@taon-dev/session 21.0.216 → 21.0.240

package/lib-prod/taon-session/taon-session.state.service.js

@@ -0,0 +1,384 @@
+//#region imports
+/* */
+import { BehaviorSubject, map, of, shareReplay, switchMap, tap, } from 'rxjs';
+import { TaonBaseProvider, TaonProvider } from 'taon/lib-prod';
+import { signal } from 'tnp-core/lib-prod';
+import { TaonStateMachine } from 'tnp-core/lib-prod';
+/* */
+/* */
+import { TaonSessionState, } from './taon-session.models';
+//#endregion
+//#region @backend
+let TaonSessionStateService = class TaonSessionStateService extends TaonBaseProvider {
+    //#region fields & getters
+    /* */
+    /* */
+    /**
+     * Refreshes session/authentication information.
+     *
+     * This causes getCurrentUserId() to be called again.
+     */
+    refreshSrc = new BehaviorSubject(void 0);
+    /**
+     * Refreshes authorization context without reloading
+     * the current session/user.
+     *
+     * Useful when roles/groups/permissions change while
+     * the currently authenticated user stays the same.
+     */
+    contextRefreshSrc = new BehaviorSubject(void 0);
+    userId = signal(void 0);
+    currentSlide = signal(TaonSessionState.LOADING_INITIAL_AUTH_INFO);
+    allowedStateMap = new Map([
+        [
+            TaonSessionState.LOADING_INITIAL_AUTH_INFO,
+            [TaonSessionState.LOGIN_OR_REGISTER, TaonSessionState.LOGIN_SUCCESS],
+        ],
+        [
+            TaonSessionState.LOGIN_OR_REGISTER,
+            [
+                TaonSessionState.ENTER_PASSWORD,
+                TaonSessionState.ENTER_REGISTRATION_PASSWORDS,
+                TaonSessionState.LOADING_AUTH,
+                TaonSessionState.LOADING_CHECK_USER_EMAIL_EXISTS,
+            ],
+        ],
+        [
+            TaonSessionState.LOADING_CHECK_USER_EMAIL_EXISTS,
+            [
+                TaonSessionState.ENTER_PASSWORD,
+                TaonSessionState.ENTER_REGISTRATION_PASSWORDS,
+                TaonSessionState.LOGIN_OR_REGISTER,
+            ],
+        ],
+        [
+            TaonSessionState.ENTER_REGISTRATION_PASSWORDS,
+            [TaonSessionState.LOADING_AUTH, TaonSessionState.LOGIN_OR_REGISTER],
+        ],
+        [
+            TaonSessionState.ENTER_PASSWORD,
+            [
+                TaonSessionState.LOGIN_OR_REGISTER,
+                TaonSessionState.ENTER_PASSWORD,
+                TaonSessionState.LOADING_AUTH,
+                TaonSessionState.TWO_FA_AUTHENTICATOR,
+                TaonSessionState.TWO_FA_EMAIL,
+                TaonSessionState.TWO_FA_SMS,
+            ],
+        ],
+        [
+            TaonSessionState.LOADING_AUTH,
+            [
+                TaonSessionState.ENTER_PASSWORD,
+                TaonSessionState.LOGIN_OR_REGISTER,
+                TaonSessionState.LOGIN_SUCCESS,
+            ],
+        ],
+        [
+            TaonSessionState.LOGIN_SUCCESS,
+            [
+                TaonSessionState.LOADING_LOGOUT_INFO,
+                TaonSessionState.ENTER_PASSWORD,
+                TaonSessionState.PROFILE_INFO,
+            ],
+        ],
+        [
+            TaonSessionState.PROFILE_INFO,
+            [
+                TaonSessionState.LOGIN_SUCCESS,
+                TaonSessionState.LOADING_LOGOUT_INFO,
+                TaonSessionState.ENTER_PASSWORD,
+            ],
+        ],
+        [
+            TaonSessionState.LOADING_LOGOUT_INFO,
+            [TaonSessionState.LOGIN_OR_REGISTER, TaonSessionState.LOGIN_SUCCESS],
+        ],
+    ]);
+    state = new TaonStateMachine({
+        defaultValue: this.currentSlide(),
+        allowedStateMap: this.allowedStateMap,
+        effect: (nextState, previousState, debugMode) => {
+            this.currentSlide.set(nextState);
+        },
+    });
+    /**
+     * Current authenticated user.
+     *
+     * Shared because multiple consumers may depend on userId$,
+     * isLoggedIn$ and context$ at the same time.
+     *
+     * One refresh => one getCurrentUserId() request.
+     */
+    userId$ = this.refreshSrc.pipe(switchMap(() => {
+        //#region @backend
+        return of(1000000);
+        //#endregion
+        /* */
+        /* */
+        /* */
+        /* */
+        /* */
+        /* */
+        /* */
+    }), tap(userId => {
+        this.userId.set(userId);
+        if (userId) {
+            this.state.set(TaonSessionState.LOGIN_SUCCESS);
+        }
+        else {
+            this.state.set(TaonSessionState.LOGIN_OR_REGISTER);
+        }
+    }), shareReplay({
+        bufferSize: 1,
+        refCount: true,
+    }));
+    /**
+     * Projection of userId$.
+     *
+     * Does NOT cause another getCurrentUserId() call because
+     * userId$ is shared.
+     */
+    isLoggedIn$ = this.userId$.pipe(map(userId => !!userId));
+    /* */
+    /* */
+    /* */
+    /* */
+    /* */
+    /* */
+    /* */
+    /* */
+    /* */
+    /* */
+    /* */
+    /* */
+    /* */
+    /* */
+    /* */
+    /* */
+    /* */
+    /* */
+    /* */
+    /* */
+    /* */
+    /* */
+    /* */
+    /* */
+    /* */
+    /* */
+    /* */
+    /* */
+    /* */
+    /* */
+    //#endregion
+    executeActionForState(
+    /* */
+    /* */
+    ) {
+        /* */
+        /* */
+        /* */
+        /* */
+        /* */
+        /* */
+        /* */
+        /* */
+        /* */
+        /* */
+        /* */
+        /* */
+        /* */
+        /* */
+        /* */
+        /* */
+        /* */
+        /* */
+        /* */
+        /* */
+        /* */
+        /* */
+        /* */
+        /* */
+        /* */
+        /* */
+        /* */
+        /* */
+        /* */
+        /* */
+        /* */
+        /* */
+        /* */
+        /* */
+        /* */
+        /* */
+        /* */
+        /* */
+        /* */
+        /* */
+        /* */
+        /* */
+        /* */
+        /* */
+        /* */
+        /* */
+        /* */
+        /* */
+        /* */
+        /* */
+        /* */
+        /* */
+        /* */
+        /* */
+        /* */
+        /* */
+        /* */
+        /* */
+        /* */
+        /* */
+        /* */
+        /* */
+        /* */
+        /* */
+        /* */
+        /* */
+        /* */
+        /* */
+        /* */
+        /* */
+        /* */
+        /* */
+        /* */
+        /* */
+        /* */
+        /* */
+        /* */
+        /* */
+        /* */
+        /* */
+        /* */
+        /* */
+        /* */
+        /* */
+        /* */
+        /* */
+        /* */
+        /* */
+        /* */
+        /* */
+        /* */
+        /* */
+        /* */
+        /* */
+        /* */
+        /* */
+        /* */
+        /* */
+        /* */
+        /* */
+        /* */
+        /* */
+        /* */
+        /* */
+        /* */
+        /* */
+        /* */
+        /* */
+        /* */
+        /* */
+        /* */
+        /* */
+        /* */
+        /* */
+        /* */
+        /* */
+        /* */
+        /* */
+        /* */
+        /* */
+        /* */
+        /* */
+        /* */
+        /* */
+        /* */
+        /* */
+        /* */
+        /* */
+        /* */
+        /* */
+        /* */
+        /* */
+        /* */
+        /* */
+        /* */
+        /* */
+        /* */
+        /* */
+        /* */
+        /* */
+        /* */
+        /* */
+        /* */
+        /* */
+        /* */
+        /* */
+        /* */
+        /* */
+        /* */
+    }
+    logout(successCallback) {
+        this.state.set(TaonSessionState.LOADING_LOGOUT_INFO);
+        /* */
+        /* */
+        /* */
+        /* */
+        /* */
+        /* */
+        /* */
+        /* */
+        /* */
+        /* */
+        /* */
+        /* */
+        /* */
+        /* */
+        /* */
+        /* */
+        /* */
+        /* */
+        /* */
+        /* */
+        /* */
+        /* */
+    }
+    /**
+     * Reload complete authentication/session state.
+     *
+     * This causes:
+     *
+     * getCurrentUserId()
+     *   -> userId$
+     *   -> isLoggedIn$
+     *   -> context$
+     */
+    refresh() {
+        this.refreshSrc.next(void 0);
+    }
+    /**
+     * Reload authorization context only.
+     *
+     * Does NOT call getCurrentUserId().
+     */
+    refreshContext() {
+        this.contextRefreshSrc.next(void 0);
+    }
+};
+TaonSessionStateService = __decorate([
+    TaonProvider({
+        className: 'TaonSessionStateService',
+    })
+    //#endregion
+    /* */
+    /* */
+], TaonSessionStateService);
+export { TaonSessionStateService };
+//# sourceMappingURL=taon-session.state.service.js.map

package/lib-prod/taon-session/taon-session.state.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"taon-session.state.service.js","sourceRoot":"","sources":[""],"names":[],"mappings":"AAAA,iBAAiB;AAEjB,KAAK;AAEL,OAAO,EACL,eAAe,EAIf,GAAG,EAGH,EAAE,EACF,WAAW,EACX,SAAS,EAET,GAAG,GACJ,MAAM,MAAM,CAAC;AAEd,OAAO,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAC/D,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAC3C,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAIrD,KAAK;AACL,KAAK;AACL,OAAO,EAGL,gBAAgB,GACjB,MAAM,uBAAuB,CAAC;AAE/B,YAAY;AAEZ,kBAAkB;AAQX,IAAM,uBAAuB,GAA7B,MAAM,uBAAwB,SAAQ,gBAAgB;IAC3D,0BAA0B;IAE5B,KAAK;IACL,KAAK;IAGH;;;;OAIG;IACgB,UAAU,GAAG,IAAI,eAAe,CAAO,KAAK,CAAC,CAAC,CAAC;IAElE;;;;;;OAMG;IACgB,iBAAiB,GAAG,IAAI,eAAe,CAAO,KAAK,CAAC,CAAC,CAAC;IAEtD,MAAM,GAAG,MAAM,CAAqB,KAAK,CAAC,CAAC,CAAC;IAE5C,YAAY,GAAG,MAAM,CACtC,gBAAgB,CAAC,yBAAyB,CAC3C,CAAC;IAEM,eAAe,GAAG,IAAI,GAAG,CAAuC;QACtE;YACE,gBAAgB,CAAC,yBAAyB;YAC1C,CAAC,gBAAgB,CAAC,iBAAiB,EAAE,gBAAgB,CAAC,aAAa,CAAC;SACrE;QACD;YACE,gBAAgB,CAAC,iBAAiB;YAClC;gBACE,gBAAgB,CAAC,cAAc;gBAC/B,gBAAgB,CAAC,4BAA4B;gBAC7C,gBAAgB,CAAC,YAAY;gBAC7B,gBAAgB,CAAC,+BAA+B;aACjD;SACF;QACD;YACE,gBAAgB,CAAC,+BAA+B;YAChD;gBACE,gBAAgB,CAAC,cAAc;gBAC/B,gBAAgB,CAAC,4BAA4B;gBAC7C,gBAAgB,CAAC,iBAAiB;aACnC;SACF;QACD;YACE,gBAAgB,CAAC,4BAA4B;YAC7C,CAAC,gBAAgB,CAAC,YAAY,EAAE,gBAAgB,CAAC,iBAAiB,CAAC;SACpE;QACD;YACE,gBAAgB,CAAC,cAAc;YAC/B;gBACE,gBAAgB,CAAC,iBAAiB;gBAClC,gBAAgB,CAAC,cAAc;gBAC/B,gBAAgB,CAAC,YAAY;gBAC7B,gBAAgB,CAAC,oBAAoB;gBACrC,gBAAgB,CAAC,YAAY;gBAC7B,gBAAgB,CAAC,UAAU;aAC5B;SACF;QACD;YACE,gBAAgB,CAAC,YAAY;YAC7B;gBACE,gBAAgB,CAAC,cAAc;gBAC/B,gBAAgB,CAAC,iBAAiB;gBAClC,gBAAgB,CAAC,aAAa;aAC/B;SACF;QACD;YACE,gBAAgB,CAAC,aAAa;YAC9B;gBACE,gBAAgB,CAAC,mBAAmB;gBACpC,gBAAgB,CAAC,cAAc;gBAC/B,gBAAgB,CAAC,YAAY;aAC9B;SACF;QACD;YACE,gBAAgB,CAAC,YAAY;YAC7B;gBACE,gBAAgB,CAAC,aAAa;gBAC9B,gBAAgB,CAAC,mBAAmB;gBACpC,gBAAgB,CAAC,cAAc;aAChC;SACF;QACD;YACE,gBAAgB,CAAC,mBAAmB;YACpC,CAAC,gBAAgB,CAAC,iBAAiB,EAAE,gBAAgB,CAAC,aAAa,CAAC;SACrE;KACF,CAAC,CAAC;IAEI,KAAK,GAAG,IAAI,gBAAgB,CAAmB;QACpD,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE;QACjC,eAAe,EAAE,IAAI,CAAC,eAAe;QACrC,MAAM,EAAE,CAAC,SAAS,EAAE,aAAa,EAAE,SAAS,EAAE,EAAE;YAC9C,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACnC,CAAC;KACF,CAAC,CAAC;IAEH;;;;;;;OAOG;IACgB,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAC/C,SAAS,CAAC,GAAG,EAAE;QACb,kBAAkB;QAClB,OAAO,EAAE,CAAC,OAAO,CAAC,CAAC;QACnB,YAAY;QAElB,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;IAED,CAAC,CAAC,EAEF,GAAG,CAAC,MAAM,CAAC,EAAE;QACX,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAExB,IAAI,MAAM,EAAE,CAAC;YACX,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,gBAAgB,CAAC,aAAa,CAAC,CAAC;QACjD,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,gBAAgB,CAAC,iBAAiB,CAAC,CAAC;QACrD,CAAC;IACH,CAAC,CAAC,EAEF,WAAW,CAAC;QACV,UAAU,EAAE,CAAC;QACb,QAAQ,EAAE,IAAI;KACf,CAAC,CACH,CAAC;IAEF;;;;;OAKG;IACa,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;IAE3E,KAAK;IACL,KAAK;IACL,KAAK;IACL,KAAK;IACL,KAAK;IACL,KAAK;IACL,KAAK;IACL,KAAK;IACL,KAAK;IACL,KAAK;IACL,KAAK;IACL,KAAK;IACL,KAAK;IACL,KAAK;IACL,KAAK;IACL,KAAK;IACL,KAAK;IACL,KAAK;IACL,KAAK;IACL,KAAK;IACL,KAAK;IACL,KAAK;IACL,KAAK;IACL,KAAK;IACL,KAAK;IACL,KAAK;IACL,KAAK;IACL,KAAK;IACL,KAAK;IACL,KAAK;IAGH,YAAY;IAEL,qBAAqB;IAC9B,KAAK;IACL,KAAK;;QAGL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;IAEH,CAAC;IAEM,MAAM,CAAC,eAA4B;QACxC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,gBAAgB,CAAC,mBAAmB,CAAC,CAAC;QAEzD,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;IAEH,CAAC;IAED;;;;;;;;;OASG;IACI,OAAO;QACZ,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;IAC/B,CAAC;IAED;;;;OAIG;IACI,cAAc;QACnB,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;IACtC,CAAC;CACF,CAAA;AAzYY,uBAAuB;IAPnC,YAAY,CAAC;QACZ,SAAS,EAAE,yBAAyB;KACrC,CAAC;IACF,YAAY;IACZ,KAAK;IACL,KAAK;GAEQ,uBAAuB,CAyYnC"}

package/lib-prod/taon-session/taon-session.utils.d.ts

@@ -1 +1,13 @@
-export {};
+import { TaonServerMiddlewareInterceptOptions } from 'ng2-rest/lib-prod';
+export declare const TaonSessionUtils__NS__getRequestMetadata: (req: TaonServerMiddlewareInterceptOptions["req"]) => {
+    userAgent?: string;
+    ip?: string;
+    deviceName?: string;
+};
+export declare function TaonSessionUtils__NS__verifyGoogleAuthorizationCode(GOOGLE_CLIENT_ID: string, GOOGLE_CLIENT_SECRET: string, code: string): Promise<{
+    sub: string;
+    email: string;
+    emailVerified: true;
+    name: string;
+    picture: string;
+}>;

package/lib-prod/taon-session/taon-session.utils.js

@@ -1,4 +1,158 @@
-export {};
 //namespace TaonSessionUtils
+export const TaonSessionUtils__NS__getRequestMetadata = (req) => {
+    //#region @websqlFunc
+    const header = req.headers?.['user-agent'];
+    const userAgent = typeof header === 'string' ? header.slice(0, 4096) : undefined;
+    // Express applies trust-proxy; the Worker adapter resolves the edge IP.
+    const ip = req.ip || req.socket?.remoteAddress;
+    const browsers = [
+        ['Edg/', 'Edge'], ['OPR/', 'Opera'], ['Chrome/', 'Chrome'],
+        ['Firefox/', 'Firefox'], ['Safari/', 'Safari'],
+    ];
+    const systems = [
+        ['Android', 'Android'], ['iPhone|iPad', 'iOS'], ['Windows', 'Windows'],
+        ['Macintosh', 'macOS'], ['Linux', 'Linux'],
+    ];
+    const browser = browsers.find(([pattern]) => userAgent?.includes(pattern))?.[1];
+    const system = systems.find(([pattern]) => new RegExp(pattern).test(userAgent || ''))?.[1];
+    return {
+        userAgent,
+        ip,
+        deviceName: [browser, system].filter(Boolean).join(' / ') || undefined,
+    };
+    //#endregion
+};
+//#region verify google authorization code
+export async function TaonSessionUtils__NS__verifyGoogleAuthorizationCode(GOOGLE_CLIENT_ID, GOOGLE_CLIENT_SECRET, code) {
+    //#region @websqlFunc
+    // ---------------------------------------------------------
+    // 1. Exchange authorization code for tokens
+    // ---------------------------------------------------------
+    const tokenResponse = await fetch('https://oauth2.googleapis.com/token', {
+        method: 'POST',
+        headers: {
+            'Content-Type': 'application/x-www-form-urlencoded',
+        },
+        body: new URLSearchParams({
+            client_id: GOOGLE_CLIENT_ID,
+            client_secret: GOOGLE_CLIENT_SECRET,
+            code,
+            grant_type: 'authorization_code',
+            // Important:
+            // must match what was used when obtaining the code.
+            redirect_uri: 'postmessage',
+        }),
+    });
+    const tokens = (await tokenResponse.json());
+    if (!tokenResponse.ok) {
+        throw new Error(`Google token exchange failed: ${tokens.error_description || tokens.error || tokenResponse.statusText}`);
+    }
+    if (!tokens.id_token) {
+        throw new Error('Google did not return an ID token.');
+    }
+    // ---------------------------------------------------------
+    // 2. Verify Google ID token
+    // ---------------------------------------------------------
+    const payload = await verifyGoogleIdToken(tokens.id_token, GOOGLE_CLIENT_ID);
+    // ---------------------------------------------------------
+    // 3. Validate required identity data
+    // ---------------------------------------------------------
+    if (!payload.sub) {
+        throw new Error('Google identity does not contain sub.');
+    }
+    if (!payload.email) {
+        throw new Error('Google identity does not contain email.');
+    }
+    if (payload.email_verified !== true) {
+        throw new Error('Google email is not verified.');
+    }
+    return {
+        sub: payload.sub,
+        email: payload.email,
+        emailVerified: payload.email_verified,
+        name: payload.name,
+        picture: payload.picture,
+    };
+    //#endregion
+}
+//#endregion
+//#region verify google id token
+async function verifyGoogleIdToken(idToken, expectedAudience) {
+    const parts = idToken.split('.');
+    if (parts.length !== 3) {
+        throw new Error('Invalid Google ID token.');
+    }
+    const [encodedHeader, encodedPayload, encodedSignature] = parts;
+    const header = JSON.parse(decodeBase64UrlToString(encodedHeader));
+    if (header.alg !== 'RS256') {
+        throw new Error(`Unsupported Google JWT algorithm: ${header.alg}`);
+    }
+    if (!header.kid) {
+        throw new Error('Google ID token does not contain kid.');
+    }
+    // ---------------------------------------------------------
+    // Google's public signing keys
+    // ---------------------------------------------------------
+    const jwksResponse = await fetch('https://www.googleapis.com/oauth2/v3/certs');
+    if (!jwksResponse.ok) {
+        throw new Error('Unable to download Google signing keys.');
+    }
+    const jwks = (await jwksResponse.json());
+    const jwk = jwks.keys.find(key => key.kid === header.kid);
+    if (!jwk) {
+        throw new Error('Google signing key not found.');
+    }
+    // ---------------------------------------------------------
+    // Import RSA public key
+    // ---------------------------------------------------------
+    const publicKey = await crypto.subtle.importKey('jwk', jwk, {
+        name: 'RSASSA-PKCS1-v1_5',
+        hash: 'SHA-256',
+    }, false, ['verify']);
+    // ---------------------------------------------------------
+    // Verify JWT signature
+    // ---------------------------------------------------------
+    const signedData = new TextEncoder().encode(`${encodedHeader}.${encodedPayload}`);
+    const signature = decodeBase64UrlToBytes(encodedSignature);
+    const validSignature = await crypto.subtle.verify('RSASSA-PKCS1-v1_5', publicKey, 
+    // @ts-ignore
+    signature, signedData);
+    if (!validSignature) {
+        throw new Error('Invalid Google ID token signature.');
+    }
+    // ---------------------------------------------------------
+    // Decode + validate claims
+    // ---------------------------------------------------------
+    const payload = JSON.parse(decodeBase64UrlToString(encodedPayload));
+    if (payload.iss !== 'https://accounts.google.com' &&
+        payload.iss !== 'accounts.google.com') {
+        throw new Error(`Invalid Google token issuer: ${payload.iss}`);
+    }
+    const audiences = Array.isArray(payload.aud) ? payload.aud : [payload.aud];
+    if (!audiences.includes(expectedAudience)) {
+        throw new Error('Google ID token audience mismatch.');
+    }
+    const now = Math.floor(Date.now() / 1000);
+    if (!payload.exp || payload.exp <= now) {
+        throw new Error('Google ID token has expired.');
+    }
+    return payload;
+}
+//#endregion
+//#region base64 url
+function decodeBase64UrlToBytes(input) {
+    let base64 = input.replace(/-/g, '+').replace(/_/g, '/');
+    base64 += '='.repeat((4 - (base64.length % 4)) % 4);
+    const binary = atob(base64);
+    const result = new Uint8Array(binary.length);
+    for (let i = 0; i < binary.length; i++) {
+        result[i] = binary.charCodeAt(i);
+    }
+    return result;
+}
+function decodeBase64UrlToString(input) {
+    return new TextDecoder().decode(decodeBase64UrlToBytes(input));
+}
+//#endregion
 //end of namespace TaonSessionUtils
 //# sourceMappingURL=taon-session.utils.js.map

package/lib-prod/taon-session/taon-session.utils.js.map

@@ -1 +1 @@
-{"version":3,"file":"taon-session.utils.js","sourceRoot":"","sources":[""],"names":[],"mappings":";AAEA,4BAA4B;AAE5B,mCAAmC"}
+{"version":3,"file":"taon-session.utils.js","sourceRoot":"","sources":[""],"names":[],"mappings":"AAEA,4BAA4B;AAE1B,MAAM,CAAC,MAAM,wCAAwC,GAAG,CACtD,GAAgD,EACU,EAAE;IAC5D,qBAAqB;IACrB,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC,YAAY,CAAC,CAAC;IAC3C,MAAM,SAAS,GAAG,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACjF,wEAAwE;IACxE,MAAM,EAAE,GAAG,GAAG,CAAC,EAAE,IAAI,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC;IAC/C,MAAM,QAAQ,GAAG;QACf,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,QAAQ,CAAC;QAC1D,CAAC,UAAU,EAAE,SAAS,CAAC,EAAE,CAAC,SAAS,EAAE,QAAQ,CAAC;KAC/C,CAAC;IACF,MAAM,OAAO,GAAG;QACd,CAAC,SAAS,EAAE,SAAS,CAAC,EAAE,CAAC,aAAa,EAAE,KAAK,CAAC,EAAE,CAAC,SAAS,EAAE,SAAS,CAAC;QACtE,CAAC,WAAW,EAAE,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC;KAC3C,CAAC;IACF,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC,SAAS,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAChF,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC3F,OAAO;QACL,SAAS;QACT,EAAE;QACF,UAAU,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,SAAS;KACvE,CAAC;IACF,YAAY;AACd,CAAC,CAAC;AA8BF,0CAA0C;AAC1C,MAAM,CAAC,KAAK,UAAU,mDAAmD,CACvE,gBAAwB,EACxB,oBAA4B,EAC5B,IAAY;IAEZ,qBAAqB;IAErB,4DAA4D;IAC5D,4CAA4C;IAC5C,4DAA4D;IAE5D,MAAM,aAAa,GAAG,MAAM,KAAK,CAAC,qCAAqC,EAAE;QACvE,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,cAAc,EAAE,mCAAmC;SACpD;QACD,IAAI,EAAE,IAAI,eAAe,CAAC;YACxB,SAAS,EAAE,gBAAgB;YAC3B,aAAa,EAAE,oBAAoB;YACnC,IAAI;YACJ,UAAU,EAAE,oBAAoB;YAEhC,aAAa;YACb,oDAAoD;YACpD,YAAY,EAAE,aAAa;SAC5B,CAAC;KACH,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,CAAC,MAAM,aAAa,CAAC,IAAI,EAAE,CAAwB,CAAC;IAEnE,IAAI,CAAC,aAAa,CAAC,EAAE,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CACb,iCACE,MAAM,CAAC,iBAAiB,IAAI,MAAM,CAAC,KAAK,IAAI,aAAa,CAAC,UAC5D,EAAE,CACH,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;IACxD,CAAC;IAED,4DAA4D;IAC5D,4BAA4B;IAC5B,4DAA4D;IAE5D,MAAM,OAAO,GAAG,MAAM,mBAAmB,CACvC,MAAM,CAAC,QAAQ,EACf,gBAAgB,CACjB,CAAC;IAEF,4DAA4D;IAC5D,qCAAqC;IACrC,4DAA4D;IAE5D,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IAC3D,CAAC;IAED,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAC7D,CAAC;IAED,IAAI,OAAO,CAAC,cAAc,KAAK,IAAI,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;IACnD,CAAC;IAED,OAAO;QACL,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,aAAa,EAAE,OAAO,CAAC,cAAc;QACrC,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,OAAO,EAAE,OAAO,CAAC,OAAO;KACzB,CAAC;IAEF,YAAY;AACd,CAAC;AACD,YAAY;AAEZ,gCAAgC;AAChC,KAAK,UAAU,mBAAmB,CAChC,OAAe,EACf,gBAAwB;IAExB,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAEjC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;IAC9C,CAAC;IAED,MAAM,CAAC,aAAa,EAAE,cAAc,EAAE,gBAAgB,CAAC,GAAG,KAAK,CAAC;IAEhE,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,uBAAuB,CAAC,aAAa,CAAC,CAG/D,CAAC;IAEF,IAAI,MAAM,CAAC,GAAG,KAAK,OAAO,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CAAC,qCAAqC,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC;IACrE,CAAC;IAED,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IAC3D,CAAC;IAED,4DAA4D;IAC5D,+BAA+B;IAC/B,4DAA4D;IAE5D,MAAM,YAAY,GAAG,MAAM,KAAK,CAC9B,4CAA4C,CAC7C,CAAC;IAEF,IAAI,CAAC,YAAY,CAAC,EAAE,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAC7D,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,MAAM,YAAY,CAAC,IAAI,EAAE,CAEtC,CAAC;IAEF,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG,CAAC,CAAC;IAE1D,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;IACnD,CAAC;IAED,4DAA4D;IAC5D,wBAAwB;IACxB,4DAA4D;IAE5D,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAC7C,KAAK,EACL,GAAG,EACH;QACE,IAAI,EAAE,mBAAmB;QACzB,IAAI,EAAE,SAAS;KAChB,EACD,KAAK,EACL,CAAC,QAAQ,CAAC,CACX,CAAC;IAEF,4DAA4D;IAC5D,uBAAuB;IACvB,4DAA4D;IAE5D,MAAM,UAAU,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CACzC,GAAG,aAAa,IAAI,cAAc,EAAE,CACrC,CAAC;IAEF,MAAM,SAAS,GAAG,sBAAsB,CAAC,gBAAgB,CAAC,CAAC;IAE3D,MAAM,cAAc,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAC/C,mBAAmB,EACnB,SAAS;IACT,aAAa;IACb,SAAS,EACT,UAAU,CACX,CAAC;IAEF,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;IACxD,CAAC;IAED,4DAA4D;IAC5D,2BAA2B;IAC3B,4DAA4D;IAE5D,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CACxB,uBAAuB,CAAC,cAAc,CAAC,CAChB,CAAC;IAE1B,IACE,OAAO,CAAC,GAAG,KAAK,6BAA6B;QAC7C,OAAO,CAAC,GAAG,KAAK,qBAAqB,EACrC,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,gCAAgC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IACjE,CAAC;IAED,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAE3E,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;IACxD,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAE1C,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,IAAI,GAAG,EAAE,CAAC;QACvC,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;IAClD,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AACD,YAAY;AAEZ,oBAAoB;AACpB,SAAS,sBAAsB,CAAC,KAAa;IAC3C,IAAI,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAEzD,MAAM,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAEpD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;IAE5B,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAE7C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACvC,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IACnC,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,uBAAuB,CAAC,KAAa;IAC5C,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,sBAAsB,CAAC,KAAK,CAAC,CAAC,CAAC;AACjE,CAAC;AACD,YAAY;AAEd,mCAAmC"}

package/lib-prod/taon-session/taon-session.validators.d.ts

@@ -0,0 +1 @@
+export {};

package/lib-prod/taon-session/taon-session.validators.js

@@ -0,0 +1,23 @@
+export {};
+//namespace TaonSessionValidator
+/* */
+/* */
+/* */
+/* */
+/* */
+/* */
+/* */
+/* */
+/* */
+/* */
+/* */
+/* */
+/* */
+/* */
+/* */
+/* */
+/* */
+/* */
+/* */
+//end of namespace TaonSessionValidator
+//# sourceMappingURL=taon-session.validators.js.map

package/lib-prod/taon-session/taon-session.validators.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"taon-session.validators.js","sourceRoot":"","sources":[""],"names":[],"mappings":";AAIA,gCAAgC;AAEhC,KAAK;AACL,KAAK;AACL,KAAK;AACL,KAAK;AACL,KAAK;AACL,KAAK;AACL,KAAK;AACL,KAAK;AACL,KAAK;AACL,KAAK;AACL,KAAK;AACL,KAAK;AACL,KAAK;AACL,KAAK;AACL,KAAK;AACL,KAAK;AACL,KAAK;AACL,KAAK;AACL,KAAK;AAGL,uCAAuC"}

package/lib-prod/taon-session-user/index.d.ts

@@ -0,0 +1,11 @@
+export * from './taon-session-user-group.repository';
+export * from './taon-session-user.abstract.context';
+export * from './taon-session-user.constants';
+export * from './taon-session-user.controller';
+export * from './taon-session-user.entity';
+export * from './taon-session-user.middleware';
+export * from './taon-session-user.models';
+export * from './taon-session-user.provider';
+export * from './taon-session-user.repository';
+export * from './taon-session-user.subscriber';
+export * from './taon-session-user.utils';

package/lib-prod/taon-session-user/index.js

@@ -0,0 +1,13 @@
+/* */
+export * from './taon-session-user-group.repository';
+export * from './taon-session-user.abstract.context';
+export * from './taon-session-user.constants';
+export * from './taon-session-user.controller';
+export * from './taon-session-user.entity';
+export * from './taon-session-user.middleware';
+export * from './taon-session-user.models';
+export * from './taon-session-user.provider';
+export * from './taon-session-user.repository';
+export * from './taon-session-user.subscriber';
+export * from './taon-session-user.utils';
+//# sourceMappingURL=index.js.map

package/lib-prod/taon-session-user/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":[""],"names":[],"mappings":"AAAA,KAAK;AACL,cAAc,sCAAsC,CAAC;AACrD,cAAc,sCAAsC,CAAC;AACrD,cAAc,+BAA+B,CAAC;AAC9C,cAAc,gCAAgC,CAAC;AAC/C,cAAc,4BAA4B,CAAC;AAC3C,cAAc,gCAAgC,CAAC;AAC/C,cAAc,4BAA4B,CAAC;AAC3C,cAAc,8BAA8B,CAAC;AAC7C,cAAc,gCAAgC,CAAC;AAC/C,cAAc,gCAAgC,CAAC;AAC/C,cAAc,2BAA2B,CAAC"}

package/lib-prod/taon-session-user/taon-session-backoffice-users/index.d.ts

@@ -0,0 +1 @@
+export declare function dummy1791746351776(): void;

package/lib-prod/taon-session-user/taon-session-backoffice-users/index.js

@@ -0,0 +1,2 @@
+export function dummy1791746351776() { }
+//# sourceMappingURL=index.js.map

package/lib-prod/taon-session-user/taon-session-backoffice-users/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":[""],"names":[],"mappings":"AAAA,MAAM,UAAU,kBAAkB,KAAK,CAAC"}

package/lib-prod/taon-session-user/taon-session-backoffice-users/taon-session-backoffice-users.models.d.ts

@@ -0,0 +1,12 @@
+export type TaonSessionBackofficeUsersModels__NS__AssignedGroupRoleRow = {
+    roleId: number;
+    name: string;
+};
+export type TaonSessionBackofficeUsersModels__NS__AssignedGroupRow = {
+    userId: number;
+    groupId: number;
+    name: string;
+    code: string;
+    description?: string;
+    roles: TaonSessionBackofficeUsersModels__NS__AssignedGroupRoleRow[];
+};

package/lib-prod/taon-session-user/taon-session-backoffice-users/taon-session-backoffice-users.models.js

@@ -0,0 +1,4 @@
+//namespace TaonSessionBackofficeUsersModels
+export {};
+//end of namespace TaonSessionBackofficeUsersModels
+//# sourceMappingURL=taon-session-backoffice-users.models.js.map

package/lib-prod/taon-session-user/taon-session-backoffice-users/taon-session-backoffice-users.models.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"taon-session-backoffice-users.models.js","sourceRoot":"","sources":[""],"names":[],"mappings":"AAAA,4CAA4C;;AAgB5C,mDAAmD"}