@sync-in/server 1.5.2 → 1.6.0

package/server/authentication/services/auth-methods/auth-method-ldap.service.js

@@ -29,9 +29,31 @@ function _ts_decorate(decorators, target, key, desc) {
 function _ts_metadata(k, v) {
     if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 }
+const LDAP_ATTRIBUTES = {
+    AD: {
+        SAM_ACCOUNT: 'sAMAccountName',
+        USER_NAME: 'userPrincipalName'
+    },
+    LDAP: {
+        UID: 'uid'
+    },
+    COMMON: {
+        MAIL: 'mail',
+        GIVEN_NAME: 'givenName',
+        SN: 'sn',
+        CN: 'cn',
+        DISPLAY_NAME: 'displayName'
+    }
+};
+const ALL_ATTRIBUTES = [
+    ...Object.values(LDAP_ATTRIBUTES.COMMON),
+    ...Object.values(LDAP_ATTRIBUTES.LDAP),
+    ...Object.values(LDAP_ATTRIBUTES.AD)
+];
 let AuthMethodLdapService = class AuthMethodLdapService {
-    async validateUser(loginOrEmail, password, ip) {
-        let user = await this.usersManager.findUser(loginOrEmail, false);
+    async validateUser(login, password, ip, scope) {
+        login = this.getUserLogin(login);
+        let user = await this.usersManager.findUser(login, false);
         if (user) {
             if (user.isGuest) {
                 // allow guests to be authenticated from db and check if the current user is defined as active
@@ -42,29 +64,38 @@ let AuthMethodLdapService = class AuthMethodLdapService {
                 throw new _common.HttpException('Account locked', _common.HttpStatus.FORBIDDEN);
             }
         }
-        const entry = await this.checkAuth(loginOrEmail, password);
+        const entry = await this.checkAuth(login, password);
         if (entry === false) {
+            // LDAP auth failed
             if (user) {
-                this.usersManager.updateAccesses(user, ip, false).catch((e)=>this.logger.error(`${this.validateUser.name} : ${e}`));
+                let authSuccess = false;
+                if (scope) {
+                    // try user app password
+                    authSuccess = await this.usersManager.validateAppPassword(user, password, ip, scope);
+                }
+                this.usersManager.updateAccesses(user, ip, authSuccess).catch((e)=>this.logger.error(`${this.validateUser.name} : ${e}`));
+                if (authSuccess) {
+                    // logged with app password
+                    return user;
+                }
             }
             return null;
-        } else if (!entry.mail || !entry.uid) {
-            this.logger.error(`${this.validateUser.name} - ${loginOrEmail} : some ldap fields are missing => (${JSON.stringify(entry)})`);
+        } else if (!entry[_configenvironment.configuration.auth.ldap.attributes.login] || !entry[_configenvironment.configuration.auth.ldap.attributes.email]) {
+            this.logger.error(`${this.validateUser.name} - required ldap fields are missing : 
+      [${_configenvironment.configuration.auth.ldap.attributes.login}, ${_configenvironment.configuration.auth.ldap.attributes.email}] => 
+      (${JSON.stringify(entry)})`);
             return null;
         }
-        const identity = {
-            login: entry.uid,
-            email: entry.mail,
-            password: password,
-            ...(0, _functions.splitFullName)(entry.cn)
-        };
+        const identity = this.createIdentity(entry, password);
         user = await this.updateOrCreateUser(identity, user);
         this.usersManager.updateAccesses(user, ip, true).catch((e)=>this.logger.error(`${this.validateUser.name} : ${e}`));
         return user;
     }
     async checkAuth(uid, password) {
         const servers = _configenvironment.configuration.auth.ldap.servers;
-        const bindUserDN = `${_configenvironment.configuration.auth.ldap.loginAttribute}=${uid},${_configenvironment.configuration.auth.ldap.baseDN}`;
+        const loginAttr = _configenvironment.configuration.auth.ldap.attributes.login;
+        const baseDN = _configenvironment.configuration.auth.ldap.baseDN;
+        const bindUserDN = Object.values(LDAP_ATTRIBUTES.AD).indexOf(loginAttr) > -1 ? loginAttr : `${loginAttr}=${uid},${baseDN}`;
         let client;
         let error;
         for (const s of servers){
@@ -98,25 +129,22 @@ let AuthMethodLdapService = class AuthMethodLdapService {
         return false;
     }
     async checkAccess(client, uid) {
-        const searchFilter = `(&(${_configenvironment.configuration.auth.ldap.loginAttribute}=${uid})${_configenvironment.configuration.auth.ldap.filter || ''})`;
+        const searchFilter = `(&(${_configenvironment.configuration.auth.ldap.attributes.login}=${uid})${_configenvironment.configuration.auth.ldap.filter || ''})`;
         try {
             const { searchEntries } = await client.search(_configenvironment.configuration.auth.ldap.baseDN, {
                 scope: 'sub',
                 filter: searchFilter,
-                attributes: this.entryAttributes
+                attributes: ALL_ATTRIBUTES
             });
             for (const entry of searchEntries){
-                if (entry[_configenvironment.configuration.auth.ldap.loginAttribute] === uid) {
-                    if (Array.isArray(entry.mail)) {
-                        // handles the case of multiple emails, keep the first
-                        entry.mail = entry.mail[0];
-                    }
-                    return entry;
+                if (entry[_configenvironment.configuration.auth.ldap.attributes.login] === uid) {
+                    return this.convertToLdapUserEntry(entry);
                 }
             }
+            this.logger.warn(`${this.checkAuth.name} - unable to find user id : ${uid}`);
             return false;
         } catch (e) {
-            this.logger.warn(`${this.checkAccess.name} - ${uid} : ${e}`);
+            this.logger.error(`${this.checkAccess.name} - ${uid} : ${e}`);
             return false;
         }
     }
@@ -149,6 +177,10 @@ let AuthMethodLdapService = class AuthMethodLdapService {
                         delete identityHasChanged.password;
                     }
                     Object.assign(user, identityHasChanged);
+                    if ('lastName' in identityHasChanged || 'firstName' in identityHasChanged) {
+                        // force fullName update
+                        user.setFullName(true);
+                    }
                 } catch (e) {
                     this.logger.warn(`${this.updateOrCreateUser.name} - unable to update user *${user.login}* : ${e}`);
                 }
@@ -157,15 +189,56 @@ let AuthMethodLdapService = class AuthMethodLdapService {
             return user;
         }
     }
+    convertToLdapUserEntry(entry) {
+        for (const attr of ALL_ATTRIBUTES){
+            if (Array.isArray(entry[attr])) {
+                entry[attr] = entry[attr].length > 0 ? entry[attr][0] : null;
+            }
+        }
+        return entry;
+    }
+    createIdentity(entry, password) {
+        return {
+            login: this.getUserLogin(entry[_configenvironment.configuration.auth.ldap.attributes.login]),
+            email: entry[_configenvironment.configuration.auth.ldap.attributes.email],
+            password: password,
+            ...this.getFirstNameAndLastName(entry)
+        };
+    }
+    getFirstNameAndLastName(entry) {
+        // 1) Prefer structured attributes
+        if (entry.sn && entry.givenName) {
+            return {
+                firstName: entry.givenName,
+                lastName: entry.sn
+            };
+        }
+        // 2) Fallback to displayName if available
+        if (entry.displayName && entry.displayName.trim()) {
+            return (0, _functions.splitFullName)(entry.displayName);
+        }
+        // 3) Fallback to cn
+        if (entry.cn && entry.cn.trim()) {
+            return (0, _functions.splitFullName)(entry.cn);
+        }
+        // 4) Nothing usable
+        return {
+            firstName: '',
+            lastName: ''
+        };
+    }
+    getUserLogin(login) {
+        if (_configenvironment.configuration.auth.ldap.attributes.login === LDAP_ATTRIBUTES.AD.USER_NAME) {
+            return login.split('@')[0];
+        } else if (_configenvironment.configuration.auth.ldap.attributes.login === LDAP_ATTRIBUTES.AD.SAM_ACCOUNT) {
+            return login.split('\\')[0];
+        }
+        return login;
+    }
     constructor(usersManager, adminUsersManager){
         this.usersManager = usersManager;
         this.adminUsersManager = adminUsersManager;
         this.logger = new _common.Logger(AuthMethodLdapService.name);
-        this.entryAttributes = [
-            'uid',
-            'mail',
-            'cn'
-        ];
         this.clientOptions = {
             timeout: 6000,
             connectTimeout: 6000,

package/server/authentication/services/auth-methods/auth-method-ldap.service.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../backend/src/authentication/services/auth-methods/auth-method-ldap.service.ts"],"sourcesContent":["/*\n * Copyright (C) 2012-2025 Johan Legrand <johan.legrand@sync-in.com>\n * This file is part of Sync-in | The open source file sync and share solution\n * See the LICENSE file for licensing details\n */\n\nimport { HttpException, HttpStatus, Injectable, Logger } from '@nestjs/common'\nimport { Client, ClientOptions, Entry, InvalidCredentialsError } from 'ldapts'\nimport { CONNECT_ERROR_CODE } from '../../../app.constants'\nimport { USER_ROLE } from '../../../applications/users/constants/user'\nimport { CreateUserDto, UpdateUserDto } from '../../../applications/users/dto/create-or-update-user.dto'\nimport { UserModel } from '../../../applications/users/models/user.model'\nimport { AdminUsersManager } from '../../../applications/users/services/admin-users-manager.service'\nimport { UsersManager } from '../../../applications/users/services/users-manager.service'\nimport { comparePassword, splitFullName } from '../../../common/functions'\nimport { configuration } from '../../../configuration/config.environment'\nimport { AuthMethod } from '../../models/auth-method'\n\ntype LdapUserEntry = Entry & { uid: string; mail: string; cn: string }\n\n@Injectable()\nexport class AuthMethodLdapService implements AuthMethod {\n  private readonly logger = new Logger(AuthMethodLdapService.name)\n  private readonly entryAttributes = ['uid', 'mail', 'cn']\n  private clientOptions: ClientOptions = { timeout: 6000, connectTimeout: 6000, url: '' }\n\n  constructor(\n    private readonly usersManager: UsersManager,\n    private readonly adminUsersManager: AdminUsersManager\n  ) {}\n\n  async validateUser(loginOrEmail: string, password: string, ip?: string): Promise<UserModel> {\n    let user = await this.usersManager.findUser(loginOrEmail, false)\n    if (user) {\n      if (user.isGuest) {\n        // allow guests to be authenticated from db and check if the current user is defined as active\n        return this.usersManager.logUser(user, password, ip)\n      }\n      if (!user.isActive) {\n        this.logger.error(`${this.validateUser.name} - user *${user.login}* is locked`)\n        throw new HttpException('Account locked', HttpStatus.FORBIDDEN)\n      }\n    }\n    const entry: false | LdapUserEntry = await this.checkAuth(loginOrEmail, password)\n    if (entry === false) {\n      if (user) {\n        this.usersManager.updateAccesses(user, ip, false).catch((e: Error) => this.logger.error(`${this.validateUser.name} : ${e}`))\n      }\n      return null\n    } else if (!entry.mail || !entry.uid) {\n      this.logger.error(`${this.validateUser.name} - ${loginOrEmail} : some ldap fields are missing => (${JSON.stringify(entry)})`)\n      return null\n    }\n    const identity = { login: entry.uid, email: entry.mail, password: password, ...splitFullName(entry.cn) } satisfies CreateUserDto\n    user = await this.updateOrCreateUser(identity, user)\n    this.usersManager.updateAccesses(user, ip, true).catch((e: Error) => this.logger.error(`${this.validateUser.name} : ${e}`))\n    return user\n  }\n\n  private async checkAuth(uid: string, password: string): Promise<LdapUserEntry | false> {\n    const servers = configuration.auth.ldap.servers\n    const bindUserDN = `${configuration.auth.ldap.loginAttribute}=${uid},${configuration.auth.ldap.baseDN}`\n    let client: Client\n    let error: any\n    for (const s of servers) {\n      client = new Client({ ...this.clientOptions, url: s })\n      try {\n        await client.bind(bindUserDN, password)\n        return await this.checkAccess(client, uid)\n      } catch (e) {\n        if (e.errors?.length) {\n          for (const err of e.errors) {\n            this.logger.warn(`${this.checkAuth.name} - ${uid} : ${err}`)\n            error = err\n          }\n        } else {\n          error = e\n          this.logger.warn(`${this.checkAuth.name} - ${uid} : ${e}`)\n        }\n        if (error instanceof InvalidCredentialsError) {\n          return false\n        }\n      } finally {\n        await client.unbind()\n      }\n    }\n    if (error && CONNECT_ERROR_CODE.has(error.code)) {\n      throw new HttpException('Authentication service error', HttpStatus.INTERNAL_SERVER_ERROR)\n    }\n    return false\n  }\n\n  private async checkAccess(client: Client, uid: string): Promise<LdapUserEntry | false> {\n    const searchFilter = `(&(${configuration.auth.ldap.loginAttribute}=${uid})${configuration.auth.ldap.filter || ''})`\n    try {\n      const { searchEntries } = await client.search(configuration.auth.ldap.baseDN, {\n        scope: 'sub',\n        filter: searchFilter,\n        attributes: this.entryAttributes\n      })\n      for (const entry of searchEntries) {\n        if (entry[configuration.auth.ldap.loginAttribute] === uid) {\n          if (Array.isArray(entry.mail)) {\n            // handles the case of multiple emails, keep the first\n            entry.mail = entry.mail[0]\n          }\n          return entry as LdapUserEntry\n        }\n      }\n      return false\n    } catch (e) {\n      this.logger.warn(`${this.checkAccess.name} - ${uid} : ${e}`)\n      return false\n    }\n  }\n\n  private async updateOrCreateUser(identity: CreateUserDto, user: UserModel): Promise<UserModel> {\n    if (user === null) {\n      return this.adminUsersManager.createUserOrGuest(identity, USER_ROLE.USER)\n    } else {\n      if (identity.login !== user.login) {\n        this.logger.error(`${this.updateOrCreateUser.name} - user id mismatch : ${identity.login} !== ${user.login}`)\n        throw new HttpException('Account matching error', HttpStatus.FORBIDDEN)\n      }\n      // check if user information has changed\n      const identityHasChanged: UpdateUserDto = Object.fromEntries(\n        (\n          await Promise.all(\n            Object.keys(identity).map(async (key: string) => {\n              if (key === 'password') {\n                const isSame = await comparePassword(identity[key], user.password)\n                return isSame ? null : [key, identity[key]]\n              }\n              return identity[key] !== user[key] ? [key, identity[key]] : null\n            })\n          )\n        ).filter(Boolean)\n      )\n      if (Object.keys(identityHasChanged).length > 0) {\n        try {\n          await this.adminUsersManager.updateUserOrGuest(user.id, identityHasChanged)\n          if (identityHasChanged?.password) {\n            delete identityHasChanged.password\n          }\n          Object.assign(user, identityHasChanged)\n        } catch (e) {\n          this.logger.warn(`${this.updateOrCreateUser.name} - unable to update user *${user.login}* : ${e}`)\n        }\n      }\n      await user.makePaths()\n      return user\n    }\n  }\n}\n"],"names":["AuthMethodLdapService","validateUser","loginOrEmail","password","ip","user","usersManager","findUser","isGuest","logUser","isActive","logger","error","name","login","HttpException","HttpStatus","FORBIDDEN","entry","checkAuth","updateAccesses","catch","e","mail","uid","JSON","stringify","identity","email","splitFullName","cn","updateOrCreateUser","servers","configuration","auth","ldap","bindUserDN","loginAttribute","baseDN","client","s","Client","clientOptions","url","bind","checkAccess","errors","length","err","warn","InvalidCredentialsError","unbind","CONNECT_ERROR_CODE","has","code","INTERNAL_SERVER_ERROR","searchFilter","filter","searchEntries","search","scope","attributes","entryAttributes","Array","isArray","adminUsersManager","createUserOrGuest","USER_ROLE","USER","identityHasChanged","Object","fromEntries","Promise","all","keys","map","key","isSame","comparePassword","Boolean","updateUserOrGuest","id","assign","makePaths","Logger","timeout","connectTimeout"],"mappings":"AAAA;;;;CAIC;;;;+BAiBYA;;;eAAAA;;;wBAfiD;wBACQ;8BACnC;sBACT;0CAGQ;qCACL;2BACkB;mCACjB;;;;;;;;;;AAMvB,IAAA,AAAMA,wBAAN,MAAMA;IAUX,MAAMC,aAAaC,YAAoB,EAAEC,QAAgB,EAAEC,EAAW,EAAsB;QAC1F,IAAIC,OAAO,MAAM,IAAI,CAACC,YAAY,CAACC,QAAQ,CAACL,cAAc;QAC1D,IAAIG,MAAM;YACR,IAAIA,KAAKG,OAAO,EAAE;gBAChB,8FAA8F;gBAC9F,OAAO,IAAI,CAACF,YAAY,CAACG,OAAO,CAACJ,MAAMF,UAAUC;YACnD;YACA,IAAI,CAACC,KAAKK,QAAQ,EAAE;gBAClB,IAAI,CAACC,MAAM,CAACC,KAAK,CAAC,GAAG,IAAI,CAACX,YAAY,CAACY,IAAI,CAAC,SAAS,EAAER,KAAKS,KAAK,CAAC,WAAW,CAAC;gBAC9E,MAAM,IAAIC,qBAAa,CAAC,kBAAkBC,kBAAU,CAACC,SAAS;YAChE;QACF;QACA,MAAMC,QAA+B,MAAM,IAAI,CAACC,SAAS,CAACjB,cAAcC;QACxE,IAAIe,UAAU,OAAO;YACnB,IAAIb,MAAM;gBACR,IAAI,CAACC,YAAY,CAACc,cAAc,CAACf,MAAMD,IAAI,OAAOiB,KAAK,CAAC,CAACC,IAAa,IAAI,CAACX,MAAM,CAACC,KAAK,CAAC,GAAG,IAAI,CAACX,YAAY,CAACY,IAAI,CAAC,GAAG,EAAES,GAAG;YAC5H;YACA,OAAO;QACT,OAAO,IAAI,CAACJ,MAAMK,IAAI,IAAI,CAACL,MAAMM,GAAG,EAAE;YACpC,IAAI,CAACb,MAAM,CAACC,KAAK,CAAC,GAAG,IAAI,CAACX,YAAY,CAACY,IAAI,CAAC,GAAG,EAAEX,aAAa,oCAAoC,EAAEuB,KAAKC,SAAS,CAACR,OAAO,CAAC,CAAC;YAC5H,OAAO;QACT;QACA,MAAMS,WAAW;YAAEb,OAAOI,MAAMM,GAAG;YAAEI,OAAOV,MAAMK,IAAI;YAAEpB,UAAUA;YAAU,GAAG0B,IAAAA,wBAAa,EAACX,MAAMY,EAAE,CAAC;QAAC;QACvGzB,OAAO,MAAM,IAAI,CAAC0B,kBAAkB,CAACJ,UAAUtB;QAC/C,IAAI,CAACC,YAAY,CAACc,cAAc,CAACf,MAAMD,IAAI,MAAMiB,KAAK,CAAC,CAACC,IAAa,IAAI,CAACX,MAAM,CAACC,KAAK,CAAC,GAAG,IAAI,CAACX,YAAY,CAACY,IAAI,CAAC,GAAG,EAAES,GAAG;QACzH,OAAOjB;IACT;IAEA,MAAcc,UAAUK,GAAW,EAAErB,QAAgB,EAAkC;QACrF,MAAM6B,UAAUC,gCAAa,CAACC,IAAI,CAACC,IAAI,CAACH,OAAO;QAC/C,MAAMI,aAAa,GAAGH,gCAAa,CAACC,IAAI,CAACC,IAAI,CAACE,cAAc,CAAC,CAAC,EAAEb,IAAI,CAAC,EAAES,gCAAa,CAACC,IAAI,CAACC,IAAI,CAACG,MAAM,EAAE;QACvG,IAAIC;QACJ,IAAI3B;QACJ,KAAK,MAAM4B,KAAKR,QAAS;YACvBO,SAAS,IAAIE,cAAM,CAAC;gBAAE,GAAG,IAAI,CAACC,aAAa;gBAAEC,KAAKH;YAAE;YACpD,IAAI;gBACF,MAAMD,OAAOK,IAAI,CAACR,YAAYjC;gBAC9B,OAAO,MAAM,IAAI,CAAC0C,WAAW,CAACN,QAAQf;YACxC,EAAE,OAAOF,GAAG;gBACV,IAAIA,EAAEwB,MAAM,EAAEC,QAAQ;oBACpB,KAAK,MAAMC,OAAO1B,EAAEwB,MAAM,CAAE;wBAC1B,IAAI,CAACnC,MAAM,CAACsC,IAAI,CAAC,GAAG,IAAI,CAAC9B,SAAS,CAACN,IAAI,CAAC,GAAG,EAAEW,IAAI,GAAG,EAAEwB,KAAK;wBAC3DpC,QAAQoC;oBACV;gBACF,OAAO;oBACLpC,QAAQU;oBACR,IAAI,CAACX,MAAM,CAACsC,IAAI,CAAC,GAAG,IAAI,CAAC9B,SAAS,CAACN,IAAI,CAAC,GAAG,EAAEW,IAAI,GAAG,EAAEF,GAAG;gBAC3D;gBACA,IAAIV,iBAAiBsC,+BAAuB,EAAE;oBAC5C,OAAO;gBACT;YACF,SAAU;gBACR,MAAMX,OAAOY,MAAM;YACrB;QACF;QACA,IAAIvC,SAASwC,gCAAkB,CAACC,GAAG,CAACzC,MAAM0C,IAAI,GAAG;YAC/C,MAAM,IAAIvC,qBAAa,CAAC,gCAAgCC,kBAAU,CAACuC,qBAAqB;QAC1F;QACA,OAAO;IACT;IAEA,MAAcV,YAAYN,MAAc,EAAEf,GAAW,EAAkC;QACrF,MAAMgC,eAAe,CAAC,GAAG,EAAEvB,gCAAa,CAACC,IAAI,CAACC,IAAI,CAACE,cAAc,CAAC,CAAC,EAAEb,IAAI,CAAC,EAAES,gCAAa,CAACC,IAAI,CAACC,IAAI,CAACsB,MAAM,IAAI,GAAG,CAAC,CAAC;QACnH,IAAI;YACF,MAAM,EAAEC,aAAa,EAAE,GAAG,MAAMnB,OAAOoB,MAAM,CAAC1B,gCAAa,CAACC,IAAI,CAACC,IAAI,CAACG,MAAM,EAAE;gBAC5EsB,OAAO;gBACPH,QAAQD;gBACRK,YAAY,IAAI,CAACC,eAAe;YAClC;YACA,KAAK,MAAM5C,SAASwC,cAAe;gBACjC,IAAIxC,KAAK,CAACe,gCAAa,CAACC,IAAI,CAACC,IAAI,CAACE,cAAc,CAAC,KAAKb,KAAK;oBACzD,IAAIuC,MAAMC,OAAO,CAAC9C,MAAMK,IAAI,GAAG;wBAC7B,sDAAsD;wBACtDL,MAAMK,IAAI,GAAGL,MAAMK,IAAI,CAAC,EAAE;oBAC5B;oBACA,OAAOL;gBACT;YACF;YACA,OAAO;QACT,EAAE,OAAOI,GAAG;YACV,IAAI,CAACX,MAAM,CAACsC,IAAI,CAAC,GAAG,IAAI,CAACJ,WAAW,CAAChC,IAAI,CAAC,GAAG,EAAEW,IAAI,GAAG,EAAEF,GAAG;YAC3D,OAAO;QACT;IACF;IAEA,MAAcS,mBAAmBJ,QAAuB,EAAEtB,IAAe,EAAsB;QAC7F,IAAIA,SAAS,MAAM;YACjB,OAAO,IAAI,CAAC4D,iBAAiB,CAACC,iBAAiB,CAACvC,UAAUwC,eAAS,CAACC,IAAI;QAC1E,OAAO;YACL,IAAIzC,SAASb,KAAK,KAAKT,KAAKS,KAAK,EAAE;gBACjC,IAAI,CAACH,MAAM,CAACC,KAAK,CAAC,GAAG,IAAI,CAACmB,kBAAkB,CAAClB,IAAI,CAAC,sBAAsB,EAAEc,SAASb,KAAK,CAAC,KAAK,EAAET,KAAKS,KAAK,EAAE;gBAC5G,MAAM,IAAIC,qBAAa,CAAC,0BAA0BC,kBAAU,CAACC,SAAS;YACxE;YACA,wCAAwC;YACxC,MAAMoD,qBAAoCC,OAAOC,WAAW,CAC1D,AACE,CAAA,MAAMC,QAAQC,GAAG,CACfH,OAAOI,IAAI,CAAC/C,UAAUgD,GAAG,CAAC,OAAOC;gBAC/B,IAAIA,QAAQ,YAAY;oBACtB,MAAMC,SAAS,MAAMC,IAAAA,0BAAe,EAACnD,QAAQ,CAACiD,IAAI,EAAEvE,KAAKF,QAAQ;oBACjE,OAAO0E,SAAS,OAAO;wBAACD;wBAAKjD,QAAQ,CAACiD,IAAI;qBAAC;gBAC7C;gBACA,OAAOjD,QAAQ,CAACiD,IAAI,KAAKvE,IAAI,CAACuE,IAAI,GAAG;oBAACA;oBAAKjD,QAAQ,CAACiD,IAAI;iBAAC,GAAG;YAC9D,GACF,EACAnB,MAAM,CAACsB;YAEX,IAAIT,OAAOI,IAAI,CAACL,oBAAoBtB,MAAM,GAAG,GAAG;gBAC9C,IAAI;oBACF,MAAM,IAAI,CAACkB,iBAAiB,CAACe,iBAAiB,CAAC3E,KAAK4E,EAAE,EAAEZ;oBACxD,IAAIA,oBAAoBlE,UAAU;wBAChC,OAAOkE,mBAAmBlE,QAAQ;oBACpC;oBACAmE,OAAOY,MAAM,CAAC7E,MAAMgE;gBACtB,EAAE,OAAO/C,GAAG;oBACV,IAAI,CAACX,MAAM,CAACsC,IAAI,CAAC,GAAG,IAAI,CAAClB,kBAAkB,CAAClB,IAAI,CAAC,0BAA0B,EAAER,KAAKS,KAAK,CAAC,IAAI,EAAEQ,GAAG;gBACnG;YACF;YACA,MAAMjB,KAAK8E,SAAS;YACpB,OAAO9E;QACT;IACF;IA9HA,YACE,AAAiBC,YAA0B,EAC3C,AAAiB2D,iBAAoC,CACrD;aAFiB3D,eAAAA;aACA2D,oBAAAA;aANFtD,SAAS,IAAIyE,cAAM,CAACpF,sBAAsBa,IAAI;aAC9CiD,kBAAkB;YAAC;YAAO;YAAQ;SAAK;aAChDpB,gBAA+B;YAAE2C,SAAS;YAAMC,gBAAgB;YAAM3C,KAAK;QAAG;IAKnF;AA4HL"}
+{"version":3,"sources":["../../../../../backend/src/authentication/services/auth-methods/auth-method-ldap.service.ts"],"sourcesContent":["/*\n * Copyright (C) 2012-2025 Johan Legrand <johan.legrand@sync-in.com>\n * This file is part of Sync-in | The open source file sync and share solution\n * See the LICENSE file for licensing details\n */\n\nimport { HttpException, HttpStatus, Injectable, Logger } from '@nestjs/common'\nimport { Client, ClientOptions, Entry, InvalidCredentialsError } from 'ldapts'\nimport { CONNECT_ERROR_CODE } from '../../../app.constants'\nimport { USER_ROLE } from '../../../applications/users/constants/user'\nimport type { CreateUserDto, UpdateUserDto } from '../../../applications/users/dto/create-or-update-user.dto'\nimport { UserModel } from '../../../applications/users/models/user.model'\nimport { AdminUsersManager } from '../../../applications/users/services/admin-users-manager.service'\nimport { UsersManager } from '../../../applications/users/services/users-manager.service'\nimport { comparePassword, splitFullName } from '../../../common/functions'\nimport { configuration } from '../../../configuration/config.environment'\nimport type { AUTH_SCOPE } from '../../constants/scope'\nimport { AuthMethod } from '../../models/auth-method'\n\nconst LDAP_ATTRIBUTES = {\n  AD: {\n    SAM_ACCOUNT: 'sAMAccountName',\n    USER_NAME: 'userPrincipalName'\n  },\n  LDAP: {\n    UID: 'uid'\n  },\n  COMMON: {\n    MAIL: 'mail',\n    GIVEN_NAME: 'givenName',\n    SN: 'sn',\n    CN: 'cn',\n    DISPLAY_NAME: 'displayName'\n  }\n} as const\n\nconst ALL_ATTRIBUTES = [...Object.values(LDAP_ATTRIBUTES.COMMON), ...Object.values(LDAP_ATTRIBUTES.LDAP), ...Object.values(LDAP_ATTRIBUTES.AD)]\n\ntype KnownAttr =\n  | (typeof LDAP_ATTRIBUTES.AD)[keyof typeof LDAP_ATTRIBUTES.AD]\n  | (typeof LDAP_ATTRIBUTES.LDAP)[keyof typeof LDAP_ATTRIBUTES.LDAP]\n  | (typeof LDAP_ATTRIBUTES.COMMON)[keyof typeof LDAP_ATTRIBUTES.COMMON]\n\ntype LdapUserEntry = Entry & Record<KnownAttr | string, string>\n\n@Injectable()\nexport class AuthMethodLdapService implements AuthMethod {\n  private readonly logger = new Logger(AuthMethodLdapService.name)\n  private clientOptions: ClientOptions = { timeout: 6000, connectTimeout: 6000, url: '' }\n\n  constructor(\n    private readonly usersManager: UsersManager,\n    private readonly adminUsersManager: AdminUsersManager\n  ) {}\n\n  async validateUser(login: string, password: string, ip?: string, scope?: AUTH_SCOPE): Promise<UserModel> {\n    login = this.getUserLogin(login)\n    let user: UserModel = await this.usersManager.findUser(login, false)\n    if (user) {\n      if (user.isGuest) {\n        // allow guests to be authenticated from db and check if the current user is defined as active\n        return this.usersManager.logUser(user, password, ip)\n      }\n      if (!user.isActive) {\n        this.logger.error(`${this.validateUser.name} - user *${user.login}* is locked`)\n        throw new HttpException('Account locked', HttpStatus.FORBIDDEN)\n      }\n    }\n    const entry: false | LdapUserEntry = await this.checkAuth(login, password)\n    if (entry === false) {\n      // LDAP auth failed\n      if (user) {\n        let authSuccess = false\n        if (scope) {\n          // try user app password\n          authSuccess = await this.usersManager.validateAppPassword(user, password, ip, scope)\n        }\n        this.usersManager.updateAccesses(user, ip, authSuccess).catch((e: Error) => this.logger.error(`${this.validateUser.name} : ${e}`))\n        if (authSuccess) {\n          // logged with app password\n          return user\n        }\n      }\n      return null\n    } else if (!entry[configuration.auth.ldap.attributes.login] || !entry[configuration.auth.ldap.attributes.email]) {\n      this.logger.error(`${this.validateUser.name} - required ldap fields are missing : \n      [${configuration.auth.ldap.attributes.login}, ${configuration.auth.ldap.attributes.email}] => \n      (${JSON.stringify(entry)})`)\n      return null\n    }\n    const identity = this.createIdentity(entry, password)\n    user = await this.updateOrCreateUser(identity, user)\n    this.usersManager.updateAccesses(user, ip, true).catch((e: Error) => this.logger.error(`${this.validateUser.name} : ${e}`))\n    return user\n  }\n\n  private async checkAuth(uid: string, password: string): Promise<LdapUserEntry | false> {\n    const servers = configuration.auth.ldap.servers\n    const loginAttr = configuration.auth.ldap.attributes.login\n    const baseDN = configuration.auth.ldap.baseDN\n    const bindUserDN = (Object.values(LDAP_ATTRIBUTES.AD) as string[]).indexOf(loginAttr) > -1 ? loginAttr : `${loginAttr}=${uid},${baseDN}`\n    let client: Client\n    let error: any\n    for (const s of servers) {\n      client = new Client({ ...this.clientOptions, url: s })\n      try {\n        await client.bind(bindUserDN, password)\n        return await this.checkAccess(client, uid)\n      } catch (e) {\n        if (e.errors?.length) {\n          for (const err of e.errors) {\n            this.logger.warn(`${this.checkAuth.name} - ${uid} : ${err}`)\n            error = err\n          }\n        } else {\n          error = e\n          this.logger.warn(`${this.checkAuth.name} - ${uid} : ${e}`)\n        }\n        if (error instanceof InvalidCredentialsError) {\n          return false\n        }\n      } finally {\n        await client.unbind()\n      }\n    }\n    if (error && CONNECT_ERROR_CODE.has(error.code)) {\n      throw new HttpException('Authentication service error', HttpStatus.INTERNAL_SERVER_ERROR)\n    }\n    return false\n  }\n\n  private async checkAccess(client: Client, uid: string): Promise<LdapUserEntry | false> {\n    const searchFilter = `(&(${configuration.auth.ldap.attributes.login}=${uid})${configuration.auth.ldap.filter || ''})`\n    try {\n      const { searchEntries } = await client.search(configuration.auth.ldap.baseDN, {\n        scope: 'sub',\n        filter: searchFilter,\n        attributes: ALL_ATTRIBUTES\n      })\n      for (const entry of searchEntries) {\n        if (entry[configuration.auth.ldap.attributes.login] === uid) {\n          return this.convertToLdapUserEntry(entry)\n        }\n      }\n      this.logger.warn(`${this.checkAuth.name} - unable to find user id : ${uid}`)\n      return false\n    } catch (e) {\n      this.logger.error(`${this.checkAccess.name} - ${uid} : ${e}`)\n      return false\n    }\n  }\n\n  private async updateOrCreateUser(identity: CreateUserDto, user: UserModel): Promise<UserModel> {\n    if (user === null) {\n      return this.adminUsersManager.createUserOrGuest(identity, USER_ROLE.USER)\n    } else {\n      if (identity.login !== user.login) {\n        this.logger.error(`${this.updateOrCreateUser.name} - user id mismatch : ${identity.login} !== ${user.login}`)\n        throw new HttpException('Account matching error', HttpStatus.FORBIDDEN)\n      }\n      // check if user information has changed\n      const identityHasChanged: UpdateUserDto = Object.fromEntries(\n        (\n          await Promise.all(\n            Object.keys(identity).map(async (key: string) => {\n              if (key === 'password') {\n                const isSame = await comparePassword(identity[key], user.password)\n                return isSame ? null : [key, identity[key]]\n              }\n              return identity[key] !== user[key] ? [key, identity[key]] : null\n            })\n          )\n        ).filter(Boolean)\n      )\n      if (Object.keys(identityHasChanged).length > 0) {\n        try {\n          await this.adminUsersManager.updateUserOrGuest(user.id, identityHasChanged)\n          if (identityHasChanged?.password) {\n            delete identityHasChanged.password\n          }\n          Object.assign(user, identityHasChanged)\n          if ('lastName' in identityHasChanged || 'firstName' in identityHasChanged) {\n            // force fullName update\n            user.setFullName(true)\n          }\n        } catch (e) {\n          this.logger.warn(`${this.updateOrCreateUser.name} - unable to update user *${user.login}* : ${e}`)\n        }\n      }\n      await user.makePaths()\n      return user\n    }\n  }\n\n  private convertToLdapUserEntry(entry: Entry): LdapUserEntry {\n    for (const attr of ALL_ATTRIBUTES) {\n      if (Array.isArray(entry[attr])) {\n        entry[attr] = entry[attr].length > 0 ? entry[attr][0] : null\n      }\n    }\n    return entry as LdapUserEntry\n  }\n\n  private createIdentity(entry: LdapUserEntry, password: string): CreateUserDto {\n    return {\n      login: this.getUserLogin(entry[configuration.auth.ldap.attributes.login]),\n      email: entry[configuration.auth.ldap.attributes.email],\n      password: password,\n      ...this.getFirstNameAndLastName(entry)\n    } satisfies CreateUserDto\n  }\n\n  private getFirstNameAndLastName(entry: LdapUserEntry): { firstName: string; lastName: string } {\n    // 1) Prefer structured attributes\n    if (entry.sn && entry.givenName) {\n      return { firstName: entry.givenName, lastName: entry.sn }\n    }\n    // 2) Fallback to displayName if available\n    if (entry.displayName && entry.displayName.trim()) {\n      return splitFullName(entry.displayName)\n    }\n    // 3) Fallback to cn\n    if (entry.cn && entry.cn.trim()) {\n      return splitFullName(entry.cn)\n    }\n    // 4) Nothing usable\n    return { firstName: '', lastName: '' }\n  }\n\n  private getUserLogin(login: string): string {\n    if (configuration.auth.ldap.attributes.login === LDAP_ATTRIBUTES.AD.USER_NAME) {\n      return login.split('@')[0]\n    } else if (configuration.auth.ldap.attributes.login === LDAP_ATTRIBUTES.AD.SAM_ACCOUNT) {\n      return login.split('\\\\')[0]\n    }\n    return login\n  }\n}\n"],"names":["AuthMethodLdapService","LDAP_ATTRIBUTES","AD","SAM_ACCOUNT","USER_NAME","LDAP","UID","COMMON","MAIL","GIVEN_NAME","SN","CN","DISPLAY_NAME","ALL_ATTRIBUTES","Object","values","validateUser","login","password","ip","scope","getUserLogin","user","usersManager","findUser","isGuest","logUser","isActive","logger","error","name","HttpException","HttpStatus","FORBIDDEN","entry","checkAuth","authSuccess","validateAppPassword","updateAccesses","catch","e","configuration","auth","ldap","attributes","email","JSON","stringify","identity","createIdentity","updateOrCreateUser","uid","servers","loginAttr","baseDN","bindUserDN","indexOf","client","s","Client","clientOptions","url","bind","checkAccess","errors","length","err","warn","InvalidCredentialsError","unbind","CONNECT_ERROR_CODE","has","code","INTERNAL_SERVER_ERROR","searchFilter","filter","searchEntries","search","convertToLdapUserEntry","adminUsersManager","createUserOrGuest","USER_ROLE","USER","identityHasChanged","fromEntries","Promise","all","keys","map","key","isSame","comparePassword","Boolean","updateUserOrGuest","id","assign","setFullName","makePaths","attr","Array","isArray","getFirstNameAndLastName","sn","givenName","firstName","lastName","displayName","trim","splitFullName","cn","split","Logger","timeout","connectTimeout"],"mappings":"AAAA;;;;CAIC;;;;+BA0CYA;;;eAAAA;;;wBAxCiD;wBACQ;8BACnC;sBACT;0CAGQ;qCACL;2BACkB;mCACjB;;;;;;;;;;AAI9B,MAAMC,kBAAkB;IACtBC,IAAI;QACFC,aAAa;QACbC,WAAW;IACb;IACAC,MAAM;QACJC,KAAK;IACP;IACAC,QAAQ;QACNC,MAAM;QACNC,YAAY;QACZC,IAAI;QACJC,IAAI;QACJC,cAAc;IAChB;AACF;AAEA,MAAMC,iBAAiB;OAAIC,OAAOC,MAAM,CAACd,gBAAgBM,MAAM;OAAMO,OAAOC,MAAM,CAACd,gBAAgBI,IAAI;OAAMS,OAAOC,MAAM,CAACd,gBAAgBC,EAAE;CAAE;AAUxI,IAAA,AAAMF,wBAAN,MAAMA;IASX,MAAMgB,aAAaC,KAAa,EAAEC,QAAgB,EAAEC,EAAW,EAAEC,KAAkB,EAAsB;QACvGH,QAAQ,IAAI,CAACI,YAAY,CAACJ;QAC1B,IAAIK,OAAkB,MAAM,IAAI,CAACC,YAAY,CAACC,QAAQ,CAACP,OAAO;QAC9D,IAAIK,MAAM;YACR,IAAIA,KAAKG,OAAO,EAAE;gBAChB,8FAA8F;gBAC9F,OAAO,IAAI,CAACF,YAAY,CAACG,OAAO,CAACJ,MAAMJ,UAAUC;YACnD;YACA,IAAI,CAACG,KAAKK,QAAQ,EAAE;gBAClB,IAAI,CAACC,MAAM,CAACC,KAAK,CAAC,GAAG,IAAI,CAACb,YAAY,CAACc,IAAI,CAAC,SAAS,EAAER,KAAKL,KAAK,CAAC,WAAW,CAAC;gBAC9E,MAAM,IAAIc,qBAAa,CAAC,kBAAkBC,kBAAU,CAACC,SAAS;YAChE;QACF;QACA,MAAMC,QAA+B,MAAM,IAAI,CAACC,SAAS,CAAClB,OAAOC;QACjE,IAAIgB,UAAU,OAAO;YACnB,mBAAmB;YACnB,IAAIZ,MAAM;gBACR,IAAIc,cAAc;gBAClB,IAAIhB,OAAO;oBACT,wBAAwB;oBACxBgB,cAAc,MAAM,IAAI,CAACb,YAAY,CAACc,mBAAmB,CAACf,MAAMJ,UAAUC,IAAIC;gBAChF;gBACA,IAAI,CAACG,YAAY,CAACe,cAAc,CAAChB,MAAMH,IAAIiB,aAAaG,KAAK,CAAC,CAACC,IAAa,IAAI,CAACZ,MAAM,CAACC,KAAK,CAAC,GAAG,IAAI,CAACb,YAAY,CAACc,IAAI,CAAC,GAAG,EAAEU,GAAG;gBAChI,IAAIJ,aAAa;oBACf,2BAA2B;oBAC3B,OAAOd;gBACT;YACF;YACA,OAAO;QACT,OAAO,IAAI,CAACY,KAAK,CAACO,gCAAa,CAACC,IAAI,CAACC,IAAI,CAACC,UAAU,CAAC3B,KAAK,CAAC,IAAI,CAACiB,KAAK,CAACO,gCAAa,CAACC,IAAI,CAACC,IAAI,CAACC,UAAU,CAACC,KAAK,CAAC,EAAE;YAC/G,IAAI,CAACjB,MAAM,CAACC,KAAK,CAAC,GAAG,IAAI,CAACb,YAAY,CAACc,IAAI,CAAC;OAC3C,EAAEW,gCAAa,CAACC,IAAI,CAACC,IAAI,CAACC,UAAU,CAAC3B,KAAK,CAAC,EAAE,EAAEwB,gCAAa,CAACC,IAAI,CAACC,IAAI,CAACC,UAAU,CAACC,KAAK,CAAC;OACxF,EAAEC,KAAKC,SAAS,CAACb,OAAO,CAAC,CAAC;YAC3B,OAAO;QACT;QACA,MAAMc,WAAW,IAAI,CAACC,cAAc,CAACf,OAAOhB;QAC5CI,OAAO,MAAM,IAAI,CAAC4B,kBAAkB,CAACF,UAAU1B;QAC/C,IAAI,CAACC,YAAY,CAACe,cAAc,CAAChB,MAAMH,IAAI,MAAMoB,KAAK,CAAC,CAACC,IAAa,IAAI,CAACZ,MAAM,CAACC,KAAK,CAAC,GAAG,IAAI,CAACb,YAAY,CAACc,IAAI,CAAC,GAAG,EAAEU,GAAG;QACzH,OAAOlB;IACT;IAEA,MAAca,UAAUgB,GAAW,EAAEjC,QAAgB,EAAkC;QACrF,MAAMkC,UAAUX,gCAAa,CAACC,IAAI,CAACC,IAAI,CAACS,OAAO;QAC/C,MAAMC,YAAYZ,gCAAa,CAACC,IAAI,CAACC,IAAI,CAACC,UAAU,CAAC3B,KAAK;QAC1D,MAAMqC,SAASb,gCAAa,CAACC,IAAI,CAACC,IAAI,CAACW,MAAM;QAC7C,MAAMC,aAAa,AAACzC,OAAOC,MAAM,CAACd,gBAAgBC,EAAE,EAAesD,OAAO,CAACH,aAAa,CAAC,IAAIA,YAAY,GAAGA,UAAU,CAAC,EAAEF,IAAI,CAAC,EAAEG,QAAQ;QACxI,IAAIG;QACJ,IAAI5B;QACJ,KAAK,MAAM6B,KAAKN,QAAS;YACvBK,SAAS,IAAIE,cAAM,CAAC;gBAAE,GAAG,IAAI,CAACC,aAAa;gBAAEC,KAAKH;YAAE;YACpD,IAAI;gBACF,MAAMD,OAAOK,IAAI,CAACP,YAAYrC;gBAC9B,OAAO,MAAM,IAAI,CAAC6C,WAAW,CAACN,QAAQN;YACxC,EAAE,OAAOX,GAAG;gBACV,IAAIA,EAAEwB,MAAM,EAAEC,QAAQ;oBACpB,KAAK,MAAMC,OAAO1B,EAAEwB,MAAM,CAAE;wBAC1B,IAAI,CAACpC,MAAM,CAACuC,IAAI,CAAC,GAAG,IAAI,CAAChC,SAAS,CAACL,IAAI,CAAC,GAAG,EAAEqB,IAAI,GAAG,EAAEe,KAAK;wBAC3DrC,QAAQqC;oBACV;gBACF,OAAO;oBACLrC,QAAQW;oBACR,IAAI,CAACZ,MAAM,CAACuC,IAAI,CAAC,GAAG,IAAI,CAAChC,SAAS,CAACL,IAAI,CAAC,GAAG,EAAEqB,IAAI,GAAG,EAAEX,GAAG;gBAC3D;gBACA,IAAIX,iBAAiBuC,+BAAuB,EAAE;oBAC5C,OAAO;gBACT;YACF,SAAU;gBACR,MAAMX,OAAOY,MAAM;YACrB;QACF;QACA,IAAIxC,SAASyC,gCAAkB,CAACC,GAAG,CAAC1C,MAAM2C,IAAI,GAAG;YAC/C,MAAM,IAAIzC,qBAAa,CAAC,gCAAgCC,kBAAU,CAACyC,qBAAqB;QAC1F;QACA,OAAO;IACT;IAEA,MAAcV,YAAYN,MAAc,EAAEN,GAAW,EAAkC;QACrF,MAAMuB,eAAe,CAAC,GAAG,EAAEjC,gCAAa,CAACC,IAAI,CAACC,IAAI,CAACC,UAAU,CAAC3B,KAAK,CAAC,CAAC,EAAEkC,IAAI,CAAC,EAAEV,gCAAa,CAACC,IAAI,CAACC,IAAI,CAACgC,MAAM,IAAI,GAAG,CAAC,CAAC;QACrH,IAAI;YACF,MAAM,EAAEC,aAAa,EAAE,GAAG,MAAMnB,OAAOoB,MAAM,CAACpC,gCAAa,CAACC,IAAI,CAACC,IAAI,CAACW,MAAM,EAAE;gBAC5ElC,OAAO;gBACPuD,QAAQD;gBACR9B,YAAY/B;YACd;YACA,KAAK,MAAMqB,SAAS0C,cAAe;gBACjC,IAAI1C,KAAK,CAACO,gCAAa,CAACC,IAAI,CAACC,IAAI,CAACC,UAAU,CAAC3B,KAAK,CAAC,KAAKkC,KAAK;oBAC3D,OAAO,IAAI,CAAC2B,sBAAsB,CAAC5C;gBACrC;YACF;YACA,IAAI,CAACN,MAAM,CAACuC,IAAI,CAAC,GAAG,IAAI,CAAChC,SAAS,CAACL,IAAI,CAAC,4BAA4B,EAAEqB,KAAK;YAC3E,OAAO;QACT,EAAE,OAAOX,GAAG;YACV,IAAI,CAACZ,MAAM,CAACC,KAAK,CAAC,GAAG,IAAI,CAACkC,WAAW,CAACjC,IAAI,CAAC,GAAG,EAAEqB,IAAI,GAAG,EAAEX,GAAG;YAC5D,OAAO;QACT;IACF;IAEA,MAAcU,mBAAmBF,QAAuB,EAAE1B,IAAe,EAAsB;QAC7F,IAAIA,SAAS,MAAM;YACjB,OAAO,IAAI,CAACyD,iBAAiB,CAACC,iBAAiB,CAAChC,UAAUiC,eAAS,CAACC,IAAI;QAC1E,OAAO;YACL,IAAIlC,SAAS/B,KAAK,KAAKK,KAAKL,KAAK,EAAE;gBACjC,IAAI,CAACW,MAAM,CAACC,KAAK,CAAC,GAAG,IAAI,CAACqB,kBAAkB,CAACpB,IAAI,CAAC,sBAAsB,EAAEkB,SAAS/B,KAAK,CAAC,KAAK,EAAEK,KAAKL,KAAK,EAAE;gBAC5G,MAAM,IAAIc,qBAAa,CAAC,0BAA0BC,kBAAU,CAACC,SAAS;YACxE;YACA,wCAAwC;YACxC,MAAMkD,qBAAoCrE,OAAOsE,WAAW,CAC1D,AACE,CAAA,MAAMC,QAAQC,GAAG,CACfxE,OAAOyE,IAAI,CAACvC,UAAUwC,GAAG,CAAC,OAAOC;gBAC/B,IAAIA,QAAQ,YAAY;oBACtB,MAAMC,SAAS,MAAMC,IAAAA,0BAAe,EAAC3C,QAAQ,CAACyC,IAAI,EAAEnE,KAAKJ,QAAQ;oBACjE,OAAOwE,SAAS,OAAO;wBAACD;wBAAKzC,QAAQ,CAACyC,IAAI;qBAAC;gBAC7C;gBACA,OAAOzC,QAAQ,CAACyC,IAAI,KAAKnE,IAAI,CAACmE,IAAI,GAAG;oBAACA;oBAAKzC,QAAQ,CAACyC,IAAI;iBAAC,GAAG;YAC9D,GACF,EACAd,MAAM,CAACiB;YAEX,IAAI9E,OAAOyE,IAAI,CAACJ,oBAAoBlB,MAAM,GAAG,GAAG;gBAC9C,IAAI;oBACF,MAAM,IAAI,CAACc,iBAAiB,CAACc,iBAAiB,CAACvE,KAAKwE,EAAE,EAAEX;oBACxD,IAAIA,oBAAoBjE,UAAU;wBAChC,OAAOiE,mBAAmBjE,QAAQ;oBACpC;oBACAJ,OAAOiF,MAAM,CAACzE,MAAM6D;oBACpB,IAAI,cAAcA,sBAAsB,eAAeA,oBAAoB;wBACzE,wBAAwB;wBACxB7D,KAAK0E,WAAW,CAAC;oBACnB;gBACF,EAAE,OAAOxD,GAAG;oBACV,IAAI,CAACZ,MAAM,CAACuC,IAAI,CAAC,GAAG,IAAI,CAACjB,kBAAkB,CAACpB,IAAI,CAAC,0BAA0B,EAAER,KAAKL,KAAK,CAAC,IAAI,EAAEuB,GAAG;gBACnG;YACF;YACA,MAAMlB,KAAK2E,SAAS;YACpB,OAAO3E;QACT;IACF;IAEQwD,uBAAuB5C,KAAY,EAAiB;QAC1D,KAAK,MAAMgE,QAAQrF,eAAgB;YACjC,IAAIsF,MAAMC,OAAO,CAAClE,KAAK,CAACgE,KAAK,GAAG;gBAC9BhE,KAAK,CAACgE,KAAK,GAAGhE,KAAK,CAACgE,KAAK,CAACjC,MAAM,GAAG,IAAI/B,KAAK,CAACgE,KAAK,CAAC,EAAE,GAAG;YAC1D;QACF;QACA,OAAOhE;IACT;IAEQe,eAAef,KAAoB,EAAEhB,QAAgB,EAAiB;QAC5E,OAAO;YACLD,OAAO,IAAI,CAACI,YAAY,CAACa,KAAK,CAACO,gCAAa,CAACC,IAAI,CAACC,IAAI,CAACC,UAAU,CAAC3B,KAAK,CAAC;YACxE4B,OAAOX,KAAK,CAACO,gCAAa,CAACC,IAAI,CAACC,IAAI,CAACC,UAAU,CAACC,KAAK,CAAC;YACtD3B,UAAUA;YACV,GAAG,IAAI,CAACmF,uBAAuB,CAACnE,MAAM;QACxC;IACF;IAEQmE,wBAAwBnE,KAAoB,EAA2C;QAC7F,kCAAkC;QAClC,IAAIA,MAAMoE,EAAE,IAAIpE,MAAMqE,SAAS,EAAE;YAC/B,OAAO;gBAAEC,WAAWtE,MAAMqE,SAAS;gBAAEE,UAAUvE,MAAMoE,EAAE;YAAC;QAC1D;QACA,0CAA0C;QAC1C,IAAIpE,MAAMwE,WAAW,IAAIxE,MAAMwE,WAAW,CAACC,IAAI,IAAI;YACjD,OAAOC,IAAAA,wBAAa,EAAC1E,MAAMwE,WAAW;QACxC;QACA,oBAAoB;QACpB,IAAIxE,MAAM2E,EAAE,IAAI3E,MAAM2E,EAAE,CAACF,IAAI,IAAI;YAC/B,OAAOC,IAAAA,wBAAa,EAAC1E,MAAM2E,EAAE;QAC/B;QACA,oBAAoB;QACpB,OAAO;YAAEL,WAAW;YAAIC,UAAU;QAAG;IACvC;IAEQpF,aAAaJ,KAAa,EAAU;QAC1C,IAAIwB,gCAAa,CAACC,IAAI,CAACC,IAAI,CAACC,UAAU,CAAC3B,KAAK,KAAKhB,gBAAgBC,EAAE,CAACE,SAAS,EAAE;YAC7E,OAAOa,MAAM6F,KAAK,CAAC,IAAI,CAAC,EAAE;QAC5B,OAAO,IAAIrE,gCAAa,CAACC,IAAI,CAACC,IAAI,CAACC,UAAU,CAAC3B,KAAK,KAAKhB,gBAAgBC,EAAE,CAACC,WAAW,EAAE;YACtF,OAAOc,MAAM6F,KAAK,CAAC,KAAK,CAAC,EAAE;QAC7B;QACA,OAAO7F;IACT;IA1LA,YACE,AAAiBM,YAA0B,EAC3C,AAAiBwD,iBAAoC,CACrD;aAFiBxD,eAAAA;aACAwD,oBAAAA;aALFnD,SAAS,IAAImF,cAAM,CAAC/G,sBAAsB8B,IAAI;aACvD8B,gBAA+B;YAAEoD,SAAS;YAAMC,gBAAgB;YAAMpD,KAAK;QAAG;IAKnF;AAwLL"}

package/server/authentication/services/auth-methods/auth-method-ldap.service.spec.js

@@ -7,13 +7,13 @@ Object.defineProperty(exports, "__esModule", {
     value: true
 });
 const _testing = require("@nestjs/testing");
+const _ldapts = require("ldapts");
 const _appconstants = require("../../../app.constants");
 const _adminusersmanagerservice = require("../../../applications/users/services/admin-users-manager.service");
 const _usersmanagerservice = require("../../../applications/users/services/users-manager.service");
-const _authmethodldapservice = require("./auth-method-ldap.service");
-const _configenvironment = require("../../../configuration/config.environment");
-const _ldapts = require("ldapts");
 const _functions = /*#__PURE__*/ _interop_require_wildcard(require("../../../common/functions"));
+const _configenvironment = require("../../../configuration/config.environment");
+const _authmethodldapservice = require("./auth-method-ldap.service");
 function _getRequireWildcardCache(nodeInterop) {
     if (typeof WeakMap !== "function") return null;
     var cacheBabelInterop = new WeakMap();
@@ -147,7 +147,10 @@ describe(_authmethodldapservice.AuthMethodLdapService.name, ()=>{
             servers: [
                 'ldap://localhost:389'
             ],
-            loginAttribute: 'uid',
+            attributes: {
+                login: 'uid',
+                email: 'mail'
+            },
             baseDN: 'ou=people,dc=example,dc=org',
             filter: ''
         };
@@ -192,8 +195,6 @@ describe(_authmethodldapservice.AuthMethodLdapService.name, ()=>{
             id: 8
         });
         usersManager.findUser.mockResolvedValue(existingUser);
-        const originalAttr = _configenvironment.configuration.auth.ldap.loginAttribute;
-        _configenvironment.configuration.auth.ldap.loginAttribute = 'cn';
         mockBindResolve(ldapClient);
         mockSearchEntries(ldapClient, [
             {
@@ -202,9 +203,7 @@ describe(_authmethodldapservice.AuthMethodLdapService.name, ()=>{
                 mail: 'jane@example.org'
             }
         ]);
-        await expect(authMethodLdapService.validateUser('john', 'pwd')).rejects.toThrow(/account matching error/i);
-        // restore the attribute to avoid impacting other tests
-        _configenvironment.configuration.auth.ldap.loginAttribute = originalAttr;
+        await expect(authMethodLdapService.validateUser('john', 'pwd')).resolves.toEqual(null);
     });
     it('should handle invalid LDAP credentials for both existing and unknown users', async ()=>{
         // Phase 1: existing user -> updateAccesses invoked with success=false and logger.error intercepted
@@ -439,7 +438,7 @@ describe(_authmethodldapservice.AuthMethodLdapService.name, ()=>{
         });
         usersManager.findUser.mockResolvedValue(existingUser);
         // Ensure LDAP loginAttribute matches uid for this test (a previous test sets it to 'cn')
-        _configenvironment.configuration.auth.ldap.loginAttribute = 'uid';
+        _configenvironment.configuration.auth.ldap.attributes.login = 'uid';
         setupLdapSuccess([
             {
                 uid: 'john',
@@ -471,7 +470,7 @@ describe(_authmethodldapservice.AuthMethodLdapService.name, ()=>{
             isActive: true
         };
         usersManager.findUser.mockResolvedValue(userA);
-        _configenvironment.configuration.auth.ldap.loginAttribute = 'uid';
+        _configenvironment.configuration.auth.ldap.attributes.login = 'uid';
         ldapClient.bind.mockResolvedValue(undefined);
         // Non-matching entry: uid !== requested uid
         ldapClient.search.mockResolvedValue({
@@ -494,7 +493,7 @@ describe(_authmethodldapservice.AuthMethodLdapService.name, ()=>{
             email: 'old@ex.org'
         });
         usersManager.findUser.mockResolvedValue(userB);
-        _configenvironment.configuration.auth.ldap.loginAttribute = 'uid';
+        _configenvironment.configuration.auth.ldap.attributes.login = 'uid';
         setupLdapSuccess([
             {
                 uid: 'john',

package/server/authentication/services/auth-methods/auth-method-ldap.service.spec.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../backend/src/authentication/services/auth-methods/auth-method-ldap.service.spec.ts"],"sourcesContent":["/*\n * Copyright (C) 2012-2025 Johan Legrand <johan.legrand@sync-in.com>\n * This file is part of Sync-in | The open source file sync and share solution\n * See the LICENSE file for licensing details\n */\n\nimport { Test, TestingModule } from '@nestjs/testing'\nimport { CONNECT_ERROR_CODE } from '../../../app.constants'\nimport { UserModel } from '../../../applications/users/models/user.model'\nimport { AdminUsersManager } from '../../../applications/users/services/admin-users-manager.service'\nimport { UsersManager } from '../../../applications/users/services/users-manager.service'\nimport { AuthMethodLdapService } from './auth-method-ldap.service'\nimport { configuration } from '../../../configuration/config.environment'\nimport { Client, InvalidCredentialsError } from 'ldapts'\nimport { Mocked } from 'jest-mock'\nimport * as commonFunctions from '../../../common/functions'\n\n// Mock ldapts Client to simulate LDAP behaviors\njest.mock('ldapts', () => {\n  class InvalidCredentialsError extends Error {}\n  const mockClientInstance = {\n    bind: jest.fn(),\n    search: jest.fn(),\n    unbind: jest.fn()\n  }\n  const Client = jest.fn().mockImplementation(() => mockClientInstance)\n  return { Client, InvalidCredentialsError }\n})\n\n// --- Test helpers (DRY) ---\n// Reusable LDAP mocks\nconst mockBindResolve = (ldapClient: any) => {\n  ldapClient.bind.mockResolvedValue(undefined)\n  ldapClient.unbind.mockResolvedValue(undefined)\n}\nconst mockBindRejectInvalid = (ldapClient: any, InvalidCredentialsErrorCtor: any, message = 'invalid') => {\n  ldapClient.bind.mockRejectedValue(new InvalidCredentialsErrorCtor(message))\n  ldapClient.unbind.mockResolvedValue(undefined)\n}\nconst mockSearchEntries = (ldapClient: any, entries: any[]) => {\n  ldapClient.search.mockResolvedValue({ searchEntries: entries })\n}\nconst mockSearchReject = (ldapClient: any, err: Error) => {\n  ldapClient.search.mockRejectedValue(err)\n}\n// User factory\nconst buildUser = (overrides: Partial<UserModel> = {}) =>\n  ({\n    id: 0,\n    login: 'john',\n    email: 'old@example.org',\n    password: 'hashed',\n    isGuest: false,\n    isActive: true,\n    makePaths: jest.fn().mockResolvedValue(undefined),\n    ...overrides\n  }) as any\n\n// --------------------------\n\ndescribe(AuthMethodLdapService.name, () => {\n  let authMethodLdapService: AuthMethodLdapService\n  let usersManager: Mocked<UsersManager>\n  let adminUsersManager: Mocked<AdminUsersManager>\n  const ldapClient = {\n    bind: jest.fn(),\n    search: jest.fn(),\n    unbind: jest.fn()\n  }\n  ;(Client as Mocked<any>).mockImplementation(() => ldapClient)\n\n  // Local helpers (need access to authMethodLdapService and ldapClient in this scope)\n  const setupLdapSuccess = (entries: any[]) => {\n    mockBindResolve(ldapClient)\n    mockSearchEntries(ldapClient, entries)\n  }\n  const spyLoggerError = () => jest.spyOn(authMethodLdapService['logger'], 'error').mockImplementation(() => undefined as any)\n\n  beforeAll(async () => {\n    const module: TestingModule = await Test.createTestingModule({\n      providers: [\n        AuthMethodLdapService,\n        {\n          provide: UsersManager,\n          useValue: {\n            findUser: jest.fn(),\n            logUser: jest.fn(),\n            updateAccesses: jest.fn().mockResolvedValue(undefined)\n          }\n        },\n        {\n          provide: AdminUsersManager,\n          useValue: {\n            createUserOrGuest: jest.fn(),\n            updateUserOrGuest: jest.fn()\n          }\n        }\n      ]\n    }).compile()\n\n    module.useLogger(['fatal'])\n    authMethodLdapService = module.get<AuthMethodLdapService>(AuthMethodLdapService)\n    adminUsersManager = module.get<Mocked<AdminUsersManager>>(AdminUsersManager)\n    usersManager = module.get<Mocked<UsersManager>>(UsersManager)\n    configuration.auth.ldap = { servers: ['ldap://localhost:389'], loginAttribute: 'uid', baseDN: 'ou=people,dc=example,dc=org', filter: '' }\n  })\n\n  it('should be defined', () => {\n    expect(authMethodLdapService).toBeDefined()\n    expect(usersManager).toBeDefined()\n    expect(adminUsersManager).toBeDefined()\n    expect(ldapClient).toBeDefined()\n  })\n\n  it('should authenticate a guest user via database and bypass LDAP', async () => {\n    // Arrange\n    const guestUser: any = { id: 1, login: 'guest1', isGuest: true, isActive: true }\n    usersManager.findUser.mockResolvedValue(guestUser)\n    const dbAuthResult: any = { ...guestUser, token: 'jwt' }\n    usersManager.logUser.mockResolvedValue(dbAuthResult)\n\n    const res = await authMethodLdapService.validateUser('guest1', 'pass', '127.0.0.1')\n\n    expect(res).toEqual(dbAuthResult)\n    expect(usersManager.logUser).toHaveBeenCalledWith(guestUser, 'pass', '127.0.0.1')\n    expect(Client).not.toHaveBeenCalled() // client should not be constructed\n  })\n\n  it('should throw FORBIDDEN for locked account and LDAP login mismatch', async () => {\n    // Phase 1: locked account\n    usersManager.findUser.mockResolvedValue({ login: 'john', isGuest: false, isActive: false } as UserModel)\n    const loggerErrorSpy1 = jest.spyOn(authMethodLdapService['logger'], 'error').mockImplementation(() => undefined as any)\n\n    await expect(authMethodLdapService.validateUser('john', 'pwd')).rejects.toThrow(/account locked/i)\n    expect(loggerErrorSpy1).toHaveBeenCalled()\n\n    // Phase 2: mismatch between requested login and LDAP returned login\n    const existingUser: any = buildUser({ id: 8 })\n    usersManager.findUser.mockResolvedValue(existingUser)\n    const originalAttr = configuration.auth.ldap.loginAttribute\n    configuration.auth.ldap.loginAttribute = 'cn'\n    mockBindResolve(ldapClient)\n    mockSearchEntries(ldapClient, [{ uid: 'jane', cn: 'john', mail: 'jane@example.org' }])\n\n    await expect(authMethodLdapService.validateUser('john', 'pwd')).rejects.toThrow(/account matching error/i)\n\n    // restore the attribute to avoid impacting other tests\n    configuration.auth.ldap.loginAttribute = originalAttr\n  })\n\n  it('should handle invalid LDAP credentials for both existing and unknown users', async () => {\n    // Phase 1: existing user -> updateAccesses invoked with success=false and logger.error intercepted\n    const existingUser: any = buildUser({ id: 1 })\n    usersManager.findUser.mockResolvedValue(existingUser)\n    // Make LDAP bind throw InvalidCredentialsError\n    mockBindRejectInvalid(ldapClient, InvalidCredentialsError, 'invalid credentials')\n    // Force updateAccesses to reject to hit the catch and logger.error\n    const loggerErrorSpy = jest.spyOn(authMethodLdapService['logger'], 'error').mockImplementation(() => undefined as any)\n    usersManager.updateAccesses.mockRejectedValueOnce(new Error('updateAccesses boom'))\n\n    const res1 = await authMethodLdapService.validateUser('john', 'badpwd', '10.0.0.1')\n\n    expect(res1).toBeNull()\n    expect(usersManager.updateAccesses).toHaveBeenCalledWith(existingUser, '10.0.0.1', false)\n    expect(loggerErrorSpy).toHaveBeenCalled()\n\n    // Phase 2: unknown user → no access update\n    usersManager.updateAccesses.mockClear()\n    usersManager.findUser.mockResolvedValue(null)\n    ldapClient.bind.mockRejectedValue(new InvalidCredentialsError('invalid'))\n    ldapClient.unbind.mockResolvedValue(undefined)\n\n    const res2 = await authMethodLdapService.validateUser('jane', 'badpwd')\n\n    expect(res2).toBeNull()\n    expect(usersManager.updateAccesses).not.toHaveBeenCalled()\n  })\n\n  it('should handle LDAP new-user flow: missing fields, creation success, and multi-email selection', async () => {\n    // Phase 1: incomplete LDAP entry -> null + error log, no creation\n    usersManager.findUser.mockResolvedValue(null)\n    mockBindResolve(ldapClient)\n    // Simulate an entry with missing mail\n    mockSearchEntries(ldapClient, [{ uid: 'jane', cn: 'Jane Doe', mail: undefined }])\n    const loggerErrorSpy = jest.spyOn(authMethodLdapService['logger'], 'error').mockImplementation(() => undefined as any)\n\n    const resA = await authMethodLdapService.validateUser('jane', 'pwd')\n\n    expect(resA).toBeNull()\n    expect(adminUsersManager.createUserOrGuest).not.toHaveBeenCalled()\n    expect(loggerErrorSpy).toHaveBeenCalled()\n\n    // Phase 2: create a new user (success, single email)\n    usersManager.findUser.mockResolvedValue(null)\n    setupLdapSuccess([{ uid: 'john', cn: 'John Doe', mail: 'john@example.org' }])\n\n    const createdUser: any = { id: 2, login: 'john', isGuest: false, isActive: true, makePaths: jest.fn() }\n    adminUsersManager.createUserOrGuest.mockResolvedValue(createdUser)\n    // Cover the success-flow catch branch\n    const loggerErrorSpy2 = spyLoggerError()\n    usersManager.updateAccesses.mockRejectedValueOnce(new Error('updateAccesses success flow boom'))\n\n    const resB = await authMethodLdapService.validateUser('john', 'pwd', '192.168.1.10')\n\n    expect(adminUsersManager.createUserOrGuest).toHaveBeenCalledWith(\n      { login: 'john', email: 'john@example.org', password: 'pwd', firstName: 'John', lastName: 'Doe' },\n      expect.anything() // USER_ROLE.USER\n    )\n    expect(resB).toBe(createdUser)\n    expect(usersManager.updateAccesses).toHaveBeenCalledWith(createdUser, '192.168.1.10', true)\n    expect(loggerErrorSpy2).toHaveBeenCalled()\n\n    // Phase 3: multiple emails -> keep the first\n    usersManager.findUser.mockResolvedValue(null)\n    setupLdapSuccess([{ uid: 'multi', cn: 'Multi Mail', mail: ['first@example.org', 'second@example.org'] }])\n\n    const createdUser2: any = { id: 9, login: 'multi', makePaths: jest.fn() }\n    adminUsersManager.createUserOrGuest.mockResolvedValue(createdUser2)\n\n    const resC = await authMethodLdapService.validateUser('multi', 'pwd')\n\n    expect(adminUsersManager.createUserOrGuest).toHaveBeenCalledWith(expect.objectContaining({ email: 'first@example.org' }), expect.anything())\n    expect(resC).toBe(createdUser2)\n  })\n\n  it('should update existing user profile when LDAP identity changed (except password assigned back)', async () => {\n    // Arrange: existing user with different profile and an old password\n    const existingUser: any = buildUser({ id: 5 })\n    usersManager.findUser.mockResolvedValue(existingUser)\n\n    // LDAP succeeds and returns different email and same uid\n    setupLdapSuccess([{ uid: 'john', cn: 'John Doe', mail: 'john@example.org' }])\n\n    // Admin manager successfully updates a user\n    adminUsersManager.updateUserOrGuest.mockResolvedValue(undefined)\n\n    // Ensure password is considered changed so the update payload includes it,\n    // which then triggers the deletion and local assignment branches after update\n    const compareSpy = jest.spyOn(commonFunctions, 'comparePassword').mockResolvedValue(false)\n\n    const res = await authMethodLdapService.validateUser('john', 'new-plain-password', '127.0.0.2')\n\n    expect(adminUsersManager.updateUserOrGuest).toHaveBeenCalledWith(\n      5,\n      expect.objectContaining({\n        email: 'john@example.org',\n        firstName: 'John',\n        lastName: 'Doe'\n      })\n    )\n    // Password should not be assigned back onto the user object (it is deleted before Object.assign)\n    expect(existingUser.password).toBe('hashed')\n    // Other fields should be updated locally\n    expect(existingUser.email).toBe('john@example.org')\n    expect(existingUser).toMatchObject({ firstName: 'John', lastName: 'Doe' })\n    // Accesses updated as success\n    expect(usersManager.updateAccesses).toHaveBeenCalledWith(existingUser, '127.0.0.2', true)\n    // Returned user is the same instance\n    expect(res).toBe(existingUser)\n\n    // Second run: password unchanged (comparePassword => true) to cover the null branch for password\n    adminUsersManager.updateUserOrGuest.mockClear()\n    usersManager.updateAccesses.mockClear()\n    // Force another non-password change so an update occurs\n    existingUser.email = 'old@example.org'\n    compareSpy.mockResolvedValue(true)\n\n    const res2 = await authMethodLdapService.validateUser('john', 'same-plain-password', '127.0.0.3')\n\n    // Update should be called without password, only with changed fields\n    expect(adminUsersManager.updateUserOrGuest).toHaveBeenCalled()\n    const updateArgs = adminUsersManager.updateUserOrGuest.mock.calls[0]\n    expect(updateArgs[0]).toBe(5)\n    expect(updateArgs[1]).toEqual(\n      expect.objectContaining({\n        email: 'john@example.org'\n      })\n    )\n    expect(updateArgs[1]).toEqual(expect.not.objectContaining({ password: expect.anything() }))\n\n    // Password remains unchanged locally\n    expect(existingUser.password).toBe('hashed')\n    // Accesses updated as success\n    expect(usersManager.updateAccesses).toHaveBeenCalledWith(existingUser, '127.0.0.3', true)\n    // Returned user is the same instance\n    expect(res2).toBe(existingUser)\n\n    // Third run: no changes at all (identityHasChanged is empty) to cover the else branch\n    adminUsersManager.updateUserOrGuest.mockClear()\n    usersManager.updateAccesses.mockClear()\n    compareSpy.mockResolvedValue(true)\n\n    // Local user already matches LDAP identity; call again\n    const res3 = await authMethodLdapService.validateUser('john', 'same-plain-password', '127.0.0.4')\n\n    // No update should be triggered\n    expect(adminUsersManager.updateUserOrGuest).not.toHaveBeenCalled()\n    // Access should still be updated as success\n    expect(usersManager.updateAccesses).toHaveBeenCalledWith(existingUser, '127.0.0.4', true)\n    // Returned user is the same instance\n    expect(res3).toBe(existingUser)\n  })\n\n  it('should log failed access when LDAP search returns no entry or throws after bind', async () => {\n    // Phase 1: no entry found after a successful bind -> failed access\n    const existingUser: any = { id: 7, login: 'ghost', isGuest: false, isActive: true }\n    usersManager.findUser.mockResolvedValue(existingUser)\n    setupLdapSuccess([])\n\n    const resA = await authMethodLdapService.validateUser('ghost', 'pwd', '10.10.0.1')\n\n    expect(resA).toBeNull()\n    expect(usersManager.updateAccesses).toHaveBeenCalledWith(existingUser, '10.10.0.1', false)\n\n    // Phase 2: exception during search after a bind -> failed access\n    jest.clearAllMocks()\n    const existingUser2: any = { id: 10, login: 'john', isGuest: false, isActive: true }\n    usersManager.findUser.mockResolvedValue(existingUser2)\n    mockBindResolve(ldapClient)\n    mockSearchReject(ldapClient, new Error('search failed'))\n\n    const resB = await authMethodLdapService.validateUser('john', 'pwd', '1.1.1.1')\n\n    expect(resB).toBeNull()\n    expect(usersManager.updateAccesses).toHaveBeenCalledWith(existingUser2, '1.1.1.1', false)\n  })\n\n  it('should throw 500 when LDAP connection error occurs during bind', async () => {\n    // Arrange: no existing user to reach checkAuth flow\n    usersManager.findUser.mockResolvedValue(null)\n    const err1 = new Error('socket hang up')\n    const err2 = Object.assign(new Error('connect ECONNREFUSED'), { code: Array.from(CONNECT_ERROR_CODE)[0] })\n    ldapClient.bind.mockRejectedValue({ errors: [err1, err2] })\n    ldapClient.unbind.mockResolvedValue(undefined)\n\n    // First scenario: recognized connection error -> throws 500\n    await expect(authMethodLdapService.validateUser('john', 'pwd')).rejects.toThrow(/authentication service/i)\n\n    // Second scenario: generic error (no code, not InvalidCredentialsError) -> resolves to null and no access update\n    ldapClient.bind.mockReset()\n    ldapClient.unbind.mockReset()\n    usersManager.updateAccesses.mockClear()\n    usersManager.findUser.mockResolvedValue(null as any)\n    ldapClient.bind.mockRejectedValue(new Error('unexpected failure'))\n    ldapClient.unbind.mockResolvedValue(undefined)\n\n    const res = await authMethodLdapService.validateUser('john', 'pwd')\n    expect(res).toBeNull()\n    expect(usersManager.updateAccesses).not.toHaveBeenCalled()\n  })\n\n  it('should log update failure and still call makePaths when updating existing user', async () => {\n    // Arrange: existing user with changed identity\n    const existingUser: any = buildUser({ id: 11, email: 'old@ex.org' })\n    usersManager.findUser.mockResolvedValue(existingUser)\n\n    // Ensure LDAP loginAttribute matches uid for this test (a previous test sets it to 'cn')\n    configuration.auth.ldap.loginAttribute = 'uid'\n\n    setupLdapSuccess([{ uid: 'john', cn: 'John Doe', mail: 'john@example.org' }])\n    adminUsersManager.updateUserOrGuest.mockRejectedValue(new Error('db error'))\n\n    // Force identity to be considered changed only for this test\n    jest.spyOn(commonFunctions, 'comparePassword').mockResolvedValue(false)\n    jest.spyOn(commonFunctions, 'splitFullName').mockReturnValue({ firstName: 'John', lastName: 'Doe' })\n\n    const res = await authMethodLdapService.validateUser('john', 'pwd')\n\n    expect(adminUsersManager.updateUserOrGuest).toHaveBeenCalled()\n    // makePaths still invoked\n    expect(existingUser.makePaths).toHaveBeenCalled()\n    // Local fields unchanged since update failed\n    expect(existingUser.email).toBe('old@ex.org')\n    expect(res).toBe(existingUser)\n  })\n\n  it('should skip non-matching LDAP entries then update user with changed password without reassigning it', async () => {\n    // Phase A: LDAP returns an entry but loginAttribute value does not match -> checkAccess returns false (covers return after loop)\n    const userA: any = { id: 20, login: 'john', isGuest: false, isActive: true }\n    usersManager.findUser.mockResolvedValue(userA)\n    configuration.auth.ldap.loginAttribute = 'uid'\n    ldapClient.bind.mockResolvedValue(undefined)\n    // Non-matching entry: uid !== requested uid\n    ldapClient.search.mockResolvedValue({ searchEntries: [{ uid: 'jane', cn: 'Jane Doe', mail: 'jane@example.org' }] })\n    ldapClient.unbind.mockResolvedValue(undefined)\n\n    const resA = await authMethodLdapService.validateUser('john', 'pwd', '3.3.3.3')\n    expect(resA).toBeNull()\n    expect(usersManager.updateAccesses).toHaveBeenCalledWith(userA, '3.3.3.3', false)\n\n    // Phase B: Matching entry + password considered changed -> updateUserOrGuest called, password not reassigned locally\n    jest.clearAllMocks()\n    const userB: any = buildUser({ id: 21, email: 'old@ex.org' })\n    usersManager.findUser.mockResolvedValue(userB)\n    configuration.auth.ldap.loginAttribute = 'uid'\n    setupLdapSuccess([{ uid: 'john', cn: 'John Doe', mail: 'john@example.org' }])\n    adminUsersManager.updateUserOrGuest.mockResolvedValue(undefined)\n\n    // Force password to be considered changed to execute deletion + Object.assign branch\n    jest.spyOn(commonFunctions, 'comparePassword').mockResolvedValue(false)\n    jest.spyOn(commonFunctions, 'splitFullName').mockReturnValue({ firstName: 'John', lastName: 'Doe' })\n\n    const resB = await authMethodLdapService.validateUser('john', 'newpwd', '4.4.4.4')\n\n    // Line 132: updateUserOrGuest call\n    expect(adminUsersManager.updateUserOrGuest).toHaveBeenCalledWith(\n      21,\n      expect.objectContaining({ email: 'john@example.org', firstName: 'John', lastName: 'Doe' })\n    )\n    // Lines 139-142: password removed from local assign, other fields assigned\n    expect(userB.password).toBe('hashed')\n    expect(userB.email).toBe('john@example.org')\n    expect(userB).toMatchObject({ firstName: 'John', lastName: 'Doe' })\n    expect(userB.makePaths).toHaveBeenCalled()\n    expect(resB).toBe(userB)\n  })\n})\n"],"names":["jest","mock","InvalidCredentialsError","Error","mockClientInstance","bind","fn","search","unbind","Client","mockImplementation","mockBindResolve","ldapClient","mockResolvedValue","undefined","mockBindRejectInvalid","InvalidCredentialsErrorCtor","message","mockRejectedValue","mockSearchEntries","entries","searchEntries","mockSearchReject","err","buildUser","overrides","id","login","email","password","isGuest","isActive","makePaths","describe","AuthMethodLdapService","name","authMethodLdapService","usersManager","adminUsersManager","setupLdapSuccess","spyLoggerError","spyOn","beforeAll","module","Test","createTestingModule","providers","provide","UsersManager","useValue","findUser","logUser","updateAccesses","AdminUsersManager","createUserOrGuest","updateUserOrGuest","compile","useLogger","get","configuration","auth","ldap","servers","loginAttribute","baseDN","filter","it","expect","toBeDefined","guestUser","dbAuthResult","token","res","validateUser","toEqual","toHaveBeenCalledWith","not","toHaveBeenCalled","loggerErrorSpy1","rejects","toThrow","existingUser","originalAttr","uid","cn","mail","loggerErrorSpy","mockRejectedValueOnce","res1","toBeNull","mockClear","res2","resA","createdUser","loggerErrorSpy2","resB","firstName","lastName","anything","toBe","createdUser2","resC","objectContaining","compareSpy","commonFunctions","toMatchObject","updateArgs","calls","res3","clearAllMocks","existingUser2","err1","err2","Object","assign","code","Array","from","CONNECT_ERROR_CODE","errors","mockReset","mockReturnValue","userA","userB"],"mappings":"AAAA;;;;CAIC;;;;yBAEmC;8BACD;0CAED;qCACL;uCACS;mCACR;wBACkB;mEAEf;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAEjC,gDAAgD;AAChDA,KAAKC,IAAI,CAAC,UAAU;IAClB,IAAA,AAAMC,0BAAN,MAAMA,gCAAgCC;IAAO;IAC7C,MAAMC,qBAAqB;QACzBC,MAAML,KAAKM,EAAE;QACbC,QAAQP,KAAKM,EAAE;QACfE,QAAQR,KAAKM,EAAE;IACjB;IACA,MAAMG,SAAST,KAAKM,EAAE,GAAGI,kBAAkB,CAAC,IAAMN;IAClD,OAAO;QAAEK;QAAQP;IAAwB;AAC3C;AAEA,6BAA6B;AAC7B,sBAAsB;AACtB,MAAMS,kBAAkB,CAACC;IACvBA,WAAWP,IAAI,CAACQ,iBAAiB,CAACC;IAClCF,WAAWJ,MAAM,CAACK,iBAAiB,CAACC;AACtC;AACA,MAAMC,wBAAwB,CAACH,YAAiBI,6BAAkCC,UAAU,SAAS;IACnGL,WAAWP,IAAI,CAACa,iBAAiB,CAAC,IAAIF,4BAA4BC;IAClEL,WAAWJ,MAAM,CAACK,iBAAiB,CAACC;AACtC;AACA,MAAMK,oBAAoB,CAACP,YAAiBQ;IAC1CR,WAAWL,MAAM,CAACM,iBAAiB,CAAC;QAAEQ,eAAeD;IAAQ;AAC/D;AACA,MAAME,mBAAmB,CAACV,YAAiBW;IACzCX,WAAWL,MAAM,CAACW,iBAAiB,CAACK;AACtC;AACA,eAAe;AACf,MAAMC,YAAY,CAACC,YAAgC,CAAC,CAAC,GAClD,CAAA;QACCC,IAAI;QACJC,OAAO;QACPC,OAAO;QACPC,UAAU;QACVC,SAAS;QACTC,UAAU;QACVC,WAAWhC,KAAKM,EAAE,GAAGO,iBAAiB,CAACC;QACvC,GAAGW,SAAS;IACd,CAAA;AAEF,6BAA6B;AAE7BQ,SAASC,4CAAqB,CAACC,IAAI,EAAE;IACnC,IAAIC;IACJ,IAAIC;IACJ,IAAIC;IACJ,MAAM1B,aAAa;QACjBP,MAAML,KAAKM,EAAE;QACbC,QAAQP,KAAKM,EAAE;QACfE,QAAQR,KAAKM,EAAE;IACjB;IACEG,cAAM,CAAiBC,kBAAkB,CAAC,IAAME;IAElD,oFAAoF;IACpF,MAAM2B,mBAAmB,CAACnB;QACxBT,gBAAgBC;QAChBO,kBAAkBP,YAAYQ;IAChC;IACA,MAAMoB,iBAAiB,IAAMxC,KAAKyC,KAAK,CAACL,qBAAqB,CAAC,SAAS,EAAE,SAAS1B,kBAAkB,CAAC,IAAMI;IAE3G4B,UAAU;QACR,MAAMC,SAAwB,MAAMC,aAAI,CAACC,mBAAmB,CAAC;YAC3DC,WAAW;gBACTZ,4CAAqB;gBACrB;oBACEa,SAASC,iCAAY;oBACrBC,UAAU;wBACRC,UAAUlD,KAAKM,EAAE;wBACjB6C,SAASnD,KAAKM,EAAE;wBAChB8C,gBAAgBpD,KAAKM,EAAE,GAAGO,iBAAiB,CAACC;oBAC9C;gBACF;gBACA;oBACEiC,SAASM,2CAAiB;oBAC1BJ,UAAU;wBACRK,mBAAmBtD,KAAKM,EAAE;wBAC1BiD,mBAAmBvD,KAAKM,EAAE;oBAC5B;gBACF;aACD;QACH,GAAGkD,OAAO;QAEVb,OAAOc,SAAS,CAAC;YAAC;SAAQ;QAC1BrB,wBAAwBO,OAAOe,GAAG,CAAwBxB,4CAAqB;QAC/EI,oBAAoBK,OAAOe,GAAG,CAA4BL,2CAAiB;QAC3EhB,eAAeM,OAAOe,GAAG,CAAuBV,iCAAY;QAC5DW,gCAAa,CAACC,IAAI,CAACC,IAAI,GAAG;YAAEC,SAAS;gBAAC;aAAuB;YAAEC,gBAAgB;YAAOC,QAAQ;YAA+BC,QAAQ;QAAG;IAC1I;IAEAC,GAAG,qBAAqB;QACtBC,OAAO/B,uBAAuBgC,WAAW;QACzCD,OAAO9B,cAAc+B,WAAW;QAChCD,OAAO7B,mBAAmB8B,WAAW;QACrCD,OAAOvD,YAAYwD,WAAW;IAChC;IAEAF,GAAG,iEAAiE;QAClE,UAAU;QACV,MAAMG,YAAiB;YAAE3C,IAAI;YAAGC,OAAO;YAAUG,SAAS;YAAMC,UAAU;QAAK;QAC/EM,aAAaa,QAAQ,CAACrC,iBAAiB,CAACwD;QACxC,MAAMC,eAAoB;YAAE,GAAGD,SAAS;YAAEE,OAAO;QAAM;QACvDlC,aAAac,OAAO,CAACtC,iBAAiB,CAACyD;QAEvC,MAAME,MAAM,MAAMpC,sBAAsBqC,YAAY,CAAC,UAAU,QAAQ;QAEvEN,OAAOK,KAAKE,OAAO,CAACJ;QACpBH,OAAO9B,aAAac,OAAO,EAAEwB,oBAAoB,CAACN,WAAW,QAAQ;QACrEF,OAAO1D,cAAM,EAAEmE,GAAG,CAACC,gBAAgB,IAAG,mCAAmC;IAC3E;IAEAX,GAAG,qEAAqE;QACtE,0BAA0B;QAC1B7B,aAAaa,QAAQ,CAACrC,iBAAiB,CAAC;YAAEc,OAAO;YAAQG,SAAS;YAAOC,UAAU;QAAM;QACzF,MAAM+C,kBAAkB9E,KAAKyC,KAAK,CAACL,qBAAqB,CAAC,SAAS,EAAE,SAAS1B,kBAAkB,CAAC,IAAMI;QAEtG,MAAMqD,OAAO/B,sBAAsBqC,YAAY,CAAC,QAAQ,QAAQM,OAAO,CAACC,OAAO,CAAC;QAChFb,OAAOW,iBAAiBD,gBAAgB;QAExC,oEAAoE;QACpE,MAAMI,eAAoBzD,UAAU;YAAEE,IAAI;QAAE;QAC5CW,aAAaa,QAAQ,CAACrC,iBAAiB,CAACoE;QACxC,MAAMC,eAAevB,gCAAa,CAACC,IAAI,CAACC,IAAI,CAACE,cAAc;QAC3DJ,gCAAa,CAACC,IAAI,CAACC,IAAI,CAACE,cAAc,GAAG;QACzCpD,gBAAgBC;QAChBO,kBAAkBP,YAAY;YAAC;gBAAEuE,KAAK;gBAAQC,IAAI;gBAAQC,MAAM;YAAmB;SAAE;QAErF,MAAMlB,OAAO/B,sBAAsBqC,YAAY,CAAC,QAAQ,QAAQM,OAAO,CAACC,OAAO,CAAC;QAEhF,uDAAuD;QACvDrB,gCAAa,CAACC,IAAI,CAACC,IAAI,CAACE,cAAc,GAAGmB;IAC3C;IAEAhB,GAAG,8EAA8E;QAC/E,mGAAmG;QACnG,MAAMe,eAAoBzD,UAAU;YAAEE,IAAI;QAAE;QAC5CW,aAAaa,QAAQ,CAACrC,iBAAiB,CAACoE;QACxC,+CAA+C;QAC/ClE,sBAAsBH,YAAYV,+BAAuB,EAAE;QAC3D,mEAAmE;QACnE,MAAMoF,iBAAiBtF,KAAKyC,KAAK,CAACL,qBAAqB,CAAC,SAAS,EAAE,SAAS1B,kBAAkB,CAAC,IAAMI;QACrGuB,aAAae,cAAc,CAACmC,qBAAqB,CAAC,IAAIpF,MAAM;QAE5D,MAAMqF,OAAO,MAAMpD,sBAAsBqC,YAAY,CAAC,QAAQ,UAAU;QAExEN,OAAOqB,MAAMC,QAAQ;QACrBtB,OAAO9B,aAAae,cAAc,EAAEuB,oBAAoB,CAACM,cAAc,YAAY;QACnFd,OAAOmB,gBAAgBT,gBAAgB;QAEvC,2CAA2C;QAC3CxC,aAAae,cAAc,CAACsC,SAAS;QACrCrD,aAAaa,QAAQ,CAACrC,iBAAiB,CAAC;QACxCD,WAAWP,IAAI,CAACa,iBAAiB,CAAC,IAAIhB,+BAAuB,CAAC;QAC9DU,WAAWJ,MAAM,CAACK,iBAAiB,CAACC;QAEpC,MAAM6E,OAAO,MAAMvD,sBAAsBqC,YAAY,CAAC,QAAQ;QAE9DN,OAAOwB,MAAMF,QAAQ;QACrBtB,OAAO9B,aAAae,cAAc,EAAEwB,GAAG,CAACC,gBAAgB;IAC1D;IAEAX,GAAG,iGAAiG;QAClG,kEAAkE;QAClE7B,aAAaa,QAAQ,CAACrC,iBAAiB,CAAC;QACxCF,gBAAgBC;QAChB,sCAAsC;QACtCO,kBAAkBP,YAAY;YAAC;gBAAEuE,KAAK;gBAAQC,IAAI;gBAAYC,MAAMvE;YAAU;SAAE;QAChF,MAAMwE,iBAAiBtF,KAAKyC,KAAK,CAACL,qBAAqB,CAAC,SAAS,EAAE,SAAS1B,kBAAkB,CAAC,IAAMI;QAErG,MAAM8E,OAAO,MAAMxD,sBAAsBqC,YAAY,CAAC,QAAQ;QAE9DN,OAAOyB,MAAMH,QAAQ;QACrBtB,OAAO7B,kBAAkBgB,iBAAiB,EAAEsB,GAAG,CAACC,gBAAgB;QAChEV,OAAOmB,gBAAgBT,gBAAgB;QAEvC,qDAAqD;QACrDxC,aAAaa,QAAQ,CAACrC,iBAAiB,CAAC;QACxC0B,iBAAiB;YAAC;gBAAE4C,KAAK;gBAAQC,IAAI;gBAAYC,MAAM;YAAmB;SAAE;QAE5E,MAAMQ,cAAmB;YAAEnE,IAAI;YAAGC,OAAO;YAAQG,SAAS;YAAOC,UAAU;YAAMC,WAAWhC,KAAKM,EAAE;QAAG;QACtGgC,kBAAkBgB,iBAAiB,CAACzC,iBAAiB,CAACgF;QACtD,sCAAsC;QACtC,MAAMC,kBAAkBtD;QACxBH,aAAae,cAAc,CAACmC,qBAAqB,CAAC,IAAIpF,MAAM;QAE5D,MAAM4F,OAAO,MAAM3D,sBAAsBqC,YAAY,CAAC,QAAQ,OAAO;QAErEN,OAAO7B,kBAAkBgB,iBAAiB,EAAEqB,oBAAoB,CAC9D;YAAEhD,OAAO;YAAQC,OAAO;YAAoBC,UAAU;YAAOmE,WAAW;YAAQC,UAAU;QAAM,GAChG9B,OAAO+B,QAAQ,GAAG,iBAAiB;;QAErC/B,OAAO4B,MAAMI,IAAI,CAACN;QAClB1B,OAAO9B,aAAae,cAAc,EAAEuB,oBAAoB,CAACkB,aAAa,gBAAgB;QACtF1B,OAAO2B,iBAAiBjB,gBAAgB;QAExC,6CAA6C;QAC7CxC,aAAaa,QAAQ,CAACrC,iBAAiB,CAAC;QACxC0B,iBAAiB;YAAC;gBAAE4C,KAAK;gBAASC,IAAI;gBAAcC,MAAM;oBAAC;oBAAqB;iBAAqB;YAAC;SAAE;QAExG,MAAMe,eAAoB;YAAE1E,IAAI;YAAGC,OAAO;YAASK,WAAWhC,KAAKM,EAAE;QAAG;QACxEgC,kBAAkBgB,iBAAiB,CAACzC,iBAAiB,CAACuF;QAEtD,MAAMC,OAAO,MAAMjE,sBAAsBqC,YAAY,CAAC,SAAS;QAE/DN,OAAO7B,kBAAkBgB,iBAAiB,EAAEqB,oBAAoB,CAACR,OAAOmC,gBAAgB,CAAC;YAAE1E,OAAO;QAAoB,IAAIuC,OAAO+B,QAAQ;QACzI/B,OAAOkC,MAAMF,IAAI,CAACC;IACpB;IAEAlC,GAAG,kGAAkG;QACnG,oEAAoE;QACpE,MAAMe,eAAoBzD,UAAU;YAAEE,IAAI;QAAE;QAC5CW,aAAaa,QAAQ,CAACrC,iBAAiB,CAACoE;QAExC,yDAAyD;QACzD1C,iBAAiB;YAAC;gBAAE4C,KAAK;gBAAQC,IAAI;gBAAYC,MAAM;YAAmB;SAAE;QAE5E,4CAA4C;QAC5C/C,kBAAkBiB,iBAAiB,CAAC1C,iBAAiB,CAACC;QAEtD,2EAA2E;QAC3E,8EAA8E;QAC9E,MAAMyF,aAAavG,KAAKyC,KAAK,CAAC+D,YAAiB,mBAAmB3F,iBAAiB,CAAC;QAEpF,MAAM2D,MAAM,MAAMpC,sBAAsBqC,YAAY,CAAC,QAAQ,sBAAsB;QAEnFN,OAAO7B,kBAAkBiB,iBAAiB,EAAEoB,oBAAoB,CAC9D,GACAR,OAAOmC,gBAAgB,CAAC;YACtB1E,OAAO;YACPoE,WAAW;YACXC,UAAU;QACZ;QAEF,iGAAiG;QACjG9B,OAAOc,aAAapD,QAAQ,EAAEsE,IAAI,CAAC;QACnC,yCAAyC;QACzChC,OAAOc,aAAarD,KAAK,EAAEuE,IAAI,CAAC;QAChChC,OAAOc,cAAcwB,aAAa,CAAC;YAAET,WAAW;YAAQC,UAAU;QAAM;QACxE,8BAA8B;QAC9B9B,OAAO9B,aAAae,cAAc,EAAEuB,oBAAoB,CAACM,cAAc,aAAa;QACpF,qCAAqC;QACrCd,OAAOK,KAAK2B,IAAI,CAAClB;QAEjB,iGAAiG;QACjG3C,kBAAkBiB,iBAAiB,CAACmC,SAAS;QAC7CrD,aAAae,cAAc,CAACsC,SAAS;QACrC,wDAAwD;QACxDT,aAAarD,KAAK,GAAG;QACrB2E,WAAW1F,iBAAiB,CAAC;QAE7B,MAAM8E,OAAO,MAAMvD,sBAAsBqC,YAAY,CAAC,QAAQ,uBAAuB;QAErF,qEAAqE;QACrEN,OAAO7B,kBAAkBiB,iBAAiB,EAAEsB,gBAAgB;QAC5D,MAAM6B,aAAapE,kBAAkBiB,iBAAiB,CAACtD,IAAI,CAAC0G,KAAK,CAAC,EAAE;QACpExC,OAAOuC,UAAU,CAAC,EAAE,EAAEP,IAAI,CAAC;QAC3BhC,OAAOuC,UAAU,CAAC,EAAE,EAAEhC,OAAO,CAC3BP,OAAOmC,gBAAgB,CAAC;YACtB1E,OAAO;QACT;QAEFuC,OAAOuC,UAAU,CAAC,EAAE,EAAEhC,OAAO,CAACP,OAAOS,GAAG,CAAC0B,gBAAgB,CAAC;YAAEzE,UAAUsC,OAAO+B,QAAQ;QAAG;QAExF,qCAAqC;QACrC/B,OAAOc,aAAapD,QAAQ,EAAEsE,IAAI,CAAC;QACnC,8BAA8B;QAC9BhC,OAAO9B,aAAae,cAAc,EAAEuB,oBAAoB,CAACM,cAAc,aAAa;QACpF,qCAAqC;QACrCd,OAAOwB,MAAMQ,IAAI,CAAClB;QAElB,sFAAsF;QACtF3C,kBAAkBiB,iBAAiB,CAACmC,SAAS;QAC7CrD,aAAae,cAAc,CAACsC,SAAS;QACrCa,WAAW1F,iBAAiB,CAAC;QAE7B,uDAAuD;QACvD,MAAM+F,OAAO,MAAMxE,sBAAsBqC,YAAY,CAAC,QAAQ,uBAAuB;QAErF,gCAAgC;QAChCN,OAAO7B,kBAAkBiB,iBAAiB,EAAEqB,GAAG,CAACC,gBAAgB;QAChE,4CAA4C;QAC5CV,OAAO9B,aAAae,cAAc,EAAEuB,oBAAoB,CAACM,cAAc,aAAa;QACpF,qCAAqC;QACrCd,OAAOyC,MAAMT,IAAI,CAAClB;IACpB;IAEAf,GAAG,mFAAmF;QACpF,mEAAmE;QACnE,MAAMe,eAAoB;YAAEvD,IAAI;YAAGC,OAAO;YAASG,SAAS;YAAOC,UAAU;QAAK;QAClFM,aAAaa,QAAQ,CAACrC,iBAAiB,CAACoE;QACxC1C,iBAAiB,EAAE;QAEnB,MAAMqD,OAAO,MAAMxD,sBAAsBqC,YAAY,CAAC,SAAS,OAAO;QAEtEN,OAAOyB,MAAMH,QAAQ;QACrBtB,OAAO9B,aAAae,cAAc,EAAEuB,oBAAoB,CAACM,cAAc,aAAa;QAEpF,iEAAiE;QACjEjF,KAAK6G,aAAa;QAClB,MAAMC,gBAAqB;YAAEpF,IAAI;YAAIC,OAAO;YAAQG,SAAS;YAAOC,UAAU;QAAK;QACnFM,aAAaa,QAAQ,CAACrC,iBAAiB,CAACiG;QACxCnG,gBAAgBC;QAChBU,iBAAiBV,YAAY,IAAIT,MAAM;QAEvC,MAAM4F,OAAO,MAAM3D,sBAAsBqC,YAAY,CAAC,QAAQ,OAAO;QAErEN,OAAO4B,MAAMN,QAAQ;QACrBtB,OAAO9B,aAAae,cAAc,EAAEuB,oBAAoB,CAACmC,eAAe,WAAW;IACrF;IAEA5C,GAAG,kEAAkE;QACnE,oDAAoD;QACpD7B,aAAaa,QAAQ,CAACrC,iBAAiB,CAAC;QACxC,MAAMkG,OAAO,IAAI5G,MAAM;QACvB,MAAM6G,OAAOC,OAAOC,MAAM,CAAC,IAAI/G,MAAM,yBAAyB;YAAEgH,MAAMC,MAAMC,IAAI,CAACC,gCAAkB,CAAC,CAAC,EAAE;QAAC;QACxG1G,WAAWP,IAAI,CAACa,iBAAiB,CAAC;YAAEqG,QAAQ;gBAACR;gBAAMC;aAAK;QAAC;QACzDpG,WAAWJ,MAAM,CAACK,iBAAiB,CAACC;QAEpC,4DAA4D;QAC5D,MAAMqD,OAAO/B,sBAAsBqC,YAAY,CAAC,QAAQ,QAAQM,OAAO,CAACC,OAAO,CAAC;QAEhF,iHAAiH;QACjHpE,WAAWP,IAAI,CAACmH,SAAS;QACzB5G,WAAWJ,MAAM,CAACgH,SAAS;QAC3BnF,aAAae,cAAc,CAACsC,SAAS;QACrCrD,aAAaa,QAAQ,CAACrC,iBAAiB,CAAC;QACxCD,WAAWP,IAAI,CAACa,iBAAiB,CAAC,IAAIf,MAAM;QAC5CS,WAAWJ,MAAM,CAACK,iBAAiB,CAACC;QAEpC,MAAM0D,MAAM,MAAMpC,sBAAsBqC,YAAY,CAAC,QAAQ;QAC7DN,OAAOK,KAAKiB,QAAQ;QACpBtB,OAAO9B,aAAae,cAAc,EAAEwB,GAAG,CAACC,gBAAgB;IAC1D;IAEAX,GAAG,kFAAkF;QACnF,+CAA+C;QAC/C,MAAMe,eAAoBzD,UAAU;YAAEE,IAAI;YAAIE,OAAO;QAAa;QAClES,aAAaa,QAAQ,CAACrC,iBAAiB,CAACoE;QAExC,yFAAyF;QACzFtB,gCAAa,CAACC,IAAI,CAACC,IAAI,CAACE,cAAc,GAAG;QAEzCxB,iBAAiB;YAAC;gBAAE4C,KAAK;gBAAQC,IAAI;gBAAYC,MAAM;YAAmB;SAAE;QAC5E/C,kBAAkBiB,iBAAiB,CAACrC,iBAAiB,CAAC,IAAIf,MAAM;QAEhE,6DAA6D;QAC7DH,KAAKyC,KAAK,CAAC+D,YAAiB,mBAAmB3F,iBAAiB,CAAC;QACjEb,KAAKyC,KAAK,CAAC+D,YAAiB,iBAAiBiB,eAAe,CAAC;YAAEzB,WAAW;YAAQC,UAAU;QAAM;QAElG,MAAMzB,MAAM,MAAMpC,sBAAsBqC,YAAY,CAAC,QAAQ;QAE7DN,OAAO7B,kBAAkBiB,iBAAiB,EAAEsB,gBAAgB;QAC5D,0BAA0B;QAC1BV,OAAOc,aAAajD,SAAS,EAAE6C,gBAAgB;QAC/C,6CAA6C;QAC7CV,OAAOc,aAAarD,KAAK,EAAEuE,IAAI,CAAC;QAChChC,OAAOK,KAAK2B,IAAI,CAAClB;IACnB;IAEAf,GAAG,uGAAuG;QACxG,iIAAiI;QACjI,MAAMwD,QAAa;YAAEhG,IAAI;YAAIC,OAAO;YAAQG,SAAS;YAAOC,UAAU;QAAK;QAC3EM,aAAaa,QAAQ,CAACrC,iBAAiB,CAAC6G;QACxC/D,gCAAa,CAACC,IAAI,CAACC,IAAI,CAACE,cAAc,GAAG;QACzCnD,WAAWP,IAAI,CAACQ,iBAAiB,CAACC;QAClC,4CAA4C;QAC5CF,WAAWL,MAAM,CAACM,iBAAiB,CAAC;YAAEQ,eAAe;gBAAC;oBAAE8D,KAAK;oBAAQC,IAAI;oBAAYC,MAAM;gBAAmB;aAAE;QAAC;QACjHzE,WAAWJ,MAAM,CAACK,iBAAiB,CAACC;QAEpC,MAAM8E,OAAO,MAAMxD,sBAAsBqC,YAAY,CAAC,QAAQ,OAAO;QACrEN,OAAOyB,MAAMH,QAAQ;QACrBtB,OAAO9B,aAAae,cAAc,EAAEuB,oBAAoB,CAAC+C,OAAO,WAAW;QAE3E,qHAAqH;QACrH1H,KAAK6G,aAAa;QAClB,MAAMc,QAAanG,UAAU;YAAEE,IAAI;YAAIE,OAAO;QAAa;QAC3DS,aAAaa,QAAQ,CAACrC,iBAAiB,CAAC8G;QACxChE,gCAAa,CAACC,IAAI,CAACC,IAAI,CAACE,cAAc,GAAG;QACzCxB,iBAAiB;YAAC;gBAAE4C,KAAK;gBAAQC,IAAI;gBAAYC,MAAM;YAAmB;SAAE;QAC5E/C,kBAAkBiB,iBAAiB,CAAC1C,iBAAiB,CAACC;QAEtD,qFAAqF;QACrFd,KAAKyC,KAAK,CAAC+D,YAAiB,mBAAmB3F,iBAAiB,CAAC;QACjEb,KAAKyC,KAAK,CAAC+D,YAAiB,iBAAiBiB,eAAe,CAAC;YAAEzB,WAAW;YAAQC,UAAU;QAAM;QAElG,MAAMF,OAAO,MAAM3D,sBAAsBqC,YAAY,CAAC,QAAQ,UAAU;QAExE,mCAAmC;QACnCN,OAAO7B,kBAAkBiB,iBAAiB,EAAEoB,oBAAoB,CAC9D,IACAR,OAAOmC,gBAAgB,CAAC;YAAE1E,OAAO;YAAoBoE,WAAW;YAAQC,UAAU;QAAM;QAE1F,2EAA2E;QAC3E9B,OAAOwD,MAAM9F,QAAQ,EAAEsE,IAAI,CAAC;QAC5BhC,OAAOwD,MAAM/F,KAAK,EAAEuE,IAAI,CAAC;QACzBhC,OAAOwD,OAAOlB,aAAa,CAAC;YAAET,WAAW;YAAQC,UAAU;QAAM;QACjE9B,OAAOwD,MAAM3F,SAAS,EAAE6C,gBAAgB;QACxCV,OAAO4B,MAAMI,IAAI,CAACwB;IACpB;AACF"}
+{"version":3,"sources":["../../../../../backend/src/authentication/services/auth-methods/auth-method-ldap.service.spec.ts"],"sourcesContent":["/*\n * Copyright (C) 2012-2025 Johan Legrand <johan.legrand@sync-in.com>\n * This file is part of Sync-in | The open source file sync and share solution\n * See the LICENSE file for licensing details\n */\n\nimport { Test, TestingModule } from '@nestjs/testing'\nimport { Mocked } from 'jest-mock'\nimport { Client, InvalidCredentialsError } from 'ldapts'\nimport { CONNECT_ERROR_CODE } from '../../../app.constants'\nimport { UserModel } from '../../../applications/users/models/user.model'\nimport { AdminUsersManager } from '../../../applications/users/services/admin-users-manager.service'\nimport { UsersManager } from '../../../applications/users/services/users-manager.service'\nimport * as commonFunctions from '../../../common/functions'\nimport { configuration } from '../../../configuration/config.environment'\nimport { AuthMethodLdapService } from './auth-method-ldap.service'\n\n// Mock ldapts Client to simulate LDAP behaviors\njest.mock('ldapts', () => {\n  class InvalidCredentialsError extends Error {}\n  const mockClientInstance = {\n    bind: jest.fn(),\n    search: jest.fn(),\n    unbind: jest.fn()\n  }\n  const Client = jest.fn().mockImplementation(() => mockClientInstance)\n  return { Client, InvalidCredentialsError }\n})\n\n// --- Test helpers (DRY) ---\n// Reusable LDAP mocks\nconst mockBindResolve = (ldapClient: any) => {\n  ldapClient.bind.mockResolvedValue(undefined)\n  ldapClient.unbind.mockResolvedValue(undefined)\n}\nconst mockBindRejectInvalid = (ldapClient: any, InvalidCredentialsErrorCtor: any, message = 'invalid') => {\n  ldapClient.bind.mockRejectedValue(new InvalidCredentialsErrorCtor(message))\n  ldapClient.unbind.mockResolvedValue(undefined)\n}\nconst mockSearchEntries = (ldapClient: any, entries: any[]) => {\n  ldapClient.search.mockResolvedValue({ searchEntries: entries })\n}\nconst mockSearchReject = (ldapClient: any, err: Error) => {\n  ldapClient.search.mockRejectedValue(err)\n}\n// User factory\nconst buildUser = (overrides: Partial<UserModel> = {}) =>\n  ({\n    id: 0,\n    login: 'john',\n    email: 'old@example.org',\n    password: 'hashed',\n    isGuest: false,\n    isActive: true,\n    makePaths: jest.fn().mockResolvedValue(undefined),\n    ...overrides\n  }) as any\n\n// --------------------------\n\ndescribe(AuthMethodLdapService.name, () => {\n  let authMethodLdapService: AuthMethodLdapService\n  let usersManager: Mocked<UsersManager>\n  let adminUsersManager: Mocked<AdminUsersManager>\n  const ldapClient = {\n    bind: jest.fn(),\n    search: jest.fn(),\n    unbind: jest.fn()\n  }\n  ;(Client as Mocked<any>).mockImplementation(() => ldapClient)\n\n  // Local helpers (need access to authMethodLdapService and ldapClient in this scope)\n  const setupLdapSuccess = (entries: any[]) => {\n    mockBindResolve(ldapClient)\n    mockSearchEntries(ldapClient, entries)\n  }\n  const spyLoggerError = () => jest.spyOn(authMethodLdapService['logger'], 'error').mockImplementation(() => undefined as any)\n\n  beforeAll(async () => {\n    const module: TestingModule = await Test.createTestingModule({\n      providers: [\n        AuthMethodLdapService,\n        {\n          provide: UsersManager,\n          useValue: {\n            findUser: jest.fn(),\n            logUser: jest.fn(),\n            updateAccesses: jest.fn().mockResolvedValue(undefined)\n          }\n        },\n        {\n          provide: AdminUsersManager,\n          useValue: {\n            createUserOrGuest: jest.fn(),\n            updateUserOrGuest: jest.fn()\n          }\n        }\n      ]\n    }).compile()\n\n    module.useLogger(['fatal'])\n    authMethodLdapService = module.get<AuthMethodLdapService>(AuthMethodLdapService)\n    adminUsersManager = module.get<Mocked<AdminUsersManager>>(AdminUsersManager)\n    usersManager = module.get<Mocked<UsersManager>>(UsersManager)\n    configuration.auth.ldap = {\n      servers: ['ldap://localhost:389'],\n      attributes: { login: 'uid', email: 'mail' },\n      baseDN: 'ou=people,dc=example,dc=org',\n      filter: ''\n    }\n  })\n\n  it('should be defined', () => {\n    expect(authMethodLdapService).toBeDefined()\n    expect(usersManager).toBeDefined()\n    expect(adminUsersManager).toBeDefined()\n    expect(ldapClient).toBeDefined()\n  })\n\n  it('should authenticate a guest user via database and bypass LDAP', async () => {\n    // Arrange\n    const guestUser: any = { id: 1, login: 'guest1', isGuest: true, isActive: true }\n    usersManager.findUser.mockResolvedValue(guestUser)\n    const dbAuthResult: any = { ...guestUser, token: 'jwt' }\n    usersManager.logUser.mockResolvedValue(dbAuthResult)\n\n    const res = await authMethodLdapService.validateUser('guest1', 'pass', '127.0.0.1')\n\n    expect(res).toEqual(dbAuthResult)\n    expect(usersManager.logUser).toHaveBeenCalledWith(guestUser, 'pass', '127.0.0.1')\n    expect(Client).not.toHaveBeenCalled() // client should not be constructed\n  })\n\n  it('should throw FORBIDDEN for locked account and LDAP login mismatch', async () => {\n    // Phase 1: locked account\n    usersManager.findUser.mockResolvedValue({ login: 'john', isGuest: false, isActive: false } as UserModel)\n    const loggerErrorSpy1 = jest.spyOn(authMethodLdapService['logger'], 'error').mockImplementation(() => undefined as any)\n\n    await expect(authMethodLdapService.validateUser('john', 'pwd')).rejects.toThrow(/account locked/i)\n    expect(loggerErrorSpy1).toHaveBeenCalled()\n\n    // Phase 2: mismatch between requested login and LDAP returned login\n    const existingUser: any = buildUser({ id: 8 })\n    usersManager.findUser.mockResolvedValue(existingUser)\n    mockBindResolve(ldapClient)\n    mockSearchEntries(ldapClient, [{ uid: 'jane', cn: 'john', mail: 'jane@example.org' }])\n\n    await expect(authMethodLdapService.validateUser('john', 'pwd')).resolves.toEqual(null)\n  })\n\n  it('should handle invalid LDAP credentials for both existing and unknown users', async () => {\n    // Phase 1: existing user -> updateAccesses invoked with success=false and logger.error intercepted\n    const existingUser: any = buildUser({ id: 1 })\n    usersManager.findUser.mockResolvedValue(existingUser)\n    // Make LDAP bind throw InvalidCredentialsError\n    mockBindRejectInvalid(ldapClient, InvalidCredentialsError, 'invalid credentials')\n    // Force updateAccesses to reject to hit the catch and logger.error\n    const loggerErrorSpy = jest.spyOn(authMethodLdapService['logger'], 'error').mockImplementation(() => undefined as any)\n    usersManager.updateAccesses.mockRejectedValueOnce(new Error('updateAccesses boom'))\n\n    const res1 = await authMethodLdapService.validateUser('john', 'badpwd', '10.0.0.1')\n\n    expect(res1).toBeNull()\n    expect(usersManager.updateAccesses).toHaveBeenCalledWith(existingUser, '10.0.0.1', false)\n    expect(loggerErrorSpy).toHaveBeenCalled()\n\n    // Phase 2: unknown user → no access update\n    usersManager.updateAccesses.mockClear()\n    usersManager.findUser.mockResolvedValue(null)\n    ldapClient.bind.mockRejectedValue(new InvalidCredentialsError('invalid'))\n    ldapClient.unbind.mockResolvedValue(undefined)\n\n    const res2 = await authMethodLdapService.validateUser('jane', 'badpwd')\n\n    expect(res2).toBeNull()\n    expect(usersManager.updateAccesses).not.toHaveBeenCalled()\n  })\n\n  it('should handle LDAP new-user flow: missing fields, creation success, and multi-email selection', async () => {\n    // Phase 1: incomplete LDAP entry -> null + error log, no creation\n    usersManager.findUser.mockResolvedValue(null)\n    mockBindResolve(ldapClient)\n    // Simulate an entry with missing mail\n    mockSearchEntries(ldapClient, [{ uid: 'jane', cn: 'Jane Doe', mail: undefined }])\n    const loggerErrorSpy = jest.spyOn(authMethodLdapService['logger'], 'error').mockImplementation(() => undefined as any)\n\n    const resA = await authMethodLdapService.validateUser('jane', 'pwd')\n\n    expect(resA).toBeNull()\n    expect(adminUsersManager.createUserOrGuest).not.toHaveBeenCalled()\n    expect(loggerErrorSpy).toHaveBeenCalled()\n\n    // Phase 2: create a new user (success, single email)\n    usersManager.findUser.mockResolvedValue(null)\n    setupLdapSuccess([{ uid: 'john', cn: 'John Doe', mail: 'john@example.org' }])\n\n    const createdUser: any = { id: 2, login: 'john', isGuest: false, isActive: true, makePaths: jest.fn() }\n    adminUsersManager.createUserOrGuest.mockResolvedValue(createdUser)\n    // Cover the success-flow catch branch\n    const loggerErrorSpy2 = spyLoggerError()\n    usersManager.updateAccesses.mockRejectedValueOnce(new Error('updateAccesses success flow boom'))\n\n    const resB = await authMethodLdapService.validateUser('john', 'pwd', '192.168.1.10')\n\n    expect(adminUsersManager.createUserOrGuest).toHaveBeenCalledWith(\n      { login: 'john', email: 'john@example.org', password: 'pwd', firstName: 'John', lastName: 'Doe' },\n      expect.anything() // USER_ROLE.USER\n    )\n    expect(resB).toBe(createdUser)\n    expect(usersManager.updateAccesses).toHaveBeenCalledWith(createdUser, '192.168.1.10', true)\n    expect(loggerErrorSpy2).toHaveBeenCalled()\n\n    // Phase 3: multiple emails -> keep the first\n    usersManager.findUser.mockResolvedValue(null)\n    setupLdapSuccess([{ uid: 'multi', cn: 'Multi Mail', mail: ['first@example.org', 'second@example.org'] }])\n\n    const createdUser2: any = { id: 9, login: 'multi', makePaths: jest.fn() }\n    adminUsersManager.createUserOrGuest.mockResolvedValue(createdUser2)\n\n    const resC = await authMethodLdapService.validateUser('multi', 'pwd')\n\n    expect(adminUsersManager.createUserOrGuest).toHaveBeenCalledWith(expect.objectContaining({ email: 'first@example.org' }), expect.anything())\n    expect(resC).toBe(createdUser2)\n  })\n\n  it('should update existing user profile when LDAP identity changed (except password assigned back)', async () => {\n    // Arrange: existing user with different profile and an old password\n    const existingUser: any = buildUser({ id: 5 })\n    usersManager.findUser.mockResolvedValue(existingUser)\n\n    // LDAP succeeds and returns different email and same uid\n    setupLdapSuccess([{ uid: 'john', cn: 'John Doe', mail: 'john@example.org' }])\n\n    // Admin manager successfully updates a user\n    adminUsersManager.updateUserOrGuest.mockResolvedValue(undefined)\n\n    // Ensure password is considered changed so the update payload includes it,\n    // which then triggers the deletion and local assignment branches after update\n    const compareSpy = jest.spyOn(commonFunctions, 'comparePassword').mockResolvedValue(false)\n\n    const res = await authMethodLdapService.validateUser('john', 'new-plain-password', '127.0.0.2')\n\n    expect(adminUsersManager.updateUserOrGuest).toHaveBeenCalledWith(\n      5,\n      expect.objectContaining({\n        email: 'john@example.org',\n        firstName: 'John',\n        lastName: 'Doe'\n      })\n    )\n    // Password should not be assigned back onto the user object (it is deleted before Object.assign)\n    expect(existingUser.password).toBe('hashed')\n    // Other fields should be updated locally\n    expect(existingUser.email).toBe('john@example.org')\n    expect(existingUser).toMatchObject({ firstName: 'John', lastName: 'Doe' })\n    // Accesses updated as success\n    expect(usersManager.updateAccesses).toHaveBeenCalledWith(existingUser, '127.0.0.2', true)\n    // Returned user is the same instance\n    expect(res).toBe(existingUser)\n\n    // Second run: password unchanged (comparePassword => true) to cover the null branch for password\n    adminUsersManager.updateUserOrGuest.mockClear()\n    usersManager.updateAccesses.mockClear()\n    // Force another non-password change so an update occurs\n    existingUser.email = 'old@example.org'\n    compareSpy.mockResolvedValue(true)\n\n    const res2 = await authMethodLdapService.validateUser('john', 'same-plain-password', '127.0.0.3')\n\n    // Update should be called without password, only with changed fields\n    expect(adminUsersManager.updateUserOrGuest).toHaveBeenCalled()\n    const updateArgs = adminUsersManager.updateUserOrGuest.mock.calls[0]\n    expect(updateArgs[0]).toBe(5)\n    expect(updateArgs[1]).toEqual(\n      expect.objectContaining({\n        email: 'john@example.org'\n      })\n    )\n    expect(updateArgs[1]).toEqual(expect.not.objectContaining({ password: expect.anything() }))\n\n    // Password remains unchanged locally\n    expect(existingUser.password).toBe('hashed')\n    // Accesses updated as success\n    expect(usersManager.updateAccesses).toHaveBeenCalledWith(existingUser, '127.0.0.3', true)\n    // Returned user is the same instance\n    expect(res2).toBe(existingUser)\n\n    // Third run: no changes at all (identityHasChanged is empty) to cover the else branch\n    adminUsersManager.updateUserOrGuest.mockClear()\n    usersManager.updateAccesses.mockClear()\n    compareSpy.mockResolvedValue(true)\n\n    // Local user already matches LDAP identity; call again\n    const res3 = await authMethodLdapService.validateUser('john', 'same-plain-password', '127.0.0.4')\n\n    // No update should be triggered\n    expect(adminUsersManager.updateUserOrGuest).not.toHaveBeenCalled()\n    // Access should still be updated as success\n    expect(usersManager.updateAccesses).toHaveBeenCalledWith(existingUser, '127.0.0.4', true)\n    // Returned user is the same instance\n    expect(res3).toBe(existingUser)\n  })\n\n  it('should log failed access when LDAP search returns no entry or throws after bind', async () => {\n    // Phase 1: no entry found after a successful bind -> failed access\n    const existingUser: any = { id: 7, login: 'ghost', isGuest: false, isActive: true }\n    usersManager.findUser.mockResolvedValue(existingUser)\n    setupLdapSuccess([])\n\n    const resA = await authMethodLdapService.validateUser('ghost', 'pwd', '10.10.0.1')\n\n    expect(resA).toBeNull()\n    expect(usersManager.updateAccesses).toHaveBeenCalledWith(existingUser, '10.10.0.1', false)\n\n    // Phase 2: exception during search after a bind -> failed access\n    jest.clearAllMocks()\n    const existingUser2: any = { id: 10, login: 'john', isGuest: false, isActive: true }\n    usersManager.findUser.mockResolvedValue(existingUser2)\n    mockBindResolve(ldapClient)\n    mockSearchReject(ldapClient, new Error('search failed'))\n\n    const resB = await authMethodLdapService.validateUser('john', 'pwd', '1.1.1.1')\n\n    expect(resB).toBeNull()\n    expect(usersManager.updateAccesses).toHaveBeenCalledWith(existingUser2, '1.1.1.1', false)\n  })\n\n  it('should throw 500 when LDAP connection error occurs during bind', async () => {\n    // Arrange: no existing user to reach checkAuth flow\n    usersManager.findUser.mockResolvedValue(null)\n    const err1 = new Error('socket hang up')\n    const err2 = Object.assign(new Error('connect ECONNREFUSED'), { code: Array.from(CONNECT_ERROR_CODE)[0] })\n    ldapClient.bind.mockRejectedValue({ errors: [err1, err2] })\n    ldapClient.unbind.mockResolvedValue(undefined)\n\n    // First scenario: recognized connection error -> throws 500\n    await expect(authMethodLdapService.validateUser('john', 'pwd')).rejects.toThrow(/authentication service/i)\n\n    // Second scenario: generic error (no code, not InvalidCredentialsError) -> resolves to null and no access update\n    ldapClient.bind.mockReset()\n    ldapClient.unbind.mockReset()\n    usersManager.updateAccesses.mockClear()\n    usersManager.findUser.mockResolvedValue(null as any)\n    ldapClient.bind.mockRejectedValue(new Error('unexpected failure'))\n    ldapClient.unbind.mockResolvedValue(undefined)\n\n    const res = await authMethodLdapService.validateUser('john', 'pwd')\n    expect(res).toBeNull()\n    expect(usersManager.updateAccesses).not.toHaveBeenCalled()\n  })\n\n  it('should log update failure and still call makePaths when updating existing user', async () => {\n    // Arrange: existing user with changed identity\n    const existingUser: any = buildUser({ id: 11, email: 'old@ex.org' })\n    usersManager.findUser.mockResolvedValue(existingUser)\n\n    // Ensure LDAP loginAttribute matches uid for this test (a previous test sets it to 'cn')\n    configuration.auth.ldap.attributes.login = 'uid'\n\n    setupLdapSuccess([{ uid: 'john', cn: 'John Doe', mail: 'john@example.org' }])\n    adminUsersManager.updateUserOrGuest.mockRejectedValue(new Error('db error'))\n\n    // Force identity to be considered changed only for this test\n    jest.spyOn(commonFunctions, 'comparePassword').mockResolvedValue(false)\n    jest.spyOn(commonFunctions, 'splitFullName').mockReturnValue({ firstName: 'John', lastName: 'Doe' })\n\n    const res = await authMethodLdapService.validateUser('john', 'pwd')\n\n    expect(adminUsersManager.updateUserOrGuest).toHaveBeenCalled()\n    // makePaths still invoked\n    expect(existingUser.makePaths).toHaveBeenCalled()\n    // Local fields unchanged since update failed\n    expect(existingUser.email).toBe('old@ex.org')\n    expect(res).toBe(existingUser)\n  })\n\n  it('should skip non-matching LDAP entries then update user with changed password without reassigning it', async () => {\n    // Phase A: LDAP returns an entry but loginAttribute value does not match -> checkAccess returns false (covers return after loop)\n    const userA: any = { id: 20, login: 'john', isGuest: false, isActive: true }\n    usersManager.findUser.mockResolvedValue(userA)\n    configuration.auth.ldap.attributes.login = 'uid'\n    ldapClient.bind.mockResolvedValue(undefined)\n    // Non-matching entry: uid !== requested uid\n    ldapClient.search.mockResolvedValue({ searchEntries: [{ uid: 'jane', cn: 'Jane Doe', mail: 'jane@example.org' }] })\n    ldapClient.unbind.mockResolvedValue(undefined)\n\n    const resA = await authMethodLdapService.validateUser('john', 'pwd', '3.3.3.3')\n    expect(resA).toBeNull()\n    expect(usersManager.updateAccesses).toHaveBeenCalledWith(userA, '3.3.3.3', false)\n\n    // Phase B: Matching entry + password considered changed -> updateUserOrGuest called, password not reassigned locally\n    jest.clearAllMocks()\n    const userB: any = buildUser({ id: 21, email: 'old@ex.org' })\n    usersManager.findUser.mockResolvedValue(userB)\n    configuration.auth.ldap.attributes.login = 'uid'\n    setupLdapSuccess([{ uid: 'john', cn: 'John Doe', mail: 'john@example.org' }])\n    adminUsersManager.updateUserOrGuest.mockResolvedValue(undefined)\n\n    // Force password to be considered changed to execute deletion + Object.assign branch\n    jest.spyOn(commonFunctions, 'comparePassword').mockResolvedValue(false)\n    jest.spyOn(commonFunctions, 'splitFullName').mockReturnValue({ firstName: 'John', lastName: 'Doe' })\n\n    const resB = await authMethodLdapService.validateUser('john', 'newpwd', '4.4.4.4')\n\n    // Line 132: updateUserOrGuest call\n    expect(adminUsersManager.updateUserOrGuest).toHaveBeenCalledWith(\n      21,\n      expect.objectContaining({ email: 'john@example.org', firstName: 'John', lastName: 'Doe' })\n    )\n    // Lines 139-142: password removed from local assign, other fields assigned\n    expect(userB.password).toBe('hashed')\n    expect(userB.email).toBe('john@example.org')\n    expect(userB).toMatchObject({ firstName: 'John', lastName: 'Doe' })\n    expect(userB.makePaths).toHaveBeenCalled()\n    expect(resB).toBe(userB)\n  })\n})\n"],"names":["jest","mock","InvalidCredentialsError","Error","mockClientInstance","bind","fn","search","unbind","Client","mockImplementation","mockBindResolve","ldapClient","mockResolvedValue","undefined","mockBindRejectInvalid","InvalidCredentialsErrorCtor","message","mockRejectedValue","mockSearchEntries","entries","searchEntries","mockSearchReject","err","buildUser","overrides","id","login","email","password","isGuest","isActive","makePaths","describe","AuthMethodLdapService","name","authMethodLdapService","usersManager","adminUsersManager","setupLdapSuccess","spyLoggerError","spyOn","beforeAll","module","Test","createTestingModule","providers","provide","UsersManager","useValue","findUser","logUser","updateAccesses","AdminUsersManager","createUserOrGuest","updateUserOrGuest","compile","useLogger","get","configuration","auth","ldap","servers","attributes","baseDN","filter","it","expect","toBeDefined","guestUser","dbAuthResult","token","res","validateUser","toEqual","toHaveBeenCalledWith","not","toHaveBeenCalled","loggerErrorSpy1","rejects","toThrow","existingUser","uid","cn","mail","resolves","loggerErrorSpy","mockRejectedValueOnce","res1","toBeNull","mockClear","res2","resA","createdUser","loggerErrorSpy2","resB","firstName","lastName","anything","toBe","createdUser2","resC","objectContaining","compareSpy","commonFunctions","toMatchObject","updateArgs","calls","res3","clearAllMocks","existingUser2","err1","err2","Object","assign","code","Array","from","CONNECT_ERROR_CODE","errors","mockReset","mockReturnValue","userA","userB"],"mappings":"AAAA;;;;CAIC;;;;yBAEmC;wBAEY;8BACb;0CAED;qCACL;mEACI;mCACH;uCACQ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAEtC,gDAAgD;AAChDA,KAAKC,IAAI,CAAC,UAAU;IAClB,IAAA,AAAMC,0BAAN,MAAMA,gCAAgCC;IAAO;IAC7C,MAAMC,qBAAqB;QACzBC,MAAML,KAAKM,EAAE;QACbC,QAAQP,KAAKM,EAAE;QACfE,QAAQR,KAAKM,EAAE;IACjB;IACA,MAAMG,SAAST,KAAKM,EAAE,GAAGI,kBAAkB,CAAC,IAAMN;IAClD,OAAO;QAAEK;QAAQP;IAAwB;AAC3C;AAEA,6BAA6B;AAC7B,sBAAsB;AACtB,MAAMS,kBAAkB,CAACC;IACvBA,WAAWP,IAAI,CAACQ,iBAAiB,CAACC;IAClCF,WAAWJ,MAAM,CAACK,iBAAiB,CAACC;AACtC;AACA,MAAMC,wBAAwB,CAACH,YAAiBI,6BAAkCC,UAAU,SAAS;IACnGL,WAAWP,IAAI,CAACa,iBAAiB,CAAC,IAAIF,4BAA4BC;IAClEL,WAAWJ,MAAM,CAACK,iBAAiB,CAACC;AACtC;AACA,MAAMK,oBAAoB,CAACP,YAAiBQ;IAC1CR,WAAWL,MAAM,CAACM,iBAAiB,CAAC;QAAEQ,eAAeD;IAAQ;AAC/D;AACA,MAAME,mBAAmB,CAACV,YAAiBW;IACzCX,WAAWL,MAAM,CAACW,iBAAiB,CAACK;AACtC;AACA,eAAe;AACf,MAAMC,YAAY,CAACC,YAAgC,CAAC,CAAC,GAClD,CAAA;QACCC,IAAI;QACJC,OAAO;QACPC,OAAO;QACPC,UAAU;QACVC,SAAS;QACTC,UAAU;QACVC,WAAWhC,KAAKM,EAAE,GAAGO,iBAAiB,CAACC;QACvC,GAAGW,SAAS;IACd,CAAA;AAEF,6BAA6B;AAE7BQ,SAASC,4CAAqB,CAACC,IAAI,EAAE;IACnC,IAAIC;IACJ,IAAIC;IACJ,IAAIC;IACJ,MAAM1B,aAAa;QACjBP,MAAML,KAAKM,EAAE;QACbC,QAAQP,KAAKM,EAAE;QACfE,QAAQR,KAAKM,EAAE;IACjB;IACEG,cAAM,CAAiBC,kBAAkB,CAAC,IAAME;IAElD,oFAAoF;IACpF,MAAM2B,mBAAmB,CAACnB;QACxBT,gBAAgBC;QAChBO,kBAAkBP,YAAYQ;IAChC;IACA,MAAMoB,iBAAiB,IAAMxC,KAAKyC,KAAK,CAACL,qBAAqB,CAAC,SAAS,EAAE,SAAS1B,kBAAkB,CAAC,IAAMI;IAE3G4B,UAAU;QACR,MAAMC,SAAwB,MAAMC,aAAI,CAACC,mBAAmB,CAAC;YAC3DC,WAAW;gBACTZ,4CAAqB;gBACrB;oBACEa,SAASC,iCAAY;oBACrBC,UAAU;wBACRC,UAAUlD,KAAKM,EAAE;wBACjB6C,SAASnD,KAAKM,EAAE;wBAChB8C,gBAAgBpD,KAAKM,EAAE,GAAGO,iBAAiB,CAACC;oBAC9C;gBACF;gBACA;oBACEiC,SAASM,2CAAiB;oBAC1BJ,UAAU;wBACRK,mBAAmBtD,KAAKM,EAAE;wBAC1BiD,mBAAmBvD,KAAKM,EAAE;oBAC5B;gBACF;aACD;QACH,GAAGkD,OAAO;QAEVb,OAAOc,SAAS,CAAC;YAAC;SAAQ;QAC1BrB,wBAAwBO,OAAOe,GAAG,CAAwBxB,4CAAqB;QAC/EI,oBAAoBK,OAAOe,GAAG,CAA4BL,2CAAiB;QAC3EhB,eAAeM,OAAOe,GAAG,CAAuBV,iCAAY;QAC5DW,gCAAa,CAACC,IAAI,CAACC,IAAI,GAAG;YACxBC,SAAS;gBAAC;aAAuB;YACjCC,YAAY;gBAAEpC,OAAO;gBAAOC,OAAO;YAAO;YAC1CoC,QAAQ;YACRC,QAAQ;QACV;IACF;IAEAC,GAAG,qBAAqB;QACtBC,OAAO/B,uBAAuBgC,WAAW;QACzCD,OAAO9B,cAAc+B,WAAW;QAChCD,OAAO7B,mBAAmB8B,WAAW;QACrCD,OAAOvD,YAAYwD,WAAW;IAChC;IAEAF,GAAG,iEAAiE;QAClE,UAAU;QACV,MAAMG,YAAiB;YAAE3C,IAAI;YAAGC,OAAO;YAAUG,SAAS;YAAMC,UAAU;QAAK;QAC/EM,aAAaa,QAAQ,CAACrC,iBAAiB,CAACwD;QACxC,MAAMC,eAAoB;YAAE,GAAGD,SAAS;YAAEE,OAAO;QAAM;QACvDlC,aAAac,OAAO,CAACtC,iBAAiB,CAACyD;QAEvC,MAAME,MAAM,MAAMpC,sBAAsBqC,YAAY,CAAC,UAAU,QAAQ;QAEvEN,OAAOK,KAAKE,OAAO,CAACJ;QACpBH,OAAO9B,aAAac,OAAO,EAAEwB,oBAAoB,CAACN,WAAW,QAAQ;QACrEF,OAAO1D,cAAM,EAAEmE,GAAG,CAACC,gBAAgB,IAAG,mCAAmC;IAC3E;IAEAX,GAAG,qEAAqE;QACtE,0BAA0B;QAC1B7B,aAAaa,QAAQ,CAACrC,iBAAiB,CAAC;YAAEc,OAAO;YAAQG,SAAS;YAAOC,UAAU;QAAM;QACzF,MAAM+C,kBAAkB9E,KAAKyC,KAAK,CAACL,qBAAqB,CAAC,SAAS,EAAE,SAAS1B,kBAAkB,CAAC,IAAMI;QAEtG,MAAMqD,OAAO/B,sBAAsBqC,YAAY,CAAC,QAAQ,QAAQM,OAAO,CAACC,OAAO,CAAC;QAChFb,OAAOW,iBAAiBD,gBAAgB;QAExC,oEAAoE;QACpE,MAAMI,eAAoBzD,UAAU;YAAEE,IAAI;QAAE;QAC5CW,aAAaa,QAAQ,CAACrC,iBAAiB,CAACoE;QACxCtE,gBAAgBC;QAChBO,kBAAkBP,YAAY;YAAC;gBAAEsE,KAAK;gBAAQC,IAAI;gBAAQC,MAAM;YAAmB;SAAE;QAErF,MAAMjB,OAAO/B,sBAAsBqC,YAAY,CAAC,QAAQ,QAAQY,QAAQ,CAACX,OAAO,CAAC;IACnF;IAEAR,GAAG,8EAA8E;QAC/E,mGAAmG;QACnG,MAAMe,eAAoBzD,UAAU;YAAEE,IAAI;QAAE;QAC5CW,aAAaa,QAAQ,CAACrC,iBAAiB,CAACoE;QACxC,+CAA+C;QAC/ClE,sBAAsBH,YAAYV,+BAAuB,EAAE;QAC3D,mEAAmE;QACnE,MAAMoF,iBAAiBtF,KAAKyC,KAAK,CAACL,qBAAqB,CAAC,SAAS,EAAE,SAAS1B,kBAAkB,CAAC,IAAMI;QACrGuB,aAAae,cAAc,CAACmC,qBAAqB,CAAC,IAAIpF,MAAM;QAE5D,MAAMqF,OAAO,MAAMpD,sBAAsBqC,YAAY,CAAC,QAAQ,UAAU;QAExEN,OAAOqB,MAAMC,QAAQ;QACrBtB,OAAO9B,aAAae,cAAc,EAAEuB,oBAAoB,CAACM,cAAc,YAAY;QACnFd,OAAOmB,gBAAgBT,gBAAgB;QAEvC,2CAA2C;QAC3CxC,aAAae,cAAc,CAACsC,SAAS;QACrCrD,aAAaa,QAAQ,CAACrC,iBAAiB,CAAC;QACxCD,WAAWP,IAAI,CAACa,iBAAiB,CAAC,IAAIhB,+BAAuB,CAAC;QAC9DU,WAAWJ,MAAM,CAACK,iBAAiB,CAACC;QAEpC,MAAM6E,OAAO,MAAMvD,sBAAsBqC,YAAY,CAAC,QAAQ;QAE9DN,OAAOwB,MAAMF,QAAQ;QACrBtB,OAAO9B,aAAae,cAAc,EAAEwB,GAAG,CAACC,gBAAgB;IAC1D;IAEAX,GAAG,iGAAiG;QAClG,kEAAkE;QAClE7B,aAAaa,QAAQ,CAACrC,iBAAiB,CAAC;QACxCF,gBAAgBC;QAChB,sCAAsC;QACtCO,kBAAkBP,YAAY;YAAC;gBAAEsE,KAAK;gBAAQC,IAAI;gBAAYC,MAAMtE;YAAU;SAAE;QAChF,MAAMwE,iBAAiBtF,KAAKyC,KAAK,CAACL,qBAAqB,CAAC,SAAS,EAAE,SAAS1B,kBAAkB,CAAC,IAAMI;QAErG,MAAM8E,OAAO,MAAMxD,sBAAsBqC,YAAY,CAAC,QAAQ;QAE9DN,OAAOyB,MAAMH,QAAQ;QACrBtB,OAAO7B,kBAAkBgB,iBAAiB,EAAEsB,GAAG,CAACC,gBAAgB;QAChEV,OAAOmB,gBAAgBT,gBAAgB;QAEvC,qDAAqD;QACrDxC,aAAaa,QAAQ,CAACrC,iBAAiB,CAAC;QACxC0B,iBAAiB;YAAC;gBAAE2C,KAAK;gBAAQC,IAAI;gBAAYC,MAAM;YAAmB;SAAE;QAE5E,MAAMS,cAAmB;YAAEnE,IAAI;YAAGC,OAAO;YAAQG,SAAS;YAAOC,UAAU;YAAMC,WAAWhC,KAAKM,EAAE;QAAG;QACtGgC,kBAAkBgB,iBAAiB,CAACzC,iBAAiB,CAACgF;QACtD,sCAAsC;QACtC,MAAMC,kBAAkBtD;QACxBH,aAAae,cAAc,CAACmC,qBAAqB,CAAC,IAAIpF,MAAM;QAE5D,MAAM4F,OAAO,MAAM3D,sBAAsBqC,YAAY,CAAC,QAAQ,OAAO;QAErEN,OAAO7B,kBAAkBgB,iBAAiB,EAAEqB,oBAAoB,CAC9D;YAAEhD,OAAO;YAAQC,OAAO;YAAoBC,UAAU;YAAOmE,WAAW;YAAQC,UAAU;QAAM,GAChG9B,OAAO+B,QAAQ,GAAG,iBAAiB;;QAErC/B,OAAO4B,MAAMI,IAAI,CAACN;QAClB1B,OAAO9B,aAAae,cAAc,EAAEuB,oBAAoB,CAACkB,aAAa,gBAAgB;QACtF1B,OAAO2B,iBAAiBjB,gBAAgB;QAExC,6CAA6C;QAC7CxC,aAAaa,QAAQ,CAACrC,iBAAiB,CAAC;QACxC0B,iBAAiB;YAAC;gBAAE2C,KAAK;gBAASC,IAAI;gBAAcC,MAAM;oBAAC;oBAAqB;iBAAqB;YAAC;SAAE;QAExG,MAAMgB,eAAoB;YAAE1E,IAAI;YAAGC,OAAO;YAASK,WAAWhC,KAAKM,EAAE;QAAG;QACxEgC,kBAAkBgB,iBAAiB,CAACzC,iBAAiB,CAACuF;QAEtD,MAAMC,OAAO,MAAMjE,sBAAsBqC,YAAY,CAAC,SAAS;QAE/DN,OAAO7B,kBAAkBgB,iBAAiB,EAAEqB,oBAAoB,CAACR,OAAOmC,gBAAgB,CAAC;YAAE1E,OAAO;QAAoB,IAAIuC,OAAO+B,QAAQ;QACzI/B,OAAOkC,MAAMF,IAAI,CAACC;IACpB;IAEAlC,GAAG,kGAAkG;QACnG,oEAAoE;QACpE,MAAMe,eAAoBzD,UAAU;YAAEE,IAAI;QAAE;QAC5CW,aAAaa,QAAQ,CAACrC,iBAAiB,CAACoE;QAExC,yDAAyD;QACzD1C,iBAAiB;YAAC;gBAAE2C,KAAK;gBAAQC,IAAI;gBAAYC,MAAM;YAAmB;SAAE;QAE5E,4CAA4C;QAC5C9C,kBAAkBiB,iBAAiB,CAAC1C,iBAAiB,CAACC;QAEtD,2EAA2E;QAC3E,8EAA8E;QAC9E,MAAMyF,aAAavG,KAAKyC,KAAK,CAAC+D,YAAiB,mBAAmB3F,iBAAiB,CAAC;QAEpF,MAAM2D,MAAM,MAAMpC,sBAAsBqC,YAAY,CAAC,QAAQ,sBAAsB;QAEnFN,OAAO7B,kBAAkBiB,iBAAiB,EAAEoB,oBAAoB,CAC9D,GACAR,OAAOmC,gBAAgB,CAAC;YACtB1E,OAAO;YACPoE,WAAW;YACXC,UAAU;QACZ;QAEF,iGAAiG;QACjG9B,OAAOc,aAAapD,QAAQ,EAAEsE,IAAI,CAAC;QACnC,yCAAyC;QACzChC,OAAOc,aAAarD,KAAK,EAAEuE,IAAI,CAAC;QAChChC,OAAOc,cAAcwB,aAAa,CAAC;YAAET,WAAW;YAAQC,UAAU;QAAM;QACxE,8BAA8B;QAC9B9B,OAAO9B,aAAae,cAAc,EAAEuB,oBAAoB,CAACM,cAAc,aAAa;QACpF,qCAAqC;QACrCd,OAAOK,KAAK2B,IAAI,CAAClB;QAEjB,iGAAiG;QACjG3C,kBAAkBiB,iBAAiB,CAACmC,SAAS;QAC7CrD,aAAae,cAAc,CAACsC,SAAS;QACrC,wDAAwD;QACxDT,aAAarD,KAAK,GAAG;QACrB2E,WAAW1F,iBAAiB,CAAC;QAE7B,MAAM8E,OAAO,MAAMvD,sBAAsBqC,YAAY,CAAC,QAAQ,uBAAuB;QAErF,qEAAqE;QACrEN,OAAO7B,kBAAkBiB,iBAAiB,EAAEsB,gBAAgB;QAC5D,MAAM6B,aAAapE,kBAAkBiB,iBAAiB,CAACtD,IAAI,CAAC0G,KAAK,CAAC,EAAE;QACpExC,OAAOuC,UAAU,CAAC,EAAE,EAAEP,IAAI,CAAC;QAC3BhC,OAAOuC,UAAU,CAAC,EAAE,EAAEhC,OAAO,CAC3BP,OAAOmC,gBAAgB,CAAC;YACtB1E,OAAO;QACT;QAEFuC,OAAOuC,UAAU,CAAC,EAAE,EAAEhC,OAAO,CAACP,OAAOS,GAAG,CAAC0B,gBAAgB,CAAC;YAAEzE,UAAUsC,OAAO+B,QAAQ;QAAG;QAExF,qCAAqC;QACrC/B,OAAOc,aAAapD,QAAQ,EAAEsE,IAAI,CAAC;QACnC,8BAA8B;QAC9BhC,OAAO9B,aAAae,cAAc,EAAEuB,oBAAoB,CAACM,cAAc,aAAa;QACpF,qCAAqC;QACrCd,OAAOwB,MAAMQ,IAAI,CAAClB;QAElB,sFAAsF;QACtF3C,kBAAkBiB,iBAAiB,CAACmC,SAAS;QAC7CrD,aAAae,cAAc,CAACsC,SAAS;QACrCa,WAAW1F,iBAAiB,CAAC;QAE7B,uDAAuD;QACvD,MAAM+F,OAAO,MAAMxE,sBAAsBqC,YAAY,CAAC,QAAQ,uBAAuB;QAErF,gCAAgC;QAChCN,OAAO7B,kBAAkBiB,iBAAiB,EAAEqB,GAAG,CAACC,gBAAgB;QAChE,4CAA4C;QAC5CV,OAAO9B,aAAae,cAAc,EAAEuB,oBAAoB,CAACM,cAAc,aAAa;QACpF,qCAAqC;QACrCd,OAAOyC,MAAMT,IAAI,CAAClB;IACpB;IAEAf,GAAG,mFAAmF;QACpF,mEAAmE;QACnE,MAAMe,eAAoB;YAAEvD,IAAI;YAAGC,OAAO;YAASG,SAAS;YAAOC,UAAU;QAAK;QAClFM,aAAaa,QAAQ,CAACrC,iBAAiB,CAACoE;QACxC1C,iBAAiB,EAAE;QAEnB,MAAMqD,OAAO,MAAMxD,sBAAsBqC,YAAY,CAAC,SAAS,OAAO;QAEtEN,OAAOyB,MAAMH,QAAQ;QACrBtB,OAAO9B,aAAae,cAAc,EAAEuB,oBAAoB,CAACM,cAAc,aAAa;QAEpF,iEAAiE;QACjEjF,KAAK6G,aAAa;QAClB,MAAMC,gBAAqB;YAAEpF,IAAI;YAAIC,OAAO;YAAQG,SAAS;YAAOC,UAAU;QAAK;QACnFM,aAAaa,QAAQ,CAACrC,iBAAiB,CAACiG;QACxCnG,gBAAgBC;QAChBU,iBAAiBV,YAAY,IAAIT,MAAM;QAEvC,MAAM4F,OAAO,MAAM3D,sBAAsBqC,YAAY,CAAC,QAAQ,OAAO;QAErEN,OAAO4B,MAAMN,QAAQ;QACrBtB,OAAO9B,aAAae,cAAc,EAAEuB,oBAAoB,CAACmC,eAAe,WAAW;IACrF;IAEA5C,GAAG,kEAAkE;QACnE,oDAAoD;QACpD7B,aAAaa,QAAQ,CAACrC,iBAAiB,CAAC;QACxC,MAAMkG,OAAO,IAAI5G,MAAM;QACvB,MAAM6G,OAAOC,OAAOC,MAAM,CAAC,IAAI/G,MAAM,yBAAyB;YAAEgH,MAAMC,MAAMC,IAAI,CAACC,gCAAkB,CAAC,CAAC,EAAE;QAAC;QACxG1G,WAAWP,IAAI,CAACa,iBAAiB,CAAC;YAAEqG,QAAQ;gBAACR;gBAAMC;aAAK;QAAC;QACzDpG,WAAWJ,MAAM,CAACK,iBAAiB,CAACC;QAEpC,4DAA4D;QAC5D,MAAMqD,OAAO/B,sBAAsBqC,YAAY,CAAC,QAAQ,QAAQM,OAAO,CAACC,OAAO,CAAC;QAEhF,iHAAiH;QACjHpE,WAAWP,IAAI,CAACmH,SAAS;QACzB5G,WAAWJ,MAAM,CAACgH,SAAS;QAC3BnF,aAAae,cAAc,CAACsC,SAAS;QACrCrD,aAAaa,QAAQ,CAACrC,iBAAiB,CAAC;QACxCD,WAAWP,IAAI,CAACa,iBAAiB,CAAC,IAAIf,MAAM;QAC5CS,WAAWJ,MAAM,CAACK,iBAAiB,CAACC;QAEpC,MAAM0D,MAAM,MAAMpC,sBAAsBqC,YAAY,CAAC,QAAQ;QAC7DN,OAAOK,KAAKiB,QAAQ;QACpBtB,OAAO9B,aAAae,cAAc,EAAEwB,GAAG,CAACC,gBAAgB;IAC1D;IAEAX,GAAG,kFAAkF;QACnF,+CAA+C;QAC/C,MAAMe,eAAoBzD,UAAU;YAAEE,IAAI;YAAIE,OAAO;QAAa;QAClES,aAAaa,QAAQ,CAACrC,iBAAiB,CAACoE;QAExC,yFAAyF;QACzFtB,gCAAa,CAACC,IAAI,CAACC,IAAI,CAACE,UAAU,CAACpC,KAAK,GAAG;QAE3CY,iBAAiB;YAAC;gBAAE2C,KAAK;gBAAQC,IAAI;gBAAYC,MAAM;YAAmB;SAAE;QAC5E9C,kBAAkBiB,iBAAiB,CAACrC,iBAAiB,CAAC,IAAIf,MAAM;QAEhE,6DAA6D;QAC7DH,KAAKyC,KAAK,CAAC+D,YAAiB,mBAAmB3F,iBAAiB,CAAC;QACjEb,KAAKyC,KAAK,CAAC+D,YAAiB,iBAAiBiB,eAAe,CAAC;YAAEzB,WAAW;YAAQC,UAAU;QAAM;QAElG,MAAMzB,MAAM,MAAMpC,sBAAsBqC,YAAY,CAAC,QAAQ;QAE7DN,OAAO7B,kBAAkBiB,iBAAiB,EAAEsB,gBAAgB;QAC5D,0BAA0B;QAC1BV,OAAOc,aAAajD,SAAS,EAAE6C,gBAAgB;QAC/C,6CAA6C;QAC7CV,OAAOc,aAAarD,KAAK,EAAEuE,IAAI,CAAC;QAChChC,OAAOK,KAAK2B,IAAI,CAAClB;IACnB;IAEAf,GAAG,uGAAuG;QACxG,iIAAiI;QACjI,MAAMwD,QAAa;YAAEhG,IAAI;YAAIC,OAAO;YAAQG,SAAS;YAAOC,UAAU;QAAK;QAC3EM,aAAaa,QAAQ,CAACrC,iBAAiB,CAAC6G;QACxC/D,gCAAa,CAACC,IAAI,CAACC,IAAI,CAACE,UAAU,CAACpC,KAAK,GAAG;QAC3Cf,WAAWP,IAAI,CAACQ,iBAAiB,CAACC;QAClC,4CAA4C;QAC5CF,WAAWL,MAAM,CAACM,iBAAiB,CAAC;YAAEQ,eAAe;gBAAC;oBAAE6D,KAAK;oBAAQC,IAAI;oBAAYC,MAAM;gBAAmB;aAAE;QAAC;QACjHxE,WAAWJ,MAAM,CAACK,iBAAiB,CAACC;QAEpC,MAAM8E,OAAO,MAAMxD,sBAAsBqC,YAAY,CAAC,QAAQ,OAAO;QACrEN,OAAOyB,MAAMH,QAAQ;QACrBtB,OAAO9B,aAAae,cAAc,EAAEuB,oBAAoB,CAAC+C,OAAO,WAAW;QAE3E,qHAAqH;QACrH1H,KAAK6G,aAAa;QAClB,MAAMc,QAAanG,UAAU;YAAEE,IAAI;YAAIE,OAAO;QAAa;QAC3DS,aAAaa,QAAQ,CAACrC,iBAAiB,CAAC8G;QACxChE,gCAAa,CAACC,IAAI,CAACC,IAAI,CAACE,UAAU,CAACpC,KAAK,GAAG;QAC3CY,iBAAiB;YAAC;gBAAE2C,KAAK;gBAAQC,IAAI;gBAAYC,MAAM;YAAmB;SAAE;QAC5E9C,kBAAkBiB,iBAAiB,CAAC1C,iBAAiB,CAACC;QAEtD,qFAAqF;QACrFd,KAAKyC,KAAK,CAAC+D,YAAiB,mBAAmB3F,iBAAiB,CAAC;QACjEb,KAAKyC,KAAK,CAAC+D,YAAiB,iBAAiBiB,eAAe,CAAC;YAAEzB,WAAW;YAAQC,UAAU;QAAM;QAElG,MAAMF,OAAO,MAAM3D,sBAAsBqC,YAAY,CAAC,QAAQ,UAAU;QAExE,mCAAmC;QACnCN,OAAO7B,kBAAkBiB,iBAAiB,EAAEoB,oBAAoB,CAC9D,IACAR,OAAOmC,gBAAgB,CAAC;YAAE1E,OAAO;YAAoBoE,WAAW;YAAQC,UAAU;QAAM;QAE1F,2EAA2E;QAC3E9B,OAAOwD,MAAM9F,QAAQ,EAAEsE,IAAI,CAAC;QAC5BhC,OAAOwD,MAAM/F,KAAK,EAAEuE,IAAI,CAAC;QACzBhC,OAAOwD,OAAOlB,aAAa,CAAC;YAAET,WAAW;YAAQC,UAAU;QAAM;QACjE9B,OAAOwD,MAAM3F,SAAS,EAAE6C,gBAAgB;QACxCV,OAAO4B,MAAMI,IAAI,CAACwB;IACpB;AACF"}