@techelusive/nest-auth 0.0.0-stage → 0.2.1

package/dist/features/signing-keys/jwks.controller.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwks.controller.js","sourceRoot":"","sources":["../../../src/features/signing-keys/jwks.controller.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,2CAAyD;AACzD,8DAAkD;AAClD,iEAA4D;AAC5D,2CAAsE;AACtE,wEAAkE;AAElE;;;GAGG;AAII,IAAM,cAAc,GAApB,MAAM,cAAc;IACI;IAA7B,YAA6B,WAA+B;QAA/B,gBAAW,GAAX,WAAW,CAAoB;IAAG,CAAC;IAEhE;;;;OAIG;IAGG,AAAN,KAAK,CAAC,aAAa;QACjB,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,cAAc,EAAE,CAAC;QAC/D,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;IAC9B,CAAC;CACF,CAAA;AAdY,wCAAc;AAUnB;IAFL,IAAA,YAAG,EAAC,kBAAM,CAAC,SAAS,CAAC,IAAI,CAAC;IAC1B,IAAA,eAAM,EAAC,uBAAW,CAAC,YAAY,EAAE,8BAAkB,CAAC;;;;mDAIpD;yBAbU,cAAc;IAH1B,IAAA,mBAAU,EAAC,kBAAM,CAAC,SAAS,CAAC,MAAM,CAAC;IACnC,IAAA,wCAAiB,GAAE;IACnB,IAAA,wBAAM,GAAE;qCAEmC,yCAAkB;GADjD,cAAc,CAc1B"}

package/dist/features/signing-keys/signing-keys.service.d.ts

@@ -0,0 +1,67 @@
+import { KeyObject } from 'node:crypto';
+import { AuthOptions } from '../../auth-options.js';
+import { EncryptionService } from '../../common/encryption.service.js';
+import { JsonWebKey } from '../../common/crypto/jwt.js';
+export interface LoadedSigningKeys {
+    /** The key that signs every new token. */
+    currentKey: {
+        keyId: string;
+        privateKey: KeyObject;
+    };
+    /** Public keys that can verify tokens: the current one plus recently retired ones. */
+    publicKeysById: Map<string, KeyObject>;
+    /** The same public keys in JWK form, served at /.well-known/jwks.json. */
+    publicJwks: JsonWebKey[];
+}
+/**
+ * Manages the ES256 keys that sign access tokens.
+ *
+ * - The first key is created automatically the first time it is needed.
+ * - Private keys are encrypted before being saved (EncryptionService).
+ * - rotateSigningKey() replaces the key; tokens signed by the old key keep working until they expire.
+ */
+export declare class SigningKeysService {
+    private readonly encryption;
+    private readonly logger;
+    private readonly database;
+    private cachedKeys?;
+    constructor(options: AuthOptions, encryption: EncryptionService);
+    /**
+     * Returns the keys, re-reading them from the database at most once a minute.
+     * A failed load is not cached, so the next call tries again.
+     *
+     * @returns The current private key and every public key that may still verify tokens.
+     */
+    getSigningKeys(): Promise<LoadedSigningKeys>;
+    /**
+     * Retires the current key and starts signing with a new one. Run it every few months, or at
+     * once if you think a key leaked. Other servers pick up the new key within a minute, and tokens
+     * signed with the old key keep working until they expire.
+     */
+    rotateSigningKey(): Promise<void>;
+    /**
+     * Reads the current key and recently retired ones from the database, creating the first key if needed.
+     *
+     * @returns The loaded keys.
+     * @throws If there is no current key or it can't be decrypted.
+     */
+    private loadSigningKeys;
+    /**
+     * Creates the very first signing key. Safe when several servers start at once: the database
+     * allows only one current key, so the losers simply use the winner's.
+     */
+    private createFirstKeyIfMissing;
+    /**
+     * Binds the encrypted private key to its key id, so it can't be swapped with another row.
+     *
+     * @param keyId - The key's id.
+     * @returns The context for `EncryptionService`.
+     */
+    private encryptionContext;
+    /**
+     * Creates a new ES256 key pair. The key id is the key's RFC 7638 thumbprint.
+     *
+     * @returns The row to insert: key id, public JWK, and the encrypted private key.
+     */
+    private generateSigningKey;
+}

package/dist/features/signing-keys/signing-keys.service.js

@@ -0,0 +1,142 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SigningKeysService = void 0;
+const common_1 = require("@nestjs/common");
+const node_crypto_1 = require("node:crypto");
+const typeorm_1 = require("typeorm");
+const encryption_service_1 = require("../../common/encryption.service.js");
+const jwt_1 = require("../../common/crypto/jwt.js");
+const constants_1 = require("../../constants.js");
+const entities_1 = require("../../database/entities/index.js");
+/**
+ * Manages the ES256 keys that sign access tokens.
+ *
+ * - The first key is created automatically the first time it is needed.
+ * - Private keys are encrypted before being saved (EncryptionService).
+ * - rotateSigningKey() replaces the key; tokens signed by the old key keep working until they expire.
+ */
+let SigningKeysService = class SigningKeysService {
+    encryption;
+    logger = new common_1.Logger(constants_1.LOG_CONTEXT.signingKeys);
+    database;
+    cachedKeys;
+    constructor(options, encryption) {
+        this.encryption = encryption;
+        this.database = options.dataSource;
+    }
+    /**
+     * Returns the keys, re-reading them from the database at most once a minute.
+     * A failed load is not cached, so the next call tries again.
+     *
+     * @returns The current private key and every public key that may still verify tokens.
+     */
+    getSigningKeys() {
+        const cacheIsFresh = this.cachedKeys && Date.now() - this.cachedKeys.loadedAt < constants_1.SIGNING_KEYS_CACHE_SECONDS * constants_1.SECOND_IN_MILLISECONDS;
+        if (!cacheIsFresh) {
+            const keys = this.loadSigningKeys();
+            keys.catch(() => (this.cachedKeys = undefined));
+            this.cachedKeys = { keys, loadedAt: Date.now() };
+        }
+        return this.cachedKeys.keys;
+    }
+    /**
+     * Retires the current key and starts signing with a new one. Run it every few months, or at
+     * once if you think a key leaked. Other servers pick up the new key within a minute, and tokens
+     * signed with the old key keep working until they expire.
+     */
+    async rotateSigningKey() {
+        const newKey = await this.generateSigningKey();
+        await this.database.transaction(async (transaction) => {
+            await transaction.update(entities_1.SigningKeyEntity, { retiredAt: (0, typeorm_1.IsNull)() }, { retiredAt: new Date() });
+            await transaction.insert(entities_1.SigningKeyEntity, newKey);
+        });
+        this.cachedKeys = undefined;
+        this.logger.log(`Signing key rotated. New key id: ${newKey.keyId}`);
+    }
+    /**
+     * Reads the current key and recently retired ones from the database, creating the first key if needed.
+     *
+     * @returns The loaded keys.
+     * @throws If there is no current key or it can't be decrypted.
+     */
+    async loadSigningKeys() {
+        await this.createFirstKeyIfMissing();
+        const oldestRetirementStillPublished = new Date(Date.now() - constants_1.RETIRED_SIGNING_KEY_PUBLISH_SECONDS * constants_1.SECOND_IN_MILLISECONDS);
+        const keyRows = await this.database.getRepository(entities_1.SigningKeyEntity).find({
+            where: [{ retiredAt: (0, typeorm_1.IsNull)() }, { retiredAt: (0, typeorm_1.MoreThan)(oldestRetirementStillPublished) }],
+        });
+        const currentKeyRow = keyRows.find((row) => row.retiredAt === null);
+        if (!currentKeyRow)
+            throw new Error('No current signing key found');
+        const privateJwk = JSON.parse(await this.encryption.decrypt(currentKeyRow.encryptedPrivateKey, this.encryptionContext(currentKeyRow.keyId)));
+        return {
+            currentKey: { keyId: currentKeyRow.keyId, privateKey: (0, jwt_1.privateKeyFromJwk)(privateJwk) },
+            publicKeysById: new Map(keyRows.map((row) => [row.keyId, (0, jwt_1.publicKeyFromJwk)(row.publicKey)])),
+            publicJwks: keyRows.map((row) => row.publicKey),
+        };
+    }
+    /**
+     * Creates the very first signing key. Safe when several servers start at once: the database
+     * allows only one current key, so the losers simply use the winner's.
+     */
+    async createFirstKeyIfMissing() {
+        const keys = this.database.getRepository(entities_1.SigningKeyEntity);
+        if (await keys.exists({ where: { retiredAt: (0, typeorm_1.IsNull)() } }))
+            return;
+        try {
+            await keys.insert(await this.generateSigningKey());
+            this.logger.log('Created the first signing key');
+        }
+        catch (error) {
+            // Two servers started at the same moment. The database allows only one current key, so the other server won.
+            if (!(await keys.exists({ where: { retiredAt: (0, typeorm_1.IsNull)() } })))
+                throw error;
+        }
+    }
+    /**
+     * Binds the encrypted private key to its key id, so it can't be swapped with another row.
+     *
+     * @param keyId - The key's id.
+     * @returns The context for `EncryptionService`.
+     */
+    encryptionContext(keyId) {
+        return { purpose: constants_1.ENCRYPTION_PURPOSE.signingKey, keyId };
+    }
+    /**
+     * Creates a new ES256 key pair. The key id is the key's RFC 7638 thumbprint.
+     *
+     * @returns The row to insert: key id, public JWK, and the encrypted private key.
+     */
+    async generateSigningKey() {
+        const { privateKey, publicKey } = (0, node_crypto_1.generateKeyPairSync)(constants_1.SIGNING_KEY_PAIR_TYPE, { namedCurve: constants_1.SIGNING_KEY_CURVE });
+        const publicJwk = publicKey.export({ format: constants_1.JWK_EXPORT_FORMAT });
+        // The key id is the key's RFC 7638 thumbprint: a hash of its public parts.
+        const keyId = (0, node_crypto_1.createHash)(constants_1.HASH_ALGORITHM.sha256)
+            .update(JSON.stringify({ crv: publicJwk.crv, kty: publicJwk.kty, x: publicJwk.x, y: publicJwk.y }))
+            .digest(constants_1.TEXT_ENCODING.base64Url);
+        return {
+            keyId,
+            publicKey: { kty: publicJwk.kty, crv: publicJwk.crv, x: publicJwk.x, y: publicJwk.y, kid: keyId, alg: constants_1.SIGNING_ALGORITHM, use: constants_1.JWK_USE_SIGNATURE },
+            encryptedPrivateKey: await this.encryption.encrypt(JSON.stringify(privateKey.export({ format: constants_1.JWK_EXPORT_FORMAT })), this.encryptionContext(keyId)),
+        };
+    }
+};
+exports.SigningKeysService = SigningKeysService;
+exports.SigningKeysService = SigningKeysService = __decorate([
+    (0, common_1.Injectable)(),
+    __param(0, (0, common_1.Inject)(constants_1.AUTH_OPTIONS_TOKEN)),
+    __metadata("design:paramtypes", [Object, encryption_service_1.EncryptionService])
+], SigningKeysService);
+//# sourceMappingURL=signing-keys.service.js.map

package/dist/features/signing-keys/signing-keys.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"signing-keys.service.js","sourceRoot":"","sources":["../../../src/features/signing-keys/signing-keys.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,2CAA4D;AAC5D,6CAAyE;AACzE,qCAAuD;AAEvD,oEAAgE;AAChE,6CAAsF;AACtF,2CAcqB;AACrB,kDAAuD;AAWvD;;;;;;GAMG;AAEI,IAAM,kBAAkB,GAAxB,MAAM,kBAAkB;IAOV;IANF,MAAM,GAAG,IAAI,eAAM,CAAC,uBAAW,CAAC,WAAW,CAAC,CAAC;IAC7C,QAAQ,CAAa;IAC9B,UAAU,CAA0D;IAE5E,YAC8B,OAAoB,EAC/B,UAA6B;QAA7B,eAAU,GAAV,UAAU,CAAmB;QAE9C,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,UAAU,CAAC;IACrC,CAAC;IAED;;;;;OAKG;IACH,cAAc;QACZ,MAAM,YAAY,GAChB,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,UAAU,CAAC,QAAQ,GAAG,sCAA0B,GAAG,kCAAsB,CAAC;QACjH,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,MAAM,IAAI,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC;YACpC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,GAAG,SAAS,CAAC,CAAC,CAAC;YAChD,IAAI,CAAC,UAAU,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;QACnD,CAAC;QACD,OAAO,IAAI,CAAC,UAAW,CAAC,IAAI,CAAC;IAC/B,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,gBAAgB;QACpB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,kBAAkB,EAAE,CAAC;QAC/C,MAAM,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,KAAK,EAAE,WAAW,EAAE,EAAE;YACpD,MAAM,WAAW,CAAC,MAAM,CAAC,2BAAgB,EAAE,EAAE,SAAS,EAAE,IAAA,gBAAM,GAAE,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC,CAAC;YAC/F,MAAM,WAAW,CAAC,MAAM,CAAC,2BAAgB,EAAE,MAAM,CAAC,CAAC;QACrD,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,UAAU,GAAG,SAAS,CAAC;QAC5B,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,oCAAoC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;IACtE,CAAC;IAED;;;;;OAKG;IACK,KAAK,CAAC,eAAe;QAC3B,MAAM,IAAI,CAAC,uBAAuB,EAAE,CAAC;QAErC,MAAM,8BAA8B,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,+CAAmC,GAAG,kCAAsB,CAAC,CAAC;QAC3H,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,2BAAgB,CAAC,CAAC,IAAI,CAAC;YACvE,KAAK,EAAE,CAAC,EAAE,SAAS,EAAE,IAAA,gBAAM,GAAE,EAAE,EAAE,EAAE,SAAS,EAAE,IAAA,kBAAQ,EAAC,8BAA8B,CAAC,EAAE,CAAC;SAC1F,CAAC,CAAC;QACH,MAAM,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,SAAS,KAAK,IAAI,CAAC,CAAC;QACpE,IAAI,CAAC,aAAa;YAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;QAEpE,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,aAAa,CAAC,mBAAmB,EAAE,IAAI,CAAC,iBAAiB,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAE7I,OAAO;YACL,UAAU,EAAE,EAAE,KAAK,EAAE,aAAa,CAAC,KAAK,EAAE,UAAU,EAAE,IAAA,uBAAiB,EAAC,UAAU,CAAC,EAAE;YACrF,cAAc,EAAE,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,IAAA,sBAAgB,EAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;YAC3F,UAAU,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,SAAS,CAAC;SAChD,CAAC;IACJ,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,uBAAuB;QACnC,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,2BAAgB,CAAC,CAAC;QAC3D,IAAI,MAAM,IAAI,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,EAAE,SAAS,EAAE,IAAA,gBAAM,GAAE,EAAE,EAAE,CAAC;YAAE,OAAO;QAClE,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,kBAAkB,EAAE,CAAC,CAAC;YACnD,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,+BAA+B,CAAC,CAAC;QACnD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,6GAA6G;YAC7G,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,EAAE,SAAS,EAAE,IAAA,gBAAM,GAAE,EAAE,EAAE,CAAC,CAAC;gBAAE,MAAM,KAAK,CAAC;QAC5E,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACK,iBAAiB,CAAC,KAAa;QACrC,OAAO,EAAE,OAAO,EAAE,8BAAkB,CAAC,UAAU,EAAE,KAAK,EAAE,CAAC;IAC3D,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,kBAAkB;QAC9B,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,IAAA,iCAAmB,EAAC,iCAAqB,EAAE,EAAE,UAAU,EAAE,6BAAiB,EAAE,CAAC,CAAC;QAChH,MAAM,SAAS,GAAG,SAAS,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,6BAAiB,EAAE,CAAe,CAAC;QAEhF,2EAA2E;QAC3E,MAAM,KAAK,GAAG,IAAA,wBAAU,EAAC,0BAAc,CAAC,MAAM,CAAC;aAC5C,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,SAAS,CAAC,GAAG,EAAE,CAAC,EAAE,SAAS,CAAC,CAAC,EAAE,CAAC,EAAE,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC;aAClG,MAAM,CAAC,yBAAa,CAAC,SAAS,CAAC,CAAC;QAEnC,OAAO;YACL,KAAK;YACL,SAAS,EAAE,EAAE,GAAG,EAAE,SAAS,CAAC,GAAI,EAAE,GAAG,EAAE,SAAS,CAAC,GAAI,EAAE,CAAC,EAAE,SAAS,CAAC,CAAE,EAAE,CAAC,EAAE,SAAS,CAAC,CAAE,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,6BAAiB,EAAE,GAAG,EAAE,6BAAiB,EAAE;YACrJ,mBAAmB,EAAE,MAAM,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,6BAAiB,EAAE,CAAC,CAAC,EAAE,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC;SACpJ,CAAC;IACJ,CAAC;CACF,CAAA;AAnHY,gDAAkB;6BAAlB,kBAAkB;IAD9B,IAAA,mBAAU,GAAE;IAOR,WAAA,IAAA,eAAM,EAAC,8BAAkB,CAAC,CAAA;6CACE,sCAAiB;GAPrC,kBAAkB,CAmH9B"}

package/dist/features/social/social-auth.service.d.ts

@@ -0,0 +1,100 @@
+import { AuthOptions } from '../../auth-options.js';
+import { RateLimiterService } from '../../common/rate-limiter.service.js';
+import { RequestContext } from '../../common/request-context.js';
+import { SocialProvider } from '../../database/entities/index.js';
+import { AuthEventsService } from '../events/auth-events.service.js';
+import { SettingsService } from '../settings/settings.service.js';
+import { SignInService } from '../sign-in/sign-in.service.js';
+import { SignInResult } from '../sign-in/sign-in.types.js';
+import { SignInMethodsService } from '../users/sign-in-methods.service.js';
+import { UsersService } from '../users/users.service.js';
+import { SocialSignInInput } from './social.dto';
+import { SocialProvidersService } from './social-providers.service';
+/**
+ * Sign in with Google, Apple or Facebook, and link / unlink them to an existing account.
+ *
+ * Who the token belongs to is decided like this:
+ * - The provider account is already linked: sign in as that user.
+ * - The provider PROVED the email, and a user has it: link to that user, then sign in.
+ * - The email is NOT proven, and a user has it: refuse (ACCOUNT_EXISTS_WITH_OTHER_METHOD).
+ *   Otherwise anyone could create a Facebook account with your email and take over yours.
+ * - Nobody has the email: create a new account (if sign-up is open).
+ */
+export declare class SocialAuthService {
+    private readonly settingsService;
+    private readonly providers;
+    private readonly users;
+    private readonly signIn;
+    private readonly signInMethods;
+    private readonly rateLimiter;
+    private readonly events;
+    private readonly database;
+    constructor(options: AuthOptions, settingsService: SettingsService, providers: SocialProvidersService, users: UsersService, signIn: SignInService, signInMethods: SignInMethodsService, rateLimiter: RateLimiterService, events: AuthEventsService);
+    /**
+     * Signs in (or signs up) with a token from Google, Apple or Facebook.
+     * See the class comment for how the token is matched to a user.
+     *
+     * @param provider - "google", "apple" or "facebook".
+     * @param input - The provider's token, the optional nonce, and sign-up details for new accounts.
+     * @param request - Who is asking.
+     * @returns Tokens, or a 2FA challenge.
+     * @throws AuthError INVALID_SOCIAL_TOKEN when the provider's token doesn't check out.
+     * @throws AuthError ACCOUNT_EXISTS_WITH_OTHER_METHOD when a user has this email but the provider didn't prove it.
+     * @throws AuthError SIGN_UP_CLOSED or VALIDATION_ERROR when a new account can't be created.
+     */
+    signInWithProvider(provider: SocialProvider, input: SocialSignInInput, request: RequestContext): Promise<SignInResult>;
+    /**
+     * Links a provider account to the signed-in user (e.g. "Connect Google" in settings).
+     * Linking the same account again is a no-op.
+     *
+     * @param userId - The signed-in user.
+     * @param provider - "google", "apple" or "facebook".
+     * @param input - The provider's token and optional nonce.
+     * @param request - Who is asking (for the audit log).
+     * @returns `{ success: true }`.
+     * @throws AuthError SOCIAL_ACCOUNT_IN_USE when that provider account belongs to another user.
+     */
+    linkProvider(userId: string, provider: SocialProvider, input: SocialSignInInput, request: RequestContext): Promise<{
+        success: true;
+    }>;
+    /**
+     * Removes a linked provider, unless it is the user's only way to sign in.
+     *
+     * @param userId - The signed-in user.
+     * @param provider - The provider to disconnect.
+     * @param request - Who is asking (for the audit log).
+     * @returns `{ success: true }`.
+     * @throws AuthError NOT_FOUND when the provider isn't linked.
+     * @throws AuthError LAST_SIGN_IN_METHOD when it is the user's only way to sign in.
+     */
+    unlinkProvider(userId: string, provider: SocialProvider, request: RequestContext): Promise<{
+        success: true;
+    }>;
+    /**
+     * @param identity - Who the provider says the user is.
+     * @returns The link row for this provider account, or null.
+     */
+    private findLinkedAccount;
+    /**
+     * Links a provider account to a user.
+     *
+     * @param userId - The user.
+     * @param identity - Who the provider says the user is.
+     * @param request - Who is asking (for the audit log).
+     * @param transaction - Pass one to save the link together with other rows (e.g. a new user).
+     * @throws AuthError SOCIAL_ACCOUNT_IN_USE when two requests link the same provider account at once.
+     */
+    private saveLink;
+    /**
+     * Creates a new account from a provider's identity, linked to that provider.
+     * Names from the app (Apple sends them only to the app) win over names from the provider.
+     *
+     * @param identity - Who the provider says the user is.
+     * @param input - Sign-up details sent by the app.
+     * @param settings - The current settings.
+     * @param request - Who is asking.
+     * @returns The new user.
+     * @throws AuthError SIGN_UP_CLOSED, EMAIL_DOMAIN_NOT_ALLOWED, or VALIDATION_ERROR (e.g. no email from Facebook).
+     */
+    private createUserFromIdentity;
+}

package/dist/features/social/social-auth.service.js

@@ -0,0 +1,232 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SocialAuthService = void 0;
+const common_1 = require("@nestjs/common");
+const typeorm_1 = require("typeorm");
+const auth_error_1 = require("../../common/auth-error.js");
+const identifiers_1 = require("../../common/identifiers.js");
+const rate_limiter_service_1 = require("../../common/rate-limiter.service.js");
+const constants_1 = require("../../constants.js");
+const entities_1 = require("../../database/entities/index.js");
+const auth_events_service_1 = require("../events/auth-events.service.js");
+const settings_service_1 = require("../settings/settings.service.js");
+const sign_in_service_1 = require("../sign-in/sign-in.service.js");
+const sign_in_methods_service_1 = require("../users/sign-in-methods.service.js");
+const sign_up_rules_1 = require("../users/sign-up-rules.js");
+const users_service_1 = require("../users/users.service.js");
+const social_providers_service_1 = require("./social-providers.service");
+/**
+ * Sign in with Google, Apple or Facebook, and link / unlink them to an existing account.
+ *
+ * Who the token belongs to is decided like this:
+ * - The provider account is already linked: sign in as that user.
+ * - The provider PROVED the email, and a user has it: link to that user, then sign in.
+ * - The email is NOT proven, and a user has it: refuse (ACCOUNT_EXISTS_WITH_OTHER_METHOD).
+ *   Otherwise anyone could create a Facebook account with your email and take over yours.
+ * - Nobody has the email: create a new account (if sign-up is open).
+ */
+let SocialAuthService = class SocialAuthService {
+    settingsService;
+    providers;
+    users;
+    signIn;
+    signInMethods;
+    rateLimiter;
+    events;
+    database;
+    constructor(options, settingsService, providers, users, signIn, signInMethods, rateLimiter, events) {
+        this.settingsService = settingsService;
+        this.providers = providers;
+        this.users = users;
+        this.signIn = signIn;
+        this.signInMethods = signInMethods;
+        this.rateLimiter = rateLimiter;
+        this.events = events;
+        this.database = options.dataSource;
+    }
+    /**
+     * Signs in (or signs up) with a token from Google, Apple or Facebook.
+     * See the class comment for how the token is matched to a user.
+     *
+     * @param provider - "google", "apple" or "facebook".
+     * @param input - The provider's token, the optional nonce, and sign-up details for new accounts.
+     * @param request - Who is asking.
+     * @returns Tokens, or a 2FA challenge.
+     * @throws AuthError INVALID_SOCIAL_TOKEN when the provider's token doesn't check out.
+     * @throws AuthError ACCOUNT_EXISTS_WITH_OTHER_METHOD when a user has this email but the provider didn't prove it.
+     * @throws AuthError SIGN_UP_CLOSED or VALIDATION_ERROR when a new account can't be created.
+     */
+    async signInWithProvider(provider, input, request) {
+        const settings = await this.settingsService.getSettings();
+        await this.rateLimiter.consume(constants_1.RATE_LIMIT_KEY.signInPerIp(request.ipAddress), constants_1.RATE_LIMITS.signInPerIp);
+        const identity = await this.providers.verifyCredential(provider, { token: input.token, nonce: input.nonce }, settings);
+        // This provider account is already linked to a user.
+        const linkedAccount = await this.findLinkedAccount(identity);
+        if (linkedAccount) {
+            const linkedUser = await this.users.findUserById(linkedAccount.userId);
+            if (!linkedUser)
+                throw new auth_error_1.AuthError(constants_1.AUTH_ERRORS.invalidSocialToken);
+            return this.signIn.completeSignIn(linkedUser, provider, request, settings);
+        }
+        // Someone already has this email: link only if the provider proved it.
+        const userWithSameEmail = identity.email ? await this.users.findUserByEmail(identity.email) : null;
+        if (userWithSameEmail) {
+            if (!identity.isEmailVerified)
+                throw new auth_error_1.AuthError(constants_1.AUTH_ERRORS.accountExistsWithOtherMethod);
+            await this.users.removeUnprovenPassword(userWithSameEmail, request);
+            await this.saveLink(userWithSameEmail.id, identity, request);
+            const verifiedUser = await this.users.markEmailVerified(userWithSameEmail, settings, request);
+            return this.signIn.completeSignIn(verifiedUser, provider, request, settings);
+        }
+        // Nobody has this email yet.
+        const newUser = await this.createUserFromIdentity(identity, input, settings, request);
+        return this.signIn.completeSignIn(newUser, provider, request, settings);
+    }
+    /**
+     * Links a provider account to the signed-in user (e.g. "Connect Google" in settings).
+     * Linking the same account again is a no-op.
+     *
+     * @param userId - The signed-in user.
+     * @param provider - "google", "apple" or "facebook".
+     * @param input - The provider's token and optional nonce.
+     * @param request - Who is asking (for the audit log).
+     * @returns `{ success: true }`.
+     * @throws AuthError SOCIAL_ACCOUNT_IN_USE when that provider account belongs to another user.
+     */
+    async linkProvider(userId, provider, input, request) {
+        const settings = await this.settingsService.getSettings();
+        const identity = await this.providers.verifyCredential(provider, { token: input.token, nonce: input.nonce }, settings);
+        await this.users.getUserOrThrow(userId);
+        const linkedAccount = await this.findLinkedAccount(identity);
+        if (linkedAccount) {
+            if (linkedAccount.userId === userId)
+                return { success: true };
+            throw new auth_error_1.AuthError(constants_1.AUTH_ERRORS.socialAccountAlreadyLinked);
+        }
+        await this.saveLink(userId, identity, request);
+        return { success: true };
+    }
+    /**
+     * Removes a linked provider, unless it is the user's only way to sign in.
+     *
+     * @param userId - The signed-in user.
+     * @param provider - The provider to disconnect.
+     * @param request - Who is asking (for the audit log).
+     * @returns `{ success: true }`.
+     * @throws AuthError NOT_FOUND when the provider isn't linked.
+     * @throws AuthError LAST_SIGN_IN_METHOD when it is the user's only way to sign in.
+     */
+    async unlinkProvider(userId, provider, request) {
+        const settings = await this.settingsService.getSettings();
+        const user = await this.users.getUserOrThrow(userId);
+        const accounts = this.database.getRepository(entities_1.SocialAccountEntity);
+        if (!(await accounts.exists({ where: { userId, provider } })))
+            throw new auth_error_1.AuthError(constants_1.AUTH_ERRORS.notFound);
+        await this.signInMethods.assertCanRemove(user, settings, constants_1.REMOVABLE_SIGN_IN_METHOD.social);
+        await accounts.delete({ userId, provider });
+        await this.events.record({ name: constants_1.AUTH_EVENTS.socialAccountUnlinked, userId, request, details: { provider } });
+        return { success: true };
+    }
+    // -------------------------------------------------------------------------------------------
+    /**
+     * @param identity - Who the provider says the user is.
+     * @returns The link row for this provider account, or null.
+     */
+    findLinkedAccount(identity) {
+        return this.database.getRepository(entities_1.SocialAccountEntity).findOne({
+            where: { provider: identity.provider, providerUserId: identity.providerUserId },
+        });
+    }
+    /**
+     * Links a provider account to a user.
+     *
+     * @param userId - The user.
+     * @param identity - Who the provider says the user is.
+     * @param request - Who is asking (for the audit log).
+     * @param transaction - Pass one to save the link together with other rows (e.g. a new user).
+     * @throws AuthError SOCIAL_ACCOUNT_IN_USE when two requests link the same provider account at once.
+     */
+    async saveLink(userId, identity, request, transaction = this.database.manager) {
+        try {
+            await transaction.insert(entities_1.SocialAccountEntity, {
+                userId,
+                provider: identity.provider,
+                providerUserId: identity.providerUserId,
+                email: identity.email,
+            });
+        }
+        catch (error) {
+            // Two requests linked the same provider account at once.
+            const code = error.code;
+            if (error instanceof typeorm_1.QueryFailedError && code === constants_1.POSTGRES_UNIQUE_VIOLATION_CODE)
+                throw new auth_error_1.AuthError(constants_1.AUTH_ERRORS.socialAccountAlreadyLinked);
+            throw error;
+        }
+        await this.events.record({ name: constants_1.AUTH_EVENTS.socialAccountLinked, userId, request, details: { provider: identity.provider } });
+    }
+    /**
+     * Creates a new account from a provider's identity, linked to that provider.
+     * Names from the app (Apple sends them only to the app) win over names from the provider.
+     *
+     * @param identity - Who the provider says the user is.
+     * @param input - Sign-up details sent by the app.
+     * @param settings - The current settings.
+     * @param request - Who is asking.
+     * @returns The new user.
+     * @throws AuthError SIGN_UP_CLOSED, EMAIL_DOMAIN_NOT_ALLOWED, or VALIDATION_ERROR (e.g. no email from Facebook).
+     */
+    async createUserFromIdentity(identity, input, settings, request) {
+        if (!settings.registration.enabled)
+            throw new auth_error_1.AuthError(constants_1.AUTH_ERRORS.signUpClosed);
+        // Every account needs an email or phone. Facebook users can refuse to share their email.
+        if (!identity.email)
+            throw new auth_error_1.AuthError(constants_1.AUTH_ERRORS.validationFailed, { missingSignUpDetails: [constants_1.SIGN_UP_DETAIL.email] });
+        if (!(0, identifiers_1.isEmailDomainAllowed)(identity.email, settings.registration.allowedEmailDomains)) {
+            throw new auth_error_1.AuthError(constants_1.AUTH_ERRORS.emailDomainNotAllowed);
+        }
+        // Names from the app (Apple sends them only to the app) win over names from the provider.
+        const signUpDetails = {
+            ...input,
+            firstName: input.firstName?.trim() || identity.firstName || undefined,
+            lastName: input.lastName?.trim() || identity.lastName || undefined,
+        };
+        (0, sign_up_rules_1.assertSignUpDetailsComplete)(signUpDetails, settings);
+        return this.database.transaction(async (transaction) => {
+            const newUser = await this.users.createUser({
+                email: identity.email,
+                isEmailVerified: identity.isEmailVerified,
+                firstName: signUpDetails.firstName ?? null,
+                lastName: signUpDetails.lastName ?? null,
+                acceptedTerms: input.acceptTerms === true,
+                acceptedPrivacyPolicy: input.acceptPrivacyPolicy === true,
+            }, settings, request, transaction);
+            await this.saveLink(newUser.id, identity, request, transaction);
+            return newUser;
+        });
+    }
+};
+exports.SocialAuthService = SocialAuthService;
+exports.SocialAuthService = SocialAuthService = __decorate([
+    (0, common_1.Injectable)(),
+    __param(0, (0, common_1.Inject)(constants_1.AUTH_OPTIONS_TOKEN)),
+    __metadata("design:paramtypes", [Object, settings_service_1.SettingsService,
+        social_providers_service_1.SocialProvidersService,
+        users_service_1.UsersService,
+        sign_in_service_1.SignInService,
+        sign_in_methods_service_1.SignInMethodsService,
+        rate_limiter_service_1.RateLimiterService,
+        auth_events_service_1.AuthEventsService])
+], SocialAuthService);
+//# sourceMappingURL=social-auth.service.js.map

package/dist/features/social/social-auth.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"social-auth.service.js","sourceRoot":"","sources":["../../../src/features/social/social-auth.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,2CAAoD;AACpD,qCAAuD;AAEvD,oDAAgD;AAChD,sDAA4D;AAC5D,wEAAmE;AAEnE,2CASqB;AACrB,kDAAsF;AACtF,+EAA0E;AAC1E,2EAAuE;AAEvE,wEAAmE;AAEnE,sFAAgF;AAChF,kEAA6E;AAC7E,kEAA8D;AAE9D,yEAAoF;AAEpF;;;;;;;;;GASG;AAEI,IAAM,iBAAiB,GAAvB,MAAM,iBAAiB;IAKT;IACA;IACA;IACA;IACA;IACA;IACA;IAVF,QAAQ,CAAa;IAEtC,YAC8B,OAAoB,EAC/B,eAAgC,EAChC,SAAiC,EACjC,KAAmB,EACnB,MAAqB,EACrB,aAAmC,EACnC,WAA+B,EAC/B,MAAyB;QANzB,oBAAe,GAAf,eAAe,CAAiB;QAChC,cAAS,GAAT,SAAS,CAAwB;QACjC,UAAK,GAAL,KAAK,CAAc;QACnB,WAAM,GAAN,MAAM,CAAe;QACrB,kBAAa,GAAb,aAAa,CAAsB;QACnC,gBAAW,GAAX,WAAW,CAAoB;QAC/B,WAAM,GAAN,MAAM,CAAmB;QAE1C,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,UAAU,CAAC;IACrC,CAAC;IAED;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,kBAAkB,CAAC,QAAwB,EAAE,KAAwB,EAAE,OAAuB;QAClG,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,WAAW,EAAE,CAAC;QAC1D,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,0BAAc,CAAC,WAAW,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,uBAAW,CAAC,WAAW,CAAC,CAAC;QACvG,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,gBAAgB,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,EAAE,QAAQ,CAAC,CAAC;QAEvH,qDAAqD;QACrD,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC;QAC7D,IAAI,aAAa,EAAE,CAAC;YAClB,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;YACvE,IAAI,CAAC,UAAU;gBAAE,MAAM,IAAI,sBAAS,CAAC,uBAAW,CAAC,kBAAkB,CAAC,CAAC;YACrE,OAAO,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;QAC7E,CAAC;QAED,uEAAuE;QACvE,MAAM,iBAAiB,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACnG,IAAI,iBAAiB,EAAE,CAAC;YACtB,IAAI,CAAC,QAAQ,CAAC,eAAe;gBAAE,MAAM,IAAI,sBAAS,CAAC,uBAAW,CAAC,4BAA4B,CAAC,CAAC;YAC7F,MAAM,IAAI,CAAC,KAAK,CAAC,sBAAsB,CAAC,iBAAiB,EAAE,OAAO,CAAC,CAAC;YACpE,MAAM,IAAI,CAAC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;YAC7D,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC,iBAAiB,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;YAC9F,OAAO,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,YAAY,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;QAC/E,CAAC;QAED,6BAA6B;QAC7B,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;QACtF,OAAO,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;IAC1E,CAAC;IAED;;;;;;;;;;OAUG;IACH,KAAK,CAAC,YAAY,CAAC,MAAc,EAAE,QAAwB,EAAE,KAAwB,EAAE,OAAuB;QAC5G,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,WAAW,EAAE,CAAC;QAC1D,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,gBAAgB,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,EAAE,QAAQ,CAAC,CAAC;QACvH,MAAM,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;QAExC,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC;QAC7D,IAAI,aAAa,EAAE,CAAC;YAClB,IAAI,aAAa,CAAC,MAAM,KAAK,MAAM;gBAAE,OAAO,EAAE,OAAO,EAAE,IAAa,EAAE,CAAC;YACvE,MAAM,IAAI,sBAAS,CAAC,uBAAW,CAAC,0BAA0B,CAAC,CAAC;QAC9D,CAAC;QACD,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;QAC/C,OAAO,EAAE,OAAO,EAAE,IAAa,EAAE,CAAC;IACpC,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,cAAc,CAAC,MAAc,EAAE,QAAwB,EAAE,OAAuB;QACpF,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,WAAW,EAAE,CAAC;QAC1D,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;QACrD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,8BAAmB,CAAC,CAAC;QAClE,IAAI,CAAC,CAAC,MAAM,QAAQ,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;YAAE,MAAM,IAAI,sBAAS,CAAC,uBAAW,CAAC,QAAQ,CAAC,CAAC;QAEzG,MAAM,IAAI,CAAC,aAAa,CAAC,eAAe,CAAC,IAAI,EAAE,QAAQ,EAAE,oCAAwB,CAAC,MAAM,CAAC,CAAC;QAC1F,MAAM,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;QAC5C,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,uBAAW,CAAC,qBAAqB,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;QAC9G,OAAO,EAAE,OAAO,EAAE,IAAa,EAAE,CAAC;IACpC,CAAC;IAED,8FAA8F;IAE9F;;;OAGG;IACK,iBAAiB,CAAC,QAAwB;QAChD,OAAO,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,8BAAmB,CAAC,CAAC,OAAO,CAAC;YAC9D,KAAK,EAAE,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,cAAc,EAAE,QAAQ,CAAC,cAAc,EAAE;SAChF,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;OAQG;IACK,KAAK,CAAC,QAAQ,CAAC,MAAc,EAAE,QAAwB,EAAE,OAAuB,EAAE,WAAW,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO;QAC3H,IAAI,CAAC;YACH,MAAM,WAAW,CAAC,MAAM,CAAC,8BAAmB,EAAE;gBAC5C,MAAM;gBACN,QAAQ,EAAE,QAAQ,CAAC,QAAQ;gBAC3B,cAAc,EAAE,QAAQ,CAAC,cAAc;gBACvC,KAAK,EAAE,QAAQ,CAAC,KAAK;aACtB,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,yDAAyD;YACzD,MAAM,IAAI,GAAI,KAA8C,CAAC,IAAI,CAAC;YAClE,IAAI,KAAK,YAAY,0BAAgB,IAAI,IAAI,KAAK,0CAA8B;gBAAE,MAAM,IAAI,sBAAS,CAAC,uBAAW,CAAC,0BAA0B,CAAC,CAAC;YAC9I,MAAM,KAAK,CAAC;QACd,CAAC;QACD,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,uBAAW,CAAC,mBAAmB,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;IACjI,CAAC;IAED;;;;;;;;;;OAUG;IACK,KAAK,CAAC,sBAAsB,CAClC,QAAwB,EACxB,KAAwB,EACxB,QAAsB,EACtB,OAAuB;QAEvB,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,OAAO;YAAE,MAAM,IAAI,sBAAS,CAAC,uBAAW,CAAC,YAAY,CAAC,CAAC;QAClF,yFAAyF;QACzF,IAAI,CAAC,QAAQ,CAAC,KAAK;YAAE,MAAM,IAAI,sBAAS,CAAC,uBAAW,CAAC,gBAAgB,EAAE,EAAE,oBAAoB,EAAE,CAAC,0BAAc,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACzH,IAAI,CAAC,IAAA,kCAAoB,EAAC,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,YAAY,CAAC,mBAAmB,CAAC,EAAE,CAAC;YACrF,MAAM,IAAI,sBAAS,CAAC,uBAAW,CAAC,qBAAqB,CAAC,CAAC;QACzD,CAAC;QACD,0FAA0F;QAC1F,MAAM,aAAa,GAAG;YACpB,GAAG,KAAK;YACR,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,QAAQ,CAAC,SAAS,IAAI,SAAS;YACrE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,QAAQ,CAAC,QAAQ,IAAI,SAAS;SACnE,CAAC;QACF,IAAA,2CAA2B,EAAC,aAAa,EAAE,QAAQ,CAAC,CAAC;QAErD,OAAO,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,KAAK,EAAE,WAAW,EAAE,EAAE;YACrD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,CACzC;gBACE,KAAK,EAAE,QAAQ,CAAC,KAAK;gBACrB,eAAe,EAAE,QAAQ,CAAC,eAAe;gBACzC,SAAS,EAAE,aAAa,CAAC,SAAS,IAAI,IAAI;gBAC1C,QAAQ,EAAE,aAAa,CAAC,QAAQ,IAAI,IAAI;gBACxC,aAAa,EAAE,KAAK,CAAC,WAAW,KAAK,IAAI;gBACzC,qBAAqB,EAAE,KAAK,CAAC,mBAAmB,KAAK,IAAI;aAC1D,EACD,QAAQ,EACR,OAAO,EACP,WAAW,CACZ,CAAC;YACF,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,WAAW,CAAC,CAAC;YAChE,OAAO,OAAO,CAAC;QACjB,CAAC,CAAC,CAAC;IACL,CAAC;CACF,CAAA;AA9LY,8CAAiB;4BAAjB,iBAAiB;IAD7B,IAAA,mBAAU,GAAE;IAKR,WAAA,IAAA,eAAM,EAAC,8BAAkB,CAAC,CAAA;6CACO,kCAAe;QACrB,iDAAsB;QAC1B,4BAAY;QACX,+BAAa;QACN,8CAAoB;QACtB,yCAAkB;QACvB,uCAAiB;GAXjC,iBAAiB,CA8L7B"}