@techelusive/nest-auth 0.0.0-stage → 0.2.0

package/dist/features/passwordless/passwordless.dto.js

@@ -0,0 +1,101 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.VerifyMagicLinkInput = exports.VerifyPhoneCodeInput = exports.PhoneNumberInput = exports.VerifyEmailCodeInput = exports.SignUpDetailsInput = void 0;
+const class_validator_1 = require("class-validator");
+const constants_1 = require("../../constants.js");
+/**
+ * Optional details for someone signing up with a code, link or social account. Only used when
+ * the sign-in creates a NEW account; ignored for existing users. If your settings require names
+ * or consent and they are missing, the response is VALIDATION_ERROR with `missingSignUpDetails`.
+ */
+class SignUpDetailsInput {
+    firstName;
+    lastName;
+    acceptTerms;
+    acceptPrivacyPolicy;
+}
+exports.SignUpDetailsInput = SignUpDetailsInput;
+__decorate([
+    (0, class_validator_1.IsOptional)(),
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.MaxLength)(constants_1.DISPLAY_NAME_MAX_LENGTH),
+    __metadata("design:type", String)
+], SignUpDetailsInput.prototype, "firstName", void 0);
+__decorate([
+    (0, class_validator_1.IsOptional)(),
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.MaxLength)(constants_1.DISPLAY_NAME_MAX_LENGTH),
+    __metadata("design:type", String)
+], SignUpDetailsInput.prototype, "lastName", void 0);
+__decorate([
+    (0, class_validator_1.IsOptional)(),
+    (0, class_validator_1.IsBoolean)(),
+    __metadata("design:type", Boolean)
+], SignUpDetailsInput.prototype, "acceptTerms", void 0);
+__decorate([
+    (0, class_validator_1.IsOptional)(),
+    (0, class_validator_1.IsBoolean)(),
+    __metadata("design:type", Boolean)
+], SignUpDetailsInput.prototype, "acceptPrivacyPolicy", void 0);
+/** POST /auth/email/verify-otp */
+class VerifyEmailCodeInput extends SignUpDetailsInput {
+    email;
+    code;
+}
+exports.VerifyEmailCodeInput = VerifyEmailCodeInput;
+__decorate([
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.MaxLength)(constants_1.EMAIL_MAX_LENGTH),
+    __metadata("design:type", String)
+], VerifyEmailCodeInput.prototype, "email", void 0);
+__decorate([
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.MaxLength)(constants_1.CODE_INPUT_MAX_LENGTH),
+    __metadata("design:type", String)
+], VerifyEmailCodeInput.prototype, "code", void 0);
+/** POST /auth/phone/send-otp */
+class PhoneNumberInput {
+    phoneNumber;
+}
+exports.PhoneNumberInput = PhoneNumberInput;
+__decorate([
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.MaxLength)(constants_1.PHONE_NUMBER_INPUT_MAX_LENGTH),
+    __metadata("design:type", String)
+], PhoneNumberInput.prototype, "phoneNumber", void 0);
+/** POST /auth/phone/verify-otp */
+class VerifyPhoneCodeInput extends SignUpDetailsInput {
+    phoneNumber;
+    code;
+}
+exports.VerifyPhoneCodeInput = VerifyPhoneCodeInput;
+__decorate([
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.MaxLength)(constants_1.PHONE_NUMBER_INPUT_MAX_LENGTH),
+    __metadata("design:type", String)
+], VerifyPhoneCodeInput.prototype, "phoneNumber", void 0);
+__decorate([
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.MaxLength)(constants_1.CODE_INPUT_MAX_LENGTH),
+    __metadata("design:type", String)
+], VerifyPhoneCodeInput.prototype, "code", void 0);
+/** POST /auth/magic-link/verify */
+class VerifyMagicLinkInput extends SignUpDetailsInput {
+    token;
+}
+exports.VerifyMagicLinkInput = VerifyMagicLinkInput;
+__decorate([
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.MaxLength)(constants_1.RANDOM_TOKEN_INPUT_MAX_LENGTH),
+    __metadata("design:type", String)
+], VerifyMagicLinkInput.prototype, "token", void 0);
+//# sourceMappingURL=passwordless.dto.js.map

package/dist/features/passwordless/passwordless.dto.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"passwordless.dto.js","sourceRoot":"","sources":["../../../src/features/passwordless/passwordless.dto.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,qDAA6E;AAC7E,2CAMqB;AAErB;;;;GAIG;AACH,MAAa,kBAAkB;IAE7B,SAAS,CAAU;IAGnB,QAAQ,CAAU;IAGlB,WAAW,CAAW;IAGtB,mBAAmB,CAAW;CAC/B;AAZD,gDAYC;AAVC;IADC,IAAA,4BAAU,GAAE;IAAE,IAAA,0BAAQ,GAAE;IAAE,IAAA,2BAAS,EAAC,mCAAuB,CAAC;;qDAC1C;AAGnB;IADC,IAAA,4BAAU,GAAE;IAAE,IAAA,0BAAQ,GAAE;IAAE,IAAA,2BAAS,EAAC,mCAAuB,CAAC;;oDAC3C;AAGlB;IADC,IAAA,4BAAU,GAAE;IAAE,IAAA,2BAAS,GAAE;;uDACJ;AAGtB;IADC,IAAA,4BAAU,GAAE;IAAE,IAAA,2BAAS,GAAE;;+DACI;AAGhC,kCAAkC;AAClC,MAAa,oBAAqB,SAAQ,kBAAkB;IAE1D,KAAK,CAAS;IAGd,IAAI,CAAS;CACd;AAND,oDAMC;AAJC;IADC,IAAA,0BAAQ,GAAE;IAAE,IAAA,2BAAS,EAAC,4BAAgB,CAAC;;mDAC1B;AAGd;IADC,IAAA,0BAAQ,GAAE;IAAE,IAAA,2BAAS,EAAC,iCAAqB,CAAC;;kDAChC;AAGf,gCAAgC;AAChC,MAAa,gBAAgB;IAE3B,WAAW,CAAS;CACrB;AAHD,4CAGC;AADC;IADC,IAAA,0BAAQ,GAAE;IAAE,IAAA,2BAAS,EAAC,yCAA6B,CAAC;;qDACjC;AAGtB,kCAAkC;AAClC,MAAa,oBAAqB,SAAQ,kBAAkB;IAE1D,WAAW,CAAS;IAGpB,IAAI,CAAS;CACd;AAND,oDAMC;AAJC;IADC,IAAA,0BAAQ,GAAE;IAAE,IAAA,2BAAS,EAAC,yCAA6B,CAAC;;yDACjC;AAGpB;IADC,IAAA,0BAAQ,GAAE;IAAE,IAAA,2BAAS,EAAC,iCAAqB,CAAC;;kDAChC;AAGf,mCAAmC;AACnC,MAAa,oBAAqB,SAAQ,kBAAkB;IAE1D,KAAK,CAAS;CACf;AAHD,oDAGC;AADC;IADC,IAAA,0BAAQ,GAAE;IAAE,IAAA,2BAAS,EAAC,yCAA6B,CAAC;;mDACvC"}

package/dist/features/passwords/password-auth.service.d.ts

@@ -0,0 +1,154 @@
+import { AuthOptions } from '../../auth-options.js';
+import { RateLimiterService } from '../../common/rate-limiter.service.js';
+import { RequestContext } from '../../common/request-context.js';
+import { SIGN_IN_STATUS } from '../../constants.js';
+import { LinkTokensService } from '../email-links/link-tokens.service.js';
+import { EmailVerificationService } from '../email-links/email-verification.service.js';
+import { AuthEventsService } from '../events/auth-events.service.js';
+import { NotificationsService } from '../notifications/notifications.service.js';
+import { SessionService } from '../sessions/session.service.js';
+import { SettingsService } from '../settings/settings.service.js';
+import { SignInService } from '../sign-in/sign-in.service.js';
+import { SignInResult } from '../sign-in/sign-in.types.js';
+import { UsersService } from '../users/users.service.js';
+import { PendingVerification } from '../users/users.types.js';
+import { RegisterInput } from './password.dto';
+import { PasswordPolicyService } from './password-policy.service';
+/** What POST /auth/register returns when the user still has to verify something. */
+export interface RegisteredResult {
+    success: true;
+    status: typeof SIGN_IN_STATUS.verificationRequired;
+    message: string;
+    pendingVerifications: PendingVerification[];
+}
+/**
+ * Email + password: register, sign in, forgot / reset password, change password.
+ */
+export declare class PasswordAuthService {
+    private readonly settingsService;
+    private readonly passwordPolicy;
+    private readonly users;
+    private readonly signIn;
+    private readonly sessions;
+    private readonly linkTokens;
+    private readonly emailVerification;
+    private readonly notifications;
+    private readonly rateLimiter;
+    private readonly events;
+    private readonly database;
+    constructor(options: AuthOptions, settingsService: SettingsService, passwordPolicy: PasswordPolicyService, users: UsersService, signIn: SignInService, sessions: SessionService, linkTokens: LinkTokensService, emailVerification: EmailVerificationService, notifications: NotificationsService, rateLimiter: RateLimiterService, events: AuthEventsService);
+    /**
+     * Creates an account.
+     *
+     * - If the settings require no verification, the user is signed in straight away.
+     * - Otherwise a verification email is sent and the response says what to verify next.
+     * - If the email is already registered, the response looks exactly like a new sign-up
+     *   (no account is created), so nobody can use this form to find out who has an account.
+     *
+     * @param input - The sign-up form: email, password, and optional phone, names and consents.
+     * @param request - Who is asking (for rate limits and the audit log).
+     * @returns Tokens when the account is active at once, otherwise `status: "verification_required"`.
+     * @throws AuthError SIGN_UP_CLOSED, EMAIL_DOMAIN_NOT_ALLOWED, TERMS_NOT_ACCEPTED... when a sign-up rule fails.
+     * @throws AuthError INVALID_PASSWORD when the password breaks a rule or appeared in a data breach.
+     * @throws AuthError TOO_MANY_REQUESTS after too many sign-ups from one IP.
+     */
+    register(input: RegisterInput, request: RequestContext): Promise<SignInResult | RegisteredResult>;
+    /**
+     * Signs in with email + password. Wrong email and wrong password give the same error.
+     *
+     * @param typedEmail - The email from the request.
+     * @param typedPassword - The password from the request.
+     * @param request - Who is asking (for rate limits and the audit log).
+     * @returns Tokens, or a 2FA challenge when the user has 2FA on.
+     * @throws AuthError INVALID_CREDENTIALS when the email or password is wrong.
+     * @throws AuthError TOO_MANY_REQUESTS after too many attempts for this IP or account.
+     */
+    signInWithPassword(typedEmail: unknown, typedPassword: unknown, request: RequestContext): Promise<SignInResult>;
+    /**
+     * Emails a password reset link. Always answers the same, whether or not the email has an account.
+     *
+     * @param typedEmail - The email from the request.
+     * @param request - Who is asking (for rate limits and the audit log).
+     * @returns A generic success message.
+     * @throws AuthError TOO_MANY_REQUESTS after too many emails for this IP or address.
+     */
+    requestPasswordReset(typedEmail: unknown, request: RequestContext): Promise<{
+        success: true;
+        message: "If an account exists for this email, a password reset link is on its way.";
+    }>;
+    /**
+     * Sets a new password from a reset link. Signs the user out everywhere (whoever knew the old
+     * password is kicked out) and marks the email verified (the user just proved they read it).
+     *
+     * @param resetToken - The token from the link in the email.
+     * @param newPassword - The new password.
+     * @param request - Who is asking (for the audit log).
+     * @returns A success message. The user signs in again with the new password.
+     * @throws AuthError INVALID_TOKEN when the link is unknown, used, expired, or the
+     *   account's email has changed since it was sent.
+     * @throws AuthError INVALID_PASSWORD when the new password breaks a rule or appeared in a data breach.
+     */
+    resetPassword(resetToken: unknown, newPassword: unknown, request: RequestContext): Promise<{
+        success: true;
+        message: "Your password has been reset. Please sign in with your new password.";
+    }>;
+    /**
+     * Changes the password of a signed-in user (they must type the current one).
+     * Users who signed up with Google etc. have no password yet and may set one without it.
+     * Other devices are signed out; this one stays signed in.
+     *
+     * @param userId - The signed-in user.
+     * @param sessionId - This device's session, which stays signed in.
+     * @param currentPassword - The current password (ignored when the user has none yet).
+     * @param newPassword - The new password.
+     * @param request - Who is asking (for the audit log).
+     * @returns A success message.
+     * @throws AuthError INVALID_CREDENTIALS when the current password is wrong.
+     * @throws AuthError INVALID_PASSWORD when the new password breaks a rule or equals the current one.
+     */
+    changePassword(userId: string, sessionId: string, currentPassword: unknown, newPassword: unknown, request: RequestContext): Promise<{
+        success: true;
+        message: "Your password has been changed. Other devices have been signed out.";
+    }>;
+    /**
+     * @returns The current settings.
+     * @throws AuthError SIGN_IN_METHOD_DISABLED when email + password is turned off.
+     */
+    private getPasswordSettings;
+    /**
+     * Checks the sign-up form against the registration rules in settings.
+     *
+     * @param input - The sign-up form.
+     * @param email - The normalized email.
+     * @param phoneNumber - The normalized phone number, or null.
+     * @param settings - The current settings.
+     * @throws AuthError for the first rule that fails (SIGN_UP_CLOSED, EMAIL_DOMAIN_NOT_ALLOWED,
+     *   INVALID_PHONE, VALIDATION_ERROR, TERMS_NOT_ACCEPTED, PRIVACY_POLICY_NOT_ACCEPTED).
+     */
+    private assertRegistrationRules;
+    /**
+     * The verifications a brand-new email + password account will need (same answer for everyone,
+     * so the response can't reveal whether the email was already registered).
+     *
+     * @param phoneNumber - The phone number from the form, or null.
+     * @param settings - The current settings.
+     * @returns e.g. ["email"] or ["email", "phone"].
+     */
+    private newAccountVerifications;
+    /**
+     * Hashes the password and stores it, replacing any old one.
+     *
+     * @param userId - The user.
+     * @param password - The plain password (already checked against the rules).
+     */
+    private savePassword;
+    /**
+     * Records the change in the audit log and, if enabled, emails the user that it happened.
+     *
+     * @param user - The user whose password changed.
+     * @param settings - The current settings.
+     * @param request - Who made the change.
+     * @param how - "reset", "changed" or "first_set".
+     */
+    private afterPasswordChanged;
+}

package/dist/features/passwords/password-auth.service.js

@@ -0,0 +1,317 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PasswordAuthService = void 0;
+const common_1 = require("@nestjs/common");
+const auth_error_1 = require("../../common/auth-error.js");
+const identifiers_1 = require("../../common/identifiers.js");
+const rate_limiter_service_1 = require("../../common/rate-limiter.service.js");
+const constants_1 = require("../../constants.js");
+const entities_1 = require("../../database/entities/index.js");
+const link_tokens_service_1 = require("../email-links/link-tokens.service.js");
+const email_verification_service_1 = require("../email-links/email-verification.service.js");
+const auth_events_service_1 = require("../events/auth-events.service.js");
+const notifications_service_1 = require("../notifications/notifications.service.js");
+const session_service_1 = require("../sessions/session.service.js");
+const settings_service_1 = require("../settings/settings.service.js");
+const sign_in_service_1 = require("../sign-in/sign-in.service.js");
+const users_service_1 = require("../users/users.service.js");
+const password_policy_service_1 = require("./password-policy.service");
+/**
+ * Email + password: register, sign in, forgot / reset password, change password.
+ */
+let PasswordAuthService = class PasswordAuthService {
+    settingsService;
+    passwordPolicy;
+    users;
+    signIn;
+    sessions;
+    linkTokens;
+    emailVerification;
+    notifications;
+    rateLimiter;
+    events;
+    database;
+    constructor(options, settingsService, passwordPolicy, users, signIn, sessions, linkTokens, emailVerification, notifications, rateLimiter, events) {
+        this.settingsService = settingsService;
+        this.passwordPolicy = passwordPolicy;
+        this.users = users;
+        this.signIn = signIn;
+        this.sessions = sessions;
+        this.linkTokens = linkTokens;
+        this.emailVerification = emailVerification;
+        this.notifications = notifications;
+        this.rateLimiter = rateLimiter;
+        this.events = events;
+        this.database = options.dataSource;
+    }
+    /**
+     * Creates an account.
+     *
+     * - If the settings require no verification, the user is signed in straight away.
+     * - Otherwise a verification email is sent and the response says what to verify next.
+     * - If the email is already registered, the response looks exactly like a new sign-up
+     *   (no account is created), so nobody can use this form to find out who has an account.
+     *
+     * @param input - The sign-up form: email, password, and optional phone, names and consents.
+     * @param request - Who is asking (for rate limits and the audit log).
+     * @returns Tokens when the account is active at once, otherwise `status: "verification_required"`.
+     * @throws AuthError SIGN_UP_CLOSED, EMAIL_DOMAIN_NOT_ALLOWED, TERMS_NOT_ACCEPTED... when a sign-up rule fails.
+     * @throws AuthError INVALID_PASSWORD when the password breaks a rule or appeared in a data breach.
+     * @throws AuthError TOO_MANY_REQUESTS after too many sign-ups from one IP.
+     */
+    async register(input, request) {
+        const settings = await this.getPasswordSettings();
+        await this.rateLimiter.consume(constants_1.RATE_LIMIT_KEY.signUpPerIp(request.ipAddress), constants_1.RATE_LIMITS.signUpPerIp);
+        const email = (0, identifiers_1.normalizeEmail)(input.email);
+        const phoneNumber = input.phoneNumber ? (0, identifiers_1.normalizePhoneNumber)(input.phoneNumber) : null;
+        this.assertRegistrationRules(input, email, phoneNumber, settings);
+        const password = await this.passwordPolicy.assertPasswordIsAcceptable(input.password, settings);
+        const genericResult = {
+            success: true,
+            status: constants_1.SIGN_IN_STATUS.verificationRequired,
+            message: constants_1.SUCCESS_MESSAGES.registered,
+            pendingVerifications: this.newAccountVerifications(phoneNumber, settings),
+        };
+        const existingUser = await this.users.findUserByEmail(email);
+        if (existingUser) {
+            // Help a real owner who never finished verifying; tell a stranger nothing.
+            if (!existingUser.isEmailVerified)
+                await this.emailVerification.sendVerificationEmail(email, request);
+            return genericResult;
+        }
+        const passwordHash = await this.passwordPolicy.hashPassword(password);
+        const newUser = await this.database.transaction(async (transaction) => {
+            const createdUser = await this.users.createUser({
+                email,
+                phoneNumber,
+                firstName: input.firstName?.trim() || null,
+                lastName: input.lastName?.trim() || null,
+                acceptedTerms: input.acceptTerms === true,
+                acceptedPrivacyPolicy: input.acceptPrivacyPolicy === true,
+            }, settings, request, transaction);
+            await transaction.insert(entities_1.PasswordEntity, { userId: createdUser.id, passwordHash });
+            return createdUser;
+        });
+        if (newUser.status === constants_1.ACCOUNT_STATUS.active)
+            return this.signIn.completeSignIn(newUser, constants_1.SIGN_IN_METHOD.password, request, settings);
+        if (this.users.getPendingVerifications(newUser, settings).includes(constants_1.PENDING_VERIFICATION.email)) {
+            await this.emailVerification.sendVerificationEmail(email, request);
+        }
+        return genericResult;
+    }
+    /**
+     * Signs in with email + password. Wrong email and wrong password give the same error.
+     *
+     * @param typedEmail - The email from the request.
+     * @param typedPassword - The password from the request.
+     * @param request - Who is asking (for rate limits and the audit log).
+     * @returns Tokens, or a 2FA challenge when the user has 2FA on.
+     * @throws AuthError INVALID_CREDENTIALS when the email or password is wrong.
+     * @throws AuthError TOO_MANY_REQUESTS after too many attempts for this IP or account.
+     */
+    async signInWithPassword(typedEmail, typedPassword, request) {
+        const settings = await this.getPasswordSettings();
+        const email = (0, identifiers_1.normalizeEmail)(typedEmail);
+        await this.rateLimiter.consume(constants_1.RATE_LIMIT_KEY.signInPerIp(request.ipAddress), constants_1.RATE_LIMITS.signInPerIp);
+        await this.rateLimiter.consume(constants_1.RATE_LIMIT_KEY.signInPerAccount(email), constants_1.RATE_LIMITS.signInPerAccount);
+        const user = await this.users.findUserByEmail(email);
+        const storedPassword = user
+            ? await this.database.getRepository(entities_1.PasswordEntity).findOne({ where: { userId: user.id } })
+            : null;
+        // Always run the slow hash check, even with no account, so response time reveals nothing.
+        const isPasswordRight = await this.passwordPolicy.verifyPassword(storedPassword?.passwordHash ?? null, typedPassword);
+        if (!user || !storedPassword || !isPasswordRight) {
+            await this.signIn.recordFailedSignIn(user?.id ?? null, constants_1.SIGN_IN_METHOD.password, constants_1.SIGN_IN_FAILURE_REASON.wrongEmailOrPassword, request);
+            throw new auth_error_1.AuthError(constants_1.AUTH_ERRORS.invalidCredentials);
+        }
+        await this.rateLimiter.reset(constants_1.RATE_LIMIT_KEY.signInPerAccount(email));
+        if (this.passwordPolicy.needsRehash(storedPassword.passwordHash)) {
+            await this.savePassword(user.id, typedPassword);
+        }
+        return this.signIn.completeSignIn(user, constants_1.SIGN_IN_METHOD.password, request, settings);
+    }
+    /**
+     * Emails a password reset link. Always answers the same, whether or not the email has an account.
+     *
+     * @param typedEmail - The email from the request.
+     * @param request - Who is asking (for rate limits and the audit log).
+     * @returns A generic success message.
+     * @throws AuthError TOO_MANY_REQUESTS after too many emails for this IP or address.
+     */
+    async requestPasswordReset(typedEmail, request) {
+        await this.getPasswordSettings();
+        const email = (0, identifiers_1.normalizeEmail)(typedEmail);
+        await this.rateLimiter.consume(constants_1.RATE_LIMIT_KEY.sendEmailLinkPerIp(request.ipAddress), constants_1.RATE_LIMITS.sendEmailLinkPerIp);
+        await this.rateLimiter.consume(constants_1.RATE_LIMIT_KEY.sendEmailLinkPerEmail(email), constants_1.RATE_LIMITS.sendEmailLinkPerEmail);
+        const user = await this.users.findUserByEmail(email);
+        if (user && user.status !== constants_1.ACCOUNT_STATUS.deleted && user.status !== constants_1.ACCOUNT_STATUS.suspended) {
+            const token = await this.linkTokens.createLinkToken(constants_1.LINK_PURPOSE.resetPassword, email, user.id);
+            await this.notifications.sendRequiredEmail({ type: constants_1.EMAIL_TYPE.resetPassword, to: email, token });
+            await this.events.record({ name: constants_1.AUTH_EVENTS.passwordResetRequested, userId: user.id, request });
+        }
+        return { success: true, message: constants_1.SUCCESS_MESSAGES.passwordResetEmailSent };
+    }
+    /**
+     * Sets a new password from a reset link. Signs the user out everywhere (whoever knew the old
+     * password is kicked out) and marks the email verified (the user just proved they read it).
+     *
+     * @param resetToken - The token from the link in the email.
+     * @param newPassword - The new password.
+     * @param request - Who is asking (for the audit log).
+     * @returns A success message. The user signs in again with the new password.
+     * @throws AuthError INVALID_TOKEN when the link is unknown, used, expired, or the
+     *   account's email has changed since it was sent.
+     * @throws AuthError INVALID_PASSWORD when the new password breaks a rule or appeared in a data breach.
+     */
+    async resetPassword(resetToken, newPassword, request) {
+        const settings = await this.getPasswordSettings();
+        const password = await this.passwordPolicy.assertPasswordIsAcceptable(newPassword, settings);
+        const usedToken = await this.linkTokens.useLinkToken(resetToken, constants_1.LINK_PURPOSE.resetPassword);
+        const user = usedToken.userId ? await this.users.findUserById(usedToken.userId) : null;
+        // The email may have changed, or the account been deleted, since the link was sent.
+        if (!user || user.email !== usedToken.email || user.status === constants_1.ACCOUNT_STATUS.deleted)
+            throw new auth_error_1.AuthError(constants_1.AUTH_ERRORS.invalidOrExpiredLink);
+        await this.savePassword(user.id, password);
+        await this.linkTokens.cancelLinkTokens(constants_1.LINK_PURPOSE.resetPassword, user.id);
+        await this.sessions.revokeAllSessions(user.id, constants_1.SESSION_END_REASON.passwordReset);
+        await this.users.markEmailVerified(user, settings, request);
+        await this.afterPasswordChanged(user, settings, request, constants_1.PASSWORD_CHANGE_KIND.reset);
+        return { success: true, message: constants_1.SUCCESS_MESSAGES.passwordReset };
+    }
+    /**
+     * Changes the password of a signed-in user (they must type the current one).
+     * Users who signed up with Google etc. have no password yet and may set one without it.
+     * Other devices are signed out; this one stays signed in.
+     *
+     * @param userId - The signed-in user.
+     * @param sessionId - This device's session, which stays signed in.
+     * @param currentPassword - The current password (ignored when the user has none yet).
+     * @param newPassword - The new password.
+     * @param request - Who is asking (for the audit log).
+     * @returns A success message.
+     * @throws AuthError INVALID_CREDENTIALS when the current password is wrong.
+     * @throws AuthError INVALID_PASSWORD when the new password breaks a rule or equals the current one.
+     */
+    async changePassword(userId, sessionId, currentPassword, newPassword, request) {
+        const settings = await this.getPasswordSettings();
+        await this.rateLimiter.consume(constants_1.RATE_LIMIT_KEY.changePasswordPerUser(userId), constants_1.RATE_LIMITS.changePasswordPerUser);
+        const user = await this.users.getUserOrThrow(userId);
+        const storedPassword = await this.database.getRepository(entities_1.PasswordEntity).findOne({ where: { userId } });
+        if (storedPassword && !(await this.passwordPolicy.verifyPassword(storedPassword.passwordHash, currentPassword))) {
+            throw new auth_error_1.AuthError(constants_1.AUTH_ERRORS.invalidCredentials);
+        }
+        const password = await this.passwordPolicy.assertPasswordIsAcceptable(newPassword, settings);
+        if (storedPassword && (await this.passwordPolicy.verifyPassword(storedPassword.passwordHash, password))) {
+            throw new auth_error_1.AuthError(constants_1.AUTH_ERRORS.invalidPassword, { requirements: [constants_1.PASSWORD_REQUIREMENT.differentFromCurrent] });
+        }
+        await this.savePassword(userId, password);
+        await this.sessions.revokeAllSessions(userId, constants_1.SESSION_END_REASON.passwordChanged, sessionId);
+        await this.afterPasswordChanged(user, settings, request, storedPassword ? constants_1.PASSWORD_CHANGE_KIND.changed : constants_1.PASSWORD_CHANGE_KIND.firstSet);
+        return { success: true, message: constants_1.SUCCESS_MESSAGES.passwordChanged };
+    }
+    // -------------------------------------------------------------------------------------------
+    /**
+     * @returns The current settings.
+     * @throws AuthError SIGN_IN_METHOD_DISABLED when email + password is turned off.
+     */
+    async getPasswordSettings() {
+        const settings = await this.settingsService.getSettings();
+        if (!settings.password.enabled)
+            throw new auth_error_1.AuthError(constants_1.AUTH_ERRORS.signInMethodDisabled);
+        return settings;
+    }
+    /**
+     * Checks the sign-up form against the registration rules in settings.
+     *
+     * @param input - The sign-up form.
+     * @param email - The normalized email.
+     * @param phoneNumber - The normalized phone number, or null.
+     * @param settings - The current settings.
+     * @throws AuthError for the first rule that fails (SIGN_UP_CLOSED, EMAIL_DOMAIN_NOT_ALLOWED,
+     *   INVALID_PHONE, VALIDATION_ERROR, TERMS_NOT_ACCEPTED, PRIVACY_POLICY_NOT_ACCEPTED).
+     */
+    assertRegistrationRules(input, email, phoneNumber, settings) {
+        const rules = settings.registration;
+        if (!rules.enabled)
+            throw new auth_error_1.AuthError(constants_1.AUTH_ERRORS.signUpClosed);
+        if (!(0, identifiers_1.isEmailDomainAllowed)(email, rules.allowedEmailDomains))
+            throw new auth_error_1.AuthError(constants_1.AUTH_ERRORS.emailDomainNotAllowed);
+        if (rules.requirePhoneNumber && !phoneNumber)
+            throw new auth_error_1.AuthError(constants_1.AUTH_ERRORS.invalidPhone);
+        if (rules.requireFirstAndLastName && (!input.firstName?.trim() || !input.lastName?.trim())) {
+            throw new auth_error_1.AuthError(constants_1.AUTH_ERRORS.validationFailed, { problems: [constants_1.VALIDATION_PROBLEM.namesRequired] });
+        }
+        if (rules.requireTermsAcceptance && input.acceptTerms !== true)
+            throw new auth_error_1.AuthError(constants_1.AUTH_ERRORS.termsNotAccepted);
+        if (rules.requirePrivacyPolicyAcceptance && input.acceptPrivacyPolicy !== true)
+            throw new auth_error_1.AuthError(constants_1.AUTH_ERRORS.privacyPolicyNotAccepted);
+    }
+    /**
+     * The verifications a brand-new email + password account will need (same answer for everyone,
+     * so the response can't reveal whether the email was already registered).
+     *
+     * @param phoneNumber - The phone number from the form, or null.
+     * @param settings - The current settings.
+     * @returns e.g. ["email"] or ["email", "phone"].
+     */
+    newAccountVerifications(phoneNumber, settings) {
+        const pending = [];
+        if (settings.activation.requireVerifiedEmail)
+            pending.push(constants_1.PENDING_VERIFICATION.email);
+        if (settings.activation.requireVerifiedPhone && phoneNumber)
+            pending.push(constants_1.PENDING_VERIFICATION.phone);
+        return pending;
+    }
+    /**
+     * Hashes the password and stores it, replacing any old one.
+     *
+     * @param userId - The user.
+     * @param password - The plain password (already checked against the rules).
+     */
+    async savePassword(userId, password) {
+        const passwordHash = await this.passwordPolicy.hashPassword(password);
+        await this.database.getRepository(entities_1.PasswordEntity).upsert({ userId, passwordHash }, ['userId']);
+    }
+    /**
+     * Records the change in the audit log and, if enabled, emails the user that it happened.
+     *
+     * @param user - The user whose password changed.
+     * @param settings - The current settings.
+     * @param request - Who made the change.
+     * @param how - "reset", "changed" or "first_set".
+     */
+    async afterPasswordChanged(user, settings, request, how) {
+        await this.events.record({ name: constants_1.AUTH_EVENTS.passwordChanged, userId: user.id, request, details: { how } });
+        if (settings.password.notifyOnChange && user.email) {
+            await this.notifications.sendNoticeEmail({ type: constants_1.EMAIL_TYPE.passwordChanged, to: user.email });
+        }
+    }
+};
+exports.PasswordAuthService = PasswordAuthService;
+exports.PasswordAuthService = PasswordAuthService = __decorate([
+    (0, common_1.Injectable)(),
+    __param(0, (0, common_1.Inject)(constants_1.AUTH_OPTIONS_TOKEN)),
+    __metadata("design:paramtypes", [Object, settings_service_1.SettingsService,
+        password_policy_service_1.PasswordPolicyService,
+        users_service_1.UsersService,
+        sign_in_service_1.SignInService,
+        session_service_1.SessionService,
+        link_tokens_service_1.LinkTokensService,
+        email_verification_service_1.EmailVerificationService,
+        notifications_service_1.NotificationsService,
+        rate_limiter_service_1.RateLimiterService,
+        auth_events_service_1.AuthEventsService])
+], PasswordAuthService);
+//# sourceMappingURL=password-auth.service.js.map

package/dist/features/passwords/password-auth.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"password-auth.service.js","sourceRoot":"","sources":["../../../src/features/passwords/password-auth.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,2CAAoD;AAGpD,oDAAgD;AAChD,sDAAkG;AAClG,wEAAmE;AAEnE,2CAmBqB;AACrB,kDAAiE;AACjE,oFAA+E;AAC/E,kGAA6F;AAC7F,+EAA0E;AAC1E,0FAAsF;AACtF,yEAAqE;AACrE,2EAAuE;AAEvE,wEAAmE;AAEnE,kEAA8D;AAG9D,uEAAkE;AAUlE;;GAEG;AAEI,IAAM,mBAAmB,GAAzB,MAAM,mBAAmB;IAKX;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IAbF,QAAQ,CAAa;IAEtC,YAC8B,OAAoB,EAC/B,eAAgC,EAChC,cAAqC,EACrC,KAAmB,EACnB,MAAqB,EACrB,QAAwB,EACxB,UAA6B,EAC7B,iBAA2C,EAC3C,aAAmC,EACnC,WAA+B,EAC/B,MAAyB;QATzB,oBAAe,GAAf,eAAe,CAAiB;QAChC,mBAAc,GAAd,cAAc,CAAuB;QACrC,UAAK,GAAL,KAAK,CAAc;QACnB,WAAM,GAAN,MAAM,CAAe;QACrB,aAAQ,GAAR,QAAQ,CAAgB;QACxB,eAAU,GAAV,UAAU,CAAmB;QAC7B,sBAAiB,GAAjB,iBAAiB,CAA0B;QAC3C,kBAAa,GAAb,aAAa,CAAsB;QACnC,gBAAW,GAAX,WAAW,CAAoB;QAC/B,WAAM,GAAN,MAAM,CAAmB;QAE1C,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,UAAU,CAAC;IACrC,CAAC;IAED;;;;;;;;;;;;;;OAcG;IACH,KAAK,CAAC,QAAQ,CAAC,KAAoB,EAAE,OAAuB;QAC1D,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,mBAAmB,EAAE,CAAC;QAClD,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,0BAAc,CAAC,WAAW,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,uBAAW,CAAC,WAAW,CAAC,CAAC;QAEvG,MAAM,KAAK,GAAG,IAAA,4BAAc,EAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC1C,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,IAAA,kCAAoB,EAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACvF,IAAI,CAAC,uBAAuB,CAAC,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;QAClE,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,0BAA0B,CAAC,KAAK,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QAEhG,MAAM,aAAa,GAAqB;YACtC,OAAO,EAAE,IAAI;YACb,MAAM,EAAE,0BAAc,CAAC,oBAAoB;YAC3C,OAAO,EAAE,4BAAgB,CAAC,UAAU;YACpC,oBAAoB,EAAE,IAAI,CAAC,uBAAuB,CAAC,WAAW,EAAE,QAAQ,CAAC;SAC1E,CAAC;QAEF,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;QAC7D,IAAI,YAAY,EAAE,CAAC;YACjB,2EAA2E;YAC3E,IAAI,CAAC,YAAY,CAAC,eAAe;gBAAE,MAAM,IAAI,CAAC,iBAAiB,CAAC,qBAAqB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;YACtG,OAAO,aAAa,CAAC;QACvB,CAAC;QAED,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;QACtE,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,KAAK,EAAE,WAAW,EAAE,EAAE;YACpE,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,CAC7C;gBACE,KAAK;gBACL,WAAW;gBACX,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,IAAI;gBAC1C,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,IAAI;gBACxC,aAAa,EAAE,KAAK,CAAC,WAAW,KAAK,IAAI;gBACzC,qBAAqB,EAAE,KAAK,CAAC,mBAAmB,KAAK,IAAI;aAC1D,EACD,QAAQ,EACR,OAAO,EACP,WAAW,CACZ,CAAC;YACF,MAAM,WAAW,CAAC,MAAM,CAAC,yBAAc,EAAE,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,EAAE,YAAY,EAAE,CAAC,CAAC;YACnF,OAAO,WAAW,CAAC;QACrB,CAAC,CAAC,CAAC;QAEH,IAAI,OAAO,CAAC,MAAM,KAAK,0BAAc,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,0BAAc,CAAC,QAAQ,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;QAErI,IAAI,IAAI,CAAC,KAAK,CAAC,uBAAuB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,gCAAoB,CAAC,KAAK,CAAC,EAAE,CAAC;YAC/F,MAAM,IAAI,CAAC,iBAAiB,CAAC,qBAAqB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QACrE,CAAC;QACD,OAAO,aAAa,CAAC;IACvB,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,kBAAkB,CAAC,UAAmB,EAAE,aAAsB,EAAE,OAAuB;QAC3F,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,mBAAmB,EAAE,CAAC;QAClD,MAAM,KAAK,GAAG,IAAA,4BAAc,EAAC,UAAU,CAAC,CAAC;QACzC,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,0BAAc,CAAC,WAAW,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,uBAAW,CAAC,WAAW,CAAC,CAAC;QACvG,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,0BAAc,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,uBAAW,CAAC,gBAAgB,CAAC,CAAC;QAErG,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;QACrD,MAAM,cAAc,GAAG,IAAI;YACzB,CAAC,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,yBAAc,CAAC,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC;YAC3F,CAAC,CAAC,IAAI,CAAC;QAET,0FAA0F;QAC1F,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,cAAc,CAAC,cAAc,EAAE,YAAY,IAAI,IAAI,EAAE,aAAa,CAAC,CAAC;QACtH,IAAI,CAAC,IAAI,IAAI,CAAC,cAAc,IAAI,CAAC,eAAe,EAAE,CAAC;YACjD,MAAM,IAAI,CAAC,MAAM,CAAC,kBAAkB,CAAC,IAAI,EAAE,EAAE,IAAI,IAAI,EAAE,0BAAc,CAAC,QAAQ,EAAE,kCAAsB,CAAC,oBAAoB,EAAE,OAAO,CAAC,CAAC;YACtI,MAAM,IAAI,sBAAS,CAAC,uBAAW,CAAC,kBAAkB,CAAC,CAAC;QACtD,CAAC;QAED,MAAM,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,0BAAc,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC;QACrE,IAAI,IAAI,CAAC,cAAc,CAAC,WAAW,CAAC,cAAc,CAAC,YAAY,CAAC,EAAE,CAAC;YACjE,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,EAAE,aAAuB,CAAC,CAAC;QAC5D,CAAC;QACD,OAAO,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,0BAAc,CAAC,QAAQ,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;IACtF,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,oBAAoB,CAAC,UAAmB,EAAE,OAAuB;QACrE,MAAM,IAAI,CAAC,mBAAmB,EAAE,CAAC;QACjC,MAAM,KAAK,GAAG,IAAA,4BAAc,EAAC,UAAU,CAAC,CAAC;QACzC,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,0BAAc,CAAC,kBAAkB,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,uBAAW,CAAC,kBAAkB,CAAC,CAAC;QACrH,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,0BAAc,CAAC,qBAAqB,CAAC,KAAK,CAAC,EAAE,uBAAW,CAAC,qBAAqB,CAAC,CAAC;QAE/G,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;QACrD,IAAI,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,0BAAc,CAAC,OAAO,IAAI,IAAI,CAAC,MAAM,KAAK,0BAAc,CAAC,SAAS,EAAE,CAAC;YAC/F,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,eAAe,CAAC,wBAAY,CAAC,aAAa,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;YAChG,MAAM,IAAI,CAAC,aAAa,CAAC,iBAAiB,CAAC,EAAE,IAAI,EAAE,sBAAU,CAAC,aAAa,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;YACjG,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,uBAAW,CAAC,sBAAsB,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;QACnG,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,IAAa,EAAE,OAAO,EAAE,4BAAgB,CAAC,sBAAsB,EAAE,CAAC;IACtF,CAAC;IAED;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,aAAa,CAAC,UAAmB,EAAE,WAAoB,EAAE,OAAuB;QACpF,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,mBAAmB,EAAE,CAAC;QAClD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,0BAA0B,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;QAC7F,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,UAAU,EAAE,wBAAY,CAAC,aAAa,CAAC,CAAC;QAE7F,MAAM,IAAI,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACvF,oFAAoF;QACpF,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,KAAK,IAAI,IAAI,CAAC,MAAM,KAAK,0BAAc,CAAC,OAAO;YAAE,MAAM,IAAI,sBAAS,CAAC,uBAAW,CAAC,oBAAoB,CAAC,CAAC;QAE7I,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;QAC3C,MAAM,IAAI,CAAC,UAAU,CAAC,gBAAgB,CAAC,wBAAY,CAAC,aAAa,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;QAC5E,MAAM,IAAI,CAAC,QAAQ,CAAC,iBAAiB,CAAC,IAAI,CAAC,EAAE,EAAE,8BAAkB,CAAC,aAAa,CAAC,CAAC;QACjF,MAAM,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;QAC5D,MAAM,IAAI,CAAC,oBAAoB,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,gCAAoB,CAAC,KAAK,CAAC,CAAC;QACrF,OAAO,EAAE,OAAO,EAAE,IAAa,EAAE,OAAO,EAAE,4BAAgB,CAAC,aAAa,EAAE,CAAC;IAC7E,CAAC;IAED;;;;;;;;;;;;;OAaG;IACH,KAAK,CAAC,cAAc,CAAC,MAAc,EAAE,SAAiB,EAAE,eAAwB,EAAE,WAAoB,EAAE,OAAuB;QAC7H,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,mBAAmB,EAAE,CAAC;QAClD,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,0BAAc,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE,uBAAW,CAAC,qBAAqB,CAAC,CAAC;QAChH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;QAErD,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,yBAAc,CAAC,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;QACxG,IAAI,cAAc,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,cAAc,CAAC,cAAc,CAAC,cAAc,CAAC,YAAY,EAAE,eAAe,CAAC,CAAC,EAAE,CAAC;YAChH,MAAM,IAAI,sBAAS,CAAC,uBAAW,CAAC,kBAAkB,CAAC,CAAC;QACtD,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,0BAA0B,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;QAC7F,IAAI,cAAc,IAAI,CAAC,MAAM,IAAI,CAAC,cAAc,CAAC,cAAc,CAAC,cAAc,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC,EAAE,CAAC;YACxG,MAAM,IAAI,sBAAS,CAAC,uBAAW,CAAC,eAAe,EAAE,EAAE,YAAY,EAAE,CAAC,gCAAoB,CAAC,oBAAoB,CAAC,EAAE,CAAC,CAAC;QAClH,CAAC;QAED,MAAM,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QAC1C,MAAM,IAAI,CAAC,QAAQ,CAAC,iBAAiB,CAAC,MAAM,EAAE,8BAAkB,CAAC,eAAe,EAAE,SAAS,CAAC,CAAC;QAC7F,MAAM,IAAI,CAAC,oBAAoB,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,cAAc,CAAC,CAAC,CAAC,gCAAoB,CAAC,OAAO,CAAC,CAAC,CAAC,gCAAoB,CAAC,QAAQ,CAAC,CAAC;QACxI,OAAO,EAAE,OAAO,EAAE,IAAa,EAAE,OAAO,EAAE,4BAAgB,CAAC,eAAe,EAAE,CAAC;IAC/E,CAAC;IAED,8FAA8F;IAE9F;;;OAGG;IACK,KAAK,CAAC,mBAAmB;QAC/B,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,WAAW,EAAE,CAAC;QAC1D,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO;YAAE,MAAM,IAAI,sBAAS,CAAC,uBAAW,CAAC,oBAAoB,CAAC,CAAC;QACtF,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED;;;;;;;;;OASG;IACK,uBAAuB,CAAC,KAAoB,EAAE,KAAa,EAAE,WAA0B,EAAE,QAAsB;QACrH,MAAM,KAAK,GAAG,QAAQ,CAAC,YAAY,CAAC;QACpC,IAAI,CAAC,KAAK,CAAC,OAAO;YAAE,MAAM,IAAI,sBAAS,CAAC,uBAAW,CAAC,YAAY,CAAC,CAAC;QAClE,IAAI,CAAC,IAAA,kCAAoB,EAAC,KAAK,EAAE,KAAK,CAAC,mBAAmB,CAAC;YAAE,MAAM,IAAI,sBAAS,CAAC,uBAAW,CAAC,qBAAqB,CAAC,CAAC;QACpH,IAAI,KAAK,CAAC,kBAAkB,IAAI,CAAC,WAAW;YAAE,MAAM,IAAI,sBAAS,CAAC,uBAAW,CAAC,YAAY,CAAC,CAAC;QAC5F,IAAI,KAAK,CAAC,uBAAuB,IAAI,CAAC,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;YAC3F,MAAM,IAAI,sBAAS,CAAC,uBAAW,CAAC,gBAAgB,EAAE,EAAE,QAAQ,EAAE,CAAC,8BAAkB,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;QACtG,CAAC;QACD,IAAI,KAAK,CAAC,sBAAsB,IAAI,KAAK,CAAC,WAAW,KAAK,IAAI;YAAE,MAAM,IAAI,sBAAS,CAAC,uBAAW,CAAC,gBAAgB,CAAC,CAAC;QAClH,IAAI,KAAK,CAAC,8BAA8B,IAAI,KAAK,CAAC,mBAAmB,KAAK,IAAI;YAAE,MAAM,IAAI,sBAAS,CAAC,uBAAW,CAAC,wBAAwB,CAAC,CAAC;IAC5I,CAAC;IAED;;;;;;;OAOG;IACK,uBAAuB,CAAC,WAA0B,EAAE,QAAsB;QAChF,MAAM,OAAO,GAA0B,EAAE,CAAC;QAC1C,IAAI,QAAQ,CAAC,UAAU,CAAC,oBAAoB;YAAE,OAAO,CAAC,IAAI,CAAC,gCAAoB,CAAC,KAAK,CAAC,CAAC;QACvF,IAAI,QAAQ,CAAC,UAAU,CAAC,oBAAoB,IAAI,WAAW;YAAE,OAAO,CAAC,IAAI,CAAC,gCAAoB,CAAC,KAAK,CAAC,CAAC;QACtG,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;;;;OAKG;IACK,KAAK,CAAC,YAAY,CAAC,MAAc,EAAE,QAAgB;QACzD,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;QACtE,MAAM,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,yBAAc,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;IACjG,CAAC;IAED;;;;;;;OAOG;IACK,KAAK,CAAC,oBAAoB,CAAC,IAAgB,EAAE,QAAsB,EAAE,OAAuB,EAAE,GAAuB;QAC3H,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,uBAAW,CAAC,eAAe,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;QAC5G,IAAI,QAAQ,CAAC,QAAQ,CAAC,cAAc,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACnD,MAAM,IAAI,CAAC,aAAa,CAAC,eAAe,CAAC,EAAE,IAAI,EAAE,sBAAU,CAAC,eAAe,EAAE,EAAE,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;QACjG,CAAC;IACH,CAAC;CACF,CAAA;AAvRY,kDAAmB;8BAAnB,mBAAmB;IAD/B,IAAA,mBAAU,GAAE;IAKR,WAAA,IAAA,eAAM,EAAC,8BAAkB,CAAC,CAAA;6CACO,kCAAe;QAChB,+CAAqB;QAC9B,4BAAY;QACX,+BAAa;QACX,gCAAc;QACZ,uCAAiB;QACV,qDAAwB;QAC5B,4CAAoB;QACtB,yCAAkB;QACvB,uCAAiB;GAdjC,mBAAmB,CAuR/B"}