@sync-in/server 1.11.0 → 2.0.0

package/server/authentication/providers/oidc/auth-provider-oidc.service.spec.js

@@ -0,0 +1,270 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", {
+    value: true
+});
+const _common = require("@nestjs/common");
+const _testing = require("@nestjs/testing");
+const _openidclient = require("openid-client");
+const _user = require("../../../applications/users/constants/user");
+const _adminusersmanagerservice = require("../../../applications/users/services/admin-users-manager.service");
+const _usersmanagerservice = require("../../../applications/users/services/users-manager.service");
+const _authoidcconstants = require("./auth-oidc.constants");
+const _authprovideroidcservice = require("./auth-provider-oidc.service");
+jest.mock('../../../configuration/config.environment', ()=>({
+        configuration: {
+            auth: {
+                oidc: {
+                    issuerUrl: 'https://issuer.example.test',
+                    clientId: 'client-id',
+                    clientSecret: 'client-secret',
+                    redirectUri: 'https://api.example.test/auth/oidc/callback',
+                    security: {
+                        scope: 'openid profile email',
+                        tokenSigningAlg: 'RS256',
+                        userInfoSigningAlg: 'RS256',
+                        tokenEndpointAuthMethod: 'client_secret_basic',
+                        skipSubjectCheck: false
+                    },
+                    options: {
+                        enablePasswordAuth: false,
+                        autoCreateUser: true,
+                        adminRoleOrGroup: 'admins',
+                        autoCreatePermissions: [
+                            'read'
+                        ]
+                    }
+                }
+            }
+        }
+    }));
+jest.mock('openid-client', ()=>{
+    let AuthorizationResponseError = class AuthorizationResponseError extends Error {
+        constructor(message, options){
+            super(message);
+            this.code = 'authorization_response_error';
+            this.error_description = options?.cause?.get('error_description') ?? message;
+        }
+    };
+    return {
+        allowInsecureRequests: jest.fn(),
+        authorizationCodeGrant: jest.fn(),
+        AuthorizationResponseError,
+        calculatePKCECodeChallenge: jest.fn(),
+        ClientSecretBasic: jest.fn(),
+        ClientSecretPost: jest.fn(),
+        Configuration: class {
+        },
+        discovery: jest.fn(),
+        fetchUserInfo: jest.fn(),
+        IDToken: class {
+        },
+        None: jest.fn(),
+        randomNonce: jest.fn(),
+        randomPKCECodeVerifier: jest.fn(),
+        randomState: jest.fn(),
+        skipSubjectCheck: Symbol('skipSubjectCheck'),
+        UserInfoResponse: class {
+        }
+    };
+});
+describe(_authprovideroidcservice.AuthProviderOIDC.name, ()=>{
+    let service;
+    let usersManager;
+    let adminUsersManager;
+    const makeConfig = (supportsPKCE = true)=>({
+            serverMetadata: ()=>({
+                    supportsPKCE: ()=>supportsPKCE,
+                    authorization_endpoint: 'https://issuer.example.test/authorize'
+                })
+        });
+    const makeReply = ()=>({
+            header: jest.fn().mockReturnThis(),
+            setCookie: jest.fn(),
+            clearCookie: jest.fn()
+        });
+    beforeAll(async ()=>{
+        usersManager = {
+            findUser: jest.fn(),
+            logUser: jest.fn(),
+            updateAccesses: jest.fn().mockResolvedValue(undefined),
+            fromUserId: jest.fn()
+        };
+        adminUsersManager = {
+            createUserOrGuest: jest.fn(),
+            updateUserOrGuest: jest.fn()
+        };
+        const module = await _testing.Test.createTestingModule({
+            providers: [
+                {
+                    provide: _usersmanagerservice.UsersManager,
+                    useValue: usersManager
+                },
+                {
+                    provide: _adminusersmanagerservice.AdminUsersManager,
+                    useValue: adminUsersManager
+                },
+                _authprovideroidcservice.AuthProviderOIDC
+            ]
+        }).compile();
+        module.useLogger([
+            'fatal'
+        ]);
+        service = module.get(_authprovideroidcservice.AuthProviderOIDC);
+    });
+    beforeEach(()=>{
+        jest.restoreAllMocks();
+        jest.clearAllMocks();
+    });
+    it('returns null when user is not found', async ()=>{
+        usersManager.findUser.mockResolvedValue(null);
+        const result = await service.validateUser('john', 'secret');
+        expect(result).toBeNull();
+        expect(usersManager.findUser).toHaveBeenCalledWith('john', false);
+        expect(usersManager.logUser).not.toHaveBeenCalled();
+    });
+    it('allows local password auth for guest users', async ()=>{
+        const guestUser = {
+            id: 1,
+            isGuest: true,
+            isAdmin: false
+        };
+        usersManager.findUser.mockResolvedValue(guestUser);
+        usersManager.logUser.mockResolvedValue(guestUser);
+        const result = await service.validateUser('guest', 'secret');
+        expect(usersManager.logUser).toHaveBeenCalledWith(guestUser, 'secret', undefined, undefined);
+        expect(result).toBe(guestUser);
+    });
+    it('builds the authorization url with PKCE data and cookies', async ()=>{
+        jest.spyOn(service, 'getConfig').mockResolvedValue(makeConfig(true));
+        _openidclient.randomState.mockReturnValue('state-1');
+        _openidclient.randomNonce.mockReturnValue('nonce-1');
+        _openidclient.randomPKCECodeVerifier.mockReturnValue('verifier-1');
+        _openidclient.calculatePKCECodeChallenge.mockResolvedValue('challenge-1');
+        const reply = makeReply();
+        const authUrl = await service.getAuthorizationUrl(reply);
+        expect(reply.header).toHaveBeenCalled();
+        expect(reply.setCookie).toHaveBeenCalledWith(_authoidcconstants.OAuthCookie.State, 'state-1', expect.any(Object));
+        expect(reply.setCookie).toHaveBeenCalledWith(_authoidcconstants.OAuthCookie.Nonce, 'nonce-1', expect.any(Object));
+        expect(reply.setCookie).toHaveBeenCalledWith(_authoidcconstants.OAuthCookie.CodeVerifier, 'verifier-1', expect.any(Object));
+        const url = new URL(authUrl);
+        expect(url.searchParams.get('code_challenge')).toBe('challenge-1');
+        expect(url.searchParams.get('client_id')).toBe('client-id');
+    });
+    it('handles callback success and clears cookies', async ()=>{
+        const config = makeConfig(true);
+        jest.spyOn(service, 'getConfig').mockResolvedValue(config);
+        const processSpy = jest.spyOn(service, 'processUserInfo').mockResolvedValue({
+            id: 7
+        });
+        _openidclient.authorizationCodeGrant.mockResolvedValue({
+            claims: ()=>({
+                    sub: 'subject-1'
+                }),
+            access_token: 'access-token'
+        });
+        _openidclient.fetchUserInfo.mockResolvedValue({
+            sub: 'subject-1',
+            email: 'a@b.c',
+            preferred_username: 'alice'
+        });
+        const req = {
+            cookies: {
+                [_authoidcconstants.OAuthCookie.State]: 'state-1',
+                [_authoidcconstants.OAuthCookie.Nonce]: 'nonce-1',
+                [_authoidcconstants.OAuthCookie.CodeVerifier]: 'verifier-1'
+            },
+            ip: '127.0.0.1'
+        };
+        const reply = makeReply();
+        const result = await service.handleCallback(req, reply, {
+            code: 'abc'
+        });
+        expect(result).toEqual({
+            id: 7
+        });
+        expect(processSpy).toHaveBeenCalledWith({
+            sub: 'subject-1',
+            email: 'a@b.c',
+            preferred_username: 'alice'
+        }, '127.0.0.1');
+        expect(reply.clearCookie).toHaveBeenCalledWith(_authoidcconstants.OAuthCookie.State, {
+            path: '/'
+        });
+        expect(reply.clearCookie).toHaveBeenCalledWith(_authoidcconstants.OAuthCookie.Nonce, {
+            path: '/'
+        });
+        expect(reply.clearCookie).toHaveBeenCalledWith(_authoidcconstants.OAuthCookie.CodeVerifier, {
+            path: '/'
+        });
+    });
+    it('rejects callback when state is missing', async ()=>{
+        jest.spyOn(service, 'getConfig').mockResolvedValue(makeConfig(false));
+        const reply = makeReply();
+        const req = {
+            cookies: {},
+            ip: '127.0.0.1'
+        };
+        await expect(service.handleCallback(req, reply, {
+            code: 'abc'
+        })).rejects.toMatchObject({
+            status: _common.HttpStatus.BAD_REQUEST
+        });
+        expect(reply.clearCookie).toHaveBeenCalledWith(_authoidcconstants.OAuthCookie.State, {
+            path: '/'
+        });
+    });
+    it('maps AuthorizationResponseError to BAD_REQUEST', async ()=>{
+        jest.spyOn(service, 'getConfig').mockResolvedValue(makeConfig(false));
+        _openidclient.authorizationCodeGrant.mockRejectedValue(new _openidclient.AuthorizationResponseError('access_denied', {
+            cause: new URLSearchParams('error=access_denied&error_description=No access')
+        }));
+        const req = {
+            cookies: {
+                [_authoidcconstants.OAuthCookie.State]: 'state-1',
+                [_authoidcconstants.OAuthCookie.Nonce]: 'nonce-1'
+            },
+            ip: '127.0.0.1'
+        };
+        const reply = makeReply();
+        await expect(service.handleCallback(req, reply, {
+            code: 'abc'
+        })).rejects.toMatchObject({
+            status: _common.HttpStatus.BAD_REQUEST,
+            message: 'No access'
+        });
+    });
+    it('builds the redirect callback url with token expirations', ()=>{
+        const url = service.getRedirectCallbackUrl(10, 20);
+        const parsed = new URL(url);
+        expect(parsed.hash).toContain('access_expiration=10');
+        expect(parsed.hash).toContain('refresh_expiration=20');
+    });
+    it('creates identities with admin role when claims match', async ()=>{
+        usersManager.findUser.mockResolvedValue(null);
+        adminUsersManager.createUserOrGuest.mockResolvedValue({
+            id: 10,
+            login: 'bob'
+        });
+        usersManager.fromUserId.mockResolvedValue({
+            id: 10,
+            role: _user.USER_ROLE.ADMINISTRATOR,
+            login: 'bob',
+            setFullName: jest.fn()
+        });
+        const userInfo = {
+            sub: 'x',
+            email: 'b@c.d',
+            preferred_username: 'bob',
+            groups: [
+                'admins'
+            ]
+        };
+        const result = await service.processUserInfo(userInfo, '127.0.0.1');
+        expect(adminUsersManager.createUserOrGuest).toHaveBeenCalledWith(expect.objectContaining({
+            role: _user.USER_ROLE.ADMINISTRATOR
+        }), _user.USER_ROLE.ADMINISTRATOR);
+        expect(result.role).toBe(_user.USER_ROLE.ADMINISTRATOR);
+    });
+});
+
+//# sourceMappingURL=auth-provider-oidc.service.spec.js.map

package/server/authentication/providers/oidc/auth-provider-oidc.service.spec.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../backend/src/authentication/providers/oidc/auth-provider-oidc.service.spec.ts"],"sourcesContent":["import { HttpStatus } from '@nestjs/common'\nimport { Test, TestingModule } from '@nestjs/testing'\nimport {\n  authorizationCodeGrant,\n  AuthorizationResponseError,\n  calculatePKCECodeChallenge,\n  fetchUserInfo,\n  randomNonce,\n  randomPKCECodeVerifier,\n  randomState\n} from 'openid-client'\nimport { USER_ROLE } from '../../../applications/users/constants/user'\nimport { AdminUsersManager } from '../../../applications/users/services/admin-users-manager.service'\nimport { UsersManager } from '../../../applications/users/services/users-manager.service'\nimport { OAuthCookie } from './auth-oidc.constants'\nimport { AuthProviderOIDC } from './auth-provider-oidc.service'\n\njest.mock('../../../configuration/config.environment', () => ({\n  configuration: {\n    auth: {\n      oidc: {\n        issuerUrl: 'https://issuer.example.test',\n        clientId: 'client-id',\n        clientSecret: 'client-secret',\n        redirectUri: 'https://api.example.test/auth/oidc/callback',\n        security: {\n          scope: 'openid profile email',\n          tokenSigningAlg: 'RS256',\n          userInfoSigningAlg: 'RS256',\n          tokenEndpointAuthMethod: 'client_secret_basic',\n          skipSubjectCheck: false\n        },\n        options: {\n          enablePasswordAuth: false,\n          autoCreateUser: true,\n          adminRoleOrGroup: 'admins',\n          autoCreatePermissions: ['read']\n        }\n      }\n    }\n  }\n}))\n\njest.mock('openid-client', () => {\n  class AuthorizationResponseError extends Error {\n    code: string\n    error_description: string\n    constructor(message: string, options: { cause: URLSearchParams }) {\n      super(message)\n      this.code = 'authorization_response_error'\n      this.error_description = options?.cause?.get('error_description') ?? message\n    }\n  }\n\n  return {\n    allowInsecureRequests: jest.fn(),\n    authorizationCodeGrant: jest.fn(),\n    AuthorizationResponseError,\n    calculatePKCECodeChallenge: jest.fn(),\n    ClientSecretBasic: jest.fn(),\n    ClientSecretPost: jest.fn(),\n    Configuration: class {},\n    discovery: jest.fn(),\n    fetchUserInfo: jest.fn(),\n    IDToken: class {},\n    None: jest.fn(),\n    randomNonce: jest.fn(),\n    randomPKCECodeVerifier: jest.fn(),\n    randomState: jest.fn(),\n    skipSubjectCheck: Symbol('skipSubjectCheck'),\n    UserInfoResponse: class {}\n  }\n})\n\ndescribe(AuthProviderOIDC.name, () => {\n  let service: AuthProviderOIDC\n  let usersManager: {\n    findUser: jest.Mock\n    logUser: jest.Mock\n    updateAccesses: jest.Mock\n    fromUserId: jest.Mock\n  }\n  let adminUsersManager: {\n    createUserOrGuest: jest.Mock\n    updateUserOrGuest: jest.Mock\n  }\n\n  const makeConfig = (supportsPKCE = true) => ({\n    serverMetadata: () => ({\n      supportsPKCE: () => supportsPKCE,\n      authorization_endpoint: 'https://issuer.example.test/authorize'\n    })\n  })\n\n  const makeReply = () => ({\n    header: jest.fn().mockReturnThis(),\n    setCookie: jest.fn(),\n    clearCookie: jest.fn()\n  })\n\n  beforeAll(async () => {\n    usersManager = {\n      findUser: jest.fn(),\n      logUser: jest.fn(),\n      updateAccesses: jest.fn().mockResolvedValue(undefined),\n      fromUserId: jest.fn()\n    }\n    adminUsersManager = {\n      createUserOrGuest: jest.fn(),\n      updateUserOrGuest: jest.fn()\n    }\n\n    const module: TestingModule = await Test.createTestingModule({\n      providers: [{ provide: UsersManager, useValue: usersManager }, { provide: AdminUsersManager, useValue: adminUsersManager }, AuthProviderOIDC]\n    }).compile()\n\n    module.useLogger(['fatal'])\n    service = module.get<AuthProviderOIDC>(AuthProviderOIDC)\n  })\n\n  beforeEach(() => {\n    jest.restoreAllMocks()\n    jest.clearAllMocks()\n  })\n\n  it('returns null when user is not found', async () => {\n    usersManager.findUser.mockResolvedValue(null)\n\n    const result = await service.validateUser('john', 'secret')\n\n    expect(result).toBeNull()\n    expect(usersManager.findUser).toHaveBeenCalledWith('john', false)\n    expect(usersManager.logUser).not.toHaveBeenCalled()\n  })\n\n  it('allows local password auth for guest users', async () => {\n    const guestUser = { id: 1, isGuest: true, isAdmin: false } as any\n    usersManager.findUser.mockResolvedValue(guestUser)\n    usersManager.logUser.mockResolvedValue(guestUser)\n\n    const result = await service.validateUser('guest', 'secret')\n\n    expect(usersManager.logUser).toHaveBeenCalledWith(guestUser, 'secret', undefined, undefined)\n    expect(result).toBe(guestUser)\n  })\n\n  it('builds the authorization url with PKCE data and cookies', async () => {\n    jest.spyOn(service, 'getConfig').mockResolvedValue(makeConfig(true) as any)\n    ;(randomState as jest.Mock).mockReturnValue('state-1')\n    ;(randomNonce as jest.Mock).mockReturnValue('nonce-1')\n    ;(randomPKCECodeVerifier as jest.Mock).mockReturnValue('verifier-1')\n    ;(calculatePKCECodeChallenge as jest.Mock).mockResolvedValue('challenge-1')\n    const reply = makeReply()\n\n    const authUrl = await service.getAuthorizationUrl(reply as any)\n\n    expect(reply.header).toHaveBeenCalled()\n    expect(reply.setCookie).toHaveBeenCalledWith(OAuthCookie.State, 'state-1', expect.any(Object))\n    expect(reply.setCookie).toHaveBeenCalledWith(OAuthCookie.Nonce, 'nonce-1', expect.any(Object))\n    expect(reply.setCookie).toHaveBeenCalledWith(OAuthCookie.CodeVerifier, 'verifier-1', expect.any(Object))\n    const url = new URL(authUrl)\n    expect(url.searchParams.get('code_challenge')).toBe('challenge-1')\n    expect(url.searchParams.get('client_id')).toBe('client-id')\n  })\n\n  it('handles callback success and clears cookies', async () => {\n    const config = makeConfig(true)\n    jest.spyOn(service, 'getConfig').mockResolvedValue(config as any)\n    const processSpy = jest.spyOn(service as any, 'processUserInfo').mockResolvedValue({ id: 7 } as any)\n    ;(authorizationCodeGrant as jest.Mock).mockResolvedValue({\n      claims: () => ({ sub: 'subject-1' }),\n      access_token: 'access-token'\n    })\n    ;(fetchUserInfo as jest.Mock).mockResolvedValue({ sub: 'subject-1', email: 'a@b.c', preferred_username: 'alice' })\n    const req = {\n      cookies: {\n        [OAuthCookie.State]: 'state-1',\n        [OAuthCookie.Nonce]: 'nonce-1',\n        [OAuthCookie.CodeVerifier]: 'verifier-1'\n      },\n      ip: '127.0.0.1'\n    }\n    const reply = makeReply()\n\n    const result = await service.handleCallback(req as any, reply as any, { code: 'abc' })\n\n    expect(result).toEqual({ id: 7 })\n    expect(processSpy).toHaveBeenCalledWith({ sub: 'subject-1', email: 'a@b.c', preferred_username: 'alice' }, '127.0.0.1')\n    expect(reply.clearCookie).toHaveBeenCalledWith(OAuthCookie.State, { path: '/' })\n    expect(reply.clearCookie).toHaveBeenCalledWith(OAuthCookie.Nonce, { path: '/' })\n    expect(reply.clearCookie).toHaveBeenCalledWith(OAuthCookie.CodeVerifier, { path: '/' })\n  })\n\n  it('rejects callback when state is missing', async () => {\n    jest.spyOn(service, 'getConfig').mockResolvedValue(makeConfig(false) as any)\n    const reply = makeReply()\n    const req = { cookies: {}, ip: '127.0.0.1' }\n\n    await expect(service.handleCallback(req as any, reply as any, { code: 'abc' })).rejects.toMatchObject({ status: HttpStatus.BAD_REQUEST })\n    expect(reply.clearCookie).toHaveBeenCalledWith(OAuthCookie.State, { path: '/' })\n  })\n\n  it('maps AuthorizationResponseError to BAD_REQUEST', async () => {\n    jest.spyOn(service, 'getConfig').mockResolvedValue(makeConfig(false) as any)\n    ;(authorizationCodeGrant as jest.Mock).mockRejectedValue(\n      new AuthorizationResponseError('access_denied', {\n        cause: new URLSearchParams('error=access_denied&error_description=No access')\n      })\n    )\n    const req = {\n      cookies: {\n        [OAuthCookie.State]: 'state-1',\n        [OAuthCookie.Nonce]: 'nonce-1'\n      },\n      ip: '127.0.0.1'\n    }\n    const reply = makeReply()\n\n    await expect(service.handleCallback(req as any, reply as any, { code: 'abc' })).rejects.toMatchObject({\n      status: HttpStatus.BAD_REQUEST,\n      message: 'No access'\n    })\n  })\n\n  it('builds the redirect callback url with token expirations', () => {\n    const url = service.getRedirectCallbackUrl(10, 20)\n    const parsed = new URL(url)\n    expect(parsed.hash).toContain('access_expiration=10')\n    expect(parsed.hash).toContain('refresh_expiration=20')\n  })\n\n  it('creates identities with admin role when claims match', async () => {\n    usersManager.findUser.mockResolvedValue(null)\n    adminUsersManager.createUserOrGuest.mockResolvedValue({ id: 10, login: 'bob' })\n    usersManager.fromUserId.mockResolvedValue({ id: 10, role: USER_ROLE.ADMINISTRATOR, login: 'bob', setFullName: jest.fn() } as any)\n    const userInfo = { sub: 'x', email: 'b@c.d', preferred_username: 'bob', groups: ['admins'] }\n\n    const result = await (service as any).processUserInfo(userInfo, '127.0.0.1')\n\n    expect(adminUsersManager.createUserOrGuest).toHaveBeenCalledWith(\n      expect.objectContaining({ role: USER_ROLE.ADMINISTRATOR }),\n      USER_ROLE.ADMINISTRATOR\n    )\n    expect(result.role).toBe(USER_ROLE.ADMINISTRATOR)\n  })\n})\n"],"names":["jest","mock","configuration","auth","oidc","issuerUrl","clientId","clientSecret","redirectUri","security","scope","tokenSigningAlg","userInfoSigningAlg","tokenEndpointAuthMethod","skipSubjectCheck","options","enablePasswordAuth","autoCreateUser","adminRoleOrGroup","autoCreatePermissions","AuthorizationResponseError","Error","message","code","error_description","cause","get","allowInsecureRequests","fn","authorizationCodeGrant","calculatePKCECodeChallenge","ClientSecretBasic","ClientSecretPost","Configuration","discovery","fetchUserInfo","IDToken","None","randomNonce","randomPKCECodeVerifier","randomState","Symbol","UserInfoResponse","describe","AuthProviderOIDC","name","service","usersManager","adminUsersManager","makeConfig","supportsPKCE","serverMetadata","authorization_endpoint","makeReply","header","mockReturnThis","setCookie","clearCookie","beforeAll","findUser","logUser","updateAccesses","mockResolvedValue","undefined","fromUserId","createUserOrGuest","updateUserOrGuest","module","Test","createTestingModule","providers","provide","UsersManager","useValue","AdminUsersManager","compile","useLogger","beforeEach","restoreAllMocks","clearAllMocks","it","result","validateUser","expect","toBeNull","toHaveBeenCalledWith","not","toHaveBeenCalled","guestUser","id","isGuest","isAdmin","toBe","spyOn","mockReturnValue","reply","authUrl","getAuthorizationUrl","OAuthCookie","State","any","Object","Nonce","CodeVerifier","url","URL","searchParams","config","processSpy","claims","sub","access_token","email","preferred_username","req","cookies","ip","handleCallback","toEqual","path","rejects","toMatchObject","status","HttpStatus","BAD_REQUEST","mockRejectedValue","URLSearchParams","getRedirectCallbackUrl","parsed","hash","toContain","login","role","USER_ROLE","ADMINISTRATOR","setFullName","userInfo","groups","processUserInfo","objectContaining"],"mappings":";;;;wBAA2B;yBACS;8BAS7B;sBACmB;0CACQ;qCACL;mCACD;yCACK;AAEjCA,KAAKC,IAAI,CAAC,6CAA6C,IAAO,CAAA;QAC5DC,eAAe;YACbC,MAAM;gBACJC,MAAM;oBACJC,WAAW;oBACXC,UAAU;oBACVC,cAAc;oBACdC,aAAa;oBACbC,UAAU;wBACRC,OAAO;wBACPC,iBAAiB;wBACjBC,oBAAoB;wBACpBC,yBAAyB;wBACzBC,kBAAkB;oBACpB;oBACAC,SAAS;wBACPC,oBAAoB;wBACpBC,gBAAgB;wBAChBC,kBAAkB;wBAClBC,uBAAuB;4BAAC;yBAAO;oBACjC;gBACF;YACF;QACF;IACF,CAAA;AAEAnB,KAAKC,IAAI,CAAC,iBAAiB;IACzB,IAAA,AAAMmB,6BAAN,MAAMA,mCAAmCC;QAGvC,YAAYC,OAAe,EAAEP,OAAmC,CAAE;YAChE,KAAK,CAACO;YACN,IAAI,CAACC,IAAI,GAAG;YACZ,IAAI,CAACC,iBAAiB,GAAGT,SAASU,OAAOC,IAAI,wBAAwBJ;QACvE;IACF;IAEA,OAAO;QACLK,uBAAuB3B,KAAK4B,EAAE;QAC9BC,wBAAwB7B,KAAK4B,EAAE;QAC/BR;QACAU,4BAA4B9B,KAAK4B,EAAE;QACnCG,mBAAmB/B,KAAK4B,EAAE;QAC1BI,kBAAkBhC,KAAK4B,EAAE;QACzBK,eAAe;QAAO;QACtBC,WAAWlC,KAAK4B,EAAE;QAClBO,eAAenC,KAAK4B,EAAE;QACtBQ,SAAS;QAAO;QAChBC,MAAMrC,KAAK4B,EAAE;QACbU,aAAatC,KAAK4B,EAAE;QACpBW,wBAAwBvC,KAAK4B,EAAE;QAC/BY,aAAaxC,KAAK4B,EAAE;QACpBd,kBAAkB2B,OAAO;QACzBC,kBAAkB;QAAO;IAC3B;AACF;AAEAC,SAASC,yCAAgB,CAACC,IAAI,EAAE;IAC9B,IAAIC;IACJ,IAAIC;IAMJ,IAAIC;IAKJ,MAAMC,aAAa,CAACC,eAAe,IAAI,GAAM,CAAA;YAC3CC,gBAAgB,IAAO,CAAA;oBACrBD,cAAc,IAAMA;oBACpBE,wBAAwB;gBAC1B,CAAA;QACF,CAAA;IAEA,MAAMC,YAAY,IAAO,CAAA;YACvBC,QAAQtD,KAAK4B,EAAE,GAAG2B,cAAc;YAChCC,WAAWxD,KAAK4B,EAAE;YAClB6B,aAAazD,KAAK4B,EAAE;QACtB,CAAA;IAEA8B,UAAU;QACRX,eAAe;YACbY,UAAU3D,KAAK4B,EAAE;YACjBgC,SAAS5D,KAAK4B,EAAE;YAChBiC,gBAAgB7D,KAAK4B,EAAE,GAAGkC,iBAAiB,CAACC;YAC5CC,YAAYhE,KAAK4B,EAAE;QACrB;QACAoB,oBAAoB;YAClBiB,mBAAmBjE,KAAK4B,EAAE;YAC1BsC,mBAAmBlE,KAAK4B,EAAE;QAC5B;QAEA,MAAMuC,SAAwB,MAAMC,aAAI,CAACC,mBAAmB,CAAC;YAC3DC,WAAW;gBAAC;oBAAEC,SAASC,iCAAY;oBAAEC,UAAU1B;gBAAa;gBAAG;oBAAEwB,SAASG,2CAAiB;oBAAED,UAAUzB;gBAAkB;gBAAGJ,yCAAgB;aAAC;QAC/I,GAAG+B,OAAO;QAEVR,OAAOS,SAAS,CAAC;YAAC;SAAQ;QAC1B9B,UAAUqB,OAAOzC,GAAG,CAAmBkB,yCAAgB;IACzD;IAEAiC,WAAW;QACT7E,KAAK8E,eAAe;QACpB9E,KAAK+E,aAAa;IACpB;IAEAC,GAAG,uCAAuC;QACxCjC,aAAaY,QAAQ,CAACG,iBAAiB,CAAC;QAExC,MAAMmB,SAAS,MAAMnC,QAAQoC,YAAY,CAAC,QAAQ;QAElDC,OAAOF,QAAQG,QAAQ;QACvBD,OAAOpC,aAAaY,QAAQ,EAAE0B,oBAAoB,CAAC,QAAQ;QAC3DF,OAAOpC,aAAaa,OAAO,EAAE0B,GAAG,CAACC,gBAAgB;IACnD;IAEAP,GAAG,8CAA8C;QAC/C,MAAMQ,YAAY;YAAEC,IAAI;YAAGC,SAAS;YAAMC,SAAS;QAAM;QACzD5C,aAAaY,QAAQ,CAACG,iBAAiB,CAAC0B;QACxCzC,aAAaa,OAAO,CAACE,iBAAiB,CAAC0B;QAEvC,MAAMP,SAAS,MAAMnC,QAAQoC,YAAY,CAAC,SAAS;QAEnDC,OAAOpC,aAAaa,OAAO,EAAEyB,oBAAoB,CAACG,WAAW,UAAUzB,WAAWA;QAClFoB,OAAOF,QAAQW,IAAI,CAACJ;IACtB;IAEAR,GAAG,2DAA2D;QAC5DhF,KAAK6F,KAAK,CAAC/C,SAAS,aAAagB,iBAAiB,CAACb,WAAW;QAC5DT,yBAAW,CAAesD,eAAe,CAAC;QAC1CxD,yBAAW,CAAewD,eAAe,CAAC;QAC1CvD,oCAAsB,CAAeuD,eAAe,CAAC;QACrDhE,wCAA0B,CAAegC,iBAAiB,CAAC;QAC7D,MAAMiC,QAAQ1C;QAEd,MAAM2C,UAAU,MAAMlD,QAAQmD,mBAAmB,CAACF;QAElDZ,OAAOY,MAAMzC,MAAM,EAAEiC,gBAAgB;QACrCJ,OAAOY,MAAMvC,SAAS,EAAE6B,oBAAoB,CAACa,8BAAW,CAACC,KAAK,EAAE,WAAWhB,OAAOiB,GAAG,CAACC;QACtFlB,OAAOY,MAAMvC,SAAS,EAAE6B,oBAAoB,CAACa,8BAAW,CAACI,KAAK,EAAE,WAAWnB,OAAOiB,GAAG,CAACC;QACtFlB,OAAOY,MAAMvC,SAAS,EAAE6B,oBAAoB,CAACa,8BAAW,CAACK,YAAY,EAAE,cAAcpB,OAAOiB,GAAG,CAACC;QAChG,MAAMG,MAAM,IAAIC,IAAIT;QACpBb,OAAOqB,IAAIE,YAAY,CAAChF,GAAG,CAAC,mBAAmBkE,IAAI,CAAC;QACpDT,OAAOqB,IAAIE,YAAY,CAAChF,GAAG,CAAC,cAAckE,IAAI,CAAC;IACjD;IAEAZ,GAAG,+CAA+C;QAChD,MAAM2B,SAAS1D,WAAW;QAC1BjD,KAAK6F,KAAK,CAAC/C,SAAS,aAAagB,iBAAiB,CAAC6C;QACnD,MAAMC,aAAa5G,KAAK6F,KAAK,CAAC/C,SAAgB,mBAAmBgB,iBAAiB,CAAC;YAAE2B,IAAI;QAAE;QACzF5D,oCAAsB,CAAeiC,iBAAiB,CAAC;YACvD+C,QAAQ,IAAO,CAAA;oBAAEC,KAAK;gBAAY,CAAA;YAClCC,cAAc;QAChB;QACE5E,2BAAa,CAAe2B,iBAAiB,CAAC;YAAEgD,KAAK;YAAaE,OAAO;YAASC,oBAAoB;QAAQ;QAChH,MAAMC,MAAM;YACVC,SAAS;gBACP,CAACjB,8BAAW,CAACC,KAAK,CAAC,EAAE;gBACrB,CAACD,8BAAW,CAACI,KAAK,CAAC,EAAE;gBACrB,CAACJ,8BAAW,CAACK,YAAY,CAAC,EAAE;YAC9B;YACAa,IAAI;QACN;QACA,MAAMrB,QAAQ1C;QAEd,MAAM4B,SAAS,MAAMnC,QAAQuE,cAAc,CAACH,KAAYnB,OAAc;YAAExE,MAAM;QAAM;QAEpF4D,OAAOF,QAAQqC,OAAO,CAAC;YAAE7B,IAAI;QAAE;QAC/BN,OAAOyB,YAAYvB,oBAAoB,CAAC;YAAEyB,KAAK;YAAaE,OAAO;YAASC,oBAAoB;QAAQ,GAAG;QAC3G9B,OAAOY,MAAMtC,WAAW,EAAE4B,oBAAoB,CAACa,8BAAW,CAACC,KAAK,EAAE;YAAEoB,MAAM;QAAI;QAC9EpC,OAAOY,MAAMtC,WAAW,EAAE4B,oBAAoB,CAACa,8BAAW,CAACI,KAAK,EAAE;YAAEiB,MAAM;QAAI;QAC9EpC,OAAOY,MAAMtC,WAAW,EAAE4B,oBAAoB,CAACa,8BAAW,CAACK,YAAY,EAAE;YAAEgB,MAAM;QAAI;IACvF;IAEAvC,GAAG,0CAA0C;QAC3ChF,KAAK6F,KAAK,CAAC/C,SAAS,aAAagB,iBAAiB,CAACb,WAAW;QAC9D,MAAM8C,QAAQ1C;QACd,MAAM6D,MAAM;YAAEC,SAAS,CAAC;YAAGC,IAAI;QAAY;QAE3C,MAAMjC,OAAOrC,QAAQuE,cAAc,CAACH,KAAYnB,OAAc;YAAExE,MAAM;QAAM,IAAIiG,OAAO,CAACC,aAAa,CAAC;YAAEC,QAAQC,kBAAU,CAACC,WAAW;QAAC;QACvIzC,OAAOY,MAAMtC,WAAW,EAAE4B,oBAAoB,CAACa,8BAAW,CAACC,KAAK,EAAE;YAAEoB,MAAM;QAAI;IAChF;IAEAvC,GAAG,kDAAkD;QACnDhF,KAAK6F,KAAK,CAAC/C,SAAS,aAAagB,iBAAiB,CAACb,WAAW;QAC5DpB,oCAAsB,CAAegG,iBAAiB,CACtD,IAAIzG,wCAA0B,CAAC,iBAAiB;YAC9CK,OAAO,IAAIqG,gBAAgB;QAC7B;QAEF,MAAMZ,MAAM;YACVC,SAAS;gBACP,CAACjB,8BAAW,CAACC,KAAK,CAAC,EAAE;gBACrB,CAACD,8BAAW,CAACI,KAAK,CAAC,EAAE;YACvB;YACAc,IAAI;QACN;QACA,MAAMrB,QAAQ1C;QAEd,MAAM8B,OAAOrC,QAAQuE,cAAc,CAACH,KAAYnB,OAAc;YAAExE,MAAM;QAAM,IAAIiG,OAAO,CAACC,aAAa,CAAC;YACpGC,QAAQC,kBAAU,CAACC,WAAW;YAC9BtG,SAAS;QACX;IACF;IAEA0D,GAAG,2DAA2D;QAC5D,MAAMwB,MAAM1D,QAAQiF,sBAAsB,CAAC,IAAI;QAC/C,MAAMC,SAAS,IAAIvB,IAAID;QACvBrB,OAAO6C,OAAOC,IAAI,EAAEC,SAAS,CAAC;QAC9B/C,OAAO6C,OAAOC,IAAI,EAAEC,SAAS,CAAC;IAChC;IAEAlD,GAAG,wDAAwD;QACzDjC,aAAaY,QAAQ,CAACG,iBAAiB,CAAC;QACxCd,kBAAkBiB,iBAAiB,CAACH,iBAAiB,CAAC;YAAE2B,IAAI;YAAI0C,OAAO;QAAM;QAC7EpF,aAAaiB,UAAU,CAACF,iBAAiB,CAAC;YAAE2B,IAAI;YAAI2C,MAAMC,eAAS,CAACC,aAAa;YAAEH,OAAO;YAAOI,aAAavI,KAAK4B,EAAE;QAAG;QACxH,MAAM4G,WAAW;YAAE1B,KAAK;YAAKE,OAAO;YAASC,oBAAoB;YAAOwB,QAAQ;gBAAC;aAAS;QAAC;QAE3F,MAAMxD,SAAS,MAAM,AAACnC,QAAgB4F,eAAe,CAACF,UAAU;QAEhErD,OAAOnC,kBAAkBiB,iBAAiB,EAAEoB,oBAAoB,CAC9DF,OAAOwD,gBAAgB,CAAC;YAAEP,MAAMC,eAAS,CAACC,aAAa;QAAC,IACxDD,eAAS,CAACC,aAAa;QAEzBnD,OAAOF,OAAOmD,IAAI,EAAExC,IAAI,CAACyC,eAAS,CAACC,aAAa;IAClD;AACF"}

package/server/authentication/{services/auth-methods/auth-method-two-fa.service.js → providers/two-fa/auth-provider-two-fa.service.js}

@@ -1,15 +1,11 @@
-/*
- * Copyright (C) 2012-2025 Johan Legrand <johan.legrand@sync-in.com>
- * This file is part of Sync-in | The open source file sync and share solution
- * See the LICENSE file for licensing details
- */ "use strict";
+"use strict";
 Object.defineProperty(exports, "__esModule", {
     value: true
 });
-Object.defineProperty(exports, "AuthMethod2FA", {
+Object.defineProperty(exports, "AuthProvider2FA", {
     enumerable: true,
     get: function() {
-        return AuthMethod2FA;
+        return AuthProvider2FA;
     }
 });
 const _common = require("@nestjs/common");
@@ -33,7 +29,7 @@ function _ts_decorate(decorators, target, key, desc) {
 function _ts_metadata(k, v) {
     if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 }
-let AuthMethod2FA = class AuthMethod2FA {
+let AuthProvider2FA = class AuthProvider2FA {
     async initTwoFactor(user) {
         const { secret, qrDataUrl } = this.generateSecretAndQr(user.email);
         // store encrypted secret in cache for 5 minutes
@@ -89,7 +85,10 @@ let AuthMethod2FA = class AuthMethod2FA {
         const user = await this.loadUser(req.user.id, req.ip);
         secret = secret || user.secrets.twoFaSecret;
         const auth = verifyDto.isRecoveryCode ? await this.validateRecoveryCode(req.user.id, verifyDto.code, user.secrets.recoveryCodes) : this.validateTwoFactorCode(verifyDto.code, secret);
-        this.usersManager.updateAccesses(user, req.ip, auth.success, true).catch((e)=>this.logger.error(`${this.verify.name} - ${e}`));
+        this.usersManager.updateAccesses(user, req.ip, auth.success, true).catch((e)=>this.logger.error({
+                tag: this.verify.name,
+                msg: `${e}`
+            }));
         return fromLogin ? [
             auth,
             user
@@ -109,14 +108,20 @@ let AuthMethod2FA = class AuthMethod2FA {
         } catch (e) {
             auth.success = false;
             auth.message = e.message;
-            this.logger.error(`${this.adminResetUserTwoFa.name} - ${e}`);
+            this.logger.error({
+                tag: this.adminResetUserTwoFa.name,
+                msg: `${e}`
+            });
         }
         return auth;
     }
     async loadUser(userId, ip) {
         const user = await this.usersManager.fromUserId(userId);
         if (!user) {
-            this.logger.warn(`User ${userId} (${ip}) not found`);
+            this.logger.warn({
+                tag: this.loadUser.name,
+                msg: `User ${userId} (${ip}) not found`
+            });
             throw new _common.HttpException(`User not found`, _common.HttpStatus.NOT_FOUND);
         }
         this.usersManager.validateUserAccess(user, ip);
@@ -126,7 +131,10 @@ let AuthMethod2FA = class AuthMethod2FA {
         // This function works with any authentication method, provided that
         // the authentication service implements proper user password updates in the database.
         if (!await this.usersManager.compareUserPassword(user.id, password)) {
-            this.usersManager.updateAccesses(user, ip, false, true).catch((e)=>this.logger.error(`${this.enableTwoFactor.name} - ${e}`));
+            this.usersManager.updateAccesses(user, ip, false, true).catch((e)=>this.logger.error({
+                    tag: this.verifyUserPassword.name,
+                    msg: `${e}`
+                }));
             throw new _common.HttpException('Incorrect code or password', _common.HttpStatus.BAD_REQUEST);
         }
     }
@@ -147,7 +155,10 @@ let AuthMethod2FA = class AuthMethod2FA {
             });
             if (!auth.success) auth.message = 'Incorrect code or password';
         } catch (e) {
-            this.logger.error(`${this.validateTwoFactorCode.name} - ${e}`);
+            this.logger.error({
+                tag: this.validateTwoFactorCode.name,
+                msg: `${e}`
+            });
             auth.message = e.message;
         }
         return auth;
@@ -159,28 +170,32 @@ let AuthMethod2FA = class AuthMethod2FA {
         };
         if (!encryptedCodes || encryptedCodes.length === 0) {
             auth.message = 'Invalid code';
-        } else {
-            try {
-                for (const encCode of encryptedCodes){
-                    if (code === this.decryptSecret(encCode)) {
-                        auth.success = true;
-                        // removed used code
-                        encryptedCodes.splice(encryptedCodes.indexOf(encCode), 1);
-                        break;
-                    }
-                }
-                if (auth.success) {
-                    // update recovery codes
-                    await this.usersManager.updateSecrets(userId, {
-                        recoveryCodes: encryptedCodes
-                    });
-                } else {
-                    auth.message = 'Invalid code';
+            return auth;
+        }
+        try {
+            for (const encCode of encryptedCodes){
+                const decryptedCode = this.decryptSecret(encCode);
+                if (code === decryptedCode) {
+                    auth.success = true;
+                    // removed used code
+                    encryptedCodes.splice(encryptedCodes.indexOf(encCode), 1);
+                    break;
                 }
-            } catch (e) {
-                this.logger.error(`${this.validateRecoveryCode.name} - ${e}`);
-                auth.message = e.message;
             }
+            if (auth.success) {
+                // update recovery codes
+                await this.usersManager.updateSecrets(userId, {
+                    recoveryCodes: encryptedCodes
+                });
+            } else {
+                auth.message = 'Invalid code';
+            }
+        } catch (e) {
+            this.logger.error({
+                tag: this.validateRecoveryCode.name,
+                msg: `${e}`
+            });
+            auth.message = e.message;
         }
         return auth;
     }
@@ -228,17 +243,20 @@ let AuthMethod2FA = class AuthMethod2FA {
         };
         this.notificationsManager.sendEmailNotification([
             req.user
-        ], notification).catch((e)=>this.logger.error(`${this.sendEmailNotification.name} - ${e}`));
+        ], notification).catch((e)=>this.logger.error({
+                tag: this.sendEmailNotification.name,
+                msg: `${e}`
+            }));
     }
     constructor(cache, usersManager, notificationsManager){
         this.cache = cache;
         this.usersManager = usersManager;
         this.notificationsManager = notificationsManager;
-        this.logger = new _common.Logger(AuthMethod2FA.name);
+        this.logger = new _common.Logger(AuthProvider2FA.name);
         this.cacheKeyPrefix = 'auth-2fa-pending-user-';
     }
 };
-AuthMethod2FA = _ts_decorate([
+AuthProvider2FA = _ts_decorate([
     (0, _common.Injectable)(),
     _ts_metadata("design:type", Function),
     _ts_metadata("design:paramtypes", [
@@ -246,6 +264,6 @@ AuthMethod2FA = _ts_decorate([
         typeof _usersmanagerservice.UsersManager === "undefined" ? Object : _usersmanagerservice.UsersManager,
         typeof _notificationsmanagerservice.NotificationsManager === "undefined" ? Object : _notificationsmanagerservice.NotificationsManager
     ])
-], AuthMethod2FA);
+], AuthProvider2FA);
 
-//# sourceMappingURL=auth-method-two-fa.service.js.map
+//# sourceMappingURL=auth-provider-two-fa.service.js.map

package/server/authentication/providers/two-fa/auth-provider-two-fa.service.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../backend/src/authentication/providers/two-fa/auth-provider-two-fa.service.ts"],"sourcesContent":["import { HttpException, HttpStatus, Injectable, Logger } from '@nestjs/common'\nimport { Totp } from 'time2fa'\nimport { NOTIFICATION_APP, NOTIFICATION_APP_EVENT } from '../../../applications/notifications/constants/notifications'\nimport { NotificationContent } from '../../../applications/notifications/interfaces/notification-properties.interface'\nimport { NotificationsManager } from '../../../applications/notifications/services/notifications-manager.service'\nimport { UserModel } from '../../../applications/users/models/user.model'\nimport { UsersManager } from '../../../applications/users/services/users-manager.service'\nimport { ACTION } from '../../../common/constants'\nimport { generateShortUUID } from '../../../common/functions'\nimport { qrcodeToDataURL } from '../../../common/qrcode'\nimport { configuration } from '../../../configuration/config.environment'\nimport { Cache } from '../../../infrastructure/cache/services/cache.service'\nimport { TWO_FA_CODE_LENGTH } from '../../constants/auth'\nimport { FastifyAuthenticatedRequest } from '../../interfaces/auth-request.interface'\nimport { decryptSecret, encryptSecret } from '../../utils/crypt-secret'\nimport { TwoFaVerifyDto, TwoFaVerifyWithPasswordDto } from './auth-two-fa.dtos'\nimport { TwoFaEnableResult, TwoFaSetup, TwoFaVerifyResult } from './auth-two-fa.interfaces'\n\n@Injectable()\nexport class AuthProvider2FA {\n  private readonly logger = new Logger(AuthProvider2FA.name)\n  private readonly cacheKeyPrefix = 'auth-2fa-pending-user-'\n\n  constructor(\n    private readonly cache: Cache,\n    private readonly usersManager: UsersManager,\n    private readonly notificationsManager: NotificationsManager\n  ) {}\n\n  async initTwoFactor(user: UserModel): Promise<TwoFaSetup> {\n    const { secret, qrDataUrl } = this.generateSecretAndQr(user.email)\n    // store encrypted secret in cache for 5 minutes\n    await this.cache.set(this.getCacheKey(user.id), this.encryptSecret(secret), 300)\n    return { secret, qrDataUrl }\n  }\n\n  async enableTwoFactor(body: TwoFaVerifyWithPasswordDto, req: FastifyAuthenticatedRequest): Promise<TwoFaEnableResult> {\n    // retrieve encrypted secret from cache\n    const secret: string = await this.cache.get(this.getCacheKey(req.user.id))\n    if (!secret) {\n      throw new HttpException('The secret has expired', HttpStatus.BAD_REQUEST)\n    }\n    // load user\n    const [auth, user] = await this.verify(body, req, true, secret)\n    if (!auth.success) {\n      throw new HttpException(auth.message, HttpStatus.FORBIDDEN)\n    }\n    // verify user password\n    await this.verifyUserPassword(user, body.password, req.ip)\n    // generate recovery codes\n    const recoveryCodes = this.generateRecoveryCodes()\n    // store and enable TwoFA & recovery codes\n    await this.usersManager.updateSecrets(user.id, {\n      twoFaSecret: secret,\n      recoveryCodes: recoveryCodes.map((code) => this.encryptSecret(code))\n    })\n    this.sendEmailNotification(req, ACTION.ADD)\n    return { ...auth, recoveryCodes: recoveryCodes }\n  }\n\n  async disableTwoFactor(body: TwoFaVerifyWithPasswordDto, req: FastifyAuthenticatedRequest): Promise<TwoFaVerifyResult> {\n    // load user\n    const [auth, user] = await this.verify(body, req, true)\n    if (!auth.success) {\n      throw new HttpException(auth.message, HttpStatus.FORBIDDEN)\n    }\n    // verify user password\n    await this.verifyUserPassword(user, body.password, req.ip)\n    // store and disable TwoFA & recovery codes\n    await this.usersManager.updateSecrets(user.id, { twoFaSecret: undefined, recoveryCodes: undefined })\n    this.sendEmailNotification(req, ACTION.DELETE)\n    return auth\n  }\n\n  async verify(verifyDto: TwoFaVerifyDto, req: FastifyAuthenticatedRequest, fromLogin?: false, secret?: string): Promise<TwoFaVerifyResult>\n  async verify(verifyDto: TwoFaVerifyDto, req: FastifyAuthenticatedRequest, fromLogin: true, secret?: string): Promise<[TwoFaVerifyResult, UserModel]>\n  async verify(\n    verifyDto: TwoFaVerifyDto,\n    req: FastifyAuthenticatedRequest,\n    fromLogin = false,\n    secret?: string\n  ): Promise<TwoFaVerifyResult | [TwoFaVerifyResult, UserModel]> {\n    const user = await this.loadUser(req.user.id, req.ip)\n    secret = secret || user.secrets.twoFaSecret\n    const auth = verifyDto.isRecoveryCode\n      ? await this.validateRecoveryCode(req.user.id, verifyDto.code, user.secrets.recoveryCodes)\n      : this.validateTwoFactorCode(verifyDto.code, secret)\n    this.usersManager.updateAccesses(user, req.ip, auth.success, true).catch((e: Error) => this.logger.error({ tag: this.verify.name, msg: `${e}` }))\n    return fromLogin ? [auth, user] : auth\n  }\n\n  async adminResetUserTwoFa(userId: number) {\n    const auth: TwoFaVerifyResult = { success: false, message: '' }\n    try {\n      await this.usersManager.updateSecrets(userId, { twoFaSecret: undefined, recoveryCodes: undefined })\n      auth.success = true\n    } catch (e) {\n      auth.success = false\n      auth.message = e.message\n      this.logger.error({ tag: this.adminResetUserTwoFa.name, msg: `${e}` })\n    }\n    return auth\n  }\n\n  async loadUser(userId: number, ip: string) {\n    const user: UserModel = await this.usersManager.fromUserId(userId)\n    if (!user) {\n      this.logger.warn({ tag: this.loadUser.name, msg: `User ${userId} (${ip}) not found` })\n      throw new HttpException(`User not found`, HttpStatus.NOT_FOUND)\n    }\n    this.usersManager.validateUserAccess(user, ip)\n    return user\n  }\n\n  async verifyUserPassword(user: UserModel, password: string, ip: string) {\n    // This function works with any authentication method, provided that\n    // the authentication service implements proper user password updates in the database.\n    if (!(await this.usersManager.compareUserPassword(user.id, password))) {\n      this.usersManager\n        .updateAccesses(user, ip, false, true)\n        .catch((e: Error) => this.logger.error({ tag: this.verifyUserPassword.name, msg: `${e}` }))\n      throw new HttpException('Incorrect code or password', HttpStatus.BAD_REQUEST)\n    }\n  }\n\n  validateTwoFactorCode(code: string, encryptedSecret: string): TwoFaVerifyResult {\n    const auth: TwoFaVerifyResult = { success: false, message: '' }\n    if (!encryptedSecret) {\n      auth.message = 'Incorrect code or password'\n      return auth\n    }\n    try {\n      auth.success = Totp.validate({ passcode: code, secret: this.decryptSecret(encryptedSecret), drift: 1 })\n      if (!auth.success) auth.message = 'Incorrect code or password'\n    } catch (e) {\n      this.logger.error({ tag: this.validateTwoFactorCode.name, msg: `${e}` })\n      auth.message = e.message\n    }\n    return auth\n  }\n\n  async validateRecoveryCode(userId: number, code: string, encryptedCodes: string[]): Promise<TwoFaVerifyResult> {\n    const auth: TwoFaVerifyResult = { success: false, message: '' }\n    if (!encryptedCodes || encryptedCodes.length === 0) {\n      auth.message = 'Invalid code'\n      return auth\n    }\n    try {\n      for (const encCode of encryptedCodes) {\n        const decryptedCode = this.decryptSecret(encCode)\n        if (code === decryptedCode) {\n          auth.success = true\n          // removed used code\n          encryptedCodes.splice(encryptedCodes.indexOf(encCode), 1)\n          break\n        }\n      }\n      if (auth.success) {\n        // update recovery codes\n        await this.usersManager.updateSecrets(userId, { recoveryCodes: encryptedCodes })\n      } else {\n        auth.message = 'Invalid code'\n      }\n    } catch (e) {\n      this.logger.error({ tag: this.validateRecoveryCode.name, msg: `${e}` })\n      auth.message = e.message\n    }\n    return auth\n  }\n\n  private generateSecretAndQr(userEmail: string): TwoFaSetup {\n    // Generate secret + otpauth URL + QR (DataURL)\n    // Totp.generateKey returns { issuer, user, config, secret, url }\n    const key = Totp.generateKey({ issuer: configuration.auth.mfa.totp.issuer, user: userEmail }, { digits: TWO_FA_CODE_LENGTH })\n    const qrDataUrl = qrcodeToDataURL(key.url)\n    return { secret: key.secret, qrDataUrl: qrDataUrl }\n  }\n\n  private getCacheKey(userId: number): string {\n    return `${this.cacheKeyPrefix}${userId}`\n  }\n\n  private encryptSecret(secret: string): string {\n    if (configuration.auth.encryptionKey) {\n      return encryptSecret(secret, configuration.auth.encryptionKey)\n    }\n    return secret\n  }\n\n  private decryptSecret(secret: string): string {\n    if (configuration.auth.encryptionKey) {\n      return decryptSecret(secret, configuration.auth.encryptionKey)\n    }\n    return secret\n  }\n\n  private generateRecoveryCodes(count = 5): string[] {\n    return Array.from({ length: count }, () => generateShortUUID())\n  }\n\n  private sendEmailNotification(req: FastifyAuthenticatedRequest, action: ACTION) {\n    const notification: NotificationContent = {\n      app: NOTIFICATION_APP.AUTH_2FA,\n      event: NOTIFICATION_APP_EVENT.AUTH_2FA[action],\n      element: req.headers['user-agent'],\n      url: req.ip\n    }\n    this.notificationsManager\n      .sendEmailNotification([req.user], notification)\n      .catch((e: Error) => this.logger.error({ tag: this.sendEmailNotification.name, msg: `${e}` }))\n  }\n}\n"],"names":["AuthProvider2FA","initTwoFactor","user","secret","qrDataUrl","generateSecretAndQr","email","cache","set","getCacheKey","id","encryptSecret","enableTwoFactor","body","req","get","HttpException","HttpStatus","BAD_REQUEST","auth","verify","success","message","FORBIDDEN","verifyUserPassword","password","ip","recoveryCodes","generateRecoveryCodes","usersManager","updateSecrets","twoFaSecret","map","code","sendEmailNotification","ACTION","ADD","disableTwoFactor","undefined","DELETE","verifyDto","fromLogin","loadUser","secrets","isRecoveryCode","validateRecoveryCode","validateTwoFactorCode","updateAccesses","catch","e","logger","error","tag","name","msg","adminResetUserTwoFa","userId","fromUserId","warn","NOT_FOUND","validateUserAccess","compareUserPassword","encryptedSecret","Totp","validate","passcode","decryptSecret","drift","encryptedCodes","length","encCode","decryptedCode","splice","indexOf","userEmail","key","generateKey","issuer","configuration","mfa","totp","digits","TWO_FA_CODE_LENGTH","qrcodeToDataURL","url","cacheKeyPrefix","encryptionKey","count","Array","from","generateShortUUID","action","notification","app","NOTIFICATION_APP","AUTH_2FA","event","NOTIFICATION_APP_EVENT","element","headers","notificationsManager","Logger"],"mappings":";;;;+BAmBaA;;;eAAAA;;;wBAnBiD;yBACzC;+BACoC;6CAEpB;qCAER;2BACN;2BACW;wBACF;mCACF;8BACR;sBACa;6BAEU;;;;;;;;;;AAKtC,IAAA,AAAMA,kBAAN,MAAMA;IAUX,MAAMC,cAAcC,IAAe,EAAuB;QACxD,MAAM,EAAEC,MAAM,EAAEC,SAAS,EAAE,GAAG,IAAI,CAACC,mBAAmB,CAACH,KAAKI,KAAK;QACjE,gDAAgD;QAChD,MAAM,IAAI,CAACC,KAAK,CAACC,GAAG,CAAC,IAAI,CAACC,WAAW,CAACP,KAAKQ,EAAE,GAAG,IAAI,CAACC,aAAa,CAACR,SAAS;QAC5E,OAAO;YAAEA;YAAQC;QAAU;IAC7B;IAEA,MAAMQ,gBAAgBC,IAAgC,EAAEC,GAAgC,EAA8B;QACpH,uCAAuC;QACvC,MAAMX,SAAiB,MAAM,IAAI,CAACI,KAAK,CAACQ,GAAG,CAAC,IAAI,CAACN,WAAW,CAACK,IAAIZ,IAAI,CAACQ,EAAE;QACxE,IAAI,CAACP,QAAQ;YACX,MAAM,IAAIa,qBAAa,CAAC,0BAA0BC,kBAAU,CAACC,WAAW;QAC1E;QACA,YAAY;QACZ,MAAM,CAACC,MAAMjB,KAAK,GAAG,MAAM,IAAI,CAACkB,MAAM,CAACP,MAAMC,KAAK,MAAMX;QACxD,IAAI,CAACgB,KAAKE,OAAO,EAAE;YACjB,MAAM,IAAIL,qBAAa,CAACG,KAAKG,OAAO,EAAEL,kBAAU,CAACM,SAAS;QAC5D;QACA,uBAAuB;QACvB,MAAM,IAAI,CAACC,kBAAkB,CAACtB,MAAMW,KAAKY,QAAQ,EAAEX,IAAIY,EAAE;QACzD,0BAA0B;QAC1B,MAAMC,gBAAgB,IAAI,CAACC,qBAAqB;QAChD,0CAA0C;QAC1C,MAAM,IAAI,CAACC,YAAY,CAACC,aAAa,CAAC5B,KAAKQ,EAAE,EAAE;YAC7CqB,aAAa5B;YACbwB,eAAeA,cAAcK,GAAG,CAAC,CAACC,OAAS,IAAI,CAACtB,aAAa,CAACsB;QAChE;QACA,IAAI,CAACC,qBAAqB,CAACpB,KAAKqB,iBAAM,CAACC,GAAG;QAC1C,OAAO;YAAE,GAAGjB,IAAI;YAAEQ,eAAeA;QAAc;IACjD;IAEA,MAAMU,iBAAiBxB,IAAgC,EAAEC,GAAgC,EAA8B;QACrH,YAAY;QACZ,MAAM,CAACK,MAAMjB,KAAK,GAAG,MAAM,IAAI,CAACkB,MAAM,CAACP,MAAMC,KAAK;QAClD,IAAI,CAACK,KAAKE,OAAO,EAAE;YACjB,MAAM,IAAIL,qBAAa,CAACG,KAAKG,OAAO,EAAEL,kBAAU,CAACM,SAAS;QAC5D;QACA,uBAAuB;QACvB,MAAM,IAAI,CAACC,kBAAkB,CAACtB,MAAMW,KAAKY,QAAQ,EAAEX,IAAIY,EAAE;QACzD,2CAA2C;QAC3C,MAAM,IAAI,CAACG,YAAY,CAACC,aAAa,CAAC5B,KAAKQ,EAAE,EAAE;YAAEqB,aAAaO;YAAWX,eAAeW;QAAU;QAClG,IAAI,CAACJ,qBAAqB,CAACpB,KAAKqB,iBAAM,CAACI,MAAM;QAC7C,OAAOpB;IACT;IAIA,MAAMC,OACJoB,SAAyB,EACzB1B,GAAgC,EAChC2B,YAAY,KAAK,EACjBtC,MAAe,EAC8C;QAC7D,MAAMD,OAAO,MAAM,IAAI,CAACwC,QAAQ,CAAC5B,IAAIZ,IAAI,CAACQ,EAAE,EAAEI,IAAIY,EAAE;QACpDvB,SAASA,UAAUD,KAAKyC,OAAO,CAACZ,WAAW;QAC3C,MAAMZ,OAAOqB,UAAUI,cAAc,GACjC,MAAM,IAAI,CAACC,oBAAoB,CAAC/B,IAAIZ,IAAI,CAACQ,EAAE,EAAE8B,UAAUP,IAAI,EAAE/B,KAAKyC,OAAO,CAAChB,aAAa,IACvF,IAAI,CAACmB,qBAAqB,CAACN,UAAUP,IAAI,EAAE9B;QAC/C,IAAI,CAAC0B,YAAY,CAACkB,cAAc,CAAC7C,MAAMY,IAAIY,EAAE,EAAEP,KAAKE,OAAO,EAAE,MAAM2B,KAAK,CAAC,CAACC,IAAa,IAAI,CAACC,MAAM,CAACC,KAAK,CAAC;gBAAEC,KAAK,IAAI,CAAChC,MAAM,CAACiC,IAAI;gBAAEC,KAAK,GAAGL,GAAG;YAAC;QAC9I,OAAOR,YAAY;YAACtB;YAAMjB;SAAK,GAAGiB;IACpC;IAEA,MAAMoC,oBAAoBC,MAAc,EAAE;QACxC,MAAMrC,OAA0B;YAAEE,SAAS;YAAOC,SAAS;QAAG;QAC9D,IAAI;YACF,MAAM,IAAI,CAACO,YAAY,CAACC,aAAa,CAAC0B,QAAQ;gBAAEzB,aAAaO;gBAAWX,eAAeW;YAAU;YACjGnB,KAAKE,OAAO,GAAG;QACjB,EAAE,OAAO4B,GAAG;YACV9B,KAAKE,OAAO,GAAG;YACfF,KAAKG,OAAO,GAAG2B,EAAE3B,OAAO;YACxB,IAAI,CAAC4B,MAAM,CAACC,KAAK,CAAC;gBAAEC,KAAK,IAAI,CAACG,mBAAmB,CAACF,IAAI;gBAAEC,KAAK,GAAGL,GAAG;YAAC;QACtE;QACA,OAAO9B;IACT;IAEA,MAAMuB,SAASc,MAAc,EAAE9B,EAAU,EAAE;QACzC,MAAMxB,OAAkB,MAAM,IAAI,CAAC2B,YAAY,CAAC4B,UAAU,CAACD;QAC3D,IAAI,CAACtD,MAAM;YACT,IAAI,CAACgD,MAAM,CAACQ,IAAI,CAAC;gBAAEN,KAAK,IAAI,CAACV,QAAQ,CAACW,IAAI;gBAAEC,KAAK,CAAC,KAAK,EAAEE,OAAO,EAAE,EAAE9B,GAAG,WAAW,CAAC;YAAC;YACpF,MAAM,IAAIV,qBAAa,CAAC,CAAC,cAAc,CAAC,EAAEC,kBAAU,CAAC0C,SAAS;QAChE;QACA,IAAI,CAAC9B,YAAY,CAAC+B,kBAAkB,CAAC1D,MAAMwB;QAC3C,OAAOxB;IACT;IAEA,MAAMsB,mBAAmBtB,IAAe,EAAEuB,QAAgB,EAAEC,EAAU,EAAE;QACtE,oEAAoE;QACpE,sFAAsF;QACtF,IAAI,CAAE,MAAM,IAAI,CAACG,YAAY,CAACgC,mBAAmB,CAAC3D,KAAKQ,EAAE,EAAEe,WAAY;YACrE,IAAI,CAACI,YAAY,CACdkB,cAAc,CAAC7C,MAAMwB,IAAI,OAAO,MAChCsB,KAAK,CAAC,CAACC,IAAa,IAAI,CAACC,MAAM,CAACC,KAAK,CAAC;oBAAEC,KAAK,IAAI,CAAC5B,kBAAkB,CAAC6B,IAAI;oBAAEC,KAAK,GAAGL,GAAG;gBAAC;YAC1F,MAAM,IAAIjC,qBAAa,CAAC,8BAA8BC,kBAAU,CAACC,WAAW;QAC9E;IACF;IAEA4B,sBAAsBb,IAAY,EAAE6B,eAAuB,EAAqB;QAC9E,MAAM3C,OAA0B;YAAEE,SAAS;YAAOC,SAAS;QAAG;QAC9D,IAAI,CAACwC,iBAAiB;YACpB3C,KAAKG,OAAO,GAAG;YACf,OAAOH;QACT;QACA,IAAI;YACFA,KAAKE,OAAO,GAAG0C,aAAI,CAACC,QAAQ,CAAC;gBAAEC,UAAUhC;gBAAM9B,QAAQ,IAAI,CAAC+D,aAAa,CAACJ;gBAAkBK,OAAO;YAAE;YACrG,IAAI,CAAChD,KAAKE,OAAO,EAAEF,KAAKG,OAAO,GAAG;QACpC,EAAE,OAAO2B,GAAG;YACV,IAAI,CAACC,MAAM,CAACC,KAAK,CAAC;gBAAEC,KAAK,IAAI,CAACN,qBAAqB,CAACO,IAAI;gBAAEC,KAAK,GAAGL,GAAG;YAAC;YACtE9B,KAAKG,OAAO,GAAG2B,EAAE3B,OAAO;QAC1B;QACA,OAAOH;IACT;IAEA,MAAM0B,qBAAqBW,MAAc,EAAEvB,IAAY,EAAEmC,cAAwB,EAA8B;QAC7G,MAAMjD,OAA0B;YAAEE,SAAS;YAAOC,SAAS;QAAG;QAC9D,IAAI,CAAC8C,kBAAkBA,eAAeC,MAAM,KAAK,GAAG;YAClDlD,KAAKG,OAAO,GAAG;YACf,OAAOH;QACT;QACA,IAAI;YACF,KAAK,MAAMmD,WAAWF,eAAgB;gBACpC,MAAMG,gBAAgB,IAAI,CAACL,aAAa,CAACI;gBACzC,IAAIrC,SAASsC,eAAe;oBAC1BpD,KAAKE,OAAO,GAAG;oBACf,oBAAoB;oBACpB+C,eAAeI,MAAM,CAACJ,eAAeK,OAAO,CAACH,UAAU;oBACvD;gBACF;YACF;YACA,IAAInD,KAAKE,OAAO,EAAE;gBAChB,wBAAwB;gBACxB,MAAM,IAAI,CAACQ,YAAY,CAACC,aAAa,CAAC0B,QAAQ;oBAAE7B,eAAeyC;gBAAe;YAChF,OAAO;gBACLjD,KAAKG,OAAO,GAAG;YACjB;QACF,EAAE,OAAO2B,GAAG;YACV,IAAI,CAACC,MAAM,CAACC,KAAK,CAAC;gBAAEC,KAAK,IAAI,CAACP,oBAAoB,CAACQ,IAAI;gBAAEC,KAAK,GAAGL,GAAG;YAAC;YACrE9B,KAAKG,OAAO,GAAG2B,EAAE3B,OAAO;QAC1B;QACA,OAAOH;IACT;IAEQd,oBAAoBqE,SAAiB,EAAc;QACzD,+CAA+C;QAC/C,iEAAiE;QACjE,MAAMC,MAAMZ,aAAI,CAACa,WAAW,CAAC;YAAEC,QAAQC,gCAAa,CAAC3D,IAAI,CAAC4D,GAAG,CAACC,IAAI,CAACH,MAAM;YAAE3E,MAAMwE;QAAU,GAAG;YAAEO,QAAQC,wBAAkB;QAAC;QAC3H,MAAM9E,YAAY+E,IAAAA,uBAAe,EAACR,IAAIS,GAAG;QACzC,OAAO;YAAEjF,QAAQwE,IAAIxE,MAAM;YAAEC,WAAWA;QAAU;IACpD;IAEQK,YAAY+C,MAAc,EAAU;QAC1C,OAAO,GAAG,IAAI,CAAC6B,cAAc,GAAG7B,QAAQ;IAC1C;IAEQ7C,cAAcR,MAAc,EAAU;QAC5C,IAAI2E,gCAAa,CAAC3D,IAAI,CAACmE,aAAa,EAAE;YACpC,OAAO3E,IAAAA,0BAAa,EAACR,QAAQ2E,gCAAa,CAAC3D,IAAI,CAACmE,aAAa;QAC/D;QACA,OAAOnF;IACT;IAEQ+D,cAAc/D,MAAc,EAAU;QAC5C,IAAI2E,gCAAa,CAAC3D,IAAI,CAACmE,aAAa,EAAE;YACpC,OAAOpB,IAAAA,0BAAa,EAAC/D,QAAQ2E,gCAAa,CAAC3D,IAAI,CAACmE,aAAa;QAC/D;QACA,OAAOnF;IACT;IAEQyB,sBAAsB2D,QAAQ,CAAC,EAAY;QACjD,OAAOC,MAAMC,IAAI,CAAC;YAAEpB,QAAQkB;QAAM,GAAG,IAAMG,IAAAA,4BAAiB;IAC9D;IAEQxD,sBAAsBpB,GAAgC,EAAE6E,MAAc,EAAE;QAC9E,MAAMC,eAAoC;YACxCC,KAAKC,+BAAgB,CAACC,QAAQ;YAC9BC,OAAOC,qCAAsB,CAACF,QAAQ,CAACJ,OAAO;YAC9CO,SAASpF,IAAIqF,OAAO,CAAC,aAAa;YAClCf,KAAKtE,IAAIY,EAAE;QACb;QACA,IAAI,CAAC0E,oBAAoB,CACtBlE,qBAAqB,CAAC;YAACpB,IAAIZ,IAAI;SAAC,EAAE0F,cAClC5C,KAAK,CAAC,CAACC,IAAa,IAAI,CAACC,MAAM,CAACC,KAAK,CAAC;gBAAEC,KAAK,IAAI,CAAClB,qBAAqB,CAACmB,IAAI;gBAAEC,KAAK,GAAGL,GAAG;YAAC;IAC/F;IA3LA,YACE,AAAiB1C,KAAY,EAC7B,AAAiBsB,YAA0B,EAC3C,AAAiBuE,oBAA0C,CAC3D;aAHiB7F,QAAAA;aACAsB,eAAAA;aACAuE,uBAAAA;aANFlD,SAAS,IAAImD,cAAM,CAACrG,gBAAgBqD,IAAI;aACxCgC,iBAAiB;IAM/B;AAwLL"}

package/server/authentication/{services/auth-methods/auth-method-two-fa.service.spec.js → providers/two-fa/auth-provider-two-fa.service.spec.js}

@@ -1,8 +1,4 @@
-/*
- * Copyright (C) 2012-2025 Johan Legrand <johan.legrand@sync-in.com>
- * This file is part of Sync-in | The open source file sync and share solution
- * See the LICENSE file for licensing details
- */ "use strict";
+"use strict";
 Object.defineProperty(exports, "__esModule", {
     value: true
 });
@@ -13,7 +9,7 @@ const _notificationsmanagerservice = require("../../../applications/notification
 const _usersmanagerservice = require("../../../applications/users/services/users-manager.service");
 const _cacheservice = require("../../../infrastructure/cache/services/cache.service");
 const _cryptsecret = require("../../utils/crypt-secret");
-const _authmethodtwofaservice = require("./auth-method-two-fa.service");
+const _authprovidertwofaservice = require("./auth-provider-two-fa.service");
 function _getRequireWildcardCache(nodeInterop) {
     if (typeof WeakMap !== "function") return null;
     var cacheBabelInterop = new WeakMap();
@@ -57,7 +53,7 @@ function _interop_require_wildcard(obj, nodeInterop) {
 }
 jest.mock('../../utils/crypt-secret');
 jest.mock('../../../common/qrcode');
-describe(_authmethodtwofaservice.AuthMethod2FA.name, ()=>{
+describe(_authprovidertwofaservice.AuthProvider2FA.name, ()=>{
     let service;
     let cache;
     let usersManager;
@@ -87,7 +83,7 @@ describe(_authmethodtwofaservice.AuthMethod2FA.name, ()=>{
     beforeEach(async ()=>{
         const module = await _testing.Test.createTestingModule({
             providers: [
-                _authmethodtwofaservice.AuthMethod2FA,
+                _authprovidertwofaservice.AuthProvider2FA,
                 {
                     provide: _cacheservice.Cache,
                     useValue: {
@@ -116,7 +112,7 @@ describe(_authmethodtwofaservice.AuthMethod2FA.name, ()=>{
         module.useLogger([
             'fatal'
         ]);
-        service = module.get(_authmethodtwofaservice.AuthMethod2FA);
+        service = module.get(_authprovidertwofaservice.AuthProvider2FA);
         cache = module.get(_cacheservice.Cache);
         usersManager = module.get(_usersmanagerservice.UsersManager);
         notificationsManager = module.get(_notificationsmanagerservice.NotificationsManager);
@@ -384,4 +380,4 @@ describe(_authmethodtwofaservice.AuthMethod2FA.name, ()=>{
     });
 });
 
-//# sourceMappingURL=auth-method-two-fa.service.spec.js.map
+//# sourceMappingURL=auth-provider-two-fa.service.spec.js.map

package/server/authentication/providers/two-fa/auth-provider-two-fa.service.spec.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../backend/src/authentication/providers/two-fa/auth-provider-two-fa.service.spec.ts"],"sourcesContent":["import { HttpException, HttpStatus } from '@nestjs/common'\nimport { Test, TestingModule } from '@nestjs/testing'\nimport { Totp } from 'time2fa'\nimport { NotificationsManager } from '../../../applications/notifications/services/notifications-manager.service'\nimport { UserModel } from '../../../applications/users/models/user.model'\nimport { UsersManager } from '../../../applications/users/services/users-manager.service'\nimport { Cache } from '../../../infrastructure/cache/services/cache.service'\nimport { FastifyAuthenticatedRequest } from '../../interfaces/auth-request.interface'\nimport { decryptSecret, encryptSecret } from '../../utils/crypt-secret'\nimport { AuthProvider2FA } from './auth-provider-two-fa.service'\nimport { TwoFaVerifyDto, TwoFaVerifyWithPasswordDto } from './auth-two-fa.dtos'\n\njest.mock('../../utils/crypt-secret')\njest.mock('../../../common/qrcode')\n\ndescribe(AuthProvider2FA.name, () => {\n  let service: AuthProvider2FA\n  let cache: jest.Mocked<Cache>\n  let usersManager: jest.Mocked<UsersManager>\n  let notificationsManager: jest.Mocked<NotificationsManager>\n\n  const mockUser: Partial<UserModel> = {\n    id: 1,\n    login: 'testuser',\n    email: 'test@example.com',\n    secrets: {\n      twoFaSecret: 'encrypted-secret',\n      recoveryCodes: ['encrypted-code-1', 'encrypted-code-2']\n    }\n  }\n\n  const mockRequest: Partial<FastifyAuthenticatedRequest> = {\n    user: { id: 1, login: 'testuser' } as any,\n    ip: '127.0.0.1',\n    headers: { 'user-agent': 'test-agent' }\n  }\n\n  beforeEach(async () => {\n    const module: TestingModule = await Test.createTestingModule({\n      providers: [\n        AuthProvider2FA,\n        {\n          provide: Cache,\n          useValue: {\n            get: jest.fn(),\n            set: jest.fn()\n          }\n        },\n        {\n          provide: UsersManager,\n          useValue: {\n            fromUserId: jest.fn(),\n            validateUserAccess: jest.fn(),\n            compareUserPassword: jest.fn(),\n            updateAccesses: jest.fn().mockResolvedValue(undefined),\n            updateSecrets: jest.fn()\n          }\n        },\n        {\n          provide: NotificationsManager,\n          useValue: {\n            sendEmailNotification: jest.fn().mockResolvedValue(undefined)\n          }\n        }\n      ]\n    }).compile()\n\n    module.useLogger(['fatal'])\n    service = module.get<AuthProvider2FA>(AuthProvider2FA)\n    cache = module.get(Cache)\n    usersManager = module.get(UsersManager)\n    notificationsManager = module.get(NotificationsManager)\n    ;(encryptSecret as jest.Mock).mockImplementation((secret: string) => `encrypted-${secret}`)\n    ;(decryptSecret as jest.Mock).mockImplementation((secret: string) => secret.replace('encrypted-', ''))\n\n    const { qrcodeToDataURL } = await import('../../../common/qrcode')\n    ;(qrcodeToDataURL as jest.Mock).mockReturnValue('data:image/png;base64,mock')\n  })\n\n  afterEach(() => {\n    jest.clearAllMocks()\n  })\n\n  it('should be defined', () => {\n    expect(service).toBeDefined()\n  })\n\n  describe('initTwoFactor', () => {\n    it('should generate secret and QR code and store in cache', async () => {\n      const result = await service.initTwoFactor(mockUser as UserModel)\n\n      expect(result).toHaveProperty('secret')\n      expect(result).toHaveProperty('qrDataUrl')\n      expect(result.qrDataUrl).toBe('data:image/png;base64,mock')\n      expect(cache.set).toHaveBeenCalledWith(`auth-2fa-pending-user-${mockUser.id}`, expect.any(String), 300)\n    })\n  })\n\n  describe('enableTwoFactor', () => {\n    const enableDto: TwoFaVerifyWithPasswordDto = {\n      code: '123456',\n      password: 'password123',\n      isRecoveryCode: false\n    }\n\n    it('should throw error if secret has expired', async () => {\n      cache.get.mockResolvedValue(null)\n\n      await expect(service.enableTwoFactor(enableDto, mockRequest as FastifyAuthenticatedRequest)).rejects.toThrow(\n        new HttpException('The secret has expired', HttpStatus.BAD_REQUEST)\n      )\n    })\n\n    it('should throw error if verification fails', async () => {\n      cache.get.mockResolvedValue('encrypted-secret')\n      usersManager.fromUserId.mockResolvedValue(mockUser as UserModel)\n      jest.spyOn(service, 'validateTwoFactorCode').mockReturnValue({ success: false, message: 'Invalid code' })\n\n      await expect(service.enableTwoFactor(enableDto, mockRequest as FastifyAuthenticatedRequest)).rejects.toThrow(\n        new HttpException('Invalid code', HttpStatus.FORBIDDEN)\n      )\n    })\n\n    it('should throw error if password is incorrect', async () => {\n      cache.get.mockResolvedValue('encrypted-secret')\n      usersManager.fromUserId.mockResolvedValue(mockUser as UserModel)\n      jest.spyOn(service, 'validateTwoFactorCode').mockReturnValue({ success: true, message: '' })\n      usersManager.compareUserPassword.mockResolvedValue(false)\n\n      await expect(service.enableTwoFactor(enableDto, mockRequest as FastifyAuthenticatedRequest)).rejects.toThrow(\n        new HttpException('Incorrect code or password', HttpStatus.BAD_REQUEST)\n      )\n    })\n\n    it('should enable 2FA and return recovery codes on success', async () => {\n      cache.get.mockResolvedValue('encrypted-secret')\n      usersManager.fromUserId.mockResolvedValue(mockUser as UserModel)\n      jest.spyOn(service, 'validateTwoFactorCode').mockReturnValue({ success: true, message: '' })\n      usersManager.compareUserPassword.mockResolvedValue(true)\n\n      const result = await service.enableTwoFactor(enableDto, mockRequest as FastifyAuthenticatedRequest)\n\n      expect(result.success).toBe(true)\n      expect(result.recoveryCodes).toHaveLength(5)\n      expect(usersManager.updateSecrets).toHaveBeenCalledWith(mockUser.id, {\n        twoFaSecret: 'encrypted-secret',\n        recoveryCodes: expect.any(Array)\n      })\n      expect(notificationsManager.sendEmailNotification).toHaveBeenCalledWith([mockRequest.user], {\n        app: 'auth_2fa',\n        event: 'Two-factor authentication (2FA) on your account has been enabled',\n        element: 'test-agent',\n        url: '127.0.0.1'\n      })\n    })\n  })\n\n  describe('disableTwoFactor', () => {\n    const disableDto: TwoFaVerifyWithPasswordDto = {\n      code: '123456',\n      password: 'password123',\n      isRecoveryCode: false\n    }\n\n    it('should throw error if verification fails', async () => {\n      usersManager.fromUserId.mockResolvedValue(mockUser as UserModel)\n      jest.spyOn(service, 'validateTwoFactorCode').mockReturnValue({ success: false, message: 'Invalid code' })\n\n      await expect(service.disableTwoFactor(disableDto, mockRequest as FastifyAuthenticatedRequest)).rejects.toThrow(\n        new HttpException('Invalid code', HttpStatus.FORBIDDEN)\n      )\n    })\n\n    it('should throw error if password is incorrect', async () => {\n      usersManager.fromUserId.mockResolvedValue(mockUser as UserModel)\n      jest.spyOn(service, 'validateTwoFactorCode').mockReturnValue({ success: true, message: '' })\n      usersManager.compareUserPassword.mockResolvedValue(false)\n\n      await expect(service.disableTwoFactor(disableDto, mockRequest as FastifyAuthenticatedRequest)).rejects.toThrow(\n        new HttpException('Incorrect code or password', HttpStatus.BAD_REQUEST)\n      )\n    })\n\n    it('should disable 2FA on success', async () => {\n      usersManager.fromUserId.mockResolvedValue(mockUser as UserModel)\n      jest.spyOn(service, 'validateTwoFactorCode').mockReturnValue({ success: true, message: '' })\n      usersManager.compareUserPassword.mockResolvedValue(true)\n\n      const result = await service.disableTwoFactor(disableDto, mockRequest as FastifyAuthenticatedRequest)\n\n      expect(result.success).toBe(true)\n      expect(usersManager.updateSecrets).toHaveBeenCalledWith(mockUser.id, {\n        twoFaSecret: undefined,\n        recoveryCodes: undefined\n      })\n      expect(notificationsManager.sendEmailNotification).toHaveBeenCalledWith([mockRequest.user], {\n        app: 'auth_2fa',\n        event: 'Two-factor authentication (2FA) on your account has been disabled',\n        element: 'test-agent',\n        url: '127.0.0.1'\n      })\n    })\n  })\n\n  describe('verify', () => {\n    const verifyDto: TwoFaVerifyDto = {\n      code: '123456',\n      isRecoveryCode: false\n    }\n\n    it('should verify 2FA code successfully', async () => {\n      usersManager.fromUserId.mockResolvedValue(mockUser as UserModel)\n      jest.spyOn(service, 'validateTwoFactorCode').mockReturnValue({ success: true, message: '' })\n\n      const result = await service.verify(verifyDto, mockRequest as FastifyAuthenticatedRequest)\n\n      expect(result.success).toBe(true)\n      expect(usersManager.updateAccesses).toHaveBeenCalledWith(mockUser, mockRequest.ip, true, true)\n    })\n\n    it('should verify recovery code successfully', async () => {\n      const recoveryDto: TwoFaVerifyDto = { code: 'code-1', isRecoveryCode: true }\n      usersManager.fromUserId.mockResolvedValue(mockUser as UserModel)\n      usersManager.updateSecrets.mockResolvedValue(undefined)\n\n      await service.verify(recoveryDto, mockRequest as FastifyAuthenticatedRequest)\n\n      expect(usersManager.updateSecrets).toHaveBeenCalled()\n    })\n\n    it('should fail when recovery codes are empty', async () => {\n      const recoveryDto: TwoFaVerifyDto = { code: 'code-1', isRecoveryCode: true }\n      const userWithoutCodes = { ...mockUser, secrets: { ...mockUser.secrets, recoveryCodes: [] } }\n      usersManager.fromUserId.mockResolvedValue(userWithoutCodes as UserModel)\n\n      const result = await service.verify(recoveryDto, mockRequest as FastifyAuthenticatedRequest)\n\n      expect(result.success).toBe(false)\n      expect(result.message).toBe('Invalid code')\n    })\n\n    it('should fail when recovery code does not match', async () => {\n      const recoveryDto: TwoFaVerifyDto = { code: 'wrong-code', isRecoveryCode: true }\n      usersManager.fromUserId.mockResolvedValue(mockUser as UserModel)\n\n      const result = await service.verify(recoveryDto, mockRequest as FastifyAuthenticatedRequest)\n\n      expect(result.success).toBe(false)\n      expect(result.message).toBe('Invalid code')\n    })\n\n    it('should handle errors during recovery code validation', async () => {\n      const recoveryDto: TwoFaVerifyDto = { code: 'code-1', isRecoveryCode: true }\n      usersManager.fromUserId.mockResolvedValue(mockUser as UserModel)\n      usersManager.updateSecrets.mockRejectedValue(new Error())\n\n      const result = await service.verify(recoveryDto, mockRequest as FastifyAuthenticatedRequest)\n\n      expect(result.success).toBe(false)\n      expect(result.message).toBe('Invalid code')\n    })\n\n    it('should return user when fromLogin is true', async () => {\n      usersManager.fromUserId.mockResolvedValue(mockUser as UserModel)\n      jest.spyOn(service, 'validateTwoFactorCode').mockReturnValue({ success: true, message: '' })\n\n      const result = await service.verify(verifyDto, mockRequest as FastifyAuthenticatedRequest, true)\n\n      expect(Array.isArray(result)).toBe(true)\n      expect(result[0].success).toBe(true)\n      expect(result[1]).toBe(mockUser)\n    })\n  })\n\n  describe('adminResetUserTwoFa', () => {\n    it('should reset user 2FA successfully', async () => {\n      usersManager.updateSecrets.mockResolvedValue(undefined)\n\n      const result = await service.adminResetUserTwoFa(1)\n\n      expect(result.success).toBe(true)\n      expect(usersManager.updateSecrets).toHaveBeenCalledWith(1, {\n        twoFaSecret: undefined,\n        recoveryCodes: undefined\n      })\n    })\n\n    it('should handle errors during reset', async () => {\n      usersManager.updateSecrets.mockRejectedValue(new Error('Database error'))\n\n      const result = await service.adminResetUserTwoFa(1)\n\n      expect(result.success).toBe(false)\n      expect(result.message).toBe('Database error')\n    })\n  })\n\n  describe('loadUser', () => {\n    it('should load and validate user successfully', async () => {\n      usersManager.fromUserId.mockResolvedValue(mockUser as UserModel)\n\n      const result = await service.loadUser(1, '127.0.0.1')\n\n      expect(result).toBe(mockUser)\n      expect(usersManager.validateUserAccess).toHaveBeenCalledWith(mockUser, '127.0.0.1')\n    })\n\n    it('should throw error if user not found', async () => {\n      usersManager.fromUserId.mockResolvedValue(null)\n\n      await expect(service.loadUser(1, '127.0.0.1')).rejects.toThrow(new HttpException('User not found', HttpStatus.NOT_FOUND))\n    })\n  })\n\n  describe('verifyUserPassword', () => {\n    it('should verify password successfully', async () => {\n      usersManager.compareUserPassword.mockResolvedValue(true)\n\n      await expect(service.verifyUserPassword(mockUser as UserModel, 'password123', '127.0.0.1')).resolves.not.toThrow()\n    })\n\n    it('should throw error if password is incorrect', async () => {\n      usersManager.compareUserPassword.mockResolvedValue(false)\n\n      await expect(service.verifyUserPassword(mockUser as UserModel, 'wrong-password', '127.0.0.1')).rejects.toThrow(\n        new HttpException('Incorrect code or password', HttpStatus.BAD_REQUEST)\n      )\n      expect(usersManager.updateAccesses).toHaveBeenCalledWith(mockUser, '127.0.0.1', false, true)\n    })\n  })\n\n  describe('validateTwoFactorCode', () => {\n    it('should validate code successfully', () => {\n      jest.spyOn(Totp, 'validate').mockReturnValue(true)\n\n      const result = service.validateTwoFactorCode('123456', 'encrypted-secret')\n\n      expect(result.success).toBe(true)\n      expect(result.message).toBe('')\n    })\n\n    it('should fail validation for incorrect code', () => {\n      jest.spyOn(Totp, 'validate').mockReturnValue(false)\n\n      const result = service.validateTwoFactorCode('wrong-code', 'encrypted-secret')\n\n      expect(result.success).toBe(false)\n      expect(result.message).toBe('Incorrect code or password')\n    })\n\n    it('should return error if secret is not provided', () => {\n      const result = service.validateTwoFactorCode('123456', '')\n\n      expect(result.success).toBe(false)\n      expect(result.message).toBe('Incorrect code or password')\n    })\n\n    it('should handle validation errors', () => {\n      jest.spyOn(Totp, 'validate').mockImplementation(() => {\n        throw new Error('Validation error')\n      })\n\n      const result = service.validateTwoFactorCode('123456', 'encrypted-secret')\n\n      expect(result.success).toBe(false)\n      expect(result.message).toBe('Validation error')\n    })\n  })\n})\n"],"names":["jest","mock","describe","AuthProvider2FA","name","service","cache","usersManager","notificationsManager","mockUser","id","login","email","secrets","twoFaSecret","recoveryCodes","mockRequest","user","ip","headers","beforeEach","module","Test","createTestingModule","providers","provide","Cache","useValue","get","fn","set","UsersManager","fromUserId","validateUserAccess","compareUserPassword","updateAccesses","mockResolvedValue","undefined","updateSecrets","NotificationsManager","sendEmailNotification","compile","useLogger","encryptSecret","mockImplementation","secret","decryptSecret","replace","qrcodeToDataURL","mockReturnValue","afterEach","clearAllMocks","it","expect","toBeDefined","result","initTwoFactor","toHaveProperty","qrDataUrl","toBe","toHaveBeenCalledWith","any","String","enableDto","code","password","isRecoveryCode","enableTwoFactor","rejects","toThrow","HttpException","HttpStatus","BAD_REQUEST","spyOn","success","message","FORBIDDEN","toHaveLength","Array","app","event","element","url","disableDto","disableTwoFactor","verifyDto","verify","recoveryDto","toHaveBeenCalled","userWithoutCodes","mockRejectedValue","Error","isArray","adminResetUserTwoFa","loadUser","NOT_FOUND","verifyUserPassword","resolves","not","Totp","validateTwoFactorCode"],"mappings":";;;;wBAA0C;yBACN;yBACf;6CACgB;qCAER;8BACP;6BAEuB;0CACb;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAGhCA,KAAKC,IAAI,CAAC;AACVD,KAAKC,IAAI,CAAC;AAEVC,SAASC,yCAAe,CAACC,IAAI,EAAE;IAC7B,IAAIC;IACJ,IAAIC;IACJ,IAAIC;IACJ,IAAIC;IAEJ,MAAMC,WAA+B;QACnCC,IAAI;QACJC,OAAO;QACPC,OAAO;QACPC,SAAS;YACPC,aAAa;YACbC,eAAe;gBAAC;gBAAoB;aAAmB;QACzD;IACF;IAEA,MAAMC,cAAoD;QACxDC,MAAM;YAAEP,IAAI;YAAGC,OAAO;QAAW;QACjCO,IAAI;QACJC,SAAS;YAAE,cAAc;QAAa;IACxC;IAEAC,WAAW;QACT,MAAMC,SAAwB,MAAMC,aAAI,CAACC,mBAAmB,CAAC;YAC3DC,WAAW;gBACTrB,yCAAe;gBACf;oBACEsB,SAASC,mBAAK;oBACdC,UAAU;wBACRC,KAAK5B,KAAK6B,EAAE;wBACZC,KAAK9B,KAAK6B,EAAE;oBACd;gBACF;gBACA;oBACEJ,SAASM,iCAAY;oBACrBJ,UAAU;wBACRK,YAAYhC,KAAK6B,EAAE;wBACnBI,oBAAoBjC,KAAK6B,EAAE;wBAC3BK,qBAAqBlC,KAAK6B,EAAE;wBAC5BM,gBAAgBnC,KAAK6B,EAAE,GAAGO,iBAAiB,CAACC;wBAC5CC,eAAetC,KAAK6B,EAAE;oBACxB;gBACF;gBACA;oBACEJ,SAASc,iDAAoB;oBAC7BZ,UAAU;wBACRa,uBAAuBxC,KAAK6B,EAAE,GAAGO,iBAAiB,CAACC;oBACrD;gBACF;aACD;QACH,GAAGI,OAAO;QAEVpB,OAAOqB,SAAS,CAAC;YAAC;SAAQ;QAC1BrC,UAAUgB,OAAOO,GAAG,CAAkBzB,yCAAe;QACrDG,QAAQe,OAAOO,GAAG,CAACF,mBAAK;QACxBnB,eAAec,OAAOO,GAAG,CAACG,iCAAY;QACtCvB,uBAAuBa,OAAOO,GAAG,CAACW,iDAAoB;QACpDI,0BAAa,CAAeC,kBAAkB,CAAC,CAACC,SAAmB,CAAC,UAAU,EAAEA,QAAQ;QACxFC,0BAAa,CAAeF,kBAAkB,CAAC,CAACC,SAAmBA,OAAOE,OAAO,CAAC,cAAc;QAElG,MAAM,EAAEC,eAAe,EAAE,GAAG,MAAM,mEAAA,QAAO;QACvCA,gBAA8BC,eAAe,CAAC;IAClD;IAEAC,UAAU;QACRlD,KAAKmD,aAAa;IACpB;IAEAC,GAAG,qBAAqB;QACtBC,OAAOhD,SAASiD,WAAW;IAC7B;IAEApD,SAAS,iBAAiB;QACxBkD,GAAG,yDAAyD;YAC1D,MAAMG,SAAS,MAAMlD,QAAQmD,aAAa,CAAC/C;YAE3C4C,OAAOE,QAAQE,cAAc,CAAC;YAC9BJ,OAAOE,QAAQE,cAAc,CAAC;YAC9BJ,OAAOE,OAAOG,SAAS,EAAEC,IAAI,CAAC;YAC9BN,OAAO/C,MAAMwB,GAAG,EAAE8B,oBAAoB,CAAC,CAAC,sBAAsB,EAAEnD,SAASC,EAAE,EAAE,EAAE2C,OAAOQ,GAAG,CAACC,SAAS;QACrG;IACF;IAEA5D,SAAS,mBAAmB;QAC1B,MAAM6D,YAAwC;YAC5CC,MAAM;YACNC,UAAU;YACVC,gBAAgB;QAClB;QAEAd,GAAG,4CAA4C;YAC7C9C,MAAMsB,GAAG,CAACQ,iBAAiB,CAAC;YAE5B,MAAMiB,OAAOhD,QAAQ8D,eAAe,CAACJ,WAAW/C,cAA6CoD,OAAO,CAACC,OAAO,CAC1G,IAAIC,qBAAa,CAAC,0BAA0BC,kBAAU,CAACC,WAAW;QAEtE;QAEApB,GAAG,4CAA4C;YAC7C9C,MAAMsB,GAAG,CAACQ,iBAAiB,CAAC;YAC5B7B,aAAayB,UAAU,CAACI,iBAAiB,CAAC3B;YAC1CT,KAAKyE,KAAK,CAACpE,SAAS,yBAAyB4C,eAAe,CAAC;gBAAEyB,SAAS;gBAAOC,SAAS;YAAe;YAEvG,MAAMtB,OAAOhD,QAAQ8D,eAAe,CAACJ,WAAW/C,cAA6CoD,OAAO,CAACC,OAAO,CAC1G,IAAIC,qBAAa,CAAC,gBAAgBC,kBAAU,CAACK,SAAS;QAE1D;QAEAxB,GAAG,+CAA+C;YAChD9C,MAAMsB,GAAG,CAACQ,iBAAiB,CAAC;YAC5B7B,aAAayB,UAAU,CAACI,iBAAiB,CAAC3B;YAC1CT,KAAKyE,KAAK,CAACpE,SAAS,yBAAyB4C,eAAe,CAAC;gBAAEyB,SAAS;gBAAMC,SAAS;YAAG;YAC1FpE,aAAa2B,mBAAmB,CAACE,iBAAiB,CAAC;YAEnD,MAAMiB,OAAOhD,QAAQ8D,eAAe,CAACJ,WAAW/C,cAA6CoD,OAAO,CAACC,OAAO,CAC1G,IAAIC,qBAAa,CAAC,8BAA8BC,kBAAU,CAACC,WAAW;QAE1E;QAEApB,GAAG,0DAA0D;YAC3D9C,MAAMsB,GAAG,CAACQ,iBAAiB,CAAC;YAC5B7B,aAAayB,UAAU,CAACI,iBAAiB,CAAC3B;YAC1CT,KAAKyE,KAAK,CAACpE,SAAS,yBAAyB4C,eAAe,CAAC;gBAAEyB,SAAS;gBAAMC,SAAS;YAAG;YAC1FpE,aAAa2B,mBAAmB,CAACE,iBAAiB,CAAC;YAEnD,MAAMmB,SAAS,MAAMlD,QAAQ8D,eAAe,CAACJ,WAAW/C;YAExDqC,OAAOE,OAAOmB,OAAO,EAAEf,IAAI,CAAC;YAC5BN,OAAOE,OAAOxC,aAAa,EAAE8D,YAAY,CAAC;YAC1CxB,OAAO9C,aAAa+B,aAAa,EAAEsB,oBAAoB,CAACnD,SAASC,EAAE,EAAE;gBACnEI,aAAa;gBACbC,eAAesC,OAAOQ,GAAG,CAACiB;YAC5B;YACAzB,OAAO7C,qBAAqBgC,qBAAqB,EAAEoB,oBAAoB,CAAC;gBAAC5C,YAAYC,IAAI;aAAC,EAAE;gBAC1F8D,KAAK;gBACLC,OAAO;gBACPC,SAAS;gBACTC,KAAK;YACP;QACF;IACF;IAEAhF,SAAS,oBAAoB;QAC3B,MAAMiF,aAAyC;YAC7CnB,MAAM;YACNC,UAAU;YACVC,gBAAgB;QAClB;QAEAd,GAAG,4CAA4C;YAC7C7C,aAAayB,UAAU,CAACI,iBAAiB,CAAC3B;YAC1CT,KAAKyE,KAAK,CAACpE,SAAS,yBAAyB4C,eAAe,CAAC;gBAAEyB,SAAS;gBAAOC,SAAS;YAAe;YAEvG,MAAMtB,OAAOhD,QAAQ+E,gBAAgB,CAACD,YAAYnE,cAA6CoD,OAAO,CAACC,OAAO,CAC5G,IAAIC,qBAAa,CAAC,gBAAgBC,kBAAU,CAACK,SAAS;QAE1D;QAEAxB,GAAG,+CAA+C;YAChD7C,aAAayB,UAAU,CAACI,iBAAiB,CAAC3B;YAC1CT,KAAKyE,KAAK,CAACpE,SAAS,yBAAyB4C,eAAe,CAAC;gBAAEyB,SAAS;gBAAMC,SAAS;YAAG;YAC1FpE,aAAa2B,mBAAmB,CAACE,iBAAiB,CAAC;YAEnD,MAAMiB,OAAOhD,QAAQ+E,gBAAgB,CAACD,YAAYnE,cAA6CoD,OAAO,CAACC,OAAO,CAC5G,IAAIC,qBAAa,CAAC,8BAA8BC,kBAAU,CAACC,WAAW;QAE1E;QAEApB,GAAG,iCAAiC;YAClC7C,aAAayB,UAAU,CAACI,iBAAiB,CAAC3B;YAC1CT,KAAKyE,KAAK,CAACpE,SAAS,yBAAyB4C,eAAe,CAAC;gBAAEyB,SAAS;gBAAMC,SAAS;YAAG;YAC1FpE,aAAa2B,mBAAmB,CAACE,iBAAiB,CAAC;YAEnD,MAAMmB,SAAS,MAAMlD,QAAQ+E,gBAAgB,CAACD,YAAYnE;YAE1DqC,OAAOE,OAAOmB,OAAO,EAAEf,IAAI,CAAC;YAC5BN,OAAO9C,aAAa+B,aAAa,EAAEsB,oBAAoB,CAACnD,SAASC,EAAE,EAAE;gBACnEI,aAAauB;gBACbtB,eAAesB;YACjB;YACAgB,OAAO7C,qBAAqBgC,qBAAqB,EAAEoB,oBAAoB,CAAC;gBAAC5C,YAAYC,IAAI;aAAC,EAAE;gBAC1F8D,KAAK;gBACLC,OAAO;gBACPC,SAAS;gBACTC,KAAK;YACP;QACF;IACF;IAEAhF,SAAS,UAAU;QACjB,MAAMmF,YAA4B;YAChCrB,MAAM;YACNE,gBAAgB;QAClB;QAEAd,GAAG,uCAAuC;YACxC7C,aAAayB,UAAU,CAACI,iBAAiB,CAAC3B;YAC1CT,KAAKyE,KAAK,CAACpE,SAAS,yBAAyB4C,eAAe,CAAC;gBAAEyB,SAAS;gBAAMC,SAAS;YAAG;YAE1F,MAAMpB,SAAS,MAAMlD,QAAQiF,MAAM,CAACD,WAAWrE;YAE/CqC,OAAOE,OAAOmB,OAAO,EAAEf,IAAI,CAAC;YAC5BN,OAAO9C,aAAa4B,cAAc,EAAEyB,oBAAoB,CAACnD,UAAUO,YAAYE,EAAE,EAAE,MAAM;QAC3F;QAEAkC,GAAG,4CAA4C;YAC7C,MAAMmC,cAA8B;gBAAEvB,MAAM;gBAAUE,gBAAgB;YAAK;YAC3E3D,aAAayB,UAAU,CAACI,iBAAiB,CAAC3B;YAC1CF,aAAa+B,aAAa,CAACF,iBAAiB,CAACC;YAE7C,MAAMhC,QAAQiF,MAAM,CAACC,aAAavE;YAElCqC,OAAO9C,aAAa+B,aAAa,EAAEkD,gBAAgB;QACrD;QAEApC,GAAG,6CAA6C;YAC9C,MAAMmC,cAA8B;gBAAEvB,MAAM;gBAAUE,gBAAgB;YAAK;YAC3E,MAAMuB,mBAAmB;gBAAE,GAAGhF,QAAQ;gBAAEI,SAAS;oBAAE,GAAGJ,SAASI,OAAO;oBAAEE,eAAe,EAAE;gBAAC;YAAE;YAC5FR,aAAayB,UAAU,CAACI,iBAAiB,CAACqD;YAE1C,MAAMlC,SAAS,MAAMlD,QAAQiF,MAAM,CAACC,aAAavE;YAEjDqC,OAAOE,OAAOmB,OAAO,EAAEf,IAAI,CAAC;YAC5BN,OAAOE,OAAOoB,OAAO,EAAEhB,IAAI,CAAC;QAC9B;QAEAP,GAAG,iDAAiD;YAClD,MAAMmC,cAA8B;gBAAEvB,MAAM;gBAAcE,gBAAgB;YAAK;YAC/E3D,aAAayB,UAAU,CAACI,iBAAiB,CAAC3B;YAE1C,MAAM8C,SAAS,MAAMlD,QAAQiF,MAAM,CAACC,aAAavE;YAEjDqC,OAAOE,OAAOmB,OAAO,EAAEf,IAAI,CAAC;YAC5BN,OAAOE,OAAOoB,OAAO,EAAEhB,IAAI,CAAC;QAC9B;QAEAP,GAAG,wDAAwD;YACzD,MAAMmC,cAA8B;gBAAEvB,MAAM;gBAAUE,gBAAgB;YAAK;YAC3E3D,aAAayB,UAAU,CAACI,iBAAiB,CAAC3B;YAC1CF,aAAa+B,aAAa,CAACoD,iBAAiB,CAAC,IAAIC;YAEjD,MAAMpC,SAAS,MAAMlD,QAAQiF,MAAM,CAACC,aAAavE;YAEjDqC,OAAOE,OAAOmB,OAAO,EAAEf,IAAI,CAAC;YAC5BN,OAAOE,OAAOoB,OAAO,EAAEhB,IAAI,CAAC;QAC9B;QAEAP,GAAG,6CAA6C;YAC9C7C,aAAayB,UAAU,CAACI,iBAAiB,CAAC3B;YAC1CT,KAAKyE,KAAK,CAACpE,SAAS,yBAAyB4C,eAAe,CAAC;gBAAEyB,SAAS;gBAAMC,SAAS;YAAG;YAE1F,MAAMpB,SAAS,MAAMlD,QAAQiF,MAAM,CAACD,WAAWrE,aAA4C;YAE3FqC,OAAOyB,MAAMc,OAAO,CAACrC,SAASI,IAAI,CAAC;YACnCN,OAAOE,MAAM,CAAC,EAAE,CAACmB,OAAO,EAAEf,IAAI,CAAC;YAC/BN,OAAOE,MAAM,CAAC,EAAE,EAAEI,IAAI,CAAClD;QACzB;IACF;IAEAP,SAAS,uBAAuB;QAC9BkD,GAAG,sCAAsC;YACvC7C,aAAa+B,aAAa,CAACF,iBAAiB,CAACC;YAE7C,MAAMkB,SAAS,MAAMlD,QAAQwF,mBAAmB,CAAC;YAEjDxC,OAAOE,OAAOmB,OAAO,EAAEf,IAAI,CAAC;YAC5BN,OAAO9C,aAAa+B,aAAa,EAAEsB,oBAAoB,CAAC,GAAG;gBACzD9C,aAAauB;gBACbtB,eAAesB;YACjB;QACF;QAEAe,GAAG,qCAAqC;YACtC7C,aAAa+B,aAAa,CAACoD,iBAAiB,CAAC,IAAIC,MAAM;YAEvD,MAAMpC,SAAS,MAAMlD,QAAQwF,mBAAmB,CAAC;YAEjDxC,OAAOE,OAAOmB,OAAO,EAAEf,IAAI,CAAC;YAC5BN,OAAOE,OAAOoB,OAAO,EAAEhB,IAAI,CAAC;QAC9B;IACF;IAEAzD,SAAS,YAAY;QACnBkD,GAAG,8CAA8C;YAC/C7C,aAAayB,UAAU,CAACI,iBAAiB,CAAC3B;YAE1C,MAAM8C,SAAS,MAAMlD,QAAQyF,QAAQ,CAAC,GAAG;YAEzCzC,OAAOE,QAAQI,IAAI,CAAClD;YACpB4C,OAAO9C,aAAa0B,kBAAkB,EAAE2B,oBAAoB,CAACnD,UAAU;QACzE;QAEA2C,GAAG,wCAAwC;YACzC7C,aAAayB,UAAU,CAACI,iBAAiB,CAAC;YAE1C,MAAMiB,OAAOhD,QAAQyF,QAAQ,CAAC,GAAG,cAAc1B,OAAO,CAACC,OAAO,CAAC,IAAIC,qBAAa,CAAC,kBAAkBC,kBAAU,CAACwB,SAAS;QACzH;IACF;IAEA7F,SAAS,sBAAsB;QAC7BkD,GAAG,uCAAuC;YACxC7C,aAAa2B,mBAAmB,CAACE,iBAAiB,CAAC;YAEnD,MAAMiB,OAAOhD,QAAQ2F,kBAAkB,CAACvF,UAAuB,eAAe,cAAcwF,QAAQ,CAACC,GAAG,CAAC7B,OAAO;QAClH;QAEAjB,GAAG,+CAA+C;YAChD7C,aAAa2B,mBAAmB,CAACE,iBAAiB,CAAC;YAEnD,MAAMiB,OAAOhD,QAAQ2F,kBAAkB,CAACvF,UAAuB,kBAAkB,cAAc2D,OAAO,CAACC,OAAO,CAC5G,IAAIC,qBAAa,CAAC,8BAA8BC,kBAAU,CAACC,WAAW;YAExEnB,OAAO9C,aAAa4B,cAAc,EAAEyB,oBAAoB,CAACnD,UAAU,aAAa,OAAO;QACzF;IACF;IAEAP,SAAS,yBAAyB;QAChCkD,GAAG,qCAAqC;YACtCpD,KAAKyE,KAAK,CAAC0B,aAAI,EAAE,YAAYlD,eAAe,CAAC;YAE7C,MAAMM,SAASlD,QAAQ+F,qBAAqB,CAAC,UAAU;YAEvD/C,OAAOE,OAAOmB,OAAO,EAAEf,IAAI,CAAC;YAC5BN,OAAOE,OAAOoB,OAAO,EAAEhB,IAAI,CAAC;QAC9B;QAEAP,GAAG,6CAA6C;YAC9CpD,KAAKyE,KAAK,CAAC0B,aAAI,EAAE,YAAYlD,eAAe,CAAC;YAE7C,MAAMM,SAASlD,QAAQ+F,qBAAqB,CAAC,cAAc;YAE3D/C,OAAOE,OAAOmB,OAAO,EAAEf,IAAI,CAAC;YAC5BN,OAAOE,OAAOoB,OAAO,EAAEhB,IAAI,CAAC;QAC9B;QAEAP,GAAG,iDAAiD;YAClD,MAAMG,SAASlD,QAAQ+F,qBAAqB,CAAC,UAAU;YAEvD/C,OAAOE,OAAOmB,OAAO,EAAEf,IAAI,CAAC;YAC5BN,OAAOE,OAAOoB,OAAO,EAAEhB,IAAI,CAAC;QAC9B;QAEAP,GAAG,mCAAmC;YACpCpD,KAAKyE,KAAK,CAAC0B,aAAI,EAAE,YAAYvD,kBAAkB,CAAC;gBAC9C,MAAM,IAAI+C,MAAM;YAClB;YAEA,MAAMpC,SAASlD,QAAQ+F,qBAAqB,CAAC,UAAU;YAEvD/C,OAAOE,OAAOmB,OAAO,EAAEf,IAAI,CAAC;YAC5BN,OAAOE,OAAOoB,OAAO,EAAEhB,IAAI,CAAC;QAC9B;IACF;AACF"}