@trokky/trokky 2.0.3

package/dist/core/services/auth-service.js

@@ -0,0 +1,530 @@
+/**
+ * Authentication service: password verification, JWT issuance and the
+ * login flows (including MFA hand-off). Extracted from TrokkyCore.
+ */
+export class AuthService {
+    deps;
+    constructor(deps) {
+        this.deps = deps;
+    }
+    // Authentication utilities
+    async verifyPassword(plainPassword, hashedPassword) {
+        return await this.deps.cryptoAdapter.verifyPassword(plainPassword, hashedPassword);
+    }
+    /**
+     * Hash a password using the configured crypto adapter
+     * Exposed publicly to ensure consistent hashing across all password operations
+     */
+    async hashPassword(password) {
+        return await this.deps.cryptoAdapter.hashPassword(password);
+    }
+    checkWeakPassword(password) {
+        // Common weak passwords
+        const commonPasswords = [
+            'password', 'admin', 'changeme', 'changeme123', '123456',
+            'qwerty', 'abc123', 'password123', 'admin123', 'letmein',
+            'welcome', 'monkey', 'dragon', 'master', 'secret'
+        ];
+        // Check if password is too short
+        if (password.length < 8) {
+            return { isWeak: true, reason: 'Password is too short (minimum 8 characters)' };
+        }
+        // Check for common weak passwords
+        if (commonPasswords.includes(password.toLowerCase())) {
+            return { isWeak: true, reason: 'Password is a common weak password' };
+        }
+        // Check for simple patterns
+        if (/^(.)\1+$/.test(password)) {
+            return { isWeak: true, reason: 'Password contains only repeated characters' };
+        }
+        if (/^(012|123|234|345|456|567|678|789|890|abc|def|qwe|asd|zxc)/i.test(password)) {
+            return { isWeak: true, reason: 'Password contains sequential characters' };
+        }
+        // Warn if password is short (8-11 characters) even if not technically weak
+        if (password.length < 12) {
+            return { isWeak: true, reason: 'Password is shorter than recommended (12+ characters)' };
+        }
+        // Check password complexity
+        const hasLower = /[a-z]/.test(password);
+        const hasUpper = /[A-Z]/.test(password);
+        const hasNumber = /\d/.test(password);
+        const hasSpecial = /[!@#$%^&*()_+\-=\[\]{};':"\\|,.<>\/?]/.test(password);
+        const complexityCount = [hasLower, hasUpper, hasNumber, hasSpecial].filter(Boolean).length;
+        if (complexityCount < 3) {
+            return { isWeak: true, reason: 'Password lacks complexity (needs lowercase, uppercase, numbers, and/or symbols)' };
+        }
+        return { isWeak: false };
+    }
+    // JWT Token Management
+    async generateAuthToken(user, expiresIn = '24h', rememberMe) {
+        const payload = {
+            userId: user.id,
+            username: user.username,
+            role: user.role,
+            permissions: user.permissions,
+            rememberMe: rememberMe // Store rememberMe flag in JWT payload
+        };
+        return await this.deps.cryptoAdapter.generateJWT(payload, this.deps.jwtSecret, { expiresIn });
+    }
+    async verifyAuthToken(token) {
+        const decoded = await this.deps.cryptoAdapter.verifyJWT(token, this.deps.jwtSecret);
+        // Handle both standard 'userId' claim and OAuth2 'sub' claim
+        const userId = decoded?.userId || decoded?.sub;
+        const username = decoded?.username;
+        if (!decoded || !userId || !username) {
+            return null;
+        }
+        // Fetch fresh user data from storage to get current permissions
+        try {
+            const currentUser = await this.deps.getUser(userId);
+            if (!currentUser || !currentUser.isActive) {
+                return null; // User no longer exists or is inactive
+            }
+            return {
+                userId,
+                username,
+                role: currentUser.role, // Use fresh role from storage
+                permissions: currentUser.permissions, // Use fresh permissions from storage
+                loginAt: decoded.iat ? new Date(decoded.iat * 1000).toISOString() : new Date().toISOString(),
+                expiresAt: decoded.exp ? new Date(decoded.exp * 1000).toISOString() : undefined
+            };
+        }
+        catch (error) {
+            // If we can't fetch user data, fall back to JWT payload for backwards compatibility
+            if (!decoded.role || !decoded.permissions) {
+                return null;
+            }
+            return {
+                userId,
+                username,
+                role: decoded.role,
+                permissions: decoded.permissions,
+                loginAt: decoded.iat ? new Date(decoded.iat * 1000).toISOString() : new Date().toISOString(),
+                expiresAt: decoded.exp ? new Date(decoded.exp * 1000).toISOString() : undefined
+            };
+        }
+    }
+    /**
+     * Unified token validation that handles both JWT and API tokens
+     * Returns a consistent UserSession interface for both token types
+     */
+    async verifyAnyToken(token) {
+        // Check if it's a JWT token (3 parts separated by dots)
+        const parts = token.split('.');
+        if (parts.length === 3) {
+            // JWT token - use existing verification
+            return await this.verifyAuthToken(token);
+        }
+        else if (token.length === 64 && /^[a-f0-9]{64}$/.test(token)) {
+            // API token - validate and get permissions
+            const result = await this.deps.validateAppToken(token);
+            if (result.valid && result.appToken) {
+                // Create a session-like object for API tokens
+                return {
+                    userId: result.appToken.createdBy,
+                    username: `api-token-${result.appToken.name}`,
+                    role: 'api', // Special role for API tokens
+                    permissions: result.appToken.permissions,
+                    loginAt: new Date().toISOString(),
+                    expiresAt: result.appToken.expiresAt
+                };
+            }
+        }
+        return null;
+    }
+    /**
+     * Authentication result types for MFA support
+     */
+    async authenticateUser(username, password, options = {}) {
+        try {
+            // Get user by username
+            const user = await this.deps.getUserByUsername(username);
+            if (!user || !user.isActive) {
+                return null;
+            }
+            // Verify password
+            const isPasswordValid = await this.verifyPassword(password, user.passwordHash);
+            if (!isPasswordValid) {
+                return null;
+            }
+            // Upgrade the stored hash if it uses an outdated format or work factor.
+            // Never blocks login: any failure below is logged and ignored.
+            const loginUpdate = { lastLoginAt: new Date().toISOString() };
+            let loginUpdatePersisted = false;
+            if (this.deps.cryptoAdapter.needsRehash(user.passwordHash)) {
+                try {
+                    const upgradedHash = await this.hashPassword(password);
+                    const updateUserIf = this.deps.updateUserIf;
+                    if (updateUserIf) {
+                        // Atomic compare-and-set: the write only applies while the stored
+                        // hash is still the one we verified, so a password change/reset that
+                        // commits in between cannot be overwritten.
+                        const conditionalUpdate = { ...loginUpdate, passwordHash: upgradedHash };
+                        const updated = await updateUserIf(user.id, conditionalUpdate, { passwordHash: user.passwordHash });
+                        if (updated) {
+                            loginUpdatePersisted = true;
+                            // Mirror the audit event updateUser would have emitted for this write
+                            this.deps.logAuditEvent({
+                                type: 'user_updated',
+                                targetUserId: user.id,
+                                username: user.username,
+                                action: `User updated`,
+                                timestamp: new Date().toISOString(),
+                                success: true,
+                                details: {
+                                    updatedFields: Object.keys(conditionalUpdate),
+                                    previousRole: user.role,
+                                    newRole: user.role
+                                }
+                            });
+                            this.deps.logger.debug('Password hash upgraded to current format', { userId: user.id });
+                        }
+                        else {
+                            this.deps.logger.debug('Skipped password hash upgrade: hash changed during login', { userId: user.id });
+                        }
+                    }
+                    else {
+                        // Adapter has no conditional update: guard with a re-read, which
+                        // narrows but does not close the race.
+                        const current = await this.deps.getUser(user.id);
+                        if (current && current.passwordHash === user.passwordHash) {
+                            loginUpdate.passwordHash = upgradedHash;
+                        }
+                        else {
+                            this.deps.logger.debug('Skipped password hash upgrade: hash changed during login', { userId: user.id });
+                        }
+                    }
+                }
+                catch (error) {
+                    this.deps.logger.warn('Failed to upgrade password hash', { userId: user.id });
+                }
+            }
+            // Persist last login time (and upgraded hash, if any) in a single write.
+            // A storage failure here must not turn a correct password into a 401.
+            if (!loginUpdatePersisted) {
+                try {
+                    await this.deps.updateUser(user.id, loginUpdate);
+                    if (loginUpdate.passwordHash) {
+                        this.deps.logger.debug('Password hash upgraded to current format', { userId: user.id });
+                    }
+                }
+                catch (error) {
+                    this.deps.logger.warn('Failed to persist login update', { userId: user.id });
+                }
+            }
+            // Check MFA requirements
+            const mfaStatus = await this.deps.checkMFARequired(user.id);
+            // If MFA is required
+            if (mfaStatus.required) {
+                // Check if device is trusted (can skip MFA)
+                if (options.deviceId && mfaStatus.userHasMFA) {
+                    const isTrusted = await this.deps.isDeviceTrusted(user.id, options.deviceId);
+                    if (isTrusted) {
+                        // Device is trusted, issue full tokens
+                        return this.issueFullTokens(user, options);
+                    }
+                }
+                // User has MFA set up - require verification
+                if (mfaStatus.userHasMFA) {
+                    // Generate MFA pending token (short-lived)
+                    const mfaToken = await this.generateMFAPendingToken(user, mfaStatus.methods);
+                    this.deps.logAuditEvent({
+                        type: 'user_login',
+                        userId: user.id,
+                        username: user.username,
+                        action: 'MFA verification required',
+                        timestamp: new Date().toISOString(),
+                        success: true,
+                        details: {
+                            mfaRequired: true,
+                            methods: mfaStatus.methods
+                        }
+                    });
+                    return {
+                        type: 'mfa_required',
+                        requiresMFA: true,
+                        mfaToken,
+                        methods: mfaStatus.methods,
+                        expiresIn: 300 // 5 minutes
+                    };
+                }
+                // Org or role requires MFA but user hasn't set it up
+                if (mfaStatus.reason === 'org_required' || mfaStatus.reason === 'role_required') {
+                    const setupToken = await this.generateMFASetupToken(user, mfaStatus.methods);
+                    const message = mfaStatus.reason === 'role_required'
+                        ? `Your role (${user.role}) requires MFA. Please set up multi-factor authentication.`
+                        : 'Your organization requires MFA. Please set up multi-factor authentication.';
+                    this.deps.logAuditEvent({
+                        type: 'user_login',
+                        userId: user.id,
+                        username: user.username,
+                        action: 'MFA setup required',
+                        timestamp: new Date().toISOString(),
+                        success: true,
+                        details: {
+                            mfaSetupRequired: true,
+                            allowedMethods: mfaStatus.methods,
+                            reason: mfaStatus.reason
+                        }
+                    });
+                    return {
+                        type: 'mfa_setup_required',
+                        requiresMFASetup: true,
+                        setupToken,
+                        allowedMethods: mfaStatus.methods,
+                        message,
+                        expiresIn: 900 // 15 minutes
+                    };
+                }
+            }
+            // No MFA required - issue full tokens
+            return this.issueFullTokens(user, options);
+        }
+        catch (error) {
+            console.error('Authentication failed:', error instanceof Error ? error.message : 'Unknown error');
+            return null;
+        }
+    }
+    /**
+     * Issue full authentication tokens after successful login (including MFA if required)
+     */
+    async issueFullTokens(user, options = {}) {
+        const securityConfig = this.deps.config.security?.tokens;
+        const tokenExpiresIn = options.rememberMe
+            ? (securityConfig?.rememberMeTtl || '7d')
+            : (securityConfig?.accessTokenTtl || '2h');
+        const refreshTokenExpiresIn = options.rememberMe
+            ? '30d'
+            : (securityConfig?.refreshTokenTtl || '7d');
+        const token = await this.generateAuthToken(user, tokenExpiresIn, options.rememberMe);
+        const refreshToken = await this.generateAuthToken(user, refreshTokenExpiresIn, options.rememberMe);
+        // Log successful login
+        this.deps.logAuditEvent({
+            type: 'user_login',
+            userId: user.id,
+            username: user.username,
+            action: 'User authenticated successfully',
+            timestamp: new Date().toISOString(),
+            success: true,
+            details: {
+                role: user.role,
+                lastLoginAt: new Date().toISOString(),
+                rememberMe: options.rememberMe
+            }
+        });
+        // Get token expiration time
+        const session = await this.verifyAuthToken(token);
+        const expiresAt = session?.expiresAt || new Date(Date.now() + 2 * 60 * 60 * 1000).toISOString();
+        // Return user without password hash
+        const { passwordHash, ...safeUser } = user;
+        return {
+            type: 'success',
+            user: { ...safeUser, passwordHash: '' },
+            token,
+            refreshToken,
+            expiresAt
+        };
+    }
+    /**
+     * Generate MFA pending token (used when MFA verification is needed)
+     */
+    async generateMFAPendingToken(user, methods) {
+        const payload = {
+            type: 'mfa_pending',
+            userId: user.id,
+            username: user.username,
+            mfaMethods: methods
+        };
+        return this.deps.cryptoAdapter.generateJWT(payload, this.deps.jwtSecret, { expiresIn: '5m' });
+    }
+    /**
+     * Generate MFA setup token (used when org requires MFA but user hasn't set it up)
+     */
+    async generateMFASetupToken(user, allowedMethods) {
+        const payload = {
+            type: 'mfa_setup',
+            userId: user.id,
+            username: user.username,
+            allowedMethods
+        };
+        return this.deps.cryptoAdapter.generateJWT(payload, this.deps.jwtSecret, { expiresIn: '15m' });
+    }
+    /**
+     * Complete MFA verification and issue full tokens
+     * Call this after verifyMFACode returns true
+     */
+    async completeMFAAuthentication(mfaToken, options = {}) {
+        try {
+            // Verify MFA pending token
+            const payload = await this.deps.cryptoAdapter.verifyJWT(mfaToken, this.deps.jwtSecret);
+            if (!payload || payload.type !== 'mfa_pending') {
+                return null;
+            }
+            // Get user
+            const user = await this.deps.getUser(payload.userId);
+            if (!user || !user.isActive) {
+                return null;
+            }
+            // Trust device if requested
+            if (options.trustDevice && options.deviceId) {
+                await this.deps.trustDevice(user.id, options.deviceId, options.deviceName || 'Unknown Device');
+            }
+            // Issue full tokens
+            return this.issueFullTokens(user, options);
+        }
+        catch (error) {
+            this.deps.logger.error('MFA authentication completion failed', {
+                error: error instanceof Error ? error.message : String(error)
+            });
+            return null;
+        }
+    }
+    /**
+     * Verify MFA setup token and return user info
+     */
+    async verifyMFASetupToken(setupToken) {
+        try {
+            const payload = await this.deps.cryptoAdapter.verifyJWT(setupToken, this.deps.jwtSecret);
+            if (!payload || payload.type !== 'mfa_setup') {
+                return null;
+            }
+            return {
+                userId: payload.userId,
+                username: payload.username,
+                allowedMethods: payload.allowedMethods
+            };
+        }
+        catch {
+            return null;
+        }
+    }
+    /**
+     * Verify any MFA token (pending or setup) and return payload
+     */
+    async verifyMFAToken(token) {
+        try {
+            const payload = await this.deps.cryptoAdapter.verifyJWT(token, this.deps.jwtSecret);
+            if (!payload) {
+                return null;
+            }
+            // Validate it's an MFA token type
+            if (payload.type !== 'mfa_pending' && payload.type !== 'mfa_setup') {
+                return null;
+            }
+            return {
+                type: payload.type,
+                userId: payload.userId,
+                username: payload.username,
+                mfaMethods: payload.mfaMethods,
+                allowedMethods: payload.allowedMethods
+            };
+        }
+        catch {
+            return null;
+        }
+    }
+    /**
+     * Complete MFA setup and issue full authentication tokens
+     * Used when a user sets up MFA during the login flow (when org requires MFA)
+     */
+    async completeMFASetupAndLogin(setupToken, options = {}) {
+        try {
+            // Verify MFA setup token
+            const payload = await this.deps.cryptoAdapter.verifyJWT(setupToken, this.deps.jwtSecret);
+            if (!payload || payload.type !== 'mfa_setup') {
+                return null;
+            }
+            // Get user
+            const user = await this.deps.getUser(payload.userId);
+            if (!user || !user.isActive) {
+                return null;
+            }
+            // Verify user now has MFA enabled
+            if (!user.mfa?.enabled || !user.mfa.methods?.some(m => m.enabled && m.verified)) {
+                this.deps.logger.warn('MFA setup completion attempted but MFA not enabled', {
+                    userId: user.id
+                });
+                return null;
+            }
+            this.deps.logger.info('MFA setup completed, issuing auth tokens', {
+                userId: user.id,
+                username: user.username
+            });
+            // Issue full tokens
+            return this.issueFullTokens(user, options);
+        }
+        catch (error) {
+            this.deps.logger.error('MFA setup completion failed', {
+                error: error instanceof Error ? error.message : String(error)
+            });
+            return null;
+        }
+    }
+    /**
+     * Verify a backup code for a user
+     * Returns result with remaining codes if valid
+     */
+    async verifyBackupCode(userId, code) {
+        const user = await this.deps.getUser(userId);
+        if (!user || !user.mfa?.backupCodes) {
+            return { valid: false, remainingCodes: [] };
+        }
+        const totpService = this.deps.getTOTPService();
+        const result = totpService.verifyBackupCode(user.mfa.backupCodes, code);
+        if (result.valid) {
+            // Update user with remaining codes
+            await this.deps.updateUser(userId, {
+                mfa: {
+                    ...user.mfa,
+                    backupCodes: result.remainingCodes
+                }
+            });
+            this.deps.logger.info('Backup code used', {
+                userId,
+                remainingCodes: result.remainingCodes.length
+            });
+        }
+        return result;
+    }
+    async refreshAuthToken(refreshToken) {
+        try {
+            // Verify the refresh token
+            const session = await this.verifyAuthToken(refreshToken);
+            if (!session) {
+                return null;
+            }
+            // Get the user
+            const user = await this.deps.getUser(session.userId);
+            if (!user || !user.isActive) {
+                return null;
+            }
+            // Extract rememberMe flag from the refresh token payload
+            const decoded = await this.deps.cryptoAdapter.verifyJWT(refreshToken, this.deps.jwtSecret);
+            const rememberMe = decoded?.rememberMe === true;
+            // Generate new tokens preserving the rememberMe state
+            const securityConfig = this.deps.config.security?.tokens;
+            const tokenExpiresIn = rememberMe
+                ? (securityConfig?.rememberMeTtl || '7d')
+                : (securityConfig?.accessTokenTtl || '2h');
+            const refreshTokenExpiresIn = rememberMe
+                ? '30d'
+                : (securityConfig?.refreshTokenTtl || '7d');
+            const newToken = await this.generateAuthToken(user, tokenExpiresIn, rememberMe);
+            const newRefreshToken = await this.generateAuthToken(user, refreshTokenExpiresIn, rememberMe);
+            // Get the new token's expiration time
+            const newSession = await this.verifyAuthToken(newToken);
+            const expiresAt = newSession?.expiresAt || new Date(Date.now() + 2 * 60 * 60 * 1000).toISOString();
+            return {
+                token: newToken,
+                refreshToken: newRefreshToken,
+                user,
+                expiresAt
+            };
+        }
+        catch (error) {
+            this.deps.logger.error('Failed to refresh auth token', { error: error instanceof Error ? error.message : String(error) });
+            return null;
+        }
+    }
+}
+//# sourceMappingURL=auth-service.js.map

package/dist/core/services/auth-service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-service.js","sourceRoot":"","sources":["../../../src/core/services/auth-service.ts"],"names":[],"mappings":"AA4CA;;;GAGG;AACH,MAAM,OAAO,WAAW;IACO;IAA7B,YAA6B,IAA6B;QAA7B,SAAI,GAAJ,IAAI,CAAyB;IAAG,CAAC;IAE9D,2BAA2B;IACpB,KAAK,CAAC,cAAc,CAAC,aAAqB,EAAE,cAAsB;QACvE,OAAO,MAAM,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,cAAc,CAAC,aAAa,EAAE,cAAc,CAAC,CAAA;IACpF,CAAC;IAED;;;OAGG;IACI,KAAK,CAAC,YAAY,CAAC,QAAgB;QACxC,OAAO,MAAM,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAA;IAC7D,CAAC;IAEM,iBAAiB,CAAC,QAAgB;QACvC,wBAAwB;QACxB,MAAM,eAAe,GAAG;YACtB,UAAU,EAAE,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,QAAQ;YACxD,QAAQ,EAAE,QAAQ,EAAE,aAAa,EAAE,UAAU,EAAE,SAAS;YACxD,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ;SAClD,CAAA;QAED,iCAAiC;QACjC,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,8CAA8C,EAAE,CAAA;QACjF,CAAC;QAED,kCAAkC;QAClC,IAAI,eAAe,CAAC,QAAQ,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;YACrD,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,oCAAoC,EAAE,CAAA;QACvE,CAAC;QAED,4BAA4B;QAC5B,IAAI,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC9B,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,4CAA4C,EAAE,CAAA;QAC/E,CAAC;QAED,IAAI,6DAA6D,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YACjF,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,yCAAyC,EAAE,CAAA;QAC5E,CAAC;QAED,2EAA2E;QAC3E,IAAI,QAAQ,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;YACzB,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,uDAAuD,EAAE,CAAA;QAC1F,CAAC;QAED,4BAA4B;QAC5B,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QACvC,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QACvC,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QACrC,MAAM,UAAU,GAAG,uCAAuC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QAEzE,MAAM,eAAe,GAAG,CAAC,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAA;QAE1F,IAAI,eAAe,GAAG,CAAC,EAAE,CAAC;YACxB,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,iFAAiF,EAAE,CAAA;QACpH,CAAC;QAED,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAA;IAC1B,CAAC;IAED,uBAAuB;IAChB,KAAK,CAAC,iBAAiB,CAAC,IAAU,EAAE,YAAoB,KAAK,EAAE,UAAoB;QACxF,MAAM,OAAO,GAA0E;YACrF,MAAM,EAAE,IAAI,CAAC,EAAE;YACf,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,UAAU,EAAE,UAAU,CAAC,uCAAuC;SAC/D,CAAA;QAED,OAAO,MAAM,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,WAAW,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,CAAC,CAAA;IAC/F,CAAC;IAEM,KAAK,CAAC,eAAe,CAAC,KAAa;QACxC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;QAEnF,6DAA6D;QAC7D,MAAM,MAAM,GAAG,OAAO,EAAE,MAAM,IAAI,OAAO,EAAE,GAAG,CAAA;QAC9C,MAAM,QAAQ,GAAG,OAAO,EAAE,QAAQ,CAAA;QAElC,IAAI,CAAC,OAAO,IAAI,CAAC,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;YACrC,OAAO,IAAI,CAAA;QACb,CAAC;QAED,gEAAgE;QAChE,IAAI,CAAC;YACH,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;YACnD,IAAI,CAAC,WAAW,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,CAAC;gBAC1C,OAAO,IAAI,CAAA,CAAC,uCAAuC;YACrD,CAAC;YAED,OAAO;gBACL,MAAM;gBACN,QAAQ;gBACR,IAAI,EAAE,WAAW,CAAC,IAAI,EAAE,8BAA8B;gBACtD,WAAW,EAAE,WAAW,CAAC,WAAW,EAAE,qCAAqC;gBAC3E,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;gBAC5F,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,SAAS;aAChF,CAAA;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,oFAAoF;YACpF,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;gBAC1C,OAAO,IAAI,CAAA;YACb,CAAC;YAED,OAAO;gBACL,MAAM;gBACN,QAAQ;gBACR,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,WAAW,EAAE,OAAO,CAAC,WAAW;gBAChC,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;gBAC5F,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,SAAS;aAChF,CAAA;QACH,CAAC;IACH,CAAC;IAED;;;OAGG;IACI,KAAK,CAAC,cAAc,CAAC,KAAa;QACvC,wDAAwD;QACxD,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QAC9B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,wCAAwC;YACxC,OAAO,MAAM,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,CAAA;QAC1C,CAAC;aAAM,IAAI,KAAK,CAAC,MAAM,KAAK,EAAE,IAAI,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YAC/D,2CAA2C;YAC3C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAA;YACtD,IAAI,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;gBACpC,8CAA8C;gBAC9C,OAAO;oBACL,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,SAAS;oBACjC,QAAQ,EAAE,aAAa,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE;oBAC7C,IAAI,EAAE,KAAK,EAAE,8BAA8B;oBAC3C,WAAW,EAAE,MAAM,CAAC,QAAQ,CAAC,WAAW;oBACxC,OAAO,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;oBACjC,SAAS,EAAE,MAAM,CAAC,QAAQ,CAAC,SAAS;iBACrC,CAAA;YACH,CAAC;QACH,CAAC;QAED,OAAO,IAAI,CAAA;IACb,CAAC;IAED;;OAEG;IACI,KAAK,CAAC,gBAAgB,CAC3B,QAAgB,EAChB,QAAgB,EAChB,UAAuD,EAAE;QAEzD,IAAI,CAAC;YACH,uBAAuB;YACvB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAA;YACxD,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;gBAC5B,OAAO,IAAI,CAAA;YACb,CAAC;YAED,kBAAkB;YAClB,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,QAAQ,EAAE,IAAI,CAAC,YAAY,CAAC,CAAA;YAC9E,IAAI,CAAC,eAAe,EAAE,CAAC;gBACrB,OAAO,IAAI,CAAA;YACb,CAAC;YAED,wEAAwE;YACxE,+DAA+D;YAC/D,MAAM,WAAW,GAAmB,EAAE,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAA;YAC7E,IAAI,oBAAoB,GAAG,KAAK,CAAA;YAChC,IAAI,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,WAAW,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;gBAC3D,IAAI,CAAC;oBACH,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAA;oBACtD,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,CAAA;oBAC3C,IAAI,YAAY,EAAE,CAAC;wBACjB,kEAAkE;wBAClE,qEAAqE;wBACrE,4CAA4C;wBAC5C,MAAM,iBAAiB,GAA4B,EAAE,GAAG,WAAW,EAAE,YAAY,EAAE,YAAY,EAAE,CAAA;wBACjG,MAAM,OAAO,GAAG,MAAM,YAAY,CAChC,IAAI,CAAC,EAAE,EACP,iBAAiB,EACjB,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,CACpC,CAAA;wBACD,IAAI,OAAO,EAAE,CAAC;4BACZ,oBAAoB,GAAG,IAAI,CAAA;4BAC3B,sEAAsE;4BACtE,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC;gCACtB,IAAI,EAAE,cAAc;gCACpB,YAAY,EAAE,IAAI,CAAC,EAAE;gCACrB,QAAQ,EAAE,IAAI,CAAC,QAAQ;gCACvB,MAAM,EAAE,cAAc;gCACtB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;gCACnC,OAAO,EAAE,IAAI;gCACb,OAAO,EAAE;oCACP,aAAa,EAAE,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC;oCAC7C,YAAY,EAAE,IAAI,CAAC,IAAI;oCACvB,OAAO,EAAE,IAAI,CAAC,IAAI;iCACnB;6BACF,CAAC,CAAA;4BACF,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,0CAA0C,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAA;wBACzF,CAAC;6BAAM,CAAC;4BACN,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,0DAA0D,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAA;wBACzG,CAAC;oBACH,CAAC;yBAAM,CAAC;wBACN,iEAAiE;wBACjE,uCAAuC;wBACvC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;wBAChD,IAAI,OAAO,IAAI,OAAO,CAAC,YAAY,KAAK,IAAI,CAAC,YAAY,EAAE,CAAC;4BAC1D,WAAW,CAAC,YAAY,GAAG,YAAY,CAAA;wBACzC,CAAC;6BAAM,CAAC;4BACN,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,0DAA0D,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAA;wBACzG,CAAC;oBACH,CAAC;gBACH,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,iCAAiC,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAA;gBAC/E,CAAC;YACH,CAAC;YAED,yEAAyE;YACzE,sEAAsE;YACtE,IAAI,CAAC,oBAAoB,EAAE,CAAC;gBAC1B,IAAI,CAAC;oBACH,MAAM,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,EAAE,WAAW,CAAC,CAAA;oBAChD,IAAI,WAAW,CAAC,YAAY,EAAE,CAAC;wBAC7B,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,0CAA0C,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAA;oBACzF,CAAC;gBACH,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,gCAAgC,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAA;gBAC9E,CAAC;YACH,CAAC;YAED,yBAAyB;YACzB,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;YAE3D,qBAAqB;YACrB,IAAI,SAAS,CAAC,QAAQ,EAAE,CAAC;gBACvB,4CAA4C;gBAC5C,IAAI,OAAO,CAAC,QAAQ,IAAI,SAAS,CAAC,UAAU,EAAE,CAAC;oBAC7C,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,EAAE,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAA;oBAC5E,IAAI,SAAS,EAAE,CAAC;wBACd,uCAAuC;wBACvC,OAAO,IAAI,CAAC,eAAe,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;oBAC5C,CAAC;gBACH,CAAC;gBAED,6CAA6C;gBAC7C,IAAI,SAAS,CAAC,UAAU,EAAE,CAAC;oBACzB,2CAA2C;oBAC3C,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,IAAI,EAAE,SAAS,CAAC,OAAO,CAAC,CAAA;oBAE5E,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC;wBACtB,IAAI,EAAE,YAAY;wBAClB,MAAM,EAAE,IAAI,CAAC,EAAE;wBACf,QAAQ,EAAE,IAAI,CAAC,QAAQ;wBACvB,MAAM,EAAE,2BAA2B;wBACnC,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;wBACnC,OAAO,EAAE,IAAI;wBACb,OAAO,EAAE;4BACP,WAAW,EAAE,IAAI;4BACjB,OAAO,EAAE,SAAS,CAAC,OAAO;yBAC3B;qBACF,CAAC,CAAA;oBAEF,OAAO;wBACL,IAAI,EAAE,cAAc;wBACpB,WAAW,EAAE,IAAI;wBACjB,QAAQ;wBACR,OAAO,EAAE,SAAS,CAAC,OAAO;wBAC1B,SAAS,EAAE,GAAG,CAAC,YAAY;qBAC5B,CAAA;gBACH,CAAC;gBAED,qDAAqD;gBACrD,IAAI,SAAS,CAAC,MAAM,KAAK,cAAc,IAAI,SAAS,CAAC,MAAM,KAAK,eAAe,EAAE,CAAC;oBAChF,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,IAAI,EAAE,SAAS,CAAC,OAAO,CAAC,CAAA;oBAE5E,MAAM,OAAO,GAAG,SAAS,CAAC,MAAM,KAAK,eAAe;wBAClD,CAAC,CAAC,cAAc,IAAI,CAAC,IAAI,4DAA4D;wBACrF,CAAC,CAAC,4EAA4E,CAAA;oBAEhF,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC;wBACtB,IAAI,EAAE,YAAY;wBAClB,MAAM,EAAE,IAAI,CAAC,EAAE;wBACf,QAAQ,EAAE,IAAI,CAAC,QAAQ;wBACvB,MAAM,EAAE,oBAAoB;wBAC5B,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;wBACnC,OAAO,EAAE,IAAI;wBACb,OAAO,EAAE;4BACP,gBAAgB,EAAE,IAAI;4BACtB,cAAc,EAAE,SAAS,CAAC,OAAO;4BACjC,MAAM,EAAE,SAAS,CAAC,MAAM;yBACzB;qBACF,CAAC,CAAA;oBAEF,OAAO;wBACL,IAAI,EAAE,oBAAoB;wBAC1B,gBAAgB,EAAE,IAAI;wBACtB,UAAU;wBACV,cAAc,EAAE,SAAS,CAAC,OAAO;wBACjC,OAAO;wBACP,SAAS,EAAE,GAAG,CAAC,aAAa;qBAC7B,CAAA;gBACH,CAAC;YACH,CAAC;YAED,sCAAsC;YACtC,OAAO,IAAI,CAAC,eAAe,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;QAC5C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,wBAAwB,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC,CAAA;YACjG,OAAO,IAAI,CAAA;QACb,CAAC;IACH,CAAC;IAED;;OAEG;IACI,KAAK,CAAC,eAAe,CAC1B,IAAU,EACV,UAAoC,EAAE;QAEtC,MAAM,cAAc,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAA;QACxD,MAAM,cAAc,GAAG,OAAO,CAAC,UAAU;YACvC,CAAC,CAAC,CAAC,cAAc,EAAE,aAAa,IAAI,IAAI,CAAC;YACzC,CAAC,CAAC,CAAC,cAAc,EAAE,cAAc,IAAI,IAAI,CAAC,CAAA;QAC5C,MAAM,qBAAqB,GAAG,OAAO,CAAC,UAAU;YAC9C,CAAC,CAAC,KAAK;YACP,CAAC,CAAC,CAAC,cAAc,EAAE,eAAe,IAAI,IAAI,CAAC,CAAA;QAE7C,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,IAAI,EAAE,cAAc,EAAE,OAAO,CAAC,UAAU,CAAC,CAAA;QACpF,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,IAAI,EAAE,qBAAqB,EAAE,OAAO,CAAC,UAAU,CAAC,CAAA;QAElG,uBAAuB;QACvB,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC;YACtB,IAAI,EAAE,YAAY;YAClB,MAAM,EAAE,IAAI,CAAC,EAAE;YACf,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,MAAM,EAAE,iCAAiC;YACzC,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,OAAO,EAAE,IAAI;YACb,OAAO,EAAE;gBACP,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;gBACrC,UAAU,EAAE,OAAO,CAAC,UAAU;aAC/B;SACF,CAAC,CAAA;QAEF,4BAA4B;QAC5B,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,CAAA;QACjD,MAAM,SAAS,GAAG,OAAO,EAAE,SAAS,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE,CAAA;QAE/F,oCAAoC;QACpC,MAAM,EAAE,YAAY,EAAE,GAAG,QAAQ,EAAE,GAAG,IAAI,CAAA;QAC1C,OAAO;YACL,IAAI,EAAE,SAAS;YACf,IAAI,EAAE,EAAE,GAAG,QAAQ,EAAE,YAAY,EAAE,EAAE,EAAU;YAC/C,KAAK;YACL,YAAY;YACZ,SAAS;SACV,CAAA;IACH,CAAC;IAED;;OAEG;IACI,KAAK,CAAC,uBAAuB,CAAC,IAAU,EAAE,OAAwB;QACvE,MAAM,OAAO,GAAG;YACd,IAAI,EAAE,aAAa;YACnB,MAAM,EAAE,IAAI,CAAC,EAAE;YACf,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,UAAU,EAAE,OAAO;SACpB,CAAA;QACD,OAAO,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,WAAW,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IAC/F,CAAC;IAED;;OAEG;IACI,KAAK,CAAC,qBAAqB,CAAC,IAAU,EAAE,cAA+B;QAC5E,MAAM,OAAO,GAAG;YACd,IAAI,EAAE,WAAW;YACjB,MAAM,EAAE,IAAI,CAAC,EAAE;YACf,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,cAAc;SACf,CAAA;QACD,OAAO,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,WAAW,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAA;IAChG,CAAC;IAED;;;OAGG;IACI,KAAK,CAAC,yBAAyB,CACpC,QAAgB,EAChB,UAAmG,EAAE;QAErG,IAAI,CAAC;YACH,2BAA2B;YAC3B,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS,CAI7E,CAAA;YAER,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;gBAC/C,OAAO,IAAI,CAAA;YACb,CAAC;YAED,WAAW;YACX,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;YACpD,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;gBAC5B,OAAO,IAAI,CAAA;YACb,CAAC;YAED,4BAA4B;YAC5B,IAAI,OAAO,CAAC,WAAW,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;gBAC5C,MAAM,IAAI,CAAC,IAAI,CAAC,WAAW,CACzB,IAAI,CAAC,EAAE,EACP,OAAO,CAAC,QAAQ,EAChB,OAAO,CAAC,UAAU,IAAI,gBAAgB,CACvC,CAAA;YACH,CAAC;YAED,oBAAoB;YACpB,OAAO,IAAI,CAAC,eAAe,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;QAC5C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,sCAAsC,EAAE;gBAC7D,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;aAC9D,CAAC,CAAA;YACF,OAAO,IAAI,CAAA;QACb,CAAC;IACH,CAAC;IAED;;OAEG;IACI,KAAK,CAAC,mBAAmB,CAAC,UAAkB;QAKjD,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS,CAK/E,CAAA;YAER,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;gBAC7C,OAAO,IAAI,CAAA;YACb,CAAC;YAED,OAAO;gBACL,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,cAAc,EAAE,OAAO,CAAC,cAAc;aACvC,CAAA;QACH,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAA;QACb,CAAC;IACH,CAAC;IAED;;OAEG;IACI,KAAK,CAAC,cAAc,CAAC,KAAa;QAOvC,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS,CAM1E,CAAA;YAER,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO,IAAI,CAAA;YACb,CAAC;YAED,kCAAkC;YAClC,IAAI,OAAO,CAAC,IAAI,KAAK,aAAa,IAAI,OAAO,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;gBACnE,OAAO,IAAI,CAAA;YACb,CAAC;YAED,OAAO;gBACL,IAAI,EAAE,OAAO,CAAC,IAAmC;gBACjD,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,UAAU,EAAE,OAAO,CAAC,UAAU;gBAC9B,cAAc,EAAE,OAAO,CAAC,cAAc;aACvC,CAAA;QACH,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAA;QACb,CAAC;IACH,CAAC;IAED;;;OAGG;IACI,KAAK,CAAC,wBAAwB,CACnC,UAAkB,EAClB,UAAoC,EAAE;QAEtC,IAAI,CAAC;YACH,yBAAyB;YACzB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS,CAI/E,CAAA;YAER,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;gBAC7C,OAAO,IAAI,CAAA;YACb,CAAC;YAED,WAAW;YACX,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;YACpD,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;gBAC5B,OAAO,IAAI,CAAA;YACb,CAAC;YAED,kCAAkC;YAClC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAChF,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,oDAAoD,EAAE;oBAC1E,MAAM,EAAE,IAAI,CAAC,EAAE;iBAChB,CAAC,CAAA;gBACF,OAAO,IAAI,CAAA;YACb,CAAC;YAED,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,0CAA0C,EAAE;gBAChE,MAAM,EAAE,IAAI,CAAC,EAAE;gBACf,QAAQ,EAAE,IAAI,CAAC,QAAQ;aACxB,CAAC,CAAA;YAEF,oBAAoB;YACpB,OAAO,IAAI,CAAC,eAAe,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;QAC5C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,6BAA6B,EAAE;gBACpD,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;aAC9D,CAAC,CAAA;YACF,OAAO,IAAI,CAAA;QACb,CAAC;IACH,CAAC;IAED;;;OAGG;IACI,KAAK,CAAC,gBAAgB,CAAC,MAAc,EAAE,IAAY;QAIxD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;QAC5C,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,WAAW,EAAE,CAAC;YACpC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,EAAE,CAAA;QAC7C,CAAC;QAED,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,CAAA;QAC9C,MAAM,MAAM,GAAG,WAAW,CAAC,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,CAAA;QAEvE,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;YACjB,mCAAmC;YACnC,MAAM,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE;gBACjC,GAAG,EAAE;oBACH,GAAG,IAAI,CAAC,GAAG;oBACX,WAAW,EAAE,MAAM,CAAC,cAAc;iBACnC;aACgB,CAAC,CAAA;YAEpB,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,kBAAkB,EAAE;gBACxC,MAAM;gBACN,cAAc,EAAE,MAAM,CAAC,cAAc,CAAC,MAAM;aAC7C,CAAC,CAAA;QACJ,CAAC;QAED,OAAO,MAAM,CAAA;IACf,CAAC;IAEM,KAAK,CAAC,gBAAgB,CAAC,YAAoB;QAChD,IAAI,CAAC;YACH,2BAA2B;YAC3B,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,YAAY,CAAC,CAAA;YACxD,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO,IAAI,CAAA;YACb,CAAC;YAED,eAAe;YACf,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;YACpD,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;gBAC5B,OAAO,IAAI,CAAA;YACb,CAAC;YAED,yDAAyD;YACzD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,YAAY,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;YAC1F,MAAM,UAAU,GAAG,OAAO,EAAE,UAAU,KAAK,IAAI,CAAA;YAE/C,sDAAsD;YACtD,MAAM,cAAc,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAA;YACxD,MAAM,cAAc,GAAG,UAAU;gBAC/B,CAAC,CAAC,CAAC,cAAc,EAAE,aAAa,IAAI,IAAI,CAAC;gBACzC,CAAC,CAAC,CAAC,cAAc,EAAE,cAAc,IAAI,IAAI,CAAC,CAAA;YAC5C,MAAM,qBAAqB,GAAG,UAAU;gBACtC,CAAC,CAAC,KAAK;gBACP,CAAC,CAAC,CAAC,cAAc,EAAE,eAAe,IAAI,IAAI,CAAC,CAAA;YAE7C,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,IAAI,EAAE,cAAc,EAAE,UAAU,CAAC,CAAA;YAC/E,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,IAAI,EAAE,qBAAqB,EAAE,UAAU,CAAC,CAAA;YAE7F,sCAAsC;YACtC,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAA;YACvD,MAAM,SAAS,GAAG,UAAU,EAAE,SAAS,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE,CAAA;YAElG,OAAO;gBACL,KAAK,EAAE,QAAQ;gBACf,YAAY,EAAE,eAAe;gBAC7B,IAAI;gBACJ,SAAS;aACV,CAAA;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,8BAA8B,EAAE,EAAE,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;YACzH,OAAO,IAAI,CAAA;QACb,CAAC;IACH,CAAC;CACF"}

package/dist/core/services/captcha-service.d.ts

@@ -0,0 +1,44 @@
+import type { TrokkyLogger } from '../utils/logger.js';
+import { type CaptchaProvider, type CaptchaProviderType, type CaptchaProtectedEndpoint, type CaptchaVerificationResult } from '../security/captcha/index.js';
+import { TrokkyConfig } from '../types/index.js';
+export interface CaptchaServiceDependencies {
+    config: TrokkyConfig;
+    logger: TrokkyLogger;
+}
+/**
+ * CAPTCHA provider configuration and token verification.
+ */
+export declare class CaptchaService {
+    private readonly deps;
+    private captchaProvider;
+    constructor(deps: CaptchaServiceDependencies);
+    /**
+     * Get or create the CAPTCHA provider instance
+     */
+    getCaptchaProvider(): CaptchaProvider | null;
+    /**
+     * Check if CAPTCHA is configured
+     */
+    isCaptchaConfigured(): boolean;
+    /**
+     * Check if CAPTCHA is required for a specific endpoint
+     * @param endpoint - The endpoint to check ('login', 'passwordResetRequest', 'passwordResetVerify')
+     */
+    isCaptchaRequiredFor(endpoint: CaptchaProtectedEndpoint): boolean;
+    /**
+     * Get CAPTCHA configuration for frontend use
+     * Returns public config (site key, provider, options) - never the secret key
+     */
+    getCaptchaConfig(): {
+        provider: CaptchaProviderType;
+        siteKey: string;
+        options?: Record<string, unknown>;
+    } | null;
+    /**
+     * Verify a CAPTCHA token
+     * @param token - The CAPTCHA token from the frontend widget
+     * @param remoteIp - Optional client IP address for verification
+     */
+    verifyCaptcha(token: string, remoteIp?: string): Promise<CaptchaVerificationResult>;
+}
+//# sourceMappingURL=captcha-service.d.ts.map

package/dist/core/services/captcha-service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"captcha-service.d.ts","sourceRoot":"","sources":["../../../src/core/services/captcha-service.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AACtD,OAAO,EAEL,KAAK,eAAe,EACpB,KAAK,mBAAmB,EACxB,KAAK,wBAAwB,EAC7B,KAAK,yBAAyB,EAC/B,MAAM,8BAA8B,CAAA;AACrC,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAEhD,MAAM,WAAW,0BAA0B;IACzC,MAAM,EAAE,YAAY,CAAA;IACpB,MAAM,EAAE,YAAY,CAAA;CACrB;AAED;;GAEG;AACH,qBAAa,cAAc;IAGb,OAAO,CAAC,QAAQ,CAAC,IAAI;IAFjC,OAAO,CAAC,eAAe,CAA+B;gBAEzB,IAAI,EAAE,0BAA0B;IAE7D;;OAEG;IACI,kBAAkB,IAAI,eAAe,GAAG,IAAI;IAmBnD;;OAEG;IACI,mBAAmB,IAAI,OAAO;IAKrC;;;OAGG;IACI,oBAAoB,CAAC,QAAQ,EAAE,wBAAwB,GAAG,OAAO;IAQxE;;;OAGG;IACI,gBAAgB,IAAI;QAAE,QAAQ,EAAE,mBAAmB,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,GAAG,IAAI;IAUvH;;;;OAIG;IACU,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,yBAAyB,CAAC;CASjG"}