialsErrorCtor: any, message = 'invalid') => {\n  ldapClient.bind.mockRejectedValue(new InvalidCredentialsErrorCtor(message))\n  ldapClient.unbind.mockResolvedValue(undefined)\n}\nconst mockSearchEntries = (ldapClient: any, entries: any[]) => {\n  ldapClient.search.mockResolvedValue({ searchEntries: entries })\n}\nconst mockSearchReject = (ldapClient: any, err: Error) => {\n  ldapClient.search.mockRejectedValue(err)\n}\n// User factory\nconst buildUser = (overrides: Partial<UserModel> = {}) =>\n  ({\n    id: 0,\n    login: 'john',\n    email: 'old@example.org',\n    password: 'hashed',\n    isGuest: false,\n    isActive: true,\n    makePaths: jest.fn().mockResolvedValue(undefined),\n    setFullName: jest.fn(), // needed when firstName/lastName change\n    ...overrides\n  }) as any\n\n// --------------------------\n\ndescribe(AuthMethodLdapService.name, () => {\n  let authMethodLdapService: AuthMethodLdapService\n  let usersManager: Mocked<UsersManager>\n  let adminUsersManager: Mocked<AdminUsersManager>\n  const ldapClient = {\n    bind: jest.fn(),\n    search: jest.fn(),\n    unbind: jest.fn()\n  }\n  ;(Client as Mocked<any>).mockImplementation(() => ldapClient)\n\n  // Local helpers (need access to authMethodLdapService and ldapClient in this scope)\n  const setupLdapSuccess = (entries: any[]) => {\n    mockBindResolve(ldapClient)\n    mockSearchEntries(ldapClient, entries)\n  }\n  const spyLoggerError = () => jest.spyOn(authMethodLdapService['logger'], 'error').mockImplementation(() => undefined as any)\n\n  beforeAll(async () => {\n    configuration.auth.ldap = {\n      servers: ['ldap://localhost:389'],\n      attributes: { login: LDAP_LOGIN_ATTR.UID, email: 'mail' },\n      baseDN: 'ou=people,dc=example,dc=org',\n      filter: ''\n    }\n\n    const module: TestingModule = await Test.createTestingModule({\n      providers: [\n        AuthMethodLdapService,\n        {\n          provide: UsersManager,\n          useValue: {\n            findUser: jest.fn(),\n            logUser: jest.fn(),\n            updateAccesses: jest.fn().mockResolvedValue(undefined),\n            validateAppPassword: jest.fn(),\n            fromUserId: jest.fn()\n          }\n        },\n        {\n          provide: AdminUsersManager,\n          useValue: {\n            createUserOrGuest: jest.fn(),\n            updateUserOrGuest: jest.fn()\n          }\n        }\n      ]\n    }).compile()\n\n    module.useLogger(['fatal'])\n    authMethodLdapService = module.get<AuthMethodLdapService>(AuthMethodLdapService)\n    adminUsersManager = module.get<Mocked<AdminUsersManager>>(AdminUsersManager)\n    usersManager = module.get<Mocked<UsersManager>>(UsersManager)\n  })\n\n  it('should be defined', () => {\n    expect(authMethodLdapService).toBeDefined()\n    expect(usersManager).toBeDefined()\n    expect(adminUsersManager).toBeDefined()\n    expect(ldapClient).toBeDefined()\n  })\n\n  it('should authenticate a guest user via database and bypass LDAP', async () => {\n    // Arrange\n    const guestUser: any = { id: 1, login: 'guest1', isGuest: true, isActive: true }\n    usersManager.findUser.mockResolvedValue(guestUser)\n    const dbAuthResult: any = { ...guestUser, token: 'jwt' }\n    usersManager.logUser.mockResolvedValue(dbAuthResult)\n    const res = await authMethodLdapService.validateUser('guest1', 'pass', '127.0.0.1')\n    expect(res).toEqual(dbAuthResult)\n    expect(usersManager.logUser).toHaveBeenCalledWith(guestUser, 'pass', '127.0.0.1')\n    expect(Client).not.toHaveBeenCalled() // client should not be constructed\n  })\n\n  it('should throw FORBIDDEN for locked account and resolve null for LDAP login mismatch', async () => {\n    // Phase 1: locked account\n    usersManager.findUser.mockResolvedValue({ login: 'john', isGuest: false, isActive: false } as UserModel)\n    const loggerErrorSpy1 = jest.spyOn(authMethodLdapService['logger'], 'error').mockImplementation(() => undefined as any)\n    await expect(authMethodLdapService.validateUser('john', 'pwd')).rejects.toThrow(/account locked/i)\n    expect(loggerErrorSpy1).toHaveBeenCalled()\n\n    // Phase 2: mismatch between requested login and LDAP returned login -> service renvoie null\n    const existingUser: any = buildUser({ id: 8 })\n    usersManager.findUser.mockResolvedValue(existingUser)\n    mockBindResolve(ldapClient)\n    mockSearchEntries(ldapClient, [{ uid: 'jane', cn: 'john', mail: 'jane@example.org' }])\n    await expect(authMethodLdapService.validateUser('john', 'pwd')).rejects.toThrow(/account matching error/i)\n  })\n\n  it('should handle invalid LDAP credentials for both existing and unknown users', async () => {\n    // Phase 1: existing user -> updateAccesses invoked with success=false and logger.error intercepted\n    const existingUser: any = buildUser({ id: 1 })\n    usersManager.findUser.mockResolvedValue(existingUser)\n    // Make LDAP bind throw InvalidCredentialsError\n    mockBindRejectInvalid(ldapClient, InvalidCredentialsError, 'invalid credentials')\n    // Force updateAccesses to reject to hit the catch and logger.error\n    const loggerErrorSpy = jest.spyOn(authMethodLdapService['logger'], 'error').mockImplementation(() => undefined as any)\n    usersManager.updateAccesses.mockRejectedValueOnce(new Error('updateAccesses boom'))\n    const res1 = await authMethodLdapService.validateUser('john', 'badpwd', '10.0.0.1')\n    expect(res1).toBeNull()\n    expect(usersManager.updateAccesses).toHaveBeenCalledWith(existingUser, '10.0.0.1', false)\n    expect(loggerErrorSpy).toHaveBeenCalled()\n\n    // Phase 2: unknown user → no access update\n    usersManager.updateAccesses.mockClear()\n    usersManager.findUser.mockResolvedValue(null)\n    ldapClient.bind.mockRejectedValue(new InvalidCredentialsError('invalid'))\n    ldapClient.unbind.mockResolvedValue(undefined)\n    const res2 = await authMethodLdapService.validateUser('jane', 'badpwd')\n    expect(res2).toBeNull()\n    expect(usersManager.updateAccesses).not.toHaveBeenCalled()\n  })\n\n  it('should handle LDAP new-user flow: missing fields, creation success, and multi-email selection', async () => {\n    // Phase 1: incomplete LDAP entry -> null + error log, no creation\n    usersManager.findUser.mockResolvedValue(null)\n    mockBindResolve(ldapClient)\n    // Simulate an entry with missing mail\n    mockSearchEntries(ldapClient, [{ uid: 'jane', cn: 'Jane Doe', mail: undefined }])\n    const loggerErrorSpy = jest.spyOn(authMethodLdapService['logger'], 'error').mockImplementation(() => undefined as any)\n    const resA = await authMethodLdapService.validateUser('jane', 'pwd')\n    expect(resA).toBeNull()\n    expect(adminUsersManager.createUserOrGuest).not.toHaveBeenCalled()\n    expect(loggerErrorSpy).toHaveBeenCalled()\n\n    // Phase 2: create a new user (success, single email)\n    // Stub directement checkAuth pour retourner une entrée LDAP valide\n    const checkAuthSpy = jest.spyOn<any, any>(authMethodLdapService as any, 'checkAuth')\n    checkAuthSpy.mockResolvedValueOnce({ uid: 'john', cn: 'John Doe', mail: 'john@example.org' } as any)\n    adminUsersManager.createUserOrGuest.mockClear()\n    usersManager.findUser.mockResolvedValue(null)\n    const createdUser: any = { id: 2, login: 'john', isGuest: false, isActive: true, makePaths: jest.fn() }\n    adminUsersManager.createUserOrGuest.mockResolvedValue(createdUser)\n    // If the service reloads the user via fromUserId after creation\n    usersManager.fromUserId.mockResolvedValue(createdUser)\n    // Cover the success-flow catch branch\n    const loggerErrorSpy2 = spyLoggerError()\n    usersManager.updateAccesses.mockRejectedValueOnce(new Error('updateAccesses success flow boom'))\n    const resB = await authMethodLdapService.validateUser('john', 'pwd', '192.168.1.10')\n    expect(adminUsersManager.createUserOrGuest).toHaveBeenCalledWith(\n      { login: 'john', email: 'john@example.org', password: 'pwd', firstName: 'John', lastName: 'Doe', role: 1 },\n      expect.anything() // USER_ROLE.USER\n    )\n    expect(resB).toBe(createdUser)\n    expect(usersManager.updateAccesses).toHaveBeenCalledWith(createdUser, '192.168.1.10', true)\n    expect(loggerErrorSpy2).toHaveBeenCalled()\n    // Phase 3: multiple emails -> keep the first\n    adminUsersManager.createUserOrGuest.mockClear()\n    usersManager.findUser.mockResolvedValue(null)\n    setupLdapSuccess([{ uid: 'multi', cn: 'Multi Mail', mail: ['first@example.org', 'second@example.org'] }])\n    const createdUser2: any = { id: 9, login: 'multi', makePaths: jest.fn() }\n    adminUsersManager.createUserOrGuest.mockResolvedValue(createdUser2)\n    usersManager.fromUserId.mockResolvedValue(createdUser2)\n    const resC = await authMethodLdapService.validateUser('multi', 'pwd')\n    expect(adminUsersManager.createUserOrGuest).toHaveBeenCalledWith(expect.objectContaining({ email: 'first@example.org' }), expect.anything())\n    expect(resC).toBe(createdUser2)\n  })\n\n  it('should update existing user profile when LDAP identity changed (except password assigned back)', async () => {\n    // Arrange: existing user with different profile and an old password\n    const existingUser: any = buildUser({ id: 5 })\n    usersManager.findUser.mockResolvedValue(existingUser)\n    // LDAP succeeds and returns different email and same uid\n    setupLdapSuccess([{ uid: 'john', cn: 'John Doe', mail: 'john@example.org' }])\n    // Admin manager successfully updates a user\n    adminUsersManager.updateUserOrGuest.mockResolvedValue(undefined)\n    // Ensure password is considered changed so the update payload includes it,\n    // which then triggers the deletion and local assignment branches after update\n    const compareSpy = jest.spyOn(commonFunctions, 'comparePassword').mockResolvedValue(false)\n    const res = await authMethodLdapService.validateUser('john', 'new-plain-password', '127.0.0.2')\n    expect(adminUsersManager.updateUserOrGuest).toHaveBeenCalledWith(\n      5,\n      expect.objectContaining({\n        email: 'john@example.org',\n        firstName: 'John',\n        lastName: 'Doe'\n      })\n    )\n    // Password should not be assigned back onto the user object (it is deleted before Object.assign)\n    expect(existingUser.password).toBe('hashed')\n    // Other fields should be updated locally\n    expect(existingUser.email).toBe('john@example.org')\n    expect(existingUser).toMatchObject({ firstName: 'John', lastName: 'Doe' })\n    // Accesses updated as success\n    expect(usersManager.updateAccesses).toHaveBeenCalledWith(existingUser, '127.0.0.2', true)\n    // Returned user is the same instance\n    expect(res).toBe(existingUser)\n\n    // Second run: password unchanged (comparePassword => true) to cover the null branch for password\n    adminUsersManager.updateUserOrGuest.mockClear()\n    usersManager.updateAccesses.mockClear()\n    // Force another non-password change so an update occurs\n    existingUser.email = 'old@example.org'\n    compareSpy.mockResolvedValue(true)\n    const res2 = await authMethodLdapService.validateUser('john', 'same-plain-password', '127.0.0.3')\n    // Update should be called without password, only with changed fields\n    expect(adminUsersManager.updateUserOrGuest).toHaveBeenCalled()\n    const updateArgs = adminUsersManager.updateUserOrGuest.mock.calls[0]\n    expect(updateArgs[0]).toBe(5)\n    expect(updateArgs[1]).toEqual(\n      expect.objectContaining({\n        email: 'john@example.org'\n      })\n    )\n    expect(updateArgs[1]).toEqual(expect.not.objectContaining({ password: expect.anything() }))\n    // Password remains unchanged locally\n    expect(existingUser.password).toBe('hashed')\n    // Accesses updated as success\n    expect(usersManager.updateAccesses).toHaveBeenCalledWith(existingUser, '127.0.0.3', true)\n    // Returned user is the same instance\n    expect(res2).toBe(existingUser)\n    // Third run: no changes at all (identityHasChanged is empty) to cover the else branch\n    adminUsersManager.updateUserOrGuest.mockClear()\n    usersManager.updateAccesses.mockClear()\n    compareSpy.mockResolvedValue(true)\n    // Local user already matches LDAP identity; call again\n    const res3 = await authMethodLdapService.validateUser('john', 'same-plain-password', '127.0.0.4')\n    // No update should be triggered\n    expect(adminUsersManager.updateUserOrGuest).not.toHaveBeenCalled()\n    // Access should still be updated as success\n    expect(usersManager.updateAccesses).toHaveBeenCalledWith(existingUser, '127.0.0.4', true)\n    // Returned user is the same instance\n    expect(res3).toBe(existingUser)\n  })\n\n  it('should log failed access when LDAP search returns no entry or throws after bind', async () => {\n    // Phase 1: no entry found after a successful bind -> failed access\n    const existingUser: any = { id: 7, login: 'ghost', isGuest: false, isActive: true }\n    usersManager.findUser.mockResolvedValue(existingUser)\n    setupLdapSuccess([])\n    const resA = await authMethodLdapService.validateUser('ghost', 'pwd', '10.10.0.1')\n    expect(resA).toBeNull()\n    expect(usersManager.updateAccesses).toHaveBeenCalledWith(existingUser, '10.10.0.1', false)\n\n    // Phase 2: exception during search after a bind -> failed access\n    jest.clearAllMocks()\n    const existingUser2: any = { id: 10, login: 'john', isGuest: false, isActive: true }\n    usersManager.findUser.mockResolvedValue(existingUser2)\n    mockBindResolve(ldapClient)\n    mockSearchReject(ldapClient, new Error('search failed'))\n    const resB = await authMethodLdapService.validateUser('john', 'pwd', '1.1.1.1')\n    expect(resB).toBeNull()\n    expect(usersManager.updateAccesses).toHaveBeenCalledWith(existingUser2, '1.1.1.1', false)\n  })\n\n  it('should allow app password when LDAP fails and scope is provided', async () => {\n    const existingUser: any = buildUser({ id: 42 })\n    usersManager.findUser.mockResolvedValue(existingUser)\n    // LDAP invalid credentials\n    mockBindRejectInvalid(ldapClient, InvalidCredentialsError, 'invalid credentials')\n    // App password success\n    usersManager.validateAppPassword.mockResolvedValue(true)\n    const res = await authMethodLdapService.validateUser('john', 'app-password', '10.0.0.2', 'webdav' as any)\n    expect(res).toBe(existingUser)\n    expect(usersManager.validateAppPassword).toHaveBeenCalledWith(existingUser, 'app-password', '10.0.0.2', 'webdav')\n    expect(usersManager.updateAccesses).toHaveBeenCalledWith(existingUser, '10.0.0.2', true)\n  })\n\n  it('should throw 500 when LDAP connection error occurs during bind', async () => {\n    // Arrange: no existing user to reach checkAuth flow\n    usersManager.findUser.mockResolvedValue(null)\n    const err1 = new Error('socket hang up')\n    const err2 = Object.assign(new Error('connect ECONNREFUSED'), { code: Array.from(CONNECT_ERROR_CODE)[0] })\n    ldapClient.bind.mockRejectedValue({ errors: [err1, err2] })\n    ldapClient.unbind.mockResolvedValue(undefined)\n\n    // First scenario: recognized connection error -> throws 500\n    await expect(authMethodLdapService.validateUser('john', 'pwd')).rejects.toThrow(/authentication service/i)\n\n    // Second scenario: generic error (no code, not InvalidCredentialsError) -> resolves to null and no access update\n    ldapClient.bind.mockReset()\n    ldapClient.unbind.mockReset()\n    usersManager.updateAccesses.mockClear()\n    usersManager.findUser.mockResolvedValue(null as any)\n    ldapClient.bind.mockRejectedValue(new Error('unexpected failure'))\n    ldapClient.unbind.mockResolvedValue(undefined)\n\n    const res = await authMethodLdapService.validateUser('john', 'pwd')\n    expect(res).toBeNull()\n    expect(usersManager.updateAccesses).not.toHaveBeenCalled()\n  })\n\n  it('should log update failure when updating existing user', async () => {\n    // Arrange: existing user with changed identity\n    const existingUser: any = buildUser({ id: 11, email: 'old@ex.org' })\n    usersManager.findUser.mockResolvedValue(existingUser)\n    // Ensure LDAP loginAttribute matches uid for this test (a previous test sets it to 'cn')\n    setupLdapSuccess([{ uid: 'john', cn: 'John Doe', mail: 'john@example.org' }])\n    adminUsersManager.updateUserOrGuest.mockRejectedValue(new Error('db error'))\n    // Force identity to be considered changed only for this test\n    jest.spyOn(commonFunctions, 'comparePassword').mockResolvedValue(false)\n    jest.spyOn(commonFunctions, 'splitFullName').mockReturnValue({ firstName: 'John', lastName: 'Doe' })\n    const res = await authMethodLdapService.validateUser('john', 'pwd')\n    expect(adminUsersManager.updateUserOrGuest).toHaveBeenCalled()\n    // Local fields unchanged since update failed\n    expect(existingUser.email).toBe('old@ex.org')\n    expect(res).toBe(existingUser)\n  })\n\n  it('should skip non-matching LDAP entries then update user with changed password without reassigning it', async () => {\n    // Phase A: LDAP returns an entry but loginAttribute value does not match -> checkAccess returns false (covers return after loop)\n    const userA: any = { id: 20, login: 'john', isGuest: false, isActive: true }\n    usersManager.findUser.mockResolvedValue(userA)\n    ldapClient.bind.mockResolvedValue(undefined)\n\n    // Phase B: Matching entry + password considered changed -> updateUserOrGuest called, password not reassigned locally\n    jest.clearAllMocks()\n    const userB: any = buildUser({ id: 21, email: 'old@ex.org' })\n    usersManager.findUser.mockResolvedValue(userB)\n    setupLdapSuccess([{ uid: 'john', cn: 'John Doe', mail: 'john@example.org' }])\n    adminUsersManager.updateUserOrGuest.mockResolvedValue(undefined)\n\n    // Force password to be considered changed to execute deletion + Object.assign branch\n    jest.spyOn(commonFunctions, 'comparePassword').mockResolvedValue(false)\n    jest.spyOn(commonFunctions, 'splitFullName').mockReturnValue({ firstName: 'John', lastName: 'Doe' })\n    const resB = await authMethodLdapService.validateUser('john', 'newpwd', '4.4.4.4')\n\n    // Line 132: updateUserOrGuest call\n    expect(adminUsersManager.updateUserOrGuest).toHaveBeenCalledWith(\n      21,\n      expect.objectContaining({ email: 'john@example.org', firstName: 'John', lastName: 'Doe' })\n    )\n\n    // Lines 139-142: password removed from local assign, other fields assigned\n    expect(userB.password).toBe('hashed')\n    expect(userB.email).toBe('john@example.org')\n    expect(userB).toMatchObject({ firstName: 'John', lastName: 'Doe' })\n    expect(resB).toBe(userB)\n  })\n})\n"],"names":["jest","mock","actual","requireActual","mockClientInstance","bind","fn","search","unbind","Client","mockImplementation","mockBindResolve","ldapClient","mockResolvedValue","undefined","mockBindRejectInvalid","InvalidCredentialsErrorCtor","message","mockRejectedValue","mockSearchEntries","entries","searchEntries","mockSearchReject","err","buildUser","overrides","id","login","email","password","isGuest","isActive","makePaths","setFullName","describe","AuthMethodLdapService","name","authMethodLdapService","usersManager","adminUsersManager","setupLdapSuccess","spyLoggerError","spyOn","beforeAll","configuration","auth","ldap","servers","attributes","LDAP_LOGIN_ATTR","UID","baseDN","filter","module","Test","createTestingModule","providers","provide","UsersManager","useValue","findUser","logUser","updateAccesses","validateAppPassword","fromUserId","AdminUsersManager","createUserOrGuest","updateUserOrGuest","compile","useLogger","get","it","expect","toBeDefined","guestUser","dbAuthResult","token","res","validateUser","toEqual","toHaveBeenCalledWith","not","toHaveBeenCalled","loggerErrorSpy1","rejects","toThrow","existingUser","uid","cn","mail","InvalidCredentialsError","loggerErrorSpy","mockRejectedValueOnce","Error","res1","toBeNull","mockClear","res2","resA","checkAuthSpy","mockResolvedValueOnce","createdUser","loggerErrorSpy2","resB","firstName","lastName","role","anything","toBe","createdUser2","resC","objectContaining","compareSpy","commonFunctions","toMatchObject","updateArgs","calls","res3","clearAllMocks","existingUser2","err1","err2","Object","assign","code","Array","from","CONNECT_ERROR_CODE","errors","mockReset","mockReturnValue","userA","userB"],"mappings":"AAAA;;;;CAIC;;;;yBAEmC;wBAEY;8BACb;0CAED;qCACL;mEACI;mCACH;0BACE;uCACM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAEtC,gDAAgD;AAChDA,KAAKC,IAAI,CAAC,UAAU;IAClB,MAAMC,SAASF,KAAKG,aAAa,CAAC;IAClC,MAAMC,qBAAqB;QACzBC,MAAML,KAAKM,EAAE;QACbC,QAAQP,KAAKM,EAAE;QACfE,QAAQR,KAAKM,EAAE;IACjB;IACA,MAAMG,SAAST,KAAKM,EAAE,GAAGI,kBAAkB,CAAC,IAAMN;IAClD,0GAA0G;IAC1G,OAAO;QAAE,GAAGF,MAAM;QAAEO;IAAO;AAC7B;AAEA,6BAA6B;AAC7B,sBAAsB;AACtB,MAAME,kBAAkB,CAACC;IACvBA,WAAWP,IAAI,CAACQ,iBAAiB,CAACC;IAClCF,WAAWJ,MAAM,CAACK,iBAAiB,CAACC;AACtC;AACA,MAAMC,wBAAwB,CAACH,YAAiBI,6BAAkCC,UAAU,SAAS;IACnGL,WAAWP,IAAI,CAACa,iBAAiB,CAAC,IAAIF,4BAA4BC;IAClEL,WAAWJ,MAAM,CAACK,iBAAiB,CAACC;AACtC;AACA,MAAMK,oBAAoB,CAACP,YAAiBQ;IAC1CR,WAAWL,MAAM,CAACM,iBAAiB,CAAC;QAAEQ,eAAeD;IAAQ;AAC/D;AACA,MAAME,mBAAmB,CAACV,YAAiBW;IACzCX,WAAWL,MAAM,CAACW,iBAAiB,CAACK;AACtC;AACA,eAAe;AACf,MAAMC,YAAY,CAACC,YAAgC,CAAC,CAAC,GAClD,CAAA;QACCC,IAAI;QACJC,OAAO;QACPC,OAAO;QACPC,UAAU;QACVC,SAAS;QACTC,UAAU;QACVC,WAAWhC,KAAKM,EAAE,GAAGO,iBAAiB,CAACC;QACvCmB,aAAajC,KAAKM,EAAE;QACpB,GAAGmB,SAAS;IACd,CAAA;AAEF,6BAA6B;AAE7BS,SAASC,4CAAqB,CAACC,IAAI,EAAE;IACnC,IAAIC;IACJ,IAAIC;IACJ,IAAIC;IACJ,MAAM3B,aAAa;QACjBP,MAAML,KAAKM,EAAE;QACbC,QAAQP,KAAKM,EAAE;QACfE,QAAQR,KAAKM,EAAE;IACjB;IACEG,cAAM,CAAiBC,kBAAkB,CAAC,IAAME;IAElD,oFAAoF;IACpF,MAAM4B,mBAAmB,CAACpB;QACxBT,gBAAgBC;QAChBO,kBAAkBP,YAAYQ;IAChC;IACA,MAAMqB,iBAAiB,IAAMzC,KAAK0C,KAAK,CAACL,qBAAqB,CAAC,SAAS,EAAE,SAAS3B,kBAAkB,CAAC,IAAMI;IAE3G6B,UAAU;QACRC,gCAAa,CAACC,IAAI,CAACC,IAAI,GAAG;YACxBC,SAAS;gBAAC;aAAuB;YACjCC,YAAY;gBAAErB,OAAOsB,yBAAe,CAACC,GAAG;gBAAEtB,OAAO;YAAO;YACxDuB,QAAQ;YACRC,QAAQ;QACV;QAEA,MAAMC,SAAwB,MAAMC,aAAI,CAACC,mBAAmB,CAAC;YAC3DC,WAAW;gBACTrB,4CAAqB;gBACrB;oBACEsB,SAASC,iCAAY;oBACrBC,UAAU;wBACRC,UAAU5D,KAAKM,EAAE;wBACjBuD,SAAS7D,KAAKM,EAAE;wBAChBwD,gBAAgB9D,KAAKM,EAAE,GAAGO,iBAAiB,CAACC;wBAC5CiD,qBAAqB/D,KAAKM,EAAE;wBAC5B0D,YAAYhE,KAAKM,EAAE;oBACrB;gBACF;gBACA;oBACEmD,SAASQ,2CAAiB;oBAC1BN,UAAU;wBACRO,mBAAmBlE,KAAKM,EAAE;wBAC1B6D,mBAAmBnE,KAAKM,EAAE;oBAC5B;gBACF;aACD;QACH,GAAG8D,OAAO;QAEVf,OAAOgB,SAAS,CAAC;YAAC;SAAQ;QAC1BhC,wBAAwBgB,OAAOiB,GAAG,CAAwBnC,4CAAqB;QAC/EI,oBAAoBc,OAAOiB,GAAG,CAA4BL,2CAAiB;QAC3E3B,eAAee,OAAOiB,GAAG,CAAuBZ,iCAAY;IAC9D;IAEAa,GAAG,qBAAqB;QACtBC,OAAOnC,uBAAuBoC,WAAW;QACzCD,OAAOlC,cAAcmC,WAAW;QAChCD,OAAOjC,mBAAmBkC,WAAW;QACrCD,OAAO5D,YAAY6D,WAAW;IAChC;IAEAF,GAAG,iEAAiE;QAClE,UAAU;QACV,MAAMG,YAAiB;YAAEhD,IAAI;YAAGC,OAAO;YAAUG,SAAS;YAAMC,UAAU;QAAK;QAC/EO,aAAasB,QAAQ,CAAC/C,iBAAiB,CAAC6D;QACxC,MAAMC,eAAoB;YAAE,GAAGD,SAAS;YAAEE,OAAO;QAAM;QACvDtC,aAAauB,OAAO,CAAChD,iBAAiB,CAAC8D;QACvC,MAAME,MAAM,MAAMxC,sBAAsByC,YAAY,CAAC,UAAU,QAAQ;QACvEN,OAAOK,KAAKE,OAAO,CAACJ;QACpBH,OAAOlC,aAAauB,OAAO,EAAEmB,oBAAoB,CAACN,WAAW,QAAQ;QACrEF,OAAO/D,cAAM,EAAEwE,GAAG,CAACC,gBAAgB,IAAG,mCAAmC;IAC3E;IAEAX,GAAG,sFAAsF;QACvF,0BAA0B;QAC1BjC,aAAasB,QAAQ,CAAC/C,iBAAiB,CAAC;YAAEc,OAAO;YAAQG,SAAS;YAAOC,UAAU;QAAM;QACzF,MAAMoD,kBAAkBnF,KAAK0C,KAAK,CAACL,qBAAqB,CAAC,SAAS,EAAE,SAAS3B,kBAAkB,CAAC,IAAMI;QACtG,MAAM0D,OAAOnC,sBAAsByC,YAAY,CAAC,QAAQ,QAAQM,OAAO,CAACC,OAAO,CAAC;QAChFb,OAAOW,iBAAiBD,gBAAgB;QAExC,4FAA4F;QAC5F,MAAMI,eAAoB9D,UAAU;YAAEE,IAAI;QAAE;QAC5CY,aAAasB,QAAQ,CAAC/C,iBAAiB,CAACyE;QACxC3E,gBAAgBC;QAChBO,kBAAkBP,YAAY;YAAC;gBAAE2E,KAAK;gBAAQC,IAAI;gBAAQC,MAAM;YAAmB;SAAE;QACrF,MAAMjB,OAAOnC,sBAAsByC,YAAY,CAAC,QAAQ,QAAQM,OAAO,CAACC,OAAO,CAAC;IAClF;IAEAd,GAAG,8EAA8E;QAC/E,mGAAmG;QACnG,MAAMe,eAAoB9D,UAAU;YAAEE,IAAI;QAAE;QAC5CY,aAAasB,QAAQ,CAAC/C,iBAAiB,CAACyE;QACxC,+CAA+C;QAC/CvE,sBAAsBH,YAAY8E,+BAAuB,EAAE;QAC3D,mEAAmE;QACnE,MAAMC,iBAAiB3F,KAAK0C,KAAK,CAACL,qBAAqB,CAAC,SAAS,EAAE,SAAS3B,kBAAkB,CAAC,IAAMI;QACrGwB,aAAawB,cAAc,CAAC8B,qBAAqB,CAAC,IAAIC,MAAM;QAC5D,MAAMC,OAAO,MAAMzD,sBAAsByC,YAAY,CAAC,QAAQ,UAAU;QACxEN,OAAOsB,MAAMC,QAAQ;QACrBvB,OAAOlC,aAAawB,cAAc,EAAEkB,oBAAoB,CAACM,cAAc,YAAY;QACnFd,OAAOmB,gBAAgBT,gBAAgB;QAEvC,2CAA2C;QAC3C5C,aAAawB,cAAc,CAACkC,SAAS;QACrC1D,aAAasB,QAAQ,CAAC/C,iBAAiB,CAAC;QACxCD,WAAWP,IAAI,CAACa,iBAAiB,CAAC,IAAIwE,+BAAuB,CAAC;QAC9D9E,WAAWJ,MAAM,CAACK,iBAAiB,CAACC;QACpC,MAAMmF,OAAO,MAAM5D,sBAAsByC,YAAY,CAAC,QAAQ;QAC9DN,OAAOyB,MAAMF,QAAQ;QACrBvB,OAAOlC,aAAawB,cAAc,EAAEmB,GAAG,CAACC,gBAAgB;IAC1D;IAEAX,GAAG,iGAAiG;QAClG,kEAAkE;QAClEjC,aAAasB,QAAQ,CAAC/C,iBAAiB,CAAC;QACxCF,gBAAgBC;QAChB,sCAAsC;QACtCO,kBAAkBP,YAAY;YAAC;gBAAE2E,KAAK;gBAAQC,IAAI;gBAAYC,MAAM3E;YAAU;SAAE;QAChF,MAAM6E,iBAAiB3F,KAAK0C,KAAK,CAACL,qBAAqB,CAAC,SAAS,EAAE,SAAS3B,kBAAkB,CAAC,IAAMI;QACrG,MAAMoF,OAAO,MAAM7D,sBAAsByC,YAAY,CAAC,QAAQ;QAC9DN,OAAO0B,MAAMH,QAAQ;QACrBvB,OAAOjC,kBAAkB2B,iBAAiB,EAAEe,GAAG,CAACC,gBAAgB;QAChEV,OAAOmB,gBAAgBT,gBAAgB;QAEvC,qDAAqD;QACrD,mEAAmE;QACnE,MAAMiB,eAAenG,KAAK0C,KAAK,CAAWL,uBAA8B;QACxE8D,aAAaC,qBAAqB,CAAC;YAAEb,KAAK;YAAQC,IAAI;YAAYC,MAAM;QAAmB;QAC3FlD,kBAAkB2B,iBAAiB,CAAC8B,SAAS;QAC7C1D,aAAasB,QAAQ,CAAC/C,iBAAiB,CAAC;QACxC,MAAMwF,cAAmB;YAAE3E,IAAI;YAAGC,OAAO;YAAQG,SAAS;YAAOC,UAAU;YAAMC,WAAWhC,KAAKM,EAAE;QAAG;QACtGiC,kBAAkB2B,iBAAiB,CAACrD,iBAAiB,CAACwF;QACtD,gEAAgE;QAChE/D,aAAa0B,UAAU,CAACnD,iBAAiB,CAACwF;QAC1C,sCAAsC;QACtC,MAAMC,kBAAkB7D;QACxBH,aAAawB,cAAc,CAAC8B,qBAAqB,CAAC,IAAIC,MAAM;QAC5D,MAAMU,OAAO,MAAMlE,sBAAsByC,YAAY,CAAC,QAAQ,OAAO;QACrEN,OAAOjC,kBAAkB2B,iBAAiB,EAAEc,oBAAoB,CAC9D;YAAErD,OAAO;YAAQC,OAAO;YAAoBC,UAAU;YAAO2E,WAAW;YAAQC,UAAU;YAAOC,MAAM;QAAE,GACzGlC,OAAOmC,QAAQ,GAAG,iBAAiB;;QAErCnC,OAAO+B,MAAMK,IAAI,CAACP;QAClB7B,OAAOlC,aAAawB,cAAc,EAAEkB,oBAAoB,CAACqB,aAAa,gBAAgB;QACtF7B,OAAO8B,iBAAiBpB,gBAAgB;QACxC,6CAA6C;QAC7C3C,kBAAkB2B,iBAAiB,CAAC8B,SAAS;QAC7C1D,aAAasB,QAAQ,CAAC/C,iBAAiB,CAAC;QACxC2B,iBAAiB;YAAC;gBAAE+C,KAAK;gBAASC,IAAI;gBAAcC,MAAM;oBAAC;oBAAqB;iBAAqB;YAAC;SAAE;QACxG,MAAMoB,eAAoB;YAAEnF,IAAI;YAAGC,OAAO;YAASK,WAAWhC,KAAKM,EAAE;QAAG;QACxEiC,kBAAkB2B,iBAAiB,CAACrD,iBAAiB,CAACgG;QACtDvE,aAAa0B,UAAU,CAACnD,iBAAiB,CAACgG;QAC1C,MAAMC,OAAO,MAAMzE,sBAAsByC,YAAY,CAAC,SAAS;QAC/DN,OAAOjC,kBAAkB2B,iBAAiB,EAAEc,oBAAoB,CAACR,OAAOuC,gBAAgB,CAAC;YAAEnF,OAAO;QAAoB,IAAI4C,OAAOmC,QAAQ;QACzInC,OAAOsC,MAAMF,IAAI,CAACC;IACpB;IAEAtC,GAAG,kGAAkG;QACnG,oEAAoE;QACpE,MAAMe,eAAoB9D,UAAU;YAAEE,IAAI;QAAE;QAC5CY,aAAasB,QAAQ,CAAC/C,iBAAiB,CAACyE;QACxC,yDAAyD;QACzD9C,iBAAiB;YAAC;gBAAE+C,KAAK;gBAAQC,IAAI;gBAAYC,MAAM;YAAmB;SAAE;QAC5E,4CAA4C;QAC5ClD,kBAAkB4B,iBAAiB,CAACtD,iBAAiB,CAACC;QACtD,2EAA2E;QAC3E,8EAA8E;QAC9E,MAAMkG,aAAahH,KAAK0C,KAAK,CAACuE,YAAiB,mBAAmBpG,iBAAiB,CAAC;QACpF,MAAMgE,MAAM,MAAMxC,sBAAsByC,YAAY,CAAC,QAAQ,sBAAsB;QACnFN,OAAOjC,kBAAkB4B,iBAAiB,EAAEa,oBAAoB,CAC9D,GACAR,OAAOuC,gBAAgB,CAAC;YACtBnF,OAAO;YACP4E,WAAW;YACXC,UAAU;QACZ;QAEF,iGAAiG;QACjGjC,OAAOc,aAAazD,QAAQ,EAAE+E,IAAI,CAAC;QACnC,yCAAyC;QACzCpC,OAAOc,aAAa1D,KAAK,EAAEgF,IAAI,CAAC;QAChCpC,OAAOc,cAAc4B,aAAa,CAAC;YAAEV,WAAW;YAAQC,UAAU;QAAM;QACxE,8BAA8B;QAC9BjC,OAAOlC,aAAawB,cAAc,EAAEkB,oBAAoB,CAACM,cAAc,aAAa;QACpF,qCAAqC;QACrCd,OAAOK,KAAK+B,IAAI,CAACtB;QAEjB,iGAAiG;QACjG/C,kBAAkB4B,iBAAiB,CAAC6B,SAAS;QAC7C1D,aAAawB,cAAc,CAACkC,SAAS;QACrC,wDAAwD;QACxDV,aAAa1D,KAAK,GAAG;QACrBoF,WAAWnG,iBAAiB,CAAC;QAC7B,MAAMoF,OAAO,MAAM5D,sBAAsByC,YAAY,CAAC,QAAQ,uBAAuB;QACrF,qEAAqE;QACrEN,OAAOjC,kBAAkB4B,iBAAiB,EAAEe,gBAAgB;QAC5D,MAAMiC,aAAa5E,kBAAkB4B,iBAAiB,CAAClE,IAAI,CAACmH,KAAK,CAAC,EAAE;QACpE5C,OAAO2C,UAAU,CAAC,EAAE,EAAEP,IAAI,CAAC;QAC3BpC,OAAO2C,UAAU,CAAC,EAAE,EAAEpC,OAAO,CAC3BP,OAAOuC,gBAAgB,CAAC;YACtBnF,OAAO;QACT;QAEF4C,OAAO2C,UAAU,CAAC,EAAE,EAAEpC,OAAO,CAACP,OAAOS,GAAG,CAAC8B,gBAAgB,CAAC;YAAElF,UAAU2C,OAAOmC,QAAQ;QAAG;QACxF,qCAAqC;QACrCnC,OAAOc,aAAazD,QAAQ,EAAE+E,IAAI,CAAC;QACnC,8BAA8B;QAC9BpC,OAAOlC,aAAawB,cAAc,EAAEkB,oBAAoB,CAACM,cAAc,aAAa;QACpF,qCAAqC;QACrCd,OAAOyB,MAAMW,IAAI,CAACtB;QAClB,sFAAsF;QACtF/C,kBAAkB4B,iBAAiB,CAAC6B,SAAS;QAC7C1D,aAAawB,cAAc,CAACkC,SAAS;QACrCgB,WAAWnG,iBAAiB,CAAC;QAC7B,uDAAuD;QACvD,MAAMwG,OAAO,MAAMhF,sBAAsByC,YAAY,CAAC,QAAQ,uBAAuB;QACrF,gCAAgC;QAChCN,OAAOjC,kBAAkB4B,iBAAiB,EAAEc,GAAG,CAACC,gBAAgB;QAChE,4CAA4C;QAC5CV,OAAOlC,aAAawB,cAAc,EAAEkB,oBAAoB,CAACM,cAAc,aAAa;QACpF,qCAAqC;QACrCd,OAAO6C,MAAMT,IAAI,CAACtB;IACpB;IAEAf,GAAG,mFAAmF;QACpF,mEAAmE;QACnE,MAAMe,eAAoB;YAAE5D,IAAI;YAAGC,OAAO;YAASG,SAAS;YAAOC,UAAU;QAAK;QAClFO,aAAasB,QAAQ,CAAC/C,iBAAiB,CAACyE;QACxC9C,iBAAiB,EAAE;QACnB,MAAM0D,OAAO,MAAM7D,sBAAsByC,YAAY,CAAC,SAAS,OAAO;QACtEN,OAAO0B,MAAMH,QAAQ;QACrBvB,OAAOlC,aAAawB,cAAc,EAAEkB,oBAAoB,CAACM,cAAc,aAAa;QAEpF,iEAAiE;QACjEtF,KAAKsH,aAAa;QAClB,MAAMC,gBAAqB;YAAE7F,IAAI;YAAIC,OAAO;YAAQG,SAAS;YAAOC,UAAU;QAAK;QACnFO,aAAasB,QAAQ,CAAC/C,iBAAiB,CAAC0G;QACxC5G,gBAAgBC;QAChBU,iBAAiBV,YAAY,IAAIiF,MAAM;QACvC,MAAMU,OAAO,MAAMlE,sBAAsByC,YAAY,CAAC,QAAQ,OAAO;QACrEN,OAAO+B,MAAMR,QAAQ;QACrBvB,OAAOlC,aAAawB,cAAc,EAAEkB,oBAAoB,CAACuC,eAAe,WAAW;IACrF;IAEAhD,GAAG,mEAAmE;QACpE,MAAMe,eAAoB9D,UAAU;YAAEE,IAAI;QAAG;QAC7CY,aAAasB,QAAQ,CAAC/C,iBAAiB,CAACyE;QACxC,2BAA2B;QAC3BvE,sBAAsBH,YAAY8E,+BAAuB,EAAE;QAC3D,uBAAuB;QACvBpD,aAAayB,mBAAmB,CAAClD,iBAAiB,CAAC;QACnD,MAAMgE,MAAM,MAAMxC,sBAAsByC,YAAY,CAAC,QAAQ,gBAAgB,YAAY;QACzFN,OAAOK,KAAK+B,IAAI,CAACtB;QACjBd,OAAOlC,aAAayB,mBAAmB,EAAEiB,oBAAoB,CAACM,cAAc,gBAAgB,YAAY;QACxGd,OAAOlC,aAAawB,cAAc,EAAEkB,oBAAoB,CAACM,cAAc,YAAY;IACrF;IAEAf,GAAG,kEAAkE;QACnE,oDAAoD;QACpDjC,aAAasB,QAAQ,CAAC/C,iBAAiB,CAAC;QACxC,MAAM2G,OAAO,IAAI3B,MAAM;QACvB,MAAM4B,OAAOC,OAAOC,MAAM,CAAC,IAAI9B,MAAM,yBAAyB;YAAE+B,MAAMC,MAAMC,IAAI,CAACC,gCAAkB,CAAC,CAAC,EAAE;QAAC;QACxGnH,WAAWP,IAAI,CAACa,iBAAiB,CAAC;YAAE8G,QAAQ;gBAACR;gBAAMC;aAAK;QAAC;QACzD7G,WAAWJ,MAAM,CAACK,iBAAiB,CAACC;QAEpC,4DAA4D;QAC5D,MAAM0D,OAAOnC,sBAAsByC,YAAY,CAAC,QAAQ,QAAQM,OAAO,CAACC,OAAO,CAAC;QAEhF,iHAAiH;QACjHzE,WAAWP,IAAI,CAAC4H,SAAS;QACzBrH,WAAWJ,MAAM,CAACyH,SAAS;QAC3B3F,aAAawB,cAAc,CAACkC,SAAS;QACrC1D,aAAasB,QAAQ,CAAC/C,iBAAiB,CAAC;QACxCD,WAAWP,IAAI,CAACa,iBAAiB,CAAC,IAAI2E,MAAM;QAC5CjF,WAAWJ,MAAM,CAACK,iBAAiB,CAACC;QAEpC,MAAM+D,MAAM,MAAMxC,sBAAsByC,YAAY,CAAC,QAAQ;QAC7DN,OAAOK,KAAKkB,QAAQ;QACpBvB,OAAOlC,aAAawB,cAAc,EAAEmB,GAAG,CAACC,gBAAgB;IAC1D;IAEAX,GAAG,yDAAyD;QAC1D,+CAA+C;QAC/C,MAAMe,eAAoB9D,UAAU;YAAEE,IAAI;YAAIE,OAAO;QAAa;QAClEU,aAAasB,QAAQ,CAAC/C,iBAAiB,CAACyE;QACxC,yFAAyF;QACzF9C,iBAAiB;YAAC;gBAAE+C,KAAK;gBAAQC,IAAI;gBAAYC,MAAM;YAAmB;SAAE;QAC5ElD,kBAAkB4B,iBAAiB,CAACjD,iBAAiB,CAAC,IAAI2E,MAAM;QAChE,6DAA6D;QAC7D7F,KAAK0C,KAAK,CAACuE,YAAiB,mBAAmBpG,iBAAiB,CAAC;QACjEb,KAAK0C,KAAK,CAACuE,YAAiB,iBAAiBiB,eAAe,CAAC;YAAE1B,WAAW;YAAQC,UAAU;QAAM;QAClG,MAAM5B,MAAM,MAAMxC,sBAAsByC,YAAY,CAAC,QAAQ;QAC7DN,OAAOjC,kBAAkB4B,iBAAiB,EAAEe,gBAAgB;QAC5D,6CAA6C;QAC7CV,OAAOc,aAAa1D,KAAK,EAAEgF,IAAI,CAAC;QAChCpC,OAAOK,KAAK+B,IAAI,CAACtB;IACnB;IAEAf,GAAG,uGAAuG;QACxG,iIAAiI;QACjI,MAAM4D,QAAa;YAAEzG,IAAI;YAAIC,OAAO;YAAQG,SAAS;YAAOC,UAAU;QAAK;QAC3EO,aAAasB,QAAQ,CAAC/C,iBAAiB,CAACsH;QACxCvH,WAAWP,IAAI,CAACQ,iBAAiB,CAACC;QAElC,qHAAqH;QACrHd,KAAKsH,aAAa;QAClB,MAAMc,QAAa5G,UAAU;YAAEE,IAAI;YAAIE,OAAO;QAAa;QAC3DU,aAAasB,QAAQ,CAAC/C,iBAAiB,CAACuH;QACxC5F,iBAAiB;YAAC;gBAAE+C,KAAK;gBAAQC,IAAI;gBAAYC,MAAM;YAAmB;SAAE;QAC5ElD,kBAAkB4B,iBAAiB,CAACtD,iBAAiB,CAACC;QAEtD,qFAAqF;QACrFd,KAAK0C,KAAK,CAACuE,YAAiB,mBAAmBpG,iBAAiB,CAAC;QACjEb,KAAK0C,KAAK,CAACuE,YAAiB,iBAAiBiB,eAAe,CAAC;YAAE1B,WAAW;YAAQC,UAAU;QAAM;QAClG,MAAMF,OAAO,MAAMlE,sBAAsByC,YAAY,CAAC,QAAQ,UAAU;QAExE,mCAAmC;QACnCN,OAAOjC,kBAAkB4B,iBAAiB,EAAEa,oBAAoB,CAC9D,IACAR,OAAOuC,gBAAgB,CAAC;YAAEnF,OAAO;YAAoB4E,WAAW;YAAQC,UAAU;QAAM;QAG1F,2EAA2E;QAC3EjC,OAAO4D,MAAMvG,QAAQ,EAAE+E,IAAI,CAAC;QAC5BpC,OAAO4D,MAAMxG,KAAK,EAAEgF,IAAI,CAAC;QACzBpC,OAAO4D,OAAOlB,aAAa,CAAC;YAAEV,WAAW;YAAQC,UAAU;QAAM;QACjEjC,OAAO+B,MAAMK,IAAI,CAACwB;IACpB;AACF"}

package/server/authentication/services/auth-methods/auth-method-two-fa.service.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../../../../../backend/src/authentication/services/auth-methods/auth-method-two-fa.service.ts"],"sourcesContent":["/*\n * Copyright (C) 2012-2025 Johan Legrand <johan.legrand@sync-in.com>\n * This file is part of Sync-in | The open source file sync and share solution\n * See the LICENSE file for licensing details\n */\n\nimport { HttpException, HttpStatus, Injectable, Logger } from '@nestjs/common'\nimport { Totp } from 'time2fa'\nimport { NOTIFICATION_APP, NOTIFICATION_APP_EVENT } from '../../../applications/notifications/constants/notifications'\nimport { NotificationContent } from '../../../applications/notifications/interfaces/notification-properties.interface'\nimport { NotificationsManager } from '../../../applications/notifications/services/notifications-manager.service'\nimport { UserModel } from '../../../applications/users/models/user.model'\nimport { UsersManager } from '../../../applications/users/services/users-manager.service'\nimport { ACTION } from '../../../common/constants'\nimport { generateShortUUID } from '../../../common/functions'\nimport { qrcodeToDataURL } from '../../../common/qrcode'\nimport { configuration } from '../../../configuration/config.environment'\nimport { Cache } from '../../../infrastructure/cache/services/cache.service'\nimport { TWO_FA_CODE_LENGTH } from '../../constants/auth'\nimport { TwoFaVerifyDto, TwoFaVerifyWithPasswordDto } from '../../dto/two-fa-verify.dto'\nimport { FastifyAuthenticatedRequest } from '../../interfaces/auth-request.interface'\nimport { TwoFaEnableResult, TwoFaSetup, TwoFaVerifyResult } from '../../interfaces/two-fa-setup.interface'\nimport { decryptSecret, encryptSecret } from '../../utils/crypt-secret'\n\n@Injectable()\nexport class AuthMethod2FA {\n  private readonly logger = new Logger(AuthMethod2FA.name)\n  private readonly cacheKeyPrefix = 'auth-2fa-pending-user-'\n\n  constructor(\n    private readonly cache: Cache,\n    private readonly usersManager: UsersManager,\n    private readonly notificationsManager: NotificationsManager\n  ) {}\n\n  async initTwoFactor(user: UserModel): Promise<TwoFaSetup> {\n    const { secret, qrDataUrl } = this.generateSecretAndQr(user.email)\n    // store encrypted secret in cache for 5 minutes\n    await this.cache.set(this.getCacheKey(user.id), this.encryptSecret(secret), 300)\n    return { secret, qrDataUrl }\n  }\n\n  async enableTwoFactor(body: TwoFaVerifyWithPasswordDto, req: FastifyAuthenticatedRequest): Promise<TwoFaEnableResult> {\n    // retrieve encrypted secret from cache\n    const secret: string = await this.cache.get(this.getCacheKey(req.user.id))\n    if (!secret) {\n      throw new HttpException('The secret has expired', HttpStatus.BAD_REQUEST)\n    }\n    // load user\n    const [auth, user] = await this.verify(body, req, true, secret)\n    if (!auth.success) {\n      throw new HttpException(auth.message, HttpStatus.FORBIDDEN)\n    }\n    // verify user password\n    await this.verifyUserPassword(user, body.password, req.ip)\n    // generate recovery codes\n    const recoveryCodes = this.generateRecoveryCodes()\n    // store and enable TwoFA & recovery codes\n    await this.usersManager.updateSecrets(user.id, {\n      twoFaSecret: secret,\n      recoveryCodes: recoveryCodes.map((code) => this.encryptSecret(code))\n    })\n    this.sendEmailNotification(req, ACTION.ADD)\n    return { ...auth, recoveryCodes: recoveryCodes }\n  }\n\n  async disableTwoFactor(body: TwoFaVerifyWithPasswordDto, req: FastifyAuthenticatedRequest): Promise<TwoFaVerifyResult> {\n    // load user\n    const [auth, user] = await this.verify(body, req, true)\n    if (!auth.success) {\n      throw new HttpException(auth.message, HttpStatus.FORBIDDEN)\n    }\n    // verify user password\n    await this.verifyUserPassword(user, body.password, req.ip)\n    // store and disable TwoFA & recovery codes\n    await this.usersManager.updateSecrets(user.id, { twoFaSecret: undefined, recoveryCodes: undefined })\n    this.sendEmailNotification(req, ACTION.DELETE)\n    return auth\n  }\n\n  async verify(verifyDto: TwoFaVerifyDto, req: FastifyAuthenticatedRequest, fromLogin?: false, secret?: string): Promise<TwoFaVerifyResult>\n  async verify(verifyDto: TwoFaVerifyDto, req: FastifyAuthenticatedRequest, fromLogin: true, secret?: string): Promise<[TwoFaVerifyResult, UserModel]>\n  async verify(\n    verifyDto: TwoFaVerifyDto,\n    req: FastifyAuthenticatedRequest,\n    fromLogin = false,\n    secret?: string\n  ): Promise<TwoFaVerifyResult | [TwoFaVerifyResult, UserModel]> {\n    const user = await this.loadUser(req.user.id, req.ip)\n    secret = secret || user.secrets.twoFaSecret\n    const auth = verifyDto.isRecoveryCode\n      ? await this.validateRecoveryCode(req.user.id, verifyDto.code, user.secrets.recoveryCodes)\n      : this.validateTwoFactorCode(verifyDto.code, secret)\n    this.usersManager.updateAccesses(user, req.ip, auth.success, true).catch((e: Error) => this.logger.error(`${this.verify.name} - ${e}`))\n    return fromLogin ? [auth, user] : auth\n  }\n\n  async adminResetUserTwoFa(userId: number) {\n    const auth: TwoFaVerifyResult = { success: false, message: '' }\n    try {\n      await this.usersManager.updateSecrets(userId, { twoFaSecret: undefined, recoveryCodes: undefined })\n      auth.success = true\n    } catch (e) {\n      auth.success = false\n      auth.message = e.message\n      this.logger.error(`${this.adminResetUserTwoFa.name} - ${e}`)\n    }\n    return auth\n  }\n\n  async loadUser(userId: number, ip: string) {\n    const user: UserModel = await this.usersManager.fromUserId(userId)\n    if (!user) {\n      this.logger.warn(`User ${userId} (${ip}) not found`)\n      throw new HttpException(`User not found`, HttpStatus.NOT_FOUND)\n    }\n    this.usersManager.validateUserAccess(user, ip)\n    return user\n  }\n\n  async verifyUserPassword(user: UserModel, password: string, ip: string) {\n    // This function works with any authentication method, provided that\n    // the authentication service implements proper user password updates in the database.\n    if (!(await this.usersManager.compareUserPassword(user.id, password))) {\n      this.usersManager.updateAccesses(user, ip, false, true).catch((e: Error) => this.logger.error(`${this.enableTwoFactor.name} - ${e}`))\n      throw new HttpException('Incorrect code or password', HttpStatus.BAD_REQUEST)\n    }\n  }\n\n  validateTwoFactorCode(code: string, encryptedSecret: string): TwoFaVerifyResult {\n    const auth: TwoFaVerifyResult = { success: false, message: '' }\n    if (!encryptedSecret) {\n      auth.message = 'Incorrect code or password'\n      return auth\n    }\n    try {\n      auth.success = Totp.validate({ passcode: code, secret: this.decryptSecret(encryptedSecret), drift: 1 })\n      if (!auth.success) auth.message = 'Incorrect code or password'\n    } catch (e) {\n      this.logger.error(`${this.validateTwoFactorCode.name} - ${e}`)\n      auth.message = e.message\n    }\n    return auth\n  }\n\n  private async validateRecoveryCode(userId: number, code: string, encryptedCodes: string[]): Promise<TwoFaVerifyResult> {\n    const auth: TwoFaVerifyResult = { success: false, message: '' }\n    if (!encryptedCodes || encryptedCodes.length === 0) {\n      auth.message = 'Invalid code'\n    } else {\n      try {\n        for (const encCode of encryptedCodes) {\n          if (code === this.decryptSecret(encCode)) {\n            auth.success = true\n            // removed used code\n            encryptedCodes.splice(encryptedCodes.indexOf(encCode), 1)\n            break\n          }\n        }\n        if (auth.success) {\n          // update recovery codes\n          await this.usersManager.updateSecrets(userId, { recoveryCodes: encryptedCodes })\n        } else {\n          auth.message = 'Invalid code'\n        }\n      } catch (e) {\n        this.logger.error(`${this.validateRecoveryCode.name} - ${e}`)\n        auth.message = e.message\n      }\n    }\n    return auth\n  }\n\n  private generateSecretAndQr(userEmail: string): TwoFaSetup {\n    // Generate secret + otpauth URL + QR (DataURL)\n    // Totp.generateKey returns { issuer, user, config, secret, url }\n    const key = Totp.generateKey({ issuer: configuration.auth.mfa.totp.issuer, user: userEmail }, { digits: TWO_FA_CODE_LENGTH })\n    const qrDataUrl = qrcodeToDataURL(key.url)\n    return { secret: key.secret, qrDataUrl: qrDataUrl }\n  }\n\n  private getCacheKey(userId: number): string {\n    return `${this.cacheKeyPrefix}${userId}`\n  }\n\n  private encryptSecret(secret: string): string {\n    if (configuration.auth.encryptionKey) {\n      return encryptSecret(secret, configuration.auth.encryptionKey)\n    }\n    return secret\n  }\n\n  private decryptSecret(secret: string): string {\n    if (configuration.auth.encryptionKey) {\n      return decryptSecret(secret, configuration.auth.encryptionKey)\n    }\n    return secret\n  }\n\n  private generateRecoveryCodes(count = 5): string[] {\n    return Array.from({ length: count }, () => generateShortUUID())\n  }\n\n  private sendEmailNotification(req: FastifyAuthenticatedRequest, action: ACTION) {\n    const notification: NotificationContent = {\n      app: NOTIFICATION_APP.AUTH_2FA,\n      event: NOTIFICATION_APP_EVENT.AUTH_2FA[action],\n      element: req.headers['user-agent'],\n      url: req.ip\n    }\n    this.notificationsManager\n      .sendEmailNotification([req.user], notification)\n      .catch((e: Error) => this.logger.error(`${this.sendEmailNotification.name} - ${e}`))\n  }\n}\n"],"names":["AuthMethod2FA","initTwoFactor","user","secret","qrDataUrl","generateSecretAndQr","email","cache","set","getCacheKey","id","encryptSecret","enableTwoFactor","body","req","get","HttpException","HttpStatus","BAD_REQUEST","auth","verify","success","message","FORBIDDEN","verifyUserPassword","password","ip","recoveryCodes","generateRecoveryCodes","usersManager","updateSecrets","twoFaSecret","map","code","sendEmailNotification","ACTION","ADD","disableTwoFactor","undefined","DELETE","verifyDto","fromLogin","loadUser","secrets","isRecoveryCode","validateRecoveryCode","validateTwoFactorCode","updateAccesses","catch","e","logger","error","name","adminResetUserTwoFa","userId","fromUserId","warn","NOT_FOUND","validateUserAccess","compareUserPassword","encryptedSecret","Totp","validate","passcode","decryptSecret","drift","encryptedCodes","length","encCode","splice","indexOf","userEmail","key","generateKey","issuer","configuration","mfa","totp","digits","TWO_FA_CODE_LENGTH","qrcodeToDataURL","url","cacheKeyPrefix","encryptionKey","count","Array","from","generateShortUUID","action","notification","app","NOTIFICATION_APP","AUTH_2FA","event","NOTIFICATION_APP_EVENT","element","headers","notificationsManager","Logger"],"mappings":"AAAA;;;;CAIC;;;;+BAqBYA;;;eAAAA;;;wBAnBiD;yBACzC;+BACoC;6CAEpB;qCAER;2BACN;2BACW;wBACF;mCACF;8BACR;sBACa;6BAIU;;;;;;;;;;AAGtC,IAAA,AAAMA,gBAAN,MAAMA;IAUX,MAAMC,cAAcC,IAAe,EAAuB;QACxD,MAAM,EAAEC,MAAM,EAAEC,SAAS,EAAE,GAAG,IAAI,CAACC,mBAAmB,CAACH,KAAKI,KAAK;QACjE,gDAAgD;QAChD,MAAM,IAAI,CAACC,KAAK,CAACC,GAAG,CAAC,IAAI,CAACC,WAAW,CAACP,KAAKQ,EAAE,GAAG,IAAI,CAACC,aAAa,CAACR,SAAS;QAC5E,OAAO;YAAEA;YAAQC;QAAU;IAC7B;IAEA,MAAMQ,gBAAgBC,IAAgC,EAAEC,GAAgC,EAA8B;QACpH,uCAAuC;QACvC,MAAMX,SAAiB,MAAM,IAAI,CAACI,KAAK,CAACQ,GAAG,CAAC,IAAI,CAACN,WAAW,CAACK,IAAIZ,IAAI,CAACQ,EAAE;QACxE,IAAI,CAACP,QAAQ;YACX,MAAM,IAAIa,qBAAa,CAAC,0BAA0BC,kBAAU,CAACC,WAAW;QAC1E;QACA,YAAY;QACZ,MAAM,CAACC,MAAMjB,KAAK,GAAG,MAAM,IAAI,CAACkB,MAAM,CAACP,MAAMC,KAAK,MAAMX;QACxD,IAAI,CAACgB,KAAKE,OAAO,EAAE;YACjB,MAAM,IAAIL,qBAAa,CAACG,KAAKG,OAAO,EAAEL,kBAAU,CAACM,SAAS;QAC5D;QACA,uBAAuB;QACvB,MAAM,IAAI,CAACC,kBAAkB,CAACtB,MAAMW,KAAKY,QAAQ,EAAEX,IAAIY,EAAE;QACzD,0BAA0B;QAC1B,MAAMC,gBAAgB,IAAI,CAACC,qBAAqB;QAChD,0CAA0C;QAC1C,MAAM,IAAI,CAACC,YAAY,CAACC,aAAa,CAAC5B,KAAKQ,EAAE,EAAE;YAC7CqB,aAAa5B;YACbwB,eAAeA,cAAcK,GAAG,CAAC,CAACC,OAAS,IAAI,CAACtB,aAAa,CAACsB;QAChE;QACA,IAAI,CAACC,qBAAqB,CAACpB,KAAKqB,iBAAM,CAACC,GAAG;QAC1C,OAAO;YAAE,GAAGjB,IAAI;YAAEQ,eAAeA;QAAc;IACjD;IAEA,MAAMU,iBAAiBxB,IAAgC,EAAEC,GAAgC,EAA8B;QACrH,YAAY;QACZ,MAAM,CAACK,MAAMjB,KAAK,GAAG,MAAM,IAAI,CAACkB,MAAM,CAACP,MAAMC,KAAK;QAClD,IAAI,CAACK,KAAKE,OAAO,EAAE;YACjB,MAAM,IAAIL,qBAAa,CAACG,KAAKG,OAAO,EAAEL,kBAAU,CAACM,SAAS;QAC5D;QACA,uBAAuB;QACvB,MAAM,IAAI,CAACC,kBAAkB,CAACtB,MAAMW,KAAKY,QAAQ,EAAEX,IAAIY,EAAE;QACzD,2CAA2C;QAC3C,MAAM,IAAI,CAACG,YAAY,CAACC,aAAa,CAAC5B,KAAKQ,EAAE,EAAE;YAAEqB,aAAaO;YAAWX,eAAeW;QAAU;QAClG,IAAI,CAACJ,qBAAqB,CAACpB,KAAKqB,iBAAM,CAACI,MAAM;QAC7C,OAAOpB;IACT;IAIA,MAAMC,OACJoB,SAAyB,EACzB1B,GAAgC,EAChC2B,YAAY,KAAK,EACjBtC,MAAe,EAC8C;QAC7D,MAAMD,OAAO,MAAM,IAAI,CAACwC,QAAQ,CAAC5B,IAAIZ,IAAI,CAACQ,EAAE,EAAEI,IAAIY,EAAE;QACpDvB,SAASA,UAAUD,KAAKyC,OAAO,CAACZ,WAAW;QAC3C,MAAMZ,OAAOqB,UAAUI,cAAc,GACjC,MAAM,IAAI,CAACC,oBAAoB,CAAC/B,IAAIZ,IAAI,CAACQ,EAAE,EAAE8B,UAAUP,IAAI,EAAE/B,KAAKyC,OAAO,CAAChB,aAAa,IACvF,IAAI,CAACmB,qBAAqB,CAACN,UAAUP,IAAI,EAAE9B;QAC/C,IAAI,CAAC0B,YAAY,CAACkB,cAAc,CAAC7C,MAAMY,IAAIY,EAAE,EAAEP,KAAKE,OAAO,EAAE,MAAM2B,KAAK,CAAC,CAACC,IAAa,IAAI,CAACC,MAAM,CAACC,KAAK,CAAC,GAAG,IAAI,CAAC/B,MAAM,CAACgC,IAAI,CAAC,GAAG,EAAEH,GAAG;QACrI,OAAOR,YAAY;YAACtB;YAAMjB;SAAK,GAAGiB;IACpC;IAEA,MAAMkC,oBAAoBC,MAAc,EAAE;QACxC,MAAMnC,OAA0B;YAAEE,SAAS;YAAOC,SAAS;QAAG;QAC9D,IAAI;YACF,MAAM,IAAI,CAACO,YAAY,CAACC,aAAa,CAACwB,QAAQ;gBAAEvB,aAAaO;gBAAWX,eAAeW;YAAU;YACjGnB,KAAKE,OAAO,GAAG;QACjB,EAAE,OAAO4B,GAAG;YACV9B,KAAKE,OAAO,GAAG;YACfF,KAAKG,OAAO,GAAG2B,EAAE3B,OAAO;YACxB,IAAI,CAAC4B,MAAM,CAACC,KAAK,CAAC,GAAG,IAAI,CAACE,mBAAmB,CAACD,IAAI,CAAC,GAAG,EAAEH,GAAG;QAC7D;QACA,OAAO9B;IACT;IAEA,MAAMuB,SAASY,MAAc,EAAE5B,EAAU,EAAE;QACzC,MAAMxB,OAAkB,MAAM,IAAI,CAAC2B,YAAY,CAAC0B,UAAU,CAACD;QAC3D,IAAI,CAACpD,MAAM;YACT,IAAI,CAACgD,MAAM,CAACM,IAAI,CAAC,CAAC,KAAK,EAAEF,OAAO,EAAE,EAAE5B,GAAG,WAAW,CAAC;YACnD,MAAM,IAAIV,qBAAa,CAAC,CAAC,cAAc,CAAC,EAAEC,kBAAU,CAACwC,SAAS;QAChE;QACA,IAAI,CAAC5B,YAAY,CAAC6B,kBAAkB,CAACxD,MAAMwB;QAC3C,OAAOxB;IACT;IAEA,MAAMsB,mBAAmBtB,IAAe,EAAEuB,QAAgB,EAAEC,EAAU,EAAE;QACtE,oEAAoE;QACpE,sFAAsF;QACtF,IAAI,CAAE,MAAM,IAAI,CAACG,YAAY,CAAC8B,mBAAmB,CAACzD,KAAKQ,EAAE,EAAEe,WAAY;YACrE,IAAI,CAACI,YAAY,CAACkB,cAAc,CAAC7C,MAAMwB,IAAI,OAAO,MAAMsB,KAAK,CAAC,CAACC,IAAa,IAAI,CAACC,MAAM,CAACC,KAAK,CAAC,GAAG,IAAI,CAACvC,eAAe,CAACwC,IAAI,CAAC,GAAG,EAAEH,GAAG;YACnI,MAAM,IAAIjC,qBAAa,CAAC,8BAA8BC,kBAAU,CAACC,WAAW;QAC9E;IACF;IAEA4B,sBAAsBb,IAAY,EAAE2B,eAAuB,EAAqB;QAC9E,MAAMzC,OAA0B;YAAEE,SAAS;YAAOC,SAAS;QAAG;QAC9D,IAAI,CAACsC,iBAAiB;YACpBzC,KAAKG,OAAO,GAAG;YACf,OAAOH;QACT;QACA,IAAI;YACFA,KAAKE,OAAO,GAAGwC,aAAI,CAACC,QAAQ,CAAC;gBAAEC,UAAU9B;gBAAM9B,QAAQ,IAAI,CAAC6D,aAAa,CAACJ;gBAAkBK,OAAO;YAAE;YACrG,IAAI,CAAC9C,KAAKE,OAAO,EAAEF,KAAKG,OAAO,GAAG;QACpC,EAAE,OAAO2B,GAAG;YACV,IAAI,CAACC,MAAM,CAACC,KAAK,CAAC,GAAG,IAAI,CAACL,qBAAqB,CAACM,IAAI,CAAC,GAAG,EAAEH,GAAG;YAC7D9B,KAAKG,OAAO,GAAG2B,EAAE3B,OAAO;QAC1B;QACA,OAAOH;IACT;IAEA,MAAc0B,qBAAqBS,MAAc,EAAErB,IAAY,EAAEiC,cAAwB,EAA8B;QACrH,MAAM/C,OAA0B;YAAEE,SAAS;YAAOC,SAAS;QAAG;QAC9D,IAAI,CAAC4C,kBAAkBA,eAAeC,MAAM,KAAK,GAAG;YAClDhD,KAAKG,OAAO,GAAG;QACjB,OAAO;YACL,IAAI;gBACF,KAAK,MAAM8C,WAAWF,eAAgB;oBACpC,IAAIjC,SAAS,IAAI,CAAC+B,aAAa,CAACI,UAAU;wBACxCjD,KAAKE,OAAO,GAAG;wBACf,oBAAoB;wBACpB6C,eAAeG,MAAM,CAACH,eAAeI,OAAO,CAACF,UAAU;wBACvD;oBACF;gBACF;gBACA,IAAIjD,KAAKE,OAAO,EAAE;oBAChB,wBAAwB;oBACxB,MAAM,IAAI,CAACQ,YAAY,CAACC,aAAa,CAACwB,QAAQ;wBAAE3B,eAAeuC;oBAAe;gBAChF,OAAO;oBACL/C,KAAKG,OAAO,GAAG;gBACjB;YACF,EAAE,OAAO2B,GAAG;gBACV,IAAI,CAACC,MAAM,CAACC,KAAK,CAAC,GAAG,IAAI,CAACN,oBAAoB,CAACO,IAAI,CAAC,GAAG,EAAEH,GAAG;gBAC5D9B,KAAKG,OAAO,GAAG2B,EAAE3B,OAAO;YAC1B;QACF;QACA,OAAOH;IACT;IAEQd,oBAAoBkE,SAAiB,EAAc;QACzD,+CAA+C;QAC/C,iEAAiE;QACjE,MAAMC,MAAMX,aAAI,CAACY,WAAW,CAAC;YAAEC,QAAQC,gCAAa,CAACxD,IAAI,CAACyD,GAAG,CAACC,IAAI,CAACH,MAAM;YAAExE,MAAMqE;QAAU,GAAG;YAAEO,QAAQC,wBAAkB;QAAC;QAC3H,MAAM3E,YAAY4E,IAAAA,uBAAe,EAACR,IAAIS,GAAG;QACzC,OAAO;YAAE9E,QAAQqE,IAAIrE,MAAM;YAAEC,WAAWA;QAAU;IACpD;IAEQK,YAAY6C,MAAc,EAAU;QAC1C,OAAO,GAAG,IAAI,CAAC4B,cAAc,GAAG5B,QAAQ;IAC1C;IAEQ3C,cAAcR,MAAc,EAAU;QAC5C,IAAIwE,gCAAa,CAACxD,IAAI,CAACgE,aAAa,EAAE;YACpC,OAAOxE,IAAAA,0BAAa,EAACR,QAAQwE,gCAAa,CAACxD,IAAI,CAACgE,aAAa;QAC/D;QACA,OAAOhF;IACT;IAEQ6D,cAAc7D,MAAc,EAAU;QAC5C,IAAIwE,gCAAa,CAACxD,IAAI,CAACgE,aAAa,EAAE;YACpC,OAAOnB,IAAAA,0BAAa,EAAC7D,QAAQwE,gCAAa,CAACxD,IAAI,CAACgE,aAAa;QAC/D;QACA,OAAOhF;IACT;IAEQyB,sBAAsBwD,QAAQ,CAAC,EAAY;QACjD,OAAOC,MAAMC,IAAI,CAAC;YAAEnB,QAAQiB;QAAM,GAAG,IAAMG,IAAAA,4BAAiB;IAC9D;IAEQrD,sBAAsBpB,GAAgC,EAAE0E,MAAc,EAAE;QAC9E,MAAMC,eAAoC;YACxCC,KAAKC,+BAAgB,CAACC,QAAQ;YAC9BC,OAAOC,qCAAsB,CAACF,QAAQ,CAACJ,OAAO;YAC9CO,SAASjF,IAAIkF,OAAO,CAAC,aAAa;YAClCf,KAAKnE,IAAIY,EAAE;QACb;QACA,IAAI,CAACuE,oBAAoB,CACtB/D,qBAAqB,CAAC;YAACpB,IAAIZ,IAAI;SAAC,EAAEuF,cAClCzC,KAAK,CAAC,CAACC,IAAa,IAAI,CAACC,MAAM,CAACC,KAAK,CAAC,GAAG,IAAI,CAACjB,qBAAqB,CAACkB,IAAI,CAAC,GAAG,EAAEH,GAAG;IACtF;IAxLA,YACE,AAAiB1C,KAAY,EAC7B,AAAiBsB,YAA0B,EAC3C,AAAiBoE,oBAA0C,CAC3D;aAHiB1F,QAAAA;aACAsB,eAAAA;aACAoE,uBAAAA;aANF/C,SAAS,IAAIgD,cAAM,CAAClG,cAAcoD,IAAI;aACtC8B,iBAAiB;IAM/B;AAqLL"}